598 files changed, 8956 insertions, 4105 deletions

diff --git a/Documentation/ABI/testing/sysfs-platform-at91 b/Documentation/ABI/testing/sysfs-platform-at91
new file mode 100644
index 000000000000..4cc6a865ae66
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-platform-at91
@@ -0,0 +1,25 @@
+What:           /sys/devices/platform/at91_can/net/<iface>/mb0_id
+Date:           January 2011
+KernelVersion:  2.6.38
+Contact:        Marc Kleine-Budde <kernel@pengutronix.de>
+Description:
+                Value representing the can_id of mailbox 0.
+
+                Default: 0x7ff (standard frame)
+
+                Due to a chip bug (errata 50.2.6.3 & 50.3.5.3 in
+                "AT91SAM9263 Preliminary 6249H-ATARM-27-Jul-09") the
+                contents of mailbox 0 may be send under certain
+                conditions (even if disabled or in rx mode).
+
+                The workaround in the errata suggests not to use the
+                mailbox and load it with an unused identifier.
+
+                In order to use an extended can_id add the
+                CAN_EFF_FLAG (0x80000000U) to the can_id. Example:
+
+                - standard id 0x7ff:
+                echo 0x7ff      > /sys/class/net/can0/mb0_id
+
+                - extended id 0x1fffffff:
+                echo 0x9fffffff > /sys/class/net/can0/mb0_id
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index b959659c5df4..b3f35e5f9c95 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -603,3 +603,19 @@ Why:	The adm9240, w83792d and w83793 hardware monitoring drivers have
 Who:    Jean Delvare <khali@linux-fr.org>
 
 ----------------------------
+
+What:   noswapaccount kernel command line parameter
+When:   2.6.40
+Why:    The original implementation of memsw feature enabled by
+        CONFIG_CGROUP_MEM_RES_CTLR_SWAP could be disabled by the noswapaccount
+        kernel parameter (introduced in 2.6.29-rc1). Later on, this decision
+        turned out to be not ideal because we cannot have the feature compiled
+        in and disabled by default and let only interested to enable it
+        (e.g. general distribution kernels might need it). Therefore we have
+        added swapaccount[=0|1] parameter (introduced in 2.6.37) which provides
+        the both possibilities. If we remove noswapaccount we will have
+        less command line parameters with the same functionality and we
+        can also cleanup the parameter handling a bit ().
+Who:    Michal Hocko <mhocko@suse.cz>
+
+----------------------------
diff --git a/Documentation/filesystems/ntfs.txt b/Documentation/filesystems/ntfs.txt
index 6ef8cf3bc9a3..933bc66ccff1 100644
--- a/Documentation/filesystems/ntfs.txt
+++ b/Documentation/filesystems/ntfs.txt
@@ -460,6 +460,8 @@ Note, a technical ChangeLog aimed at kernel hackers is in fs/ntfs/ChangeLog.
 2.1.30:
         - Fix writev() (it kept writing the first segment over and over again
           instead of moving onto subsequent segments).
+        - Fix crash in ntfs_mft_record_alloc() when mapping the new extent mft
+          record failed.
 2.1.29:
         - Fix a deadlock when mounting read-write.
 2.1.28:
diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 5dc638791d97..25d2f4141d27 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -49,7 +49,8 @@ Table of Contents
 3.3     Configuring Bonding Manually with Ifenslave
 3.3.1           Configuring Multiple Bonds Manually
 3.4     Configuring Bonding Manually via Sysfs
-3.5     Overriding Configuration for Special Cases
+3.5     Configuration with Interfaces Support
+3.6     Overriding Configuration for Special Cases
 
 4. Querying Bonding Configuration
 4.1     Bonding Configuration
@@ -161,8 +162,8 @@ onwards) do not have /usr/include/linux symbolically linked to the
 default kernel source include directory.
 
 SECOND IMPORTANT NOTE:
-        If you plan to configure bonding using sysfs, you do not need
-to use ifenslave.
+        If you plan to configure bonding using sysfs or using the
+/etc/network/interfaces file, you do not need to use ifenslave.
 
 2. Bonding Driver Options
 =========================
@@ -779,22 +780,26 @@ resend_igmp
 
         You can configure bonding using either your distro's network
 initialization scripts, or manually using either ifenslave or the
-sysfs interface.  Distros generally use one of two packages for the
-network initialization scripts: initscripts or sysconfig.  Recent
-versions of these packages have support for bonding, while older
+sysfs interface.  Distros generally use one of three packages for the
+network initialization scripts: initscripts, sysconfig or interfaces.
+Recent versions of these packages have support for bonding, while older
 versions do not.
 
         We will first describe the options for configuring bonding for
-distros using versions of initscripts and sysconfig with full or
-partial support for bonding, then provide information on enabling
+distros using versions of initscripts, sysconfig and interfaces with full
+or partial support for bonding, then provide information on enabling
 bonding without support from the network initialization scripts (i.e.,
 older versions of initscripts or sysconfig).
 
-        If you're unsure whether your distro uses sysconfig or
-initscripts, or don't know if it's new enough, have no fear.
+        If you're unsure whether your distro uses sysconfig,
+initscripts or interfaces, or don't know if it's new enough, have no fear.
 Determining this is fairly straightforward.
 
-        First, issue the command:
+        First, look for a file called interfaces in /etc/network directory.
+If this file is present in your system, then your system use interfaces. See
+Configuration with Interfaces Support.
+
+        Else, issue the command:
 
 $ rpm -qf /sbin/ifup
 
@@ -1327,8 +1332,62 @@ echo 2000 > /sys/class/net/bond1/bonding/arp_interval
 echo +eth2 > /sys/class/net/bond1/bonding/slaves
 echo +eth3 > /sys/class/net/bond1/bonding/slaves
 
-3.5 Overriding Configuration for Special Cases
+3.5 Configuration with Interfaces Support
+-----------------------------------------
+
+        This section applies to distros which use /etc/network/interfaces file
+to describe network interface configuration, most notably Debian and it's
+derivatives.
+
+        The ifup and ifdown commands on Debian don't support bonding out of
+the box. The ifenslave-2.6 package should be installed to provide bonding
+support.  Once installed, this package will provide bond-* options to be used
+into /etc/network/interfaces.
+
+        Note that ifenslave-2.6 package will load the bonding module and use
+the ifenslave command when appropriate.
+
+Example Configurations
+----------------------
+
+In /etc/network/interfaces, the following stanza will configure bond0, in
+active-backup mode, with eth0 and eth1 as slaves.
+
+auto bond0
+iface bond0 inet dhcp
+        bond-slaves eth0 eth1
+        bond-mode active-backup
+        bond-miimon 100
+        bond-primary eth0 eth1
+
+If the above configuration doesn't work, you might have a system using
+upstart for system startup. This is most notably true for recent
+Ubuntu versions. The following stanza in /etc/network/interfaces will
+produce the same result on those systems.
+
+auto bond0
+iface bond0 inet dhcp
+        bond-slaves none
+        bond-mode active-backup
+        bond-miimon 100
+
+auto eth0
+iface eth0 inet manual
+        bond-master bond0
+        bond-primary eth0 eth1
+
+auto eth1
+iface eth1 inet manual
+        bond-master bond0
+        bond-primary eth0 eth1
+
+For a full list of bond-* supported options in /etc/network/interfaces and some
+more advanced examples tailored to you particular distros, see the files in
+/usr/share/doc/ifenslave-2.6.
+
+3.6 Overriding Configuration for Special Cases
 ----------------------------------------------
+
 When using the bonding driver, the physical port which transmits a frame is
 typically selected by the bonding driver, and is not relevant to the user or
 system administrator.  The output port is simply selected using the policies of
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index d99940dcfc44..ac3b4a726a1a 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -187,7 +187,7 @@ tcp_cookie_size - INTEGER
 tcp_dsack - BOOLEAN
         Allows TCP to send "duplicate" SACKs.
 
-tcp_ecn - BOOLEAN
+tcp_ecn - INTEGER
         Enable Explicit Congestion Notification (ECN) in TCP. ECN is only
         used when both ends of the TCP flow support it. It is useful to
         avoid losses due to congestion (when the bottleneck router supports
diff --git a/Documentation/scheduler/sched-stats.txt b/Documentation/scheduler/sched-stats.txt
index 01e69404ee5e..1cd5d51bc761 100644
--- a/Documentation/scheduler/sched-stats.txt
+++ b/Documentation/scheduler/sched-stats.txt
@@ -1,3 +1,7 @@
+Version 15 of schedstats dropped counters for some sched_yield:
+yld_exp_empty, yld_act_empty and yld_both_empty. Otherwise, it is
+identical to version 14.
+
 Version 14 of schedstats includes support for sched_domains, which hit the
 mainline kernel in 2.6.20 although it is identical to the stats from version
 12 which was in the kernel from 2.6.13-2.6.19 (version 13 never saw a kernel
@@ -28,32 +32,25 @@ to write their own scripts, the fields are described here.
 
 CPU statistics
 --------------
-cpu<N> 1 2 3 4 5 6 7 8 9 10 11 12
-
-NOTE: In the sched_yield() statistics, the active queue is considered empty
-    if it has only one process in it, since obviously the process calling
-    sched_yield() is that process.
+cpu<N> 1 2 3 4 5 6 7 8 9
 
-First four fields are sched_yield() statistics:
-     1) # of times both the active and the expired queue were empty
-     2) # of times just the active queue was empty
-     3) # of times just the expired queue was empty
-     4) # of times sched_yield() was called
+First field is a sched_yield() statistic:
+     1) # of times sched_yield() was called
 
 Next three are schedule() statistics:
-     5) # of times we switched to the expired queue and reused it
-     6) # of times schedule() was called
-     7) # of times schedule() left the processor idle
+     2) # of times we switched to the expired queue and reused it
+     3) # of times schedule() was called
+     4) # of times schedule() left the processor idle
 
 Next two are try_to_wake_up() statistics:
-     8) # of times try_to_wake_up() was called
-     9) # of times try_to_wake_up() was called to wake up the local cpu
+     5) # of times try_to_wake_up() was called
+     6) # of times try_to_wake_up() was called to wake up the local cpu
 
 Next three are statistics describing scheduling latency:
-    10) sum of all time spent running by tasks on this processor (in jiffies)
-    11) sum of all time spent waiting to run by tasks on this processor (in
+     7) sum of all time spent running by tasks on this processor (in jiffies)
+     8) sum of all time spent waiting to run by tasks on this processor (in
         jiffies)
-    12) # of timeslices run on this cpu
+     9) # of timeslices run on this cpu
 
 
 Domain statistics
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index 16ae4300c747..0caf77e59be4 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -296,6 +296,7 @@ Conexant 5066
 =============
   laptop        Basic Laptop config (default)
   hp-laptop     HP laptops, e g G60
+  asus          Asus K52JU, Lenovo G560
   dell-laptop   Dell laptops
   dell-vostro   Dell Vostro
   olpc-xo-1_5   OLPC XO 1.5
diff --git a/MAINTAINERS b/MAINTAINERS
index cf0f3a5c09cc..531c5cf150ba 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -978,6 +978,8 @@ S:	Maintained
 F:      arch/arm/plat-samsung/
 F:      arch/arm/plat-s3c24xx/
 F:      arch/arm/plat-s5p/
+F:      drivers/*/*s3c2410*
+F:      drivers/*/*/*s3c2410*
 
 ARM/S3C2410 ARM ARCHITECTURE
 M:      Ben Dooks <ben-linux@fluff.org>
@@ -3139,6 +3141,12 @@ S:	Maintained
 F:      net/ieee802154/
 F:      drivers/ieee802154/
 
+IKANOS/ADI EAGLE ADSL USB DRIVER
+M:      Matthieu Castet <castet.matthieu@free.fr>
+M:      Stanislaw Gruszka <stf_xl@wp.pl>
+S:      Maintained
+F:      drivers/usb/atm/ueagle-atm.c
+
 INTEGRITY MEASUREMENT ARCHITECTURE (IMA)
 M:      Mimi Zohar <zohar@us.ibm.com>
 S:      Supported
@@ -3327,7 +3335,6 @@ F:	drivers/net/wimax/i2400m/
 F:      include/linux/wimax/i2400m.h
 
 INTEL WIRELESS WIFI LINK (iwlwifi)
-M:      Reinette Chatre <reinette.chatre@intel.com>
 M:      Wey-Yi Guy <wey-yi.w.guy@intel.com>
 M:      Intel Linux Wireless <ilw@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
@@ -5544,12 +5551,11 @@ S:	Supported
 F:      drivers/scsi/be2iscsi/
 
 SERVER ENGINES 10Gbps NIC - BladeEngine 2 DRIVER
-M:      Sathya Perla <sathyap@serverengines.com>
-M:      Subbu Seetharaman <subbus@serverengines.com>
-M:      Sarveshwar Bandi <sarveshwarb@serverengines.com>
-M:      Ajit Khaparde <ajitk@serverengines.com>
+M:      Sathya Perla <sathya.perla@emulex.com>
+M:      Subbu Seetharaman <subbu.seetharaman@emulex.com>
+M:      Ajit Khaparde <ajit.khaparde@emulex.com>
 L:      netdev@vger.kernel.org
-W:      http://www.serverengines.com
+W:      http://www.emulex.com
 S:      Supported
 F:      drivers/net/benet/
 
@@ -5609,18 +5615,20 @@ F:	include/linux/sfi*.h
 
 SIMTEC EB110ATX (Chalice CATS)
 P:      Ben Dooks
-M:      Vincent Sanders <support@simtec.co.uk>
+P:      Vincent Sanders <vince@simtec.co.uk>
+M:      Simtec Linux Team <linux@simtec.co.uk>
 W:      http://www.simtec.co.uk/products/EB110ATX/
 S:      Supported
 
 SIMTEC EB2410ITX (BAST)
 P:      Ben Dooks
-M:      Vincent Sanders <support@simtec.co.uk>
+P:      Vincent Sanders <vince@simtec.co.uk>
+M:      Simtec Linux Team <linux@simtec.co.uk>
 W:      http://www.simtec.co.uk/products/EB2410ITX/
 S:      Supported
-F:      arch/arm/mach-s3c2410/
-F:      drivers/*/*s3c2410*
-F:      drivers/*/*/*s3c2410*
+F:      arch/arm/mach-s3c2410/mach-bast.c
+F:      arch/arm/mach-s3c2410/bast-ide.c
+F:      arch/arm/mach-s3c2410/bast-irq.c
 
 TI DAVINCI MACHINE SUPPORT
 M:      Kevin Hilman <khilman@deeprootsystems.com>
@@ -6595,6 +6603,16 @@ S:	Maintained
 F:      drivers/char/virtio_console.c
 F:      include/linux/virtio_console.h
 
+VIRTIO CORE, NET AND BLOCK DRIVERS
+M:      Rusty Russell <rusty@rustcorp.com.au>
+M:      "Michael S. Tsirkin" <mst@redhat.com>
+L:      virtualization@lists.linux-foundation.org
+S:      Maintained
+F:      drivers/virtio/
+F:      drivers/net/virtio_net.c
+F:      drivers/block/virtio_blk.c
+F:      include/linux/virtio_*.h
+
 VIRTIO HOST (VHOST)
 M:      "Michael S. Tsirkin" <mst@redhat.com>
 L:      kvm@vger.kernel.org
@@ -6768,12 +6786,12 @@ S:	Maintained
 F:      drivers/net/wireless/wl1251/*
 
 WL1271 WIRELESS DRIVER
-M:      Luciano Coelho <luciano.coelho@nokia.com>
+M:      Luciano Coelho <coelho@ti.com>
 L:      linux-wireless@vger.kernel.org
-W:      http://wireless.kernel.org
+W:      http://wireless.kernel.org/en/users/Drivers/wl12xx
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/luca/wl12xx.git
 S:      Maintained
-F:      drivers/net/wireless/wl12xx/wl1271*
+F:      drivers/net/wireless/wl12xx/
 F:      include/linux/wl12xx.h
 
 WL3501 WIRELESS PCMCIA CARD DRIVER
diff --git a/Makefile b/Makefile
index 1f474953427f..c9c8c8fd2591 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 38
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc4
 NAME = Flesh-Eating Bats with Fangs
 
 # *DOCUMENTATION*
diff --git a/arch/arm/include/asm/io.h b/arch/arm/include/asm/io.h
index 20e0f7c9e03e..d66605dea55a 100644
--- a/arch/arm/include/asm/io.h
+++ b/arch/arm/include/asm/io.h
@@ -95,6 +95,15 @@ static inline void __iomem *__typesafe_io(unsigned long addr)
         return (void __iomem *)addr;
 }
 
+/* IO barriers */
+#ifdef CONFIG_ARM_DMA_MEM_BUFFERABLE
+#define __iormb()               rmb()
+#define __iowmb()               wmb()
+#else
+#define __iormb()               do { } while (0)
+#define __iowmb()               do { } while (0)
+#endif
+
 /*
  * Now, pick up the machine-defined IO definitions
  */
@@ -125,17 +134,17 @@ static inline void __iomem *__typesafe_io(unsigned long addr)
  * The {in,out}[bwl] macros are for emulating x86-style PCI/ISA IO space.
  */
 #ifdef __io
-#define outb(v,p)               __raw_writeb(v,__io(p))
-#define outw(v,p)               __raw_writew((__force __u16) \
-                                        cpu_to_le16(v),__io(p))
-#define outl(v,p)               __raw_writel((__force __u32) \
-                                        cpu_to_le32(v),__io(p))
+#define outb(v,p)       ({ __iowmb(); __raw_writeb(v,__io(p)); })
+#define outw(v,p)       ({ __iowmb(); __raw_writew((__force __u16) \
+                                        cpu_to_le16(v),__io(p)); })
+#define outl(v,p)       ({ __iowmb(); __raw_writel((__force __u32) \
+                                        cpu_to_le32(v),__io(p)); })
 
-#define inb(p)  ({ __u8 __v = __raw_readb(__io(p)); __v; })
+#define inb(p)  ({ __u8 __v = __raw_readb(__io(p)); __iormb(); __v; })
 #define inw(p)  ({ __u16 __v = le16_to_cpu((__force __le16) \
-                        __raw_readw(__io(p))); __v; })
+                        __raw_readw(__io(p))); __iormb(); __v; })
 #define inl(p)  ({ __u32 __v = le32_to_cpu((__force __le32) \
-                        __raw_readl(__io(p))); __v; })
+                        __raw_readl(__io(p))); __iormb(); __v; })
 
 #define outsb(p,d,l)            __raw_writesb(__io(p),d,l)
 #define outsw(p,d,l)            __raw_writesw(__io(p),d,l)
@@ -192,14 +201,6 @@ extern void _memset_io(volatile void __iomem *, int, size_t);
 #define writel_relaxed(v,c)     ((void)__raw_writel((__force u32) \
                                         cpu_to_le32(v),__mem_pci(c)))
 
-#ifdef CONFIG_ARM_DMA_MEM_BUFFERABLE
-#define __iormb()               rmb()
-#define __iowmb()               wmb()
-#else
-#define __iormb()               do { } while (0)
-#define __iowmb()               do { } while (0)
-#endif
-
 #define readb(c)                ({ u8  __v = readb_relaxed(c); __iormb(); __v; })
 #define readw(c)                ({ u16 __v = readw_relaxed(c); __iormb(); __v; })
 #define readl(c)                ({ u32 __v = readl_relaxed(c); __iormb(); __v; })
diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
index f17d9a09e8fb..c0225da3fb21 100644
--- a/arch/arm/kernel/head.S
+++ b/arch/arm/kernel/head.S
@@ -392,24 +392,22 @@ ENDPROC(__turn_mmu_on)
 
 #ifdef CONFIG_SMP_ON_UP
 __fixup_smp:
-        mov     r4, #0x00070000
-        orr     r3, r4, #0xff000000     @ mask 0xff070000
-        orr     r4, r4, #0x41000000     @ val 0x41070000
-        and     r0, r9, r3
-        teq     r0, r4                  @ ARM CPU and ARMv6/v7?
+        and     r3, r9, #0x000f0000     @ architecture version
+        teq     r3, #0x000f0000         @ CPU ID supported?
         bne     __fixup_smp_on_up       @ no, assume UP
 
-        orr     r3, r3, #0x0000ff00
-        orr     r3, r3, #0x000000f0     @ mask 0xff07fff0
+        bic     r3, r9, #0x00ff0000
+        bic     r3, r3, #0x0000000f     @ mask 0xff00fff0
+        mov     r4, #0x41000000
         orr     r4, r4, #0x0000b000
-        orr     r4, r4, #0x00000020     @ val 0x4107b020
-        and     r0, r9, r3
-        teq     r0, r4                  @ ARM 11MPCore?
+        orr     r4, r4, #0x00000020     @ val 0x4100b020
+        teq     r3, r4                  @ ARM 11MPCore?
         moveq   pc, lr                  @ yes, assume SMP
 
         mrc     p15, 0, r0, c0, c0, 5   @ read MPIDR
-        tst     r0, #1 << 31
-        movne   pc, lr                  @ bit 31 => SMP
+        and     r0, r0, #0xc0000000     @ multiprocessing extensions and
+        teq     r0, #0x80000000         @ not part of a uniprocessor system?
+        moveq   pc, lr                  @ yes, assume SMP
 
 __fixup_smp_on_up:
         adr     r0, 1f
diff --git a/arch/arm/mach-ep93xx/core.c b/arch/arm/mach-ep93xx/core.c
index ffdf87be2958..82079545adc4 100644
--- a/arch/arm/mach-ep93xx/core.c
+++ b/arch/arm/mach-ep93xx/core.c
@@ -838,7 +838,7 @@ EXPORT_SYMBOL(ep93xx_i2s_release);
 static struct resource ep93xx_ac97_resources[] = {
         {
                 .start  = EP93XX_AAC_PHYS_BASE,
-                .end    = EP93XX_AAC_PHYS_BASE + 0xb0 - 1,
+                .end    = EP93XX_AAC_PHYS_BASE + 0xac - 1,
                 .flags  = IORESOURCE_MEM,
         },
         {
diff --git a/arch/arm/mach-footbridge/include/mach/debug-macro.S b/arch/arm/mach-footbridge/include/mach/debug-macro.S
index 3c9e0c40c679..30b971d65815 100644
--- a/arch/arm/mach-footbridge/include/mach/debug-macro.S
+++ b/arch/arm/mach-footbridge/include/mach/debug-macro.S
@@ -17,8 +17,8 @@
         /* For NetWinder debugging */
                 .macro  addruart, rp, rv
                 mov     \rp, #0x000003f8
-                orr     \rv, \rp, #0x7c000000   @ physical
-                orr     \rp, \rp, #0xff000000   @ virtual
+                orr     \rv, \rp, #0xff000000   @ virtual
+                orr     \rp, \rp, #0x7c000000   @ physical
                 .endm
 
 #define UART_SHIFT      0
diff --git a/arch/arm/mach-imx/mach-mx25_3ds.c b/arch/arm/mach-imx/mach-mx25_3ds.c
index aa76cfd9f348..8382e7902078 100644
--- a/arch/arm/mach-imx/mach-mx25_3ds.c
+++ b/arch/arm/mach-imx/mach-mx25_3ds.c
@@ -180,7 +180,7 @@ static const uint32_t mx25pdk_keymap[] = {
         KEY(3, 3, KEY_POWER),
 };
 
-static const struct matrix_keymap_data mx25pdk_keymap_data __initdata = {
+static const struct matrix_keymap_data mx25pdk_keymap_data __initconst = {
         .keymap         = mx25pdk_keymap,
         .keymap_size    = ARRAY_SIZE(mx25pdk_keymap),
 };
diff --git a/arch/arm/mach-ixp4xx/common.c b/arch/arm/mach-ixp4xx/common.c
index 4dc68d6bb6be..9fd894271d5d 100644
--- a/arch/arm/mach-ixp4xx/common.c
+++ b/arch/arm/mach-ixp4xx/common.c
@@ -432,7 +432,7 @@ static struct clocksource clocksource_ixp4xx = {
         .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
-unsigned long ixp4xx_timer_freq = FREQ;
+unsigned long ixp4xx_timer_freq = IXP4XX_TIMER_FREQ;
 EXPORT_SYMBOL(ixp4xx_timer_freq);
 static void __init ixp4xx_clocksource_init(void)
 {
@@ -496,7 +496,7 @@ static struct clock_event_device clockevent_ixp4xx = {
 
 static void __init ixp4xx_clockevent_init(void)
 {
-        clockevent_ixp4xx.mult = div_sc(FREQ, NSEC_PER_SEC,
+        clockevent_ixp4xx.mult = div_sc(IXP4XX_TIMER_FREQ, NSEC_PER_SEC,
                                         clockevent_ixp4xx.shift);
         clockevent_ixp4xx.max_delta_ns =
                 clockevent_delta2ns(0xfffffffe, &clockevent_ixp4xx);
diff --git a/arch/arm/mach-ixp4xx/include/mach/timex.h b/arch/arm/mach-ixp4xx/include/mach/timex.h
index 2c3f93c3eb79..c9e930f29339 100644
--- a/arch/arm/mach-ixp4xx/include/mach/timex.h
+++ b/arch/arm/mach-ixp4xx/include/mach/timex.h
@@ -10,6 +10,7 @@
  * 66.66... MHz. We do a convulted calculation of CLOCK_TICK_RATE b/c the
  * timer register ignores the bottom 2 bits of the LATCH value.
  */
-#define FREQ 66666000
-#define CLOCK_TICK_RATE (((FREQ / HZ & ~IXP4XX_OST_RELOAD_MASK) + 1) * HZ)
+#define IXP4XX_TIMER_FREQ 66666000
+#define CLOCK_TICK_RATE \
+        (((IXP4XX_TIMER_FREQ / HZ & ~IXP4XX_OST_RELOAD_MASK) + 1) * HZ)
 
diff --git a/arch/arm/mach-ixp4xx/ixp4xx_qmgr.c b/arch/arm/mach-ixp4xx/ixp4xx_qmgr.c
index bfdbe4b5a3cc..852f7c9f87d0 100644
--- a/arch/arm/mach-ixp4xx/ixp4xx_qmgr.c
+++ b/arch/arm/mach-ixp4xx/ixp4xx_qmgr.c
@@ -265,6 +265,11 @@ void qmgr_release_queue(unsigned int queue)
                qmgr_queue_descs[queue], queue);
         qmgr_queue_descs[queue][0] = '\x0';
 #endif
+
+        while ((addr = qmgr_get_entry(queue)))
+                printk(KERN_ERR "qmgr: released queue %i not empty: 0x%08X\n",
+                       queue, addr);
+
         __raw_writel(0, &qmgr_regs->sram[queue]);
 
         used_sram_bitmap[0] &= ~mask[0];
@@ -275,10 +280,6 @@ void qmgr_release_queue(unsigned int queue)
         spin_unlock_irq(&qmgr_lock);
 
         module_put(THIS_MODULE);
-
-        while ((addr = qmgr_get_entry(queue)))
-                printk(KERN_ERR "qmgr: released queue %i not empty: 0x%08X\n",
-                       queue, addr);
 }
 
 static int qmgr_init(void)
diff --git a/arch/arm/mach-mxs/clock-mx23.c b/arch/arm/mach-mxs/clock-mx23.c
index b1a362ebfded..ca72a05ed9c1 100644
--- a/arch/arm/mach-mxs/clock-mx23.c
+++ b/arch/arm/mach-mxs/clock-mx23.c
@@ -304,7 +304,7 @@ static int name##_set_rate(struct clk *clk, unsigned long rate)		\
         reg = __raw_readl(CLKCTRL_BASE_ADDR + HW_CLKCTRL_##dr);         \
         reg &= ~BM_CLKCTRL_##dr##_DIV;                                  \
         reg |= div << BP_CLKCTRL_##dr##_DIV;                            \
-        if (reg | (1 << clk->enable_shift)) {                           \
+        if (reg & (1 << clk->enable_shift)) {                           \
                 pr_err("%s: clock is gated\n", __func__);               \
                 return -EINVAL;                                         \
         }                                                               \
@@ -347,7 +347,7 @@ static int name##_set_parent(struct clk *clk, struct clk *parent)	\
 {                                                                       \
         if (parent != clk->parent) {                                    \
                 __raw_writel(BM_CLKCTRL_CLKSEQ_BYPASS_##bit,            \
-                         HW_CLKCTRL_CLKSEQ_TOG);                        \
+                         CLKCTRL_BASE_ADDR + HW_CLKCTRL_CLKSEQ_TOG);    \
                 clk->parent = parent;                                   \
         }                                                               \
                                                                         \
diff --git a/arch/arm/mach-mxs/clock-mx28.c b/arch/arm/mach-mxs/clock-mx28.c
index 56312c092a9e..fd1c4c54b8e5 100644
--- a/arch/arm/mach-mxs/clock-mx28.c
+++ b/arch/arm/mach-mxs/clock-mx28.c
@@ -355,12 +355,12 @@ static int name##_set_rate(struct clk *clk, unsigned long rate)		\
         } else {                                                        \
                 reg &= ~BM_CLKCTRL_##dr##_DIV;                          \
                 reg |= div << BP_CLKCTRL_##dr##_DIV;                    \
-                if (reg | (1 << clk->enable_shift)) {                   \
+                if (reg & (1 << clk->enable_shift)) {                   \
                         pr_err("%s: clock is gated\n", __func__);       \
                         return -EINVAL;                                 \
                 }                                                       \
         }                                                               \
-        __raw_writel(reg, CLKCTRL_BASE_ADDR + HW_CLKCTRL_CPU);          \
+        __raw_writel(reg, CLKCTRL_BASE_ADDR + HW_CLKCTRL_##dr);         \
                                                                         \
         for (i = 10000; i; i--)                                         \
                 if (!(__raw_readl(CLKCTRL_BASE_ADDR +                   \
@@ -483,7 +483,7 @@ static int name##_set_parent(struct clk *clk, struct clk *parent)	\
 {                                                                       \
         if (parent != clk->parent) {                                    \
                 __raw_writel(BM_CLKCTRL_CLKSEQ_BYPASS_##bit,            \
-                         HW_CLKCTRL_CLKSEQ_TOG);                        \
+                         CLKCTRL_BASE_ADDR + HW_CLKCTRL_CLKSEQ_TOG);    \
                 clk->parent = parent;                                   \
         }                                                               \
                                                                         \
@@ -609,7 +609,6 @@ static struct clk_lookup lookups[] = {
         _REGISTER_CLOCK("duart", NULL, uart_clk)
         _REGISTER_CLOCK("imx28-fec.0", NULL, fec_clk)
         _REGISTER_CLOCK("imx28-fec.1", NULL, fec_clk)
-        _REGISTER_CLOCK("fec.0", NULL, fec_clk)
         _REGISTER_CLOCK("rtc", NULL, rtc_clk)
         _REGISTER_CLOCK("pll2", NULL, pll2_clk)
         _REGISTER_CLOCK(NULL, "hclk", hbus_clk)
diff --git a/arch/arm/mach-mxs/clock.c b/arch/arm/mach-mxs/clock.c
index e7d2269cf70e..a7093c88e6a6 100644
--- a/arch/arm/mach-mxs/clock.c
+++ b/arch/arm/mach-mxs/clock.c
@@ -57,7 +57,6 @@ static void __clk_disable(struct clk *clk)
                 if (clk->disable)
                         clk->disable(clk);
                 __clk_disable(clk->parent);
-                __clk_disable(clk->secondary);
         }
 }
 
@@ -68,7 +67,6 @@ static int __clk_enable(struct clk *clk)
 
         if (clk->usecount++ == 0) {
                 __clk_enable(clk->parent);
-                __clk_enable(clk->secondary);
 
                 if (clk->enable)
                         clk->enable(clk);
diff --git a/arch/arm/mach-mxs/gpio.c b/arch/arm/mach-mxs/gpio.c
index d7ad7a61366d..cb0c0e83a527 100644
--- a/arch/arm/mach-mxs/gpio.c
+++ b/arch/arm/mach-mxs/gpio.c
@@ -139,6 +139,8 @@ static void mxs_gpio_irq_handler(u32 irq, struct irq_desc *desc)
         struct mxs_gpio_port *port = (struct mxs_gpio_port *)get_irq_data(irq);
         u32 gpio_irq_no_base = port->virtual_irq_start;
 
+        desc->irq_data.chip->irq_ack(&desc->irq_data);
+
         irq_stat = __raw_readl(port->base + PINCTRL_IRQSTAT(port->id)) &
                         __raw_readl(port->base + PINCTRL_IRQEN(port->id));
 
diff --git a/arch/arm/mach-mxs/include/mach/clock.h b/arch/arm/mach-mxs/include/mach/clock.h
index 041e276d8a32..592c9ab5d760 100644
--- a/arch/arm/mach-mxs/include/mach/clock.h
+++ b/arch/arm/mach-mxs/include/mach/clock.h
@@ -29,8 +29,6 @@ struct clk {
         int id;
         /* Source clock this clk depends on */
         struct clk *parent;
-        /* Secondary clock to enable/disable with this clock */
-        struct clk *secondary;
         /* Reference count of clock enable/disable */
         __s8 usecount;
         /* Register bit position for clock's enable/disable control. */
diff --git a/arch/arm/mach-omap1/include/mach/entry-macro.S b/arch/arm/mach-omap1/include/mach/entry-macro.S
index c9be6d4d83e2..bfb4fb1d7382 100644
--- a/arch/arm/mach-omap1/include/mach/entry-macro.S
+++ b/arch/arm/mach-omap1/include/mach/entry-macro.S
@@ -14,19 +14,6 @@
 #include <mach/irqs.h>
 #include <asm/hardware/gic.h>
 
-/*
- * We use __glue to avoid errors with multiple definitions of
- * .globl omap_irq_flags as it's included from entry-armv.S but not
- * from entry-common.S.
- */
-#ifdef __glue
-                .pushsection .data
-                .globl  omap_irq_flags
-omap_irq_flags:
-                .word   0
-                .popsection
-#endif
-
                 .macro  disable_fiq
                 .endm
 
diff --git a/arch/arm/mach-omap1/irq.c b/arch/arm/mach-omap1/irq.c
index 47701584df35..731dd33bff51 100644
--- a/arch/arm/mach-omap1/irq.c
+++ b/arch/arm/mach-omap1/irq.c
@@ -57,6 +57,7 @@ struct omap_irq_bank {
         unsigned long wake_enable;
 };
 
+u32 omap_irq_flags;
 static unsigned int irq_bank_count;
 static struct omap_irq_bank *irq_banks;
 
@@ -176,7 +177,6 @@ static struct irq_chip omap_irq_chip = {
 
 void __init omap_init_irq(void)
 {
-        extern unsigned int omap_irq_flags;
         int i, j;
 
 #if defined(CONFIG_ARCH_OMAP730) || defined(CONFIG_ARCH_OMAP850)
diff --git a/arch/arm/mach-omap1/lcd_dma.c b/arch/arm/mach-omap1/lcd_dma.c
index c9088d85da04..453809359ba6 100644
--- a/arch/arm/mach-omap1/lcd_dma.c
+++ b/arch/arm/mach-omap1/lcd_dma.c
@@ -37,7 +37,7 @@ int omap_lcd_dma_running(void)
          * On OMAP1510, internal LCD controller will start the transfer
          * when it gets enabled, so assume DMA running if LCD enabled.
          */
-        if (cpu_is_omap1510())
+        if (cpu_is_omap15xx())
                 if (omap_readw(OMAP_LCDC_CONTROL) & OMAP_LCDC_CTRL_LCD_EN)
                         return 1;
 
@@ -95,7 +95,7 @@ EXPORT_SYMBOL(omap_set_lcd_dma_single_transfer);
 
 void omap_set_lcd_dma_b1_rotation(int rotate)
 {
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 printk(KERN_ERR "DMA rotation is not supported in 1510 mode\n");
                 BUG();
                 return;
@@ -106,7 +106,7 @@ EXPORT_SYMBOL(omap_set_lcd_dma_b1_rotation);
 
 void omap_set_lcd_dma_b1_mirror(int mirror)
 {
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 printk(KERN_ERR "DMA mirror is not supported in 1510 mode\n");
                 BUG();
         }
@@ -116,7 +116,7 @@ EXPORT_SYMBOL(omap_set_lcd_dma_b1_mirror);
 
 void omap_set_lcd_dma_b1_vxres(unsigned long vxres)
 {
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 printk(KERN_ERR "DMA virtual resulotion is not supported "
                                 "in 1510 mode\n");
                 BUG();
@@ -127,7 +127,7 @@ EXPORT_SYMBOL(omap_set_lcd_dma_b1_vxres);
 
 void omap_set_lcd_dma_b1_scale(unsigned int xscale, unsigned int yscale)
 {
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 printk(KERN_ERR "DMA scale is not supported in 1510 mode\n");
                 BUG();
         }
@@ -177,7 +177,7 @@ static void set_b1_regs(void)
                         bottom = PIXADDR(lcd_dma.xres - 1, lcd_dma.yres - 1);
                         /* 1510 DMA requires the bottom address to be 2 more
                          * than the actual last memory access location. */
-                        if (cpu_is_omap1510() &&
+                        if (cpu_is_omap15xx() &&
                                 lcd_dma.data_type == OMAP_DMA_DATA_TYPE_S32)
                                         bottom += 2;
                         ei = PIXSTEP(0, 0, 1, 0);
@@ -241,7 +241,7 @@ static void set_b1_regs(void)
                 return; /* Suppress warning about uninitialized vars */
         }
 
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 omap_writew(top >> 16, OMAP1510_DMA_LCD_TOP_F1_U);
                 omap_writew(top, OMAP1510_DMA_LCD_TOP_F1_L);
                 omap_writew(bottom >> 16, OMAP1510_DMA_LCD_BOT_F1_U);
@@ -343,7 +343,7 @@ void omap_free_lcd_dma(void)
                 BUG();
                 return;
         }
-        if (!cpu_is_omap1510())
+        if (!cpu_is_omap15xx())
                 omap_writew(omap_readw(OMAP1610_DMA_LCD_CCR) & ~1,
                             OMAP1610_DMA_LCD_CCR);
         lcd_dma.reserved = 0;
@@ -360,7 +360,7 @@ void omap_enable_lcd_dma(void)
          * connected. Otherwise the OMAP internal controller will
          * start the transfer when it gets enabled.
          */
-        if (cpu_is_omap1510() || !lcd_dma.ext_ctrl)
+        if (cpu_is_omap15xx() || !lcd_dma.ext_ctrl)
                 return;
 
         w = omap_readw(OMAP1610_DMA_LCD_CTRL);
@@ -378,14 +378,14 @@ EXPORT_SYMBOL(omap_enable_lcd_dma);
 void omap_setup_lcd_dma(void)
 {
         BUG_ON(lcd_dma.active);
-        if (!cpu_is_omap1510()) {
+        if (!cpu_is_omap15xx()) {
                 /* Set some reasonable defaults */
                 omap_writew(0x5440, OMAP1610_DMA_LCD_CCR);
                 omap_writew(0x9102, OMAP1610_DMA_LCD_CSDP);
                 omap_writew(0x0004, OMAP1610_DMA_LCD_LCH_CTRL);
         }
         set_b1_regs();
-        if (!cpu_is_omap1510()) {
+        if (!cpu_is_omap15xx()) {
                 u16 w;
 
                 w = omap_readw(OMAP1610_DMA_LCD_CCR);
@@ -407,7 +407,7 @@ void omap_stop_lcd_dma(void)
         u16 w;
 
         lcd_dma.active = 0;
-        if (cpu_is_omap1510() || !lcd_dma.ext_ctrl)
+        if (cpu_is_omap15xx() || !lcd_dma.ext_ctrl)
                 return;
 
         w = omap_readw(OMAP1610_DMA_LCD_CCR);
diff --git a/arch/arm/mach-omap1/time.c b/arch/arm/mach-omap1/time.c
index f83fc335c613..6885d2fac183 100644
--- a/arch/arm/mach-omap1/time.c
+++ b/arch/arm/mach-omap1/time.c
@@ -44,7 +44,6 @@
 #include <linux/clocksource.h>
 #include <linux/clockchips.h>
 #include <linux/io.h>
-#include <linux/sched.h>
 
 #include <asm/system.h>
 #include <mach/hardware.h>
diff --git a/arch/arm/mach-omap2/board-devkit8000.c b/arch/arm/mach-omap2/board-devkit8000.c
index e906e05bb41b..9a2a31e011ce 100644
--- a/arch/arm/mach-omap2/board-devkit8000.c
+++ b/arch/arm/mach-omap2/board-devkit8000.c
@@ -115,9 +115,6 @@ static struct omap2_hsmmc_info mmc[] = {
 
 static int devkit8000_panel_enable_lcd(struct omap_dss_device *dssdev)
 {
-        twl_i2c_write_u8(TWL4030_MODULE_GPIO, 0x80, REG_GPIODATADIR1);
-        twl_i2c_write_u8(TWL4030_MODULE_LED, 0x0, 0x0);
-
         if (gpio_is_valid(dssdev->reset_gpio))
                 gpio_set_value_cansleep(dssdev->reset_gpio, 1);
         return 0;
@@ -247,6 +244,8 @@ static struct gpio_led gpio_leds[];
 static int devkit8000_twl_gpio_setup(struct device *dev,
                 unsigned gpio, unsigned ngpio)
 {
+        int ret;
+
         omap_mux_init_gpio(29, OMAP_PIN_INPUT);
         /* gpio + 0 is "mmc0_cd" (input/IRQ) */
         mmc[0].gpio_cd = gpio + 0;
@@ -255,17 +254,23 @@ static int devkit8000_twl_gpio_setup(struct device *dev,
         /* TWL4030_GPIO_MAX + 1 == ledB, PMU_STAT (out, active low LED) */
         gpio_leds[2].gpio = gpio + TWL4030_GPIO_MAX + 1;
 
-        /* gpio + 1 is "LCD_PWREN" (out, active high) */
-        devkit8000_lcd_device.reset_gpio = gpio + 1;
-        gpio_request(devkit8000_lcd_device.reset_gpio, "LCD_PWREN");
-        /* Disable until needed */
-        gpio_direction_output(devkit8000_lcd_device.reset_gpio, 0);
+        /* TWL4030_GPIO_MAX + 0 is "LCD_PWREN" (out, active high) */
+        devkit8000_lcd_device.reset_gpio = gpio + TWL4030_GPIO_MAX + 0;
+        ret = gpio_request_one(devkit8000_lcd_device.reset_gpio,
+                        GPIOF_DIR_OUT | GPIOF_INIT_LOW, "LCD_PWREN");
+        if (ret < 0) {
+                devkit8000_lcd_device.reset_gpio = -EINVAL;
+                printk(KERN_ERR "Failed to request GPIO for LCD_PWRN\n");
+        }
 
         /* gpio + 7 is "DVI_PD" (out, active low) */
         devkit8000_dvi_device.reset_gpio = gpio + 7;
-        gpio_request(devkit8000_dvi_device.reset_gpio, "DVI PowerDown");
-        /* Disable until needed */
-        gpio_direction_output(devkit8000_dvi_device.reset_gpio, 0);
+        ret = gpio_request_one(devkit8000_dvi_device.reset_gpio,
+                        GPIOF_DIR_OUT | GPIOF_INIT_LOW, "DVI PowerDown");
+        if (ret < 0) {
+                devkit8000_dvi_device.reset_gpio = -EINVAL;
+                printk(KERN_ERR "Failed to request GPIO for DVI PowerDown\n");
+        }
 
         return 0;
 }
diff --git a/arch/arm/mach-omap2/board-omap4panda.c b/arch/arm/mach-omap2/board-omap4panda.c
index e001a048dc0c..e944025d5ef8 100644
--- a/arch/arm/mach-omap2/board-omap4panda.c
+++ b/arch/arm/mach-omap2/board-omap4panda.c
@@ -409,8 +409,6 @@ static void __init omap4_panda_init(void)
         platform_add_devices(panda_devices, ARRAY_SIZE(panda_devices));
         omap_serial_init();
         omap4_twl6030_hsmmc_init(mmc);
-        /* OMAP4 Panda uses internal transceiver so register nop transceiver */
-        usb_nop_xceiv_register();
         omap4_ehci_init();
         usb_musb_init(&musb_board_data);
 }
diff --git a/arch/arm/mach-omap2/board-rm680.c b/arch/arm/mach-omap2/board-rm680.c
index cb77be7ac44f..39a71bb8a308 100644
--- a/arch/arm/mach-omap2/board-rm680.c
+++ b/arch/arm/mach-omap2/board-rm680.c
@@ -40,9 +40,6 @@ static struct regulator_consumer_supply rm680_vemmc_consumers[] = {
 static struct regulator_init_data rm680_vemmc = {
         .constraints =  {
                 .name                   = "rm680_vemmc",
-                .min_uV                 = 2900000,
-                .max_uV                 = 2900000,
-                .apply_uV               = 1,
                 .valid_modes_mask       = REGULATOR_MODE_NORMAL
                                         | REGULATOR_MODE_STANDBY,
                 .valid_ops_mask         = REGULATOR_CHANGE_STATUS
diff --git a/arch/arm/mach-omap2/dma.c b/arch/arm/mach-omap2/dma.c
index d2f15f5cfd36..34922b2d2e3f 100644
--- a/arch/arm/mach-omap2/dma.c
+++ b/arch/arm/mach-omap2/dma.c
@@ -264,7 +264,7 @@ static int __init omap2_system_dma_init_dev(struct omap_hwmod *oh, void *unused)
         if (IS_ERR(od)) {
                 pr_err("%s: Cant build omap_device for %s:%s.\n",
                         __func__, name, oh->name);
-                return IS_ERR(od);
+                return PTR_ERR(od);
         }
 
         mem = platform_get_resource(&od->pdev, IORESOURCE_MEM, 0);
diff --git a/arch/arm/mach-omap2/include/mach/entry-macro.S b/arch/arm/mach-omap2/include/mach/entry-macro.S
index befa321c4c13..81985a665cb3 100644
--- a/arch/arm/mach-omap2/include/mach/entry-macro.S
+++ b/arch/arm/mach-omap2/include/mach/entry-macro.S
@@ -38,20 +38,6 @@
  */
 
 #ifdef MULTI_OMAP2
-
-/*
- * We use __glue to avoid errors with multiple definitions of
- * .globl omap_irq_base as it's included from entry-armv.S but not
- * from entry-common.S.
- */
-#ifdef __glue
-                .pushsection .data
-                .globl  omap_irq_base
-omap_irq_base:
-                .word   0
-                .popsection
-#endif
-
                 /*
                  * Configure the interrupt base on the first interrupt.
                  * See also omap_irq_base_init for setting omap_irq_base.
diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
index e66687b0b9de..c2032041d26f 100644
--- a/arch/arm/mach-omap2/io.c
+++ b/arch/arm/mach-omap2/io.c
@@ -314,14 +314,13 @@ static int _set_hwmod_postsetup_state(struct omap_hwmod *oh, void *data)
         return omap_hwmod_set_postsetup_state(oh, *(u8 *)data);
 }
 
+void __iomem *omap_irq_base;
+
 /*
  * Initialize asm_irq_base for entry-macro.S
  */
 static inline void omap_irq_base_init(void)
 {
-        extern void __iomem *omap_irq_base;
-
-#ifdef MULTI_OMAP2
         if (cpu_is_omap24xx())
                 omap_irq_base = OMAP2_L4_IO_ADDRESS(OMAP24XX_IC_BASE);
         else if (cpu_is_omap34xx())
@@ -330,7 +329,6 @@ static inline void omap_irq_base_init(void)
                 omap_irq_base = OMAP2_L4_IO_ADDRESS(OMAP44XX_GIC_CPU_BASE);
         else
                 pr_err("Could not initialize omap_irq_base\n");
-#endif
 }
 
 void __init omap2_init_common_infrastructure(void)
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index df8d2f2872c6..98148b6c36e9 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -160,7 +160,7 @@ static int __init _omap_mux_get_by_name(struct omap_mux_partition *partition,
         struct omap_mux *mux = NULL;
         struct omap_mux_entry *e;
         const char *mode_name;
-        int found = 0, found_mode, mode0_len = 0;
+        int found = 0, found_mode = 0, mode0_len = 0;
         struct list_head *muxmodes = &partition->muxmodes;
 
         mode_name = strchr(muxname, '.');
@@ -1000,6 +1000,7 @@ int __init omap_mux_init(const char *name, u32 flags,
         if (!partition->base) {
                 pr_err("%s: Could not ioremap mux partition at 0x%08x\n",
                         __func__, partition->phys);
+                kfree(partition);
                 return -ENODEV;
         }
 
diff --git a/arch/arm/mach-omap2/pm24xx.c b/arch/arm/mach-omap2/pm24xx.c
index 9e5dc8ed51e9..97feb3ab6a69 100644
--- a/arch/arm/mach-omap2/pm24xx.c
+++ b/arch/arm/mach-omap2/pm24xx.c
@@ -134,7 +134,7 @@ static void omap2_enter_full_retention(void)
 
         /* Block console output in case it is on one of the OMAP UARTs */
         if (!is_suspending())
-                if (try_acquire_console_sem())
+                if (!console_trylock())
                         goto no_sleep;
 
         omap_uart_prepare_idle(0);
@@ -151,7 +151,7 @@ static void omap2_enter_full_retention(void)
         omap_uart_resume_idle(0);
 
         if (!is_suspending())
-                release_console_sem();
+                console_unlock();
 
 no_sleep:
         if (omap2_pm_debug) {
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 8cbbeade4b8a..2f864e4b085d 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -168,9 +168,10 @@ static void omap3_core_restore_context(void)
  * once during boot sequence, but this works as we are not using secure
  * services.
  */
-static void omap3_save_secure_ram_context(u32 target_mpu_state)
+static void omap3_save_secure_ram_context(void)
 {
         u32 ret;
+        int mpu_next_state = pwrdm_read_next_pwrst(mpu_pwrdm);
 
         if (omap_type() != OMAP2_DEVICE_TYPE_GP) {
                 /*
@@ -181,7 +182,7 @@ static void omap3_save_secure_ram_context(u32 target_mpu_state)
                 pwrdm_set_next_pwrst(mpu_pwrdm, PWRDM_POWER_ON);
                 ret = _omap_save_secure_sram((u32 *)
                                 __pa(omap3_secure_ram_storage));
-                pwrdm_set_next_pwrst(mpu_pwrdm, target_mpu_state);
+                pwrdm_set_next_pwrst(mpu_pwrdm, mpu_next_state);
                 /* Following is for error tracking, it should not happen */
                 if (ret) {
                         printk(KERN_ERR "save_secure_sram() returns %08x\n",
@@ -398,7 +399,7 @@ void omap_sram_idle(void)
         if (!is_suspending())
                 if (per_next_state < PWRDM_POWER_ON ||
                     core_next_state < PWRDM_POWER_ON)
-                        if (try_acquire_console_sem())
+                        if (!console_trylock())
                                 goto console_still_active;
 
         /* PER */
@@ -481,7 +482,7 @@ void omap_sram_idle(void)
         }
 
         if (!is_suspending())
-                release_console_sem();
+                console_unlock();
 
 console_still_active:
         /* Disable IO-PAD and IO-CHAIN wakeup */
@@ -1094,7 +1095,7 @@ static int __init omap3_pm_init(void)
                 local_fiq_disable();
 
                 omap_dma_global_context_save();
-                omap3_save_secure_ram_context(PWRDM_POWER_ON);
+                omap3_save_secure_ram_context();
                 omap_dma_global_context_restore();
 
                 local_irq_enable();
diff --git a/arch/arm/mach-omap2/serial.c b/arch/arm/mach-omap2/serial.c
index 302da7403a10..32e91a9c8b6b 100644
--- a/arch/arm/mach-omap2/serial.c
+++ b/arch/arm/mach-omap2/serial.c
@@ -812,7 +812,7 @@ void __init omap_serial_init_port(struct omap_board_data *bdata)
 
         oh->dev_attr = uart;
 
-        acquire_console_sem(); /* in case the earlycon is on the UART */
+        console_lock(); /* in case the earlycon is on the UART */
 
         /*
          * Because of early UART probing, UART did not get idled
@@ -838,7 +838,7 @@ void __init omap_serial_init_port(struct omap_board_data *bdata)
         omap_uart_block_sleep(uart);
         uart->timeout = DEFAULT_TIMEOUT;
 
-        release_console_sem();
+        console_unlock();
 
         if ((cpu_is_omap34xx() && uart->padconf) ||
             (uart->wk_en && uart->wk_mask)) {
diff --git a/arch/arm/mach-omap2/smartreflex.c b/arch/arm/mach-omap2/smartreflex.c
index 77ecebf3fae2..c37e823266d3 100644
--- a/arch/arm/mach-omap2/smartreflex.c
+++ b/arch/arm/mach-omap2/smartreflex.c
@@ -780,8 +780,7 @@ static int omap_sr_autocomp_show(void *data, u64 *val)
         struct omap_sr *sr_info = (struct omap_sr *) data;
 
         if (!sr_info) {
-                pr_warning("%s: omap_sr struct for sr_%s not found\n",
-                        __func__, sr_info->voltdm->name);
+                pr_warning("%s: omap_sr struct not found\n", __func__);
                 return -EINVAL;
         }
 
@@ -795,8 +794,7 @@ static int omap_sr_autocomp_store(void *data, u64 val)
         struct omap_sr *sr_info = (struct omap_sr *) data;
 
         if (!sr_info) {
-                pr_warning("%s: omap_sr struct for sr_%s not found\n",
-                        __func__, sr_info->voltdm->name);
+                pr_warning("%s: omap_sr struct not found\n", __func__);
                 return -EINVAL;
         }
 
@@ -834,7 +832,8 @@ static int __init omap_sr_probe(struct platform_device *pdev)
 
         if (!pdata) {
                 dev_err(&pdev->dev, "%s: platform data missing\n", __func__);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_free_devinfo;
         }
 
         mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -966,7 +965,7 @@ static int __devexit omap_sr_remove(struct platform_device *pdev)
         }
 
         sr_info = _sr_lookup(pdata->voltdm);
-        if (!sr_info) {
+        if (IS_ERR(sr_info)) {
                 dev_warn(&pdev->dev, "%s: omap_sr struct not found\n",
                         __func__);
                 return -EINVAL;
diff --git a/arch/arm/mach-omap2/voltage.c b/arch/arm/mach-omap2/voltage.c
index ed6079c94c57..12be525b8df4 100644
--- a/arch/arm/mach-omap2/voltage.c
+++ b/arch/arm/mach-omap2/voltage.c
@@ -471,6 +471,7 @@ static void __init vdd_debugfs_init(struct omap_vdd_info *vdd)
         strcat(name, vdd->voltdm.name);
 
         vdd->debug_dir = debugfs_create_dir(name, voltage_dir);
+        kfree(name);
         if (IS_ERR(vdd->debug_dir)) {
                 pr_warning("%s: Unable to create debugfs directory for"
                         " vdd_%s\n", __func__, vdd->voltdm.name);
diff --git a/arch/arm/mach-tegra/gpio.c b/arch/arm/mach-tegra/gpio.c
index bd066206e110..ad8048801513 100644
--- a/arch/arm/mach-tegra/gpio.c
+++ b/arch/arm/mach-tegra/gpio.c
@@ -207,9 +207,9 @@ static int tegra_gpio_irq_set_type(struct irq_data *d, unsigned int type)
         spin_unlock_irqrestore(&bank->lvl_lock[port], flags);
 
         if (type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
-                __set_irq_handler_unlocked(irq, handle_level_irq);
+                __set_irq_handler_unlocked(d->irq, handle_level_irq);
         else if (type & (IRQ_TYPE_EDGE_FALLING | IRQ_TYPE_EDGE_RISING))
-                __set_irq_handler_unlocked(irq, handle_edge_irq);
+                __set_irq_handler_unlocked(d->irq, handle_edge_irq);
 
         return 0;
 }
diff --git a/arch/arm/mach-tegra/include/mach/clk.h b/arch/arm/mach-tegra/include/mach/clk.h
index d7723955dac7..a217f68ba57c 100644
--- a/arch/arm/mach-tegra/include/mach/clk.h
+++ b/arch/arm/mach-tegra/include/mach/clk.h
@@ -20,6 +20,8 @@
 #ifndef __MACH_CLK_H
 #define __MACH_CLK_H
 
+struct clk;
+
 void tegra_periph_reset_deassert(struct clk *c);
 void tegra_periph_reset_assert(struct clk *c);
 
diff --git a/arch/arm/mach-tegra/include/mach/clkdev.h b/arch/arm/mach-tegra/include/mach/clkdev.h
index 412f5c63e65a..66cd3f4fc896 100644
--- a/arch/arm/mach-tegra/include/mach/clkdev.h
+++ b/arch/arm/mach-tegra/include/mach/clkdev.h
@@ -20,6 +20,8 @@
 #ifndef __MACH_CLKDEV_H
 #define __MACH_CLKDEV_H
 
+struct clk;
+
 static inline int __clk_get(struct clk *clk)
 {
         return 1;
diff --git a/arch/arm/mach-tegra/include/mach/kbc.h b/arch/arm/mach-tegra/include/mach/kbc.h
new file mode 100644
index 000000000000..66ad2760c621
--- /dev/null
+++ b/arch/arm/mach-tegra/include/mach/kbc.h
@@ -0,0 +1,61 @@
+/*
+ * Platform definitions for tegra-kbc keyboard input driver
+ *
+ * Copyright (c) 2010-2011, NVIDIA Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef ASMARM_ARCH_TEGRA_KBC_H
+#define ASMARM_ARCH_TEGRA_KBC_H
+
+#include <linux/types.h>
+#include <linux/input/matrix_keypad.h>
+
+#ifdef CONFIG_ARCH_TEGRA_2x_SOC
+#define KBC_MAX_GPIO    24
+#define KBC_MAX_KPENT   8
+#else
+#define KBC_MAX_GPIO    20
+#define KBC_MAX_KPENT   7
+#endif
+
+#define KBC_MAX_ROW     16
+#define KBC_MAX_COL     8
+#define KBC_MAX_KEY     (KBC_MAX_ROW * KBC_MAX_COL)
+
+struct tegra_kbc_pin_cfg {
+        bool is_row;
+        unsigned char num;
+};
+
+struct tegra_kbc_wake_key {
+        u8 row:4;
+        u8 col:4;
+};
+
+struct tegra_kbc_platform_data {
+        unsigned int debounce_cnt;
+        unsigned int repeat_cnt;
+
+        unsigned int wake_cnt; /* 0:wake on any key >1:wake on wake_cfg */
+        const struct tegra_kbc_wake_key *wake_cfg;
+
+        struct tegra_kbc_pin_cfg pin_cfg[KBC_MAX_GPIO];
+        const struct matrix_keymap_data *keymap_data;
+
+        bool wakeup;
+};
+#endif
diff --git a/arch/arm/mach-tegra/irq.c b/arch/arm/mach-tegra/irq.c
index de7dfad6f769..17c74d21077c 100644
--- a/arch/arm/mach-tegra/irq.c
+++ b/arch/arm/mach-tegra/irq.c
@@ -46,24 +46,24 @@
 #define ICTLR_COP_IER_CLR       0x38
 #define ICTLR_COP_IEP_CLASS     0x3c
 
-static void (*gic_mask_irq)(struct irq_data *d);
-static void (*gic_unmask_irq)(struct irq_data *d);
+static void (*tegra_gic_mask_irq)(struct irq_data *d);
+static void (*tegra_gic_unmask_irq)(struct irq_data *d);
 
-#define irq_to_ictlr(irq) (((irq)-32) >> 5)
+#define irq_to_ictlr(irq) (((irq) - 32) >> 5)
 static void __iomem *tegra_ictlr_base = IO_ADDRESS(TEGRA_PRIMARY_ICTLR_BASE);
-#define ictlr_to_virt(ictlr) (tegra_ictlr_base + (ictlr)*0x100)
+#define ictlr_to_virt(ictlr) (tegra_ictlr_base + (ictlr) * 0x100)
 
 static void tegra_mask(struct irq_data *d)
 {
         void __iomem *addr = ictlr_to_virt(irq_to_ictlr(d->irq));
-        gic_mask_irq(d);
-        writel(1<<(d->irq&31), addr+ICTLR_CPU_IER_CLR);
+        tegra_gic_mask_irq(d);
+        writel(1 << (d->irq & 31), addr+ICTLR_CPU_IER_CLR);
 }
 
 static void tegra_unmask(struct irq_data *d)
 {
         void __iomem *addr = ictlr_to_virt(irq_to_ictlr(d->irq));
-        gic_unmask_irq(d);
+        tegra_gic_unmask_irq(d);
         writel(1<<(d->irq&31), addr+ICTLR_CPU_IER_SET);
 }
 
@@ -98,8 +98,8 @@ void __init tegra_init_irq(void)
                  IO_ADDRESS(TEGRA_ARM_PERIF_BASE + 0x100));
 
         gic = get_irq_chip(29);
-        gic_unmask_irq = gic->irq_unmask;
-        gic_mask_irq = gic->irq_mask;
+        tegra_gic_unmask_irq = gic->irq_unmask;
+        tegra_gic_mask_irq = gic->irq_mask;
         tegra_irq.irq_ack = gic->irq_ack;
 #ifdef CONFIG_SMP
         tegra_irq.irq_set_affinity = gic->irq_set_affinity;
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 5164069ced42..cddd684364da 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -297,6 +297,12 @@ void __init arm_memblock_init(struct meminfo *mi, struct machine_desc *mdesc)
         memblock_reserve(__pa(_stext), _end - _stext);
 #endif
 #ifdef CONFIG_BLK_DEV_INITRD
+        if (phys_initrd_size &&
+            memblock_is_region_reserved(phys_initrd_start, phys_initrd_size)) {
+                pr_err("INITRD: 0x%08lx+0x%08lx overlaps in-use memory region - disabling initrd\n",
+                       phys_initrd_start, phys_initrd_size);
+                phys_initrd_start = phys_initrd_size = 0;
+        }
         if (phys_initrd_size) {
                 memblock_reserve(phys_initrd_start, phys_initrd_size);
 
diff --git a/arch/arm/plat-mxc/include/mach/uncompress.h b/arch/arm/plat-mxc/include/mach/uncompress.h
index 3a70ebf0477f..ff469c4f1d76 100644
--- a/arch/arm/plat-mxc/include/mach/uncompress.h
+++ b/arch/arm/plat-mxc/include/mach/uncompress.h
@@ -95,6 +95,7 @@ static __inline__ void __arch_decomp_setup(unsigned long arch_id)
         case MACH_TYPE_MX35_3DS:
         case MACH_TYPE_PCM043:
         case MACH_TYPE_LILLY1131:
+        case MACH_TYPE_VPR200:
                 uart_base = MX3X_UART1_BASE_ADDR;
                 break;
         case MACH_TYPE_MAGX_ZN5:
@@ -102,6 +103,7 @@ static __inline__ void __arch_decomp_setup(unsigned long arch_id)
                 break;
         case MACH_TYPE_MX51_BABBAGE:
         case MACH_TYPE_EUKREA_CPUIMX51SD:
+        case MACH_TYPE_MX51_3DS:
                 uart_base = MX51_UART1_BASE_ADDR;
                 break;
         case MACH_TYPE_MX50_RDP:
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 2fea897ebeb1..9d6feaabbe7d 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Sun Dec 12 23:24:27 2010
+# Last update: Mon Feb 7 08:59:27 2011
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -2240,7 +2240,7 @@ arm_ultimator2		MACH_ARM_ULTIMATOR2	ARM_ULTIMATOR2		2250
 vs_v210                 MACH_VS_V210            VS_V210                 2252
 vs_v212                 MACH_VS_V212            VS_V212                 2253
 hmt                     MACH_HMT                HMT                     2254
-suen3                   MACH_SUEN3              SUEN3                   2255
+km_kirkwood             MACH_KM_KIRKWOOD        KM_KIRKWOOD             2255
 vesper                  MACH_VESPER             VESPER                  2256
 str9                    MACH_STR9               STR9                    2257
 omap3_wl_ff             MACH_OMAP3_WL_FF        OMAP3_WL_FF             2258
@@ -2987,7 +2987,7 @@ pxwnas_500_1000		MACH_PXWNAS_500_1000	PXWNAS_500_1000		3001
 ea20                    MACH_EA20               EA20                    3002
 awm2                    MACH_AWM2               AWM2                    3003
 ti8148evm               MACH_TI8148EVM          TI8148EVM               3004
-tegra_seaboard          MACH_TEGRA_SEABOARD     TEGRA_SEABOARD          3005
+seaboard                MACH_SEABOARD           SEABOARD                3005
 linkstation_chlv2       MACH_LINKSTATION_CHLV2  LINKSTATION_CHLV2       3006
 tera_pro2_rack          MACH_TERA_PRO2_RACK     TERA_PRO2_RACK          3007
 rubys                   MACH_RUBYS              RUBYS                   3008
@@ -3190,7 +3190,7 @@ synergy			MACH_SYNERGY		SYNERGY			3205
 ics_if_voip             MACH_ICS_IF_VOIP        ICS_IF_VOIP             3206
 wlf_cragg_6410          MACH_WLF_CRAGG_6410     WLF_CRAGG_6410          3207
 punica                  MACH_PUNICA             PUNICA                  3208
-sbc_nt250               MACH_SBC_NT250          SBC_NT250               3209
+trimslice               MACH_TRIMSLICE          TRIMSLICE               3209
 mx27_wmultra            MACH_MX27_WMULTRA       MX27_WMULTRA            3210
 mackerel                MACH_MACKEREL           MACKEREL                3211
 fa9x27                  MACH_FA9X27             FA9X27                  3213
@@ -3219,3 +3219,100 @@ pivicc			MACH_PIVICC		PIVICC			3235
 pcm048                  MACH_PCM048             PCM048                  3236
 dds                     MACH_DDS                DDS                     3237
 chalten_xa1             MACH_CHALTEN_XA1        CHALTEN_XA1             3238
+ts48xx                  MACH_TS48XX             TS48XX                  3239
+tonga2_tfttimer         MACH_TONGA2_TFTTIMER    TONGA2_TFTTIMER         3240
+whistler                MACH_WHISTLER           WHISTLER                3241
+asl_phoenix             MACH_ASL_PHOENIX        ASL_PHOENIX             3242
+at91sam9263otlite       MACH_AT91SAM9263OTLITE  AT91SAM9263OTLITE       3243
+ddplug                  MACH_DDPLUG             DDPLUG                  3244
+d2plug                  MACH_D2PLUG             D2PLUG                  3245
+kzm9d                   MACH_KZM9D              KZM9D                   3246
+verdi_lte               MACH_VERDI_LTE          VERDI_LTE               3247
+nanozoom                MACH_NANOZOOM           NANOZOOM                3248
+dm3730_som_lv           MACH_DM3730_SOM_LV      DM3730_SOM_LV           3249
+dm3730_torpedo          MACH_DM3730_TORPEDO     DM3730_TORPEDO          3250
+anchovy                 MACH_ANCHOVY            ANCHOVY                 3251
+re2rev20                MACH_RE2REV20           RE2REV20                3253
+re2rev21                MACH_RE2REV21           RE2REV21                3254
+cns21xx                 MACH_CNS21XX            CNS21XX                 3255
+rider                   MACH_RIDER              RIDER                   3257
+nsk330                  MACH_NSK330             NSK330                  3258
+cns2133evb              MACH_CNS2133EVB         CNS2133EVB              3259
+z3_816x_mod             MACH_Z3_816X_MOD        Z3_816X_MOD             3260
+z3_814x_mod             MACH_Z3_814X_MOD        Z3_814X_MOD             3261
+beect                   MACH_BEECT              BEECT                   3262
+dma_thunderbug          MACH_DMA_THUNDERBUG     DMA_THUNDERBUG          3263
+omn_at91sam9g20         MACH_OMN_AT91SAM9G20    OMN_AT91SAM9G20         3264
+mx25_e2s_uc             MACH_MX25_E2S_UC        MX25_E2S_UC             3265
+mione                   MACH_MIONE              MIONE                   3266
+top9000_tcu             MACH_TOP9000_TCU        TOP9000_TCU             3267
+top9000_bsl             MACH_TOP9000_BSL        TOP9000_BSL             3268
+kingdom                 MACH_KINGDOM            KINGDOM                 3269
+armadillo460            MACH_ARMADILLO460       ARMADILLO460            3270
+lq2                     MACH_LQ2                LQ2                     3271
+sweda_tms2              MACH_SWEDA_TMS2         SWEDA_TMS2              3272
+mx53_loco               MACH_MX53_LOCO          MX53_LOCO               3273
+acer_a8                 MACH_ACER_A8            ACER_A8                 3275
+acer_gauguin            MACH_ACER_GAUGUIN       ACER_GAUGUIN            3276
+guppy                   MACH_GUPPY              GUPPY                   3277
+mx61_ard                MACH_MX61_ARD           MX61_ARD                3278
+tx53                    MACH_TX53               TX53                    3279
+omapl138_case_a3        MACH_OMAPL138_CASE_A3   OMAPL138_CASE_A3        3280
+uemd                    MACH_UEMD               UEMD                    3281
+ccwmx51mut              MACH_CCWMX51MUT         CCWMX51MUT              3282
+rockhopper              MACH_ROCKHOPPER         ROCKHOPPER              3283
+nookcolor               MACH_NOOKCOLOR          NOOKCOLOR               3284
+hkdkc100                MACH_HKDKC100           HKDKC100                3285
+ts42xx                  MACH_TS42XX             TS42XX                  3286
+aebl                    MACH_AEBL               AEBL                    3287
+wario                   MACH_WARIO              WARIO                   3288
+gfs_spm                 MACH_GFS_SPM            GFS_SPM                 3289
+cm_t3730                MACH_CM_T3730           CM_T3730                3290
+isc3                    MACH_ISC3               ISC3                    3291
+rascal                  MACH_RASCAL             RASCAL                  3292
+hrefv60                 MACH_HREFV60            HREFV60                 3293
+tpt_2_0                 MACH_TPT_2_0            TPT_2_0                 3294
+pyramid_td              MACH_PYRAMID_TD         PYRAMID_TD              3295
+splendor                MACH_SPLENDOR           SPLENDOR                3296
+guf_planet              MACH_GUF_PLANET         GUF_PLANET              3297
+msm8x60_qt              MACH_MSM8X60_QT         MSM8X60_QT              3298
+htc_hd_mini             MACH_HTC_HD_MINI        HTC_HD_MINI             3299
+athene                  MACH_ATHENE             ATHENE                  3300
+deep_r_ek_1             MACH_DEEP_R_EK_1        DEEP_R_EK_1             3301
+vivow_ct                MACH_VIVOW_CT           VIVOW_CT                3302
+nery_1000               MACH_NERY_1000          NERY_1000               3303
+rfl109145_ssrv          MACH_RFL109145_SSRV     RFL109145_SSRV          3304
+nmh                     MACH_NMH                NMH                     3305
+wn802t                  MACH_WN802T             WN802T                  3306
+dragonet                MACH_DRAGONET           DRAGONET                3307
+geneva_b                MACH_GENEVA_B           GENEVA_B                3308
+at91sam9263desk16l      MACH_AT91SAM9263DESK16L AT91SAM9263DESK16L      3309
+bcmhana_sv              MACH_BCMHANA_SV         BCMHANA_SV              3310
+bcmhana_tablet          MACH_BCMHANA_TABLET     BCMHANA_TABLET          3311
+koi                     MACH_KOI                KOI                     3312
+ts4800                  MACH_TS4800             TS4800                  3313
+tqma9263                MACH_TQMA9263           TQMA9263                3314
+holiday                 MACH_HOLIDAY            HOLIDAY                 3315
+dma_6410                MACH_DMA6410            DMA6410                 3316
+pcats_overlay           MACH_PCATS_OVERLAY      PCATS_OVERLAY           3317
+hwgw6410                MACH_HWGW6410           HWGW6410                3318
+shenzhou                MACH_SHENZHOU           SHENZHOU                3319
+cwme9210                MACH_CWME9210           CWME9210                3320
+cwme9210js              MACH_CWME9210JS         CWME9210JS              3321
+pgs_v1                  MACH_PGS_SITARA         PGS_SITARA              3322
+colibri_tegra2          MACH_COLIBRI_TEGRA2     COLIBRI_TEGRA2          3323
+w21                     MACH_W21                W21                     3324
+polysat1                MACH_POLYSAT1           POLYSAT1                3325
+dataway                 MACH_DATAWAY            DATAWAY                 3326
+cobral138               MACH_COBRAL138          COBRAL138               3327
+roverpcs8               MACH_ROVERPCS8          ROVERPCS8               3328
+marvelc                 MACH_MARVELC            MARVELC                 3329
+navefihid               MACH_NAVEFIHID          NAVEFIHID               3330
+dm365_cv100             MACH_DM365_CV100        DM365_CV100             3331
+able                    MACH_ABLE               ABLE                    3332
+legacy                  MACH_LEGACY             LEGACY                  3333
+icong                   MACH_ICONG              ICONG                   3334
+rover_g8                MACH_ROVER_G8           ROVER_G8                3335
+t5388p                  MACH_T5388P             T5388P                  3336
+dingo                   MACH_DINGO              DINGO                   3337
+goflexhome              MACH_GOFLEXHOME         GOFLEXHOME              3338
diff --git a/arch/avr32/include/asm/pgalloc.h b/arch/avr32/include/asm/pgalloc.h
index 92ecd8446ef8..bc7e8ae479ee 100644
--- a/arch/avr32/include/asm/pgalloc.h
+++ b/arch/avr32/include/asm/pgalloc.h
@@ -8,6 +8,7 @@
 #ifndef __ASM_AVR32_PGALLOC_H
 #define __ASM_AVR32_PGALLOC_H
 
+#include <linux/mm.h>
 #include <linux/quicklist.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
diff --git a/arch/m32r/kernel/irq.c b/arch/m32r/kernel/irq.c
index f745c1287f3a..76eaf3883fbd 100644
--- a/arch/m32r/kernel/irq.c
+++ b/arch/m32r/kernel/irq.c
@@ -80,7 +80,7 @@ asmlinkage unsigned int do_IRQ(int irq, struct pt_regs *regs)
 #ifdef CONFIG_DEBUG_STACKOVERFLOW
         /* FIXME M32R */
 #endif
-        __do_IRQ(irq);
+        generic_handle_irq(irq);
         irq_exit();
         set_irq_regs(old_regs);
 
diff --git a/arch/microblaze/kernel/head.S b/arch/microblaze/kernel/head.S
index 42434008209e..0db20b5abb54 100644
--- a/arch/microblaze/kernel/head.S
+++ b/arch/microblaze/kernel/head.S
@@ -77,8 +77,18 @@ real_start:
    We ensure r7 points to a valid FDT, just in case the bootloader
    is broken or non-existent */
         beqi    r7, no_fdt_arg                  /* NULL pointer?  don't copy */
-        lw      r11, r0, r7                     /* Does r7 point to a */
-        rsubi   r11, r11, OF_DT_HEADER          /* valid FDT? */
+/* Does r7 point to a valid FDT? Load HEADER magic number */
+        /* Run time Big/Little endian platform */
+        /* Save 1 as word and load byte - 0 - BIG, 1 - LITTLE */
+        addik   r11, r0, 0x1 /* BIG/LITTLE checking value */
+        /* __bss_start will be zeroed later - it is just temp location */
+        swi     r11, r0, TOPHYS(__bss_start)
+        lbui    r11, r0, TOPHYS(__bss_start)
+        beqid   r11, big_endian /* DO NOT break delay stop dependency */
+        lw      r11, r0, r7 /* Big endian load in delay slot */
+        lwr     r11, r0, r7 /* Little endian load */
+big_endian:
+        rsubi   r11, r11, OF_DT_HEADER  /* Check FDT header */
         beqi    r11, _prepare_copy_fdt
         or      r7, r0, r0              /* clear R7 when not valid DTB */
         bnei    r11, no_fdt_arg                 /* No - get out of here */
diff --git a/arch/microblaze/kernel/hw_exception_handler.S b/arch/microblaze/kernel/hw_exception_handler.S
index 25f6e07d8de8..782680de3121 100644
--- a/arch/microblaze/kernel/hw_exception_handler.S
+++ b/arch/microblaze/kernel/hw_exception_handler.S
@@ -147,10 +147,6 @@
         #if CONFIG_XILINX_MICROBLAZE0_USE_BARREL > 0
         #define BSRLI(rD, rA, imm)      \
                 bsrli rD, rA, imm
-        #elif CONFIG_XILINX_MICROBLAZE0_USE_DIV > 0
-        #define BSRLI(rD, rA, imm)      \
-                ori rD, r0, (1 << imm); \
-                idivu rD, rD, rA
         #else
         #define BSRLI(rD, rA, imm) BSRLI ## imm (rD, rA)
         /* Only the used shift constants defined here - add more if needed */
diff --git a/arch/microblaze/lib/fastcopy.S b/arch/microblaze/lib/fastcopy.S
index fdc48bb065d8..62021d7e249e 100644
--- a/arch/microblaze/lib/fastcopy.S
+++ b/arch/microblaze/lib/fastcopy.S
@@ -29,6 +29,10 @@
  *      between mem locations with size of xfer spec'd in bytes
  */
 
+#ifdef __MICROBLAZEEL__
+#error Microblaze LE not support ASM optimized lib func. Disable OPT_LIB_ASM.
+#endif
+
 #include <linux/linkage.h>
         .text
         .globl  memcpy
diff --git a/arch/parisc/kernel/pdc_cons.c b/arch/parisc/kernel/pdc_cons.c
index 11bdd68e5762..fc770be465ff 100644
--- a/arch/parisc/kernel/pdc_cons.c
+++ b/arch/parisc/kernel/pdc_cons.c
@@ -169,11 +169,11 @@ static int __init pdc_console_tty_driver_init(void)
 
         struct console *tmp;
 
-        acquire_console_sem();
+        console_lock();
         for_each_console(tmp)
                 if (tmp == &pdc_cons)
                         break;
-        release_console_sem();
+        console_unlock();
 
         if (!tmp) {
                 printk(KERN_INFO "PDC console driver not registered anymore, not creating %s\n", pdc_cons.name);
diff --git a/arch/powerpc/include/asm/mmu-book3e.h b/arch/powerpc/include/asm/mmu-book3e.h
index 8eaed81ea642..17194fcd4040 100644
--- a/arch/powerpc/include/asm/mmu-book3e.h
+++ b/arch/powerpc/include/asm/mmu-book3e.h
@@ -40,8 +40,8 @@
 
 /* MAS registers bit definitions */
 
-#define MAS0_TLBSEL(x)          ((x << 28) & 0x30000000)
-#define MAS0_ESEL(x)            ((x << 16) & 0x0FFF0000)
+#define MAS0_TLBSEL(x)          (((x) << 28) & 0x30000000)
+#define MAS0_ESEL(x)            (((x) << 16) & 0x0FFF0000)
 #define MAS0_NV(x)              ((x) & 0x00000FFF)
 #define MAS0_HES                0x00004000
 #define MAS0_WQ_ALLWAYS         0x00000000
@@ -50,12 +50,12 @@
 
 #define MAS1_VALID              0x80000000
 #define MAS1_IPROT              0x40000000
-#define MAS1_TID(x)             ((x << 16) & 0x3FFF0000)
+#define MAS1_TID(x)             (((x) << 16) & 0x3FFF0000)
 #define MAS1_IND                0x00002000
 #define MAS1_TS                 0x00001000
 #define MAS1_TSIZE_MASK         0x00000f80
 #define MAS1_TSIZE_SHIFT        7
-#define MAS1_TSIZE(x)           ((x << MAS1_TSIZE_SHIFT) & MAS1_TSIZE_MASK)
+#define MAS1_TSIZE(x)           (((x) << MAS1_TSIZE_SHIFT) & MAS1_TSIZE_MASK)
 
 #define MAS2_EPN                0xFFFFF000
 #define MAS2_X0                 0x00000040
diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
index 53b64be40eb2..da4b20008541 100644
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
@@ -101,7 +101,7 @@ extern phys_addr_t kernstart_addr;
 
 #ifdef CONFIG_FLATMEM
 #define ARCH_PFN_OFFSET         (MEMORY_START >> PAGE_SHIFT)
-#define pfn_valid(pfn)          ((pfn) >= ARCH_PFN_OFFSET && (pfn) < (ARCH_PFN_OFFSET + max_mapnr))
+#define pfn_valid(pfn)          ((pfn) >= ARCH_PFN_OFFSET && (pfn) < max_mapnr)
 #endif
 
 #define virt_to_page(kaddr)     pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
diff --git a/arch/powerpc/kernel/cpu_setup_6xx.S b/arch/powerpc/kernel/cpu_setup_6xx.S
index 55cba4a8a959..f8cd9fba4d35 100644
--- a/arch/powerpc/kernel/cpu_setup_6xx.S
+++ b/arch/powerpc/kernel/cpu_setup_6xx.S
@@ -18,7 +18,7 @@
 #include <asm/mmu.h>
 
 _GLOBAL(__setup_cpu_603)
-        mflr    r4
+        mflr    r5
 BEGIN_MMU_FTR_SECTION
         li      r10,0
         mtspr   SPRN_SPRG_603_LRU,r10           /* init SW LRU tracking */
@@ -27,60 +27,60 @@ BEGIN_FTR_SECTION
         bl      __init_fpu_registers
 END_FTR_SECTION_IFCLR(CPU_FTR_FPU_UNAVAILABLE)
         bl      setup_common_caches
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_604)
-        mflr    r4
+        mflr    r5
         bl      setup_common_caches
         bl      setup_604_hid0
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_750)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_common_caches
         bl      setup_750_7400_hid0
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_750cx)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_common_caches
         bl      setup_750_7400_hid0
         bl      setup_750cx
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_750fx)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_common_caches
         bl      setup_750_7400_hid0
         bl      setup_750fx
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_7400)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_7400_workarounds
         bl      setup_common_caches
         bl      setup_750_7400_hid0
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_7410)
-        mflr    r4
+        mflr    r5
         bl      __init_fpu_registers
         bl      setup_7410_workarounds
         bl      setup_common_caches
         bl      setup_750_7400_hid0
         li      r3,0
         mtspr   SPRN_L2CR2,r3
-        mtlr    r4
+        mtlr    r5
         blr
 _GLOBAL(__setup_cpu_745x)
-        mflr    r4
+        mflr    r5
         bl      setup_common_caches
         bl      setup_745x_specifics
-        mtlr    r4
+        mtlr    r5
         blr
 
 /* Enable caches for 603's, 604, 750 & 7400 */
@@ -194,10 +194,10 @@ setup_750cx:
         cror    4*cr0+eq,4*cr0+eq,4*cr1+eq
         cror    4*cr0+eq,4*cr0+eq,4*cr2+eq
         bnelr
-        lwz     r6,CPU_SPEC_FEATURES(r5)
+        lwz     r6,CPU_SPEC_FEATURES(r4)
         li      r7,CPU_FTR_CAN_NAP
         andc    r6,r6,r7
-        stw     r6,CPU_SPEC_FEATURES(r5)
+        stw     r6,CPU_SPEC_FEATURES(r4)
         blr
 
 /* 750fx specific
@@ -225,12 +225,12 @@ BEGIN_FTR_SECTION
         andis.  r11,r11,L3CR_L3E@h
         beq     1f
 END_FTR_SECTION_IFSET(CPU_FTR_L3CR)
-        lwz     r6,CPU_SPEC_FEATURES(r5)
+        lwz     r6,CPU_SPEC_FEATURES(r4)
         andi.   r0,r6,CPU_FTR_L3_DISABLE_NAP
         beq     1f
         li      r7,CPU_FTR_CAN_NAP
         andc    r6,r6,r7
-        stw     r6,CPU_SPEC_FEATURES(r5)
+        stw     r6,CPU_SPEC_FEATURES(r4)
 1:
         mfspr   r11,SPRN_HID0
 
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 8d74a24c5502..e8e915ce3d8d 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -2076,8 +2076,8 @@ static void __init setup_cpu_spec(unsigned long offset, struct cpu_spec *s)
          * pointer on ppc64 and booke as we are running at 0 in real mode
          * on ppc64 and reloc_offset is always 0 on booke.
          */
-        if (s->cpu_setup) {
-                s->cpu_setup(offset, s);
+        if (t->cpu_setup) {
+                t->cpu_setup(offset, t);
         }
 #endif /* CONFIG_PPC64 || CONFIG_BOOKE */
 }
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index bf5cb91f07de..fd4812329570 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -186,7 +186,7 @@ static void unmap_cpu_from_node(unsigned long cpu)
         dbg("removing cpu %lu from node %d\n", cpu, node);
 
         if (cpumask_test_cpu(cpu, node_to_cpumask_map[node])) {
-                cpumask_set_cpu(cpu, node_to_cpumask_map[node]);
+                cpumask_clear_cpu(cpu, node_to_cpumask_map[node]);
         } else {
                 printk(KERN_ERR "WARNING: cpu %lu not found in node %d\n",
                        cpu, node);
@@ -1289,10 +1289,9 @@ u64 memory_hotplug_max(void)
 }
 #endif /* CONFIG_MEMORY_HOTPLUG */
 
-/* Vrtual Processor Home Node (VPHN) support */
+/* Virtual Processor Home Node (VPHN) support */
 #ifdef CONFIG_PPC_SPLPAR
-#define VPHN_NR_CHANGE_CTRS (8)
-static u8 vphn_cpu_change_counts[NR_CPUS][VPHN_NR_CHANGE_CTRS];
+static u8 vphn_cpu_change_counts[NR_CPUS][MAX_DISTANCE_REF_POINTS];
 static cpumask_t cpu_associativity_changes_mask;
 static int vphn_enabled;
 static void set_topology_timer(void);
@@ -1303,16 +1302,18 @@ static void set_topology_timer(void);
  */
 static void setup_cpu_associativity_change_counters(void)
 {
-        int cpu = 0;
+        int cpu;
+
+        /* The VPHN feature supports a maximum of 8 reference points */
+        BUILD_BUG_ON(MAX_DISTANCE_REF_POINTS > 8);
 
         for_each_possible_cpu(cpu) {
-                int i = 0;
+                int i;
                 u8 *counts = vphn_cpu_change_counts[cpu];
                 volatile u8 *hypervisor_counts = lppaca[cpu].vphn_assoc_counts;
 
-                for (i = 0; i < VPHN_NR_CHANGE_CTRS; i++) {
+                for (i = 0; i < distance_ref_points_depth; i++)
                         counts[i] = hypervisor_counts[i];
-                }
         }
 }
 
@@ -1329,7 +1330,7 @@ static void setup_cpu_associativity_change_counters(void)
  */
 static int update_cpu_associativity_changes_mask(void)
 {
-        int cpu = 0, nr_cpus = 0;
+        int cpu, nr_cpus = 0;
         cpumask_t *changes = &cpu_associativity_changes_mask;
 
         cpumask_clear(changes);
@@ -1339,8 +1340,8 @@ static int update_cpu_associativity_changes_mask(void)
                 u8 *counts = vphn_cpu_change_counts[cpu];
                 volatile u8 *hypervisor_counts = lppaca[cpu].vphn_assoc_counts;
 
-                for (i = 0; i < VPHN_NR_CHANGE_CTRS; i++) {
-                        if (hypervisor_counts[i] > counts[i]) {
+                for (i = 0; i < distance_ref_points_depth; i++) {
+                        if (hypervisor_counts[i] != counts[i]) {
                                 counts[i] = hypervisor_counts[i];
                                 changed = 1;
                         }
@@ -1354,8 +1355,11 @@ static int update_cpu_associativity_changes_mask(void)
         return nr_cpus;
 }
 
-/* 6 64-bit registers unpacked into 12 32-bit associativity values */
-#define VPHN_ASSOC_BUFSIZE (6*sizeof(u64)/sizeof(u32))
+/*
+ * 6 64-bit registers unpacked into 12 32-bit associativity values. To form
+ * the complete property we have to add the length in the first cell.
+ */
+#define VPHN_ASSOC_BUFSIZE (6*sizeof(u64)/sizeof(u32) + 1)
 
 /*
  * Convert the associativity domain numbers returned from the hypervisor
@@ -1363,15 +1367,14 @@ static int update_cpu_associativity_changes_mask(void)
  */
 static int vphn_unpack_associativity(const long *packed, unsigned int *unpacked)
 {
-        int i = 0;
-        int nr_assoc_doms = 0;
+        int i, nr_assoc_doms = 0;
         const u16 *field = (const u16*) packed;
 
 #define VPHN_FIELD_UNUSED       (0xffff)
 #define VPHN_FIELD_MSB          (0x8000)
 #define VPHN_FIELD_MASK         (~VPHN_FIELD_MSB)
 
-        for (i = 0; i < VPHN_ASSOC_BUFSIZE; i++) {
+        for (i = 1; i < VPHN_ASSOC_BUFSIZE; i++) {
                 if (*field == VPHN_FIELD_UNUSED) {
                         /* All significant fields processed, and remaining
                          * fields contain the reserved value of all 1's.
@@ -1379,14 +1382,12 @@ static int vphn_unpack_associativity(const long *packed, unsigned int *unpacked)
                          */
                         unpacked[i] = *((u32*)field);
                         field += 2;
-                }
-                else if (*field & VPHN_FIELD_MSB) {
+                } else if (*field & VPHN_FIELD_MSB) {
                         /* Data is in the lower 15 bits of this field */
                         unpacked[i] = *field & VPHN_FIELD_MASK;
                         field++;
                         nr_assoc_doms++;
-                }
-                else {
+                } else {
                         /* Data is in the lower 15 bits of this field
                          * concatenated with the next 16 bit field
                          */
@@ -1396,6 +1397,9 @@ static int vphn_unpack_associativity(const long *packed, unsigned int *unpacked)
                 }
         }
 
+        /* The first cell contains the length of the property */
+        unpacked[0] = nr_assoc_doms;
+
         return nr_assoc_doms;
 }
 
@@ -1405,7 +1409,7 @@ static int vphn_unpack_associativity(const long *packed, unsigned int *unpacked)
  */
 static long hcall_vphn(unsigned long cpu, unsigned int *associativity)
 {
-        long rc = 0;
+        long rc;
         long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
         u64 flags = 1;
         int hwcpu = get_hard_smp_processor_id(cpu);
@@ -1419,7 +1423,7 @@ static long hcall_vphn(unsigned long cpu, unsigned int *associativity)
 static long vphn_get_associativity(unsigned long cpu,
                                         unsigned int *associativity)
 {
-        long rc = 0;
+        long rc;
 
         rc = hcall_vphn(cpu, associativity);
 
@@ -1445,9 +1449,9 @@ static long vphn_get_associativity(unsigned long cpu,
  */
 int arch_update_cpu_topology(void)
 {
-        int cpu = 0, nid = 0, old_nid = 0;
+        int cpu, nid, old_nid;
         unsigned int associativity[VPHN_ASSOC_BUFSIZE] = {0};
-        struct sys_device *sysdev = NULL;
+        struct sys_device *sysdev;
 
         for_each_cpu_mask(cpu, cpu_associativity_changes_mask) {
                 vphn_get_associativity(cpu, associativity);
@@ -1512,7 +1516,8 @@ int start_topology_update(void)
 {
         int rc = 0;
 
-        if (firmware_has_feature(FW_FEATURE_VPHN)) {
+        if (firmware_has_feature(FW_FEATURE_VPHN) &&
+            get_lppaca()->shared_proc) {
                 vphn_enabled = 1;
                 setup_cpu_associativity_change_counters();
                 init_timer_deferrable(&topology_timer);
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 5d3ea9f60dd7..ca5d5898d320 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -713,6 +713,13 @@ EXPORT_SYMBOL(arch_free_page);
 /* NB: reg/unreg are called while guarded with the tracepoints_mutex */
 extern long hcall_tracepoint_refcount;
 
+/* 
+ * Since the tracing code might execute hcalls we need to guard against
+ * recursion. One example of this are spinlocks calling H_YIELD on
+ * shared processor partitions.
+ */
+static DEFINE_PER_CPU(unsigned int, hcall_trace_depth);
+
 void hcall_tracepoint_regfunc(void)
 {
         hcall_tracepoint_refcount++;
@@ -725,12 +732,42 @@ void hcall_tracepoint_unregfunc(void)
 
 void __trace_hcall_entry(unsigned long opcode, unsigned long *args)
 {
+        unsigned long flags;
+        unsigned int *depth;
+
+        local_irq_save(flags);
+
+        depth = &__get_cpu_var(hcall_trace_depth);
+
+        if (*depth)
+                goto out;
+
+        (*depth)++;
         trace_hcall_entry(opcode, args);
+        (*depth)--;
+
+out:
+        local_irq_restore(flags);
 }
 
 void __trace_hcall_exit(long opcode, unsigned long retval,
                         unsigned long *retbuf)
 {
+        unsigned long flags;
+        unsigned int *depth;
+
+        local_irq_save(flags);
+
+        depth = &__get_cpu_var(hcall_trace_depth);
+
+        if (*depth)
+                goto out;
+
+        (*depth)++;
         trace_hcall_exit(opcode, retval, retbuf);
+        (*depth)--;
+
+out:
+        local_irq_restore(flags);
 }
 #endif
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index ff19efdf6fef..636bcb81d068 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -406,7 +406,7 @@ config QDIO
           If unsure, say Y.
 
 config CHSC_SCH
-        def_tristate y
+        def_tristate m
         prompt "Support for CHSC subchannels"
         help
           This driver allows usage of CHSC subchannels. A CHSC subchannel
diff --git a/arch/s390/include/asm/cacheflush.h b/arch/s390/include/asm/cacheflush.h
index 405cc97c6249..7e1f77620624 100644
--- a/arch/s390/include/asm/cacheflush.h
+++ b/arch/s390/include/asm/cacheflush.h
@@ -1,29 +1,8 @@
 #ifndef _S390_CACHEFLUSH_H
 #define _S390_CACHEFLUSH_H
 
-/* Keep includes the same across arches.  */
-#include <linux/mm.h>
-
 /* Caches aren't brain-dead on the s390. */
-#define flush_cache_all()                       do { } while (0)
-#define flush_cache_mm(mm)                      do { } while (0)
-#define flush_cache_dup_mm(mm)                  do { } while (0)
-#define flush_cache_range(vma, start, end)      do { } while (0)
-#define flush_cache_page(vma, vmaddr, pfn)      do { } while (0)
-#define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 0
-#define flush_dcache_page(page)                 do { } while (0)
-#define flush_dcache_mmap_lock(mapping)         do { } while (0)
-#define flush_dcache_mmap_unlock(mapping)       do { } while (0)
-#define flush_icache_range(start, end)          do { } while (0)
-#define flush_icache_page(vma,pg)               do { } while (0)
-#define flush_icache_user_range(vma,pg,adr,len) do { } while (0)
-#define flush_cache_vmap(start, end)            do { } while (0)
-#define flush_cache_vunmap(start, end)          do { } while (0)
-
-#define copy_to_user_page(vma, page, vaddr, dst, src, len) \
-        memcpy(dst, src, len)
-#define copy_from_user_page(vma, page, vaddr, dst, src, len) \
-        memcpy(dst, src, len)
+#include <asm-generic/cacheflush.h>
 
 #ifdef CONFIG_DEBUG_PAGEALLOC
 void kernel_map_pages(struct page *page, int numpages, int enable);
diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
index f1f644f2240a..9074a54c4d10 100644
--- a/arch/s390/include/asm/tlb.h
+++ b/arch/s390/include/asm/tlb.h
@@ -22,6 +22,7 @@
  */
 
 #include <linux/mm.h>
+#include <linux/pagemap.h>
 #include <linux/swap.h>
 #include <asm/processor.h>
 #include <asm/pgalloc.h>
diff --git a/arch/s390/lib/uaccess_std.c b/arch/s390/lib/uaccess_std.c
index 07deaeee14c8..a6c4f7ed24a4 100644
--- a/arch/s390/lib/uaccess_std.c
+++ b/arch/s390/lib/uaccess_std.c
@@ -125,9 +125,9 @@ static size_t copy_in_user_std(size_t size, void __user *to,
         unsigned long tmp1;
 
         asm volatile(
+                "   sacf  256\n"
                 "  "AHI"  %0,-1\n"
                 "   jo    5f\n"
-                "   sacf  256\n"
                 "   bras  %3,3f\n"
                 "0:"AHI"  %0,257\n"
                 "1: mvc   0(1,%1),0(%2)\n"
@@ -142,9 +142,8 @@ static size_t copy_in_user_std(size_t size, void __user *to,
                 "3:"AHI"  %0,-256\n"
                 "   jnm   2b\n"
                 "4: ex    %0,1b-0b(%3)\n"
-                "   sacf  0\n"
                 "5: "SLR"  %0,%0\n"
-                "6:\n"
+                "6: sacf  0\n"
                 EX_TABLE(1b,6b) EX_TABLE(2b,0b) EX_TABLE(4b,0b)
                 : "+a" (size), "+a" (to), "+a" (from), "=a" (tmp1)
                 : : "cc", "memory");
@@ -156,9 +155,9 @@ static size_t clear_user_std(size_t size, void __user *to)
         unsigned long tmp1, tmp2;
 
         asm volatile(
+                "   sacf  256\n"
                 "  "AHI"  %0,-1\n"
                 "   jo    5f\n"
-                "   sacf  256\n"
                 "   bras  %3,3f\n"
                 "   xc    0(1,%1),0(%1)\n"
                 "0:"AHI"  %0,257\n"
@@ -178,9 +177,8 @@ static size_t clear_user_std(size_t size, void __user *to)
                 "3:"AHI"  %0,-256\n"
                 "   jnm   2b\n"
                 "4: ex    %0,0(%3)\n"
-                "   sacf  0\n"
                 "5: "SLR"  %0,%0\n"
-                "6:\n"
+                "6: sacf  0\n"
                 EX_TABLE(1b,6b) EX_TABLE(2b,0b) EX_TABLE(4b,0b)
                 : "+a" (size), "+a" (to), "=a" (tmp1), "=a" (tmp2)
                 : : "cc", "memory");
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 0c719c61972e..e1850c28cd68 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -336,7 +336,8 @@ void page_table_free(struct mm_struct *mm, unsigned long *table)
         page->flags ^= bits;
         if (page->flags & FRAG_MASK) {
                 /* Page now has some free pgtable fragments. */
-                list_move(&page->lru, &mm->context.pgtable_list);
+                if (!list_empty(&page->lru))
+                        list_move(&page->lru, &mm->context.pgtable_list);
                 page = NULL;
         } else
                 /* All fragments of the 4K page have been freed. */
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 4a2d4e0c18d9..8b5393ec1080 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -36,8 +36,6 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
         unsigned cpu = smp_processor_id();
 
         if (likely(prev != next)) {
-                /* stop flush ipis for the previous mm */
-                cpumask_clear_cpu(cpu, mm_cpumask(prev));
 #ifdef CONFIG_SMP
                 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
                 percpu_write(cpu_tlbstate.active_mm, next);
@@ -47,6 +45,9 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
                 /* Re-load page tables */
                 load_cr3(next->pgd);
 
+                /* stop flush ipis for the previous mm */
+                cpumask_clear_cpu(cpu, mm_cpumask(prev));
+
                 /*
                  * load the LDT, if the LDT is different:
                  */
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index 2071a8b2b32f..ebbc4d8ab170 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -558,13 +558,12 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
 static inline void set_pmd_at(struct mm_struct *mm, unsigned long addr,
                               pmd_t *pmdp, pmd_t pmd)
 {
-#if PAGETABLE_LEVELS >= 3
         if (sizeof(pmdval_t) > sizeof(long))
                 /* 5 arg words */
                 pv_mmu_ops.set_pmd_at(mm, addr, pmdp, pmd);
         else
-                PVOP_VCALL4(pv_mmu_ops.set_pmd_at, mm, addr, pmdp, pmd.pmd);
-#endif
+                PVOP_VCALL4(pv_mmu_ops.set_pmd_at, mm, addr, pmdp,
+                            native_pmd_val(pmd));
 }
 #endif
 
diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index 3788f4649db4..7e172955ee57 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -273,34 +273,34 @@ do {									\
         typeof(var) pxo_new__ = (nval);                                 \
         switch (sizeof(var)) {                                          \
         case 1:                                                         \
-                asm("\n1:mov "__percpu_arg(1)",%%al"                    \
-                    "\n\tcmpxchgb %2, "__percpu_arg(1)                  \
+                asm("\n\tmov "__percpu_arg(1)",%%al"                    \
+                    "\n1:\tcmpxchgb %2, "__percpu_arg(1)                \
                     "\n\tjnz 1b"                                        \
-                            : "=a" (pxo_ret__), "+m" (var)              \
+                            : "=&a" (pxo_ret__), "+m" (var)             \
                             : "q" (pxo_new__)                           \
                             : "memory");                                \
                 break;                                                  \
         case 2:                                                         \
-                asm("\n1:mov "__percpu_arg(1)",%%ax"                    \
-                    "\n\tcmpxchgw %2, "__percpu_arg(1)                  \
+                asm("\n\tmov "__percpu_arg(1)",%%ax"                    \
+                    "\n1:\tcmpxchgw %2, "__percpu_arg(1)                \
                     "\n\tjnz 1b"                                        \
-                            : "=a" (pxo_ret__), "+m" (var)              \
+                            : "=&a" (pxo_ret__), "+m" (var)             \
                             : "r" (pxo_new__)                           \
                             : "memory");                                \
                 break;                                                  \
         case 4:                                                         \
-                asm("\n1:mov "__percpu_arg(1)",%%eax"                   \
-                    "\n\tcmpxchgl %2, "__percpu_arg(1)                  \
+                asm("\n\tmov "__percpu_arg(1)",%%eax"                   \
+                    "\n1:\tcmpxchgl %2, "__percpu_arg(1)                \
                     "\n\tjnz 1b"                                        \
-                            : "=a" (pxo_ret__), "+m" (var)              \
+                            : "=&a" (pxo_ret__), "+m" (var)             \
                             : "r" (pxo_new__)                           \
                             : "memory");                                \
                 break;                                                  \
         case 8:                                                         \
-                asm("\n1:mov "__percpu_arg(1)",%%rax"                   \
-                    "\n\tcmpxchgq %2, "__percpu_arg(1)                  \
+                asm("\n\tmov "__percpu_arg(1)",%%rax"                   \
+                    "\n1:\tcmpxchgq %2, "__percpu_arg(1)                \
                     "\n\tjnz 1b"                                        \
-                            : "=a" (pxo_ret__), "+m" (var)              \
+                            : "=&a" (pxo_ret__), "+m" (var)             \
                             : "r" (pxo_new__)                           \
                             : "memory");                                \
                 break;                                                  \
diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
index 3597825a3112..bc6f84e11d32 100644
--- a/arch/x86/include/asm/smp.h
+++ b/arch/x86/include/asm/smp.h
@@ -47,10 +47,7 @@ DECLARE_EARLY_PER_CPU(u16, x86_cpu_to_apicid);
 DECLARE_EARLY_PER_CPU(u16, x86_bios_cpu_apicid);
 
 /* Static state in head.S used to set up a CPU */
-extern struct {
-        void *sp;
-        unsigned short ss;
-} stack_start;
+extern unsigned long stack_start; /* Initial stack pointer address */
 
 struct smp_ops {
         void (*smp_prepare_boot_cpu)(void);
diff --git a/arch/x86/include/asm/system_64.h b/arch/x86/include/asm/system_64.h
deleted file mode 100644
index 1159e091ad09..000000000000
--- a/arch/x86/include/asm/system_64.h
+++ /dev/null
@@ -1,22 +0,0 @@
-#ifndef _ASM_X86_SYSTEM_64_H
-#define _ASM_X86_SYSTEM_64_H
-
-#include <asm/segment.h>
-#include <asm/cmpxchg.h>
-
-
-static inline unsigned long read_cr8(void)
-{
-        unsigned long cr8;
-        asm volatile("movq %%cr8,%0" : "=r" (cr8));
-        return cr8;
-}
-
-static inline void write_cr8(unsigned long val)
-{
-        asm volatile("movq %0,%%cr8" :: "r" (val) : "memory");
-}
-
-#include <linux/irqflags.h>
-
-#endif /* _ASM_X86_SYSTEM_64_H */
diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
index 69fd72aa5594..68d1537b8c81 100644
--- a/arch/x86/kernel/acpi/sleep.c
+++ b/arch/x86/kernel/acpi/sleep.c
@@ -12,10 +12,8 @@
 #include <linux/cpumask.h>
 #include <asm/segment.h>
 #include <asm/desc.h>
-
-#ifdef CONFIG_X86_32
 #include <asm/pgtable.h>
-#endif
+#include <asm/cacheflush.h>
 
 #include "realmode/wakeup.h"
 #include "sleep.h"
@@ -100,7 +98,7 @@ int acpi_save_state_mem(void)
 #else /* CONFIG_64BIT */
         header->trampoline_segment = setup_trampoline() >> 4;
 #ifdef CONFIG_SMP
-        stack_start.sp = temp_stack + sizeof(temp_stack);
+        stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
         early_gdt_descr.address =
                         (unsigned long)get_cpu_gdt_table(smp_processor_id());
         initial_gs = per_cpu_offset(smp_processor_id());
@@ -149,6 +147,15 @@ void __init acpi_reserve_wakeup_memory(void)
         memblock_x86_reserve_range(mem, mem + WAKEUP_SIZE, "ACPI WAKEUP");
 }
 
+int __init acpi_configure_wakeup_memory(void)
+{
+        if (acpi_realmode)
+                set_memory_x(acpi_realmode, WAKEUP_SIZE >> PAGE_SHIFT);
+
+        return 0;
+}
+arch_initcall(acpi_configure_wakeup_memory);
+
 
 static int __init acpi_sleep_setup(char *str)
 {
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index 01c0f3ee6cc3..bebabec5b448 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -793,13 +793,21 @@ void set_mtrr_aps_delayed_init(void)
 }
 
 /*
- * MTRR initialization for all AP's
+ * Delayed MTRR initialization for all AP's
  */
 void mtrr_aps_init(void)
 {
         if (!use_intel())
                 return;
 
+        /*
+         * Check if someone has requested the delay of AP MTRR initialization,
+         * by doing set_mtrr_aps_delayed_init(), prior to this point. If not,
+         * then we are done.
+         */
+        if (!mtrr_aps_delayed_init)
+                return;
+
         set_mtrr(~0U, 0, 0, 0);
         mtrr_aps_delayed_init = false;
 }
diff --git a/arch/x86/kernel/cpu/perf_event_p4.c b/arch/x86/kernel/cpu/perf_event_p4.c
index e56b9bfbabd1..f7a0993c1e7c 100644
--- a/arch/x86/kernel/cpu/perf_event_p4.c
+++ b/arch/x86/kernel/cpu/perf_event_p4.c
@@ -682,7 +682,7 @@ static int p4_validate_raw_event(struct perf_event *event)
          * if an event is shared accross the logical threads
          * the user needs special permissions to be able to use it
          */
-        if (p4_event_bind_map[v].shared) {
+        if (p4_ht_active() && p4_event_bind_map[v].shared) {
                 if (perf_paranoid_cpu() && !capable(CAP_SYS_ADMIN))
                         return -EACCES;
         }
@@ -727,7 +727,8 @@ static int p4_hw_config(struct perf_event *event)
                 event->hw.config = p4_set_ht_bit(event->hw.config);
 
         if (event->attr.type == PERF_TYPE_RAW) {
-
+                struct p4_event_bind *bind;
+                unsigned int esel;
                 /*
                  * Clear bits we reserve to be managed by kernel itself
                  * and never allowed from a user space
@@ -743,6 +744,13 @@ static int p4_hw_config(struct perf_event *event)
                  * bits since we keep additional info here (for cache events and etc)
                  */
                 event->hw.config |= event->attr.config;
+                bind = p4_config_get_bind(event->attr.config);
+                if (!bind) {
+                        rc = -EINVAL;
+                        goto out;
+                }
+                esel = P4_OPCODE_ESEL(bind->opcode);
+                event->hw.config |= p4_config_pack_cccr(P4_CCCR_ESEL(esel));
         }
 
         rc = x86_setup_perfctr(event);
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index 64101335de19..a6b6fcf7f0ae 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -149,13 +149,13 @@ void dump_trace(struct task_struct *task,
         unsigned used = 0;
         struct thread_info *tinfo;
         int graph = 0;
+        unsigned long dummy;
         unsigned long bp;
 
         if (!task)
                 task = current;
 
         if (!stack) {
-                unsigned long dummy;
                 stack = &dummy;
                 if (task && task != current)
                         stack = (unsigned long *)task->thread.sp;
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index fc293dc8dc35..767d6c43de37 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -85,6 +85,8 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
  */
 __HEAD
 ENTRY(startup_32)
+        movl pa(stack_start),%ecx
+        
         /* test KEEP_SEGMENTS flag to see if the bootloader is asking
                 us to not reload segments */
         testb $(1<<6), BP_loadflags(%esi)
@@ -99,7 +101,9 @@ ENTRY(startup_32)
         movl %eax,%es
         movl %eax,%fs
         movl %eax,%gs
+        movl %eax,%ss
 2:
+        leal -__PAGE_OFFSET(%ecx),%esp
 
 /*
  * Clear BSS first so that there are no surprises...
@@ -145,8 +149,6 @@ ENTRY(startup_32)
  * _brk_end is set up to point to the first "safe" location.
  * Mappings are created both at virtual address 0 (identity mapping)
  * and PAGE_OFFSET for up to _end.
- *
- * Note that the stack is not yet set up!
  */
 #ifdef CONFIG_X86_PAE
 
@@ -282,6 +284,9 @@ ENTRY(startup_32_smp)
         movl %eax,%es
         movl %eax,%fs
         movl %eax,%gs
+        movl pa(stack_start),%ecx
+        movl %eax,%ss
+        leal -__PAGE_OFFSET(%ecx),%esp
 #endif /* CONFIG_SMP */
 default_entry:
 
@@ -347,8 +352,8 @@ default_entry:
         movl %eax,%cr0          /* ..and set paging (PG) bit */
         ljmp $__BOOT_CS,$1f     /* Clear prefetch and normalize %eip */
 1:
-        /* Set up the stack pointer */
-        lss stack_start,%esp
+        /* Shift the stack pointer to a virtual address */
+        addl $__PAGE_OFFSET, %esp
 
 /*
  * Initialize eflags.  Some BIOS's leave bits like NT set.  This would
@@ -360,9 +365,7 @@ default_entry:
 
 #ifdef CONFIG_SMP
         cmpb $0, ready
-        jz  1f                          /* Initial CPU cleans BSS */
-        jmp checkCPUtype
-1:
+        jnz checkCPUtype
 #endif /* CONFIG_SMP */
 
 /*
@@ -470,14 +473,7 @@ is386:	movl $2,%ecx		# set MP
 
         cld                     # gcc2 wants the direction flag cleared at all times
         pushl $0                # fake return address for unwinder
-#ifdef CONFIG_SMP
-        movb ready, %cl
         movb $1, ready
-        cmpb $0,%cl             # the first CPU calls start_kernel
-        je   1f
-        movl (stack_start), %esp
-1:
-#endif /* CONFIG_SMP */
         jmp *(initial_code)
 
 /*
@@ -670,15 +666,15 @@ ENTRY(initial_page_table)
 #endif
 
 .data
+.balign 4
 ENTRY(stack_start)
         .long init_thread_union+THREAD_SIZE
-        .long __BOOT_DS
-
-ready:  .byte 0
 
 early_recursion_flag:
         .long 0
 
+ready:  .byte 0
+
 int_msg:
         .asciz "Unknown interrupt or fault at: %p %p %p\n"
 
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index a7a3d1acc632..592214d99b43 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -620,7 +620,7 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
          * target processor state.
          */
         startup_ipi_hook(phys_apicid, (unsigned long) start_secondary,
-                         (unsigned long)stack_start.sp);
+                         stack_start);
 
         /*
          * Run STARTUP IPI loop.
@@ -767,7 +767,7 @@ do_rest:
 #endif
         early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
         initial_code = (unsigned long)start_secondary;
-        stack_start.sp = (void *) c_idle.idle->thread.sp;
+        stack_start  = c_idle.idle->thread.sp;
 
         /* start_ip had better be page-aligned! */
         start_ip = setup_trampoline();
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 8b830ca14ac4..d343b3c81f3c 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -256,7 +256,6 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
                                    unsigned long pfn)
 {
         pgprot_t forbidden = __pgprot(0);
-        pgprot_t required = __pgprot(0);
 
         /*
          * The BIOS area between 640k and 1Mb needs to be executable for
@@ -282,12 +281,6 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
         if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
                    __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
                 pgprot_val(forbidden) |= _PAGE_RW;
-        /*
-         * .data and .bss should always be writable.
-         */
-        if (within(address, (unsigned long)_sdata, (unsigned long)_edata) ||
-            within(address, (unsigned long)__bss_start, (unsigned long)__bss_stop))
-                pgprot_val(required) |= _PAGE_RW;
 
 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
         /*
@@ -327,7 +320,6 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
 #endif
 
         prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
-        prot = __pgprot(pgprot_val(prot) | pgprot_val(required));
 
         return prot;
 }
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index ddc81a06edb9..fd12d7ce7ff9 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -241,21 +241,15 @@ void __init xen_build_dynamic_phys_to_machine(void)
                  * As long as the mfn_list has enough entries to completely
                  * fill a p2m page, pointing into the array is ok. But if
                  * not the entries beyond the last pfn will be undefined.
-                 * And guessing that the 'what-ever-there-is' does not take it
-                 * too kindly when changing it to invalid markers, a new page
-                 * is allocated, initialized and filled with the valid part.
                  */
                 if (unlikely(pfn + P2M_PER_PAGE > max_pfn)) {
                         unsigned long p2midx;
-                        unsigned long *p2m = extend_brk(PAGE_SIZE, PAGE_SIZE);
-                        p2m_init(p2m);
-
-                        for (p2midx = 0; pfn + p2midx < max_pfn; p2midx++) {
-                                p2m[p2midx] = mfn_list[pfn + p2midx];
-                        }
-                        p2m_top[topidx][mididx] = p2m;
-                } else
-                        p2m_top[topidx][mididx] = &mfn_list[pfn];
+
+                        p2midx = max_pfn % P2M_PER_PAGE;
+                        for ( ; p2midx < P2M_PER_PAGE; p2midx++)
+                                mfn_list[pfn + p2midx] = INVALID_P2M_ENTRY;
+                }
+                p2m_top[topidx][mididx] = &mfn_list[pfn];
         }
 
         m2p_override_init();
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index b5a7f928234b..a8a66a50d446 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -179,8 +179,13 @@ char * __init xen_memory_setup(void)
         e820.nr_map = 0;
         xen_extra_mem_start = mem_end;
         for (i = 0; i < memmap.nr_entries; i++) {
-                unsigned long long end = map[i].addr + map[i].size;
+                unsigned long long end;
 
+                /* Guard against non-page aligned E820 entries. */
+                if (map[i].type == E820_RAM)
+                        map[i].size -= (map[i].size + map[i].addr) % PAGE_SIZE;
+
+                end = map[i].addr + map[i].size;
                 if (map[i].type == E820_RAM && end > mem_end) {
                         /* RAM off the end - may be partially included */
                         u64 delta = min(map[i].size, end - mem_end);
@@ -350,6 +355,7 @@ void __init xen_arch_setup(void)
         boot_cpu_data.hlt_works_ok = 1;
 #endif
         pm_idle = default_idle;
+        boot_option_idle_override = IDLE_HALT;
 
         fiddle_vdso();
 }
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 328826381a2d..b8d96ce37fc9 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -260,6 +260,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x1d02), board_ahci }, /* PBG AHCI */
         { PCI_VDEVICE(INTEL, 0x1d04), board_ahci }, /* PBG RAID */
         { PCI_VDEVICE(INTEL, 0x1d06), board_ahci }, /* PBG RAID */
+        { PCI_VDEVICE(INTEL, 0x2323), board_ahci }, /* DH89xxCC AHCI */
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
@@ -379,6 +380,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(MARVELL, 0x6145), board_ahci_mv },        /* 6145 */
         { PCI_VDEVICE(MARVELL, 0x6121), board_ahci_mv },        /* 6121 */
         { PCI_DEVICE(0x1b4b, 0x9123),
+          .class = PCI_CLASS_STORAGE_SATA_AHCI,
+          .class_mask = 0xffffff,
           .driver_data = board_ahci_yes_fbs },                  /* 88se9128 */
 
         /* Promise */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index a31fe96f7de6..d4e52e214859 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4138,6 +4138,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
          * device and controller are SATA.
          */
         { "PIONEER DVD-RW  DVRTD08",    "1.00", ATA_HORKAGE_NOSETXFER },
+        { "PIONEER DVD-RW  DVR-212D",   "1.28", ATA_HORKAGE_NOSETXFER },
 
         /* End Marker */
         { }
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 5defc74973d7..600f6353ecf8 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1099,9 +1099,9 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
                 struct request_queue *q = sdev->request_queue;
                 void *buf;
 
-                /* set the min alignment and padding */
-                blk_queue_update_dma_alignment(sdev->request_queue,
-                                               ATA_DMA_PAD_SZ - 1);
+                sdev->sector_size = ATA_SECT_SIZE;
+
+                /* set DMA padding */
                 blk_queue_update_dma_pad(sdev->request_queue,
                                          ATA_DMA_PAD_SZ - 1);
 
@@ -1115,13 +1115,25 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
 
                 blk_queue_dma_drain(q, atapi_drain_needed, buf, ATAPI_MAX_DRAIN);
         } else {
-                /* ATA devices must be sector aligned */
                 sdev->sector_size = ata_id_logical_sector_size(dev->id);
-                blk_queue_update_dma_alignment(sdev->request_queue,
-                                               sdev->sector_size - 1);
                 sdev->manage_start_stop = 1;
         }
 
+        /*
+         * ata_pio_sectors() expects buffer for each sector to not cross
+         * page boundary.  Enforce it by requiring buffers to be sector
+         * aligned, which works iff sector_size is not larger than
+         * PAGE_SIZE.  ATAPI devices also need the alignment as
+         * IDENTIFY_PACKET is executed as ATA_PROT_PIO.
+         */
+        if (sdev->sector_size > PAGE_SIZE)
+                ata_dev_printk(dev, KERN_WARNING,
+                        "sector_size=%u > PAGE_SIZE, PIO may malfunction\n",
+                        sdev->sector_size);
+
+        blk_queue_update_dma_alignment(sdev->request_queue,
+                                       sdev->sector_size - 1);
+
         if (dev->flags & ATA_DFLAG_AN)
                 set_bit(SDEV_EVT_MEDIA_CHANGE, sdev->supported_events);
 
diff --git a/drivers/ata/pata_hpt366.c b/drivers/ata/pata_hpt366.c
index d7e57db36bc8..538ec38ba995 100644
--- a/drivers/ata/pata_hpt366.c
+++ b/drivers/ata/pata_hpt366.c
@@ -25,7 +25,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt366"
-#define DRV_VERSION     "0.6.9"
+#define DRV_VERSION     "0.6.10"
 
 struct hpt_clock {
         u8      xfer_mode;
@@ -160,8 +160,8 @@ static int hpt_dma_blacklisted(const struct ata_device *dev, char *modestr,
 
         while (list[i] != NULL) {
                 if (!strcmp(list[i], model_num)) {
-                        printk(KERN_WARNING DRV_NAME ": %s is not supported for %s.\n",
-                                modestr, list[i]);
+                        pr_warning(DRV_NAME ": %s is not supported for %s.\n",
+                                   modestr, list[i]);
                         return 1;
                 }
                 i++;
diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
index efdd18bc8663..4c5b5183225e 100644
--- a/drivers/ata/pata_hpt37x.c
+++ b/drivers/ata/pata_hpt37x.c
@@ -24,7 +24,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt37x"
-#define DRV_VERSION     "0.6.18"
+#define DRV_VERSION     "0.6.22"
 
 struct hpt_clock {
         u8      xfer_speed;
@@ -229,8 +229,8 @@ static int hpt_dma_blacklisted(const struct ata_device *dev, char *modestr,
 
         while (list[i] != NULL) {
                 if (!strcmp(list[i], model_num)) {
-                        printk(KERN_WARNING DRV_NAME ": %s is not supported for %s.\n",
-                                modestr, list[i]);
+                        pr_warning(DRV_NAME ": %s is not supported for %s.\n",
+                                   modestr, list[i]);
                         return 1;
                 }
                 i++;
@@ -642,7 +642,6 @@ static struct ata_port_operations hpt372_port_ops = {
 static struct ata_port_operations hpt374_fn1_port_ops = {
         .inherits       = &hpt372_port_ops,
         .cable_detect   = hpt374_fn1_cable_detect,
-        .prereset       = hpt37x_pre_reset,
 };
 
 /**
@@ -803,7 +802,7 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                 .udma_mask = ATA_UDMA6,
                 .port_ops = &hpt302_port_ops
         };
-        /* HPT374 - UDMA100, function 1 uses different prereset method */
+        /* HPT374 - UDMA100, function 1 uses different cable_detect method */
         static const struct ata_port_info info_hpt374_fn0 = {
                 .flags = ATA_FLAG_SLAVE_POSS,
                 .pio_mask = ATA_PIO4,
@@ -838,7 +837,8 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
         if (rc)
                 return rc;
 
-        if (dev->device == PCI_DEVICE_ID_TTI_HPT366) {
+        switch (dev->device) {
+        case PCI_DEVICE_ID_TTI_HPT366:
                 /* May be a later chip in disguise. Check */
                 /* Older chips are in the HPT366 driver. Ignore them */
                 if (rev < 3)
@@ -863,54 +863,50 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                         chip_table = &hpt372;
                         break;
                 default:
-                        printk(KERN_ERR "pata_hpt37x: Unknown HPT366 subtype, "
+                        pr_err(DRV_NAME ": Unknown HPT366 subtype, "
                                "please report (%d).\n", rev);
                         return -ENODEV;
                 }
-        } else {
-                switch (dev->device) {
-                case PCI_DEVICE_ID_TTI_HPT372:
-                        /* 372N if rev >= 2 */
-                        if (rev >= 2)
-                                return -ENODEV;
-                        ppi[0] = &info_hpt372;
-                        chip_table = &hpt372a;
-                        break;
-                case PCI_DEVICE_ID_TTI_HPT302:
-                        /* 302N if rev > 1 */
-                        if (rev > 1)
-                                return -ENODEV;
-                        ppi[0] = &info_hpt302;
-                        /* Check this */
-                        chip_table = &hpt302;
-                        break;
-                case PCI_DEVICE_ID_TTI_HPT371:
-                        if (rev > 1)
-                                return -ENODEV;
-                        ppi[0] = &info_hpt302;
-                        chip_table = &hpt371;
-                        /*
-                         * Single channel device, master is not present
-                         * but the BIOS (or us for non x86) must mark it
-                         * absent
-                         */
-                        pci_read_config_byte(dev, 0x50, &mcr1);
-                        mcr1 &= ~0x04;
-                        pci_write_config_byte(dev, 0x50, mcr1);
-                        break;
-                case PCI_DEVICE_ID_TTI_HPT374:
-                        chip_table = &hpt374;
-                        if (!(PCI_FUNC(dev->devfn) & 1))
-                                *ppi = &info_hpt374_fn0;
-                        else
-                                *ppi = &info_hpt374_fn1;
-                        break;
-                default:
-                        printk(KERN_ERR
-                               "pata_hpt37x: PCI table is bogus, please report (%d).\n",
-                               dev->device);
-                                return -ENODEV;
-                }
+                break;
+        case PCI_DEVICE_ID_TTI_HPT372:
+                /* 372N if rev >= 2 */
+                if (rev >= 2)
+                        return -ENODEV;
+                ppi[0] = &info_hpt372;
+                chip_table = &hpt372a;
+                break;
+        case PCI_DEVICE_ID_TTI_HPT302:
+                /* 302N if rev > 1 */
+                if (rev > 1)
+                        return -ENODEV;
+                ppi[0] = &info_hpt302;
+                /* Check this */
+                chip_table = &hpt302;
+                break;
+        case PCI_DEVICE_ID_TTI_HPT371:
+                if (rev > 1)
+                        return -ENODEV;
+                ppi[0] = &info_hpt302;
+                chip_table = &hpt371;
+                /*
+                 * Single channel device, master is not present but the BIOS
+                 * (or us for non x86) must mark it absent
+                 */
+                pci_read_config_byte(dev, 0x50, &mcr1);
+                mcr1 &= ~0x04;
+                pci_write_config_byte(dev, 0x50, mcr1);
+                break;
+        case PCI_DEVICE_ID_TTI_HPT374:
+                chip_table = &hpt374;
+                if (!(PCI_FUNC(dev->devfn) & 1))
+                        *ppi = &info_hpt374_fn0;
+                else
+                        *ppi = &info_hpt374_fn1;
+                break;
+        default:
+                pr_err(DRV_NAME ": PCI table is bogus, please report (%d).\n",
+                       dev->device);
+                return -ENODEV;
         }
         /* Ok so this is a chip we support */
 
@@ -957,8 +953,7 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                 u8 sr;
                 u32 total = 0;
 
-                printk(KERN_WARNING
-                       "pata_hpt37x: BIOS has not set timing clocks.\n");
+                pr_warning(DRV_NAME ": BIOS has not set timing clocks.\n");
 
                 /* This is the process the HPT371 BIOS is reported to use */
                 for (i = 0; i < 128; i++) {
@@ -1014,7 +1009,7 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                                                (f_high << 16) | f_low | 0x100);
                 }
                 if (adjust == 8) {
-                        printk(KERN_ERR "pata_hpt37x: DPLL did not stabilize!\n");
+                        pr_err(DRV_NAME ": DPLL did not stabilize!\n");
                         return -ENODEV;
                 }
                 if (dpll == 3)
@@ -1022,8 +1017,8 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                 else
                         private_data = (void *)hpt37x_timings_50;
 
-                printk(KERN_INFO "pata_hpt37x: bus clock %dMHz, using %dMHz DPLL.\n",
-                       MHz[clock_slot], MHz[dpll]);
+                pr_info(DRV_NAME ": bus clock %dMHz, using %dMHz DPLL.\n",
+                        MHz[clock_slot], MHz[dpll]);
         } else {
                 private_data = (void *)chip_table->clocks[clock_slot];
                 /*
@@ -1036,8 +1031,9 @@ static int hpt37x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
                         ppi[0] = &info_hpt370_33;
                 if (clock_slot < 2 && ppi[0] == &info_hpt370a)
                         ppi[0] = &info_hpt370a_33;
-                printk(KERN_INFO "pata_hpt37x: %s using %dMHz bus clock.\n",
-                       chip_table->name, MHz[clock_slot]);
+
+                pr_info(DRV_NAME ": %s using %dMHz bus clock.\n",
+                        chip_table->name, MHz[clock_slot]);
         }
 
         /* Now kick off ATA set up */
diff --git a/drivers/ata/pata_hpt3x2n.c b/drivers/ata/pata_hpt3x2n.c
index d2239bbdb798..eca68caf5f46 100644
--- a/drivers/ata/pata_hpt3x2n.c
+++ b/drivers/ata/pata_hpt3x2n.c
@@ -25,7 +25,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt3x2n"
-#define DRV_VERSION     "0.3.13"
+#define DRV_VERSION     "0.3.14"
 
 enum {
         HPT_PCI_FAST    =       (1 << 31),
@@ -418,7 +418,7 @@ static int hpt3x2n_pci_clock(struct pci_dev *pdev)
                 u16 sr;
                 u32 total = 0;
 
-                printk(KERN_WARNING "pata_hpt3x2n: BIOS clock data not set.\n");
+                pr_warning(DRV_NAME ": BIOS clock data not set.\n");
 
                 /* This is the process the HPT371 BIOS is reported to use */
                 for (i = 0; i < 128; i++) {
@@ -528,8 +528,7 @@ hpt372n:
                 ppi[0] = &info_hpt372n;
                 break;
         default:
-                printk(KERN_ERR
-                       "pata_hpt3x2n: PCI table is bogus please report (%d).\n",
+                pr_err(DRV_NAME ": PCI table is bogus, please report (%d).\n",
                        dev->device);
                 return -ENODEV;
         }
@@ -579,12 +578,11 @@ hpt372n:
                 pci_write_config_dword(dev, 0x5C, (f_high << 16) | f_low);
         }
         if (adjust == 8) {
-                printk(KERN_ERR "pata_hpt3x2n: DPLL did not stabilize!\n");
+                pr_err(DRV_NAME ": DPLL did not stabilize!\n");
                 return -ENODEV;
         }
 
-        printk(KERN_INFO "pata_hpt37x: bus clock %dMHz, using 66MHz DPLL.\n",
-               pci_mhz);
+        pr_info(DRV_NAME ": bus clock %dMHz, using 66MHz DPLL.\n", pci_mhz);
 
         /*
          * Set our private data up. We only need a few flags
diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
index 8cc536e49a0a..d7d8026cde99 100644
--- a/drivers/ata/pata_mpc52xx.c
+++ b/drivers/ata/pata_mpc52xx.c
@@ -610,7 +610,7 @@ static struct scsi_host_template mpc52xx_ata_sht = {
 };
 
 static struct ata_port_operations mpc52xx_ata_port_ops = {
-        .inherits               = &ata_sff_port_ops,
+        .inherits               = &ata_bmdma_port_ops,
         .sff_dev_select         = mpc52xx_ata_dev_select,
         .set_piomode            = mpc52xx_ata_set_piomode,
         .set_dmamode            = mpc52xx_ata_set_dmamode,
diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c
index bca9cb89a118..487a54739854 100644
--- a/drivers/atm/idt77105.c
+++ b/drivers/atm/idt77105.c
@@ -151,7 +151,7 @@ static int fetch_stats(struct atm_dev *dev,struct idt77105_stats __user *arg,int
         spin_unlock_irqrestore(&idt77105_priv_lock, flags);
         if (arg == NULL)
                 return 0;
-        return copy_to_user(arg, &PRIV(dev)->stats,
+        return copy_to_user(arg, &stats,
                     sizeof(struct idt77105_stats)) ? -EFAULT : 0;
 }
 
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index 656493a5e073..42615b419dfb 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -407,12 +407,15 @@ static int rpm_suspend(struct device *dev, int rpmflags)
                 goto out;
         }
 
+        /* Maybe the parent is now able to suspend. */
         if (parent && !parent->power.ignore_children && !dev->power.irq_safe) {
-                spin_unlock_irq(&dev->power.lock);
+                spin_unlock(&dev->power.lock);
 
-                pm_request_idle(parent);
+                spin_lock(&parent->power.lock);
+                rpm_idle(parent, RPM_ASYNC);
+                spin_unlock(&parent->power.lock);
 
-                spin_lock_irq(&dev->power.lock);
+                spin_lock(&dev->power.lock);
         }
 
  out:
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 949ed09c6361..a126e614601f 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -47,46 +47,40 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);
 #define USB_REQ_DFU_DNLOAD      1
 #define BULK_SIZE               4096
 
-struct ath3k_data {
-        struct usb_device *udev;
-        u8 *fw_data;
-        u32 fw_size;
-        u32 fw_sent;
-};
-
-static int ath3k_load_firmware(struct ath3k_data *data,
-                                unsigned char *firmware,
-                                int count)
+static int ath3k_load_firmware(struct usb_device *udev,
+                                const struct firmware *firmware)
 {
         u8 *send_buf;
         int err, pipe, len, size, sent = 0;
+        int count = firmware->size;
 
-        BT_DBG("ath3k %p udev %p", data, data->udev);
+        BT_DBG("udev %p", udev);
 
-        pipe = usb_sndctrlpipe(data->udev, 0);
+        pipe = usb_sndctrlpipe(udev, 0);
 
-        if ((usb_control_msg(data->udev, pipe,
+        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+        if (!send_buf) {
+                BT_ERR("Can't allocate memory chunk for firmware");
+                return -ENOMEM;
+        }
+
+        memcpy(send_buf, firmware->data, 20);
+        if ((err = usb_control_msg(udev, pipe,
                                 USB_REQ_DFU_DNLOAD,
                                 USB_TYPE_VENDOR, 0, 0,
-                                firmware, 20, USB_CTRL_SET_TIMEOUT)) < 0) {
+                                send_buf, 20, USB_CTRL_SET_TIMEOUT)) < 0) {
                 BT_ERR("Can't change to loading configuration err");
-                return -EBUSY;
+                goto error;
         }
         sent += 20;
         count -= 20;
 
-        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
-        if (!send_buf) {
-                BT_ERR("Can't allocate memory chunk for firmware");
-                return -ENOMEM;
-        }
-
         while (count) {
                 size = min_t(uint, count, BULK_SIZE);
-                pipe = usb_sndbulkpipe(data->udev, 0x02);
-                memcpy(send_buf, firmware + sent, size);
+                pipe = usb_sndbulkpipe(udev, 0x02);
+                memcpy(send_buf, firmware->data + sent, size);
 
-                err = usb_bulk_msg(data->udev, pipe, send_buf, size,
+                err = usb_bulk_msg(udev, pipe, send_buf, size,
                                         &len, 3000);
 
                 if (err || (len != size)) {
@@ -112,57 +106,28 @@ static int ath3k_probe(struct usb_interface *intf,
 {
         const struct firmware *firmware;
         struct usb_device *udev = interface_to_usbdev(intf);
-        struct ath3k_data *data;
-        int size;
 
         BT_DBG("intf %p id %p", intf, id);
 
         if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
                 return -ENODEV;
 
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
-        if (!data)
-                return -ENOMEM;
-
-        data->udev = udev;
-
         if (request_firmware(&firmware, "ath3k-1.fw", &udev->dev) < 0) {
-                kfree(data);
                 return -EIO;
         }
 
-        size = max_t(uint, firmware->size, 4096);
-        data->fw_data = kmalloc(size, GFP_KERNEL);
-        if (!data->fw_data) {
+        if (ath3k_load_firmware(udev, firmware)) {
                 release_firmware(firmware);
-                kfree(data);
-                return -ENOMEM;
-        }
-
-        memcpy(data->fw_data, firmware->data, firmware->size);
-        data->fw_size = firmware->size;
-        data->fw_sent = 0;
-        release_firmware(firmware);
-
-        usb_set_intfdata(intf, data);
-        if (ath3k_load_firmware(data, data->fw_data, data->fw_size)) {
-                usb_set_intfdata(intf, NULL);
-                kfree(data->fw_data);
-                kfree(data);
                 return -EIO;
         }
+        release_firmware(firmware);
 
         return 0;
 }
 
 static void ath3k_disconnect(struct usb_interface *intf)
 {
-        struct ath3k_data *data = usb_get_intfdata(intf);
-
         BT_DBG("ath3k_disconnect intf %p", intf);
-
-        kfree(data->fw_data);
-        kfree(data);
 }
 
 static struct usb_driver ath3k_driver = {
diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
index fcd867d923ba..d8b1b576556c 100644
--- a/drivers/char/agp/Kconfig
+++ b/drivers/char/agp/Kconfig
@@ -50,7 +50,7 @@ config AGP_ATI
 
 config AGP_AMD
         tristate "AMD Irongate, 761, and 762 chipset support"
-        depends on AGP && (X86_32 || ALPHA)
+        depends on AGP && X86_32
         help
           This option gives you AGP support for the GLX component of
           X on AMD Irongate, 761, and 762 chipsets.
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index b1b4362bc648..45681c0ff3b6 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -41,22 +41,8 @@ static int amd_create_page_map(struct amd_page_map *page_map)
         if (page_map->real == NULL)
                 return -ENOMEM;
 
-#ifndef CONFIG_X86
-        SetPageReserved(virt_to_page(page_map->real));
-        global_cache_flush();
-        page_map->remapped = ioremap_nocache(virt_to_phys(page_map->real),
-                                            PAGE_SIZE);
-        if (page_map->remapped == NULL) {
-                ClearPageReserved(virt_to_page(page_map->real));
-                free_page((unsigned long) page_map->real);
-                page_map->real = NULL;
-                return -ENOMEM;
-        }
-        global_cache_flush();
-#else
         set_memory_uc((unsigned long)page_map->real, 1);
         page_map->remapped = page_map->real;
-#endif
 
         for (i = 0; i < PAGE_SIZE / sizeof(unsigned long); i++) {
                 writel(agp_bridge->scratch_page, page_map->remapped+i);
@@ -68,12 +54,7 @@ static int amd_create_page_map(struct amd_page_map *page_map)
 
 static void amd_free_page_map(struct amd_page_map *page_map)
 {
-#ifndef CONFIG_X86
-        iounmap(page_map->remapped);
-        ClearPageReserved(virt_to_page(page_map->real));
-#else
         set_memory_wb((unsigned long)page_map->real, 1);
-#endif
         free_page((unsigned long) page_map->real);
 }
 
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 857df10c0428..b0a0dccc98c1 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -774,20 +774,14 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
         dev_info(&pdev->dev, "Intel %s Chipset\n", intel_agp_chipsets[i].name);
 
         /*
-        * If the device has not been properly setup, the following will catch
-        * the problem and should stop the system from crashing.
-        * 20030610 - hamish@zot.org
-        */
-        if (pci_enable_device(pdev)) {
-                dev_err(&pdev->dev, "can't enable PCI device\n");
-                agp_put_bridge(bridge);
-                return -ENODEV;
-        }
-
-        /*
         * The following fixes the case where the BIOS has "forgotten" to
         * provide an address range for the GART.
         * 20030610 - hamish@zot.org
+        * This happens before pci_enable_device() intentionally;
+        * calling pci_enable_device() before assigning the resource
+        * will result in the GART being disabled on machines with such
+        * BIOSs (the GART ends up with a BAR starting at 0, which
+        * conflicts a lot of other devices).
         */
         r = &pdev->resource[0];
         if (!r->start && r->end) {
@@ -798,6 +792,17 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
                 }
         }
 
+        /*
+        * If the device has not been properly setup, the following will catch
+        * the problem and should stop the system from crashing.
+        * 20030610 - hamish@zot.org
+        */
+        if (pci_enable_device(pdev)) {
+                dev_err(&pdev->dev, "can't enable PCI device\n");
+                agp_put_bridge(bridge);
+                return -ENODEV;
+        }
+
         /* Fill in the mode register */
         if (cap_ptr) {
                 pci_read_config_dword(pdev,
diff --git a/drivers/char/bfin_jtag_comm.c b/drivers/char/bfin_jtag_comm.c
index e397df3ad98e..16402445f2b2 100644
--- a/drivers/char/bfin_jtag_comm.c
+++ b/drivers/char/bfin_jtag_comm.c
@@ -183,16 +183,16 @@ bfin_jc_circ_write(const unsigned char *buf, int count)
 }
 
 #ifndef CONFIG_BFIN_JTAG_COMM_CONSOLE
-# define acquire_console_sem()
-# define release_console_sem()
+# define console_lock()
+# define console_unlock()
 #endif
 static int
 bfin_jc_write(struct tty_struct *tty, const unsigned char *buf, int count)
 {
         int i;
-        acquire_console_sem();
+        console_lock();
         i = bfin_jc_circ_write(buf, count);
-        release_console_sem();
+        console_unlock();
         wake_up_process(bfin_jc_kthread);
         return i;
 }
diff --git a/drivers/clocksource/tcb_clksrc.c b/drivers/clocksource/tcb_clksrc.c
index 01b886e68822..79c47e88d5d1 100644
--- a/drivers/clocksource/tcb_clksrc.c
+++ b/drivers/clocksource/tcb_clksrc.c
@@ -196,9 +196,9 @@ static void __init setup_clkevents(struct atmel_tc *tc, int clk32k_divisor_idx)
         clkevt.clkevt.min_delta_ns = clockevent_delta2ns(1, &clkevt.clkevt) + 1;
         clkevt.clkevt.cpumask = cpumask_of(0);
 
