365 files changed, 4291 insertions, 2677 deletions

diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index e8552782b440..874921e97802 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -33,6 +33,7 @@ qcom	Qualcomm, Inc.
 ramtron Ramtron International
 samsung Samsung Semiconductor
 schindler       Schindler
+sil     Silicon Image
 simtek
 sirf    SiRF Technology, Inc.
 stericsson      ST-Ericsson
diff --git a/Documentation/filesystems/btrfs.txt b/Documentation/filesystems/btrfs.txt
index 64087c34327f..7671352216f1 100644
--- a/Documentation/filesystems/btrfs.txt
+++ b/Documentation/filesystems/btrfs.txt
@@ -63,8 +63,8 @@ IRC network.
 Userspace tools for creating and manipulating Btrfs file systems are
 available from the git repository at the following location:
 
- http://git.kernel.org/?p=linux/kernel/git/mason/btrfs-progs-unstable.git
- git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-progs-unstable.git
+ http://git.kernel.org/?p=linux/kernel/git/mason/btrfs-progs.git
+ git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-progs.git
 
 These include the following tools:
 
diff --git a/Documentation/power/devices.txt b/Documentation/power/devices.txt
index 646a89e0c07d..3139fb505dce 100644
--- a/Documentation/power/devices.txt
+++ b/Documentation/power/devices.txt
@@ -123,9 +123,10 @@ please refer directly to the source code for more information about it.
 Subsystem-Level Methods
 -----------------------
 The core methods to suspend and resume devices reside in struct dev_pm_ops
-pointed to by the pm member of struct bus_type, struct device_type and
-struct class.  They are mostly of interest to the people writing infrastructure
-for buses, like PCI or USB, or device type and device class drivers.
+pointed to by the ops member of struct dev_pm_domain, or by the pm member of
+struct bus_type, struct device_type and struct class.  They are mostly of
+interest to the people writing infrastructure for platforms and buses, like PCI
+or USB, or device type and device class drivers.
 
 Bus drivers implement these methods as appropriate for the hardware and the
 drivers using it; PCI works differently from USB, and so on.  Not many people
@@ -139,41 +140,57 @@ sequencing in the driver model tree.
 
 /sys/devices/.../power/wakeup files
 -----------------------------------
-All devices in the driver model have two flags to control handling of wakeup
-events (hardware signals that can force the device and/or system out of a low
-power state).  These flags are initialized by bus or device driver code using
+All device objects in the driver model contain fields that control the handling
+of system wakeup events (hardware signals that can force the system out of a
+sleep state).  These fields are initialized by bus or device driver code using
 device_set_wakeup_capable() and device_set_wakeup_enable(), defined in
 include/linux/pm_wakeup.h.
 
-The "can_wakeup" flag just records whether the device (and its driver) can
+The "power.can_wakeup" flag just records whether the device (and its driver) can
 physically support wakeup events.  The device_set_wakeup_capable() routine
-affects this flag.  The "should_wakeup" flag controls whether the device should
-try to use its wakeup mechanism.  device_set_wakeup_enable() affects this flag;
-for the most part drivers should not change its value.  The initial value of
-should_wakeup is supposed to be false for the majority of devices; the major
-exceptions are power buttons, keyboards, and Ethernet adapters whose WoL
-(wake-on-LAN) feature has been set up with ethtool.  It should also default
-to true for devices that don't generate wakeup requests on their own but merely
-forward wakeup requests from one bus to another (like PCI bridges).
+affects this flag.  The "power.wakeup" field is a pointer to an object of type
+struct wakeup_source used for controlling whether or not the device should use
+its system wakeup mechanism and for notifying the PM core of system wakeup
+events signaled by the device.  This object is only present for wakeup-capable
+devices (i.e. devices whose "can_wakeup" flags are set) and is created (or
+removed) by device_set_wakeup_capable().
 