-        setup_irq(irq, &tc_irqaction);
-
         clockevents_register_device(&clkevt.clkevt);
+
+        setup_irq(irq, &tc_irqaction);
 }
 
 #else /* !CONFIG_GENERIC_CLOCKEVENTS */
diff --git a/drivers/gpio/langwell_gpio.c b/drivers/gpio/langwell_gpio.c
index d81cc748e77f..54d70a47afc1 100644
--- a/drivers/gpio/langwell_gpio.c
+++ b/drivers/gpio/langwell_gpio.c
@@ -187,7 +187,7 @@ MODULE_DEVICE_TABLE(pci, lnw_gpio_ids);
 
 static void lnw_irq_handler(unsigned irq, struct irq_desc *desc)
 {
-        struct lnw_gpio *lnw = (struct lnw_gpio *)get_irq_data(irq);
+        struct lnw_gpio *lnw = get_irq_data(irq);
         u32 base, gpio;
         void __iomem *gedr;
         u32 gedr_v;
@@ -206,7 +206,12 @@ static void lnw_irq_handler(unsigned irq, struct irq_desc *desc)
                 /* clear the edge detect status bit */
                 writel(gedr_v, gedr);
         }
-        desc->chip->eoi(irq);
+
+        if (desc->chip->irq_eoi)
+                desc->chip->irq_eoi(irq_get_irq_data(irq));
+        else
+                dev_warn(lnw->chip.dev, "missing EOI handler for irq %d\n", irq);
+
 }
 
 static int __devinit lnw_gpio_probe(struct pci_dev *pdev,
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 2baa6708e44c..654faa803dcb 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -2674,3 +2674,23 @@ out:
         mutex_unlock(&dev->mode_config.mutex);
         return ret;
 }
+
+void drm_mode_config_reset(struct drm_device *dev)
+{
+        struct drm_crtc *crtc;
+        struct drm_encoder *encoder;
+        struct drm_connector *connector;
+
+        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+                if (crtc->funcs->reset)
+                        crtc->funcs->reset(crtc);
+
+        list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
+                if (encoder->funcs->reset)
+                        encoder->funcs->reset(encoder);
+
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head)
+                if (connector->funcs->reset)
+                        connector->funcs->reset(connector);
+}
+EXPORT_SYMBOL(drm_mode_config_reset);
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 952b3d4fb2a6..92369655dca3 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -343,13 +343,12 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         struct drm_encoder *encoder;
         bool ret = true;
 
-        adjusted_mode = drm_mode_duplicate(dev, mode);
-
         crtc->enabled = drm_helper_crtc_in_use(crtc);
-
         if (!crtc->enabled)
                 return true;
 
+        adjusted_mode = drm_mode_duplicate(dev, mode);
+
         saved_hwmode = crtc->hwmode;
         saved_mode = crtc->mode;
         saved_x = crtc->x;
@@ -437,10 +436,9 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
          */
         drm_calc_timestamping_constants(crtc);
 
-        /* XXX free adjustedmode */
-        drm_mode_destroy(dev, adjusted_mode);
         /* FIXME: add subpixel order */
 done:
+        drm_mode_destroy(dev, adjusted_mode);
         if (!ret) {
                 crtc->hwmode = saved_hwmode;
                 crtc->mode = saved_mode;
@@ -497,14 +495,17 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
 
         crtc_funcs = set->crtc->helper_private;
 
+        if (!set->mode)
+                set->fb = NULL;
+
         if (set->fb) {
                 DRM_DEBUG_KMS("[CRTC:%d] [FB:%d] #connectors=%d (x y) (%i %i)\n",
                                 set->crtc->base.id, set->fb->base.id,
                                 (int)set->num_connectors, set->x, set->y);
         } else {
-                DRM_DEBUG_KMS("[CRTC:%d] [NOFB] #connectors=%d (x y) (%i %i)\n",
-                                set->crtc->base.id, (int)set->num_connectors,
-                                set->x, set->y);
+                DRM_DEBUG_KMS("[CRTC:%d] [NOFB]\n", set->crtc->base.id);
+                set->mode = NULL;
+                set->num_connectors = 0;
         }
 
         dev = set->crtc->dev;
@@ -649,8 +650,8 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                 mode_changed = true;
 
         if (mode_changed) {
-                set->crtc->enabled = (set->mode != NULL);
-                if (set->mode != NULL) {
+                set->crtc->enabled = drm_helper_crtc_in_use(set->crtc);
+                if (set->crtc->enabled) {
                         DRM_DEBUG_KMS("attempting to set mode from"
                                         " userspace\n");
                         drm_mode_debug_printmodeline(set->mode);
@@ -665,6 +666,12 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                                 ret = -EINVAL;
                                 goto fail;
                         }
+                        DRM_DEBUG_KMS("Setting connector DPMS state to on\n");
+                        for (i = 0; i < set->num_connectors; i++) {
+                                DRM_DEBUG_KMS("\t[CONNECTOR:%d:%s] set DPMS on\n", set->connectors[i]->base.id,
+                                              drm_get_connector_name(set->connectors[i]));
+                                set->connectors[i]->dpms = DRM_MODE_DPMS_ON;
+                        }
                 }
                 drm_helper_disable_unused_functions(dev);
         } else if (fb_changed) {
@@ -681,12 +688,6 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                         goto fail;
                 }
         }
-        DRM_DEBUG_KMS("Setting connector DPMS state to on\n");
-        for (i = 0; i < set->num_connectors; i++) {
-                DRM_DEBUG_KMS("\t[CONNECTOR:%d:%s] set DPMS on\n", set->connectors[i]->base.id,
-                              drm_get_connector_name(set->connectors[i]));
-                set->connectors[i]->dpms = DRM_MODE_DPMS_ON;
-        }
 
         kfree(save_connectors);
         kfree(save_encoders);
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 0054e957203f..3dadfa2a8528 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -1250,7 +1250,7 @@ void drm_handle_vblank_events(struct drm_device *dev, int crtc)
  * Drivers should call this routine in their vblank interrupt handlers to
  * update the vblank counter and send any signals that may be pending.
  */
-void drm_handle_vblank(struct drm_device *dev, int crtc)
+bool drm_handle_vblank(struct drm_device *dev, int crtc)
 {
         u32 vblcount;
         s64 diff_ns;
@@ -1258,7 +1258,7 @@ void drm_handle_vblank(struct drm_device *dev, int crtc)
         unsigned long irqflags;
 
         if (!dev->num_crtcs)
-                return;
+                return false;
 
         /* Need timestamp lock to prevent concurrent execution with
          * vblank enable/disable, as this would cause inconsistent
@@ -1269,7 +1269,7 @@ void drm_handle_vblank(struct drm_device *dev, int crtc)
         /* Vblank irq handling disabled. Nothing to do. */
         if (!dev->vblank_enabled[crtc]) {
                 spin_unlock_irqrestore(&dev->vblank_time_lock, irqflags);
-                return;
+                return false;
         }
 
         /* Fetch corresponding timestamp for this vblank interval from
@@ -1311,5 +1311,6 @@ void drm_handle_vblank(struct drm_device *dev, int crtc)
         drm_handle_vblank_events(dev, crtc);
 
         spin_unlock_irqrestore(&dev->vblank_time_lock, irqflags);
+        return true;
 }
 EXPORT_SYMBOL(drm_handle_vblank);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 66796bb82d3e..cfb56d0ff367 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -354,6 +354,7 @@ static int i915_drm_thaw(struct drm_device *dev)
                 error = i915_gem_init_ringbuffer(dev);
                 mutex_unlock(&dev->struct_mutex);
 
+                drm_mode_config_reset(dev);
                 drm_irq_install(dev);
 
                 /* Resume the modeset for every activated CRTC */
@@ -542,6 +543,7 @@ int i915_reset(struct drm_device *dev, u8 flags)
 
                 mutex_unlock(&dev->struct_mutex);
                 drm_irq_uninstall(dev);
+                drm_mode_config_reset(dev);
                 drm_irq_install(dev);
                 mutex_lock(&dev->struct_mutex);
         }
@@ -566,6 +568,14 @@ int i915_reset(struct drm_device *dev, u8 flags)
 static int __devinit
 i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
+        /* Only bind to function 0 of the device. Early generations
+         * used function 1 as a placeholder for multi-head. This causes
+         * us confusion instead, especially on the systems where both
+         * functions have the same PCI-ID!
+         */
+        if (PCI_FUNC(pdev->devfn))
+                return -ENODEV;
+
         return drm_get_pci_dev(pdev, ent, &driver);
 }
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 062f353497e6..97f946dcc1aa 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1196,18 +1196,18 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                                 intel_finish_page_flip_plane(dev, 1);
                 }
 
-                if (pipea_stats & vblank_status) {
+                if (pipea_stats & vblank_status &&
+                    drm_handle_vblank(dev, 0)) {
                         vblank++;
-                        drm_handle_vblank(dev, 0);
                         if (!dev_priv->flip_pending_is_done) {
                                 i915_pageflip_stall_check(dev, 0);
                                 intel_finish_page_flip(dev, 0);
                         }
                 }
 
-                if (pipeb_stats & vblank_status) {
+                if (pipeb_stats & vblank_status &&
+                    drm_handle_vblank(dev, 1)) {
                         vblank++;
-                        drm_handle_vblank(dev, 1);
                         if (!dev_priv->flip_pending_is_done) {
                                 i915_pageflip_stall_check(dev, 1);
                                 intel_finish_page_flip(dev, 1);
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 17035b87ee46..8a77ff4a7237 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -535,6 +535,15 @@ static int intel_crt_set_property(struct drm_connector *connector,
         return 0;
 }
 
+static void intel_crt_reset(struct drm_connector *connector)
+{
+        struct drm_device *dev = connector->dev;
+        struct intel_crt *crt = intel_attached_crt(connector);
+
+        if (HAS_PCH_SPLIT(dev))
+                crt->force_hotplug_required = 1;
+}
+
 /*
  * Routines for controlling stuff on the analog port
  */
@@ -548,6 +557,7 @@ static const struct drm_encoder_helper_funcs intel_crt_helper_funcs = {
 };
 
 static const struct drm_connector_funcs intel_crt_connector_funcs = {
+        .reset = intel_crt_reset,
         .dpms = drm_helper_connector_dpms,
         .detect = intel_crt_detect,
         .fill_modes = drm_helper_probe_single_connector_modes,
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index d7f237deaaf0..7e42aa586504 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5551,6 +5551,18 @@ cleanup_work:
         return ret;
 }
 
+static void intel_crtc_reset(struct drm_crtc *crtc)
+{
+        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+
+        /* Reset flags back to the 'unknown' status so that they
+         * will be correctly set on the initial modeset.
+         */
+        intel_crtc->cursor_addr = 0;
+        intel_crtc->dpms_mode = -1;
+        intel_crtc->active = true; /* force the pipe off on setup_init_config */
+}
+
 static struct drm_crtc_helper_funcs intel_helper_funcs = {
         .dpms = intel_crtc_dpms,
         .mode_fixup = intel_crtc_mode_fixup,
@@ -5562,6 +5574,7 @@ static struct drm_crtc_helper_funcs intel_helper_funcs = {
 };
 
 static const struct drm_crtc_funcs intel_crtc_funcs = {
+        .reset = intel_crtc_reset,
         .cursor_set = intel_crtc_cursor_set,
         .cursor_move = intel_crtc_cursor_move,
         .gamma_set = intel_crtc_gamma_set,
@@ -5652,9 +5665,7 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
         dev_priv->plane_to_crtc_mapping[intel_crtc->plane] = &intel_crtc->base;
         dev_priv->pipe_to_crtc_mapping[intel_crtc->pipe] = &intel_crtc->base;
 
-        intel_crtc->cursor_addr = 0;
-        intel_crtc->dpms_mode = -1;
-        intel_crtc->active = true; /* force the pipe off on setup_init_config */
+        intel_crtc_reset(&intel_crtc->base);
 
         if (HAS_PCH_SPLIT(dev)) {
                 intel_helper_funcs.prepare = ironlake_crtc_prepare;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 45cd37652a37..6a09c1413d60 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -473,20 +473,6 @@ static bool intel_sdvo_write_cmd(struct intel_sdvo *intel_sdvo, u8 cmd,
                 return false;
         }
 
-        i = 3;
-        while (status == SDVO_CMD_STATUS_PENDING && i--) {
-                if (!intel_sdvo_read_byte(intel_sdvo,
-                                          SDVO_I2C_CMD_STATUS,
-                                          &status))
-                        return false;
-        }
-        if (status != SDVO_CMD_STATUS_SUCCESS) {
-                DRM_DEBUG_KMS("command returns response %s [%d]\n",
-                              status <= SDVO_CMD_STATUS_SCALING_NOT_SUPP ? cmd_status_names[status] : "???",
-                              status);
-                return false;
-        }
-
         return true;
 }
 
@@ -497,6 +483,8 @@ static bool intel_sdvo_read_response(struct intel_sdvo *intel_sdvo,
         u8 status;
         int i;
 
+        DRM_DEBUG_KMS("%s: R: ", SDVO_NAME(intel_sdvo));
+
         /*
          * The documentation states that all commands will be
          * processed within 15µs, and that we need only poll
@@ -505,14 +493,19 @@ static bool intel_sdvo_read_response(struct intel_sdvo *intel_sdvo,
          *
          * Check 5 times in case the hardware failed to read the docs.
          */
-        do {
+        if (!intel_sdvo_read_byte(intel_sdvo,
+                                  SDVO_I2C_CMD_STATUS,
+                                  &status))
+                goto log_fail;
+
+        while (status == SDVO_CMD_STATUS_PENDING && retry--) {
+                udelay(15);
                 if (!intel_sdvo_read_byte(intel_sdvo,
                                           SDVO_I2C_CMD_STATUS,
                                           &status))
-                        return false;
-        } while (status == SDVO_CMD_STATUS_PENDING && --retry);
+                        goto log_fail;
+        }
 
-        DRM_DEBUG_KMS("%s: R: ", SDVO_NAME(intel_sdvo));
         if (status <= SDVO_CMD_STATUS_SCALING_NOT_SUPP)
                 DRM_LOG_KMS("(%s)", cmd_status_names[status]);
         else
@@ -533,7 +526,7 @@ static bool intel_sdvo_read_response(struct intel_sdvo *intel_sdvo,
         return true;
 
 log_fail:
-        DRM_LOG_KMS("\n");
+        DRM_LOG_KMS("... failed\n");
         return false;
 }
 
@@ -550,6 +543,7 @@ static int intel_sdvo_get_pixel_multiplier(struct drm_display_mode *mode)
 static bool intel_sdvo_set_control_bus_switch(struct intel_sdvo *intel_sdvo,
                                               u8 ddc_bus)
 {
+        /* This must be the immediately preceding write before the i2c xfer */
         return intel_sdvo_write_cmd(intel_sdvo,
                                     SDVO_CMD_SET_CONTROL_BUS_SWITCH,
                                     &ddc_bus, 1);
@@ -557,7 +551,10 @@ static bool intel_sdvo_set_control_bus_switch(struct intel_sdvo *intel_sdvo,
 
 static bool intel_sdvo_set_value(struct intel_sdvo *intel_sdvo, u8 cmd, const void *data, int len)
 {
-        return intel_sdvo_write_cmd(intel_sdvo, cmd, data, len);
+        if (!intel_sdvo_write_cmd(intel_sdvo, cmd, data, len))
+                return false;
+
+        return intel_sdvo_read_response(intel_sdvo, NULL, 0);
 }
 
 static bool
@@ -859,18 +856,21 @@ static bool intel_sdvo_set_avi_infoframe(struct intel_sdvo *intel_sdvo)
 
         intel_dip_infoframe_csum(&avi_if);
 
-        if (!intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_HBUF_INDEX,
+        if (!intel_sdvo_set_value(intel_sdvo,
+                                  SDVO_CMD_SET_HBUF_INDEX,
                                   set_buf_index, 2))
                 return false;
 
         for (i = 0; i < sizeof(avi_if); i += 8) {
-                if (!intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_HBUF_DATA,
+                if (!intel_sdvo_set_value(intel_sdvo,
+                                          SDVO_CMD_SET_HBUF_DATA,
                                           data, 8))
                         return false;
                 data++;
         }
 
-        return intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_HBUF_TXRATE,
+        return intel_sdvo_set_value(intel_sdvo,
+                                    SDVO_CMD_SET_HBUF_TXRATE,
                                     &tx_rate, 1);
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index 2aef5cd3acf5..49e5e99917e2 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -6310,6 +6310,9 @@ void merge_like_dcb_entries(struct drm_device *dev, struct dcb_table *dcb)
 static bool
 apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf)
 {
+        struct drm_nouveau_private *dev_priv = dev->dev_private;
+        struct dcb_table *dcb = &dev_priv->vbios.dcb;
+
         /* Dell Precision M6300
          *   DCB entry 2: 02025312 00000010
          *   DCB entry 3: 02026312 00000020
@@ -6327,6 +6330,18 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf)
                         return false;
         }
 
+        /* GeForce3 Ti 200
+         *
+         * DCB reports an LVDS output that should be TMDS:
+         *   DCB entry 1: f2005014 ffffffff
+         */
+        if (nv_match_device(dev, 0x0201, 0x1462, 0x8851)) {
+                if (*conn == 0xf2005014 && *conf == 0xffffffff) {
+                        fabricate_dcb_output(dcb, OUTPUT_TMDS, 1, 1, 1);
+                        return false;
+                }
+        }
+
         return true;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.c b/drivers/gpu/drm/nouveau/nouveau_drv.c
index 13bb672a16f4..f658a04eecf9 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.c
@@ -234,9 +234,9 @@ nouveau_pci_suspend(struct pci_dev *pdev, pm_message_t pm_state)
                 pci_set_power_state(pdev, PCI_D3hot);
         }
 
-        acquire_console_sem();
+        console_lock();
         nouveau_fbcon_set_suspend(dev, 1);
-        release_console_sem();
+        console_unlock();
         nouveau_fbcon_restore_accel(dev);
         return 0;
 
@@ -359,9 +359,9 @@ nouveau_pci_resume(struct pci_dev *pdev)
                 nv_crtc->lut.depth = 0;
         }
 
-        acquire_console_sem();
+        console_lock();
         nouveau_fbcon_set_suspend(dev, 0);
-        release_console_sem();
+        console_unlock();
 
         nouveau_fbcon_zfill_all(dev);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 01bffc4412d2..9821fcacc3d2 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -848,9 +848,6 @@ extern void nv10_mem_put_tile_region(struct drm_device *dev,
                                      struct nouveau_fence *fence);
 extern const struct ttm_mem_type_manager_func nouveau_vram_manager;
 
-/* nvc0_vram.c */
-extern const struct ttm_mem_type_manager_func nvc0_vram_manager;
-
 /* nouveau_notifier.c */
 extern int  nouveau_notifier_init_channel(struct nouveau_channel *);
 extern void nouveau_notifier_takedown_channel(struct nouveau_channel *);
diff --git a/drivers/gpu/drm/nouveau/nouveau_pm.c b/drivers/gpu/drm/nouveau/nouveau_pm.c
index fb846a3fef15..f05c0cddfeca 100644
--- a/drivers/gpu/drm/nouveau/nouveau_pm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_pm.c
@@ -443,7 +443,7 @@ nouveau_hwmon_fini(struct drm_device *dev)
         struct nouveau_pm_engine *pm = &dev_priv->engine.pm;
 
         if (pm->hwmon) {
-                sysfs_remove_group(&pm->hwmon->kobj, &hwmon_attrgroup);
+                sysfs_remove_group(&dev->pdev->dev.kobj, &hwmon_attrgroup);
                 hwmon_device_unregister(pm->hwmon);
         }
 #endif
diff --git a/drivers/gpu/drm/nouveau/nouveau_temp.c b/drivers/gpu/drm/nouveau/nouveau_temp.c
index 7ecc4adc1e45..8d9968e1cba8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_temp.c
+++ b/drivers/gpu/drm/nouveau/nouveau_temp.c
@@ -265,8 +265,8 @@ nouveau_temp_probe_i2c(struct drm_device *dev)
         struct i2c_board_info info[] = {
                 { I2C_BOARD_INFO("w83l785ts", 0x2d) },
                 { I2C_BOARD_INFO("w83781d", 0x2d) },
-                { I2C_BOARD_INFO("f75375", 0x2e) },
                 { I2C_BOARD_INFO("adt7473", 0x2e) },
+                { I2C_BOARD_INFO("f75375", 0x2e) },
                 { I2C_BOARD_INFO("lm99", 0x4c) },
                 { }
         };
diff --git a/drivers/gpu/drm/nouveau/nv50_evo.c b/drivers/gpu/drm/nouveau/nv50_evo.c
index 14e24e906ee8..0ea090f4244a 100644
--- a/drivers/gpu/drm/nouveau/nv50_evo.c
+++ b/drivers/gpu/drm/nouveau/nv50_evo.c
@@ -283,8 +283,7 @@ nv50_evo_create(struct drm_device *dev)
                         nv50_evo_channel_del(&dev_priv->evo);
                         return ret;
                 }
-        } else
-        if (dev_priv->chipset != 0x50) {
+        } else {
                 ret = nv50_evo_dmaobj_new(evo, 0x3d, NvEvoFB16, 0x70, 0x19,
                                           0, 0xffffffff, 0x00010000);
                 if (ret) {
diff --git a/drivers/gpu/drm/nouveau/nv50_graph.c b/drivers/gpu/drm/nouveau/nv50_graph.c
index 2d7ea75a09d4..37e21d2be95b 100644
--- a/drivers/gpu/drm/nouveau/nv50_graph.c
+++ b/drivers/gpu/drm/nouveau/nv50_graph.c
@@ -256,6 +256,7 @@ nv50_graph_destroy_context(struct nouveau_channel *chan)
         struct drm_device *dev = chan->dev;
         struct drm_nouveau_private *dev_priv = dev->dev_private;
         struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
+        struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
         int i, hdr = (dev_priv->chipset == 0x50) ? 0x200 : 0x20;
         unsigned long flags;
 
@@ -265,6 +266,7 @@ nv50_graph_destroy_context(struct nouveau_channel *chan)
                 return;
 
         spin_lock_irqsave(&dev_priv->context_switch_lock, flags);
+        pfifo->reassign(dev, false);
         pgraph->fifo_access(dev, false);
 
         if (pgraph->channel(dev) == chan)
@@ -275,6 +277,7 @@ nv50_graph_destroy_context(struct nouveau_channel *chan)
         dev_priv->engine.instmem.flush(dev);
 
         pgraph->fifo_access(dev, true);
+        pfifo->reassign(dev, true);
         spin_unlock_irqrestore(&dev_priv->context_switch_lock, flags);
 
         nouveau_gpuobj_ref(NULL, &chan->ramin_grctx);
diff --git a/drivers/gpu/drm/nouveau/nv50_vm.c b/drivers/gpu/drm/nouveau/nv50_vm.c
index 38e523e10995..459ff08241e5 100644
--- a/drivers/gpu/drm/nouveau/nv50_vm.c
+++ b/drivers/gpu/drm/nouveau/nv50_vm.c
@@ -45,11 +45,6 @@ nv50_vm_map_pgt(struct nouveau_gpuobj *pgd, u32 pde,
         }
 
         if (phys & 1) {
-                if (dev_priv->vram_sys_base) {
-                        phys += dev_priv->vram_sys_base;
-                        phys |= 0x30;
-                }
-
                 if (coverage <= 32 * 1024 * 1024)
                         phys |= 0x60;
                 else if (coverage <= 64 * 1024 * 1024)
diff --git a/drivers/gpu/drm/nouveau/nvc0_graph.c b/drivers/gpu/drm/nouveau/nvc0_graph.c
index e6ea7d83187f..eb18a7e89f5b 100644
--- a/drivers/gpu/drm/nouveau/nvc0_graph.c
+++ b/drivers/gpu/drm/nouveau/nvc0_graph.c
@@ -31,6 +31,7 @@
 #include "nvc0_graph.h"
 
 static void nvc0_graph_isr(struct drm_device *);
+static void nvc0_runk140_isr(struct drm_device *);
 static int  nvc0_graph_unload_context_to(struct drm_device *dev, u64 chan);
 
 void
@@ -281,6 +282,7 @@ nvc0_graph_destroy(struct drm_device *dev)
                 return;
 
         nouveau_irq_unregister(dev, 12);
+        nouveau_irq_unregister(dev, 25);
 
         nouveau_gpuobj_ref(NULL, &priv->unk4188b8);
         nouveau_gpuobj_ref(NULL, &priv->unk4188b4);
@@ -390,6 +392,7 @@ nvc0_graph_create(struct drm_device *dev)
         }
 
         nouveau_irq_register(dev, 12, nvc0_graph_isr);
+        nouveau_irq_register(dev, 25, nvc0_runk140_isr);
         NVOBJ_CLASS(dev, 0x902d, GR); /* 2D */
         NVOBJ_CLASS(dev, 0x9039, GR); /* M2MF */
         NVOBJ_CLASS(dev, 0x9097, GR); /* 3D */
@@ -512,8 +515,8 @@ nvc0_graph_init_gpc_1(struct drm_device *dev)
                         nv_wr32(dev, TP_UNIT(gpc, tp, 0x224), 0xc0000000);
                         nv_wr32(dev, TP_UNIT(gpc, tp, 0x48c), 0xc0000000);
                         nv_wr32(dev, TP_UNIT(gpc, tp, 0x084), 0xc0000000);
-                        nv_wr32(dev, TP_UNIT(gpc, tp, 0xe44), 0x001ffffe);
-                        nv_wr32(dev, TP_UNIT(gpc, tp, 0xe4c), 0x0000000f);
+                        nv_wr32(dev, TP_UNIT(gpc, tp, 0x644), 0x001ffffe);
+                        nv_wr32(dev, TP_UNIT(gpc, tp, 0x64c), 0x0000000f);
                 }
                 nv_wr32(dev, GPC_UNIT(gpc, 0x2c90), 0xffffffff);
                 nv_wr32(dev, GPC_UNIT(gpc, 0x2c94), 0xffffffff);
@@ -777,3 +780,19 @@ nvc0_graph_isr(struct drm_device *dev)
 
         nv_wr32(dev, 0x400500, 0x00010001);
 }
+
+static void
+nvc0_runk140_isr(struct drm_device *dev)
+{
+        u32 units = nv_rd32(dev, 0x00017c) & 0x1f;
+
+        while (units) {
+                u32 unit = ffs(units) - 1;
+                u32 reg = 0x140000 + unit * 0x2000;
+                u32 st0 = nv_mask(dev, reg + 0x1020, 0, 0);
+                u32 st1 = nv_mask(dev, reg + 0x1420, 0, 0);
+
+                NV_INFO(dev, "PRUNK140: %d 0x%08x 0x%08x\n", unit, st0, st1);
+                units &= ~(1 << unit);
+        }
+}
diff --git a/drivers/gpu/drm/nouveau/nvc0_grctx.c b/drivers/gpu/drm/nouveau/nvc0_grctx.c
index b9e68b2d30aa..f880ff776db8 100644
--- a/drivers/gpu/drm/nouveau/nvc0_grctx.c
+++ b/drivers/gpu/drm/nouveau/nvc0_grctx.c
@@ -1830,7 +1830,7 @@ nvc0_grctx_generate(struct nouveau_channel *chan)
 
         for (tp = 0, id = 0; tp < 4; tp++) {
                 for (gpc = 0; gpc < priv->gpc_nr; gpc++) {
-                        if (tp <= priv->tp_nr[gpc]) {
+                        if (tp < priv->tp_nr[gpc]) {
                                 nv_wr32(dev, TP_UNIT(gpc, tp, 0x698), id);
                                 nv_wr32(dev, TP_UNIT(gpc, tp, 0x4e8), id);
                                 nv_wr32(dev, GPC_UNIT(gpc, 0x0c10 + tp * 4), id);
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index d3ca17080df7..b1537000a104 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -555,6 +555,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                         dp_clock = dig_connector->dp_clock;
                                 }
                         }
+/* this might work properly with the new pll algo */
 #if 0 /* doesn't work properly on some laptops */
                         /* use recommended ref_div for ss */
                         if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
@@ -572,6 +573,11 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                         adjusted_clock = mode->clock * 2;
                                 if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT))
                                         pll->flags |= RADEON_PLL_PREFER_CLOSEST_LOWER;
+                                /* rv515 needs more testing with this option */
+                                if (rdev->family != CHIP_RV515) {
+                                        if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT))
+                                                pll->flags |= RADEON_PLL_IS_LCD;
+                                }
                         } else {
                                 if (encoder->encoder_type != DRM_MODE_ENCODER_DAC)
                                         pll->flags |= RADEON_PLL_NO_ODD_POST_DIV;
@@ -951,8 +957,16 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
         /* adjust pixel clock as needed */
         adjusted_clock = atombios_adjust_pll(crtc, mode, pll, ss_enabled, &ss);
 
-        radeon_compute_pll(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
-                           &ref_div, &post_div);
+        /* rv515 seems happier with the old algo */
+        if (rdev->family == CHIP_RV515)
+                radeon_compute_pll_legacy(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
+                                          &ref_div, &post_div);
+        else if (ASIC_IS_AVIVO(rdev))
+                radeon_compute_pll_avivo(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
+                                         &ref_div, &post_div);
+        else
+                radeon_compute_pll_legacy(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
+                                          &ref_div, &post_div);
 
         atombios_crtc_program_ss(crtc, ATOM_DISABLE, radeon_crtc->pll_id, &ss);
 
@@ -994,6 +1008,7 @@ static int evergreen_crtc_do_set_base(struct drm_crtc *crtc,
         struct radeon_bo *rbo;
         uint64_t fb_location;
         uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+        u32 fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_NONE);
         int r;
 
         /* no fb bound */
@@ -1045,11 +1060,17 @@ static int evergreen_crtc_do_set_base(struct drm_crtc *crtc,
         case 16:
                 fb_format = (EVERGREEN_GRPH_DEPTH(EVERGREEN_GRPH_DEPTH_16BPP) |
                              EVERGREEN_GRPH_FORMAT(EVERGREEN_GRPH_FORMAT_ARGB565));
+#ifdef __BIG_ENDIAN
+                fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_8IN16);
+#endif
                 break;
         case 24:
         case 32:
                 fb_format = (EVERGREEN_GRPH_DEPTH(EVERGREEN_GRPH_DEPTH_32BPP) |
                              EVERGREEN_GRPH_FORMAT(EVERGREEN_GRPH_FORMAT_ARGB8888));
+#ifdef __BIG_ENDIAN
+                fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_8IN32);
+#endif
                 break;
         default:
                 DRM_ERROR("Unsupported screen depth %d\n",
@@ -1094,6 +1115,7 @@ static int evergreen_crtc_do_set_base(struct drm_crtc *crtc,
         WREG32(EVERGREEN_GRPH_SECONDARY_SURFACE_ADDRESS + radeon_crtc->crtc_offset,
                (u32) fb_location & EVERGREEN_GRPH_SURFACE_ADDRESS_MASK);
         WREG32(EVERGREEN_GRPH_CONTROL + radeon_crtc->crtc_offset, fb_format);
+        WREG32(EVERGREEN_GRPH_SWAP_CONTROL + radeon_crtc->crtc_offset, fb_swap);
 
         WREG32(EVERGREEN_GRPH_SURFACE_OFFSET_X + radeon_crtc->crtc_offset, 0);
         WREG32(EVERGREEN_GRPH_SURFACE_OFFSET_Y + radeon_crtc->crtc_offset, 0);
@@ -1150,6 +1172,7 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
         struct drm_framebuffer *target_fb;
         uint64_t fb_location;
         uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+        u32 fb_swap = R600_D1GRPH_SWAP_ENDIAN_NONE;
         int r;
 
         /* no fb bound */
@@ -1203,12 +1226,18 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
                 fb_format =
                     AVIVO_D1GRPH_CONTROL_DEPTH_16BPP |
                     AVIVO_D1GRPH_CONTROL_16BPP_RGB565;
+#ifdef __BIG_ENDIAN
+                fb_swap = R600_D1GRPH_SWAP_ENDIAN_16BIT;
+#endif
                 break;
         case 24:
         case 32:
                 fb_format =
                     AVIVO_D1GRPH_CONTROL_DEPTH_32BPP |
                     AVIVO_D1GRPH_CONTROL_32BPP_ARGB8888;
+#ifdef __BIG_ENDIAN
+                fb_swap = R600_D1GRPH_SWAP_ENDIAN_32BIT;
+#endif
                 break;
         default:
                 DRM_ERROR("Unsupported screen depth %d\n",
@@ -1248,6 +1277,8 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
         WREG32(AVIVO_D1GRPH_SECONDARY_SURFACE_ADDRESS +
                radeon_crtc->crtc_offset, (u32) fb_location);
         WREG32(AVIVO_D1GRPH_CONTROL + radeon_crtc->crtc_offset, fb_format);
+        if (rdev->family >= CHIP_R600)
+                WREG32(R600_D1GRPH_SWAP_CONTROL + radeon_crtc->crtc_offset, fb_swap);
 
         WREG32(AVIVO_D1GRPH_SURFACE_OFFSET_X + radeon_crtc->crtc_offset, 0);
         WREG32(AVIVO_D1GRPH_SURFACE_OFFSET_Y + radeon_crtc->crtc_offset, 0);
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 4e7778d44b8d..695de9a38506 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -187,9 +187,9 @@ static int dp_link_clock_for_mode_clock(u8 dpcd[DP_DPCD_SIZE], int mode_clock)
 int dp_mode_valid(u8 dpcd[DP_DPCD_SIZE], int mode_clock)
 {
         int lanes = dp_lanes_for_mode_clock(dpcd, mode_clock);
-        int bw = dp_lanes_for_mode_clock(dpcd, mode_clock);
+        int dp_clock = dp_link_clock_for_mode_clock(dpcd, mode_clock);
 
-        if ((lanes == 0) || (bw == 0))
+        if ((lanes == 0) || (dp_clock == 0))
                 return MODE_CLOCK_HIGH;
 
         return MODE_OK;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 677af91b555c..ffdc8332b76e 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -97,26 +97,29 @@ u32 evergreen_page_flip(struct radeon_device *rdev, int crtc_id, u64 crtc_base)
 }
 
 /* get temperature in millidegrees */
-u32 evergreen_get_temp(struct radeon_device *rdev)
+int evergreen_get_temp(struct radeon_device *rdev)
 {
         u32 temp = (RREG32(CG_MULT_THERMAL_STATUS) & ASIC_T_MASK) >>
                 ASIC_T_SHIFT;
         u32 actual_temp = 0;
 
-        if ((temp >> 10) & 1)
-                actual_temp = 0;
-        else if ((temp >> 9) & 1)
+        if (temp & 0x400)
+                actual_temp = -256;
+        else if (temp & 0x200)
                 actual_temp = 255;
-        else
-                actual_temp = (temp >> 1) & 0xff;
+        else if (temp & 0x100) {
+                actual_temp = temp & 0x1ff;
+                actual_temp |= ~0x1ff;
+        } else
+                actual_temp = temp & 0xff;
 
-        return actual_temp * 1000;
+        return (actual_temp * 1000) / 2;
 }
 
-u32 sumo_get_temp(struct radeon_device *rdev)
+int sumo_get_temp(struct radeon_device *rdev)
 {
         u32 temp = RREG32(CG_THERMAL_STATUS) & 0xff;
-        u32 actual_temp = (temp >> 1) & 0xff;
+        int actual_temp = temp - 49;
 
         return actual_temp * 1000;
 }
@@ -1182,6 +1185,18 @@ static void evergreen_mc_program(struct radeon_device *rdev)
 /*
  * CP.
  */
+void evergreen_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib)
+{
+        /* set to DX10/11 mode */
+        radeon_ring_write(rdev, PACKET3(PACKET3_MODE_CONTROL, 0));
+        radeon_ring_write(rdev, 1);
+        /* FIXME: implement */
+        radeon_ring_write(rdev, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+        radeon_ring_write(rdev, ib->gpu_addr & 0xFFFFFFFC);
+        radeon_ring_write(rdev, upper_32_bits(ib->gpu_addr) & 0xFF);
+        radeon_ring_write(rdev, ib->length_dw);
+}
+
 
 static int evergreen_cp_load_microcode(struct radeon_device *rdev)
 {
@@ -1233,7 +1248,7 @@ static int evergreen_cp_start(struct radeon_device *rdev)
         cp_me = 0xff;
         WREG32(CP_ME_CNTL, cp_me);
 
-        r = radeon_ring_lock(rdev, evergreen_default_size + 15);
+        r = radeon_ring_lock(rdev, evergreen_default_size + 19);
         if (r) {
                 DRM_ERROR("radeon: cp failed to lock ring (%d).\n", r);
                 return r;
@@ -1266,6 +1281,11 @@ static int evergreen_cp_start(struct radeon_device *rdev)
         radeon_ring_write(rdev, 0xffffffff);
         radeon_ring_write(rdev, 0xffffffff);
 
+        radeon_ring_write(rdev, 0xc0026900);
+        radeon_ring_write(rdev, 0x00000316);
+        radeon_ring_write(rdev, 0x0000000e); /* VGT_VERTEX_REUSE_BLOCK_CNTL */
+        radeon_ring_write(rdev, 0x00000010); /*  */
+
         radeon_ring_unlock_commit(rdev);
 
         return 0;
@@ -2072,6 +2092,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         WREG32(VGT_CACHE_INVALIDATION, vgt_cache_invalidation);
 
         WREG32(VGT_GS_VERTEX_REUSE, 16);
+        WREG32(PA_SU_LINE_STIPPLE_VALUE, 0);
         WREG32(PA_SC_LINE_STIPPLE_STATE, 0);
 
         WREG32(VGT_VERTEX_REUSE_BLOCK_CNTL, 14);
diff --git a/drivers/gpu/drm/radeon/evergreen_blit_kms.c b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
index b758dc7f2f2c..a1ba4b3053d0 100644
--- a/drivers/gpu/drm/radeon/evergreen_blit_kms.c
+++ b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
@@ -232,7 +232,7 @@ draw_auto(struct radeon_device *rdev)
 
 }
 
-/* emits 30 */
+/* emits 36 */
 static void
 set_default_state(struct radeon_device *rdev)
 {
@@ -245,6 +245,8 @@ set_default_state(struct radeon_device *rdev)
         int num_hs_threads, num_ls_threads;
         int num_ps_stack_entries, num_vs_stack_entries, num_gs_stack_entries, num_es_stack_entries;
         int num_hs_stack_entries, num_ls_stack_entries;
+        u64 gpu_addr;
+        int dwords;
 
         switch (rdev->family) {
         case CHIP_CEDAR:
@@ -497,6 +499,18 @@ set_default_state(struct radeon_device *rdev)
         radeon_ring_write(rdev, 0x00000000);
         radeon_ring_write(rdev, 0x00000000);
 
+        /* set to DX10/11 mode */
+        radeon_ring_write(rdev, PACKET3(PACKET3_MODE_CONTROL, 0));
+        radeon_ring_write(rdev, 1);
+
+        /* emit an IB pointing at default state */
+        dwords = ALIGN(rdev->r600_blit.state_len, 0x10);
+        gpu_addr = rdev->r600_blit.shader_gpu_addr + rdev->r600_blit.state_offset;
+        radeon_ring_write(rdev, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+        radeon_ring_write(rdev, gpu_addr & 0xFFFFFFFC);
+        radeon_ring_write(rdev, upper_32_bits(gpu_addr) & 0xFF);
+        radeon_ring_write(rdev, dwords);
+
 }
 
 static inline uint32_t i2f(uint32_t input)
@@ -527,8 +541,10 @@ static inline uint32_t i2f(uint32_t input)
 int evergreen_blit_init(struct radeon_device *rdev)
 {
         u32 obj_size;
-        int r;
+        int r, dwords;
         void *ptr;
+        u32 packet2s[16];
+        int num_packet2s = 0;
 
         /* pin copy shader into vram if already initialized */
         if (rdev->r600_blit.shader_obj)
@@ -536,8 +552,17 @@ int evergreen_blit_init(struct radeon_device *rdev)
 
         mutex_init(&rdev->r600_blit.mutex);
         rdev->r600_blit.state_offset = 0;
-        rdev->r600_blit.state_len = 0;
-        obj_size = 0;
+
+        rdev->r600_blit.state_len = evergreen_default_size;
+
+        dwords = rdev->r600_blit.state_len;
+        while (dwords & 0xf) {
+                packet2s[num_packet2s++] = PACKET2(0);
+                dwords++;
+        }
+
+        obj_size = dwords * 4;
+        obj_size = ALIGN(obj_size, 256);
 
         rdev->r600_blit.vs_offset = obj_size;
         obj_size += evergreen_vs_size * 4;
@@ -567,6 +592,12 @@ int evergreen_blit_init(struct radeon_device *rdev)
                 return r;
         }
 
+        memcpy_toio(ptr + rdev->r600_blit.state_offset,
+                    evergreen_default_state, rdev->r600_blit.state_len * 4);
+
+        if (num_packet2s)
+                memcpy_toio(ptr + rdev->r600_blit.state_offset + (rdev->r600_blit.state_len * 4),
+                            packet2s, num_packet2s * 4);
         memcpy(ptr + rdev->r600_blit.vs_offset, evergreen_vs, evergreen_vs_size * 4);
         memcpy(ptr + rdev->r600_blit.ps_offset, evergreen_ps, evergreen_ps_size * 4);
         radeon_bo_kunmap(rdev->r600_blit.shader_obj);
@@ -652,7 +683,7 @@ int evergreen_blit_prepare_copy(struct radeon_device *rdev, int size_bytes)
         /* calculate number of loops correctly */
         ring_size = num_loops * dwords_per_loop;
         /* set default  + shaders */
-        ring_size += 46; /* shaders + def state */
+        ring_size += 52; /* shaders + def state */
         ring_size += 10; /* fence emit for VB IB */
         ring_size += 5; /* done copy */
         ring_size += 10; /* fence emit for done copy */
@@ -660,7 +691,7 @@ int evergreen_blit_prepare_copy(struct radeon_device *rdev, int size_bytes)
         if (r)
                 return r;
 
-        set_default_state(rdev); /* 30 */
+        set_default_state(rdev); /* 36 */
         set_shaders(rdev); /* 16 */
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index 36d32d83d866..afec1aca2a73 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -240,6 +240,7 @@
 #define         FORCE_EOV_MAX_CLK_CNT(x)                        ((x) << 0)
 #define         FORCE_EOV_MAX_REZ_CNT(x)                        ((x) << 16)
 #define PA_SC_LINE_STIPPLE                              0x28A0C
+#define PA_SU_LINE_STIPPLE_VALUE                        0x8A60
 #define PA_SC_LINE_STIPPLE_STATE                        0x8B10
 
 #define SCRATCH_REG0                                    0x8500
@@ -652,6 +653,7 @@
 #define PACKET3_DISPATCH_DIRECT                         0x15
 #define PACKET3_DISPATCH_INDIRECT                       0x16
 #define PACKET3_INDIRECT_BUFFER_END                     0x17
+#define PACKET3_MODE_CONTROL                            0x18
 #define PACKET3_SET_PREDICATION                         0x20
 #define PACKET3_REG_RMW                                 0x21
 #define PACKET3_COND_EXEC                               0x22
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 5968dde243e9..5f15820efe12 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -1031,8 +1031,8 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
         WREG32(RADEON_CP_CSQ_MODE,
                REG_SET(RADEON_INDIRECT2_START, indirect2_start) |
                REG_SET(RADEON_INDIRECT1_START, indirect1_start));
-        WREG32(0x718, 0);
-        WREG32(0x744, 0x00004D4D);
+        WREG32(RADEON_CP_RB_WPTR_DELAY, 0);
+        WREG32(RADEON_CP_CSQ_MODE, 0x00004D4D);
         WREG32(RADEON_CP_CSQ_CNTL, RADEON_CSQ_PRIBM_INDBM);
         radeon_ring_start(rdev);
         r = radeon_ring_test(rdev);
@@ -2347,10 +2347,10 @@ void r100_vga_set_state(struct radeon_device *rdev, bool state)
 
         temp = RREG32(RADEON_CONFIG_CNTL);
         if (state == false) {
-                temp &= ~(1<<8);
-                temp |= (1<<9);
+                temp &= ~RADEON_CFG_VGA_RAM_EN;
+                temp |= RADEON_CFG_VGA_IO_DIS;
         } else {
-                temp &= ~(1<<9);
+                temp &= ~RADEON_CFG_VGA_IO_DIS;
         }
         WREG32(RADEON_CONFIG_CNTL, temp);
 }
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index cf862ca580bf..55fe5ba7def3 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -69,6 +69,9 @@ void rv370_pcie_gart_tlb_flush(struct radeon_device *rdev)
         mb();
 }
 
+#define R300_PTE_WRITEABLE (1 << 2)
+#define R300_PTE_READABLE  (1 << 3)
+
 int rv370_pcie_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
 {
         void __iomem *ptr = (void *)rdev->gart.table.vram.ptr;
@@ -78,7 +81,7 @@ int rv370_pcie_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
         }
         addr = (lower_32_bits(addr) >> 8) |
                ((upper_32_bits(addr) & 0xff) << 24) |
-               0xc;
+               R300_PTE_WRITEABLE | R300_PTE_READABLE;
         /* on x86 we want this to be CPU endian, on powerpc
          * on powerpc without HW swappers, it'll get swapped on way
          * into VRAM - so no need for cpu_to_le32 on VRAM tables */
@@ -135,7 +138,7 @@ int rv370_pcie_gart_enable(struct radeon_device *rdev)
         WREG32_PCIE(RADEON_PCIE_TX_DISCARD_RD_ADDR_LO, rdev->mc.vram_start);
         WREG32_PCIE(RADEON_PCIE_TX_DISCARD_RD_ADDR_HI, 0);
         /* Clear error */
-        WREG32_PCIE(0x18, 0);
+        WREG32_PCIE(RADEON_PCIE_TX_GART_ERROR, 0);
         tmp = RREG32_PCIE(RADEON_PCIE_TX_GART_CNTL);
         tmp |= RADEON_PCIE_TX_GART_EN;
         tmp |= RADEON_PCIE_TX_GART_UNMAPPED_ACCESS_DISCARD;
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index c387346f93a9..0b59ed7c7d2c 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -96,7 +96,7 @@ void r420_pipes_init(struct radeon_device *rdev)
                        "programming pipes. Bad things might happen.\n");
         }
         /* get max number of pipes */
-        gb_pipe_select = RREG32(0x402C);
+        gb_pipe_select = RREG32(R400_GB_PIPE_SELECT);
         num_pipes = ((gb_pipe_select >> 12) & 3) + 1;
 
         /* SE chips have 1 pipe */
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index 3c8677f9e385..2ce80d976568 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -79,8 +79,8 @@ static void r520_gpu_init(struct radeon_device *rdev)
                 WREG32(0x4128, 0xFF);
         }
         r420_pipes_init(rdev);
-        gb_pipe_select = RREG32(0x402C);
-        tmp = RREG32(0x170C);
+        gb_pipe_select = RREG32(R400_GB_PIPE_SELECT);
+        tmp = RREG32(R300_DST_PIPE_CONFIG);
         pipe_select_current = (tmp >> 2) & 3;
         tmp = (1 << pipe_select_current) |
               (((gb_pipe_select >> 8) & 0xF) << 4);
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 1e10e3e2ba2a..650672a0f5ad 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -97,12 +97,16 @@ void r600_irq_disable(struct radeon_device *rdev);
 static void r600_pcie_gen2_enable(struct radeon_device *rdev);
 
 /* get temperature in millidegrees */
-u32 rv6xx_get_temp(struct radeon_device *rdev)
+int rv6xx_get_temp(struct radeon_device *rdev)
 {
         u32 temp = (RREG32(CG_THERMAL_STATUS) & ASIC_T_MASK) >>
                 ASIC_T_SHIFT;
+        int actual_temp = temp & 0xff;
 
-        return temp * 1000;
+        if (temp & 0x100)
+                actual_temp -= 256;
+
+        return actual_temp * 1000;
 }
 
 void r600_pm_get_dynpm_state(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r600_reg.h b/drivers/gpu/drm/radeon/r600_reg.h
index 33cda016b083..f869897c7456 100644
--- a/drivers/gpu/drm/radeon/r600_reg.h
+++ b/drivers/gpu/drm/radeon/r600_reg.h
@@ -81,7 +81,11 @@
 #define R600_MEDIUM_VID_LOWER_GPIO_CNTL                            0x720
 #define R600_LOW_VID_LOWER_GPIO_CNTL                               0x724
 
-
+#define R600_D1GRPH_SWAP_CONTROL                               0x610C
+#       define R600_D1GRPH_SWAP_ENDIAN_NONE                    (0 << 0)
+#       define R600_D1GRPH_SWAP_ENDIAN_16BIT                   (1 << 0)
+#       define R600_D1GRPH_SWAP_ENDIAN_32BIT                   (2 << 0)
+#       define R600_D1GRPH_SWAP_ENDIAN_64BIT                   (3 << 0)
 
 #define R600_HDP_NONSURFACE_BASE                                0x2c04
 
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 71d2a554bbe6..56c48b67ef3d 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -179,10 +179,10 @@ void radeon_combios_get_power_modes(struct radeon_device *rdev);
 void radeon_atombios_get_power_modes(struct radeon_device *rdev);
 void radeon_atom_set_voltage(struct radeon_device *rdev, u16 level);
 void rs690_pm_info(struct radeon_device *rdev);
-extern u32 rv6xx_get_temp(struct radeon_device *rdev);
-extern u32 rv770_get_temp(struct radeon_device *rdev);
-extern u32 evergreen_get_temp(struct radeon_device *rdev);
-extern u32 sumo_get_temp(struct radeon_device *rdev);
+extern int rv6xx_get_temp(struct radeon_device *rdev);
+extern int rv770_get_temp(struct radeon_device *rdev);
+extern int evergreen_get_temp(struct radeon_device *rdev);
+extern int sumo_get_temp(struct radeon_device *rdev);
 
 /*
  * Fences.
@@ -812,8 +812,7 @@ struct radeon_pm {
         fixed20_12              sclk;
         fixed20_12              mclk;
         fixed20_12              needed_bandwidth;
-        /* XXX: use a define for num power modes */
-        struct radeon_power_state power_state[8];
+        struct radeon_power_state *power_state;
         /* number of valid power states */
         int                     num_power_states;
         int                     current_power_state_index;
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 3a1b16186224..e75d63b8e21d 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -759,7 +759,7 @@ static struct radeon_asic evergreen_asic = {
         .gart_tlb_flush = &evergreen_pcie_gart_tlb_flush,
         .gart_set_page = &rs600_gart_set_page,
         .ring_test = &r600_ring_test,
-        .ring_ib_execute = &r600_ring_ib_execute,
+        .ring_ib_execute = &evergreen_ring_ib_execute,
         .irq_set = &evergreen_irq_set,
         .irq_process = &evergreen_irq_process,
         .get_vblank_counter = &evergreen_get_vblank_counter,
@@ -805,7 +805,7 @@ static struct radeon_asic sumo_asic = {
         .gart_tlb_flush = &evergreen_pcie_gart_tlb_flush,
         .gart_set_page = &rs600_gart_set_page,
         .ring_test = &r600_ring_test,
-        .ring_ib_execute = &r600_ring_ib_execute,
+        .ring_ib_execute = &evergreen_ring_ib_execute,
         .irq_set = &evergreen_irq_set,
         .irq_process = &evergreen_irq_process,
         .get_vblank_counter = &evergreen_get_vblank_counter,
@@ -848,7 +848,7 @@ static struct radeon_asic btc_asic = {
         .gart_tlb_flush = &evergreen_pcie_gart_tlb_flush,
         .gart_set_page = &rs600_gart_set_page,
         .ring_test = &r600_ring_test,
-        .ring_ib_execute = &r600_ring_ib_execute,
+        .ring_ib_execute = &evergreen_ring_ib_execute,
         .irq_set = &evergreen_irq_set,
         .irq_process = &evergreen_irq_process,
         .get_vblank_counter = &evergreen_get_vblank_counter,
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index e01f07718539..c59bd98a2029 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -355,6 +355,7 @@ int evergreen_resume(struct radeon_device *rdev);
 bool evergreen_gpu_is_lockup(struct radeon_device *rdev);
 int evergreen_asic_reset(struct radeon_device *rdev);
 void evergreen_bandwidth_update(struct radeon_device *rdev);
+void evergreen_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib);
 int evergreen_copy_blit(struct radeon_device *rdev,
                         uint64_t src_offset, uint64_t dst_offset,
                         unsigned num_pages, struct radeon_fence *fence);
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 52777902bbcc..5c1cc7ad9a15 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1163,16 +1163,6 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
                                 p1pll->pll_out_min = 64800;
                         else
                                 p1pll->pll_out_min = 20000;
-                } else if (p1pll->pll_out_min > 64800) {
-                        /* Limiting the pll output range is a good thing generally as
-                         * it limits the number of possible pll combinations for a given
-                         * frequency presumably to the ones that work best on each card.
-                         * However, certain duallink DVI monitors seem to like
-                         * pll combinations that would be limited by this at least on
-                         * pre-DCE 3.0 r6xx hardware.  This might need to be adjusted per
-                         * family.
-                         */
-                        p1pll->pll_out_min = 64800;
                 }
 
                 p1pll->pll_in_min =
@@ -1987,6 +1977,9 @@ static int radeon_atombios_parse_power_table_1_3(struct radeon_device *rdev)
         num_modes = power_info->info.ucNumOfPowerModeEntries;
         if (num_modes > ATOM_MAX_NUMBEROF_POWER_BLOCK)
                 num_modes = ATOM_MAX_NUMBEROF_POWER_BLOCK;
+        rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) * num_modes, GFP_KERNEL);
+        if (!rdev->pm.power_state)
+                return state_index;
         /* last mode is usually default, array is low to high */
         for (i = 0; i < num_modes; i++) {
                 rdev->pm.power_state[state_index].clock_info[0].voltage.type = VOLTAGE_NONE;
@@ -2338,6 +2331,10 @@ static int radeon_atombios_parse_power_table_4_5(struct radeon_device *rdev)
         power_info = (union power_info *)(mode_info->atom_context->bios + data_offset);
 
         radeon_atombios_add_pplib_thermal_controller(rdev, &power_info->pplib.sThermalController);
+        rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) *
+                                       power_info->pplib.ucNumStates, GFP_KERNEL);
+        if (!rdev->pm.power_state)
+                return state_index;
         /* first mode is usually default, followed by low to high */
         for (i = 0; i < power_info->pplib.ucNumStates; i++) {
                 mode_index = 0;
@@ -2418,6 +2415,10 @@ static int radeon_atombios_parse_power_table_6(struct radeon_device *rdev)
         non_clock_info_array = (struct NonClockInfoArray *)
                 (mode_info->atom_context->bios + data_offset +
                  power_info->pplib.usNonClockInfoArrayOffset);
+        rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) *
+                                       state_array->ucNumEntries, GFP_KERNEL);
+        if (!rdev->pm.power_state)
+                return state_index;
         for (i = 0; i < state_array->ucNumEntries; i++) {
                 mode_index = 0;
                 power_state = (union pplib_power_state *)&state_array->states[i];
@@ -2491,19 +2492,22 @@ void radeon_atombios_get_power_modes(struct radeon_device *rdev)
                         break;
                 }
         } else {
-                /* add the default mode */
-                rdev->pm.power_state[state_index].type =
-                        POWER_STATE_TYPE_DEFAULT;
-                rdev->pm.power_state[state_index].num_clock_modes = 1;
-                rdev->pm.power_state[state_index].clock_info[0].mclk = rdev->clock.default_mclk;
-                rdev->pm.power_state[state_index].clock_info[0].sclk = rdev->clock.default_sclk;
-                rdev->pm.power_state[state_index].default_clock_mode =
-                        &rdev->pm.power_state[state_index].clock_info[0];
-                rdev->pm.power_state[state_index].clock_info[0].voltage.type = VOLTAGE_NONE;
-                rdev->pm.power_state[state_index].pcie_lanes = 16;
-                rdev->pm.default_power_state_index = state_index;
-                rdev->pm.power_state[state_index].flags = 0;
-                state_index++;
+                rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state), GFP_KERNEL);
+                if (rdev->pm.power_state) {
+                        /* add the default mode */
+                        rdev->pm.power_state[state_index].type =
+                                POWER_STATE_TYPE_DEFAULT;
+                        rdev->pm.power_state[state_index].num_clock_modes = 1;
+                        rdev->pm.power_state[state_index].clock_info[0].mclk = rdev->clock.default_mclk;
+                        rdev->pm.power_state[state_index].clock_info[0].sclk = rdev->clock.default_sclk;
+                        rdev->pm.power_state[state_index].default_clock_mode =
+                                &rdev->pm.power_state[state_index].clock_info[0];
+                        rdev->pm.power_state[state_index].clock_info[0].voltage.type = VOLTAGE_NONE;
+                        rdev->pm.power_state[state_index].pcie_lanes = 16;
+                        rdev->pm.default_power_state_index = state_index;
+                        rdev->pm.power_state[state_index].flags = 0;
+                        state_index++;
+                }
         }
 
         rdev->pm.num_power_states = state_index;
@@ -2619,7 +2623,7 @@ void radeon_atom_initialize_bios_scratch_regs(struct drm_device *dev)
         bios_2_scratch &= ~ATOM_S2_VRI_BRIGHT_ENABLE;
 
         /* tell the bios not to handle mode switching */
-        bios_6_scratch |= (ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH | ATOM_S6_ACC_MODE);
+        bios_6_scratch |= ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH;
 
         if (rdev->family >= CHIP_R600) {
                 WREG32(R600_BIOS_2_SCRATCH, bios_2_scratch);
@@ -2670,10 +2674,13 @@ void radeon_atom_output_lock(struct drm_encoder *encoder, bool lock)
         else
                 bios_6_scratch = RREG32(RADEON_BIOS_6_SCRATCH);
 
-        if (lock)
+        if (lock) {
                 bios_6_scratch |= ATOM_S6_CRITICAL_STATE;
-        else
+                bios_6_scratch &= ~ATOM_S6_ACC_MODE;
+        } else {
                 bios_6_scratch &= ~ATOM_S6_CRITICAL_STATE;
+                bios_6_scratch |= ATOM_S6_ACC_MODE;
+        }
 
         if (rdev->family >= CHIP_R600)
                 WREG32(R600_BIOS_6_SCRATCH, bios_6_scratch);
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 591fcae8f224..d27ef74590cd 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -2442,6 +2442,17 @@ void radeon_combios_get_power_modes(struct radeon_device *rdev)
 
         rdev->pm.default_power_state_index = -1;
 
+        /* allocate 2 power states */
+        rdev->pm.power_state = kzalloc(sizeof(struct radeon_power_state) * 2, GFP_KERNEL);
+        if (!rdev->pm.power_state) {
+                rdev->pm.default_power_state_index = state_index;
+                rdev->pm.num_power_states = 0;
+
+                rdev->pm.current_power_state_index = rdev->pm.default_power_state_index;
+                rdev->pm.current_clock_mode_index = 0;
+                return;
+        }
+
         if (rdev->flags & RADEON_IS_MOBILITY) {
                 offset = combios_get_table_offset(dev, COMBIOS_POWERPLAY_INFO_TABLE);
                 if (offset) {
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 26091d602b84..0d478932b1a9 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -891,9 +891,9 @@ int radeon_suspend_kms(struct drm_device *dev, pm_message_t state)
                 pci_disable_device(dev->pdev);
                 pci_set_power_state(dev->pdev, PCI_D3hot);
         }
-        acquire_console_sem();
+        console_lock();
         radeon_fbdev_set_suspend(rdev, 1);
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 
@@ -905,11 +905,11 @@ int radeon_resume_kms(struct drm_device *dev)
         if (dev->switch_power_state == DRM_SWITCH_POWER_OFF)
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
         pci_set_power_state(dev->pdev, PCI_D0);
         pci_restore_state(dev->pdev);
         if (pci_enable_device(dev->pdev)) {
-                release_console_sem();
+                console_unlock();
                 return -1;
         }
         pci_set_master(dev->pdev);
@@ -920,7 +920,7 @@ int radeon_resume_kms(struct drm_device *dev)
         radeon_restore_bios_scratch_regs(rdev);
 
         radeon_fbdev_set_suspend(rdev, 0);
-        release_console_sem();
+        console_unlock();
 
         /* reset hpd state */
         radeon_hpd_init(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index d26dabf878d9..2eff98cfd728 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -780,6 +780,115 @@ static int radeon_ddc_dump(struct drm_connector *connector)
         return ret;
 }
 
+/* avivo */
+static void avivo_get_fb_div(struct radeon_pll *pll,
+                             u32 target_clock,
+                             u32 post_div,
+                             u32 ref_div,
+                             u32 *fb_div,
+                             u32 *frac_fb_div)
+{
+        u32 tmp = post_div * ref_div;
+
+        tmp *= target_clock;
+        *fb_div = tmp / pll->reference_freq;
+        *frac_fb_div = tmp % pll->reference_freq;
+}
+
+static u32 avivo_get_post_div(struct radeon_pll *pll,
+                              u32 target_clock)
+{
+        u32 vco, post_div, tmp;
+
+        if (pll->flags & RADEON_PLL_USE_POST_DIV)
+                return pll->post_div;
+
+        if (pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP) {
+                if (pll->flags & RADEON_PLL_IS_LCD)
+                        vco = pll->lcd_pll_out_min;
+                else
+                        vco = pll->pll_out_min;
+        } else {
+                if (pll->flags & RADEON_PLL_IS_LCD)
+                        vco = pll->lcd_pll_out_max;
+                else
+                        vco = pll->pll_out_max;
+        }
+
+        post_div = vco / target_clock;
+        tmp = vco % target_clock;
+
+        if (pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP) {
+                if (tmp)
+                        post_div++;
+        } else {
+                if (!tmp)
+                        post_div--;
+        }
+
+        return post_div;
+}
+
+#define MAX_TOLERANCE 10
+
+void radeon_compute_pll_avivo(struct radeon_pll *pll,
+                              u32 freq,
+                              u32 *dot_clock_p,
+                              u32 *fb_div_p,
+                              u32 *frac_fb_div_p,
+                              u32 *ref_div_p,
+                              u32 *post_div_p)
+{
+        u32 target_clock = freq / 10;
+        u32 post_div = avivo_get_post_div(pll, target_clock);
+        u32 ref_div = pll->min_ref_div;
+        u32 fb_div = 0, frac_fb_div = 0, tmp;
+
+        if (pll->flags & RADEON_PLL_USE_REF_DIV)
+                ref_div = pll->reference_div;
+
+        if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV) {
+                avivo_get_fb_div(pll, target_clock, post_div, ref_div, &fb_div, &frac_fb_div);
+                frac_fb_div = (100 * frac_fb_div) / pll->reference_freq;
+                if (frac_fb_div >= 5) {
+                        frac_fb_div -= 5;
+                        frac_fb_div = frac_fb_div / 10;
+                        frac_fb_div++;
+                }
+                if (frac_fb_div >= 10) {
+                        fb_div++;
+                        frac_fb_div = 0;
+                }
+        } else {
+                while (ref_div <= pll->max_ref_div) {
+                        avivo_get_fb_div(pll, target_clock, post_div, ref_div,
+                                         &fb_div, &frac_fb_div);
+                        if (frac_fb_div >= (pll->reference_freq / 2))
+                                fb_div++;
+                        frac_fb_div = 0;
+                        tmp = (pll->reference_freq * fb_div) / (post_div * ref_div);
+                        tmp = (tmp * 10000) / target_clock;
+
+                        if (tmp > (10000 + MAX_TOLERANCE))
+                                ref_div++;
+                        else if (tmp >= (10000 - MAX_TOLERANCE))
+                                break;
+                        else
+                                ref_div++;
+                }
+        }
+
+        *dot_clock_p = ((pll->reference_freq * fb_div * 10) + (pll->reference_freq * frac_fb_div)) /
+                (ref_div * post_div * 10);
+        *fb_div_p = fb_div;
+        *frac_fb_div_p = frac_fb_div;
+        *ref_div_p = ref_div;
+        *post_div_p = post_div;
+        DRM_DEBUG_KMS("%d, pll dividers - fb: %d.%d ref: %d, post %d\n",
+                      *dot_clock_p, fb_div, frac_fb_div, ref_div, post_div);
+}
+
+/* pre-avivo */
 static inline uint32_t radeon_div(uint64_t n, uint32_t d)
 {
         uint64_t mod;
@@ -790,13 +899,13 @@ static inline uint32_t radeon_div(uint64_t n, uint32_t d)
         return n;
 }
 
-void radeon_compute_pll(struct radeon_pll *pll,
-                        uint64_t freq,
-                        uint32_t *dot_clock_p,
-                        uint32_t *fb_div_p,
-                        uint32_t *frac_fb_div_p,
-                        uint32_t *ref_div_p,
-                        uint32_t *post_div_p)
+void radeon_compute_pll_legacy(struct radeon_pll *pll,
+                               uint64_t freq,
+                               uint32_t *dot_clock_p,
+                               uint32_t *fb_div_p,
+                               uint32_t *frac_fb_div_p,
+                               uint32_t *ref_div_p,
+                               uint32_t *post_div_p)
 {
         uint32_t min_ref_div = pll->min_ref_div;
         uint32_t max_ref_div = pll->max_ref_div;
@@ -826,6 +935,9 @@ void radeon_compute_pll(struct radeon_pll *pll,
                 pll_out_max = pll->pll_out_max;
         }
 
+        if (pll_out_min > 64800)
+                pll_out_min = 64800;
+
         if (pll->flags & RADEON_PLL_USE_REF_DIV)
                 min_ref_div = max_ref_div = pll->reference_div;
         else {
@@ -849,7 +961,7 @@ void radeon_compute_pll(struct radeon_pll *pll,
                 max_fractional_feed_div = pll->max_frac_feedback_div;
         }
 
-        for (post_div = max_post_div; post_div >= min_post_div; --post_div) {
+        for (post_div = min_post_div; post_div <= max_post_div; ++post_div) {
                 uint32_t ref_div;
 
                 if ((pll->flags & RADEON_PLL_NO_ODD_POST_DIV) && (post_div & 1))
@@ -965,6 +1077,10 @@ void radeon_compute_pll(struct radeon_pll *pll,
         *frac_fb_div_p = best_frac_feedback_div;
         *ref_div_p = best_ref_div;
         *post_div_p = best_post_div;
+        DRM_DEBUG_KMS("%d %d, pll dividers - fb: %d.%d ref: %d, post %d\n",
+                      freq, best_freq / 1000, best_feedback_div, best_frac_feedback_div,
+                      best_ref_div, best_post_div);
+
 }
 
 static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb)
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 8fd184286c0b..d4a542247618 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -641,7 +641,7 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
         switch (connector->connector_type) {
         case DRM_MODE_CONNECTOR_DVII:
         case DRM_MODE_CONNECTOR_HDMIB: /* HDMI-B is basically DL-DVI; analog works fine */
-                if (drm_detect_monitor_audio(radeon_connector->edid)) {
+                if (drm_detect_monitor_audio(radeon_connector->edid) && radeon_audio) {
                         /* fix me */
                         if (ASIC_IS_DCE4(rdev))
                                 return ATOM_ENCODER_MODE_DVI;
@@ -655,7 +655,7 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
         case DRM_MODE_CONNECTOR_DVID:
         case DRM_MODE_CONNECTOR_HDMIA:
         default:
-                if (drm_detect_monitor_audio(radeon_connector->edid)) {
+                if (drm_detect_monitor_audio(radeon_connector->edid) && radeon_audio) {
                         /* fix me */
                         if (ASIC_IS_DCE4(rdev))
                                 return ATOM_ENCODER_MODE_DVI;
@@ -673,7 +673,7 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
                 if ((dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) ||
                     (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_eDP))
                         return ATOM_ENCODER_MODE_DP;
-                else if (drm_detect_monitor_audio(radeon_connector->edid)) {
+                else if (drm_detect_monitor_audio(radeon_connector->edid) && radeon_audio) {
                         /* fix me */
                         if (ASIC_IS_DCE4(rdev))
                                 return ATOM_ENCODER_MODE_DVI;
@@ -1063,7 +1063,7 @@ atombios_set_edp_panel_power(struct drm_connector *connector, int action)
         if (!ASIC_IS_DCE4(rdev))
                 return;
 
-        if ((action != ATOM_TRANSMITTER_ACTION_POWER_ON) ||
+        if ((action != ATOM_TRANSMITTER_ACTION_POWER_ON) &&
             (action != ATOM_TRANSMITTER_ACTION_POWER_OFF))
                 return;
 
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 98321298cffd..8387d32caaa7 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -247,6 +247,8 @@ void radeon_driver_preclose_kms(struct drm_device *dev,
         struct radeon_device *rdev = dev->dev_private;
         if (rdev->hyperz_filp == file_priv)
                 rdev->hyperz_filp = NULL;
+        if (rdev->cmask_filp == file_priv)
+                rdev->cmask_filp = NULL;
 }
 
 /*
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
index ace2e6384d40..cf0638c3b7c7 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
@@ -778,9 +778,9 @@ static void radeon_set_pll(struct drm_crtc *crtc, struct drm_display_mode *mode)
         DRM_DEBUG_KMS("\n");
 
         if (!use_bios_divs) {
-                radeon_compute_pll(pll, mode->clock,
-                                   &freq, &feedback_div, &frac_fb_div,
-                                   &reference_div, &post_divider);
+                radeon_compute_pll_legacy(pll, mode->clock,
+                                          &freq, &feedback_div, &frac_fb_div,
+                                          &reference_div, &post_divider);
 
                 for (post_div = &post_divs[0]; post_div->divider; ++post_div) {
                         if (post_div->divider == post_divider)
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 12bdeab91c86..6794cdf91f28 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -149,6 +149,7 @@ struct radeon_tmds_pll {
 #define RADEON_PLL_PREFER_CLOSEST_LOWER (1 << 11)
 #define RADEON_PLL_USE_POST_DIV         (1 << 12)
 #define RADEON_PLL_IS_LCD               (1 << 13)
+#define RADEON_PLL_PREFER_MINM_OVER_MAXP (1 << 14)
 
 struct radeon_pll {
         /* reference frequency */
@@ -510,13 +511,21 @@ extern bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
                                              struct radeon_atom_ss *ss,
                                              int id, u32 clock);
 
-extern void radeon_compute_pll(struct radeon_pll *pll,
-                               uint64_t freq,
-                               uint32_t *dot_clock_p,
-                               uint32_t *fb_div_p,
-                               uint32_t *frac_fb_div_p,
-                               uint32_t *ref_div_p,
-                               uint32_t *post_div_p);
+extern void radeon_compute_pll_legacy(struct radeon_pll *pll,
+                                      uint64_t freq,
+                                      uint32_t *dot_clock_p,
+                                      uint32_t *fb_div_p,
+                                      uint32_t *frac_fb_div_p,
+                                      uint32_t *ref_div_p,
+                                      uint32_t *post_div_p);
+
+extern void radeon_compute_pll_avivo(struct radeon_pll *pll,
+                                     u32 freq,
+                                     u32 *dot_clock_p,
+                                     u32 *fb_div_p,
+                                     u32 *frac_fb_div_p,
+                                     u32 *ref_div_p,
+                                     u32 *post_div_p);
 
 extern void radeon_setup_encoder_clones(struct drm_device *dev);
 
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 3b1b2bf9cdd5..2aed03bde4b2 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -430,7 +430,7 @@ static ssize_t radeon_hwmon_show_temp(struct device *dev,
 {
         struct drm_device *ddev = pci_get_drvdata(to_pci_dev(dev));
         struct radeon_device *rdev = ddev->dev_private;
-        u32 temp;
+        int temp;
 
         switch (rdev->pm.int_thermal_type) {
         case THERMAL_TYPE_RV6XX:
@@ -646,6 +646,9 @@ void radeon_pm_fini(struct radeon_device *rdev)
 #endif
         }
 
+        if (rdev->pm.power_state)
+                kfree(rdev->pm.power_state);
+
         radeon_hwmon_fini(rdev);
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_reg.h b/drivers/gpu/drm/radeon/radeon_reg.h
index 3cd4dace57c7..ec93a75369e6 100644
--- a/drivers/gpu/drm/radeon/radeon_reg.h
+++ b/drivers/gpu/drm/radeon/radeon_reg.h
@@ -375,6 +375,8 @@
 #define RADEON_CONFIG_APER_SIZE             0x0108
 #define RADEON_CONFIG_BONDS                 0x00e8
 #define RADEON_CONFIG_CNTL                  0x00e0
+#       define RADEON_CFG_VGA_RAM_EN        (1 << 8)
+#       define RADEON_CFG_VGA_IO_DIS        (1 << 9)
 #       define RADEON_CFG_ATI_REV_A11       (0   << 16)
 #       define RADEON_CFG_ATI_REV_A12       (1   << 16)
 #       define RADEON_CFG_ATI_REV_A13       (2   << 16)
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index 5512e4e5e636..c76283d9eb3d 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -203,6 +203,9 @@ void rs400_gart_fini(struct radeon_device *rdev)
         radeon_gart_table_ram_free(rdev);
 }
 
+#define RS400_PTE_WRITEABLE (1 << 2)
+#define RS400_PTE_READABLE  (1 << 3)
+
 int rs400_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
 {
         uint32_t entry;
@@ -213,7 +216,7 @@ int rs400_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
 
         entry = (lower_32_bits(addr) & PAGE_MASK) |
                 ((upper_32_bits(addr) & 0xff) << 4) |
-                0xc;
+                RS400_PTE_WRITEABLE | RS400_PTE_READABLE;
         entry = cpu_to_le32(entry);
         rdev->gart.table.ram.ptr[i] = entry;
         return 0;
@@ -226,8 +229,8 @@ int rs400_mc_wait_for_idle(struct radeon_device *rdev)
 
         for (i = 0; i < rdev->usec_timeout; i++) {
                 /* read MC_STATUS */
-                tmp = RREG32(0x0150);
-                if (tmp & (1 << 2)) {
+                tmp = RREG32(RADEON_MC_STATUS);
+                if (tmp & RADEON_MC_IDLE) {
                         return 0;
                 }
                 DRM_UDELAY(1);
@@ -241,7 +244,7 @@ void rs400_gpu_init(struct radeon_device *rdev)
         r420_pipes_init(rdev);
         if (rs400_mc_wait_for_idle(rdev)) {
                 printk(KERN_WARNING "rs400: Failed to wait MC idle while "
-                       "programming pipes. Bad things might happen. %08x\n", RREG32(0x150));
+                       "programming pipes. Bad things might happen. %08x\n", RREG32(RADEON_MC_STATUS));
         }
 }
 
@@ -300,9 +303,9 @@ static int rs400_debugfs_gart_info(struct seq_file *m, void *data)
                 seq_printf(m, "MCCFG_AGP_BASE_2 0x%08x\n", tmp);
                 tmp = RREG32_MC(RS690_MCCFG_AGP_LOCATION);
                 seq_printf(m, "MCCFG_AGP_LOCATION 0x%08x\n", tmp);
-                tmp = RREG32_MC(0x100);
+                tmp = RREG32_MC(RS690_MCCFG_FB_LOCATION);
                 seq_printf(m, "MCCFG_FB_LOCATION 0x%08x\n", tmp);
-                tmp = RREG32(0x134);
+                tmp = RREG32(RS690_HDP_FB_LOCATION);
                 seq_printf(m, "HDP_FB_LOCATION 0x%08x\n", tmp);
         } else {
                 tmp = RREG32(RADEON_AGP_BASE);
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 5d569f41f4ae..64b57af93714 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -69,13 +69,13 @@ void rv515_ring_start(struct radeon_device *rdev)
                           ISYNC_CPSCRATCH_IDLEGUI);
         radeon_ring_write(rdev, PACKET0(WAIT_UNTIL, 0));
         radeon_ring_write(rdev, WAIT_2D_IDLECLEAN | WAIT_3D_IDLECLEAN);
-        radeon_ring_write(rdev, PACKET0(0x170C, 0));
-        radeon_ring_write(rdev, 1 << 31);
+        radeon_ring_write(rdev, PACKET0(R300_DST_PIPE_CONFIG, 0));
+        radeon_ring_write(rdev, R300_PIPE_AUTO_CONFIG);
         radeon_ring_write(rdev, PACKET0(GB_SELECT, 0));
         radeon_ring_write(rdev, 0);
         radeon_ring_write(rdev, PACKET0(GB_ENABLE, 0));
         radeon_ring_write(rdev, 0);
-        radeon_ring_write(rdev, PACKET0(0x42C8, 0));
+        radeon_ring_write(rdev, PACKET0(R500_SU_REG_DEST, 0));
         radeon_ring_write(rdev, (1 << rdev->num_gb_pipes) - 1);
         radeon_ring_write(rdev, PACKET0(VAP_INDEX_OFFSET, 0));
         radeon_ring_write(rdev, 0);
@@ -153,8 +153,8 @@ void rv515_gpu_init(struct radeon_device *rdev)
         }
         rv515_vga_render_disable(rdev);
         r420_pipes_init(rdev);
-        gb_pipe_select = RREG32(0x402C);
-        tmp = RREG32(0x170C);
+        gb_pipe_select = RREG32(R400_GB_PIPE_SELECT);
+        tmp = RREG32(R300_DST_PIPE_CONFIG);
         pipe_select_current = (tmp >> 2) & 3;
         tmp = (1 << pipe_select_current) |
               (((gb_pipe_select >> 8) & 0xF) << 4);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 491dc9000655..2211a323db41 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -78,18 +78,23 @@ u32 rv770_page_flip(struct radeon_device *rdev, int crtc_id, u64 crtc_base)
 }
 
 /* get temperature in millidegrees */
-u32 rv770_get_temp(struct radeon_device *rdev)
+int rv770_get_temp(struct radeon_device *rdev)
 {
         u32 temp = (RREG32(CG_MULT_THERMAL_STATUS) & ASIC_T_MASK) >>
                 ASIC_T_SHIFT;
-        u32 actual_temp = 0;
-
-        if ((temp >> 9) & 1)
-                actual_temp = 0;
-        else
-                actual_temp = (temp >> 1) & 0xff;
-
-        return actual_temp * 1000;
+        int actual_temp;
+
+        if (temp & 0x400)
+                actual_temp = -256;
+        else if (temp & 0x200)
+                actual_temp = 255;
+        else if (temp & 0x100) {
+                actual_temp = temp & 0x1ff;
+                actual_temp |= ~0x1ff;
+        } else
+                actual_temp = temp & 0xff;
+
+        return (actual_temp * 1000) / 2;
 }
 
 void rv770_pm_misc(struct radeon_device *rdev)
diff --git a/drivers/gpu/stub/Kconfig b/drivers/gpu/stub/Kconfig
index 09aea5f1556d..70e60a4bb678 100644
--- a/drivers/gpu/stub/Kconfig
+++ b/drivers/gpu/stub/Kconfig
@@ -1,11 +1,13 @@
 config STUB_POULSBO
         tristate "Intel GMA500 Stub Driver"
         depends on PCI
+        depends on NET # for THERMAL
         # Poulsbo stub depends on ACPI_VIDEO when ACPI is enabled
         # but for select to work, need to select ACPI_VIDEO's dependencies, ick
         select BACKLIGHT_CLASS_DEVICE if ACPI
         select INPUT if ACPI
         select ACPI_VIDEO if ACPI
+        select THERMAL if ACPI
         help
           Choose this option if you have a system that has Intel GMA500
           (Poulsbo) integrated graphics. If M is selected, the module will
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index ce0372f0615e..4c0743660e9c 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -1072,6 +1072,7 @@ static int applesmc_create_nodes(struct applesmc_node_group *groups, int num)
                         node->sda.dev_attr.show = grp->show;
                         node->sda.dev_attr.store = grp->store;
                         attr = &node->sda.dev_attr.attr;
+                        sysfs_attr_init(attr);
                         attr->name = node->name;
                         attr->mode = S_IRUGO | (grp->store ? S_IWUSR : 0);
                         ret = sysfs_create_file(&pdev->dev.kobj, attr);
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index 2d68cf3c223b..b5e892017e0c 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -13,6 +13,7 @@
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 
 #include <acpi/acpi.h>
 #include <acpi/acpixf.h>
@@ -22,6 +23,21 @@
 
 #define ATK_HID "ATK0110"
 
+static bool new_if;
+module_param(new_if, bool, 0);
+MODULE_PARM_DESC(new_if, "Override detection heuristic and force the use of the new ATK0110 interface");
+
+static const struct dmi_system_id __initconst atk_force_new_if[] = {
+        {
+                /* Old interface has broken MCH temp monitoring */
+                .ident = "Asus Sabertooth X58",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_NAME, "SABERTOOTH X58")
+                }
+        },
+        { }
+};
+
 /* Minimum time between readings, enforced in order to avoid
  * hogging the CPU.
  */
@@ -1302,7 +1318,9 @@ static int atk_probe_if(struct atk_data *data)
          * analysis of multiple DSDTs indicates that when both interfaces
          * are present the new one (GGRP/GITM) is not functional.
          */
-        if (data->rtmp_handle && data->rvlt_handle && data->rfan_handle)
+        if (new_if)
+                dev_info(dev, "Overriding interface detection\n");
+        if (data->rtmp_handle && data->rvlt_handle && data->rfan_handle && !new_if)
                 data->old_interface = true;
         else if (data->enumerate_handle && data->read_handle &&
                         data->write_handle)
@@ -1420,6 +1438,9 @@ static int __init atk0110_init(void)
                 return -EBUSY;
         }
 
+        if (dmi_check_system(atk_force_new_if))
+                new_if = true;
+
         ret = acpi_bus_register_driver(&atk_driver);
         if (ret)
                 pr_info("acpi_bus_register_driver failed: %d\n", ret);
diff --git a/drivers/hwmon/lis3lv02d.c b/drivers/hwmon/lis3lv02d.c
index 1b674b7d4584..d805e8e57967 100644
--- a/drivers/hwmon/lis3lv02d.c
+++ b/drivers/hwmon/lis3lv02d.c
@@ -957,7 +957,7 @@ int lis3lv02d_init_device(struct lis3lv02d *dev)
 
         /* bail if we did not get an IRQ from the bus layer */
         if (!dev->irq) {
-                pr_err("No IRQ. Disabling /dev/freefall\n");
+                pr_debug("No IRQ. Disabling /dev/freefall\n");
                 goto out;
         }
 
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index e38be1bcc01c..fbbfa24cf572 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1079,7 +1079,7 @@ static void ib_sa_remove_one(struct ib_device *device)
 
         ib_unregister_event_handler(&sa_dev->event_handler);
 
-        flush_scheduled_work();
+        flush_workqueue(ib_wq);
 
         for (i = 0; i <= sa_dev->end_port - sa_dev->start_port; ++i) {
                 if (rdma_port_get_link_layer(device, i + 1) == IB_LINK_LAYER_INFINIBAND) {
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index ca12acf38379..ec1e9da1488b 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -636,6 +636,16 @@ static void ucma_copy_iboe_route(struct rdma_ucm_query_route_resp *resp,
         }
 }
 
+static void ucma_copy_iw_route(struct rdma_ucm_query_route_resp *resp,
+                               struct rdma_route *route)
+{
+        struct rdma_dev_addr *dev_addr;
+
+        dev_addr = &route->addr.dev_addr;
+        rdma_addr_get_dgid(dev_addr, (union ib_gid *) &resp->ib_route[0].dgid);
+        rdma_addr_get_sgid(dev_addr, (union ib_gid *) &resp->ib_route[0].sgid);
+}
+
 static ssize_t ucma_query_route(struct ucma_file *file,
                                 const char __user *inbuf,
                                 int in_len, int out_len)
@@ -670,8 +680,10 @@ static ssize_t ucma_query_route(struct ucma_file *file,
 
         resp.node_guid = (__force __u64) ctx->cm_id->device->node_guid;
         resp.port_num = ctx->cm_id->port_num;
-        if (rdma_node_get_transport(ctx->cm_id->device->node_type) == RDMA_TRANSPORT_IB) {
-                switch (rdma_port_get_link_layer(ctx->cm_id->device, ctx->cm_id->port_num)) {
+        switch (rdma_node_get_transport(ctx->cm_id->device->node_type)) {
+        case RDMA_TRANSPORT_IB:
+                switch (rdma_port_get_link_layer(ctx->cm_id->device,
+                        ctx->cm_id->port_num)) {
                 case IB_LINK_LAYER_INFINIBAND:
                         ucma_copy_ib_route(&resp, &ctx->cm_id->route);
                         break;
@@ -681,6 +693,12 @@ static ssize_t ucma_query_route(struct ucma_file *file,
                 default:
                         break;
                 }
+                break;
+        case RDMA_TRANSPORT_IWARP:
+                ucma_copy_iw_route(&resp, &ctx->cm_id->route);
+                break;
+        default:
+                break;
         }
 
 out:
diff --git a/drivers/infiniband/hw/amso1100/c2_vq.c b/drivers/infiniband/hw/amso1100/c2_vq.c
index 9ce7819b7b2e..2ec716fb2edb 100644
--- a/drivers/infiniband/hw/amso1100/c2_vq.c
+++ b/drivers/infiniband/hw/amso1100/c2_vq.c
@@ -107,7 +107,7 @@ struct c2_vq_req *vq_req_alloc(struct c2_dev *c2dev)
         r = kmalloc(sizeof(struct c2_vq_req), GFP_KERNEL);
         if (r) {
                 init_waitqueue_head(&r->wait_object);
-                r->reply_msg = (u64) NULL;
+                r->reply_msg = 0;
                 r->event = 0;
                 r->cm_id = NULL;
                 r->qp = NULL;
@@ -123,7 +123,7 @@ struct c2_vq_req *vq_req_alloc(struct c2_dev *c2dev)
  */
 void vq_req_free(struct c2_dev *c2dev, struct c2_vq_req *r)
 {
-        r->reply_msg = (u64) NULL;
+        r->reply_msg = 0;
         if (atomic_dec_and_test(&r->refcnt)) {
                 kfree(r);
         }
@@ -151,7 +151,7 @@ void vq_req_get(struct c2_dev *c2dev, struct c2_vq_req *r)
 void vq_req_put(struct c2_dev *c2dev, struct c2_vq_req *r)
 {
         if (atomic_dec_and_test(&r->refcnt)) {
-                if (r->reply_msg != (u64) NULL)
+                if (r->reply_msg != 0)
                         vq_repbuf_free(c2dev,
                                        (void *) (unsigned long) r->reply_msg);
                 kfree(r);
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 0dc62b1438be..8b00e6c46f01 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -380,7 +380,7 @@ static void send_flowc(struct c4iw_ep *ep, struct sk_buff *skb)
                                           16)) | FW_WR_FLOWID(ep->hwtid));
 
         flowc->mnemval[0].mnemonic = FW_FLOWC_MNEM_PFNVFN;
-        flowc->mnemval[0].val = cpu_to_be32(0);
+        flowc->mnemval[0].val = cpu_to_be32(PCI_FUNC(ep->com.dev->rdev.lldi.pdev->devfn) << 8);
         flowc->mnemval[1].mnemonic = FW_FLOWC_MNEM_CH;
         flowc->mnemval[1].val = cpu_to_be32(ep->tx_chan);
         flowc->mnemval[2].mnemonic = FW_FLOWC_MNEM_PORT;
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 20800900ef3f..4f0be25cab1a 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -220,7 +220,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
                 V_FW_RI_RES_WR_DCAEN(0) |
                 V_FW_RI_RES_WR_DCACPU(0) |
                 V_FW_RI_RES_WR_FBMIN(2) |
-                V_FW_RI_RES_WR_FBMAX(3) |
+                V_FW_RI_RES_WR_FBMAX(2) |
                 V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
                 V_FW_RI_RES_WR_CIDXFTHRESH(0) |
                 V_FW_RI_RES_WR_EQSIZE(eqsize));
@@ -243,7 +243,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
                 V_FW_RI_RES_WR_DCAEN(0) |
                 V_FW_RI_RES_WR_DCACPU(0) |
                 V_FW_RI_RES_WR_FBMIN(2) |
-                V_FW_RI_RES_WR_FBMAX(3) |
+                V_FW_RI_RES_WR_FBMAX(2) |
                 V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
                 V_FW_RI_RES_WR_CIDXFTHRESH(0) |
                 V_FW_RI_RES_WR_EQSIZE(eqsize));
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 50cceb3ab885..b01809a82cb0 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -623,7 +623,6 @@ struct qib_chippport_specific {
         u8 ibmalfusesnap;
         struct qib_qsfp_data qsfp_data;
         char epmsgbuf[192]; /* for port error interrupt msg buffer */
-        u8 bounced;
 };
 
 static struct {
@@ -1881,23 +1880,7 @@ static noinline void handle_7322_p_errors(struct qib_pportdata *ppd)
                     IB_PHYSPORTSTATE_DISABLED)
                         qib_set_ib_7322_lstate(ppd, 0,
                                QLOGIC_IB_IBCC_LINKINITCMD_DISABLE);
-                else {
-                        u32 lstate;
-                        /*
-                         * We need the current logical link state before
-                         * lflags are set in handle_e_ibstatuschanged.
-                         */
-                        lstate = qib_7322_iblink_state(ibcs);
-
-                        if (IS_QMH(dd) && !ppd->cpspec->bounced &&
-                            ltstate == IB_PHYSPORTSTATE_LINKUP &&
-                            (lstate >= IB_PORT_INIT &&
-                                lstate <= IB_PORT_ACTIVE)) {
-                                ppd->cpspec->bounced = 1;
-                                qib_7322_set_ib_cfg(ppd, QIB_IB_CFG_LSTATE,
-                                        IB_LINKCMD_DOWN | IB_LINKINITCMD_POLL);
-                        }
-
+                else
                         /*
                          * Since going into a recovery state causes the link
                          * state to go down and since recovery is transitory,
@@ -1911,7 +1894,6 @@ static noinline void handle_7322_p_errors(struct qib_pportdata *ppd)
                             ltstate != IB_PHYSPORTSTATE_RECOVERY_WAITRMT &&
                             ltstate != IB_PHYSPORTSTATE_RECOVERY_IDLE)
                                 qib_handle_e_ibstatuschanged(ppd, ibcs);
-                }
         }
         if (*msg && iserr)
                 qib_dev_porterr(dd, ppd->port, "%s error\n", msg);
@@ -2381,6 +2363,11 @@ static int qib_7322_bringup_serdes(struct qib_pportdata *ppd)
         qib_write_kreg_port(ppd, krp_rcvctrl, ppd->p_rcvctrl);
         spin_unlock_irqrestore(&dd->cspec->rcvmod_lock, flags);
 
+        /* Hold the link state machine for mezz boards */
+        if (IS_QMH(dd) || IS_QME(dd))
+                qib_set_ib_7322_lstate(ppd, 0,
+                                       QLOGIC_IB_IBCC_LINKINITCMD_DISABLE);
+
         /* Also enable IBSTATUSCHG interrupt.  */
         val = qib_read_kreg_port(ppd, krp_errmask);
         qib_write_kreg_port(ppd, krp_errmask,
@@ -5702,6 +5689,11 @@ static void set_no_qsfp_atten(struct qib_devdata *dd, int change)
                                 ppd->cpspec->h1_val = h1;
                         /* now change the IBC and serdes, overriding generic */
                         init_txdds_table(ppd, 1);
+                        /* Re-enable the physical state machine on mezz boards
+                         * now that the correct settings have been set. */
+                        if (IS_QMH(dd) || IS_QME(dd))
+                                qib_set_ib_7322_lstate(ppd, 0,
+                                            QLOGIC_IB_IBCC_LINKINITCMD_SLEEP);
                         any++;
                 }
                 if (*nxt == '\n')
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 417507348bab..c7a92028f450 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -343,6 +343,16 @@ config KEYBOARD_NOMADIK
           To compile this driver as a module, choose M here: the
           module will be called nmk-ske-keypad.
 
+config KEYBOARD_TEGRA
+        tristate "NVIDIA Tegra internal matrix keyboard controller support"
+        depends on ARCH_TEGRA
+        help
+          Say Y here if you want to use a matrix keyboard connected directly
+          to the internal keyboard controller on Tegra SoCs.
+
+          To compile this driver as a module, choose M here: the
+          module will be called tegra-kbc.
+
 config KEYBOARD_OPENCORES
         tristate "OpenCores Keyboard Controller"
         help
diff --git a/drivers/input/keyboard/Makefile b/drivers/input/keyboard/Makefile
index 4e5571b72cda..468c627a2844 100644
--- a/drivers/input/keyboard/Makefile
+++ b/drivers/input/keyboard/Makefile
@@ -42,6 +42,7 @@ obj-$(CONFIG_KEYBOARD_STMPE)		+= stmpe-keypad.o
 obj-$(CONFIG_KEYBOARD_STOWAWAY)         += stowaway.o
 obj-$(CONFIG_KEYBOARD_SUNKBD)           += sunkbd.o
 obj-$(CONFIG_KEYBOARD_TC3589X)          += tc3589x-keypad.o
+obj-$(CONFIG_KEYBOARD_TEGRA)            += tegra-kbc.o
 obj-$(CONFIG_KEYBOARD_TNETV107X)        += tnetv107x-keypad.o
 obj-$(CONFIG_KEYBOARD_TWL4030)          += twl4030_keypad.o
 obj-$(CONFIG_KEYBOARD_XTKBD)            += xtkbd.o
diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
index 6069abe31e42..eb3006361ee4 100644
--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c
@@ -322,7 +322,7 @@ static void gpio_keys_report_event(struct gpio_button_data *bdata)
         struct gpio_keys_button *button = bdata->button;
         struct input_dev *input = bdata->input;
         unsigned int type = button->type ?: EV_KEY;
-        int state = (gpio_get_value(button->gpio) ? 1 : 0) ^ button->active_low;
+        int state = (gpio_get_value_cansleep(button->gpio) ? 1 : 0) ^ button->active_low;
 
         input_event(input, type, button->code, !!state);
         input_sync(input);
@@ -410,8 +410,8 @@ static int __devinit gpio_keys_setup_key(struct platform_device *pdev,
         if (!button->can_disable)
                 irqflags |= IRQF_SHARED;
 
-        error = request_irq(irq, gpio_keys_isr, irqflags, desc, bdata);
-        if (error) {
+        error = request_any_context_irq(irq, gpio_keys_isr, irqflags, desc, bdata);
+        if (error < 0) {
                 dev_err(dev, "Unable to claim irq %d; error %d\n",
                         irq, error);
                 goto fail3;
diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c
new file mode 100644
index 000000000000..ac471b77c18e
--- /dev/null
+++ b/drivers/input/keyboard/tegra-kbc.c
@@ -0,0 +1,727 @@
+/*
+ * Keyboard class input driver for the NVIDIA Tegra SoC internal matrix
+ * keyboard controller
+ *
+ * Copyright (c) 2009-2011, NVIDIA Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/input.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/io.h>
+#include <linux/interrupt.h>
+#include <linux/clk.h>
+#include <linux/slab.h>
+#include <mach/clk.h>
+#include <mach/kbc.h>
+
+#define KBC_MAX_DEBOUNCE_CNT    0x3ffu
+
+/* KBC row scan time and delay for beginning the row scan. */
+#define KBC_ROW_SCAN_TIME       16
+#define KBC_ROW_SCAN_DLY        5
+
+/* KBC uses a 32KHz clock so a cycle = 1/32Khz */
+#define KBC_CYCLE_USEC  32
+
+/* KBC Registers */
+
+/* KBC Control Register */
+#define KBC_CONTROL_0   0x0
+#define KBC_FIFO_TH_CNT_SHIFT(cnt)      (cnt << 14)
+#define KBC_DEBOUNCE_CNT_SHIFT(cnt)     (cnt << 4)
+#define KBC_CONTROL_FIFO_CNT_INT_EN     (1 << 3)
+#define KBC_CONTROL_KBC_EN              (1 << 0)
+
+/* KBC Interrupt Register */
+#define KBC_INT_0       0x4
+#define KBC_INT_FIFO_CNT_INT_STATUS     (1 << 2)
+
+#define KBC_ROW_CFG0_0  0x8
+#define KBC_COL_CFG0_0  0x18
+#define KBC_INIT_DLY_0  0x28
+#define KBC_RPT_DLY_0   0x2c
+#define KBC_KP_ENT0_0   0x30
+#define KBC_KP_ENT1_0   0x34
+#define KBC_ROW0_MASK_0 0x38
+
+#define KBC_ROW_SHIFT   3
+
+struct tegra_kbc {
+        void __iomem *mmio;
+        struct input_dev *idev;
+        unsigned int irq;
+        unsigned int wake_enable_rows;
+        unsigned int wake_enable_cols;
+        spinlock_t lock;
+        unsigned int repoll_dly;
+        unsigned long cp_dly_jiffies;
+        const struct tegra_kbc_platform_data *pdata;
+        unsigned short keycode[KBC_MAX_KEY];
+        unsigned short current_keys[KBC_MAX_KPENT];
+        unsigned int num_pressed_keys;
+        struct timer_list timer;
+        struct clk *clk;
+};
+
+static const u32 tegra_kbc_default_keymap[] = {
+        KEY(0, 2, KEY_W),
+        KEY(0, 3, KEY_S),
+        KEY(0, 4, KEY_A),
+        KEY(0, 5, KEY_Z),
+        KEY(0, 7, KEY_FN),
+
+        KEY(1, 7, KEY_LEFTMETA),
+
+        KEY(2, 6, KEY_RIGHTALT),
+        KEY(2, 7, KEY_LEFTALT),
+
+        KEY(3, 0, KEY_5),
+        KEY(3, 1, KEY_4),
+        KEY(3, 2, KEY_R),
+        KEY(3, 3, KEY_E),
+        KEY(3, 4, KEY_F),
+        KEY(3, 5, KEY_D),
+        KEY(3, 6, KEY_X),
+
+        KEY(4, 0, KEY_7),
+        KEY(4, 1, KEY_6),
+        KEY(4, 2, KEY_T),
+        KEY(4, 3, KEY_H),
+        KEY(4, 4, KEY_G),
+        KEY(4, 5, KEY_V),
+        KEY(4, 6, KEY_C),
+        KEY(4, 7, KEY_SPACE),
+
+        KEY(5, 0, KEY_9),
+        KEY(5, 1, KEY_8),
+        KEY(5, 2, KEY_U),
+        KEY(5, 3, KEY_Y),
+        KEY(5, 4, KEY_J),
+        KEY(5, 5, KEY_N),
+        KEY(5, 6, KEY_B),
+        KEY(5, 7, KEY_BACKSLASH),
+
+        KEY(6, 0, KEY_MINUS),
+        KEY(6, 1, KEY_0),
+        KEY(6, 2, KEY_O),
+        KEY(6, 3, KEY_I),
+        KEY(6, 4, KEY_L),
+        KEY(6, 5, KEY_K),
+        KEY(6, 6, KEY_COMMA),
+        KEY(6, 7, KEY_M),
+
+        KEY(7, 1, KEY_EQUAL),
+        KEY(7, 2, KEY_RIGHTBRACE),
+        KEY(7, 3, KEY_ENTER),
+        KEY(7, 7, KEY_MENU),
+
+        KEY(8, 4, KEY_RIGHTSHIFT),
+        KEY(8, 5, KEY_LEFTSHIFT),
+
+        KEY(9, 5, KEY_RIGHTCTRL),
+        KEY(9, 7, KEY_LEFTCTRL),
+
+        KEY(11, 0, KEY_LEFTBRACE),
+        KEY(11, 1, KEY_P),
+        KEY(11, 2, KEY_APOSTROPHE),
+        KEY(11, 3, KEY_SEMICOLON),
+        KEY(11, 4, KEY_SLASH),
+        KEY(11, 5, KEY_DOT),
+
+        KEY(12, 0, KEY_F10),
+        KEY(12, 1, KEY_F9),
+        KEY(12, 2, KEY_BACKSPACE),
+        KEY(12, 3, KEY_3),
+        KEY(12, 4, KEY_2),
+        KEY(12, 5, KEY_UP),
+        KEY(12, 6, KEY_PRINT),
+        KEY(12, 7, KEY_PAUSE),
+
+        KEY(13, 0, KEY_INSERT),
+        KEY(13, 1, KEY_DELETE),
+        KEY(13, 3, KEY_PAGEUP),
+        KEY(13, 4, KEY_PAGEDOWN),
+        KEY(13, 5, KEY_RIGHT),
+        KEY(13, 6, KEY_DOWN),
+        KEY(13, 7, KEY_LEFT),
+
+        KEY(14, 0, KEY_F11),
+        KEY(14, 1, KEY_F12),
+        KEY(14, 2, KEY_F8),
+        KEY(14, 3, KEY_Q),
+        KEY(14, 4, KEY_F4),
+        KEY(14, 5, KEY_F3),
+        KEY(14, 6, KEY_1),
+        KEY(14, 7, KEY_F7),
+
+        KEY(15, 0, KEY_ESC),
+        KEY(15, 1, KEY_GRAVE),
+        KEY(15, 2, KEY_F5),
+        KEY(15, 3, KEY_TAB),
+        KEY(15, 4, KEY_F1),
+        KEY(15, 5, KEY_F2),
+        KEY(15, 6, KEY_CAPSLOCK),
+        KEY(15, 7, KEY_F6),
+};
+
+static const struct matrix_keymap_data tegra_kbc_default_keymap_data = {
+        .keymap         = tegra_kbc_default_keymap,
+        .keymap_size    = ARRAY_SIZE(tegra_kbc_default_keymap),
+};
+
+static void tegra_kbc_report_released_keys(struct input_dev *input,
+                                           unsigned short old_keycodes[],
+                                           unsigned int old_num_keys,
+                                           unsigned short new_keycodes[],
+                                           unsigned int new_num_keys)
+{
+        unsigned int i, j;
+
+        for (i = 0; i < old_num_keys; i++) {
+                for (j = 0; j < new_num_keys; j++)
+                        if (old_keycodes[i] == new_keycodes[j])
+                                break;
+
+                if (j == new_num_keys)
+                        input_report_key(input, old_keycodes[i], 0);
+        }
+}
+
+static void tegra_kbc_report_pressed_keys(struct input_dev *input,
+                                          unsigned char scancodes[],
+                                          unsigned short keycodes[],
+                                          unsigned int num_pressed_keys)
+{
+        unsigned int i;
+
+        for (i = 0; i < num_pressed_keys; i++) {
+                input_event(input, EV_MSC, MSC_SCAN, scancodes[i]);
+                input_report_key(input, keycodes[i], 1);
+        }
+}
+
+static void tegra_kbc_report_keys(struct tegra_kbc *kbc)
+{
+        unsigned char scancodes[KBC_MAX_KPENT];
+        unsigned short keycodes[KBC_MAX_KPENT];
+        u32 val = 0;
+        unsigned int i;
+        unsigned int num_down = 0;
+        unsigned long flags;
+
+        spin_lock_irqsave(&kbc->lock, flags);
+        for (i = 0; i < KBC_MAX_KPENT; i++) {
+                if ((i % 4) == 0)
+                        val = readl(kbc->mmio + KBC_KP_ENT0_0 + i);
+
+                if (val & 0x80) {
+                        unsigned int col = val & 0x07;
+                        unsigned int row = (val >> 3) & 0x0f;
+                        unsigned char scancode =
+                                MATRIX_SCAN_CODE(row, col, KBC_ROW_SHIFT);
+
+                        scancodes[num_down] = scancode;
+                        keycodes[num_down++] = kbc->keycode[scancode];
+                }
+
+                val >>= 8;
+        }
+        spin_unlock_irqrestore(&kbc->lock, flags);
+
+        tegra_kbc_report_released_keys(kbc->idev,
+                                       kbc->current_keys, kbc->num_pressed_keys,
+                                       keycodes, num_down);
+        tegra_kbc_report_pressed_keys(kbc->idev, scancodes, keycodes, num_down);
+        input_sync(kbc->idev);
+
+        memcpy(kbc->current_keys, keycodes, sizeof(kbc->current_keys));
+        kbc->num_pressed_keys = num_down;
+}
+
+static void tegra_kbc_keypress_timer(unsigned long data)
+{
+        struct tegra_kbc *kbc = (struct tegra_kbc *)data;
+        unsigned long flags;
+        u32 val;
+        unsigned int i;
+
+        val = (readl(kbc->mmio + KBC_INT_0) >> 4) & 0xf;
+        if (val) {
+                unsigned long dly;
+
+                tegra_kbc_report_keys(kbc);
+
+                /*
+                 * If more than one keys are pressed we need not wait
+                 * for the repoll delay.
+                 */
+                dly = (val == 1) ? kbc->repoll_dly : 1;
+                mod_timer(&kbc->timer, jiffies + msecs_to_jiffies(dly));
+        } else {
+                /* Release any pressed keys and exit the polling loop */
+                for (i = 0; i < kbc->num_pressed_keys; i++)
+                        input_report_key(kbc->idev, kbc->current_keys[i], 0);
+                input_sync(kbc->idev);
+
+                kbc->num_pressed_keys = 0;
+
+                /* All keys are released so enable the keypress interrupt */
+                spin_lock_irqsave(&kbc->lock, flags);
+                val = readl(kbc->mmio + KBC_CONTROL_0);
+                val |= KBC_CONTROL_FIFO_CNT_INT_EN;
+                writel(val, kbc->mmio + KBC_CONTROL_0);
+                spin_unlock_irqrestore(&kbc->lock, flags);
+        }
+}
+
+static irqreturn_t tegra_kbc_isr(int irq, void *args)
+{
+        struct tegra_kbc *kbc = args;
+        u32 val, ctl;
+
+        /*
+         * Until all keys are released, defer further processing to
+         * the polling loop in tegra_kbc_keypress_timer
+         */
+        ctl = readl(kbc->mmio + KBC_CONTROL_0);
+        ctl &= ~KBC_CONTROL_FIFO_CNT_INT_EN;
+        writel(ctl, kbc->mmio + KBC_CONTROL_0);
+
+        /*
+         * Quickly bail out & reenable interrupts if the fifo threshold
+         * count interrupt wasn't the interrupt source
+         */
+        val = readl(kbc->mmio + KBC_INT_0);
+        writel(val, kbc->mmio + KBC_INT_0);
+
+        if (val & KBC_INT_FIFO_CNT_INT_STATUS) {
+                /*
+                 * Schedule timer to run when hardware is in continuous
+                 * polling mode.
+                 */
+                mod_timer(&kbc->timer, jiffies + kbc->cp_dly_jiffies);
+        } else {
+                ctl |= KBC_CONTROL_FIFO_CNT_INT_EN;
+                writel(ctl, kbc->mmio + KBC_CONTROL_0);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static void tegra_kbc_setup_wakekeys(struct tegra_kbc *kbc, bool filter)
+{
+        const struct tegra_kbc_platform_data *pdata = kbc->pdata;
+        int i;
+        unsigned int rst_val;
+
+        BUG_ON(pdata->wake_cnt > KBC_MAX_KEY);
+        rst_val = (filter && pdata->wake_cnt) ? ~0 : 0;
+
+        for (i = 0; i < KBC_MAX_ROW; i++)
+                writel(rst_val, kbc->mmio + KBC_ROW0_MASK_0 + i * 4);
+
+        if (filter) {
+                for (i = 0; i < pdata->wake_cnt; i++) {
+                        u32 val, addr;
+                        addr = pdata->wake_cfg[i].row * 4 + KBC_ROW0_MASK_0;
+                        val = readl(kbc->mmio + addr);
+                        val &= ~(1 << pdata->wake_cfg[i].col);
+                        writel(val, kbc->mmio + addr);
+                }
+        }
+}
+
+static void tegra_kbc_config_pins(struct tegra_kbc *kbc)
+{
+        const struct tegra_kbc_platform_data *pdata = kbc->pdata;
+        int i;
+
+        for (i = 0; i < KBC_MAX_GPIO; i++) {
+                u32 r_shft = 5 * (i % 6);
+                u32 c_shft = 4 * (i % 8);
+                u32 r_mask = 0x1f << r_shft;
+                u32 c_mask = 0x0f << c_shft;
+                u32 r_offs = (i / 6) * 4 + KBC_ROW_CFG0_0;
+                u32 c_offs = (i / 8) * 4 + KBC_COL_CFG0_0;
+                u32 row_cfg = readl(kbc->mmio + r_offs);
+                u32 col_cfg = readl(kbc->mmio + c_offs);
+
+                row_cfg &= ~r_mask;
+                col_cfg &= ~c_mask;
+
+                if (pdata->pin_cfg[i].is_row)
+                        row_cfg |= ((pdata->pin_cfg[i].num << 1) | 1) << r_shft;
+                else
+                        col_cfg |= ((pdata->pin_cfg[i].num << 1) | 1) << c_shft;
+
+                writel(row_cfg, kbc->mmio + r_offs);
+                writel(col_cfg, kbc->mmio + c_offs);
+        }
+}
+
+static int tegra_kbc_start(struct tegra_kbc *kbc)
+{
+        const struct tegra_kbc_platform_data *pdata = kbc->pdata;
+        unsigned long flags;
+        unsigned int debounce_cnt;
+        u32 val = 0;
+
+        clk_enable(kbc->clk);
+
+        /* Reset the KBC controller to clear all previous status.*/
+        tegra_periph_reset_assert(kbc->clk);
+        udelay(100);
+        tegra_periph_reset_deassert(kbc->clk);
+        udelay(100);
+
+        tegra_kbc_config_pins(kbc);
+        tegra_kbc_setup_wakekeys(kbc, false);
+
+        writel(pdata->repeat_cnt, kbc->mmio + KBC_RPT_DLY_0);
+
+        /* Keyboard debounce count is maximum of 12 bits. */
+        debounce_cnt = min(pdata->debounce_cnt, KBC_MAX_DEBOUNCE_CNT);
+        val = KBC_DEBOUNCE_CNT_SHIFT(debounce_cnt);
+        val |= KBC_FIFO_TH_CNT_SHIFT(1); /* set fifo interrupt threshold to 1 */
+        val |= KBC_CONTROL_FIFO_CNT_INT_EN;  /* interrupt on FIFO threshold */
+        val |= KBC_CONTROL_KBC_EN;     /* enable */
+        writel(val, kbc->mmio + KBC_CONTROL_0);
+
+        /*
+         * Compute the delay(ns) from interrupt mode to continuous polling
+         * mode so the timer routine is scheduled appropriately.
+         */
+        val = readl(kbc->mmio + KBC_INIT_DLY_0);
+        kbc->cp_dly_jiffies = usecs_to_jiffies((val & 0xfffff) * 32);
+
+        kbc->num_pressed_keys = 0;
+
+        /*
+         * Atomically clear out any remaining entries in the key FIFO
+         * and enable keyboard interrupts.
+         */
+        spin_lock_irqsave(&kbc->lock, flags);
+        while (1) {
+                val = readl(kbc->mmio + KBC_INT_0);
+                val >>= 4;
+                if (!val)
+                        break;
+
+                val = readl(kbc->mmio + KBC_KP_ENT0_0);
+                val = readl(kbc->mmio + KBC_KP_ENT1_0);
+        }
+        writel(0x7, kbc->mmio + KBC_INT_0);
+        spin_unlock_irqrestore(&kbc->lock, flags);
+
+        enable_irq(kbc->irq);
+
+        return 0;
+}
+
+static void tegra_kbc_stop(struct tegra_kbc *kbc)
+{
+        unsigned long flags;
+        u32 val;
+
+        spin_lock_irqsave(&kbc->lock, flags);
+        val = readl(kbc->mmio + KBC_CONTROL_0);
+        val &= ~1;
+        writel(val, kbc->mmio + KBC_CONTROL_0);
+        spin_unlock_irqrestore(&kbc->lock, flags);
+
+        disable_irq(kbc->irq);
+        del_timer_sync(&kbc->timer);
+
+        clk_disable(kbc->clk);
+}
+
+static int tegra_kbc_open(struct input_dev *dev)
+{
+        struct tegra_kbc *kbc = input_get_drvdata(dev);
+
+        return tegra_kbc_start(kbc);
+}
+
+static void tegra_kbc_close(struct input_dev *dev)
+{
+        struct tegra_kbc *kbc = input_get_drvdata(dev);
+
+        return tegra_kbc_stop(kbc);
+}
+
+static bool __devinit
+tegra_kbc_check_pin_cfg(const struct tegra_kbc_platform_data *pdata,
+                        struct device *dev, unsigned int *num_rows)
+{
+        int i;
+
+        *num_rows = 0;
+
+        for (i = 0; i < KBC_MAX_GPIO; i++) {
+                const struct tegra_kbc_pin_cfg *pin_cfg = &pdata->pin_cfg[i];
+
+                if (pin_cfg->is_row) {
+                        if (pin_cfg->num >= KBC_MAX_ROW) {
+                                dev_err(dev,
+                                        "pin_cfg[%d]: invalid row number %d\n",
+                                        i, pin_cfg->num);
+                                return false;
+                        }
+                        (*num_rows)++;
+                } else {
+                        if (pin_cfg->num >= KBC_MAX_COL) {
+                                dev_err(dev,
+                                        "pin_cfg[%d]: invalid column number %d\n",
+                                        i, pin_cfg->num);
+                                return false;
+                        }
+                }
+        }
+
+        return true;
+}
+
+static int __devinit tegra_kbc_probe(struct platform_device *pdev)
+{
+        const struct tegra_kbc_platform_data *pdata = pdev->dev.platform_data;
+        const struct matrix_keymap_data *keymap_data;
+        struct tegra_kbc *kbc;
+        struct input_dev *input_dev;
+        struct resource *res;
+        int irq;
+        int err;
+        int i;
+        int num_rows = 0;
+        unsigned int debounce_cnt;
+        unsigned int scan_time_rows;
+
+        if (!pdata)
+                return -EINVAL;
+
+        if (!tegra_kbc_check_pin_cfg(pdata, &pdev->dev, &num_rows))
+                return -EINVAL;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "failed to get I/O memory\n");
+                return -ENXIO;
+        }
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "failed to get keyboard IRQ\n");
+                return -ENXIO;
+        }
+
+        kbc = kzalloc(sizeof(*kbc), GFP_KERNEL);
+        input_dev = input_allocate_device();
+        if (!kbc || !input_dev) {
+                err = -ENOMEM;
+                goto err_free_mem;
+        }
+
+        kbc->pdata = pdata;
+        kbc->idev = input_dev;
+        kbc->irq = irq;
+        spin_lock_init(&kbc->lock);
+        setup_timer(&kbc->timer, tegra_kbc_keypress_timer, (unsigned long)kbc);
+
+        res = request_mem_region(res->start, resource_size(res), pdev->name);
+        if (!res) {
+                dev_err(&pdev->dev, "failed to request I/O memory\n");
+                err = -EBUSY;
+                goto err_free_mem;
+        }
+
+        kbc->mmio = ioremap(res->start, resource_size(res));
+        if (!kbc->mmio) {
+                dev_err(&pdev->dev, "failed to remap I/O memory\n");
+                err = -ENXIO;
+                goto err_free_mem_region;
+        }
+
+        kbc->clk = clk_get(&pdev->dev, NULL);
+        if (IS_ERR(kbc->clk)) {
+                dev_err(&pdev->dev, "failed to get keyboard clock\n");
+                err = PTR_ERR(kbc->clk);
+                goto err_iounmap;
+        }
+
+        kbc->wake_enable_rows = 0;
+        kbc->wake_enable_cols = 0;
+        for (i = 0; i < pdata->wake_cnt; i++) {
+                kbc->wake_enable_rows |= (1 << pdata->wake_cfg[i].row);
+                kbc->wake_enable_cols |= (1 << pdata->wake_cfg[i].col);
+        }
+
+        /*
+         * The time delay between two consecutive reads of the FIFO is
+         * the sum of the repeat time and the time taken for scanning
+         * the rows. There is an additional delay before the row scanning
+         * starts. The repoll delay is computed in milliseconds.
+         */
+        debounce_cnt = min(pdata->debounce_cnt, KBC_MAX_DEBOUNCE_CNT);
+        scan_time_rows = (KBC_ROW_SCAN_TIME + debounce_cnt) * num_rows;
+        kbc->repoll_dly = KBC_ROW_SCAN_DLY + scan_time_rows + pdata->repeat_cnt;
+        kbc->repoll_dly = ((kbc->repoll_dly * KBC_CYCLE_USEC) + 999) / 1000;
+
+        input_dev->name = pdev->name;
+        input_dev->id.bustype = BUS_HOST;
+        input_dev->dev.parent = &pdev->dev;
+        input_dev->open = tegra_kbc_open;
+        input_dev->close = tegra_kbc_close;
+
+        input_set_drvdata(input_dev, kbc);
+
+        input_dev->evbit[0] = BIT_MASK(EV_KEY);
+        input_set_capability(input_dev, EV_MSC, MSC_SCAN);
+
+        input_dev->keycode = kbc->keycode;
+        input_dev->keycodesize = sizeof(kbc->keycode[0]);
+        input_dev->keycodemax = ARRAY_SIZE(kbc->keycode);
+
+        keymap_data = pdata->keymap_data ?: &tegra_kbc_default_keymap_data;
+        matrix_keypad_build_keymap(keymap_data, KBC_ROW_SHIFT,
+                                   input_dev->keycode, input_dev->keybit);
+
+        err = request_irq(kbc->irq, tegra_kbc_isr, IRQF_TRIGGER_HIGH,
+                          pdev->name, kbc);
+        if (err) {
+                dev_err(&pdev->dev, "failed to request keyboard IRQ\n");
+                goto err_put_clk;
+        }
+
+        disable_irq(kbc->irq);
+
+        err = input_register_device(kbc->idev);
+        if (err) {
+                dev_err(&pdev->dev, "failed to register input device\n");
+                goto err_free_irq;
+        }
+
+        platform_set_drvdata(pdev, kbc);
+        device_init_wakeup(&pdev->dev, pdata->wakeup);
+
+        return 0;
+
+err_free_irq:
+        free_irq(kbc->irq, pdev);
+err_put_clk:
+        clk_put(kbc->clk);
+err_iounmap:
+        iounmap(kbc->mmio);
+err_free_mem_region:
+        release_mem_region(res->start, resource_size(res));
+err_free_mem:
+        input_free_device(kbc->idev);
+        kfree(kbc);
+
+        return err;
+}
+
+static int __devexit tegra_kbc_remove(struct platform_device *pdev)
+{
+        struct tegra_kbc *kbc = platform_get_drvdata(pdev);
+        struct resource *res;
+
+        free_irq(kbc->irq, pdev);
+        clk_put(kbc->clk);
+
+        input_unregister_device(kbc->idev);
+        iounmap(kbc->mmio);
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        release_mem_region(res->start, resource_size(res));
+
+        kfree(kbc);
+
+        platform_set_drvdata(pdev, NULL);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int tegra_kbc_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct tegra_kbc *kbc = platform_get_drvdata(pdev);
+
+        if (device_may_wakeup(&pdev->dev)) {
+                tegra_kbc_setup_wakekeys(kbc, true);
+                enable_irq_wake(kbc->irq);
+                /* Forcefully clear the interrupt status */
+                writel(0x7, kbc->mmio + KBC_INT_0);
+                msleep(30);
+        } else {
+                mutex_lock(&kbc->idev->mutex);
+                if (kbc->idev->users)
+                        tegra_kbc_stop(kbc);
+                mutex_unlock(&kbc->idev->mutex);
+        }
+
+        return 0;
+}
+
+static int tegra_kbc_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct tegra_kbc *kbc = platform_get_drvdata(pdev);
+        int err = 0;
+
+        if (device_may_wakeup(&pdev->dev)) {
+                disable_irq_wake(kbc->irq);
+                tegra_kbc_setup_wakekeys(kbc, false);
+        } else {
+                mutex_lock(&kbc->idev->mutex);
+                if (kbc->idev->users)
+                        err = tegra_kbc_start(kbc);
+                mutex_unlock(&kbc->idev->mutex);
+        }
+
+        return err;
+}
+#endif
+
+static SIMPLE_DEV_PM_OPS(tegra_kbc_pm_ops, tegra_kbc_suspend, tegra_kbc_resume);
+
+static struct platform_driver tegra_kbc_driver = {
+        .probe          = tegra_kbc_probe,
+        .remove         = __devexit_p(tegra_kbc_remove),
+        .driver = {
+                .name   = "tegra-kbc",
+                .owner  = THIS_MODULE,
+                .pm     = &tegra_kbc_pm_ops,
+        },
+};
+
+static void __exit tegra_kbc_exit(void)
+{
+        platform_driver_unregister(&tegra_kbc_driver);
+}
+module_exit(tegra_kbc_exit);
+
+static int __init tegra_kbc_init(void)
+{
+        return platform_driver_register(&tegra_kbc_driver);
+}
+module_init(tegra_kbc_init);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Rakesh Iyer <riyer@nvidia.com>");
+MODULE_DESCRIPTION("Tegra matrix keyboard controller driver");
+MODULE_ALIAS("platform:tegra-kbc");
diff --git a/drivers/input/keyboard/tnetv107x-keypad.c b/drivers/input/keyboard/tnetv107x-keypad.c
index b4a81ebfab92..c8f097a15d89 100644
--- a/drivers/input/keyboard/tnetv107x-keypad.c
+++ b/drivers/input/keyboard/tnetv107x-keypad.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/err.h>
 #include <linux/errno.h>
 #include <linux/input.h>
 #include <linux/platform_device.h>
@@ -219,9 +220,9 @@ static int __devinit keypad_probe(struct platform_device *pdev)
         }
 
         kp->clk = clk_get(dev, NULL);
-        if (!kp->clk) {
+        if (IS_ERR(kp->clk)) {
                 dev_err(dev, "cannot claim device clock\n");
-                error = -EINVAL;
+                error = PTR_ERR(kp->clk);
                 goto error_clk;
         }
 
diff --git a/drivers/input/misc/ixp4xx-beeper.c b/drivers/input/misc/ixp4xx-beeper.c
index 9dfd6e5f786f..1f38302a5951 100644
--- a/drivers/input/misc/ixp4xx-beeper.c
+++ b/drivers/input/misc/ixp4xx-beeper.c
@@ -69,11 +69,7 @@ static int ixp4xx_spkr_event(struct input_dev *dev, unsigned int type, unsigned
         }
 
         if (value > 20 && value < 32767)
-#ifndef FREQ
-                count = (ixp4xx_get_board_tick_rate() / (value * 4)) - 1;
-#else
-                count = (FREQ / (value * 4)) - 1;
-#endif
+                count = (IXP4XX_TIMER_FREQ / (value * 4)) - 1;
 
         ixp4xx_spkr_control(pin, count);
 
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index da392c22fc6c..aa186cf6c514 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -755,23 +755,26 @@ static int synaptics_reconnect(struct psmouse *psmouse)
 {
         struct synaptics_data *priv = psmouse->private;
         struct synaptics_data old_priv = *priv;
+        int retry = 0;
+        int error;
 
-        psmouse_reset(psmouse);
+        do {
+                psmouse_reset(psmouse);
+                error = synaptics_detect(psmouse, 0);
+        } while (error && ++retry < 3);
 
-        if (synaptics_detect(psmouse, 0))
+        if (error)
                 return -1;
 
+        if (retry > 1)
+                printk(KERN_DEBUG "Synaptics reconnected after %d tries\n",
+                        retry);
+
         if (synaptics_query_hardware(psmouse)) {
                 printk(KERN_ERR "Unable to query Synaptics hardware.\n");
                 return -1;
         }
 
-        if (old_priv.identity != priv->identity ||
-            old_priv.model_id != priv->model_id ||
-            old_priv.capabilities != priv->capabilities ||
-            old_priv.ext_cap != priv->ext_cap)
-                return -1;
-
         if (synaptics_set_absolute_mode(psmouse)) {
                 printk(KERN_ERR "Unable to initialize Synaptics hardware.\n");
                 return -1;
@@ -782,6 +785,19 @@ static int synaptics_reconnect(struct psmouse *psmouse)
                 return -1;
         }
 
+        if (old_priv.identity != priv->identity ||
+            old_priv.model_id != priv->model_id ||
+            old_priv.capabilities != priv->capabilities ||
+            old_priv.ext_cap != priv->ext_cap) {
+                printk(KERN_ERR "Synaptics hardware appears to be different: "
+                        "id(%ld-%ld), model(%ld-%ld), caps(%lx-%lx), ext(%lx-%lx).\n",
+                        old_priv.identity, priv->identity,
+                        old_priv.model_id, priv->model_id,
+                        old_priv.capabilities, priv->capabilities,
+                        old_priv.ext_cap, priv->ext_cap);
+                return -1;
+        }
+
         return 0;
 }
 
diff --git a/drivers/input/serio/ct82c710.c b/drivers/input/serio/ct82c710.c
index 448c7724beb9..852816567241 100644
--- a/drivers/input/serio/ct82c710.c
+++ b/drivers/input/serio/ct82c710.c
@@ -111,9 +111,11 @@ static void ct82c710_close(struct serio *serio)
 static int ct82c710_open(struct serio *serio)
 {
         unsigned char status;
+        int err;
 
-        if (request_irq(CT82C710_IRQ, ct82c710_interrupt, 0, "ct82c710", NULL))
-                return -1;
+        err = request_irq(CT82C710_IRQ, ct82c710_interrupt, 0, "ct82c710", NULL);
+        if (err)
+                return err;
 
         status = inb_p(CT82C710_STATUS);
 
@@ -131,7 +133,7 @@ static int ct82c710_open(struct serio *serio)
                 status &= ~(CT82C710_ENABLE | CT82C710_INTS_ON);
                 outb_p(status, CT82C710_STATUS);
                 free_irq(CT82C710_IRQ, NULL);
-                return -1;
+                return -EBUSY;
         }
 
         return 0;
diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c
index 6e362de3f412..8755f5f3ad37 100644
--- a/drivers/input/serio/serport.c
+++ b/drivers/input/serio/serport.c
@@ -116,14 +116,15 @@ static void serport_ldisc_close(struct tty_struct *tty)
 
 /*
  * serport_ldisc_receive() is called by the low level tty driver when characters
- * are ready for us. We forward the characters, one by one to the 'interrupt'
- * routine.
+ * are ready for us. We forward the characters and flags, one by one to the
+ * 'interrupt' routine.
  */
 
 static void serport_ldisc_receive(struct tty_struct *tty, const unsigned char *cp, char *fp, int count)
 {
         struct serport *serport = (struct serport*) tty->disc_data;
         unsigned long flags;
+        unsigned int ch_flags;
         int i;
 
         spin_lock_irqsave(&serport->lock, flags);
@@ -131,8 +132,23 @@ static void serport_ldisc_receive(struct tty_struct *tty, const unsigned char *c
         if (!test_bit(SERPORT_ACTIVE, &serport->flags))
                 goto out;
 
-        for (i = 0; i < count; i++)
-                serio_interrupt(serport->serio, cp[i], 0);
+        for (i = 0; i < count; i++) {
+                switch (fp[i]) {
+                case TTY_FRAME:
+                        ch_flags = SERIO_FRAME;
+                        break;
+
+                case TTY_PARITY:
+                        ch_flags = SERIO_PARITY;
+                        break;
+
+                default:
+                        ch_flags = 0;
+                        break;
+                }
+
+                serio_interrupt(serport->serio, cp[i], ch_flags);
+        }
 
 out:
         spin_unlock_irqrestore(&serport->lock, flags);
diff --git a/drivers/input/sparse-keymap.c b/drivers/input/sparse-keymap.c
index a29a7812bd46..7729e547ba65 100644
--- a/drivers/input/sparse-keymap.c
+++ b/drivers/input/sparse-keymap.c
@@ -201,6 +201,7 @@ int sparse_keymap_setup(struct input_dev *dev,
                         break;
 
                 case KE_SW:
+                case KE_VSW:
                         __set_bit(EV_SW, dev->evbit);
                         __set_bit(entry->sw.code, dev->swbit);
                         break;
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 518782999fea..367fa82a607e 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1101,6 +1101,13 @@ void wacom_setup_device_quirks(struct wacom_features *features)
         }
 }
 
+static unsigned int wacom_calculate_touch_res(unsigned int logical_max,
+                                              unsigned int physical_max)
+{
+       /* Touch physical dimensions are in 100th of mm */
+       return (logical_max * 100) / physical_max;
+}
+
 void wacom_setup_input_capabilities(struct input_dev *input_dev,
                                     struct wacom_wac *wacom_wac)
 {
@@ -1228,8 +1235,12 @@ void wacom_setup_input_capabilities(struct input_dev *input_dev,
         case TABLETPC:
                 if (features->device_type == BTN_TOOL_DOUBLETAP ||
                     features->device_type == BTN_TOOL_TRIPLETAP) {
-                        input_set_abs_params(input_dev, ABS_RX, 0, features->x_phy, 0, 0);
-                        input_set_abs_params(input_dev, ABS_RY, 0, features->y_phy, 0, 0);
+                        input_abs_set_res(input_dev, ABS_X,
+                                wacom_calculate_touch_res(features->x_max,
+                                                        features->x_phy));
+                        input_abs_set_res(input_dev, ABS_Y,
+                                wacom_calculate_touch_res(features->y_max,
+                                                        features->y_phy));
                         __set_bit(BTN_TOOL_DOUBLETAP, input_dev->keybit);
                 }
 
@@ -1272,6 +1283,12 @@ void wacom_setup_input_capabilities(struct input_dev *input_dev,
                         input_set_abs_params(input_dev, ABS_MT_PRESSURE,
                                              0, features->pressure_max,
                                              features->pressure_fuzz, 0);
+                        input_abs_set_res(input_dev, ABS_X,
+                                wacom_calculate_touch_res(features->x_max,
+                                                        features->x_phy));
+                        input_abs_set_res(input_dev, ABS_Y,
+                                wacom_calculate_touch_res(features->y_max,
+                                                        features->y_phy));
                 } else if (features->device_type == BTN_TOOL_PEN) {
                         __set_bit(BTN_TOOL_RUBBER, input_dev->keybit);
                         __set_bit(BTN_TOOL_PEN, input_dev->keybit);
@@ -1426,6 +1443,10 @@ static struct wacom_features wacom_features_0xD3 =
         { "Wacom Bamboo 2FG 6x8", WACOM_PKGLEN_BBFUN,     21648, 13530, 1023, 63, BAMBOO_PT };
 static const struct wacom_features wacom_features_0xD4 =
         { "Wacom Bamboo Pen",     WACOM_PKGLEN_BBFUN,     14720,  9200,  255, 63, BAMBOO_PT };
+static struct wacom_features wacom_features_0xD6 =
+        { "Wacom BambooPT 2FG 4x5", WACOM_PKGLEN_BBFUN,   14720,  9200, 1023, 63, BAMBOO_PT };
+static struct wacom_features wacom_features_0xD7 =
+        { "Wacom BambooPT 2FG Small", WACOM_PKGLEN_BBFUN, 14720,  9200, 1023, 63, BAMBOO_PT };
 static struct wacom_features wacom_features_0xD8 =
         { "Wacom Bamboo Comic 2FG", WACOM_PKGLEN_BBFUN,   21648, 13530, 1023, 63, BAMBOO_PT };
 static struct wacom_features wacom_features_0xDA =
@@ -1507,6 +1528,8 @@ const struct usb_device_id wacom_ids[] = {
         { USB_DEVICE_WACOM(0xD2) },
         { USB_DEVICE_WACOM(0xD3) },
         { USB_DEVICE_WACOM(0xD4) },
+        { USB_DEVICE_WACOM(0xD6) },
+        { USB_DEVICE_WACOM(0xD7) },
         { USB_DEVICE_WACOM(0xD8) },
         { USB_DEVICE_WACOM(0xDA) },
         { USB_DEVICE_WACOM(0xDB) },
diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
index f7fa9ef4cd65..1507ce108d5b 100644
--- a/drivers/input/touchscreen/bu21013_ts.c
+++ b/drivers/input/touchscreen/bu21013_ts.c
@@ -12,6 +12,7 @@
 #include <linux/input.h>
 #include <linux/input/bu21013.h>
 #include <linux/slab.h>
+#include <linux/regulator/consumer.h>
 
 #define PEN_DOWN_INTR   0
 #define MAX_FINGERS     2
@@ -139,6 +140,7 @@
  * @chip: pointer to the touch panel controller
  * @in_dev: pointer to the input device structure
  * @intr_pin: interrupt pin value
+ * @regulator: pointer to the Regulator used for touch screen
  *
  * Touch panel device data structure
  */
@@ -149,6 +151,7 @@ struct bu21013_ts_data {
         const struct bu21013_platform_device *chip;
         struct input_dev *in_dev;
         unsigned int intr_pin;
+        struct regulator *regulator;
 };
 
 /**
@@ -456,6 +459,20 @@ static int __devinit bu21013_probe(struct i2c_client *client,
         bu21013_data->in_dev = in_dev;
         bu21013_data->chip = pdata;
         bu21013_data->client = client;
+
+        bu21013_data->regulator = regulator_get(&client->dev, "V-TOUCH");
+        if (IS_ERR(bu21013_data->regulator)) {
+                dev_err(&client->dev, "regulator_get failed\n");
+                error = PTR_ERR(bu21013_data->regulator);
+                goto err_free_mem;
+        }
+
+        error = regulator_enable(bu21013_data->regulator);
+        if (error < 0) {
+                dev_err(&client->dev, "regulator enable failed\n");
+                goto err_put_regulator;
+        }
+
         bu21013_data->touch_stopped = false;
         init_waitqueue_head(&bu21013_data->wait);
 
@@ -464,7 +481,7 @@ static int __devinit bu21013_probe(struct i2c_client *client,
                 error = pdata->cs_en(pdata->cs_pin);
                 if (error < 0) {
                         dev_err(&client->dev, "chip init failed\n");
-                        goto err_free_mem;
+                        goto err_disable_regulator;
                 }
         }
 
@@ -485,9 +502,9 @@ static int __devinit bu21013_probe(struct i2c_client *client,
         __set_bit(EV_ABS, in_dev->evbit);
 
         input_set_abs_params(in_dev, ABS_MT_POSITION_X, 0,
-                                                pdata->x_max_res, 0, 0);
+                                                pdata->touch_x_max, 0, 0);
         input_set_abs_params(in_dev, ABS_MT_POSITION_Y, 0,
-                                                pdata->y_max_res, 0, 0);
+                                                pdata->touch_y_max, 0, 0);
         input_set_drvdata(in_dev, bu21013_data);
 
         error = request_threaded_irq(pdata->irq, NULL, bu21013_gpio_irq,
@@ -513,6 +530,10 @@ err_free_irq:
         bu21013_free_irq(bu21013_data);
 err_cs_disable:
         pdata->cs_dis(pdata->cs_pin);
+err_disable_regulator:
+        regulator_disable(bu21013_data->regulator);
+err_put_regulator:
+        regulator_put(bu21013_data->regulator);
 err_free_mem:
         input_free_device(in_dev);
         kfree(bu21013_data);
@@ -535,6 +556,10 @@ static int __devexit bu21013_remove(struct i2c_client *client)
         bu21013_data->chip->cs_dis(bu21013_data->chip->cs_pin);
 
         input_unregister_device(bu21013_data->in_dev);
+
+        regulator_disable(bu21013_data->regulator);
+        regulator_put(bu21013_data->regulator);
+
         kfree(bu21013_data);
 
         device_init_wakeup(&client->dev, false);
@@ -561,6 +586,8 @@ static int bu21013_suspend(struct device *dev)
         else
                 disable_irq(bu21013_data->chip->irq);
 
+        regulator_disable(bu21013_data->regulator);
+
         return 0;
 }
 
@@ -577,6 +604,12 @@ static int bu21013_resume(struct device *dev)
         struct i2c_client *client = bu21013_data->client;
         int retval;
 
+        retval = regulator_enable(bu21013_data->regulator);
+        if (retval < 0) {
+                dev_err(&client->dev, "bu21013 regulator enable failed\n");
+                return retval;
+        }
+
         retval = bu21013_init_chip(bu21013_data);
         if (retval < 0) {
                 dev_err(&client->dev, "bu21013 controller config failed\n");
diff --git a/drivers/input/touchscreen/tnetv107x-ts.c b/drivers/input/touchscreen/tnetv107x-ts.c
index cf1dba2e267c..22a3411e93c5 100644
--- a/drivers/input/touchscreen/tnetv107x-ts.c
+++ b/drivers/input/touchscreen/tnetv107x-ts.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/err.h>
 #include <linux/errno.h>
 #include <linux/input.h>
 #include <linux/platform_device.h>
@@ -289,9 +290,9 @@ static int __devinit tsc_probe(struct platform_device *pdev)
         }
 
         ts->clk = clk_get(dev, NULL);
-        if (!ts->clk) {
+        if (IS_ERR(ts->clk)) {
                 dev_err(dev, "cannot claim device clock\n");
-                error = -EINVAL;
+                error = PTR_ERR(ts->clk);
                 goto error_clk;
         }
 
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index f2b5bab5e6a1..1f355bb85e54 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1627,7 +1627,7 @@ __setup("icn=", icn_setup);
 static int __init icn_init(void)
 {
         char *p;
-        char rev[20];
+        char rev[21];
 
         memset(&dev, 0, sizeof(icn_dev));
         dev.memaddr = (membase & 0x0ffc000);
@@ -1638,6 +1638,7 @@ static int __init icn_init(void)
 
         if ((p = strchr(revision, ':'))) {
                 strncpy(rev, p + 1, 20);
+                rev[20] = '\0';
                 p = strchr(rev, '$');
                 if (p)
                         *p = 0;
diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
index da3fa8dcdf5b..666daf77872e 100644
--- a/drivers/leds/leds-pwm.c
+++ b/drivers/leds/leds-pwm.c
@@ -69,6 +69,7 @@ static int led_pwm_probe(struct platform_device *pdev)
                 led_dat->pwm = pwm_request(cur_led->pwm_id,
                                 cur_led->name);
                 if (IS_ERR(led_dat->pwm)) {
+                        ret = PTR_ERR(led_dat->pwm);
                         dev_err(&pdev->dev, "unable to request PWM %d\n",
                                         cur_led->pwm_id);
                         goto err;
diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
index f011c5d9dea1..1c5cc65ea1e1 100644
--- a/drivers/media/rc/ir-lirc-codec.c
+++ b/drivers/media/rc/ir-lirc-codec.c
@@ -1,4 +1,4 @@
-/* ir-lirc-codec.c - ir-core to classic lirc interface bridge
+/* ir-lirc-codec.c - rc-core to classic lirc interface bridge
  *
  * Copyright (C) 2010 by Jarod Wilson <jarod@redhat.com>
  *
@@ -47,6 +47,7 @@ static int ir_lirc_decode(struct rc_dev *dev, struct ir_raw_event ev)
         /* Carrier reports */
         if (ev.carrier_report) {
                 sample = LIRC_FREQUENCY(ev.carrier);
+                IR_dprintk(2, "carrier report (freq: %d)\n", sample);
 
         /* Packet end */
         } else if (ev.timeout) {
@@ -62,6 +63,7 @@ static int ir_lirc_decode(struct rc_dev *dev, struct ir_raw_event ev)
                         return 0;
 
                 sample = LIRC_TIMEOUT(ev.duration / 1000);
+                IR_dprintk(2, "timeout report (duration: %d)\n", sample);
 