 Whether or not a device is capable of issuing wakeup events is a hardware
 matter, and the kernel is responsible for keeping track of it.  By contrast,
 whether or not a wakeup-capable device should issue wakeup events is a policy
 decision, and it is managed by user space through a sysfs attribute: the
-power/wakeup file.  User space can write the strings "enabled" or "disabled" to
-set or clear the "should_wakeup" flag, respectively.  This file is only present
-for wakeup-capable devices (i.e. devices whose "can_wakeup" flags are set)
-and is created (or removed) by device_set_wakeup_capable().  Reads from the
-file will return the corresponding string.
-
-The device_may_wakeup() routine returns true only if both flags are set.
+"power/wakeup" file.  User space can write the strings "enabled" or "disabled"
+to it to indicate whether or not, respectively, the device is supposed to signal
+system wakeup.  This file is only present if the "power.wakeup" object exists
+for the given device and is created (or removed) along with that object, by
+device_set_wakeup_capable().  Reads from the file will return the corresponding
+string.
+
+The "power/wakeup" file is supposed to contain the "disabled" string initially
+for the majority of devices; the major exceptions are power buttons, keyboards,
+and Ethernet adapters whose WoL (wake-on-LAN) feature has been set up with
+ethtool.  It should also default to "enabled" for devices that don't generate
+wakeup requests on their own but merely forward wakeup requests from one bus to
+another (like PCI Express ports).
+
+The device_may_wakeup() routine returns true only if the "power.wakeup" object
+exists and the corresponding "power/wakeup" file contains the string "enabled".
 This information is used by subsystems, like the PCI bus type code, to see
 whether or not to enable the devices' wakeup mechanisms.  If device wakeup
 mechanisms are enabled or disabled directly by drivers, they also should use
 device_may_wakeup() to decide what to do during a system sleep transition.
-However for runtime power management, wakeup events should be enabled whenever
-the device and driver both support them, regardless of the should_wakeup flag.
-
+Device drivers, however, are not supposed to call device_set_wakeup_enable()
+directly in any case.
+
+It ought to be noted that system wakeup is conceptually different from "remote
+wakeup" used by runtime power management, although it may be supported by the
+same physical mechanism.  Remote wakeup is a feature allowing devices in
+low-power states to trigger specific interrupts to signal conditions in which
+they should be put into the full-power state.  Those interrupts may or may not
+be used to signal system wakeup events, depending on the hardware design.  On
+some systems it is impossible to trigger them from system sleep states.  In any
+case, remote wakeup should always be enabled for runtime power management for
+all devices and drivers that support it.
 
 /sys/devices/.../power/control files
 ------------------------------------
@@ -249,20 +266,31 @@ for every device before the next phase begins.  Not all busses or classes
 support all these callbacks and not all drivers use all the callbacks.  The
 various phases always run after tasks have been frozen and before they are
 unfrozen.  Furthermore, the *_noirq phases run at a time when IRQ handlers have
-been disabled (except for those marked with the IRQ_WAKEUP flag).
-
-All phases use bus, type, or class callbacks (that is, methods defined in
-dev->bus->pm, dev->type->pm, or dev->class->pm).  These callbacks are mutually
-exclusive, so if the device type provides a struct dev_pm_ops object pointed to
-by its pm field (i.e. both dev->type and dev->type->pm are defined), the
-callbacks included in that object (i.e. dev->type->pm) will be used.  Otherwise,
-if the class provides a struct dev_pm_ops object pointed to by its pm field
-(i.e. both dev->class and dev->class->pm are defined), the PM core will use the
-callbacks from that object (i.e. dev->class->pm).  Finally, if the pm fields of
-both the device type and class objects are NULL (or those objects do not exist),
-the callbacks provided by the bus (that is, the callbacks from dev->bus->pm)
-will be used (this allows device types to override callbacks provided by bus
-types or classes if necessary).
+been disabled (except for those marked with the IRQF_NO_SUSPEND flag).
+
+All phases use PM domain, bus, type, or class callbacks (that is, methods
+defined in dev->pm_domain->ops, dev->bus->pm, dev->type->pm, or dev->class->pm).
+These callbacks are regarded by the PM core as mutually exclusive.  Moreover,
+PM domain callbacks always take precedence over bus, type and class callbacks,
+while type callbacks take precedence over bus and class callbacks, and class
+callbacks take precedence over bus callbacks.  To be precise, the following
+rules are used to determine which callback to execute in the given phase:
+
+    1.  If dev->pm_domain is present, the PM core will attempt to execute the
+        callback included in dev->pm_domain->ops.  If that callback is not
+        present, no action will be carried out for the given device.
+
+    2.  Otherwise, if both dev->type and dev->type->pm are present, the callback
+        included in dev->type->pm will be executed.
+
+    3.  Otherwise, if both dev->class and dev->class->pm are present, the
+        callback included in dev->class->pm will be executed.
+
+    4.  Otherwise, if both dev->bus and dev->bus->pm are present, the callback
+        included in dev->bus->pm will be executed.
+
+This allows PM domains and device types to override callbacks provided by bus
+types or device classes if necessary.
 
 These callbacks may in turn invoke device- or driver-specific methods stored in
 dev->driver->pm, but they don't have to.
@@ -283,9 +311,8 @@ When the system goes into the standby or memory sleep state, the phases are:
 
         After the prepare callback method returns, no new children may be
         registered below the device.  The method may also prepare the device or
-        driver in some way for the upcoming system power transition (for
-        example, by allocating additional memory required for this purpose), but
-        it should not put the device into a low-power state.
+        driver in some way for the upcoming system power transition, but it
+        should not put the device into a low-power state.
 
     2.  The suspend methods should quiesce the device to stop it from performing
         I/O.  They also may save the device registers and put it into the
diff --git a/Documentation/power/runtime_pm.txt b/Documentation/power/runtime_pm.txt
index 5336149f831b..c2ae8bf77d46 100644
--- a/Documentation/power/runtime_pm.txt
+++ b/Documentation/power/runtime_pm.txt
@@ -44,25 +44,33 @@ struct dev_pm_ops {
 };
 
 The ->runtime_suspend(), ->runtime_resume() and ->runtime_idle() callbacks
-are executed by the PM core for either the power domain, or the device type
-(if the device power domain's struct dev_pm_ops does not exist), or the class
-(if the device power domain's and type's struct dev_pm_ops object does not
-exist), or the bus type (if the device power domain's, type's and class'
-struct dev_pm_ops objects do not exist) of the given device, so the priority
-order of callbacks from high to low is that power domain callbacks, device
-type callbacks, class callbacks and bus type callbacks, and the high priority
-one will take precedence over low priority one. The bus type, device type and
-class callbacks are referred to as subsystem-level callbacks in what follows,
-and generally speaking, the power domain callbacks are used for representing
-power domains within a SoC.
+are executed by the PM core for the device's subsystem that may be either of
+the following:
+
+  1. PM domain of the device, if the device's PM domain object, dev->pm_domain,
+     is present.
+
+  2. Device type of the device, if both dev->type and dev->type->pm are present.
+
+  3. Device class of the device, if both dev->class and dev->class->pm are
+     present.
+
+  4. Bus type of the device, if both dev->bus and dev->bus->pm are present.
+
+The PM core always checks which callback to use in the order given above, so the
+priority order of callbacks from high to low is: PM domain, device type, class
+and bus type.  Moreover, the high-priority one will always take precedence over
+a low-priority one.  The PM domain, bus type, device type and class callbacks
+are referred to as subsystem-level callbacks in what follows.
 
 By default, the callbacks are always invoked in process context with interrupts
 enabled.  However, subsystems can use the pm_runtime_irq_safe() helper function
-to tell the PM core that a device's ->runtime_suspend() and ->runtime_resume()
-callbacks should be invoked in atomic context with interrupts disabled.
-This implies that these callback routines must not block or sleep, but it also
-means that the synchronous helper functions listed at the end of Section 4 can
-be used within an interrupt handler or in an atomic context.
+to tell the PM core that their ->runtime_suspend(), ->runtime_resume() and
+->runtime_idle() callbacks may be invoked in atomic context with interrupts
+disabled for a given device.  This implies that the callback routines in
+question must not block or sleep, but it also means that the synchronous helper
+functions listed at the end of Section 4 may be used for that device within an
+interrupt handler or generally in an atomic context.
 