         /* Normal sample */
         } else {
@@ -85,6 +87,8 @@ static int ir_lirc_decode(struct rc_dev *dev, struct ir_raw_event ev)
 
                 sample = ev.pulse ? LIRC_PULSE(ev.duration / 1000) :
                                         LIRC_SPACE(ev.duration / 1000);
+                IR_dprintk(2, "delivering %uus %s to lirc_dev\n",
+                           TO_US(ev.duration), TO_STR(ev.pulse));
         }
 
         lirc_buffer_write(dev->raw->lirc.drv->rbuf,
diff --git a/drivers/media/rc/keymaps/rc-rc6-mce.c b/drivers/media/rc/keymaps/rc-rc6-mce.c
index 3bf3337875d1..2f5dc0622b94 100644
--- a/drivers/media/rc/keymaps/rc-rc6-mce.c
+++ b/drivers/media/rc/keymaps/rc-rc6-mce.c
@@ -3,6 +3,9 @@
  *
  * Copyright (c) 2010 by Jarod Wilson <jarod@redhat.com>
  *
+ * See http://mediacenterguides.com/book/export/html/31 for details on
+ * key mappings.
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
@@ -60,6 +63,9 @@ static struct rc_map_table rc6_mce[] = {
         { 0x800f0426, KEY_EPG },                /* Guide */
         { 0x800f0427, KEY_ZOOM },               /* Aspect */
 
+        { 0x800f0432, KEY_MODE },               /* Visualization */
+        { 0x800f0433, KEY_PRESENTATION },       /* Slide Show */
+        { 0x800f0434, KEY_EJECTCD },
         { 0x800f043a, KEY_BRIGHTNESSUP },
 
         { 0x800f0446, KEY_TV },
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index 079353e5d558..6df0a4980645 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -816,7 +816,7 @@ static void mceusb_handle_command(struct mceusb_dev *ir, int index)
         switch (ir->buf_in[index]) {
         /* 2-byte return value commands */
         case MCE_CMD_S_TIMEOUT:
-                ir->rc->timeout = MS_TO_NS((hi << 8 | lo) / 2);
+                ir->rc->timeout = US_TO_NS((hi << 8 | lo) / 2);
                 break;
 
         /* 1-byte return value commands */
@@ -855,9 +855,10 @@ static void mceusb_process_ir_data(struct mceusb_dev *ir, int buf_len)
                         break;
                 case PARSE_IRDATA:
                         ir->rem--;
+                        init_ir_raw_event(&rawir);
                         rawir.pulse = ((ir->buf_in[i] & MCE_PULSE_BIT) != 0);
                         rawir.duration = (ir->buf_in[i] & MCE_PULSE_MASK)
-                                         * MS_TO_US(MCE_TIME_UNIT);
+                                         * US_TO_NS(MCE_TIME_UNIT);
 
                         dev_dbg(ir->dev, "Storing %s with duration %d\n",
                                 rawir.pulse ? "pulse" : "space",
@@ -883,6 +884,8 @@ static void mceusb_process_ir_data(struct mceusb_dev *ir, int buf_len)
                                              i, ir->rem + 1, false);
                         if (ir->rem)
                                 ir->parser_state = PARSE_IRDATA;
+                        else
+                                ir_raw_event_reset(ir->rc);
                         break;
                 }
 
@@ -1060,7 +1063,7 @@ static struct rc_dev *mceusb_init_rc_dev(struct mceusb_dev *ir)
         rc->priv = ir;
         rc->driver_type = RC_DRIVER_IR_RAW;
         rc->allowed_protos = RC_TYPE_ALL;
-        rc->timeout = MS_TO_NS(1000);
+        rc->timeout = US_TO_NS(1000);
         if (!ir->flags.no_tx) {
                 rc->s_tx_mask = mceusb_set_tx_mask;
                 rc->s_tx_carrier = mceusb_set_tx_carrier;
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index dd4caf8ef80b..273d9d674792 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -460,7 +460,7 @@ static u32 nvt_rx_carrier_detect(struct nvt_dev *nvt)
                 return 0;
         }
 
-        carrier = (count * 1000000) / duration;
+        carrier = MS_TO_NS(count) / duration;
 
         if ((carrier > MAX_CARRIER) || (carrier < MIN_CARRIER))
                 nvt_dbg("WTF? Carrier frequency out of range!");
@@ -612,8 +612,8 @@ static void nvt_process_rx_ir_data(struct nvt_dev *nvt)
                 sample = nvt->buf[i];
 
                 rawir.pulse = ((sample & BUF_PULSE_BIT) != 0);
-                rawir.duration = (sample & BUF_LEN_MASK)
-                                        * SAMPLE_PERIOD * 1000;
+                rawir.duration = US_TO_NS((sample & BUF_LEN_MASK)
+                                          * SAMPLE_PERIOD);
 
                 if ((sample & BUF_LEN_MASK) == BUF_LEN_MASK) {
                         if (nvt->rawir.pulse == rawir.pulse)
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 72be8a02118c..512a2f4ada0e 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -458,21 +458,27 @@ static int ir_getkeycode(struct input_dev *idev,
                 index = ir_lookup_by_scancode(rc_map, scancode);
         }
 
-        if (index >= rc_map->len) {
-                if (!(ke->flags & INPUT_KEYMAP_BY_INDEX))
-                        IR_dprintk(1, "unknown key for scancode 0x%04x\n",
-                                   scancode);
+        if (index < rc_map->len) {
+                entry = &rc_map->scan[index];
+
+                ke->index = index;
+                ke->keycode = entry->keycode;
+                ke->len = sizeof(entry->scancode);
+                memcpy(ke->scancode, &entry->scancode, sizeof(entry->scancode));
+
+        } else if (!(ke->flags & INPUT_KEYMAP_BY_INDEX)) {
+                /*
+                 * We do not really know the valid range of scancodes
+                 * so let's respond with KEY_RESERVED to anything we
+                 * do not have mapping for [yet].
+                 */
+                ke->index = index;
+                ke->keycode = KEY_RESERVED;
+        } else {
                 retval = -EINVAL;
                 goto out;
         }
 
-        entry = &rc_map->scan[index];
-
-        ke->index = index;
-        ke->keycode = entry->keycode;
-        ke->len = sizeof(entry->scancode);
-        memcpy(ke->scancode, &entry->scancode, sizeof(entry->scancode));
-
         retval = 0;
 
 out:
diff --git a/drivers/media/rc/streamzap.c b/drivers/media/rc/streamzap.c
index 6e2911c2abfb..e435d94c0776 100644
--- a/drivers/media/rc/streamzap.c
+++ b/drivers/media/rc/streamzap.c
@@ -164,7 +164,7 @@ static void sz_push_full_pulse(struct streamzap_ir *sz,
                                 sz->signal_start.tv_usec -
                                 sz->signal_last.tv_usec);
                         rawir.duration -= sz->sum;
-                        rawir.duration *= 1000;
+                        rawir.duration = US_TO_NS(rawir.duration);
                         rawir.duration &= IR_MAX_DURATION;
                 }
                 sz_push(sz, rawir);
@@ -177,7 +177,7 @@ static void sz_push_full_pulse(struct streamzap_ir *sz,
         rawir.duration = ((int) value) * SZ_RESOLUTION;
         rawir.duration += SZ_RESOLUTION / 2;
         sz->sum += rawir.duration;
-        rawir.duration *= 1000;
+        rawir.duration = US_TO_NS(rawir.duration);
         rawir.duration &= IR_MAX_DURATION;
         sz_push(sz, rawir);
 }
@@ -197,7 +197,7 @@ static void sz_push_full_space(struct streamzap_ir *sz,
         rawir.duration = ((int) value) * SZ_RESOLUTION;
         rawir.duration += SZ_RESOLUTION / 2;
         sz->sum += rawir.duration;
-        rawir.duration *= 1000;
+        rawir.duration = US_TO_NS(rawir.duration);
         sz_push(sz, rawir);
 }
 
@@ -273,6 +273,7 @@ static void streamzap_callback(struct urb *urb)
                                 if (sz->timeout_enabled)
                                         sz_push(sz, rawir);
                                 ir_raw_event_handle(sz->rdev);
+                                ir_raw_event_reset(sz->rdev);
                         } else {
                                 sz_push_full_space(sz, sz->buf_in[i]);
                         }
@@ -290,6 +291,7 @@ static void streamzap_callback(struct urb *urb)
                 }
         }
 
+        ir_raw_event_handle(sz->rdev);
         usb_submit_urb(urb, GFP_ATOMIC);
 
         return;
@@ -430,13 +432,13 @@ static int __devinit streamzap_probe(struct usb_interface *intf,
         sz->decoder_state = PulseSpace;
         /* FIXME: don't yet have a way to set this */
         sz->timeout_enabled = true;
-        sz->rdev->timeout = (((SZ_TIMEOUT * SZ_RESOLUTION * 1000) &
+        sz->rdev->timeout = ((US_TO_NS(SZ_TIMEOUT * SZ_RESOLUTION) &
                                 IR_MAX_DURATION) | 0x03000000);
         #if 0
         /* not yet supported, depends on patches from maxim */
         /* see also: LIRC_GET_REC_RESOLUTION and LIRC_SET_REC_TIMEOUT */
-        sz->min_timeout = SZ_TIMEOUT * SZ_RESOLUTION * 1000;
-        sz->max_timeout = SZ_TIMEOUT * SZ_RESOLUTION * 1000;
+        sz->min_timeout = US_TO_NS(SZ_TIMEOUT * SZ_RESOLUTION);
+        sz->max_timeout = US_TO_NS(SZ_TIMEOUT * SZ_RESOLUTION);
         #endif
 
         do_gettimeofday(&sz->signal_start);
diff --git a/drivers/media/video/gspca/zc3xx.c b/drivers/media/video/gspca/zc3xx.c
index 865216e9362c..47236a58bf33 100644
--- a/drivers/media/video/gspca/zc3xx.c
+++ b/drivers/media/video/gspca/zc3xx.c
@@ -5793,7 +5793,7 @@ static void usb_exchange(struct gspca_dev *gspca_dev,
                         break;
                 default:
 /*              case 0xdd:       * delay */
-                        msleep(action->val / 64 + 10);
+                        msleep(action->idx);
                         break;
                 }
                 action++;
@@ -5830,7 +5830,7 @@ static void setmatrix(struct gspca_dev *gspca_dev)
                 [SENSOR_GC0305] =       gc0305_matrix,
                 [SENSOR_HDCS2020b] =    NULL,
                 [SENSOR_HV7131B] =      NULL,
-                [SENSOR_HV7131R] =      NULL,
+                [SENSOR_HV7131R] =      po2030_matrix,
                 [SENSOR_ICM105A] =      po2030_matrix,
                 [SENSOR_MC501CB] =      NULL,
                 [SENSOR_MT9V111_1] =    gc0305_matrix,
@@ -5936,6 +5936,7 @@ static void setquality(struct gspca_dev *gspca_dev)
         case SENSOR_ADCM2700:
         case SENSOR_GC0305:
         case SENSOR_HV7131B:
+        case SENSOR_HV7131R:
         case SENSOR_OV7620:
         case SENSOR_PAS202B:
         case SENSOR_PO2030:
@@ -6108,11 +6109,13 @@ static void send_unknown(struct gspca_dev *gspca_dev, int sensor)
                 reg_w(gspca_dev, 0x02, 0x003b);
                 reg_w(gspca_dev, 0x00, 0x0038);
                 break;
+        case SENSOR_HV7131R:
         case SENSOR_PAS202B:
                 reg_w(gspca_dev, 0x03, 0x003b);
                 reg_w(gspca_dev, 0x0c, 0x003a);
                 reg_w(gspca_dev, 0x0b, 0x0039);
-                reg_w(gspca_dev, 0x0b, 0x0038);
+                if (sensor == SENSOR_PAS202B)
+                        reg_w(gspca_dev, 0x0b, 0x0038);
                 break;
         }
 }
@@ -6704,10 +6707,13 @@ static int sd_start(struct gspca_dev *gspca_dev)
                 reg_w(gspca_dev, 0x02, 0x003b);
                 reg_w(gspca_dev, 0x00, 0x0038);
                 break;
+        case SENSOR_HV7131R:
         case SENSOR_PAS202B:
                 reg_w(gspca_dev, 0x03, 0x003b);
                 reg_w(gspca_dev, 0x0c, 0x003a);
                 reg_w(gspca_dev, 0x0b, 0x0039);
+                if (sd->sensor == SENSOR_HV7131R)
+                        reg_w(gspca_dev, 0x50, ZC3XX_R11D_GLOBALGAIN);
                 break;
         }
 
@@ -6720,6 +6726,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
                 break;
         case SENSOR_PAS202B:
         case SENSOR_GC0305:
+        case SENSOR_HV7131R:
         case SENSOR_TAS5130C:
                 reg_r(gspca_dev, 0x0008);
                 /* fall thru */
@@ -6760,6 +6767,12 @@ static int sd_start(struct gspca_dev *gspca_dev)
                                                 /* ms-win + */
                 reg_w(gspca_dev, 0x40, 0x0117);
                 break;
+        case SENSOR_HV7131R:
+                i2c_write(gspca_dev, 0x25, 0x04, 0x00); /* exposure */
+                i2c_write(gspca_dev, 0x26, 0x93, 0x00);
+                i2c_write(gspca_dev, 0x27, 0xe0, 0x00);
+                reg_w(gspca_dev, 0x00, ZC3XX_R1A7_CALCGLOBALMEAN);
+                break;
         case SENSOR_GC0305:
         case SENSOR_TAS5130C:
                 reg_w(gspca_dev, 0x09, 0x01ad); /* (from win traces) */
@@ -6808,9 +6821,17 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
 {
         struct sd *sd = (struct sd *) gspca_dev;
 
-        if (data[0] == 0xff && data[1] == 0xd8) {       /* start of frame */
+        /* check the JPEG end of frame */
+        if (len >= 3
+         && data[len - 3] == 0xff && data[len - 2] == 0xd9) {
+/*fixme: what does the last byte mean?*/
                 gspca_frame_add(gspca_dev, LAST_PACKET,
-                                        NULL, 0);
+                                        data, len - 1);
+                return;
+        }
+
+        /* check the JPEG start of a frame */
+        if (data[0] == 0xff && data[1] == 0xd8) {
                 /* put the JPEG header in the new frame */
                 gspca_frame_add(gspca_dev, FIRST_PACKET,
                         sd->jpeg_hdr, JPEG_HDR_SZ);
diff --git a/drivers/media/video/hdpvr/hdpvr-core.c b/drivers/media/video/hdpvr/hdpvr-core.c
index a6572e5ae369..a27d93b503a5 100644
--- a/drivers/media/video/hdpvr/hdpvr-core.c
+++ b/drivers/media/video/hdpvr/hdpvr-core.c
@@ -283,6 +283,7 @@ static int hdpvr_probe(struct usb_interface *interface,
         struct hdpvr_device *dev;
         struct usb_host_interface *iface_desc;
         struct usb_endpoint_descriptor *endpoint;
+        struct i2c_client *client;
         size_t buffer_size;
         int i;
         int retval = -ENOMEM;
@@ -381,13 +382,21 @@ static int hdpvr_probe(struct usb_interface *interface,
 #if defined(CONFIG_I2C) || defined(CONFIG_I2C_MODULE)
         retval = hdpvr_register_i2c_adapter(dev);
         if (retval < 0) {
-                v4l2_err(&dev->v4l2_dev, "registering i2c adapter failed\n");
+                v4l2_err(&dev->v4l2_dev, "i2c adapter register failed\n");
                 goto error;
         }
 
-        retval = hdpvr_register_i2c_ir(dev);
-        if (retval < 0)
-                v4l2_err(&dev->v4l2_dev, "registering i2c IR devices failed\n");
+        client = hdpvr_register_ir_rx_i2c(dev);
+        if (!client) {
+                v4l2_err(&dev->v4l2_dev, "i2c IR RX device register failed\n");
+                goto reg_fail;
+        }
+
+        client = hdpvr_register_ir_tx_i2c(dev);
+        if (!client) {
+                v4l2_err(&dev->v4l2_dev, "i2c IR TX device register failed\n");
+                goto reg_fail;
+        }
 #endif
 
         /* let the user know what node this device is now attached to */
@@ -395,6 +404,10 @@ static int hdpvr_probe(struct usb_interface *interface,
                   video_device_node_name(dev->video_dev));
         return 0;
 
+reg_fail:
+#if defined(CONFIG_I2C) || defined(CONFIG_I2C_MODULE)
+        i2c_del_adapter(&dev->i2c_adapter);
+#endif
 error:
         if (dev) {
                 /* Destroy single thread */
@@ -424,6 +437,9 @@ static void hdpvr_disconnect(struct usb_interface *interface)
         mutex_lock(&dev->io_mutex);
         hdpvr_cancel_queue(dev);
         mutex_unlock(&dev->io_mutex);
+#if defined(CONFIG_I2C) || defined(CONFIG_I2C_MODULE)
+        i2c_del_adapter(&dev->i2c_adapter);
+#endif
         video_unregister_device(dev->video_dev);
         atomic_dec(&dev_nr);
 }
diff --git a/drivers/media/video/hdpvr/hdpvr-i2c.c b/drivers/media/video/hdpvr/hdpvr-i2c.c
index 89b71faeaac2..e53fa55d56a1 100644
--- a/drivers/media/video/hdpvr/hdpvr-i2c.c
+++ b/drivers/media/video/hdpvr/hdpvr-i2c.c
@@ -31,26 +31,34 @@
 #define Z8F0811_IR_RX_I2C_ADDR  0x71
 
 
-static struct i2c_board_info hdpvr_i2c_board_info = {
-        I2C_BOARD_INFO("ir_tx_z8f0811_hdpvr", Z8F0811_IR_TX_I2C_ADDR),
-        I2C_BOARD_INFO("ir_rx_z8f0811_hdpvr", Z8F0811_IR_RX_I2C_ADDR),
-};
+struct i2c_client *hdpvr_register_ir_tx_i2c(struct hdpvr_device *dev)
+{
+        struct IR_i2c_init_data *init_data = &dev->ir_i2c_init_data;
+        struct i2c_board_info hdpvr_ir_tx_i2c_board_info = {
+                I2C_BOARD_INFO("ir_tx_z8f0811_hdpvr", Z8F0811_IR_TX_I2C_ADDR),
+        };
+
+        init_data->name = "HD-PVR";
+        hdpvr_ir_tx_i2c_board_info.platform_data = init_data;
 
-int hdpvr_register_i2c_ir(struct hdpvr_device *dev)
+        return i2c_new_device(&dev->i2c_adapter, &hdpvr_ir_tx_i2c_board_info);
+}
+
+struct i2c_client *hdpvr_register_ir_rx_i2c(struct hdpvr_device *dev)
 {
-        struct i2c_client *c;
         struct IR_i2c_init_data *init_data = &dev->ir_i2c_init_data;
+        struct i2c_board_info hdpvr_ir_rx_i2c_board_info = {
+                I2C_BOARD_INFO("ir_rx_z8f0811_hdpvr", Z8F0811_IR_RX_I2C_ADDR),
+        };
 
         /* Our default information for ir-kbd-i2c.c to use */
         init_data->ir_codes = RC_MAP_HAUPPAUGE_NEW;
         init_data->internal_get_key_func = IR_KBD_GET_KEY_HAUP_XVR;
         init_data->type = RC_TYPE_RC5;
-        init_data->name = "HD PVR";
-        hdpvr_i2c_board_info.platform_data = init_data;
-
-        c = i2c_new_device(&dev->i2c_adapter, &hdpvr_i2c_board_info);
+        init_data->name = "HD-PVR";
+        hdpvr_ir_rx_i2c_board_info.platform_data = init_data;
 
-        return (c == NULL) ? -ENODEV : 0;
+        return i2c_new_device(&dev->i2c_adapter, &hdpvr_ir_rx_i2c_board_info);
 }
 
 static int hdpvr_i2c_read(struct hdpvr_device *dev, int bus,
diff --git a/drivers/media/video/hdpvr/hdpvr.h b/drivers/media/video/hdpvr/hdpvr.h
index ee74e3be9a6a..072f23c570f3 100644
--- a/drivers/media/video/hdpvr/hdpvr.h
+++ b/drivers/media/video/hdpvr/hdpvr.h
@@ -313,7 +313,8 @@ int hdpvr_cancel_queue(struct hdpvr_device *dev);
 /* i2c adapter registration */
 int hdpvr_register_i2c_adapter(struct hdpvr_device *dev);
 
-int hdpvr_register_i2c_ir(struct hdpvr_device *dev);
+struct i2c_client *hdpvr_register_ir_rx_i2c(struct hdpvr_device *dev);
+struct i2c_client *hdpvr_register_ir_tx_i2c(struct hdpvr_device *dev);
 
 /*========================================================================*/
 /* buffer management */
diff --git a/drivers/media/video/ir-kbd-i2c.c b/drivers/media/video/ir-kbd-i2c.c
index d2b20ad383a3..a221ad68b330 100644
--- a/drivers/media/video/ir-kbd-i2c.c
+++ b/drivers/media/video/ir-kbd-i2c.c
@@ -128,6 +128,19 @@ static int get_key_haup(struct IR_i2c *ir, u32 *ir_key, u32 *ir_raw)
 
 static int get_key_haup_xvr(struct IR_i2c *ir, u32 *ir_key, u32 *ir_raw)
 {
+        int ret;
+        unsigned char buf[1] = { 0 };
+
+        /*
+         * This is the same apparent "are you ready?" poll command observed
+         * watching Windows driver traffic and implemented in lirc_zilog. With
+         * this added, we get far saner remote behavior with z8 chips on usb
+         * connected devices, even with the default polling interval of 100ms.
+         */
+        ret = i2c_master_send(ir->c, buf, 1);
+        if (ret != 1)
+                return (ret < 0) ? ret : -EINVAL;
+
         return get_key_haup_common (ir, ir_key, ir_raw, 6, 3);
 }
 
diff --git a/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c b/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
index ccc884948f34..451ecd485f97 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
@@ -597,7 +597,6 @@ static void pvr2_i2c_register_ir(struct pvr2_hdw *hdw)
                 init_data->internal_get_key_func = IR_KBD_GET_KEY_HAUP_XVR;
                 init_data->type                  = RC_TYPE_RC5;
                 init_data->name                  = hdw->hdw_desc->description;
-                init_data->polling_interval      = 260; /* ms From lirc_zilog */
                 /* IR Receiver */
                 info.addr          = 0x71;
                 info.platform_data = init_data;
diff --git a/drivers/media/video/saa7115.c b/drivers/media/video/saa7115.c
index f35459d1f42f..0db90922ee93 100644
--- a/drivers/media/video/saa7115.c
+++ b/drivers/media/video/saa7115.c
@@ -1565,7 +1565,7 @@ static int saa711x_probe(struct i2c_client *client,
         chip_id = name[5];
 
         /* Check whether this chip is part of the saa711x series */
-        if (memcmp(name, "1f711", 5)) {
+        if (memcmp(name + 1, "f711", 4)) {
                 v4l_dbg(1, debug, client, "chip found @ 0x%x (ID %s) does not match a known saa711x chip.\n",
                         client->addr << 1, name);
                 return -ENODEV;
diff --git a/drivers/mmc/host/bfin_sdh.c b/drivers/mmc/host/bfin_sdh.c
index bac7d62866b7..0371bf502249 100644
--- a/drivers/mmc/host/bfin_sdh.c
+++ b/drivers/mmc/host/bfin_sdh.c
@@ -462,7 +462,7 @@ static int __devinit sdh_probe(struct platform_device *pdev)
                 goto out;
         }
 
-        mmc = mmc_alloc_host(sizeof(*mmc), &pdev->dev);
+        mmc = mmc_alloc_host(sizeof(struct sdh_host), &pdev->dev);
         if (!mmc) {
                 ret = -ENOMEM;
                 goto out;
diff --git a/drivers/mmc/host/jz4740_mmc.c b/drivers/mmc/host/jz4740_mmc.c
index b3a0ab0e4c2b..74218ad677e4 100644
--- a/drivers/mmc/host/jz4740_mmc.c
+++ b/drivers/mmc/host/jz4740_mmc.c
@@ -14,6 +14,7 @@
  */
 
 #include <linux/mmc/host.h>
+#include <linux/err.h>
 #include <linux/io.h>
 #include <linux/irq.h>
 #include <linux/interrupt.h>
@@ -827,8 +828,8 @@ static int __devinit jz4740_mmc_probe(struct platform_device* pdev)
         }
 
         host->clk = clk_get(&pdev->dev, "mmc");
-        if (!host->clk) {
-                ret = -ENOENT;
+        if (IS_ERR(host->clk)) {
+                ret = PTR_ERR(host->clk);
                 dev_err(&pdev->dev, "Failed to get mmc clock\n");
                 goto err_free_host;
         }
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 2de12fe155da..2d6de3e03e2d 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -14,6 +14,7 @@
 #include <linux/ioport.h>
 #include <linux/device.h>
 #include <linux/interrupt.h>
+#include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/err.h>
 #include <linux/highmem.h>
@@ -283,19 +284,19 @@ mmci_data_irq(struct mmci_host *host, struct mmc_data *data,
                 u32 remain, success;
 
                 /* Calculate how far we are into the transfer */
-                remain = readl(host->base + MMCIDATACNT) << 2;
+                remain = readl(host->base + MMCIDATACNT);
                 success = data->blksz * data->blocks - remain;
 
                 dev_dbg(mmc_dev(host->mmc), "MCI ERROR IRQ (status %08x)\n", status);
                 if (status & MCI_DATACRCFAIL) {
                         /* Last block was not successful */
-                        host->data_xfered = ((success / data->blksz) - 1 * data->blksz);
+                        host->data_xfered = round_down(success - 1, data->blksz);
                         data->error = -EILSEQ;
                 } else if (status & MCI_DATATIMEOUT) {
-                        host->data_xfered = success;
+                        host->data_xfered = round_down(success, data->blksz);
                         data->error = -ETIMEDOUT;
                 } else if (status & (MCI_TXUNDERRUN|MCI_RXOVERRUN)) {
-                        host->data_xfered = success;
+                        host->data_xfered = round_down(success, data->blksz);
                         data->error = -EIO;
                 }
 
@@ -319,7 +320,7 @@ mmci_data_irq(struct mmci_host *host, struct mmc_data *data,
         if (status & MCI_DATABLOCKEND)
                 dev_err(mmc_dev(host->mmc), "stray MCI_DATABLOCKEND interrupt\n");
 
-        if (status & MCI_DATAEND) {
+        if (status & MCI_DATAEND || data->error) {
                 mmci_stop_data(host);
 
                 if (!data->error)
@@ -342,15 +343,15 @@ mmci_cmd_irq(struct mmci_host *host, struct mmc_command *cmd,
 
         host->cmd = NULL;
 
-        cmd->resp[0] = readl(base + MMCIRESPONSE0);
-        cmd->resp[1] = readl(base + MMCIRESPONSE1);
-        cmd->resp[2] = readl(base + MMCIRESPONSE2);
-        cmd->resp[3] = readl(base + MMCIRESPONSE3);
-
         if (status & MCI_CMDTIMEOUT) {
                 cmd->error = -ETIMEDOUT;
         } else if (status & MCI_CMDCRCFAIL && cmd->flags & MMC_RSP_CRC) {
                 cmd->error = -EILSEQ;
+        } else {
+                cmd->resp[0] = readl(base + MMCIRESPONSE0);
+                cmd->resp[1] = readl(base + MMCIRESPONSE1);
+                cmd->resp[2] = readl(base + MMCIRESPONSE2);
+                cmd->resp[3] = readl(base + MMCIRESPONSE3);
         }
 
         if (!cmd->data || cmd->error) {
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index 17203586305c..5309ab95aada 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -277,10 +277,43 @@ static void sdhci_cmu_set_clock(struct sdhci_host *host, unsigned int clock)
         host->clock = clock;
 }
 
+/**
+ * sdhci_s3c_platform_8bit_width - support 8bit buswidth
+ * @host: The SDHCI host being queried
+ * @width: MMC_BUS_WIDTH_ macro for the bus width being requested
+ *
+ * We have 8-bit width support but is not a v3 controller.
+ * So we add platform_8bit_width() and support 8bit width.
+ */
+static int sdhci_s3c_platform_8bit_width(struct sdhci_host *host, int width)
+{
+        u8 ctrl;
+
+        ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL);
+
+        switch (width) {
+        case MMC_BUS_WIDTH_8:
+                ctrl |= SDHCI_CTRL_8BITBUS;
+                ctrl &= ~SDHCI_CTRL_4BITBUS;
+                break;
+        case MMC_BUS_WIDTH_4:
+                ctrl |= SDHCI_CTRL_4BITBUS;
+                ctrl &= ~SDHCI_CTRL_8BITBUS;
+                break;
+        default:
+                break;
+        }
+
+        sdhci_writeb(host, ctrl, SDHCI_HOST_CONTROL);
+
+        return 0;
+}
+
 static struct sdhci_ops sdhci_s3c_ops = {
         .get_max_clock          = sdhci_s3c_get_max_clk,
         .set_clock              = sdhci_s3c_set_clock,
         .get_min_clock          = sdhci_s3c_get_min_clock,
+        .platform_8bit_width    = sdhci_s3c_platform_8bit_width,
 };
 
 static void sdhci_s3c_notify_change(struct platform_device *dev, int state)
@@ -473,6 +506,9 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
         if (pdata->cd_type == S3C_SDHCI_CD_PERMANENT)
                 host->mmc->caps = MMC_CAP_NONREMOVABLE;
 
+        if (pdata->host_caps)
+                host->mmc->caps |= pdata->host_caps;
+
         host->quirks |= (SDHCI_QUIRK_32BIT_DMA_ADDR |
                          SDHCI_QUIRK_32BIT_DMA_SIZE);
 
diff --git a/drivers/mmc/host/ushc.c b/drivers/mmc/host/ushc.c
index f8f65df9b017..f08f944ac53c 100644
--- a/drivers/mmc/host/ushc.c
+++ b/drivers/mmc/host/ushc.c
@@ -19,7 +19,6 @@
 #include <linux/module.h>
 #include <linux/usb.h>
 #include <linux/kernel.h>
-#include <linux/usb.h>
 #include <linux/slab.h>
 #include <linux/dma-mapping.h>
 #include <linux/mmc/host.h>
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index f49e49dc5928..5ebe280225d6 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -672,33 +672,7 @@ static int io_init(struct ubi_device *ubi)
                 ubi->nor_flash = 1;
         }
 
-        /*
-         * Set UBI min. I/O size (@ubi->min_io_size). We use @mtd->writebufsize
-         * for these purposes, not @mtd->writesize. At the moment this does not
-         * matter for NAND, because currently @mtd->writebufsize is equivalent to
-         * @mtd->writesize for all NANDs. However, some CFI NOR flashes may
-         * have @mtd->writebufsize which is multiple of @mtd->writesize.
-         *
-         * The reason we use @mtd->writebufsize for @ubi->min_io_size is that
-         * UBI and UBIFS recovery algorithms rely on the fact that if there was
-         * an unclean power cut, then we can find offset of the last corrupted
-         * node, align the offset to @ubi->min_io_size, read the rest of the
-         * eraseblock starting from this offset, and check whether there are
-         * only 0xFF bytes. If yes, then we are probably dealing with a
-         * corruption caused by a power cut, if not, then this is probably some
-         * severe corruption.
-         *
-         * Thus, we have to use the maximum write unit size of the flash, which
-         * is @mtd->writebufsize, because @mtd->writesize is the minimum write
-         * size, not the maximum.
-         */
-        if (ubi->mtd->type == MTD_NANDFLASH)
-                ubi_assert(ubi->mtd->writebufsize == ubi->mtd->writesize);
-        else if (ubi->mtd->type == MTD_NORFLASH)
-                ubi_assert(ubi->mtd->writebufsize % ubi->mtd->writesize == 0);
-
-        ubi->min_io_size = ubi->mtd->writebufsize;
-
+        ubi->min_io_size = ubi->mtd->writesize;
         ubi->hdrs_min_io_size = ubi->mtd->writesize >> ubi->mtd->subpage_sft;
 
         /*
diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
index a699bbf20eb5..3824382faecc 100644
--- a/drivers/net/atl1c/atl1c_main.c
+++ b/drivers/net/atl1c/atl1c_main.c
@@ -48,6 +48,7 @@ static DEFINE_PCI_DEVICE_TABLE(atl1c_pci_tbl) = {
         {PCI_DEVICE(PCI_VENDOR_ID_ATTANSIC, PCI_DEVICE_ID_ATHEROS_L2C_B)},
         {PCI_DEVICE(PCI_VENDOR_ID_ATTANSIC, PCI_DEVICE_ID_ATHEROS_L2C_B2)},
         {PCI_DEVICE(PCI_VENDOR_ID_ATTANSIC, PCI_DEVICE_ID_ATHEROS_L1D)},
+        {PCI_DEVICE(PCI_VENDOR_ID_ATTANSIC, PCI_DEVICE_ID_ATHEROS_L1D_2_0)},
         /* required last entry */
         { 0 }
 };
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index de40d3b7152f..28a32a6c8bf1 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -312,11 +312,9 @@ void be_link_status_update(struct be_adapter *adapter, bool link_up)
         if (adapter->link_up != link_up) {
                 adapter->link_speed = -1;
                 if (link_up) {
-                        netif_start_queue(netdev);
                         netif_carrier_on(netdev);
                         printk(KERN_INFO "%s: Link up\n", netdev->name);
                 } else {
-                        netif_stop_queue(netdev);
                         netif_carrier_off(netdev);
                         printk(KERN_INFO "%s: Link down\n", netdev->name);
                 }
@@ -2628,8 +2626,6 @@ static void be_netdev_init(struct net_device *netdev)
 
         netif_napi_add(netdev, &adapter->tx_eq.napi, be_poll_tx_mcc,
                 BE_NAPI_WEIGHT);
-
-        netif_stop_queue(netdev);
 }
 
 static void be_unmap_pci_bars(struct be_adapter *adapter)
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index df99edf3464a..0ba59d5aeb7f 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -7553,6 +7553,10 @@ bnx2_set_flags(struct net_device *dev, u32 data)
             !(data & ETH_FLAG_RXVLAN))
                 return -EINVAL;
 
+        /* TSO with VLAN tag won't work with current firmware */
+        if (!(data & ETH_FLAG_TXVLAN))
+                return -EINVAL;
+
         rc = ethtool_op_set_flags(dev, data, ETH_FLAG_RXHASH | ETH_FLAG_RXVLAN |
                                   ETH_FLAG_TXVLAN);
         if (rc)
@@ -7962,11 +7966,8 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 
                 /* AER (Advanced Error Reporting) hooks */
                 err = pci_enable_pcie_error_reporting(pdev);
-                if (err) {
-                        dev_err(&pdev->dev, "pci_enable_pcie_error_reporting "
-                                            "failed 0x%x\n", err);
-                        /* non-fatal, continue */
-                }
+                if (!err)
+                        bp->flags |= BNX2_FLAG_AER_ENABLED;
 
         } else {
                 bp->pcix_cap = pci_find_capability(pdev, PCI_CAP_ID_PCIX);
@@ -8229,8 +8230,10 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         return 0;
 
 err_out_unmap:
-        if (bp->flags & BNX2_FLAG_PCIE)
+        if (bp->flags & BNX2_FLAG_AER_ENABLED) {
                 pci_disable_pcie_error_reporting(pdev);
+                bp->flags &= ~BNX2_FLAG_AER_ENABLED;
+        }
 
         if (bp->regview) {
                 iounmap(bp->regview);
@@ -8418,8 +8421,10 @@ bnx2_remove_one(struct pci_dev *pdev)
 
         kfree(bp->temp_stats_blk);
 
-        if (bp->flags & BNX2_FLAG_PCIE)
+        if (bp->flags & BNX2_FLAG_AER_ENABLED) {
                 pci_disable_pcie_error_reporting(pdev);
+                bp->flags &= ~BNX2_FLAG_AER_ENABLED;
+        }
 
         free_netdev(dev);
 
@@ -8535,7 +8540,7 @@ static pci_ers_result_t bnx2_io_slot_reset(struct pci_dev *pdev)
         }
         rtnl_unlock();
 
-        if (!(bp->flags & BNX2_FLAG_PCIE))
+        if (!(bp->flags & BNX2_FLAG_AER_ENABLED))
                 return result;
 
         err = pci_cleanup_aer_uncorrect_error_status(pdev);
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index 5488a2e82fe9..f459fb2f9add 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6741,6 +6741,7 @@ struct bnx2 {
 #define BNX2_FLAG_JUMBO_BROKEN          0x00000800
 #define BNX2_FLAG_CAN_KEEP_VLAN         0x00001000
 #define BNX2_FLAG_BROKEN_STATS          0x00002000
+#define BNX2_FLAG_AER_ENABLED           0x00004000
 
         struct bnx2_napi        bnx2_napi[BNX2_MAX_MSIX_VEC];
 
diff --git a/drivers/net/bnx2x/bnx2x.h b/drivers/net/bnx2x/bnx2x.h
index 8e4183717d91..653c62475cb6 100644
--- a/drivers/net/bnx2x/bnx2x.h
+++ b/drivers/net/bnx2x/bnx2x.h
@@ -22,8 +22,8 @@
  * (you will need to reboot afterwards) */
 /* #define BNX2X_STOP_ON_ERROR */
 
-#define DRV_MODULE_VERSION      "1.62.00-4"
-#define DRV_MODULE_RELDATE      "2011/01/18"
+#define DRV_MODULE_VERSION      "1.62.00-5"
+#define DRV_MODULE_RELDATE      "2011/01/30"
 #define BNX2X_BC_VER            0x040200
 
 #define BNX2X_MULTI_QUEUE
diff --git a/drivers/net/bnx2x/bnx2x_link.c b/drivers/net/bnx2x/bnx2x_link.c
index 7160ec51093e..dd1210fddfff 100644
--- a/drivers/net/bnx2x/bnx2x_link.c
+++ b/drivers/net/bnx2x/bnx2x_link.c
@@ -3948,48 +3948,6 @@ static u8 bnx2x_8073_8727_external_rom_boot(struct bnx2x *bp,
         return rc;
 }
 
-static void bnx2x_8073_set_xaui_low_power_mode(struct bnx2x *bp,
-                                               struct bnx2x_phy *phy)
-{
-        u16 val;
-        bnx2x_cl45_read(bp, phy,
-                        MDIO_PMA_DEVAD, MDIO_PMA_REG_8073_CHIP_REV, &val);
-
-        if (val == 0) {
-                /* Mustn't set low power mode in 8073 A0 */
-                return;
-        }
-
-        /* Disable PLL sequencer (use read-modify-write to clear bit 13) */
-        bnx2x_cl45_read(bp, phy,
-                        MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, &val);
-        val &= ~(1<<13);
-        bnx2x_cl45_write(bp, phy,
-                       MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, val);
-
-        /* PLL controls */
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805E, 0x1077);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805D, 0x0000);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805C, 0x030B);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805B, 0x1240);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x805A, 0x2490);
-
-        /* Tx Controls */
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80A7, 0x0C74);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80A6, 0x9041);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80A5, 0x4640);
-
-        /* Rx Controls */
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80FE, 0x01C4);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80FD, 0x9249);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, 0x80FC, 0x2015);
-
-        /* Enable PLL sequencer  (use read-modify-write to set bit 13) */
-        bnx2x_cl45_read(bp, phy, MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, &val);
-        val |= (1<<13);
-        bnx2x_cl45_write(bp, phy, MDIO_XS_DEVAD, MDIO_XS_PLL_SEQUENCER, val);
-}
-
 /******************************************************************/
 /*                      BCM8073 PHY SECTION                       */
 /******************************************************************/
@@ -4148,8 +4106,6 @@ static u8 bnx2x_8073_config_init(struct bnx2x_phy *phy,
 
         bnx2x_8073_set_pause_cl37(params, phy, vars);
 
-        bnx2x_8073_set_xaui_low_power_mode(bp, phy);
-
         bnx2x_cl45_read(bp, phy,
                         MDIO_PMA_DEVAD, MDIO_PMA_REG_M8051_MSGOUT_REG, &tmp1);
 
@@ -6519,6 +6475,18 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                          MDIO_PMA_DEVAD,
                                          MDIO_PMA_REG_8481_LED1_MASK,
                                          0x80);
+
+                        /* Tell LED3 to blink on source */
+                        bnx2x_cl45_read(bp, phy,
+                                        MDIO_PMA_DEVAD,
+                                        MDIO_PMA_REG_8481_LINK_SIGNAL,
+                                        &val);
+                        val &= ~(7<<6);
+                        val |= (1<<6); /* A83B[8:6]= 1 */
+                        bnx2x_cl45_write(bp, phy,
+                                         MDIO_PMA_DEVAD,
+                                         MDIO_PMA_REG_8481_LINK_SIGNAL,
+                                         val);
                 }
                 break;
         }
@@ -7720,10 +7688,13 @@ static u8 bnx2x_8073_common_init_phy(struct bnx2x *bp,
         struct bnx2x_phy phy[PORT_MAX];
         struct bnx2x_phy *phy_blk[PORT_MAX];
         u16 val;
-        s8 port;
+        s8 port = 0;
         s8 port_of_path = 0;
-
-        bnx2x_ext_phy_hw_reset(bp, 0);
+        u32 swap_val, swap_override;
+        swap_val = REG_RD(bp,  NIG_REG_PORT_SWAP);
+        swap_override = REG_RD(bp,  NIG_REG_STRAP_OVERRIDE);
+        port ^= (swap_val && swap_override);
+        bnx2x_ext_phy_hw_reset(bp, port);
         /* PART1 - Reset both phys */
         for (port = PORT_MAX - 1; port >= PORT_0; port--) {
                 u32 shmem_base, shmem2_base;
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index 8cdcf5b39d1e..f40740e68ea5 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -2301,15 +2301,10 @@ static void bnx2x_rxq_set_mac_filters(struct bnx2x *bp, u16 cl_id, u32 filters)
                 /* accept matched ucast */
                 drop_all_ucast = 0;
         }
-        if (filters & BNX2X_ACCEPT_MULTICAST) {
+        if (filters & BNX2X_ACCEPT_MULTICAST)
                 /* accept matched mcast */
                 drop_all_mcast = 0;
-                if (IS_MF_SI(bp))
-                        /* since mcast addresses won't arrive with ovlan,
-                         * fw needs to accept all of them in
-                         * switch-independent mode */
-                        accp_all_mcast = 1;
-        }
+
         if (filters & BNX2X_ACCEPT_ALL_UNICAST) {
                 /* accept all mcast */
                 drop_all_ucast = 0;
@@ -5296,10 +5291,6 @@ static int bnx2x_init_hw_common(struct bnx2x *bp, u32 load_code)
                 }
         }
 
-        bp->port.need_hw_lock = bnx2x_hw_lock_required(bp,
-                                                       bp->common.shmem_base,
-                                                       bp->common.shmem2_base);
-
         bnx2x_setup_fan_failure_detection(bp);
 
         /* clear PXP2 attentions */
@@ -5503,9 +5494,6 @@ static int bnx2x_init_hw_port(struct bnx2x *bp)
 
         bnx2x_init_block(bp, MCP_BLOCK, init_stage);
         bnx2x_init_block(bp, DMAE_BLOCK, init_stage);
-        bp->port.need_hw_lock = bnx2x_hw_lock_required(bp,
-                                                       bp->common.shmem_base,
-                                                       bp->common.shmem2_base);
         if (bnx2x_fan_failure_det_req(bp, bp->common.shmem_base,
                                       bp->common.shmem2_base, port)) {
                 u32 reg_addr = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
@@ -8379,6 +8367,17 @@ static void __devinit bnx2x_get_port_hwinfo(struct bnx2x *bp)
                  (ext_phy_type != PORT_HW_CFG_XGXS_EXT_PHY_TYPE_NOT_CONN))
                 bp->mdio.prtad =
                         XGXS_EXT_PHY_ADDR(ext_phy_config);
+
+        /*
+         * Check if hw lock is required to access MDC/MDIO bus to the PHY(s)
+         * In MF mode, it is set to cover self test cases
+         */
+        if (IS_MF(bp))
+                bp->port.need_hw_lock = 1;
+        else
+                bp->port.need_hw_lock = bnx2x_hw_lock_required(bp,
+                                                        bp->common.shmem_base,
+                                                        bp->common.shmem2_base);
 }
 
 static void __devinit bnx2x_get_mac_hwinfo(struct bnx2x *bp)
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 171782e2bb39..1024ae158227 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2470,6 +2470,10 @@ int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct pac
         if (!(dev->flags & IFF_MASTER))
                 goto out;
 
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto out;
+
         if (!pskb_may_pull(skb, sizeof(struct lacpdu)))
                 goto out;
 
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index f4e638c65129..5c6fba802f2b 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -326,6 +326,10 @@ static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct
                 goto out;
         }
 
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto out;
+
         if (!pskb_may_pull(skb, arp_hdr_len(bond_dev)))
                 goto out;
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b1025b85acf1..163e0b06eaa5 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2733,6 +2733,10 @@ static int bond_arp_rcv(struct sk_buff *skb, struct net_device *dev, struct pack
         if (!slave || !slave_do_arp_validate(bond, slave))
                 goto out_unlock;
 
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto out_unlock;
+
         if (!pskb_may_pull(skb, arp_hdr_len(dev)))
                 goto out_unlock;
 
diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
index d5a9db60ade9..5dec456fd4a4 100644
--- a/drivers/net/can/Kconfig
+++ b/drivers/net/can/Kconfig
@@ -23,7 +23,7 @@ config CAN_SLCAN
 
           As only the sending and receiving of CAN frames is implemented, this
           driver should work with the (serial/USB) CAN hardware from:
-          www.canusb.com / www.can232.com / www.mictronic.com / www.canhack.de
+          www.canusb.com / www.can232.com / www.mictronics.de / www.canhack.de
 
           Userspace tools to attach the SLCAN line discipline (slcan_attach,
           slcand) can be found in the can-utils at the SocketCAN SVN, see
@@ -117,6 +117,8 @@ source "drivers/net/can/sja1000/Kconfig"
 
 source "drivers/net/can/usb/Kconfig"
 
+source "drivers/net/can/softing/Kconfig"
+
 config CAN_DEBUG_DEVICES
         bool "CAN devices debugging messages"
         depends on CAN
diff --git a/drivers/net/can/Makefile b/drivers/net/can/Makefile
index 07ca159ba3f9..53c82a71778e 100644
--- a/drivers/net/can/Makefile
+++ b/drivers/net/can/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_CAN_DEV)		+= can-dev.o
 can-dev-y                       := dev.o
 
 obj-y                           += usb/
+obj-y                           += softing/
 
 obj-$(CONFIG_CAN_SJA1000)       += sja1000/
 obj-$(CONFIG_CAN_MSCAN)         += mscan/
diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
index 7ef83d06f7ed..57d2ffbbb433 100644
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -2,7 +2,7 @@
  * at91_can.c - CAN network driver for AT91 SoC CAN controller
  *
  * (C) 2007 by Hans J. Koch <hjk@hansjkoch.de>
- * (C) 2008, 2009, 2010 by Marc Kleine-Budde <kernel@pengutronix.de>
+ * (C) 2008, 2009, 2010, 2011 by Marc Kleine-Budde <kernel@pengutronix.de>
  *
  * This software may be distributed under the terms of the GNU General
  * Public License ("GPL") version 2 as distributed in the 'COPYING'
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/platform_device.h>
+#include <linux/rtnetlink.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
@@ -40,22 +41,23 @@
 
 #include <mach/board.h>
 
-#define AT91_NAPI_WEIGHT        12
+#define AT91_NAPI_WEIGHT        11
 
 /*
  * RX/TX Mailbox split
  * don't dare to touch
  */
-#define AT91_MB_RX_NUM          12
+#define AT91_MB_RX_NUM          11
 #define AT91_MB_TX_SHIFT        2
 
-#define AT91_MB_RX_FIRST        0
+#define AT91_MB_RX_FIRST        1
 #define AT91_MB_RX_LAST         (AT91_MB_RX_FIRST + AT91_MB_RX_NUM - 1)
 
 #define AT91_MB_RX_MASK(i)      ((1 << (i)) - 1)
 #define AT91_MB_RX_SPLIT        8
 #define AT91_MB_RX_LOW_LAST     (AT91_MB_RX_SPLIT - 1)
-#define AT91_MB_RX_LOW_MASK     (AT91_MB_RX_MASK(AT91_MB_RX_SPLIT))
+#define AT91_MB_RX_LOW_MASK     (AT91_MB_RX_MASK(AT91_MB_RX_SPLIT) & \
+                                 ~AT91_MB_RX_MASK(AT91_MB_RX_FIRST))
 
 #define AT91_MB_TX_NUM          (1 << AT91_MB_TX_SHIFT)
 #define AT91_MB_TX_FIRST        (AT91_MB_RX_LAST + 1)
@@ -168,6 +170,8 @@ struct at91_priv {
 
         struct clk              *clk;
         struct at91_can_data    *pdata;
+
+        canid_t                 mb0_id;
 };
 
 static struct can_bittiming_const at91_bittiming_const = {
@@ -220,6 +224,18 @@ static inline void set_mb_mode(const struct at91_priv *priv, unsigned int mb,
         set_mb_mode_prio(priv, mb, mode, 0);
 }
 
+static inline u32 at91_can_id_to_reg_mid(canid_t can_id)
+{
+        u32 reg_mid;
+
+        if (can_id & CAN_EFF_FLAG)
+                reg_mid = (can_id & CAN_EFF_MASK) | AT91_MID_MIDE;
+        else
+                reg_mid = (can_id & CAN_SFF_MASK) << 18;
+
+        return reg_mid;
+}
+
 /*
  * Swtich transceiver on or off
  */
@@ -233,12 +249,22 @@ static void at91_setup_mailboxes(struct net_device *dev)
 {
         struct at91_priv *priv = netdev_priv(dev);
         unsigned int i;
+        u32 reg_mid;
 
         /*
-         * The first 12 mailboxes are used as a reception FIFO. The
-         * last mailbox is configured with overwrite option. The
-         * overwrite flag indicates a FIFO overflow.
+         * Due to a chip bug (errata 50.2.6.3 & 50.3.5.3) the first
+         * mailbox is disabled. The next 11 mailboxes are used as a
+         * reception FIFO. The last mailbox is configured with
+         * overwrite option. The overwrite flag indicates a FIFO
+         * overflow.
          */
+        reg_mid = at91_can_id_to_reg_mid(priv->mb0_id);
+        for (i = 0; i < AT91_MB_RX_FIRST; i++) {
+                set_mb_mode(priv, i, AT91_MB_MODE_DISABLED);
+                at91_write(priv, AT91_MID(i), reg_mid);
+                at91_write(priv, AT91_MCR(i), 0x0);     /* clear dlc */
+        }
+
         for (i = AT91_MB_RX_FIRST; i < AT91_MB_RX_LAST; i++)
                 set_mb_mode(priv, i, AT91_MB_MODE_RX);
         set_mb_mode(priv, AT91_MB_RX_LAST, AT91_MB_MODE_RX_OVRWR);
@@ -254,7 +280,8 @@ static void at91_setup_mailboxes(struct net_device *dev)
                 set_mb_mode_prio(priv, i, AT91_MB_MODE_TX, 0);
 
         /* Reset tx and rx helper pointers */
-        priv->tx_next = priv->tx_echo = priv->rx_next = 0;
+        priv->tx_next = priv->tx_echo = 0;
+        priv->rx_next = AT91_MB_RX_FIRST;
 }
 
 static int at91_set_bittiming(struct net_device *dev)
@@ -372,12 +399,7 @@ static netdev_tx_t at91_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 netdev_err(dev, "BUG! TX buffer full when queue awake!\n");
                 return NETDEV_TX_BUSY;
         }
-
-        if (cf->can_id & CAN_EFF_FLAG)
-                reg_mid = (cf->can_id & CAN_EFF_MASK) | AT91_MID_MIDE;
-        else
-                reg_mid = (cf->can_id & CAN_SFF_MASK) << 18;
-
+        reg_mid = at91_can_id_to_reg_mid(cf->can_id);
         reg_mcr = ((cf->can_id & CAN_RTR_FLAG) ? AT91_MCR_MRTR : 0) |
                 (cf->can_dlc << 16) | AT91_MCR_MTCR;
 
@@ -539,27 +561,31 @@ static void at91_read_msg(struct net_device *dev, unsigned int mb)
  *
  * Theory of Operation:
  *
- * 12 of the 16 mailboxes on the chip are reserved for RX. we split
- * them into 2 groups. The lower group holds 8 and upper 4 mailboxes.
+ * 11 of the 16 mailboxes on the chip are reserved for RX. we split
+ * them into 2 groups. The lower group holds 7 and upper 4 mailboxes.
  *
  * Like it or not, but the chip always saves a received CAN message
  * into the first free mailbox it finds (starting with the
  * lowest). This makes it very difficult to read the messages in the
  * right order from the chip. This is how we work around that problem:
  *
- * The first message goes into mb nr. 0 and issues an interrupt. All
+ * The first message goes into mb nr. 1 and issues an interrupt. All
  * rx ints are disabled in the interrupt handler and a napi poll is
  * scheduled. We read the mailbox, but do _not_ reenable the mb (to
  * receive another message).
  *
  *    lower mbxs      upper
- *   ______^______    __^__
- *  /             \  /     \
+ *     ____^______    __^__
+ *    /           \  /     \
  * +-+-+-+-+-+-+-+-++-+-+-+-+
- * |x|x|x|x|x|x|x|x|| | | | |
+ * | |x|x|x|x|x|x|x|| | | | |
  * +-+-+-+-+-+-+-+-++-+-+-+-+
  *  0 0 0 0 0 0  0 0 0 0 1 1  \ mail
  *  0 1 2 3 4 5  6 7 8 9 0 1  / box
+ *  ^
+ *  |
+ *   \
+ *     unused, due to chip bug
  *
  * The variable priv->rx_next points to the next mailbox to read a
  * message from. As long we're in the lower mailboxes we just read the
@@ -590,10 +616,10 @@ static int at91_poll_rx(struct net_device *dev, int quota)
                         "order of incoming frames cannot be guaranteed\n");
 
  again:
-        for (mb = find_next_bit(addr, AT91_MB_RX_NUM, priv->rx_next);
-             mb < AT91_MB_RX_NUM && quota > 0;
+        for (mb = find_next_bit(addr, AT91_MB_RX_LAST + 1, priv->rx_next);
+             mb < AT91_MB_RX_LAST + 1 && quota > 0;
              reg_sr = at91_read(priv, AT91_SR),
-             mb = find_next_bit(addr, AT91_MB_RX_NUM, ++priv->rx_next)) {
+             mb = find_next_bit(addr, AT91_MB_RX_LAST + 1, ++priv->rx_next)) {
                 at91_read_msg(dev, mb);
 
                 /* reactivate mailboxes */
@@ -610,8 +636,8 @@ static int at91_poll_rx(struct net_device *dev, int quota)
 
         /* upper group completed, look again in lower */
         if (priv->rx_next > AT91_MB_RX_LOW_LAST &&
-            quota > 0 && mb >= AT91_MB_RX_NUM) {
-                priv->rx_next = 0;
+            quota > 0 && mb > AT91_MB_RX_LAST) {
+                priv->rx_next = AT91_MB_RX_FIRST;
                 goto again;
         }
 
@@ -1037,6 +1063,64 @@ static const struct net_device_ops at91_netdev_ops = {
         .ndo_start_xmit = at91_start_xmit,
 };
 
+static ssize_t at91_sysfs_show_mb0_id(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct at91_priv *priv = netdev_priv(to_net_dev(dev));
+
+        if (priv->mb0_id & CAN_EFF_FLAG)
+                return snprintf(buf, PAGE_SIZE, "0x%08x\n", priv->mb0_id);
+        else
+                return snprintf(buf, PAGE_SIZE, "0x%03x\n", priv->mb0_id);
+}
+
+static ssize_t at91_sysfs_set_mb0_id(struct device *dev,
+                struct device_attribute *attr, const char *buf, size_t count)
+{
+        struct net_device *ndev = to_net_dev(dev);
+        struct at91_priv *priv = netdev_priv(ndev);
+        unsigned long can_id;
+        ssize_t ret;
+        int err;
+
+        rtnl_lock();
+
+        if (ndev->flags & IFF_UP) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        err = strict_strtoul(buf, 0, &can_id);
+        if (err) {
+                ret = err;
+                goto out;
+        }
+
+        if (can_id & CAN_EFF_FLAG)
+                can_id &= CAN_EFF_MASK | CAN_EFF_FLAG;
+        else
+                can_id &= CAN_SFF_MASK;
+
+        priv->mb0_id = can_id;
+        ret = count;
+
+ out:
+        rtnl_unlock();
+        return ret;
+}
+
+static DEVICE_ATTR(mb0_id, S_IWUSR | S_IRUGO,
+        at91_sysfs_show_mb0_id, at91_sysfs_set_mb0_id);
+
+static struct attribute *at91_sysfs_attrs[] = {
+        &dev_attr_mb0_id.attr,
+        NULL,
+};
+
+static struct attribute_group at91_sysfs_attr_group = {
+        .attrs = at91_sysfs_attrs,
+};
+
 static int __devinit at91_can_probe(struct platform_device *pdev)
 {
         struct net_device *dev;
@@ -1082,6 +1166,7 @@ static int __devinit at91_can_probe(struct platform_device *pdev)
         dev->netdev_ops = &at91_netdev_ops;
         dev->irq = irq;
         dev->flags |= IFF_ECHO;
+        dev->sysfs_groups[0] = &at91_sysfs_attr_group;
 
         priv = netdev_priv(dev);
         priv->can.clock.freq = clk_get_rate(clk);
@@ -1093,6 +1178,7 @@ static int __devinit at91_can_probe(struct platform_device *pdev)
         priv->dev = dev;
         priv->clk = clk;
         priv->pdata = pdev->dev.platform_data;
+        priv->mb0_id = 0x7ff;
 
         netif_napi_add(dev, &priv->napi, at91_poll, AT91_NAPI_WEIGHT);
 
diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
index b9a6d7a5a739..366f5cc050ae 100644
--- a/drivers/net/can/janz-ican3.c
+++ b/drivers/net/can/janz-ican3.c
@@ -1618,7 +1618,7 @@ static ssize_t ican3_sysfs_set_term(struct device *dev,
         return count;
 }
 
-static DEVICE_ATTR(termination, S_IWUGO | S_IRUGO, ican3_sysfs_show_term,
+static DEVICE_ATTR(termination, S_IWUSR | S_IRUGO, ican3_sysfs_show_term,
                                                    ican3_sysfs_set_term);
 
 static struct attribute *ican3_sysfs_attrs[] = {
diff --git a/drivers/net/can/softing/Kconfig b/drivers/net/can/softing/Kconfig
new file mode 100644
index 000000000000..8ba81b3ddd90
--- /dev/null
+++ b/drivers/net/can/softing/Kconfig
@@ -0,0 +1,30 @@
+config CAN_SOFTING
+        tristate "Softing Gmbh CAN generic support"
+        depends on CAN_DEV && HAS_IOMEM
+        ---help---
+          Support for CAN cards from Softing Gmbh & some cards
+          from Vector Gmbh.
+          Softing Gmbh CAN cards come with 1 or 2 physical busses.
+          Those cards typically use Dual Port RAM to communicate
+          with the host CPU. The interface is then identical for PCI
+          and PCMCIA cards. This driver operates on a platform device,
+          which has been created by softing_cs or softing_pci driver.
+          Warning:
+          The API of the card does not allow fine control per bus, but
+          controls the 2 busses on the card together.
+          As such, some actions (start/stop/busoff recovery) on 1 bus
+          must bring down the other bus too temporarily.
+
+config CAN_SOFTING_CS
+        tristate "Softing Gmbh CAN pcmcia cards"
+        depends on PCMCIA
+        select CAN_SOFTING
+        ---help---
+          Support for PCMCIA cards from Softing Gmbh & some cards
+          from Vector Gmbh.
+          You need firmware for these, which you can get at
+          http://developer.berlios.de/projects/socketcan/
+          This version of the driver is written against
+          firmware version 4.6 (softing-fw-4.6-binaries.tar.gz)
+          In order to use the card as CAN device, you need the Softing generic
+          support too.
diff --git a/drivers/net/can/softing/Makefile b/drivers/net/can/softing/Makefile
new file mode 100644
index 000000000000..c5e5016c742e
--- /dev/null
+++ b/drivers/net/can/softing/Makefile
@@ -0,0 +1,6 @@
+
+softing-y := softing_main.o softing_fw.o
+obj-$(CONFIG_CAN_SOFTING) += softing.o
+obj-$(CONFIG_CAN_SOFTING_CS) += softing_cs.o
+
+ccflags-$(CONFIG_CAN_DEBUG_DEVICES) := -DDEBUG
diff --git a/drivers/net/can/softing/softing.h b/drivers/net/can/softing/softing.h
new file mode 100644
index 000000000000..7ec9f4db3d52
--- /dev/null
+++ b/drivers/net/can/softing/softing.h
@@ -0,0 +1,167 @@
+/*
+ * softing common interfaces
+ *
+ * by Kurt Van Dijck, 2008-2010
+ */
+
+#include <linux/atomic.h>
+#include <linux/netdevice.h>
+#include <linux/ktime.h>
+#include <linux/mutex.h>
+#include <linux/spinlock.h>
+#include <linux/can.h>
+#include <linux/can/dev.h>
+
+#include "softing_platform.h"
+
+struct softing;
+
+struct softing_priv {
+        struct can_priv can; /* must be the first member! */
+        struct net_device *netdev;
+        struct softing *card;
+        struct {
+                int pending;
+                /* variables wich hold the circular buffer */
+                int echo_put;
+                int echo_get;
+        } tx;
+        struct can_bittiming_const btr_const;
+        int index;
+        uint8_t output;
+        uint16_t chip;
+};
+#define netdev2softing(netdev)  ((struct softing_priv *)netdev_priv(netdev))
+
+struct softing {
+        const struct softing_platform_data *pdat;
+        struct platform_device *pdev;
+        struct net_device *net[2];
+        spinlock_t spin; /* protect this structure & DPRAM access */
+        ktime_t ts_ref;
+        ktime_t ts_overflow; /* timestamp overflow value, in ktime */
+
+        struct {
+                /* indication of firmware status */
+                int up;
+                /* protection of the 'up' variable */
+                struct mutex lock;
+        } fw;
+        struct {
+                int nr;
+                int requested;
+                int svc_count;
+                unsigned int dpram_position;
+        } irq;
+        struct {
+                int pending;
+                int last_bus;
+                /*
+                 * keep the bus that last tx'd a message,
+                 * in order to let every netdev queue resume
+                 */
+        } tx;
+        __iomem uint8_t *dpram;
+        unsigned long dpram_phys;
+        unsigned long dpram_size;
+        struct {
+                uint16_t fw_version, hw_version, license, serial;
+                uint16_t chip[2];
+                unsigned int freq; /* remote cpu's operating frequency */
+        } id;
+};
+
+extern int softing_default_output(struct net_device *netdev);
+
+extern ktime_t softing_raw2ktime(struct softing *card, u32 raw);
+
+extern int softing_chip_poweron(struct softing *card);
+
+extern int softing_bootloader_command(struct softing *card, int16_t cmd,
+                const char *msg);
+
+/* Load firmware after reset */
+extern int softing_load_fw(const char *file, struct softing *card,
+                        __iomem uint8_t *virt, unsigned int size, int offset);
+
+/* Load final application firmware after bootloader */
+extern int softing_load_app_fw(const char *file, struct softing *card);
+
+/*
+ * enable or disable irq
+ * only called with fw.lock locked
+ */
+extern int softing_enable_irq(struct softing *card, int enable);
+
+/* start/stop 1 bus on card */
+extern int softing_startstop(struct net_device *netdev, int up);
+
+/* netif_rx() */
+extern int softing_netdev_rx(struct net_device *netdev,
+                const struct can_frame *msg, ktime_t ktime);
+
+/* SOFTING DPRAM mappings */
+#define DPRAM_RX                0x0000
+        #define DPRAM_RX_SIZE   32
+        #define DPRAM_RX_CNT    16
+#define DPRAM_RX_RD             0x0201  /* uint8_t */
+#define DPRAM_RX_WR             0x0205  /* uint8_t */
+#define DPRAM_RX_LOST           0x0207  /* uint8_t */
+
+#define DPRAM_FCT_PARAM         0x0300  /* int16_t [20] */
+#define DPRAM_FCT_RESULT        0x0328  /* int16_t */
+#define DPRAM_FCT_HOST          0x032b  /* uint16_t */
+
+#define DPRAM_INFO_BUSSTATE     0x0331  /* uint16_t */
+#define DPRAM_INFO_BUSSTATE2    0x0335  /* uint16_t */
+#define DPRAM_INFO_ERRSTATE     0x0339  /* uint16_t */
+#define DPRAM_INFO_ERRSTATE2    0x033d  /* uint16_t */
+#define DPRAM_RESET             0x0341  /* uint16_t */
+#define DPRAM_CLR_RECV_FIFO     0x0345  /* uint16_t */
+#define DPRAM_RESET_TIME        0x034d  /* uint16_t */
+#define DPRAM_TIME              0x0350  /* uint64_t */
+#define DPRAM_WR_START          0x0358  /* uint8_t */
+#define DPRAM_WR_END            0x0359  /* uint8_t */
+#define DPRAM_RESET_RX_FIFO     0x0361  /* uint16_t */
+#define DPRAM_RESET_TX_FIFO     0x0364  /* uint8_t */
+#define DPRAM_READ_FIFO_LEVEL   0x0365  /* uint8_t */
+#define DPRAM_RX_FIFO_LEVEL     0x0366  /* uint16_t */
+#define DPRAM_TX_FIFO_LEVEL     0x0366  /* uint16_t */
+
+#define DPRAM_TX                0x0400  /* uint16_t */
+        #define DPRAM_TX_SIZE   16
+        #define DPRAM_TX_CNT    32
+#define DPRAM_TX_RD             0x0601  /* uint8_t */
+#define DPRAM_TX_WR             0x0605  /* uint8_t */
+
+#define DPRAM_COMMAND           0x07e0  /* uint16_t */
+#define DPRAM_RECEIPT           0x07f0  /* uint16_t */
+#define DPRAM_IRQ_TOHOST        0x07fe  /* uint8_t */
+#define DPRAM_IRQ_TOCARD        0x07ff  /* uint8_t */
+
+#define DPRAM_V2_RESET          0x0e00  /* uint8_t */
+#define DPRAM_V2_IRQ_TOHOST     0x0e02  /* uint8_t */
+
+#define TXMAX   (DPRAM_TX_CNT - 1)
+
+/* DPRAM return codes */
+#define RES_NONE        0
+#define RES_OK          1
+#define RES_NOK         2
+#define RES_UNKNOWN     3
+/* DPRAM flags */
+#define CMD_TX          0x01
+#define CMD_ACK         0x02
+#define CMD_XTD         0x04
+#define CMD_RTR         0x08
+#define CMD_ERR         0x10
+#define CMD_BUS2        0x80
+
+/* returned fifo entry bus state masks */
+#define SF_MASK_BUSOFF          0x80
+#define SF_MASK_EPASSIVE        0x60
+
+/* bus states */
+#define STATE_BUSOFF    2
+#define STATE_EPASSIVE  1
+#define STATE_EACTIVE   0
diff --git a/drivers/net/can/softing/softing_cs.c b/drivers/net/can/softing/softing_cs.c
new file mode 100644
index 000000000000..300fe75dd1a7
--- /dev/null
+++ b/drivers/net/can/softing/softing_cs.c
@@ -0,0 +1,359 @@
+/*
+ * Copyright (C) 2008-2010
+ *
+ * - Kurt Van Dijck, EIA Electronics
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the version 2 of the GNU General Public License
+ * as published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+
+#include <pcmcia/cistpl.h>
+#include <pcmcia/ds.h>
+
+#include "softing_platform.h"
+
+static int softingcs_index;
+static spinlock_t softingcs_index_lock;
+
+static int softingcs_reset(struct platform_device *pdev, int v);
+static int softingcs_enable_irq(struct platform_device *pdev, int v);
+
+/*
+ * platform_data descriptions
+ */
+#define MHZ (1000*1000)
+static const struct softing_platform_data softingcs_platform_data[] = {
+{
+        .name = "CANcard",
+        .manf = 0x0168, .prod = 0x001,
+        .generation = 1,
+        .nbus = 2,
+        .freq = 16 * MHZ, .max_brp = 32, .max_sjw = 4,
+        .dpram_size = 0x0800,
+        .boot = {0x0000, 0x000000, fw_dir "bcard.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancard.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = softingcs_enable_irq,
+}, {
+        .name = "CANcard-NEC",
+        .manf = 0x0168, .prod = 0x002,
+        .generation = 1,
+        .nbus = 2,
+        .freq = 16 * MHZ, .max_brp = 32, .max_sjw = 4,
+        .dpram_size = 0x0800,
+        .boot = {0x0000, 0x000000, fw_dir "bcard.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancard.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = softingcs_enable_irq,
+}, {
+        .name = "CANcard-SJA",
+        .manf = 0x0168, .prod = 0x004,
+        .generation = 1,
+        .nbus = 2,
+        .freq = 20 * MHZ, .max_brp = 32, .max_sjw = 4,
+        .dpram_size = 0x0800,
+        .boot = {0x0000, 0x000000, fw_dir "bcard.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cansja.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = softingcs_enable_irq,
+}, {
+        .name = "CANcard-2",
+        .manf = 0x0168, .prod = 0x005,
+        .generation = 2,
+        .nbus = 2,
+        .freq = 24 * MHZ, .max_brp = 64, .max_sjw = 4,
+        .dpram_size = 0x1000,
+        .boot = {0x0000, 0x000000, fw_dir "bcard2.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard2.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancrd2.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = NULL,
+}, {
+        .name = "Vector-CANcard",
+        .manf = 0x0168, .prod = 0x081,
+        .generation = 1,
+        .nbus = 2,
+        .freq = 16 * MHZ, .max_brp = 64, .max_sjw = 4,
+        .dpram_size = 0x0800,
+        .boot = {0x0000, 0x000000, fw_dir "bcard.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancard.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = softingcs_enable_irq,
+}, {
+        .name = "Vector-CANcard-SJA",
+        .manf = 0x0168, .prod = 0x084,
+        .generation = 1,
+        .nbus = 2,
+        .freq = 20 * MHZ, .max_brp = 32, .max_sjw = 4,
+        .dpram_size = 0x0800,
+        .boot = {0x0000, 0x000000, fw_dir "bcard.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cansja.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = softingcs_enable_irq,
+}, {
+        .name = "Vector-CANcard-2",
+        .manf = 0x0168, .prod = 0x085,
+        .generation = 2,
+        .nbus = 2,
+        .freq = 24 * MHZ, .max_brp = 64, .max_sjw = 4,
+        .dpram_size = 0x1000,
+        .boot = {0x0000, 0x000000, fw_dir "bcard2.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard2.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancrd2.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = NULL,
+}, {
+        .name = "EDICcard-NEC",
+        .manf = 0x0168, .prod = 0x102,
+        .generation = 1,
+        .nbus = 2,
+        .freq = 16 * MHZ, .max_brp = 64, .max_sjw = 4,
+        .dpram_size = 0x0800,
+        .boot = {0x0000, 0x000000, fw_dir "bcard.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancard.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = softingcs_enable_irq,
+}, {
+        .name = "EDICcard-2",
+        .manf = 0x0168, .prod = 0x105,
+        .generation = 2,
+        .nbus = 2,
+        .freq = 24 * MHZ, .max_brp = 64, .max_sjw = 4,
+        .dpram_size = 0x1000,
+        .boot = {0x0000, 0x000000, fw_dir "bcard2.bin",},
+        .load = {0x0120, 0x00f600, fw_dir "ldcard2.bin",},
+        .app = {0x0010, 0x0d0000, fw_dir "cancrd2.bin",},
+        .reset = softingcs_reset,
+        .enable_irq = NULL,
+}, {
+        0, 0,
+},
+};
+
+MODULE_FIRMWARE(fw_dir "bcard.bin");
+MODULE_FIRMWARE(fw_dir "ldcard.bin");
+MODULE_FIRMWARE(fw_dir "cancard.bin");
+MODULE_FIRMWARE(fw_dir "cansja.bin");
+
+MODULE_FIRMWARE(fw_dir "bcard2.bin");
+MODULE_FIRMWARE(fw_dir "ldcard2.bin");
+MODULE_FIRMWARE(fw_dir "cancrd2.bin");
+
+static __devinit const struct softing_platform_data
+*softingcs_find_platform_data(unsigned int manf, unsigned int prod)
+{
+        const struct softing_platform_data *lp;
+
+        for (lp = softingcs_platform_data; lp->manf; ++lp) {
+                if ((lp->manf == manf) && (lp->prod == prod))
+                        return lp;
+        }
+        return NULL;
+}
+
+/*
+ * platformdata callbacks
+ */
+static int softingcs_reset(struct platform_device *pdev, int v)
+{
+        struct pcmcia_device *pcmcia = to_pcmcia_dev(pdev->dev.parent);
+
+        dev_dbg(&pdev->dev, "pcmcia config [2] %02x\n", v ? 0 : 0x20);
+        return pcmcia_write_config_byte(pcmcia, 2, v ? 0 : 0x20);
+}
+
+static int softingcs_enable_irq(struct platform_device *pdev, int v)
+{
+        struct pcmcia_device *pcmcia = to_pcmcia_dev(pdev->dev.parent);
+
+        dev_dbg(&pdev->dev, "pcmcia config [0] %02x\n", v ? 0x60 : 0);
+        return pcmcia_write_config_byte(pcmcia, 0, v ? 0x60 : 0);
+}
+
+/*
+ * pcmcia check
+ */
+static __devinit int softingcs_probe_config(struct pcmcia_device *pcmcia,
+                void *priv_data)
+{
+        struct softing_platform_data *pdat = priv_data;
+        struct resource *pres;
+        int memspeed = 0;
+
+        WARN_ON(!pdat);
+        pres = pcmcia->resource[PCMCIA_IOMEM_0];
+        if (resource_size(pres) < 0x1000)
+                return -ERANGE;
+
+        pres->flags |= WIN_MEMORY_TYPE_CM | WIN_ENABLE;
+        if (pdat->generation < 2) {
+                pres->flags |= WIN_USE_WAIT | WIN_DATA_WIDTH_8;
+                memspeed = 3;
+        } else {
+                pres->flags |= WIN_DATA_WIDTH_16;
+        }
+        return pcmcia_request_window(pcmcia, pres, memspeed);
+}
+
+static __devexit void softingcs_remove(struct pcmcia_device *pcmcia)
+{
+        struct platform_device *pdev = pcmcia->priv;
+
+        /* free bits */
+        platform_device_unregister(pdev);
+        /* release pcmcia stuff */
+        pcmcia_disable_device(pcmcia);
+}
+
+/*
+ * platform_device wrapper
+ * pdev->resource has 2 entries: io & irq
+ */
+static void softingcs_pdev_release(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        kfree(pdev);
+}
+
+static __devinit int softingcs_probe(struct pcmcia_device *pcmcia)
+{
+        int ret;
+        struct platform_device *pdev;
+        const struct softing_platform_data *pdat;
+        struct resource *pres;
+        struct dev {
+                struct platform_device pdev;
+                struct resource res[2];
+        } *dev;
+
+        /* find matching platform_data */
+        pdat = softingcs_find_platform_data(pcmcia->manf_id, pcmcia->card_id);
+        if (!pdat)
+                return -ENOTTY;
+
+        /* setup pcmcia device */
+        pcmcia->config_flags |= CONF_ENABLE_IRQ | CONF_AUTO_SET_IOMEM |
+                CONF_AUTO_SET_VPP | CONF_AUTO_CHECK_VCC;
+        ret = pcmcia_loop_config(pcmcia, softingcs_probe_config, (void *)pdat);
+        if (ret)
+                goto pcmcia_failed;
+
+        ret = pcmcia_enable_device(pcmcia);
+        if (ret < 0)
+                goto pcmcia_failed;
+
+        pres = pcmcia->resource[PCMCIA_IOMEM_0];
+        if (!pres) {
+                ret = -EBADF;
+                goto pcmcia_bad;
+        }
+
+        /* create softing platform device */
+        dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+        if (!dev) {
+                ret = -ENOMEM;
+                goto mem_failed;
+        }
+        dev->pdev.resource = dev->res;
+        dev->pdev.num_resources = ARRAY_SIZE(dev->res);
+        dev->pdev.dev.release = softingcs_pdev_release;
+
+        pdev = &dev->pdev;
+        pdev->dev.platform_data = (void *)pdat;
+        pdev->dev.parent = &pcmcia->dev;
+        pcmcia->priv = pdev;
+
+        /* platform device resources */
+        pdev->resource[0].flags = IORESOURCE_MEM;
+        pdev->resource[0].start = pres->start;
+        pdev->resource[0].end = pres->end;
+
+        pdev->resource[1].flags = IORESOURCE_IRQ;
+        pdev->resource[1].start = pcmcia->irq;
+        pdev->resource[1].end = pdev->resource[1].start;
+
+        /* platform device setup */
+        spin_lock(&softingcs_index_lock);
+        pdev->id = softingcs_index++;
+        spin_unlock(&softingcs_index_lock);
+        pdev->name = "softing";
+        dev_set_name(&pdev->dev, "softingcs.%i", pdev->id);
+        ret = platform_device_register(pdev);
+        if (ret < 0)
+                goto platform_failed;
+
+        dev_info(&pcmcia->dev, "created %s\n", dev_name(&pdev->dev));
+        return 0;
+
+platform_failed:
+        kfree(dev);
+mem_failed:
+pcmcia_bad:
+pcmcia_failed:
+        pcmcia_disable_device(pcmcia);
+        pcmcia->priv = NULL;
+        return ret ?: -ENODEV;
+}
+
+static /*const*/ struct pcmcia_device_id softingcs_ids[] = {
+        /* softing */
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0001),
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0002),
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0004),
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0005),
+        /* vector, manufacturer? */
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0081),
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0084),
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0085),
+        /* EDIC */
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0102),
+        PCMCIA_DEVICE_MANF_CARD(0x0168, 0x0105),
+        PCMCIA_DEVICE_NULL,
+};
+
+MODULE_DEVICE_TABLE(pcmcia, softingcs_ids);
+
+static struct pcmcia_driver softingcs_driver = {
+        .owner          = THIS_MODULE,
+        .name           = "softingcs",
+        .id_table       = softingcs_ids,
+        .probe          = softingcs_probe,
+        .remove         = __devexit_p(softingcs_remove),
+};
+
+static int __init softingcs_start(void)
+{
+        spin_lock_init(&softingcs_index_lock);
+        return pcmcia_register_driver(&softingcs_driver);
+}
+
+static void __exit softingcs_stop(void)
+{
+        pcmcia_unregister_driver(&softingcs_driver);
+}
+
+module_init(softingcs_start);
+module_exit(softingcs_stop);
+
+MODULE_DESCRIPTION("softing CANcard driver"
+                ", links PCMCIA card to softing driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/net/can/softing/softing_fw.c b/drivers/net/can/softing/softing_fw.c
new file mode 100644
index 000000000000..b520784fb197
--- /dev/null
+++ b/drivers/net/can/softing/softing_fw.c
@@ -0,0 +1,691 @@
+/*
+ * Copyright (C) 2008-2010
+ *
+ * - Kurt Van Dijck, EIA Electronics
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the version 2 of the GNU General Public License
+ * as published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/firmware.h>
+#include <linux/sched.h>
+#include <asm/div64.h>
+
+#include "softing.h"
+
+/*
+ * low level DPRAM command.
+ * Make sure that card->dpram[DPRAM_FCT_HOST] is preset
+ */
+static int _softing_fct_cmd(struct softing *card, int16_t cmd, uint16_t vector,
+                const char *msg)
+{
+        int ret;
+        unsigned long stamp;
+
+        iowrite16(cmd, &card->dpram[DPRAM_FCT_PARAM]);
+        iowrite8(vector >> 8, &card->dpram[DPRAM_FCT_HOST + 1]);
+        iowrite8(vector, &card->dpram[DPRAM_FCT_HOST]);
+        /* be sure to flush this to the card */
+        wmb();
+        stamp = jiffies + 1 * HZ;
+        /* wait for card */
+        do {
+                /* DPRAM_FCT_HOST is _not_ aligned */
+                ret = ioread8(&card->dpram[DPRAM_FCT_HOST]) +
+                        (ioread8(&card->dpram[DPRAM_FCT_HOST + 1]) << 8);
+                /* don't have any cached variables */
+                rmb();
+                if (ret == RES_OK)
+                        /* read return-value now */
+                        return ioread16(&card->dpram[DPRAM_FCT_RESULT]);
+
+                if ((ret != vector) || time_after(jiffies, stamp))
+                        break;
+                /* process context => relax */
+                usleep_range(500, 10000);
+        } while (1);
+
+        ret = (ret == RES_NONE) ? -ETIMEDOUT : -ECANCELED;
+        dev_alert(&card->pdev->dev, "firmware %s failed (%i)\n", msg, ret);
+        return ret;
+}
+
+static int softing_fct_cmd(struct softing *card, int16_t cmd, const char *msg)
+{
+        int ret;
+
+        ret = _softing_fct_cmd(card, cmd, 0, msg);
+        if (ret > 0) {
+                dev_alert(&card->pdev->dev, "%s returned %u\n", msg, ret);
+                ret = -EIO;
+        }
+        return ret;
+}
+
+int softing_bootloader_command(struct softing *card, int16_t cmd,
+                const char *msg)
+{
+        int ret;
+        unsigned long stamp;
+
+        iowrite16(RES_NONE, &card->dpram[DPRAM_RECEIPT]);
+        iowrite16(cmd, &card->dpram[DPRAM_COMMAND]);
+        /* be sure to flush this to the card */
+        wmb();
+        stamp = jiffies + 3 * HZ;
+        /* wait for card */
+        do {
+                ret = ioread16(&card->dpram[DPRAM_RECEIPT]);
+                /* don't have any cached variables */
+                rmb();
+                if (ret == RES_OK)
+                        return 0;
+                if (time_after(jiffies, stamp))
+                        break;
+                /* process context => relax */
+                usleep_range(500, 10000);
+        } while (!signal_pending(current));
+
+        ret = (ret == RES_NONE) ? -ETIMEDOUT : -ECANCELED;
+        dev_alert(&card->pdev->dev, "bootloader %s failed (%i)\n", msg, ret);
+        return ret;
+}
+
+static int fw_parse(const uint8_t **pmem, uint16_t *ptype, uint32_t *paddr,
+                uint16_t *plen, const uint8_t **pdat)
+{
+        uint16_t checksum[2];
+        const uint8_t *mem;
+        const uint8_t *end;
+
+        /*
+         * firmware records are a binary, unaligned stream composed of:
+         * uint16_t type;
+         * uint32_t addr;
+         * uint16_t len;
+         * uint8_t dat[len];
+         * uint16_t checksum;
+         * all values in little endian.
+         * We could define a struct for this, with __attribute__((packed)),
+         * but would that solve the alignment in _all_ cases (cfr. the
+         * struct itself may be an odd address)?
+         *
+         * I chose to use leXX_to_cpup() since this solves both
+         * endianness & alignment.
+         */
+        mem = *pmem;
+        *ptype = le16_to_cpup((void *)&mem[0]);
+        *paddr = le32_to_cpup((void *)&mem[2]);
+        *plen = le16_to_cpup((void *)&mem[6]);
+        *pdat = &mem[8];
+        /* verify checksum */
+        end = &mem[8 + *plen];
+        checksum[0] = le16_to_cpup((void *)end);
+        for (checksum[1] = 0; mem < end; ++mem)
+                checksum[1] += *mem;
+        if (checksum[0] != checksum[1])
+                return -EINVAL;
+        /* increment */
+        *pmem += 10 + *plen;
+        return 0;
+}
+
+int softing_load_fw(const char *file, struct softing *card,
+                __iomem uint8_t *dpram, unsigned int size, int offset)
+{
+        const struct firmware *fw;
+        int ret;
+        const uint8_t *mem, *end, *dat;
+        uint16_t type, len;
+        uint32_t addr;
+        uint8_t *buf = NULL;
+        int buflen = 0;
+        int8_t type_end = 0;
+
+        ret = request_firmware(&fw, file, &card->pdev->dev);
+        if (ret < 0)
+                return ret;
+        dev_dbg(&card->pdev->dev, "%s, firmware(%s) got %u bytes"
+                ", offset %c0x%04x\n",
+                card->pdat->name, file, (unsigned int)fw->size,
+                (offset >= 0) ? '+' : '-', (unsigned int)abs(offset));
+        /* parse the firmware */
+        mem = fw->data;
+        end = &mem[fw->size];
+        /* look for header record */
+        ret = fw_parse(&mem, &type, &addr, &len, &dat);
+        if (ret < 0)
+                goto failed;
+        if (type != 0xffff)
+                goto failed;
+        if (strncmp("Structured Binary Format, Softing GmbH" , dat, len)) {
+                ret = -EINVAL;
+                goto failed;
+        }
+        /* ok, we had a header */
+        while (mem < end) {
+                ret = fw_parse(&mem, &type, &addr, &len, &dat);
+                if (ret < 0)
+                        goto failed;
+                if (type == 3) {
+                        /* start address, not used here */
+                        continue;
+                } else if (type == 1) {
+                        /* eof */
+                        type_end = 1;
+                        break;
+                } else if (type != 0) {
+                        ret = -EINVAL;
+                        goto failed;
+                }
+
+                if ((addr + len + offset) > size)
+                        goto failed;
+                memcpy_toio(&dpram[addr + offset], dat, len);
+                /* be sure to flush caches from IO space */
+                mb();
+                if (len > buflen) {
+                        /* align buflen */
+                        buflen = (len + (1024-1)) & ~(1024-1);
+                        buf = krealloc(buf, buflen, GFP_KERNEL);
+                        if (!buf) {
+                                ret = -ENOMEM;
+                                goto failed;
+                        }
+                }
+                /* verify record data */
+                memcpy_fromio(buf, &dpram[addr + offset], len);
+                if (memcmp(buf, dat, len)) {
+                        /* is not ok */
+                        dev_alert(&card->pdev->dev, "DPRAM readback failed\n");
+                        ret = -EIO;
+                        goto failed;
+                }
+        }
+        if (!type_end)
+                /* no end record seen */
+                goto failed;
+        ret = 0;
+failed:
+        kfree(buf);
+        release_firmware(fw);
+        if (ret < 0)
+                dev_info(&card->pdev->dev, "firmware %s failed\n", file);
+        return ret;
+}
+
+int softing_load_app_fw(const char *file, struct softing *card)
+{
+        const struct firmware *fw;
+        const uint8_t *mem, *end, *dat;
+        int ret, j;
+        uint16_t type, len;
+        uint32_t addr, start_addr = 0;
+        unsigned int sum, rx_sum;
+        int8_t type_end = 0, type_entrypoint = 0;
+
+        ret = request_firmware(&fw, file, &card->pdev->dev);
+        if (ret) {
+                dev_alert(&card->pdev->dev, "request_firmware(%s) got %i\n",
+                        file, ret);
+                return ret;
+        }
+        dev_dbg(&card->pdev->dev, "firmware(%s) got %lu bytes\n",
+                file, (unsigned long)fw->size);
+        /* parse the firmware */
+        mem = fw->data;
+        end = &mem[fw->size];
+        /* look for header record */
+        ret = fw_parse(&mem, &type, &addr, &len, &dat);
+        if (ret)
+                goto failed;
+        ret = -EINVAL;
+        if (type != 0xffff) {
+                dev_alert(&card->pdev->dev, "firmware starts with type 0x%x\n",
+                        type);
+                goto failed;
+        }
+        if (strncmp("Structured Binary Format, Softing GmbH", dat, len)) {
+                dev_alert(&card->pdev->dev, "firmware string '%.*s' fault\n",
+                                len, dat);
+                goto failed;
+        }
+        /* ok, we had a header */
+        while (mem < end) {
+                ret = fw_parse(&mem, &type, &addr, &len, &dat);
+                if (ret)
+                        goto failed;
+
+                if (type == 3) {
+                        /* start address */
+                        start_addr = addr;
+                        type_entrypoint = 1;
+                        continue;
+                } else if (type == 1) {
+                        /* eof */
+                        type_end = 1;
+                        break;
+                } else if (type != 0) {
+                        dev_alert(&card->pdev->dev,
+                                        "unknown record type 0x%04x\n", type);
+                        ret = -EINVAL;
+                        goto failed;
+                }
+
+                /* regualar data */
+                for (sum = 0, j = 0; j < len; ++j)
+                        sum += dat[j];
+                /* work in 16bit (target) */
+                sum &= 0xffff;
+
+                memcpy_toio(&card->dpram[card->pdat->app.offs], dat, len);
+                iowrite32(card->pdat->app.offs + card->pdat->app.addr,
+                                &card->dpram[DPRAM_COMMAND + 2]);
+                iowrite32(addr, &card->dpram[DPRAM_COMMAND + 6]);
+                iowrite16(len, &card->dpram[DPRAM_COMMAND + 10]);
+                iowrite8(1, &card->dpram[DPRAM_COMMAND + 12]);
+                ret = softing_bootloader_command(card, 1, "loading app.");
+                if (ret < 0)
+                        goto failed;
+                /* verify checksum */
+                rx_sum = ioread16(&card->dpram[DPRAM_RECEIPT + 2]);
+                if (rx_sum != sum) {
+                        dev_alert(&card->pdev->dev, "SRAM seems to be damaged"
+                                ", wanted 0x%04x, got 0x%04x\n", sum, rx_sum);
+                        ret = -EIO;
+                        goto failed;
+                }
+        }
+        if (!type_end || !type_entrypoint)
+                goto failed;
+        /* start application in card */
+        iowrite32(start_addr, &card->dpram[DPRAM_COMMAND + 2]);
+        iowrite8(1, &card->dpram[DPRAM_COMMAND + 6]);
+        ret = softing_bootloader_command(card, 3, "start app.");
+        if (ret < 0)
+                goto failed;
+        ret = 0;
+failed:
+        release_firmware(fw);
+        if (ret < 0)
+                dev_info(&card->pdev->dev, "firmware %s failed\n", file);
+        return ret;
+}
+
+static int softing_reset_chip(struct softing *card)
+{
+        int ret;
+
+        do {
+                /* reset chip */
+                iowrite8(0, &card->dpram[DPRAM_RESET_RX_FIFO]);
+                iowrite8(0, &card->dpram[DPRAM_RESET_RX_FIFO+1]);
+                iowrite8(1, &card->dpram[DPRAM_RESET]);
+                iowrite8(0, &card->dpram[DPRAM_RESET+1]);
+
+                ret = softing_fct_cmd(card, 0, "reset_can");
+                if (!ret)
+                        break;
+                if (signal_pending(current))
+                        /* don't wait any longer */
+                        break;
+        } while (1);
+        card->tx.pending = 0;
+        return ret;
+}
+
+int softing_chip_poweron(struct softing *card)
+{
+        int ret;
+        /* sync */
+        ret = _softing_fct_cmd(card, 99, 0x55, "sync-a");
+        if (ret < 0)
+                goto failed;
+
+        ret = _softing_fct_cmd(card, 99, 0xaa, "sync-b");
+        if (ret < 0)
+                goto failed;
+
+        ret = softing_reset_chip(card);
+        if (ret < 0)
+                goto failed;
+        /* get_serial */
+        ret = softing_fct_cmd(card, 43, "get_serial_number");
+        if (ret < 0)
+                goto failed;
+        card->id.serial = ioread32(&card->dpram[DPRAM_FCT_PARAM]);
+        /* get_version */
+        ret = softing_fct_cmd(card, 12, "get_version");
+        if (ret < 0)
+                goto failed;
+        card->id.fw_version = ioread16(&card->dpram[DPRAM_FCT_PARAM + 2]);
+        card->id.hw_version = ioread16(&card->dpram[DPRAM_FCT_PARAM + 4]);
+        card->id.license = ioread16(&card->dpram[DPRAM_FCT_PARAM + 6]);
+        card->id.chip[0] = ioread16(&card->dpram[DPRAM_FCT_PARAM + 8]);
+        card->id.chip[1] = ioread16(&card->dpram[DPRAM_FCT_PARAM + 10]);
+        return 0;
+failed:
+        return ret;
+}
+
+static void softing_initialize_timestamp(struct softing *card)
+{
+        uint64_t ovf;
+
+        card->ts_ref = ktime_get();
+
+        /* 16MHz is the reference */
+        ovf = 0x100000000ULL * 16;
+        do_div(ovf, card->pdat->freq ?: 16);
+
+        card->ts_overflow = ktime_add_us(ktime_set(0, 0), ovf);
+}
+
+ktime_t softing_raw2ktime(struct softing *card, u32 raw)
+{
+        uint64_t rawl;
+        ktime_t now, real_offset;
+        ktime_t target;
+        ktime_t tmp;
+
+        now = ktime_get();
+        real_offset = ktime_sub(ktime_get_real(), now);
+
+        /* find nsec from card */
+        rawl = raw * 16;
+        do_div(rawl, card->pdat->freq ?: 16);
+        target = ktime_add_us(card->ts_ref, rawl);
+        /* test for overflows */
+        tmp = ktime_add(target, card->ts_overflow);
+        while (unlikely(ktime_to_ns(tmp) > ktime_to_ns(now))) {
+                card->ts_ref = ktime_add(card->ts_ref, card->ts_overflow);
+                target = tmp;
+                tmp = ktime_add(target, card->ts_overflow);
+        }
+        return ktime_add(target, real_offset);
+}
+
+static inline int softing_error_reporting(struct net_device *netdev)
+{
+        struct softing_priv *priv = netdev_priv(netdev);
+
+        return (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING)
+                ? 1 : 0;
+}
+
+int softing_startstop(struct net_device *dev, int up)
+{
+        int ret;
+        struct softing *card;
+        struct softing_priv *priv;
+        struct net_device *netdev;
+        int bus_bitmask_start;
+        int j, error_reporting;
+        struct can_frame msg;
+        const struct can_bittiming *bt;
+
+        priv = netdev_priv(dev);
+        card = priv->card;
+
+        if (!card->fw.up)
+                return -EIO;
+
+        ret = mutex_lock_interruptible(&card->fw.lock);
+        if (ret)
+                return ret;
+
+        bus_bitmask_start = 0;
+        if (dev && up)
+                /* prepare to start this bus as well */
+                bus_bitmask_start |= (1 << priv->index);
+        /* bring netdevs down */
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                netdev = card->net[j];
+                if (!netdev)
+                        continue;
+                priv = netdev_priv(netdev);
+
+                if (dev != netdev)
+                        netif_stop_queue(netdev);
+
+                if (netif_running(netdev)) {
+                        if (dev != netdev)
+                                bus_bitmask_start |= (1 << j);
+                        priv->tx.pending = 0;
+                        priv->tx.echo_put = 0;
+                        priv->tx.echo_get = 0;
+                        /*
+                         * this bus' may just have called open_candev()
+                         * which is rather stupid to call close_candev()
+                         * already
+                         * but we may come here from busoff recovery too
+                         * in which case the echo_skb _needs_ flushing too.
+                         * just be sure to call open_candev() again
+                         */
+                        close_candev(netdev);
+                }
+                priv->can.state = CAN_STATE_STOPPED;
+        }
+        card->tx.pending = 0;
+
+        softing_enable_irq(card, 0);
+        ret = softing_reset_chip(card);
+        if (ret)
+                goto failed;
+        if (!bus_bitmask_start)
+                /* no busses to be brought up */
+                goto card_done;
+
+        if ((bus_bitmask_start & 1) && (bus_bitmask_start & 2)
+                        && (softing_error_reporting(card->net[0])
+                                != softing_error_reporting(card->net[1]))) {
+                dev_alert(&card->pdev->dev,
+                                "err_reporting flag differs for busses\n");
+                goto invalid;
+        }
+        error_reporting = 0;
+        if (bus_bitmask_start & 1) {
+                netdev = card->net[0];
+                priv = netdev_priv(netdev);
+                error_reporting += softing_error_reporting(netdev);
+                /* init chip 1 */
+                bt = &priv->can.bittiming;
+                iowrite16(bt->brp, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                iowrite16(bt->sjw, &card->dpram[DPRAM_FCT_PARAM + 4]);
+                iowrite16(bt->phase_seg1 + bt->prop_seg,
+                                &card->dpram[DPRAM_FCT_PARAM + 6]);
+                iowrite16(bt->phase_seg2, &card->dpram[DPRAM_FCT_PARAM + 8]);
+                iowrite16((priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES) ? 1 : 0,
+                                &card->dpram[DPRAM_FCT_PARAM + 10]);
+                ret = softing_fct_cmd(card, 1, "initialize_chip[0]");
+                if (ret < 0)
+                        goto failed;
+                /* set mode */
+                iowrite16(0, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                iowrite16(0, &card->dpram[DPRAM_FCT_PARAM + 4]);
+                ret = softing_fct_cmd(card, 3, "set_mode[0]");
+                if (ret < 0)
+                        goto failed;
+                /* set filter */
+                /* 11bit id & mask */
+                iowrite16(0x0000, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                iowrite16(0x07ff, &card->dpram[DPRAM_FCT_PARAM + 4]);
+                /* 29bit id.lo & mask.lo & id.hi & mask.hi */
+                iowrite16(0x0000, &card->dpram[DPRAM_FCT_PARAM + 6]);
+                iowrite16(0xffff, &card->dpram[DPRAM_FCT_PARAM + 8]);
+                iowrite16(0x0000, &card->dpram[DPRAM_FCT_PARAM + 10]);
+                iowrite16(0x1fff, &card->dpram[DPRAM_FCT_PARAM + 12]);
+                ret = softing_fct_cmd(card, 7, "set_filter[0]");
+                if (ret < 0)
+                        goto failed;
+                /* set output control */
+                iowrite16(priv->output, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                ret = softing_fct_cmd(card, 5, "set_output[0]");
+                if (ret < 0)
+                        goto failed;
+        }
+        if (bus_bitmask_start & 2) {
+                netdev = card->net[1];
+                priv = netdev_priv(netdev);
+                error_reporting += softing_error_reporting(netdev);
+                /* init chip2 */
+                bt = &priv->can.bittiming;
+                iowrite16(bt->brp, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                iowrite16(bt->sjw, &card->dpram[DPRAM_FCT_PARAM + 4]);
+                iowrite16(bt->phase_seg1 + bt->prop_seg,
+                                &card->dpram[DPRAM_FCT_PARAM + 6]);
+                iowrite16(bt->phase_seg2, &card->dpram[DPRAM_FCT_PARAM + 8]);
+                iowrite16((priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES) ? 1 : 0,
+                                &card->dpram[DPRAM_FCT_PARAM + 10]);
+                ret = softing_fct_cmd(card, 2, "initialize_chip[1]");
+                if (ret < 0)
+                        goto failed;
+                /* set mode2 */
+                iowrite16(0, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                iowrite16(0, &card->dpram[DPRAM_FCT_PARAM + 4]);
+                ret = softing_fct_cmd(card, 4, "set_mode[1]");
+                if (ret < 0)
+                        goto failed;
+                /* set filter2 */
+                /* 11bit id & mask */
+                iowrite16(0x0000, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                iowrite16(0x07ff, &card->dpram[DPRAM_FCT_PARAM + 4]);
+                /* 29bit id.lo & mask.lo & id.hi & mask.hi */
+                iowrite16(0x0000, &card->dpram[DPRAM_FCT_PARAM + 6]);
+                iowrite16(0xffff, &card->dpram[DPRAM_FCT_PARAM + 8]);
+                iowrite16(0x0000, &card->dpram[DPRAM_FCT_PARAM + 10]);
+                iowrite16(0x1fff, &card->dpram[DPRAM_FCT_PARAM + 12]);
+                ret = softing_fct_cmd(card, 8, "set_filter[1]");
+                if (ret < 0)
+                        goto failed;
+                /* set output control2 */
+                iowrite16(priv->output, &card->dpram[DPRAM_FCT_PARAM + 2]);
+                ret = softing_fct_cmd(card, 6, "set_output[1]");
+                if (ret < 0)
+                        goto failed;
+        }
+        /* enable_error_frame */
+        /*
+         * Error reporting is switched off at the moment since
+         * the receiving of them is not yet 100% verified
+         * This should be enabled sooner or later
+         *
+        if (error_reporting) {
+                ret = softing_fct_cmd(card, 51, "enable_error_frame");
+                if (ret < 0)
+                        goto failed;
+        }
+        */
+        /* initialize interface */
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 2]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 4]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 6]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 8]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 10]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 12]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 14]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 16]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 18]);
+        iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 20]);
+        ret = softing_fct_cmd(card, 17, "initialize_interface");
+        if (ret < 0)
+                goto failed;
+        /* enable_fifo */
+        ret = softing_fct_cmd(card, 36, "enable_fifo");
+        if (ret < 0)
+                goto failed;
+        /* enable fifo tx ack */
+        ret = softing_fct_cmd(card, 13, "fifo_tx_ack[0]");
+        if (ret < 0)
+                goto failed;
+        /* enable fifo tx ack2 */
+        ret = softing_fct_cmd(card, 14, "fifo_tx_ack[1]");
+        if (ret < 0)
+                goto failed;
+        /* start_chip */
+        ret = softing_fct_cmd(card, 11, "start_chip");
+        if (ret < 0)
+                goto failed;
+        iowrite8(0, &card->dpram[DPRAM_INFO_BUSSTATE]);
+        iowrite8(0, &card->dpram[DPRAM_INFO_BUSSTATE2]);
+        if (card->pdat->generation < 2) {
+                iowrite8(0, &card->dpram[DPRAM_V2_IRQ_TOHOST]);
+                /* flush the DPRAM caches */
+                wmb();
+        }
+
+        softing_initialize_timestamp(card);
+
+        /*
+         * do socketcan notifications/status changes
+         * from here, no errors should occur, or the failed: part
+         * must be reviewed
+         */
+        memset(&msg, 0, sizeof(msg));
+        msg.can_id = CAN_ERR_FLAG | CAN_ERR_RESTARTED;
+        msg.can_dlc = CAN_ERR_DLC;
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                if (!(bus_bitmask_start & (1 << j)))
+                        continue;
+                netdev = card->net[j];
+                if (!netdev)
+                        continue;
+                priv = netdev_priv(netdev);
+                priv->can.state = CAN_STATE_ERROR_ACTIVE;
+                open_candev(netdev);
+                if (dev != netdev) {
+                        /* notify other busses on the restart */
+                        softing_netdev_rx(netdev, &msg, ktime_set(0, 0));
+                        ++priv->can.can_stats.restarts;
+                }
+                netif_wake_queue(netdev);
+        }
+
+        /* enable interrupts */
+        ret = softing_enable_irq(card, 1);
+        if (ret)
+                goto failed;
+card_done:
+        mutex_unlock(&card->fw.lock);
+        return 0;
+invalid:
+        ret = -EINVAL;
+failed:
+        softing_enable_irq(card, 0);
+        softing_reset_chip(card);
+        mutex_unlock(&card->fw.lock);
+        /* bring all other interfaces down */
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                netdev = card->net[j];
+                if (!netdev)
+                        continue;
+                dev_close(netdev);
+        }
+        return ret;
+}
+
+int softing_default_output(struct net_device *netdev)
+{
+        struct softing_priv *priv = netdev_priv(netdev);
+        struct softing *card = priv->card;
+
+        switch (priv->chip) {
+        case 1000:
+                return (card->pdat->generation < 2) ? 0xfb : 0xfa;
+        case 5:
+                return 0x60;
+        default:
+                return 0x40;
+        }
+}
diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c
new file mode 100644
index 000000000000..5157e15e96eb
--- /dev/null
+++ b/drivers/net/can/softing/softing_main.c
@@ -0,0 +1,893 @@
+/*
+ * Copyright (C) 2008-2010
+ *
+ * - Kurt Van Dijck, EIA Electronics
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the version 2 of the GNU General Public License
+ * as published by the Free Software Foundation
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+
+#include "softing.h"
+
+#define TX_ECHO_SKB_MAX (((TXMAX+1)/2)-1)
+
+/*
+ * test is a specific CAN netdev
+ * is online (ie. up 'n running, not sleeping, not busoff
+ */
+static inline int canif_is_active(struct net_device *netdev)
+{
+        struct can_priv *can = netdev_priv(netdev);
+
+        if (!netif_running(netdev))
+                return 0;
+        return (can->state <= CAN_STATE_ERROR_PASSIVE);
+}
+
+/* reset DPRAM */
+static inline void softing_set_reset_dpram(struct softing *card)
+{
+        if (card->pdat->generation >= 2) {
+                spin_lock_bh(&card->spin);
+                iowrite8(ioread8(&card->dpram[DPRAM_V2_RESET]) & ~1,
+                                &card->dpram[DPRAM_V2_RESET]);
+                spin_unlock_bh(&card->spin);
+        }
+}
+
+static inline void softing_clr_reset_dpram(struct softing *card)
+{
+        if (card->pdat->generation >= 2) {
+                spin_lock_bh(&card->spin);
+                iowrite8(ioread8(&card->dpram[DPRAM_V2_RESET]) | 1,
+                                &card->dpram[DPRAM_V2_RESET]);
+                spin_unlock_bh(&card->spin);
+        }
+}
+
+/* trigger the tx queue-ing */
+static netdev_tx_t softing_netdev_start_xmit(struct sk_buff *skb,
+                struct net_device *dev)
+{
+        struct softing_priv *priv = netdev_priv(dev);
+        struct softing *card = priv->card;
+        int ret;
+        uint8_t *ptr;
+        uint8_t fifo_wr, fifo_rd;
+        struct can_frame *cf = (struct can_frame *)skb->data;
+        uint8_t buf[DPRAM_TX_SIZE];
+
+        if (can_dropped_invalid_skb(dev, skb))
+                return NETDEV_TX_OK;
+
+        spin_lock(&card->spin);
+
+        ret = NETDEV_TX_BUSY;
+        if (!card->fw.up ||
+                        (card->tx.pending >= TXMAX) ||
+                        (priv->tx.pending >= TX_ECHO_SKB_MAX))
+                goto xmit_done;
+        fifo_wr = ioread8(&card->dpram[DPRAM_TX_WR]);
+        fifo_rd = ioread8(&card->dpram[DPRAM_TX_RD]);
+        if (fifo_wr == fifo_rd)
+                /* fifo full */
+                goto xmit_done;
+        memset(buf, 0, sizeof(buf));
+        ptr = buf;
+        *ptr = CMD_TX;
+        if (cf->can_id & CAN_RTR_FLAG)
+                *ptr |= CMD_RTR;
+        if (cf->can_id & CAN_EFF_FLAG)
+                *ptr |= CMD_XTD;
+        if (priv->index)
+                *ptr |= CMD_BUS2;
+        ++ptr;
+        *ptr++ = cf->can_dlc;
+        *ptr++ = (cf->can_id >> 0);
+        *ptr++ = (cf->can_id >> 8);
+        if (cf->can_id & CAN_EFF_FLAG) {
+                *ptr++ = (cf->can_id >> 16);
+                *ptr++ = (cf->can_id >> 24);
+        } else {
+                /* increment 1, not 2 as you might think */
+                ptr += 1;
+        }
+        if (!(cf->can_id & CAN_RTR_FLAG))
+                memcpy(ptr, &cf->data[0], cf->can_dlc);
+        memcpy_toio(&card->dpram[DPRAM_TX + DPRAM_TX_SIZE * fifo_wr],
+                        buf, DPRAM_TX_SIZE);
+        if (++fifo_wr >= DPRAM_TX_CNT)
+                fifo_wr = 0;
+        iowrite8(fifo_wr, &card->dpram[DPRAM_TX_WR]);
+        card->tx.last_bus = priv->index;
+        ++card->tx.pending;
+        ++priv->tx.pending;
+        can_put_echo_skb(skb, dev, priv->tx.echo_put);
+        ++priv->tx.echo_put;
+        if (priv->tx.echo_put >= TX_ECHO_SKB_MAX)
+                priv->tx.echo_put = 0;
+        /* can_put_echo_skb() saves the skb, safe to return TX_OK */
+        ret = NETDEV_TX_OK;
+xmit_done:
+        spin_unlock(&card->spin);
+        if (card->tx.pending >= TXMAX) {
+                int j;
+                for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                        if (card->net[j])
+                                netif_stop_queue(card->net[j]);
+                }
+        }
+        if (ret != NETDEV_TX_OK)
+                netif_stop_queue(dev);
+
+        return ret;
+}
+
+/*
+ * shortcut for skb delivery
+ */
+int softing_netdev_rx(struct net_device *netdev, const struct can_frame *msg,
+                ktime_t ktime)
+{
+        struct sk_buff *skb;
+        struct can_frame *cf;
+
+        skb = alloc_can_skb(netdev, &cf);
+        if (!skb)
+                return -ENOMEM;
+        memcpy(cf, msg, sizeof(*msg));
+        skb->tstamp = ktime;
+        return netif_rx(skb);
+}
+
+/*
+ * softing_handle_1
+ * pop 1 entry from the DPRAM queue, and process
+ */
+static int softing_handle_1(struct softing *card)
+{
+        struct net_device *netdev;
+        struct softing_priv *priv;
+        ktime_t ktime;
+        struct can_frame msg;
+        int cnt = 0, lost_msg;
+        uint8_t fifo_rd, fifo_wr, cmd;
+        uint8_t *ptr;
+        uint32_t tmp_u32;
+        uint8_t buf[DPRAM_RX_SIZE];
+
+        memset(&msg, 0, sizeof(msg));
+        /* test for lost msgs */
+        lost_msg = ioread8(&card->dpram[DPRAM_RX_LOST]);
+        if (lost_msg) {
+                int j;
+                /* reset condition */
+                iowrite8(0, &card->dpram[DPRAM_RX_LOST]);
+                /* prepare msg */
+                msg.can_id = CAN_ERR_FLAG | CAN_ERR_CRTL;
+                msg.can_dlc = CAN_ERR_DLC;
+                msg.data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
+                /*
+                 * service to all busses, we don't know which it was applicable
+                 * but only service busses that are online
+                 */
+                for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                        netdev = card->net[j];
+                        if (!netdev)
+                                continue;
+                        if (!canif_is_active(netdev))
+                                /* a dead bus has no overflows */
+                                continue;
+                        ++netdev->stats.rx_over_errors;
+                        softing_netdev_rx(netdev, &msg, ktime_set(0, 0));
+                }
+                /* prepare for other use */
+                memset(&msg, 0, sizeof(msg));
+                ++cnt;
+        }
+
+        fifo_rd = ioread8(&card->dpram[DPRAM_RX_RD]);
+        fifo_wr = ioread8(&card->dpram[DPRAM_RX_WR]);
+
+        if (++fifo_rd >= DPRAM_RX_CNT)
+                fifo_rd = 0;
+        if (fifo_wr == fifo_rd)
+                return cnt;
+
+        memcpy_fromio(buf, &card->dpram[DPRAM_RX + DPRAM_RX_SIZE*fifo_rd],
+                        DPRAM_RX_SIZE);
+        mb();
+        /* trigger dual port RAM */
+        iowrite8(fifo_rd, &card->dpram[DPRAM_RX_RD]);
+
+        ptr = buf;
+        cmd = *ptr++;
+        if (cmd == 0xff)
+                /* not quite usefull, probably the card has got out */
+                return 0;
+        netdev = card->net[0];
+        if (cmd & CMD_BUS2)
+                netdev = card->net[1];
+        priv = netdev_priv(netdev);
+
+        if (cmd & CMD_ERR) {
+                uint8_t can_state, state;
+
+                state = *ptr++;
+
+                msg.can_id = CAN_ERR_FLAG;
+                msg.can_dlc = CAN_ERR_DLC;
+
+                if (state & SF_MASK_BUSOFF) {
+                        can_state = CAN_STATE_BUS_OFF;
+                        msg.can_id |= CAN_ERR_BUSOFF;
+                        state = STATE_BUSOFF;
+                } else if (state & SF_MASK_EPASSIVE) {
+                        can_state = CAN_STATE_ERROR_PASSIVE;
+                        msg.can_id |= CAN_ERR_CRTL;
+                        msg.data[1] = CAN_ERR_CRTL_TX_PASSIVE;
+                        state = STATE_EPASSIVE;
+                } else {
+                        can_state = CAN_STATE_ERROR_ACTIVE;
+                        msg.can_id |= CAN_ERR_CRTL;
+                        state = STATE_EACTIVE;
+                }
+                /* update DPRAM */
+                iowrite8(state, &card->dpram[priv->index ?
+                                DPRAM_INFO_BUSSTATE2 : DPRAM_INFO_BUSSTATE]);
+                /* timestamp */
+                tmp_u32 = le32_to_cpup((void *)ptr);
+                ptr += 4;
+                ktime = softing_raw2ktime(card, tmp_u32);
+
+                ++netdev->stats.rx_errors;
+                /* update internal status */
+                if (can_state != priv->can.state) {
+                        priv->can.state = can_state;
+                        if (can_state == CAN_STATE_ERROR_PASSIVE)
+                                ++priv->can.can_stats.error_passive;
+                        else if (can_state == CAN_STATE_BUS_OFF) {
+                                /* this calls can_close_cleanup() */
+                                can_bus_off(netdev);
+                                netif_stop_queue(netdev);
+                        }
+                        /* trigger socketcan */
+                        softing_netdev_rx(netdev, &msg, ktime);
+                }
+
+        } else {
+                if (cmd & CMD_RTR)
+                        msg.can_id |= CAN_RTR_FLAG;
+                msg.can_dlc = get_can_dlc(*ptr++);
+                if (cmd & CMD_XTD) {
+                        msg.can_id |= CAN_EFF_FLAG;
+                        msg.can_id |= le32_to_cpup((void *)ptr);
+                        ptr += 4;
+                } else {
+                        msg.can_id |= le16_to_cpup((void *)ptr);
+                        ptr += 2;
+                }
+                /* timestamp */
+                tmp_u32 = le32_to_cpup((void *)ptr);
+                ptr += 4;
+                ktime = softing_raw2ktime(card, tmp_u32);
+                if (!(msg.can_id & CAN_RTR_FLAG))
+                        memcpy(&msg.data[0], ptr, 8);
+                ptr += 8;
+                /* update socket */
+                if (cmd & CMD_ACK) {
+                        /* acknowledge, was tx msg */
+                        struct sk_buff *skb;
+                        skb = priv->can.echo_skb[priv->tx.echo_get];
+                        if (skb)
+                                skb->tstamp = ktime;
+                        can_get_echo_skb(netdev, priv->tx.echo_get);
+                        ++priv->tx.echo_get;
+                        if (priv->tx.echo_get >= TX_ECHO_SKB_MAX)
+                                priv->tx.echo_get = 0;
+                        if (priv->tx.pending)
+                                --priv->tx.pending;
+                        if (card->tx.pending)
+                                --card->tx.pending;
+                        ++netdev->stats.tx_packets;
+                        if (!(msg.can_id & CAN_RTR_FLAG))
+                                netdev->stats.tx_bytes += msg.can_dlc;
+                } else {
+                        int ret;
+
+                        ret = softing_netdev_rx(netdev, &msg, ktime);
+                        if (ret == NET_RX_SUCCESS) {
+                                ++netdev->stats.rx_packets;
+                                if (!(msg.can_id & CAN_RTR_FLAG))
+                                        netdev->stats.rx_bytes += msg.can_dlc;
+                        } else {
+                                ++netdev->stats.rx_dropped;
+                        }
+                }
+        }
+        ++cnt;
+        return cnt;
+}
+
+/*
+ * real interrupt handler
+ */
+static irqreturn_t softing_irq_thread(int irq, void *dev_id)
+{
+        struct softing *card = (struct softing *)dev_id;
+        struct net_device *netdev;
+        struct softing_priv *priv;
+        int j, offset, work_done;
+
+        work_done = 0;
+        spin_lock_bh(&card->spin);
+        while (softing_handle_1(card) > 0) {
+                ++card->irq.svc_count;
+                ++work_done;
+        }
+        spin_unlock_bh(&card->spin);
+        /* resume tx queue's */
+        offset = card->tx.last_bus;
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                if (card->tx.pending >= TXMAX)
+                        break;
+                netdev = card->net[(j + offset + 1) % card->pdat->nbus];
+                if (!netdev)
+                        continue;
+                priv = netdev_priv(netdev);
+                if (!canif_is_active(netdev))
+                        /* it makes no sense to wake dead busses */
+                        continue;
+                if (priv->tx.pending >= TX_ECHO_SKB_MAX)
+                        continue;
+                ++work_done;
+                netif_wake_queue(netdev);
+        }
+        return work_done ? IRQ_HANDLED : IRQ_NONE;
+}
+
+/*
+ * interrupt routines:
+ * schedule the 'real interrupt handler'
+ */
+static irqreturn_t softing_irq_v2(int irq, void *dev_id)
+{
+        struct softing *card = (struct softing *)dev_id;
+        uint8_t ir;
+
+        ir = ioread8(&card->dpram[DPRAM_V2_IRQ_TOHOST]);
+        iowrite8(0, &card->dpram[DPRAM_V2_IRQ_TOHOST]);
+        return (1 == ir) ? IRQ_WAKE_THREAD : IRQ_NONE;
+}
+
+static irqreturn_t softing_irq_v1(int irq, void *dev_id)
+{
+        struct softing *card = (struct softing *)dev_id;
+        uint8_t ir;
+
+        ir = ioread8(&card->dpram[DPRAM_IRQ_TOHOST]);
+        iowrite8(0, &card->dpram[DPRAM_IRQ_TOHOST]);
+        return ir ? IRQ_WAKE_THREAD : IRQ_NONE;
+}
+
+/*
+ * netdev/candev inter-operability
+ */
+static int softing_netdev_open(struct net_device *ndev)
+{
+        int ret;
+
+        /* check or determine and set bittime */
+        ret = open_candev(ndev);
+        if (!ret)
+                ret = softing_startstop(ndev, 1);
+        return ret;
+}
+
+static int softing_netdev_stop(struct net_device *ndev)
+{
+        int ret;
+
+        netif_stop_queue(ndev);
+
+        /* softing cycle does close_candev() */
+        ret = softing_startstop(ndev, 0);
+        return ret;
+}
+
+static int softing_candev_set_mode(struct net_device *ndev, enum can_mode mode)
+{
+        int ret;
+
+        switch (mode) {
+        case CAN_MODE_START:
+                /* softing_startstop does close_candev() */
+                ret = softing_startstop(ndev, 1);
+                return ret;
+        case CAN_MODE_STOP:
+        case CAN_MODE_SLEEP:
+                return -EOPNOTSUPP;
+        }
+        return 0;
+}
+
+/*
+ * Softing device management helpers
+ */
+int softing_enable_irq(struct softing *card, int enable)
+{
+        int ret;
+
+        if (!card->irq.nr) {
+                return 0;
+        } else if (card->irq.requested && !enable) {
+                free_irq(card->irq.nr, card);
+                card->irq.requested = 0;
+        } else if (!card->irq.requested && enable) {
+                ret = request_threaded_irq(card->irq.nr,
+                                (card->pdat->generation >= 2) ?
+                                        softing_irq_v2 : softing_irq_v1,
+                                softing_irq_thread, IRQF_SHARED,
+                                dev_name(&card->pdev->dev), card);
+                if (ret) {
+                        dev_alert(&card->pdev->dev,
+                                        "request_threaded_irq(%u) failed\n",
+                                        card->irq.nr);
+                        return ret;
+                }
+                card->irq.requested = 1;
+        }
+        return 0;
+}
+
+static void softing_card_shutdown(struct softing *card)
+{
+        int fw_up = 0;
+
+        if (mutex_lock_interruptible(&card->fw.lock))
+                /* return -ERESTARTSYS */;
+        fw_up = card->fw.up;
+        card->fw.up = 0;
+
+        if (card->irq.requested && card->irq.nr) {
+                free_irq(card->irq.nr, card);
+                card->irq.requested = 0;
+        }
+        if (fw_up) {
+                if (card->pdat->enable_irq)
+                        card->pdat->enable_irq(card->pdev, 0);
+                softing_set_reset_dpram(card);
+                if (card->pdat->reset)
+                        card->pdat->reset(card->pdev, 1);
+        }
+        mutex_unlock(&card->fw.lock);
+}
+
+static __devinit int softing_card_boot(struct softing *card)
+{
+        int ret, j;
+        static const uint8_t stream[] = {
+                0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, };
+        unsigned char back[sizeof(stream)];
+
+        if (mutex_lock_interruptible(&card->fw.lock))
+                return -ERESTARTSYS;
+        if (card->fw.up) {
+                mutex_unlock(&card->fw.lock);
+                return 0;
+        }
+        /* reset board */
+        if (card->pdat->enable_irq)
+                card->pdat->enable_irq(card->pdev, 1);
+        /* boot card */
+        softing_set_reset_dpram(card);
+        if (card->pdat->reset)
+                card->pdat->reset(card->pdev, 1);
+        for (j = 0; (j + sizeof(stream)) < card->dpram_size;
+                        j += sizeof(stream)) {
+
+                memcpy_toio(&card->dpram[j], stream, sizeof(stream));
+                /* flush IO cache */
+                mb();
+                memcpy_fromio(back, &card->dpram[j], sizeof(stream));
+
+                if (!memcmp(back, stream, sizeof(stream)))
+                        continue;
+                /* memory is not equal */
+                dev_alert(&card->pdev->dev, "dpram failed at 0x%04x\n", j);
+                ret = -EIO;
+                goto failed;
+        }
+        wmb();
+        /* load boot firmware */
+        ret = softing_load_fw(card->pdat->boot.fw, card, card->dpram,
+                                card->dpram_size,
+                                card->pdat->boot.offs - card->pdat->boot.addr);
+        if (ret < 0)
+                goto failed;
+        /* load loader firmware */
+        ret = softing_load_fw(card->pdat->load.fw, card, card->dpram,
+                                card->dpram_size,
+                                card->pdat->load.offs - card->pdat->load.addr);
+        if (ret < 0)
+                goto failed;
+
+        if (card->pdat->reset)
+                card->pdat->reset(card->pdev, 0);
+        softing_clr_reset_dpram(card);
+        ret = softing_bootloader_command(card, 0, "card boot");
+        if (ret < 0)
+                goto failed;
+        ret = softing_load_app_fw(card->pdat->app.fw, card);
+        if (ret < 0)
+                goto failed;
+
+        ret = softing_chip_poweron(card);
+        if (ret < 0)
+                goto failed;
+
+        card->fw.up = 1;
+        mutex_unlock(&card->fw.lock);
+        return 0;
+failed:
+        card->fw.up = 0;
+        if (card->pdat->enable_irq)
+                card->pdat->enable_irq(card->pdev, 0);
+        softing_set_reset_dpram(card);
+        if (card->pdat->reset)
+                card->pdat->reset(card->pdev, 1);
+        mutex_unlock(&card->fw.lock);
+        return ret;
+}
+
+/*
+ * netdev sysfs
+ */
+static ssize_t show_channel(struct device *dev, struct device_attribute *attr,
+                char *buf)
+{
+        struct net_device *ndev = to_net_dev(dev);
+        struct softing_priv *priv = netdev2softing(ndev);
+
+        return sprintf(buf, "%i\n", priv->index);
+}
+
+static ssize_t show_chip(struct device *dev, struct device_attribute *attr,
+                char *buf)
+{
+        struct net_device *ndev = to_net_dev(dev);
+        struct softing_priv *priv = netdev2softing(ndev);
+
+        return sprintf(buf, "%i\n", priv->chip);
+}
+
+static ssize_t show_output(struct device *dev, struct device_attribute *attr,
+                char *buf)
+{
+        struct net_device *ndev = to_net_dev(dev);
+        struct softing_priv *priv = netdev2softing(ndev);
+
+        return sprintf(buf, "0x%02x\n", priv->output);
+}
+
+static ssize_t store_output(struct device *dev, struct device_attribute *attr,
+                const char *buf, size_t count)
+{
+        struct net_device *ndev = to_net_dev(dev);
+        struct softing_priv *priv = netdev2softing(ndev);
+        struct softing *card = priv->card;
+        unsigned long val;
+        int ret;
+
+        ret = strict_strtoul(buf, 0, &val);
+        if (ret < 0)
+                return ret;
+        val &= 0xFF;
+
+        ret = mutex_lock_interruptible(&card->fw.lock);
+        if (ret)
+                return -ERESTARTSYS;
+        if (netif_running(ndev)) {
+                mutex_unlock(&card->fw.lock);
+                return -EBUSY;
+        }
+        priv->output = val;
+        mutex_unlock(&card->fw.lock);
+        return count;
+}
+
+static const DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
+static const DEVICE_ATTR(chip, S_IRUGO, show_chip, NULL);
+static const DEVICE_ATTR(output, S_IRUGO | S_IWUSR, show_output, store_output);
+
+static const struct attribute *const netdev_sysfs_attrs[] = {
+        &dev_attr_channel.attr,
+        &dev_attr_chip.attr,
+        &dev_attr_output.attr,
+        NULL,
+};
+static const struct attribute_group netdev_sysfs_group = {
+        .name = NULL,
+        .attrs = (struct attribute **)netdev_sysfs_attrs,
+};
+
+static const struct net_device_ops softing_netdev_ops = {
+        .ndo_open = softing_netdev_open,
+        .ndo_stop = softing_netdev_stop,
+        .ndo_start_xmit = softing_netdev_start_xmit,
+};
+
+static const struct can_bittiming_const softing_btr_const = {
+        .tseg1_min = 1,
+        .tseg1_max = 16,
+        .tseg2_min = 1,
+        .tseg2_max = 8,
+        .sjw_max = 4, /* overruled */
+        .brp_min = 1,
+        .brp_max = 32, /* overruled */
+        .brp_inc = 1,
+};
+
+
+static __devinit struct net_device *softing_netdev_create(struct softing *card,
+                uint16_t chip_id)
+{
+        struct net_device *netdev;
+        struct softing_priv *priv;
+
+        netdev = alloc_candev(sizeof(*priv), TX_ECHO_SKB_MAX);
+        if (!netdev) {
+                dev_alert(&card->pdev->dev, "alloc_candev failed\n");
+                return NULL;
+        }
+        priv = netdev_priv(netdev);
+        priv->netdev = netdev;
+        priv->card = card;
+        memcpy(&priv->btr_const, &softing_btr_const, sizeof(priv->btr_const));
+        priv->btr_const.brp_max = card->pdat->max_brp;
+        priv->btr_const.sjw_max = card->pdat->max_sjw;
+        priv->can.bittiming_const = &priv->btr_const;
+        priv->can.clock.freq = 8000000;
+        priv->chip = chip_id;
+        priv->output = softing_default_output(netdev);
+        SET_NETDEV_DEV(netdev, &card->pdev->dev);
+
+        netdev->flags |= IFF_ECHO;
+        netdev->netdev_ops = &softing_netdev_ops;
+        priv->can.do_set_mode = softing_candev_set_mode;
+        priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES;
+
+        return netdev;
+}
+
+static __devinit int softing_netdev_register(struct net_device *netdev)
+{
+        int ret;
+
+        netdev->sysfs_groups[0] = &netdev_sysfs_group;
+        ret = register_candev(netdev);
+        if (ret) {
+                dev_alert(&netdev->dev, "register failed\n");
+                return ret;
+        }
+        return 0;
+}
+
+static void softing_netdev_cleanup(struct net_device *netdev)
+{
+        unregister_candev(netdev);
+        free_candev(netdev);
+}
+
+/*
+ * sysfs for Platform device
+ */
+#define DEV_ATTR_RO(name, member) \
+static ssize_t show_##name(struct device *dev, \
+                struct device_attribute *attr, char *buf) \
+{ \
+        struct softing *card = platform_get_drvdata(to_platform_device(dev)); \
+        return sprintf(buf, "%u\n", card->member); \
+} \
+static DEVICE_ATTR(name, 0444, show_##name, NULL)
+
+#define DEV_ATTR_RO_STR(name, member) \
+static ssize_t show_##name(struct device *dev, \
+                struct device_attribute *attr, char *buf) \
+{ \
+        struct softing *card = platform_get_drvdata(to_platform_device(dev)); \
+        return sprintf(buf, "%s\n", card->member); \
+} \
+static DEVICE_ATTR(name, 0444, show_##name, NULL)
+
+DEV_ATTR_RO(serial, id.serial);
+DEV_ATTR_RO_STR(firmware, pdat->app.fw);
+DEV_ATTR_RO(firmware_version, id.fw_version);
+DEV_ATTR_RO_STR(hardware, pdat->name);
+DEV_ATTR_RO(hardware_version, id.hw_version);
+DEV_ATTR_RO(license, id.license);
+DEV_ATTR_RO(frequency, id.freq);
+DEV_ATTR_RO(txpending, tx.pending);
+
+static struct attribute *softing_pdev_attrs[] = {
+        &dev_attr_serial.attr,
+        &dev_attr_firmware.attr,
+        &dev_attr_firmware_version.attr,
+        &dev_attr_hardware.attr,
+        &dev_attr_hardware_version.attr,
+        &dev_attr_license.attr,
+        &dev_attr_frequency.attr,
+        &dev_attr_txpending.attr,
+        NULL,
+};
+
+static const struct attribute_group softing_pdev_group = {
+        .name = NULL,
+        .attrs = softing_pdev_attrs,
+};
+
+/*
+ * platform driver
+ */
+static __devexit int softing_pdev_remove(struct platform_device *pdev)
+{
+        struct softing *card = platform_get_drvdata(pdev);
+        int j;
+
+        /* first, disable card*/
+        softing_card_shutdown(card);
+
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                if (!card->net[j])
+                        continue;
+                softing_netdev_cleanup(card->net[j]);
+                card->net[j] = NULL;
+        }
+        sysfs_remove_group(&pdev->dev.kobj, &softing_pdev_group);
+
+        iounmap(card->dpram);
+        kfree(card);
+        return 0;
+}
+
+static __devinit int softing_pdev_probe(struct platform_device *pdev)
+{
+        const struct softing_platform_data *pdat = pdev->dev.platform_data;
+        struct softing *card;
+        struct net_device *netdev;
+        struct softing_priv *priv;
+        struct resource *pres;
+        int ret;
+        int j;
+
+        if (!pdat) {
+                dev_warn(&pdev->dev, "no platform data\n");
+                return -EINVAL;
+        }
+        if (pdat->nbus > ARRAY_SIZE(card->net)) {
+                dev_warn(&pdev->dev, "%u nets??\n", pdat->nbus);
+                return -EINVAL;
+        }
+
+        card = kzalloc(sizeof(*card), GFP_KERNEL);
+        if (!card)
+                return -ENOMEM;
+        card->pdat = pdat;
+        card->pdev = pdev;
+        platform_set_drvdata(pdev, card);
+        mutex_init(&card->fw.lock);
+        spin_lock_init(&card->spin);
+
+        ret = -EINVAL;
+        pres = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!pres)
+                goto platform_resource_failed;;
+        card->dpram_phys = pres->start;
+        card->dpram_size = pres->end - pres->start + 1;
+        card->dpram = ioremap_nocache(card->dpram_phys, card->dpram_size);
+        if (!card->dpram) {
+                dev_alert(&card->pdev->dev, "dpram ioremap failed\n");
+                goto ioremap_failed;
+        }
+
+        pres = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (pres)
+                card->irq.nr = pres->start;
+
+        /* reset card */
+        ret = softing_card_boot(card);
+        if (ret < 0) {
+                dev_alert(&pdev->dev, "failed to boot\n");
+                goto boot_failed;
+        }
+
+        /* only now, the chip's are known */
+        card->id.freq = card->pdat->freq;
+
+        ret = sysfs_create_group(&pdev->dev.kobj, &softing_pdev_group);
+        if (ret < 0) {
+                dev_alert(&card->pdev->dev, "sysfs failed\n");
+                goto sysfs_failed;
+        }
+
+        ret = -ENOMEM;
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                card->net[j] = netdev =
+                        softing_netdev_create(card, card->id.chip[j]);
+                if (!netdev) {
+                        dev_alert(&pdev->dev, "failed to make can[%i]", j);
+                        goto netdev_failed;
+                }
+                priv = netdev_priv(card->net[j]);
+                priv->index = j;
+                ret = softing_netdev_register(netdev);
+                if (ret) {
+                        free_candev(netdev);
+                        card->net[j] = NULL;
+                        dev_alert(&card->pdev->dev,
+                                        "failed to register can[%i]\n", j);
+                        goto netdev_failed;
+                }
+        }
+        dev_info(&card->pdev->dev, "%s ready.\n", card->pdat->name);
+        return 0;
+
+netdev_failed:
+        for (j = 0; j < ARRAY_SIZE(card->net); ++j) {
+                if (!card->net[j])
+                        continue;
+                softing_netdev_cleanup(card->net[j]);
+        }
+        sysfs_remove_group(&pdev->dev.kobj, &softing_pdev_group);
+sysfs_failed:
+        softing_card_shutdown(card);
+boot_failed:
+        iounmap(card->dpram);
+ioremap_failed:
+platform_resource_failed:
+        kfree(card);
+        return ret;
+}
+
+static struct platform_driver softing_driver = {
+        .driver = {
+                .name = "softing",
+                .owner = THIS_MODULE,
+        },
+        .probe = softing_pdev_probe,
+        .remove = __devexit_p(softing_pdev_remove),
+};
+
+MODULE_ALIAS("platform:softing");
+
+static int __init softing_start(void)
+{
+        return platform_driver_register(&softing_driver);
+}
+
+static void __exit softing_stop(void)
+{
+        platform_driver_unregister(&softing_driver);
+}
+
+module_init(softing_start);
+module_exit(softing_stop);
+
+MODULE_DESCRIPTION("Softing DPRAM CAN driver");
+MODULE_AUTHOR("Kurt Van Dijck <kurt.van.dijck@eia.be>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/net/can/softing/softing_platform.h b/drivers/net/can/softing/softing_platform.h
new file mode 100644
index 000000000000..ebbf69815623
--- /dev/null
+++ b/drivers/net/can/softing/softing_platform.h
@@ -0,0 +1,40 @@
+
+#include <linux/platform_device.h>
+
+#ifndef _SOFTING_DEVICE_H_
+#define _SOFTING_DEVICE_H_
+
+/* softing firmware directory prefix */
+#define fw_dir "softing-4.6/"
+
+struct softing_platform_data {
+        unsigned int manf;
+        unsigned int prod;
+        /*
+         * generation
+         * 1st with NEC or SJA1000
+         * 8bit, exclusive interrupt, ...
+         * 2nd only SJA1000
+         * 16bit, shared interrupt
+         */
+        int generation;
+        int nbus; /* # busses on device */
+        unsigned int freq; /* operating frequency in Hz */
+        unsigned int max_brp;
+        unsigned int max_sjw;
+        unsigned long dpram_size;
+        const char *name;
+        struct {
+                unsigned long offs;
+                unsigned long addr;
+                const char *fw;
+        } boot, load, app;
+        /*
+         * reset() function
+         * bring pdev in or out of reset, depending on value
+         */
+        int (*reset)(struct platform_device *pdev, int value);
+        int (*enable_irq)(struct platform_device *pdev, int value);
+};
+
+#endif
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 263a2944566f..7ff170cbc7dc 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -699,13 +699,13 @@ static void cnic_free_dma(struct cnic_dev *dev, struct cnic_dma *dma)
 static void cnic_setup_page_tbl(struct cnic_dev *dev, struct cnic_dma *dma)
 {
         int i;
-        u32 *page_table = dma->pgtbl;
+        __le32 *page_table = (__le32 *) dma->pgtbl;
 
         for (i = 0; i < dma->num_pages; i++) {
                 /* Each entry needs to be in big endian format. */
-                *page_table = (u32) ((u64) dma->pg_map_arr[i] >> 32);
+                *page_table = cpu_to_le32((u64) dma->pg_map_arr[i] >> 32);
                 page_table++;
-                *page_table = (u32) dma->pg_map_arr[i];
+                *page_table = cpu_to_le32(dma->pg_map_arr[i] & 0xffffffff);
                 page_table++;
         }
 }
@@ -713,13 +713,13 @@ static void cnic_setup_page_tbl(struct cnic_dev *dev, struct cnic_dma *dma)
 static void cnic_setup_page_tbl_le(struct cnic_dev *dev, struct cnic_dma *dma)
 {
         int i;
-        u32 *page_table = dma->pgtbl;
+        __le32 *page_table = (__le32 *) dma->pgtbl;
 
         for (i = 0; i < dma->num_pages; i++) {
                 /* Each entry needs to be in little endian format. */
-                *page_table = dma->pg_map_arr[i] & 0xffffffff;
+                *page_table = cpu_to_le32(dma->pg_map_arr[i] & 0xffffffff);
                 page_table++;
-                *page_table = (u32) ((u64) dma->pg_map_arr[i] >> 32);
+                *page_table = cpu_to_le32((u64) dma->pg_map_arr[i] >> 32);
                 page_table++;
         }
 }
diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
index 059c1eec8c3f..ec35d458102c 100644
--- a/drivers/net/cxgb4/cxgb4_main.c
+++ b/drivers/net/cxgb4/cxgb4_main.c
@@ -2710,6 +2710,8 @@ static int cxgb_open(struct net_device *dev)
         struct port_info *pi = netdev_priv(dev);
         struct adapter *adapter = pi->adapter;
 
+        netif_carrier_off(dev);
+
         if (!(adapter->flags & FULL_INIT_DONE)) {
                 err = cxgb_up(adapter);
                 if (err < 0)
@@ -3661,7 +3663,6 @@ static int __devinit init_one(struct pci_dev *pdev,
                 pi->xact_addr_filt = -1;
                 pi->rx_offload = RX_CSO;
                 pi->port_id = i;
-                netif_carrier_off(netdev);
                 netdev->irq = pdev->irq;
 
                 netdev->features |= NETIF_F_SG | TSO_FLAGS;
diff --git a/drivers/net/depca.c b/drivers/net/depca.c
index 1b48b68ad4fd..8b0084d17c8c 100644
--- a/drivers/net/depca.c
+++ b/drivers/net/depca.c
@@ -1094,7 +1094,7 @@ static int depca_rx(struct net_device *dev)
                                 }
                         }
                         /* Change buffer ownership for this last frame, back to the adapter */
-                        for (; lp->rx_old != entry; lp->rx_old = (++lp->rx_old) & lp->rxRingMask) {
+                        for (; lp->rx_old != entry; lp->rx_old = (lp->rx_old + 1) & lp->rxRingMask) {
                                 writel(readl(&lp->rx_ring[lp->rx_old].base) | R_OWN, &lp->rx_ring[lp->rx_old].base);
                         }
                         writel(readl(&lp->rx_ring[entry].base) | R_OWN, &lp->rx_ring[entry].base);
@@ -1103,7 +1103,7 @@ static int depca_rx(struct net_device *dev)
                 /*
                    ** Update entry information
                  */
-                lp->rx_new = (++lp->rx_new) & lp->rxRingMask;
+                lp->rx_new = (lp->rx_new + 1) & lp->rxRingMask;
         }
 
         return 0;
@@ -1148,7 +1148,7 @@ static int depca_tx(struct net_device *dev)
                 }
 
                 /* Update all the pointers */
-                lp->tx_old = (++lp->tx_old) & lp->txRingMask;
+                lp->tx_old = (lp->tx_old + 1) & lp->txRingMask;
         }
 
         return 0;
diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
index e1a8216ff692..c05db6046050 100644
--- a/drivers/net/dl2k.c
+++ b/drivers/net/dl2k.c
@@ -1753,8 +1753,6 @@ rio_close (struct net_device *dev)
 