 The subsystem-level suspend callback is _entirely_ _responsible_ for handling
 the suspend of the device as appropriate, which may, but need not include
diff --git a/MAINTAINERS b/MAINTAINERS
index 3523ab000f1f..447560284996 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -789,6 +789,7 @@ L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 T:      git git://git.pengutronix.de/git/imx/linux-2.6.git
 F:      arch/arm/mach-mx*/
+F:      arch/arm/mach-imx/
 F:      arch/arm/plat-mxc/
 
 ARM/FREESCALE IMX51
@@ -804,6 +805,13 @@ S:	Maintained
 T:      git git://git.linaro.org/people/shawnguo/linux-2.6.git
 F:      arch/arm/mach-imx/*imx6*
 
+ARM/FREESCALE MXS ARM ARCHITECTURE
+M:      Shawn Guo <shawn.guo@linaro.org>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+T:      git git://git.linaro.org/people/shawnguo/linux-2.6.git
+F:      arch/arm/mach-mxs/
+
 ARM/GLOMATION GESBC9312SX MACHINE SUPPORT
 M:      Lennert Buytenhek <kernel@wantstofly.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -5667,7 +5675,6 @@ F:	drivers/media/video/*7146*
 F:      include/media/*7146*
 
 SAMSUNG AUDIO (ASoC) DRIVERS
-M:      Jassi Brar <jassisinghbrar@gmail.com>
 M:      Sangbeom Kim <sbkim73@samsung.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Supported
diff --git a/Makefile b/Makefile
index 3a8f0640cda0..12aafc20efbd 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 2
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Saber-toothed Squirrel
 
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 44789eff983f..e084b7e981e8 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1231,7 +1231,7 @@ config ARM_ERRATA_742231
           capabilities of the processor.
 
 config PL310_ERRATA_588369
-        bool "Clean & Invalidate maintenance operations do not invalidate clean lines"
+        bool "PL310 errata: Clean & Invalidate maintenance operations do not invalidate clean lines"
         depends on CACHE_L2X0
         help
            The PL310 L2 cache controller implements three types of Clean &
@@ -1256,7 +1256,7 @@ config ARM_ERRATA_720789
           entries regardless of the ASID.
 
 config PL310_ERRATA_727915
-        bool "Background Clean & Invalidate by Way operation can cause data corruption"
+        bool "PL310 errata: Background Clean & Invalidate by Way operation can cause data corruption"
         depends on CACHE_L2X0
         help
           PL310 implements the Clean & Invalidate by Way L2 cache maintenance
@@ -1289,8 +1289,8 @@ config ARM_ERRATA_751472
           operation is received by a CPU before the ICIALLUIS has completed,
           potentially leading to corrupted entries in the cache or TLB.
 
-config ARM_ERRATA_753970
-        bool "ARM errata: cache sync operation may be faulty"
+config PL310_ERRATA_753970
+        bool "PL310 errata: cache sync operation may be faulty"
         depends on CACHE_PL310
         help
           This option enables the workaround for the 753970 PL310 (r3p0) erratum.
@@ -1352,6 +1352,18 @@ config ARM_ERRATA_764369
           relevant cache maintenance functions and sets a specific bit
           in the diagnostic control register of the SCU.
 
+config PL310_ERRATA_769419
+        bool "PL310 errata: no automatic Store Buffer drain"
+        depends on CACHE_L2X0
+        help
+          On revisions of the PL310 prior to r3p2, the Store Buffer does
+          not automatically drain. This can cause normal, non-cacheable
+          writes to be retained when the memory system is idle, leading
+          to suboptimal I/O performance for drivers using coherent DMA.
+          This option adds a write barrier to the cpu_idle loop so that,
+          on systems with an outer cache, the store buffer is drained
+          explicitly.
+
 endmenu
 
 source "arch/arm/common/Kconfig"
diff --git a/arch/arm/common/gic.c b/arch/arm/common/gic.c
index 0e6ae470c94f..410a546060a2 100644
--- a/arch/arm/common/gic.c
+++ b/arch/arm/common/gic.c
@@ -526,7 +526,8 @@ static void __init gic_pm_init(struct gic_chip_data *gic)
                 sizeof(u32));
         BUG_ON(!gic->saved_ppi_conf);
 