         /* Free all the skbuffs in the queue. */
         for (i = 0; i < RX_RING_SIZE; i++) {
-                np->rx_ring[i].status = 0;
-                np->rx_ring[i].fraginfo = 0;
                 skb = np->rx_skbuff[i];
                 if (skb) {
                         pci_unmap_single(np->pdev,
@@ -1763,6 +1761,8 @@ rio_close (struct net_device *dev)
                         dev_kfree_skb (skb);
                         np->rx_skbuff[i] = NULL;
                 }
+                np->rx_ring[i].status = 0;
+                np->rx_ring[i].fraginfo = 0;
         }
         for (i = 0; i < TX_RING_SIZE; i++) {
                 skb = np->tx_skbuff[i];
diff --git a/drivers/net/enc28j60.c b/drivers/net/enc28j60.c
index 112c5aa9af7f..907b05a1c659 100644
--- a/drivers/net/enc28j60.c
+++ b/drivers/net/enc28j60.c
@@ -812,7 +812,7 @@ static void enc28j60_read_tsv(struct enc28j60_net *priv, u8 tsv[TSV_SIZE])
         if (netif_msg_hw(priv))
                 printk(KERN_DEBUG DRV_NAME ": reading TSV at addr:0x%04x\n",
                          endptr + 1);
-        enc28j60_mem_read(priv, endptr + 1, sizeof(tsv), tsv);
+        enc28j60_mem_read(priv, endptr + 1, TSV_SIZE, tsv);
 }
 
 static void enc28j60_dump_tsv(struct enc28j60_net *priv, const char *msg,
diff --git a/drivers/net/mlx4/main.c b/drivers/net/mlx4/main.c
index 4ffdc18fcb8a..2765a3ce9c24 100644
--- a/drivers/net/mlx4/main.c
+++ b/drivers/net/mlx4/main.c
@@ -1286,6 +1286,21 @@ static DEFINE_PCI_DEVICE_TABLE(mlx4_pci_table) = {
         { PCI_VDEVICE(MELLANOX, 0x6764) }, /* MT26468 ConnectX EN 10GigE PCIe gen2*/
         { PCI_VDEVICE(MELLANOX, 0x6746) }, /* MT26438 ConnectX EN 40GigE PCIe gen2 5GT/s */
         { PCI_VDEVICE(MELLANOX, 0x676e) }, /* MT26478 ConnectX2 40GigE PCIe gen2 */
+        { PCI_VDEVICE(MELLANOX, 0x1002) }, /* MT25400 Family [ConnectX-2 Virtual Function] */
+        { PCI_VDEVICE(MELLANOX, 0x1003) }, /* MT27500 Family [ConnectX-3] */
+        { PCI_VDEVICE(MELLANOX, 0x1004) }, /* MT27500 Family [ConnectX-3 Virtual Function] */
+        { PCI_VDEVICE(MELLANOX, 0x1005) }, /* MT27510 Family */
+        { PCI_VDEVICE(MELLANOX, 0x1006) }, /* MT27511 Family */
+        { PCI_VDEVICE(MELLANOX, 0x1007) }, /* MT27520 Family */
+        { PCI_VDEVICE(MELLANOX, 0x1008) }, /* MT27521 Family */
+        { PCI_VDEVICE(MELLANOX, 0x1009) }, /* MT27530 Family */
+        { PCI_VDEVICE(MELLANOX, 0x100a) }, /* MT27531 Family */
+        { PCI_VDEVICE(MELLANOX, 0x100b) }, /* MT27540 Family */
+        { PCI_VDEVICE(MELLANOX, 0x100c) }, /* MT27541 Family */
+        { PCI_VDEVICE(MELLANOX, 0x100d) }, /* MT27550 Family */
+        { PCI_VDEVICE(MELLANOX, 0x100e) }, /* MT27551 Family */
+        { PCI_VDEVICE(MELLANOX, 0x100f) }, /* MT27560 Family */
+        { PCI_VDEVICE(MELLANOX, 0x1010) }, /* MT27561 Family */
         { 0, }
 };
 
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index 2541321bad82..9fb59d3f9c92 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -4489,6 +4489,9 @@ static int niu_alloc_channels(struct niu *np)
 {
         struct niu_parent *parent = np->parent;
         int first_rx_channel, first_tx_channel;
+        int num_rx_rings, num_tx_rings;
+        struct rx_ring_info *rx_rings;
+        struct tx_ring_info *tx_rings;
         int i, port, err;
 
         port = np->port;
@@ -4498,18 +4501,21 @@ static int niu_alloc_channels(struct niu *np)
                 first_tx_channel += parent->txchan_per_port[i];
         }
 
-        np->num_rx_rings = parent->rxchan_per_port[port];
-        np->num_tx_rings = parent->txchan_per_port[port];
+        num_rx_rings = parent->rxchan_per_port[port];
+        num_tx_rings = parent->txchan_per_port[port];
 
-        netif_set_real_num_rx_queues(np->dev, np->num_rx_rings);
-        netif_set_real_num_tx_queues(np->dev, np->num_tx_rings);
-
-        np->rx_rings = kcalloc(np->num_rx_rings, sizeof(struct rx_ring_info),
-                               GFP_KERNEL);
+        rx_rings = kcalloc(num_rx_rings, sizeof(struct rx_ring_info),
+                           GFP_KERNEL);
         err = -ENOMEM;
-        if (!np->rx_rings)
+        if (!rx_rings)
                 goto out_err;
 
+        np->num_rx_rings = num_rx_rings;
+        smp_wmb();
+        np->rx_rings = rx_rings;
+
+        netif_set_real_num_rx_queues(np->dev, num_rx_rings);
+
         for (i = 0; i < np->num_rx_rings; i++) {
                 struct rx_ring_info *rp = &np->rx_rings[i];
 
@@ -4538,12 +4544,18 @@ static int niu_alloc_channels(struct niu *np)
                         return err;
         }
 
-        np->tx_rings = kcalloc(np->num_tx_rings, sizeof(struct tx_ring_info),
-                               GFP_KERNEL);
+        tx_rings = kcalloc(num_tx_rings, sizeof(struct tx_ring_info),
+                           GFP_KERNEL);
         err = -ENOMEM;
-        if (!np->tx_rings)
+        if (!tx_rings)
                 goto out_err;
 
+        np->num_tx_rings = num_tx_rings;
+        smp_wmb();
+        np->tx_rings = tx_rings;
+
+        netif_set_real_num_tx_queues(np->dev, num_tx_rings);
+
         for (i = 0; i < np->num_tx_rings; i++) {
                 struct tx_ring_info *rp = &np->tx_rings[i];
 
@@ -6246,11 +6258,17 @@ static void niu_sync_mac_stats(struct niu *np)
 static void niu_get_rx_stats(struct niu *np)
 {
         unsigned long pkts, dropped, errors, bytes;
+        struct rx_ring_info *rx_rings;
         int i;
 
         pkts = dropped = errors = bytes = 0;
+
+        rx_rings = ACCESS_ONCE(np->rx_rings);
+        if (!rx_rings)
+                goto no_rings;
+
         for (i = 0; i < np->num_rx_rings; i++) {
-                struct rx_ring_info *rp = &np->rx_rings[i];
+                struct rx_ring_info *rp = &rx_rings[i];
 
                 niu_sync_rx_discard_stats(np, rp, 0);
 
@@ -6259,6 +6277,8 @@ static void niu_get_rx_stats(struct niu *np)
                 dropped += rp->rx_dropped;
                 errors += rp->rx_errors;
         }
+
+no_rings:
         np->dev->stats.rx_packets = pkts;
         np->dev->stats.rx_bytes = bytes;
         np->dev->stats.rx_dropped = dropped;
@@ -6268,16 +6288,24 @@ static void niu_get_rx_stats(struct niu *np)
 static void niu_get_tx_stats(struct niu *np)
 {
         unsigned long pkts, errors, bytes;
+        struct tx_ring_info *tx_rings;
         int i;
 
         pkts = errors = bytes = 0;
+
+        tx_rings = ACCESS_ONCE(np->tx_rings);
+        if (!tx_rings)
+                goto no_rings;
+
         for (i = 0; i < np->num_tx_rings; i++) {
-                struct tx_ring_info *rp = &np->tx_rings[i];
+                struct tx_ring_info *rp = &tx_rings[i];
 
                 pkts += rp->tx_packets;
                 bytes += rp->tx_bytes;
                 errors += rp->tx_errors;
         }
+
+no_rings:
         np->dev->stats.tx_packets = pkts;
         np->dev->stats.tx_bytes = bytes;
         np->dev->stats.tx_errors = errors;
@@ -6287,9 +6315,10 @@ static struct net_device_stats *niu_get_stats(struct net_device *dev)
 {
         struct niu *np = netdev_priv(dev);
 
-        niu_get_rx_stats(np);
-        niu_get_tx_stats(np);
-
+        if (netif_running(dev)) {
+                niu_get_rx_stats(np);
+                niu_get_tx_stats(np);
+        }
         return &dev->stats;
 }
 
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index d7355306a738..1bf12339441b 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -2247,7 +2247,7 @@ static void pch_gbe_remove(struct pci_dev *pdev)
         struct net_device *netdev = pci_get_drvdata(pdev);
         struct pch_gbe_adapter *adapter = netdev_priv(netdev);
 
-        flush_scheduled_work();
+        cancel_work_sync(&adapter->reset_task);
         unregister_netdev(netdev);
 
         pch_gbe_hal_phy_hw_reset(&adapter->hw);
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index 1f42f6ac8551..d3cb77205863 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -1488,12 +1488,10 @@ static void ei_rx_overrun(struct net_device *dev)
     
         /* 
          * Wait a full Tx time (1.2ms) + some guard time, NS says 1.6ms total.
-         * Early datasheets said to poll the reset bit, but now they say that
-         * it "is not a reliable indicator and subsequently should be ignored."
-         * We wait at least 10ms.
+         * We wait at least 2ms.
          */
 
-        mdelay(10);
+        mdelay(2);
 
         /*
          * Reset RBCR[01] back to zero as per magic incantation.
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index bde7d61f1930..59ccf0c5c610 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -973,7 +973,8 @@ static void __rtl8169_check_link_status(struct net_device *dev,
                 if (pm)
                         pm_request_resume(&tp->pci_dev->dev);
                 netif_carrier_on(dev);
-                netif_info(tp, ifup, dev, "link up\n");
+                if (net_ratelimit())
+                        netif_info(tp, ifup, dev, "link up\n");
         } else {
                 netif_carrier_off(dev);
                 netif_info(tp, ifdown, dev, "link down\n");
@@ -3757,7 +3758,8 @@ static void rtl_hw_start_8168(struct net_device *dev)
         RTL_W16(IntrMitigate, 0x5151);
 
         /* Work around for RxFIFO overflow. */
-        if (tp->mac_version == RTL_GIGA_MAC_VER_11) {
+        if (tp->mac_version == RTL_GIGA_MAC_VER_11 ||
+            tp->mac_version == RTL_GIGA_MAC_VER_22) {
                 tp->intr_event |= RxFIFOOver | PCSTimeout;
                 tp->intr_event &= ~RxOverflow;
         }
@@ -4639,12 +4641,33 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
                         break;
                 }
 
-                /* Work around for rx fifo overflow */
-                if (unlikely(status & RxFIFOOver) &&
-                (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
-                        netif_stop_queue(dev);
-                        rtl8169_tx_timeout(dev);
-                        break;
+                if (unlikely(status & RxFIFOOver)) {
+                        switch (tp->mac_version) {
+                        /* Work around for rx fifo overflow */
+                        case RTL_GIGA_MAC_VER_11:
+                        case RTL_GIGA_MAC_VER_22:
+                        case RTL_GIGA_MAC_VER_26:
+                                netif_stop_queue(dev);
+                                rtl8169_tx_timeout(dev);
+                                goto done;
+                        /* Testers needed. */
+                        case RTL_GIGA_MAC_VER_17:
+                        case RTL_GIGA_MAC_VER_19:
+                        case RTL_GIGA_MAC_VER_20:
+                        case RTL_GIGA_MAC_VER_21:
+                        case RTL_GIGA_MAC_VER_23:
+                        case RTL_GIGA_MAC_VER_24:
+                        case RTL_GIGA_MAC_VER_27:
+                        case RTL_GIGA_MAC_VER_28:
+                        /* Experimental science. Pktgen proof. */
+                        case RTL_GIGA_MAC_VER_12:
+                        case RTL_GIGA_MAC_VER_25:
+                                if (status == RxFIFOOver)
+                                        goto done;
+                                break;
+                        default:
+                                break;
+                        }
                 }
 
                 if (unlikely(status & SYSErr)) {
@@ -4680,7 +4703,7 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
                         (status & RxFIFOOver) ? (status | RxOverflow) : status);
                 status = RTL_R16(IntrStatus);
         }
-
+done:
         return IRQ_RETVAL(handled);
 }
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 7841a8f69998..93b32d366611 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -60,12 +60,6 @@
 #define BAR_0   0
 #define BAR_2   2
 
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
-#define TG3_VLAN_TAG_USED 1
-#else
-#define TG3_VLAN_TAG_USED 0
-#endif
-
 #include "tg3.h"
 
 #define DRV_MODULE_NAME         "tg3"
@@ -134,9 +128,6 @@
                                  TG3_TX_RING_SIZE)
 #define NEXT_TX(N)              (((N) + 1) & (TG3_TX_RING_SIZE - 1))
 
-#define TG3_RX_DMA_ALIGN                16
-#define TG3_RX_HEADROOM                 ALIGN(VLAN_HLEN, TG3_RX_DMA_ALIGN)
-
 #define TG3_DMA_BYTE_ENAB               64
 
 #define TG3_RX_STD_DMA_SZ               1536
@@ -4722,8 +4713,6 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                 struct sk_buff *skb;
                 dma_addr_t dma_addr;
                 u32 opaque_key, desc_idx, *post_ptr;
-                bool hw_vlan __maybe_unused = false;
-                u16 vtag __maybe_unused = 0;
 
                 desc_idx = desc->opaque & RXD_OPAQUE_INDEX_MASK;
                 opaque_key = desc->opaque & RXD_OPAQUE_RING_MASK;
@@ -4782,12 +4771,12 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                         tg3_recycle_rx(tnapi, tpr, opaque_key,
                                        desc_idx, *post_ptr);
 
-                        copy_skb = netdev_alloc_skb(tp->dev, len + VLAN_HLEN +
+                        copy_skb = netdev_alloc_skb(tp->dev, len +
                                                     TG3_RAW_IP_ALIGN);
                         if (copy_skb == NULL)
                                 goto drop_it_no_recycle;
 
-                        skb_reserve(copy_skb, TG3_RAW_IP_ALIGN + VLAN_HLEN);
+                        skb_reserve(copy_skb, TG3_RAW_IP_ALIGN);
                         skb_put(copy_skb, len);
                         pci_dma_sync_single_for_cpu(tp->pdev, dma_addr, len, PCI_DMA_FROMDEVICE);
                         skb_copy_from_linear_data(skb, copy_skb->data, len);
@@ -4814,30 +4803,11 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                 }
 
                 if (desc->type_flags & RXD_FLAG_VLAN &&
-                    !(tp->rx_mode & RX_MODE_KEEP_VLAN_TAG)) {
-                        vtag = desc->err_vlan & RXD_VLAN_MASK;
-#if TG3_VLAN_TAG_USED
-                        if (tp->vlgrp)
-                                hw_vlan = true;
-                        else
-#endif
-                        {
-                                struct vlan_ethhdr *ve = (struct vlan_ethhdr *)
-                                                    __skb_push(skb, VLAN_HLEN);
-
-                                memmove(ve, skb->data + VLAN_HLEN,
-                                        ETH_ALEN * 2);
-                                ve->h_vlan_proto = htons(ETH_P_8021Q);
-                                ve->h_vlan_TCI = htons(vtag);
-                        }
-                }
+                    !(tp->rx_mode & RX_MODE_KEEP_VLAN_TAG))
+                        __vlan_hwaccel_put_tag(skb,
+                                               desc->err_vlan & RXD_VLAN_MASK);
 
-#if TG3_VLAN_TAG_USED
-                if (hw_vlan)
-                        vlan_gro_receive(&tnapi->napi, tp->vlgrp, vtag, skb);
-                else
-#endif
-                        napi_gro_receive(&tnapi->napi, skb);
+                napi_gro_receive(&tnapi->napi, skb);
 
                 received++;
                 budget--;
@@ -5740,11 +5710,9 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb,
                 base_flags |= TXD_FLAG_TCPUDP_CSUM;
         }
 
-#if TG3_VLAN_TAG_USED
         if (vlan_tx_tag_present(skb))
                 base_flags |= (TXD_FLAG_VLAN |
                                (vlan_tx_tag_get(skb) << 16));
-#endif
 
         len = skb_headlen(skb);
 
@@ -5986,11 +5954,10 @@ static netdev_tx_t tg3_start_xmit_dma_bug(struct sk_buff *skb,
                         }
                 }
         }
-#if TG3_VLAN_TAG_USED
+
         if (vlan_tx_tag_present(skb))
                 base_flags |= (TXD_FLAG_VLAN |
                                (vlan_tx_tag_get(skb) << 16));
-#endif
 
         if ((tp->tg3_flags3 & TG3_FLG3_USE_JUMBO_BDFLAG) &&
             !mss && skb->len > VLAN_ETH_FRAME_LEN)
@@ -9532,17 +9499,10 @@ static void __tg3_set_rx_mode(struct net_device *dev)
         rx_mode = tp->rx_mode & ~(RX_MODE_PROMISC |
                                   RX_MODE_KEEP_VLAN_TAG);
 
+#if !defined(CONFIG_VLAN_8021Q) && !defined(CONFIG_VLAN_8021Q_MODULE)
         /* When ASF is in use, we always keep the RX_MODE_KEEP_VLAN_TAG
          * flag clear.
          */
-#if TG3_VLAN_TAG_USED
-        if (!tp->vlgrp &&
-            !(tp->tg3_flags & TG3_FLAG_ENABLE_ASF))
-                rx_mode |= RX_MODE_KEEP_VLAN_TAG;
-#else
-        /* By definition, VLAN is disabled always in this
-         * case.
-         */
         if (!(tp->tg3_flags & TG3_FLAG_ENABLE_ASF))
                 rx_mode |= RX_MODE_KEEP_VLAN_TAG;
 #endif
@@ -11230,31 +11190,6 @@ static int tg3_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         return -EOPNOTSUPP;
 }
 
-#if TG3_VLAN_TAG_USED
-static void tg3_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
-{
-        struct tg3 *tp = netdev_priv(dev);
-
-        if (!netif_running(dev)) {
-                tp->vlgrp = grp;
-                return;
-        }
-
-        tg3_netif_stop(tp);
-
-        tg3_full_lock(tp, 0);
-
-        tp->vlgrp = grp;
-
-        /* Update RX_MODE_KEEP_VLAN_TAG bit in RX_MODE register. */
-        __tg3_set_rx_mode(dev);
-
-        tg3_netif_start(tp);
-
-        tg3_full_unlock(tp);
-}
-#endif
-
 static int tg3_get_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
 {
         struct tg3 *tp = netdev_priv(dev);
@@ -13066,9 +13001,7 @@ static struct pci_dev * __devinit tg3_find_peer(struct tg3 *);
 
 static void inline vlan_features_add(struct net_device *dev, unsigned long flags)
 {
-#if TG3_VLAN_TAG_USED
         dev->vlan_features |= flags;
-#endif
 }
 
 static inline u32 tg3_rx_ret_ring_size(struct tg3 *tp)
@@ -13861,11 +13794,11 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         else
                 tp->tg3_flags &= ~TG3_FLAG_POLL_SERDES;
 
-        tp->rx_offset = NET_IP_ALIGN + TG3_RX_HEADROOM;
+        tp->rx_offset = NET_IP_ALIGN;
         tp->rx_copy_thresh = TG3_RX_COPY_THRESHOLD;
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701 &&
             (tp->tg3_flags & TG3_FLAG_PCIX_MODE) != 0) {
-                tp->rx_offset -= NET_IP_ALIGN;
+                tp->rx_offset = 0;
 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
                 tp->rx_copy_thresh = ~(u16)0;
 #endif
@@ -14629,9 +14562,6 @@ static const struct net_device_ops tg3_netdev_ops = {
         .ndo_do_ioctl           = tg3_ioctl,
         .ndo_tx_timeout         = tg3_tx_timeout,
         .ndo_change_mtu         = tg3_change_mtu,
-#if TG3_VLAN_TAG_USED
-        .ndo_vlan_rx_register   = tg3_vlan_rx_register,
-#endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = tg3_poll_controller,
 #endif
@@ -14648,9 +14578,6 @@ static const struct net_device_ops tg3_netdev_ops_dma_bug = {
         .ndo_do_ioctl           = tg3_ioctl,
         .ndo_tx_timeout         = tg3_tx_timeout,
         .ndo_change_mtu         = tg3_change_mtu,
-#if TG3_VLAN_TAG_USED
-        .ndo_vlan_rx_register   = tg3_vlan_rx_register,
-#endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = tg3_poll_controller,
 #endif
@@ -14700,9 +14627,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
 
         SET_NETDEV_DEV(dev, &pdev->dev);
 
-#if TG3_VLAN_TAG_USED
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
-#endif
 
         tp = netdev_priv(dev);
         tp->pdev = pdev;
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index d62c8d937c82..f528243e1a4f 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2808,9 +2808,6 @@ struct tg3 {
         u32                             rx_std_max_post;
         u32                             rx_offset;
         u32                             rx_pkt_map_sz;
-#if TG3_VLAN_TAG_USED
-        struct vlan_group               *vlgrp;
-#endif
 
 
         /* begin "everything else" cacheline(s) section */
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 5e98643a4a21..7dc84971f26f 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -406,6 +406,7 @@ static int kaweth_download_firmware(struct kaweth_device *kaweth,
 
         if (fw->size > KAWETH_FIRMWARE_BUF_SIZE) {
                 err("Firmware too big: %zu", fw->size);
+                release_firmware(fw);
                 return -ENOSPC;
         }
         data_len = fw->size;
diff --git a/drivers/net/vxge/vxge-config.c b/drivers/net/vxge/vxge-config.c
index 01c05f53e2f9..228d4f7a58af 100644
--- a/drivers/net/vxge/vxge-config.c
+++ b/drivers/net/vxge/vxge-config.c
@@ -3690,7 +3690,7 @@ __vxge_hw_vpath_rts_table_get(struct __vxge_hw_vpath_handle *vp,
         if (status != VXGE_HW_OK)
                 goto exit;
 
-        if ((rts_table != VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_DA) ||
+        if ((rts_table != VXGE_HW_RTS_ACCESS_STEER_CTRL_DATA_STRUCT_SEL_DA) &&
             (rts_table !=
              VXGE_HW_RTS_ACS_STEER_CTRL_DATA_STRUCT_SEL_RTH_MULTI_IT))
                 *data1 = 0;
diff --git a/drivers/net/wireless/ath/ath5k/dma.c b/drivers/net/wireless/ath/ath5k/dma.c
index 0064be7ce5c9..21091c26a9a5 100644
--- a/drivers/net/wireless/ath/ath5k/dma.c
+++ b/drivers/net/wireless/ath/ath5k/dma.c
@@ -838,9 +838,9 @@ int ath5k_hw_dma_stop(struct ath5k_hw *ah)
         for (i = 0; i < qmax; i++) {
                 err = ath5k_hw_stop_tx_dma(ah, i);
                 /* -EINVAL -> queue inactive */
-                if (err != -EINVAL)
+                if (err && err != -EINVAL)
                         return err;
         }
 
-        return err;
+        return 0;
 }
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index e5f2b96a4c63..a702817daf72 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -86,7 +86,7 @@ int ath5k_hw_get_frame_duration(struct ath5k_hw *ah,
         if (!ah->ah_bwmode) {
                 dur = ieee80211_generic_frame_duration(sc->hw,
                                                 NULL, len, rate);
-                return dur;
+                return le16_to_cpu(dur);
         }
 
         bitrate = rate->bitrate;
@@ -265,8 +265,6 @@ static inline void ath5k_hw_write_rate_duration(struct ath5k_hw *ah)
                  * what rate we should choose to TX ACKs. */
                 tx_time = ath5k_hw_get_frame_duration(ah, 10, rate);
 
-                tx_time = le16_to_cpu(tx_time);
-
                 ath5k_hw_reg_write(ah, tx_time, reg);
 
                 if (!(rate->flags & IEEE80211_RATE_SHORT_PREAMBLE))
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index f8a7771faee2..f44c84ab5dce 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -426,9 +426,8 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
                 }
 
                 /* WAR for ASPM system hang */
-                if (AR_SREV_9280(ah) || AR_SREV_9285(ah) || AR_SREV_9287(ah)) {
+                if (AR_SREV_9285(ah) || AR_SREV_9287(ah))
                         val |= (AR_WA_BIT6 | AR_WA_BIT7);
-                }
 
                 if (AR_SREV_9285E_20(ah))
                         val |= AR_WA_BIT23;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 38433f9bfe59..0352f0994caa 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -142,9 +142,6 @@ static void ath9k_deinit_priv(struct ath9k_htc_priv *priv)
 {
         ath9k_htc_exit_debug(priv->ah);
         ath9k_hw_deinit(priv->ah);
-        tasklet_kill(&priv->swba_tasklet);
-        tasklet_kill(&priv->rx_tasklet);
-        tasklet_kill(&priv->tx_tasklet);
         kfree(priv->ah);
         priv->ah = NULL;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index f4d576bc3ccd..6bb59958f71e 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1025,12 +1025,6 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
         int ret = 0;
         u8 cmd_rsp;
 
-        /* Cancel all the running timers/work .. */
-        cancel_work_sync(&priv->fatal_work);
-        cancel_work_sync(&priv->ps_work);
-        cancel_delayed_work_sync(&priv->ath9k_led_blink_work);
-        ath9k_led_stop_brightness(priv);
-
         mutex_lock(&priv->mutex);
 
         if (priv->op_flags & OP_INVALID) {
@@ -1044,8 +1038,23 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
         WMI_CMD(WMI_DRAIN_TXQ_ALL_CMDID);
         WMI_CMD(WMI_STOP_RECV_CMDID);
+
+        tasklet_kill(&priv->swba_tasklet);
+        tasklet_kill(&priv->rx_tasklet);
+        tasklet_kill(&priv->tx_tasklet);
+
         skb_queue_purge(&priv->tx_queue);
 
+        mutex_unlock(&priv->mutex);
+
+        /* Cancel all the running timers/work .. */
+        cancel_work_sync(&priv->fatal_work);
+        cancel_work_sync(&priv->ps_work);
+        cancel_delayed_work_sync(&priv->ath9k_led_blink_work);
+        ath9k_led_stop_brightness(priv);
+
+        mutex_lock(&priv->mutex);
+
         /* Remove monitor interface here */
         if (ah->opmode == NL80211_IFTYPE_MONITOR) {
                 if (ath9k_htc_remove_monitor_interface(priv))
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 1afb8bb85756..9f01e50d5cda 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -369,6 +369,9 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         else
                 ah->config.ht_enable = 0;
 
+        /* PAPRD needs some more work to be enabled */
+        ah->config.paprd_disable = 1;
+
         ah->config.rx_intr_mitigation = true;
         ah->config.pcieSerDesWrite = true;
 
@@ -1933,7 +1936,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 pCap->rx_status_len = sizeof(struct ar9003_rxs);
                 pCap->tx_desc_len = sizeof(struct ar9003_txc);
                 pCap->txs_len = sizeof(struct ar9003_txs);
-                if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+                if (!ah->config.paprd_disable &&
+                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
                         pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
         } else {
                 pCap->tx_desc_len = sizeof(struct ath_desc);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 5a3dfec45e96..ea9fde670646 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -225,6 +225,7 @@ struct ath9k_ops_config {
         u32 pcie_waen;
         u8 analog_shiftreg;
         u8 ht_enable;
+        u8 paprd_disable;
         u32 ofdm_trig_low;
         u32 ofdm_trig_high;
         u32 cck_trig_high;
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 767d8b86f1e1..087a6a95edd5 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -598,8 +598,6 @@ err_btcoex:
 err_queues:
         ath9k_hw_deinit(ah);
 err_hw:
-        tasklet_kill(&sc->intr_tq);
-        tasklet_kill(&sc->bcon_tasklet);
 
         kfree(ah);
         sc->sc_ah = NULL;
@@ -807,9 +805,6 @@ static void ath9k_deinit_softc(struct ath_softc *sc)
 
         ath9k_hw_deinit(sc->sc_ah);
 
-        tasklet_kill(&sc->intr_tq);
-        tasklet_kill(&sc->bcon_tasklet);
-
         kfree(sc->sc_ah);
         sc->sc_ah = NULL;
 }
@@ -824,6 +819,8 @@ void ath9k_deinit_device(struct ath_softc *sc)
         wiphy_rfkill_stop_polling(sc->hw->wiphy);
         ath_deinit_leds(sc);
 
+        ath9k_ps_restore(sc);
+
         for (i = 0; i < sc->num_sec_wiphy; i++) {
                 struct ath_wiphy *aphy = sc->sec_wiphy[i];
                 if (aphy == NULL)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index f90a6ca94a76..9040c2ff1909 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -325,6 +325,8 @@ static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int
 {
         struct ieee80211_hw *hw = sc->hw;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_tx_control txctl;
         int time_left;
 
@@ -342,8 +344,12 @@ static bool ath_paprd_send_frame(struct ath_softc *sc, struct sk_buff *skb, int
         init_completion(&sc->paprd_complete);
         sc->paprd_pending = true;
         txctl.paprd = BIT(chain);
-        if (ath_tx_start(hw, skb, &txctl) != 0)
+
+        if (ath_tx_start(hw, skb, &txctl) != 0) {
+                ath_dbg(common, ATH_DBG_XMIT, "PAPRD TX failed\n");
+                dev_kfree_skb_any(skb);
                 return false;
+        }
 
         time_left = wait_for_completion_timeout(&sc->paprd_complete,
                         msecs_to_jiffies(ATH_PAPRD_TIMEOUT));
@@ -592,14 +598,12 @@ void ath9k_tasklet(unsigned long data)
         u32 status = sc->intrstatus;
         u32 rxmask;
 
-        ath9k_ps_wakeup(sc);
-
         if (status & ATH9K_INT_FATAL) {
                 ath_reset(sc, true);
-                ath9k_ps_restore(sc);
                 return;
         }
 
+        ath9k_ps_wakeup(sc);
         spin_lock(&sc->sc_pcu_lock);
 
         if (!ath9k_hw_check_alive(ah))
@@ -955,8 +959,6 @@ void ath_radio_disable(struct ath_softc *sc, struct ieee80211_hw *hw)
 
         spin_unlock_bh(&sc->sc_pcu_lock);
         ath9k_ps_restore(sc);
-
-        ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
 }
 
 int ath_reset(struct ath_softc *sc, bool retry_tx)
@@ -969,6 +971,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
         /* Stop ANI */
         del_timer_sync(&common->ani.timer);
 
+        ath9k_ps_wakeup(sc);
         spin_lock_bh(&sc->sc_pcu_lock);
 
         ieee80211_stop_queues(hw);
@@ -1015,6 +1018,7 @@ int ath_reset(struct ath_softc *sc, bool retry_tx)
 
         /* Start ANI */
         ath_start_ani(common);
+        ath9k_ps_restore(sc);
 
         return r;
 }
@@ -1309,6 +1313,9 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         spin_lock_bh(&sc->sc_pcu_lock);
 
+        /* prevent tasklets to enable interrupts once we disable them */
+        ah->imask &= ~ATH9K_INT_GLOBAL;
+
         /* make sure h/w will not generate any interrupt
          * before setting the invalid flag. */
         ath9k_hw_disable_interrupts(ah);
@@ -1326,6 +1333,12 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         spin_unlock_bh(&sc->sc_pcu_lock);
 
+        /* we can now sync irq and kill any running tasklets, since we already
+         * disabled interrupts and not holding a spin lock */
+        synchronize_irq(sc->irq);
+        tasklet_kill(&sc->intr_tq);
+        tasklet_kill(&sc->bcon_tasklet);
+
         ath9k_ps_restore(sc);
 
         sc->ps_idle = true;
@@ -1701,7 +1714,9 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
 skip_chan_change:
         if (changed & IEEE80211_CONF_CHANGE_POWER) {
                 sc->config.txpowlimit = 2 * conf->power_level;
+                ath9k_ps_wakeup(sc);
                 ath_update_txpow(sc);
+                ath9k_ps_restore(sc);
         }
 
         spin_lock_bh(&sc->wiphy_lock);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 332d1feb5c18..33a37edbaf79 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2113,9 +2113,7 @@ static void ath_tx_complete_poll_work(struct work_struct *work)
         if (needreset) {
                 ath_dbg(ath9k_hw_common(sc->sc_ah), ATH_DBG_RESET,
                         "tx hung, resetting the chip\n");
-                ath9k_ps_wakeup(sc);
                 ath_reset(sc, true);
-                ath9k_ps_restore(sc);
         }
 
         ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 3f1e5f1bf847..91a9f5253469 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2624,6 +2624,7 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .fw_name_pre = IWL4965_FW_PRE,
         .ucode_api_max = IWL4965_UCODE_API_MAX,
         .ucode_api_min = IWL4965_UCODE_API_MIN,
+        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .valid_tx_ant = ANT_AB,
         .valid_rx_ant = ANT_ABC,
         .eeprom_ver = EEPROM_4965_EEPROM_VERSION,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
index 14ceb4df72f6..27b5a3eec9dc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-eeprom.c
@@ -152,11 +152,14 @@ int iwl_eeprom_check_sku(struct iwl_priv *priv)
 
         eeprom_sku = iwl_eeprom_query16(priv, EEPROM_SKU_CAP);
 
-        priv->cfg->sku = ((eeprom_sku & EEPROM_SKU_CAP_BAND_SELECTION) >>
+        if (!priv->cfg->sku) {
+                /* not using sku overwrite */
+                priv->cfg->sku =
+                        ((eeprom_sku & EEPROM_SKU_CAP_BAND_SELECTION) >>
                         EEPROM_SKU_CAP_BAND_POS);
-        if (eeprom_sku & EEPROM_SKU_CAP_11N_ENABLE)
-                priv->cfg->sku |= IWL_SKU_N;
-
+                if (eeprom_sku & EEPROM_SKU_CAP_11N_ENABLE)
+                        priv->cfg->sku |= IWL_SKU_N;
+        }
         if (!priv->cfg->sku) {
                 IWL_ERR(priv, "Invalid device sku\n");
                 return -EINVAL;
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 0b4e8590cbb7..029be3c6c030 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2446,6 +2446,7 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0812, 0x3101), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Qcom */
         { USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
diff --git a/drivers/net/wireless/rtlwifi/efuse.c b/drivers/net/wireless/rtlwifi/efuse.c
index b8433f3a9bc2..62876cd5c41a 100644
--- a/drivers/net/wireless/rtlwifi/efuse.c
+++ b/drivers/net/wireless/rtlwifi/efuse.c
@@ -726,9 +726,9 @@ static int efuse_pg_packet_read(struct ieee80211_hw *hw, u8 offset, u8 *data)
 }
 
 static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
-                                u8 efuse_data, u8 offset, int *bcontinual,
-                                u8 *write_state, struct pgpkt_struct target_pkt,
-                                int *repeat_times, int *bresult, u8 word_en)
+                        u8 efuse_data, u8 offset, int *bcontinual,
+                        u8 *write_state, struct pgpkt_struct *target_pkt,
+                        int *repeat_times, int *bresult, u8 word_en)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct pgpkt_struct tmp_pkt;
@@ -744,8 +744,8 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
         tmp_pkt.word_en = tmp_header & 0x0F;
         tmp_word_cnts = efuse_calculate_word_cnts(tmp_pkt.word_en);
 
-        if (tmp_pkt.offset != target_pkt.offset) {
-                efuse_addr = efuse_addr + (tmp_word_cnts * 2) + 1;
+        if (tmp_pkt.offset != target_pkt->offset) {
+                *efuse_addr = *efuse_addr + (tmp_word_cnts * 2) + 1;
                 *write_state = PG_STATE_HEADER;
         } else {
                 for (tmpindex = 0; tmpindex < (tmp_word_cnts * 2); tmpindex++) {
@@ -756,23 +756,23 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
                 }
 
                 if (bdataempty == false) {
-                        efuse_addr = efuse_addr + (tmp_word_cnts * 2) + 1;
+                        *efuse_addr = *efuse_addr + (tmp_word_cnts * 2) + 1;
                         *write_state = PG_STATE_HEADER;
                 } else {
                         match_word_en = 0x0F;
-                        if (!((target_pkt.word_en & BIT(0)) |
+                        if (!((target_pkt->word_en & BIT(0)) |
                              (tmp_pkt.word_en & BIT(0))))
                                 match_word_en &= (~BIT(0));
 
-                        if (!((target_pkt.word_en & BIT(1)) |
+                        if (!((target_pkt->word_en & BIT(1)) |
                              (tmp_pkt.word_en & BIT(1))))
                                 match_word_en &= (~BIT(1));
 
-                        if (!((target_pkt.word_en & BIT(2)) |
+                        if (!((target_pkt->word_en & BIT(2)) |
                              (tmp_pkt.word_en & BIT(2))))
                                 match_word_en &= (~BIT(2));
 
-                        if (!((target_pkt.word_en & BIT(3)) |
+                        if (!((target_pkt->word_en & BIT(3)) |
                              (tmp_pkt.word_en & BIT(3))))
                                 match_word_en &= (~BIT(3));
 
@@ -780,7 +780,7 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
                                 badworden = efuse_word_enable_data_write(
                                                             hw, *efuse_addr + 1,
                                                             tmp_pkt.word_en,
-                                                            target_pkt.data);
+                                                            target_pkt->data);
 
                                 if (0x0F != (badworden & 0x0F)) {
                                         u8 reorg_offset = offset;
@@ -791,26 +791,26 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
                                 }
 
                                 tmp_word_en = 0x0F;
-                                if ((target_pkt.word_en & BIT(0)) ^
+                                if ((target_pkt->word_en & BIT(0)) ^
                                     (match_word_en & BIT(0)))
                                         tmp_word_en &= (~BIT(0));
 
-                                if ((target_pkt.word_en & BIT(1)) ^
+                                if ((target_pkt->word_en & BIT(1)) ^
                                     (match_word_en & BIT(1)))
                                         tmp_word_en &= (~BIT(1));
 
-                                if ((target_pkt.word_en & BIT(2)) ^
+                                if ((target_pkt->word_en & BIT(2)) ^
                                         (match_word_en & BIT(2)))
                                         tmp_word_en &= (~BIT(2));
 
-                                if ((target_pkt.word_en & BIT(3)) ^
+                                if ((target_pkt->word_en & BIT(3)) ^
                                     (match_word_en & BIT(3)))
                                         tmp_word_en &= (~BIT(3));
 
                                 if ((tmp_word_en & 0x0F) != 0x0F) {
                                         *efuse_addr = efuse_get_current_size(hw);
-                                        target_pkt.offset = offset;
-                                        target_pkt.word_en = tmp_word_en;
+                                        target_pkt->offset = offset;
+                                        target_pkt->word_en = tmp_word_en;
                                 } else
                                         *bcontinual = false;
                                 *write_state = PG_STATE_HEADER;
@@ -821,8 +821,8 @@ static void efuse_write_data_case1(struct ieee80211_hw *hw, u16 *efuse_addr,
                                 }
                         } else {
                                 *efuse_addr += (2 * tmp_word_cnts) + 1;
-                                target_pkt.offset = offset;
-                                target_pkt.word_en = word_en;
+                                target_pkt->offset = offset;
+                                target_pkt->word_en = word_en;
                                 *write_state = PG_STATE_HEADER;
                         }
                 }
@@ -938,7 +938,7 @@ static int efuse_pg_packet_write(struct ieee80211_hw *hw,
                                 efuse_write_data_case1(hw, &efuse_addr,
                                                        efuse_data, offset,
                                                        &bcontinual,
-                                                       &write_state, target_pkt,
+                                                       &write_state, &target_pkt,
                                                        &repeat_times, &bresult,
                                                        word_en);
                         else
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 0fa36aa6701a..1758d4463247 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -619,6 +619,13 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                                         struct sk_buff *uskb = NULL;
                                         u8 *pdata;
                                         uskb = dev_alloc_skb(skb->len + 128);
+                                        if (!uskb) {
+                                                RT_TRACE(rtlpriv,
+                                                        (COMP_INTR | COMP_RECV),
+                                                        DBG_EMERG,
+                                                        ("can't alloc rx skb\n"));
+                                                goto done;
+                                        }
                                         memcpy(IEEE80211_SKB_RXCB(uskb),
                                                         &rx_status,
                                                         sizeof(rx_status));
@@ -641,7 +648,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         new_skb = dev_alloc_skb(rtlpci->rxbuffersize);
                         if (unlikely(!new_skb)) {
                                 RT_TRACE(rtlpriv, (COMP_INTR | COMP_RECV),
-                                         DBG_DMESG,
+                                         DBG_EMERG,
                                          ("can't alloc skb for rx\n"));
                                 goto done;
                         }
@@ -1066,9 +1073,9 @@ static int _rtl_pci_init_rx_ring(struct ieee80211_hw *hw)
                         struct sk_buff *skb =
                             dev_alloc_skb(rtlpci->rxbuffersize);
                         u32 bufferaddress;
-                        entry = &rtlpci->rx_ring[rx_queue_idx].desc[i];
                         if (!skb)
                                 return 0;
+                        entry = &rtlpci->rx_ring[rx_queue_idx].desc[i];
 
                         /*skb->dev = dev; */
 
diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
index 46714910f98c..7145ea543783 100644
--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -110,9 +110,8 @@ static void wl1271_spi_reset(struct wl1271 *wl)
         spi_message_add_tail(&t, &m);
 
         spi_sync(wl_to_spi(wl), &m);
-        kfree(cmd);
-
         wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
+        kfree(cmd);
 }
 
 static void wl1271_spi_init(struct wl1271 *wl)
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 546de5749824..da1f12120346 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -120,6 +120,9 @@ struct netfront_info {
         unsigned long rx_pfn_array[NET_RX_RING_SIZE];
         struct multicall_entry rx_mcl[NET_RX_RING_SIZE+1];
         struct mmu_update rx_mmu[NET_RX_RING_SIZE];
+
+        /* Statistics */
+        int rx_gso_checksum_fixup;
 };
 
 struct netfront_rx_info {
@@ -770,11 +773,29 @@ static RING_IDX xennet_fill_frags(struct netfront_info *np,
         return cons;
 }
 
-static int skb_checksum_setup(struct sk_buff *skb)
+static int checksum_setup(struct net_device *dev, struct sk_buff *skb)
 {
         struct iphdr *iph;
         unsigned char *th;
         int err = -EPROTO;
+        int recalculate_partial_csum = 0;
+
+        /*
+         * A GSO SKB must be CHECKSUM_PARTIAL. However some buggy
+         * peers can fail to set NETRXF_csum_blank when sending a GSO
+         * frame. In this case force the SKB to CHECKSUM_PARTIAL and
+         * recalculate the partial checksum.
+         */
+        if (skb->ip_summed != CHECKSUM_PARTIAL && skb_is_gso(skb)) {
+                struct netfront_info *np = netdev_priv(dev);
+                np->rx_gso_checksum_fixup++;
+                skb->ip_summed = CHECKSUM_PARTIAL;
+                recalculate_partial_csum = 1;
+        }
+
+        /* A non-CHECKSUM_PARTIAL SKB does not require setup. */
+        if (skb->ip_summed != CHECKSUM_PARTIAL)
+                return 0;
 
         if (skb->protocol != htons(ETH_P_IP))
                 goto out;
@@ -788,9 +809,23 @@ static int skb_checksum_setup(struct sk_buff *skb)
         switch (iph->protocol) {
         case IPPROTO_TCP:
                 skb->csum_offset = offsetof(struct tcphdr, check);
+
+                if (recalculate_partial_csum) {
+                        struct tcphdr *tcph = (struct tcphdr *)th;
+                        tcph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
+                                                         skb->len - iph->ihl*4,
+                                                         IPPROTO_TCP, 0);
+                }
                 break;
         case IPPROTO_UDP:
                 skb->csum_offset = offsetof(struct udphdr, check);
+
+                if (recalculate_partial_csum) {
+                        struct udphdr *udph = (struct udphdr *)th;
+                        udph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
+                                                         skb->len - iph->ihl*4,
+                                                         IPPROTO_UDP, 0);
+                }
                 break;
         default:
                 if (net_ratelimit())
@@ -829,13 +864,11 @@ static int handle_incoming_queue(struct net_device *dev,
                 /* Ethernet work: Delayed to here as it peeks the header. */
                 skb->protocol = eth_type_trans(skb, dev);
 
-                if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                        if (skb_checksum_setup(skb)) {
-                                kfree_skb(skb);
-                                packets_dropped++;
-                                dev->stats.rx_errors++;
-                                continue;
-                        }
+                if (checksum_setup(dev, skb)) {
+                        kfree_skb(skb);
+                        packets_dropped++;
+                        dev->stats.rx_errors++;
+                        continue;
                 }
 
                 dev->stats.rx_packets++;
@@ -1632,12 +1665,59 @@ static void netback_changed(struct xenbus_device *dev,
         }
 }
 
+static const struct xennet_stat {
+        char name[ETH_GSTRING_LEN];
+        u16 offset;
+} xennet_stats[] = {
+        {
+                "rx_gso_checksum_fixup",
+                offsetof(struct netfront_info, rx_gso_checksum_fixup)
+        },
+};
+
+static int xennet_get_sset_count(struct net_device *dev, int string_set)
+{
+        switch (string_set) {
+        case ETH_SS_STATS:
+                return ARRAY_SIZE(xennet_stats);
+        default:
+                return -EINVAL;
+        }
+}
+
+static void xennet_get_ethtool_stats(struct net_device *dev,
+                                     struct ethtool_stats *stats, u64 * data)
+{
+        void *np = netdev_priv(dev);
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(xennet_stats); i++)
+                data[i] = *(int *)(np + xennet_stats[i].offset);
+}
+
+static void xennet_get_strings(struct net_device *dev, u32 stringset, u8 * data)
+{
+        int i;
+
+        switch (stringset) {
+        case ETH_SS_STATS:
+                for (i = 0; i < ARRAY_SIZE(xennet_stats); i++)
+                        memcpy(data + i * ETH_GSTRING_LEN,
+                               xennet_stats[i].name, ETH_GSTRING_LEN);
+                break;
+        }
+}
+
 static const struct ethtool_ops xennet_ethtool_ops =
 {
         .set_tx_csum = ethtool_op_set_tx_csum,
         .set_sg = xennet_set_sg,
         .set_tso = xennet_set_tso,
         .get_link = ethtool_op_get_link,
+
+        .get_sset_count = xennet_get_sset_count,
+        .get_ethtool_stats = xennet_get_ethtool_stats,
+        .get_strings = xennet_get_strings,
 };
 
 #ifdef CONFIG_SYSFS
diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index a2d9d1e59260..a848e02e6be3 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -678,7 +678,7 @@ void parport_unregister_device(struct pardevice *dev)
 
         /* Make sure we haven't left any pointers around in the wait
          * list. */
-        spin_lock (&port->waitlist_lock);
+        spin_lock_irq(&port->waitlist_lock);
         if (dev->waitprev || dev->waitnext || port->waithead == dev) {
                 if (dev->waitprev)
                         dev->waitprev->waitnext = dev->waitnext;
@@ -689,7 +689,7 @@ void parport_unregister_device(struct pardevice *dev)
                 else
                         port->waittail = dev->waitprev;
         }
-        spin_unlock (&port->waitlist_lock);
+        spin_unlock_irq(&port->waitlist_lock);
 
         kfree(dev->state);
         kfree(dev);
diff --git a/drivers/platform/x86/intel_scu_ipc.c b/drivers/platform/x86/intel_scu_ipc.c
index f374c5961b32..a91d510a798b 100644
--- a/drivers/platform/x86/intel_scu_ipc.c
+++ b/drivers/platform/x86/intel_scu_ipc.c
@@ -26,7 +26,6 @@
 #include <linux/sfi.h>
 #include <asm/mrst.h>
 #include <asm/intel_scu_ipc.h>
-#include <asm/mrst.h>
 
 /* IPC defines the following message types */
 #define IPCMSG_WATCHDOG_TIMER 0xF8 /* Set Kernel Watchdog Threshold */
diff --git a/drivers/pps/clients/pps-ktimer.c b/drivers/pps/clients/pps-ktimer.c
index 2728469d3884..82583b0ff82d 100644
--- a/drivers/pps/clients/pps-ktimer.c
+++ b/drivers/pps/clients/pps-ktimer.c
@@ -46,8 +46,6 @@ static void pps_ktimer_event(unsigned long ptr)
         /* First of all we get the time stamp... */
         pps_get_ts(&ts);
 
-        dev_info(pps->dev, "PPS event at %lu\n", jiffies);
-
         pps_event(pps, &ts, PPS_CAPTUREASSERT, NULL);
 
         mod_timer(&ktimer, jiffies + HZ);
diff --git a/drivers/pps/clients/pps_parport.c b/drivers/pps/clients/pps_parport.c
index 32221efd9ca9..c571d6dd8f61 100644
--- a/drivers/pps/clients/pps_parport.c
+++ b/drivers/pps/clients/pps_parport.c
@@ -163,7 +163,7 @@ static void parport_attach(struct parport *port)
         }
 
         device->pardev = parport_register_device(port, KBUILD_MODNAME,
-                        NULL, NULL, parport_irq, 0, device);
+                        NULL, NULL, parport_irq, PARPORT_FLAG_EXCL, device);
         if (!device->pardev) {
                 pr_err("couldn't register with %s\n", port->name);
                 goto err_free;
diff --git a/drivers/pps/generators/pps_gen_parport.c b/drivers/pps/generators/pps_gen_parport.c
index 5c32f8dacf56..b93af3ebb5ba 100644
--- a/drivers/pps/generators/pps_gen_parport.c
+++ b/drivers/pps/generators/pps_gen_parport.c
@@ -198,7 +198,7 @@ static void parport_attach(struct parport *port)
         }
 
         device.pardev = parport_register_device(port, KBUILD_MODNAME,
-                        NULL, NULL, NULL, 0, &device);
+                        NULL, NULL, NULL, PARPORT_FLAG_EXCL, &device);
         if (!device.pardev) {
                 pr_err("couldn't register with %s\n", port->name);
                 return;
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index 9583cbcc6b79..c404b61386bf 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -143,6 +143,7 @@ struct rtc_device *rtc_device_register(const char *name, struct device *dev,
         rtc->id = id;
         rtc->ops = ops;
         rtc->owner = owner;
+        rtc->irq_freq = 1;
         rtc->max_user_freq = 64;
         rtc->dev.parent = dev;
         rtc->dev.class = rtc_class;
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 925006d33109..a0c01967244d 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -464,6 +464,9 @@ int rtc_irq_set_freq(struct rtc_device *rtc, struct rtc_task *task, int freq)
         int err = 0;
         unsigned long flags;
 
+        if (freq <= 0)
+                return -EINVAL;
+
         spin_lock_irqsave(&rtc->irq_task_lock, flags);
         if (rtc->irq_task != NULL && task == NULL)
                 err = -EBUSY;
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 4155805dcdff..2b771f18d1ad 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -319,6 +319,9 @@ void dasd_alias_disconnect_device_from_lcu(struct dasd_device *device)
 
         private = (struct dasd_eckd_private *) device->private;
         lcu = private->lcu;
+        /* nothing to do if already disconnected */
+        if (!lcu)
+                return;
         device->discipline->get_uid(device, &uid);
         spin_lock_irqsave(&lcu->lock, flags);
         list_del_init(&device->alias_list);
@@ -680,6 +683,9 @@ int dasd_alias_remove_device(struct dasd_device *device)
 
         private = (struct dasd_eckd_private *) device->private;
         lcu = private->lcu;
+        /* nothing to do if already removed */
+        if (!lcu)
+                return 0;
         spin_lock_irqsave(&lcu->lock, flags);
         _remove_device_from_lcu(lcu, device);
         spin_unlock_irqrestore(&lcu->lock, flags);
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index e9fff2b9bce2..5640c89cd9de 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -476,7 +476,7 @@ static inline void inbound_primed(struct qdio_q *q, int count)
 static int get_inbound_buffer_frontier(struct qdio_q *q)
 {
         int count, stop;
-        unsigned char state;
+        unsigned char state = 0;
 
         /*
          * Don't check 128 buffers, as otherwise qdio_inbound_q_moved
@@ -643,7 +643,7 @@ void qdio_inbound_processing(unsigned long data)
 static int get_outbound_buffer_frontier(struct qdio_q *q)
 {
         int count, stop;
-        unsigned char state;
+        unsigned char state = 0;
 
         if (need_siga_sync(q))
                 if (((queue_type(q) != QDIO_IQDIO_QFMT) &&
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
index 65ebee0a3266..b6a6356d09b3 100644
--- a/drivers/s390/net/netiucv.c
+++ b/drivers/s390/net/netiucv.c
@@ -565,7 +565,7 @@ static int netiucv_callback_connreq(struct iucv_path *path,
         struct iucv_event ev;
         int rc;
 
-        if (memcmp(iucvMagic, ipuser, sizeof(ipuser)))
+        if (memcmp(iucvMagic, ipuser, 16))
                 /* ipuser must match iucvMagic. */
                 return -EINVAL;
         rc = -EINVAL;
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 29f848bfc12f..019ae58ab913 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -988,16 +988,30 @@ static void qeth_get_channel_path_desc(struct qeth_card *card)
         chp_dsc = (struct channelPath_dsc *)ccw_device_get_chp_desc(ccwdev, 0);
         if (chp_dsc != NULL) {
                 /* CHPP field bit 6 == 1 -> single queue */
-                if ((chp_dsc->chpp & 0x02) == 0x02)
+                if ((chp_dsc->chpp & 0x02) == 0x02) {
+                        if ((atomic_read(&card->qdio.state) !=
+                                QETH_QDIO_UNINITIALIZED) &&
+                            (card->qdio.no_out_queues == 4))
+                                /* change from 4 to 1 outbound queues */
+                                qeth_free_qdio_buffers(card);
                         card->qdio.no_out_queues = 1;
+                        if (card->qdio.default_out_queue != 0)
+                                dev_info(&card->gdev->dev,
+                                        "Priority Queueing not supported\n");
+                        card->qdio.default_out_queue = 0;
+                } else {
+                        if ((atomic_read(&card->qdio.state) !=
+                                QETH_QDIO_UNINITIALIZED) &&
+                            (card->qdio.no_out_queues == 1)) {
+                                /* change from 1 to 4 outbound queues */
+                                qeth_free_qdio_buffers(card);
+                                card->qdio.default_out_queue = 2;
+                        }
+                        card->qdio.no_out_queues = 4;
+                }
                 card->info.func_level = 0x4100 + chp_dsc->desc;
                 kfree(chp_dsc);
         }
-        if (card->qdio.no_out_queues == 1) {
-                card->qdio.default_out_queue = 0;
-                dev_info(&card->gdev->dev,
-                        "Priority Queueing not supported\n");
-        }
         QETH_DBF_TEXT_(SETUP, 2, "nr:%x", card->qdio.no_out_queues);
         QETH_DBF_TEXT_(SETUP, 2, "lvl:%02x", card->info.func_level);
         return;
@@ -1832,33 +1846,6 @@ static inline int qeth_get_initial_mtu_for_card(struct qeth_card *card)
         }
 }
 
-static inline int qeth_get_max_mtu_for_card(int cardtype)
-{
-        switch (cardtype) {
-
-        case QETH_CARD_TYPE_UNKNOWN:
-        case QETH_CARD_TYPE_OSD:
-        case QETH_CARD_TYPE_OSN:
-        case QETH_CARD_TYPE_OSM:
-        case QETH_CARD_TYPE_OSX:
-                return 61440;
-        case QETH_CARD_TYPE_IQD:
-                return 57344;
-        default:
-                return 1500;
-        }
-}
-
-static inline int qeth_get_mtu_out_of_mpc(int cardtype)
-{
-        switch (cardtype) {
-        case QETH_CARD_TYPE_IQD:
-                return 1;
-        default:
-                return 0;
-        }
-}
-
 static inline int qeth_get_mtu_outof_framesize(int framesize)
 {
         switch (framesize) {
@@ -1881,10 +1868,9 @@ static inline int qeth_mtu_is_valid(struct qeth_card *card, int mtu)
         case QETH_CARD_TYPE_OSD:
         case QETH_CARD_TYPE_OSM:
         case QETH_CARD_TYPE_OSX:
-                return ((mtu >= 576) && (mtu <= 61440));
         case QETH_CARD_TYPE_IQD:
                 return ((mtu >= 576) &&
-                        (mtu <= card->info.max_mtu + 4096 - 32));
+                        (mtu <= card->info.max_mtu));
         case QETH_CARD_TYPE_OSN:
         case QETH_CARD_TYPE_UNKNOWN:
         default:
@@ -1907,7 +1893,7 @@ static int qeth_ulp_enable_cb(struct qeth_card *card, struct qeth_reply *reply,
         memcpy(&card->token.ulp_filter_r,
                QETH_ULP_ENABLE_RESP_FILTER_TOKEN(iob->data),
                QETH_MPC_TOKEN_LENGTH);
-        if (qeth_get_mtu_out_of_mpc(card->info.type)) {
+        if (card->info.type == QETH_CARD_TYPE_IQD) {
                 memcpy(&framesize, QETH_ULP_ENABLE_RESP_MAX_MTU(iob->data), 2);
                 mtu = qeth_get_mtu_outof_framesize(framesize);
                 if (!mtu) {
@@ -1915,12 +1901,21 @@ static int qeth_ulp_enable_cb(struct qeth_card *card, struct qeth_reply *reply,
                         QETH_DBF_TEXT_(SETUP, 2, "  rc%d", iob->rc);
                         return 0;
                 }
-                card->info.max_mtu = mtu;
+                if (card->info.initial_mtu && (card->info.initial_mtu != mtu)) {
+                        /* frame size has changed */
+                        if (card->dev &&
+                            ((card->dev->mtu == card->info.initial_mtu) ||
+                             (card->dev->mtu > mtu)))
+                                card->dev->mtu = mtu;
+                        qeth_free_qdio_buffers(card);
+                }
                 card->info.initial_mtu = mtu;
+                card->info.max_mtu = mtu;
                 card->qdio.in_buf_size = mtu + 2 * PAGE_SIZE;
         } else {
                 card->info.initial_mtu = qeth_get_initial_mtu_for_card(card);
-                card->info.max_mtu = qeth_get_max_mtu_for_card(card->info.type);
+                card->info.max_mtu = *(__u16 *)QETH_ULP_ENABLE_RESP_MAX_MTU(
+                        iob->data);
                 card->qdio.in_buf_size = QETH_IN_BUF_SIZE_DEFAULT;
         }
 
@@ -3775,6 +3770,47 @@ static inline int qeth_get_qdio_q_format(struct qeth_card *card)
         }
 }
 
+static void qeth_determine_capabilities(struct qeth_card *card)
+{
+        int rc;
+        int length;
+        char *prcd;
+        struct ccw_device *ddev;
+        int ddev_offline = 0;
+
+        QETH_DBF_TEXT(SETUP, 2, "detcapab");
+        ddev = CARD_DDEV(card);
+        if (!ddev->online) {
+                ddev_offline = 1;
+                rc = ccw_device_set_online(ddev);
+                if (rc) {
+                        QETH_DBF_TEXT_(SETUP, 2, "3err%d", rc);
+                        goto out;
+                }
+        }
+
+        rc = qeth_read_conf_data(card, (void **) &prcd, &length);
+        if (rc) {
+                QETH_DBF_MESSAGE(2, "%s qeth_read_conf_data returned %i\n",
+                        dev_name(&card->gdev->dev), rc);
+                QETH_DBF_TEXT_(SETUP, 2, "5err%d", rc);
+                goto out_offline;
+        }
+        qeth_configure_unitaddr(card, prcd);
+        qeth_configure_blkt_default(card, prcd);
+        kfree(prcd);
+
+        rc = qdio_get_ssqd_desc(ddev, &card->ssqd);
+        if (rc)
+                QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
+
+out_offline:
+        if (ddev_offline == 1)
+                ccw_device_set_offline(ddev);
+out:
+        return;
+}
+
 static int qeth_qdio_establish(struct qeth_card *card)
 {
         struct qdio_initialize init_data;
@@ -3905,6 +3941,7 @@ int qeth_core_hardsetup_card(struct qeth_card *card)
 
         QETH_DBF_TEXT(SETUP, 2, "hrdsetup");
         atomic_set(&card->force_alloc_skb, 0);
+        qeth_get_channel_path_desc(card);
 retry:
         if (retries)
                 QETH_DBF_MESSAGE(2, "%s Retrying to do IDX activates.\n",
@@ -3933,6 +3970,7 @@ retriable:
                 else
                         goto retry;
         }
+        qeth_determine_capabilities(card);
         qeth_init_tokens(card);
         qeth_init_func_level(card);
         rc = qeth_idx_activate_channel(&card->read, qeth_idx_read_cb);
@@ -4202,41 +4240,6 @@ void qeth_core_free_discipline(struct qeth_card *card)
         card->discipline.ccwgdriver = NULL;
 }
 
-static void qeth_determine_capabilities(struct qeth_card *card)
-{
-        int rc;
-        int length;
-        char *prcd;
-
-        QETH_DBF_TEXT(SETUP, 2, "detcapab");
-        rc = ccw_device_set_online(CARD_DDEV(card));
-        if (rc) {
-                QETH_DBF_TEXT_(SETUP, 2, "3err%d", rc);
-                goto out;
-        }
-
-
-        rc = qeth_read_conf_data(card, (void **) &prcd, &length);
-        if (rc) {
-                QETH_DBF_MESSAGE(2, "%s qeth_read_conf_data returned %i\n",
-                        dev_name(&card->gdev->dev), rc);
-                QETH_DBF_TEXT_(SETUP, 2, "5err%d", rc);
-                goto out_offline;
-        }
-        qeth_configure_unitaddr(card, prcd);
-        qeth_configure_blkt_default(card, prcd);
-        kfree(prcd);
-
-        rc = qdio_get_ssqd_desc(CARD_DDEV(card), &card->ssqd);
-        if (rc)
-                QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc);
-
-out_offline:
-        ccw_device_set_offline(CARD_DDEV(card));
-out:
-        return;
-}
-
 static int qeth_core_probe_device(struct ccwgroup_device *gdev)
 {
         struct qeth_card *card;
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 2ac8f6aff5a4..ada0fe782373 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -573,13 +573,13 @@ static int qeth_l2_send_setmac_cb(struct qeth_card *card,
                 case IPA_RC_L2_DUP_LAYER3_MAC:
                         dev_warn(&card->gdev->dev,
                                 "MAC address %pM already exists\n",
-                                card->dev->dev_addr);
+                                cmd->data.setdelmac.mac);
                         break;
                 case IPA_RC_L2_MAC_NOT_AUTH_BY_HYP:
                 case IPA_RC_L2_MAC_NOT_AUTH_BY_ADP:
                         dev_warn(&card->gdev->dev,
                                 "MAC address %pM is not authorized\n",
-                                card->dev->dev_addr);
+                                cmd->data.setdelmac.mac);
                         break;
                 default:
                         break;
diff --git a/drivers/s390/net/smsgiucv.c b/drivers/s390/net/smsgiucv.c
index 65e1cf104943..207b7d742443 100644
--- a/drivers/s390/net/smsgiucv.c
+++ b/drivers/s390/net/smsgiucv.c
@@ -60,7 +60,7 @@ static struct iucv_handler smsg_handler = {
 static int smsg_path_pending(struct iucv_path *path, u8 ipvmid[8],
                              u8 ipuser[16])
 {
-        if (strncmp(ipvmid, "*MSG    ", sizeof(ipvmid)) != 0)
+        if (strncmp(ipvmid, "*MSG    ", 8) != 0)
                 return -EINVAL;
         /* Path pending from *MSG. */
         return iucv_path_accept(path, &smsg_handler, "SMSGIUCV        ", NULL);
diff --git a/drivers/scsi/arcmsr/arcmsr.h b/drivers/scsi/arcmsr/arcmsr.h
index 475c31ae985c..77b26f5b9c33 100644
--- a/drivers/scsi/arcmsr/arcmsr.h
+++ b/drivers/scsi/arcmsr/arcmsr.h
@@ -2,7 +2,7 @@
 *******************************************************************************
 **        O.S   : Linux
 **   FILE NAME  : arcmsr.h
-**        BY    : Erich Chen
+**        BY    : Nick Cheng
 **   Description: SCSI RAID Device Driver for
 **                ARECA RAID Host adapter
 *******************************************************************************
@@ -46,8 +46,12 @@
 struct device_attribute;
 /*The limit of outstanding scsi command that firmware can handle*/
 #define ARCMSR_MAX_OUTSTANDING_CMD                                              256
-#define ARCMSR_MAX_FREECCB_NUM                                                  320
-#define ARCMSR_DRIVER_VERSION                "Driver Version 1.20.00.15 2010/02/02"
+#ifdef CONFIG_XEN
+        #define ARCMSR_MAX_FREECCB_NUM  160
+#else
+        #define ARCMSR_MAX_FREECCB_NUM  320
+#endif
+#define ARCMSR_DRIVER_VERSION                "Driver Version 1.20.00.15 2010/08/05"
 #define ARCMSR_SCSI_INITIATOR_ID                                                255
 #define ARCMSR_MAX_XFER_SECTORS                                                 512
 #define ARCMSR_MAX_XFER_SECTORS_B                                               4096
@@ -60,7 +64,6 @@ struct device_attribute;
 #define ARCMSR_MAX_HBB_POSTQUEUE                                                264
 #define ARCMSR_MAX_XFER_LEN                                                     0x26000 /* 152K */
 #define ARCMSR_CDB_SG_PAGE_LENGTH                                               256 
-#define SCSI_CMD_ARECA_SPECIFIC                                         0xE1
 #ifndef PCI_DEVICE_ID_ARECA_1880
 #define PCI_DEVICE_ID_ARECA_1880 0x1880
  #endif
diff --git a/drivers/scsi/arcmsr/arcmsr_attr.c b/drivers/scsi/arcmsr/arcmsr_attr.c
index a4e04c50c436..acdae33de521 100644
--- a/drivers/scsi/arcmsr/arcmsr_attr.c
+++ b/drivers/scsi/arcmsr/arcmsr_attr.c
@@ -2,7 +2,7 @@
 *******************************************************************************
 **        O.S   : Linux
 **   FILE NAME  : arcmsr_attr.c
-**        BY    : Erich Chen
+**        BY    : Nick Cheng
 **   Description: attributes exported to sysfs and device host
 *******************************************************************************
 ** Copyright (C) 2002 - 2005, Areca Technology Corporation All rights reserved
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index 1cadcd6b7da6..984bd527c6c9 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -2,7 +2,7 @@
 *******************************************************************************
 **        O.S   : Linux
 **   FILE NAME  : arcmsr_hba.c
-**        BY    : Erich Chen
+**        BY    : Nick Cheng
 **   Description: SCSI RAID Device Driver for
 **                ARECA RAID Host adapter
 *******************************************************************************
@@ -76,7 +76,7 @@ MODULE_DESCRIPTION("ARECA (ARC11xx/12xx/16xx/1880) SATA/SAS RAID Host Bus Adapte
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_VERSION(ARCMSR_DRIVER_VERSION);
 static int sleeptime = 10;
-static int retrycount = 30;
+static int retrycount = 12;
 wait_queue_head_t wait_q;
 static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
                                         struct scsi_cmnd *cmd);
@@ -187,7 +187,6 @@ int arcmsr_sleep_for_bus_reset(struct scsi_cmnd *cmd)
                 if (isleep > 0) {
                         msleep(isleep*1000);
                 }
-                printk(KERN_NOTICE "wake-up\n");
                 return 0;
 }
 
@@ -921,7 +920,6 @@ static void arcmsr_report_ccb_state(struct AdapterControlBlock *acb,
 }
 
 static void arcmsr_drain_donequeue(struct AdapterControlBlock *acb, struct CommandControlBlock *pCCB, bool error)
-
 {
         int id, lun;
         if ((pCCB->acb != acb) || (pCCB->startdone != ARCMSR_CCB_START)) {
@@ -948,7 +946,7 @@ static void arcmsr_drain_donequeue(struct AdapterControlBlock *acb, struct Comma
                                 , pCCB->startdone
                                 , atomic_read(&acb->ccboutstandingcount));
                   return;
-                }
+        }
         arcmsr_report_ccb_state(acb, pCCB, error);
 }
 
@@ -981,7 +979,7 @@ static void arcmsr_done4abort_postqueue(struct AdapterControlBlock *acb)
         case ACB_ADAPTER_TYPE_B: {
                 struct MessageUnit_B *reg = acb->pmuB;
                 /*clear all outbound posted Q*/
-                writel(ARCMSR_DOORBELL_INT_CLEAR_PATTERN, &reg->iop2drv_doorbell); /* clear doorbell interrupt */
+                writel(ARCMSR_DOORBELL_INT_CLEAR_PATTERN, reg->iop2drv_doorbell); /* clear doorbell interrupt */
                 for (i = 0; i < ARCMSR_MAX_HBB_POSTQUEUE; i++) {
                         if ((flag_ccb = readl(&reg->done_qbuffer[i])) != 0) {
                                 writel(0, &reg->done_qbuffer[i]);
@@ -1511,7 +1509,6 @@ static void arcmsr_hba_postqueue_isr(struct AdapterControlBlock *acb)
                 arcmsr_drain_donequeue(acb, pCCB, error);
         }
 }
-
 static void arcmsr_hbb_postqueue_isr(struct AdapterControlBlock *acb)
 {
         uint32_t index;
@@ -2106,10 +2103,6 @@ static int arcmsr_queue_command_lck(struct scsi_cmnd *cmd,
         if (atomic_read(&acb->ccboutstandingcount) >=
                         ARCMSR_MAX_OUTSTANDING_CMD)
                 return SCSI_MLQUEUE_HOST_BUSY;
-        if ((scsicmd == SCSI_CMD_ARECA_SPECIFIC)) {
-                printk(KERN_NOTICE "Receiveing SCSI_CMD_ARECA_SPECIFIC command..\n");
-                return 0;
-        }
         ccb = arcmsr_get_freeccb(acb);
         if (!ccb)
                 return SCSI_MLQUEUE_HOST_BUSY;
@@ -2393,6 +2386,7 @@ static int arcmsr_polling_hbb_ccbdone(struct AdapterControlBlock *acb,
         int index, rtn;
         bool error;
         polling_hbb_ccb_retry:
+
         poll_count++;
         /* clear doorbell interrupt */
         writel(ARCMSR_DOORBELL_INT_CLEAR_PATTERN, reg->iop2drv_doorbell);
@@ -2663,6 +2657,7 @@ static void arcmsr_request_hba_device_map(struct AdapterControlBlock *acb)
 {
         struct MessageUnit_A __iomem *reg = acb->pmuA;
         if (unlikely(atomic_read(&acb->rq_map_token) == 0) || ((acb->acb_flags & ACB_F_BUS_RESET) != 0 ) || ((acb->acb_flags & ACB_F_ABORT) != 0 )){
+                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                 return;
         } else {
                 acb->fw_flag = FW_NORMAL;
@@ -2670,8 +2665,10 @@ static void arcmsr_request_hba_device_map(struct AdapterControlBlock *acb)
                         atomic_set(&acb->rq_map_token, 16);
                 }
                 atomic_set(&acb->ante_token_value, atomic_read(&acb->rq_map_token));
-                if (atomic_dec_and_test(&acb->rq_map_token))
+                if (atomic_dec_and_test(&acb->rq_map_token)) {
+                        mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                         return;
+                }
                 writel(ARCMSR_INBOUND_MESG0_GET_CONFIG, &reg->inbound_msgaddr0);
                 mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
         }
@@ -2682,15 +2679,18 @@ static void arcmsr_request_hbb_device_map(struct AdapterControlBlock *acb)
 {
         struct MessageUnit_B __iomem *reg = acb->pmuB;
         if (unlikely(atomic_read(&acb->rq_map_token) == 0) || ((acb->acb_flags & ACB_F_BUS_RESET) != 0 ) || ((acb->acb_flags & ACB_F_ABORT) != 0 )){
+                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                 return;
         } else {
                 acb->fw_flag = FW_NORMAL;
                 if (atomic_read(&acb->ante_token_value) == atomic_read(&acb->rq_map_token)) {
-                        atomic_set(&acb->rq_map_token,16);
+                        atomic_set(&acb->rq_map_token, 16);
                 }
                 atomic_set(&acb->ante_token_value, atomic_read(&acb->rq_map_token));
-                if(atomic_dec_and_test(&acb->rq_map_token))
+                if (atomic_dec_and_test(&acb->rq_map_token)) {
+                        mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                         return;
+                }
                 writel(ARCMSR_MESSAGE_GET_CONFIG, reg->drv2iop_doorbell);
                 mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
         }
@@ -2701,6 +2701,7 @@ static void arcmsr_request_hbc_device_map(struct AdapterControlBlock *acb)
 {
         struct MessageUnit_C __iomem *reg = acb->pmuC;
         if (unlikely(atomic_read(&acb->rq_map_token) == 0) || ((acb->acb_flags & ACB_F_BUS_RESET) != 0) || ((acb->acb_flags & ACB_F_ABORT) != 0)) {
+                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                 return;
         } else {
                 acb->fw_flag = FW_NORMAL;
@@ -2708,8 +2709,10 @@ static void arcmsr_request_hbc_device_map(struct AdapterControlBlock *acb)
                         atomic_set(&acb->rq_map_token, 16);
                 }
                 atomic_set(&acb->ante_token_value, atomic_read(&acb->rq_map_token));
-                if (atomic_dec_and_test(&acb->rq_map_token))
+                if (atomic_dec_and_test(&acb->rq_map_token)) {
+                        mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                         return;
+                }
                 writel(ARCMSR_INBOUND_MESG0_GET_CONFIG, &reg->inbound_msgaddr0);
                 writel(ARCMSR_HBCMU_DRV2IOP_MESSAGE_CMD_DONE, &reg->inbound_doorbell);
                 mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
@@ -2897,6 +2900,8 @@ static uint8_t arcmsr_iop_reset(struct AdapterControlBlock *acb)
         uint32_t intmask_org;
         uint8_t rtnval = 0x00;
         int i = 0;
+        unsigned long flags;
+
         if (atomic_read(&acb->ccboutstandingcount) != 0) {
                 /* disable all outbound interrupt */
                 intmask_org = arcmsr_disable_outbound_ints(acb);
@@ -2907,7 +2912,12 @@ static uint8_t arcmsr_iop_reset(struct AdapterControlBlock *acb)
                 for (i = 0; i < ARCMSR_MAX_FREECCB_NUM; i++) {
                         ccb = acb->pccb_pool[i];
                         if (ccb->startdone == ARCMSR_CCB_START) {
-                                arcmsr_ccb_complete(ccb);
+                                scsi_dma_unmap(ccb->pcmd);
+                                ccb->startdone = ARCMSR_CCB_DONE;
+                                ccb->ccb_flags = 0;
+                                spin_lock_irqsave(&acb->ccblist_lock, flags);
+                                list_add_tail(&ccb->list, &acb->ccb_free_list);
+                                spin_unlock_irqrestore(&acb->ccblist_lock, flags);
                         }
                 }
                 atomic_set(&acb->ccboutstandingcount, 0);
@@ -2920,8 +2930,7 @@ static uint8_t arcmsr_iop_reset(struct AdapterControlBlock *acb)
 
 static int arcmsr_bus_reset(struct scsi_cmnd *cmd)
 {
-        struct AdapterControlBlock *acb =
-                (struct AdapterControlBlock *)cmd->device->host->hostdata;
+        struct AdapterControlBlock *acb;
         uint32_t intmask_org, outbound_doorbell;
         int retry_count = 0;
         int rtn = FAILED;
@@ -2971,31 +2980,16 @@ sleep_again:
                                 atomic_set(&acb->rq_map_token, 16);
                                 atomic_set(&acb->ante_token_value, 16);
                                 acb->fw_flag = FW_NORMAL;
-                                init_timer(&acb->eternal_timer);
-                                acb->eternal_timer.expires = jiffies + msecs_to_jiffies(6*HZ);
-                                acb->eternal_timer.data = (unsigned long) acb;
-                                acb->eternal_timer.function = &arcmsr_request_device_map;
-                                add_timer(&acb->eternal_timer);
+                                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                                 acb->acb_flags &= ~ACB_F_BUS_RESET;
                                 rtn = SUCCESS;
                                 printk(KERN_ERR "arcmsr: scsi  bus reset eh returns with success\n");
                         } else {
                                 acb->acb_flags &= ~ACB_F_BUS_RESET;
-                                if (atomic_read(&acb->rq_map_token) == 0) {
-                                        atomic_set(&acb->rq_map_token, 16);
-                                        atomic_set(&acb->ante_token_value, 16);
-                                        acb->fw_flag = FW_NORMAL;
-                                        init_timer(&acb->eternal_timer);
-                                                acb->eternal_timer.expires = jiffies + msecs_to_jiffies(6*HZ);
-                                        acb->eternal_timer.data = (unsigned long) acb;
-                                        acb->eternal_timer.function = &arcmsr_request_device_map;
-                                        add_timer(&acb->eternal_timer);
-                                } else {
-                                        atomic_set(&acb->rq_map_token, 16);
-                                        atomic_set(&acb->ante_token_value, 16);
-                                        acb->fw_flag = FW_NORMAL;
-                                        mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6*HZ));
-                                }
+                                atomic_set(&acb->rq_map_token, 16);
+                                atomic_set(&acb->ante_token_value, 16);
+                                acb->fw_flag = FW_NORMAL;
+                                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6*HZ));
                                 rtn = SUCCESS;
                         }
                         break;
@@ -3007,21 +3001,10 @@ sleep_again:
                                 rtn = FAILED;
                         } else {
                                 acb->acb_flags &= ~ACB_F_BUS_RESET;
-                                if (atomic_read(&acb->rq_map_token) == 0) {
-                                        atomic_set(&acb->rq_map_token, 16);
-                                        atomic_set(&acb->ante_token_value, 16);
-                                        acb->fw_flag = FW_NORMAL;
-                                        init_timer(&acb->eternal_timer);
-                                                acb->eternal_timer.expires = jiffies + msecs_to_jiffies(6*HZ);
-                                        acb->eternal_timer.data = (unsigned long) acb;
-                                        acb->eternal_timer.function = &arcmsr_request_device_map;
-                                        add_timer(&acb->eternal_timer);
-                                } else {
-                                        atomic_set(&acb->rq_map_token, 16);
-                                        atomic_set(&acb->ante_token_value, 16);
-                                        acb->fw_flag = FW_NORMAL;
-                                        mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6*HZ));
-                                }
+                                atomic_set(&acb->rq_map_token, 16);
+                                atomic_set(&acb->ante_token_value, 16);
+                                acb->fw_flag = FW_NORMAL;
+                                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                                 rtn = SUCCESS;
                         }
                         break;
@@ -3067,31 +3050,16 @@ sleep:
                                 atomic_set(&acb->rq_map_token, 16);
                                 atomic_set(&acb->ante_token_value, 16);
                                 acb->fw_flag = FW_NORMAL;
-                                init_timer(&acb->eternal_timer);
-                                acb->eternal_timer.expires = jiffies + msecs_to_jiffies(6 * HZ);
-                                acb->eternal_timer.data = (unsigned long) acb;
-                                acb->eternal_timer.function = &arcmsr_request_device_map;
-                                add_timer(&acb->eternal_timer);
+                                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6 * HZ));
                                 acb->acb_flags &= ~ACB_F_BUS_RESET;
                                 rtn = SUCCESS;
                                 printk(KERN_ERR "arcmsr: scsi bus reset eh returns with success\n");
                         } else {
                                 acb->acb_flags &= ~ACB_F_BUS_RESET;
-                                if (atomic_read(&acb->rq_map_token) == 0) {
-                                        atomic_set(&acb->rq_map_token, 16);
-                                        atomic_set(&acb->ante_token_value, 16);
-                                        acb->fw_flag = FW_NORMAL;
-                                        init_timer(&acb->eternal_timer);
-                                                acb->eternal_timer.expires = jiffies + msecs_to_jiffies(6*HZ);
-                                        acb->eternal_timer.data = (unsigned long) acb;
-                                        acb->eternal_timer.function = &arcmsr_request_device_map;
-                                        add_timer(&acb->eternal_timer);
-                                } else {
-                                        atomic_set(&acb->rq_map_token, 16);
-                                        atomic_set(&acb->ante_token_value, 16);
-                                        acb->fw_flag = FW_NORMAL;
-                                        mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6*HZ));
-                                }
+                                atomic_set(&acb->rq_map_token, 16);
+                                atomic_set(&acb->ante_token_value, 16);
+                                acb->fw_flag = FW_NORMAL;
+                                mod_timer(&acb->eternal_timer, jiffies + msecs_to_jiffies(6*HZ));
                                 rtn = SUCCESS;
                         }
                         break;
diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
index 5815cbeb27a6..9a7aaf5f1311 100644
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -646,6 +646,7 @@ void sas_scsi_recover_host(struct Scsi_Host *shost)
 
         spin_lock_irqsave(shost->host_lock, flags);
         list_splice_init(&shost->eh_cmd_q, &eh_work_q);
+        shost->host_eh_scheduled = 0;
         spin_unlock_irqrestore(shost->host_lock, flags);
 
         SAS_DPRINTK("Enter %s\n", __func__);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index b2a817055b8b..9ead0399808a 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -2176,9 +2176,9 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
                 /* adjust hba_queue_depth, reply_free_queue_depth,
                  * and queue_size
                  */
-                ioc->hba_queue_depth -= queue_diff;
-                ioc->reply_free_queue_depth -= queue_diff;
-                queue_size -= queue_diff;
+                ioc->hba_queue_depth -= (queue_diff / 2);
+                ioc->reply_free_queue_depth -= (queue_diff / 2);
+                queue_size = facts->MaxReplyDescriptorPostQueueDepth;
         }
         ioc->reply_post_queue_depth = queue_size;
 
@@ -3941,6 +3941,8 @@ mpt2sas_base_detach(struct MPT2SAS_ADAPTER *ioc)
 static void
 _base_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
 {
+        mpt2sas_scsih_reset_handler(ioc, reset_phase);
+        mpt2sas_ctl_reset_handler(ioc, reset_phase);
         switch (reset_phase) {
         case MPT2_IOC_PRE_RESET:
                 dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: "
@@ -3971,8 +3973,6 @@ _base_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
                     "MPT2_IOC_DONE_RESET\n", ioc->name, __func__));
                 break;
         }
-        mpt2sas_scsih_reset_handler(ioc, reset_phase);
-        mpt2sas_ctl_reset_handler(ioc, reset_phase);
 }
 
 /**
@@ -4026,6 +4026,7 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
 {
         int r;
         unsigned long flags;
+        u8 pe_complete = ioc->wait_for_port_enable_to_complete;
 
         dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter\n", ioc->name,
             __func__));
@@ -4068,6 +4069,14 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
         if (r)
                 goto out;
         _base_reset_handler(ioc, MPT2_IOC_AFTER_RESET);
+
+        /* If this hard reset is called while port enable is active, then
+         * there is no reason to call make_ioc_operational
+         */
+        if (pe_complete) {
+                r = -EFAULT;
+                goto out;
+        }
         r = _base_make_ioc_operational(ioc, sleep_flag);
         if (!r)
                 _base_reset_handler(ioc, MPT2_IOC_DONE_RESET);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index eda347c57979..5ded3db6e316 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -819,7 +819,7 @@ _scsih_is_end_device(u32 device_info)
 }
 
 /**
- * mptscsih_get_scsi_lookup - returns scmd entry
+ * _scsih_scsi_lookup_get - returns scmd entry
  * @ioc: per adapter object
  * @smid: system request message index
  *
@@ -832,6 +832,28 @@ _scsih_scsi_lookup_get(struct MPT2SAS_ADAPTER *ioc, u16 smid)
 }
 
 /**
+ * _scsih_scsi_lookup_get_clear - returns scmd entry
+ * @ioc: per adapter object
+ * @smid: system request message index
+ *
+ * Returns the smid stored scmd pointer.
+ * Then will derefrence the stored scmd pointer.
+ */
+static inline struct scsi_cmnd *
+_scsih_scsi_lookup_get_clear(struct MPT2SAS_ADAPTER *ioc, u16 smid)
+{
+        unsigned long flags;
+        struct scsi_cmnd *scmd;
+
+        spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+        scmd = ioc->scsi_lookup[smid - 1].scmd;
+        ioc->scsi_lookup[smid - 1].scmd = NULL;
+        spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
+
+        return scmd;
+}
+
+/**
  * _scsih_scsi_lookup_find_by_scmd - scmd lookup
  * @ioc: per adapter object
  * @smid: system request message index
@@ -2981,9 +3003,6 @@ _scsih_check_topo_delete_events(struct MPT2SAS_ADAPTER *ioc,
         u16 handle;
 
         for (i = 0 ; i < event_data->NumEntries; i++) {
-                if (event_data->PHY[i].PhyStatus &
-                    MPI2_EVENT_SAS_TOPO_PHYSTATUS_VACANT)
-                        continue;
                 handle = le16_to_cpu(event_data->PHY[i].AttachedDevHandle);
                 if (!handle)
                         continue;
@@ -3210,7 +3229,7 @@ _scsih_flush_running_cmds(struct MPT2SAS_ADAPTER *ioc)
         u16 count = 0;
 
         for (smid = 1; smid <= ioc->scsiio_depth; smid++) {
-                scmd = _scsih_scsi_lookup_get(ioc, smid);
+                scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
                 if (!scmd)
                         continue;
                 count++;
@@ -3804,7 +3823,7 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
         u32 response_code = 0;
 
         mpi_reply = mpt2sas_base_get_reply_virt_addr(ioc, reply);
-        scmd = _scsih_scsi_lookup_get(ioc, smid);
+        scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
         if (scmd == NULL)
                 return 1;
 
@@ -5005,6 +5024,12 @@ _scsih_sas_device_status_change_event(struct MPT2SAS_ADAPTER *ioc,
                      event_data);
 #endif
 
+        /* In MPI Revision K (0xC), the internal device reset complete was
+         * implemented, so avoid setting tm_busy flag for older firmware.
+         */
+        if ((ioc->facts.HeaderVersion >> 8) < 0xC)
+                return;
+
         if (event_data->ReasonCode !=
             MPI2_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET &&
            event_data->ReasonCode !=
@@ -5099,6 +5124,7 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
     struct fw_event_work *fw_event)
 {
         struct scsi_cmnd *scmd;
+        struct scsi_device *sdev;
         u16 smid, handle;
         u32 lun;
         struct MPT2SAS_DEVICE *sas_device_priv_data;
@@ -5109,12 +5135,17 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
         Mpi2EventDataSasBroadcastPrimitive_t *event_data = fw_event->event_data;
 #endif
         u16 ioc_status;
+        unsigned long flags;
+        int r;
+
         dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "broadcast primative: "
             "phy number(%d), width(%d)\n", ioc->name, event_data->PhyNum,
             event_data->PortWidth));
         dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter\n", ioc->name,
             __func__));
 
+        spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+        ioc->broadcast_aen_busy = 0;
         termination_count = 0;
         query_count = 0;
         mpi_reply = ioc->tm_cmds.reply;
@@ -5122,7 +5153,8 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
                 scmd = _scsih_scsi_lookup_get(ioc, smid);
                 if (!scmd)
                         continue;
-                sas_device_priv_data = scmd->device->hostdata;
+                sdev = scmd->device;
+                sas_device_priv_data = sdev->hostdata;
                 if (!sas_device_priv_data || !sas_device_priv_data->sas_target)
                         continue;
                  /* skip hidden raid components */
@@ -5138,6 +5170,7 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
                 lun = sas_device_priv_data->lun;
                 query_count++;
 
+                spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
                 mpt2sas_scsih_issue_tm(ioc, handle, 0, 0, lun,
                     MPI2_SCSITASKMGMT_TASKTYPE_QUERY_TASK, smid, 30, NULL);
                 ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
@@ -5147,14 +5180,20 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
                     (mpi_reply->ResponseCode ==
                      MPI2_SCSITASKMGMT_RSP_TM_SUCCEEDED ||
                      mpi_reply->ResponseCode ==
-                     MPI2_SCSITASKMGMT_RSP_IO_QUEUED_ON_IOC))
+                     MPI2_SCSITASKMGMT_RSP_IO_QUEUED_ON_IOC)) {
+                        spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
                         continue;
-
-                mpt2sas_scsih_issue_tm(ioc, handle, 0, 0, lun,
-                    MPI2_SCSITASKMGMT_TASKTYPE_ABRT_TASK_SET, 0, 30, NULL);
+                }
+                r = mpt2sas_scsih_issue_tm(ioc, handle, sdev->channel, sdev->id,
+                    sdev->lun, MPI2_SCSITASKMGMT_TASKTYPE_ABORT_TASK, smid, 30,
+                    scmd);
+                if (r == FAILED)
+                        sdev_printk(KERN_WARNING, sdev, "task abort: FAILED "
+                            "scmd(%p)\n", scmd);
                 termination_count += le32_to_cpu(mpi_reply->TerminationCount);
+                spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
         }
-        ioc->broadcast_aen_busy = 0;
+        spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
 
         dtmprintk(ioc, printk(MPT2SAS_INFO_FMT
             "%s - exit, query_count = %d termination_count = %d\n",
@@ -6626,6 +6665,7 @@ _scsih_remove(struct pci_dev *pdev)
                 destroy_workqueue(wq);
 
         /* release all the volumes */
+        _scsih_ir_shutdown(ioc);
         list_for_each_entry_safe(raid_device, next, &ioc->raid_device_list,
             list) {
                 if (raid_device->starget) {
diff --git a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c
index 0e298dba9fc8..29b8ab44ea47 100644
--- a/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c
+++ b/drivers/staging/ath6kl/miscdrv/ar3kps/ar3kpsconfig.c
@@ -360,8 +360,8 @@ int PSSendOps(void *arg)
                 status = 1;
                 goto complete;
         }
-        len = (firmware->size > MAX_BDADDR_FORMAT_LENGTH)? MAX_BDADDR_FORMAT_LENGTH: firmware->size;
-        memcpy(config_bdaddr, firmware->data,len);
+        len = min(firmware->size, MAX_BDADDR_FORMAT_LENGTH - 1);
+        memcpy(config_bdaddr, firmware->data, len);
         config_bdaddr[len] = '\0';
         write_bdaddr(hdev,config_bdaddr,BDADDR_TYPE_STRING);
         A_RELEASE_FIRMWARE(firmware);
diff --git a/drivers/staging/brcm80211/sys/wl_mac80211.c b/drivers/staging/brcm80211/sys/wl_mac80211.c
index bdd629d72a75..f1235884cc5d 100644
--- a/drivers/staging/brcm80211/sys/wl_mac80211.c
+++ b/drivers/staging/brcm80211/sys/wl_mac80211.c
@@ -209,11 +209,8 @@ static void wl_ops_stop(struct ieee80211_hw *hw)
         struct wl_info *wl = hw->priv;
         ASSERT(wl);
         WL_LOCK(wl);
-        wl_down(wl);
         ieee80211_stop_queues(hw);
         WL_UNLOCK(wl);
-
-        return;
 }
 
 static int
@@ -246,7 +243,14 @@ wl_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 static void
 wl_ops_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
-        return;
+        struct wl_info *wl;
+
+        wl = HW_TO_WL(hw);
+
+        /* put driver in down state */
+        WL_LOCK(wl);
+        wl_down(wl);
+        WL_UNLOCK(wl);
 }
 
 static int
@@ -779,7 +783,7 @@ static struct wl_info *wl_attach(u16 vendor, u16 device, unsigned long regs,
         wl_found++;
         return wl;
 
- fail:
+fail:
         wl_free(wl);
 fail1:
         return NULL;
@@ -1090,7 +1094,6 @@ wl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         return 0;
 }
 
-#ifdef LINUXSTA_PS
 static int wl_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct wl_info *wl;
@@ -1105,11 +1108,12 @@ static int wl_suspend(struct pci_dev *pdev, pm_message_t state)
                 return -ENODEV;
         }
 
+        /* only need to flag hw is down for proper resume */
         WL_LOCK(wl);
-        wl_down(wl);
         wl->pub->hw_up = false;
         WL_UNLOCK(wl);
-        pci_save_state(pdev, wl->pci_psstate);
+
+        pci_save_state(pdev);
         pci_disable_device(pdev);
         return pci_set_power_state(pdev, PCI_D3hot);
 }
@@ -1133,7 +1137,7 @@ static int wl_resume(struct pci_dev *pdev)
         if (err)
                 return err;
 
-        pci_restore_state(pdev, wl->pci_psstate);
+        pci_restore_state(pdev);
 
         err = pci_enable_device(pdev);
         if (err)
@@ -1145,13 +1149,12 @@ static int wl_resume(struct pci_dev *pdev)
         if ((val & 0x0000ff00) != 0)
                 pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
 
-        WL_LOCK(wl);
-        err = wl_up(wl);
-        WL_UNLOCK(wl);
-
+        /*
+        *  done. driver will be put in up state
+        *  in wl_ops_add_interface() call.
+        */
         return err;
 }
-#endif                          /* LINUXSTA_PS */
 
 static void wl_remove(struct pci_dev *pdev)
 {
@@ -1184,14 +1187,12 @@ static void wl_remove(struct pci_dev *pdev)
 }
 
 static struct pci_driver wl_pci_driver = {
- .name  = "brcm80211",
- .probe = wl_pci_probe,
-#ifdef LINUXSTA_PS
- .suspend = wl_suspend,
- .resume  = wl_resume,
-#endif                          /* LINUXSTA_PS */
- .remove   = __devexit_p(wl_remove),
- .id_table = wl_id_table,
+        .name = "brcm80211",
+        .probe = wl_pci_probe,
+        .suspend = wl_suspend,
+        .resume = wl_resume,
+        .remove = __devexit_p(wl_remove),
+        .id_table = wl_id_table,
 };
 
 /**
diff --git a/drivers/staging/brcm80211/sys/wlc_mac80211.c b/drivers/staging/brcm80211/sys/wlc_mac80211.c
index 1d5d01ac0a9b..a1303863686c 100644
--- a/drivers/staging/brcm80211/sys/wlc_mac80211.c
+++ b/drivers/staging/brcm80211/sys/wlc_mac80211.c
@@ -5126,7 +5126,6 @@ wlc_sendpkt_mac80211(struct wlc_info *wlc, struct sk_buff *sdu,
         fifo = prio2fifo[prio];
 
         ASSERT((uint) skb_headroom(sdu) >= TXOFF);
-        ASSERT(!(sdu->cloned));
         ASSERT(!(sdu->next));
         ASSERT(!(sdu->prev));
         ASSERT(fifo < NFIFO);
diff --git a/drivers/staging/comedi/drivers/ni_labpc.c b/drivers/staging/comedi/drivers/ni_labpc.c
index 4d1868d04bac..0728c3c0cb0e 100644
--- a/drivers/staging/comedi/drivers/ni_labpc.c
+++ b/drivers/staging/comedi/drivers/ni_labpc.c
@@ -575,7 +575,8 @@ int labpc_common_attach(struct comedi_device *dev, unsigned long iobase,
         /* grab our IRQ */
         if (irq) {
                 isr_flags = 0;
-                if (thisboard->bustype == pci_bustype)
+                if (thisboard->bustype == pci_bustype
+                    || thisboard->bustype == pcmcia_bustype)
                         isr_flags |= IRQF_SHARED;
                 if (request_irq(irq, labpc_interrupt, isr_flags,
                                 driver_labpc.driver_name, dev)) {
diff --git a/drivers/staging/hv/blkvsc_drv.c b/drivers/staging/hv/blkvsc_drv.c
index b3d05fcfe6d2..4fb809485d9e 100644
--- a/drivers/staging/hv/blkvsc_drv.c
+++ b/drivers/staging/hv/blkvsc_drv.c
@@ -368,6 +368,7 @@ static int blkvsc_probe(struct device *device)
                 blkdev->gd->first_minor = 0;
         blkdev->gd->fops = &block_ops;
         blkdev->gd->private_data = blkdev;
+        blkdev->gd->driverfs_dev = &(blkdev->device_ctx->device);
         sprintf(blkdev->gd->disk_name, "hd%c", 'a' + devnum);
 
         blkvsc_do_inquiry(blkdev);
diff --git a/drivers/staging/hv/netvsc.c b/drivers/staging/hv/netvsc.c
index df9cd131e953..0edbe7483a4c 100644
--- a/drivers/staging/hv/netvsc.c
+++ b/drivers/staging/hv/netvsc.c
@@ -1279,7 +1279,7 @@ static void netvsc_channel_cb(void *context)
         /* ASSERT(device); */
 
         packet = kzalloc(NETVSC_PACKET_SIZE * sizeof(unsigned char),
-                         GFP_KERNEL);
+                         GFP_ATOMIC);
         if (!packet)
                 return;
         buffer = packet;
diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
index 0147b407512c..54706a16dc0a 100644
--- a/drivers/staging/hv/netvsc_drv.c
+++ b/drivers/staging/hv/netvsc_drv.c
@@ -358,7 +358,6 @@ static int netvsc_probe(struct device *device)
 
         /* Set initial state */
         netif_carrier_off(net);
-        netif_stop_queue(net);
 
         net_device_ctx = netdev_priv(net);
         net_device_ctx->device_ctx = device_ctx;
diff --git a/drivers/staging/iio/adc/ad7476_core.c b/drivers/staging/iio/adc/ad7476_core.c
index deb68c8a6e18..b8b54da67c63 100644
--- a/drivers/staging/iio/adc/ad7476_core.c
+++ b/drivers/staging/iio/adc/ad7476_core.c
@@ -68,7 +68,7 @@ static ssize_t ad7476_show_scale(struct device *dev,
         /* Corresponds to Vref / 2^(bits) */
         unsigned int scale_uv = (st->int_vref_mv * 1000) >> st->chip_info->bits;
 
-        return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
+        return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
 }
 static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad7476_show_scale, NULL, 0);
 
diff --git a/drivers/staging/iio/adc/ad7887_core.c b/drivers/staging/iio/adc/ad7887_core.c
index 685908995d49..5d85efab658c 100644
--- a/drivers/staging/iio/adc/ad7887_core.c
+++ b/drivers/staging/iio/adc/ad7887_core.c
@@ -68,7 +68,7 @@ static ssize_t ad7887_show_scale(struct device *dev,
         /* Corresponds to Vref / 2^(bits) */
         unsigned int scale_uv = (st->int_vref_mv * 1000) >> st->chip_info->bits;
 
-        return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
+        return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
 }
 static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad7887_show_scale, NULL, 0);
 
diff --git a/drivers/staging/iio/adc/ad799x_core.c b/drivers/staging/iio/adc/ad799x_core.c
index 6309d521a864..89ccf375a188 100644
--- a/drivers/staging/iio/adc/ad799x_core.c
+++ b/drivers/staging/iio/adc/ad799x_core.c
@@ -432,7 +432,7 @@ static ssize_t ad799x_show_scale(struct device *dev,
         /* Corresponds to Vref / 2^(bits) */
         unsigned int scale_uv = (st->int_vref_mv * 1000) >> st->chip_info->bits;
 
-        return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
+        return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
 }
 
 static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad799x_show_scale, NULL, 0);
diff --git a/drivers/staging/iio/dac/ad5446.c b/drivers/staging/iio/dac/ad5446.c
index e3387cd31145..0f87ecac82fc 100644
--- a/drivers/staging/iio/dac/ad5446.c
+++ b/drivers/staging/iio/dac/ad5446.c
@@ -87,7 +87,7 @@ static ssize_t ad5446_show_scale(struct device *dev,
         /* Corresponds to Vref / 2^(bits) */
         unsigned int scale_uv = (st->vref_mv * 1000) >> st->chip_info->bits;
 
-        return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
+        return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
 }
 static IIO_DEVICE_ATTR(out_scale, S_IRUGO, ad5446_show_scale, NULL, 0);
 
diff --git a/drivers/staging/lirc/lirc_zilog.c b/drivers/staging/lirc/lirc_zilog.c
index 3fe5f4160194..0aad0d7a74a3 100644
--- a/drivers/staging/lirc/lirc_zilog.c
+++ b/drivers/staging/lirc/lirc_zilog.c
@@ -495,7 +495,7 @@ static int send_data_block(struct IR_tx *tx, unsigned char *data_block)
 /* send boot data to the IR TX device */
 static int send_boot_data(struct IR_tx *tx)
 {
-        int ret;
+        int ret, i;
         unsigned char buf[4];
 
         /* send the boot block */
@@ -503,7 +503,7 @@ static int send_boot_data(struct IR_tx *tx)
         if (ret != 0)
                 return ret;
 
-        /* kick it off? */
+        /* Hit the go button to activate the new boot data */
         buf[0] = 0x00;
         buf[1] = 0x20;
         ret = i2c_master_send(tx->c, buf, 2);
@@ -511,7 +511,19 @@ static int send_boot_data(struct IR_tx *tx)
                 zilog_error("i2c_master_send failed with %d\n", ret);
                 return ret < 0 ? ret : -EFAULT;
         }
-        ret = i2c_master_send(tx->c, buf, 1);
+
+        /*
+         * Wait for zilog to settle after hitting go post boot block upload.
+         * Without this delay, the HD-PVR and HVR-1950 both return an -EIO
+         * upon attempting to get firmware revision, and tx probe thus fails.
+         */
+        for (i = 0; i < 10; i++) {
+                ret = i2c_master_send(tx->c, buf, 1);
+                if (ret == 1)
+                        break;
+                udelay(100);
+        }
+
         if (ret != 1) {
                 zilog_error("i2c_master_send failed with %d\n", ret);
                 return ret < 0 ? ret : -EFAULT;
@@ -523,8 +535,8 @@ static int send_boot_data(struct IR_tx *tx)
                 zilog_error("i2c_master_recv failed with %d\n", ret);
                 return 0;
         }
-        if (buf[0] != 0x80) {
-                zilog_error("unexpected IR TX response: %02x\n", buf[0]);
+        if ((buf[0] != 0x80) && (buf[0] != 0xa0)) {
+                zilog_error("unexpected IR TX init response: %02x\n", buf[0]);
                 return 0;
         }
         zilog_notify("Zilog/Hauppauge IR blaster firmware version "
@@ -827,7 +839,15 @@ static int send_code(struct IR_tx *tx, unsigned int code, unsigned int key)
                 zilog_error("i2c_master_send failed with %d\n", ret);
                 return ret < 0 ? ret : -EFAULT;
         }
-        ret = i2c_master_send(tx->c, buf, 1);
+
+        /* Give the z8 a moment to process data block */
+        for (i = 0; i < 10; i++) {
+                ret = i2c_master_send(tx->c, buf, 1);
+                if (ret == 1)
+                        break;
+                udelay(100);
+        }
+
         if (ret != 1) {
                 zilog_error("i2c_master_send failed with %d\n", ret);
                 return ret < 0 ? ret : -EFAULT;
diff --git a/drivers/staging/msm/msm_fb.c b/drivers/staging/msm/msm_fb.c
index 23fa049b51f2..a2f29d464051 100644
--- a/drivers/staging/msm/msm_fb.c
+++ b/drivers/staging/msm/msm_fb.c
@@ -347,7 +347,7 @@ static int msm_fb_suspend(struct platform_device *pdev, pm_message_t state)
         if ((!mfd) || (mfd->key != MFD_KEY))
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(mfd->fbi, 1);
 
         ret = msm_fb_suspend_sub(mfd);
@@ -358,7 +358,7 @@ static int msm_fb_suspend(struct platform_device *pdev, pm_message_t state)
                 pdev->dev.power.power_state = state;
         }
 
-        release_console_sem();
+        console_unlock();
         return ret;
 }
 #else
@@ -431,11 +431,11 @@ static int msm_fb_resume(struct platform_device *pdev)
         if ((!mfd) || (mfd->key != MFD_KEY))
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
         ret = msm_fb_resume_sub(mfd);
         pdev->dev.power.power_state = PMSG_ON;
         fb_set_suspend(mfd->fbi, 1);
-        release_console_sem();
+        console_unlock();
 
         return ret;
 }
diff --git a/drivers/staging/olpc_dcon/olpc_dcon.c b/drivers/staging/olpc_dcon/olpc_dcon.c
index 9f26dc9408bb..56a283d1a74d 100644
--- a/drivers/staging/olpc_dcon/olpc_dcon.c
+++ b/drivers/staging/olpc_dcon/olpc_dcon.c
@@ -373,17 +373,17 @@ static void dcon_source_switch(struct work_struct *work)
                  *
                  * For now, we just hope..
                  */
-                acquire_console_sem();
+                console_lock();
                 ignore_fb_events = 1;
                 if (fb_blank(fbinfo, FB_BLANK_UNBLANK)) {
                         ignore_fb_events = 0;
-                        release_console_sem();
+                        console_unlock();
                         printk(KERN_ERR "olpc-dcon:  Failed to enter CPU mode\n");
                         dcon_pending = DCON_SOURCE_DCON;
                         return;
                 }
                 ignore_fb_events = 0;
-                release_console_sem();
+                console_unlock();
 
                 /* And turn off the DCON */
                 pdata->set_dconload(1);
@@ -435,12 +435,12 @@ static void dcon_source_switch(struct work_struct *work)
                         }
                 }
 
-                acquire_console_sem();
+                console_lock();
                 ignore_fb_events = 1;
                 if (fb_blank(fbinfo, FB_BLANK_POWERDOWN))
                         printk(KERN_ERR "olpc-dcon:  couldn't blank fb!\n");
                 ignore_fb_events = 0;
-                release_console_sem();
+                console_unlock();
 
                 printk(KERN_INFO "olpc-dcon: The DCON has control\n");
                 break;
diff --git a/drivers/staging/rt2860/rt_main_dev.c b/drivers/staging/rt2860/rt_main_dev.c
index 701561d6b6fd..236dd36d349a 100644
--- a/drivers/staging/rt2860/rt_main_dev.c
+++ b/drivers/staging/rt2860/rt_main_dev.c
@@ -484,8 +484,6 @@ struct net_device *RtmpPhyNetDevInit(struct rt_rtmp_adapter *pAd,
         net_dev->ml_priv = (void *)pAd;
         pAd->net_dev = net_dev;
 
-        netif_stop_queue(net_dev);
-
         return net_dev;
 
 }
diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
index ee68d51caa4e..322bf49ee906 100644
--- a/drivers/staging/rt2860/usb_main_dev.c
+++ b/drivers/staging/rt2860/usb_main_dev.c
@@ -106,6 +106,7 @@ struct usb_device_id rtusb_usb_id[] = {
         {USB_DEVICE(0x0411, 0x016f)},   /* MelCo.,Inc. WLI-UC-G301N */
         {USB_DEVICE(0x1737, 0x0070)},   /* Linksys WUSB100 */
         {USB_DEVICE(0x1737, 0x0071)},   /* Linksys WUSB600N */
+        {USB_DEVICE(0x1737, 0x0078)},   /* Linksys WUSB100v2 */
         {USB_DEVICE(0x0411, 0x00e8)},   /* Buffalo WLI-UC-G300N */
         {USB_DEVICE(0x050d, 0x815c)},   /* Belkin F5D8053 */
         {USB_DEVICE(0x100D, 0x9031)},   /* Motorola 2770 */
diff --git a/drivers/staging/rtl8712/hal_init.c b/drivers/staging/rtl8712/hal_init.c
index 32088a641eba..84be383abec3 100644
--- a/drivers/staging/rtl8712/hal_init.c
+++ b/drivers/staging/rtl8712/hal_init.c
@@ -128,12 +128,13 @@ static u8 rtl8712_dl_fw(struct _adapter *padapter)
         u8 *ptmpchar = NULL, *ppayload, *ptr;
         struct tx_desc *ptx_desc;
         u32 txdscp_sz = sizeof(struct tx_desc);
+        u8 ret = _FAIL;
 
         ulfilelength = rtl871x_open_fw(padapter, &phfwfile_hdl, &pmappedfw);
         if (pmappedfw && (ulfilelength > 0)) {
                 update_fwhdr(&fwhdr, pmappedfw);
                 if (chk_fwhdr(&fwhdr, ulfilelength) == _FAIL)
-                        goto exit_fail;
+                        goto firmware_rel;
                 fill_fwpriv(padapter, &fwhdr.fwpriv);
                 /* firmware check ok */
                 maxlen = (fwhdr.img_IMEM_size > fwhdr.img_SRAM_size) ?
@@ -141,7 +142,7 @@ static u8 rtl8712_dl_fw(struct _adapter *padapter)
                 maxlen += txdscp_sz;
                 ptmpchar = _malloc(maxlen + FWBUFF_ALIGN_SZ);
                 if (ptmpchar == NULL)
-                        return _FAIL;
+                        goto firmware_rel;
 
                 ptx_desc = (struct tx_desc *)(ptmpchar + FWBUFF_ALIGN_SZ -
                             ((addr_t)(ptmpchar) & (FWBUFF_ALIGN_SZ - 1)));
@@ -273,11 +274,13 @@ static u8 rtl8712_dl_fw(struct _adapter *padapter)
                         goto exit_fail;
         } else
                 goto exit_fail;
-        return _SUCCESS;
+        ret = _SUCCESS;
 
 exit_fail:
         kfree(ptmpchar);
-        return _FAIL;
+firmware_rel:
+        release_firmware((struct firmware *)phfwfile_hdl);
+        return ret;
 }
 
 uint rtl8712_hal_init(struct _adapter *padapter)
diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
index a692ee88b9e9..21ce2af447b5 100644
--- a/drivers/staging/rtl8712/usb_intf.c
+++ b/drivers/staging/rtl8712/usb_intf.c
@@ -47,54 +47,123 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
 static void r871xu_dev_remove(struct usb_interface *pusb_intf);
 
 static struct usb_device_id rtl871x_usb_id_tbl[] = {
-        /*92SU
-         * Realtek */
-        {USB_DEVICE(0x0bda, 0x8171)},
-        {USB_DEVICE(0x0bda, 0x8172)},
+
+/* RTL8188SU */
+        /* Realtek */
+        {USB_DEVICE(0x0BDA, 0x8171)},
         {USB_DEVICE(0x0bda, 0x8173)},
-        {USB_DEVICE(0x0bda, 0x8174)},
         {USB_DEVICE(0x0bda, 0x8712)},
         {USB_DEVICE(0x0bda, 0x8713)},
         {USB_DEVICE(0x0bda, 0xC512)},
-        /* Abocom  */
+        /* Abocom */
         {USB_DEVICE(0x07B8, 0x8188)},
+        /* ASUS */
+        {USB_DEVICE(0x0B05, 0x1786)},
+        {USB_DEVICE(0x0B05, 0x1791)}, /* 11n mode disable */
+        /* Belkin */
+        {USB_DEVICE(0x050D, 0x945A)},
         /* Corega */
-        {USB_DEVICE(0x07aa, 0x0047)},
-        /* Dlink */
-        {USB_DEVICE(0x07d1, 0x3303)},
-        {USB_DEVICE(0x07d1, 0x3302)},
-        {USB_DEVICE(0x07d1, 0x3300)},
-        /* Dlink for Skyworth */
-        {USB_DEVICE(0x14b2, 0x3300)},
-        {USB_DEVICE(0x14b2, 0x3301)},
-        {USB_DEVICE(0x14b2, 0x3302)},
+        {USB_DEVICE(0x07AA, 0x0047)},
+        /* D-Link */
+        {USB_DEVICE(0x2001, 0x3306)},
+        {USB_DEVICE(0x07D1, 0x3306)}, /* 11n mode disable */
+        /* Edimax */
+        {USB_DEVICE(0x7392, 0x7611)},
         /* EnGenius */
         {USB_DEVICE(0x1740, 0x9603)},
-        {USB_DEVICE(0x1740, 0x9605)},
+        /* Hawking */
+        {USB_DEVICE(0x0E66, 0x0016)},
+        /* Hercules */
+        {USB_DEVICE(0x06F8, 0xE034)},
+        {USB_DEVICE(0x06F8, 0xE032)},
+        /* Logitec */
+        {USB_DEVICE(0x0789, 0x0167)},
+        /* PCI */
+        {USB_DEVICE(0x2019, 0xAB28)},
+        {USB_DEVICE(0x2019, 0xED16)},
+        /* Sitecom */
+        {USB_DEVICE(0x0DF6, 0x0057)},
+        {USB_DEVICE(0x0DF6, 0x0045)},
+        {USB_DEVICE(0x0DF6, 0x0059)}, /* 11n mode disable */
+        {USB_DEVICE(0x0DF6, 0x004B)},
+        {USB_DEVICE(0x0DF6, 0x0063)},
+        /* Sweex */
+        {USB_DEVICE(0x177F, 0x0154)},
+        /* Thinkware */
+        {USB_DEVICE(0x0BDA, 0x5077)},
+        /* Toshiba */
+        {USB_DEVICE(0x1690, 0x0752)},
+        /* - */
+        {USB_DEVICE(0x20F4, 0x646B)},
+        {USB_DEVICE(0x083A, 0xC512)},
+
+/* RTL8191SU */
+        /* Realtek */
+        {USB_DEVICE(0x0BDA, 0x8172)},
+        /* Amigo */
+        {USB_DEVICE(0x0EB0, 0x9061)},
+        /* ASUS/EKB */
+        {USB_DEVICE(0x0BDA, 0x8172)},
+        {USB_DEVICE(0x13D3, 0x3323)},
+        {USB_DEVICE(0x13D3, 0x3311)}, /* 11n mode disable */
+        {USB_DEVICE(0x13D3, 0x3342)},
+        /* ASUS/EKBLenovo */
+        {USB_DEVICE(0x13D3, 0x3333)},
+        {USB_DEVICE(0x13D3, 0x3334)},
+        {USB_DEVICE(0x13D3, 0x3335)}, /* 11n mode disable */
+        {USB_DEVICE(0x13D3, 0x3336)}, /* 11n mode disable */
+        /* ASUS/Media BOX */
+        {USB_DEVICE(0x13D3, 0x3309)},
         /* Belkin */
-        {USB_DEVICE(0x050d, 0x815F)},
-        {USB_DEVICE(0x050d, 0x945A)},
-        {USB_DEVICE(0x050d, 0x845A)},
-        /* Guillemot */
-        {USB_DEVICE(0x06f8, 0xe031)},
+        {USB_DEVICE(0x050D, 0x815F)},
+        /* D-Link */
+        {USB_DEVICE(0x07D1, 0x3302)},
+        {USB_DEVICE(0x07D1, 0x3300)},
+        {USB_DEVICE(0x07D1, 0x3303)},
         /* Edimax */
-        {USB_DEVICE(0x7392, 0x7611)},
         {USB_DEVICE(0x7392, 0x7612)},
-        {USB_DEVICE(0x7392, 0x7622)},
-        /* Sitecom */
-        {USB_DEVICE(0x0DF6, 0x0045)},
+        /* EnGenius */
+        {USB_DEVICE(0x1740, 0x9605)},
+        /* Guillemot */
+        {USB_DEVICE(0x06F8, 0xE031)},
         /* Hawking */
         {USB_DEVICE(0x0E66, 0x0015)},
-        {USB_DEVICE(0x0E66, 0x0016)},
-        {USB_DEVICE(0x0b05, 0x1786)},
-        {USB_DEVICE(0x0b05, 0x1791)},    /* 11n mode disable */
-
+        /* Mediao */
         {USB_DEVICE(0x13D3, 0x3306)},
-        {USB_DEVICE(0x13D3, 0x3309)},
+        /* PCI */
+        {USB_DEVICE(0x2019, 0xED18)},
+        {USB_DEVICE(0x2019, 0x4901)},
+        /* Sitecom */
+        {USB_DEVICE(0x0DF6, 0x0058)},
+        {USB_DEVICE(0x0DF6, 0x0049)},
+        {USB_DEVICE(0x0DF6, 0x004C)},
+        {USB_DEVICE(0x0DF6, 0x0064)},
+        /* Skyworth */
+        {USB_DEVICE(0x14b2, 0x3300)},
+        {USB_DEVICE(0x14b2, 0x3301)},
+        {USB_DEVICE(0x14B2, 0x3302)},
+        /* - */
+        {USB_DEVICE(0x04F2, 0xAFF2)},
+        {USB_DEVICE(0x04F2, 0xAFF5)},
+        {USB_DEVICE(0x04F2, 0xAFF6)},
+        {USB_DEVICE(0x13D3, 0x3339)},
+        {USB_DEVICE(0x13D3, 0x3340)}, /* 11n mode disable */
+        {USB_DEVICE(0x13D3, 0x3341)}, /* 11n mode disable */
         {USB_DEVICE(0x13D3, 0x3310)},
-        {USB_DEVICE(0x13D3, 0x3311)},    /* 11n mode disable */
         {USB_DEVICE(0x13D3, 0x3325)},
-        {USB_DEVICE(0x083A, 0xC512)},
+
+/* RTL8192SU */
+        /* Realtek */
+        {USB_DEVICE(0x0BDA, 0x8174)},
+        {USB_DEVICE(0x0BDA, 0x8174)},
+        /* Belkin */
+        {USB_DEVICE(0x050D, 0x845A)},
+        /* Corega */
+        {USB_DEVICE(0x07AA, 0x0051)},
+        /* Edimax */
+        {USB_DEVICE(0x7392, 0x7622)},
+        /* NEC */
+        {USB_DEVICE(0x0409, 0x02B6)},
         {}
 };
 
@@ -103,8 +172,20 @@ MODULE_DEVICE_TABLE(usb, rtl871x_usb_id_tbl);
 static struct specific_device_id specific_device_id_tbl[] = {
         {.idVendor = 0x0b05, .idProduct = 0x1791,
                  .flags = SPEC_DEV_ID_DISABLE_HT},
+        {.idVendor = 0x0df6, .idProduct = 0x0059,
+                 .flags = SPEC_DEV_ID_DISABLE_HT},
+        {.idVendor = 0x13d3, .idProduct = 0x3306,
+                 .flags = SPEC_DEV_ID_DISABLE_HT},
         {.idVendor = 0x13D3, .idProduct = 0x3311,
                  .flags = SPEC_DEV_ID_DISABLE_HT},
+        {.idVendor = 0x13d3, .idProduct = 0x3335,
+                 .flags = SPEC_DEV_ID_DISABLE_HT},
+        {.idVendor = 0x13d3, .idProduct = 0x3336,
+                 .flags = SPEC_DEV_ID_DISABLE_HT},
+        {.idVendor = 0x13d3, .idProduct = 0x3340,
+                 .flags = SPEC_DEV_ID_DISABLE_HT},
+        {.idVendor = 0x13d3, .idProduct = 0x3341,
+                 .flags = SPEC_DEV_ID_DISABLE_HT},
         {}
 };
 
diff --git a/drivers/staging/sm7xx/smtcfb.c b/drivers/staging/sm7xx/smtcfb.c
index 0bc113c44d39..d007e4a12c14 100644
--- a/drivers/staging/sm7xx/smtcfb.c
+++ b/drivers/staging/sm7xx/smtcfb.c
@@ -1044,9 +1044,9 @@ static int __maybe_unused smtcfb_suspend(struct pci_dev *pdev, pm_message_t msg)
 
         /* when doing suspend, call fb apis and pci apis */
         if (msg.event == PM_EVENT_SUSPEND) {
-                acquire_console_sem();
+                console_lock();
                 fb_set_suspend(&sfb->fb, 1);
-                release_console_sem();
+                console_unlock();
                 retv = pci_save_state(pdev);
                 pci_disable_device(pdev);
                 retv = pci_choose_state(pdev, msg);
@@ -1105,9 +1105,9 @@ static int __maybe_unused smtcfb_resume(struct pci_dev *pdev)
 
         smtcfb_setmode(sfb);
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(&sfb->fb, 0);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/staging/speakup/kobjects.c b/drivers/staging/speakup/kobjects.c
index 408bb9b3303e..07a7f5432597 100644
--- a/drivers/staging/speakup/kobjects.c
+++ b/drivers/staging/speakup/kobjects.c
@@ -332,7 +332,7 @@ static ssize_t silent_store(struct kobject *kobj, struct kobj_attribute *attr,
         unsigned long flags;
 
         len = strlen(buf);
-        if (len > 0 || len < 3) {
+        if (len > 0 && len < 3) {
                 ch = buf[0];
                 if (ch == '\n')
                         ch = '0';
diff --git a/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c b/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c
index e8f047e86a32..80183a7e6624 100644
--- a/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c
+++ b/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c
@@ -986,12 +986,6 @@ static int __devinit synaptics_rmi4_probe
         input_set_abs_params(rmi4_data->input_dev, ABS_MT_TOUCH_MAJOR, 0,
                                                 MAX_TOUCH_MAJOR, 0, 0);
 
-        retval = input_register_device(rmi4_data->input_dev);
-        if (retval) {
-                dev_err(&client->dev, "%s:input register failed\n", __func__);
-                goto err_input_register;
-        }
-
         /* Clear interrupts */
         synaptics_rmi4_i2c_block_read(rmi4_data,
                         rmi4_data->fn01_data_base_addr + 1, intr_status,
@@ -1003,15 +997,20 @@ static int __devinit synaptics_rmi4_probe
         if (retval) {
                 dev_err(&client->dev, "%s:Unable to get attn irq %d\n",
                                 __func__, platformdata->irq_number);
-                goto err_request_irq;
+                goto err_unset_clientdata;
+        }
+
+        retval = input_register_device(rmi4_data->input_dev);
+        if (retval) {
+                dev_err(&client->dev, "%s:input register failed\n", __func__);
+                goto err_free_irq;
         }
 
         return retval;
 
-err_request_irq:
+err_free_irq:
         free_irq(platformdata->irq_number, rmi4_data);
-        input_unregister_device(rmi4_data->input_dev);
-err_input_register:
+err_unset_clientdata:
         i2c_set_clientdata(client, NULL);
 err_query_dev:
         if (platformdata->regulator_en) {
diff --git a/drivers/staging/tidspbridge/core/io_sm.c b/drivers/staging/tidspbridge/core/io_sm.c
index 571864555ddd..27e0aa81a584 100644
--- a/drivers/staging/tidspbridge/core/io_sm.c
+++ b/drivers/staging/tidspbridge/core/io_sm.c
@@ -949,7 +949,7 @@ func_end:
  *      Calls the Bridge's CHNL_ISR to determine if this interrupt is ours, then
  *      schedules a DPC to dispatch I/O.
  */
-void io_mbox_msg(u32 msg)
+int io_mbox_msg(struct notifier_block *self, unsigned long len, void *msg)
 {
         struct io_mgr *pio_mgr;
         struct dev_object *dev_obj;
@@ -959,9 +959,9 @@ void io_mbox_msg(u32 msg)
         dev_get_io_mgr(dev_obj, &pio_mgr);
 
         if (!pio_mgr)
-                return;
+                return NOTIFY_BAD;
 
-        pio_mgr->intr_val = (u16)msg;
+        pio_mgr->intr_val = (u16)((u32)msg);
         if (pio_mgr->intr_val & MBX_PM_CLASS)
                 io_dispatch_pm(pio_mgr);
 
@@ -973,7 +973,7 @@ void io_mbox_msg(u32 msg)
                 spin_unlock_irqrestore(&pio_mgr->dpc_lock, flags);
                 tasklet_schedule(&pio_mgr->dpc_tasklet);
         }
-        return;
+        return NOTIFY_OK;
 }
 
 /*
diff --git a/drivers/staging/tidspbridge/core/tiomap3430.c b/drivers/staging/tidspbridge/core/tiomap3430.c
index a3b0a183d570..a3f69f6f505f 100644
--- a/drivers/staging/tidspbridge/core/tiomap3430.c
+++ b/drivers/staging/tidspbridge/core/tiomap3430.c
@@ -223,6 +223,10 @@ static struct bridge_drv_interface drv_interface_fxns = {
         bridge_msg_set_queue_id,
 };
 
+static struct notifier_block dsp_mbox_notifier = {
+        .notifier_call = io_mbox_msg,
+};
+
 static inline void flush_all(struct bridge_dev_context *dev_context)
 {
         if (dev_context->dw_brd_state == BRD_DSP_HIBERNATION ||
@@ -553,7 +557,7 @@ static int bridge_brd_start(struct bridge_dev_context *dev_ctxt,
                  * Enable Mailbox events and also drain any pending
                  * stale messages.
                  */
-                dev_context->mbox = omap_mbox_get("dsp");
+                dev_context->mbox = omap_mbox_get("dsp", &dsp_mbox_notifier);
                 if (IS_ERR(dev_context->mbox)) {
                         dev_context->mbox = NULL;
                         pr_err("%s: Failed to get dsp mailbox handle\n",
@@ -563,8 +567,6 @@ static int bridge_brd_start(struct bridge_dev_context *dev_ctxt,
 
         }
         if (!status) {
-                dev_context->mbox->rxq->callback = (int (*)(void *))io_mbox_msg;
-
 /*PM_IVA2GRPSEL_PER = 0xC0;*/
                 temp = readl(resources->dw_per_pm_base + 0xA8);
                 temp = (temp & 0xFFFFFF30) | 0xC0;
@@ -685,7 +687,7 @@ static int bridge_brd_stop(struct bridge_dev_context *dev_ctxt)
         /* Disable the mailbox interrupts */
         if (dev_context->mbox) {
                 omap_mbox_disable_irq(dev_context->mbox, IRQ_RX);
-                omap_mbox_put(dev_context->mbox);
+                omap_mbox_put(dev_context->mbox, &dsp_mbox_notifier);
                 dev_context->mbox = NULL;
         }
         /* Reset IVA2 clocks*/
@@ -786,10 +788,7 @@ static int bridge_dev_create(struct bridge_dev_context
 
         pt_attrs = kzalloc(sizeof(struct pg_table_attrs), GFP_KERNEL);
         if (pt_attrs != NULL) {
-                /* Assuming that we use only DSP's memory map
-                 * until 0x4000:0000 , we would need only 1024
-                 * L1 enties i.e L1 size = 4K */
-                pt_attrs->l1_size = 0x1000;
+                pt_attrs->l1_size = SZ_16K; /* 4096 entries of 32 bits */
                 align_size = pt_attrs->l1_size;
                 /* Align sizes are expected to be power of 2 */
                 /* we like to get aligned on L1 table size */
diff --git a/drivers/staging/tidspbridge/include/dspbridge/io_sm.h b/drivers/staging/tidspbridge/include/dspbridge/io_sm.h
index 18aec55d8647..8242c70e09dd 100644
--- a/drivers/staging/tidspbridge/include/dspbridge/io_sm.h
+++ b/drivers/staging/tidspbridge/include/dspbridge/io_sm.h
@@ -72,22 +72,17 @@ extern void io_dpc(unsigned long ref_data);
 /*
  *  ======== io_mbox_msg ========
  *  Purpose:
- *      Main interrupt handler for the shared memory Bridge channel manager.
- *      Calls the Bridge's chnlsm_isr to determine if this interrupt is ours,
- *      then schedules a DPC to dispatch I/O.
+ *      Main message handler for the shared memory Bridge channel manager.
+ *      Determine if this message is ours, then schedules a DPC to
+ *      dispatch I/O.
  *  Parameters:
- *      ref_data:   Pointer to the channel manager object for this board.
- *                  Set in an initial call to ISR_Install().
+ *      self:   Pointer to its own notifier_block struct.
+ *      len:    Length of message.
+ *      msg:    Message code received.
  *  Returns:
- *      TRUE if interrupt handled; FALSE otherwise.
- *  Requires:
- *      Must be in locked memory if executing in kernel mode.
- *      Must only call functions which are in locked memory if Kernel mode.
- *      Must only call asynchronous services.
- *      Interrupts are disabled and EOI for this interrupt has been sent.
- *  Ensures:
+ *      NOTIFY_OK if handled; NOTIFY_BAD otherwise.
  */
-void io_mbox_msg(u32 msg);
+int io_mbox_msg(struct notifier_block *self, unsigned long len, void *msg);
 
 /*
  *  ======== io_request_chnl ========
diff --git a/drivers/staging/usbip/stub.h b/drivers/staging/usbip/stub.h
index 30dbfb6d16f2..d73267961ef4 100644
--- a/drivers/staging/usbip/stub.h
+++ b/drivers/staging/usbip/stub.h
@@ -32,6 +32,7 @@
 
 struct stub_device {
         struct usb_interface *interface;
+        struct usb_device *udev;
         struct list_head list;
 
         struct usbip_device ud;
diff --git a/drivers/staging/usbip/stub_dev.c b/drivers/staging/usbip/stub_dev.c
index b186b5fed2b9..a7ce51cc8909 100644
--- a/drivers/staging/usbip/stub_dev.c
+++ b/drivers/staging/usbip/stub_dev.c
@@ -258,10 +258,11 @@ static void stub_shutdown_connection(struct usbip_device *ud)
 static void stub_device_reset(struct usbip_device *ud)
 {
         struct stub_device *sdev = container_of(ud, struct stub_device, ud);
-        struct usb_device *udev = interface_to_usbdev(sdev->interface);
+        struct usb_device *udev = sdev->udev;
         int ret;
 
         usbip_udbg("device reset");
+
         ret = usb_lock_device_for_reset(udev, sdev->interface);
         if (ret < 0) {
                 dev_err(&udev->dev, "lock for reset\n");
@@ -309,7 +310,8 @@ static void stub_device_unusable(struct usbip_device *ud)
  *
  * Allocates and initializes a new stub_device struct.
  */
-static struct stub_device *stub_device_alloc(struct usb_interface *interface)
+static struct stub_device *stub_device_alloc(struct usb_device *udev,
+                                             struct usb_interface *interface)
 {
         struct stub_device *sdev;
         int busnum = interface_to_busnum(interface);
@@ -324,7 +326,8 @@ static struct stub_device *stub_device_alloc(struct usb_interface *interface)
                 return NULL;
         }
 
-        sdev->interface = interface;
+        sdev->interface = usb_get_intf(interface);
+        sdev->udev = usb_get_dev(udev);
 
         /*
          * devid is defined with devnum when this driver is first allocated.
@@ -450,11 +453,12 @@ static int stub_probe(struct usb_interface *interface,
                         return err;
                 }
 
+                usb_get_intf(interface);
                 return 0;
         }
 
         /* ok. this is my device. */
-        sdev = stub_device_alloc(interface);
+        sdev = stub_device_alloc(udev, interface);
         if (!sdev)
                 return -ENOMEM;
 
@@ -476,6 +480,8 @@ static int stub_probe(struct usb_interface *interface,
                 dev_err(&interface->dev, "create sysfs files for %s\n",
                         udev_busid);
                 usb_set_intfdata(interface, NULL);
+                usb_put_intf(interface);
+
                 busid_priv->interf_count = 0;
 
                 busid_priv->sdev = NULL;
@@ -545,6 +551,7 @@ static void stub_disconnect(struct usb_interface *interface)
         if (busid_priv->interf_count > 1) {
                 busid_priv->interf_count--;
                 shutdown_busid(busid_priv);
+                usb_put_intf(interface);
                 return;
         }
 
@@ -554,6 +561,9 @@ static void stub_disconnect(struct usb_interface *interface)
         /* 1. shutdown the current connection */
         shutdown_busid(busid_priv);
 
+        usb_put_dev(sdev->udev);
+        usb_put_intf(interface);
+
         /* 3. free sdev */
         busid_priv->sdev = NULL;
         stub_device_free(sdev);
diff --git a/drivers/staging/usbip/stub_rx.c b/drivers/staging/usbip/stub_rx.c
index 3de6fd2539dc..ae6ac82754a4 100644
--- a/drivers/staging/usbip/stub_rx.c
+++ b/drivers/staging/usbip/stub_rx.c
@@ -364,7 +364,7 @@ static struct stub_priv *stub_priv_alloc(struct stub_device *sdev,
 
 static int get_pipe(struct stub_device *sdev, int epnum, int dir)
 {
-        struct usb_device *udev = interface_to_usbdev(sdev->interface);
+        struct usb_device *udev = sdev->udev;
         struct usb_host_endpoint *ep;
         struct usb_endpoint_descriptor *epd = NULL;
 
@@ -484,7 +484,7 @@ static void stub_recv_cmd_submit(struct stub_device *sdev,
         int ret;
         struct stub_priv *priv;
         struct usbip_device *ud = &sdev->ud;
-        struct usb_device *udev = interface_to_usbdev(sdev->interface);
+        struct usb_device *udev = sdev->udev;
         int pipe = get_pipe(sdev, pdu->base.ep, pdu->base.direction);
 
 
diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
index 41a1fe5138f4..afc3b1a71881 100644
--- a/drivers/staging/usbip/vhci.h
+++ b/drivers/staging/usbip/vhci.h
@@ -100,9 +100,6 @@ struct vhci_hcd {
          * But, the index of this array begins from 0.
          */
         struct vhci_device vdev[VHCI_NPORTS];
-
-        /* vhci_device which has not been assiged its address yet */
-        int pending_port;
 };
 
 
@@ -119,6 +116,9 @@ void rh_port_disconnect(int rhport);
 void vhci_rx_loop(struct usbip_task *ut);
 void vhci_tx_loop(struct usbip_task *ut);
 
+struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,
+                                            __u32 seqnum);
+
 #define hardware                (&the_controller->pdev.dev)
 
 static inline struct vhci_device *port_to_vdev(__u32 port)
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
index 08bd26a245d5..a35fe61268de 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -138,8 +138,6 @@ void rh_port_connect(int rhport, enum usb_device_speed speed)
          * the_controller->vdev[rhport].ud.status = VDEV_CONNECT;
          * spin_unlock(&the_controller->vdev[rhport].ud.lock); */
 
-        the_controller->pending_port = rhport;
-
         spin_unlock_irqrestore(&the_controller->lock, flags);
 
         usb_hcd_poll_rh_status(vhci_to_hcd(the_controller));
@@ -559,6 +557,7 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
         struct device *dev = &urb->dev->dev;
         int ret = 0;
         unsigned long flags;
+        struct vhci_device *vdev;
 
         usbip_dbg_vhci_hc("enter, usb_hcd %p urb %p mem_flags %d\n",
                     hcd, urb, mem_flags);
@@ -574,6 +573,18 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
                 return urb->status;
         }
 
+        vdev = port_to_vdev(urb->dev->portnum-1);
+
+        /* refuse enqueue for dead connection */
+        spin_lock(&vdev->ud.lock);
+        if (vdev->ud.status == VDEV_ST_NULL || vdev->ud.status == VDEV_ST_ERROR) {
+                usbip_uerr("enqueue for inactive port %d\n", vdev->rhport);
+                spin_unlock(&vdev->ud.lock);
+                spin_unlock_irqrestore(&the_controller->lock, flags);
+                return -ENODEV;
+        }
+        spin_unlock(&vdev->ud.lock);
+
         ret = usb_hcd_link_urb_to_ep(hcd, urb);
         if (ret)
                 goto no_need_unlink;
@@ -592,8 +603,6 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
                 __u8 type = usb_pipetype(urb->pipe);
                 struct usb_ctrlrequest *ctrlreq =
                                 (struct usb_ctrlrequest *) urb->setup_packet;
-                struct vhci_device *vdev =
-                                port_to_vdev(the_controller->pending_port);
 
                 if (type != PIPE_CONTROL || !ctrlreq) {
                         dev_err(dev, "invalid request to devnum 0\n");
@@ -607,7 +616,9 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
                         dev_info(dev, "SetAddress Request (%d) to port %d\n",
                                  ctrlreq->wValue, vdev->rhport);
 
-                        vdev->udev = urb->dev;
+                        if (vdev->udev)
+                                usb_put_dev(vdev->udev);
+                        vdev->udev = usb_get_dev(urb->dev);
 
                         spin_lock(&vdev->ud.lock);
                         vdev->ud.status = VDEV_ST_USED;
@@ -627,8 +638,9 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
                                                 "Get_Descriptor to device 0 "
                                                 "(get max pipe size)\n");
 
-                        /* FIXME: reference count? (usb_get_dev()) */
-                        vdev->udev = urb->dev;
+                        if (vdev->udev)
+                                usb_put_dev(vdev->udev);
+                        vdev->udev = usb_get_dev(urb->dev);
                         goto out;
 
                 default:
@@ -805,7 +817,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
         return 0;
 }
 
-
 static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
 {
         struct vhci_unlink *unlink, *tmp;
@@ -813,11 +824,34 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
         spin_lock(&vdev->priv_lock);
 
         list_for_each_entry_safe(unlink, tmp, &vdev->unlink_tx, list) {
+                usbip_uinfo("unlink cleanup tx %lu\n", unlink->unlink_seqnum);
                 list_del(&unlink->list);
                 kfree(unlink);
         }
 
         list_for_each_entry_safe(unlink, tmp, &vdev->unlink_rx, list) {
+                struct urb *urb;
+
+                /* give back URB of unanswered unlink request */
+                usbip_uinfo("unlink cleanup rx %lu\n", unlink->unlink_seqnum);
+
+                urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum);
+                if (!urb) {
+                        usbip_uinfo("the urb (seqnum %lu) was already given back\n",
+                                                        unlink->unlink_seqnum);
+                        list_del(&unlink->list);
+                        kfree(unlink);
+                        continue;
+                }
+
+                urb->status = -ENODEV;
+
+                spin_lock(&the_controller->lock);
+                usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb);
+                spin_unlock(&the_controller->lock);
+
+                usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, urb->status);
+
                 list_del(&unlink->list);
                 kfree(unlink);
         }
@@ -887,6 +921,10 @@ static void vhci_device_reset(struct usbip_device *ud)
         vdev->speed  = 0;
         vdev->devid  = 0;
 
+        if (vdev->udev)
+                usb_put_dev(vdev->udev);
+        vdev->udev = NULL;
+
         ud->tcp_socket = NULL;
 
         ud->status = VDEV_ST_NULL;
diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
index 8147d7202b2d..bf6991470941 100644
--- a/drivers/staging/usbip/vhci_rx.c
+++ b/drivers/staging/usbip/vhci_rx.c
@@ -23,16 +23,14 @@
 #include "vhci.h"
 
 
-/* get URB from transmitted urb queue */
-static struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,
+/* get URB from transmitted urb queue. caller must hold vdev->priv_lock */
+struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,
                                             __u32 seqnum)
 {
         struct vhci_priv *priv, *tmp;
         struct urb *urb = NULL;
         int status;
 
-        spin_lock(&vdev->priv_lock);
-
         list_for_each_entry_safe(priv, tmp, &vdev->priv_rx, list) {
                 if (priv->seqnum == seqnum) {
                         urb = priv->urb;
@@ -63,8 +61,6 @@ static struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev,
                 }
         }
 
-        spin_unlock(&vdev->priv_lock);
-
         return urb;
 }
 
@@ -74,9 +70,11 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
         struct usbip_device *ud = &vdev->ud;
         struct urb *urb;
 
+        spin_lock(&vdev->priv_lock);
 
         urb = pickup_urb_and_free_priv(vdev, pdu->base.seqnum);
 
+        spin_unlock(&vdev->priv_lock);
 
         if (!urb) {
                 usbip_uerr("cannot find a urb of seqnum %u\n",
@@ -161,7 +159,12 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
                 return;
         }
 
+        spin_lock(&vdev->priv_lock);
+
         urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum);
+
+        spin_unlock(&vdev->priv_lock);
+
         if (!urb) {
                 /*
                  * I get the result of a unlink request. But, it seems that I
@@ -190,6 +193,19 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev,
         return;
 }
 