-        cpu_pm_register_notifier(&gic_notifier_block);
+        if (gic == &gic_data[0])
+                cpu_pm_register_notifier(&gic_notifier_block);
 }
 #else
 static void __init gic_pm_init(struct gic_chip_data *gic)
@@ -581,13 +582,16 @@ void __init gic_init(unsigned int gic_nr, int irq_start,
          * For primary GICs, skip over SGIs.
          * For secondary GICs, skip over PPIs, too.
          */
+        domain->hwirq_base = 32;
         if (gic_nr == 0) {
                 gic_cpu_base_addr = cpu_base;
-                domain->hwirq_base = 16;
-                if (irq_start > 0)
-                        irq_start = (irq_start & ~31) + 16;
-        } else
-                domain->hwirq_base = 32;
+
+                if ((irq_start & 31) > 0) {
+                        domain->hwirq_base = 16;
+                        if (irq_start != -1)
+                                irq_start = (irq_start & ~31) + 16;
+                }
+        }
 
         /*
          * Find out how many interrupts are supported.
diff --git a/arch/arm/common/pl330.c b/arch/arm/common/pl330.c
index 7129cfbdacd6..f407a6b35d3d 100644
--- a/arch/arm/common/pl330.c
+++ b/arch/arm/common/pl330.c
@@ -1211,8 +1211,8 @@ static inline u32 _prepare_ccr(const struct pl330_reqcfg *rqc)
         ccr |= (rqc->brst_size << CC_SRCBRSTSIZE_SHFT);
         ccr |= (rqc->brst_size << CC_DSTBRSTSIZE_SHFT);
 
-        ccr |= (rqc->dcctl << CC_SRCCCTRL_SHFT);
-        ccr |= (rqc->scctl << CC_DSTCCTRL_SHFT);
+        ccr |= (rqc->scctl << CC_SRCCCTRL_SHFT);
+        ccr |= (rqc->dcctl << CC_DSTCCTRL_SHFT);
 
         ccr |= (rqc->swap << CC_SWAP_SHFT);
 
@@ -1623,6 +1623,11 @@ static inline int _alloc_event(struct pl330_thread *thrd)
         return -1;
 }
 
+static bool _chan_ns(const struct pl330_info *pi, int i)
+{
+        return pi->pcfg.irq_ns & (1 << i);
+}
+
 /* Upon success, returns IdentityToken for the
  * allocated channel, NULL otherwise.
  */
@@ -1647,7 +1652,8 @@ void *pl330_request_channel(const struct pl330_info *pi)
 