+static int vhci_priv_tx_empty(struct vhci_device *vdev)
+{
+        int empty = 0;
+
+        spin_lock(&vdev->priv_lock);
+
+        empty = list_empty(&vdev->priv_rx);
+
+        spin_unlock(&vdev->priv_lock);
+
+        return empty;
+}
+
 /* recv a pdu */
 static void vhci_rx_pdu(struct usbip_device *ud)
 {
@@ -202,11 +218,29 @@ static void vhci_rx_pdu(struct usbip_device *ud)
 
         memset(&pdu, 0, sizeof(pdu));
 
-
         /* 1. receive a pdu header */
         ret = usbip_xmit(0, ud->tcp_socket, (char *) &pdu, sizeof(pdu), 0);
+        if (ret < 0) {
+                if (ret == -ECONNRESET)
+                        usbip_uinfo("connection reset by peer\n");
+                else if (ret == -EAGAIN) {
+                        /* ignore if connection was idle */
+                        if (vhci_priv_tx_empty(vdev))
+                                return;
+                        usbip_uinfo("connection timed out with pending urbs\n");
+                } else if (ret != -ERESTARTSYS)
+                        usbip_uinfo("xmit failed %d\n", ret);
+
+                usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+                return;
+        }
+        if (ret == 0) {
+                usbip_uinfo("connection closed");
+                usbip_event_add(ud, VDEV_EVENT_DOWN);
+                return;
+        }
         if (ret != sizeof(pdu)) {
-                usbip_uerr("receiving pdu failed! size is %d, should be %d\n",
+                usbip_uerr("received pdu size is %d, should be %d\n",
                                         ret, (unsigned int)sizeof(pdu));
                 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
                 return;
diff --git a/drivers/staging/vme/bridges/Module.symvers b/drivers/staging/vme/bridges/Module.symvers
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/drivers/staging/vme/bridges/Module.symvers
+++ /dev/null
diff --git a/drivers/staging/xgifb/vb_setmode.c b/drivers/staging/xgifb/vb_setmode.c
index 7016fdd2509f..e19b932492e1 100644
--- a/drivers/staging/xgifb/vb_setmode.c
+++ b/drivers/staging/xgifb/vb_setmode.c
@@ -3954,8 +3954,8 @@ void XGI_GetCRT2ResInfo(unsigned short ModeNo, unsigned short ModeIdIndex,
 unsigned char XGI_IsLCDDualLink(struct vb_device_info *pVBInfo)
 {
 
-        if ((((pVBInfo->VBInfo & SetCRT2ToLCD) | SetCRT2ToLCDA))
-                        && (pVBInfo->LCDInfo & SetLCDDualLink)) /* shampoo0129 */
+        if ((pVBInfo->VBInfo & (SetCRT2ToLCD | SetCRT2ToLCDA)) &&
+                        (pVBInfo->LCDInfo & SetLCDDualLink)) /* shampoo0129 */
                 return 1;
 
         return 0;
@@ -8773,7 +8773,7 @@ unsigned short XGI_GetVCLK2Ptr(unsigned short ModeNo,
 
         if (pVBInfo->IF_DEF_LVDS == 0) {
                 CRT2Index = CRT2Index >> 6; /*  for LCD */
-                if (((pVBInfo->VBInfo & SetCRT2ToLCD) | SetCRT2ToLCDA)) { /*301b*/
+                if (pVBInfo->VBInfo & (SetCRT2ToLCD | SetCRT2ToLCDA)) { /*301b*/
                         if (pVBInfo->LCDResInfo != Panel1024x768)
                                 VCLKIndex = LCDXlat2VCLK[CRT2Index];
                         else
diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
index 47d32281032c..52fc0c9a6364 100644
--- a/drivers/tty/n_hdlc.c
+++ b/drivers/tty/n_hdlc.c
@@ -581,8 +581,9 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
                            __u8 __user *buf, size_t nr)
 {
         struct n_hdlc *n_hdlc = tty2n_hdlc(tty);
-        int ret;
+        int ret = 0;
         struct n_hdlc_buf *rbuf;
+        DECLARE_WAITQUEUE(wait, current);
 
         if (debuglevel >= DEBUG_LEVEL_INFO)     
                 printk("%s(%d)n_hdlc_tty_read() called\n",__FILE__,__LINE__);
@@ -598,57 +599,55 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
                 return -EFAULT;
         }
 
-        tty_lock();
+        add_wait_queue(&tty->read_wait, &wait);
 
         for (;;) {
                 if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) {
-                        tty_unlock();
-                        return -EIO;
+                        ret = -EIO;
+                        break;
                 }
+                if (tty_hung_up_p(file))
+                        break;
 
-                n_hdlc = tty2n_hdlc (tty);
-                if (!n_hdlc || n_hdlc->magic != HDLC_MAGIC ||
-                         tty != n_hdlc->tty) {
-                        tty_unlock();
-                        return 0;
-                }
+                set_current_state(TASK_INTERRUPTIBLE);
 
                 rbuf = n_hdlc_buf_get(&n_hdlc->rx_buf_list);
-                if (rbuf)
+                if (rbuf) {
+                        if (rbuf->count > nr) {
+                                /* too large for caller's buffer */
+                                ret = -EOVERFLOW;
+                        } else {
+                                if (copy_to_user(buf, rbuf->buf, rbuf->count))
+                                        ret = -EFAULT;
+                                else
+                                        ret = rbuf->count;
+                        }
+
+                        if (n_hdlc->rx_free_buf_list.count >
+                            DEFAULT_RX_BUF_COUNT)
+                                kfree(rbuf);
+                        else
+                                n_hdlc_buf_put(&n_hdlc->rx_free_buf_list, rbuf);
                         break;
+                }
                         
                 /* no data */
                 if (file->f_flags & O_NONBLOCK) {
-                        tty_unlock();
-                        return -EAGAIN;
+                        ret = -EAGAIN;
+                        break;
                 }
-                        
-                interruptible_sleep_on (&tty->read_wait);
+
+                schedule();
+
                 if (signal_pending(current)) {
-                        tty_unlock();
-                        return -EINTR;
+                        ret = -EINTR;
+                        break;
                 }
         }
-                
-        if (rbuf->count > nr)
-                /* frame too large for caller's buffer (discard frame) */
-                ret = -EOVERFLOW;
-        else {
-                /* Copy the data to the caller's buffer */
-                if (copy_to_user(buf, rbuf->buf, rbuf->count))
-                        ret = -EFAULT;
-                else
-                        ret = rbuf->count;
-        }
-        
-        /* return HDLC buffer to free list unless the free list */
-        /* count has exceeded the default value, in which case the */
-        /* buffer is freed back to the OS to conserve memory */
-        if (n_hdlc->rx_free_buf_list.count > DEFAULT_RX_BUF_COUNT)
-                kfree(rbuf);
-        else    
-                n_hdlc_buf_put(&n_hdlc->rx_free_buf_list,rbuf);
-        tty_unlock();
+
+        remove_wait_queue(&tty->read_wait, &wait);
+        __set_current_state(TASK_RUNNING);
+
         return ret;
         
 }       /* end of n_hdlc_tty_read() */
@@ -691,14 +690,15 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
                 count = maxframe;
         }
         
-        tty_lock();
-
         add_wait_queue(&tty->write_wait, &wait);
-        set_current_state(TASK_INTERRUPTIBLE);
+
+        for (;;) {
+                set_current_state(TASK_INTERRUPTIBLE);
         
-        /* Allocate transmit buffer */
-        /* sleep until transmit buffer available */             
-        while (!(tbuf = n_hdlc_buf_get(&n_hdlc->tx_free_buf_list))) {
+                tbuf = n_hdlc_buf_get(&n_hdlc->tx_free_buf_list);
+                if (tbuf)
+                        break;
+
                 if (file->f_flags & O_NONBLOCK) {
                         error = -EAGAIN;
                         break;
@@ -719,7 +719,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
                 }
         }
 
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
         remove_wait_queue(&tty->write_wait, &wait);
 
         if (!error) {           
@@ -731,7 +731,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
                 n_hdlc_buf_put(&n_hdlc->tx_buf_list,tbuf);
                 n_hdlc_send_frames(n_hdlc,tty);
         }
-        tty_unlock();
+
         return error;
         
 }       /* end of n_hdlc_tty_write() */
diff --git a/drivers/tty/serial/8250.c b/drivers/tty/serial/8250.c
index b25e6e490530..3975df6f7fdb 100644
--- a/drivers/tty/serial/8250.c
+++ b/drivers/tty/serial/8250.c
@@ -236,7 +236,8 @@ static const struct serial8250_config uart_config[] = {
                 .fifo_size      = 128,
                 .tx_loadsz      = 128,
                 .fcr            = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
-                .flags          = UART_CAP_FIFO | UART_CAP_EFR | UART_CAP_SLEEP,
+                /* UART_CAP_EFR breaks billionon CF bluetooth card. */
+                .flags          = UART_CAP_FIFO | UART_CAP_SLEEP,
         },
         [PORT_16654] = {
                 .name           = "ST16654",
diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
index b1682d7f1d8a..2b8334601c8b 100644
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -1518,6 +1518,7 @@ config SERIAL_BCM63XX_CONSOLE
 config SERIAL_GRLIB_GAISLER_APBUART
         tristate "GRLIB APBUART serial support"
         depends on OF
+        select SERIAL_CORE
         ---help---
         Add support for the GRLIB APBUART serial port.
 
diff --git a/drivers/tty/serial/sb1250-duart.c b/drivers/tty/serial/sb1250-duart.c
index a2f2b3254499..602d9845c52f 100644
--- a/drivers/tty/serial/sb1250-duart.c
+++ b/drivers/tty/serial/sb1250-duart.c
@@ -829,7 +829,7 @@ static void __init sbd_probe_duarts(void)
 #ifdef CONFIG_SERIAL_SB1250_DUART_CONSOLE
 /*
  * Serial console stuff.  Very basic, polling driver for doing serial
- * console output.  The console_sem is held by the caller, so we
+ * console output.  The console_lock is held by the caller, so we
  * shouldn't be interrupted for more console activity.
  */
 static void sbd_console_putchar(struct uart_port *uport, int ch)
diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index c556ed9db13d..8e0dd254eb11 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -46,7 +46,7 @@
 #include <asm/irq_regs.h>
 
 /* Whether we react on sysrq keys or just ignore them */
-static int __read_mostly sysrq_enabled = 1;
+static int __read_mostly sysrq_enabled = SYSRQ_DEFAULT_ENABLE;
 static bool __read_mostly sysrq_always_enabled;
 
 static bool sysrq_on(void)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 464d09d97873..0065da4b11c1 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -3256,8 +3256,8 @@ static ssize_t show_cons_active(struct device *dev,
         struct console *c;
         ssize_t count = 0;
 
-        acquire_console_sem();
-        for (c = console_drivers; c; c = c->next) {
+        console_lock();
+        for_each_console(c) {
                 if (!c->device)
                         continue;
                 if (!c->write)
@@ -3271,7 +3271,7 @@ static ssize_t show_cons_active(struct device *dev,
         while (i--)
                 count += sprintf(buf + count, "%s%d%c",
                                  cs[i]->name, cs[i]->index, i ? ' ':'\n');
-        release_console_sem();
+        console_unlock();
 
         return count;
 }
@@ -3306,7 +3306,7 @@ int __init tty_init(void)
         if (IS_ERR(consdev))
                 consdev = NULL;
         else
-                device_create_file(consdev, &dev_attr_active);
+                WARN_ON(device_create_file(consdev, &dev_attr_active) < 0);
 
 #ifdef CONFIG_VT
         vty_init(&console_fops);
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index ebae344ce910..c956ed6c83a3 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -316,9 +316,9 @@ int paste_selection(struct tty_struct *tty)
         /* always called with BTM from vt_ioctl */
         WARN_ON(!tty_locked());
 
-        acquire_console_sem();
+        console_lock();
         poke_blanked_console();
-        release_console_sem();
+        console_unlock();
 
         ld = tty_ldisc_ref(tty);
         if (!ld) {
diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
index eab3a1ff99e4..a672ed192d33 100644
--- a/drivers/tty/vt/vc_screen.c
+++ b/drivers/tty/vt/vc_screen.c
@@ -202,7 +202,7 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
         /* Select the proper current console and verify
          * sanity of the situation under the console lock.
          */
-        acquire_console_sem();
+        console_lock();
 
         attr = (currcons & 128);
         currcons = (currcons & 127);
@@ -336,9 +336,9 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
                  * the pagefault handling code may want to call printk().
                  */
 
-                release_console_sem();
+                console_unlock();
                 ret = copy_to_user(buf, con_buf_start, orig_count);
-                acquire_console_sem();
+                console_lock();
 
                 if (ret) {
                         read += (orig_count - ret);
@@ -354,7 +354,7 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
         if (read)
                 ret = read;
 unlock_out:
-        release_console_sem();
+        console_unlock();
         mutex_unlock(&con_buf_mtx);
         return ret;
 }
@@ -379,7 +379,7 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
         /* Select the proper current console and verify
          * sanity of the situation under the console lock.
          */
-        acquire_console_sem();
+        console_lock();
 
         attr = (currcons & 128);
         currcons = (currcons & 127);
@@ -414,9 +414,9 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
                 /* Temporarily drop the console lock so that we can read
                  * in the write data from userspace safely.
                  */
-                release_console_sem();
+                console_unlock();
                 ret = copy_from_user(con_buf, buf, this_round);
-                acquire_console_sem();
+                console_lock();
 
                 if (ret) {
                         this_round -= ret;
@@ -542,7 +542,7 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
                 vcs_scr_updated(vc);
 
 unlock_out:
-        release_console_sem();
+        console_unlock();
 
         mutex_unlock(&con_buf_mtx);
 
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 76407eca9ab0..147ede3423df 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1003,9 +1003,9 @@ static int vt_resize(struct tty_struct *tty, struct winsize *ws)
         struct vc_data *vc = tty->driver_data;
         int ret;
 
-        acquire_console_sem();
+        console_lock();
         ret = vc_do_resize(tty, vc, ws->ws_col, ws->ws_row);
-        release_console_sem();
+        console_unlock();
         return ret;
 }
 
@@ -1271,7 +1271,7 @@ static void default_attr(struct vc_data *vc)
         vc->vc_color = vc->vc_def_color;
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void csi_m(struct vc_data *vc)
 {
         int i;
@@ -1415,7 +1415,7 @@ int mouse_reporting(void)
         return vc_cons[fg_console].d->vc_report_mouse;
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void set_mode(struct vc_data *vc, int on_off)
 {
         int i;
@@ -1485,7 +1485,7 @@ static void set_mode(struct vc_data *vc, int on_off)
                 }
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void setterm_command(struct vc_data *vc)
 {
         switch(vc->vc_par[0]) {
@@ -1545,7 +1545,7 @@ static void setterm_command(struct vc_data *vc)
         }
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void csi_at(struct vc_data *vc, unsigned int nr)
 {
         if (nr > vc->vc_cols - vc->vc_x)
@@ -1555,7 +1555,7 @@ static void csi_at(struct vc_data *vc, unsigned int nr)
         insert_char(vc, nr);
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void csi_L(struct vc_data *vc, unsigned int nr)
 {
         if (nr > vc->vc_rows - vc->vc_y)
@@ -1566,7 +1566,7 @@ static void csi_L(struct vc_data *vc, unsigned int nr)
         vc->vc_need_wrap = 0;
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void csi_P(struct vc_data *vc, unsigned int nr)
 {
         if (nr > vc->vc_cols - vc->vc_x)
@@ -1576,7 +1576,7 @@ static void csi_P(struct vc_data *vc, unsigned int nr)
         delete_char(vc, nr);
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void csi_M(struct vc_data *vc, unsigned int nr)
 {
         if (nr > vc->vc_rows - vc->vc_y)
@@ -1587,7 +1587,7 @@ static void csi_M(struct vc_data *vc, unsigned int nr)
         vc->vc_need_wrap = 0;
 }
 
-/* console_sem is held (except via vc_init->reset_terminal */
+/* console_lock is held (except via vc_init->reset_terminal */
 static void save_cur(struct vc_data *vc)
 {
         vc->vc_saved_x          = vc->vc_x;
@@ -1603,7 +1603,7 @@ static void save_cur(struct vc_data *vc)
         vc->vc_saved_G1         = vc->vc_G1_charset;
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void restore_cur(struct vc_data *vc)
 {
         gotoxy(vc, vc->vc_saved_x, vc->vc_saved_y);
@@ -1625,7 +1625,7 @@ enum { ESnormal, ESesc, ESsquare, ESgetpars, ESgotpars, ESfunckey,
         EShash, ESsetG0, ESsetG1, ESpercent, ESignore, ESnonstd,
         ESpalette };
 
-/* console_sem is held (except via vc_init()) */
+/* console_lock is held (except via vc_init()) */
 static void reset_terminal(struct vc_data *vc, int do_clear)
 {
         vc->vc_top              = 0;
@@ -1685,7 +1685,7 @@ static void reset_terminal(struct vc_data *vc, int do_clear)
             csi_J(vc, 2);
 }
 
-/* console_sem is held */
+/* console_lock is held */
 static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
 {
         /*
@@ -2119,7 +2119,7 @@ static int is_double_width(uint32_t ucs)
         return bisearch(ucs, double_width, ARRAY_SIZE(double_width) - 1);
 }
 
-/* acquires console_sem */
+/* acquires console_lock */
 static int do_con_write(struct tty_struct *tty, const unsigned char *buf, int count)
 {
 #ifdef VT_BUF_VRAM_ONLY
@@ -2147,11 +2147,11 @@ static int do_con_write(struct tty_struct *tty, const unsigned char *buf, int co
 
         might_sleep();
 
-        acquire_console_sem();
+        console_lock();
         vc = tty->driver_data;
         if (vc == NULL) {
                 printk(KERN_ERR "vt: argh, driver_data is NULL !\n");
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
 
@@ -2159,7 +2159,7 @@ static int do_con_write(struct tty_struct *tty, const unsigned char *buf, int co
         if (!vc_cons_allocated(currcons)) {
             /* could this happen? */
                 printk_once("con_write: tty %d not allocated\n", currcons+1);
-            release_console_sem();
+            console_unlock();
             return 0;
         }
 
@@ -2375,7 +2375,7 @@ rescan_last_byte:
         }
         FLUSH
         console_conditional_schedule();
-        release_console_sem();
+        console_unlock();
         notify_update(vc);
         return n;
 #undef FLUSH
@@ -2388,11 +2388,11 @@ rescan_last_byte:
  * us to do the switches asynchronously (needed when we want
  * to switch due to a keyboard interrupt).  Synchronization
  * with other console code and prevention of re-entrancy is
- * ensured with console_sem.
+ * ensured with console_lock.
  */
 static void console_callback(struct work_struct *ignored)
 {
-        acquire_console_sem();
+        console_lock();
 
         if (want_console >= 0) {
                 if (want_console != fg_console &&
@@ -2422,7 +2422,7 @@ static void console_callback(struct work_struct *ignored)
         }
         notify_update(vc_cons[fg_console].d);
 
-        release_console_sem();
+        console_unlock();
 }
 
 int set_console(int nr)
@@ -2603,7 +2603,7 @@ static struct console vt_console_driver = {
  */
 
 /*
- * Generally a bit racy with respect to console_sem().
+ * Generally a bit racy with respect to console_lock();.
  *
  * There are some functions which don't need it.
  *
@@ -2629,17 +2629,17 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
         switch (type)
         {
                 case TIOCL_SETSEL:
-                        acquire_console_sem();
+                        console_lock();
                         ret = set_selection((struct tiocl_selection __user *)(p+1), tty);
-                        release_console_sem();
+                        console_unlock();
                         break;
                 case TIOCL_PASTESEL:
                         ret = paste_selection(tty);
                         break;
                 case TIOCL_UNBLANKSCREEN:
-                        acquire_console_sem();
+                        console_lock();
                         unblank_screen();
-                        release_console_sem();
+                        console_unlock();
                         break;
                 case TIOCL_SELLOADLUT:
                         ret = sel_loadlut(p);
@@ -2688,10 +2688,10 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
                         }
                         break;
                 case TIOCL_BLANKSCREEN: /* until explicitly unblanked, not only poked */
-                        acquire_console_sem();
+                        console_lock();
                         ignore_poke = 1;
                         do_blank_screen(0);
-                        release_console_sem();
+                        console_unlock();
                         break;
                 case TIOCL_BLANKEDSCREEN:
                         ret = console_blanked;
@@ -2790,11 +2790,11 @@ static void con_flush_chars(struct tty_struct *tty)
                 return;
 
         /* if we race with con_close(), vt may be null */
-        acquire_console_sem();
+        console_lock();
         vc = tty->driver_data;
         if (vc)
                 set_cursor(vc);
-        release_console_sem();
+        console_unlock();
 }
 
 /*
@@ -2805,7 +2805,7 @@ static int con_open(struct tty_struct *tty, struct file *filp)
         unsigned int currcons = tty->index;
         int ret = 0;
 
-        acquire_console_sem();
+        console_lock();
         if (tty->driver_data == NULL) {
                 ret = vc_allocate(currcons);
                 if (ret == 0) {
@@ -2813,7 +2813,7 @@ static int con_open(struct tty_struct *tty, struct file *filp)
 
                         /* Still being freed */
                         if (vc->port.tty) {
-                                release_console_sem();
+                                console_unlock();
                                 return -ERESTARTSYS;
                         }
                         tty->driver_data = vc;
@@ -2827,11 +2827,11 @@ static int con_open(struct tty_struct *tty, struct file *filp)
                                 tty->termios->c_iflag |= IUTF8;
                         else
                                 tty->termios->c_iflag &= ~IUTF8;
-                        release_console_sem();
+                        console_unlock();
                         return ret;
                 }
         }
-        release_console_sem();
+        console_unlock();
         return ret;
 }
 
@@ -2844,9 +2844,9 @@ static void con_shutdown(struct tty_struct *tty)
 {
         struct vc_data *vc = tty->driver_data;
         BUG_ON(vc == NULL);
-        acquire_console_sem();
+        console_lock();
         vc->port.tty = NULL;
-        release_console_sem();
+        console_unlock();
         tty_shutdown(tty);
 }
 
@@ -2893,13 +2893,13 @@ static int __init con_init(void)
         struct vc_data *vc;
         unsigned int currcons = 0, i;
 
-        acquire_console_sem();
+        console_lock();
 
         if (conswitchp)
                 display_desc = conswitchp->con_startup();
         if (!display_desc) {
                 fg_console = 0;
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
 
@@ -2946,7 +2946,7 @@ static int __init con_init(void)
         printable = 1;
         printk("\n");
 
-        release_console_sem();
+        console_unlock();
 
 #ifdef CONFIG_VT_CONSOLE
         register_console(&vt_console_driver);
@@ -2994,7 +2994,7 @@ int __init vty_init(const struct file_operations *console_fops)
         if (IS_ERR(tty0dev))
                 tty0dev = NULL;
         else
-                device_create_file(tty0dev, &dev_attr_active);
+                WARN_ON(device_create_file(tty0dev, &dev_attr_active) < 0);
 
         vcs_init();
 
@@ -3037,7 +3037,7 @@ static int bind_con_driver(const struct consw *csw, int first, int last,
         if (!try_module_get(owner))
                 return -ENODEV;
 
-        acquire_console_sem();
+        console_lock();
 
         /* check if driver is registered */
         for (i = 0; i < MAX_NR_CON_DRIVER; i++) {
@@ -3122,7 +3122,7 @@ static int bind_con_driver(const struct consw *csw, int first, int last,
 
         retval = 0;
 err:
-        release_console_sem();
+        console_unlock();
         module_put(owner);
         return retval;
 };
@@ -3171,7 +3171,7 @@ int unbind_con_driver(const struct consw *csw, int first, int last, int deflt)
         if (!try_module_get(owner))
                 return -ENODEV;
 
-        acquire_console_sem();
+        console_lock();
 
         /* check if driver is registered and if it is unbindable */
         for (i = 0; i < MAX_NR_CON_DRIVER; i++) {
@@ -3185,7 +3185,7 @@ int unbind_con_driver(const struct consw *csw, int first, int last, int deflt)
         }
 
         if (retval) {
-                release_console_sem();
+                console_unlock();
                 goto err;
         }
 
@@ -3204,12 +3204,12 @@ int unbind_con_driver(const struct consw *csw, int first, int last, int deflt)
         }
 
         if (retval) {
-                release_console_sem();
+                console_unlock();
                 goto err;
         }
 
         if (!con_is_bound(csw)) {
-                release_console_sem();
+                console_unlock();
                 goto err;
         }
 
@@ -3238,7 +3238,7 @@ int unbind_con_driver(const struct consw *csw, int first, int last, int deflt)
         if (!con_is_bound(csw))
                 con_driver->flag &= ~CON_DRIVER_FLAG_INIT;
 
-        release_console_sem();
+        console_unlock();
         /* ignore return value, binding should not fail */
         bind_con_driver(defcsw, first, last, deflt);
 err:
@@ -3538,14 +3538,14 @@ int register_con_driver(const struct consw *csw, int first, int last)
         if (!try_module_get(owner))
                 return -ENODEV;
 
-        acquire_console_sem();
+        console_lock();
 
         for (i = 0; i < MAX_NR_CON_DRIVER; i++) {
                 con_driver = &registered_con_driver[i];
 
                 /* already registered */
                 if (con_driver->con == csw)
-                        retval = -EINVAL;
+                        retval = -EBUSY;
         }
 
         if (retval)
@@ -3592,7 +3592,7 @@ int register_con_driver(const struct consw *csw, int first, int last)
         }
 
 err:
-        release_console_sem();
+        console_unlock();
         module_put(owner);
         return retval;
 }
@@ -3613,7 +3613,7 @@ int unregister_con_driver(const struct consw *csw)
 {
         int i, retval = -ENODEV;
 
-        acquire_console_sem();
+        console_lock();
 
         /* cannot unregister a bound driver */
         if (con_is_bound(csw))
@@ -3639,7 +3639,7 @@ int unregister_con_driver(const struct consw *csw)
                 }
         }
 err:
-        release_console_sem();
+        console_unlock();
         return retval;
 }
 EXPORT_SYMBOL(unregister_con_driver);
@@ -3656,7 +3656,12 @@ int take_over_console(const struct consw *csw, int first, int last, int deflt)
         int err;
 
         err = register_con_driver(csw, first, last);
-
+        /* if we get an busy error we still want to bind the console driver
+         * and return success, as we may have unbound the console driver
+         * but not unregistered it.
+        */
+        if (err == -EBUSY)
+                err = 0;
         if (!err)
                 bind_con_driver(csw, first, last, deflt);
 
@@ -3934,9 +3939,9 @@ int con_set_cmap(unsigned char __user *arg)
 {
         int rc;
 
-        acquire_console_sem();
+        console_lock();
         rc = set_get_cmap (arg,1);
-        release_console_sem();
+        console_unlock();
 
         return rc;
 }
@@ -3945,9 +3950,9 @@ int con_get_cmap(unsigned char __user *arg)
 {
         int rc;
 
-        acquire_console_sem();
+        console_lock();
         rc = set_get_cmap (arg,0);
-        release_console_sem();
+        console_unlock();
 
         return rc;
 }
@@ -3994,12 +3999,12 @@ static int con_font_get(struct vc_data *vc, struct console_font_op *op)
         } else
                 font.data = NULL;
 
-        acquire_console_sem();
+        console_lock();
         if (vc->vc_sw->con_font_get)
                 rc = vc->vc_sw->con_font_get(vc, &font);
         else
                 rc = -ENOSYS;
-        release_console_sem();
+        console_unlock();
 
         if (rc)
                 goto out;
@@ -4076,12 +4081,12 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op)
         font.data = memdup_user(op->data, size);
         if (IS_ERR(font.data))
                 return PTR_ERR(font.data);
-        acquire_console_sem();
+        console_lock();
         if (vc->vc_sw->con_font_set)
                 rc = vc->vc_sw->con_font_set(vc, &font, op->flags);
         else
                 rc = -ENOSYS;
-        release_console_sem();
+        console_unlock();
         kfree(font.data);
         return rc;
 }
@@ -4103,12 +4108,12 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
         else
                 name[MAX_FONT_NAME - 1] = 0;
 
-        acquire_console_sem();
+        console_lock();
         if (vc->vc_sw->con_font_default)
                 rc = vc->vc_sw->con_font_default(vc, &font, s);
         else
                 rc = -ENOSYS;
-        release_console_sem();
+        console_unlock();
         if (!rc) {
                 op->width = font.width;
                 op->height = font.height;
@@ -4124,7 +4129,7 @@ static int con_font_copy(struct vc_data *vc, struct console_font_op *op)
         if (vc->vc_mode != KD_TEXT)
                 return -EINVAL;
 
-        acquire_console_sem();
+        console_lock();
         if (!vc->vc_sw->con_font_copy)
                 rc = -ENOSYS;
         else if (con < 0 || !vc_cons_allocated(con))
@@ -4133,7 +4138,7 @@ static int con_font_copy(struct vc_data *vc, struct console_font_op *op)
                 rc = 0;
         else
                 rc = vc->vc_sw->con_font_copy(vc, con);
-        release_console_sem();
+        console_unlock();
         return rc;
 }
 
diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
index 6b68a0fb4611..1235ebda6e1c 100644
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -649,12 +649,12 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 /*
                  * explicitly blank/unblank the screen if switching modes
                  */
-                acquire_console_sem();
+                console_lock();
                 if (arg == KD_TEXT)
                         do_unblank_screen(1);
                 else
                         do_blank_screen(1);
-                release_console_sem();
+                console_unlock();
                 break;
 
         case KDGETMODE:
@@ -893,7 +893,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                         ret = -EINVAL;
                         goto out;
                 }
-                acquire_console_sem();
+                console_lock();
                 vc->vt_mode = tmp;
                 /* the frsig is ignored, so we set it to 0 */
                 vc->vt_mode.frsig = 0;
@@ -901,7 +901,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 vc->vt_pid = get_pid(task_pid(current));
                 /* no switch is required -- saw@shade.msu.ru */
                 vc->vt_newvt = -1;
-                release_console_sem();
+                console_unlock();
                 break;
         }
 
@@ -910,9 +910,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 struct vt_mode tmp;
                 int rc;
 
-                acquire_console_sem();
+                console_lock();
                 memcpy(&tmp, &vc->vt_mode, sizeof(struct vt_mode));
-                release_console_sem();
+                console_unlock();
 
                 rc = copy_to_user(up, &tmp, sizeof(struct vt_mode));
                 if (rc)
@@ -965,9 +965,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                         ret =  -ENXIO;
                 else {
                         arg--;
-                        acquire_console_sem();
+                        console_lock();
                         ret = vc_allocate(arg);
-                        release_console_sem();
+                        console_unlock();
                         if (ret)
                                 break;
                         set_console(arg);
@@ -990,7 +990,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                         ret = -ENXIO;
                 else {
                         vsa.console--;
-                        acquire_console_sem();
+                        console_lock();
                         ret = vc_allocate(vsa.console);
                         if (ret == 0) {
                                 struct vc_data *nvc;
@@ -1003,7 +1003,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                                 put_pid(nvc->vt_pid);
                                 nvc->vt_pid = get_pid(task_pid(current));
                         }
-                        release_console_sem();
+                        console_unlock();
                         if (ret)
                                 break;
                         /* Commence switch and lock */
@@ -1044,7 +1044,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 /*
                  * Switching-from response
                  */
-                acquire_console_sem();
+                console_lock();
                 if (vc->vt_newvt >= 0) {
                         if (arg == 0)
                                 /*
@@ -1063,7 +1063,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                                 vc->vt_newvt = -1;
                                 ret = vc_allocate(newvt);
                                 if (ret) {
-                                        release_console_sem();
+                                        console_unlock();
                                         break;
                                 }
                                 /*
@@ -1083,7 +1083,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                         if (arg != VT_ACKACQ)
                                 ret = -EINVAL;
                 }
-                release_console_sem();
+                console_unlock();
                 break;
 
          /*
@@ -1096,20 +1096,20 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 }
                 if (arg == 0) {
                     /* deallocate all unused consoles, but leave 0 */
-                        acquire_console_sem();
+                        console_lock();
                         for (i=1; i<MAX_NR_CONSOLES; i++)
                                 if (! VT_BUSY(i))
                                         vc_deallocate(i);
-                        release_console_sem();
+                        console_unlock();
                 } else {
                         /* deallocate a single console, if possible */
                         arg--;
                         if (VT_BUSY(arg))
                                 ret = -EBUSY;
                         else if (arg) {                       /* leave 0 */
-                                acquire_console_sem();
+                                console_lock();
                                 vc_deallocate(arg);
-                                release_console_sem();
+                                console_unlock();
                         }
                 }
                 break;
@@ -1126,7 +1126,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                     get_user(cc, &vtsizes->v_cols))
                         ret = -EFAULT;
                 else {
-                        acquire_console_sem();
+                        console_lock();
                         for (i = 0; i < MAX_NR_CONSOLES; i++) {
                                 vc = vc_cons[i].d;
 
@@ -1135,7 +1135,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                                         vc_resize(vc_cons[i].d, cc, ll);
                                 }
                         }
-                        release_console_sem();
+                        console_unlock();
                 }
                 break;
         }
@@ -1187,14 +1187,14 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 for (i = 0; i < MAX_NR_CONSOLES; i++) {
                         if (!vc_cons[i].d)
                                 continue;
-                        acquire_console_sem();
+                        console_lock();
                         if (vlin)
                                 vc_cons[i].d->vc_scan_lines = vlin;
                         if (clin)
                                 vc_cons[i].d->vc_font.height = clin;
                         vc_cons[i].d->vc_resize_user = 1;
                         vc_resize(vc_cons[i].d, cc, ll);
-                        release_console_sem();
+                        console_unlock();
                 }
                 break;
         }
@@ -1367,7 +1367,7 @@ void vc_SAK(struct work_struct *work)
         struct vc_data *vc;
         struct tty_struct *tty;
 
-        acquire_console_sem();
+        console_lock();
         vc = vc_con->d;
         if (vc) {
                 tty = vc->port.tty;
@@ -1379,7 +1379,7 @@ void vc_SAK(struct work_struct *work)
                         __do_SAK(tty);
                 reset_vc(vc);
         }
-        release_console_sem();
+        console_unlock();
 }
 
 #ifdef CONFIG_COMPAT
@@ -1737,10 +1737,10 @@ int vt_move_to_console(unsigned int vt, int alloc)
 {
         int prev;
 
-        acquire_console_sem();
+        console_lock();
         /* Graphics mode - up to X */
         if (disable_vt_switch) {
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
         prev = fg_console;
@@ -1748,7 +1748,7 @@ int vt_move_to_console(unsigned int vt, int alloc)
         if (alloc && vc_allocate(vt)) {
                 /* we can't have a free VC for now. Too bad,
                  * we don't want to mess the screen for now. */
-                release_console_sem();
+                console_unlock();
                 return -ENOSPC;
         }
 
@@ -1758,10 +1758,10 @@ int vt_move_to_console(unsigned int vt, int alloc)
                  * Let the calling function know so it can decide
                  * what to do.
                  */
-                release_console_sem();
+                console_unlock();
                 return -EIO;
         }
-        release_console_sem();
+        console_unlock();
         tty_lock();
         if (vt_waitactive(vt + 1)) {
                 pr_debug("Suspend: Can't switch VCs.");
@@ -1781,8 +1781,8 @@ int vt_move_to_console(unsigned int vt, int alloc)
  */
 void pm_set_vt_switch(int do_switch)
 {
-        acquire_console_sem();
+        console_lock();
         disable_vt_switch = !do_switch;
-        release_console_sem();
+        console_unlock();
 }
 EXPORT_SYMBOL(pm_set_vt_switch);
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 6ee4451bfe2d..47085e5879ab 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -342,7 +342,7 @@ static ssize_t wdm_write
                 goto outnp;
         }
 
-        if (!file->f_flags && O_NONBLOCK)
+        if (!(file->f_flags & O_NONBLOCK))
                 r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
                                                                 &desc->flags));
         else
diff --git a/drivers/usb/core/endpoint.c b/drivers/usb/core/endpoint.c
index 9da250563027..df502a98d0df 100644
--- a/drivers/usb/core/endpoint.c
+++ b/drivers/usb/core/endpoint.c
@@ -192,12 +192,12 @@ int usb_create_ep_devs(struct device *parent,
         ep_dev->dev.parent = parent;
         ep_dev->dev.release = ep_device_release;
         dev_set_name(&ep_dev->dev, "ep_%02x", endpoint->desc.bEndpointAddress);
-        device_enable_async_suspend(&ep_dev->dev);
 
         retval = device_register(&ep_dev->dev);
         if (retval)
                 goto error_register;
 
+        device_enable_async_suspend(&ep_dev->dev);
         endpoint->ep_dev = ep_dev;
         return retval;
 
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index b55d46070a25..f71e8e307e0f 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -405,7 +405,12 @@ static int suspend_common(struct device *dev, bool do_wakeup)
                         return retval;
         }
 
-        synchronize_irq(pci_dev->irq);
+        /* If MSI-X is enabled, the driver will have synchronized all vectors
+         * in pci_suspend(). If MSI or legacy PCI is enabled, that will be
+         * synchronized here.
+         */
+        if (!hcd->msix_enabled)
+                synchronize_irq(pci_dev->irq);
 
         /* Downstream ports from this root hub should already be quiesced, so
          * there will be no DMA activity.  Now we can shut down the upstream
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index b98efae6a1cf..4310cc4b1cb5 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -676,6 +676,8 @@ static void hub_init_func3(struct work_struct *ws);
 static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 {
         struct usb_device *hdev = hub->hdev;
+        struct usb_hcd *hcd;
+        int ret;
         int port1;
         int status;
         bool need_debounce_delay = false;
@@ -714,6 +716,25 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
                         usb_autopm_get_interface_no_resume(
                                         to_usb_interface(hub->intfdev));
                         return;         /* Continues at init2: below */
+                } else if (type == HUB_RESET_RESUME) {
+                        /* The internal host controller state for the hub device
+                         * may be gone after a host power loss on system resume.
+                         * Update the device's info so the HW knows it's a hub.
+                         */
+                        hcd = bus_to_hcd(hdev->bus);
+                        if (hcd->driver->update_hub_device) {
+                                ret = hcd->driver->update_hub_device(hcd, hdev,
+                                                &hub->tt, GFP_NOIO);
+                                if (ret < 0) {
+                                        dev_err(hub->intfdev, "Host not "
+                                                        "accepting hub info "
+                                                        "update.\n");
+                                        dev_err(hub->intfdev, "LS/FS devices "
+                                                        "and hubs may not work "
+                                                        "under this hub\n.");
+                                }
+                        }
+                        hub_power_on(hub, true);
                 } else {
                         hub_power_on(hub, true);
                 }
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 1dc9739277b4..06bb9d4587e9 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -509,7 +509,7 @@ config USB_LANGWELL
         select USB_GADGET_SELECTED
 
 config USB_GADGET_EG20T
-        boolean "Intel EG20T(Topcliff) USB Device controller"
+        boolean "Intel EG20T PCH/OKI SEMICONDUCTOR ML7213 IOH UDC"
         depends on PCI
         select USB_GADGET_DUALSPEED
         help
@@ -525,6 +525,11 @@ config USB_GADGET_EG20T
           This driver dose not support interrupt transfer or isochronous
           transfer modes.
 
+          This driver also can be used for OKI SEMICONDUCTOR's ML7213 which is
+          for IVI(In-Vehicle Infotainment) use.
+          ML7213 is companion chip for Intel Atom E6xx series.
+          ML7213 is completely compatible for Intel EG20T PCH.
+
 config USB_EG20T
         tristate
         depends on USB_GADGET_EG20T
diff --git a/drivers/usb/gadget/ci13xxx_udc.c b/drivers/usb/gadget/ci13xxx_udc.c
index 31656a2b4ab4..a1c67ae1572a 100644
--- a/drivers/usb/gadget/ci13xxx_udc.c
+++ b/drivers/usb/gadget/ci13xxx_udc.c
@@ -76,10 +76,21 @@ static DEFINE_SPINLOCK(udc_lock);
 
 /* control endpoint description */
 static const struct usb_endpoint_descriptor
-ctrl_endpt_desc = {
+ctrl_endpt_out_desc = {
         .bLength         = USB_DT_ENDPOINT_SIZE,
         .bDescriptorType = USB_DT_ENDPOINT,
 
+        .bEndpointAddress = USB_DIR_OUT,
+        .bmAttributes    = USB_ENDPOINT_XFER_CONTROL,
+        .wMaxPacketSize  = cpu_to_le16(CTRL_PAYLOAD_MAX),
+};
+
+static const struct usb_endpoint_descriptor
+ctrl_endpt_in_desc = {
+        .bLength         = USB_DT_ENDPOINT_SIZE,
+        .bDescriptorType = USB_DT_ENDPOINT,
+
+        .bEndpointAddress = USB_DIR_IN,
         .bmAttributes    = USB_ENDPOINT_XFER_CONTROL,
         .wMaxPacketSize  = cpu_to_le16(CTRL_PAYLOAD_MAX),
 };
@@ -265,10 +276,10 @@ static int hw_device_init(void __iomem *base)
         hw_bank.size /= sizeof(u32);
 
         reg = hw_aread(ABS_DCCPARAMS, DCCPARAMS_DEN) >> ffs_nr(DCCPARAMS_DEN);
-        if (reg == 0 || reg > ENDPT_MAX)
-                return -ENODEV;
+        hw_ep_max = reg * 2;   /* cache hw ENDPT_MAX */
 
-        hw_ep_max = reg;   /* cache hw ENDPT_MAX */
+        if (hw_ep_max == 0 || hw_ep_max > ENDPT_MAX)
+                return -ENODEV;
 
         /* setup lock mode ? */
 
@@ -1197,16 +1208,17 @@ static ssize_t show_qheads(struct device *dev, struct device_attribute *attr,
         }
 
         spin_lock_irqsave(udc->lock, flags);
-        for (i = 0; i < hw_ep_max; i++) {
-                struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
+        for (i = 0; i < hw_ep_max/2; i++) {
+                struct ci13xxx_ep *mEpRx = &udc->ci13xxx_ep[i];
+                struct ci13xxx_ep *mEpTx = &udc->ci13xxx_ep[i + hw_ep_max/2];
                 n += scnprintf(buf + n, PAGE_SIZE - n,
                                "EP=%02i: RX=%08X TX=%08X\n",
-                               i, (u32)mEp->qh[RX].dma, (u32)mEp->qh[TX].dma);
+                               i, (u32)mEpRx->qh.dma, (u32)mEpTx->qh.dma);
                 for (j = 0; j < (sizeof(struct ci13xxx_qh)/sizeof(u32)); j++) {
                         n += scnprintf(buf + n, PAGE_SIZE - n,
                                        " %04X:    %08X    %08X\n", j,
-                                       *((u32 *)mEp->qh[RX].ptr + j),
-                                       *((u32 *)mEp->qh[TX].ptr + j));
+                                       *((u32 *)mEpRx->qh.ptr + j),
+                                       *((u32 *)mEpTx->qh.ptr + j));
                 }
         }
         spin_unlock_irqrestore(udc->lock, flags);
@@ -1293,7 +1305,7 @@ static ssize_t show_requests(struct device *dev, struct device_attribute *attr,
         unsigned long flags;
         struct list_head   *ptr = NULL;
         struct ci13xxx_req *req = NULL;
-        unsigned i, j, k, n = 0, qSize = sizeof(struct ci13xxx_td)/sizeof(u32);
+        unsigned i, j, n = 0, qSize = sizeof(struct ci13xxx_td)/sizeof(u32);
 
         dbg_trace("[%s] %p\n", __func__, buf);
         if (attr == NULL || buf == NULL) {
@@ -1303,22 +1315,20 @@ static ssize_t show_requests(struct device *dev, struct device_attribute *attr,
 
         spin_lock_irqsave(udc->lock, flags);
         for (i = 0; i < hw_ep_max; i++)
-                for (k = RX; k <= TX; k++)
-                        list_for_each(ptr, &udc->ci13xxx_ep[i].qh[k].queue)
-                        {
-                                req = list_entry(ptr,
-                                                 struct ci13xxx_req, queue);
+                list_for_each(ptr, &udc->ci13xxx_ep[i].qh.queue)
+                {
+                        req = list_entry(ptr, struct ci13xxx_req, queue);
+
+                        n += scnprintf(buf + n, PAGE_SIZE - n,
+                                        "EP=%02i: TD=%08X %s\n",
+                                        i % hw_ep_max/2, (u32)req->dma,
+                                        ((i < hw_ep_max/2) ? "RX" : "TX"));
 
+                        for (j = 0; j < qSize; j++)
                                 n += scnprintf(buf + n, PAGE_SIZE - n,
-                                               "EP=%02i: TD=%08X %s\n",
-                                               i, (u32)req->dma,
-                                               ((k == RX) ? "RX" : "TX"));
-
-                                for (j = 0; j < qSize; j++)
-                                        n += scnprintf(buf + n, PAGE_SIZE - n,
-                                                       " %04X:    %08X\n", j,
-                                                       *((u32 *)req->ptr + j));
-                        }
+                                                " %04X:    %08X\n", j,
+                                                *((u32 *)req->ptr + j));
+                }
         spin_unlock_irqrestore(udc->lock, flags);
 
         return n;
@@ -1467,12 +1477,12 @@ static int _hardware_enqueue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq)
          *  At this point it's guaranteed exclusive access to qhead
          *  (endpt is not primed) so it's no need to use tripwire
          */
-        mEp->qh[mEp->dir].ptr->td.next   = mReq->dma;    /* TERMINATE = 0 */
-        mEp->qh[mEp->dir].ptr->td.token &= ~TD_STATUS;   /* clear status */
+        mEp->qh.ptr->td.next   = mReq->dma;    /* TERMINATE = 0 */
+        mEp->qh.ptr->td.token &= ~TD_STATUS;   /* clear status */
         if (mReq->req.zero == 0)
-                mEp->qh[mEp->dir].ptr->cap |=  QH_ZLT;
+                mEp->qh.ptr->cap |=  QH_ZLT;
         else
-                mEp->qh[mEp->dir].ptr->cap &= ~QH_ZLT;
+                mEp->qh.ptr->cap &= ~QH_ZLT;
 
         wmb();   /* synchronize before ep prime */
 
@@ -1542,11 +1552,11 @@ __acquires(mEp->lock)
 
         hw_ep_flush(mEp->num, mEp->dir);
 
-        while (!list_empty(&mEp->qh[mEp->dir].queue)) {
+        while (!list_empty(&mEp->qh.queue)) {
 
                 /* pop oldest request */
                 struct ci13xxx_req *mReq = \
-                        list_entry(mEp->qh[mEp->dir].queue.next,
+                        list_entry(mEp->qh.queue.next,
                                    struct ci13xxx_req, queue);
                 list_del_init(&mReq->queue);
                 mReq->req.status = -ESHUTDOWN;
@@ -1571,8 +1581,6 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
 {
         struct usb_ep *ep;
         struct ci13xxx    *udc = container_of(gadget, struct ci13xxx, gadget);
-        struct ci13xxx_ep *mEp = container_of(gadget->ep0,
-                                              struct ci13xxx_ep, ep);
 
         trace("%p", gadget);
 
@@ -1583,7 +1591,8 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
         gadget_for_each_ep(ep, gadget) {
                 usb_ep_fifo_flush(ep);
         }
-        usb_ep_fifo_flush(gadget->ep0);
+        usb_ep_fifo_flush(&udc->ep0out.ep);
+        usb_ep_fifo_flush(&udc->ep0in.ep);
 
         udc->driver->disconnect(gadget);
 
@@ -1591,11 +1600,12 @@ static int _gadget_stop_activity(struct usb_gadget *gadget)
         gadget_for_each_ep(ep, gadget) {
                 usb_ep_disable(ep);
         }
-        usb_ep_disable(gadget->ep0);
+        usb_ep_disable(&udc->ep0out.ep);
+        usb_ep_disable(&udc->ep0in.ep);
 
-        if (mEp->status != NULL) {
-                usb_ep_free_request(gadget->ep0, mEp->status);
-                mEp->status = NULL;
+        if (udc->status != NULL) {
+                usb_ep_free_request(&udc->ep0in.ep, udc->status);
+                udc->status = NULL;
         }
 
         return 0;
@@ -1614,7 +1624,6 @@ static void isr_reset_handler(struct ci13xxx *udc)
 __releases(udc->lock)
 __acquires(udc->lock)
 {
-        struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[0];
         int retval;
 
         trace("%p", udc);
@@ -1635,11 +1644,15 @@ __acquires(udc->lock)
         if (retval)
                 goto done;
 
-        retval = usb_ep_enable(&mEp->ep, &ctrl_endpt_desc);
+        retval = usb_ep_enable(&udc->ep0out.ep, &ctrl_endpt_out_desc);
+        if (retval)
+                goto done;
+
+        retval = usb_ep_enable(&udc->ep0in.ep, &ctrl_endpt_in_desc);
         if (!retval) {
-                mEp->status = usb_ep_alloc_request(&mEp->ep, GFP_ATOMIC);
-                if (mEp->status == NULL) {
-                        usb_ep_disable(&mEp->ep);
+                udc->status = usb_ep_alloc_request(&udc->ep0in.ep, GFP_ATOMIC);
+                if (udc->status == NULL) {
+                        usb_ep_disable(&udc->ep0out.ep);
                         retval = -ENOMEM;
                 }
         }
@@ -1672,16 +1685,17 @@ static void isr_get_status_complete(struct usb_ep *ep, struct usb_request *req)
 
 /**
  * isr_get_status_response: get_status request response
- * @ep:    endpoint
+ * @udc: udc struct
  * @setup: setup request packet
  *
  * This function returns an error code
  */
-static int isr_get_status_response(struct ci13xxx_ep *mEp,
+static int isr_get_status_response(struct ci13xxx *udc,
                                    struct usb_ctrlrequest *setup)
 __releases(mEp->lock)
 __acquires(mEp->lock)
 {
+        struct ci13xxx_ep *mEp = &udc->ep0in;
         struct usb_request *req = NULL;
         gfp_t gfp_flags = GFP_ATOMIC;
         int dir, num, retval;
@@ -1736,27 +1750,23 @@ __acquires(mEp->lock)
 
 /**
  * isr_setup_status_phase: queues the status phase of a setup transation
- * @mEp: endpoint
+ * @udc: udc struct
  *
  * This function returns an error code
  */
-static int isr_setup_status_phase(struct ci13xxx_ep *mEp)
+static int isr_setup_status_phase(struct ci13xxx *udc)
 __releases(mEp->lock)
 __acquires(mEp->lock)
 {
         int retval;
+        struct ci13xxx_ep *mEp;
 
-        trace("%p", mEp);
-
-        /* mEp is always valid & configured */
-
-        if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
-                mEp->dir = (mEp->dir == TX) ? RX : TX;
+        trace("%p", udc);
 
-        mEp->status->no_interrupt = 1;
+        mEp = (udc->ep0_dir == TX) ? &udc->ep0out : &udc->ep0in;
 
         spin_unlock(mEp->lock);
-        retval = usb_ep_queue(&mEp->ep, mEp->status, GFP_ATOMIC);
+        retval = usb_ep_queue(&mEp->ep, udc->status, GFP_ATOMIC);
         spin_lock(mEp->lock);
 
         return retval;
@@ -1778,11 +1788,11 @@ __acquires(mEp->lock)
 
         trace("%p", mEp);
 
-        if (list_empty(&mEp->qh[mEp->dir].queue))
+        if (list_empty(&mEp->qh.queue))
                 return -EINVAL;
 
         /* pop oldest request */
-        mReq = list_entry(mEp->qh[mEp->dir].queue.next,
+        mReq = list_entry(mEp->qh.queue.next,
                           struct ci13xxx_req, queue);
         list_del_init(&mReq->queue);
 
@@ -1794,10 +1804,10 @@ __acquires(mEp->lock)
 
         dbg_done(_usb_addr(mEp), mReq->ptr->token, retval);
 
-        if (!list_empty(&mEp->qh[mEp->dir].queue)) {
+        if (!list_empty(&mEp->qh.queue)) {
                 struct ci13xxx_req* mReqEnq;
 
-                mReqEnq = list_entry(mEp->qh[mEp->dir].queue.next,
+                mReqEnq = list_entry(mEp->qh.queue.next,
                                   struct ci13xxx_req, queue);
                 _hardware_enqueue(mEp, mReqEnq);
         }
@@ -1836,16 +1846,14 @@ __acquires(udc->lock)
                 int type, num, err = -EINVAL;
                 struct usb_ctrlrequest req;
 
-
                 if (mEp->desc == NULL)
                         continue;   /* not configured */
 
-                if ((mEp->dir == RX && hw_test_and_clear_complete(i)) ||
-                    (mEp->dir == TX && hw_test_and_clear_complete(i + 16))) {
+                if (hw_test_and_clear_complete(i)) {
                         err = isr_tr_complete_low(mEp);
                         if (mEp->type == USB_ENDPOINT_XFER_CONTROL) {
                                 if (err > 0)   /* needs status phase */
-                                        err = isr_setup_status_phase(mEp);
+                                        err = isr_setup_status_phase(udc);
                                 if (err < 0) {
                                         dbg_event(_usb_addr(mEp),
                                                   "ERROR", err);
@@ -1866,15 +1874,22 @@ __acquires(udc->lock)
                         continue;
                 }
 
+                /*
+                 * Flush data and handshake transactions of previous
+                 * setup packet.
+                 */
+                _ep_nuke(&udc->ep0out);
+                _ep_nuke(&udc->ep0in);
+
                 /* read_setup_packet */
                 do {
                         hw_test_and_set_setup_guard();
-                        memcpy(&req, &mEp->qh[RX].ptr->setup, sizeof(req));
+                        memcpy(&req, &mEp->qh.ptr->setup, sizeof(req));
                 } while (!hw_test_and_clear_setup_guard());
 
                 type = req.bRequestType;
 
-                mEp->dir = (type & USB_DIR_IN) ? TX : RX;
+                udc->ep0_dir = (type & USB_DIR_IN) ? TX : RX;
 
                 dbg_setup(_usb_addr(mEp), &req);
 
@@ -1895,7 +1910,7 @@ __acquires(udc->lock)
                                 if (err)
                                         break;
                         }
-                        err = isr_setup_status_phase(mEp);
+                        err = isr_setup_status_phase(udc);
                         break;
                 case USB_REQ_GET_STATUS:
                         if (type != (USB_DIR_IN|USB_RECIP_DEVICE)   &&
@@ -1905,7 +1920,7 @@ __acquires(udc->lock)
                         if (le16_to_cpu(req.wLength) != 2 ||
                             le16_to_cpu(req.wValue)  != 0)
                                 break;
-                        err = isr_get_status_response(mEp, &req);
+                        err = isr_get_status_response(udc, &req);
                         break;
                 case USB_REQ_SET_ADDRESS:
                         if (type != (USB_DIR_OUT|USB_RECIP_DEVICE))
@@ -1916,7 +1931,7 @@ __acquires(udc->lock)
                         err = hw_usb_set_address((u8)le16_to_cpu(req.wValue));
                         if (err)
                                 break;
-                        err = isr_setup_status_phase(mEp);
+                        err = isr_setup_status_phase(udc);
                         break;
                 case USB_REQ_SET_FEATURE:
                         if (type != (USB_DIR_OUT|USB_RECIP_ENDPOINT) &&
@@ -1932,12 +1947,12 @@ __acquires(udc->lock)
                         spin_lock(udc->lock);
                         if (err)
                                 break;
-                        err = isr_setup_status_phase(mEp);
+                        err = isr_setup_status_phase(udc);
                         break;
                 default:
 delegate:
                         if (req.wLength == 0)   /* no data phase */
-                                mEp->dir = TX;
+                                udc->ep0_dir = TX;
 
                         spin_unlock(udc->lock);
                         err = udc->driver->setup(&udc->gadget, &req);
@@ -1968,7 +1983,7 @@ static int ep_enable(struct usb_ep *ep,
                      const struct usb_endpoint_descriptor *desc)
 {
         struct ci13xxx_ep *mEp = container_of(ep, struct ci13xxx_ep, ep);
-        int direction, retval = 0;
+        int retval = 0;
         unsigned long flags;
 
         trace("%p, %p", ep, desc);
@@ -1982,7 +1997,7 @@ static int ep_enable(struct usb_ep *ep,
 
         mEp->desc = desc;
 
-        if (!list_empty(&mEp->qh[mEp->dir].queue))
+        if (!list_empty(&mEp->qh.queue))
                 warn("enabling a non-empty endpoint!");
 
         mEp->dir  = usb_endpoint_dir_in(desc) ? TX : RX;
@@ -1991,29 +2006,22 @@ static int ep_enable(struct usb_ep *ep,
 
         mEp->ep.maxpacket = __constant_le16_to_cpu(desc->wMaxPacketSize);
 
-        direction = mEp->dir;
-        do {
-                dbg_event(_usb_addr(mEp), "ENABLE", 0);
+        dbg_event(_usb_addr(mEp), "ENABLE", 0);
 
-                mEp->qh[mEp->dir].ptr->cap = 0;
+        mEp->qh.ptr->cap = 0;
 
-                if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
-                        mEp->qh[mEp->dir].ptr->cap |=  QH_IOS;
-                else if (mEp->type == USB_ENDPOINT_XFER_ISOC)
-                        mEp->qh[mEp->dir].ptr->cap &= ~QH_MULT;
-                else
-                        mEp->qh[mEp->dir].ptr->cap &= ~QH_ZLT;
-
-                mEp->qh[mEp->dir].ptr->cap |=
-                        (mEp->ep.maxpacket << ffs_nr(QH_MAX_PKT)) & QH_MAX_PKT;
-                mEp->qh[mEp->dir].ptr->td.next |= TD_TERMINATE;   /* needed? */
-
-                retval |= hw_ep_enable(mEp->num, mEp->dir, mEp->type);
+        if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
+                mEp->qh.ptr->cap |=  QH_IOS;
+        else if (mEp->type == USB_ENDPOINT_XFER_ISOC)
+                mEp->qh.ptr->cap &= ~QH_MULT;
+        else
+                mEp->qh.ptr->cap &= ~QH_ZLT;
 
-                if (mEp->type == USB_ENDPOINT_XFER_CONTROL)
-                        mEp->dir = (mEp->dir == TX) ? RX : TX;
+        mEp->qh.ptr->cap |=
+                (mEp->ep.maxpacket << ffs_nr(QH_MAX_PKT)) & QH_MAX_PKT;
+        mEp->qh.ptr->td.next |= TD_TERMINATE;   /* needed? */
 
-        } while (mEp->dir != direction);
+        retval |= hw_ep_enable(mEp->num, mEp->dir, mEp->type);
 
         spin_unlock_irqrestore(mEp->lock, flags);
         return retval;
@@ -2146,7 +2154,7 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req,
         spin_lock_irqsave(mEp->lock, flags);
 
         if (mEp->type == USB_ENDPOINT_XFER_CONTROL &&
-            !list_empty(&mEp->qh[mEp->dir].queue)) {
+            !list_empty(&mEp->qh.queue)) {
                 _ep_nuke(mEp);
                 retval = -EOVERFLOW;
                 warn("endpoint ctrl %X nuked", _usb_addr(mEp));
@@ -2170,9 +2178,9 @@ static int ep_queue(struct usb_ep *ep, struct usb_request *req,
         /* push request */
         mReq->req.status = -EINPROGRESS;
         mReq->req.actual = 0;
-        list_add_tail(&mReq->queue, &mEp->qh[mEp->dir].queue);
+        list_add_tail(&mReq->queue, &mEp->qh.queue);
 
-        if (list_is_singular(&mEp->qh[mEp->dir].queue))
+        if (list_is_singular(&mEp->qh.queue))
                 retval = _hardware_enqueue(mEp, mReq);
 
         if (retval == -EALREADY) {
@@ -2199,7 +2207,7 @@ static int ep_dequeue(struct usb_ep *ep, struct usb_request *req)
         trace("%p, %p", ep, req);
 
         if (ep == NULL || req == NULL || mEp->desc == NULL ||
-            list_empty(&mReq->queue)  || list_empty(&mEp->qh[mEp->dir].queue))
+            list_empty(&mReq->queue)  || list_empty(&mEp->qh.queue))
                 return -EINVAL;
 
         spin_lock_irqsave(mEp->lock, flags);
@@ -2244,7 +2252,7 @@ static int ep_set_halt(struct usb_ep *ep, int value)
 #ifndef STALL_IN
         /* g_file_storage MS compliant but g_zero fails chapter 9 compliance */
         if (value && mEp->type == USB_ENDPOINT_XFER_BULK && mEp->dir == TX &&
-            !list_empty(&mEp->qh[mEp->dir].queue)) {
+            !list_empty(&mEp->qh.queue)) {
                 spin_unlock_irqrestore(mEp->lock, flags);
                 return -EAGAIN;
         }
@@ -2355,7 +2363,7 @@ static int ci13xxx_vbus_session(struct usb_gadget *_gadget, int is_active)
                 if (is_active) {
                         pm_runtime_get_sync(&_gadget->dev);
                         hw_device_reset(udc);
-                        hw_device_state(udc->ci13xxx_ep[0].qh[RX].dma);
+                        hw_device_state(udc->ep0out.qh.dma);
                 } else {
                         hw_device_state(0);
                         if (udc->udc_driver->notify_event)
@@ -2390,7 +2398,8 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
                 int (*bind)(struct usb_gadget *))
 {
         struct ci13xxx *udc = _udc;
-        unsigned long i, k, flags;
+        unsigned long flags;
+        int i, j;
         int retval = -ENOMEM;
 
         trace("%p", driver);
@@ -2427,45 +2436,46 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
 
         info("hw_ep_max = %d", hw_ep_max);
 
-        udc->driver = driver;
         udc->gadget.dev.driver = NULL;
 
         retval = 0;
-        for (i = 0; i < hw_ep_max; i++) {
-                struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
+        for (i = 0; i < hw_ep_max/2; i++) {
+                for (j = RX; j <= TX; j++) {
+                        int k = i + j * hw_ep_max/2;
+                        struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[k];
 
-                scnprintf(mEp->name, sizeof(mEp->name), "ep%i", (int)i);
+                        scnprintf(mEp->name, sizeof(mEp->name), "ep%i%s", i,
+                                        (j == TX)  ? "in" : "out");
 
-                mEp->lock         = udc->lock;
-                mEp->device       = &udc->gadget.dev;
-                mEp->td_pool      = udc->td_pool;
+                        mEp->lock         = udc->lock;
+                        mEp->device       = &udc->gadget.dev;
+                        mEp->td_pool      = udc->td_pool;
 
-                mEp->ep.name      = mEp->name;
-                mEp->ep.ops       = &usb_ep_ops;
-                mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
+                        mEp->ep.name      = mEp->name;
+                        mEp->ep.ops       = &usb_ep_ops;
+                        mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
 
-                /* this allocation cannot be random */
-                for (k = RX; k <= TX; k++) {
-                        INIT_LIST_HEAD(&mEp->qh[k].queue);
+                        INIT_LIST_HEAD(&mEp->qh.queue);
                         spin_unlock_irqrestore(udc->lock, flags);
-                        mEp->qh[k].ptr = dma_pool_alloc(udc->qh_pool,
-                                                        GFP_KERNEL,
-                                                        &mEp->qh[k].dma);
+                        mEp->qh.ptr = dma_pool_alloc(udc->qh_pool, GFP_KERNEL,
+                                        &mEp->qh.dma);
                         spin_lock_irqsave(udc->lock, flags);
-                        if (mEp->qh[k].ptr == NULL)
+                        if (mEp->qh.ptr == NULL)
                                 retval = -ENOMEM;
                         else
-                                memset(mEp->qh[k].ptr, 0,
-                                       sizeof(*mEp->qh[k].ptr));
-                }
-                if (i == 0)
-                        udc->gadget.ep0 = &mEp->ep;
-                else
+                                memset(mEp->qh.ptr, 0, sizeof(*mEp->qh.ptr));
+
+                        /* skip ep0 out and in endpoints */
+                        if (i == 0)
+                                continue;
+
                         list_add_tail(&mEp->ep.ep_list, &udc->gadget.ep_list);
+                }
         }
         if (retval)
                 goto done;
 
+        udc->gadget.ep0 = &udc->ep0in.ep;
         /* bind gadget */
         driver->driver.bus     = NULL;
         udc->gadget.dev.driver = &driver->driver;
@@ -2479,6 +2489,7 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
                 goto done;
         }
 
+        udc->driver = driver;
         pm_runtime_get_sync(&udc->gadget.dev);
         if (udc->udc_driver->flags & CI13XXX_PULLUP_ON_VBUS) {
                 if (udc->vbus_active) {
@@ -2490,14 +2501,12 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
                 }
         }
 
-        retval = hw_device_state(udc->ci13xxx_ep[0].qh[RX].dma);
+        retval = hw_device_state(udc->ep0out.qh.dma);
         if (retval)
                 pm_runtime_put_sync(&udc->gadget.dev);
 
  done:
         spin_unlock_irqrestore(udc->lock, flags);
-        if (retval)
-                usb_gadget_unregister_driver(driver);
         return retval;
 }
 EXPORT_SYMBOL(usb_gadget_probe_driver);
@@ -2510,7 +2519,7 @@ EXPORT_SYMBOL(usb_gadget_probe_driver);
 int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 {
         struct ci13xxx *udc = _udc;
-        unsigned long i, k, flags;
+        unsigned long i, flags;
 
         trace("%p", driver);
 
@@ -2546,17 +2555,14 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
         for (i = 0; i < hw_ep_max; i++) {
                 struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
 
-                if (i == 0)
-                        udc->gadget.ep0 = NULL;
-                else if (!list_empty(&mEp->ep.ep_list))
+                if (!list_empty(&mEp->ep.ep_list))
                         list_del_init(&mEp->ep.ep_list);
 
-                for (k = RX; k <= TX; k++)
-                        if (mEp->qh[k].ptr != NULL)
-                                dma_pool_free(udc->qh_pool,
-                                              mEp->qh[k].ptr, mEp->qh[k].dma);
+                if (mEp->qh.ptr != NULL)
+                        dma_pool_free(udc->qh_pool, mEp->qh.ptr, mEp->qh.dma);
         }
 
+        udc->gadget.ep0 = NULL;
         udc->driver = NULL;
 
         spin_unlock_irqrestore(udc->lock, flags);
diff --git a/drivers/usb/gadget/ci13xxx_udc.h b/drivers/usb/gadget/ci13xxx_udc.h
index f61fed07f76b..a2492b65f98c 100644
--- a/drivers/usb/gadget/ci13xxx_udc.h
+++ b/drivers/usb/gadget/ci13xxx_udc.h
@@ -20,7 +20,7 @@
  * DEFINE
  *****************************************************************************/
 #define CI13XXX_PAGE_SIZE  4096ul /* page size for TD's */
-#define ENDPT_MAX          (16)
+#define ENDPT_MAX          (32)
 #define CTRL_PAYLOAD_MAX   (64)
 #define RX        (0)  /* similar to USB_DIR_OUT but can be used as an index */
 #define TX        (1)  /* similar to USB_DIR_IN  but can be used as an index */
@@ -88,8 +88,7 @@ struct ci13xxx_ep {
                 struct list_head   queue;
                 struct ci13xxx_qh *ptr;
                 dma_addr_t         dma;
-        }                                      qh[2];
-        struct usb_request                    *status;
+        }                                      qh;
         int                                    wedge;
 
         /* global resources */
@@ -119,9 +118,13 @@ struct ci13xxx {
 
         struct dma_pool           *qh_pool;   /* DMA pool for queue heads */
         struct dma_pool           *td_pool;   /* DMA pool for transfer descs */
+        struct usb_request        *status;    /* ep0 status request */
 
         struct usb_gadget          gadget;     /* USB slave device */
         struct ci13xxx_ep          ci13xxx_ep[ENDPT_MAX]; /* extended endpts */
+        u32                        ep0_dir;    /* ep0 direction */
+#define ep0out ci13xxx_ep[0]
+#define ep0in  ci13xxx_ep[16]
 
         struct usb_gadget_driver  *driver;     /* 3rd party gadget driver */
         struct ci13xxx_udc_driver *udc_driver; /* device controller driver */
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index f6ff8456d52d..1ba4befe336b 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -928,8 +928,9 @@ unknown:
                  */
                 switch (ctrl->bRequestType & USB_RECIP_MASK) {
                 case USB_RECIP_INTERFACE:
-                        if (cdev->config)
-                                f = cdev->config->interface[intf];
+                        if (!cdev->config || w_index >= MAX_CONFIG_INTERFACES)
+                                break;
+                        f = cdev->config->interface[intf];
                         break;
 
                 case USB_RECIP_ENDPOINT:
diff --git a/drivers/usb/gadget/pch_udc.c b/drivers/usb/gadget/pch_udc.c
index 0c8dd81dddca..b120dbb64d0f 100644
--- a/drivers/usb/gadget/pch_udc.c
+++ b/drivers/usb/gadget/pch_udc.c
@@ -198,10 +198,10 @@
 #define PCH_UDC_BRLEN           0x0F    /* Burst length */
 #define PCH_UDC_THLEN           0x1F    /* Threshold length */
 /* Value of EP Buffer Size */
-#define UDC_EP0IN_BUFF_SIZE     64
-#define UDC_EPIN_BUFF_SIZE      512
-#define UDC_EP0OUT_BUFF_SIZE    64
-#define UDC_EPOUT_BUFF_SIZE     512
+#define UDC_EP0IN_BUFF_SIZE     16
+#define UDC_EPIN_BUFF_SIZE      256
+#define UDC_EP0OUT_BUFF_SIZE    16
+#define UDC_EPOUT_BUFF_SIZE     256
 /* Value of EP maximum packet size */
 #define UDC_EP0IN_MAX_PKT_SIZE  64
 #define UDC_EP0OUT_MAX_PKT_SIZE 64
@@ -351,7 +351,7 @@ struct pch_udc_dev {
         struct pci_pool         *data_requests;
         struct pci_pool         *stp_requests;
         dma_addr_t                      dma_addr;
-        unsigned long                   ep0out_buf[64];
+        void                            *ep0out_buf;
         struct usb_ctrlrequest          setup_data;
         unsigned long                   phys_addr;
         void __iomem                    *base_addr;
@@ -361,6 +361,8 @@ struct pch_udc_dev {
 
 #define PCH_UDC_PCI_BAR                 1
 #define PCI_DEVICE_ID_INTEL_EG20T_UDC   0x8808
+#define PCI_VENDOR_ID_ROHM              0x10DB
+#define PCI_DEVICE_ID_ML7213_IOH_UDC    0x801D
 
 static const char       ep0_string[] = "ep0in";
 static DEFINE_SPINLOCK(udc_stall_spinlock);     /* stall spin lock */
@@ -1219,11 +1221,11 @@ static void complete_req(struct pch_udc_ep *ep, struct pch_udc_request *req,
         dev = ep->dev;
         if (req->dma_mapped) {
                 if (ep->in)
-                        pci_unmap_single(dev->pdev, req->req.dma,
-                                         req->req.length, PCI_DMA_TODEVICE);
+                        dma_unmap_single(&dev->pdev->dev, req->req.dma,
+                                         req->req.length, DMA_TO_DEVICE);
                 else
-                        pci_unmap_single(dev->pdev, req->req.dma,
-                                         req->req.length, PCI_DMA_FROMDEVICE);
+                        dma_unmap_single(&dev->pdev->dev, req->req.dma,
+                                         req->req.length, DMA_FROM_DEVICE);
                 req->dma_mapped = 0;
                 req->req.dma = DMA_ADDR_INVALID;
         }
@@ -1414,7 +1416,6 @@ static void pch_udc_start_rxrequest(struct pch_udc_ep *ep,
 
         pch_udc_clear_dma(ep->dev, DMA_DIR_RX);
         td_data = req->td_data;
-        ep->td_data = req->td_data;
         /* Set the status bits for all descriptors */
         while (1) {
                 td_data->status = (td_data->status & ~PCH_UDC_BUFF_STS) |
@@ -1613,15 +1614,19 @@ static int pch_udc_pcd_queue(struct usb_ep *usbep, struct usb_request *usbreq,
         if (usbreq->length &&
             ((usbreq->dma == DMA_ADDR_INVALID) || !usbreq->dma)) {
                 if (ep->in)
-                        usbreq->dma = pci_map_single(dev->pdev, usbreq->buf,
-                                        usbreq->length, PCI_DMA_TODEVICE);
+                        usbreq->dma = dma_map_single(&dev->pdev->dev,
+                                                     usbreq->buf,
+                                                     usbreq->length,
+                                                     DMA_TO_DEVICE);
                 else
-                        usbreq->dma = pci_map_single(dev->pdev, usbreq->buf,
-                                        usbreq->length, PCI_DMA_FROMDEVICE);
+                        usbreq->dma = dma_map_single(&dev->pdev->dev,
+                                                     usbreq->buf,
+                                                     usbreq->length,
+                                                     DMA_FROM_DEVICE);
                 req->dma_mapped = 1;
         }
         if (usbreq->length > 0) {
-                retval = prepare_dma(ep, req, gfp);
+                retval = prepare_dma(ep, req, GFP_ATOMIC);
                 if (retval)
                         goto probe_end;
         }
@@ -1646,7 +1651,6 @@ static int pch_udc_pcd_queue(struct usb_ep *usbep, struct usb_request *usbreq,
                         pch_udc_wait_ep_stall(ep);
                         pch_udc_ep_clear_nak(ep);
                         pch_udc_enable_ep_interrupts(ep->dev, (1 << ep->num));
-                        pch_udc_set_dma(dev, DMA_DIR_TX);
                 }
         }
         /* Now add this request to the ep's pending requests */
@@ -1926,6 +1930,7 @@ static void pch_udc_complete_receiver(struct pch_udc_ep *ep)
             PCH_UDC_BS_DMA_DONE)
                 return;
         pch_udc_clear_dma(ep->dev, DMA_DIR_RX);
+        pch_udc_ep_set_ddptr(ep, 0);
         if ((req->td_data_last->status & PCH_UDC_RXTX_STS) !=
             PCH_UDC_RTS_SUCC) {
                 dev_err(&dev->pdev->dev, "Invalid RXTX status (0x%08x) "
@@ -1963,7 +1968,7 @@ static void pch_udc_svc_data_in(struct pch_udc_dev *dev, int ep_num)
         u32     epsts;
         struct pch_udc_ep       *ep;
 
-        ep = &dev->ep[2*ep_num];
+        ep = &dev->ep[UDC_EPIN_IDX(ep_num)];
         epsts = ep->epsts;
         ep->epsts = 0;
 
@@ -2008,7 +2013,7 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num)
         struct pch_udc_ep               *ep;
         struct pch_udc_request          *req = NULL;
 
-        ep = &dev->ep[2*ep_num + 1];
+        ep = &dev->ep[UDC_EPOUT_IDX(ep_num)];
         epsts = ep->epsts;
         ep->epsts = 0;
 
@@ -2025,10 +2030,11 @@ static void pch_udc_svc_data_out(struct pch_udc_dev *dev, int ep_num)
         }
         if (epsts & UDC_EPSTS_HE)
                 return;
-        if (epsts & UDC_EPSTS_RSS)
+        if (epsts & UDC_EPSTS_RSS) {
                 pch_udc_ep_set_stall(ep);
                 pch_udc_enable_ep_interrupts(ep->dev,
                                              PCH_UDC_EPINT(ep->in, ep->num));
+        }
         if (epsts & UDC_EPSTS_RCS) {
                 if (!dev->prot_stall) {
                         pch_udc_ep_clear_stall(ep);
@@ -2060,8 +2066,10 @@ static void pch_udc_svc_control_in(struct pch_udc_dev *dev)
 {
         u32     epsts;
         struct pch_udc_ep       *ep;
+        struct pch_udc_ep       *ep_out;
 
         ep = &dev->ep[UDC_EP0IN_IDX];
+        ep_out = &dev->ep[UDC_EP0OUT_IDX];
         epsts = ep->epsts;
         ep->epsts = 0;
 
@@ -2073,8 +2081,16 @@ static void pch_udc_svc_control_in(struct pch_udc_dev *dev)
                 return;
         if (epsts & UDC_EPSTS_HE)
                 return;
-        if ((epsts & UDC_EPSTS_TDC) && (!dev->stall))
+        if ((epsts & UDC_EPSTS_TDC) && (!dev->stall)) {
                 pch_udc_complete_transfer(ep);
+                pch_udc_clear_dma(dev, DMA_DIR_RX);
+                ep_out->td_data->status = (ep_out->td_data->status &
+                                        ~PCH_UDC_BUFF_STS) |
+                                        PCH_UDC_BS_HST_RDY;
+                pch_udc_ep_clear_nak(ep_out);
+                pch_udc_set_dma(dev, DMA_DIR_RX);
+                pch_udc_ep_set_rrdy(ep_out);
+        }
         /* On IN interrupt, provide data if we have any */
         if ((epsts & UDC_EPSTS_IN) && !(epsts & UDC_EPSTS_TDC) &&
              !(epsts & UDC_EPSTS_TXEMPTY))
@@ -2102,11 +2118,9 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev)
                 dev->stall = 0;
                 dev->ep[UDC_EP0IN_IDX].halted = 0;
                 dev->ep[UDC_EP0OUT_IDX].halted = 0;
-                /* In data not ready */
-                pch_udc_ep_set_nak(&(dev->ep[UDC_EP0IN_IDX]));
                 dev->setup_data = ep->td_stp->request;
                 pch_udc_init_setup_buff(ep->td_stp);
-                pch_udc_clear_dma(dev, DMA_DIR_TX);
+                pch_udc_clear_dma(dev, DMA_DIR_RX);
                 pch_udc_ep_fifo_flush(&(dev->ep[UDC_EP0IN_IDX]),
                                       dev->ep[UDC_EP0IN_IDX].in);
                 if ((dev->setup_data.bRequestType & USB_DIR_IN))
@@ -2122,14 +2136,23 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev)
                 setup_supported = dev->driver->setup(&dev->gadget,
                                                      &dev->setup_data);
                 spin_lock(&dev->lock);
+
+                if (dev->setup_data.bRequestType & USB_DIR_IN) {
+                        ep->td_data->status = (ep->td_data->status &
+                                                ~PCH_UDC_BUFF_STS) |
+                                                PCH_UDC_BS_HST_RDY;
+                        pch_udc_ep_set_ddptr(ep, ep->td_data_phys);
+                }
                 /* ep0 in returns data on IN phase */
                 if (setup_supported >= 0 && setup_supported <
                                             UDC_EP0IN_MAX_PKT_SIZE) {
                         pch_udc_ep_clear_nak(&(dev->ep[UDC_EP0IN_IDX]));
                         /* Gadget would have queued a request when
                          * we called the setup */
-                        pch_udc_set_dma(dev, DMA_DIR_RX);
-                        pch_udc_ep_clear_nak(ep);
+                        if (!(dev->setup_data.bRequestType & USB_DIR_IN)) {
+                                pch_udc_set_dma(dev, DMA_DIR_RX);
+                                pch_udc_ep_clear_nak(ep);
+                        }
                 } else if (setup_supported < 0) {
                         /* if unsupported request, then stall */
                         pch_udc_ep_set_stall(&(dev->ep[UDC_EP0IN_IDX]));
@@ -2142,22 +2165,13 @@ static void pch_udc_svc_control_out(struct pch_udc_dev *dev)
                 }
         } else if ((((stat & UDC_EPSTS_OUT_MASK) >> UDC_EPSTS_OUT_SHIFT) ==
                      UDC_EPSTS_OUT_DATA) && !dev->stall) {
-                if (list_empty(&ep->queue)) {
-                        dev_err(&dev->pdev->dev, "%s: No request\n", __func__);
-                        ep->td_data->status = (ep->td_data->status &
-                                               ~PCH_UDC_BUFF_STS) |
-                                               PCH_UDC_BS_HST_RDY;
-                        pch_udc_set_dma(dev, DMA_DIR_RX);
-                } else {
-                        /* control write */
-                        /* next function will pickuo an clear the status */
+                pch_udc_clear_dma(dev, DMA_DIR_RX);
+                pch_udc_ep_set_ddptr(ep, 0);
+                if (!list_empty(&ep->queue)) {
                         ep->epsts = stat;
-
-                        pch_udc_svc_data_out(dev, 0);
-                        /* re-program desc. pointer for possible ZLPs */
-                        pch_udc_ep_set_ddptr(ep, ep->td_data_phys);
-                        pch_udc_set_dma(dev, DMA_DIR_RX);
+                        pch_udc_svc_data_out(dev, PCH_UDC_EP0);
                 }
+                pch_udc_set_dma(dev, DMA_DIR_RX);
         }
         pch_udc_ep_set_rrdy(ep);
 }
@@ -2174,7 +2188,7 @@ static void pch_udc_postsvc_epinters(struct pch_udc_dev *dev, int ep_num)
         struct pch_udc_ep       *ep;
         struct pch_udc_request *req;
 
-        ep = &dev->ep[2*ep_num];
+        ep = &dev->ep[UDC_EPIN_IDX(ep_num)];
         if (!list_empty(&ep->queue)) {
                 req = list_entry(ep->queue.next, struct pch_udc_request, queue);
                 pch_udc_enable_ep_interrupts(ep->dev,
@@ -2196,13 +2210,13 @@ static void pch_udc_read_all_epstatus(struct pch_udc_dev *dev, u32 ep_intr)
         for (i = 0; i < PCH_UDC_USED_EP_NUM; i++) {
                 /* IN */
                 if (ep_intr & (0x1 << i)) {
-                        ep = &dev->ep[2*i];
+                        ep = &dev->ep[UDC_EPIN_IDX(i)];
                         ep->epsts = pch_udc_read_ep_status(ep);
                         pch_udc_clear_ep_status(ep, ep->epsts);
                 }
                 /* OUT */
                 if (ep_intr & (0x10000 << i)) {
-                        ep = &dev->ep[2*i+1];
+                        ep = &dev->ep[UDC_EPOUT_IDX(i)];
                         ep->epsts = pch_udc_read_ep_status(ep);
                         pch_udc_clear_ep_status(ep, ep->epsts);
                 }
@@ -2563,9 +2577,6 @@ static void pch_udc_pcd_reinit(struct pch_udc_dev *dev)
         dev->ep[UDC_EP0IN_IDX].ep.maxpacket = UDC_EP0IN_MAX_PKT_SIZE;
         dev->ep[UDC_EP0OUT_IDX].ep.maxpacket = UDC_EP0OUT_MAX_PKT_SIZE;
 
-        dev->dma_addr = pci_map_single(dev->pdev, dev->ep0out_buf, 256,
-                                  PCI_DMA_FROMDEVICE);
-
         /* remove ep0 in and out from the list.  They have own pointer */
         list_del_init(&dev->ep[UDC_EP0IN_IDX].ep.ep_list);
         list_del_init(&dev->ep[UDC_EP0OUT_IDX].ep.ep_list);
@@ -2637,6 +2648,13 @@ static int init_dma_pools(struct pch_udc_dev *dev)
         dev->ep[UDC_EP0IN_IDX].td_stp_phys = 0;
         dev->ep[UDC_EP0IN_IDX].td_data = NULL;
         dev->ep[UDC_EP0IN_IDX].td_data_phys = 0;
+
+        dev->ep0out_buf = kzalloc(UDC_EP0OUT_BUFF_SIZE * 4, GFP_KERNEL);
+        if (!dev->ep0out_buf)
+                return -ENOMEM;
+        dev->dma_addr = dma_map_single(&dev->pdev->dev, dev->ep0out_buf,
+                                       UDC_EP0OUT_BUFF_SIZE * 4,
+                                       DMA_FROM_DEVICE);
         return 0;
 }
 
@@ -2700,7 +2718,8 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 
         pch_udc_disable_interrupts(dev, UDC_DEVINT_MSK);
 
-        /* Assues that there are no pending requets with this driver */
+        /* Assures that there are no pending requests with this driver */
+        driver->disconnect(&dev->gadget);
         driver->unbind(&dev->gadget);
         dev->gadget.dev.driver = NULL;
         dev->driver = NULL;
@@ -2750,6 +2769,11 @@ static void pch_udc_remove(struct pci_dev *pdev)
                 pci_pool_destroy(dev->stp_requests);
         }
 
+        if (dev->dma_addr)
+                dma_unmap_single(&dev->pdev->dev, dev->dma_addr,
+                                 UDC_EP0OUT_BUFF_SIZE * 4, DMA_FROM_DEVICE);
+        kfree(dev->ep0out_buf);
+
         pch_udc_exit(dev);
 
         if (dev->irq_registered)
@@ -2792,11 +2816,7 @@ static int pch_udc_resume(struct pci_dev *pdev)
         int ret;
 
         pci_set_power_state(pdev, PCI_D0);
-        ret = pci_restore_state(pdev);
-        if (ret) {
-                dev_err(&pdev->dev, "%s: pci_restore_state failed\n", __func__);
-                return ret;
-        }
+        pci_restore_state(pdev);
         ret = pci_enable_device(pdev);
         if (ret) {
                 dev_err(&pdev->dev, "%s: pci_enable_device failed\n", __func__);
@@ -2914,6 +2934,11 @@ static DEFINE_PCI_DEVICE_TABLE(pch_udc_pcidev_id) = {
                 .class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
                 .class_mask = 0xffffffff,
         },
+        {
+                PCI_DEVICE(PCI_VENDOR_ID_ROHM, PCI_DEVICE_ID_ML7213_IOH_UDC),
+                .class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
+                .class_mask = 0xffffffff,
+        },
         { 0 },
 };
 
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index 2fc8636316c5..12ff6cffedc9 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -131,31 +131,31 @@ static struct printer_dev usb_printer_gadget;
  * parameters are in UTF-8 (superset of ASCII's 7 bit characters).
  */
 
-static ushort __initdata idVendor;
+static ushort idVendor;
 module_param(idVendor, ushort, S_IRUGO);
 MODULE_PARM_DESC(idVendor, "USB Vendor ID");
 
-static ushort __initdata idProduct;
+static ushort idProduct;
 module_param(idProduct, ushort, S_IRUGO);
 MODULE_PARM_DESC(idProduct, "USB Product ID");
 
-static ushort __initdata bcdDevice;
+static ushort bcdDevice;
 module_param(bcdDevice, ushort, S_IRUGO);
 MODULE_PARM_DESC(bcdDevice, "USB Device version (BCD)");
 
-static char *__initdata iManufacturer;
+static char *iManufacturer;
 module_param(iManufacturer, charp, S_IRUGO);
 MODULE_PARM_DESC(iManufacturer, "USB Manufacturer string");
 
-static char *__initdata iProduct;
+static char *iProduct;
 module_param(iProduct, charp, S_IRUGO);
 MODULE_PARM_DESC(iProduct, "USB Product string");
 
-static char *__initdata iSerialNum;
+static char *iSerialNum;
 module_param(iSerialNum, charp, S_IRUGO);
 MODULE_PARM_DESC(iSerialNum, "1");
 
-static char *__initdata iPNPstring;
+static char *iPNPstring;
 module_param(iPNPstring, charp, S_IRUGO);
 MODULE_PARM_DESC(iPNPstring, "MFG:linux;MDL:g_printer;CLS:PRINTER;SN:1;");
 
@@ -1596,13 +1596,12 @@ cleanup(void)
         int status;
 
         mutex_lock(&usb_printer_gadget.lock_printer_io);
-        class_destroy(usb_gadget_class);
-        unregister_chrdev_region(g_printer_devno, 2);
-
         status = usb_gadget_unregister_driver(&printer_driver);
         if (status)
                 ERROR(dev, "usb_gadget_unregister_driver %x\n", status);
 
+        unregister_chrdev_region(g_printer_devno, 2);
+        class_destroy(usb_gadget_class);
         mutex_unlock(&usb_printer_gadget.lock_printer_io);
 }
 module_exit(cleanup);
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index 86e42892016d..5c761df7fa83 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -52,7 +52,6 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver,
         struct resource *res;
         int irq;
         int retval;
-        unsigned int temp;
 
         pr_debug("initializing FSL-SOC USB Controller\n");
 
@@ -126,18 +125,6 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver,
                 goto err3;
         }
 
-        /*
-         * Check if it is MPC5121 SoC, otherwise set pdata->have_sysif_regs
-         * flag for 83xx or 8536 system interface registers.
-         */
-        if (pdata->big_endian_mmio)
-                temp = in_be32(hcd->regs + FSL_SOC_USB_ID);
-        else
-                temp = in_le32(hcd->regs + FSL_SOC_USB_ID);
-
-        if ((temp & ID_MSK) != (~((temp & NID_MSK) >> 8) & ID_MSK))
-                pdata->have_sysif_regs = 1;
-
         /* Enable USB controller, 83xx or 8536 */
         if (pdata->have_sysif_regs)
                 setbits32(hcd->regs + FSL_SOC_USB_CTRL, 0x4);
diff --git a/drivers/usb/host/ehci-fsl.h b/drivers/usb/host/ehci-fsl.h
index 2c8353795226..3fabed33d940 100644
--- a/drivers/usb/host/ehci-fsl.h
+++ b/drivers/usb/host/ehci-fsl.h
@@ -19,9 +19,6 @@
 #define _EHCI_FSL_H
 
 /* offsets for the non-ehci registers in the FSL SOC USB controller */
-#define FSL_SOC_USB_ID          0x0
-#define ID_MSK                  0x3f
-#define NID_MSK                 0x3f00
 #define FSL_SOC_USB_ULPIVP      0x170
 #define FSL_SOC_USB_PORTSC1     0x184
 #define PORT_PTS_MSK            (3<<30)
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 6fee3cd58efe..74dcf49bd015 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -572,6 +572,8 @@ static int ehci_init(struct usb_hcd *hcd)
         ehci->iaa_watchdog.function = ehci_iaa_watchdog;
         ehci->iaa_watchdog.data = (unsigned long) ehci;
 
+        hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
+
         /*
          * hw default: 1K periodic list heads, one per frame.
          * periodic_size can shrink by USBCMD update if hcc_params allows.
@@ -579,11 +581,20 @@ static int ehci_init(struct usb_hcd *hcd)
         ehci->periodic_size = DEFAULT_I_TDPS;
         INIT_LIST_HEAD(&ehci->cached_itd_list);
         INIT_LIST_HEAD(&ehci->cached_sitd_list);
+
+        if (HCC_PGM_FRAMELISTLEN(hcc_params)) {
+                /* periodic schedule size can be smaller than default */
+                switch (EHCI_TUNE_FLS) {
+                case 0: ehci->periodic_size = 1024; break;
+                case 1: ehci->periodic_size = 512; break;
+                case 2: ehci->periodic_size = 256; break;
+                default:        BUG();
+                }
+        }
         if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0)
                 return retval;
 
         /* controllers may cache some of the periodic schedule ... */
-        hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
         if (HCC_ISOC_CACHE(hcc_params))         // full frame cache
                 ehci->i_thresh = 2 + 8;
         else                                    // N microframes cached
@@ -637,12 +648,6 @@ static int ehci_init(struct usb_hcd *hcd)
                 /* periodic schedule size can be smaller than default */
                 temp &= ~(3 << 2);
                 temp |= (EHCI_TUNE_FLS << 2);
-                switch (EHCI_TUNE_FLS) {
-                case 0: ehci->periodic_size = 1024; break;
-                case 1: ehci->periodic_size = 512; break;
-                case 2: ehci->periodic_size = 256; break;
-                default:        BUG();
-                }
         }
         if (HCC_LPM(hcc_params)) {
                 /* support link power management EHCI 1.1 addendum */
diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
index fa59b26fc5bc..c8e360d7d975 100644
--- a/drivers/usb/host/ehci-mxc.c
+++ b/drivers/usb/host/ehci-mxc.c
@@ -21,10 +21,13 @@
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/usb/otg.h>
+#include <linux/usb/ulpi.h>
 #include <linux/slab.h>
 
 #include <mach/mxc_ehci.h>
 
+#include <asm/mach-types.h>
+
 #define ULPI_VIEWPORT_OFFSET    0x170
 
 struct ehci_mxc_priv {
@@ -114,6 +117,7 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
         struct usb_hcd *hcd;
         struct resource *res;
         int irq, ret;
+        unsigned int flags;
         struct ehci_mxc_priv *priv;
         struct device *dev = &pdev->dev;
         struct ehci_hcd *ehci;
@@ -177,8 +181,8 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
                 clk_enable(priv->ahbclk);
         }
 
-        /* "dr" device has its own clock */
-        if (pdev->id == 0) {
+        /* "dr" device has its own clock on i.MX51 */
+        if (cpu_is_mx51() && (pdev->id == 0)) {
                 priv->phy1clk = clk_get(dev, "usb_phy1");
                 if (IS_ERR(priv->phy1clk)) {
                         ret = PTR_ERR(priv->phy1clk);
@@ -240,6 +244,23 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
         if (ret)
                 goto err_add;
 
+        if (pdata->otg) {
+                /*
+                 * efikamx and efikasb have some hardware bug which is
+                 * preventing usb to work unless CHRGVBUS is set.
+                 * It's in violation of USB specs
+                 */
+                if (machine_is_mx51_efikamx() || machine_is_mx51_efikasb()) {
+                        flags = otg_io_read(pdata->otg, ULPI_OTG_CTRL);
+                        flags |= ULPI_OTG_CTRL_CHRGVBUS;
+                        ret = otg_io_write(pdata->otg, flags, ULPI_OTG_CTRL);
+                        if (ret) {
+                                dev_err(dev, "unable to set CHRVBUS\n");
+                                goto err_add;
+                        }
+                }
+        }
+
         return 0;
 
 err_add:
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 76179c39c0e3..bed07d4aab06 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -44,28 +44,35 @@ static int ehci_pci_reinit(struct ehci_hcd *ehci, struct pci_dev *pdev)
         return 0;
 }
 
-static int ehci_quirk_amd_SB800(struct ehci_hcd *ehci)
+static int ehci_quirk_amd_hudson(struct ehci_hcd *ehci)
 {
         struct pci_dev *amd_smbus_dev;
         u8 rev = 0;
 
         amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI, 0x4385, NULL);
-        if (!amd_smbus_dev)
-                return 0;
-
-        pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
-        if (rev < 0x40) {
-                pci_dev_put(amd_smbus_dev);
-                amd_smbus_dev = NULL;
-                return 0;
+        if (amd_smbus_dev) {
+                pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
+                if (rev < 0x40) {
+                        pci_dev_put(amd_smbus_dev);
+                        amd_smbus_dev = NULL;
+                        return 0;
+                }
+        } else {
+                amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x780b, NULL);
+                if (!amd_smbus_dev)
+                        return 0;
+                pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
+                if (rev < 0x11 || rev > 0x18) {
+                        pci_dev_put(amd_smbus_dev);
+                        amd_smbus_dev = NULL;
+                        return 0;
+                }
         }
 
         if (!amd_nb_dev)
                 amd_nb_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x1510, NULL);
-        if (!amd_nb_dev)
-                ehci_err(ehci, "QUIRK: unable to get AMD NB device\n");
 
-        ehci_info(ehci, "QUIRK: Enable AMD SB800 L1 fix\n");
+        ehci_info(ehci, "QUIRK: Enable exception for AMD Hudson ASPM\n");
 
         pci_dev_put(amd_smbus_dev);
         amd_smbus_dev = NULL;
@@ -131,7 +138,7 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
         /* cache this readonly data; minimize chip reads */
         ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
 
-        if (ehci_quirk_amd_SB800(ehci))
+        if (ehci_quirk_amd_hudson(ehci))
                 ehci->amd_l1_fix = 1;
 
         retval = ehci_halt(ehci);
diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c
index 574b99ea0700..79a66d622f9c 100644
--- a/drivers/usb/host/fsl-mph-dr-of.c
+++ b/drivers/usb/host/fsl-mph-dr-of.c
@@ -262,19 +262,24 @@ static void fsl_usb2_mpc5121_exit(struct platform_device *pdev)
         }
 }
 
-struct fsl_usb2_platform_data fsl_usb2_mpc5121_pd = {
+static struct fsl_usb2_platform_data fsl_usb2_mpc5121_pd = {
         .big_endian_desc = 1,
         .big_endian_mmio = 1,
         .es = 1,
+        .have_sysif_regs = 0,
         .le_setup_buf = 1,
         .init = fsl_usb2_mpc5121_init,
         .exit = fsl_usb2_mpc5121_exit,
 };
 #endif /* CONFIG_PPC_MPC512x */
 
+static struct fsl_usb2_platform_data fsl_usb2_mpc8xxx_pd = {
+        .have_sysif_regs = 1,
+};
+
 static const struct of_device_id fsl_usb2_mph_dr_of_match[] = {
-        { .compatible = "fsl-usb2-mph", },
-        { .compatible = "fsl-usb2-dr", },
+        { .compatible = "fsl-usb2-mph", .data = &fsl_usb2_mpc8xxx_pd, },
+        { .compatible = "fsl-usb2-dr", .data = &fsl_usb2_mpc8xxx_pd, },
 #ifdef CONFIG_PPC_MPC512x
         { .compatible = "fsl,mpc5121-usb2-dr", .data = &fsl_usb2_mpc5121_pd, },
 #endif
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index df558f6f84e3..3e8211c1ce5a 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -308,11 +308,8 @@ static int room_on_ring(struct xhci_hcd *xhci, struct xhci_ring *ring,
 /* Ring the host controller doorbell after placing a command on the ring */
 void xhci_ring_cmd_db(struct xhci_hcd *xhci)
 {
-        u32 temp;
-
         xhci_dbg(xhci, "// Ding dong!\n");
-        temp = xhci_readl(xhci, &xhci->dba->doorbell[0]) & DB_MASK;
-        xhci_writel(xhci, temp | DB_TARGET_HOST, &xhci->dba->doorbell[0]);
+        xhci_writel(xhci, DB_VALUE_HOST, &xhci->dba->doorbell[0]);
         /* Flush PCI posted writes */
         xhci_readl(xhci, &xhci->dba->doorbell[0]);
 }
@@ -322,26 +319,24 @@ void xhci_ring_ep_doorbell(struct xhci_hcd *xhci,
                 unsigned int ep_index,
                 unsigned int stream_id)
 {
-        struct xhci_virt_ep *ep;
-        unsigned int ep_state;
-        u32 field;
         __u32 __iomem *db_addr = &xhci->dba->doorbell[slot_id];
+        struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index];
+        unsigned int ep_state = ep->ep_state;
 
-        ep = &xhci->devs[slot_id]->eps[ep_index];
-        ep_state = ep->ep_state;
         /* Don't ring the doorbell for this endpoint if there are pending
-         * cancellations because the we don't want to interrupt processing.
+         * cancellations because we don't want to interrupt processing.
          * We don't want to restart any stream rings if there's a set dequeue
          * pointer command pending because the device can choose to start any
          * stream once the endpoint is on the HW schedule.
          * FIXME - check all the stream rings for pending cancellations.
          */
-        if (!(ep_state & EP_HALT_PENDING) && !(ep_state & SET_DEQ_PENDING)
-                        && !(ep_state & EP_HALTED)) {
-                field = xhci_readl(xhci, db_addr) & DB_MASK;
-                field |= EPI_TO_DB(ep_index) | STREAM_ID_TO_DB(stream_id);
-                xhci_writel(xhci, field, db_addr);
-        }
+        if ((ep_state & EP_HALT_PENDING) || (ep_state & SET_DEQ_PENDING) ||
+            (ep_state & EP_HALTED))
+                return;
+        xhci_writel(xhci, DB_VALUE(ep_index, stream_id), db_addr);
+        /* The CPU has better things to do at this point than wait for a
+         * write-posting flush.  It'll get there soon enough.
+         */
 }
 
 /* Ring the doorbell for any rings with pending URBs */
@@ -1188,7 +1183,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
 
         addr = &xhci->op_regs->port_status_base + NUM_PORT_REGS * (port_id - 1);
         temp = xhci_readl(xhci, addr);
-        if ((temp & PORT_CONNECT) && (hcd->state == HC_STATE_SUSPENDED)) {
+        if (hcd->state == HC_STATE_SUSPENDED) {
                 xhci_dbg(xhci, "resume root hub\n");
                 usb_hcd_resume_root_hub(hcd);
         }
@@ -1710,8 +1705,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
                 /* Others already handled above */
                 break;
         }
-        dev_dbg(&td->urb->dev->dev,
-                        "ep %#x - asked for %d bytes, "
+        xhci_dbg(xhci, "ep %#x - asked for %d bytes, "
                         "%d bytes untransferred\n",
                         td->urb->ep->desc.bEndpointAddress,
                         td->urb->transfer_buffer_length,
@@ -2389,7 +2383,8 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
         }
         xhci_dbg(xhci, "\n");
         if (!in_interrupt())
-                dev_dbg(&urb->dev->dev, "ep %#x - urb len = %d, sglist used, num_trbs = %d\n",
+                xhci_dbg(xhci, "ep %#x - urb len = %d, sglist used, "
+                                "num_trbs = %d\n",
                                 urb->ep->desc.bEndpointAddress,
                                 urb->transfer_buffer_length,
                                 num_trbs);
@@ -2414,14 +2409,17 @@ static void check_trb_math(struct urb *urb, int num_trbs, int running_total)
 
 static void giveback_first_trb(struct xhci_hcd *xhci, int slot_id,
                 unsigned int ep_index, unsigned int stream_id, int start_cycle,
-                struct xhci_generic_trb *start_trb, struct xhci_td *td)
+                struct xhci_generic_trb *start_trb)
 {
         /*
          * Pass all the TRBs to the hardware at once and make sure this write
          * isn't reordered.
          */
         wmb();
-        start_trb->field[3] |= start_cycle;
+        if (start_cycle)
+                start_trb->field[3] |= start_cycle;
+        else
+                start_trb->field[3] &= ~0x1;
         xhci_ring_ep_doorbell(xhci, slot_id, ep_index, stream_id);
 }
 
@@ -2449,7 +2447,7 @@ int xhci_queue_intr_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
          * to set the polling interval (once the API is added).
          */
         if (xhci_interval != ep_interval) {
-                if (!printk_ratelimit())
+                if (printk_ratelimit())
                         dev_dbg(&urb->dev->dev, "Driver uses different interval"
                                         " (%d microframe%s) than xHCI "
                                         "(%d microframe%s)\n",
@@ -2551,9 +2549,11 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 u32 remainder = 0;
 
                 /* Don't change the cycle bit of the first TRB until later */
-                if (first_trb)
+                if (first_trb) {
                         first_trb = false;
-                else
+                        if (start_cycle == 0)
+                                field |= 0x1;
+                } else
                         field |= ep_ring->cycle_state;
 
                 /* Chain all the TRBs together; clear the chain bit in the last
@@ -2625,7 +2625,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 
         check_trb_math(urb, num_trbs, running_total);
         giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
-                        start_cycle, start_trb, td);
+                        start_cycle, start_trb);
         return 0;
 }
 
@@ -2671,7 +2671,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         /* FIXME: this doesn't deal with URB_ZERO_PACKET - need one more */
 
         if (!in_interrupt())
-                dev_dbg(&urb->dev->dev, "ep %#x - urb len = %#x (%d), addr = %#llx, num_trbs = %d\n",
+                xhci_dbg(xhci, "ep %#x - urb len = %#x (%d), "
+                                "addr = %#llx, num_trbs = %d\n",
                                 urb->ep->desc.bEndpointAddress,
                                 urb->transfer_buffer_length,
                                 urb->transfer_buffer_length,
@@ -2711,9 +2712,11 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 field = 0;
 
                 /* Don't change the cycle bit of the first TRB until later */
-                if (first_trb)
+                if (first_trb) {
                         first_trb = false;
-                else
+                        if (start_cycle == 0)
+                                field |= 0x1;
+                } else
                         field |= ep_ring->cycle_state;
 
                 /* Chain all the TRBs together; clear the chain bit in the last
@@ -2757,7 +2760,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 
         check_trb_math(urb, num_trbs, running_total);
         giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
-                        start_cycle, start_trb, td);
+                        start_cycle, start_trb);
         return 0;
 }
 
@@ -2818,13 +2821,17 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         /* Queue setup TRB - see section 6.4.1.2.1 */
         /* FIXME better way to translate setup_packet into two u32 fields? */
         setup = (struct usb_ctrlrequest *) urb->setup_packet;
+        field = 0;
+        field |= TRB_IDT | TRB_TYPE(TRB_SETUP);
+        if (start_cycle == 0)
+                field |= 0x1;
         queue_trb(xhci, ep_ring, false, true,
                         /* FIXME endianness is probably going to bite my ass here. */
                         setup->bRequestType | setup->bRequest << 8 | setup->wValue << 16,
                         setup->wIndex | setup->wLength << 16,
                         TRB_LEN(8) | TRB_INTR_TARGET(0),
                         /* Immediate data in pointer */
-                        TRB_IDT | TRB_TYPE(TRB_SETUP));
+                        field);
 
         /* If there's data, queue data TRBs */
         field = 0;
@@ -2859,7 +2866,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                         field | TRB_IOC | TRB_TYPE(TRB_STATUS) | ep_ring->cycle_state);
 
         giveback_first_trb(xhci, slot_id, ep_index, 0,
-                        start_cycle, start_trb, td);
+                        start_cycle, start_trb);
         return 0;
 }
 
@@ -2900,6 +2907,7 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         int running_total, trb_buff_len, td_len, td_remain_len, ret;
         u64 start_addr, addr;
         int i, j;
+        bool more_trbs_coming;
 
         ep_ring = xhci->devs[slot_id]->eps[ep_index].ring;
 
@@ -2910,7 +2918,7 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         }
 
         if (!in_interrupt())
-                dev_dbg(&urb->dev->dev, "ep %#x - urb len = %#x (%d),"
+                xhci_dbg(xhci, "ep %#x - urb len = %#x (%d),"
                                 " addr = %#llx, num_tds = %d\n",
                                 urb->ep->desc.bEndpointAddress,
                                 urb->transfer_buffer_length,
@@ -2950,7 +2958,10 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                                 field |= TRB_TYPE(TRB_ISOC);
                                 /* Assume URB_ISO_ASAP is set */
                                 field |= TRB_SIA;
-                                if (i > 0)
+                                if (i == 0) {
+                                        if (start_cycle == 0)
+                                                field |= 0x1;
+                                } else
                                         field |= ep_ring->cycle_state;
                                 first_trb = false;
                         } else {
@@ -2965,9 +2976,11 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                          */
                         if (j < trbs_per_td - 1) {
                                 field |= TRB_CHAIN;
+                                more_trbs_coming = true;
                         } else {
                                 td->last_trb = ep_ring->enqueue;
                                 field |= TRB_IOC;
+                                more_trbs_coming = false;
                         }
 
                         /* Calculate TRB length */
@@ -2980,7 +2993,7 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                         length_field = TRB_LEN(trb_buff_len) |
                                 remainder |
                                 TRB_INTR_TARGET(0);
-                        queue_trb(xhci, ep_ring, false, false,
+                        queue_trb(xhci, ep_ring, false, more_trbs_coming,
                                 lower_32_bits(addr),
                                 upper_32_bits(addr),
                                 length_field,
@@ -3003,10 +3016,8 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 }
         }
 
-        wmb();
-        start_trb->field[3] |= start_cycle;
-
-        xhci_ring_ep_doorbell(xhci, slot_id, ep_index, urb->stream_id);
+        giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
+                        start_cycle, start_trb);
         return 0;
 }
 
@@ -3064,7 +3075,7 @@ int xhci_queue_isoc_tx_prepare(struct xhci_hcd *xhci, gfp_t mem_flags,
          * to set the polling interval (once the API is added).
          */
         if (xhci_interval != ep_interval) {
-                if (!printk_ratelimit())
+                if (printk_ratelimit())
                         dev_dbg(&urb->dev->dev, "Driver uses different interval"
                                         " (%d microframe%s) than xHCI "
                                         "(%d microframe%s)\n",
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 45e4a3108cc3..34cf4e165877 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -226,7 +226,8 @@ static int xhci_setup_msi(struct xhci_hcd *xhci)
 static int xhci_setup_msix(struct xhci_hcd *xhci)
 {
         int i, ret = 0;
-        struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+        struct usb_hcd *hcd = xhci_to_hcd(xhci);
+        struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
 
         /*
          * calculate number of msi-x vectors supported.
@@ -265,6 +266,7 @@ static int xhci_setup_msix(struct xhci_hcd *xhci)
                         goto disable_msix;
         }
 
+        hcd->msix_enabled = 1;
         return ret;
 
 disable_msix:
@@ -280,7 +282,8 @@ free_entries:
 /* Free any IRQs and disable MSI-X */
 static void xhci_cleanup_msix(struct xhci_hcd *xhci)
 {
-        struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+        struct usb_hcd *hcd = xhci_to_hcd(xhci);
+        struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
 
         xhci_free_irq(xhci);
 
@@ -292,6 +295,7 @@ static void xhci_cleanup_msix(struct xhci_hcd *xhci)
                 pci_disable_msi(pdev);
         }
 
+        hcd->msix_enabled = 0;
         return;
 }
 
@@ -508,9 +512,10 @@ void xhci_stop(struct usb_hcd *hcd)
         spin_lock_irq(&xhci->lock);
         xhci_halt(xhci);
         xhci_reset(xhci);
-        xhci_cleanup_msix(xhci);
         spin_unlock_irq(&xhci->lock);
 
+        xhci_cleanup_msix(xhci);
+
 #ifdef CONFIG_USB_XHCI_HCD_DEBUGGING
         /* Tell the event ring poll function not to reschedule */
         xhci->zombie = 1;
@@ -544,9 +549,10 @@ void xhci_shutdown(struct usb_hcd *hcd)
 
         spin_lock_irq(&xhci->lock);
         xhci_halt(xhci);
-        xhci_cleanup_msix(xhci);
         spin_unlock_irq(&xhci->lock);
 
+        xhci_cleanup_msix(xhci);
+
         xhci_dbg(xhci, "xhci_shutdown completed - status = %x\n",
                     xhci_readl(xhci, &xhci->op_regs->status));
 }
@@ -647,6 +653,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
         int                     rc = 0;
         struct usb_hcd          *hcd = xhci_to_hcd(xhci);
         u32                     command;
+        int                     i;
 
         spin_lock_irq(&xhci->lock);
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
@@ -677,10 +684,15 @@ int xhci_suspend(struct xhci_hcd *xhci)
                 spin_unlock_irq(&xhci->lock);
                 return -ETIMEDOUT;
         }
-        /* step 5: remove core well power */
-        xhci_cleanup_msix(xhci);
         spin_unlock_irq(&xhci->lock);
 
+        /* step 5: remove core well power */
+        /* synchronize irq when using MSI-X */
+        if (xhci->msix_entries) {
+                for (i = 0; i < xhci->msix_count; i++)
+                        synchronize_irq(xhci->msix_entries[i].vector);
+        }
+
         return rc;
 }
 
@@ -694,7 +706,6 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 {
         u32                     command, temp = 0;
         struct usb_hcd          *hcd = xhci_to_hcd(xhci);
-        struct pci_dev          *pdev = to_pci_dev(hcd->self.controller);
         int     old_state, retval;
 
         old_state = hcd->state;
@@ -729,9 +740,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                 xhci_dbg(xhci, "Stop HCD\n");
                 xhci_halt(xhci);
                 xhci_reset(xhci);
-                if (hibernated)
-                        xhci_cleanup_msix(xhci);
                 spin_unlock_irq(&xhci->lock);
+                xhci_cleanup_msix(xhci);
 
 #ifdef CONFIG_USB_XHCI_HCD_DEBUGGING
                 /* Tell the event ring poll function not to reschedule */
@@ -765,30 +775,6 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                 return retval;
         }
 
-        spin_unlock_irq(&xhci->lock);
-        /* Re-setup MSI-X */
-        if (hcd->irq)
-                free_irq(hcd->irq, hcd);
-        hcd->irq = -1;
-
-        retval = xhci_setup_msix(xhci);
-        if (retval)
-                /* fall back to msi*/
-                retval = xhci_setup_msi(xhci);
-
-        if (retval) {
-                /* fall back to legacy interrupt*/
-                retval = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
-                                        hcd->irq_descr, hcd);
-                if (retval) {
-                        xhci_err(xhci, "request interrupt %d failed\n",
-                                        pdev->irq);
-                        return retval;
-                }
-                hcd->irq = pdev->irq;
-        }
-
-        spin_lock_irq(&xhci->lock);
         /* step 4: set Run/Stop bit */
         command = xhci_readl(xhci, &xhci->op_regs->command);
         command |= CMD_RUN;
@@ -2445,8 +2431,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
                 xhci_err(xhci, "Error while assigning device slot ID\n");
                 return 0;
         }
-        /* xhci_alloc_virt_device() does not touch rings; no need to lock */
-        if (!xhci_alloc_virt_device(xhci, xhci->slot_id, udev, GFP_KERNEL)) {
+        /* xhci_alloc_virt_device() does not touch rings; no need to lock.
+         * Use GFP_NOIO, since this function can be called from
+         * xhci_discover_or_reset_device(), which may be called as part of
+         * mass storage driver error handling.
+         */
+        if (!xhci_alloc_virt_device(xhci, xhci->slot_id, udev, GFP_NOIO)) {
                 /* Disable slot, if we can do it without mem alloc */
                 xhci_warn(xhci, "Could not allocate xHCI USB device data structures\n");
                 spin_lock_irqsave(&xhci->lock, flags);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 170c367112d2..7f236fd22015 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -436,22 +436,18 @@ struct xhci_run_regs {
 /**
  * struct doorbell_array
  *
+ * Bits  0 -  7: Endpoint target
+ * Bits  8 - 15: RsvdZ
+ * Bits 16 - 31: Stream ID
+ *
  * Section 5.6
  */
 struct xhci_doorbell_array {
         u32     doorbell[256];
 };
 
-#define DB_TARGET_MASK          0xFFFFFF00
-#define DB_STREAM_ID_MASK       0x0000FFFF
-#define DB_TARGET_HOST          0x0
-#define DB_STREAM_ID_HOST       0x0
-#define DB_MASK                 (0xff << 8)
-
-/* Endpoint Target - bits 0:7 */
-#define EPI_TO_DB(p)            (((p) + 1) & 0xff)
-#define STREAM_ID_TO_DB(p)      (((p) & 0xffff) << 16)
-
+#define DB_VALUE(ep, stream)    ((((ep) + 1) & 0xff) | ((stream) << 16))
+#define DB_VALUE_HOST           0x00000000
 
 /**
  * struct xhci_protocol_caps
diff --git a/drivers/usb/misc/usbled.c b/drivers/usb/misc/usbled.c
index 1732d9bc097e..1616ad1793a4 100644
--- a/drivers/usb/misc/usbled.c
+++ b/drivers/usb/misc/usbled.c
@@ -45,7 +45,7 @@ struct usb_led {
 
 static void change_color(struct usb_led *led)
 {
-        int retval;
+        int retval = 0;
         unsigned char *buffer;
 
         buffer = kmalloc(8, GFP_KERNEL);
diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index 4ff21587ab03..f7a205738032 100644
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -776,7 +776,6 @@ static const struct usb_device_id uss720_table[] = {
         { USB_DEVICE(0x0557, 0x2001) },
         { USB_DEVICE(0x0729, 0x1284) },
         { USB_DEVICE(0x1293, 0x0002) },
-        { USB_DEVICE(0x1293, 0x0002) },
         { USB_DEVICE(0x050d, 0x0002) },
         { }                                             /* Terminating entry */
 };
diff --git a/drivers/usb/otg/nop-usb-xceiv.c b/drivers/usb/otg/nop-usb-xceiv.c
index e70014ab0976..8acf165fe13b 100644
--- a/drivers/usb/otg/nop-usb-xceiv.c
+++ b/drivers/usb/otg/nop-usb-xceiv.c
@@ -132,6 +132,8 @@ static int __devinit nop_usb_xceiv_probe(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, nop);
 
+        BLOCKING_INIT_NOTIFIER_HEAD(&nop->otg.notifier);
+
         return 0;
 exit:
         kfree(nop);
diff --git a/drivers/usb/otg/ulpi.c b/drivers/usb/otg/ulpi.c
index 059d9ac0ab5b..770d799d5afb 100644
--- a/drivers/usb/otg/ulpi.c
+++ b/drivers/usb/otg/ulpi.c
@@ -45,7 +45,7 @@ struct ulpi_info {
 /* ULPI hardcoded IDs, used for probing */
 static struct ulpi_info ulpi_ids[] = {
         ULPI_INFO(ULPI_ID(0x04cc, 0x1504), "NXP ISP1504"),
-        ULPI_INFO(ULPI_ID(0x0424, 0x0006), "SMSC USB3319"),
+        ULPI_INFO(ULPI_ID(0x0424, 0x0006), "SMSC USB331x"),
 };
 
 static int ulpi_set_otg_flags(struct otg_transceiver *otg)
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 63f7cc45bcac..7b8815ddf368 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -486,12 +486,22 @@ static void ch341_read_int_callback(struct urb *urb)
         if (actual_length >= 4) {
                 struct ch341_private *priv = usb_get_serial_port_data(port);
                 unsigned long flags;
+                u8 prev_line_status = priv->line_status;
 
                 spin_lock_irqsave(&priv->lock, flags);
                 priv->line_status = (~(data[2])) & CH341_BITS_MODEM_STAT;
                 if ((data[1] & CH341_MULT_STAT))
                         priv->multi_status_change = 1;
                 spin_unlock_irqrestore(&priv->lock, flags);
+
+                if ((priv->line_status ^ prev_line_status) & CH341_BIT_DCD) {
+                        struct tty_struct *tty = tty_port_tty_get(&port->port);
+                        if (tty)
+                                usb_serial_handle_dcd_change(port, tty,
+                                            priv->line_status & CH341_BIT_DCD);
+                        tty_kref_put(tty);
+                }
+
                 wake_up_interruptible(&priv->delta_msr_wait);
         }
 
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 8d7731dbf478..735ea03157ab 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -49,7 +49,6 @@ static int cp210x_tiocmset_port(struct usb_serial_port *port, struct file *,
 static void cp210x_break_ctl(struct tty_struct *, int);
 static int cp210x_startup(struct usb_serial *);
 static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
-static int cp210x_carrier_raised(struct usb_serial_port *p);
 
 static int debug;
 
@@ -87,7 +86,6 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x8115) }, /* Arygon NFC/Mifare Reader */
         { USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */
         { USB_DEVICE(0x10C4, 0x813F) }, /* Tams Master Easy Control */
-        { USB_DEVICE(0x10C4, 0x8149) }, /* West Mountain Radio Computerized Battery Analyzer */
         { USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */
         { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
         { USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */
@@ -110,7 +108,9 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
         { USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */
         { USB_DEVICE(0x10C4, 0x83A8) }, /* Amber Wireless AMB2560 */
+        { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */
         { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
+        { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
         { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
         { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
         { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
@@ -165,8 +165,7 @@ static struct usb_serial_driver cp210x_device = {
         .tiocmget               = cp210x_tiocmget,
         .tiocmset               = cp210x_tiocmset,
         .attach                 = cp210x_startup,
-        .dtr_rts                = cp210x_dtr_rts,
-        .carrier_raised         = cp210x_carrier_raised
+        .dtr_rts                = cp210x_dtr_rts
 };
 
 /* Config request types */
@@ -765,15 +764,6 @@ static int cp210x_tiocmget (struct tty_struct *tty, struct file *file)
         return result;
 }
 
-static int cp210x_carrier_raised(struct usb_serial_port *p)
-{
-        unsigned int control;
-        cp210x_get_config(p, CP210X_GET_MDMSTS, &control, 1);
-        if (control & CONTROL_DCD)
-                return 1;
-        return 0;
-}
-
 static void cp210x_break_ctl (struct tty_struct *tty, int break_state)
 {
         struct usb_serial_port *port = tty->driver_data;
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index b92070c103cd..666e5a6edd82 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -455,7 +455,6 @@ static int digi_write_room(struct tty_struct *tty);
 static int digi_chars_in_buffer(struct tty_struct *tty);
 static int digi_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void digi_close(struct usb_serial_port *port);
-static int digi_carrier_raised(struct usb_serial_port *port);
 static void digi_dtr_rts(struct usb_serial_port *port, int on);
 static int digi_startup_device(struct usb_serial *serial);
 static int digi_startup(struct usb_serial *serial);
@@ -511,7 +510,6 @@ static struct usb_serial_driver digi_acceleport_2_device = {
         .open =                         digi_open,
         .close =                        digi_close,
         .dtr_rts =                      digi_dtr_rts,
-        .carrier_raised =               digi_carrier_raised,
         .write =                        digi_write,
         .write_room =                   digi_write_room,
         .write_bulk_callback =          digi_write_bulk_callback,
@@ -1339,14 +1337,6 @@ static void digi_dtr_rts(struct usb_serial_port *port, int on)
         digi_set_modem_signals(port, on * (TIOCM_DTR|TIOCM_RTS), 1);
 }
 
-static int digi_carrier_raised(struct usb_serial_port *port)
-{
-        struct digi_port *priv = usb_get_serial_port_data(port);
-        if (priv->dp_modem_signals & TIOCM_CD)
-                return 1;
-        return 0;
-}
-
 static int digi_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
         int ret;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index a2668d089260..4787c0cd063f 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -676,7 +676,17 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
-        { USB_DEVICE(ICOM_ID1_VID, ICOM_ID1_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2C2_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2D_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2VT_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2VR_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP4KVT_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP4KVR_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2KVT_PID) },
+        { USB_DEVICE(ICOM_VID, ICOM_ID_RP2KVR_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_THORLABS_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index bf0867285481..ed160def8584 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -569,11 +569,23 @@
 #define OCT_US101_PID           0x0421  /* OCT US101 USB to RS-232 */
 
 /*
- * Icom ID-1 digital transceiver
- */
-
-#define ICOM_ID1_VID            0x0C26
-#define ICOM_ID1_PID            0x0004
+ * Definitions for Icom Inc. devices
+ */
+#define ICOM_VID                0x0C26 /* Icom vendor ID */
+/* Note: ID-1 is a communications tranceiver for HAM-radio operators */
+#define ICOM_ID_1_PID           0x0004 /* ID-1 USB to RS-232 */
+/* Note: OPC is an Optional cable to connect an Icom Tranceiver */
+#define ICOM_OPC_U_UC_PID       0x0018 /* OPC-478UC, OPC-1122U cloning cable */
+/* Note: ID-RP* devices are Icom Repeater Devices for HAM-radio */
+#define ICOM_ID_RP2C1_PID       0x0009 /* ID-RP2C Asset 1 to RS-232 */
+#define ICOM_ID_RP2C2_PID       0x000A /* ID-RP2C Asset 2 to RS-232 */
+#define ICOM_ID_RP2D_PID        0x000B /* ID-RP2D configuration port*/
+#define ICOM_ID_RP2VT_PID       0x000C /* ID-RP2V Transmit config port */
+#define ICOM_ID_RP2VR_PID       0x000D /* ID-RP2V Receive config port */
+#define ICOM_ID_RP4KVT_PID      0x0010 /* ID-RP4000V Transmit config port */
+#define ICOM_ID_RP4KVR_PID      0x0011 /* ID-RP4000V Receive config port */
+#define ICOM_ID_RP2KVT_PID      0x0012 /* ID-RP2000V Transmit config port */
+#define ICOM_ID_RP2KVR_PID      0x0013 /* ID-RP2000V Receive config port */
 
 /*
  * GN Otometrics (http://www.otometrics.com)
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index e6833e216fc9..e4db5ad2bc55 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -479,6 +479,26 @@ int usb_serial_handle_break(struct usb_serial_port *port)
 }
 EXPORT_SYMBOL_GPL(usb_serial_handle_break);
 
+/**
+ *      usb_serial_handle_dcd_change - handle a change of carrier detect state
+ *      @port: usb_serial_port structure for the open port
+ *      @tty: tty_struct structure for the port
+ *      @status: new carrier detect status, nonzero if active
+ */
+void usb_serial_handle_dcd_change(struct usb_serial_port *usb_port,
+                                struct tty_struct *tty, unsigned int status)
+{
+        struct tty_port *port = &usb_port->port;
+
+        dbg("%s - port %d, status %d", __func__, usb_port->number, status);
+
+        if (status)
+                wake_up_interruptible(&port->open_wait);
+        else if (tty && !C_CLOCAL(tty))
+                tty_hangup(tty);
+}
+EXPORT_SYMBOL_GPL(usb_serial_handle_dcd_change);
+
 int usb_serial_generic_resume(struct usb_serial *serial)
 {
         struct usb_serial_port *port;
diff --git a/drivers/usb/serial/io_tables.h b/drivers/usb/serial/io_tables.h
index 6ab2a3f97fe8..178b22eb32b1 100644
--- a/drivers/usb/serial/io_tables.h
+++ b/drivers/usb/serial/io_tables.h
@@ -199,6 +199,7 @@ static struct usb_serial_driver epic_device = {
                 .name           = "epic",
         },
         .description            = "EPiC device",
+        .usb_driver             = &io_driver,
         .id_table               = Epic_port_id_table,
         .num_ports              = 1,
         .open                   = edge_open,
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index 12ed594f5f80..99b97c04896f 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -1275,6 +1275,7 @@ static struct usb_serial_driver iuu_device = {
                    .name = "iuu_phoenix",
                    },
         .id_table = id_table,
+        .usb_driver = &iuu_driver,
         .num_ports = 1,
         .bulk_in_size = 512,
         .bulk_out_size = 512,
diff --git a/drivers/usb/serial/keyspan.h b/drivers/usb/serial/keyspan.h
index 2d8baf6ac472..ce134dc28ddf 100644
--- a/drivers/usb/serial/keyspan.h
+++ b/drivers/usb/serial/keyspan.h
@@ -546,6 +546,7 @@ static struct usb_serial_driver keyspan_pre_device = {
                 .name           = "keyspan_no_firm",
         },
         .description            = "Keyspan - (without firmware)",
+        .usb_driver             = &keyspan_driver,
         .id_table               = keyspan_pre_ids,
         .num_ports              = 1,
         .attach                 = keyspan_fake_startup,
@@ -557,6 +558,7 @@ static struct usb_serial_driver keyspan_1port_device = {
                 .name           = "keyspan_1",
         },
         .description            = "Keyspan 1 port adapter",
+        .usb_driver             = &keyspan_driver,
         .id_table               = keyspan_1port_ids,
         .num_ports              = 1,
         .open                   = keyspan_open,
@@ -579,6 +581,7 @@ static struct usb_serial_driver keyspan_2port_device = {
                 .name           = "keyspan_2",
         },
         .description            = "Keyspan 2 port adapter",
+        .usb_driver             = &keyspan_driver,
         .id_table               = keyspan_2port_ids,
         .num_ports              = 2,
         .open                   = keyspan_open,
@@ -601,6 +604,7 @@ static struct usb_serial_driver keyspan_4port_device = {
                 .name           = "keyspan_4",
         },
         .description            = "Keyspan 4 port adapter",
+        .usb_driver             = &keyspan_driver,
         .id_table               = keyspan_4port_ids,
         .num_ports              = 4,
         .open                   = keyspan_open,
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index a10dd5676ccc..554a8693a463 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -679,22 +679,6 @@ static void keyspan_pda_dtr_rts(struct usb_serial_port *port, int on)
         }
 }
 
-static int keyspan_pda_carrier_raised(struct usb_serial_port *port)
-{
-        struct usb_serial *serial = port->serial;
-        unsigned char modembits;
-
-        /* If we can read the modem status and the DCD is low then
-           carrier is not raised yet */
-        if (keyspan_pda_get_modem_info(serial, &modembits) >= 0) {
-                if (!(modembits & (1>>6)))
-                        return 0;
-        }
-        /* Carrier raised, or we failed (eg disconnected) so
-           progress accordingly */
-        return 1;
-}
-
 
 static int keyspan_pda_open(struct tty_struct *tty,
                                         struct usb_serial_port *port)
@@ -881,7 +865,6 @@ static struct usb_serial_driver keyspan_pda_device = {
         .id_table =             id_table_std,
         .num_ports =            1,
         .dtr_rts =              keyspan_pda_dtr_rts,
-        .carrier_raised =       keyspan_pda_carrier_raised,
         .open =                 keyspan_pda_open,
         .close =                keyspan_pda_close,
         .write =                keyspan_pda_write,
diff --git a/drivers/usb/serial/moto_modem.c b/drivers/usb/serial/moto_modem.c
index cf1718394e18..653465f61d4a 100644
--- a/drivers/usb/serial/moto_modem.c
+++ b/drivers/usb/serial/moto_modem.c
@@ -44,6 +44,7 @@ static struct usb_serial_driver moto_device = {
                 .name =         "moto-modem",
         },
         .id_table =             id_table,
+        .usb_driver =           &moto_driver,
         .num_ports =            1,
 };
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 748778288d94..5f46838dfee5 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -382,7 +382,16 @@ static void option_instat_callback(struct urb *urb);
 #define HAIER_VENDOR_ID                         0x201e
 #define HAIER_PRODUCT_CE100                     0x2009
 
-#define CINTERION_VENDOR_ID                     0x0681
+/* Cinterion (formerly Siemens) products */
+#define SIEMENS_VENDOR_ID                               0x0681
+#define CINTERION_VENDOR_ID                             0x1e2d
+#define CINTERION_PRODUCT_HC25_MDM              0x0047
+#define CINTERION_PRODUCT_HC25_MDMNET   0x0040
+#define CINTERION_PRODUCT_HC28_MDM              0x004C
+#define CINTERION_PRODUCT_HC28_MDMNET   0x004A /* same for HC28J */
+#define CINTERION_PRODUCT_EU3_E                 0x0051
+#define CINTERION_PRODUCT_EU3_P                 0x0052
+#define CINTERION_PRODUCT_PH8                   0x0053
 
 /* Olivetti products */
 #define OLIVETTI_VENDOR_ID                      0x0b3c
@@ -944,7 +953,17 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100F) },
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)},
         { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)},
-        { USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) },
+        /* Cinterion */
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) },
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, 
+        { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
+        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
+        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
+        { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+
         { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
         { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
         { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
index 5be866bb7a41..73613205be7a 100644
--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -157,6 +157,7 @@ static struct usb_serial_driver oti6858_device = {
                 .name =         "oti6858",
         },
         .id_table =             id_table,
+        .usb_driver =           &oti6858_driver,
         .num_ports =            1,
         .open =                 oti6858_open,
         .close =                oti6858_close,
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 8ae4c6cbc38a..08c9181b8e48 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -50,6 +50,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
         { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
         { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
         { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
@@ -677,9 +678,11 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
 {
 
         struct pl2303_private *priv = usb_get_serial_port_data(port);
+        struct tty_struct *tty;
         unsigned long flags;
         u8 status_idx = UART_STATE;
         u8 length = UART_STATE + 1;
+        u8 prev_line_status;
         u16 idv, idp;
 
         idv = le16_to_cpu(port->serial->dev->descriptor.idVendor);
@@ -701,11 +704,20 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
 
         /* Save off the uart status for others to look at */
         spin_lock_irqsave(&priv->lock, flags);
+        prev_line_status = priv->line_status;
         priv->line_status = data[status_idx];
         spin_unlock_irqrestore(&priv->lock, flags);
         if (priv->line_status & UART_BREAK_ERROR)
                 usb_serial_handle_break(port);
         wake_up_interruptible(&priv->delta_msr_wait);
+
+        tty = tty_port_tty_get(&port->port);
+        if (!tty)
+                return;
+        if ((priv->line_status ^ prev_line_status) & UART_DCD)
+                usb_serial_handle_dcd_change(port, tty,
+                                priv->line_status & UART_DCD);
+        tty_kref_put(tty);
 }
 
 static void pl2303_read_int_callback(struct urb *urb)
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 43eb9bdad422..1b025f75dafd 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -21,6 +21,7 @@
 #define PL2303_PRODUCT_ID_MMX           0x0612
 #define PL2303_PRODUCT_ID_GPRS          0x0609
 #define PL2303_PRODUCT_ID_HCR331        0x331a
+#define PL2303_PRODUCT_ID_MOTOROLA      0x0307
 
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
diff --git a/drivers/usb/serial/qcaux.c b/drivers/usb/serial/qcaux.c
index 214a3e504292..30b73e68a904 100644
--- a/drivers/usb/serial/qcaux.c
+++ b/drivers/usb/serial/qcaux.c
@@ -36,6 +36,7 @@
 #define UTSTARCOM_PRODUCT_UM175_V1              0x3712
 #define UTSTARCOM_PRODUCT_UM175_V2              0x3714
 #define UTSTARCOM_PRODUCT_UM175_ALLTEL          0x3715
+#define PANTECH_PRODUCT_UML290_VZW              0x3718
 
 /* CMOTECH devices */
 #define CMOTECH_VENDOR_ID                       0x16d8
@@ -66,6 +67,7 @@ static struct usb_device_id id_table[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_U520, 0xff, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) },
         { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
@@ -84,6 +86,7 @@ static struct usb_serial_driver qcaux_device = {
                 .name =         "qcaux",
         },
         .id_table =             id_table,
+        .usb_driver =           &qcaux_driver,
         .num_ports =            1,
 };
 
diff --git a/drivers/usb/serial/siemens_mpi.c b/drivers/usb/serial/siemens_mpi.c
index cb8195cabfde..74cd4ccdb3fc 100644
--- a/drivers/usb/serial/siemens_mpi.c
+++ b/drivers/usb/serial/siemens_mpi.c
@@ -42,6 +42,7 @@ static struct usb_serial_driver siemens_usb_mpi_device = {
                 .name =         "siemens_mpi",
         },
         .id_table =             id_table,
+        .usb_driver =           &siemens_usb_mpi_driver,
         .num_ports =            1,
 };
 
diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
index 765aa983bf58..cbfb70bffdd0 100644
--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -133,7 +133,7 @@ struct spcp8x5_usb_ctrl_arg {
 
 /* how come ??? */
 #define UART_STATE                      0x08
-#define UART_STATE_TRANSIENT_MASK       0x74
+#define UART_STATE_TRANSIENT_MASK       0x75
 #define UART_DCD                        0x01
 #define UART_DSR                        0x02
 #define UART_BREAK_ERROR                0x04
@@ -525,6 +525,10 @@ static void spcp8x5_process_read_urb(struct urb *urb)
                 /* overrun is special, not associated with a char */
                 if (status & UART_OVERRUN_ERROR)
                         tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+
+                if (status & UART_DCD)
+                        usb_serial_handle_dcd_change(port, tty,
+                                   priv->line_status & MSR_STATUS_LINE_DCD);
         }
 
         tty_insert_flip_string_fixed_flag(tty, data, tty_flag,
@@ -645,6 +649,7 @@ static struct usb_serial_driver spcp8x5_device = {
                 .name =         "SPCP8x5",
         },
         .id_table               = id_table,
+        .usb_driver             = &spcp8x5_driver,
         .num_ports              = 1,
         .open                   = spcp8x5_open,
         .dtr_rts                = spcp8x5_dtr_rts,
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 6954de50c0ff..546a52179bec 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1344,11 +1344,15 @@ int usb_serial_register(struct usb_serial_driver *driver)
                 return -ENODEV;
 
         fixup_generic(driver);
-        if (driver->usb_driver)
-                driver->usb_driver->supports_autosuspend = 1;
 
         if (!driver->description)
                 driver->description = driver->driver.name;
+        if (!driver->usb_driver) {
+                WARN(1, "Serial driver %s has no usb_driver\n",
+                                driver->description);
+                return -EINVAL;
+        }
+        driver->usb_driver->supports_autosuspend = 1;
 
         /* Add this device to our list of devices */
         mutex_lock(&table_lock);
diff --git a/drivers/usb/serial/usb_debug.c b/drivers/usb/serial/usb_debug.c
index f2ed6a31be77..95a82148ee81 100644
--- a/drivers/usb/serial/usb_debug.c
+++ b/drivers/usb/serial/usb_debug.c
@@ -75,6 +75,7 @@ static struct usb_serial_driver debug_device = {
                 .name =         "debug",
         },
         .id_table =             id_table,
+        .usb_driver =           &debug_driver,
         .num_ports =            1,
         .bulk_out_size =        USB_DEBUG_MAX_PACKET_SIZE,
         .break_ctl =            usb_debug_break_ctl,
diff --git a/drivers/usb/storage/unusual_cypress.h b/drivers/usb/storage/unusual_cypress.h
index c854fdebe0ae..2c8553026222 100644
--- a/drivers/usb/storage/unusual_cypress.h
+++ b/drivers/usb/storage/unusual_cypress.h
@@ -31,4 +31,9 @@ UNUSUAL_DEV(  0x04b4, 0x6831, 0x0000, 0x9999,
                 "Cypress ISD-300LP",
                 USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
 
+UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x9999,
+                "Super Top",
+                "USB 2.0  SATA BRIDGE",
+                USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
+
 #endif /* defined(CONFIG_USB_STORAGE_CYPRESS_ATACB) || ... */
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index fcc1e32ce256..24bd5d7c3deb 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1044,6 +1044,15 @@ UNUSUAL_DEV(  0x084d, 0x0011, 0x0110, 0x0110,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_BULK32),
 
+/* Reported by <ttkspam@free.fr>
+ * The device reports a vendor-specific device class, requiring an
+ * explicit vendor/product match.
+ */
+UNUSUAL_DEV(  0x0851, 0x1542, 0x0002, 0x0002,
+                "MagicPixel",
+                "FW_Omega2",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL, 0),
+
 /* Andrew Lunn <andrew@lunn.ch>
  * PanDigital Digital Picture Frame. Does not like ALLOW_MEDIUM_REMOVAL
  * on LUN 4.
@@ -1872,6 +1881,15 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_READ_DISC_INFO ),
 
+/* Patch by Richard Schütz <r.schtz@t-online.de>
+ * This external hard drive enclosure uses a JMicron chip which
+ * needs the US_FL_IGNORE_RESIDUE flag to work properly. */
+UNUSUAL_DEV(  0x1e68, 0x001b, 0x0000, 0x0000,
+                "TrekStor GmbH & Co. KG",
+                "DataStation maxi g.u",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
+
 UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001,
                 "ST",
                 "2A",
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 9b3ca103135f..f616cefc95ba 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -128,8 +128,7 @@ static void handle_tx(struct vhost_net *net)
         size_t hdr_size;
         struct socket *sock;
 
-        /* TODO: check that we are running from vhost_worker?
-         * Not sure it's worth it, it's straight-forward enough. */
+        /* TODO: check that we are running from vhost_worker? */
         sock = rcu_dereference_check(vq->private_data, 1);
         if (!sock)
                 return;
@@ -306,7 +305,8 @@ static void handle_rx_big(struct vhost_net *net)
         size_t len, total_len = 0;
         int err;
         size_t hdr_size;
-        struct socket *sock = rcu_dereference(vq->private_data);
+        /* TODO: check that we are running from vhost_worker? */
+        struct socket *sock = rcu_dereference_check(vq->private_data, 1);
         if (!sock || skb_queue_empty(&sock->sk->sk_receive_queue))
                 return;
 
@@ -415,7 +415,8 @@ static void handle_rx_mergeable(struct vhost_net *net)
         int err, headcount;
         size_t vhost_hlen, sock_hlen;
         size_t vhost_len, sock_len;
-        struct socket *sock = rcu_dereference(vq->private_data);
+        /* TODO: check that we are running from vhost_worker? */
+        struct socket *sock = rcu_dereference_check(vq->private_data, 1);
         if (!sock || skb_queue_empty(&sock->sk->sk_receive_queue))
                 return;
 
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 2af44b7b1f3f..b3363ae38518 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -173,9 +173,9 @@ static inline int vhost_has_feature(struct vhost_dev *dev, int bit)
 {
         unsigned acked_features;
 
-        acked_features =
-                rcu_dereference_index_check(dev->acked_features,
-                                            lockdep_is_held(&dev->mutex));
+        /* TODO: check that we are running from vhost_worker or dev mutex is
+         * held? */
+        acked_features = rcu_dereference_index_check(dev->acked_features, 1);
         return acked_features & (1 << bit);
 }
 
diff --git a/drivers/video/arkfb.c b/drivers/video/arkfb.c
index d583bea608fd..391ac939f011 100644
--- a/drivers/video/arkfb.c
+++ b/drivers/video/arkfb.c
@@ -23,7 +23,7 @@
 #include <linux/svga.h>
 #include <linux/init.h>
 #include <linux/pci.h>
-#include <linux/console.h> /* Why should fb driver call console functions? because acquire_console_sem() */
+#include <linux/console.h> /* Why should fb driver call console functions? because console_lock() */
 #include <video/vga.h>
 
 #ifdef CONFIG_MTRR
@@ -1091,12 +1091,12 @@ static int ark_pci_suspend (struct pci_dev* dev, pm_message_t state)
 
         dev_info(info->device, "suspend\n");
 
-        acquire_console_sem();
+        console_lock();
         mutex_lock(&(par->open_lock));
 
         if ((state.event == PM_EVENT_FREEZE) || (par->ref_count == 0)) {
                 mutex_unlock(&(par->open_lock));
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
 
@@ -1107,7 +1107,7 @@ static int ark_pci_suspend (struct pci_dev* dev, pm_message_t state)
         pci_set_power_state(dev, pci_choose_state(dev, state));
 
         mutex_unlock(&(par->open_lock));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -1122,7 +1122,7 @@ static int ark_pci_resume (struct pci_dev* dev)
 
         dev_info(info->device, "resume\n");
 
-        acquire_console_sem();
+        console_lock();
         mutex_lock(&(par->open_lock));
 
         if (par->ref_count == 0)
@@ -1141,7 +1141,7 @@ static int ark_pci_resume (struct pci_dev* dev)
 
 fail:
         mutex_unlock(&(par->open_lock));
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 #else
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index dd9de2e80580..4cb6a576c567 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -1860,11 +1860,11 @@ static void aty128_early_resume(void *data)
 {
         struct aty128fb_par *par = data;
 
-        if (try_acquire_console_sem())
+        if (!console_trylock())
                 return;
         pci_restore_state(par->pdev);
         aty128_do_resume(par->pdev);
-        release_console_sem();
+        console_unlock();
 }
 #endif /* CONFIG_PPC_PMAC */
 
@@ -2438,7 +2438,7 @@ static int aty128_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 
         printk(KERN_DEBUG "aty128fb: suspending...\n");
         
-        acquire_console_sem();
+        console_lock();
 
         fb_set_suspend(info, 1);
 
@@ -2470,7 +2470,7 @@ static int aty128_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         if (state.event != PM_EVENT_ON)
                 aty128_set_suspend(par, 1);
 
-        release_console_sem();
+        console_unlock();
 
         pdev->dev.power.power_state = state;
 
@@ -2527,9 +2527,9 @@ static int aty128_pci_resume(struct pci_dev *pdev)
 {
         int rc;
 
-        acquire_console_sem();
+        console_lock();
         rc = aty128_do_resume(pdev);
-        release_console_sem();
+        console_unlock();
 
         return rc;
 }
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index 767ab4fb1a05..94e293fce1d2 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -2069,7 +2069,7 @@ static int atyfb_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         if (state.event == pdev->dev.power.power_state.event)
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
 
         fb_set_suspend(info, 1);
 
@@ -2097,14 +2097,14 @@ static int atyfb_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                 par->lock_blank = 0;
                 atyfb_blank(FB_BLANK_UNBLANK, info);
                 fb_set_suspend(info, 0);
-                release_console_sem();
+                console_unlock();
                 return -EIO;
         }
 #else
         pci_set_power_state(pdev, pci_choose_state(pdev, state));
 #endif
 
-        release_console_sem();
+        console_unlock();
 
         pdev->dev.power.power_state = state;
 
@@ -2133,7 +2133,7 @@ static int atyfb_pci_resume(struct pci_dev *pdev)
         if (pdev->dev.power.power_state.event == PM_EVENT_ON)
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
 
         /*
          * PCI state will have been restored by the core, so
@@ -2161,7 +2161,7 @@ static int atyfb_pci_resume(struct pci_dev *pdev)
         par->lock_blank = 0;
         atyfb_blank(FB_BLANK_UNBLANK, info);
 
-        release_console_sem();
+        console_unlock();
 
         pdev->dev.power.power_state = PMSG_ON;
 
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index c4e17642d9c5..92bda5848516 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -2626,7 +2626,7 @@ int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
                 goto done;
         }
 
-        acquire_console_sem();
+        console_lock();
 
         fb_set_suspend(info, 1);
 
@@ -2690,7 +2690,7 @@ int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
         if (rinfo->pm_mode & radeon_pm_d2)
                 radeon_set_suspend(rinfo, 1);
 
-        release_console_sem();
+        console_unlock();
 
  done:
         pdev->dev.power.power_state = mesg;
@@ -2715,10 +2715,10 @@ int radeonfb_pci_resume(struct pci_dev *pdev)
                 return 0;
 
         if (rinfo->no_schedule) {
-                if (try_acquire_console_sem())
+                if (!console_trylock())
                         return 0;
         } else
-                acquire_console_sem();
+                console_lock();
 
         printk(KERN_DEBUG "radeonfb (%s): resuming from state: %d...\n",
                pci_name(pdev), pdev->dev.power.power_state.event);
@@ -2783,7 +2783,7 @@ int radeonfb_pci_resume(struct pci_dev *pdev)
         pdev->dev.power.power_state = PMSG_ON;
 
  bail:
-        release_console_sem();
+        console_unlock();
 
         return rc;
 }
diff --git a/drivers/video/chipsfb.c b/drivers/video/chipsfb.c
index d637e1f53172..cff742abdc5d 100644
--- a/drivers/video/chipsfb.c
+++ b/drivers/video/chipsfb.c
@@ -460,10 +460,10 @@ static int chipsfb_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         if (!(state.event & PM_EVENT_SLEEP))
                 goto done;
 
-        acquire_console_sem();
+        console_lock();
         chipsfb_blank(1, p);
         fb_set_suspend(p, 1);
-        release_console_sem();
+        console_unlock();
  done:
         pdev->dev.power.power_state = state;
         return 0;
@@ -473,10 +473,10 @@ static int chipsfb_pci_resume(struct pci_dev *pdev)
 {
         struct fb_info *p = pci_get_drvdata(pdev);
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(p, 0);
         chipsfb_blank(0, p);
-        release_console_sem();
+        console_unlock();
 
         pdev->dev.power.power_state = PMSG_ON;
         return 0;
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 7ccc967831f0..9c092b8d64e6 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -375,14 +375,14 @@ static void fb_flashcursor(struct work_struct *work)
         int c;
         int mode;
 
-        acquire_console_sem();
+        console_lock();
         if (ops && ops->currcon != -1)
                 vc = vc_cons[ops->currcon].d;
 
         if (!vc || !CON_IS_VISIBLE(vc) ||
             registered_fb[con2fb_map[vc->vc_num]] != info ||
             vc->vc_deccm != 1) {
-                release_console_sem();
+                console_unlock();
                 return;
         }
 
@@ -392,7 +392,7 @@ static void fb_flashcursor(struct work_struct *work)
                 CM_ERASE : CM_DRAW;
         ops->cursor(vc, info, mode, softback_lines, get_color(vc, info, c, 1),
                     get_color(vc, info, c, 0));
-        release_console_sem();
+        console_unlock();
 }
 
 static void cursor_timer_handler(unsigned long dev_addr)
@@ -836,7 +836,7 @@ static int set_con2fb_map(int unit, int newidx, int user)
 
         found = search_fb_in_map(newidx);
 
-        acquire_console_sem();
+        console_lock();
         con2fb_map[unit] = newidx;
         if (!err && !found)
                 err = con2fb_acquire_newinfo(vc, info, unit, oldidx);
@@ -863,7 +863,7 @@ static int set_con2fb_map(int unit, int newidx, int user)
         if (!search_fb_in_map(info_idx))
                 info_idx = newidx;
 
-        release_console_sem();
+        console_unlock();
         return err;
 }
 
@@ -3321,7 +3321,7 @@ static ssize_t store_rotate(struct device *device,
         if (fbcon_has_exited)
                 return count;
 
-        acquire_console_sem();
+        console_lock();
         idx = con2fb_map[fg_console];
 
         if (idx == -1 || registered_fb[idx] == NULL)
@@ -3331,7 +3331,7 @@ static ssize_t store_rotate(struct device *device,
         rotate = simple_strtoul(buf, last, 0);
         fbcon_rotate(info, rotate);
 err:
-        release_console_sem();
+        console_unlock();
         return count;
 }
 
@@ -3346,7 +3346,7 @@ static ssize_t store_rotate_all(struct device *device,
         if (fbcon_has_exited)
                 return count;
 
-        acquire_console_sem();
+        console_lock();
         idx = con2fb_map[fg_console];
 
         if (idx == -1 || registered_fb[idx] == NULL)
@@ -3356,7 +3356,7 @@ static ssize_t store_rotate_all(struct device *device,
         rotate = simple_strtoul(buf, last, 0);
         fbcon_rotate_all(info, rotate);
 err:
-        release_console_sem();
+        console_unlock();
         return count;
 }
 
@@ -3369,7 +3369,7 @@ static ssize_t show_rotate(struct device *device,
         if (fbcon_has_exited)
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
         idx = con2fb_map[fg_console];
 
         if (idx == -1 || registered_fb[idx] == NULL)
@@ -3378,7 +3378,7 @@ static ssize_t show_rotate(struct device *device,
         info = registered_fb[idx];
         rotate = fbcon_get_rotate(info);
 err:
-        release_console_sem();
+        console_unlock();
         return snprintf(buf, PAGE_SIZE, "%d\n", rotate);
 }
 
@@ -3392,7 +3392,7 @@ static ssize_t show_cursor_blink(struct device *device,
         if (fbcon_has_exited)
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
         idx = con2fb_map[fg_console];
 
         if (idx == -1 || registered_fb[idx] == NULL)
@@ -3406,7 +3406,7 @@ static ssize_t show_cursor_blink(struct device *device,
 
         blink = (ops->flags & FBCON_FLAGS_CURSOR_TIMER) ? 1 : 0;
 err:
-        release_console_sem();
+        console_unlock();
         return snprintf(buf, PAGE_SIZE, "%d\n", blink);
 }
 
@@ -3421,7 +3421,7 @@ static ssize_t store_cursor_blink(struct device *device,
         if (fbcon_has_exited)
                 return count;
 
-        acquire_console_sem();
+        console_lock();
         idx = con2fb_map[fg_console];
 
         if (idx == -1 || registered_fb[idx] == NULL)
@@ -3443,7 +3443,7 @@ static ssize_t store_cursor_blink(struct device *device,
         }
 
 err:
-        release_console_sem();
+        console_unlock();
         return count;
 }
 
@@ -3482,7 +3482,7 @@ static void fbcon_start(void)
         if (num_registered_fb) {
                 int i;
 
-                acquire_console_sem();
+                console_lock();
 
                 for (i = 0; i < FB_MAX; i++) {
                         if (registered_fb[i] != NULL) {
@@ -3491,7 +3491,7 @@ static void fbcon_start(void)
                         }
                 }
 
-                release_console_sem();
+                console_unlock();
                 fbcon_takeover(0);
         }
 }
@@ -3552,7 +3552,7 @@ static int __init fb_console_init(void)
 {
         int i;
 
-        acquire_console_sem();
+        console_lock();
         fb_register_client(&fbcon_event_notifier);
         fbcon_device = device_create(fb_class, NULL, MKDEV(0, 0), NULL,
                                      "fbcon");
@@ -3568,7 +3568,7 @@ static int __init fb_console_init(void)
         for (i = 0; i < MAX_NR_CONSOLES; i++)
                 con2fb_map[i] = -1;
 
-        release_console_sem();
+        console_unlock();
         fbcon_start();
         return 0;
 }
@@ -3591,12 +3591,12 @@ static void __exit fbcon_deinit_device(void)
 
 static void __exit fb_console_exit(void)
 {
-        acquire_console_sem();
+        console_lock();
         fb_unregister_client(&fbcon_event_notifier);
         fbcon_deinit_device();
         device_destroy(fb_class, MKDEV(0, 0));
         fbcon_exit();
-        release_console_sem();
+        console_unlock();
         unregister_con_driver(&fb_con);
 }       
 
diff --git a/drivers/video/da8xx-fb.c b/drivers/video/da8xx-fb.c
index 520047ac6e3e..8d61ef96eedd 100644
--- a/drivers/video/da8xx-fb.c
+++ b/drivers/video/da8xx-fb.c
@@ -1131,14 +1131,14 @@ static int fb_suspend(struct platform_device *dev, pm_message_t state)
         struct fb_info *info = platform_get_drvdata(dev);
         struct da8xx_fb_par *par = info->par;
 
-        acquire_console_sem();
+        console_lock();
         if (par->panel_power_ctrl)
                 par->panel_power_ctrl(0);
 
         fb_set_suspend(info, 1);
         lcd_disable_raster();
         clk_disable(par->lcdc_clk);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -1147,14 +1147,14 @@ static int fb_resume(struct platform_device *dev)
         struct fb_info *info = platform_get_drvdata(dev);
         struct da8xx_fb_par *par = info->par;
 
-        acquire_console_sem();
+        console_lock();
         if (par->panel_power_ctrl)
                 par->panel_power_ctrl(1);
 
         clk_enable(par->lcdc_clk);
         lcd_enable_raster();
         fb_set_suspend(info, 0);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 4ac1201ad6c2..e2bf95370e40 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1036,11 +1036,11 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
                         return -EFAULT;
                 if (!lock_fb_info(info))
                         return -ENODEV;
-                acquire_console_sem();
+                console_lock();
                 info->flags |= FBINFO_MISC_USEREVENT;
                 ret = fb_set_var(info, &var);
                 info->flags &= ~FBINFO_MISC_USEREVENT;
-                release_console_sem();
+                console_unlock();
                 unlock_fb_info(info);
                 if (!ret && copy_to_user(argp, &var, sizeof(var)))
                         ret = -EFAULT;
@@ -1072,9 +1072,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
                         return -EFAULT;
                 if (!lock_fb_info(info))
                         return -ENODEV;
-                acquire_console_sem();
+                console_lock();
                 ret = fb_pan_display(info, &var);
-                release_console_sem();
+                console_unlock();
                 unlock_fb_info(info);
                 if (ret == 0 && copy_to_user(argp, &var, sizeof(var)))
                         return -EFAULT;
@@ -1119,11 +1119,11 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
         case FBIOBLANK:
                 if (!lock_fb_info(info))
                         return -ENODEV;
-                acquire_console_sem();
+                console_lock();
                 info->flags |= FBINFO_MISC_USEREVENT;
                 ret = fb_blank(info, arg);
                 info->flags &= ~FBINFO_MISC_USEREVENT;
-                release_console_sem();
+                console_unlock();
                 unlock_fb_info(info);
                 break;
         default:
diff --git a/drivers/video/fbsysfs.c b/drivers/video/fbsysfs.c
index 0a08f1341227..f4a32779168b 100644
--- a/drivers/video/fbsysfs.c
+++ b/drivers/video/fbsysfs.c
@@ -90,11 +90,11 @@ static int activate(struct fb_info *fb_info, struct fb_var_screeninfo *var)
         int err;
 
         var->activate |= FB_ACTIVATE_FORCE;
-        acquire_console_sem();
+        console_lock();
         fb_info->flags |= FBINFO_MISC_USEREVENT;
         err = fb_set_var(fb_info, var);
         fb_info->flags &= ~FBINFO_MISC_USEREVENT;
-        release_console_sem();
+        console_unlock();
         if (err)
                 return err;
         return 0;
@@ -175,7 +175,7 @@ static ssize_t store_modes(struct device *device,
         if (i * sizeof(struct fb_videomode) != count)
                 return -EINVAL;
 
-        acquire_console_sem();
+        console_lock();
         list_splice(&fb_info->modelist, &old_list);
         fb_videomode_to_modelist((const struct fb_videomode *)buf, i,
                                  &fb_info->modelist);
@@ -185,7 +185,7 @@ static ssize_t store_modes(struct device *device,
         } else
                 fb_destroy_modelist(&old_list);
 
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -301,11 +301,11 @@ static ssize_t store_blank(struct device *device,
         char *last = NULL;
         int err;
 
-        acquire_console_sem();
+        console_lock();
         fb_info->flags |= FBINFO_MISC_USEREVENT;
         err = fb_blank(fb_info, simple_strtoul(buf, &last, 0));
         fb_info->flags &= ~FBINFO_MISC_USEREVENT;
-        release_console_sem();
+        console_unlock();
         if (err < 0)
                 return err;
         return count;
@@ -364,9 +364,9 @@ static ssize_t store_pan(struct device *device,
                 return -EINVAL;
         var.yoffset = simple_strtoul(last, &last, 0);
 
-        acquire_console_sem();
+        console_lock();
         err = fb_pan_display(fb_info, &var);
-        release_console_sem();
+        console_unlock();
 
         if (err < 0)
                 return err;
@@ -399,9 +399,9 @@ static ssize_t store_fbstate(struct device *device,
 
         state = simple_strtoul(buf, &last, 0);
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(fb_info, (int)state);
-        release_console_sem();
+        console_unlock();
 
         return count;
 }
diff --git a/drivers/video/geode/gxfb_core.c b/drivers/video/geode/gxfb_core.c
index 70b1d9d51c96..b4f19db9bb54 100644
--- a/drivers/video/geode/gxfb_core.c
+++ b/drivers/video/geode/gxfb_core.c
@@ -344,10 +344,10 @@ static int gxfb_suspend(struct pci_dev *pdev, pm_message_t state)
         struct fb_info *info = pci_get_drvdata(pdev);
 
         if (state.event == PM_EVENT_SUSPEND) {
-                acquire_console_sem();
+                console_lock();
                 gx_powerdown(info);
                 fb_set_suspend(info, 1);
-                release_console_sem();
+                console_unlock();
         }
 
         /* there's no point in setting PCI states; we emulate PCI, so
@@ -361,7 +361,7 @@ static int gxfb_resume(struct pci_dev *pdev)
         struct fb_info *info = pci_get_drvdata(pdev);
         int ret;
 
-        acquire_console_sem();
+        console_lock();
         ret = gx_powerup(info);
         if (ret) {
                 printk(KERN_ERR "gxfb:  power up failed!\n");
@@ -369,7 +369,7 @@ static int gxfb_resume(struct pci_dev *pdev)
         }
 
         fb_set_suspend(info, 0);
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 #endif
diff --git a/drivers/video/geode/lxfb_core.c b/drivers/video/geode/lxfb_core.c
index 39bdbedf43b4..416851ca8754 100644
--- a/drivers/video/geode/lxfb_core.c
+++ b/drivers/video/geode/lxfb_core.c
@@ -465,10 +465,10 @@ static int lxfb_suspend(struct pci_dev *pdev, pm_message_t state)
         struct fb_info *info = pci_get_drvdata(pdev);
 
         if (state.event == PM_EVENT_SUSPEND) {
-                acquire_console_sem();
+                console_lock();
                 lx_powerdown(info);
                 fb_set_suspend(info, 1);
-                release_console_sem();
+                console_unlock();
         }
 
         /* there's no point in setting PCI states; we emulate PCI, so
@@ -482,7 +482,7 @@ static int lxfb_resume(struct pci_dev *pdev)
         struct fb_info *info = pci_get_drvdata(pdev);
         int ret;
 
-        acquire_console_sem();
+        console_lock();
         ret = lx_powerup(info);
         if (ret) {
                 printk(KERN_ERR "lxfb:  power up failed!\n");
@@ -490,7 +490,7 @@ static int lxfb_resume(struct pci_dev *pdev)
         }
 
         fb_set_suspend(info, 0);
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 #else
diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
index 5743ea25e818..318f6fb895b2 100644
--- a/drivers/video/i810/i810_main.c
+++ b/drivers/video/i810/i810_main.c
@@ -1574,7 +1574,7 @@ static int i810fb_suspend(struct pci_dev *dev, pm_message_t mesg)
                 return 0;
         }
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(info, 1);
 
         if (info->fbops->fb_sync)
@@ -1587,7 +1587,7 @@ static int i810fb_suspend(struct pci_dev *dev, pm_message_t mesg)
         pci_save_state(dev);
         pci_disable_device(dev);
         pci_set_power_state(dev, pci_choose_state(dev, mesg));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -1605,7 +1605,7 @@ static int i810fb_resume(struct pci_dev *dev)
                 return 0;
         }
 
-        acquire_console_sem();
+        console_lock();
         pci_set_power_state(dev, PCI_D0);
         pci_restore_state(dev);
 
@@ -1621,7 +1621,7 @@ static int i810fb_resume(struct pci_dev *dev)
         fb_set_suspend (info, 0);
         info->fbops->fb_blank(VESA_NO_BLANKING, info);
 fail:
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 /***********************************************************************
diff --git a/drivers/video/jz4740_fb.c b/drivers/video/jz4740_fb.c
index 670ecaa0385a..de366937c933 100644
--- a/drivers/video/jz4740_fb.c
+++ b/drivers/video/jz4740_fb.c
@@ -778,9 +778,9 @@ static int jzfb_suspend(struct device *dev)
 {
         struct jzfb *jzfb = dev_get_drvdata(dev);
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(jzfb->fb, 1);
-        release_console_sem();
+        console_unlock();
 
         mutex_lock(&jzfb->lock);
         if (jzfb->is_enabled)
@@ -800,9 +800,9 @@ static int jzfb_resume(struct device *dev)
                 jzfb_enable(jzfb);
         mutex_unlock(&jzfb->lock);
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(jzfb->fb, 0);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
index cb013919e9ce..7e3a490e8d76 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/mx3fb.c
@@ -1177,9 +1177,9 @@ static int mx3fb_suspend(struct platform_device *pdev, pm_message_t state)
         struct mx3fb_data *mx3fb = platform_get_drvdata(pdev);
         struct mx3fb_info *mx3_fbi = mx3fb->fbi->par;
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(mx3fb->fbi, 1);
-        release_console_sem();
+        console_unlock();
 
         if (mx3_fbi->blank == FB_BLANK_UNBLANK) {
                 sdc_disable_channel(mx3_fbi);
@@ -1202,9 +1202,9 @@ static int mx3fb_resume(struct platform_device *pdev)
                 sdc_set_brightness(mx3fb, mx3fb->backlight_level);
         }
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(mx3fb->fbi, 0);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index efe10ff86d63..081dc4745274 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -1057,7 +1057,7 @@ static int nvidiafb_suspend(struct pci_dev *dev, pm_message_t mesg)
 
         if (mesg.event == PM_EVENT_PRETHAW)
                 mesg.event = PM_EVENT_FREEZE;
-        acquire_console_sem();
+        console_lock();
         par->pm_state = mesg.event;
 
         if (mesg.event & PM_EVENT_SLEEP) {
@@ -1070,7 +1070,7 @@ static int nvidiafb_suspend(struct pci_dev *dev, pm_message_t mesg)
         }
         dev->dev.power.power_state = mesg;
 
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 
@@ -1079,7 +1079,7 @@ static int nvidiafb_resume(struct pci_dev *dev)
         struct fb_info *info = pci_get_drvdata(dev);
         struct nvidia_par *par = info->par;
 
-        acquire_console_sem();
+        console_lock();
         pci_set_power_state(dev, PCI_D0);
 
         if (par->pm_state != PM_EVENT_FREEZE) {
@@ -1097,7 +1097,7 @@ static int nvidiafb_resume(struct pci_dev *dev)
         nvidiafb_blank(FB_BLANK_UNBLANK, info);
 
 fail:
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 #else
diff --git a/drivers/video/ps3fb.c b/drivers/video/ps3fb.c
index 9c0144ee7ae5..65560a1a0439 100644
--- a/drivers/video/ps3fb.c
+++ b/drivers/video/ps3fb.c
@@ -513,9 +513,9 @@ static int ps3fb_release(struct fb_info *info, int user)
         if (atomic_dec_and_test(&ps3fb.f_count)) {
                 if (atomic_read(&ps3fb.ext_flip)) {
                         atomic_set(&ps3fb.ext_flip, 0);
-                        if (!try_acquire_console_sem()) {
+                        if (console_trylock()) {
                                 ps3fb_sync(info, 0);    /* single buffer */
-                                release_console_sem();
+                                console_unlock();
                         }
                 }
         }
@@ -830,14 +830,14 @@ static int ps3fb_ioctl(struct fb_info *info, unsigned int cmd,
                         if (vmode) {
                                 var = info->var;
                                 fb_videomode_to_var(&var, vmode);
-                                acquire_console_sem();
+                                console_lock();
                                 info->flags |= FBINFO_MISC_USEREVENT;
                                 /* Force, in case only special bits changed */
                                 var.activate |= FB_ACTIVATE_FORCE;
                                 par->new_mode_id = val;
                                 retval = fb_set_var(info, &var);
                                 info->flags &= ~FBINFO_MISC_USEREVENT;
-                                release_console_sem();
+                                console_unlock();
                         }
                         break;
                 }
@@ -881,9 +881,9 @@ static int ps3fb_ioctl(struct fb_info *info, unsigned int cmd,
                         break;
 
                 dev_dbg(info->device, "PS3FB_IOCTL_FSEL:%d\n", val);
-                acquire_console_sem();
+                console_lock();
                 retval = ps3fb_sync(info, val);
-                release_console_sem();
+                console_unlock();
                 break;
 
         default:
@@ -903,9 +903,9 @@ static int ps3fbd(void *arg)
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (ps3fb.is_kicked) {
                         ps3fb.is_kicked = 0;
-                        acquire_console_sem();
+                        console_lock();
                         ps3fb_sync(info, 0);    /* single buffer */
-                        release_console_sem();
+                        console_unlock();
                 }
                 schedule();
         }
diff --git a/drivers/video/s3fb.c b/drivers/video/s3fb.c
index dce8c97b4333..75738a928610 100644
--- a/drivers/video/s3fb.c
+++ b/drivers/video/s3fb.c
@@ -22,7 +22,7 @@
 #include <linux/svga.h>
 #include <linux/init.h>
 #include <linux/pci.h>
-#include <linux/console.h> /* Why should fb driver call console functions? because acquire_console_sem() */
+#include <linux/console.h> /* Why should fb driver call console functions? because console_lock() */
 #include <video/vga.h>
 
 #ifdef CONFIG_MTRR
@@ -1113,12 +1113,12 @@ static int s3_pci_suspend(struct pci_dev* dev, pm_message_t state)
 
         dev_info(info->device, "suspend\n");
 
-        acquire_console_sem();
+        console_lock();
         mutex_lock(&(par->open_lock));
 
         if ((state.event == PM_EVENT_FREEZE) || (par->ref_count == 0)) {
                 mutex_unlock(&(par->open_lock));
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
 
@@ -1129,7 +1129,7 @@ static int s3_pci_suspend(struct pci_dev* dev, pm_message_t state)
         pci_set_power_state(dev, pci_choose_state(dev, state));
 
         mutex_unlock(&(par->open_lock));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -1145,12 +1145,12 @@ static int s3_pci_resume(struct pci_dev* dev)
 
         dev_info(info->device, "resume\n");
 
-        acquire_console_sem();
+        console_lock();
         mutex_lock(&(par->open_lock));
 
         if (par->ref_count == 0) {
                 mutex_unlock(&(par->open_lock));
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
 
@@ -1159,7 +1159,7 @@ static int s3_pci_resume(struct pci_dev* dev)
         err = pci_enable_device(dev);
         if (err) {
                 mutex_unlock(&(par->open_lock));
-                release_console_sem();
+                console_unlock();
                 dev_err(info->device, "error %d enabling device for resume\n", err);
                 return err;
         }
@@ -1169,7 +1169,7 @@ static int s3_pci_resume(struct pci_dev* dev)
         fb_set_suspend(info, 0);
 
         mutex_unlock(&(par->open_lock));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index 842d157e1025..487911e2926c 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -2373,7 +2373,7 @@ static int savagefb_suspend(struct pci_dev *dev, pm_message_t mesg)
         if (mesg.event == PM_EVENT_FREEZE)
                 return 0;
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(info, 1);
 
         if (info->fbops->fb_sync)
@@ -2385,7 +2385,7 @@ static int savagefb_suspend(struct pci_dev *dev, pm_message_t mesg)
         pci_save_state(dev);
         pci_disable_device(dev);
         pci_set_power_state(dev, pci_choose_state(dev, mesg));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -2409,7 +2409,7 @@ static int savagefb_resume(struct pci_dev* dev)
                 return 0;
         }
 
-        acquire_console_sem();
+        console_lock();
 
         pci_set_power_state(dev, PCI_D0);
         pci_restore_state(dev);
@@ -2423,7 +2423,7 @@ static int savagefb_resume(struct pci_dev* dev)
         savagefb_set_par(info);
         fb_set_suspend(info, 0);
         savagefb_blank(FB_BLANK_UNBLANK, info);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/video/sh_mobile_hdmi.c b/drivers/video/sh_mobile_hdmi.c
index 74d9f546a2e8..2b9e56a6bde4 100644
--- a/drivers/video/sh_mobile_hdmi.c
+++ b/drivers/video/sh_mobile_hdmi.c
@@ -1151,7 +1151,7 @@ static void sh_hdmi_edid_work_fn(struct work_struct *work)
 
                 ch = info->par;
 
-                acquire_console_sem();
+                console_lock();
 
                 /* HDMI plug in */
                 if (!sh_hdmi_must_reconfigure(hdmi) &&
@@ -1171,7 +1171,7 @@ static void sh_hdmi_edid_work_fn(struct work_struct *work)
                         fb_set_suspend(info, 0);
                 }
 
-                release_console_sem();
+                console_unlock();
         } else {
                 ret = 0;
                 if (!hdmi->info)
@@ -1181,12 +1181,12 @@ static void sh_hdmi_edid_work_fn(struct work_struct *work)
                 fb_destroy_modedb(hdmi->monspec.modedb);
                 hdmi->monspec.modedb = NULL;
 
-                acquire_console_sem();
+                console_lock();
 
                 /* HDMI disconnect */
                 fb_set_suspend(hdmi->info, 1);
 
-                release_console_sem();
+                console_unlock();
                 pm_runtime_put(hdmi->dev);
         }
 
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index bd4840a8a6b7..bf12e53aed5c 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -912,9 +912,9 @@ static int sh_mobile_release(struct fb_info *info, int user)
 
         /* Nothing to reconfigure, when called from fbcon */
         if (user) {
-                acquire_console_sem();
+                console_lock();
                 sh_mobile_fb_reconfig(info);
-                release_console_sem();
+                console_unlock();
         }
 
         mutex_unlock(&ch->open_lock);
diff --git a/drivers/video/sm501fb.c b/drivers/video/sm501fb.c
index b7dc1800efa9..bcb44a594ebc 100644
--- a/drivers/video/sm501fb.c
+++ b/drivers/video/sm501fb.c
@@ -2010,9 +2010,9 @@ static int sm501fb_suspend_fb(struct sm501fb_info *info,
 
         /* tell console/fb driver we are suspending */
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(fbi, 1);
-        release_console_sem();
+        console_unlock();
 
         /* backup copies in case chip is powered down over suspend */
 
@@ -2069,9 +2069,9 @@ static void sm501fb_resume_fb(struct sm501fb_info *info,
                 memcpy_toio(par->cursor.k_addr, par->store_cursor,
                             par->cursor.size);
 
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(fbi, 0);
-        release_console_sem();
+        console_unlock();
 
         vfree(par->store_fb);
         vfree(par->store_cursor);
diff --git a/drivers/video/tmiofb.c b/drivers/video/tmiofb.c
index 6913fe168c25..dfef88c803d4 100644
--- a/drivers/video/tmiofb.c
+++ b/drivers/video/tmiofb.c
@@ -25,7 +25,7 @@
 #include <linux/fb.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
-/* Why should fb driver call console functions? because acquire_console_sem() */
+/* Why should fb driver call console functions? because console_lock() */
 #include <linux/console.h>
 #include <linux/mfd/core.h>
 #include <linux/mfd/tmio.h>
@@ -944,7 +944,7 @@ static int tmiofb_suspend(struct platform_device *dev, pm_message_t state)
         struct mfd_cell *cell = dev->dev.platform_data;
         int retval = 0;
 
-        acquire_console_sem();
+        console_lock();
 
         fb_set_suspend(info, 1);
 
@@ -965,7 +965,7 @@ static int tmiofb_suspend(struct platform_device *dev, pm_message_t state)
         if (cell->suspend)
                 retval = cell->suspend(dev);
 
-        release_console_sem();
+        console_unlock();
 
         return retval;
 }
@@ -976,7 +976,7 @@ static int tmiofb_resume(struct platform_device *dev)
         struct mfd_cell *cell = dev->dev.platform_data;
         int retval = 0;
 
-        acquire_console_sem();
+        console_lock();
 
         if (cell->resume) {
                 retval = cell->resume(dev);
@@ -992,7 +992,7 @@ static int tmiofb_resume(struct platform_device *dev)
 
         fb_set_suspend(info, 0);
 out:
-        release_console_sem();
+        console_unlock();
         return retval;
 }
 #else
diff --git a/drivers/video/via/viafbdev.c b/drivers/video/via/viafbdev.c
index 289edd519527..4e66349e4366 100644
--- a/drivers/video/via/viafbdev.c
+++ b/drivers/video/via/viafbdev.c
@@ -1674,17 +1674,17 @@ static int parse_mode(const char *str, u32 *xres, u32 *yres)
 #ifdef CONFIG_PM
 static int viafb_suspend(void *unused)
 {
-        acquire_console_sem();
+        console_lock();
         fb_set_suspend(viafbinfo, 1);
         viafb_sync(viafbinfo);
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
 
 static int viafb_resume(void *unused)
 {
-        acquire_console_sem();
+        console_lock();
         if (viaparinfo->shared->vdev->engine_mmio)
                 viafb_reset_engine(viaparinfo);
         viafb_set_par(viafbinfo);
@@ -1692,7 +1692,7 @@ static int viafb_resume(void *unused)
                 viafb_set_par(viafbinfo1);
         fb_set_suspend(viafbinfo, 0);
 
-        release_console_sem();
+        console_unlock();
         return 0;
 }
 
diff --git a/drivers/video/vt8623fb.c b/drivers/video/vt8623fb.c
index 85d76ec4c63e..a2965ab92cfb 100644
--- a/drivers/video/vt8623fb.c
+++ b/drivers/video/vt8623fb.c
@@ -23,7 +23,7 @@
 #include <linux/svga.h>
 #include <linux/init.h>
 #include <linux/pci.h>
-#include <linux/console.h> /* Why should fb driver call console functions? because acquire_console_sem() */
+#include <linux/console.h> /* Why should fb driver call console functions? because console_lock() */
 #include <video/vga.h>
 
 #ifdef CONFIG_MTRR
@@ -819,12 +819,12 @@ static int vt8623_pci_suspend(struct pci_dev* dev, pm_message_t state)
 
         dev_info(info->device, "suspend\n");
 
-        acquire_console_sem();
+        console_lock();
         mutex_lock(&(par->open_lock));
 
         if ((state.event == PM_EVENT_FREEZE) || (par->ref_count == 0)) {
                 mutex_unlock(&(par->open_lock));
-                release_console_sem();
+                console_unlock();
                 return 0;
         }
 
@@ -835,7 +835,7 @@ static int vt8623_pci_suspend(struct pci_dev* dev, pm_message_t state)
         pci_set_power_state(dev, pci_choose_state(dev, state));
 
         mutex_unlock(&(par->open_lock));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
@@ -850,7 +850,7 @@ static int vt8623_pci_resume(struct pci_dev* dev)
 
         dev_info(info->device, "resume\n");
 
-        acquire_console_sem();
+        console_lock();
         mutex_lock(&(par->open_lock));
 
         if (par->ref_count == 0)
@@ -869,7 +869,7 @@ static int vt8623_pci_resume(struct pci_dev* dev)
 
 fail:
         mutex_unlock(&(par->open_lock));
-        release_console_sem();
+        console_unlock();
 
         return 0;
 }
diff --git a/drivers/video/xen-fbfront.c b/drivers/video/xen-fbfront.c
index 3e6934d4bea8..a20218c2fda8 100644
--- a/drivers/video/xen-fbfront.c
+++ b/drivers/video/xen-fbfront.c
@@ -491,12 +491,12 @@ xenfb_make_preferred_console(void)
         if (console_set_on_cmdline)
                 return;
 
-        acquire_console_sem();
+        console_lock();
         for_each_console(c) {
                 if (!strcmp(c->name, "tty") && c->index == 0)
                         break;
         }
-        release_console_sem();
+        console_unlock();
         if (c) {
                 unregister_console(c);
                 c->flags |= CON_CONSDEV;
diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
index 15b5ca2a2606..9c949348510b 100644
--- a/fs/btrfs/acl.c
+++ b/fs/btrfs/acl.c
@@ -37,6 +37,9 @@ static struct posix_acl *btrfs_get_acl(struct inode *inode, int type)
         char *value = NULL;
         struct posix_acl *acl;
 
+        if (!IS_POSIXACL(inode))
+                return NULL;
+
         acl = get_cached_acl(inode, type);
         if (acl != ACL_NOT_CACHED)
                 return acl;
@@ -84,6 +87,9 @@ static int btrfs_xattr_acl_get(struct dentry *dentry, const char *name,
         struct posix_acl *acl;
         int ret = 0;
 
+        if (!IS_POSIXACL(dentry->d_inode))
+                return -EOPNOTSUPP;
+
         acl = btrfs_get_acl(dentry->d_inode, type);
 
         if (IS_ERR(acl))
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index f745287fbf2e..4d2110eafe29 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -562,7 +562,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
         u64 em_len;
         u64 em_start;
         struct extent_map *em;
-        int ret;
+        int ret = -ENOMEM;
         u32 *sums;
 
         tree = &BTRFS_I(inode)->io_tree;
@@ -577,6 +577,9 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
 
         compressed_len = em->block_len;
         cb = kmalloc(compressed_bio_size(root, compressed_len), GFP_NOFS);
+        if (!cb)
+                goto out;
+
         atomic_set(&cb->pending_bios, 0);
         cb->errors = 0;
         cb->inode = inode;
@@ -597,13 +600,18 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
 
         nr_pages = (compressed_len + PAGE_CACHE_SIZE - 1) /
                                  PAGE_CACHE_SIZE;
-        cb->compressed_pages = kmalloc(sizeof(struct page *) * nr_pages,
+        cb->compressed_pages = kzalloc(sizeof(struct page *) * nr_pages,
                                        GFP_NOFS);
+        if (!cb->compressed_pages)
+                goto fail1;
+
         bdev = BTRFS_I(inode)->root->fs_info->fs_devices->latest_bdev;
 
         for (page_index = 0; page_index < nr_pages; page_index++) {
                 cb->compressed_pages[page_index] = alloc_page(GFP_NOFS |
                                                               __GFP_HIGHMEM);
+                if (!cb->compressed_pages[page_index])
+                        goto fail2;
         }
         cb->nr_pages = nr_pages;
 
@@ -614,6 +622,8 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
         cb->len = uncompressed_len;
 
         comp_bio = compressed_bio_alloc(bdev, cur_disk_byte, GFP_NOFS);
+        if (!comp_bio)
+                goto fail2;
         comp_bio->bi_private = cb;
         comp_bio->bi_end_io = end_compressed_bio_read;
         atomic_inc(&cb->pending_bios);
@@ -681,6 +691,17 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
 
         bio_put(comp_bio);
         return 0;
+
+fail2:
+        for (page_index = 0; page_index < nr_pages; page_index++)
+                free_page((unsigned long)cb->compressed_pages[page_index]);
+
+        kfree(cb->compressed_pages);
+fail1:
+        kfree(cb);
+out:
+        free_extent_map(em);
+        return ret;
 }
 
 static struct list_head comp_idle_workspace[BTRFS_COMPRESS_TYPES];
@@ -900,7 +921,7 @@ int btrfs_decompress(int type, unsigned char *data_in, struct page *dest_page,
         return ret;
 }
 
-void __exit btrfs_exit_compress(void)
+void btrfs_exit_compress(void)
 {
         free_workspaces();
 }
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index b531c36455d8..fdce8799b98d 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1550,6 +1550,7 @@ static int transaction_kthread(void *arg)
                 spin_unlock(&root->fs_info->new_trans_lock);
 
                 trans = btrfs_join_transaction(root, 1);
+                BUG_ON(IS_ERR(trans));
                 if (transid == trans->transid) {
                         ret = btrfs_commit_transaction(trans, root);
                         BUG_ON(ret);
@@ -2453,10 +2454,14 @@ int btrfs_commit_super(struct btrfs_root *root)
         up_write(&root->fs_info->cleanup_work_sem);
 
         trans = btrfs_join_transaction(root, 1);
+        if (IS_ERR(trans))
+                return PTR_ERR(trans);
         ret = btrfs_commit_transaction(trans, root);
         BUG_ON(ret);
         /* run commit again to drop the original snapshot */
         trans = btrfs_join_transaction(root, 1);
+        if (IS_ERR(trans))
+                return PTR_ERR(trans);
         btrfs_commit_transaction(trans, root);
         ret = btrfs_write_and_wait_transaction(NULL, root);
         BUG_ON(ret);
@@ -2554,6 +2559,8 @@ int close_ctree(struct btrfs_root *root)
         kfree(fs_info->chunk_root);
         kfree(fs_info->dev_root);
         kfree(fs_info->csum_root);
+        kfree(fs_info);
+
         return 0;
 }
 
diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c
index 9786963b07e5..ff27d7a477b2 100644
--- a/fs/btrfs/export.c
+++ b/fs/btrfs/export.c
@@ -171,6 +171,8 @@ static struct dentry *btrfs_get_parent(struct dentry *child)
         int ret;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return ERR_PTR(-ENOMEM);
 
         if (dir->i_ino == BTRFS_FIRST_FREE_OBJECTID) {
                 key.objectid = root->root_key.objectid;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index b55269340cec..4e7e012ad667 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -320,11 +320,6 @@ static int caching_kthread(void *data)
         if (!path)
                 return -ENOMEM;
 
-        exclude_super_stripes(extent_root, block_group);
-        spin_lock(&block_group->space_info->lock);
-        block_group->space_info->bytes_readonly += block_group->bytes_super;
-        spin_unlock(&block_group->space_info->lock);
-
         last = max_t(u64, block_group->key.objectid, BTRFS_SUPER_INFO_OFFSET);
 
         /*
@@ -467,8 +462,10 @@ static int cache_block_group(struct btrfs_block_group_cache *cache,
                         cache->cached = BTRFS_CACHE_NO;
                 }
                 spin_unlock(&cache->lock);
-                if (ret == 1)
+                if (ret == 1) {
+                        free_excluded_extents(fs_info->extent_root, cache);
                         return 0;
+                }
         }
 
         if (load_cache_only)
@@ -3344,8 +3341,10 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
         u64 reserved;
         u64 max_reclaim;
         u64 reclaimed = 0;
+        long time_left;
         int pause = 1;
         int nr_pages = (2 * 1024 * 1024) >> PAGE_CACHE_SHIFT;
+        int loops = 0;
 
         block_rsv = &root->fs_info->delalloc_block_rsv;
         space_info = block_rsv->space_info;
@@ -3358,7 +3357,7 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
 
         max_reclaim = min(reserved, to_reclaim);
 
-        while (1) {
+        while (loops < 1024) {
                 /* have the flusher threads jump in and do some IO */
                 smp_mb();
                 nr_pages = min_t(unsigned long, nr_pages,
@@ -3366,8 +3365,12 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
                 writeback_inodes_sb_nr_if_idle(root->fs_info->sb, nr_pages);
 
                 spin_lock(&space_info->lock);
-                if (reserved > space_info->bytes_reserved)
+                if (reserved > space_info->bytes_reserved) {
+                        loops = 0;
                         reclaimed += reserved - space_info->bytes_reserved;
+                } else {
+                        loops++;
+                }
                 reserved = space_info->bytes_reserved;
                 spin_unlock(&space_info->lock);
 
@@ -3378,7 +3381,12 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
                         return -EAGAIN;
 
                 __set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(pause);
+                time_left = schedule_timeout(pause);
+
+                /* We were interrupted, exit */
+                if (time_left)
+                        break;
+
                 pause <<= 1;
                 if (pause > HZ / 10)
                         pause = HZ / 10;
@@ -3588,8 +3596,20 @@ void block_rsv_release_bytes(struct btrfs_block_rsv *block_rsv,
 
         if (num_bytes > 0) {
                 if (dest) {
-                        block_rsv_add_bytes(dest, num_bytes, 0);
-                } else {
+                        spin_lock(&dest->lock);
+                        if (!dest->full) {
+                                u64 bytes_to_add;
+
+                                bytes_to_add = dest->size - dest->reserved;
+                                bytes_to_add = min(num_bytes, bytes_to_add);
+                                dest->reserved += bytes_to_add;
+                                if (dest->reserved >= dest->size)
+                                        dest->full = 1;
+                                num_bytes -= bytes_to_add;
+                        }
+                        spin_unlock(&dest->lock);
+                }
+                if (num_bytes) {
                         spin_lock(&space_info->lock);
                         space_info->bytes_reserved -= num_bytes;
                         spin_unlock(&space_info->lock);
@@ -4012,6 +4032,7 @@ void btrfs_delalloc_release_metadata(struct inode *inode, u64 num_bytes)
 
         num_bytes = ALIGN(num_bytes, root->sectorsize);
         atomic_dec(&BTRFS_I(inode)->outstanding_extents);
+        WARN_ON(atomic_read(&BTRFS_I(inode)->outstanding_extents) < 0);
 
         spin_lock(&BTRFS_I(inode)->accounting_lock);
         nr_extents = atomic_read(&BTRFS_I(inode)->outstanding_extents);
@@ -5633,6 +5654,7 @@ use_block_rsv(struct btrfs_trans_handle *trans,
               struct btrfs_root *root, u32 blocksize)
 {
         struct btrfs_block_rsv *block_rsv;
+        struct btrfs_block_rsv *global_rsv = &root->fs_info->global_block_rsv;
         int ret;
 
         block_rsv = get_block_rsv(trans, root);
@@ -5640,14 +5662,39 @@ use_block_rsv(struct btrfs_trans_handle *trans,
         if (block_rsv->size == 0) {
                 ret = reserve_metadata_bytes(trans, root, block_rsv,
                                              blocksize, 0);
-                if (ret)
+                /*
+                 * If we couldn't reserve metadata bytes try and use some from
+                 * the global reserve.
+                 */
+                if (ret && block_rsv != global_rsv) {
+                        ret = block_rsv_use_bytes(global_rsv, blocksize);
+                        if (!ret)
+                                return global_rsv;
+                        return ERR_PTR(ret);
+                } else if (ret) {
                         return ERR_PTR(ret);
+                }
                 return block_rsv;
         }
 
         ret = block_rsv_use_bytes(block_rsv, blocksize);
         if (!ret)
                 return block_rsv;
+        if (ret) {
+                WARN_ON(1);
+                ret = reserve_metadata_bytes(trans, root, block_rsv, blocksize,
+                                             0);
+                if (!ret) {
+                        spin_lock(&block_rsv->lock);
+                        block_rsv->size += blocksize;
+                        spin_unlock(&block_rsv->lock);
+                        return block_rsv;
+                } else if (ret && block_rsv != global_rsv) {
+                        ret = block_rsv_use_bytes(global_rsv, blocksize);
+                        if (!ret)
+                                return global_rsv;
+                }
+        }
 
         return ERR_PTR(-ENOSPC);
 }
@@ -6221,6 +6268,8 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
         BUG_ON(!wc);
 
         trans = btrfs_start_transaction(tree_root, 0);
+        BUG_ON(IS_ERR(trans));
+
         if (block_rsv)
                 trans->block_rsv = block_rsv;
 
@@ -6318,6 +6367,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
 
                         btrfs_end_transaction_throttle(trans, tree_root);
                         trans = btrfs_start_transaction(tree_root, 0);
+                        BUG_ON(IS_ERR(trans));
                         if (block_rsv)
                                 trans->block_rsv = block_rsv;
                 }
@@ -6446,6 +6496,8 @@ static noinline int relocate_inode_pages(struct inode *inode, u64 start,
         int ret = 0;
 
         ra = kzalloc(sizeof(*ra), GFP_NOFS);
+        if (!ra)
+                return -ENOMEM;
 
         mutex_lock(&inode->i_mutex);
         first_index = start >> PAGE_CACHE_SHIFT;
@@ -7477,7 +7529,7 @@ int btrfs_drop_dead_reloc_roots(struct btrfs_root *root)
                 BUG_ON(reloc_root->commit_root != NULL);
                 while (1) {
                         trans = btrfs_join_transaction(root, 1);
-                        BUG_ON(!trans);
+                        BUG_ON(IS_ERR(trans));
 
                         mutex_lock(&root->fs_info->drop_mutex);
                         ret = btrfs_drop_snapshot(trans, reloc_root);
@@ -7535,7 +7587,7 @@ int btrfs_cleanup_reloc_trees(struct btrfs_root *root)
 
         if (found) {
                 trans = btrfs_start_transaction(root, 1);
-                BUG_ON(!trans);
+                BUG_ON(IS_ERR(trans));
                 ret = btrfs_commit_transaction(trans, root);
                 BUG_ON(ret);
         }
@@ -7779,7 +7831,7 @@ static noinline int relocate_one_extent(struct btrfs_root *extent_root,
 
 
         trans = btrfs_start_transaction(extent_root, 1);
-        BUG_ON(!trans);
+        BUG_ON(IS_ERR(trans));
 
         if (extent_key->objectid == 0) {
                 ret = del_extent_zero(trans, extent_root, path, extent_key);
@@ -8270,6 +8322,13 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
                 if (block_group->cached == BTRFS_CACHE_STARTED)
                         wait_block_group_cache_done(block_group);
 
+                /*
+                 * We haven't cached this block group, which means we could
+                 * possibly have excluded extents on this block group.
+                 */
+                if (block_group->cached == BTRFS_CACHE_NO)
+                        free_excluded_extents(info->extent_root, block_group);
+
                 btrfs_remove_free_space_cache(block_group);
                 btrfs_put_block_group(block_group);
 
@@ -8385,6 +8444,13 @@ int btrfs_read_block_groups(struct btrfs_root *root)
                 cache->sectorsize = root->sectorsize;
 
                 /*
+                 * We need to exclude the super stripes now so that the space
+                 * info has super bytes accounted for, otherwise we'll think
+                 * we have more space than we actually do.
+                 */
+                exclude_super_stripes(root, cache);
+
+                /*
                  * check for two cases, either we are full, and therefore
                  * don't need to bother with the caching work since we won't
                  * find any space, or we are empty, and we can just add all
@@ -8392,12 +8458,10 @@ int btrfs_read_block_groups(struct btrfs_root *root)
                  * time, particularly in the full case.
                  */
                 if (found_key.offset == btrfs_block_group_used(&cache->item)) {
-                        exclude_super_stripes(root, cache);
                         cache->last_byte_to_unpin = (u64)-1;
                         cache->cached = BTRFS_CACHE_FINISHED;
                         free_excluded_extents(root, cache);
                 } else if (btrfs_block_group_used(&cache->item) == 0) {
-                        exclude_super_stripes(root, cache);
                         cache->last_byte_to_unpin = (u64)-1;
                         cache->cached = BTRFS_CACHE_FINISHED;
                         add_new_free_space(cache, root->fs_info,
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 2e993cf1766e..5e76a474cb7e 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -1865,7 +1865,7 @@ static int submit_one_bio(int rw, struct bio *bio, int mirror_num,
         bio_get(bio);
 
         if (tree->ops && tree->ops->submit_bio_hook)
-                tree->ops->submit_bio_hook(page->mapping->host, rw, bio,
+                ret = tree->ops->submit_bio_hook(page->mapping->host, rw, bio,
                                            mirror_num, bio_flags, start);
         else
                 submit_bio(rw, bio);
@@ -1920,6 +1920,8 @@ static int submit_extent_page(int rw, struct extent_io_tree *tree,
                 nr = bio_get_nr_vecs(bdev);
 
         bio = btrfs_bio_alloc(bdev, sector, nr, GFP_NOFS | __GFP_HIGH);
+        if (!bio)
+                return -ENOMEM;
 
         bio_add_page(bio, page, page_size, offset);
         bio->bi_end_io = end_io_func;
@@ -2126,7 +2128,7 @@ int extent_read_full_page(struct extent_io_tree *tree, struct page *page,
         ret = __extent_read_full_page(tree, page, get_extent, &bio, 0,
                                       &bio_flags);
         if (bio)
-                submit_one_bio(READ, bio, 0, bio_flags);
+                ret = submit_one_bio(READ, bio, 0, bio_flags);
         return ret;
 }
 
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index a562a250ae77..4f19a3e1bf32 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -536,6 +536,8 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
         root = root->fs_info->csum_root;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
 
         while (1) {
                 key.objectid = BTRFS_EXTENT_CSUM_OBJECTID;
@@ -548,7 +550,10 @@ int btrfs_del_csums(struct btrfs_trans_handle *trans,
                         if (path->slots[0] == 0)
                                 goto out;
                         path->slots[0]--;
+                } else if (ret < 0) {
+                        goto out;
                 }
+
                 leaf = path->nodes[0];
                 btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
 
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index c800d58f3013..c1d3a818731a 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -793,8 +793,12 @@ again:
         for (i = 0; i < num_pages; i++) {
                 pages[i] = grab_cache_page(inode->i_mapping, index + i);
                 if (!pages[i]) {
-                        err = -ENOMEM;
-                        BUG_ON(1);
+                        int c;
+                        for (c = i - 1; c >= 0; c--) {
+                                unlock_page(pages[c]);
+                                page_cache_release(pages[c]);
+                        }
+                        return -ENOMEM;
                 }
                 wait_on_page_writeback(pages[i]);
         }
@@ -946,6 +950,10 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
                      PAGE_CACHE_SIZE, PAGE_CACHE_SIZE /
                      (sizeof(struct page *)));
         pages = kmalloc(nrptrs * sizeof(struct page *), GFP_KERNEL);
+        if (!pages) {
+                ret = -ENOMEM;
+                goto out;
+        }
 
         /* generic_write_checks can change our pos */
         start_pos = pos;
@@ -984,8 +992,8 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
                 size_t write_bytes = min(iov_iter_count(&i),
                                          nrptrs * (size_t)PAGE_CACHE_SIZE -
                                          offset);
-                size_t num_pages = (write_bytes + PAGE_CACHE_SIZE - 1) >>
-                                        PAGE_CACHE_SHIFT;
+                size_t num_pages = (write_bytes + offset +
+                                    PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 
                 WARN_ON(num_pages > nrptrs);
                 memset(pages, 0, sizeof(struct page *) * nrptrs);
@@ -1015,8 +1023,8 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
 
                 copied = btrfs_copy_from_user(pos, num_pages,
                                            write_bytes, pages, &i);
-                dirty_pages = (copied + PAGE_CACHE_SIZE - 1) >>
-                                        PAGE_CACHE_SHIFT;
+                dirty_pages = (copied + offset + PAGE_CACHE_SIZE - 1) >>
+                                PAGE_CACHE_SHIFT;
 
                 if (num_pages > dirty_pages) {
                         if (copied > 0)
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 60d684266959..a0390657451b 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -987,11 +987,18 @@ tree_search_offset(struct btrfs_block_group_cache *block_group,
         return entry;
 }
 
-static void unlink_free_space(struct btrfs_block_group_cache *block_group,
-                              struct btrfs_free_space *info)
+static inline void
+__unlink_free_space(struct btrfs_block_group_cache *block_group,
+                    struct btrfs_free_space *info)
 {
         rb_erase(&info->offset_index, &block_group->free_space_offset);
         block_group->free_extents--;
+}
+
+static void unlink_free_space(struct btrfs_block_group_cache *block_group,
+                              struct btrfs_free_space *info)
+{
+        __unlink_free_space(block_group, info);
         block_group->free_space -= info->bytes;
 }
 
@@ -1016,14 +1023,18 @@ static void recalculate_thresholds(struct btrfs_block_group_cache *block_group)
         u64 max_bytes;
         u64 bitmap_bytes;
         u64 extent_bytes;
+        u64 size = block_group->key.offset;
 
         /*
          * The goal is to keep the total amount of memory used per 1gb of space
          * at or below 32k, so we need to adjust how much memory we allow to be
          * used by extent based free space tracking
          */
-        max_bytes = MAX_CACHE_BYTES_PER_GIG *
-                (div64_u64(block_group->key.offset, 1024 * 1024 * 1024));
+        if (size < 1024 * 1024 * 1024)
+                max_bytes = MAX_CACHE_BYTES_PER_GIG;
+        else
+                max_bytes = MAX_CACHE_BYTES_PER_GIG *
+                        div64_u64(size, 1024 * 1024 * 1024);
 
         /*
          * we want to account for 1 more bitmap than what we have so we can make
@@ -1171,6 +1182,16 @@ static void add_new_bitmap(struct btrfs_block_group_cache *block_group,
         recalculate_thresholds(block_group);
 }
 
+static void free_bitmap(struct btrfs_block_group_cache *block_group,
+                        struct btrfs_free_space *bitmap_info)
+{
+        unlink_free_space(block_group, bitmap_info);
+        kfree(bitmap_info->bitmap);
+        kfree(bitmap_info);
+        block_group->total_bitmaps--;
+        recalculate_thresholds(block_group);
+}
+
 static noinline int remove_from_bitmap(struct btrfs_block_group_cache *block_group,
                               struct btrfs_free_space *bitmap_info,
                               u64 *offset, u64 *bytes)
@@ -1195,6 +1216,7 @@ again:
          */
         search_start = *offset;
         search_bytes = *bytes;
+        search_bytes = min(search_bytes, end - search_start + 1);
         ret = search_bitmap(block_group, bitmap_info, &search_start,
                             &search_bytes);
         BUG_ON(ret < 0 || search_start != *offset);
@@ -1211,13 +1233,8 @@ again:
 
         if (*bytes) {
                 struct rb_node *next = rb_next(&bitmap_info->offset_index);
-                if (!bitmap_info->bytes) {
-                        unlink_free_space(block_group, bitmap_info);
-                        kfree(bitmap_info->bitmap);
-                        kfree(bitmap_info);
-                        block_group->total_bitmaps--;
-                        recalculate_thresholds(block_group);
-                }
+                if (!bitmap_info->bytes)
+                        free_bitmap(block_group, bitmap_info);
 
                 /*
                  * no entry after this bitmap, but we still have bytes to
@@ -1250,13 +1267,8 @@ again:
                         return -EAGAIN;
 
                 goto again;
-        } else if (!bitmap_info->bytes) {
-                unlink_free_space(block_group, bitmap_info);
-                kfree(bitmap_info->bitmap);
-                kfree(bitmap_info);
-                block_group->total_bitmaps--;
-                recalculate_thresholds(block_group);
-        }
+        } else if (!bitmap_info->bytes)
+                free_bitmap(block_group, bitmap_info);
 
         return 0;
 }
@@ -1359,22 +1371,14 @@ out:
         return ret;
 }
 
-int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
-                         u64 offset, u64 bytes)
+bool try_merge_free_space(struct btrfs_block_group_cache *block_group,
+                          struct btrfs_free_space *info, bool update_stat)
 {
-        struct btrfs_free_space *right_info = NULL;
-        struct btrfs_free_space *left_info = NULL;
-        struct btrfs_free_space *info = NULL;
-        int ret = 0;
-
-        info = kzalloc(sizeof(struct btrfs_free_space), GFP_NOFS);
-        if (!info)
-                return -ENOMEM;
-
-        info->offset = offset;
-        info->bytes = bytes;
-
-        spin_lock(&block_group->tree_lock);
+        struct btrfs_free_space *left_info;
+        struct btrfs_free_space *right_info;
+        bool merged = false;
+        u64 offset = info->offset;
+        u64 bytes = info->bytes;
 
         /*
          * first we want to see if there is free space adjacent to the range we
@@ -1388,37 +1392,62 @@ int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
         else
                 left_info = tree_search_offset(block_group, offset - 1, 0, 0);
 
-        /*
-         * If there was no extent directly to the left or right of this new
-         * extent then we know we're going to have to allocate a new extent, so
-         * before we do that see if we need to drop this into a bitmap
-         */
-        if ((!left_info || left_info->bitmap) &&
-            (!right_info || right_info->bitmap)) {
-                ret = insert_into_bitmap(block_group, info);
-
-                if (ret < 0) {
-                        goto out;
-                } else if (ret) {
-                        ret = 0;
-                        goto out;
-                }
-        }
-
         if (right_info && !right_info->bitmap) {
-                unlink_free_space(block_group, right_info);
+                if (update_stat)
+                        unlink_free_space(block_group, right_info);
+                else
+                        __unlink_free_space(block_group, right_info);
                 info->bytes += right_info->bytes;
                 kfree(right_info);
+                merged = true;
         }
 
         if (left_info && !left_info->bitmap &&
             left_info->offset + left_info->bytes == offset) {
-                unlink_free_space(block_group, left_info);
+                if (update_stat)
+                        unlink_free_space(block_group, left_info);
+                else
+                        __unlink_free_space(block_group, left_info);
                 info->offset = left_info->offset;
                 info->bytes += left_info->bytes;
                 kfree(left_info);
+                merged = true;
         }
 
+        return merged;
+}
+
+int btrfs_add_free_space(struct btrfs_block_group_cache *block_group,
+                         u64 offset, u64 bytes)
+{
+        struct btrfs_free_space *info;
+        int ret = 0;
+
+        info = kzalloc(sizeof(struct btrfs_free_space), GFP_NOFS);
+        if (!info)
+                return -ENOMEM;
+
+        info->offset = offset;
+        info->bytes = bytes;
+
+        spin_lock(&block_group->tree_lock);
+
+        if (try_merge_free_space(block_group, info, true))
+                goto link;
+
+        /*
+         * There was no extent directly to the left or right of this new
+         * extent then we know we're going to have to allocate a new extent, so
+         * before we do that see if we need to drop this into a bitmap
+         */
+        ret = insert_into_bitmap(block_group, info);
+        if (ret < 0) {
+                goto out;
+        } else if (ret) {
+                ret = 0;
+                goto out;
+        }
+link:
         ret = link_free_space(block_group, info);
         if (ret)
                 kfree(info);
@@ -1621,6 +1650,7 @@ __btrfs_return_cluster_to_free_space(
                 node = rb_next(&entry->offset_index);
                 rb_erase(&entry->offset_index, &cluster->root);
                 BUG_ON(entry->bitmap);
+                try_merge_free_space(block_group, entry, false);
                 tree_insert_offset(&block_group->free_space_offset,
                                    entry->offset, &entry->offset_index, 0);
         }
@@ -1685,13 +1715,8 @@ u64 btrfs_find_space_for_alloc(struct btrfs_block_group_cache *block_group,
         ret = offset;
         if (entry->bitmap) {
                 bitmap_clear_bits(block_group, entry, offset, bytes);
-                if (!entry->bytes) {
-                        unlink_free_space(block_group, entry);
-                        kfree(entry->bitmap);
-                        kfree(entry);
-                        block_group->total_bitmaps--;
-                        recalculate_thresholds(block_group);
-                }
+                if (!entry->bytes)
+                        free_bitmap(block_group, entry);
         } else {
                 unlink_free_space(block_group, entry);
                 entry->offset += bytes;
@@ -1789,6 +1814,8 @@ static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
 
         ret = search_start;
         bitmap_clear_bits(block_group, entry, ret, bytes);
+        if (entry->bytes == 0)
+                free_bitmap(block_group, entry);
 out:
         spin_unlock(&cluster->lock);
         spin_unlock(&block_group->tree_lock);
@@ -1842,15 +1869,26 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
                 entry->offset += bytes;
                 entry->bytes -= bytes;
 
-                if (entry->bytes == 0) {
+                if (entry->bytes == 0)
                         rb_erase(&entry->offset_index, &cluster->root);
-                        kfree(entry);
-                }
                 break;
         }
 out:
         spin_unlock(&cluster->lock);
 
+        if (!ret)
+                return 0;
+
+        spin_lock(&block_group->tree_lock);
+
+        block_group->free_space -= bytes;
+        if (entry->bytes == 0) {
+                block_group->free_extents--;
+                kfree(entry);
+        }
+
+        spin_unlock(&block_group->tree_lock);
+
         return ret;
 }
 
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 160b55b3e132..bcc461a9695f 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -416,7 +416,7 @@ again:
         }
         if (start == 0) {
                 trans = btrfs_join_transaction(root, 1);
-                BUG_ON(!trans);
+                BUG_ON(IS_ERR(trans));
                 btrfs_set_trans_block_group(trans, inode);
                 trans->block_rsv = &root->fs_info->delalloc_block_rsv;
 
@@ -612,6 +612,7 @@ retry:
                             GFP_NOFS);
 
                 trans = btrfs_join_transaction(root, 1);
+                BUG_ON(IS_ERR(trans));
                 ret = btrfs_reserve_extent(trans, root,
                                            async_extent->compressed_size,
                                            async_extent->compressed_size,
@@ -771,7 +772,7 @@ static noinline int cow_file_range(struct inode *inode,
 
         BUG_ON(root == root->fs_info->tree_root);
         trans = btrfs_join_transaction(root, 1);
-        BUG_ON(!trans);
+        BUG_ON(IS_ERR(trans));
         btrfs_set_trans_block_group(trans, inode);
         trans->block_rsv = &root->fs_info->delalloc_block_rsv;
 
@@ -1049,7 +1050,7 @@ static noinline int run_delalloc_nocow(struct inode *inode,
         } else {
                 trans = btrfs_join_transaction(root, 1);
         }
-        BUG_ON(!trans);
+        BUG_ON(IS_ERR(trans));
 
         cow_start = (u64)-1;
         cur_offset = start;
@@ -1557,6 +1558,7 @@ out:
 out_page:
         unlock_page(page);
         page_cache_release(page);
+        kfree(fixup);
 }
 
 /*
@@ -1703,7 +1705,7 @@ static int btrfs_finish_ordered_io(struct inode *inode, u64 start, u64 end)
                                 trans = btrfs_join_transaction_nolock(root, 1);
                         else
                                 trans = btrfs_join_transaction(root, 1);
-                        BUG_ON(!trans);
+                        BUG_ON(IS_ERR(trans));
                         btrfs_set_trans_block_group(trans, inode);
                         trans->block_rsv = &root->fs_info->delalloc_block_rsv;
                         ret = btrfs_update_inode(trans, root, inode);
@@ -1720,6 +1722,7 @@ static int btrfs_finish_ordered_io(struct inode *inode, u64 start, u64 end)
                 trans = btrfs_join_transaction_nolock(root, 1);
         else
                 trans = btrfs_join_transaction(root, 1);
+        BUG_ON(IS_ERR(trans));
         btrfs_set_trans_block_group(trans, inode);
         trans->block_rsv = &root->fs_info->delalloc_block_rsv;
 
@@ -2354,6 +2357,7 @@ void btrfs_orphan_cleanup(struct btrfs_root *root)
                  */
                 if (is_bad_inode(inode)) {
                         trans = btrfs_start_transaction(root, 0);
+                        BUG_ON(IS_ERR(trans));
                         btrfs_orphan_del(trans, inode);
                         btrfs_end_transaction(trans, root);
                         iput(inode);
@@ -2381,6 +2385,7 @@ void btrfs_orphan_cleanup(struct btrfs_root *root)
 
         if (root->orphan_block_rsv || root->orphan_item_inserted) {
                 trans = btrfs_join_transaction(root, 1);
+                BUG_ON(IS_ERR(trans));
                 btrfs_end_transaction(trans, root);
         }
 
@@ -2641,7 +2646,7 @@ int btrfs_unlink_inode(struct btrfs_trans_handle *trans,
         path = btrfs_alloc_path();
         if (!path) {
                 ret = -ENOMEM;
-                goto err;
+                goto out;
         }
 
         path->leave_spinning = 1;
@@ -2714,9 +2719,10 @@ static int check_path_shared(struct btrfs_root *root,
         struct extent_buffer *eb;
         int level;
         u64 refs = 1;
-        int uninitialized_var(ret);
 
         for (level = 0; level < BTRFS_MAX_LEVEL; level++) {
+                int ret;
+
                 if (!path->nodes[level])
                         break;
                 eb = path->nodes[level];
@@ -2727,7 +2733,7 @@ static int check_path_shared(struct btrfs_root *root,
                 if (refs > 1)
                         return 1;
         }
-        return ret; /* XXX callers? */
+        return 0;
 }
 
 /*
@@ -4134,7 +4140,7 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
         }
         srcu_read_unlock(&root->fs_info->subvol_srcu, index);
 
-        if (root != sub_root) {
+        if (!IS_ERR(inode) && root != sub_root) {
                 down_read(&root->fs_info->cleanup_work_sem);
                 if (!(inode->i_sb->s_flags & MS_RDONLY))
                         btrfs_orphan_cleanup(sub_root);
@@ -4347,6 +4353,8 @@ int btrfs_write_inode(struct inode *inode, struct writeback_control *wbc)
                         trans = btrfs_join_transaction_nolock(root, 1);
                 else
                         trans = btrfs_join_transaction(root, 1);
+                if (IS_ERR(trans))
+                        return PTR_ERR(trans);
                 btrfs_set_trans_block_group(trans, inode);
                 if (nolock)
                         ret = btrfs_end_transaction_nolock(trans, root);
@@ -4372,6 +4380,7 @@ void btrfs_dirty_inode(struct inode *inode)
                 return;
 
         trans = btrfs_join_transaction(root, 1);
+        BUG_ON(IS_ERR(trans));
         btrfs_set_trans_block_group(trans, inode);
 
         ret = btrfs_update_inode(trans, root, inode);
@@ -5176,6 +5185,8 @@ again:
                                 em = NULL;
                                 btrfs_release_path(root, path);
                                 trans = btrfs_join_transaction(root, 1);
+                                if (IS_ERR(trans))
+                                        return ERR_CAST(trans);
                                 goto again;
                         }
                         map = kmap(page);
@@ -5280,8 +5291,8 @@ static struct extent_map *btrfs_new_extent_direct(struct inode *inode,
         btrfs_drop_extent_cache(inode, start, start + len - 1, 0);
 
         trans = btrfs_join_transaction(root, 0);
-        if (!trans)
-                return ERR_PTR(-ENOMEM);
+        if (IS_ERR(trans))
+                return ERR_CAST(trans);
 
         trans->block_rsv = &root->fs_info->delalloc_block_rsv;
 
@@ -5505,7 +5516,7 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
                  * while we look for nocow cross refs
                  */
                 trans = btrfs_join_transaction(root, 0);
-                if (!trans)
+                if (IS_ERR(trans))
                         goto must_cow;
 
                 if (can_nocow_odirect(trans, inode, start, len) == 1) {
@@ -5640,7 +5651,7 @@ again:
         BUG_ON(!ordered);
 
         trans = btrfs_join_transaction(root, 1);
-        if (!trans) {
+        if (IS_ERR(trans)) {
                 err = -ENOMEM;
                 goto out;
         }
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index a506a22b522a..02d224e8c83f 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -203,7 +203,7 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg)
 
 
         trans = btrfs_join_transaction(root, 1);
-        BUG_ON(!trans);
+        BUG_ON(IS_ERR(trans));
 
         ret = btrfs_update_inode(trans, root, inode);
         BUG_ON(ret);
@@ -907,6 +907,10 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
 
         if (new_size > old_size) {
                 trans = btrfs_start_transaction(root, 0);
+                if (IS_ERR(trans)) {
+                        ret = PTR_ERR(trans);
+                        goto out_unlock;
+                }
                 ret = btrfs_grow_device(trans, device, new_size);
                 btrfs_commit_transaction(trans, root);
         } else {
@@ -1898,7 +1902,10 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
 
                         memcpy(&new_key, &key, sizeof(new_key));
                         new_key.objectid = inode->i_ino;
-                        new_key.offset = key.offset + destoff - off;
+                        if (off <= key.offset)
+                                new_key.offset = key.offset + destoff - off;
+                        else
+                                new_key.offset = destoff;
 
                         trans = btrfs_start_transaction(root, 1);
                         if (IS_ERR(trans)) {
@@ -2082,7 +2089,7 @@ static long btrfs_ioctl_trans_start(struct file *file)
 
         ret = -ENOMEM;
         trans = btrfs_start_ioctl_transaction(root, 0);
-        if (!trans)
+        if (IS_ERR(trans))
                 goto out_drop;
 
         file->private_data = trans;
@@ -2138,9 +2145,9 @@ static long btrfs_ioctl_default_subvol(struct file *file, void __user *argp)
         path->leave_spinning = 1;
 
         trans = btrfs_start_transaction(root, 1);
-        if (!trans) {
+        if (IS_ERR(trans)) {
                 btrfs_free_path(path);
-                return -ENOMEM;
+                return PTR_ERR(trans);
         }
 
         dir_id = btrfs_super_root_dir(&root->fs_info->super_copy);
@@ -2334,6 +2341,8 @@ static noinline long btrfs_ioctl_start_sync(struct file *file, void __user *argp
         u64 transid;
 
         trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans))
+                return PTR_ERR(trans);
         transid = trans->transid;
         btrfs_commit_transaction_async(trans, root, 0);
 
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 2b61e1ddcd99..083a55477375 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -141,7 +141,7 @@ static inline struct rb_node *tree_search(struct btrfs_ordered_inode_tree *tree,
                                           u64 file_offset)
 {
         struct rb_root *root = &tree->tree;
-        struct rb_node *prev;
+        struct rb_node *prev = NULL;
         struct rb_node *ret;
         struct btrfs_ordered_extent *entry;
 
diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
index 0d126be22b63..fb2605d998e9 100644
--- a/fs/btrfs/print-tree.c
+++ b/fs/btrfs/print-tree.c
@@ -260,6 +260,7 @@ void btrfs_print_leaf(struct btrfs_root *root, struct extent_buffer *l)
 #else
                         BUG();
 #endif
+                        break;
                 case BTRFS_BLOCK_GROUP_ITEM_KEY:
                         bi = btrfs_item_ptr(l, i,
                                             struct btrfs_block_group_item);
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 045c9c2b2d7e..1f5556acb530 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -2028,6 +2028,7 @@ static noinline_for_stack int merge_reloc_root(struct reloc_control *rc,
 
         while (1) {
                 trans = btrfs_start_transaction(root, 0);
+                BUG_ON(IS_ERR(trans));
                 trans->block_rsv = rc->block_rsv;
 
                 ret = btrfs_block_rsv_check(trans, root, rc->block_rsv,
@@ -2147,6 +2148,12 @@ again:
         }
 
         trans = btrfs_join_transaction(rc->extent_root, 1);
+        if (IS_ERR(trans)) {
+                if (!err)
+                        btrfs_block_rsv_release(rc->extent_root,
+                                                rc->block_rsv, num_bytes);
+                return PTR_ERR(trans);
+        }
 
         if (!err) {
                 if (num_bytes != rc->merging_rsv_size) {
@@ -3222,6 +3229,7 @@ truncate:
         trans = btrfs_join_transaction(root, 0);
         if (IS_ERR(trans)) {
                 btrfs_free_path(path);
+                ret = PTR_ERR(trans);
                 goto out;
         }
 
@@ -3628,6 +3636,7 @@ int prepare_to_relocate(struct reloc_control *rc)
         set_reloc_control(rc);
 
         trans = btrfs_join_transaction(rc->extent_root, 1);
+        BUG_ON(IS_ERR(trans));
         btrfs_commit_transaction(trans, rc->extent_root);
         return 0;
 }
@@ -3657,6 +3666,7 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
 
         while (1) {
                 trans = btrfs_start_transaction(rc->extent_root, 0);
+                BUG_ON(IS_ERR(trans));
 
                 if (update_backref_cache(trans, &rc->backref_cache)) {
                         btrfs_end_transaction(trans, rc->extent_root);
@@ -3804,7 +3814,10 @@ static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
 
         /* get rid of pinned extents */
         trans = btrfs_join_transaction(rc->extent_root, 1);
-        btrfs_commit_transaction(trans, rc->extent_root);
+        if (IS_ERR(trans))
+                err = PTR_ERR(trans);
+        else
+                btrfs_commit_transaction(trans, rc->extent_root);
 out_free:
         btrfs_free_block_rsv(rc->extent_root, rc->block_rsv);
         btrfs_free_path(path);
@@ -4022,6 +4035,7 @@ static noinline_for_stack int mark_garbage_root(struct btrfs_root *root)
         int ret;
 
         trans = btrfs_start_transaction(root->fs_info->tree_root, 0);
+        BUG_ON(IS_ERR(trans));
 
         memset(&root->root_item.drop_progress, 0,
                 sizeof(root->root_item.drop_progress));
@@ -4125,6 +4139,11 @@ int btrfs_recover_relocation(struct btrfs_root *root)
         set_reloc_control(rc);
 
         trans = btrfs_join_transaction(rc->extent_root, 1);
+        if (IS_ERR(trans)) {
+                unset_reloc_control(rc);
+                err = PTR_ERR(trans);
+                goto out_free;
+        }
 
         rc->merge_reloc_tree = 1;
 
@@ -4154,9 +4173,13 @@ int btrfs_recover_relocation(struct btrfs_root *root)
         unset_reloc_control(rc);
 
         trans = btrfs_join_transaction(rc->extent_root, 1);
-        btrfs_commit_transaction(trans, rc->extent_root);
-out:
+        if (IS_ERR(trans))
+                err = PTR_ERR(trans);
+        else
+                btrfs_commit_transaction(trans, rc->extent_root);
+out_free:
         kfree(rc);
+out:
         while (!list_empty(&reloc_roots)) {
                 reloc_root = list_entry(reloc_roots.next,
                                         struct btrfs_root, root_list);
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index b2130c46fdb5..a004008f7d28 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -383,7 +383,7 @@ static int btrfs_parse_early_options(const char *options, fmode_t flags,
                 struct btrfs_fs_devices **fs_devices)
 {
         substring_t args[MAX_OPT_ARGS];
-        char *opts, *p;
+        char *opts, *orig, *p;
         int error = 0;
         int intarg;
 
@@ -397,6 +397,7 @@ static int btrfs_parse_early_options(const char *options, fmode_t flags,
         opts = kstrdup(options, GFP_KERNEL);
         if (!opts)
                 return -ENOMEM;
+        orig = opts;
 
         while ((p = strsep(&opts, ",")) != NULL) {
                 int token;
@@ -432,7 +433,7 @@ static int btrfs_parse_early_options(const char *options, fmode_t flags,
         }
 
  out_free_opts:
-        kfree(opts);
+        kfree(orig);
  out:
         /*
          * If no subvolume name is specified we use the default one.  Allocate
@@ -623,6 +624,8 @@ int btrfs_sync_fs(struct super_block *sb, int wait)
         btrfs_wait_ordered_extents(root, 0, 0);
 
         trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans))
+                return PTR_ERR(trans);
         ret = btrfs_commit_transaction(trans, root);
         return ret;
 }
@@ -761,6 +764,8 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags,
                 }
 
                 btrfs_close_devices(fs_devices);
+                kfree(fs_info);
+                kfree(tree_root);
         } else {
                 char b[BDEVNAME_SIZE];
 
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index bae5c7b8bbe2..3d73c8d93bbb 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1161,6 +1161,11 @@ int btrfs_commit_transaction_async(struct btrfs_trans_handle *trans,
         INIT_DELAYED_WORK(&ac->work, do_async_commit);
         ac->root = root;
         ac->newtrans = btrfs_join_transaction(root, 0);
+        if (IS_ERR(ac->newtrans)) {
+                int err = PTR_ERR(ac->newtrans);
+                kfree(ac);
+                return err;
+        }
 
         /* take transaction reference */
         mutex_lock(&root->fs_info->trans_mutex);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 054744ac5719..a4bbb854dfd2 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -338,6 +338,12 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
                 }
                 dst_copy = kmalloc(item_size, GFP_NOFS);
                 src_copy = kmalloc(item_size, GFP_NOFS);
+                if (!dst_copy || !src_copy) {
+                        btrfs_release_path(root, path);
+                        kfree(dst_copy);
+                        kfree(src_copy);
+                        return -ENOMEM;
+                }
 
                 read_extent_buffer(eb, src_copy, src_ptr, item_size);
 
@@ -665,6 +671,9 @@ static noinline int drop_one_dir_item(struct btrfs_trans_handle *trans,
         btrfs_dir_item_key_to_cpu(leaf, di, &location);
         name_len = btrfs_dir_name_len(leaf, di);
         name = kmalloc(name_len, GFP_NOFS);
+        if (!name)
+                return -ENOMEM;
+
         read_extent_buffer(leaf, name, (unsigned long)(di + 1), name_len);
         btrfs_release_path(root, path);
 
@@ -744,6 +753,9 @@ static noinline int backref_in_log(struct btrfs_root *log,
         int match = 0;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
         ret = btrfs_search_slot(NULL, log, key, path, 0, 0);
         if (ret != 0)
                 goto out;
@@ -967,6 +979,8 @@ static noinline int fixup_inode_link_count(struct btrfs_trans_handle *trans,
         key.offset = (u64)-1;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
 
         while (1) {
                 ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
@@ -1178,6 +1192,9 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,
 
         name_len = btrfs_dir_name_len(eb, di);
         name = kmalloc(name_len, GFP_NOFS);
+        if (!name)
+                return -ENOMEM;
+
         log_type = btrfs_dir_type(eb, di);
         read_extent_buffer(eb, name, (unsigned long)(di + 1),
                    name_len);
@@ -1692,6 +1709,8 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
                 root_owner = btrfs_header_owner(parent);
 
                 next = btrfs_find_create_tree_block(root, bytenr, blocksize);
+                if (!next)
+                        return -ENOMEM;
 
                 if (*level == 1) {
                         wc->process_func(root, next, wc, ptr_gen);
@@ -2032,6 +2051,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
                 wait_log_commit(trans, log_root_tree,
                                 log_root_tree->log_transid);
                 mutex_unlock(&log_root_tree->log_mutex);
+                ret = 0;
                 goto out;
         }
         atomic_set(&log_root_tree->log_commit[index2], 1);
@@ -2096,7 +2116,7 @@ out:
         smp_mb();
         if (waitqueue_active(&root->log_commit_wait[index1]))
                 wake_up(&root->log_commit_wait[index1]);
-        return 0;
+        return ret;
 }
 
 static void free_log_tree(struct btrfs_trans_handle *trans,
@@ -2194,6 +2214,9 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
 
         log = root->log_root;
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+
         di = btrfs_lookup_dir_item(trans, log, path, dir->i_ino,
                                    name, name_len, -1);
         if (IS_ERR(di)) {
@@ -2594,6 +2617,9 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
 
         ins_data = kmalloc(nr * sizeof(struct btrfs_key) +
                            nr * sizeof(u32), GFP_NOFS);
+        if (!ins_data)
+                return -ENOMEM;
+
         ins_sizes = (u32 *)ins_data;
         ins_keys = (struct btrfs_key *)(ins_data + nr * sizeof(u32));
 
@@ -2725,7 +2751,13 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
         log = root->log_root;
 
         path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
         dst_path = btrfs_alloc_path();
+        if (!dst_path) {
+                btrfs_free_path(path);
+                return -ENOMEM;
+        }
 
         min_key.objectid = inode->i_ino;
         min_key.type = BTRFS_INODE_ITEM_KEY;
@@ -3080,6 +3112,7 @@ int btrfs_recover_log_trees(struct btrfs_root *log_root_tree)
         BUG_ON(!path);
 
         trans = btrfs_start_transaction(fs_info->tree_root, 0);
+        BUG_ON(IS_ERR(trans));
 
         wc.trans = trans;
         wc.pin = 1;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index d158530233b7..2636a051e4b2 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1213,6 +1213,10 @@ static int btrfs_rm_dev_item(struct btrfs_root *root,
                 return -ENOMEM;
 
         trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans)) {
+                btrfs_free_path(path);
+                return PTR_ERR(trans);
+        }
         key.objectid = BTRFS_DEV_ITEMS_OBJECTID;
         key.type = BTRFS_DEV_ITEM_KEY;
         key.offset = device->devid;
@@ -1606,6 +1610,12 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
         }
 
         trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans)) {
+                kfree(device);
+                ret = PTR_ERR(trans);
+                goto error;
+        }
+
         lock_chunks(root);
 
         device->writeable = 1;
@@ -1873,7 +1883,7 @@ static int btrfs_relocate_chunk(struct btrfs_root *root,
                 return ret;
 
         trans = btrfs_start_transaction(root, 0);
-        BUG_ON(!trans);
+        BUG_ON(IS_ERR(trans));
 
         lock_chunks(root);
 
@@ -2047,7 +2057,7 @@ int btrfs_balance(struct btrfs_root *dev_root)
                 BUG_ON(ret);
 
                 trans = btrfs_start_transaction(dev_root, 0);
-                BUG_ON(!trans);
+                BUG_ON(IS_ERR(trans));
 
                 ret = btrfs_grow_device(trans, device, old_size);
                 BUG_ON(ret);
@@ -2213,6 +2223,11 @@ again:
 
         /* Shrinking succeeded, else we would be at "done". */
         trans = btrfs_start_transaction(root, 0);
+        if (IS_ERR(trans)) {
+                ret = PTR_ERR(trans);
+                goto done;
+        }
+
         lock_chunks(root);
 
         device->disk_total_bytes = new_size;
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 60d27bc9eb83..6b61ded701e1 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1560,9 +1560,10 @@ retry_locked:
                 /* NOTE: no side-effects allowed, until we take s_mutex */
 
                 revoking = cap->implemented & ~cap->issued;
-                if (revoking)
-                        dout(" mds%d revoking %s\n", cap->mds,
-                             ceph_cap_string(revoking));
+                dout(" mds%d cap %p issued %s implemented %s revoking %s\n",
+                     cap->mds, cap, ceph_cap_string(cap->issued),
+                     ceph_cap_string(cap->implemented),
+                     ceph_cap_string(revoking));
 
                 if (cap == ci->i_auth_cap &&
                     (cap->issued & CEPH_CAP_FILE_WR)) {
@@ -1658,6 +1659,8 @@ ack:
 
                 if (cap == ci->i_auth_cap && ci->i_dirty_caps)
                         flushing = __mark_caps_flushing(inode, session);
+                else
+                        flushing = 0;
 
                 mds = cap->mds;  /* remember mds, so we don't repeat */
                 sent++;
@@ -1940,6 +1943,35 @@ void ceph_kick_flushing_caps(struct ceph_mds_client *mdsc,
         }
 }
 
+static void kick_flushing_inode_caps(struct ceph_mds_client *mdsc,
+                                     struct ceph_mds_session *session,
+                                     struct inode *inode)
+{
+        struct ceph_inode_info *ci = ceph_inode(inode);
+        struct ceph_cap *cap;
+        int delayed = 0;
+
+        spin_lock(&inode->i_lock);
+        cap = ci->i_auth_cap;
+        dout("kick_flushing_inode_caps %p flushing %s flush_seq %lld\n", inode,
+             ceph_cap_string(ci->i_flushing_caps), ci->i_cap_flush_seq);
+        __ceph_flush_snaps(ci, &session, 1);
+        if (ci->i_flushing_caps) {
+                delayed = __send_cap(mdsc, cap, CEPH_CAP_OP_FLUSH,
+                                     __ceph_caps_used(ci),
+                                     __ceph_caps_wanted(ci),
+                                     cap->issued | cap->implemented,
+                                     ci->i_flushing_caps, NULL);
+                if (delayed) {
+                        spin_lock(&inode->i_lock);
+                        __cap_delay_requeue(mdsc, ci);
+                        spin_unlock(&inode->i_lock);
+                }
+        } else {
+                spin_unlock(&inode->i_lock);
+        }
+}
+
 
 /*
  * Take references to capabilities we hold, so that we don't release
@@ -2687,7 +2719,7 @@ static void handle_cap_import(struct ceph_mds_client *mdsc,
         ceph_add_cap(inode, session, cap_id, -1,
                      issued, wanted, seq, mseq, realmino, CEPH_CAP_FLAG_AUTH,
                      NULL /* no caps context */);
-        try_flush_caps(inode, session, NULL);
+        kick_flushing_inode_caps(mdsc, session, inode);
         up_read(&mdsc->snap_rwsem);
 
         /* make sure we re-request max_size, if necessary */
@@ -2785,8 +2817,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         case CEPH_CAP_OP_IMPORT:
                 handle_cap_import(mdsc, inode, h, session,
                                   snaptrace, snaptrace_len);
-                ceph_check_caps(ceph_inode(inode), CHECK_CAPS_NODELAY,
-                                session);
+                ceph_check_caps(ceph_inode(inode), 0, session);
                 goto done_unlocked;
         }
 
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index e835eff551e3..5625463aa479 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -710,10 +710,6 @@ static int fill_inode(struct inode *inode,
                         ci->i_ceph_flags |= CEPH_I_COMPLETE;
                         ci->i_max_offset = 2;
                 }
-
-                /* it may be better to set st_size in getattr instead? */
-                if (ceph_test_mount_opt(ceph_sb_to_client(inode->i_sb), RBYTES))
-                        inode->i_size = ci->i_rbytes;
                 break;
         default:
                 pr_err("fill_inode %llx.%llx BAD mode 0%o\n",
@@ -1819,7 +1815,11 @@ int ceph_getattr(struct vfsmount *mnt, struct dentry *dentry,
                 else
                         stat->dev = 0;
                 if (S_ISDIR(inode->i_mode)) {
-                        stat->size = ci->i_rbytes;
+                        if (ceph_test_mount_opt(ceph_sb_to_client(inode->i_sb),
+                                                RBYTES))
+                                stat->size = ci->i_rbytes;
+                        else
+                                stat->size = ci->i_files + ci->i_subdirs;
                         stat->blocks = 0;
                         stat->blksize = 65536;
                 }
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 1e30d194a8e3..a1ee8fa3a8e7 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -693,9 +693,11 @@ static int __choose_mds(struct ceph_mds_client *mdsc,
                                 dout("choose_mds %p %llx.%llx "
                                      "frag %u mds%d (%d/%d)\n",
                                      inode, ceph_vinop(inode),
-                                     frag.frag, frag.mds,
+                                     frag.frag, mds,
                                      (int)r, frag.ndist);
-                                return mds;
+                                if (ceph_mdsmap_get_state(mdsc->mdsmap, mds) >=
+                                    CEPH_MDS_STATE_ACTIVE)
+                                        return mds;
                         }
 
                         /* since this file/dir wasn't known to be
@@ -708,7 +710,9 @@ static int __choose_mds(struct ceph_mds_client *mdsc,
                                 dout("choose_mds %p %llx.%llx "
                                      "frag %u mds%d (auth)\n",
                                      inode, ceph_vinop(inode), frag.frag, mds);
-                                return mds;
+                                if (ceph_mdsmap_get_state(mdsc->mdsmap, mds) >=
+                                    CEPH_MDS_STATE_ACTIVE)
+                                        return mds;
                         }
                 }
         }
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index bf6f0f34082a..9c5085465a63 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -290,6 +290,8 @@ static int parse_mount_options(struct ceph_mount_options **pfsopt,
 
         fsopt->rsize = CEPH_MOUNT_RSIZE_DEFAULT;
         fsopt->snapdir_name = kstrdup(CEPH_SNAPDIRNAME_DEFAULT, GFP_KERNEL);
+        fsopt->caps_wanted_delay_min = CEPH_CAPS_WANTED_DELAY_MIN_DEFAULT;
+        fsopt->caps_wanted_delay_max = CEPH_CAPS_WANTED_DELAY_MAX_DEFAULT;
         fsopt->cap_release_safety = CEPH_CAP_RELEASE_SAFETY_DEFAULT;
         fsopt->max_readdir = CEPH_MAX_READDIR_DEFAULT;
         fsopt->max_readdir_bytes = CEPH_MAX_READDIR_BYTES_DEFAULT;
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 6e12a6ba5f79..8c9eba6ef9df 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -219,6 +219,7 @@ static struct ceph_inode_xattr *__get_xattr(struct ceph_inode_info *ci,
         struct rb_node **p;
         struct rb_node *parent = NULL;
         struct ceph_inode_xattr *xattr = NULL;
+        int name_len = strlen(name);
         int c;
 
         p = &ci->i_xattrs.index.rb_node;
@@ -226,6 +227,8 @@ static struct ceph_inode_xattr *__get_xattr(struct ceph_inode_info *ci,
                 parent = *p;
                 xattr = rb_entry(parent, struct ceph_inode_xattr, node);
                 c = strncmp(name, xattr->name, xattr->name_len);
+                if (c == 0 && name_len > xattr->name_len)
+                        c = 1;
                 if (c < 0)
                         p = &(*p)->rb_left;
                 else if (c > 0)
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index ee45648b0d1a..7cb0f7f847e4 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -3,6 +3,7 @@ config CIFS
         depends on INET
         select NLS
         select CRYPTO
+        select CRYPTO_MD4
         select CRYPTO_MD5
         select CRYPTO_HMAC
         select CRYPTO_ARC4
diff --git a/fs/cifs/Makefile b/fs/cifs/Makefile
index 43b19dd39191..d87558448e3d 100644
--- a/fs/cifs/Makefile
+++ b/fs/cifs/Makefile
@@ -5,7 +5,7 @@ obj-$(CONFIG_CIFS) += cifs.o
 
 cifs-y := cifsfs.o cifssmb.o cifs_debug.o connect.o dir.o file.o inode.o \
           link.o misc.o netmisc.o smbdes.o smbencrypt.o transport.o asn1.o \
-          md4.o md5.o cifs_unicode.o nterr.o xattr.o cifsencrypt.o \
+          cifs_unicode.o nterr.o xattr.o cifsencrypt.o \
           readdir.o ioctl.o sess.o export.o
 
 cifs-$(CONFIG_CIFS_ACL) += cifsacl.o
diff --git a/fs/cifs/README b/fs/cifs/README
index 46af99ab3614..fe1683590828 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -452,6 +452,11 @@ A partial list of the supported mount options follows:
                 if oplock (caching token) is granted and held. Note that
                 direct allows write operations larger than page size
                 to be sent to the server.
+  strictcache   Use for switching on strict cache mode. In this mode the
+                client read from the cache all the time it has Oplock Level II,
+                otherwise - read from the server. All written data are stored
+                in the cache, but if the client doesn't have Exclusive Oplock,
+                it writes the data to the server.
   acl           Allow setfacl and getfacl to manage posix ACLs if server
                 supports them.  (default)
   noacl         Do not allow setfacl and getfacl calls on this mount
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index f1c68629f277..0a265ad9e426 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -282,8 +282,6 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
         cFYI(1, "in %s", __func__);
         BUG_ON(IS_ROOT(mntpt));
 
-        xid = GetXid();
-
         /*
          * The MSDFS spec states that paths in DFS referral requests and
          * responses must be prefixed by a single '\' character instead of
@@ -293,7 +291,7 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
         mnt = ERR_PTR(-ENOMEM);
         full_path = build_path_from_dentry(mntpt);
         if (full_path == NULL)
-                goto free_xid;
+                goto cdda_exit;
 
         cifs_sb = CIFS_SB(mntpt->d_inode->i_sb);
         tlink = cifs_sb_tlink(cifs_sb);
@@ -303,9 +301,11 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
         }
         ses = tlink_tcon(tlink)->ses;
 
+        xid = GetXid();
         rc = get_dfs_path(xid, ses, full_path + 1, cifs_sb->local_nls,
                 &num_referrals, &referrals,
                 cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
+        FreeXid(xid);
 
         cifs_put_tlink(tlink);
 
@@ -338,8 +338,7 @@ success:
         free_dfs_info_array(referrals, num_referrals);
 free_full_path:
         kfree(full_path);
-free_xid:
-        FreeXid(xid);
+cdda_exit:
         cFYI(1, "leaving %s" , __func__);
         return mnt;
 }
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 1e7636b145a8..beeebf194234 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -372,6 +372,10 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl,
 
                 ppace = kmalloc(num_aces * sizeof(struct cifs_ace *),
                                 GFP_KERNEL);
+                if (!ppace) {
+                        cERROR(1, "DACL memory allocation error");
+                        return;
+                }
 
                 for (i = 0; i < num_aces; ++i) {
                         ppace[i] = (struct cifs_ace *) (acl_base + acl_size);
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 66f3d50d0676..a51585f9852b 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -24,7 +24,6 @@
 #include "cifspdu.h"
 #include "cifsglob.h"
 #include "cifs_debug.h"
-#include "md5.h"
 #include "cifs_unicode.h"
 #include "cifsproto.h"
 #include "ntlmssp.h"
@@ -37,11 +36,6 @@
 /* Note that the smb header signature field on input contains the
         sequence number before this function is called */
 
-extern void mdfour(unsigned char *out, unsigned char *in, int n);
-extern void E_md4hash(const unsigned char *passwd, unsigned char *p16);
-extern void SMBencrypt(unsigned char *passwd, const unsigned char *c8,
-                       unsigned char *p24);
-
 static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu,
                                 struct TCP_Server_Info *server, char *signature)
 {
@@ -234,6 +228,7 @@ int cifs_verify_signature(struct smb_hdr *cifs_pdu,
 /* first calculate 24 bytes ntlm response and then 16 byte session key */
 int setup_ntlm_response(struct cifsSesInfo *ses)
 {
+        int rc = 0;
         unsigned int temp_len = CIFS_SESS_KEY_SIZE + CIFS_AUTH_RESP_SIZE;
         char temp_key[CIFS_SESS_KEY_SIZE];
 
@@ -247,13 +242,26 @@ int setup_ntlm_response(struct cifsSesInfo *ses)
         }
         ses->auth_key.len = temp_len;
 
-        SMBNTencrypt(ses->password, ses->server->cryptkey,
+        rc = SMBNTencrypt(ses->password, ses->server->cryptkey,
                         ses->auth_key.response + CIFS_SESS_KEY_SIZE);
+        if (rc) {
+                cFYI(1, "%s Can't generate NTLM response, error: %d",
+                        __func__, rc);
+                return rc;
+        }
 
-        E_md4hash(ses->password, temp_key);
-        mdfour(ses->auth_key.response, temp_key, CIFS_SESS_KEY_SIZE);
+        rc = E_md4hash(ses->password, temp_key);
+        if (rc) {
+                cFYI(1, "%s Can't generate NT hash, error: %d", __func__, rc);
+                return rc;
+        }
 
-        return 0;
+        rc = mdfour(ses->auth_key.response, temp_key, CIFS_SESS_KEY_SIZE);
+        if (rc)
+                cFYI(1, "%s Can't generate NTLM session key, error: %d",
+                        __func__, rc);
+
+        return rc;
 }
 
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
@@ -649,9 +657,10 @@ calc_seckey(struct cifsSesInfo *ses)
         get_random_bytes(sec_key, CIFS_SESS_KEY_SIZE);
 
         tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC);
-        if (!tfm_arc4 || IS_ERR(tfm_arc4)) {
+        if (IS_ERR(tfm_arc4)) {
+                rc = PTR_ERR(tfm_arc4);
                 cERROR(1, "could not allocate crypto API arc4\n");
-                return PTR_ERR(tfm_arc4);
+                return rc;
         }
 
         desc.tfm = tfm_arc4;
@@ -700,14 +709,13 @@ cifs_crypto_shash_allocate(struct TCP_Server_Info *server)
         unsigned int size;
 
         server->secmech.hmacmd5 = crypto_alloc_shash("hmac(md5)", 0, 0);
-        if (!server->secmech.hmacmd5 ||
-                        IS_ERR(server->secmech.hmacmd5)) {
+        if (IS_ERR(server->secmech.hmacmd5)) {
                 cERROR(1, "could not allocate crypto hmacmd5\n");
                 return PTR_ERR(server->secmech.hmacmd5);
         }
 
         server->secmech.md5 = crypto_alloc_shash("md5", 0, 0);
-        if (!server->secmech.md5 || IS_ERR(server->secmech.md5)) {
+        if (IS_ERR(server->secmech.md5)) {
                 cERROR(1, "could not allocate crypto md5\n");
                 rc = PTR_ERR(server->secmech.md5);
                 goto crypto_allocate_md5_fail;
diff --git a/fs/cifs/cifsencrypt.h b/fs/cifs/cifsencrypt.h
deleted file mode 100644
index 15d2ec006474..000000000000
--- a/fs/cifs/cifsencrypt.h
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- *   fs/cifs/cifsencrypt.h
- *
- *   Copyright (c) International Business Machines  Corp., 2005
- *   Author(s): Steve French (sfrench@us.ibm.com)
- *
- *   Externs for misc. small encryption routines
- *   so we do not have to put them in cifsproto.h
- *
- *   This library is free software; you can redistribute it and/or modify
- *   it under the terms of the GNU Lesser General Public License as published
- *   by the Free Software Foundation; either version 2.1 of the License, or
- *   (at your option) any later version.
- *
- *   This library is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
- *   the GNU Lesser General Public License for more details.
- *
- *   You should have received a copy of the GNU Lesser General Public License
- *   along with this library; if not, write to the Free Software
- *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- */
-
-/* md4.c */
-extern void mdfour(unsigned char *out, unsigned char *in, int n);
-/* smbdes.c */
-extern void E_P16(unsigned char *p14, unsigned char *p16);
-extern void E_P24(unsigned char *p21, const unsigned char *c8,
-                  unsigned char *p24);
-
-
-
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index a8323f1dc1c4..f2970136d17d 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -600,10 +600,17 @@ static ssize_t cifs_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
 {
         struct inode *inode = iocb->ki_filp->f_path.dentry->d_inode;
         ssize_t written;
+        int rc;
 
         written = generic_file_aio_write(iocb, iov, nr_segs, pos);
-        if (!CIFS_I(inode)->clientCanCacheAll)
-                filemap_fdatawrite(inode->i_mapping);
+
+        if (CIFS_I(inode)->clientCanCacheAll)
+                return written;
+
+        rc = filemap_fdatawrite(inode->i_mapping);
+        if (rc)
+                cFYI(1, "cifs_file_aio_write: %d rc on %p inode", rc, inode);
+
         return written;
 }
 
@@ -737,7 +744,7 @@ const struct file_operations cifs_file_strict_ops = {
         .read = do_sync_read,
         .write = do_sync_write,
         .aio_read = cifs_strict_readv,
-        .aio_write = cifs_file_aio_write,
+        .aio_write = cifs_strict_writev,
         .open = cifs_open,
         .release = cifs_close,
         .lock = cifs_lock,
@@ -793,7 +800,7 @@ const struct file_operations cifs_file_strict_nobrl_ops = {
         .read = do_sync_read,
         .write = do_sync_write,
         .aio_read = cifs_strict_readv,
-        .aio_write = cifs_file_aio_write,
+        .aio_write = cifs_strict_writev,
         .open = cifs_open,
         .release = cifs_close,
         .fsync = cifs_strict_fsync,
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index f23206d46531..4a3330235d55 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -85,7 +85,9 @@ extern ssize_t cifs_user_read(struct file *file, char __user *read_data,
 extern ssize_t cifs_strict_readv(struct kiocb *iocb, const struct iovec *iov,
                                  unsigned long nr_segs, loff_t pos);
 extern ssize_t cifs_user_write(struct file *file, const char __user *write_data,
-                         size_t write_size, loff_t *poffset);
+                               size_t write_size, loff_t *poffset);
+extern ssize_t cifs_strict_writev(struct kiocb *iocb, const struct iovec *iov,
+                                  unsigned long nr_segs, loff_t pos);
 extern int cifs_lock(struct file *, int, struct file_lock *);
 extern int cifs_fsync(struct file *, int);
 extern int cifs_strict_fsync(struct file *, int);
@@ -125,5 +127,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* EXPERIMENTAL */
 
-#define CIFS_VERSION   "1.69"
+#define CIFS_VERSION   "1.70"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 982895fa7615..8096f27ad9a8 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -85,6 +85,8 @@ extern int checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length);
 extern bool is_valid_oplock_break(struct smb_hdr *smb,
                                   struct TCP_Server_Info *);
 extern bool is_size_safe_to_change(struct cifsInodeInfo *, __u64 eof);
+extern void cifs_update_eof(struct cifsInodeInfo *cifsi, loff_t offset,
+                            unsigned int bytes_written);
 extern struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *, bool);
 extern struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *, bool);
 extern unsigned int smbCalcSize(struct smb_hdr *ptr);
@@ -373,7 +375,7 @@ extern int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *,
 extern int cifs_verify_signature(struct smb_hdr *,
                                  struct TCP_Server_Info *server,
                                 __u32 expected_sequence_number);
-extern void SMBNTencrypt(unsigned char *, unsigned char *, unsigned char *);
+extern int SMBNTencrypt(unsigned char *, unsigned char *, unsigned char *);
 extern int setup_ntlm_response(struct cifsSesInfo *);
 extern int setup_ntlmv2_rsp(struct cifsSesInfo *, const struct nls_table *);
 extern int cifs_crypto_shash_allocate(struct TCP_Server_Info *);
@@ -423,4 +425,11 @@ extern bool CIFSCouldBeMFSymlink(const struct cifs_fattr *fattr);
 extern int CIFSCheckMFSymlink(struct cifs_fattr *fattr,
                 const unsigned char *path,
                 struct cifs_sb_info *cifs_sb, int xid);
+extern int mdfour(unsigned char *, unsigned char *, int);
+extern int E_md4hash(const unsigned char *passwd, unsigned char *p16);
+extern void SMBencrypt(unsigned char *passwd, const unsigned char *c8,
+                        unsigned char *p24);
+extern void E_P16(unsigned char *p14, unsigned char *p16);
+extern void E_P24(unsigned char *p21, const unsigned char *c8,
+                        unsigned char *p24);
 #endif                  /* _CIFSPROTO_H */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 3106f5e5c633..904aa47e3515 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -136,9 +136,6 @@ cifs_reconnect_tcon(struct cifsTconInfo *tcon, int smb_command)
                 }
         }
 
-        if (ses->status == CifsExiting)
-                return -EIO;
-
         /*
          * Give demultiplex thread up to 10 seconds to reconnect, should be
          * greater than cifs socket timeout which is 7 seconds
@@ -156,7 +153,7 @@ cifs_reconnect_tcon(struct cifsTconInfo *tcon, int smb_command)
                  * retrying until process is killed or server comes
                  * back on-line
                  */
-                if (!tcon->retry || ses->status == CifsExiting) {
+                if (!tcon->retry) {
                         cFYI(1, "gave up waiting on reconnect in smb_init");
                         return -EHOSTDOWN;
                 }
@@ -4914,7 +4911,6 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
                    __u16 fid, __u32 pid_of_opener, bool SetAllocation)
 {
         struct smb_com_transaction2_sfi_req *pSMB  = NULL;
-        char *data_offset;
         struct file_end_of_file_info *parm_data;
         int rc = 0;
         __u16 params, param_offset, offset, byte_count, count;
@@ -4938,8 +4934,6 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
         param_offset = offsetof(struct smb_com_transaction2_sfi_req, Fid) - 4;
         offset = param_offset + params;
 
-        data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
-
         count = sizeof(struct file_end_of_file_info);
         pSMB->MaxParameterCount = cpu_to_le16(2);
         /* BB find exact max SMB PDU from sess structure BB */
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 0cc3b81c2e84..257b6d895e20 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -55,9 +55,6 @@
 /* SMB echo "timeout" -- FIXME: tunable? */
 #define SMB_ECHO_INTERVAL (60 * HZ)
 
-extern void SMBNTencrypt(unsigned char *passwd, unsigned char *c8,
-                         unsigned char *p24);
-
 extern mempool_t *cifs_req_poolp;
 
 struct smb_vol {
@@ -87,6 +84,7 @@ struct smb_vol {
         bool no_xattr:1;   /* set if xattr (EA) support should be disabled*/
         bool server_ino:1; /* use inode numbers from server ie UniqueId */
         bool direct_io:1;
+        bool strict_io:1; /* strict cache behavior */
         bool remap:1;      /* set to remap seven reserved chars in filenames */
         bool posix_paths:1; /* unset to not ask for posix pathnames. */
         bool no_linux_ext:1;
@@ -339,8 +337,12 @@ cifs_echo_request(struct work_struct *work)
         struct TCP_Server_Info *server = container_of(work,
                                         struct TCP_Server_Info, echo.work);
 
-        /* no need to ping if we got a response recently */
-        if (time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
+        /*
+         * We cannot send an echo until the NEGOTIATE_PROTOCOL request is done.
+         * Also, no need to ping if we got a response recently
+         */
+        if (server->tcpStatus != CifsGood ||
+            time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ))
                 goto requeue_echo;
 
         rc = CIFSSMBEcho(server);
@@ -580,12 +582,12 @@ incomplete_rcv:
                 else if (reconnect == 1)
                         continue;
 
-                length += 4; /* account for rfc1002 hdr */
-
+                total_read += 4; /* account for rfc1002 hdr */
 
-                dump_smb(smb_buffer, length);
-                if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
-                        cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
+                dump_smb(smb_buffer, total_read);
+                if (checkSMB(smb_buffer, smb_buffer->Mid, total_read)) {
+                        cifs_dump_mem("Bad SMB: ", smb_buffer,
+                                        total_read < 48 ? total_read : 48);
                         continue;
                 }
 
@@ -635,11 +637,11 @@ incomplete_rcv:
                                 mid_entry->largeBuf = isLargeBuf;
 multi_t2_fnd:
                                 mid_entry->midState = MID_RESPONSE_RECEIVED;
-                                list_del_init(&mid_entry->qhead);
-                                mid_entry->callback(mid_entry);
 #ifdef CONFIG_CIFS_STATS2
                                 mid_entry->when_received = jiffies;
 #endif
+                                list_del_init(&mid_entry->qhead);
+                                mid_entry->callback(mid_entry);
                                 break;
                         }
                         mid_entry = NULL;
@@ -1344,6 +1346,8 @@ cifs_parse_mount_options(char *options, const char *devname,
                         vol->direct_io = 1;
                 } else if (strnicmp(data, "forcedirectio", 13) == 0) {
                         vol->direct_io = 1;
+                } else if (strnicmp(data, "strictcache", 11) == 0) {
+                        vol->strict_io = 1;
                 } else if (strnicmp(data, "noac", 4) == 0) {
                         printk(KERN_WARNING "CIFS: Mount option noac not "
                                 "supported. Instead set "
@@ -2584,6 +2588,8 @@ static void setup_cifs_sb(struct smb_vol *pvolume_info,
         if (pvolume_info->multiuser)
                 cifs_sb->mnt_cifs_flags |= (CIFS_MOUNT_MULTIUSER |
                                             CIFS_MOUNT_NO_PERM);
+        if (pvolume_info->strict_io)
+                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_STRICT_IO;
         if (pvolume_info->direct_io) {
                 cFYI(1, "mounting share using direct i/o");
                 cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_DIRECT_IO;
@@ -2985,7 +2991,8 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                                          bcc_ptr);
                 else
 #endif /* CIFS_WEAK_PW_HASH */
-                SMBNTencrypt(tcon->password, ses->server->cryptkey, bcc_ptr);
+                rc = SMBNTencrypt(tcon->password, ses->server->cryptkey,
+                                        bcc_ptr);
 
                 bcc_ptr += CIFS_AUTH_RESP_SIZE;
                 if (ses->capabilities & CAP_UNICODE) {
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index d7d65a70678e..e964b1cd5dd0 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -346,7 +346,6 @@ int cifs_open(struct inode *inode, struct file *file)
         struct cifsTconInfo *tcon;
         struct tcon_link *tlink;
         struct cifsFileInfo *pCifsFile = NULL;
-        struct cifsInodeInfo *pCifsInode;
         char *full_path = NULL;
         bool posix_open_ok = false;
         __u16 netfid;
@@ -361,8 +360,6 @@ int cifs_open(struct inode *inode, struct file *file)
         }
         tcon = tlink_tcon(tlink);
 
-        pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
-
         full_path = build_path_from_dentry(file->f_path.dentry);
         if (full_path == NULL) {
                 rc = -ENOMEM;
@@ -848,7 +845,7 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
 }
 
 /* update the file size (if needed) after a write */
-static void
+void
 cifs_update_eof(struct cifsInodeInfo *cifsi, loff_t offset,
                       unsigned int bytes_written)
 {
@@ -1146,7 +1143,6 @@ static int cifs_partialpagewrite(struct page *page, unsigned from, unsigned to)
         char *write_data;
         int rc = -EFAULT;
         int bytes_written = 0;
-        struct cifs_sb_info *cifs_sb;
         struct inode *inode;
         struct cifsFileInfo *open_file;
 
@@ -1154,7 +1150,6 @@ static int cifs_partialpagewrite(struct page *page, unsigned from, unsigned to)
                 return -EFAULT;
 
         inode = page->mapping->host;
-        cifs_sb = CIFS_SB(inode->i_sb);
 
         offset += (loff_t)from;
         write_data = kmap(page);
@@ -1619,13 +1614,215 @@ int cifs_flush(struct file *file, fl_owner_t id)
         return rc;
 }
 
+static int
+cifs_write_allocate_pages(struct page **pages, unsigned long num_pages)
+{
+        int rc = 0;
+        unsigned long i;
+
+        for (i = 0; i < num_pages; i++) {
+                pages[i] = alloc_page(__GFP_HIGHMEM);
+                if (!pages[i]) {
+                        /*
+                         * save number of pages we have already allocated and
+                         * return with ENOMEM error
+                         */
+                        num_pages = i;
+                        rc = -ENOMEM;
+                        goto error;
+                }
+        }
+
+        return rc;
+
+error:
+        for (i = 0; i < num_pages; i++)
+                put_page(pages[i]);
+        return rc;
+}
+
+static inline
+size_t get_numpages(const size_t wsize, const size_t len, size_t *cur_len)
+{
+        size_t num_pages;
+        size_t clen;
+
+        clen = min_t(const size_t, len, wsize);
+        num_pages = clen / PAGE_CACHE_SIZE;
+        if (clen % PAGE_CACHE_SIZE)
+                num_pages++;
+
+        if (cur_len)
+                *cur_len = clen;
+
+        return num_pages;
+}
+
+static ssize_t
+cifs_iovec_write(struct file *file, const struct iovec *iov,
+                 unsigned long nr_segs, loff_t *poffset)
+{
+        unsigned int written;
+        unsigned long num_pages, npages, i;
+        size_t copied, len, cur_len;
+        ssize_t total_written = 0;
+        struct kvec *to_send;
+        struct page **pages;
+        struct iov_iter it;
+        struct inode *inode;
+        struct cifsFileInfo *open_file;
+        struct cifsTconInfo *pTcon;
+        struct cifs_sb_info *cifs_sb;
+        int xid, rc;
+
+        len = iov_length(iov, nr_segs);
+        if (!len)
+                return 0;
+
+        rc = generic_write_checks(file, poffset, &len, 0);
+        if (rc)
+                return rc;
+
+        cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
+        num_pages = get_numpages(cifs_sb->wsize, len, &cur_len);
+
+        pages = kmalloc(sizeof(struct pages *)*num_pages, GFP_KERNEL);
+        if (!pages)
+                return -ENOMEM;
+
+        to_send = kmalloc(sizeof(struct kvec)*(num_pages + 1), GFP_KERNEL);
+        if (!to_send) {
+                kfree(pages);
+                return -ENOMEM;
+        }
+
+        rc = cifs_write_allocate_pages(pages, num_pages);
+        if (rc) {
+                kfree(pages);
+                kfree(to_send);
+                return rc;
+        }
+
+        xid = GetXid();
+        open_file = file->private_data;
+        pTcon = tlink_tcon(open_file->tlink);
+        inode = file->f_path.dentry->d_inode;
+
+        iov_iter_init(&it, iov, nr_segs, len, 0);
+        npages = num_pages;
+
+        do {
+                size_t save_len = cur_len;
+                for (i = 0; i < npages; i++) {
+                        copied = min_t(const size_t, cur_len, PAGE_CACHE_SIZE);
+                        copied = iov_iter_copy_from_user(pages[i], &it, 0,
+                                                         copied);
+                        cur_len -= copied;
+                        iov_iter_advance(&it, copied);
+                        to_send[i+1].iov_base = kmap(pages[i]);
+                        to_send[i+1].iov_len = copied;
+                }
+
+                cur_len = save_len - cur_len;
+
+                do {
+                        if (open_file->invalidHandle) {
+                                rc = cifs_reopen_file(open_file, false);
+                                if (rc != 0)
+                                        break;
+                        }
+                        rc = CIFSSMBWrite2(xid, pTcon, open_file->netfid,
+                                           cur_len, *poffset, &written,
+                                           to_send, npages, 0);
+                } while (rc == -EAGAIN);
+
+                for (i = 0; i < npages; i++)
+                        kunmap(pages[i]);
+
+                if (written) {
+                        len -= written;
+                        total_written += written;
+                        cifs_update_eof(CIFS_I(inode), *poffset, written);
+                        *poffset += written;
+                } else if (rc < 0) {
+                        if (!total_written)
+                                total_written = rc;
+                        break;
+                }
+
+                /* get length and number of kvecs of the next write */
+                npages = get_numpages(cifs_sb->wsize, len, &cur_len);
+        } while (len > 0);
+
+        if (total_written > 0) {
+                spin_lock(&inode->i_lock);
+                if (*poffset > inode->i_size)
+                        i_size_write(inode, *poffset);
+                spin_unlock(&inode->i_lock);
+        }
+
+        cifs_stats_bytes_written(pTcon, total_written);
+        mark_inode_dirty_sync(inode);
+
+        for (i = 0; i < num_pages; i++)
+                put_page(pages[i]);
+        kfree(to_send);
+        kfree(pages);
+        FreeXid(xid);
+        return total_written;
+}
+
+static ssize_t cifs_user_writev(struct kiocb *iocb, const struct iovec *iov,
+                                unsigned long nr_segs, loff_t pos)
+{
+        ssize_t written;
+        struct inode *inode;
+
+        inode = iocb->ki_filp->f_path.dentry->d_inode;
+
+        /*
+         * BB - optimize the way when signing is disabled. We can drop this
+         * extra memory-to-memory copying and use iovec buffers for constructing
+         * write request.
+         */
+
+        written = cifs_iovec_write(iocb->ki_filp, iov, nr_segs, &pos);
+        if (written > 0) {
+                CIFS_I(inode)->invalid_mapping = true;
+                iocb->ki_pos = pos;
+        }
+
+        return written;
+}
+
+ssize_t cifs_strict_writev(struct kiocb *iocb, const struct iovec *iov,
+                           unsigned long nr_segs, loff_t pos)
+{
+        struct inode *inode;
+
+        inode = iocb->ki_filp->f_path.dentry->d_inode;
+
+        if (CIFS_I(inode)->clientCanCacheAll)
+                return generic_file_aio_write(iocb, iov, nr_segs, pos);
+
+        /*
+         * In strict cache mode we need to write the data to the server exactly
+         * from the pos to pos+len-1 rather than flush all affected pages
+         * because it may cause a error with mandatory locks on these pages but
+         * not on the region from pos to ppos+len-1.
+         */
+
+        return cifs_user_writev(iocb, iov, nr_segs, pos);
+}
+
 static ssize_t
 cifs_iovec_read(struct file *file, const struct iovec *iov,
                  unsigned long nr_segs, loff_t *poffset)
 {
         int rc;
         int xid;
-        unsigned int total_read, bytes_read = 0;
+        ssize_t total_read;
+        unsigned int bytes_read = 0;
         size_t len, cur_len;
         int iov_offset = 0;
         struct cifs_sb_info *cifs_sb;
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 306769de2fb5..e8804d373404 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -28,7 +28,6 @@
 #include "cifsproto.h"
 #include "cifs_debug.h"
 #include "cifs_fs_sb.h"
-#include "md5.h"
 
 #define CIFS_MF_SYMLINK_LEN_OFFSET (4+1)
 #define CIFS_MF_SYMLINK_MD5_OFFSET (CIFS_MF_SYMLINK_LEN_OFFSET+(4+1))
@@ -47,6 +46,45 @@
         md5_hash[12], md5_hash[13], md5_hash[14], md5_hash[15]
 
 static int
+symlink_hash(unsigned int link_len, const char *link_str, u8 *md5_hash)
+{
+        int rc;
+        unsigned int size;
+        struct crypto_shash *md5;
+        struct sdesc *sdescmd5;
+
+        md5 = crypto_alloc_shash("md5", 0, 0);
+        if (IS_ERR(md5)) {
+                rc = PTR_ERR(md5);
+                cERROR(1, "%s: Crypto md5 allocation error %d\n", __func__, rc);
+                return rc;
+        }
+        size = sizeof(struct shash_desc) + crypto_shash_descsize(md5);
+        sdescmd5 = kmalloc(size, GFP_KERNEL);
+        if (!sdescmd5) {
+                rc = -ENOMEM;
+                cERROR(1, "%s: Memory allocation failure\n", __func__);
+                goto symlink_hash_err;
+        }
+        sdescmd5->shash.tfm = md5;
+        sdescmd5->shash.flags = 0x0;
+
+        rc = crypto_shash_init(&sdescmd5->shash);
+        if (rc) {
+                cERROR(1, "%s: Could not init md5 shash\n", __func__);
+                goto symlink_hash_err;
+        }
+        crypto_shash_update(&sdescmd5->shash, link_str, link_len);
+        rc = crypto_shash_final(&sdescmd5->shash, md5_hash);
+
+symlink_hash_err:
+        crypto_free_shash(md5);
+        kfree(sdescmd5);
+
+        return rc;
+}
+
+static int
 CIFSParseMFSymlink(const u8 *buf,
                    unsigned int buf_len,
                    unsigned int *_link_len,
@@ -56,7 +94,6 @@ CIFSParseMFSymlink(const u8 *buf,
         unsigned int link_len;
         const char *md5_str1;
         const char *link_str;
-        struct MD5Context md5_ctx;
         u8 md5_hash[16];
         char md5_str2[34];
 
@@ -70,9 +107,11 @@ CIFSParseMFSymlink(const u8 *buf,
         if (rc != 1)
                 return -EINVAL;
 
-        cifs_MD5_init(&md5_ctx);
-        cifs_MD5_update(&md5_ctx, (const u8 *)link_str, link_len);
-        cifs_MD5_final(md5_hash, &md5_ctx);
+        rc = symlink_hash(link_len, link_str, md5_hash);
+        if (rc) {
+                cFYI(1, "%s: MD5 hash failure: %d\n", __func__, rc);
+                return rc;
+        }
 
         snprintf(md5_str2, sizeof(md5_str2),
                  CIFS_MF_SYMLINK_MD5_FORMAT,
@@ -94,9 +133,9 @@ CIFSParseMFSymlink(const u8 *buf,
 static int
 CIFSFormatMFSymlink(u8 *buf, unsigned int buf_len, const char *link_str)
 {
+        int rc;
         unsigned int link_len;
         unsigned int ofs;
-        struct MD5Context md5_ctx;
         u8 md5_hash[16];
 
         if (buf_len != CIFS_MF_SYMLINK_FILE_SIZE)
@@ -107,9 +146,11 @@ CIFSFormatMFSymlink(u8 *buf, unsigned int buf_len, const char *link_str)
         if (link_len > CIFS_MF_SYMLINK_LINK_MAXLEN)
                 return -ENAMETOOLONG;
 
-        cifs_MD5_init(&md5_ctx);
-        cifs_MD5_update(&md5_ctx, (const u8 *)link_str, link_len);
-        cifs_MD5_final(md5_hash, &md5_ctx);
+        rc = symlink_hash(link_len, link_str, md5_hash);
+        if (rc) {
+                cFYI(1, "%s: MD5 hash failure: %d\n", __func__, rc);
+                return rc;
+        }
 
         snprintf(buf, buf_len,
                  CIFS_MF_SYMLINK_LEN_FORMAT CIFS_MF_SYMLINK_MD5_FORMAT,
diff --git a/fs/cifs/md4.c b/fs/cifs/md4.c
deleted file mode 100644
index a725c2609d67..000000000000
--- a/fs/cifs/md4.c
+++ /dev/null
@@ -1,205 +0,0 @@
-/*
-   Unix SMB/Netbios implementation.
-   Version 1.9.
-   a implementation of MD4 designed for use in the SMB authentication protocol
-   Copyright (C) Andrew Tridgell 1997-1998.
-   Modified by Steve French (sfrench@us.ibm.com) 2002-2003
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-#include <linux/module.h>
-#include <linux/fs.h>
-#include "cifsencrypt.h"
-
-/* NOTE: This code makes no attempt to be fast! */
-
-static __u32
-F(__u32 X, __u32 Y, __u32 Z)
-{
-        return (X & Y) | ((~X) & Z);
-}
-
-static __u32
-G(__u32 X, __u32 Y, __u32 Z)
-{
-        return (X & Y) | (X & Z) | (Y & Z);
-}
-
-static __u32
-H(__u32 X, __u32 Y, __u32 Z)
-{
-        return X ^ Y ^ Z;
-}
-
-static __u32
-lshift(__u32 x, int s)
-{
-        x &= 0xFFFFFFFF;
-        return ((x << s) & 0xFFFFFFFF) | (x >> (32 - s));
-}
-
-#define ROUND1(a,b,c,d,k,s) (*a) = lshift((*a) + F(*b,*c,*d) + X[k], s)
-#define ROUND2(a,b,c,d,k,s) (*a) = lshift((*a) + G(*b,*c,*d) + X[k] + (__u32)0x5A827999,s)
-#define ROUND3(a,b,c,d,k,s) (*a) = lshift((*a) + H(*b,*c,*d) + X[k] + (__u32)0x6ED9EBA1,s)
-
-/* this applies md4 to 64 byte chunks */
-static void
-mdfour64(__u32 *M, __u32 *A, __u32 *B, __u32 *C, __u32 *D)
-{
-        int j;
-        __u32 AA, BB, CC, DD;
-        __u32 X[16];
-
-
-        for (j = 0; j < 16; j++)
-                X[j] = M[j];
-
-        AA = *A;
-        BB = *B;
-        CC = *C;
-        DD = *D;
-
-        ROUND1(A, B, C, D, 0, 3);
-        ROUND1(D, A, B, C, 1, 7);
-        ROUND1(C, D, A, B, 2, 11);
-        ROUND1(B, C, D, A, 3, 19);
-        ROUND1(A, B, C, D, 4, 3);
-        ROUND1(D, A, B, C, 5, 7);
-        ROUND1(C, D, A, B, 6, 11);
-        ROUND1(B, C, D, A, 7, 19);
-        ROUND1(A, B, C, D, 8, 3);
-        ROUND1(D, A, B, C, 9, 7);
-        ROUND1(C, D, A, B, 10, 11);
-        ROUND1(B, C, D, A, 11, 19);
-        ROUND1(A, B, C, D, 12, 3);
-        ROUND1(D, A, B, C, 13, 7);
-        ROUND1(C, D, A, B, 14, 11);
-        ROUND1(B, C, D, A, 15, 19);
-
-        ROUND2(A, B, C, D, 0, 3);
-        ROUND2(D, A, B, C, 4, 5);
-        ROUND2(C, D, A, B, 8, 9);
-        ROUND2(B, C, D, A, 12, 13);
-        ROUND2(A, B, C, D, 1, 3);
-        ROUND2(D, A, B, C, 5, 5);
-        ROUND2(C, D, A, B, 9, 9);
-        ROUND2(B, C, D, A, 13, 13);
-        ROUND2(A, B, C, D, 2, 3);
-        ROUND2(D, A, B, C, 6, 5);
-        ROUND2(C, D, A, B, 10, 9);
-        ROUND2(B, C, D, A, 14, 13);
-        ROUND2(A, B, C, D, 3, 3);
-        ROUND2(D, A, B, C, 7, 5);
-        ROUND2(C, D, A, B, 11, 9);
-        ROUND2(B, C, D, A, 15, 13);
-
-        ROUND3(A, B, C, D, 0, 3);
-        ROUND3(D, A, B, C, 8, 9);
-        ROUND3(C, D, A, B, 4, 11);
-        ROUND3(B, C, D, A, 12, 15);
-        ROUND3(A, B, C, D, 2, 3);
-        ROUND3(D, A, B, C, 10, 9);
-        ROUND3(C, D, A, B, 6, 11);
-        ROUND3(B, C, D, A, 14, 15);
-        ROUND3(A, B, C, D, 1, 3);
-        ROUND3(D, A, B, C, 9, 9);
-        ROUND3(C, D, A, B, 5, 11);
-        ROUND3(B, C, D, A, 13, 15);
-        ROUND3(A, B, C, D, 3, 3);
-        ROUND3(D, A, B, C, 11, 9);
-        ROUND3(C, D, A, B, 7, 11);
-        ROUND3(B, C, D, A, 15, 15);
-
-        *A += AA;
-        *B += BB;
-        *C += CC;
-        *D += DD;
-
-        *A &= 0xFFFFFFFF;
-        *B &= 0xFFFFFFFF;
-        *C &= 0xFFFFFFFF;
-        *D &= 0xFFFFFFFF;
-
-        for (j = 0; j < 16; j++)
-                X[j] = 0;
-}
-
-static void
-copy64(__u32 *M, unsigned char *in)
-{
-        int i;
-
-        for (i = 0; i < 16; i++)
-                M[i] = (in[i * 4 + 3] << 24) | (in[i * 4 + 2] << 16) |
-                    (in[i * 4 + 1] << 8) | (in[i * 4 + 0] << 0);
-}
-
-static void
-copy4(unsigned char *out, __u32 x)
-{
-        out[0] = x & 0xFF;
-        out[1] = (x >> 8) & 0xFF;
-        out[2] = (x >> 16) & 0xFF;
-        out[3] = (x >> 24) & 0xFF;
-}
-
-/* produce a md4 message digest from data of length n bytes */
-void
-mdfour(unsigned char *out, unsigned char *in, int n)
-{
-        unsigned char buf[128];
-        __u32 M[16];
-        __u32 b = n * 8;
-        int i;
-        __u32 A = 0x67452301;
-        __u32 B = 0xefcdab89;
-        __u32 C = 0x98badcfe;
-        __u32 D = 0x10325476;
-
-        while (n > 64) {
-                copy64(M, in);
-                mdfour64(M, &A, &B, &C, &D);
-                in += 64;
-                n -= 64;
-        }
-
-        for (i = 0; i < 128; i++)
-                buf[i] = 0;
-        memcpy(buf, in, n);
-        buf[n] = 0x80;
-
-        if (n <= 55) {
-                copy4(buf + 56, b);
-                copy64(M, buf);
-                mdfour64(M, &A, &B, &C, &D);
-        } else {
-                copy4(buf + 120, b);
-                copy64(M, buf);
-                mdfour64(M, &A, &B, &C, &D);
-                copy64(M, buf + 64);
-                mdfour64(M, &A, &B, &C, &D);
-        }
-
-        for (i = 0; i < 128; i++)
-                buf[i] = 0;
-        copy64(M, buf);
-
-        copy4(out, A);
-        copy4(out + 4, B);
-        copy4(out + 8, C);
-        copy4(out + 12, D);
-
-        A = B = C = D = 0;
-}
diff --git a/fs/cifs/md5.c b/fs/cifs/md5.c
deleted file mode 100644
index 98b66a54c319..000000000000
--- a/fs/cifs/md5.c
+++ /dev/null
@@ -1,366 +0,0 @@
-/*
- * This code implements the MD5 message-digest algorithm.
- * The algorithm is due to Ron Rivest.  This code was
- * written by Colin Plumb in 1993, no copyright is claimed.
- * This code is in the public domain; do with it what you wish.
- *
- * Equivalent code is available from RSA Data Security, Inc.
- * This code has been tested against that, and is equivalent,
- * except that you don't need to include two pages of legalese
- * with every copy.
- *
- * To compute the message digest of a chunk of bytes, declare an
- * MD5Context structure, pass it to cifs_MD5_init, call cifs_MD5_update as
- * needed on buffers full of bytes, and then call cifs_MD5_final, which
- * will fill a supplied 16-byte array with the digest.
- */
-
-/* This code slightly modified to fit into Samba by
-   abartlet@samba.org Jun 2001
-   and to fit the cifs vfs by
-   Steve French sfrench@us.ibm.com */
-
-#include <linux/string.h>
-#include "md5.h"
-
-static void MD5Transform(__u32 buf[4], __u32 const in[16]);
-
-/*
- * Note: this code is harmless on little-endian machines.
- */
-static void
-byteReverse(unsigned char *buf, unsigned longs)
-{
-        __u32 t;
-        do {
-                t = (__u32) ((unsigned) buf[3] << 8 | buf[2]) << 16 |
-                    ((unsigned) buf[1] << 8 | buf[0]);
-                *(__u32 *) buf = t;
-                buf += 4;
-        } while (--longs);
-}
-
-/*
- * Start MD5 accumulation.  Set bit count to 0 and buffer to mysterious
- * initialization constants.
- */
-void
-cifs_MD5_init(struct MD5Context *ctx)
-{
-        ctx->buf[0] = 0x67452301;
-        ctx->buf[1] = 0xefcdab89;
-        ctx->buf[2] = 0x98badcfe;
-        ctx->buf[3] = 0x10325476;
-
-        ctx->bits[0] = 0;
-        ctx->bits[1] = 0;
-}
-
-/*
- * Update context to reflect the concatenation of another buffer full
- * of bytes.
- */
-void
-cifs_MD5_update(struct MD5Context *ctx, unsigned char const *buf, unsigned len)
-{
-        register __u32 t;
-
-        /* Update bitcount */
-
-        t = ctx->bits[0];
-        if ((ctx->bits[0] = t + ((__u32) len << 3)) < t)
-                ctx->bits[1]++; /* Carry from low to high */
-        ctx->bits[1] += len >> 29;
-
-        t = (t >> 3) & 0x3f;    /* Bytes already in shsInfo->data */
-
-        /* Handle any leading odd-sized chunks */
-
-        if (t) {
-                unsigned char *p = (unsigned char *) ctx->in + t;
-
-                t = 64 - t;
-                if (len < t) {
-                        memmove(p, buf, len);
-                        return;
-                }
-                memmove(p, buf, t);
-                byteReverse(ctx->in, 16);
-                MD5Transform(ctx->buf, (__u32 *) ctx->in);
-                buf += t;
-                len -= t;
-        }
-        /* Process data in 64-byte chunks */
-
-        while (len >= 64) {
-                memmove(ctx->in, buf, 64);
-                byteReverse(ctx->in, 16);
-                MD5Transform(ctx->buf, (__u32 *) ctx->in);
-                buf += 64;
-                len -= 64;
-        }
-
-        /* Handle any remaining bytes of data. */
-
-        memmove(ctx->in, buf, len);
-}
-
-/*
- * Final wrapup - pad to 64-byte boundary with the bit pattern
- * 1 0* (64-bit count of bits processed, MSB-first)
- */
-void
-cifs_MD5_final(unsigned char digest[16], struct MD5Context *ctx)
-{
-        unsigned int count;
-        unsigned char *p;
-
-        /* Compute number of bytes mod 64 */
-        count = (ctx->bits[0] >> 3) & 0x3F;
-
-        /* Set the first char of padding to 0x80.  This is safe since there is
-           always at least one byte free */
-        p = ctx->in + count;
-        *p++ = 0x80;
-
-        /* Bytes of padding needed to make 64 bytes */
-        count = 64 - 1 - count;
-
-        /* Pad out to 56 mod 64 */
-        if (count < 8) {
-                /* Two lots of padding:  Pad the first block to 64 bytes */
-                memset(p, 0, count);
-                byteReverse(ctx->in, 16);
-                MD5Transform(ctx->buf, (__u32 *) ctx->in);
-
-                /* Now fill the next block with 56 bytes */
-                memset(ctx->in, 0, 56);
-        } else {
-                /* Pad block to 56 bytes */
-                memset(p, 0, count - 8);
-        }
-        byteReverse(ctx->in, 14);
-
-        /* Append length in bits and transform */
-        ((__u32 *) ctx->in)[14] = ctx->bits[0];
-        ((__u32 *) ctx->in)[15] = ctx->bits[1];
-
-        MD5Transform(ctx->buf, (__u32 *) ctx->in);
-        byteReverse((unsigned char *) ctx->buf, 4);
-        memmove(digest, ctx->buf, 16);
-        memset(ctx, 0, sizeof(*ctx));   /* In case it's sensitive */
-}
-
-/* The four core functions - F1 is optimized somewhat */
-
-/* #define F1(x, y, z) (x & y | ~x & z) */
-#define F1(x, y, z) (z ^ (x & (y ^ z)))
-#define F2(x, y, z) F1(z, x, y)
-#define F3(x, y, z) (x ^ y ^ z)
-#define F4(x, y, z) (y ^ (x | ~z))
-
-/* This is the central step in the MD5 algorithm. */
-#define MD5STEP(f, w, x, y, z, data, s) \
-        (w += f(x, y, z) + data,  w = w<<s | w>>(32-s),  w += x)
-
-/*
- * The core of the MD5 algorithm, this alters an existing MD5 hash to
- * reflect the addition of 16 longwords of new data.  cifs_MD5_update blocks
- * the data and converts bytes into longwords for this routine.
- */
-static void
-MD5Transform(__u32 buf[4], __u32 const in[16])
-{
-        register __u32 a, b, c, d;
-
-        a = buf[0];
-        b = buf[1];
-        c = buf[2];
-        d = buf[3];
-
-        MD5STEP(F1, a, b, c, d, in[0] + 0xd76aa478, 7);
-        MD5STEP(F1, d, a, b, c, in[1] + 0xe8c7b756, 12);
-        MD5STEP(F1, c, d, a, b, in[2] + 0x242070db, 17);
-        MD5STEP(F1, b, c, d, a, in[3] + 0xc1bdceee, 22);
-        MD5STEP(F1, a, b, c, d, in[4] + 0xf57c0faf, 7);
-        MD5STEP(F1, d, a, b, c, in[5] + 0x4787c62a, 12);
-        MD5STEP(F1, c, d, a, b, in[6] + 0xa8304613, 17);
-        MD5STEP(F1, b, c, d, a, in[7] + 0xfd469501, 22);
-        MD5STEP(F1, a, b, c, d, in[8] + 0x698098d8, 7);
-        MD5STEP(F1, d, a, b, c, in[9] + 0x8b44f7af, 12);
-        MD5STEP(F1, c, d, a, b, in[10] + 0xffff5bb1, 17);
-        MD5STEP(F1, b, c, d, a, in[11] + 0x895cd7be, 22);
-        MD5STEP(F1, a, b, c, d, in[12] + 0x6b901122, 7);
-        MD5STEP(F1, d, a, b, c, in[13] + 0xfd987193, 12);
-        MD5STEP(F1, c, d, a, b, in[14] + 0xa679438e, 17);
-        MD5STEP(F1, b, c, d, a, in[15] + 0x49b40821, 22);
-
-        MD5STEP(F2, a, b, c, d, in[1] + 0xf61e2562, 5);
-        MD5STEP(F2, d, a, b, c, in[6] + 0xc040b340, 9);
-        MD5STEP(F2, c, d, a, b, in[11] + 0x265e5a51, 14);
-        MD5STEP(F2, b, c, d, a, in[0] + 0xe9b6c7aa, 20);
-        MD5STEP(F2, a, b, c, d, in[5] + 0xd62f105d, 5);
-        MD5STEP(F2, d, a, b, c, in[10] + 0x02441453, 9);
-        MD5STEP(F2, c, d, a, b, in[15] + 0xd8a1e681, 14);
-        MD5STEP(F2, b, c, d, a, in[4] + 0xe7d3fbc8, 20);
-        MD5STEP(F2, a, b, c, d, in[9] + 0x21e1cde6, 5);
-        MD5STEP(F2, d, a, b, c, in[14] + 0xc33707d6, 9);
-        MD5STEP(F2, c, d, a, b, in[3] + 0xf4d50d87, 14);
-        MD5STEP(F2, b, c, d, a, in[8] + 0x455a14ed, 20);
-        MD5STEP(F2, a, b, c, d, in[13] + 0xa9e3e905, 5);
-        MD5STEP(F2, d, a, b, c, in[2] + 0xfcefa3f8, 9);
-        MD5STEP(F2, c, d, a, b, in[7] + 0x676f02d9, 14);
-        MD5STEP(F2, b, c, d, a, in[12] + 0x8d2a4c8a, 20);
-
-        MD5STEP(F3, a, b, c, d, in[5] + 0xfffa3942, 4);
-        MD5STEP(F3, d, a, b, c, in[8] + 0x8771f681, 11);
-        MD5STEP(F3, c, d, a, b, in[11] + 0x6d9d6122, 16);
-        MD5STEP(F3, b, c, d, a, in[14] + 0xfde5380c, 23);
-        MD5STEP(F3, a, b, c, d, in[1] + 0xa4beea44, 4);
-        MD5STEP(F3, d, a, b, c, in[4] + 0x4bdecfa9, 11);
-        MD5STEP(F3, c, d, a, b, in[7] + 0xf6bb4b60, 16);
-        MD5STEP(F3, b, c, d, a, in[10] + 0xbebfbc70, 23);
-        MD5STEP(F3, a, b, c, d, in[13] + 0x289b7ec6, 4);
-        MD5STEP(F3, d, a, b, c, in[0] + 0xeaa127fa, 11);
-        MD5STEP(F3, c, d, a, b, in[3] + 0xd4ef3085, 16);
-        MD5STEP(F3, b, c, d, a, in[6] + 0x04881d05, 23);
-        MD5STEP(F3, a, b, c, d, in[9] + 0xd9d4d039, 4);
-        MD5STEP(F3, d, a, b, c, in[12] + 0xe6db99e5, 11);
-        MD5STEP(F3, c, d, a, b, in[15] + 0x1fa27cf8, 16);
-        MD5STEP(F3, b, c, d, a, in[2] + 0xc4ac5665, 23);
-
-        MD5STEP(F4, a, b, c, d, in[0] + 0xf4292244, 6);
-        MD5STEP(F4, d, a, b, c, in[7] + 0x432aff97, 10);
-        MD5STEP(F4, c, d, a, b, in[14] + 0xab9423a7, 15);
-        MD5STEP(F4, b, c, d, a, in[5] + 0xfc93a039, 21);
-        MD5STEP(F4, a, b, c, d, in[12] + 0x655b59c3, 6);
-        MD5STEP(F4, d, a, b, c, in[3] + 0x8f0ccc92, 10);
-        MD5STEP(F4, c, d, a, b, in[10] + 0xffeff47d, 15);
-        MD5STEP(F4, b, c, d, a, in[1] + 0x85845dd1, 21);
-        MD5STEP(F4, a, b, c, d, in[8] + 0x6fa87e4f, 6);
-        MD5STEP(F4, d, a, b, c, in[15] + 0xfe2ce6e0, 10);
-        MD5STEP(F4, c, d, a, b, in[6] + 0xa3014314, 15);
-        MD5STEP(F4, b, c, d, a, in[13] + 0x4e0811a1, 21);
-        MD5STEP(F4, a, b, c, d, in[4] + 0xf7537e82, 6);
-        MD5STEP(F4, d, a, b, c, in[11] + 0xbd3af235, 10);
-        MD5STEP(F4, c, d, a, b, in[2] + 0x2ad7d2bb, 15);
-        MD5STEP(F4, b, c, d, a, in[9] + 0xeb86d391, 21);
-
-        buf[0] += a;
-        buf[1] += b;
-        buf[2] += c;
-        buf[3] += d;
-}
-
-#if 0   /* currently unused */
-/***********************************************************************
- the rfc 2104 version of hmac_md5 initialisation.
-***********************************************************************/
-static void
-hmac_md5_init_rfc2104(unsigned char *key, int key_len,
-                      struct HMACMD5Context *ctx)
-{
-        int i;
-
-        /* if key is longer than 64 bytes reset it to key=MD5(key) */
-        if (key_len > 64) {
-                unsigned char tk[16];
-                struct MD5Context tctx;
-
-                cifs_MD5_init(&tctx);
-                cifs_MD5_update(&tctx, key, key_len);
-                cifs_MD5_final(tk, &tctx);
-
-                key = tk;
-                key_len = 16;
-        }
-
-        /* start out by storing key in pads */
-        memset(ctx->k_ipad, 0, sizeof(ctx->k_ipad));
-        memset(ctx->k_opad, 0, sizeof(ctx->k_opad));
-        memcpy(ctx->k_ipad, key, key_len);
-        memcpy(ctx->k_opad, key, key_len);
-
-        /* XOR key with ipad and opad values */
-        for (i = 0; i < 64; i++) {
-                ctx->k_ipad[i] ^= 0x36;
-                ctx->k_opad[i] ^= 0x5c;
-        }
-
-        cifs_MD5_init(&ctx->ctx);
-        cifs_MD5_update(&ctx->ctx, ctx->k_ipad, 64);
-}
-#endif
-
-/***********************************************************************
- the microsoft version of hmac_md5 initialisation.
-***********************************************************************/
-void
-hmac_md5_init_limK_to_64(const unsigned char *key, int key_len,
-                         struct HMACMD5Context *ctx)
-{
-        int i;
-
-        /* if key is longer than 64 bytes truncate it */
-        if (key_len > 64)
-                key_len = 64;
-
-        /* start out by storing key in pads */
-        memset(ctx->k_ipad, 0, sizeof(ctx->k_ipad));
-        memset(ctx->k_opad, 0, sizeof(ctx->k_opad));
-        memcpy(ctx->k_ipad, key, key_len);
-        memcpy(ctx->k_opad, key, key_len);
-
-        /* XOR key with ipad and opad values */
-        for (i = 0; i < 64; i++) {
-                ctx->k_ipad[i] ^= 0x36;
-                ctx->k_opad[i] ^= 0x5c;
-        }
-
-        cifs_MD5_init(&ctx->ctx);
-        cifs_MD5_update(&ctx->ctx, ctx->k_ipad, 64);
-}
-
-/***********************************************************************
- update hmac_md5 "inner" buffer
-***********************************************************************/
-void
-hmac_md5_update(const unsigned char *text, int text_len,
-                struct HMACMD5Context *ctx)
-{
-        cifs_MD5_update(&ctx->ctx, text, text_len);     /* then text of datagram */
-}
-
-/***********************************************************************
- finish off hmac_md5 "inner" buffer and generate outer one.
-***********************************************************************/
-void
-hmac_md5_final(unsigned char *digest, struct HMACMD5Context *ctx)
-{
-        struct MD5Context ctx_o;
-
-        cifs_MD5_final(digest, &ctx->ctx);
-
-        cifs_MD5_init(&ctx_o);
-        cifs_MD5_update(&ctx_o, ctx->k_opad, 64);
-        cifs_MD5_update(&ctx_o, digest, 16);
-        cifs_MD5_final(digest, &ctx_o);
-}
-
-/***********************************************************
- single function to calculate an HMAC MD5 digest from data.
- use the microsoft hmacmd5 init method because the key is 16 bytes.
-************************************************************/
-#if 0 /* currently unused */
-static void
-hmac_md5(unsigned char key[16], unsigned char *data, int data_len,
-         unsigned char *digest)
-{
-        struct HMACMD5Context ctx;
-        hmac_md5_init_limK_to_64(key, 16, &ctx);
-        if (data_len != 0)
-                hmac_md5_update(data, data_len, &ctx);
-
-        hmac_md5_final(digest, &ctx);
-}
-#endif
diff --git a/fs/cifs/md5.h b/fs/cifs/md5.h
deleted file mode 100644
index 6fba8cb402fd..000000000000
--- a/fs/cifs/md5.h
+++ /dev/null
@@ -1,38 +0,0 @@
-#ifndef MD5_H
-#define MD5_H
-#ifndef HEADER_MD5_H
-/* Try to avoid clashes with OpenSSL */
-#define HEADER_MD5_H
-#endif
-
-struct MD5Context {
-        __u32 buf[4];
-        __u32 bits[2];
-        unsigned char in[64];
-};
-#endif                          /* !MD5_H */
-
-#ifndef _HMAC_MD5_H
-struct HMACMD5Context {
-        struct MD5Context ctx;
-        unsigned char k_ipad[65];
-        unsigned char k_opad[65];
-};
-#endif                          /* _HMAC_MD5_H */
-
-void cifs_MD5_init(struct MD5Context *context);
-void cifs_MD5_update(struct MD5Context *context, unsigned char const *buf,
-                        unsigned len);
-void cifs_MD5_final(unsigned char digest[16], struct MD5Context *context);
-
-/* The following definitions come from lib/hmacmd5.c  */
-
-/* void hmac_md5_init_rfc2104(unsigned char *key, int key_len,
-                        struct HMACMD5Context *ctx);*/
-void hmac_md5_init_limK_to_64(const unsigned char *key, int key_len,
-                        struct HMACMD5Context *ctx);
-void hmac_md5_update(const unsigned char *text, int text_len,
-                        struct HMACMD5Context *ctx);
-void hmac_md5_final(unsigned char *digest, struct HMACMD5Context *ctx);
-/* void hmac_md5(unsigned char key[16], unsigned char *data, int data_len,
-                        unsigned char *digest);*/
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index a09e077ba925..2a930a752a78 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -236,10 +236,7 @@ __u16 GetNextMid(struct TCP_Server_Info *server)
 {
         __u16 mid = 0;
         __u16 last_mid;
-        int   collision;
-
-        if (server == NULL)
-                return mid;
+        bool collision;
 
         spin_lock(&GlobalMid_Lock);
         last_mid = server->CurrentMid; /* we do not want to loop forever */
@@ -252,24 +249,38 @@ __u16 GetNextMid(struct TCP_Server_Info *server)
         (and it would also have to have been a request that
          did not time out) */
         while (server->CurrentMid != last_mid) {
-                struct list_head *tmp;
                 struct mid_q_entry *mid_entry;
+                unsigned int num_mids;
 
-                collision = 0;
+                collision = false;
                 if (server->CurrentMid == 0)
                         server->CurrentMid++;
 
-                list_for_each(tmp, &server->pending_mid_q) {
-                        mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
-
-                        if ((mid_entry->mid == server->CurrentMid) &&
-                            (mid_entry->midState == MID_REQUEST_SUBMITTED)) {
+                num_mids = 0;
+                list_for_each_entry(mid_entry, &server->pending_mid_q, qhead) {
+                        ++num_mids;
+                        if (mid_entry->mid == server->CurrentMid &&
+                            mid_entry->midState == MID_REQUEST_SUBMITTED) {
                                 /* This mid is in use, try a different one */
-                                collision = 1;
+                                collision = true;
                                 break;
                         }
                 }
-                if (collision == 0) {
+
+                /*
+                 * if we have more than 32k mids in the list, then something
+                 * is very wrong. Possibly a local user is trying to DoS the
+                 * box by issuing long-running calls and SIGKILL'ing them. If
+                 * we get to 2^16 mids then we're in big trouble as this
+                 * function could loop forever.
+                 *
+                 * Go ahead and assign out the mid in this situation, but force
+                 * an eventual reconnect to clean out the pending_mid_q.
+                 */
+                if (num_mids > 32768)
+                        server->tcpStatus = CifsNeedReconnect;
+
+                if (!collision) {
                         mid = server->CurrentMid;
                         break;
                 }
@@ -381,29 +392,31 @@ header_assemble(struct smb_hdr *buffer, char smb_command /* command */ ,
 }
 
 static int
-checkSMBhdr(struct smb_hdr *smb, __u16 mid)
+check_smb_hdr(struct smb_hdr *smb, __u16 mid)
 {
-        /* Make sure that this really is an SMB, that it is a response,
-           and that the message ids match */
-        if ((*(__le32 *) smb->Protocol == cpu_to_le32(0x424d53ff)) &&
-                (mid == smb->Mid)) {
-                if (smb->Flags & SMBFLG_RESPONSE)
-                        return 0;
-                else {
-                /* only one valid case where server sends us request */
-                        if (smb->Command == SMB_COM_LOCKING_ANDX)
-                                return 0;
-                        else
-                                cERROR(1, "Received Request not response");
-                }
-        } else { /* bad signature or mid */
-                if (*(__le32 *) smb->Protocol != cpu_to_le32(0x424d53ff))
-                        cERROR(1, "Bad protocol string signature header %x",
-                                *(unsigned int *) smb->Protocol);
-                if (mid != smb->Mid)
-                        cERROR(1, "Mids do not match");
+        /* does it have the right SMB "signature" ? */
+        if (*(__le32 *) smb->Protocol != cpu_to_le32(0x424d53ff)) {
+                cERROR(1, "Bad protocol string signature header 0x%x",
+                        *(unsigned int *)smb->Protocol);
+                return 1;
+        }
+
+        /* Make sure that message ids match */
+        if (mid != smb->Mid) {
+                cERROR(1, "Mids do not match. received=%u expected=%u",
+                        smb->Mid, mid);
+                return 1;
         }
-        cERROR(1, "bad smb detected. The Mid=%d", smb->Mid);
+
+        /* if it's a response then accept */
+        if (smb->Flags & SMBFLG_RESPONSE)
+                return 0;
+
+        /* only one valid case where server sends us request */
+        if (smb->Command == SMB_COM_LOCKING_ANDX)
+                return 0;
+
+        cERROR(1, "Server sent request, not response. mid=%u", smb->Mid);
         return 1;
 }
 
@@ -448,7 +461,7 @@ checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length)
                 return 1;
         }
 
-        if (checkSMBhdr(smb, mid))
+        if (check_smb_hdr(smb, mid))
                 return 1;
         clc_len = smbCalcSize_LE(smb);
 
@@ -465,25 +478,26 @@ checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length)
                         if (((4 + len) & 0xFFFF) == (clc_len & 0xFFFF))
                                 return 0; /* bcc wrapped */
                 }
-                cFYI(1, "Calculated size %d vs length %d mismatch for mid %d",
+                cFYI(1, "Calculated size %u vs length %u mismatch for mid=%u",
                                 clc_len, 4 + len, smb->Mid);
-                /* Windows XP can return a few bytes too much, presumably
-                an illegal pad, at the end of byte range lock responses
-                so we allow for that three byte pad, as long as actual
-                received length is as long or longer than calculated length */
-                /* We have now had to extend this more, since there is a
-                case in which it needs to be bigger still to handle a
-                malformed response to transact2 findfirst from WinXP when
-                access denied is returned and thus bcc and wct are zero
-                but server says length is 0x21 bytes too long as if the server
-                forget to reset the smb rfc1001 length when it reset the
-                wct and bcc to minimum size and drop the t2 parms and data */
-                if ((4+len > clc_len) && (len <= clc_len + 512))
-                        return 0;
-                else {
-                        cERROR(1, "RFC1001 size %d bigger than SMB for Mid=%d",
+
+                if (4 + len < clc_len) {
+                        cERROR(1, "RFC1001 size %u smaller than SMB for mid=%u",
                                         len, smb->Mid);
                         return 1;
+                } else if (len > clc_len + 512) {
+                        /*
+                         * Some servers (Windows XP in particular) send more
+                         * data than the lengths in the SMB packet would
+                         * indicate on certain calls (byte range locks and
+                         * trans2 find first calls in particular). While the
+                         * client can handle such a frame by ignoring the
+                         * trailing data, we choose limit the amount of extra
+                         * data to 512 bytes.
+                         */
+                        cERROR(1, "RFC1001 size %u more than 512 bytes larger "
+                                  "than SMB for mid=%u", len, smb->Mid);
+                        return 1;
                 }
         }
         return 0;
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 7f25cc3d2256..f8e4cd2a7912 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -764,7 +764,6 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
 {
         int rc = 0;
         int xid, i;
-        struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
         struct cifsFileInfo *cifsFile = NULL;
         char *current_entry;
@@ -775,8 +774,6 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
 
         xid = GetXid();
 
-        cifs_sb = CIFS_SB(file->f_path.dentry->d_sb);
-
         /*
          * Ensure FindFirst doesn't fail before doing filldir() for '.' and
          * '..'. Otherwise we won't be able to notify VFS in case of failure.
diff --git a/fs/cifs/smbdes.c b/fs/cifs/smbdes.c
index b6b6dcb500bf..04721485925d 100644
--- a/fs/cifs/smbdes.c
+++ b/fs/cifs/smbdes.c
@@ -45,7 +45,6 @@
    up with a different answer to the one above)
 */
 #include <linux/slab.h>
-#include "cifsencrypt.h"
 #define uchar unsigned char
 
 static uchar perm1[56] = { 57, 49, 41, 33, 25, 17, 9,
diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index 192ea51af20f..b5041c849981 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -32,9 +32,8 @@
 #include "cifs_unicode.h"
 #include "cifspdu.h"
 #include "cifsglob.h"
-#include "md5.h"
 #include "cifs_debug.h"
-#include "cifsencrypt.h"
+#include "cifsproto.h"
 
 #ifndef false
 #define false 0
@@ -48,14 +47,58 @@
 #define SSVALX(buf,pos,val) (CVAL(buf,pos)=(val)&0xFF,CVAL(buf,pos+1)=(val)>>8)
 #define SSVAL(buf,pos,val) SSVALX((buf),(pos),((__u16)(val)))
 
-/*The following definitions come from  libsmb/smbencrypt.c  */
+/* produce a md4 message digest from data of length n bytes */
+int
+mdfour(unsigned char *md4_hash, unsigned char *link_str, int link_len)
+{
+        int rc;
+        unsigned int size;
+        struct crypto_shash *md4;
+        struct sdesc *sdescmd4;
+
+        md4 = crypto_alloc_shash("md4", 0, 0);
+        if (IS_ERR(md4)) {
+                rc = PTR_ERR(md4);
+                cERROR(1, "%s: Crypto md4 allocation error %d\n", __func__, rc);
+                return rc;
+        }
+        size = sizeof(struct shash_desc) + crypto_shash_descsize(md4);
+        sdescmd4 = kmalloc(size, GFP_KERNEL);
+        if (!sdescmd4) {
+                rc = -ENOMEM;
+                cERROR(1, "%s: Memory allocation failure\n", __func__);
+                goto mdfour_err;
+        }
+        sdescmd4->shash.tfm = md4;
+        sdescmd4->shash.flags = 0x0;
+
+        rc = crypto_shash_init(&sdescmd4->shash);
+        if (rc) {
+                cERROR(1, "%s: Could not init md4 shash\n", __func__);
+                goto mdfour_err;
+        }
+        crypto_shash_update(&sdescmd4->shash, link_str, link_len);
+        rc = crypto_shash_final(&sdescmd4->shash, md4_hash);
 
-void SMBencrypt(unsigned char *passwd, const unsigned char *c8,
-                unsigned char *p24);
-void E_md4hash(const unsigned char *passwd, unsigned char *p16);
-static void SMBOWFencrypt(unsigned char passwd[16], const unsigned char *c8,
-                   unsigned char p24[24]);
-void SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24);
+mdfour_err:
+        crypto_free_shash(md4);
+        kfree(sdescmd4);
+
+        return rc;
+}
+
+/* Does the des encryption from the NT or LM MD4 hash. */
+static void
+SMBOWFencrypt(unsigned char passwd[16], const unsigned char *c8,
+              unsigned char p24[24])
+{
+        unsigned char p21[21];
+
+        memset(p21, '\0', 21);
+
+        memcpy(p21, passwd, 16);
+        E_P24(p21, c8, p24);
+}
 
 /*
    This implements the X/Open SMB password encryption
@@ -118,9 +161,10 @@ _my_mbstowcs(__u16 *dst, const unsigned char *src, int len)
  * Creates the MD4 Hash of the users password in NT UNICODE.
  */
 
-void
+int
 E_md4hash(const unsigned char *passwd, unsigned char *p16)
 {
+        int rc;
         int len;
         __u16 wpwd[129];
 
@@ -139,8 +183,10 @@ E_md4hash(const unsigned char *passwd, unsigned char *p16)
         /* Calculate length in bytes */
         len = _my_wcslen(wpwd) * sizeof(__u16);
 
-        mdfour(p16, (unsigned char *) wpwd, len);
+        rc = mdfour(p16, (unsigned char *) wpwd, len);
         memset(wpwd, 0, 129 * 2);
+
+        return rc;
 }
 
 #if 0 /* currently unused */
@@ -212,19 +258,6 @@ ntv2_owf_gen(const unsigned char owf[16], const char *user_n,
 }
 #endif
 
-/* Does the des encryption from the NT or LM MD4 hash. */
-static void
-SMBOWFencrypt(unsigned char passwd[16], const unsigned char *c8,
-              unsigned char p24[24])
-{
-        unsigned char p21[21];
-
-        memset(p21, '\0', 21);
-
-        memcpy(p21, passwd, 16);
-        E_P24(p21, c8, p24);
-}
-
 /* Does the des encryption from the FIRST 8 BYTES of the NT or LM MD4 hash. */
 #if 0 /* currently unused */
 static void
@@ -242,16 +275,21 @@ NTLMSSPOWFencrypt(unsigned char passwd[8],
 #endif
 
 /* Does the NT MD4 hash then des encryption. */
-
-void
+int
 SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24)
 {
+        int rc;
         unsigned char p21[21];
 
         memset(p21, '\0', 21);
 
-        E_md4hash(passwd, p21);
+        rc = E_md4hash(passwd, p21);
+        if (rc) {
+                cFYI(1, "%s Can't generate NT hash, error: %d", __func__, rc);
+                return rc;
+        }
         SMBOWFencrypt(p21, c8, p24);
+        return rc;
 }
 
 
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index c1ccca1a933f..fbc5aace54b1 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -236,9 +236,9 @@ smb_sendv(struct TCP_Server_Info *server, struct kvec *iov, int n_vec)
                 server->tcpStatus = CifsNeedReconnect;
         }
 
-        if (rc < 0) {
+        if (rc < 0 && rc != -EINTR)
                 cERROR(1, "Error %d sending data on socket to server", rc);
-        } else
+        else
                 rc = 0;
 
         /* Don't want to modify the buffer as a
@@ -359,6 +359,10 @@ cifs_call_async(struct TCP_Server_Info *server, struct smb_hdr *in_buf,
         if (rc)
                 return rc;
 
+        /* enable signing if server requires it */
+        if (server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
+                in_buf->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
+
         mutex_lock(&server->srv_mutex);
         mid = AllocMidQEntry(in_buf, server);
         if (mid == NULL) {
@@ -570,17 +574,33 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
 #endif
 
         mutex_unlock(&ses->server->srv_mutex);
-        cifs_small_buf_release(in_buf);
 
-        if (rc < 0)
+        if (rc < 0) {
+                cifs_small_buf_release(in_buf);
                 goto out;
+        }
 
-        if (long_op == CIFS_ASYNC_OP)
+        if (long_op == CIFS_ASYNC_OP) {
+                cifs_small_buf_release(in_buf);
                 goto out;
+        }
 
         rc = wait_for_response(ses->server, midQ);
-        if (rc != 0)
-                goto out;
+        if (rc != 0) {
+                send_nt_cancel(ses->server, in_buf, midQ);
+                spin_lock(&GlobalMid_Lock);
+                if (midQ->midState == MID_REQUEST_SUBMITTED) {
+                        midQ->callback = DeleteMidQEntry;
+                        spin_unlock(&GlobalMid_Lock);
+                        cifs_small_buf_release(in_buf);
+                        atomic_dec(&ses->server->inFlight);
+                        wake_up(&ses->server->request_q);
+                        return rc;
+                }
+                spin_unlock(&GlobalMid_Lock);
+        }
+
+        cifs_small_buf_release(in_buf);
 
         rc = sync_mid_result(midQ, ses->server);
         if (rc != 0) {
@@ -724,8 +744,19 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
                 goto out;
 
         rc = wait_for_response(ses->server, midQ);
-        if (rc != 0)
-                goto out;
+        if (rc != 0) {
+                send_nt_cancel(ses->server, in_buf, midQ);
+                spin_lock(&GlobalMid_Lock);
+                if (midQ->midState == MID_REQUEST_SUBMITTED) {
+                        /* no longer considered to be "in-flight" */
+                        midQ->callback = DeleteMidQEntry;
+                        spin_unlock(&GlobalMid_Lock);
+                        atomic_dec(&ses->server->inFlight);
+                        wake_up(&ses->server->request_q);
+                        return rc;
+                }
+                spin_unlock(&GlobalMid_Lock);
+        }
 
         rc = sync_mid_result(midQ, ses->server);
         if (rc != 0) {
@@ -922,10 +953,21 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
                         }
                 }
 
-                if (wait_for_response(ses->server, midQ) == 0) {
-                        /* We got the response - restart system call. */
-                        rstart = 1;
+                rc = wait_for_response(ses->server, midQ);
+                if (rc) {
+                        send_nt_cancel(ses->server, in_buf, midQ);
+                        spin_lock(&GlobalMid_Lock);
+                        if (midQ->midState == MID_REQUEST_SUBMITTED) {
+                                /* no longer considered to be "in-flight" */
+                                midQ->callback = DeleteMidQEntry;
+                                spin_unlock(&GlobalMid_Lock);
+                                return rc;
+                        }
+                        spin_unlock(&GlobalMid_Lock);
                 }
+
+                /* We got the response - restart system call. */
+                rstart = 1;
         }
 
         rc = sync_mid_result(midQ, ses->server);
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index cc8a9b7d6064..267d0ada4541 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1114,6 +1114,17 @@ static int ep_send_events(struct eventpoll *ep,
         return ep_scan_ready_list(ep, ep_send_events_proc, &esed);
 }
 
+static inline struct timespec ep_set_mstimeout(long ms)
+{
+        struct timespec now, ts = {
+                .tv_sec = ms / MSEC_PER_SEC,
+                .tv_nsec = NSEC_PER_MSEC * (ms % MSEC_PER_SEC),
+        };
+
+        ktime_get_ts(&now);
+        return timespec_add_safe(now, ts);
+}
+
 static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
                    int maxevents, long timeout)
 {
@@ -1121,12 +1132,11 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
         unsigned long flags;
         long slack;
         wait_queue_t wait;
-        struct timespec end_time;
         ktime_t expires, *to = NULL;
 
         if (timeout > 0) {
-                ktime_get_ts(&end_time);
-                timespec_add_ns(&end_time, (u64)timeout * NSEC_PER_MSEC);
+                struct timespec end_time = ep_set_mstimeout(timeout);
+
                 slack = select_estimate_accuracy(&end_time);
                 to = &expires;
                 *to = timespec_to_ktime(end_time);
diff --git a/fs/exec.c b/fs/exec.c
index c62efcb959c7..52a447d9b6ab 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -120,7 +120,7 @@ SYSCALL_DEFINE1(uselib, const char __user *, library)
                 goto out;
 
         file = do_filp_open(AT_FDCWD, tmp,
-                                O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
+                                O_LARGEFILE | O_RDONLY | __FMODE_EXEC, 0,
                                 MAY_READ | MAY_EXEC | MAY_OPEN);
         putname(tmp);
         error = PTR_ERR(file);
@@ -723,7 +723,7 @@ struct file *open_exec(const char *name)
         int err;
 
         file = do_filp_open(AT_FDCWD, name,
-                                O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
+                                O_LARGEFILE | O_RDONLY | __FMODE_EXEC, 0,
                                 MAY_EXEC | MAY_OPEN);
         if (IS_ERR(file))
                 goto out;
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index 42685424817b..a7555238c41a 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -1030,7 +1030,6 @@ struct inode *exofs_iget(struct super_block *sb, unsigned long ino)
                 memcpy(oi->i_data, fcb.i_data, sizeof(fcb.i_data));
         }
 
-        inode->i_mapping->backing_dev_info = sb->s_bdi;
         if (S_ISREG(inode->i_mode)) {
                 inode->i_op = &exofs_file_inode_operations;
                 inode->i_fop = &exofs_file_operations;
@@ -1131,7 +1130,6 @@ struct inode *exofs_new_inode(struct inode *dir, int mode)
 
         sbi = sb->s_fs_info;
 
-        inode->i_mapping->backing_dev_info = sb->s_bdi;
         sb->s_dirt = 1;
         inode_init_owner(inode, dir, mode);
         inode->i_ino = sbi->s_nextid++;
diff --git a/fs/fcntl.c b/fs/fcntl.c
index ecc8b3954ed6..cb1026181bdc 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -815,7 +815,7 @@ static int __init fcntl_init(void)
                 __O_SYNC        | O_DSYNC       | FASYNC        |
                 O_DIRECT        | O_LARGEFILE   | O_DIRECTORY   |
                 O_NOFOLLOW      | O_NOATIME     | O_CLOEXEC     |
-                FMODE_EXEC
+                __FMODE_EXEC
                 ));
 
         fasync_cache = kmem_cache_create("fasync_cache",
diff --git a/fs/file_table.c b/fs/file_table.c
index c3e89adf53c0..eb36b6b17e26 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -125,13 +125,13 @@ struct file *get_empty_filp(void)
                 goto fail;
 
         percpu_counter_inc(&nr_files);
+        f->f_cred = get_cred(cred);
         if (security_file_alloc(f))
                 goto fail_sec;
 
         INIT_LIST_HEAD(&f->f_u.fu_list);
         atomic_long_set(&f->f_count, 1);
         rwlock_init(&f->f_owner.lock);
-        f->f_cred = get_cred(cred);
         spin_lock_init(&f->f_lock);
         eventpoll_init_file(f);
         /* f->f_version: 0 */
diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
index 52a0bcaa7b6d..b1991a2a08e0 100644
--- a/fs/hfsplus/extents.c
+++ b/fs/hfsplus/extents.c
@@ -397,8 +397,8 @@ int hfsplus_file_extend(struct inode *inode)
         u32 start, len, goal;
         int res;
 
-        if (sbi->total_blocks - sbi->free_blocks + 8 >
-                        sbi->alloc_file->i_size * 8) {
+        if (sbi->alloc_file->i_size * 8 <
+            sbi->total_blocks - sbi->free_blocks + 8) {
                 /* extend alloc file */
                 printk(KERN_ERR "hfs: extend alloc file! "
                                 "(%llu,%u,%u)\n",
diff --git a/fs/hfsplus/part_tbl.c b/fs/hfsplus/part_tbl.c
index d66ad113b1cc..40ad88c12c64 100644
--- a/fs/hfsplus/part_tbl.c
+++ b/fs/hfsplus/part_tbl.c
@@ -134,7 +134,7 @@ int hfs_part_find(struct super_block *sb,
         res = hfsplus_submit_bio(sb->s_bdev, *part_start + HFS_PMAP_BLK,
                                  data, READ);
         if (res)
-                return res;
+                goto out;
 
         switch (be16_to_cpu(*((__be16 *)data))) {
         case HFS_OLD_PMAP_MAGIC:
@@ -147,7 +147,7 @@ int hfs_part_find(struct super_block *sb,
                 res = -ENOENT;
                 break;
         }
-
+out:
         kfree(data);
         return res;
 }
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 9a3b4795f43c..b49b55584c84 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -338,20 +338,22 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         struct inode *root, *inode;
         struct qstr str;
         struct nls_table *nls = NULL;
-        int err = -EINVAL;
+        int err;
 
+        err = -EINVAL;
         sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
         if (!sbi)
-                return -ENOMEM;
+                goto out;
 
         sb->s_fs_info = sbi;
         mutex_init(&sbi->alloc_mutex);
         mutex_init(&sbi->vh_mutex);
         hfsplus_fill_defaults(sbi);
+
+        err = -EINVAL;
         if (!hfsplus_parse_options(data, sbi)) {
                 printk(KERN_ERR "hfs: unable to parse mount options\n");
-                err = -EINVAL;
-                goto cleanup;
+                goto out_unload_nls;
         }
 
         /* temporarily use utf8 to correctly find the hidden dir below */
@@ -359,16 +361,14 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         sbi->nls = load_nls("utf8");
         if (!sbi->nls) {
                 printk(KERN_ERR "hfs: unable to load nls for utf8\n");
-                err = -EINVAL;
-                goto cleanup;
+                goto out_unload_nls;
         }
 
         /* Grab the volume header */
         if (hfsplus_read_wrapper(sb)) {
                 if (!silent)
                         printk(KERN_WARNING "hfs: unable to find HFS+ superblock\n");
-                err = -EINVAL;
-                goto cleanup;
+                goto out_unload_nls;
         }
         vhdr = sbi->s_vhdr;
 
@@ -377,7 +377,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         if (be16_to_cpu(vhdr->version) < HFSPLUS_MIN_VERSION ||
             be16_to_cpu(vhdr->version) > HFSPLUS_CURRENT_VERSION) {
                 printk(KERN_ERR "hfs: wrong filesystem version\n");
-                goto cleanup;
+                goto out_free_vhdr;
         }
         sbi->total_blocks = be32_to_cpu(vhdr->total_blocks);
         sbi->free_blocks = be32_to_cpu(vhdr->free_blocks);
@@ -421,19 +421,19 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         sbi->ext_tree = hfs_btree_open(sb, HFSPLUS_EXT_CNID);
         if (!sbi->ext_tree) {
                 printk(KERN_ERR "hfs: failed to load extents file\n");
-                goto cleanup;
+                goto out_free_vhdr;
         }
         sbi->cat_tree = hfs_btree_open(sb, HFSPLUS_CAT_CNID);
         if (!sbi->cat_tree) {
                 printk(KERN_ERR "hfs: failed to load catalog file\n");
-                goto cleanup;
+                goto out_close_ext_tree;
         }
 
         inode = hfsplus_iget(sb, HFSPLUS_ALLOC_CNID);
         if (IS_ERR(inode)) {
                 printk(KERN_ERR "hfs: failed to load allocation file\n");
                 err = PTR_ERR(inode);
-                goto cleanup;
+                goto out_close_cat_tree;
         }
         sbi->alloc_file = inode;
 
@@ -442,14 +442,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         if (IS_ERR(root)) {
                 printk(KERN_ERR "hfs: failed to load root directory\n");
                 err = PTR_ERR(root);
-                goto cleanup;
-        }
-        sb->s_d_op = &hfsplus_dentry_operations;
-        sb->s_root = d_alloc_root(root);
-        if (!sb->s_root) {
-                iput(root);
-                err = -ENOMEM;
-                goto cleanup;
+                goto out_put_alloc_file;
         }
 
         str.len = sizeof(HFSP_HIDDENDIR_NAME) - 1;
@@ -459,46 +452,69 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         if (!hfs_brec_read(&fd, &entry, sizeof(entry))) {
                 hfs_find_exit(&fd);
                 if (entry.type != cpu_to_be16(HFSPLUS_FOLDER))
-                        goto cleanup;
+                        goto out_put_root;
                 inode = hfsplus_iget(sb, be32_to_cpu(entry.folder.id));
                 if (IS_ERR(inode)) {
                         err = PTR_ERR(inode);
-                        goto cleanup;
+                        goto out_put_root;
                 }
                 sbi->hidden_dir = inode;
         } else
                 hfs_find_exit(&fd);
 
-        if (sb->s_flags & MS_RDONLY)
-                goto out;
+        if (!(sb->s_flags & MS_RDONLY)) {
+                /*
+                 * H+LX == hfsplusutils, H+Lx == this driver, H+lx is unused
+                 * all three are registered with Apple for our use
+                 */
+                vhdr->last_mount_vers = cpu_to_be32(HFSP_MOUNT_VERSION);
+                vhdr->modify_date = hfsp_now2mt();
+                be32_add_cpu(&vhdr->write_count, 1);
+                vhdr->attributes &= cpu_to_be32(~HFSPLUS_VOL_UNMNT);
+                vhdr->attributes |= cpu_to_be32(HFSPLUS_VOL_INCNSTNT);
+                hfsplus_sync_fs(sb, 1);
 
-        /* H+LX == hfsplusutils, H+Lx == this driver, H+lx is unused
-         * all three are registered with Apple for our use
-         */
-        vhdr->last_mount_vers = cpu_to_be32(HFSP_MOUNT_VERSION);
-        vhdr->modify_date = hfsp_now2mt();
-        be32_add_cpu(&vhdr->write_count, 1);
-        vhdr->attributes &= cpu_to_be32(~HFSPLUS_VOL_UNMNT);
-        vhdr->attributes |= cpu_to_be32(HFSPLUS_VOL_INCNSTNT);
-        hfsplus_sync_fs(sb, 1);
-
-        if (!sbi->hidden_dir) {
-                mutex_lock(&sbi->vh_mutex);
-                sbi->hidden_dir = hfsplus_new_inode(sb, S_IFDIR);
-                hfsplus_create_cat(sbi->hidden_dir->i_ino, sb->s_root->d_inode,
-                                   &str, sbi->hidden_dir);
-                mutex_unlock(&sbi->vh_mutex);
-
-                hfsplus_mark_inode_dirty(sbi->hidden_dir, HFSPLUS_I_CAT_DIRTY);
+                if (!sbi->hidden_dir) {
+                        mutex_lock(&sbi->vh_mutex);
+                        sbi->hidden_dir = hfsplus_new_inode(sb, S_IFDIR);
+                        hfsplus_create_cat(sbi->hidden_dir->i_ino, root, &str,
+                                           sbi->hidden_dir);
+                        mutex_unlock(&sbi->vh_mutex);
+
+                        hfsplus_mark_inode_dirty(sbi->hidden_dir,
+                                                 HFSPLUS_I_CAT_DIRTY);
+                }
         }
-out:
+
+        sb->s_d_op = &hfsplus_dentry_operations;
+        sb->s_root = d_alloc_root(root);
+        if (!sb->s_root) {
+                err = -ENOMEM;
+                goto out_put_hidden_dir;
+        }
+
         unload_nls(sbi->nls);
         sbi->nls = nls;
         return 0;
 
-cleanup:
-        hfsplus_put_super(sb);
+out_put_hidden_dir:
+        iput(sbi->hidden_dir);
+out_put_root:
+        iput(sbi->alloc_file);
+out_put_alloc_file:
+        iput(sbi->alloc_file);
+out_close_cat_tree:
+        hfs_btree_close(sbi->cat_tree);
+out_close_ext_tree:
+        hfs_btree_close(sbi->ext_tree);
+out_free_vhdr:
+        kfree(sbi->s_vhdr);
+        kfree(sbi->s_backup_vhdr);
+out_unload_nls:
+        unload_nls(sbi->nls);
         unload_nls(nls);
+        kfree(sbi);
+out:
         return err;
 }
 
diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
index 196231794f64..3031d81f5f0f 100644
--- a/fs/hfsplus/wrapper.c
+++ b/fs/hfsplus/wrapper.c
@@ -167,7 +167,7 @@ reread:
                 break;
         case cpu_to_be16(HFSP_WRAP_MAGIC):
                 if (!hfsplus_read_mdb(sbi->s_vhdr, &wd))
-                        goto out;
+                        goto out_free_backup_vhdr;
                 wd.ablk_size >>= HFSPLUS_SECTOR_SHIFT;
                 part_start += wd.ablk_start + wd.embed_start * wd.ablk_size;
                 part_size = wd.embed_count * wd.ablk_size;
@@ -179,7 +179,7 @@ reread:
                  * (should do this only for cdrom/loop though)
                  */
                 if (hfs_part_find(sb, &part_start, &part_size))
-                        goto out;
+                        goto out_free_backup_vhdr;
                 goto reread;
         }
 
diff --git a/fs/ioctl.c b/fs/ioctl.c
index a59635e295fa..1eebeb72b202 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -273,6 +273,13 @@ int __generic_block_fiemap(struct inode *inode,
                 len = isize;
         }
 
+        /*
+         * Some filesystems can't deal with being asked to map less than
+         * blocksize, so make sure our len is at least block length.
+         */
+        if (logical_to_blk(inode, len) == 0)
+                len = blk_to_logical(inode, 1);
+
         start_blk = logical_to_blk(inode, start);
         last_blk = logical_to_blk(inode, start + len - 1);
 
diff --git a/fs/lockd/host.c b/fs/lockd/host.c
index 5f1bcb2f06f3..b7c99bfb3da6 100644
--- a/fs/lockd/host.c
+++ b/fs/lockd/host.c
@@ -520,7 +520,7 @@ static struct nlm_host *next_host_state(struct hlist_head *cache,
                                         struct nsm_handle *nsm,
                                         const struct nlm_reboot *info)
 {
-        struct nlm_host *host = NULL;
+        struct nlm_host *host;
         struct hlist_head *chain;
         struct hlist_node *pos;
 
@@ -532,12 +532,13 @@ static struct nlm_host *next_host_state(struct hlist_head *cache,
                         host->h_state++;
 
                         nlm_get_host(host);
-                        goto out;
+                        mutex_unlock(&nlm_host_mutex);
+                        return host;
                 }
         }
-out:
+
         mutex_unlock(&nlm_host_mutex);
-        return host;
+        return NULL;
 }
 
 /**
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 199016528fcb..e3d294269058 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -135,33 +135,6 @@ out_err:
 
 #if defined(CONFIG_NFS_V4_1)
 /*
- *  * CB_SEQUENCE operations will fail until the callback sessionid is set.
- *   */
-int nfs4_set_callback_sessionid(struct nfs_client *clp)
-{
-        struct svc_serv *serv = clp->cl_rpcclient->cl_xprt->bc_serv;
-        struct nfs4_sessionid *bc_sid;
-
-        if (!serv->sv_bc_xprt)
-                return -EINVAL;
-
-        /* on success freed in xprt_free */
-        bc_sid = kmalloc(sizeof(struct nfs4_sessionid), GFP_KERNEL);
-        if (!bc_sid)
-                return -ENOMEM;
-        memcpy(bc_sid->data, &clp->cl_session->sess_id.data,
-                NFS4_MAX_SESSIONID_LEN);
-        spin_lock_bh(&serv->sv_cb_lock);
-        serv->sv_bc_xprt->xpt_bc_sid = bc_sid;
-        spin_unlock_bh(&serv->sv_cb_lock);
-        dprintk("%s set xpt_bc_sid=%u:%u:%u:%u for sv_bc_xprt %p\n", __func__,
-                ((u32 *)bc_sid->data)[0], ((u32 *)bc_sid->data)[1],
-                ((u32 *)bc_sid->data)[2], ((u32 *)bc_sid->data)[3],
-                serv->sv_bc_xprt);
-        return 0;
-}
-
-/*
  * The callback service for NFSv4.1 callbacks
  */
 static int
@@ -266,10 +239,6 @@ static inline void nfs_callback_bc_serv(u32 minorversion, struct rpc_xprt *xprt,
                 struct nfs_callback_data *cb_info)
 {
 }
-int nfs4_set_callback_sessionid(struct nfs_client *clp)
-{
-        return 0;
-}
 #endif /* CONFIG_NFS_V4_1 */
 
 /*
@@ -359,78 +328,58 @@ void nfs_callback_down(int minorversion)
         mutex_unlock(&nfs_callback_mutex);
 }
 
-static int check_gss_callback_principal(struct nfs_client *clp,
-                                        struct svc_rqst *rqstp)
+/* Boolean check of RPC_AUTH_GSS principal */
+int
+check_gss_callback_principal(struct nfs_client *clp, struct svc_rqst *rqstp)
 {
         struct rpc_clnt *r = clp->cl_rpcclient;
         char *p = svc_gss_principal(rqstp);
 
+        if (rqstp->rq_authop->flavour != RPC_AUTH_GSS)
+                return 1;
+
         /* No RPC_AUTH_GSS on NFSv4.1 back channel yet */
         if (clp->cl_minorversion != 0)
-                return SVC_DROP;
+                return 0;
         /*
          * It might just be a normal user principal, in which case
          * userspace won't bother to tell us the name at all.
          */
         if (p == NULL)
-                return SVC_DENIED;
+                return 0;
 
         /* Expect a GSS_C_NT_HOSTBASED_NAME like "nfs@serverhostname" */
 
         if (memcmp(p, "nfs@", 4) != 0)
-                return SVC_DENIED;
+                return 0;
         p += 4;
         if (strcmp(p, r->cl_server) != 0)
-                return SVC_DENIED;
-        return SVC_OK;
+                return 0;
+        return 1;
 }
 
-/* pg_authenticate method helper */
-static struct nfs_client *nfs_cb_find_client(struct svc_rqst *rqstp)
-{
-        struct nfs4_sessionid *sessionid = bc_xprt_sid(rqstp);
-        int is_cb_compound = rqstp->rq_proc == CB_COMPOUND ? 1 : 0;
-
-        dprintk("--> %s rq_proc %d\n", __func__, rqstp->rq_proc);
-        if (svc_is_backchannel(rqstp))
-                /* Sessionid (usually) set after CB_NULL ping */
-                return nfs4_find_client_sessionid(svc_addr(rqstp), sessionid,
-                                                  is_cb_compound);
-        else
-                /* No callback identifier in pg_authenticate */
-                return nfs4_find_client_no_ident(svc_addr(rqstp));
-}
-
-/* pg_authenticate method for nfsv4 callback threads. */
+/*
+ * pg_authenticate method for nfsv4 callback threads.
+ *
+ * The authflavor has been negotiated, so an incorrect flavor is a server
+ * bug. Drop packets with incorrect authflavor.
+ *
+ * All other checking done after NFS decoding where the nfs_client can be
+ * found in nfs4_callback_compound
+ */
 static int nfs_callback_authenticate(struct svc_rqst *rqstp)
 {
-        struct nfs_client *clp;
-        RPC_IFDEBUG(char buf[RPC_MAX_ADDRBUFLEN]);
-        int ret = SVC_OK;
-
-        /* Don't talk to strangers */
-        clp = nfs_cb_find_client(rqstp);
-        if (clp == NULL)
-                return SVC_DROP;
-
-        dprintk("%s: %s NFSv4 callback!\n", __func__,
-                        svc_print_addr(rqstp, buf, sizeof(buf)));
-
         switch (rqstp->rq_authop->flavour) {
-                case RPC_AUTH_NULL:
-                        if (rqstp->rq_proc != CB_NULL)
-                                ret = SVC_DENIED;
-                        break;
-                case RPC_AUTH_UNIX:
-                        break;
-                case RPC_AUTH_GSS:
-                        ret = check_gss_callback_principal(clp, rqstp);
-                        break;
-                default:
-                        ret = SVC_DENIED;
+        case RPC_AUTH_NULL:
+                if (rqstp->rq_proc != CB_NULL)
+                        return SVC_DROP;
+                break;
+        case RPC_AUTH_GSS:
+                /* No RPC_AUTH_GSS support yet in NFSv4.1 */
+                 if (svc_is_backchannel(rqstp))
+                        return SVC_DROP;
         }
-        nfs_put_client(clp);
-        return ret;
+        return SVC_OK;
 }
 
 /*
diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h
index d3b44f9bd747..46d93ce7311b 100644
--- a/fs/nfs/callback.h
+++ b/fs/nfs/callback.h
@@ -7,6 +7,7 @@
  */
 #ifndef __LINUX_FS_NFS_CALLBACK_H
 #define __LINUX_FS_NFS_CALLBACK_H
+#include <linux/sunrpc/svc.h>
 
 #define NFS4_CALLBACK 0x40000000
 #define NFS4_CALLBACK_XDRSIZE 2048
@@ -37,7 +38,6 @@ enum nfs4_callback_opnum {
 struct cb_process_state {
         __be32                  drc_status;
         struct nfs_client       *clp;
-        struct nfs4_sessionid   *svc_sid; /* v4.1 callback service sessionid */
 };
 
 struct cb_compound_hdr_arg {
@@ -168,7 +168,7 @@ extern unsigned nfs4_callback_layoutrecall(
 extern void nfs4_check_drain_bc_complete(struct nfs4_session *ses);
 extern void nfs4_cb_take_slot(struct nfs_client *clp);
 #endif /* CONFIG_NFS_V4_1 */
-
+extern int check_gss_callback_principal(struct nfs_client *, struct svc_rqst *);
 extern __be32 nfs4_callback_getattr(struct cb_getattrargs *args,
                                     struct cb_getattrres *res,
                                     struct cb_process_state *cps);
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index 4bb91cb2620d..89587573fe50 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -373,17 +373,11 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
 {
         struct nfs_client *clp;
         int i;
-        __be32 status;
+        __be32 status = htonl(NFS4ERR_BADSESSION);
 
         cps->clp = NULL;
 
-        status = htonl(NFS4ERR_BADSESSION);
-        /* Incoming session must match the callback session */
-        if (memcmp(&args->csa_sessionid, cps->svc_sid, NFS4_MAX_SESSIONID_LEN))
-                goto out;
-
-        clp = nfs4_find_client_sessionid(args->csa_addr,
-                                         &args->csa_sessionid, 1);
+        clp = nfs4_find_client_sessionid(args->csa_addr, &args->csa_sessionid);
         if (clp == NULL)
                 goto out;
 
@@ -414,9 +408,9 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
         res->csr_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;
         res->csr_target_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;
         nfs4_cb_take_slot(clp);
-        cps->clp = clp; /* put in nfs4_callback_compound */
 
 out:
+        cps->clp = clp; /* put in nfs4_callback_compound */
         for (i = 0; i < args->csa_nrclists; i++)
                 kfree(args->csa_rclists[i].rcl_refcalls);
         kfree(args->csa_rclists);
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 23112c263f81..14e0f9371d14 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -794,10 +794,9 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
 
         if (hdr_arg.minorversion == 0) {
                 cps.clp = nfs4_find_client_ident(hdr_arg.cb_ident);
-                if (!cps.clp)
+                if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
                         return rpc_drop_reply;
-        } else
-                cps.svc_sid = bc_xprt_sid(rqstp);
+        }
 
         hdr_res.taglen = hdr_arg.taglen;
         hdr_res.tag = hdr_arg.tag;
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 192f2f860265..bd3ca32879e7 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -1206,16 +1206,11 @@ nfs4_find_client_ident(int cb_ident)
  * For CB_COMPOUND calls, find a client by IP address, protocol version,
  * minorversion, and sessionID
  *
- * CREATE_SESSION triggers a CB_NULL ping from servers. The callback service
- * sessionid can only be set after the CREATE_SESSION return, so a CB_NULL
- * can arrive before the callback sessionid is set. For CB_NULL calls,
- * find a client by IP address protocol version, and minorversion.
- *
  * Returns NULL if no such client
  */
 struct nfs_client *
 nfs4_find_client_sessionid(const struct sockaddr *addr,
-                           struct nfs4_sessionid *sid, int is_cb_compound)
+                           struct nfs4_sessionid *sid)
 {
         struct nfs_client *clp;
 
@@ -1227,9 +1222,9 @@ nfs4_find_client_sessionid(const struct sockaddr *addr,
                 if (!nfs4_has_session(clp))
                         continue;
 
-                /* Match sessionid unless cb_null call*/
-                if (is_cb_compound && (memcmp(clp->cl_session->sess_id.data,
-                    sid->data, NFS4_MAX_SESSIONID_LEN) != 0))
+                /* Match sessionid*/
+                if (memcmp(clp->cl_session->sess_id.data,
+                    sid->data, NFS4_MAX_SESSIONID_LEN) != 0)
                         continue;
 
                 atomic_inc(&clp->cl_count);
@@ -1244,7 +1239,7 @@ nfs4_find_client_sessionid(const struct sockaddr *addr,
 
 struct nfs_client *
 nfs4_find_client_sessionid(const struct sockaddr *addr,
-                           struct nfs4_sessionid *sid, int is_cb_compound)
+                           struct nfs4_sessionid *sid)
 {
         return NULL;
 }
diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
index 364e4328f392..bbbc6bf5cb2e 100644
--- a/fs/nfs/delegation.c
+++ b/fs/nfs/delegation.c
@@ -23,8 +23,6 @@
 
 static void nfs_do_free_delegation(struct nfs_delegation *delegation)
 {
-        if (delegation->cred)
-                put_rpccred(delegation->cred);
         kfree(delegation);
 }
 
@@ -37,6 +35,10 @@ static void nfs_free_delegation_callback(struct rcu_head *head)
 
 static void nfs_free_delegation(struct nfs_delegation *delegation)
 {
+        if (delegation->cred) {
+                put_rpccred(delegation->cred);
+                delegation->cred = NULL;
+        }
         call_rcu(&delegation->rcu, nfs_free_delegation_callback);
 }
 
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index e6ace0d93c71..9943a75bb6d1 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -407,15 +407,18 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
                 pos += vec->iov_len;
         }
 
+        /*
+         * If no bytes were started, return the error, and let the
+         * generic layer handle the completion.
+         */
+        if (requested_bytes == 0) {
+                nfs_direct_req_release(dreq);
+                return result < 0 ? result : -EIO;
+        }
+
         if (put_dreq(dreq))
                 nfs_direct_complete(dreq);
-
-        if (requested_bytes != 0)
-                return 0;
-
-        if (result < 0)
-                return result;
-        return -EIO;
+        return 0;
 }
 
 static ssize_t nfs_direct_read(struct kiocb *iocb, const struct iovec *iov,
@@ -841,15 +844,18 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
                 pos += vec->iov_len;
         }
 
+        /*
+         * If no bytes were started, return the error, and let the
+         * generic layer handle the completion.
+         */
+        if (requested_bytes == 0) {
+                nfs_direct_req_release(dreq);
+                return result < 0 ? result : -EIO;
+        }
+
         if (put_dreq(dreq))
                 nfs_direct_write_complete(dreq, dreq->inode);
-
-        if (requested_bytes != 0)
-                return 0;
-
-        if (result < 0)
-                return result;
-        return -EIO;
+        return 0;
 }
 
 static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index d8512423ba72..1cc600e77bb4 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -881,9 +881,10 @@ out:
         return ret;
 }
 
-static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+static unsigned long nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 {
         struct nfs_inode *nfsi = NFS_I(inode);
+        unsigned long ret = 0;
 
         if ((fattr->valid & NFS_ATTR_FATTR_PRECHANGE)
                         && (fattr->valid & NFS_ATTR_FATTR_CHANGE)
@@ -891,25 +892,32 @@ static void nfs_wcc_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                 nfsi->change_attr = fattr->change_attr;
                 if (S_ISDIR(inode->i_mode))
                         nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                ret |= NFS_INO_INVALID_ATTR;
         }
         /* If we have atomic WCC data, we may update some attributes */
         if ((fattr->valid & NFS_ATTR_FATTR_PRECTIME)
                         && (fattr->valid & NFS_ATTR_FATTR_CTIME)
-                        && timespec_equal(&inode->i_ctime, &fattr->pre_ctime))
-                        memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+                        && timespec_equal(&inode->i_ctime, &fattr->pre_ctime)) {
+                memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
+                ret |= NFS_INO_INVALID_ATTR;
+        }
 
         if ((fattr->valid & NFS_ATTR_FATTR_PREMTIME)
                         && (fattr->valid & NFS_ATTR_FATTR_MTIME)
                         && timespec_equal(&inode->i_mtime, &fattr->pre_mtime)) {
-                        memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
-                        if (S_ISDIR(inode->i_mode))
-                                nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
+                if (S_ISDIR(inode->i_mode))
+                        nfsi->cache_validity |= NFS_INO_INVALID_DATA;
+                ret |= NFS_INO_INVALID_ATTR;
         }
         if ((fattr->valid & NFS_ATTR_FATTR_PRESIZE)
                         && (fattr->valid & NFS_ATTR_FATTR_SIZE)
                         && i_size_read(inode) == nfs_size_to_loff_t(fattr->pre_size)
-                        && nfsi->npages == 0)
-                        i_size_write(inode, nfs_size_to_loff_t(fattr->size));
+                        && nfsi->npages == 0) {
+                i_size_write(inode, nfs_size_to_loff_t(fattr->size));
+                ret |= NFS_INO_INVALID_ATTR;
+        }
+        return ret;
 }
 
 /**
@@ -1223,7 +1231,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
                         | NFS_INO_REVAL_PAGECACHE);
 
         /* Do atomic weak cache consistency updates */
-        nfs_wcc_update_inode(inode, fattr);
+        invalid |= nfs_wcc_update_inode(inode, fattr);
 
         /* More cache consistency checks */
         if (fattr->valid & NFS_ATTR_FATTR_CHANGE) {
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 4644f04b4b46..cf9fdbdabc67 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -133,8 +133,7 @@ extern void nfs_put_client(struct nfs_client *);
 extern struct nfs_client *nfs4_find_client_no_ident(const struct sockaddr *);
 extern struct nfs_client *nfs4_find_client_ident(int);
 extern struct nfs_client *
-nfs4_find_client_sessionid(const struct sockaddr *, struct nfs4_sessionid *,
-                           int);
+nfs4_find_client_sessionid(const struct sockaddr *, struct nfs4_sessionid *);
 extern struct nfs_server *nfs_create_server(
                                         const struct nfs_parsed_mount_data *,
                                         struct nfs_fh *);
diff --git a/fs/nfs/nfs3acl.c b/fs/nfs/nfs3acl.c
index 9f88c5f4c7e2..274342771655 100644
--- a/fs/nfs/nfs3acl.c
+++ b/fs/nfs/nfs3acl.c
@@ -311,8 +311,8 @@ static int nfs3_proc_setacls(struct inode *inode, struct posix_acl *acl,
         if (!nfs_server_capable(inode, NFS_CAP_ACLS))
                 goto out;
 
-        /* We are doing this here, because XDR marshalling can only
-           return -ENOMEM. */
+        /* We are doing this here because XDR marshalling does not
+         * return any results, it BUGs. */
         status = -ENOSPC;
         if (acl != NULL && acl->a_count > NFS_ACL_MAX_ENTRIES)
                 goto out;
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 01c5e8b1941d..183c6b123d0f 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -1328,10 +1328,13 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req,
 
         encode_nfs_fh3(xdr, NFS_FH(args->inode));
         encode_uint32(xdr, args->mask);
+
+        base = req->rq_slen;
         if (args->npages != 0)
                 xdr_write_pages(xdr, args->pages, 0, args->len);
+        else
+                xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
 
-        base = req->rq_slen;
         error = nfsacl_encode(xdr->buf, base, args->inode,
                             (args->mask & NFS_ACL) ?
                             args->acl_access : NULL, 1, 0);
diff --git a/fs/nfs/nfs4filelayoutdev.c b/fs/nfs/nfs4filelayoutdev.c
index 51fe64ace55a..f5c9b125e8cc 100644
--- a/fs/nfs/nfs4filelayoutdev.c
+++ b/fs/nfs/nfs4filelayoutdev.c
@@ -214,7 +214,7 @@ decode_and_add_ds(__be32 **pp, struct inode *inode)
 
         /* ipv6 length plus port is legal */
         if (rlen > INET6_ADDRSTRLEN + 8) {
-                dprintk("%s Invalid address, length %d\n", __func__,
+                dprintk("%s: Invalid address, length %d\n", __func__,
                         rlen);
                 goto out_err;
         }
@@ -225,6 +225,11 @@ decode_and_add_ds(__be32 **pp, struct inode *inode)
         /* replace the port dots with dashes for the in4_pton() delimiter*/
         for (i = 0; i < 2; i++) {
                 char *res = strrchr(buf, '.');
+                if (!res) {
+                        dprintk("%s: Failed finding expected dots in port\n",
+                                __func__);
+                        goto out_free;
+                }
                 *res = '-';
         }
 
@@ -240,7 +245,7 @@ decode_and_add_ds(__be32 **pp, struct inode *inode)
         port = htons((tmp[0] << 8) | (tmp[1]));
 
         ds = nfs4_pnfs_ds_add(inode, ip_addr, port);
-        dprintk("%s Decoded address and port %s\n", __func__, buf);
+        dprintk("%s: Decoded address and port %s\n", __func__, buf);
 out_free:
         kfree(buf);
 out_err:
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 9d992b0346e3..78936a8f40ab 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -50,6 +50,7 @@
 #include <linux/module.h>
 #include <linux/sunrpc/bc_xprt.h>
 #include <linux/xattr.h>
+#include <linux/utsname.h>
 
 #include "nfs4_fs.h"
 #include "delegation.h"
@@ -4572,27 +4573,16 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
         *p = htonl((u32)clp->cl_boot_time.tv_nsec);
         args.verifier = &verifier;
 
-        while (1) {
-                args.id_len = scnprintf(args.id, sizeof(args.id),
-                                        "%s/%s %u",
-                                        clp->cl_ipaddr,
-                                        rpc_peeraddr2str(clp->cl_rpcclient,
-                                                         RPC_DISPLAY_ADDR),
-                                        clp->cl_id_uniquifier);
-
-                status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
-
-                if (status != -NFS4ERR_CLID_INUSE)
-                        break;
-
-                if (signalled())
-                        break;
-
-                if (++clp->cl_id_uniquifier == 0)
-                        break;
-        }
+        args.id_len = scnprintf(args.id, sizeof(args.id),
+                                "%s/%s.%s/%u",
+                                clp->cl_ipaddr,
+                                init_utsname()->nodename,
+                                init_utsname()->domainname,
+                                clp->cl_rpcclient->cl_auth->au_flavor);
 
-        status = nfs4_check_cl_exchange_flags(clp->cl_exchange_flags);
+        status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
+        if (!status)
+                status = nfs4_check_cl_exchange_flags(clp->cl_exchange_flags);
         dprintk("<-- %s status= %d\n", __func__, status);
         return status;
 }
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 2336d532cf66..e6742b57a04c 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -232,12 +232,6 @@ int nfs41_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
         status = nfs4_proc_create_session(clp);
         if (status != 0)
                 goto out;
-        status = nfs4_set_callback_sessionid(clp);
-        if (status != 0) {
-                printk(KERN_WARNING "Sessionid not set. No callback service\n");
-                nfs_callback_down(1);
-                status = 0;
-        }
         nfs41_setup_state_renewal(clp);
         nfs_mark_client_ready(clp, NFS_CS_READY);
 out:
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 2ab8e5cb8f59..4e2c168b6ee9 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -6086,11 +6086,11 @@ int nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
         __be32 *p = xdr_inline_decode(xdr, 4);
         if (unlikely(!p))
                 goto out_overflow;
-        if (!ntohl(*p++)) {
+        if (*p == xdr_zero) {
                 p = xdr_inline_decode(xdr, 4);
                 if (unlikely(!p))
                         goto out_overflow;
-                if (!ntohl(*p++))
+                if (*p == xdr_zero)
                         return -EAGAIN;
                 entry->eof = 1;
                 return -EBADCOOKIE;
@@ -6101,7 +6101,7 @@ int nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
                 goto out_overflow;
         entry->prev_cookie = entry->cookie;
         p = xdr_decode_hyper(p, &entry->cookie);
-        entry->len = ntohl(*p++);
+        entry->len = be32_to_cpup(p);
 
         p = xdr_inline_decode(xdr, entry->len);
         if (unlikely(!p))
@@ -6132,9 +6132,6 @@ int nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
         if (entry->fattr->valid & NFS_ATTR_FATTR_TYPE)
                 entry->d_type = nfs_umode_to_dtype(entry->fattr->mode);
 
-        if (verify_attr_len(xdr, p, len) < 0)
-                goto out_overflow;
-
         return 0;
 
 out_overflow:
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index bc4089769735..1b1bc1a0fb0a 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -951,7 +951,7 @@ pnfs_put_deviceid_cache(struct nfs_client *clp)
 {
         struct pnfs_deviceid_cache *local = clp->cl_devid_cache;
 
-        dprintk("--> %s cl_devid_cache %p\n", __func__, clp->cl_devid_cache);
+        dprintk("--> %s ({%d})\n", __func__, atomic_read(&local->dc_ref));
         if (atomic_dec_and_lock(&local->dc_ref, &clp->cl_lock)) {
                 int i;
                 /* Verify cache is empty */
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 10d648ea128b..c8278f4046cb 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -932,7 +932,7 @@ out_bad:
         while (!list_empty(&list)) {
                 data = list_entry(list.next, struct nfs_write_data, pages);
                 list_del(&data->pages);
-                nfs_writedata_release(data);
+                nfs_writedata_free(data);
         }
         nfs_redirty_request(req);
         return -ENOMEM;
diff --git a/fs/nfs_common/nfsacl.c b/fs/nfs_common/nfsacl.c
index fc1c52571c03..84c27d69d421 100644
--- a/fs/nfs_common/nfsacl.c
+++ b/fs/nfs_common/nfsacl.c
@@ -42,6 +42,11 @@ struct nfsacl_encode_desc {
         gid_t gid;
 };
 
+struct nfsacl_simple_acl {
+        struct posix_acl acl;
+        struct posix_acl_entry ace[4];
+};
+
 static int
 xdr_nfsace_encode(struct xdr_array2_desc *desc, void *elem)
 {
@@ -72,9 +77,20 @@ xdr_nfsace_encode(struct xdr_array2_desc *desc, void *elem)
         return 0;
 }
 
-unsigned int
-nfsacl_encode(struct xdr_buf *buf, unsigned int base, struct inode *inode,
-              struct posix_acl *acl, int encode_entries, int typeflag)
+/**
+ * nfsacl_encode - Encode an NFSv3 ACL
+ *
+ * @buf: destination xdr_buf to contain XDR encoded ACL
+ * @base: byte offset in xdr_buf where XDR'd ACL begins
+ * @inode: inode of file whose ACL this is
+ * @acl: posix_acl to encode
+ * @encode_entries: whether to encode ACEs as well
+ * @typeflag: ACL type: NFS_ACL_DEFAULT or zero
+ *
+ * Returns size of encoded ACL in bytes or a negative errno value.
+ */
+int nfsacl_encode(struct xdr_buf *buf, unsigned int base, struct inode *inode,
+                  struct posix_acl *acl, int encode_entries, int typeflag)
 {
         int entries = (acl && acl->a_count) ? max_t(int, acl->a_count, 4) : 0;
         struct nfsacl_encode_desc nfsacl_desc = {
@@ -88,17 +104,22 @@ nfsacl_encode(struct xdr_buf *buf, unsigned int base, struct inode *inode,
                 .uid = inode->i_uid,
                 .gid = inode->i_gid,
         };
+        struct nfsacl_simple_acl aclbuf;
         int err;
-        struct posix_acl *acl2 = NULL;
 
         if (entries > NFS_ACL_MAX_ENTRIES ||
             xdr_encode_word(buf, base, entries))
                 return -EINVAL;
         if (encode_entries && acl && acl->a_count == 3) {
-                /* Fake up an ACL_MASK entry. */
-                acl2 = posix_acl_alloc(4, GFP_KERNEL);
-                if (!acl2)
-                        return -ENOMEM;
+                struct posix_acl *acl2 = &aclbuf.acl;
+
+                /* Avoid the use of posix_acl_alloc().  nfsacl_encode() is
+                 * invoked in contexts where a memory allocation failure is
+                 * fatal.  Fortunately this fake ACL is small enough to
+                 * construct on the stack. */
+                memset(acl2, 0, sizeof(acl2));
+                posix_acl_init(acl2, 4);
+
                 /* Insert entries in canonical order: other orders seem
                  to confuse Solaris VxFS. */
                 acl2->a_entries[0] = acl->a_entries[0];  /* ACL_USER_OBJ */
@@ -109,8 +130,6 @@ nfsacl_encode(struct xdr_buf *buf, unsigned int base, struct inode *inode,
                 nfsacl_desc.acl = acl2;
         }
         err = xdr_encode_array2(buf, base + 4, &nfsacl_desc.desc);
-        if (acl2)
-                posix_acl_release(acl2);
         if (!err)
                 err = 8 + nfsacl_desc.desc.elem_size *
                           nfsacl_desc.desc.array_len;
@@ -224,9 +243,18 @@ posix_acl_from_nfsacl(struct posix_acl *acl)
         return 0;
 }
 
-unsigned int
-nfsacl_decode(struct xdr_buf *buf, unsigned int base, unsigned int *aclcnt,
-              struct posix_acl **pacl)
+/**
+ * nfsacl_decode - Decode an NFSv3 ACL
+ *
+ * @buf: xdr_buf containing XDR'd ACL data to decode
+ * @base: byte offset in xdr_buf where XDR'd ACL begins
+ * @aclcnt: count of ACEs in decoded posix_acl
+ * @pacl: buffer in which to place decoded posix_acl
+ *
+ * Returns the length of the decoded ACL in bytes, or a negative errno value.
+ */
+int nfsacl_decode(struct xdr_buf *buf, unsigned int base, unsigned int *aclcnt,
+                  struct posix_acl **pacl)
 {
         struct nfsacl_decode_desc nfsacl_desc = {
                 .desc = {
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index b572b6727181..326e7475a22a 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1,7 +1,7 @@
 /**
  * mft.c - NTFS kernel mft record operations. Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2006 Anton Altaparmakov
+ * Copyright (c) 2001-2011 Anton Altaparmakov and Tuxera Inc.
  * Copyright (c) 2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -2576,6 +2576,8 @@ mft_rec_already_initialized:
         flush_dcache_page(page);
         SetPageUptodate(page);
         if (base_ni) {
+                MFT_RECORD *m_tmp;
+
                 /*
                  * Setup the base mft record in the extent mft record.  This
                  * completes initialization of the allocated extent mft record
@@ -2588,11 +2590,11 @@ mft_rec_already_initialized:
                  * attach it to the base inode @base_ni and map, pin, and lock
                  * its, i.e. the allocated, mft record.
                  */
-                m = map_extent_mft_record(base_ni, bit, &ni);
-                if (IS_ERR(m)) {
+                m_tmp = map_extent_mft_record(base_ni, bit, &ni);
+                if (IS_ERR(m_tmp)) {
                         ntfs_error(vol->sb, "Failed to map allocated extent "
                                         "mft record 0x%llx.", (long long)bit);
-                        err = PTR_ERR(m);
+                        err = PTR_ERR(m_tmp);
                         /* Set the mft record itself not in use. */
                         m->flags &= cpu_to_le16(
                                         ~le16_to_cpu(MFT_RECORD_IN_USE));
@@ -2603,6 +2605,7 @@ mft_rec_already_initialized:
                         ntfs_unmap_page(page);
                         goto undo_mftbmp_alloc;
                 }
+                BUG_ON(m != m_tmp);
                 /*
                  * Make sure the allocated mft record is written out to disk.
                  * No need to set the inode dirty because the caller is going
diff --git a/fs/posix_acl.c b/fs/posix_acl.c
index 39df95a0ec25..b1cf6bf4b41d 100644
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -22,6 +22,7 @@
 
 #include <linux/errno.h>
 
+EXPORT_SYMBOL(posix_acl_init);
 EXPORT_SYMBOL(posix_acl_alloc);
 EXPORT_SYMBOL(posix_acl_clone);
 EXPORT_SYMBOL(posix_acl_valid);
@@ -32,6 +33,16 @@ EXPORT_SYMBOL(posix_acl_chmod_masq);
 EXPORT_SYMBOL(posix_acl_permission);
 
 /*
+ * Init a fresh posix_acl
+ */
+void
+posix_acl_init(struct posix_acl *acl, int count)
+{
+        atomic_set(&acl->a_refcount, 1);
+        acl->a_count = count;
+}
+
+/*
  * Allocate a new ACL with the specified number of entries.
  */
 struct posix_acl *
@@ -40,10 +51,8 @@ posix_acl_alloc(int count, gfp_t flags)
         const size_t size = sizeof(struct posix_acl) +
                             count * sizeof(struct posix_acl_entry);
         struct posix_acl *acl = kmalloc(size, flags);
-        if (acl) {
-                atomic_set(&acl->a_refcount, 1);
-                acl->a_count = count;
-        }
+        if (acl)
+                posix_acl_init(acl, count);
         return acl;
 }
 
diff --git a/fs/proc/consoles.c b/fs/proc/consoles.c
index eafc22ab1fdd..b701eaa482bf 100644
--- a/fs/proc/consoles.c
+++ b/fs/proc/consoles.c
@@ -67,7 +67,7 @@ static void *c_start(struct seq_file *m, loff_t *pos)
         struct console *con;
         loff_t off = 0;
 
-        acquire_console_sem();
+        console_lock();
         for_each_console(con)
                 if (off++ == *pos)
                         break;
@@ -84,7 +84,7 @@ static void *c_next(struct seq_file *m, void *v, loff_t *pos)
 
 static void c_stop(struct seq_file *m, void *v)
 {
-        release_console_sem();
+        console_unlock();
 }
 
 static const struct seq_operations consoles_op = {
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 2fb2882f0fa7..8ab48bc2fa7d 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -63,6 +63,14 @@ static struct buffer_head *get_block_length(struct super_block *sb,
                 *length = (unsigned char) bh->b_data[*offset] |
                         (unsigned char) bh->b_data[*offset + 1] << 8;
                 *offset += 2;
+
+                if (*offset == msblk->devblksize) {
+                        put_bh(bh);
+                        bh = sb_bread(sb, ++(*cur_index));
+                        if (bh == NULL)
+                                return NULL;
+                        *offset = 0;
+                }
         }
 
         return bh;
diff --git a/fs/squashfs/xz_wrapper.c b/fs/squashfs/xz_wrapper.c
index 856756ca5ee4..c4eb40018256 100644
--- a/fs/squashfs/xz_wrapper.c
+++ b/fs/squashfs/xz_wrapper.c
@@ -95,12 +95,6 @@ static int squashfs_xz_uncompress(struct squashfs_sb_info *msblk, void **buffer,
                         if (!buffer_uptodate(bh[k]))
                                 goto release_mutex;
 
-                        if (avail == 0) {
-                                offset = 0;
-                                put_bh(bh[k++]);
-                                continue;
-                        }
-
                         stream->buf.in = bh[k]->b_data + offset;
                         stream->buf.in_size = avail;
                         stream->buf.in_pos = 0;
diff --git a/fs/squashfs/zlib_wrapper.c b/fs/squashfs/zlib_wrapper.c
index 818a5e063faf..4661ae2b1cec 100644
--- a/fs/squashfs/zlib_wrapper.c
+++ b/fs/squashfs/zlib_wrapper.c
@@ -82,12 +82,6 @@ static int zlib_uncompress(struct squashfs_sb_info *msblk, void **buffer,
                         if (!buffer_uptodate(bh[k]))
                                 goto release_mutex;
 
-                        if (avail == 0) {
-                                offset = 0;
-                                put_bh(bh[k++]);
-                                continue;
-                        }
-
                         stream->next_in = bh[k]->b_data + offset;
                         stream->avail_in = avail;
                         offset = 0;
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index b06ede1d0bed..f5e2a19e0f8e 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -985,10 +985,22 @@ xfs_ioctl_setattr(
 
                 /*
                  * Extent size must be a multiple of the appropriate block
-                 * size, if set at all.
+                 * size, if set at all. It must also be smaller than the
+                 * maximum extent size supported by the filesystem.
+                 *
+                 * Also, for non-realtime files, limit the extent size hint to
+                 * half the size of the AGs in the filesystem so alignment
+                 * doesn't result in extents larger than an AG.
                  */
                 if (fa->fsx_extsize != 0) {
-                        xfs_extlen_t    size;
+                        xfs_extlen_t    size;
+                        xfs_fsblock_t   extsize_fsb;
+
+                        extsize_fsb = XFS_B_TO_FSB(mp, fa->fsx_extsize);
+                        if (extsize_fsb > MAXEXTLEN) {
+                                code = XFS_ERROR(EINVAL);
+                                goto error_return;
+                        }
 
                         if (XFS_IS_REALTIME_INODE(ip) ||
                             ((mask & FSX_XFLAGS) &&
@@ -997,6 +1009,10 @@ xfs_ioctl_setattr(
                                        mp->m_sb.sb_blocklog;
                         } else {
                                 size = mp->m_sb.sb_blocksize;
+                                if (extsize_fsb > mp->m_sb.sb_agblocks / 2) {
+                                        code = XFS_ERROR(EINVAL);
+                                        goto error_return;
+                                }
                         }
 
                         if (fa->fsx_extsize % size) {
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index f8e854b4fde8..206a2815ced6 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -1863,12 +1863,14 @@ xfs_qm_dqreclaim_one(void)
         xfs_dquot_t     *dqpout;
         xfs_dquot_t     *dqp;
         int             restarts;
+        int             startagain;
 
         restarts = 0;
         dqpout = NULL;
 
         /* lockorder: hashchainlock, freelistlock, mplistlock, dqlock, dqflock */
-startagain:
+again:
+        startagain = 0;
         mutex_lock(&xfs_Gqm->qm_dqfrlist_lock);
 
         list_for_each_entry(dqp, &xfs_Gqm->qm_dqfrlist, q_freelist) {
@@ -1885,13 +1887,10 @@ startagain:
                         ASSERT(! (dqp->dq_flags & XFS_DQ_INACTIVE));
 
                         trace_xfs_dqreclaim_want(dqp);
-
-                        xfs_dqunlock(dqp);
-                        mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
-                        if (++restarts >= XFS_QM_RECLAIM_MAX_RESTARTS)
-                                return NULL;
                         XQM_STATS_INC(xqmstats.xs_qm_dqwants);
-                        goto startagain;
+                        restarts++;
+                        startagain = 1;
+                        goto dqunlock;
                 }
 
                 /*
@@ -1906,23 +1905,20 @@ startagain:
                         ASSERT(list_empty(&dqp->q_mplist));
                         list_del_init(&dqp->q_freelist);
                         xfs_Gqm->qm_dqfrlist_cnt--;
-                        xfs_dqunlock(dqp);
                         dqpout = dqp;
                         XQM_STATS_INC(xqmstats.xs_qm_dqinact_reclaims);
-                        break;
+                        goto dqunlock;
                 }
 
                 ASSERT(dqp->q_hash);
                 ASSERT(!list_empty(&dqp->q_mplist));
 
                 /*
-                 * Try to grab the flush lock. If this dquot is in the process of
-                 * getting flushed to disk, we don't want to reclaim it.
+                 * Try to grab the flush lock. If this dquot is in the process
+                 * of getting flushed to disk, we don't want to reclaim it.
                  */
-                if (!xfs_dqflock_nowait(dqp)) {
-                        xfs_dqunlock(dqp);
-                        continue;
-                }
+                if (!xfs_dqflock_nowait(dqp))
+                        goto dqunlock;
 
                 /*
                  * We have the flush lock so we know that this is not in the
@@ -1944,8 +1940,7 @@ startagain:
                                 xfs_fs_cmn_err(CE_WARN, mp,
                         "xfs_qm_dqreclaim: dquot %p flush failed", dqp);
                         }
-                        xfs_dqunlock(dqp); /* dqflush unlocks dqflock */
-                        continue;
+                        goto dqunlock;
                 }
 
                 /*
@@ -1967,13 +1962,8 @@ startagain:
                  */
                 if (!mutex_trylock(&mp->m_quotainfo->qi_dqlist_lock)) {
                         restarts++;
-                        mutex_unlock(&dqp->q_hash->qh_lock);
-                        xfs_dqfunlock(dqp);
-                        xfs_dqunlock(dqp);
-                        mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
-                        if (restarts++ >= XFS_QM_RECLAIM_MAX_RESTARTS)
-                                return NULL;
-                        goto startagain;
+                        startagain = 1;
+                        goto qhunlock;
                 }
 
                 ASSERT(dqp->q_nrefs == 0);
@@ -1986,14 +1976,20 @@ startagain:
                 xfs_Gqm->qm_dqfrlist_cnt--;
                 dqpout = dqp;
                 mutex_unlock(&mp->m_quotainfo->qi_dqlist_lock);
+qhunlock:
                 mutex_unlock(&dqp->q_hash->qh_lock);
 dqfunlock:
                 xfs_dqfunlock(dqp);
+dqunlock:
                 xfs_dqunlock(dqp);
                 if (dqpout)
                         break;
                 if (restarts >= XFS_QM_RECLAIM_MAX_RESTARTS)
-                        return NULL;
+                        break;
+                if (startagain) {
+                        mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
+                        goto again;
+                }
         }
         mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
         return dqpout;
diff --git a/fs/xfs/xfs_alloc.h b/fs/xfs/xfs_alloc.h
index 0ab56b32c7eb..d0b3bc72005b 100644
--- a/fs/xfs/xfs_alloc.h
+++ b/fs/xfs/xfs_alloc.h
@@ -75,6 +75,22 @@ typedef unsigned int xfs_alloctype_t;
 #define XFS_ALLOC_SET_ASIDE(mp)  (4 + ((mp)->m_sb.sb_agcount * 4))
 
 /*
+ * When deciding how much space to allocate out of an AG, we limit the
+ * allocation maximum size to the size the AG. However, we cannot use all the
+ * blocks in the AG - some are permanently used by metadata. These
+ * blocks are generally:
+ *      - the AG superblock, AGF, AGI and AGFL
+ *      - the AGF (bno and cnt) and AGI btree root blocks
+ *      - 4 blocks on the AGFL according to XFS_ALLOC_SET_ASIDE() limits
+ *
+ * The AG headers are sector sized, so the amount of space they take up is
+ * dependent on filesystem geometry. The others are all single blocks.
+ */
+#define XFS_ALLOC_AG_MAX_USABLE(mp)     \
+        ((mp)->m_sb.sb_agblocks - XFS_BB_TO_FSB(mp, XFS_FSS_TO_BB(mp, 4)) - 7)
+
+
+/*
  * Argument structure for xfs_alloc routines.
  * This is turned into a structure to avoid having 20 arguments passed
  * down several levels of the stack.
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 4111cd3966c7..dc3afd7739ff 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -1038,17 +1038,34 @@ xfs_bmap_add_extent_delay_real(
                  * Filling in the middle part of a previous delayed allocation.
                  * Contiguity is impossible here.
                  * This case is avoided almost all the time.
+                 *
+                 * We start with a delayed allocation:
+                 *
+                 * +ddddddddddddddddddddddddddddddddddddddddddddddddddddddd+
+                 *  PREV @ idx
+                 *
+                 * and we are allocating:
+                 *                     +rrrrrrrrrrrrrrrrr+
+                 *                            new
+                 *
+                 * and we set it up for insertion as:
+                 * +ddddddddddddddddddd+rrrrrrrrrrrrrrrrr+ddddddddddddddddd+
+                 *                            new
+                 *  PREV @ idx          LEFT              RIGHT
+                 *                      inserted at idx + 1
                  */
                 temp = new->br_startoff - PREV.br_startoff;
-                trace_xfs_bmap_pre_update(ip, idx, 0, _THIS_IP_);
-                xfs_bmbt_set_blockcount(ep, temp);
-                r[0] = *new;
-                r[1].br_state = PREV.br_state;
-                r[1].br_startblock = 0;
-                r[1].br_startoff = new_endoff;
                 temp2 = PREV.br_startoff + PREV.br_blockcount - new_endoff;
-                r[1].br_blockcount = temp2;
-                xfs_iext_insert(ip, idx + 1, 2, &r[0], state);
+                trace_xfs_bmap_pre_update(ip, idx, 0, _THIS_IP_);
+                xfs_bmbt_set_blockcount(ep, temp);      /* truncate PREV */
+                LEFT = *new;
+                RIGHT.br_state = PREV.br_state;
+                RIGHT.br_startblock = nullstartblock(
+                                (int)xfs_bmap_worst_indlen(ip, temp2));
+                RIGHT.br_startoff = new_endoff;
+                RIGHT.br_blockcount = temp2;
+                /* insert LEFT (r[0]) and RIGHT (r[1]) at the same time */
+                xfs_iext_insert(ip, idx + 1, 2, &LEFT, state);
                 ip->i_df.if_lastex = idx + 1;
                 ip->i_d.di_nextents++;
                 if (cur == NULL)
@@ -2430,7 +2447,7 @@ xfs_bmap_btalloc_nullfb(
                 startag = ag = 0;
 
         pag = xfs_perag_get(mp, ag);
-        while (*blen < ap->alen) {
+        while (*blen < args->maxlen) {
                 if (!pag->pagf_init) {
                         error = xfs_alloc_pagf_init(mp, args->tp, ag,
                                                     XFS_ALLOC_FLAG_TRYLOCK);
@@ -2452,7 +2469,7 @@ xfs_bmap_btalloc_nullfb(
                         notinit = 1;
 
                 if (xfs_inode_is_filestream(ap->ip)) {
-                        if (*blen >= ap->alen)
+                        if (*blen >= args->maxlen)
                                 break;
 
                         if (ap->userdata) {
@@ -2498,14 +2515,14 @@ xfs_bmap_btalloc_nullfb(
          * If the best seen length is less than the request
          * length, use the best as the minimum.
          */
-        else if (*blen < ap->alen)
+        else if (*blen < args->maxlen)
                 args->minlen = *blen;
         /*
-         * Otherwise we've seen an extent as big as alen,
+         * Otherwise we've seen an extent as big as maxlen,
          * use that as the minimum.
          */
         else
-                args->minlen = ap->alen;
+                args->minlen = args->maxlen;
 
         /*
          * set the failure fallback case to look in the selected
@@ -2573,7 +2590,9 @@ xfs_bmap_btalloc(
         args.tp = ap->tp;
         args.mp = mp;
         args.fsbno = ap->rval;
-        args.maxlen = MIN(ap->alen, mp->m_sb.sb_agblocks);
+
+        /* Trim the allocation back to the maximum an AG can fit. */
+        args.maxlen = MIN(ap->alen, XFS_ALLOC_AG_MAX_USABLE(mp));
         args.firstblock = ap->firstblock;
         blen = 0;
         if (nullfb) {
@@ -2621,7 +2640,7 @@ xfs_bmap_btalloc(
                         /*
                          * Adjust for alignment
                          */
-                        if (blen > args.alignment && blen <= ap->alen)
+                        if (blen > args.alignment && blen <= args.maxlen)
                                 args.minlen = blen - args.alignment;
                         args.minalignslop = 0;
                 } else {
@@ -2640,7 +2659,7 @@ xfs_bmap_btalloc(
                          * of minlen+alignment+slop doesn't go up
                          * between the calls.
                          */
-                        if (blen > mp->m_dalign && blen <= ap->alen)
+                        if (blen > mp->m_dalign && blen <= args.maxlen)
                                 nextminlen = blen - mp->m_dalign;
                         else
                                 nextminlen = args.minlen;
@@ -4485,6 +4504,16 @@ xfs_bmapi(
                                 /* Figure out the extent size, adjust alen */
                                 extsz = xfs_get_extsz_hint(ip);
                                 if (extsz) {
+                                        /*
+                                         * make sure we don't exceed a single
+                                         * extent length when we align the
+                                         * extent by reducing length we are
+                                         * going to allocate by the maximum
+                                         * amount extent size aligment may
+                                         * require.
+                                         */
+                                        alen = XFS_FILBLKS_MIN(len,
+                                                   MAXEXTLEN - (2 * extsz - 1));
                                         error = xfs_bmap_extsize_align(mp,
                                                         &got, &prev, extsz,
                                                         rt, eof,
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 98c6f73b6752..6f8c21ce0d6d 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -427,13 +427,15 @@ xfs_buf_item_unpin(
 
                 if (remove) {
                         /*
-                         * We have to remove the log item from the transaction
-                         * as we are about to release our reference to the
-                         * buffer.  If we don't, the unlock that occurs later
-                         * in xfs_trans_uncommit() will ry to reference the
+                         * If we are in a transaction context, we have to
+                         * remove the log item from the transaction as we are
+                         * about to release our reference to the buffer.  If we
+                         * don't, the unlock that occurs later in
+                         * xfs_trans_uncommit() will try to reference the
                          * buffer which we no longer have a hold on.
                          */
-                        xfs_trans_del_item(lip);
+                        if (lip->li_desc)
+                                xfs_trans_del_item(lip);
 
                         /*
                          * Since the transaction no longer refers to the buffer,
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index 75f2ef60e579..d22e62623437 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -138,7 +138,8 @@ xfs_efi_item_unpin(
 
         if (remove) {
                 ASSERT(!(lip->li_flags & XFS_LI_IN_AIL));
-                xfs_trans_del_item(lip);
+                if (lip->li_desc)
+                        xfs_trans_del_item(lip);
                 xfs_efi_item_free(efip);
                 return;
         }
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 55582bd66659..8a0f044750c3 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -337,7 +337,12 @@ xfs_iomap_prealloc_size(
                 int shift = 0;
                 int64_t freesp;
 
-                alloc_blocks = XFS_B_TO_FSB(mp, ip->i_size);
+                /*
+                 * rounddown_pow_of_two() returns an undefined result
+                 * if we pass in alloc_blocks = 0. Hence the "+ 1" to
+                 * ensure we always pass in a non-zero value.
+                 */
+                alloc_blocks = XFS_B_TO_FSB(mp, ip->i_size) + 1;
                 alloc_blocks = XFS_FILEOFF_MIN(MAXEXTLEN,
                                         rounddown_pow_of_two(alloc_blocks));
 
diff --git a/fs/xfs/xfs_log.h b/fs/xfs/xfs_log.h
index 916eb7db14d9..3bd3291ef8d2 100644
--- a/fs/xfs/xfs_log.h
+++ b/fs/xfs/xfs_log.h
@@ -191,7 +191,7 @@ void	  xfs_log_ticket_put(struct xlog_ticket *ticket);
 
 xlog_tid_t xfs_log_get_trans_ident(struct xfs_trans *tp);
 
-int     xfs_log_commit_cil(struct xfs_mount *mp, struct xfs_trans *tp,
+void    xfs_log_commit_cil(struct xfs_mount *mp, struct xfs_trans *tp,
                                 struct xfs_log_vec *log_vector,
                                 xfs_lsn_t *commit_lsn, int flags);
 bool    xfs_log_item_in_current_chkpt(struct xfs_log_item *lip);
diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
index 9dc8125d04e5..9ca59be08977 100644
--- a/fs/xfs/xfs_log_cil.c
+++ b/fs/xfs/xfs_log_cil.c
@@ -543,7 +543,7 @@ xlog_cil_push(
 
         error = xlog_write(log, &lvhdr, tic, &ctx->start_lsn, NULL, 0);
         if (error)
-                goto out_abort;
+                goto out_abort_free_ticket;
 
         /*
          * now that we've written the checkpoint into the log, strictly
@@ -569,8 +569,9 @@ restart:
         }
         spin_unlock(&cil->xc_cil_lock);
 
+        /* xfs_log_done always frees the ticket on error. */
         commit_lsn = xfs_log_done(log->l_mp, tic, &commit_iclog, 0);
-        if (error || commit_lsn == -1)
+        if (commit_lsn == -1)
                 goto out_abort;
 
         /* attach all the transactions w/ busy extents to iclog */
@@ -600,6 +601,8 @@ out_free_ticket:
         kmem_free(new_ctx);
         return 0;
 
+out_abort_free_ticket:
+        xfs_log_ticket_put(tic);
 out_abort:
         xlog_cil_committed(ctx, XFS_LI_ABORTED);
         return XFS_ERROR(EIO);
@@ -622,7 +625,7 @@ out_abort:
  * background commit, returns without it held once background commits are
  * allowed again.
  */
-int
+void
 xfs_log_commit_cil(
         struct xfs_mount        *mp,
         struct xfs_trans        *tp,
@@ -637,11 +640,6 @@ xfs_log_commit_cil(
         if (flags & XFS_TRANS_RELEASE_LOG_RES)
                 log_flags = XFS_LOG_REL_PERM_RESERV;
 
-        if (XLOG_FORCED_SHUTDOWN(log)) {
-                xlog_cil_free_logvec(log_vector);
-                return XFS_ERROR(EIO);
-        }
-
         /*
          * do all the hard work of formatting items (including memory
          * allocation) outside the CIL context lock. This prevents stalling CIL
@@ -701,7 +699,6 @@ xfs_log_commit_cil(
          */
         if (push)
                 xlog_cil_push(log, 0);
-        return 0;
 }
 
 /*
diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
index 33dbc4e0ad62..76922793f64f 100644
--- a/fs/xfs/xfs_trans.c
+++ b/fs/xfs/xfs_trans.c
@@ -1446,6 +1446,14 @@ xfs_log_item_batch_insert(
  * Bulk operation version of xfs_trans_committed that takes a log vector of
  * items to insert into the AIL. This uses bulk AIL insertion techniques to
  * minimise lock traffic.
+ *
+ * If we are called with the aborted flag set, it is because a log write during
+ * a CIL checkpoint commit has failed. In this case, all the items in the
+ * checkpoint have already gone through IOP_COMMITED and IOP_UNLOCK, which
+ * means that checkpoint commit abort handling is treated exactly the same
+ * as an iclog write error even though we haven't started any IO yet. Hence in
+ * this case all we need to do is IOP_COMMITTED processing, followed by an
+ * IOP_UNPIN(aborted) call.
  */
 void
 xfs_trans_committed_bulk(
@@ -1472,6 +1480,16 @@ xfs_trans_committed_bulk(
                 if (XFS_LSN_CMP(item_lsn, (xfs_lsn_t)-1) == 0)
                         continue;
 
+                /*
+                 * if we are aborting the operation, no point in inserting the
+                 * object into the AIL as we are in a shutdown situation.
+                 */
+                if (aborted) {
+                        ASSERT(XFS_FORCED_SHUTDOWN(ailp->xa_mount));
+                        IOP_UNPIN(lip, 1);
+                        continue;
+                }
+
                 if (item_lsn != commit_lsn) {
 
                         /*
@@ -1503,20 +1521,24 @@ xfs_trans_committed_bulk(
 }
 
 /*
- * Called from the trans_commit code when we notice that
- * the filesystem is in the middle of a forced shutdown.
+ * Called from the trans_commit code when we notice that the filesystem is in
+ * the middle of a forced shutdown.
+ *
+ * When we are called here, we have already pinned all the items in the
+ * transaction. However, neither IOP_COMMITTING or IOP_UNLOCK has been called
+ * so we can simply walk the items in the transaction, unpin them with an abort
+ * flag and then free the items. Note that unpinning the items can result in
+ * them being freed immediately, so we need to use a safe list traversal method
+ * here.
  */
 STATIC void
 xfs_trans_uncommit(
         struct xfs_trans        *tp,
         uint                    flags)
 {
-        struct xfs_log_item_desc *lidp;
+        struct xfs_log_item_desc *lidp, *n;
 
-        list_for_each_entry(lidp, &tp->t_items, lid_trans) {
-                /*
-                 * Unpin all but those that aren't dirty.
-                 */
+        list_for_each_entry_safe(lidp, n, &tp->t_items, lid_trans) {
                 if (lidp->lid_flags & XFS_LID_DIRTY)
                         IOP_UNPIN(lidp->lid_item, 1);
         }
@@ -1733,7 +1755,6 @@ xfs_trans_commit_cil(
         int                     flags)
 {
         struct xfs_log_vec      *log_vector;
-        int                     error;
 
         /*
          * Get each log item to allocate a vector structure for
@@ -1744,9 +1765,7 @@ xfs_trans_commit_cil(
         if (!log_vector)
                 return ENOMEM;
 
-        error = xfs_log_commit_cil(mp, tp, log_vector, commit_lsn, flags);
-        if (error)
-                return error;
+        xfs_log_commit_cil(mp, tp, log_vector, commit_lsn, flags);
 
         current_restore_flags_nested(&tp->t_pflags, PF_FSTRANS);
         xfs_trans_free(tp);
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 6ebb81030d2d..fe77e3395b40 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -124,7 +124,8 @@
 #endif
 
 #ifdef CONFIG_EVENT_TRACING
-#define FTRACE_EVENTS() VMLINUX_SYMBOL(__start_ftrace_events) = .;      \
+#define FTRACE_EVENTS() . = ALIGN(8);                                   \
+                        VMLINUX_SYMBOL(__start_ftrace_events) = .;      \
                         *(_ftrace_events)                               \
                         VMLINUX_SYMBOL(__stop_ftrace_events) = .;
 #else
@@ -140,7 +141,8 @@
 #endif
 
 #ifdef CONFIG_FTRACE_SYSCALLS
-#define TRACE_SYSCALLS() VMLINUX_SYMBOL(__start_syscalls_metadata) = .; \
+#define TRACE_SYSCALLS() . = ALIGN(8);                                  \
+                         VMLINUX_SYMBOL(__start_syscalls_metadata) = .; \
                          *(__syscalls_metadata)                         \
                          VMLINUX_SYMBOL(__stop_syscalls_metadata) = .;
 #else
@@ -165,10 +167,8 @@
         CPU_KEEP(exit.data)                                             \
         MEM_KEEP(init.data)                                             \
         MEM_KEEP(exit.data)                                             \
-        . = ALIGN(32);                                                  \
-        VMLINUX_SYMBOL(__start___tracepoints) = .;                      \
+        STRUCT_ALIGN();                                                 \
         *(__tracepoints)                                                \
-        VMLINUX_SYMBOL(__stop___tracepoints) = .;                       \
         /* implement dynamic printk debug */                            \
         . = ALIGN(8);                                                   \
         VMLINUX_SYMBOL(__start___verbose) = .;                          \
@@ -176,13 +176,7 @@
         VMLINUX_SYMBOL(__stop___verbose) = .;                           \
         LIKELY_PROFILE()                                                \
         BRANCH_PROFILE()                                                \
-        TRACE_PRINTKS()                                                 \
-                                                                        \
-        STRUCT_ALIGN();                                                 \
-        FTRACE_EVENTS()                                                 \
-                                                                        \
-        STRUCT_ALIGN();                                                 \
-        TRACE_SYSCALLS()
+        TRACE_PRINTKS()
 
 /*
  * Data section helpers
@@ -220,6 +214,10 @@
                 VMLINUX_SYMBOL(__start_rodata) = .;                     \
                 *(.rodata) *(.rodata.*)                                 \
                 *(__vermagic)           /* Kernel version magic */      \
+                . = ALIGN(8);                                           \
+                VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .;         \
+                *(__tracepoints_ptrs)   /* Tracepoints: pointer array */\
+                VMLINUX_SYMBOL(__stop___tracepoints_ptrs) = .;          \
                 *(__markers_strings)    /* Markers: strings */          \
                 *(__tracepoints_strings)/* Tracepoints: strings */      \
         }                                                               \
@@ -482,6 +480,8 @@
         KERNEL_CTORS()                                                  \
         *(.init.rodata)                                                 \
         MCOUNT_REC()                                                    \
+        FTRACE_EVENTS()                                                 \
+        TRACE_SYSCALLS()                                                \
         DEV_DISCARD(init.rodata)                                        \
         CPU_DISCARD(init.rodata)                                        \
         MEM_DISCARD(init.rodata)                                        \
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index a4694c610330..fe29aadb129d 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -1367,7 +1367,7 @@ extern int drm_vblank_wait(struct drm_device *dev, unsigned int *vbl_seq);
 extern u32 drm_vblank_count(struct drm_device *dev, int crtc);
 extern u32 drm_vblank_count_and_time(struct drm_device *dev, int crtc,
                                      struct timeval *vblanktime);
-extern void drm_handle_vblank(struct drm_device *dev, int crtc);
+extern bool drm_handle_vblank(struct drm_device *dev, int crtc);
 extern int drm_vblank_get(struct drm_device *dev, int crtc);
 extern void drm_vblank_put(struct drm_device *dev, int crtc);
 extern void drm_vblank_off(struct drm_device *dev, int crtc);
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index acd7fade160d..801be59f4f15 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -275,6 +275,7 @@ struct drm_pending_vblank_event;
 
 /**
  * drm_crtc_funcs - control CRTCs for a given device
+ * @reset: reset CRTC after state has been invalidate (e.g. resume)
  * @dpms: control display power levels
  * @save: save CRTC state
  * @resore: restore CRTC state
@@ -302,6 +303,8 @@ struct drm_crtc_funcs {
         void (*save)(struct drm_crtc *crtc); /* suspend? */
         /* Restore CRTC state */
         void (*restore)(struct drm_crtc *crtc); /* resume? */
+        /* Reset CRTC state */
+        void (*reset)(struct drm_crtc *crtc);
 
         /* cursor controls */
         int (*cursor_set)(struct drm_crtc *crtc, struct drm_file *file_priv,
@@ -379,6 +382,7 @@ struct drm_crtc {
  * @dpms: set power state (see drm_crtc_funcs above)
  * @save: save connector state
  * @restore: restore connector state
+ * @reset: reset connector after state has been invalidate (e.g. resume)
  * @mode_valid: is this mode valid on the given connector?
  * @mode_fixup: try to fixup proposed mode for this connector
  * @mode_set: set this mode
@@ -396,6 +400,7 @@ struct drm_connector_funcs {
         void (*dpms)(struct drm_connector *connector, int mode);
         void (*save)(struct drm_connector *connector);
         void (*restore)(struct drm_connector *connector);
+        void (*reset)(struct drm_connector *connector);
 
         /* Check to see if anything is attached to the connector.
          * @force is set to false whilst polling, true when checking the
@@ -413,6 +418,7 @@ struct drm_connector_funcs {
 };
 
 struct drm_encoder_funcs {
+        void (*reset)(struct drm_encoder *encoder);
         void (*destroy)(struct drm_encoder *encoder);
 };
 
@@ -656,6 +662,7 @@ extern struct drm_display_mode *drm_mode_duplicate(struct drm_device *dev,
                                                    struct drm_display_mode *mode);
 extern void drm_mode_debug_printmodeline(struct drm_display_mode *mode);
 extern void drm_mode_config_init(struct drm_device *dev);
+extern void drm_mode_config_reset(struct drm_device *dev);
 extern void drm_mode_config_cleanup(struct drm_device *dev);
 extern void drm_mode_set_name(struct drm_display_mode *mode);
 extern bool drm_mode_equal(struct drm_display_mode *mode1, struct drm_display_mode *mode2);
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index fe29ae328bd9..5ff1194dc2ea 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -28,7 +28,6 @@
         {0x1002, 0x4156, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
         {0x1002, 0x4237, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP}, \
         {0x1002, 0x4242, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x4243, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
         {0x1002, 0x4336, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS100|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
         {0x1002, 0x4337, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
         {0x1002, 0x4437, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 2296d8b1931f..b0ada6f37dd6 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -1,5 +1,6 @@
 header-y += byteorder/
 header-y += can/
+header-y += caif/
 header-y += dvb/
 header-y += hdlc/
 header-y += isdn/
diff --git a/include/linux/caif/Kbuild b/include/linux/caif/Kbuild
new file mode 100644
index 000000000000..a9cf250689dc
--- /dev/null
+++ b/include/linux/caif/Kbuild
@@ -0,0 +1,2 @@
+header-y += caif_socket.h
+header-y += if_caif.h
diff --git a/include/linux/console.h b/include/linux/console.h
index 9774fe6a1a97..7453cfd593c8 100644
--- a/include/linux/console.h
+++ b/include/linux/console.h
@@ -139,9 +139,9 @@ extern int update_console_cmdline(char *name, int idx, char *name_new, int idx_n
 extern void register_console(struct console *);
 extern int unregister_console(struct console *);
 extern struct console *console_drivers;
-extern void acquire_console_sem(void);
-extern int try_acquire_console_sem(void);
-extern void release_console_sem(void);
+extern void console_lock(void);
+extern int console_trylock(void);
+extern void console_unlock(void);
 extern void console_conditional_schedule(void);
 extern void console_unblank(void);
 extern struct tty_driver *console_device(int *);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 32b38cd829d3..bd3215940c37 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2555,9 +2555,12 @@ int proc_nr_inodes(struct ctl_table *table, int write,
                    void __user *buffer, size_t *lenp, loff_t *ppos);
 int __init get_filesystem_list(char *buf);
 
+#define __FMODE_EXEC            ((__force int) FMODE_EXEC)
+#define __FMODE_NONOTIFY        ((__force int) FMODE_NONOTIFY)
+
 #define ACC_MODE(x) ("\004\002\006\006"[(x)&O_ACCMODE])
 #define OPEN_FMODE(flag) ((__force fmode_t)(((flag + 1) & O_ACCMODE) | \
-                                            (flag & FMODE_NONOTIFY)))
+                                            (flag & __FMODE_NONOTIFY)))
 
 #endif /* __KERNEL__ */
 #endif /* _LINUX_FS_H */
diff --git a/include/linux/input/bu21013.h b/include/linux/input/bu21013.h
index e470d387dd49..05e03284b92a 100644
--- a/include/linux/input/bu21013.h
+++ b/include/linux/input/bu21013.h
@@ -12,8 +12,6 @@
  * @cs_en:      pointer to the cs enable function
  * @cs_dis:     pointer to the cs disable function
  * @irq_read_val:    pointer to read the pen irq value function
- * @x_max_res: xmax resolution
- * @y_max_res: ymax resolution
  * @touch_x_max: touch x max
  * @touch_y_max: touch y max
  * @cs_pin: chip select pin
@@ -29,8 +27,6 @@ struct bu21013_platform_device {
         int (*cs_en)(int reset_pin);
         int (*cs_dis)(int reset_pin);
         int (*irq_read_val)(void);
-        int x_max_res;
-        int y_max_res;
         int touch_x_max;
         int touch_y_max;
         unsigned int cs_pin;
diff --git a/include/linux/irq.h b/include/linux/irq.h
index abde2527c699..80fcb53057bc 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -74,7 +74,8 @@ typedef	void (*irq_flow_handler_t)(unsigned int irq,
 
 #define IRQF_MODIFY_MASK        \
         (IRQ_TYPE_SENSE_MASK | IRQ_NOPROBE | IRQ_NOREQUEST | \
-         IRQ_NOAUTOEN | IRQ_MOVE_PCNTXT | IRQ_LEVEL)
+         IRQ_NOAUTOEN | IRQ_MOVE_PCNTXT | IRQ_LEVEL | IRQ_NO_BALANCING | \
+         IRQ_PER_CPU)
 
 #ifdef CONFIG_IRQ_PER_CPU
 # define CHECK_IRQ_PER_CPU(var) ((var) & IRQ_PER_CPU)
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index e2f4d6af2125..2fe6e84894a4 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -588,7 +588,7 @@ struct sysinfo {
 
 /**
  * BUILD_BUG_ON - break compile if a condition is true.
- * @cond: the condition which the compiler should know is false.
+ * @condition: the condition which the compiler should know is false.
  *
  * If you have some code which relies on certain constants being equal, or
  * other compile-time-evaluated condition, you should use BUILD_BUG_ON to
diff --git a/include/linux/module.h b/include/linux/module.h
index e7c6385c6683..9bdf27c7615b 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -377,7 +377,7 @@ struct module
            keeping pointers to this stuff */
         char *args;
 #ifdef CONFIG_TRACEPOINTS
-        struct tracepoint *tracepoints;
+        struct tracepoint * const *tracepoints_ptrs;
         unsigned int num_tracepoints;
 #endif
 #ifdef HAVE_JUMP_LABEL
@@ -389,7 +389,7 @@ struct module
         unsigned int num_trace_bprintk_fmt;
 #endif
 #ifdef CONFIG_EVENT_TRACING
-        struct ftrace_event_call *trace_events;
+        struct ftrace_event_call **trace_events;
         unsigned int num_trace_events;
 #endif
 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
diff --git a/include/linux/mroute.h b/include/linux/mroute.h
index 0fa7a3a874c8..b21d567692b2 100644
--- a/include/linux/mroute.h
+++ b/include/linux/mroute.h
@@ -150,6 +150,7 @@ static inline int ip_mroute_opt(int opt)
 extern int ip_mroute_setsockopt(struct sock *, int, char __user *, unsigned int);
 extern int ip_mroute_getsockopt(struct sock *, int, char __user *, int __user *);
 extern int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg);
+extern int ipmr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
 extern int ip_mr_init(void);
 #else
 static inline
diff --git a/include/linux/mroute6.h b/include/linux/mroute6.h
index 6091ab77f388..9d2deb200f54 100644
--- a/include/linux/mroute6.h
+++ b/include/linux/mroute6.h
@@ -136,6 +136,7 @@ extern int ip6_mroute_setsockopt(struct sock *, int, char __user *, unsigned int
 extern int ip6_mroute_getsockopt(struct sock *, int, char __user *, int __user *);
 extern int ip6_mr_input(struct sk_buff *skb);
 extern int ip6mr_ioctl(struct sock *sk, int cmd, void __user *arg);
+extern int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
 extern int ip6_mr_init(void);
 extern void ip6_mr_cleanup(void);
 #else
diff --git a/include/linux/nfsacl.h b/include/linux/nfsacl.h
index f321b578edeb..fabcb1e5c460 100644
--- a/include/linux/nfsacl.h
+++ b/include/linux/nfsacl.h
@@ -51,10 +51,10 @@ nfsacl_size(struct posix_acl *acl_access, struct posix_acl *acl_default)
         return w;
 }
 
-extern unsigned int
+extern int
 nfsacl_encode(struct xdr_buf *buf, unsigned int base, struct inode *inode,
               struct posix_acl *acl, int encode_entries, int typeflag);
-extern unsigned int
+extern int
 nfsacl_decode(struct xdr_buf *buf, unsigned int base, unsigned int *aclcnt,
               struct posix_acl **pacl);
 
diff --git a/include/linux/posix_acl.h b/include/linux/posix_acl.h
index d68283a898bb..54211c1cd926 100644
--- a/include/linux/posix_acl.h
+++ b/include/linux/posix_acl.h
@@ -71,6 +71,7 @@ posix_acl_release(struct posix_acl *acl)
 
 /* posix_acl.c */
 
+extern void posix_acl_init(struct posix_acl *, int);
 extern struct posix_acl *posix_acl_alloc(int, gfp_t);
 extern struct posix_acl *posix_acl_clone(const struct posix_acl *, gfp_t);
 extern int posix_acl_valid(const struct posix_acl *);
diff --git a/include/linux/res_counter.h b/include/linux/res_counter.h
index fcb9884df618..a5930cb66145 100644
--- a/include/linux/res_counter.h
+++ b/include/linux/res_counter.h
@@ -182,6 +182,26 @@ static inline bool res_counter_check_under_limit(struct res_counter *cnt)
         return ret;
 }
 
+/**
+ * res_counter_check_margin - check if the counter allows charging
+ * @cnt: the resource counter to check
+ * @bytes: the number of bytes to check the remaining space against
+ *
+ * Returns a boolean value on whether the counter can be charged
+ * @bytes or whether this would exceed the limit.
+ */
+static inline bool res_counter_check_margin(struct res_counter *cnt,
+                                            unsigned long bytes)
+{
+        bool ret;
+        unsigned long flags;
+
+        spin_lock_irqsave(&cnt->lock, flags);
+        ret = cnt->limit - cnt->usage >= bytes;
+        spin_unlock_irqrestore(&cnt->lock, flags);
+        return ret;
+}
+
 static inline bool res_counter_check_under_soft_limit(struct res_counter *cnt)
 {
         bool ret;
diff --git a/include/linux/sunrpc/bc_xprt.h b/include/linux/sunrpc/bc_xprt.h
index c50b458b8a3f..082884295f80 100644
--- a/include/linux/sunrpc/bc_xprt.h
+++ b/include/linux/sunrpc/bc_xprt.h
@@ -47,14 +47,6 @@ static inline int svc_is_backchannel(const struct svc_rqst *rqstp)
                 return 1;
         return 0;
 }
-static inline struct nfs4_sessionid *bc_xprt_sid(struct svc_rqst *rqstp)
-{
-        if (svc_is_backchannel(rqstp))
-                return (struct nfs4_sessionid *)
-                        rqstp->rq_server->sv_bc_xprt->xpt_bc_sid;
-        return NULL;
-}
-
 #else /* CONFIG_NFS_V4_1 */
 static inline int xprt_setup_backchannel(struct rpc_xprt *xprt,
                                          unsigned int min_reqs)
@@ -67,11 +59,6 @@ static inline int svc_is_backchannel(const struct svc_rqst *rqstp)
         return 0;
 }
 
-static inline struct nfs4_sessionid *bc_xprt_sid(struct svc_rqst *rqstp)
-{
-        return NULL;
-}
-
 static inline void xprt_free_bc_request(struct rpc_rqst *req)
 {
 }
diff --git a/include/linux/sunrpc/svc_xprt.h b/include/linux/sunrpc/svc_xprt.h
index 059877b4d85b..7ad9751a0d87 100644
--- a/include/linux/sunrpc/svc_xprt.h
+++ b/include/linux/sunrpc/svc_xprt.h
@@ -77,7 +77,6 @@ struct svc_xprt {
         size_t                  xpt_remotelen;  /* length of address */
         struct rpc_wait_queue   xpt_bc_pending; /* backchannel wait queue */
         struct list_head        xpt_users;      /* callbacks on free */
-        void                    *xpt_bc_sid;    /* back channel session ID */
 
         struct net              *xpt_net;
         struct rpc_xprt         *xpt_bc_xprt;   /* NFSv4.1 backchannel */
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 18cd0684fc4e..98664db1be47 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -125,39 +125,37 @@ extern struct trace_event_functions enter_syscall_print_funcs;
 extern struct trace_event_functions exit_syscall_print_funcs;
 
 #define SYSCALL_TRACE_ENTER_EVENT(sname)                                \
-        static struct syscall_metadata                                  \
-        __attribute__((__aligned__(4))) __syscall_meta_##sname;         \
+        static struct syscall_metadata __syscall_meta_##sname;          \
         static struct ftrace_event_call __used                          \
-          __attribute__((__aligned__(4)))                               \
-          __attribute__((section("_ftrace_events")))                    \
           event_enter_##sname = {                                       \
                 .name                   = "sys_enter"#sname,            \
                 .class                  = &event_class_syscall_enter,   \
                 .event.funcs            = &enter_syscall_print_funcs,   \
                 .data                   = (void *)&__syscall_meta_##sname,\
         };                                                              \
+        static struct ftrace_event_call __used                          \
+          __attribute__((section("_ftrace_events")))                    \
+         *__event_enter_##sname = &event_enter_##sname;                 \
         __TRACE_EVENT_FLAGS(enter_##sname, TRACE_EVENT_FL_CAP_ANY)
 
 #define SYSCALL_TRACE_EXIT_EVENT(sname)                                 \
-        static struct syscall_metadata                                  \
-        __attribute__((__aligned__(4))) __syscall_meta_##sname;         \
+        static struct syscall_metadata __syscall_meta_##sname;          \
         static struct ftrace_event_call __used                          \
-          __attribute__((__aligned__(4)))                               \
-          __attribute__((section("_ftrace_events")))                    \
           event_exit_##sname = {                                        \
                 .name                   = "sys_exit"#sname,             \
                 .class                  = &event_class_syscall_exit,    \
                 .event.funcs            = &exit_syscall_print_funcs,    \
                 .data                   = (void *)&__syscall_meta_##sname,\
         };                                                              \
+        static struct ftrace_event_call __used                          \
+          __attribute__((section("_ftrace_events")))                    \
+        *__event_exit_##sname = &event_exit_##sname;                    \
         __TRACE_EVENT_FLAGS(exit_##sname, TRACE_EVENT_FL_CAP_ANY)
 
 #define SYSCALL_METADATA(sname, nb)                             \
         SYSCALL_TRACE_ENTER_EVENT(sname);                       \
         SYSCALL_TRACE_EXIT_EVENT(sname);                        \
         static struct syscall_metadata __used                   \
-          __attribute__((__aligned__(4)))                       \
-          __attribute__((section("__syscalls_metadata")))       \
           __syscall_meta_##sname = {                            \
                 .name           = "sys"#sname,                  \
                 .nb_args        = nb,                           \
@@ -166,14 +164,15 @@ extern struct trace_event_functions exit_syscall_print_funcs;
                 .enter_event    = &event_enter_##sname,         \
                 .exit_event     = &event_exit_##sname,          \
                 .enter_fields   = LIST_HEAD_INIT(__syscall_meta_##sname.enter_fields), \
-        };
+        };                                                      \
+        static struct syscall_metadata __used                   \
+          __attribute__((section("__syscalls_metadata")))       \
+         *__p_syscall_meta_##sname = &__syscall_meta_##sname;
 
 #define SYSCALL_DEFINE0(sname)                                  \
         SYSCALL_TRACE_ENTER_EVENT(_##sname);                    \
         SYSCALL_TRACE_EXIT_EVENT(_##sname);                     \
         static struct syscall_metadata __used                   \
-          __attribute__((__aligned__(4)))                       \
-          __attribute__((section("__syscalls_metadata")))       \
           __syscall_meta__##sname = {                           \
                 .name           = "sys_"#sname,                 \
                 .nb_args        = 0,                            \
@@ -181,6 +180,9 @@ extern struct trace_event_functions exit_syscall_print_funcs;
                 .exit_event     = &event_exit__##sname,         \
                 .enter_fields   = LIST_HEAD_INIT(__syscall_meta__##sname.enter_fields), \
         };                                                      \
+        static struct syscall_metadata __used                   \
+          __attribute__((section("__syscalls_metadata")))       \
+         *__p_syscall_meta_##sname = &__syscall_meta__##sname;  \
         asmlinkage long sys_##sname(void)
 #else
 #define SYSCALL_DEFINE0(name)      asmlinkage long sys_##name(void)
diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
index 387fa7d05c98..7faf933cced7 100644
--- a/include/linux/sysrq.h
+++ b/include/linux/sysrq.h
@@ -17,6 +17,9 @@
 #include <linux/errno.h>
 #include <linux/types.h>
 
+/* Enable/disable SYSRQ support by default (0==no, 1==yes). */
+#define SYSRQ_DEFAULT_ENABLE    1
+
 /* Possible values of bitmask for enabling sysrq functions */
 /* 0x0001 is reserved for enable everything */
 #define SYSRQ_ENABLE_LOG        0x0002
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index c6814616653b..97c84a58efb8 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -33,12 +33,7 @@ struct tracepoint {
         void (*regfunc)(void);
         void (*unregfunc)(void);
         struct tracepoint_func __rcu *funcs;
-} __attribute__((aligned(32)));         /*
-                                         * Aligned on 32 bytes because it is
-                                         * globally visible and gcc happily
-                                         * align these on the structure size.
-                                         * Keep in sync with vmlinux.lds.h.
-                                         */
+};
 
 /*
  * Connect a probe to a tracepoint.
@@ -61,15 +56,15 @@ extern void tracepoint_probe_update_all(void);
 
 struct tracepoint_iter {
         struct module *module;
-        struct tracepoint *tracepoint;
+        struct tracepoint * const *tracepoint;
 };
 
 extern void tracepoint_iter_start(struct tracepoint_iter *iter);
 extern void tracepoint_iter_next(struct tracepoint_iter *iter);
 extern void tracepoint_iter_stop(struct tracepoint_iter *iter);
 extern void tracepoint_iter_reset(struct tracepoint_iter *iter);
-extern int tracepoint_get_iter_range(struct tracepoint **tracepoint,
-        struct tracepoint *begin, struct tracepoint *end);
+extern int tracepoint_get_iter_range(struct tracepoint * const **tracepoint,
+        struct tracepoint * const *begin, struct tracepoint * const *end);
 
 /*
  * tracepoint_synchronize_unregister must be called between the last tracepoint
@@ -84,11 +79,13 @@ static inline void tracepoint_synchronize_unregister(void)
 #define PARAMS(args...) args
 
 #ifdef CONFIG_TRACEPOINTS
-extern void tracepoint_update_probe_range(struct tracepoint *begin,
-        struct tracepoint *end);
+extern
+void tracepoint_update_probe_range(struct tracepoint * const *begin,
+        struct tracepoint * const *end);
 #else
-static inline void tracepoint_update_probe_range(struct tracepoint *begin,
-        struct tracepoint *end)
+static inline
+void tracepoint_update_probe_range(struct tracepoint * const *begin,
+        struct tracepoint * const *end)
 { }
 #endif /* CONFIG_TRACEPOINTS */
 
@@ -174,12 +171,20 @@ do_trace:								\
         {                                                               \
         }
 
+/*
+ * We have no guarantee that gcc and the linker won't up-align the tracepoint
+ * structures, so we create an array of pointers that will be used for iteration
+ * on the tracepoints.
+ */
 #define DEFINE_TRACE_FN(name, reg, unreg)                               \
         static const char __tpstrtab_##name[]                           \
         __attribute__((section("__tracepoints_strings"))) = #name;      \
         struct tracepoint __tracepoint_##name                           \
-        __attribute__((section("__tracepoints"), aligned(32))) =        \
-                { __tpstrtab_##name, 0, reg, unreg, NULL }
+        __attribute__((section("__tracepoints"))) =                     \
+                { __tpstrtab_##name, 0, reg, unreg, NULL };             \
+        static struct tracepoint * const __tracepoint_ptr_##name __used \
+        __attribute__((section("__tracepoints_ptrs"))) =                \
+                &__tracepoint_##name;
 
 #define DEFINE_TRACE(name)                                              \
         DEFINE_TRACE_FN(name, NULL, NULL);
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index dd6ee49a0844..a854fe89484e 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -112,6 +112,7 @@ struct usb_hcd {
         /* Flags that get set only during HCD registration or removal. */
         unsigned                rh_registered:1;/* is root hub registered? */
         unsigned                rh_pollable:1;  /* may we poll the root hub? */
+        unsigned                msix_enabled:1; /* driver has MSI-X enabled? */
 
         /* The next flag is a stopgap, to be removed when all the HCDs
          * support the new root-hub polling mechanism. */
diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
index 16d682f4f7c3..c9049139a7a5 100644
--- a/include/linux/usb/serial.h
+++ b/include/linux/usb/serial.h
@@ -347,6 +347,9 @@ extern int usb_serial_generic_prepare_write_buffer(struct usb_serial_port *port,
 extern int usb_serial_handle_sysrq_char(struct usb_serial_port *port,
                                         unsigned int ch);
 extern int usb_serial_handle_break(struct usb_serial_port *port);
+extern void usb_serial_handle_dcd_change(struct usb_serial_port *usb_port,
+                                         struct tty_struct *tty,
+                                         unsigned int status);
 
 
 extern int usb_serial_bus_register(struct usb_serial_driver *device);
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index a29feb01854e..d2cf88407690 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -184,6 +184,7 @@ struct hci_conn {
         __u32            link_mode;
         __u8             auth_type;
         __u8             sec_level;
+        __u8             pending_sec_level;
         __u8             power_save;
         __u16            disc_timeout;
         unsigned long    pend;
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 8a64b811a39a..b4c7c1cbcf40 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -195,7 +195,8 @@ static inline int genlmsg_end(struct sk_buff *skb, void *hdr)
  */
 static inline void genlmsg_cancel(struct sk_buff *skb, void *hdr)
 {
-        nlmsg_cancel(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
+        if (hdr)
+                nlmsg_cancel(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
 }
 
 /**
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h
index 96ba5f7dcab6..349cefedc9f3 100644
--- a/include/net/netfilter/nf_conntrack_ecache.h
+++ b/include/net/netfilter/nf_conntrack_ecache.h
@@ -77,9 +77,6 @@ nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
         if (e == NULL)
                 return;
 
-        if (!(e->ctmask & (1 << event)))
-                return;
-
         set_bit(event, &e->cache);
 }
 
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index e9eee99d8b1f..160a407c1963 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -445,7 +445,6 @@ static inline int __qdisc_enqueue_tail(struct sk_buff *skb, struct Qdisc *sch,
 {
         __skb_queue_tail(list, skb);
         sch->qstats.backlog += qdisc_pkt_len(skb);
-        qdisc_bstats_update(sch, skb);
 
         return NET_XMIT_SUCCESS;
 }
@@ -460,8 +459,10 @@ static inline struct sk_buff *__qdisc_dequeue_head(struct Qdisc *sch,
 {
         struct sk_buff *skb = __skb_dequeue(list);
 
-        if (likely(skb != NULL))
+        if (likely(skb != NULL)) {
                 sch->qstats.backlog -= qdisc_pkt_len(skb);
+                qdisc_bstats_update(sch, skb);
+        }
 
         return skb;
 }
@@ -474,10 +475,11 @@ static inline struct sk_buff *qdisc_dequeue_head(struct Qdisc *sch)
 static inline unsigned int __qdisc_queue_drop_head(struct Qdisc *sch,
                                               struct sk_buff_head *list)
 {
-        struct sk_buff *skb = __qdisc_dequeue_head(sch, list);
+        struct sk_buff *skb = __skb_dequeue(list);
 
         if (likely(skb != NULL)) {
                 unsigned int len = qdisc_pkt_len(skb);
+                sch->qstats.backlog -= len;
                 kfree_skb(skb);
                 return len;
         }
diff --git a/include/net/sock.h b/include/net/sock.h
index d884d268c704..bc1cf7d88ccb 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -753,6 +753,8 @@ struct proto {
                                         int level,
                                         int optname, char __user *optval,
                                         int __user *option);
+        int                     (*compat_ioctl)(struct sock *sk,
+                                        unsigned int cmd, unsigned long arg);
 #endif
         int                     (*sendmsg)(struct kiocb *iocb, struct sock *sk,
                                            struct msghdr *msg, size_t len);
diff --git a/include/scsi/scsi.h b/include/scsi/scsi.h
index 648d23358038..b76d4006e36d 100644
--- a/include/scsi/scsi.h
+++ b/include/scsi/scsi.h
@@ -9,6 +9,7 @@
 #define _SCSI_SCSI_H
 
 #include <linux/types.h>
+#include <linux/scatterlist.h>
 
 struct scsi_cmnd;
 
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index e16610c208c9..3e68366d485a 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -446,14 +446,16 @@ static inline notrace int ftrace_get_offsets_##call(			\
  *      .reg                    = ftrace_event_reg,
  * };
  *
- * static struct ftrace_event_call __used
- * __attribute__((__aligned__(4)))
- * __attribute__((section("_ftrace_events"))) event_<call> = {
+ * static struct ftrace_event_call event_<call> = {
  *      .name                   = "<call>",
  *      .class                  = event_class_<template>,
  *      .event                  = &ftrace_event_type_<call>,
  *      .print_fmt              = print_fmt_<call>,
  * };
+ * // its only safe to use pointers when doing linker tricks to
+ * // create an array.
+ * static struct ftrace_event_call __used
+ * __attribute__((section("_ftrace_events"))) *__event_<call> = &event_<call>;
  *
  */
 
@@ -579,28 +581,28 @@ static struct ftrace_event_class __used event_class_##call = {		\
 #undef DEFINE_EVENT
 #define DEFINE_EVENT(template, call, proto, args)                       \
                                                                         \
-static struct ftrace_event_call __used                                  \
-__attribute__((__aligned__(4)))                                         \
-__attribute__((section("_ftrace_events"))) event_##call = {             \
+static struct ftrace_event_call __used event_##call = {                 \
         .name                   = #call,                                \
         .class                  = &event_class_##template,              \
         .event.funcs            = &ftrace_event_type_funcs_##template,  \
         .print_fmt              = print_fmt_##template,                 \
-};
+};                                                                      \
+static struct ftrace_event_call __used                                  \
+__attribute__((section("_ftrace_events"))) *__event_##call = &event_##call
 
 #undef DEFINE_EVENT_PRINT
 #define DEFINE_EVENT_PRINT(template, call, proto, args, print)          \
                                                                         \
 static const char print_fmt_##call[] = print;                           \
                                                                         \
-static struct ftrace_event_call __used                                  \
-__attribute__((__aligned__(4)))                                         \
-__attribute__((section("_ftrace_events"))) event_##call = {             \
+static struct ftrace_event_call __used event_##call = {                 \
         .name                   = #call,                                \
         .class                  = &event_class_##template,              \
         .event.funcs            = &ftrace_event_type_funcs_##call,      \
         .print_fmt              = print_fmt_##call,                     \
-}
+};                                                                      \
+static struct ftrace_event_call __used                                  \
+__attribute__((section("_ftrace_events"))) *__event_##call = &event_##call
 
 #include TRACE_INCLUDE(TRACE_INCLUDE_FILE)
 
diff --git a/kernel/cred.c b/kernel/cred.c
index 6a1aa004e376..3a9d6dd53a6c 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -252,13 +252,13 @@ struct cred *cred_alloc_blank(void)
 #endif
 
         atomic_set(&new->usage, 1);
+#ifdef CONFIG_DEBUG_CREDENTIALS
+        new->magic = CRED_MAGIC;
+#endif
 
         if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
                 goto error;
 
-#ifdef CONFIG_DEBUG_CREDENTIALS
-        new->magic = CRED_MAGIC;
-#endif
         return new;
 
 error:
@@ -657,6 +657,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
         validate_creds(old);
 
         *new = *old;
+        atomic_set(&new->usage, 1);
+        set_cred_subscribers(new, 0);
         get_uid(new->user);
         get_group_info(new->group_info);
 
@@ -674,8 +676,6 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
         if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
                 goto error;
 
-        atomic_set(&new->usage, 1);
-        set_cred_subscribers(new, 0);
         put_cred(old);
         validate_creds(new);
         return new;
@@ -748,7 +748,11 @@ bool creds_are_invalid(const struct cred *cred)
         if (cred->magic != CRED_MAGIC)
                 return true;
 #ifdef CONFIG_SECURITY_SELINUX
-        if (selinux_is_enabled()) {
+        /*
+         * cred->security == NULL if security_cred_alloc_blank() or
+         * security_prepare_creds() returned an error.
+         */
+        if (selinux_is_enabled() && cred->security) {
                 if ((unsigned long) cred->security < PAGE_SIZE)
                         return true;
                 if ((*(u32 *)cred->security & 0xffffff00) ==
diff --git a/kernel/irq/migration.c b/kernel/irq/migration.c
index 1d2541940480..441fd629ff04 100644
--- a/kernel/irq/migration.c
+++ b/kernel/irq/migration.c
@@ -56,6 +56,7 @@ void move_masked_irq(int irq)
 void move_native_irq(int irq)
 {
         struct irq_desc *desc = irq_to_desc(irq);
+        bool masked;
 
         if (likely(!(desc->status & IRQ_MOVE_PENDING)))
                 return;
@@ -63,8 +64,15 @@ void move_native_irq(int irq)
         if (unlikely(desc->status & IRQ_DISABLED))
                 return;
 
-        desc->irq_data.chip->irq_mask(&desc->irq_data);
+        /*
+         * Be careful vs. already masked interrupts. If this is a
+         * threaded interrupt with ONESHOT set, we can end up with an
+         * interrupt storm.
+         */
+        masked = desc->status & IRQ_MASKED;
+        if (!masked)
+                desc->irq_data.chip->irq_mask(&desc->irq_data);
         move_masked_irq(irq);
-        desc->irq_data.chip->irq_unmask(&desc->irq_data);
+        if (!masked)
+                desc->irq_data.chip->irq_unmask(&desc->irq_data);
 }
-
diff --git a/kernel/module.c b/kernel/module.c
index 34e00b708fad..efa290ea94bf 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2460,9 +2460,9 @@ static void find_module_sections(struct module *mod, struct load_info *info)
 #endif
 
 #ifdef CONFIG_TRACEPOINTS
-        mod->tracepoints = section_objs(info, "__tracepoints",
-                                        sizeof(*mod->tracepoints),
-                                        &mod->num_tracepoints);
+        mod->tracepoints_ptrs = section_objs(info, "__tracepoints_ptrs",
+                                             sizeof(*mod->tracepoints_ptrs),
+                                             &mod->num_tracepoints);
 #endif
 #ifdef HAVE_JUMP_LABEL
         mod->jump_entries = section_objs(info, "__jump_table",
@@ -3393,7 +3393,7 @@ void module_layout(struct module *mod,
                    struct modversion_info *ver,
                    struct kernel_param *kp,
                    struct kernel_symbol *ks,
-                   struct tracepoint *tp)
+                   struct tracepoint * const *tp)
 {
 }
 EXPORT_SYMBOL(module_layout);
@@ -3407,8 +3407,8 @@ void module_update_tracepoints(void)
         mutex_lock(&module_mutex);
         list_for_each_entry(mod, &modules, list)
                 if (!mod->taints)
-                        tracepoint_update_probe_range(mod->tracepoints,
-                                mod->tracepoints + mod->num_tracepoints);
+                        tracepoint_update_probe_range(mod->tracepoints_ptrs,
+                                mod->tracepoints_ptrs + mod->num_tracepoints);
         mutex_unlock(&module_mutex);
 }
 
@@ -3432,8 +3432,8 @@ int module_get_iter_tracepoints(struct tracepoint_iter *iter)
                         else if (iter_mod > iter->module)
                                 iter->tracepoint = NULL;
                         found = tracepoint_get_iter_range(&iter->tracepoint,
-                                iter_mod->tracepoints,
-                                iter_mod->tracepoints
+                                iter_mod->tracepoints_ptrs,
+                                iter_mod->tracepoints_ptrs
                                         + iter_mod->num_tracepoints);
                         if (found) {
                                 iter->module = iter_mod;
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 126a302c481c..999835b6112b 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -1901,11 +1901,12 @@ static void __perf_event_read(void *info)
                 return;
 
         raw_spin_lock(&ctx->lock);
-        update_context_time(ctx);
+        if (ctx->is_active)
+                update_context_time(ctx);
         update_event_times(event);
+        if (event->state == PERF_EVENT_STATE_ACTIVE)
+                event->pmu->read(event);
         raw_spin_unlock(&ctx->lock);
-
-        event->pmu->read(event);
 }
 
 static inline u64 perf_event_count(struct perf_event *event)
@@ -1999,8 +2000,7 @@ static int alloc_callchain_buffers(void)
          * accessed from NMI. Use a temporary manual per cpu allocation
          * until that gets sorted out.
          */
-        size = sizeof(*entries) + sizeof(struct perf_callchain_entry *) *
-                num_possible_cpus();
+        size = offsetof(struct callchain_cpus_entries, cpu_entries[nr_cpu_ids]);
 
         entries = kzalloc(size, GFP_KERNEL);
         if (!entries)
diff --git a/kernel/printk.c b/kernel/printk.c
index 53d9a9ec88e6..2ddbdc73aade 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -97,7 +97,7 @@ static int console_locked, console_suspended;
 /*
  * logbuf_lock protects log_buf, log_start, log_end, con_start and logged_chars
  * It is also used in interesting ways to provide interlocking in
- * release_console_sem().
+ * console_unlock();.
  */
 static DEFINE_SPINLOCK(logbuf_lock);
 
@@ -501,7 +501,7 @@ static void _call_console_drivers(unsigned start,
 /*
  * Call the console drivers, asking them to write out
  * log_buf[start] to log_buf[end - 1].
- * The console_sem must be held.
+ * The console_lock must be held.
  */
 static void call_console_drivers(unsigned start, unsigned end)
 {
@@ -604,11 +604,11 @@ static int have_callable_console(void)
  *
  * This is printk().  It can be called from any context.  We want it to work.
  *
- * We try to grab the console_sem.  If we succeed, it's easy - we log the output and
+ * We try to grab the console_lock.  If we succeed, it's easy - we log the output and
  * call the console drivers.  If we fail to get the semaphore we place the output
  * into the log buffer and return.  The current holder of the console_sem will
- * notice the new output in release_console_sem() and will send it to the
- * consoles before releasing the semaphore.
+ * notice the new output in console_unlock(); and will send it to the
+ * consoles before releasing the lock.
  *
  * One effect of this deferred printing is that code which calls printk() and
  * then changes console_loglevel may break. This is because console_loglevel
@@ -659,19 +659,19 @@ static inline int can_use_console(unsigned int cpu)
 /*
  * Try to get console ownership to actually show the kernel
  * messages from a 'printk'. Return true (and with the
- * console_semaphore held, and 'console_locked' set) if it
+ * console_lock held, and 'console_locked' set) if it
  * is successful, false otherwise.
  *
  * This gets called with the 'logbuf_lock' spinlock held and
  * interrupts disabled. It should return with 'lockbuf_lock'
  * released but interrupts still disabled.
  */
-static int acquire_console_semaphore_for_printk(unsigned int cpu)
+static int console_trylock_for_printk(unsigned int cpu)
         __releases(&logbuf_lock)
 {
         int retval = 0;
 
-        if (!try_acquire_console_sem()) {
+        if (console_trylock()) {
                 retval = 1;
 
                 /*
@@ -827,12 +827,12 @@ asmlinkage int vprintk(const char *fmt, va_list args)
          * actual magic (print out buffers, wake up klogd,
          * etc). 
          *
-         * The acquire_console_semaphore_for_printk() function
+         * The console_trylock_for_printk() function
          * will release 'logbuf_lock' regardless of whether it
          * actually gets the semaphore or not.
          */
-        if (acquire_console_semaphore_for_printk(this_cpu))
-                release_console_sem();
+        if (console_trylock_for_printk(this_cpu))
+                console_unlock();
 
         lockdep_on();
 out_restore_irqs:
@@ -993,7 +993,7 @@ void suspend_console(void)
         if (!console_suspend_enabled)
                 return;
         printk("Suspending console(s) (use no_console_suspend to debug)\n");
-        acquire_console_sem();
+        console_lock();
         console_suspended = 1;
         up(&console_sem);
 }
@@ -1004,7 +1004,7 @@ void resume_console(void)
                 return;
         down(&console_sem);
         console_suspended = 0;
-        release_console_sem();
+        console_unlock();
 }
 
 /**
@@ -1027,21 +1027,21 @@ static int __cpuinit console_cpu_notify(struct notifier_block *self,
         case CPU_DYING:
         case CPU_DOWN_FAILED:
         case CPU_UP_CANCELED:
-                acquire_console_sem();
-                release_console_sem();
+                console_lock();
+                console_unlock();
         }
         return NOTIFY_OK;
 }
 
 /**
- * acquire_console_sem - lock the console system for exclusive use.
+ * console_lock - lock the console system for exclusive use.
  *
- * Acquires a semaphore which guarantees that the caller has
+ * Acquires a lock which guarantees that the caller has
  * exclusive access to the console system and the console_drivers list.
  *
  * Can sleep, returns nothing.
  */
-void acquire_console_sem(void)
+void console_lock(void)
 {
         BUG_ON(in_interrupt());
         down(&console_sem);
@@ -1050,21 +1050,29 @@ void acquire_console_sem(void)
         console_locked = 1;
         console_may_schedule = 1;
 }
-EXPORT_SYMBOL(acquire_console_sem);
+EXPORT_SYMBOL(console_lock);
 
-int try_acquire_console_sem(void)
+/**
+ * console_trylock - try to lock the console system for exclusive use.
+ *
+ * Tried to acquire a lock which guarantees that the caller has
+ * exclusive access to the console system and the console_drivers list.
+ *
+ * returns 1 on success, and 0 on failure to acquire the lock.
+ */
+int console_trylock(void)
 {
         if (down_trylock(&console_sem))
-                return -1;
+                return 0;
         if (console_suspended) {
                 up(&console_sem);
-                return -1;
+                return 0;
         }
         console_locked = 1;
         console_may_schedule = 0;
-        return 0;
+        return 1;
 }
-EXPORT_SYMBOL(try_acquire_console_sem);
+EXPORT_SYMBOL(console_trylock);
 
 int is_console_locked(void)
 {
@@ -1095,20 +1103,20 @@ void wake_up_klogd(void)
 }
 
 /**
- * release_console_sem - unlock the console system
+ * console_unlock - unlock the console system
  *
- * Releases the semaphore which the caller holds on the console system
+ * Releases the console_lock which the caller holds on the console system
  * and the console driver list.
  *
- * While the semaphore was held, console output may have been buffered
- * by printk().  If this is the case, release_console_sem() emits
- * the output prior to releasing the semaphore.
+ * While the console_lock was held, console output may have been buffered
+ * by printk().  If this is the case, console_unlock(); emits
+ * the output prior to releasing the lock.
  *
  * If there is output waiting for klogd, we wake it up.
  *
- * release_console_sem() may be called from any context.
+ * console_unlock(); may be called from any context.
  */
-void release_console_sem(void)
+void console_unlock(void)
 {
         unsigned long flags;
         unsigned _con_start, _log_end;
@@ -1141,7 +1149,7 @@ void release_console_sem(void)
         if (wake_klogd)
                 wake_up_klogd();
 }
-EXPORT_SYMBOL(release_console_sem);
+EXPORT_SYMBOL(console_unlock);
 
 /**
  * console_conditional_schedule - yield the CPU if required
@@ -1150,7 +1158,7 @@ EXPORT_SYMBOL(release_console_sem);
  * if this CPU should yield the CPU to another task, do
  * so here.
  *
- * Must be called within acquire_console_sem().
+ * Must be called within console_lock();.
  */
 void __sched console_conditional_schedule(void)
 {
@@ -1171,14 +1179,14 @@ void console_unblank(void)
                 if (down_trylock(&console_sem) != 0)
                         return;
         } else
-                acquire_console_sem();
+                console_lock();
 
         console_locked = 1;
         console_may_schedule = 0;
         for_each_console(c)
                 if ((c->flags & CON_ENABLED) && c->unblank)
                         c->unblank();
-        release_console_sem();
+        console_unlock();
 }
 
 /*
@@ -1189,7 +1197,7 @@ struct tty_driver *console_device(int *index)
         struct console *c;
         struct tty_driver *driver = NULL;
 
-        acquire_console_sem();
+        console_lock();
         for_each_console(c) {
                 if (!c->device)
                         continue;
@@ -1197,7 +1205,7 @@ struct tty_driver *console_device(int *index)
                 if (driver)
                         break;
         }
-        release_console_sem();
+        console_unlock();
         return driver;
 }
 
@@ -1208,17 +1216,17 @@ struct tty_driver *console_device(int *index)
  */
 void console_stop(struct console *console)
 {
-        acquire_console_sem();
+        console_lock();
         console->flags &= ~CON_ENABLED;
-        release_console_sem();
+        console_unlock();
 }
 EXPORT_SYMBOL(console_stop);
 
 void console_start(struct console *console)
 {
-        acquire_console_sem();
+        console_lock();
         console->flags |= CON_ENABLED;
-        release_console_sem();
+        console_unlock();
 }
 EXPORT_SYMBOL(console_start);
 
@@ -1340,7 +1348,7 @@ void register_console(struct console *newcon)
          *      Put this console in the list - keep the
          *      preferred driver at the head of the list.
          */
-        acquire_console_sem();
+        console_lock();
         if ((newcon->flags & CON_CONSDEV) || console_drivers == NULL) {
                 newcon->next = console_drivers;
                 console_drivers = newcon;
@@ -1352,14 +1360,14 @@ void register_console(struct console *newcon)
         }
         if (newcon->flags & CON_PRINTBUFFER) {
                 /*
-                 * release_console_sem() will print out the buffered messages
+                 * console_unlock(); will print out the buffered messages
                  * for us.
                  */
                 spin_lock_irqsave(&logbuf_lock, flags);
                 con_start = log_start;
                 spin_unlock_irqrestore(&logbuf_lock, flags);
         }
-        release_console_sem();
+        console_unlock();
         console_sysfs_notify();
 
         /*
@@ -1396,7 +1404,7 @@ int unregister_console(struct console *console)
                 return braille_unregister_console(console);
 #endif
 
-        acquire_console_sem();
+        console_lock();
         if (console_drivers == console) {
                 console_drivers=console->next;
                 res = 0;
@@ -1418,7 +1426,7 @@ int unregister_console(struct console *console)
         if (console_drivers != NULL && console->flags & CON_CONSDEV)
                 console_drivers->flags |= CON_CONSDEV;
 
-        release_console_sem();
+        console_unlock();
         console_sysfs_notify();
         return res;
 }
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 354769979c02..0c26e2df450e 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -722,10 +722,10 @@ static void update_cfs_load(struct cfs_rq *cfs_rq, int global_update)
         u64 now, delta;
         unsigned long load = cfs_rq->load.weight;
 
-        if (!cfs_rq)
+        if (cfs_rq->tg == &root_task_group)
                 return;
 
-        now = rq_of(cfs_rq)->clock;
+        now = rq_of(cfs_rq)->clock_task;
         delta = now - cfs_rq->load_stamp;
 
         /* truncate load history at 4 idle periods */
@@ -830,9 +830,6 @@ static void update_cfs_shares(struct cfs_rq *cfs_rq, long weight_delta)
         struct sched_entity *se;
         long shares;
 
-        if (!cfs_rq)
-                return;
-
         tg = cfs_rq->tg;
         se = tg->se[cpu_of(rq_of(cfs_rq))];
         if (!se)
@@ -1432,7 +1429,7 @@ static inline unsigned long effective_load(struct task_group *tg, int cpu,
 
 static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
 {
-        unsigned long this_load, load;
+        s64 this_load, load;
         int idx, this_cpu, prev_cpu;
         unsigned long tl_per_task;
         struct task_group *tg;
@@ -1471,8 +1468,8 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
          * Otherwise check if either cpus are near enough in load to allow this
          * task to be woken on this_cpu.
          */
-        if (this_load) {
-                unsigned long this_eff_load, prev_eff_load;
+        if (this_load > 0) {
+                s64 this_eff_load, prev_eff_load;
 
                 this_eff_load = 100;
                 this_eff_load *= power_of(prev_cpu);
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index c914ec747ca6..ad6267714c84 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -625,7 +625,7 @@ static void update_curr_rt(struct rq *rq)
         struct rt_rq *rt_rq = rt_rq_of_se(rt_se);
         u64 delta_exec;
 
-        if (!task_has_rt_policy(curr))
+        if (curr->sched_class != &rt_sched_class)
                 return;
 
         delta_exec = rq->clock_task - curr->se.exec_start;
diff --git a/kernel/sys.c b/kernel/sys.c
index 31b71a276b40..18da702ec813 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1385,7 +1385,8 @@ static int check_prlimit_permission(struct task_struct *task)
         const struct cred *cred = current_cred(), *tcred;
 
         tcred = __task_cred(task);
-        if ((cred->uid != tcred->euid ||
+        if (current != task &&
+            (cred->uid != tcred->euid ||
              cred->uid != tcred->suid ||
              cred->uid != tcred->uid  ||
              cred->gid != tcred->egid ||
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index bc86bb32e126..0f1bd83db985 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -170,7 +170,8 @@ static int proc_taint(struct ctl_table *table, int write,
 #endif
 
 #ifdef CONFIG_MAGIC_SYSRQ
-static int __sysrq_enabled; /* Note: sysrq code ises it's own private copy */
+/* Note: sysrq code uses it's own private copy */
+static int __sysrq_enabled = SYSRQ_DEFAULT_ENABLE;
 
 static int sysrq_sysctl_handler(ctl_table *table, int write,
                                 void __user *buffer, size_t *lenp,
diff --git a/kernel/timer.c b/kernel/timer.c
index 43ca9936f2d0..d53ce66daea0 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -969,10 +969,14 @@ EXPORT_SYMBOL(try_to_del_timer_sync);
 int del_timer_sync(struct timer_list *timer)
 {
 #ifdef CONFIG_LOCKDEP
+        unsigned long flags;
+
+        raw_local_irq_save(flags);
         local_bh_disable();
         lock_map_acquire(&timer->lockdep_map);
         lock_map_release(&timer->lockdep_map);
-        local_bh_enable();
+        _local_bh_enable();
+        raw_local_irq_restore(flags);
 #endif
         /*
          * don't use it in hardirq context, because it
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 35fde09b81de..5f499e0438a4 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1284,7 +1284,7 @@ trace_create_file_ops(struct module *mod)
 static void trace_module_add_events(struct module *mod)
 {
         struct ftrace_module_file_ops *file_ops = NULL;
-        struct ftrace_event_call *call, *start, *end;
+        struct ftrace_event_call **call, **start, **end;
 
         start = mod->trace_events;
         end = mod->trace_events + mod->num_trace_events;
@@ -1297,7 +1297,7 @@ static void trace_module_add_events(struct module *mod)
                 return;
 
         for_each_event(call, start, end) {
-                __trace_add_event_call(call, mod,
+                __trace_add_event_call(*call, mod,
                                        &file_ops->id, &file_ops->enable,
                                        &file_ops->filter, &file_ops->format);
         }
@@ -1367,8 +1367,8 @@ static struct notifier_block trace_module_nb = {
         .priority = 0,
 };
 
-extern struct ftrace_event_call __start_ftrace_events[];
-extern struct ftrace_event_call __stop_ftrace_events[];
+extern struct ftrace_event_call *__start_ftrace_events[];
+extern struct ftrace_event_call *__stop_ftrace_events[];
 
 static char bootup_event_buf[COMMAND_LINE_SIZE] __initdata;
 
@@ -1384,7 +1384,7 @@ __setup("trace_event=", setup_trace_event);
 
 static __init int event_trace_init(void)
 {
-        struct ftrace_event_call *call;
+        struct ftrace_event_call **call;
         struct dentry *d_tracer;
         struct dentry *entry;
         struct dentry *d_events;
@@ -1430,7 +1430,7 @@ static __init int event_trace_init(void)
                 pr_warning("tracing: Failed to allocate common fields");
 
         for_each_event(call, __start_ftrace_events, __stop_ftrace_events) {
-                __trace_add_event_call(call, NULL, &ftrace_event_id_fops,
+                __trace_add_event_call(*call, NULL, &ftrace_event_id_fops,
                                        &ftrace_enable_fops,
                                        &ftrace_event_filter_fops,
                                        &ftrace_event_format_fops);
diff --git a/kernel/trace/trace_export.c b/kernel/trace/trace_export.c
index 4b74d71705c0..bbeec31e0ae3 100644
--- a/kernel/trace/trace_export.c
+++ b/kernel/trace/trace_export.c
@@ -161,13 +161,13 @@ struct ftrace_event_class event_class_ftrace_##call = {			\
         .fields                 = LIST_HEAD_INIT(event_class_ftrace_##call.fields),\
 };                                                                      \
                                                                         \
-struct ftrace_event_call __used                                         \
-__attribute__((__aligned__(4)))                                         \
-__attribute__((section("_ftrace_events"))) event_##call = {             \
+struct ftrace_event_call __used event_##call = {                        \
         .name                   = #call,                                \
         .event.type             = etype,                                \
         .class                  = &event_class_ftrace_##call,           \
         .print_fmt              = print,                                \
 };                                                                      \
+struct ftrace_event_call __used                                         \
+__attribute__((section("_ftrace_events"))) *__event_##call = &event_##call;
 
 #include "trace_entries.h"
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index b706529b4fc7..5c9fe08d2093 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -55,20 +55,21 @@ struct ftrace_event_class event_class_syscall_exit = {
         .raw_init       = init_syscall_trace,
 };
 
-extern unsigned long __start_syscalls_metadata[];
-extern unsigned long __stop_syscalls_metadata[];
+extern struct syscall_metadata *__start_syscalls_metadata[];
+extern struct syscall_metadata *__stop_syscalls_metadata[];
 
 static struct syscall_metadata **syscalls_metadata;
 
-static struct syscall_metadata *find_syscall_meta(unsigned long syscall)
+static __init struct syscall_metadata *
+find_syscall_meta(unsigned long syscall)
 {
-        struct syscall_metadata *start;
-        struct syscall_metadata *stop;
+        struct syscall_metadata **start;
+        struct syscall_metadata **stop;
         char str[KSYM_SYMBOL_LEN];
 
 
-        start = (struct syscall_metadata *)__start_syscalls_metadata;
-        stop = (struct syscall_metadata *)__stop_syscalls_metadata;
+        start = __start_syscalls_metadata;
+        stop = __stop_syscalls_metadata;
         kallsyms_lookup(syscall, NULL, NULL, NULL, str);
 
         for ( ; start < stop; start++) {
@@ -78,8 +79,8 @@ static struct syscall_metadata *find_syscall_meta(unsigned long syscall)
                  * with "SyS" instead of "sys", leading to an unwanted
                  * mismatch.
                  */
-                if (start->name && !strcmp(start->name + 3, str + 3))
-                        return start;
+                if ((*start)->name && !strcmp((*start)->name + 3, str + 3))
+                        return *start;
         }
         return NULL;
 }
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index e95ee7f31d43..68187af4889e 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -27,8 +27,8 @@
 #include <linux/sched.h>
 #include <linux/jump_label.h>
 
-extern struct tracepoint __start___tracepoints[];
-extern struct tracepoint __stop___tracepoints[];
+extern struct tracepoint * const __start___tracepoints_ptrs[];
+extern struct tracepoint * const __stop___tracepoints_ptrs[];
 
 /* Set to 1 to enable tracepoint debug output */
 static const int tracepoint_debug;
@@ -298,10 +298,10 @@ static void disable_tracepoint(struct tracepoint *elem)
  *
  * Updates the probe callback corresponding to a range of tracepoints.
  */
-void
-tracepoint_update_probe_range(struct tracepoint *begin, struct tracepoint *end)
+void tracepoint_update_probe_range(struct tracepoint * const *begin,
+                                   struct tracepoint * const *end)
 {
-        struct tracepoint *iter;
+        struct tracepoint * const *iter;
         struct tracepoint_entry *mark_entry;
 
         if (!begin)
@@ -309,12 +309,12 @@ tracepoint_update_probe_range(struct tracepoint *begin, struct tracepoint *end)
 
         mutex_lock(&tracepoints_mutex);
         for (iter = begin; iter < end; iter++) {
-                mark_entry = get_tracepoint(iter->name);
+                mark_entry = get_tracepoint((*iter)->name);
                 if (mark_entry) {
-                        set_tracepoint(&mark_entry, iter,
+                        set_tracepoint(&mark_entry, *iter,
                                         !!mark_entry->refcount);
                 } else {
-                        disable_tracepoint(iter);
+                        disable_tracepoint(*iter);
                 }
         }
         mutex_unlock(&tracepoints_mutex);
@@ -326,8 +326,8 @@ tracepoint_update_probe_range(struct tracepoint *begin, struct tracepoint *end)
 static void tracepoint_update_probes(void)
 {
         /* Core kernel tracepoints */
-        tracepoint_update_probe_range(__start___tracepoints,
-                __stop___tracepoints);
+        tracepoint_update_probe_range(__start___tracepoints_ptrs,
+                __stop___tracepoints_ptrs);
         /* tracepoints in modules. */
         module_update_tracepoints();
 }
@@ -514,8 +514,8 @@ EXPORT_SYMBOL_GPL(tracepoint_probe_update_all);
  * Will return the first tracepoint in the range if the input tracepoint is
  * NULL.
  */
-int tracepoint_get_iter_range(struct tracepoint **tracepoint,
-        struct tracepoint *begin, struct tracepoint *end)
+int tracepoint_get_iter_range(struct tracepoint * const **tracepoint,
+        struct tracepoint * const *begin, struct tracepoint * const *end)
 {
         if (!*tracepoint && begin != end) {
                 *tracepoint = begin;
@@ -534,7 +534,8 @@ static void tracepoint_get_iter(struct tracepoint_iter *iter)
         /* Core kernel tracepoints */
         if (!iter->module) {
                 found = tracepoint_get_iter_range(&iter->tracepoint,
-                                __start___tracepoints, __stop___tracepoints);
+                                __start___tracepoints_ptrs,
+                                __stop___tracepoints_ptrs);
                 if (found)
                         goto end;
         }
@@ -585,8 +586,8 @@ int tracepoint_module_notify(struct notifier_block *self,
         switch (val) {
         case MODULE_STATE_COMING:
         case MODULE_STATE_GOING:
-                tracepoint_update_probe_range(mod->tracepoints,
-                        mod->tracepoints + mod->num_tracepoints);
+                tracepoint_update_probe_range(mod->tracepoints_ptrs,
+                        mod->tracepoints_ptrs + mod->num_tracepoints);
                 break;
         }
         return 0;
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index d7ebdf4cea98..f37f974aa81b 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -27,7 +27,7 @@
 #include <asm/irq_regs.h>
 #include <linux/perf_event.h>
 
-int watchdog_enabled;
+int watchdog_enabled = 1;
 int __read_mostly softlockup_thresh = 60;
 
 static DEFINE_PER_CPU(unsigned long, watchdog_touch_ts);
@@ -43,9 +43,6 @@ static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts_saved);
 static DEFINE_PER_CPU(struct perf_event *, watchdog_ev);
 #endif
 
-static int no_watchdog;
-
-
 /* boot commands */
 /*
  * Should we panic when a soft-lockup or hard-lockup occurs:
@@ -58,7 +55,7 @@ static int __init hardlockup_panic_setup(char *str)
         if (!strncmp(str, "panic", 5))
                 hardlockup_panic = 1;
         else if (!strncmp(str, "0", 1))
-                no_watchdog = 1;
+                watchdog_enabled = 0;
         return 1;
 }
 __setup("nmi_watchdog=", hardlockup_panic_setup);
@@ -77,7 +74,7 @@ __setup("softlockup_panic=", softlockup_panic_setup);
 
 static int __init nowatchdog_setup(char *str)
 {
-        no_watchdog = 1;
+        watchdog_enabled = 0;
         return 1;
 }
 __setup("nowatchdog", nowatchdog_setup);
@@ -85,7 +82,7 @@ __setup("nowatchdog", nowatchdog_setup);
 /* deprecated */
 static int __init nosoftlockup_setup(char *str)
 {
-        no_watchdog = 1;
+        watchdog_enabled = 0;
         return 1;
 }
 __setup("nosoftlockup", nosoftlockup_setup);
@@ -432,9 +429,6 @@ static int watchdog_enable(int cpu)
                 wake_up_process(p);
         }
 
-        /* if any cpu succeeds, watchdog is considered enabled for the system */
-        watchdog_enabled = 1;
-
         return 0;
 }
 
@@ -462,12 +456,16 @@ static void watchdog_disable(int cpu)
 static void watchdog_enable_all_cpus(void)
 {
         int cpu;
-        int result = 0;
+
+        watchdog_enabled = 0;
 
         for_each_online_cpu(cpu)
-                result += watchdog_enable(cpu);
+                if (!watchdog_enable(cpu))
+                        /* if any cpu succeeds, watchdog is considered
+                           enabled for the system */
+                        watchdog_enabled = 1;
 
-        if (result)
+        if (!watchdog_enabled)
                 printk(KERN_ERR "watchdog: failed to be enabled on some cpus\n");
 
 }
@@ -476,9 +474,6 @@ static void watchdog_disable_all_cpus(void)
 {
         int cpu;
 
-        if (no_watchdog)
-                return;
-
         for_each_online_cpu(cpu)
                 watchdog_disable(cpu);
 
@@ -498,10 +493,12 @@ int proc_dowatchdog_enabled(struct ctl_table *table, int write,
 {
         proc_dointvec(table, write, buffer, length, ppos);
 
-        if (watchdog_enabled)
-                watchdog_enable_all_cpus();
-        else
-                watchdog_disable_all_cpus();
+        if (write) {
+                if (watchdog_enabled)
+                        watchdog_enable_all_cpus();
+                else
+                        watchdog_disable_all_cpus();
+        }
         return 0;
 }
 
@@ -530,7 +527,8 @@ cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
                 break;
         case CPU_ONLINE:
         case CPU_ONLINE_FROZEN:
-                err = watchdog_enable(hotcpu);
+                if (watchdog_enabled)
+                        err = watchdog_enable(hotcpu);
                 break;
 #ifdef CONFIG_HOTPLUG_CPU
         case CPU_UP_CANCELED:
@@ -555,9 +553,6 @@ void __init lockup_detector_init(void)
         void *cpu = (void *)(long)smp_processor_id();
         int err;
 
-        if (no_watchdog)
-                return;
-
         err = cpu_callback(&cpu_nfb, CPU_UP_PREPARE, cpu);
         WARN_ON(notifier_to_errno(err));
 
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 5086bb962b4d..7ea2e033d715 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -736,10 +736,11 @@ next:
                 }
         }
         /*
-         * The iftag must have been set somewhere because otherwise
-         * we would return immediated at the beginning of the function
+         * We need not to tag the root tag if there is no tag which is set with
+         * settag within the range from *first_indexp to last_index.
          */
-        root_tag_set(root, settag);
+        if (tagged > 0)
+                root_tag_set(root, settag);
         *first_indexp = index;
 
         return tagged;
diff --git a/lib/rbtree.c b/lib/rbtree.c
index 4693f79195d3..a16be19a1305 100644
--- a/lib/rbtree.c
+++ b/lib/rbtree.c
@@ -315,6 +315,7 @@ void rb_augment_insert(struct rb_node *node, rb_augment_f func, void *data)
 
         rb_augment_path(node, func, data);
 }
+EXPORT_SYMBOL(rb_augment_insert);
 
 /*
  * before removing the node, find the deepest node on the rebalance path
@@ -340,6 +341,7 @@ struct rb_node *rb_augment_erase_begin(struct rb_node *node)
 
         return deepest;
 }
+EXPORT_SYMBOL(rb_augment_erase_begin);
 
 /*
  * after removal, update the tree to account for the removed entry
@@ -350,6 +352,7 @@ void rb_augment_erase_end(struct rb_node *node, rb_augment_f func, void *data)
         if (node)
                 rb_augment_path(node, func, data);
 }
+EXPORT_SYMBOL(rb_augment_erase_end);
 
 /*
  * This function returns the first node (in sort order) of the tree.
diff --git a/lib/textsearch.c b/lib/textsearch.c
index d608331b3e47..e0cc0146ae62 100644
--- a/lib/textsearch.c
+++ b/lib/textsearch.c
@@ -13,7 +13,7 @@
  *
  * INTRODUCTION
  *
- *   The textsearch infrastructure provides text searching facitilies for
+ *   The textsearch infrastructure provides text searching facilities for
  *   both linear and non-linear data. Individual search algorithms are
  *   implemented in modules and chosen by the user.
  *
@@ -43,7 +43,7 @@
  *       to the algorithm to store persistent variables.
  *   (4) Core eventually resets the search offset and forwards the find()
  *       request to the algorithm.
- *   (5) Algorithm calls get_next_block() provided by the user continously
+ *   (5) Algorithm calls get_next_block() provided by the user continuously
  *       to fetch the data to be searched in block by block.
  *   (6) Algorithm invokes finish() after the last call to get_next_block
  *       to clean up any leftovers from get_next_block. (Optional)
@@ -58,15 +58,15 @@
  *   the pattern to look for and flags. As a flag, you can set TS_IGNORECASE
  *   to perform case insensitive matching. But it might slow down
  *   performance of algorithm, so you should use it at own your risk.
- *   The returned configuration may then be used for an arbitary
+ *   The returned configuration may then be used for an arbitrary
  *   amount of times and even in parallel as long as a separate struct
  *   ts_state variable is provided to every instance.
  *
  *   The actual search is performed by either calling textsearch_find_-
  *   continuous() for linear data or by providing an own get_next_block()
  *   implementation and calling textsearch_find(). Both functions return
- *   the position of the first occurrence of the patern or UINT_MAX if
- *   no match was found. Subsequent occurences can be found by calling
+ *   the position of the first occurrence of the pattern or UINT_MAX if
+ *   no match was found. Subsequent occurrences can be found by calling
  *   textsearch_next() regardless of the linearity of the data.
  *
  *   Once you're done using a configuration it must be given back via
diff --git a/mm/Kconfig b/mm/Kconfig
index 3ad483bdf505..e9c0c61f2ddd 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -179,7 +179,7 @@ config SPLIT_PTLOCK_CPUS
 config COMPACTION
         bool "Allow for memory compaction"
         select MIGRATION
-        depends on EXPERIMENTAL && HUGETLB_PAGE && MMU
+        depends on MMU
         help
           Allows the compaction of memory for the allocation of huge pages.
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index e187454d82f6..b6c1ce3c53b5 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1162,7 +1162,12 @@ static void __split_huge_page_refcount(struct page *page)
                 /* after clearing PageTail the gup refcount can be released */
                 smp_mb();
 
-                page_tail->flags &= ~PAGE_FLAGS_CHECK_AT_PREP;
+                /*
+                 * retain hwpoison flag of the poisoned tail page:
+                 *   fix for the unsuitable process killed on Guest Machine(KVM)
+                 *   by the memory-failure.
+                 */
+                page_tail->flags &= ~PAGE_FLAGS_CHECK_AT_PREP | __PG_HWPOISON;
                 page_tail->flags |= (page->flags &
                                      ((1L << PG_referenced) |
                                       (1L << PG_swapbacked) |
diff --git a/mm/kmemleak-test.c b/mm/kmemleak-test.c
index 177a5169bbde..ff0d9779cec8 100644
--- a/mm/kmemleak-test.c
+++ b/mm/kmemleak-test.c
@@ -75,13 +75,11 @@ static int __init kmemleak_test_init(void)
          * after the module is removed.
          */
         for (i = 0; i < 10; i++) {
-                elem = kmalloc(sizeof(*elem), GFP_KERNEL);
-                pr_info("kmemleak: kmalloc(sizeof(*elem)) = %p\n", elem);
+                elem = kzalloc(sizeof(*elem), GFP_KERNEL);
+                pr_info("kmemleak: kzalloc(sizeof(*elem)) = %p\n", elem);
                 if (!elem)
                         return -ENOMEM;
-                memset(elem, 0, sizeof(*elem));
                 INIT_LIST_HEAD(&elem->list);
-
                 list_add_tail(&elem->list, &test_list);
         }
 
diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index bd9bc214091b..84225f3b7190 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -113,7 +113,9 @@
 #define BYTES_PER_POINTER       sizeof(void *)
 
 /* GFP bitmask for kmemleak internal allocations */
-#define GFP_KMEMLEAK_MASK       (GFP_KERNEL | GFP_ATOMIC)
+#define gfp_kmemleak_mask(gfp)  (((gfp) & (GFP_KERNEL | GFP_ATOMIC)) | \
+                                 __GFP_NORETRY | __GFP_NOMEMALLOC | \
+                                 __GFP_NOWARN)
 
 /* scanning area inside a memory block */
 struct kmemleak_scan_area {
@@ -511,9 +513,10 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
         struct kmemleak_object *object;
         struct prio_tree_node *node;
 
-        object = kmem_cache_alloc(object_cache, gfp & GFP_KMEMLEAK_MASK);
+        object = kmem_cache_alloc(object_cache, gfp_kmemleak_mask(gfp));
         if (!object) {
-                kmemleak_stop("Cannot allocate a kmemleak_object structure\n");
+                pr_warning("Cannot allocate a kmemleak_object structure\n");
+                kmemleak_disable();
                 return NULL;
         }
 
@@ -734,9 +737,9 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp)
                 return;
         }
 
-        area = kmem_cache_alloc(scan_area_cache, gfp & GFP_KMEMLEAK_MASK);
+        area = kmem_cache_alloc(scan_area_cache, gfp_kmemleak_mask(gfp));
         if (!area) {
-                kmemleak_warn("Cannot allocate a scan area\n");
+                pr_warning("Cannot allocate a scan area\n");
                 goto out;
         }
 
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index db76ef726293..da53a252b259 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -612,8 +612,10 @@ static void mem_cgroup_charge_statistics(struct mem_cgroup *mem,
         /* pagein of a big page is an event. So, ignore page size */
         if (nr_pages > 0)
                 __this_cpu_inc(mem->stat->count[MEM_CGROUP_STAT_PGPGIN_COUNT]);
-        else
+        else {
                 __this_cpu_inc(mem->stat->count[MEM_CGROUP_STAT_PGPGOUT_COUNT]);
+                nr_pages = -nr_pages; /* for event */
+        }
 
         __this_cpu_add(mem->stat->count[MEM_CGROUP_EVENTS], nr_pages);
 
@@ -1111,6 +1113,23 @@ static bool mem_cgroup_check_under_limit(struct mem_cgroup *mem)
         return false;
 }
 
+/**
+ * mem_cgroup_check_margin - check if the memory cgroup allows charging
+ * @mem: memory cgroup to check
+ * @bytes: the number of bytes the caller intends to charge
+ *
+ * Returns a boolean value on whether @mem can be charged @bytes or
+ * whether this would exceed the limit.
+ */
+static bool mem_cgroup_check_margin(struct mem_cgroup *mem, unsigned long bytes)
+{
+        if (!res_counter_check_margin(&mem->res, bytes))
+                return false;
+        if (do_swap_account && !res_counter_check_margin(&mem->memsw, bytes))
+                return false;
+        return true;
+}
+
 static unsigned int get_swappiness(struct mem_cgroup *memcg)
 {
         struct cgroup *cgrp = memcg->css.cgroup;
@@ -1832,27 +1851,39 @@ static int __mem_cgroup_do_charge(struct mem_cgroup *mem, gfp_t gfp_mask,
                 if (likely(!ret))
                         return CHARGE_OK;
 
+                res_counter_uncharge(&mem->res, csize);
                 mem_over_limit = mem_cgroup_from_res_counter(fail_res, memsw);
                 flags |= MEM_CGROUP_RECLAIM_NOSWAP;
         } else
                 mem_over_limit = mem_cgroup_from_res_counter(fail_res, res);
-
-        if (csize > PAGE_SIZE) /* change csize and retry */
+        /*
+         * csize can be either a huge page (HPAGE_SIZE), a batch of
+         * regular pages (CHARGE_SIZE), or a single regular page
+         * (PAGE_SIZE).
+         *
+         * Never reclaim on behalf of optional batching, retry with a
+         * single page instead.
+         */
+        if (csize == CHARGE_SIZE)
                 return CHARGE_RETRY;
 
         if (!(gfp_mask & __GFP_WAIT))
                 return CHARGE_WOULDBLOCK;
 
         ret = mem_cgroup_hierarchical_reclaim(mem_over_limit, NULL,
-                                        gfp_mask, flags);
+                                              gfp_mask, flags);
+        if (mem_cgroup_check_margin(mem_over_limit, csize))
+                return CHARGE_RETRY;
         /*
-         * try_to_free_mem_cgroup_pages() might not give us a full
-         * picture of reclaim. Some pages are reclaimed and might be
-         * moved to swap cache or just unmapped from the cgroup.
-         * Check the limit again to see if the reclaim reduced the
-         * current usage of the cgroup before giving up
+         * Even though the limit is exceeded at this point, reclaim
+         * may have been able to free some pages.  Retry the charge
+         * before killing the task.
+         *
+         * Only for regular pages, though: huge pages are rather
+         * unlikely to succeed so close to the limit, and we fall back
+         * to regular pages anyway in case of failure.
          */
-        if (ret || mem_cgroup_check_under_limit(mem_over_limit))
+        if (csize == PAGE_SIZE && ret)
                 return CHARGE_RETRY;
 
         /*
@@ -2144,6 +2175,8 @@ void mem_cgroup_split_huge_fixup(struct page *head, struct page *tail)
         struct page_cgroup *tail_pc = lookup_page_cgroup(tail);
         unsigned long flags;
 
+        if (mem_cgroup_disabled())
+                return;
         /*
          * We have no races with charge/uncharge but will have races with
          * page state accounting.
@@ -2233,7 +2266,12 @@ static int mem_cgroup_move_account(struct page_cgroup *pc,
 {
         int ret = -EINVAL;
         unsigned long flags;
-
+        /*
+         * The page is isolated from LRU. So, collapse function
+         * will not handle this page. But page splitting can happen.
+         * Do this check under compound_page_lock(). The caller should
+         * hold it.
+         */
         if ((charge_size > PAGE_SIZE) && !PageTransHuge(pc->page))
                 return -EBUSY;
 
@@ -2265,7 +2303,7 @@ static int mem_cgroup_move_parent(struct page_cgroup *pc,
         struct cgroup *cg = child->css.cgroup;
         struct cgroup *pcg = cg->parent;
         struct mem_cgroup *parent;
-        int charge = PAGE_SIZE;
+        int page_size = PAGE_SIZE;
         unsigned long flags;
         int ret;
 
@@ -2278,23 +2316,26 @@ static int mem_cgroup_move_parent(struct page_cgroup *pc,
                 goto out;
         if (isolate_lru_page(page))
                 goto put;
-        /* The page is isolated from LRU and we have no race with splitting */
-        charge = PAGE_SIZE << compound_order(page);
+
+        if (PageTransHuge(page))
+                page_size = HPAGE_SIZE;
 
         parent = mem_cgroup_from_cont(pcg);
-        ret = __mem_cgroup_try_charge(NULL, gfp_mask, &parent, false, charge);
+        ret = __mem_cgroup_try_charge(NULL, gfp_mask,
+                                &parent, false, page_size);
         if (ret || !parent)
                 goto put_back;
 
-        if (charge > PAGE_SIZE)
+        if (page_size > PAGE_SIZE)
                 flags = compound_lock_irqsave(page);
 
-        ret = mem_cgroup_move_account(pc, child, parent, true, charge);
+        ret = mem_cgroup_move_account(pc, child, parent, true, page_size);
         if (ret)
-                mem_cgroup_cancel_charge(parent, charge);
-put_back:
-        if (charge > PAGE_SIZE)
+                mem_cgroup_cancel_charge(parent, page_size);
+
+        if (page_size > PAGE_SIZE)
                 compound_unlock_irqrestore(page, flags);
+put_back:
         putback_lru_page(page);
 put:
         put_page(page);
@@ -2312,13 +2353,19 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
                                 gfp_t gfp_mask, enum charge_type ctype)
 {
         struct mem_cgroup *mem = NULL;
+        int page_size = PAGE_SIZE;
         struct page_cgroup *pc;
+        bool oom = true;
         int ret;
-        int page_size = PAGE_SIZE;
 
         if (PageTransHuge(page)) {
                 page_size <<= compound_order(page);
                 VM_BUG_ON(!PageTransHuge(page));
+                /*
+                 * Never OOM-kill a process for a huge page.  The
+                 * fault handler will fall back to regular pages.
+                 */
+                oom = false;
         }
 
         pc = lookup_page_cgroup(page);
@@ -2327,7 +2374,7 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
                 return 0;
         prefetchw(pc);
 
-        ret = __mem_cgroup_try_charge(mm, gfp_mask, &mem, true, page_size);
+        ret = __mem_cgroup_try_charge(mm, gfp_mask, &mem, oom, page_size);
         if (ret || !mem)
                 return ret;
 
@@ -5013,9 +5060,9 @@ struct cgroup_subsys mem_cgroup_subsys = {
 static int __init enable_swap_account(char *s)
 {
         /* consider enabled if no parameter or 1 is given */
-        if (!s || !strcmp(s, "1"))
+        if (!(*s) || !strcmp(s, "=1"))
                 really_do_swap_account = 1;
-        else if (!strcmp(s, "0"))
+        else if (!strcmp(s, "=0"))
                 really_do_swap_account = 0;
         return 1;
 }
@@ -5023,7 +5070,8 @@ __setup("swapaccount", enable_swap_account);
 
 static int __init disable_swap_account(char *s)
 {
-        enable_swap_account("0");
+        printk_once("noswapaccount is deprecated and will be removed in 2.6.40. Use swapaccount=0 instead\n");
+        enable_swap_account("=0");
         return 1;
 }
 __setup("noswapaccount", disable_swap_account);
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 548fbd70f026..0207c2f6f8bd 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -233,8 +233,8 @@ void shake_page(struct page *p, int access)
         }
 
         /*
-         * Only all shrink_slab here (which would also
-         * shrink other caches) if access is not potentially fatal.
+         * Only call shrink_slab here (which would also shrink other caches) if
+         * access is not potentially fatal.
          */
         if (access) {
                 int nr;
@@ -386,8 +386,6 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill,
         struct task_struct *tsk;
         struct anon_vma *av;
 
-        if (!PageHuge(page) && unlikely(split_huge_page(page)))
-                return;
         read_lock(&tasklist_lock);
         av = page_lock_anon_vma(page);
         if (av == NULL) /* Not actually mapped anymore */
@@ -856,6 +854,7 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
         int ret;
         int kill = 1;
         struct page *hpage = compound_head(p);
+        struct page *ppage;
 
         if (PageReserved(p) || PageSlab(p))
                 return SWAP_SUCCESS;
@@ -897,6 +896,44 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
         }
 
         /*
+         * ppage: poisoned page
+         *   if p is regular page(4k page)
+         *        ppage == real poisoned page;
+         *   else p is hugetlb or THP, ppage == head page.
+         */
+        ppage = hpage;
+
+        if (PageTransHuge(hpage)) {
+                /*
+                 * Verify that this isn't a hugetlbfs head page, the check for
+                 * PageAnon is just for avoid tripping a split_huge_page
+                 * internal debug check, as split_huge_page refuses to deal with
+                 * anything that isn't an anon page. PageAnon can't go away fro
+                 * under us because we hold a refcount on the hpage, without a
+                 * refcount on the hpage. split_huge_page can't be safely called
+                 * in the first place, having a refcount on the tail isn't
+                 * enough * to be safe.
+                 */
+                if (!PageHuge(hpage) && PageAnon(hpage)) {
+                        if (unlikely(split_huge_page(hpage))) {
+                                /*
+                                 * FIXME: if splitting THP is failed, it is
+                                 * better to stop the following operation rather
+                                 * than causing panic by unmapping. System might
+                                 * survive if the page is freed later.
+                                 */
+                                printk(KERN_INFO
+                                        "MCE %#lx: failed to split THP\n", pfn);
+
+                                BUG_ON(!PageHWPoison(p));
+                                return SWAP_FAIL;
+                        }
+                        /* THP is split, so ppage should be the real poisoned page. */
+                        ppage = p;
+                }
+        }
+
+        /*
          * First collect all the processes that have the page
          * mapped in dirty form.  This has to be done before try_to_unmap,
          * because ttu takes the rmap data structures down.
@@ -905,12 +942,18 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
          * there's nothing that can be done.
          */
         if (kill)
-                collect_procs(hpage, &tokill);
+                collect_procs(ppage, &tokill);
+
+        if (hpage != ppage)
+                lock_page_nosync(ppage);
 
-        ret = try_to_unmap(hpage, ttu);
+        ret = try_to_unmap(ppage, ttu);
         if (ret != SWAP_SUCCESS)
                 printk(KERN_ERR "MCE %#lx: failed to unmap page (mapcount=%d)\n",
-                                pfn, page_mapcount(hpage));
+                                pfn, page_mapcount(ppage));
+
+        if (hpage != ppage)
+                unlock_page(ppage);
 
         /*
          * Now that the dirty bit has been propagated to the
@@ -921,7 +964,7 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
          * use a more force-full uncatchable kill to prevent
          * any accesses to the poisoned memory.
          */
-        kill_procs_ao(&tokill, !!PageDirty(hpage), trapno,
+        kill_procs_ao(&tokill, !!PageDirty(ppage), trapno,
                       ret != SWAP_SUCCESS, p, pfn);
 
         return ret;
@@ -1022,19 +1065,22 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
          * The check (unnecessarily) ignores LRU pages being isolated and
          * walked by the page reclaim code, however that's not a big loss.
          */
-        if (!PageLRU(p) && !PageHuge(p))
-                shake_page(p, 0);
-        if (!PageLRU(p) && !PageHuge(p)) {
-                /*
-                 * shake_page could have turned it free.
-                 */
-                if (is_free_buddy_page(p)) {
-                        action_result(pfn, "free buddy, 2nd try", DELAYED);
-                        return 0;
+        if (!PageHuge(p) && !PageTransCompound(p)) {
+                if (!PageLRU(p))
+                        shake_page(p, 0);
+                if (!PageLRU(p)) {
+                        /*
+                         * shake_page could have turned it free.
+                         */
+                        if (is_free_buddy_page(p)) {
+                                action_result(pfn, "free buddy, 2nd try",
+                                                DELAYED);
+                                return 0;
+                        }
+                        action_result(pfn, "non LRU", IGNORED);
+                        put_page(p);
+                        return -EBUSY;
                 }
-                action_result(pfn, "non LRU", IGNORED);
-                put_page(p);
-                return -EBUSY;
         }
 
         /*
@@ -1064,7 +1110,7 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
          * For error on the tail page, we should set PG_hwpoison
          * on the head page to show that the hugepage is hwpoisoned
          */
-        if (PageTail(p) && TestSetPageHWPoison(hpage)) {
+        if (PageHuge(p) && PageTail(p) && TestSetPageHWPoison(hpage)) {
                 action_result(pfn, "hugepage already hardware poisoned",
                                 IGNORED);
                 unlock_page(hpage);
@@ -1295,7 +1341,10 @@ static int soft_offline_huge_page(struct page *page, int flags)
         ret = migrate_huge_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL, 0,
                                 true);
         if (ret) {
-                putback_lru_pages(&pagelist);
+                struct page *page1, *page2;
+                list_for_each_entry_safe(page1, page2, &pagelist, lru)
+                        put_page(page1);
+
                 pr_debug("soft offline: %#lx: migration failed %d, type %lx\n",
                          pfn, ret, page->flags);
                 if (ret > 0)
@@ -1419,6 +1468,7 @@ int soft_offline_page(struct page *page, int flags)
                 ret = migrate_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL,
                                                                 0, true);
                 if (ret) {
+                        putback_lru_pages(&pagelist);
                         pr_info("soft offline: %#lx: migration failed %d, type %lx\n",
                                 pfn, ret, page->flags);
                         if (ret > 0)
diff --git a/mm/migrate.c b/mm/migrate.c
index 46fe8cc13d67..766115253807 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -772,6 +772,7 @@ uncharge:
 unlock:
         unlock_page(page);
 
+move_newpage:
         if (rc != -EAGAIN) {
                 /*
                  * A page that has been migrated has all references
@@ -785,8 +786,6 @@ unlock:
                 putback_lru_page(page);
         }
 
-move_newpage:
-
         /*
          * Move the new page to the LRU. If migration was not successful
          * then this will free the page.
@@ -888,7 +887,7 @@ out:
  * are movable anymore because to has become empty
  * or no retryable pages exist anymore.
  * Caller should call putback_lru_pages to return pages to the LRU
- * or free list.
+ * or free list only if ret != 0.
  *
  * Return: Number of pages not migrated or error code.
  */
@@ -981,10 +980,6 @@ int migrate_huge_pages(struct list_head *from,
         }
         rc = 0;
 out:
-
-        list_for_each_entry_safe(page, page2, from, lru)
-                put_page(page);
-
         if (rc)
                 return rc;
 
diff --git a/mm/mlock.c b/mm/mlock.c
index 13e81ee8be9d..c3924c7f00be 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -178,6 +178,13 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
         if ((vma->vm_flags & (VM_WRITE | VM_SHARED)) == VM_WRITE)
                 gup_flags |= FOLL_WRITE;
 
+        /*
+         * We want mlock to succeed for regions that have any permissions
+         * other than PROT_NONE.
+         */
+        if (vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC))
+                gup_flags |= FOLL_FORCE;
+
         if (vma->vm_flags & VM_LOCKED)
                 gup_flags |= FOLL_MLOCK;
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 90c1439549fd..a873e61e312e 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1088,8 +1088,10 @@ static void drain_pages(unsigned int cpu)
                 pset = per_cpu_ptr(zone->pageset, cpu);
 
                 pcp = &pset->pcp;
-                free_pcppages_bulk(zone, pcp->count, pcp);
-                pcp->count = 0;
+                if (pcp->count) {
+                        free_pcppages_bulk(zone, pcp->count, pcp);
+                        pcp->count = 0;
+                }
                 local_irq_restore(flags);
         }
 }
@@ -2034,6 +2036,14 @@ restart:
          */
         alloc_flags = gfp_to_alloc_flags(gfp_mask);
 
+        /*
+         * Find the true preferred zone if the allocation is unconstrained by
+         * cpusets.
+         */
+        if (!(alloc_flags & ALLOC_CPUSET) && !nodemask)
+                first_zones_zonelist(zonelist, high_zoneidx, NULL,
+                                        &preferred_zone);
+
         /* This is the last chance, in general, before the goto nopage. */
         page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist,
                         high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS,
@@ -2192,7 +2202,9 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order,
 
         get_mems_allowed();
         /* The preferred zone is used for statistics later */
-        first_zones_zonelist(zonelist, high_zoneidx, nodemask, &preferred_zone);
+        first_zones_zonelist(zonelist, high_zoneidx,
+                                nodemask ? : &cpuset_current_mems_allowed,
+                                &preferred_zone);
         if (!preferred_zone) {
                 put_mems_allowed();
                 return NULL;
diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c
index 0369f5b3ba1b..eb663fb533e0 100644
--- a/mm/pgtable-generic.c
+++ b/mm/pgtable-generic.c
@@ -6,6 +6,7 @@
  *  Copyright (C) 2010  Linus Torvalds
  */
 
+#include <linux/pagemap.h>
 #include <asm/tlb.h>
 #include <asm-generic/pgtable.h>
 
diff --git a/mm/vmscan.c b/mm/vmscan.c
index f5d90dedebba..148c6e630df2 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2083,7 +2083,8 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist,
                         struct zone *preferred_zone;
 
                         first_zones_zonelist(zonelist, gfp_zone(sc->gfp_mask),
-                                                        NULL, &preferred_zone);
+                                                &cpuset_current_mems_allowed,
+                                                &preferred_zone);
                         wait_iff_congested(preferred_zone, BLK_RW_ASYNC, HZ/10);
                 }
         }
diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c
index cd4c4231fa48..de1022cacaf7 100644
--- a/net/batman-adv/vis.c
+++ b/net/batman-adv/vis.c
@@ -64,6 +64,7 @@ static void free_info(struct kref *ref)
 
         spin_unlock_bh(&bat_priv->vis_list_lock);
         kfree_skb(info->skb_packet);
+        kfree(info);
 }
 
 /* Compare two vis packets, used by the hashing algorithm */
@@ -268,10 +269,10 @@ int vis_seq_print_text(struct seq_file *seq, void *offset)
                                 buff_pos += sprintf(buff + buff_pos, "%pM,",
                                                 entry->addr);
 
-                                for (i = 0; i < packet->entries; i++)
+                                for (j = 0; j < packet->entries; j++)
                                         buff_pos += vis_data_read_entry(
                                                         buff + buff_pos,
-                                                        &entries[i],
+                                                        &entries[j],
                                                         entry->addr,
                                                         entry->primary);
 
@@ -444,7 +445,7 @@ static struct vis_info *add_packet(struct bat_priv *bat_priv,
                               info);
         if (hash_added < 0) {
                 /* did not work (for some reason) */
-                kref_put(&old_info->refcount, free_info);
+                kref_put(&info->refcount, free_info);
                 info = NULL;
         }
 
@@ -815,7 +816,7 @@ static void send_vis_packets(struct work_struct *work)
                 container_of(work, struct delayed_work, work);
         struct bat_priv *bat_priv =
                 container_of(delayed_work, struct bat_priv, vis_work);
-        struct vis_info *info, *temp;
+        struct vis_info *info;
 
         spin_lock_bh(&bat_priv->vis_hash_lock);
         purge_vis_packets(bat_priv);
@@ -825,8 +826,9 @@ static void send_vis_packets(struct work_struct *work)
                 send_list_add(bat_priv, bat_priv->my_vis_info);
         }
 
-        list_for_each_entry_safe(info, temp, &bat_priv->vis_send_list,
-                                 send_list) {
+        while (!list_empty(&bat_priv->vis_send_list)) {
+                info = list_first_entry(&bat_priv->vis_send_list,
+                                        typeof(*info), send_list);
 
                 kref_get(&info->refcount);
                 spin_unlock_bh(&bat_priv->vis_hash_lock);
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 6b90a4191734..99cd8d9d891b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -379,14 +379,10 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         hci_conn_hold(acl);
 
         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
-                acl->sec_level = sec_level;
+                acl->sec_level = BT_SECURITY_LOW;
+                acl->pending_sec_level = sec_level;
                 acl->auth_type = auth_type;
                 hci_acl_connect(acl);
-        } else {
-                if (acl->sec_level < sec_level)
-                        acl->sec_level = sec_level;
-                if (acl->auth_type < auth_type)
-                        acl->auth_type = auth_type;
         }
 
         if (type == ACL_LINK)
@@ -442,11 +438,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 {
         BT_DBG("conn %p", conn);
 
+        if (conn->pending_sec_level > sec_level)
+                sec_level = conn->pending_sec_level;
+
         if (sec_level > conn->sec_level)
-                conn->sec_level = sec_level;
+                conn->pending_sec_level = sec_level;
         else if (conn->link_mode & HCI_LM_AUTH)
                 return 1;
 
+        /* Make sure we preserve an existing MITM requirement*/
+        auth_type |= (conn->auth_type & 0x01);
+
         conn->auth_type = auth_type;
 
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 8b602d881fd7..9c4541bc488a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1011,6 +1011,10 @@ int hci_unregister_dev(struct hci_dev *hdev)
 
         destroy_workqueue(hdev->workqueue);
 
+        hci_dev_lock_bh(hdev);
+        hci_blacklist_clear(hdev);
+        hci_dev_unlock_bh(hdev);
+
         __hci_dev_put(hdev);
 
         return 0;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 38100170d380..a290854fdaa6 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -692,13 +692,13 @@ static int hci_outgoing_auth_needed(struct hci_dev *hdev,
         if (conn->state != BT_CONFIG || !conn->out)
                 return 0;
 
-        if (conn->sec_level == BT_SECURITY_SDP)
+        if (conn->pending_sec_level == BT_SECURITY_SDP)
                 return 0;
 
         /* Only request authentication for SSP connections or non-SSP
          * devices with sec_level HIGH */
         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
-                                        conn->sec_level != BT_SECURITY_HIGH)
+                                conn->pending_sec_level != BT_SECURITY_HIGH)
                 return 0;
 
         return 1;
@@ -1095,9 +1095,10 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
         if (conn) {
-                if (!ev->status)
+                if (!ev->status) {
                         conn->link_mode |= HCI_LM_AUTH;
-                else
+                        conn->sec_level = conn->pending_sec_level;
+                } else
                         conn->sec_level = BT_SECURITY_LOW;
 
                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index c791fcda7b2d..7550abb0c96a 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -305,33 +305,44 @@ static void l2cap_chan_del(struct sock *sk, int err)
         }
 }
 
-/* Service level security */
-static inline int l2cap_check_security(struct sock *sk)
+static inline u8 l2cap_get_auth_type(struct sock *sk)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-        __u8 auth_type;
+        if (sk->sk_type == SOCK_RAW) {
+                switch (l2cap_pi(sk)->sec_level) {
+                case BT_SECURITY_HIGH:
+                        return HCI_AT_DEDICATED_BONDING_MITM;
+                case BT_SECURITY_MEDIUM:
+                        return HCI_AT_DEDICATED_BONDING;
+                default:
+                        return HCI_AT_NO_BONDING;
+                }
+        } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
+                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
+                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 
-        if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        auth_type = HCI_AT_NO_BONDING_MITM;
+                        return HCI_AT_NO_BONDING_MITM;
                 else
-                        auth_type = HCI_AT_NO_BONDING;
-
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
+                        return HCI_AT_NO_BONDING;
         } else {
                 switch (l2cap_pi(sk)->sec_level) {
                 case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
-                        break;
+                        return HCI_AT_GENERAL_BONDING_MITM;
                 case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_GENERAL_BONDING;
-                        break;
+                        return HCI_AT_GENERAL_BONDING;
                 default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
+                        return HCI_AT_NO_BONDING;
                 }
         }
+}
+
+/* Service level security */
+static inline int l2cap_check_security(struct sock *sk)
+{
+        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        __u8 auth_type;
+
+        auth_type = l2cap_get_auth_type(sk);
 
         return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
                                                                 auth_type);
@@ -1068,39 +1079,7 @@ static int l2cap_do_connect(struct sock *sk)
 
         err = -ENOMEM;
 
-        if (sk->sk_type == SOCK_RAW) {
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_DEDICATED_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_DEDICATED_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        auth_type = HCI_AT_NO_BONDING_MITM;
-                else
-                        auth_type = HCI_AT_NO_BONDING;
-
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
-        } else {
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_GENERAL_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        }
+        auth_type = l2cap_get_auth_type(sk);
 
         hcon = hci_connect(hdev, ACL_LINK, dst,
                                         l2cap_pi(sk)->sec_level, auth_type);
@@ -1127,7 +1106,8 @@ static int l2cap_do_connect(struct sock *sk)
                 if (sk->sk_type != SOCK_SEQPACKET &&
                                 sk->sk_type != SOCK_STREAM) {
                         l2cap_sock_clear_timer(sk);
-                        sk->sk_state = BT_CONNECTED;
+                        if (l2cap_check_security(sk))
+                                sk->sk_state = BT_CONNECTED;
                 } else
                         l2cap_do_start(sk);
         }
@@ -1893,8 +1873,8 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
                 if (pi->mode == L2CAP_MODE_STREAMING) {
                         l2cap_streaming_send(sk);
                 } else {
-                        if (pi->conn_state & L2CAP_CONN_REMOTE_BUSY &&
-                                        pi->conn_state && L2CAP_CONN_WAIT_F) {
+                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                                        (pi->conn_state & L2CAP_CONN_WAIT_F)) {
                                 err = len;
                                 break;
                         }
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index ff8aaa736650..6b83776534fb 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1164,7 +1164,8 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                          * initiator rfcomm_process_rx already calls
                          * rfcomm_session_put() */
                         if (s->sock->sk->sk_state != BT_CLOSED)
-                                rfcomm_session_put(s);
+                                if (list_empty(&s->dlcs))
+                                        rfcomm_session_put(s);
                         break;
                 }
         }
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 2872393b2939..88485cc74dc3 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -328,12 +328,12 @@ static struct net_bridge_fdb_entry *fdb_create(struct hlist_head *head,
         fdb = kmem_cache_alloc(br_fdb_cache, GFP_ATOMIC);
         if (fdb) {
                 memcpy(fdb->addr.addr, addr, ETH_ALEN);
-                hlist_add_head_rcu(&fdb->hlist, head);
-
                 fdb->dst = source;
                 fdb->is_local = is_local;
                 fdb->is_static = is_local;
                 fdb->ageing_timer = jiffies;
+
+                hlist_add_head_rcu(&fdb->hlist, head);
         }
         return fdb;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 7c6a46f80372..b6d0bf875a8e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -749,7 +749,8 @@ EXPORT_SYMBOL(dev_get_by_index);
  *      @ha: hardware address
  *
  *      Search for an interface by MAC address. Returns NULL if the device
- *      is not found or a pointer to the device. The caller must hold RCU
+ *      is not found or a pointer to the device.
+ *      The caller must hold RCU or RTNL.
  *      The returned device has not had its ref count increased
  *      and the caller must therefore be careful about locking
  *
@@ -2562,7 +2563,8 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
 
         map = rcu_dereference(rxqueue->rps_map);
         if (map) {
-                if (map->len == 1) {
+                if (map->len == 1 &&
+                    !rcu_dereference_raw(rxqueue->rps_flow_table)) {
                         tcpu = map->cpus[0];
                         if (cpu_online(tcpu))
                                 cpu = tcpu;
@@ -3423,6 +3425,8 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
         __skb_pull(skb, skb_headlen(skb));
         skb_reserve(skb, NET_IP_ALIGN - skb_headroom(skb));
         skb->vlan_tci = 0;
+        skb->dev = napi->dev;
+        skb->skb_iif = 0;
 
         napi->skb = skb;
 }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 17741782a345..ff2302910b5e 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -817,7 +817,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         if (regs.len > reglen)
                 regs.len = reglen;
 
-        regbuf = vmalloc(reglen);
+        regbuf = vzalloc(reglen);
         if (!regbuf)
                 return -ENOMEM;
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 750db57f3bb3..2d65c6bb24c1 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1121,8 +1121,7 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
                                 return -EOPNOTSUPP;
 
                         if (af_ops->validate_link_af) {
-                                err = af_ops->validate_link_af(dev,
-                                                        tb[IFLA_AF_SPEC]);
+                                err = af_ops->validate_link_af(dev, af);
                                 if (err < 0)
                                         return err;
                         }
@@ -1672,6 +1671,9 @@ replay:
                         snprintf(ifname, IFNAMSIZ, "%s%%d", ops->kind);
 
                 dest_net = rtnl_link_get_net(net, tb);
+                if (IS_ERR(dest_net))
+                        return PTR_ERR(dest_net);
+
                 dev = rtnl_create_link(net, dest_net, ifname, ops, tb);
 
                 if (IS_ERR(dev))
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d31bb36ae0dc..d883dcc78b6b 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -210,6 +210,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
         shinfo = skb_shinfo(skb);
         memset(shinfo, 0, offsetof(struct skb_shared_info, dataref));
         atomic_set(&shinfo->dataref, 1);
+        kmemcheck_annotate_variable(shinfo->destructor_arg);
 
         if (fclone) {
                 struct sk_buff *child = skb + 1;
@@ -2744,8 +2745,12 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
 merge:
         if (offset > headlen) {
-                skbinfo->frags[0].page_offset += offset - headlen;
-                skbinfo->frags[0].size -= offset - headlen;
+                unsigned int eat = offset - headlen;
+
+                skbinfo->frags[0].page_offset += eat;
+                skbinfo->frags[0].size -= eat;
+                skb->data_len -= eat;
+                skb->len -= eat;
                 offset = headlen;
         }
 
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index d900ab99814a..6b03f561caec 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -583,7 +583,7 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
         u8 up, idtype;
         int ret = -EINVAL;
 
-        if (!tb[DCB_ATTR_APP] || !netdev->dcbnl_ops->getapp)
+        if (!tb[DCB_ATTR_APP])
                 goto out;
 
         ret = nla_parse_nested(app_tb, DCB_APP_ATTR_MAX, tb[DCB_ATTR_APP],
@@ -604,7 +604,16 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
                 goto out;
 
         id = nla_get_u16(app_tb[DCB_APP_ATTR_ID]);
-        up = netdev->dcbnl_ops->getapp(netdev, idtype, id);
+
+        if (netdev->dcbnl_ops->getapp) {
+                up = netdev->dcbnl_ops->getapp(netdev, idtype, id);
+        } else {
+                struct dcb_app app = {
+                                        .selector = idtype,
+                                        .protocol = id,
+                                     };
+                up = dcb_getapp(netdev, &app);
+        }
 
         /* send this back */
         dcbnl_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 15dcc1a586b4..0c2826337919 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -265,13 +265,13 @@ static void ec_tx_done(struct sk_buff *skb, int result)
 static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
                           struct msghdr *msg, size_t len)
 {
-        struct sock *sk = sock->sk;
         struct sockaddr_ec *saddr=(struct sockaddr_ec *)msg->msg_name;
         struct net_device *dev;
         struct ec_addr addr;
         int err;
         unsigned char port, cb;
 #if defined(CONFIG_ECONET_AUNUDP) || defined(CONFIG_ECONET_NATIVE)
+        struct sock *sk = sock->sk;
         struct sk_buff *skb;
         struct ec_cb *eb;
 #endif
@@ -488,10 +488,10 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
 
 error_free_buf:
         vfree(userbuf);
+error:
 #else
         err = -EPROTOTYPE;
 #endif
-        error:
         mutex_unlock(&econet_mutex);
 
         return err;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f2b61107df6c..45b89d7bda5a 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -880,6 +880,19 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 }
 EXPORT_SYMBOL(inet_ioctl);
 
+#ifdef CONFIG_COMPAT
+int inet_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        struct sock *sk = sock->sk;
+        int err = -ENOIOCTLCMD;
+
+        if (sk->sk_prot->compat_ioctl)
+                err = sk->sk_prot->compat_ioctl(sk, cmd, arg);
+
+        return err;
+}
+#endif
+
 const struct proto_ops inet_stream_ops = {
         .family            = PF_INET,
         .owner             = THIS_MODULE,
@@ -903,6 +916,7 @@ const struct proto_ops inet_stream_ops = {
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_sock_common_setsockopt,
         .compat_getsockopt = compat_sock_common_getsockopt,
+        .compat_ioctl      = inet_compat_ioctl,
 #endif
 };
 EXPORT_SYMBOL(inet_stream_ops);
@@ -929,6 +943,7 @@ const struct proto_ops inet_dgram_ops = {
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_sock_common_setsockopt,
         .compat_getsockopt = compat_sock_common_getsockopt,
+        .compat_ioctl      = inet_compat_ioctl,
 #endif
 };
 EXPORT_SYMBOL(inet_dgram_ops);
@@ -959,6 +974,7 @@ static const struct proto_ops inet_sockraw_ops = {
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_sock_common_setsockopt,
         .compat_getsockopt = compat_sock_common_getsockopt,
+        .compat_ioctl      = inet_compat_ioctl,
 #endif
 };
 
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 04c8b69fd426..7927589813b5 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1017,14 +1017,13 @@ static int arp_req_set_proxy(struct net *net, struct net_device *dev, int on)
                 IPV4_DEVCONF_ALL(net, PROXY_ARP) = on;
                 return 0;
         }
-        if (__in_dev_get_rcu(dev)) {
-                IN_DEV_CONF_SET(__in_dev_get_rcu(dev), PROXY_ARP, on);
+        if (__in_dev_get_rtnl(dev)) {
+                IN_DEV_CONF_SET(__in_dev_get_rtnl(dev), PROXY_ARP, on);
                 return 0;
         }
         return -ENXIO;
 }
 
-/* must be called with rcu_read_lock() */
 static int arp_req_set_public(struct net *net, struct arpreq *r,
                 struct net_device *dev)
 {
@@ -1233,10 +1232,10 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         if (!(r.arp_flags & ATF_NETMASK))
                 ((struct sockaddr_in *)&r.arp_netmask)->sin_addr.s_addr =
                                                            htonl(0xFFFFFFFFUL);
-        rcu_read_lock();
+        rtnl_lock();
         if (r.arp_dev[0]) {
                 err = -ENODEV;
-                dev = dev_get_by_name_rcu(net, r.arp_dev);
+                dev = __dev_get_by_name(net, r.arp_dev);
                 if (dev == NULL)
                         goto out;
 
@@ -1263,7 +1262,7 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                 break;
         }
 out:
-        rcu_read_unlock();
+        rtnl_unlock();
         if (cmd == SIOCGARP && !err && copy_to_user(arg, &r, sizeof(r)))
                 err = -EFAULT;
         return err;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index d9bc85751c74..a96e65674ac3 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -475,7 +475,7 @@ static int cleanup_once(unsigned long ttl)
 struct inet_peer *inet_getpeer(struct inetpeer_addr *daddr, int create)
 {
         struct inet_peer __rcu **stack[PEER_MAXDEPTH], ***stackptr;
-        struct inet_peer_base *base = family_to_base(AF_INET);
+        struct inet_peer_base *base = family_to_base(daddr->family);
         struct inet_peer *p;
 
         /* Look up for the address quickly, lockless.
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 3f3a9afd73e0..8b65a12654e7 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -60,6 +60,7 @@
 #include <linux/notifier.h>
 #include <linux/if_arp.h>
 #include <linux/netfilter_ipv4.h>
+#include <linux/compat.h>
 #include <net/ipip.h>
 #include <net/checksum.h>
 #include <net/netlink.h>
@@ -1434,6 +1435,81 @@ int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg)
         }
 }
 
+#ifdef CONFIG_COMPAT
+struct compat_sioc_sg_req {
+        struct in_addr src;
+        struct in_addr grp;
+        compat_ulong_t pktcnt;
+        compat_ulong_t bytecnt;
+        compat_ulong_t wrong_if;
+};
+
+struct compat_sioc_vif_req {
+        vifi_t  vifi;           /* Which iface */
+        compat_ulong_t icount;
+        compat_ulong_t ocount;
+        compat_ulong_t ibytes;
+        compat_ulong_t obytes;
+};
+
+int ipmr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
+{
+        struct compat_sioc_sg_req sr;
+        struct compat_sioc_vif_req vr;
+        struct vif_device *vif;
+        struct mfc_cache *c;
+        struct net *net = sock_net(sk);
+        struct mr_table *mrt;
+
+        mrt = ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
+        if (mrt == NULL)
+                return -ENOENT;
+
+        switch (cmd) {
+        case SIOCGETVIFCNT:
+                if (copy_from_user(&vr, arg, sizeof(vr)))
+                        return -EFAULT;
+                if (vr.vifi >= mrt->maxvif)
+                        return -EINVAL;
+                read_lock(&mrt_lock);
+                vif = &mrt->vif_table[vr.vifi];
+                if (VIF_EXISTS(mrt, vr.vifi)) {
+                        vr.icount = vif->pkt_in;
+                        vr.ocount = vif->pkt_out;
+                        vr.ibytes = vif->bytes_in;
+                        vr.obytes = vif->bytes_out;
+                        read_unlock(&mrt_lock);
+
+                        if (copy_to_user(arg, &vr, sizeof(vr)))
+                                return -EFAULT;
+                        return 0;
+                }
+                read_unlock(&mrt_lock);
+                return -EADDRNOTAVAIL;
+        case SIOCGETSGCNT:
+                if (copy_from_user(&sr, arg, sizeof(sr)))
+                        return -EFAULT;
+
+                rcu_read_lock();
+                c = ipmr_cache_find(mrt, sr.src.s_addr, sr.grp.s_addr);
+                if (c) {
+                        sr.pktcnt = c->mfc_un.res.pkt;
+                        sr.bytecnt = c->mfc_un.res.bytes;
+                        sr.wrong_if = c->mfc_un.res.wrong_if;
+                        rcu_read_unlock();
+
+                        if (copy_to_user(arg, &sr, sizeof(sr)))
+                                return -EFAULT;
+                        return 0;
+                }
+                rcu_read_unlock();
+                return -EADDRNOTAVAIL;
+        default:
+                return -ENOIOCTLCMD;
+        }
+}
+#endif
+
 
 static int ipmr_device_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
index b8ddcc480ed9..a5e52a9f0a12 100644
--- a/net/ipv4/netfilter/arpt_mangle.c
+++ b/net/ipv4/netfilter/arpt_mangle.c
@@ -60,12 +60,12 @@ static int checkentry(const struct xt_tgchk_param *par)
 
         if (mangle->flags & ~ARPT_MANGLE_MASK ||
             !(mangle->flags & ARPT_MANGLE_MASK))
-                return false;
+                return -EINVAL;
 
         if (mangle->target != NF_DROP && mangle->target != NF_ACCEPT &&
            mangle->target != XT_CONTINUE)
-                return false;
-        return true;
+                return -EINVAL;
+        return 0;
 }
 
 static struct xt_target arpt_mangle_reg __read_mostly = {
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index a3d5ab786e81..6390ba299b3d 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -76,6 +76,7 @@
 #include <linux/seq_file.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
+#include <linux/compat.h>
 
 static struct raw_hashinfo raw_v4_hashinfo = {
         .lock = __RW_LOCK_UNLOCKED(raw_v4_hashinfo.lock),
@@ -838,6 +839,23 @@ static int raw_ioctl(struct sock *sk, int cmd, unsigned long arg)
         }
 }
 
+#ifdef CONFIG_COMPAT
+static int compat_raw_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
+{
+        switch (cmd) {
+        case SIOCOUTQ:
+        case SIOCINQ:
+                return -ENOIOCTLCMD;
+        default:
+#ifdef CONFIG_IP_MROUTE
+                return ipmr_compat_ioctl(sk, cmd, compat_ptr(arg));
+#else
+                return -ENOIOCTLCMD;
+#endif
+        }
+}
+#endif
+
 struct proto raw_prot = {
         .name              = "RAW",
         .owner             = THIS_MODULE,
@@ -860,6 +878,7 @@ struct proto raw_prot = {
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_raw_setsockopt,
         .compat_getsockopt = compat_raw_getsockopt,
+        .compat_ioctl      = compat_raw_ioctl,
 #endif
 };
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 351dc4e85242..788a3e74834e 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2707,6 +2707,11 @@ static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 coo
         return NULL;
 }
 
+static unsigned int ipv4_blackhole_default_mtu(const struct dst_entry *dst)
+{
+        return 0;
+}
+
 static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
 }
@@ -2716,6 +2721,7 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
         .protocol               =       cpu_to_be16(ETH_P_IP),
         .destroy                =       ipv4_dst_destroy,
         .check                  =       ipv4_blackhole_dst_check,
+        .default_mtu            =       ipv4_blackhole_default_mtu,
         .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
 };
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2549b29b062d..eb7f82ebf4a3 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4399,7 +4399,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
                         if (!skb_copy_datagram_iovec(skb, 0, tp->ucopy.iov, chunk)) {
                                 tp->ucopy.len -= chunk;
                                 tp->copied_seq += chunk;
-                                eaten = (chunk == skb->len && !th->fin);
+                                eaten = (chunk == skb->len);
                                 tcp_rcv_space_adjust(sk);
                         }
                         local_bh_disable();
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 856f68466d49..02f583b3744a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1994,7 +1994,6 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
                                 }
                                 req = req->dl_next;
                         }
-                        st->offset = 0;
                         if (++st->sbucket >= icsk->icsk_accept_queue.listen_opt->nr_table_entries)
                                 break;
 get_req:
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 24a1cf110d80..fd6782e3a038 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2661,14 +2661,12 @@ static int addrconf_ifdown(struct net_device *dev, int how)
         struct net *net = dev_net(dev);
         struct inet6_dev *idev;
         struct inet6_ifaddr *ifa;
-        LIST_HEAD(keep_list);
-        int state;
+        int state, i;
 
         ASSERT_RTNL();
 
-        /* Flush routes if device is being removed or it is not loopback */
-        if (how || !(dev->flags & IFF_LOOPBACK))
-                rt6_ifdown(net, dev);
+        rt6_ifdown(net, dev);
+        neigh_ifdown(&nd_tbl, dev);
 
         idev = __in6_dev_get(dev);
         if (idev == NULL)
@@ -2689,6 +2687,23 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
         }
 
+        /* Step 2: clear hash table */
+        for (i = 0; i < IN6_ADDR_HSIZE; i++) {
+                struct hlist_head *h = &inet6_addr_lst[i];
+                struct hlist_node *n;
+
+                spin_lock_bh(&addrconf_hash_lock);
+        restart:
+                hlist_for_each_entry_rcu(ifa, n, h, addr_lst) {
+                        if (ifa->idev == idev) {
+                                hlist_del_init_rcu(&ifa->addr_lst);
+                                addrconf_del_timer(ifa);
+                                goto restart;
+                        }
+                }
+                spin_unlock_bh(&addrconf_hash_lock);
+        }
+
         write_lock_bh(&idev->lock);
 
         /* Step 2: clear flags for stateless addrconf */
@@ -2722,52 +2737,23 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                                        struct inet6_ifaddr, if_list);
                 addrconf_del_timer(ifa);
 
-                /* If just doing link down, and address is permanent
-                   and not link-local, then retain it. */
-                if (!how &&
-                    (ifa->flags&IFA_F_PERMANENT) &&
-                    !(ipv6_addr_type(&ifa->addr) & IPV6_ADDR_LINKLOCAL)) {
-                        list_move_tail(&ifa->if_list, &keep_list);
-
-                        /* If not doing DAD on this address, just keep it. */
-                        if ((dev->flags&(IFF_NOARP|IFF_LOOPBACK)) ||
-                            idev->cnf.accept_dad <= 0 ||
-                            (ifa->flags & IFA_F_NODAD))
-                                continue;
+                list_del(&ifa->if_list);
 
-                        /* If it was tentative already, no need to notify */
-                        if (ifa->flags & IFA_F_TENTATIVE)
-                                continue;
+                write_unlock_bh(&idev->lock);
 
-                        /* Flag it for later restoration when link comes up */
-                        ifa->flags |= IFA_F_TENTATIVE;
-                        ifa->state = INET6_IFADDR_STATE_DAD;
-                } else {
-                        list_del(&ifa->if_list);
-
-                        /* clear hash table */
-                        spin_lock_bh(&addrconf_hash_lock);
-                        hlist_del_init_rcu(&ifa->addr_lst);
-                        spin_unlock_bh(&addrconf_hash_lock);
-
-                        write_unlock_bh(&idev->lock);
-                        spin_lock_bh(&ifa->state_lock);
-                        state = ifa->state;
-                        ifa->state = INET6_IFADDR_STATE_DEAD;
-                        spin_unlock_bh(&ifa->state_lock);
-
-                        if (state != INET6_IFADDR_STATE_DEAD) {
-                                __ipv6_ifa_notify(RTM_DELADDR, ifa);
-                                atomic_notifier_call_chain(&inet6addr_chain,
-                                                           NETDEV_DOWN, ifa);
-                        }
+                spin_lock_bh(&ifa->state_lock);
+                state = ifa->state;
+                ifa->state = INET6_IFADDR_STATE_DEAD;
+                spin_unlock_bh(&ifa->state_lock);
 
-                        in6_ifa_put(ifa);
-                        write_lock_bh(&idev->lock);
+                if (state != INET6_IFADDR_STATE_DEAD) {
+                        __ipv6_ifa_notify(RTM_DELADDR, ifa);
+                        atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
                 }
-        }
+                in6_ifa_put(ifa);
 
-        list_splice(&keep_list, &idev->addr_list);
+                write_lock_bh(&idev->lock);
+        }
 
         write_unlock_bh(&idev->lock);
 
@@ -4156,8 +4142,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                 addrconf_leave_solict(ifp->idev, &ifp->addr);
                 dst_hold(&ifp->rt->dst);
 
-                if (ifp->state == INET6_IFADDR_STATE_DEAD &&
-                    ip6_del_rt(ifp->rt))
+                if (ip6_del_rt(ifp->rt))
                         dst_free(&ifp->rt->dst);
                 break;
         }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 9fab274019c0..0e1d53bcf1e0 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -34,6 +34,7 @@
 #include <linux/seq_file.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/compat.h>
 #include <net/protocol.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
@@ -1804,6 +1805,80 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void __user *arg)
         }
 }
 
+#ifdef CONFIG_COMPAT
+struct compat_sioc_sg_req6 {
+        struct sockaddr_in6 src;
+        struct sockaddr_in6 grp;
+        compat_ulong_t pktcnt;
+        compat_ulong_t bytecnt;
+        compat_ulong_t wrong_if;
+};
+
+struct compat_sioc_mif_req6 {
+        mifi_t  mifi;
+        compat_ulong_t icount;
+        compat_ulong_t ocount;
+        compat_ulong_t ibytes;
+        compat_ulong_t obytes;
+};
+
+int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
+{
+        struct compat_sioc_sg_req6 sr;
+        struct compat_sioc_mif_req6 vr;
+        struct mif_device *vif;
+        struct mfc6_cache *c;
+        struct net *net = sock_net(sk);
+        struct mr6_table *mrt;
+
+        mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
+        if (mrt == NULL)
+                return -ENOENT;
+
+        switch (cmd) {
+        case SIOCGETMIFCNT_IN6:
+                if (copy_from_user(&vr, arg, sizeof(vr)))
+                        return -EFAULT;
+                if (vr.mifi >= mrt->maxvif)
+                        return -EINVAL;
+                read_lock(&mrt_lock);
+                vif = &mrt->vif6_table[vr.mifi];
+                if (MIF_EXISTS(mrt, vr.mifi)) {
+                        vr.icount = vif->pkt_in;
+                        vr.ocount = vif->pkt_out;
+                        vr.ibytes = vif->bytes_in;
+                        vr.obytes = vif->bytes_out;
+                        read_unlock(&mrt_lock);
+
+                        if (copy_to_user(arg, &vr, sizeof(vr)))
+                                return -EFAULT;
+                        return 0;
+                }
+                read_unlock(&mrt_lock);
+                return -EADDRNOTAVAIL;
+        case SIOCGETSGCNT_IN6:
+                if (copy_from_user(&sr, arg, sizeof(sr)))
+                        return -EFAULT;
+
+                read_lock(&mrt_lock);
+                c = ip6mr_cache_find(mrt, &sr.src.sin6_addr, &sr.grp.sin6_addr);
+                if (c) {
+                        sr.pktcnt = c->mfc_un.res.pkt;
+                        sr.bytecnt = c->mfc_un.res.bytes;
+                        sr.wrong_if = c->mfc_un.res.wrong_if;
+                        read_unlock(&mrt_lock);
+
+                        if (copy_to_user(arg, &sr, sizeof(sr)))
+                                return -EFAULT;
+                        return 0;
+                }
+                read_unlock(&mrt_lock);
+                return -EADDRNOTAVAIL;
+        default:
+                return -ENOIOCTLCMD;
+        }
+}
+#endif
 
 static inline int ip6mr_forward2_finish(struct sk_buff *skb)
 {
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 86c39526ba5e..c5b0915d106b 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -31,6 +31,7 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/skbuff.h>
+#include <linux/compat.h>
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
 
@@ -1157,6 +1158,23 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
         }
 }
 
+#ifdef CONFIG_COMPAT
+static int compat_rawv6_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
+{
+        switch (cmd) {
+        case SIOCOUTQ:
+        case SIOCINQ:
+                return -ENOIOCTLCMD;
+        default:
+#ifdef CONFIG_IPV6_MROUTE
+                return ip6mr_compat_ioctl(sk, cmd, compat_ptr(arg));
+#else
+                return -ENOIOCTLCMD;
+#endif
+        }
+}
+#endif
+
 static void rawv6_close(struct sock *sk, long timeout)
 {
         if (inet_sk(sk)->inet_num == IPPROTO_RAW)
@@ -1215,6 +1233,7 @@ struct proto rawv6_prot = {
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_rawv6_setsockopt,
         .compat_getsockopt = compat_rawv6_getsockopt,
+        .compat_ioctl      = compat_rawv6_ioctl,
 #endif
 };
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 373bd0416f69..1c29f95695de 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -72,8 +72,6 @@
 #define RT6_TRACE(x...) do { ; } while (0)
 #endif
 
-#define CLONE_OFFLINK_ROUTE 0
-
 static struct rt6_info * ip6_rt_copy(struct rt6_info *ort);
 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int      ip6_default_advmss(const struct dst_entry *dst);
@@ -115,6 +113,11 @@ static struct dst_ops ip6_dst_ops_template = {
         .local_out              =       __ip6_local_out,
 };
 
+static unsigned int ip6_blackhole_default_mtu(const struct dst_entry *dst)
+{
+        return 0;
+}
+
 static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
 }
@@ -124,6 +127,7 @@ static struct dst_ops ip6_dst_blackhole_ops = {
         .protocol               =       cpu_to_be16(ETH_P_IPV6),
         .destroy                =       ip6_dst_destroy,
         .check                  =       ip6_dst_check,
+        .default_mtu            =       ip6_blackhole_default_mtu,
         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
 };
 
@@ -196,7 +200,6 @@ static void ip6_dst_destroy(struct dst_entry *dst)
                 in6_dev_put(idev);
         }
         if (peer) {
-                BUG_ON(!(rt->rt6i_flags & RTF_CACHE));
                 rt->rt6i_peer = NULL;
                 inet_putpeer(peer);
         }
@@ -206,9 +209,6 @@ void rt6_bind_peer(struct rt6_info *rt, int create)
 {
         struct inet_peer *peer;
 
-        if (WARN_ON(!(rt->rt6i_flags & RTF_CACHE)))
-                return;
-
         peer = inet_getpeer_v6(&rt->rt6i_dst.addr, create);
         if (peer && cmpxchg(&rt->rt6i_peer, NULL, peer) != NULL)
                 inet_putpeer(peer);
@@ -738,13 +738,8 @@ restart:
 
         if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
                 nrt = rt6_alloc_cow(rt, &fl->fl6_dst, &fl->fl6_src);
-        else {
-#if CLONE_OFFLINK_ROUTE
+        else
                 nrt = rt6_alloc_clone(rt, &fl->fl6_dst);
-#else
-                goto out2;
-#endif
-        }
 
         dst_release(&rt->dst);
         rt = nrt ? : net->ipv6.ip6_null_entry;
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index fa1d8f4e0051..7cb65ef79f9c 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -15,6 +15,8 @@
 #include <net/addrconf.h>
 #include <net/inet_frag.h>
 
+static struct ctl_table empty[1];
+
 static ctl_table ipv6_table_template[] = {
         {
                 .procname       = "route",
@@ -35,6 +37,12 @@ static ctl_table ipv6_table_template[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
+        {
+                .procname       = "neigh",
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = empty,
+        },
         { }
 };
 
@@ -152,7 +160,6 @@ static struct ctl_table_header *ip6_base;
 
 int ipv6_static_sysctl_register(void)
 {
-        static struct ctl_table empty[1];
         ip6_base = register_sysctl_paths(net_ipv6_ctl_path, empty);
         if (ip6_base == NULL)
                 return -ENOMEM;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 7e74023ea6e4..da87428681cc 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -98,6 +98,10 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         if (!xdst->u.rt6.rt6i_idev)
                 return -ENODEV;
 
+        xdst->u.rt6.rt6i_peer = rt->rt6i_peer;
+        if (rt->rt6i_peer)
+                atomic_inc(&rt->rt6i_peer->refcnt);
+
         /* Sheit... I remember I did this right. Apparently,
          * it was magically lost, so this code needs audit */
         xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
@@ -216,6 +220,8 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
 
         if (likely(xdst->u.rt6.rt6i_idev))
                 in6_dev_put(xdst->u.rt6.rt6i_idev);
+        if (likely(xdst->u.rt6.rt6i_peer))
+                inet_putpeer(xdst->u.rt6.rt6i_peer);
         xfrm_dst_destroy(xdst);
 }
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 5950e3abead9..b64b42bc774b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2230,6 +2230,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 
         sdata = vif_to_sdata(vif);
 
+        if (!ieee80211_sdata_running(sdata))
+                goto out;
+
         if (tim_offset)
                 *tim_offset = 0;
         if (tim_length)
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
index 5702de35e2bb..63a1b915a7e4 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -63,6 +63,9 @@ void nf_ct_deliver_cached_events(struct nf_conn *ct)
                  * this does not harm and it happens very rarely. */
                 unsigned long missed = e->missed;
 
+                if (!((events | missed) & e->ctmask))
+                        goto out_unlock;
+
                 ret = notify->fcn(events | missed, &item);
                 if (unlikely(ret < 0 || missed)) {
                         spin_lock_bh(&ct->lock);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 93297aaceb2b..eead9db6f899 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -667,6 +667,7 @@ restart:
                         if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
                                                 cb->nlh->nlmsg_seq,
                                                 IPCTNL_MSG_CT_NEW, ct) < 0) {
+                                nf_conntrack_get(&ct->ct_general);
                                 cb->args[1] = (unsigned long)ct;
                                 goto out;
                         }
diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
index 88f7c3511c72..73c33a42f87f 100644
--- a/net/netfilter/xt_iprange.c
+++ b/net/netfilter/xt_iprange.c
@@ -53,15 +53,13 @@ iprange_mt4(const struct sk_buff *skb, struct xt_action_param *par)
 }
 
 static inline int
-iprange_ipv6_sub(const struct in6_addr *a, const struct in6_addr *b)
+iprange_ipv6_lt(const struct in6_addr *a, const struct in6_addr *b)
 {
         unsigned int i;
-        int r;
 
         for (i = 0; i < 4; ++i) {
-                r = ntohl(a->s6_addr32[i]) - ntohl(b->s6_addr32[i]);
-                if (r != 0)
-                        return r;
+                if (a->s6_addr32[i] != b->s6_addr32[i])
+                        return ntohl(a->s6_addr32[i]) < ntohl(b->s6_addr32[i]);
         }
 
         return 0;
@@ -75,15 +73,15 @@ iprange_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         bool m;
 
         if (info->flags & IPRANGE_SRC) {
-                m  = iprange_ipv6_sub(&iph->saddr, &info->src_min.in6) < 0;
-                m |= iprange_ipv6_sub(&iph->saddr, &info->src_max.in6) > 0;
+                m  = iprange_ipv6_lt(&iph->saddr, &info->src_min.in6);
+                m |= iprange_ipv6_lt(&info->src_max.in6, &iph->saddr);
                 m ^= !!(info->flags & IPRANGE_SRC_INV);
                 if (m)
                         return false;
         }
         if (info->flags & IPRANGE_DST) {
-                m  = iprange_ipv6_sub(&iph->daddr, &info->dst_min.in6) < 0;
-                m |= iprange_ipv6_sub(&iph->daddr, &info->dst_max.in6) > 0;
+                m  = iprange_ipv6_lt(&iph->daddr, &info->dst_min.in6);
+                m |= iprange_ipv6_lt(&info->dst_max.in6, &iph->daddr);
                 m ^= !!(info->flags & IPRANGE_DST_INV);
                 if (m)
                         return false;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index c80d1c210c5d..5f63ec58942c 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -390,7 +390,6 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         ret = qdisc_enqueue(skb, cl->q);
         if (ret == NET_XMIT_SUCCESS) {
                 sch->q.qlen++;
-                qdisc_bstats_update(sch, skb);
                 cbq_mark_toplevel(q, cl);
                 if (!cl->next_alive)
                         cbq_activate_class(cl);
@@ -649,7 +648,6 @@ static int cbq_reshape_fail(struct sk_buff *skb, struct Qdisc *child)
                 ret = qdisc_enqueue(skb, cl->q);
                 if (ret == NET_XMIT_SUCCESS) {
                         sch->q.qlen++;
-                        qdisc_bstats_update(sch, skb);
                         if (!cl->next_alive)
                                 cbq_activate_class(cl);
                         return 0;
@@ -971,6 +969,7 @@ cbq_dequeue(struct Qdisc *sch)
 
                 skb = cbq_dequeue_1(sch);
                 if (skb) {
+                        qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         sch->flags &= ~TCQ_F_THROTTLED;
                         return skb;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index de55e642eafc..6b7fe4a84f13 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -376,7 +376,6 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         bstats_update(&cl->bstats, skb);
-        qdisc_bstats_update(sch, skb);
 
         sch->q.qlen++;
         return err;
@@ -403,6 +402,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
                         skb = qdisc_dequeue_peeked(cl->qdisc);
                         if (cl->qdisc->q.qlen == 0)
                                 list_del(&cl->alist);
+                        qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 60f4bdd4408e..0f7bf3fdfea5 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -260,7 +260,6 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 return err;
         }
 
-        qdisc_bstats_update(sch, skb);
         sch->q.qlen++;
 
         return NET_XMIT_SUCCESS;
@@ -283,6 +282,7 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
         if (skb == NULL)
                 return NULL;
 
+        qdisc_bstats_update(sch, skb);
         sch->q.qlen--;
 
         index = skb->tc_index & (p->indices - 1);
diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index aa4d6337e43c..d468b479aa93 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -46,17 +46,14 @@ static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 
 static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 {
-        struct sk_buff *skb_head;
         struct fifo_sched_data *q = qdisc_priv(sch);
 
         if (likely(skb_queue_len(&sch->q) < q->limit))
                 return qdisc_enqueue_tail(skb, sch);
 
         /* queue full, remove one skb to fulfill the limit */
-        skb_head = qdisc_dequeue_head(sch);
+        __qdisc_queue_drop_head(sch, &sch->q);
         sch->qstats.drops++;
-        kfree_skb(skb_head);
-
         qdisc_enqueue_tail(skb, sch);
 
         return NET_XMIT_CN;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 2e45791d4f6c..14a799de1c35 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1600,7 +1600,6 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 set_active(cl, qdisc_pkt_len(skb));
 
         bstats_update(&cl->bstats, skb);
-        qdisc_bstats_update(sch, skb);
         sch->q.qlen++;
 
         return NET_XMIT_SUCCESS;
@@ -1666,6 +1665,7 @@ hfsc_dequeue(struct Qdisc *sch)
         }
 
         sch->flags &= ~TCQ_F_THROTTLED;
+        qdisc_bstats_update(sch, skb);
         sch->q.qlen--;
 
         return skb;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 984c1b0c6836..fc12fe6f5597 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -574,7 +574,6 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         sch->q.qlen++;
-        qdisc_bstats_update(sch, skb);
         return NET_XMIT_SUCCESS;
 }
 
@@ -842,7 +841,7 @@ next:
 
 static struct sk_buff *htb_dequeue(struct Qdisc *sch)
 {
-        struct sk_buff *skb = NULL;
+        struct sk_buff *skb;
         struct htb_sched *q = qdisc_priv(sch);
         int level;
         psched_time_t next_event;
@@ -851,6 +850,8 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
         /* try to dequeue direct packets as high prio (!) to minimize cpu work */
         skb = __skb_dequeue(&q->direct_queue);
         if (skb != NULL) {
+ok:
+                qdisc_bstats_update(sch, skb);
                 sch->flags &= ~TCQ_F_THROTTLED;
                 sch->q.qlen--;
                 return skb;
@@ -884,11 +885,8 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
                         int prio = ffz(m);
                         m |= 1 << prio;
                         skb = htb_dequeue_tree(q, prio, level);
-                        if (likely(skb != NULL)) {
-                                sch->q.qlen--;
-                                sch->flags &= ~TCQ_F_THROTTLED;
-                                goto fin;
-                        }
+                        if (likely(skb != NULL))
+                                goto ok;
                 }
         }
         sch->qstats.overlimits++;
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 21f13da24763..436a2e75b322 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -83,7 +83,6 @@ multiq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         ret = qdisc_enqueue(skb, qdisc);
         if (ret == NET_XMIT_SUCCESS) {
-                qdisc_bstats_update(sch, skb);
                 sch->q.qlen++;
                 return NET_XMIT_SUCCESS;
         }
@@ -112,6 +111,7 @@ static struct sk_buff *multiq_dequeue(struct Qdisc *sch)
                         qdisc = q->queues[q->curband];
                         skb = qdisc->dequeue(qdisc);
                         if (skb) {
+                                qdisc_bstats_update(sch, skb);
                                 sch->q.qlen--;
                                 return skb;
                         }
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 1c4bce863479..6a3006b38dc5 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -240,7 +240,6 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         if (likely(ret == NET_XMIT_SUCCESS)) {
                 sch->q.qlen++;
-                qdisc_bstats_update(sch, skb);
         } else if (net_xmit_drop_count(ret)) {
                 sch->qstats.drops++;
         }
@@ -289,6 +288,7 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch)
                                 skb->tstamp.tv64 = 0;
 #endif
                         pr_debug("netem_dequeue: return skb=%p\n", skb);
+                        qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
@@ -476,7 +476,6 @@ static int tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
                 __skb_queue_after(list, skb, nskb);
 
                 sch->qstats.backlog += qdisc_pkt_len(nskb);
-                qdisc_bstats_update(sch, nskb);
 
                 return NET_XMIT_SUCCESS;
         }
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 966158d49dd1..fbd710d619bf 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -84,7 +84,6 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         ret = qdisc_enqueue(skb, qdisc);
         if (ret == NET_XMIT_SUCCESS) {
-                qdisc_bstats_update(sch, skb);
                 sch->q.qlen++;
                 return NET_XMIT_SUCCESS;
         }
@@ -116,6 +115,7 @@ static struct sk_buff *prio_dequeue(struct Qdisc* sch)
                 struct Qdisc *qdisc = q->queues[prio];
                 struct sk_buff *skb = qdisc->dequeue(qdisc);
                 if (skb) {
+                        qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index a6009c5a2c97..9f98dbd32d4c 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -94,7 +94,6 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 
         ret = qdisc_enqueue(skb, child);
         if (likely(ret == NET_XMIT_SUCCESS)) {
-                qdisc_bstats_update(sch, skb);
                 sch->q.qlen++;
         } else if (net_xmit_drop_count(ret)) {
                 q->stats.pdrop++;
@@ -114,11 +113,13 @@ static struct sk_buff * red_dequeue(struct Qdisc* sch)
         struct Qdisc *child = q->qdisc;
 
         skb = child->dequeue(child);
-        if (skb)
+        if (skb) {
+                qdisc_bstats_update(sch, skb);
                 sch->q.qlen--;
-        else if (!red_is_idling(&q->parms))
-                red_start_of_idle_period(&q->parms);
-
+        } else {
+                if (!red_is_idling(&q->parms))
+                        red_start_of_idle_period(&q->parms);
+        }
         return skb;
 }
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 239ec53a634d..edea8cefec6c 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -402,10 +402,8 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 q->tail = slot;
                 slot->allot = q->scaled_quantum;
         }
-        if (++sch->q.qlen <= q->limit) {
-                qdisc_bstats_update(sch, skb);
+        if (++sch->q.qlen <= q->limit)
                 return NET_XMIT_SUCCESS;
-        }
 
         sfq_drop(sch);
         return NET_XMIT_CN;
@@ -445,6 +443,7 @@ next_slot:
         }
         skb = slot_dequeue_head(slot);
         sfq_dec(q, a);
+        qdisc_bstats_update(sch, skb);
         sch->q.qlen--;
         sch->qstats.backlog -= qdisc_pkt_len(skb);
 
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 77565e721811..e93165820c3f 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -134,7 +134,6 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
         }
 
         sch->q.qlen++;
-        qdisc_bstats_update(sch, skb);
         return NET_XMIT_SUCCESS;
 }
 
@@ -187,6 +186,7 @@ static struct sk_buff *tbf_dequeue(struct Qdisc* sch)
                         q->ptokens = ptoks;
                         sch->q.qlen--;
                         sch->flags &= ~TCQ_F_THROTTLED;
+                        qdisc_bstats_update(sch, skb);
                         return skb;
                 }
 
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 84ce48eadff4..d84e7329660f 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -87,7 +87,6 @@ teql_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 
         if (q->q.qlen < dev->tx_queue_len) {
                 __skb_queue_tail(&q->q, skb);
-                qdisc_bstats_update(sch, skb);
                 return NET_XMIT_SUCCESS;
         }
 
@@ -111,6 +110,8 @@ teql_dequeue(struct Qdisc* sch)
                         dat->m->slaves = sch;
                         netif_wake_queue(m);
                 }
+        } else {
+                qdisc_bstats_update(sch, skb);
         }
         sch->q.qlen = dat->q.qlen + dat_queue->qdisc->q.qlen;
         return skb;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 7bd3bbba4710..d802e941d365 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1609,9 +1609,7 @@ static struct svc_xprt *svc_bc_create_socket(struct svc_serv *serv,
  */
 static void svc_bc_sock_free(struct svc_xprt *xprt)
 {
-        if (xprt) {
-                kfree(xprt->xpt_bc_sid);
+        if (xprt)
                 kfree(container_of(xprt, struct svc_sock, sk_xprt));
-        }
 }
 #endif /* CONFIG_NFS_V4_1 */
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e276eb468536..c8d699270687 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3198,7 +3198,11 @@ static void selinux_cred_free(struct cred *cred)
 {
         struct task_security_struct *tsec = cred->security;
 
-        BUG_ON((unsigned long) cred->security < PAGE_SIZE);
+        /*
+         * cred->security == NULL if security_cred_alloc_blank() or
+         * security_prepare_creds() returned an error.
+         */
+        BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
         cred->security = (void *) 0x7UL;
         kfree(tsec);
 }
diff --git a/sound/arm/aaci.c b/sound/arm/aaci.c
index 24d3013c0231..7c1fc64cb53d 100644
--- a/sound/arm/aaci.c
+++ b/sound/arm/aaci.c
@@ -50,7 +50,11 @@ static void aaci_ac97_select_codec(struct aaci *aaci, struct snd_ac97 *ac97)
         if (v & SLFR_1RXV)
                 readl(aaci->base + AACI_SL1RX);
 
-        writel(maincr, aaci->base + AACI_MAINCR);
+        if (maincr != readl(aaci->base + AACI_MAINCR)) {
+                writel(maincr, aaci->base + AACI_MAINCR);
+                readl(aaci->base + AACI_MAINCR);
+                udelay(1);
+        }
 }
 
 /*
@@ -993,6 +997,8 @@ static unsigned int __devinit aaci_size_fifo(struct aaci *aaci)
          * disabling the channel doesn't clear the FIFO.
          */
         writel(aaci->maincr & ~MAINCR_IE, aaci->base + AACI_MAINCR);
+        readl(aaci->base + AACI_MAINCR);
+        udelay(1);
         writel(aaci->maincr, aaci->base + AACI_MAINCR);
 
         /*
diff --git a/sound/atmel/ac97c.c b/sound/atmel/ac97c.c
index 10c3a871a12d..b310702c646e 100644
--- a/sound/atmel/ac97c.c
+++ b/sound/atmel/ac97c.c
@@ -33,9 +33,12 @@
 #include <linux/dw_dmac.h>
 
 #include <mach/cpu.h>
-#include <mach/hardware.h>
 #include <mach/gpio.h>
 
+#ifdef CONFIG_ARCH_AT91
+#include <mach/hardware.h>
+#endif
+
 #include "ac97c.h"
 
 enum {
diff --git a/sound/drivers/mtpav.c b/sound/drivers/mtpav.c
index da03597fc893..5c426df87678 100644
--- a/sound/drivers/mtpav.c
+++ b/sound/drivers/mtpav.c
@@ -55,14 +55,13 @@
 #include <linux/err.h>
 #include <linux/platform_device.h>
 #include <linux/ioport.h>
+#include <linux/io.h>
 #include <linux/moduleparam.h>
 #include <sound/core.h>
 #include <sound/initval.h>
 #include <sound/rawmidi.h>
 #include <linux/delay.h>
 
-#include <asm/io.h>
-
 /*
  *      globals
  */
diff --git a/sound/oss/Makefile b/sound/oss/Makefile
index 96f14dcd0cd1..90ffb99c6b17 100644
--- a/sound/oss/Makefile
+++ b/sound/oss/Makefile
@@ -87,7 +87,7 @@ ifeq ($(CONFIG_PSS_HAVE_BOOT),y)
         $(obj)/bin2hex pss_synth < $< > $@
 else
     $(obj)/pss_boot.h:
-        (                                                       \
+        $(Q)(                                                   \
             echo 'static unsigned char * pss_synth = NULL;';    \
             echo 'static int pss_synthLen = 0;';                \
         ) > $@
@@ -102,7 +102,7 @@ ifeq ($(CONFIG_TRIX_HAVE_BOOT),y)
         $(obj)/hex2hex -i trix_boot < $< > $@
 else
     $(obj)/trix_boot.h:
-        (                                                       \
+        $(Q)(                                                   \
             echo 'static unsigned char * trix_boot = NULL;';    \
             echo 'static int trix_boot_len = 0;';               \
         ) > $@
diff --git a/sound/pci/azt3328.c b/sound/pci/azt3328.c
index 6117595fc075..573594bf3225 100644
--- a/sound/pci/azt3328.c
+++ b/sound/pci/azt3328.c
@@ -979,31 +979,25 @@ snd_azf3328_codec_setfmt(struct snd_azf3328_codec_data *codec,
 
         snd_azf3328_dbgcallenter();
         switch (bitrate) {
-#define AZF_FMT_XLATE(in_freq, out_bits) \
-        do { \
-                case AZF_FREQ_ ## in_freq: \
-                        freq = SOUNDFORMAT_FREQ_ ## out_bits; \
-                        break; \
-        } while (0);
-        AZF_FMT_XLATE(4000, SUSPECTED_4000)
-        AZF_FMT_XLATE(4800, SUSPECTED_4800)
-        /* the AZF3328 names it "5510" for some strange reason: */
-        AZF_FMT_XLATE(5512, 5510)
-        AZF_FMT_XLATE(6620, 6620)
-        AZF_FMT_XLATE(8000, 8000)
-        AZF_FMT_XLATE(9600, 9600)
-        AZF_FMT_XLATE(11025, 11025)
-        AZF_FMT_XLATE(13240, SUSPECTED_13240)
-        AZF_FMT_XLATE(16000, 16000)
-        AZF_FMT_XLATE(22050, 22050)
-        AZF_FMT_XLATE(32000, 32000)
+        case AZF_FREQ_4000:  freq = SOUNDFORMAT_FREQ_SUSPECTED_4000; break;
+        case AZF_FREQ_4800:  freq = SOUNDFORMAT_FREQ_SUSPECTED_4800; break;
+        case AZF_FREQ_5512:
+                /* the AZF3328 names it "5510" for some strange reason */
+                             freq = SOUNDFORMAT_FREQ_5510; break;
+        case AZF_FREQ_6620:  freq = SOUNDFORMAT_FREQ_6620; break;
+        case AZF_FREQ_8000:  freq = SOUNDFORMAT_FREQ_8000; break;
+        case AZF_FREQ_9600:  freq = SOUNDFORMAT_FREQ_9600; break;
+        case AZF_FREQ_11025: freq = SOUNDFORMAT_FREQ_11025; break;
+        case AZF_FREQ_13240: freq = SOUNDFORMAT_FREQ_SUSPECTED_13240; break;
+        case AZF_FREQ_16000: freq = SOUNDFORMAT_FREQ_16000; break;
+        case AZF_FREQ_22050: freq = SOUNDFORMAT_FREQ_22050; break;
+        case AZF_FREQ_32000: freq = SOUNDFORMAT_FREQ_32000; break;
         default:
                 snd_printk(KERN_WARNING "unknown bitrate %d, assuming 44.1kHz!\n", bitrate);
                 /* fall-through */
-        AZF_FMT_XLATE(44100, 44100)
-        AZF_FMT_XLATE(48000, 48000)
-        AZF_FMT_XLATE(66200, SUSPECTED_66200)
-#undef AZF_FMT_XLATE
+        case AZF_FREQ_44100: freq = SOUNDFORMAT_FREQ_44100; break;
+        case AZF_FREQ_48000: freq = SOUNDFORMAT_FREQ_48000; break;
+        case AZF_FREQ_66200: freq = SOUNDFORMAT_FREQ_SUSPECTED_66200; break;
         }
         /* val = 0xff07; 3m27.993s (65301Hz; -> 64000Hz???) hmm, 66120, 65967, 66123 */
         /* val = 0xff09; 17m15.098s (13123,478Hz; -> 12000Hz???) hmm, 13237.2Hz? */
diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index 4a663471dadc..74b0560289c0 100644
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -381,7 +381,7 @@ static void hdmi_show_short_audio_desc(struct cea_sad *a)
         snd_print_pcm_rates(a->rates, buf, sizeof(buf));
 
         if (a->format == AUDIO_CODING_TYPE_LPCM)
-                snd_print_pcm_bits(a->sample_bits, buf2 + 8, sizeof(buf2 - 8));
+                snd_print_pcm_bits(a->sample_bits, buf2 + 8, sizeof(buf2) - 8);
         else if (a->max_bitrate)
                 snprintf(buf2, sizeof(buf2),
                                 ", max bitrate = %d", a->max_bitrate);
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 9bb030a469cd..fbe97d32140d 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -85,6 +85,7 @@ struct conexant_spec {
         unsigned int auto_mic;
         int auto_mic_ext;               /* autocfg.inputs[] index for ext mic */
         unsigned int need_dac_fix;
+        hda_nid_t slave_dig_outs[2];
 
         /* capture */
         unsigned int num_adc_nids;
@@ -127,6 +128,7 @@ struct conexant_spec {
         unsigned int ideapad:1;
         unsigned int thinkpad:1;
         unsigned int hp_laptop:1;
+        unsigned int asus:1;
 
         unsigned int ext_mic_present;
         unsigned int recording;
@@ -352,6 +354,8 @@ static int conexant_build_pcms(struct hda_codec *codec)
                         info->stream[SNDRV_PCM_STREAM_CAPTURE].nid =
                                 spec->dig_in_nid;
                 }
+                if (spec->slave_dig_outs[0])
+                        codec->slave_dig_outs = spec->slave_dig_outs;
         }
 
         return 0;
@@ -403,10 +407,16 @@ static int conexant_add_jack(struct hda_codec *codec,
         struct conexant_spec *spec;
         struct conexant_jack *jack;
         const char *name;
-        int err;
+        int i, err;
 
         spec = codec->spec;
         snd_array_init(&spec->jacks, sizeof(*jack), 32);
+
+        jack = spec->jacks.list;
+        for (i = 0; i < spec->jacks.used; i++, jack++)
+                if (jack->nid == nid)
+                        return 0 ; /* already present */
+
         jack = snd_array_new(&spec->jacks);
         name = (type == SND_JACK_HEADPHONE) ? "Headphone" : "Mic" ;
 
@@ -2100,7 +2110,7 @@ static int patch_cxt5051(struct hda_codec *codec)
 static hda_nid_t cxt5066_dac_nids[1] = { 0x10 };
 static hda_nid_t cxt5066_adc_nids[3] = { 0x14, 0x15, 0x16 };
 static hda_nid_t cxt5066_capsrc_nids[1] = { 0x17 };
-#define CXT5066_SPDIF_OUT       0x21
+static hda_nid_t cxt5066_digout_pin_nids[2] = { 0x20, 0x22 };
 
 /* OLPC's microphone port is DC coupled for use with external sensors,
  * therefore we use a 50% mic bias in order to center the input signal with
@@ -2312,6 +2322,19 @@ static void cxt5066_ideapad_automic(struct hda_codec *codec)
         }
 }
 
+
+/* toggle input of built-in digital mic and mic jack appropriately */
+static void cxt5066_asus_automic(struct hda_codec *codec)
+{
+        unsigned int present;
+
+        present = snd_hda_jack_detect(codec, 0x1b);
+        snd_printdd("CXT5066: external microphone present=%d\n", present);
+        snd_hda_codec_write(codec, 0x17, 0, AC_VERB_SET_CONNECT_SEL,
+                            present ? 1 : 0);
+}
+
+
 /* toggle input of built-in digital mic and mic jack appropriately */
 static void cxt5066_hp_laptop_automic(struct hda_codec *codec)
 {
@@ -2387,79 +2410,55 @@ static void cxt5066_hp_automute(struct hda_codec *codec)
         cxt5066_update_speaker(codec);
 }
 
-/* unsolicited event for jack sensing */
-static void cxt5066_olpc_unsol_event(struct hda_codec *codec, unsigned int res)
+/* Dispatch the right mic autoswitch function */
+static void cxt5066_automic(struct hda_codec *codec)
 {
         struct conexant_spec *spec = codec->spec;
-        snd_printdd("CXT5066: unsol event %x (%x)\n", res, res >> 26);
-        switch (res >> 26) {
-        case CONEXANT_HP_EVENT:
-                cxt5066_hp_automute(codec);
-                break;
-        case CONEXANT_MIC_EVENT:
-                /* ignore mic events in DC mode; we're always using the jack */
-                if (!spec->dc_enable)
-                        cxt5066_olpc_automic(codec);
-                break;
-        }
-}
 
-/* unsolicited event for jack sensing */
-static void cxt5066_vostro_event(struct hda_codec *codec, unsigned int res)
-{
-        snd_printdd("CXT5066_vostro: unsol event %x (%x)\n", res, res >> 26);
-        switch (res >> 26) {
-        case CONEXANT_HP_EVENT:
-                cxt5066_hp_automute(codec);
-                break;
-        case CONEXANT_MIC_EVENT:
+        if (spec->dell_vostro)
                 cxt5066_vostro_automic(codec);
-                break;
-        }
-}
-
-/* unsolicited event for jack sensing */
-static void cxt5066_ideapad_event(struct hda_codec *codec, unsigned int res)
-{
-        snd_printdd("CXT5066_ideapad: unsol event %x (%x)\n", res, res >> 26);
-        switch (res >> 26) {
-        case CONEXANT_HP_EVENT:
-                cxt5066_hp_automute(codec);
-                break;
-        case CONEXANT_MIC_EVENT:
+        else if (spec->ideapad)
                 cxt5066_ideapad_automic(codec);
-                break;
-        }
+        else if (spec->thinkpad)
+                cxt5066_thinkpad_automic(codec);
+        else if (spec->hp_laptop)
+                cxt5066_hp_laptop_automic(codec);
+        else if (spec->asus)
+                cxt5066_asus_automic(codec);
 }
 
 /* unsolicited event for jack sensing */
-static void cxt5066_hp_laptop_event(struct hda_codec *codec, unsigned int res)
+static void cxt5066_olpc_unsol_event(struct hda_codec *codec, unsigned int res)
 {
-        snd_printdd("CXT5066_hp_laptop: unsol event %x (%x)\n", res, res >> 26);
+        struct conexant_spec *spec = codec->spec;
+        snd_printdd("CXT5066: unsol event %x (%x)\n", res, res >> 26);
         switch (res >> 26) {
         case CONEXANT_HP_EVENT:
                 cxt5066_hp_automute(codec);
                 break;
         case CONEXANT_MIC_EVENT:
-                cxt5066_hp_laptop_automic(codec);
+                /* ignore mic events in DC mode; we're always using the jack */
+                if (!spec->dc_enable)
+                        cxt5066_olpc_automic(codec);
                 break;
         }
 }
 
 /* unsolicited event for jack sensing */
-static void cxt5066_thinkpad_event(struct hda_codec *codec, unsigned int res)
+static void cxt5066_unsol_event(struct hda_codec *codec, unsigned int res)
 {
-        snd_printdd("CXT5066_thinkpad: unsol event %x (%x)\n", res, res >> 26);
+        snd_printdd("CXT5066: unsol event %x (%x)\n", res, res >> 26);
         switch (res >> 26) {
         case CONEXANT_HP_EVENT:
                 cxt5066_hp_automute(codec);
                 break;
         case CONEXANT_MIC_EVENT:
-                cxt5066_thinkpad_automic(codec);
+                cxt5066_automic(codec);
                 break;
         }
 }
 
+
 static const struct hda_input_mux cxt5066_analog_mic_boost = {
         .num_items = 5,
         .items = {
@@ -2633,6 +2632,27 @@ static void cxt5066_olpc_capture_cleanup(struct hda_codec *codec)
         spec->recording = 0;
 }
 
+static void conexant_check_dig_outs(struct hda_codec *codec,
+                                    hda_nid_t *dig_pins,
+                                    int num_pins)
+{
+        struct conexant_spec *spec = codec->spec;
+        hda_nid_t *nid_loc = &spec->multiout.dig_out_nid;
+        int i;
+
+        for (i = 0; i < num_pins; i++, dig_pins++) {
+                unsigned int cfg = snd_hda_codec_get_pincfg(codec, *dig_pins);
+                if (get_defcfg_connect(cfg) == AC_JACK_PORT_NONE)
+                        continue;
+                if (snd_hda_get_connections(codec, *dig_pins, nid_loc, 1) != 1)
+                        continue;
+                if (spec->slave_dig_outs[0])
+                        nid_loc++;
+                else
+                        nid_loc = spec->slave_dig_outs;
+        }
+}
+
 static struct hda_input_mux cxt5066_capture_source = {
         .num_items = 4,
         .items = {
@@ -3039,20 +3059,11 @@ static struct hda_verb cxt5066_init_verbs_hp_laptop[] = {
 /* initialize jack-sensing, too */
 static int cxt5066_init(struct hda_codec *codec)
 {
-        struct conexant_spec *spec = codec->spec;
-
         snd_printdd("CXT5066: init\n");
         conexant_init(codec);
         if (codec->patch_ops.unsol_event) {
                 cxt5066_hp_automute(codec);
-                if (spec->dell_vostro)
-                        cxt5066_vostro_automic(codec);
-                else if (spec->ideapad)
-                        cxt5066_ideapad_automic(codec);
-                else if (spec->thinkpad)
-                        cxt5066_thinkpad_automic(codec);
-                else if (spec->hp_laptop)
-                        cxt5066_hp_laptop_automic(codec);
+                cxt5066_automic(codec);
         }
         cxt5066_set_mic_boost(codec);
         return 0;
@@ -3080,6 +3091,7 @@ enum {
         CXT5066_DELL_VOSTRO,    /* Dell Vostro 1015i */
         CXT5066_IDEAPAD,        /* Lenovo IdeaPad U150 */
         CXT5066_THINKPAD,       /* Lenovo ThinkPad T410s, others? */
+        CXT5066_ASUS,           /* Asus K52JU, Lenovo G560 - Int mic at 0x1a and Ext mic at 0x1b */
         CXT5066_HP_LAPTOP,      /* HP Laptop */
         CXT5066_MODELS
 };
@@ -3091,6 +3103,7 @@ static const char * const cxt5066_models[CXT5066_MODELS] = {
         [CXT5066_DELL_VOSTRO]   = "dell-vostro",
         [CXT5066_IDEAPAD]       = "ideapad",
         [CXT5066_THINKPAD]      = "thinkpad",
+        [CXT5066_ASUS]          = "asus",
         [CXT5066_HP_LAPTOP]     = "hp-laptop",
 };
 
@@ -3102,7 +3115,9 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTRO),
         SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x103c, 0x360b, "HP G60", CXT5066_HP_LAPTOP),
-        SND_PCI_QUIRK(0x1043, 0x13f3, "Asus A52J", CXT5066_HP_LAPTOP),
+        SND_PCI_QUIRK(0x1043, 0x13f3, "Asus A52J", CXT5066_ASUS),
+        SND_PCI_QUIRK(0x1043, 0x1643, "Asus K52JU", CXT5066_ASUS),
+        SND_PCI_QUIRK(0x1043, 0x1993, "Asus U50F", CXT5066_ASUS),
         SND_PCI_QUIRK(0x1179, 0xff1e, "Toshiba Satellite C650D", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x1179, 0xff50, "Toshiba Satellite P500-PSPGSC-01800T", CXT5066_OLPC_XO_1_5),
         SND_PCI_QUIRK(0x1179, 0xffe0, "Toshiba Satellite Pro T130-15F", CXT5066_OLPC_XO_1_5),
@@ -3111,7 +3126,9 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
         SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT5066_OLPC_XO_1_5),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400s", CXT5066_THINKPAD),
         SND_PCI_QUIRK(0x17aa, 0x21c5, "Thinkpad Edge 13", CXT5066_THINKPAD),
+        SND_PCI_QUIRK(0x17aa, 0x21c6, "Thinkpad Edge 13", CXT5066_ASUS),
         SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
+        SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo G560", CXT5066_ASUS),
         SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo", CXT5066_IDEAPAD), /* Fallback for Lenovos without dock mic */
         {}
 };
@@ -3133,7 +3150,8 @@ static int patch_cxt5066(struct hda_codec *codec)
         spec->multiout.max_channels = 2;
         spec->multiout.num_dacs = ARRAY_SIZE(cxt5066_dac_nids);
         spec->multiout.dac_nids = cxt5066_dac_nids;
-        spec->multiout.dig_out_nid = CXT5066_SPDIF_OUT;
+        conexant_check_dig_outs(codec, cxt5066_digout_pin_nids,
+            ARRAY_SIZE(cxt5066_digout_pin_nids));
         spec->num_adc_nids = 1;
         spec->adc_nids = cxt5066_adc_nids;
         spec->capsrc_nids = cxt5066_capsrc_nids;
@@ -3167,17 +3185,20 @@ static int patch_cxt5066(struct hda_codec *codec)
                 spec->num_init_verbs++;
                 spec->dell_automute = 1;
                 break;
+        case CXT5066_ASUS:
         case CXT5066_HP_LAPTOP:
                 codec->patch_ops.init = cxt5066_init;
-                codec->patch_ops.unsol_event = cxt5066_hp_laptop_event;
+                codec->patch_ops.unsol_event = cxt5066_unsol_event;
                 spec->init_verbs[spec->num_init_verbs] =
                         cxt5066_init_verbs_hp_laptop;
                 spec->num_init_verbs++;
-                spec->hp_laptop = 1;
+                spec->hp_laptop = board_config == CXT5066_HP_LAPTOP;
+                spec->asus = board_config == CXT5066_ASUS;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixer_master;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixers;
                 /* no S/PDIF out */
-                spec->multiout.dig_out_nid = 0;
+                if (board_config == CXT5066_HP_LAPTOP)
+                        spec->multiout.dig_out_nid = 0;
                 /* input source automatically selected */
                 spec->input_mux = NULL;
                 spec->port_d_mode = 0;
@@ -3207,7 +3228,7 @@ static int patch_cxt5066(struct hda_codec *codec)
                 break;
         case CXT5066_DELL_VOSTRO:
                 codec->patch_ops.init = cxt5066_init;
-                codec->patch_ops.unsol_event = cxt5066_vostro_event;
+                codec->patch_ops.unsol_event = cxt5066_unsol_event;
                 spec->init_verbs[0] = cxt5066_init_verbs_vostro;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixer_master_olpc;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixers;
@@ -3224,7 +3245,7 @@ static int patch_cxt5066(struct hda_codec *codec)
                 break;
         case CXT5066_IDEAPAD:
                 codec->patch_ops.init = cxt5066_init;
-                codec->patch_ops.unsol_event = cxt5066_ideapad_event;
+                codec->patch_ops.unsol_event = cxt5066_unsol_event;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixer_master;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixers;
                 spec->init_verbs[0] = cxt5066_init_verbs_ideapad;
@@ -3240,7 +3261,7 @@ static int patch_cxt5066(struct hda_codec *codec)
                 break;
         case CXT5066_THINKPAD:
                 codec->patch_ops.init = cxt5066_init;
-                codec->patch_ops.unsol_event = cxt5066_thinkpad_event;
+                codec->patch_ops.unsol_event = cxt5066_unsol_event;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixer_master;
                 spec->mixers[spec->num_mixers++] = cxt5066_mixers;
                 spec->init_verbs[0] = cxt5066_init_verbs_thinkpad;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index be4df4c6fd56..2fa9ed99c32f 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -14954,9 +14954,11 @@ static struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
         SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
         SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
-        SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
-        SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+        SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
+        SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
+        SND_PCI_QUIRK(0x17aa, 0x21ca, "Thinkpad L412", ALC269_FIXUP_SKU_IGNORE),
+        SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
         SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
         {}
diff --git a/sound/pci/oxygen/oxygen.h b/sound/pci/oxygen/oxygen.h
index c2ae63d17cd2..f53897a708b4 100644
--- a/sound/pci/oxygen/oxygen.h
+++ b/sound/pci/oxygen/oxygen.h
@@ -92,6 +92,8 @@ struct oxygen_model {
         void (*update_dac_volume)(struct oxygen *chip);
         void (*update_dac_mute)(struct oxygen *chip);
         void (*update_center_lfe_mix)(struct oxygen *chip, bool mixed);
+        unsigned int (*adjust_dac_routing)(struct oxygen *chip,
+                                           unsigned int play_routing);
         void (*gpio_changed)(struct oxygen *chip);
         void (*uart_input)(struct oxygen *chip);
         void (*ac97_switch)(struct oxygen *chip,
diff --git a/sound/pci/oxygen/oxygen_mixer.c b/sound/pci/oxygen/oxygen_mixer.c
index 9bff14d5895d..26c7e8bcb229 100644
--- a/sound/pci/oxygen/oxygen_mixer.c
+++ b/sound/pci/oxygen/oxygen_mixer.c
@@ -180,6 +180,8 @@ void oxygen_update_dac_routing(struct oxygen *chip)
                             (1 << OXYGEN_PLAY_DAC1_SOURCE_SHIFT) |
                             (2 << OXYGEN_PLAY_DAC2_SOURCE_SHIFT) |
                             (3 << OXYGEN_PLAY_DAC3_SOURCE_SHIFT);
+        if (chip->model.adjust_dac_routing)
+                reg_value = chip->model.adjust_dac_routing(chip, reg_value);
         oxygen_write16_masked(chip, OXYGEN_PLAY_ROUTING, reg_value,
                               OXYGEN_PLAY_DAC0_SOURCE_MASK |
                               OXYGEN_PLAY_DAC1_SOURCE_MASK |
diff --git a/sound/pci/oxygen/xonar_cs43xx.c b/sound/pci/oxygen/xonar_cs43xx.c
index 9f72d424969c..252719101c42 100644
--- a/sound/pci/oxygen/xonar_cs43xx.c
+++ b/sound/pci/oxygen/xonar_cs43xx.c
@@ -392,7 +392,7 @@ static void dump_d1_registers(struct oxygen *chip,
         unsigned int i;
 
         snd_iprintf(buffer, "\nCS4398: 7?");
-        for (i = 2; i <= 8; ++i)
+        for (i = 2; i < 8; ++i)
                 snd_iprintf(buffer, " %02x", data->cs4398_regs[i]);
         snd_iprintf(buffer, "\n");
         dump_cs4362a_registers(data, buffer);
diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
index e1fa602eba79..bc6eb58be380 100644
--- a/sound/pci/oxygen/xonar_dg.c
+++ b/sound/pci/oxygen/xonar_dg.c
@@ -24,6 +24,11 @@
  *
  *   SPI 0 -> CS4245
  *
+ *   I²S 1 -> CS4245
+ *   I²S 2 -> CS4361 (center/LFE)
+ *   I²S 3 -> CS4361 (surround)
+ *   I²S 4 -> CS4361 (front)
+ *
  *   GPIO 3 <- ?
  *   GPIO 4 <- headphone detect
  *   GPIO 5 -> route input jack to line-in (0) or mic-in (1)
@@ -36,6 +41,7 @@
  *   input 1 <- aux
  *   input 2 <- front mic
  *   input 4 <- line/mic
+ *   DAC out -> headphones
  *   aux out -> front panel headphones
  */
 
@@ -207,6 +213,35 @@ static void set_cs4245_adc_params(struct oxygen *chip,
         cs4245_write_cached(chip, CS4245_ADC_CTRL, value);
 }
 
+static inline unsigned int shift_bits(unsigned int value,
+                                      unsigned int shift_from,
+                                      unsigned int shift_to,
+                                      unsigned int mask)
+{
+        if (shift_from < shift_to)
+                return (value << (shift_to - shift_from)) & mask;
+        else
+                return (value >> (shift_from - shift_to)) & mask;
+}
+
+static unsigned int adjust_dg_dac_routing(struct oxygen *chip,
+                                          unsigned int play_routing)
+{
+        return (play_routing & OXYGEN_PLAY_DAC0_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC2_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC1_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC1_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC1_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC2_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC2_SOURCE_MASK) |
+               shift_bits(play_routing,
+                          OXYGEN_PLAY_DAC0_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC3_SOURCE_SHIFT,
+                          OXYGEN_PLAY_DAC3_SOURCE_MASK);
+}
+
 static int output_switch_info(struct snd_kcontrol *ctl,
                               struct snd_ctl_elem_info *info)
 {
@@ -557,6 +592,7 @@ struct oxygen_model model_xonar_dg = {
         .resume = dg_resume,
         .set_dac_params = set_cs4245_dac_params,
         .set_adc_params = set_cs4245_adc_params,
+        .adjust_dac_routing = adjust_dg_dac_routing,
         .dump_registers = dump_cs4245_registers,
         .model_data_size = sizeof(struct dg),
         .device_config = PLAYBACK_0_TO_I2S |
diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.h b/sound/pcmcia/pdaudiocf/pdaudiocf.h
index bd26e092aead..6ce9ad700290 100644
--- a/sound/pcmcia/pdaudiocf/pdaudiocf.h
+++ b/sound/pcmcia/pdaudiocf/pdaudiocf.h
@@ -22,7 +22,7 @@
 #define __PDAUDIOCF_H
 
 #include <sound/pcm.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <linux/interrupt.h>
 #include <pcmcia/cistpl.h>
 #include <pcmcia/ds.h>
diff --git a/sound/pcmcia/vx/vxp_ops.c b/sound/pcmcia/vx/vxp_ops.c
index 989e04abb520..fe33e122e372 100644
--- a/sound/pcmcia/vx/vxp_ops.c
+++ b/sound/pcmcia/vx/vxp_ops.c
@@ -23,8 +23,8 @@
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/firmware.h>
+#include <linux/io.h>
 #include <sound/core.h>
-#include <asm/io.h>
 #include "vxpocket.h"
 
 
diff --git a/sound/soc/atmel/snd-soc-afeb9260.c b/sound/soc/atmel/snd-soc-afeb9260.c
index da2208e06b0d..5e4d499d8434 100644
--- a/sound/soc/atmel/snd-soc-afeb9260.c
+++ b/sound/soc/atmel/snd-soc-afeb9260.c
@@ -129,7 +129,7 @@ static struct snd_soc_dai_link afeb9260_dai = {
         .cpu_dai_name = "atmel-ssc-dai.0",
         .codec_dai_name = "tlv320aic23-hifi",
         .platform_name = "atmel_pcm-audio",
-        .codec_name = "tlv320aic23-codec.0-0x1a",
+        .codec_name = "tlv320aic23-codec.0-001a",
         .init = afeb9260_tlv320aic23_init,
         .ops = &afeb9260_ops,
 };
diff --git a/sound/soc/blackfin/bf5xx-ssm2602.c b/sound/soc/blackfin/bf5xx-ssm2602.c
index e902b24c1856..ad28663f5bbd 100644
--- a/sound/soc/blackfin/bf5xx-ssm2602.c
+++ b/sound/soc/blackfin/bf5xx-ssm2602.c
@@ -119,7 +119,7 @@ static struct snd_soc_dai_link bf5xx_ssm2602_dai = {
         .cpu_dai_name = "bf5xx-i2s",
         .codec_dai_name = "ssm2602-hifi",
         .platform_name = "bf5xx-pcm-audio",
-        .codec_name = "ssm2602-codec.0-0x1b",
+        .codec_name = "ssm2602-codec.0-001b",
         .ops = &bf5xx_ssm2602_ops,
 };
 
diff --git a/sound/soc/codecs/cq93vc.c b/sound/soc/codecs/cq93vc.c
index 46dbfd067f79..347a567b01e1 100644
--- a/sound/soc/codecs/cq93vc.c
+++ b/sound/soc/codecs/cq93vc.c
@@ -153,7 +153,7 @@ static int cq93vc_resume(struct snd_soc_codec *codec)
 
 static int cq93vc_probe(struct snd_soc_codec *codec)
 {
-        struct davinci_vc *davinci_vc = codec->dev->platform_data;
+        struct davinci_vc *davinci_vc = snd_soc_codec_get_drvdata(codec);
 
         davinci_vc->cq93vc.codec = codec;
         codec->control_data = davinci_vc;
diff --git a/sound/soc/codecs/cx20442.c b/sound/soc/codecs/cx20442.c
index 03d1e860d229..bb4bf65b9e7e 100644
--- a/sound/soc/codecs/cx20442.c
+++ b/sound/soc/codecs/cx20442.c
@@ -367,9 +367,12 @@ static int cx20442_codec_remove(struct snd_soc_codec *codec)
         return 0;
 }
 
+static const u8 cx20442_reg = CX20442_TELOUT | CX20442_MIC;
+
 static struct snd_soc_codec_driver cx20442_codec_dev = {
         .probe =        cx20442_codec_probe,
         .remove =       cx20442_codec_remove,
+        .reg_cache_default = &cx20442_reg,
         .reg_cache_size = 1,
         .reg_word_size = sizeof(u8),
         .read = cx20442_read_reg_cache,
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 247a6a99feb8..3351f77607b3 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -2386,7 +2386,7 @@ static int wm8994_set_tristate(struct snd_soc_dai *codec_dai, int tristate)
         else
                 val = 0;
 
-        return snd_soc_update_bits(codec, reg, mask, reg);
+        return snd_soc_update_bits(codec, reg, mask, val);
 }
 
 #define WM8994_RATES SNDRV_PCM_RATE_8000_96000
diff --git a/sound/soc/codecs/wm8995.c b/sound/soc/codecs/wm8995.c
index 6045cbde492b..608c84c5aa8e 100644
--- a/sound/soc/codecs/wm8995.c
+++ b/sound/soc/codecs/wm8995.c
@@ -1223,7 +1223,7 @@ static int wm8995_set_tristate(struct snd_soc_dai *codec_dai, int tristate)
         else
                 val = 0;
 
-        return snd_soc_update_bits(codec, reg, mask, reg);
+        return snd_soc_update_bits(codec, reg, mask, val);
 }
 
 /* The size in bits of the FLL divide multiplied by 10
diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
index c466982eed23..613df5db0b32 100644
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -91,6 +91,7 @@ static void wait_for_dc_servo(struct snd_soc_codec *codec, unsigned int op)
 static void calibrate_dc_servo(struct snd_soc_codec *codec)
 {
         struct wm_hubs_data *hubs = snd_soc_codec_get_drvdata(codec);
+        s8 offset;
         u16 reg, reg_l, reg_r, dcs_cfg;
 
         /* If we're using a digital only path and have a previously
@@ -149,16 +150,14 @@ static void calibrate_dc_servo(struct snd_soc_codec *codec)
                         hubs->dcs_codes);
 
                 /* HPOUT1L */
-                if (reg_l + hubs->dcs_codes > 0 &&
-                    reg_l + hubs->dcs_codes < 0xff)
-                        reg_l += hubs->dcs_codes;
-                dcs_cfg = reg_l << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
+                offset = reg_l;
+                offset += hubs->dcs_codes;
+                dcs_cfg = (u8)offset << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
 
                 /* HPOUT1R */
-                if (reg_r + hubs->dcs_codes > 0 &&
-                    reg_r + hubs->dcs_codes < 0xff)
-                        reg_r += hubs->dcs_codes;
-                dcs_cfg |= reg_r;
+                offset = reg_r;
+                offset += hubs->dcs_codes;
+                dcs_cfg |= (u8)offset;
 
                 dev_dbg(codec->dev, "DCS result: %x\n", dcs_cfg);
 
diff --git a/sound/soc/davinci/davinci-evm.c b/sound/soc/davinci/davinci-evm.c
index 0c2d6bacc681..b36f0b39b090 100644
--- a/sound/soc/davinci/davinci-evm.c
+++ b/sound/soc/davinci/davinci-evm.c
@@ -223,7 +223,7 @@ static struct snd_soc_dai_link da8xx_evm_dai = {
         .stream_name = "AIC3X",
         .cpu_dai_name= "davinci-mcasp.0",
         .codec_dai_name = "tlv320aic3x-hifi",
-        .codec_name = "tlv320aic3x-codec.0-001a",
+        .codec_name = "tlv320aic3x-codec.1-0018",
         .platform_name = "davinci-pcm-audio",
         .init = evm_aic3x_init,
         .ops = &evm_ops,
diff --git a/sound/soc/omap/ams-delta.c b/sound/soc/omap/ams-delta.c
index 2101bdcee21f..3167be689621 100644
--- a/sound/soc/omap/ams-delta.c
+++ b/sound/soc/omap/ams-delta.c
@@ -507,8 +507,6 @@ static int ams_delta_cx20442_init(struct snd_soc_pcm_runtime *rtd)
         /* Set up digital mute if not provided by the codec */
         if (!codec_dai->driver->ops) {
                 codec_dai->driver->ops = &ams_delta_dai_ops;
-        } else if (!codec_dai->driver->ops->digital_mute) {
-                codec_dai->driver->ops->digital_mute = ams_delta_digital_mute;
         } else {
                 ams_delta_ops.startup = ams_delta_startup;
                 ams_delta_ops.shutdown = ams_delta_shutdown;
diff --git a/sound/soc/pxa/corgi.c b/sound/soc/pxa/corgi.c
index fc592f0d5fc7..784cff5f67e8 100644
--- a/sound/soc/pxa/corgi.c
+++ b/sound/soc/pxa/corgi.c
@@ -307,10 +307,10 @@ static int corgi_wm8731_init(struct snd_soc_pcm_runtime *rtd)
 static struct snd_soc_dai_link corgi_dai = {
         .name = "WM8731",
         .stream_name = "WM8731",
-        .cpu_dai_name = "pxa-is2-dai",
+        .cpu_dai_name = "pxa2xx-i2s",
         .codec_dai_name = "wm8731-hifi",
         .platform_name = "pxa-pcm-audio",
-        .codec_name = "wm8731-codec-0.001a",
+        .codec_name = "wm8731-codec-0.001b",
         .init = corgi_wm8731_init,
         .ops = &corgi_ops,
 };
diff --git a/sound/soc/pxa/poodle.c b/sound/soc/pxa/poodle.c
index 6298ee115e27..a7d4999f9b24 100644
--- a/sound/soc/pxa/poodle.c
+++ b/sound/soc/pxa/poodle.c
@@ -276,7 +276,7 @@ static struct snd_soc_dai_link poodle_dai = {
         .cpu_dai_name = "pxa2xx-i2s",
         .codec_dai_name = "wm8731-hifi",
         .platform_name = "pxa-pcm-audio",
-        .codec_name = "wm8731-codec.0-001a",
+        .codec_name = "wm8731-codec.0-001b",
         .init = poodle_wm8731_init,
         .ops = &poodle_ops,
 };
diff --git a/sound/soc/pxa/spitz.c b/sound/soc/pxa/spitz.c
index c2acb69b957a..8e1571350630 100644
--- a/sound/soc/pxa/spitz.c
+++ b/sound/soc/pxa/spitz.c
@@ -315,10 +315,10 @@ static int spitz_wm8750_init(struct snd_soc_pcm_runtime *rtd)
 static struct snd_soc_dai_link spitz_dai = {
         .name = "wm8750",
         .stream_name = "WM8750",
-        .cpu_dai_name = "pxa-is2",
+        .cpu_dai_name = "pxa2xx-i2s",
         .codec_dai_name = "wm8750-hifi",
         .platform_name = "pxa-pcm-audio",
-        .codec_name = "wm8750-codec.0-001a",
+        .codec_name = "wm8750-codec.0-001b",
         .init = spitz_wm8750_init,
         .ops = &spitz_ops,
 };
diff --git a/sound/soc/samsung/neo1973_gta02_wm8753.c b/sound/soc/samsung/neo1973_gta02_wm8753.c
index 3eec610c10f9..0d0ae2b9eef6 100644
--- a/sound/soc/samsung/neo1973_gta02_wm8753.c
+++ b/sound/soc/samsung/neo1973_gta02_wm8753.c
@@ -397,11 +397,11 @@ static struct snd_soc_dai_link neo1973_gta02_dai[] = {
 { /* Hifi Playback - for similatious use with voice below */
         .name = "WM8753",
         .stream_name = "WM8753 HiFi",
-        .cpu_dai_name = "s3c24xx-i2s",
+        .cpu_dai_name = "s3c24xx-iis",
         .codec_dai_name = "wm8753-hifi",
         .init = neo1973_gta02_wm8753_init,
         .platform_name = "samsung-audio",
-        .codec_name = "wm8753-codec.0-0x1a",
+        .codec_name = "wm8753-codec.0-001a",
         .ops = &neo1973_gta02_hifi_ops,
 },
 { /* Voice via BT */
@@ -410,7 +410,7 @@ static struct snd_soc_dai_link neo1973_gta02_dai[] = {
         .cpu_dai_name = "bluetooth-dai",
         .codec_dai_name = "wm8753-voice",
         .ops = &neo1973_gta02_voice_ops,
-        .codec_name = "wm8753-codec.0-0x1a",
+        .codec_name = "wm8753-codec.0-001a",
         .platform_name = "samsung-audio",
 },
 };
diff --git a/sound/soc/samsung/neo1973_wm8753.c b/sound/soc/samsung/neo1973_wm8753.c
index c7a24514beb5..d20815d5ab2e 100644
--- a/sound/soc/samsung/neo1973_wm8753.c
+++ b/sound/soc/samsung/neo1973_wm8753.c
@@ -559,9 +559,9 @@ static struct snd_soc_dai_link neo1973_dai[] = {
         .name = "WM8753",
         .stream_name = "WM8753 HiFi",
         .platform_name = "samsung-audio",
-        .cpu_dai_name = "s3c24xx-i2s",
+        .cpu_dai_name = "s3c24xx-iis",
         .codec_dai_name = "wm8753-hifi",
-        .codec_name = "wm8753-codec.0-0x1a",
+        .codec_name = "wm8753-codec.0-001a",
         .init = neo1973_wm8753_init,
         .ops = &neo1973_hifi_ops,
 },
@@ -571,7 +571,7 @@ static struct snd_soc_dai_link neo1973_dai[] = {
         .platform_name = "samsung-audio",
         .cpu_dai_name = "bluetooth-dai",
         .codec_dai_name = "wm8753-voice",
-        .codec_name = "wm8753-codec.0-0x1a",
+        .codec_name = "wm8753-codec.0-001a",
         .ops = &neo1973_voice_ops,
 },
 };
diff --git a/sound/soc/samsung/s3c24xx_simtec_hermes.c b/sound/soc/samsung/s3c24xx_simtec_hermes.c
index bb4292e3596c..08fcaaa66907 100644
--- a/sound/soc/samsung/s3c24xx_simtec_hermes.c
+++ b/sound/soc/samsung/s3c24xx_simtec_hermes.c
@@ -94,8 +94,8 @@ static int simtec_hermes_init(struct snd_soc_pcm_runtime *rtd)
 static struct snd_soc_dai_link simtec_dai_aic33 = {
         .name           = "tlv320aic33",
         .stream_name    = "TLV320AIC33",
-        .codec_name     = "tlv320aic3x-codec.0-0x1a",
-        .cpu_dai_name   = "s3c24xx-i2s",
+        .codec_name     = "tlv320aic3x-codec.0-001a",
+        .cpu_dai_name   = "s3c24xx-iis",
         .codec_dai_name = "tlv320aic3x-hifi",
         .platform_name  = "samsung-audio",
         .init           = simtec_hermes_init,
diff --git a/sound/soc/samsung/s3c24xx_simtec_tlv320aic23.c b/sound/soc/samsung/s3c24xx_simtec_tlv320aic23.c
index fbba4e367729..116e3e670167 100644
--- a/sound/soc/samsung/s3c24xx_simtec_tlv320aic23.c
+++ b/sound/soc/samsung/s3c24xx_simtec_tlv320aic23.c
@@ -85,8 +85,8 @@ static int simtec_tlv320aic23_init(struct snd_soc_pcm_runtime *rtd)
 static struct snd_soc_dai_link simtec_dai_aic23 = {
         .name           = "tlv320aic23",
         .stream_name    = "TLV320AIC23",
-        .codec_name     = "tlv320aic3x-codec.0-0x1a",
-        .cpu_dai_name   = "s3c24xx-i2s",
+        .codec_name     = "tlv320aic3x-codec.0-001a",
+        .cpu_dai_name   = "s3c24xx-iis",
         .codec_dai_name = "tlv320aic3x-hifi",
         .platform_name  = "samsung-audio",
         .init           = simtec_tlv320aic23_init,
diff --git a/sound/soc/samsung/s3c24xx_uda134x.c b/sound/soc/samsung/s3c24xx_uda134x.c
index cdc8ecbcb8ef..2c09e93dd566 100644
--- a/sound/soc/samsung/s3c24xx_uda134x.c
+++ b/sound/soc/samsung/s3c24xx_uda134x.c
@@ -228,7 +228,7 @@ static struct snd_soc_dai_link s3c24xx_uda134x_dai_link = {
         .stream_name = "UDA134X",
         .codec_name = "uda134x-hifi",
         .codec_dai_name = "uda134x-hifi",
-        .cpu_dai_name = "s3c24xx-i2s",
+        .cpu_dai_name = "s3c24xx-iis",
         .ops = &s3c24xx_uda134x_ops,
         .platform_name  = "samsung-audio",
 };
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index bac7291b6ff6..c4b60610beb0 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1664,9 +1664,6 @@ static int soc_probe_aux_dev(struct snd_soc_card *card, int num)
         goto out;
 
 found:
-        if (!try_module_get(codec->dev->driver->owner))
-                return -ENODEV;
-
         ret = soc_probe_codec(card, codec);
         if (ret < 0)
                 return ret;
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 499730ab5638..8194f150bab7 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -1742,7 +1742,7 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol,
         int max = mc->max;
         unsigned int mask = (1 << fls(max)) - 1;
         unsigned int invert = mc->invert;
-        unsigned int val, val_mask;
+        unsigned int val;
         int connect, change;
         struct snd_soc_dapm_update update;
 
@@ -1750,13 +1750,13 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol,
 
         if (invert)
                 val = max - val;
-        val_mask = mask << shift;
+        mask = mask << shift;
         val = val << shift;
 
         mutex_lock(&widget->codec->mutex);
         widget->value = val;
 
-        change = snd_soc_test_bits(widget->codec, reg, val_mask, val);
+        change = snd_soc_test_bits(widget->codec, reg, mask, val);
         if (change) {
                 if (val)
                         /* new connection */
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index f5cfed60af98..d8575d31ee6c 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -90,7 +90,7 @@ int __perf_evsel__read(struct perf_evsel *evsel,
         int cpu, thread;
         struct perf_counts_values *aggr = &evsel->counts->aggr, count;
 
-        aggr->val = 0;
+        aggr->val = aggr->ena = aggr->run = 0;
 
         for (cpu = 0; cpu < ncpus; cpu++) {
                 for (thread = 0; thread < nthreads; thread++) {