         for (i = 0; i < chans; i++) {
                 thrd = &pl330->channels[i];
-                if (thrd->free) {
+                if ((thrd->free) && (!_manager_ns(thrd) ||
+                                        _chan_ns(pi, i))) {
                         thrd->ev = _alloc_event(thrd);
                         if (thrd->ev >= 0) {
                                 thrd->free = false;
diff --git a/arch/arm/configs/at91cap9adk_defconfig b/arch/arm/configs/at91cap9_defconfig
index ffb1edd93363..8826eb218e73 100644
--- a/arch/arm/configs/at91cap9adk_defconfig
+++ b/arch/arm/configs/at91cap9_defconfig
@@ -38,7 +38,6 @@ CONFIG_IP_PNP_RARP=y
 # CONFIG_IPV6 is not set
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_MTD=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
@@ -52,16 +51,12 @@ CONFIG_MTD_NAND_ATMEL=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=8192
-CONFIG_ATMEL_SSC=y
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_MULTI_LUN=y
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
 CONFIG_MII=y
 CONFIG_MACB=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 # CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 CONFIG_INPUT_EVDEV=y
 # CONFIG_INPUT_KEYBOARD is not set
@@ -81,7 +76,6 @@ CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_NOWAYOUT=y
 CONFIG_FB=y
 CONFIG_FB_ATMEL=y
-# CONFIG_VGA_CONSOLE is not set
 CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_MONO is not set
 # CONFIG_LOGO_LINUX_CLUT224 is not set
@@ -99,7 +93,6 @@ CONFIG_MMC_AT91=m
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_AT91SAM9=y
 CONFIG_EXT2_FS=y
-CONFIG_INOTIFY=y
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
 CONFIG_JFFS2_FS=y
diff --git a/arch/arm/configs/at91rm9200_defconfig b/arch/arm/configs/at91rm9200_defconfig
index 38cb7c985426..bbe4e1a1f5d8 100644
--- a/arch/arm/configs/at91rm9200_defconfig
+++ b/arch/arm/configs/at91rm9200_defconfig
@@ -5,7 +5,6 @@ CONFIG_SYSVIPC=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
-CONFIG_SYSFS_DEPRECATED_V2=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_MODULES=y
 CONFIG_MODULE_FORCE_LOAD=y
@@ -56,7 +55,6 @@ CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
 CONFIG_IP_PNP_BOOTP=y
 CONFIG_NET_IPIP=m
-CONFIG_NET_IPGRE=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_IPCOMP=m
@@ -75,18 +73,8 @@ CONFIG_IPV6_TUNNEL=m
 CONFIG_BRIDGE=m
 CONFIG_VLAN_8021Q=m
 CONFIG_BT=m
-CONFIG_BT_L2CAP=m
-CONFIG_BT_SCO=m
-CONFIG_BT_RFCOMM=m
-CONFIG_BT_RFCOMM_TTY=y
-CONFIG_BT_BNEP=m
-CONFIG_BT_BNEP_MC_FILTER=y
-CONFIG_BT_BNEP_PROTO_FILTER=y
-CONFIG_BT_HIDP=m
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_MTD=y
-CONFIG_MTD_CONCAT=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_AFS_PARTS=y
 CONFIG_MTD_CHAR=y
@@ -108,8 +96,6 @@ CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_NBD=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=8192
-CONFIG_ATMEL_TCLIB=y
-CONFIG_EEPROM_LEGACY=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_DEV_SR=m
@@ -119,14 +105,23 @@ CONFIG_SCSI_MULTI_LUN=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_NETDEVICES=y
 CONFIG_TUN=m
+CONFIG_ARM_AT91_ETHER=y
 CONFIG_PHYLIB=y
 CONFIG_DAVICOM_PHY=y
 CONFIG_SMSC_PHY=y
 CONFIG_MICREL_PHY=y
-CONFIG_NET_ETHERNET=y
-CONFIG_ARM_AT91_ETHER=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
+CONFIG_PPP=y
+CONFIG_PPP_BSDCOMP=y
+CONFIG_PPP_DEFLATE=y
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=m
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPPOE=m
+CONFIG_PPP_ASYNC=y
+CONFIG_SLIP=m
+CONFIG_SLIP_COMPRESSED=y
+CONFIG_SLIP_SMART=y
+CONFIG_SLIP_MODE_SLIP6=y
 CONFIG_USB_CATC=m
 CONFIG_USB_KAWETH=m
 CONFIG_USB_PEGASUS=m
@@ -139,18 +134,6 @@ CONFIG_USB_NET_RNDIS_HOST=m
 CONFIG_USB_ALI_M5632=y
 CONFIG_USB_AN2720=y
 CONFIG_USB_EPSON2888=y
-CONFIG_PPP=y
-CONFIG_PPP_MULTILINK=y
-CONFIG_PPP_FILTER=y
-CONFIG_PPP_ASYNC=y
-CONFIG_PPP_DEFLATE=y
-CONFIG_PPP_BSDCOMP=y
-CONFIG_PPP_MPPE=m
-CONFIG_PPPOE=m
-CONFIG_SLIP=m
-CONFIG_SLIP_COMPRESSED=y
-CONFIG_SLIP_SMART=y
-CONFIG_SLIP_MODE_SLIP6=y
 # CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 CONFIG_INPUT_MOUSEDEV_SCREEN_X=640
 CONFIG_INPUT_MOUSEDEV_SCREEN_Y=480
@@ -158,9 +141,9 @@ CONFIG_INPUT_EVDEV=y
 CONFIG_KEYBOARD_GPIO=y
 # CONFIG_INPUT_MOUSE is not set
 CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_LEGACY_PTY_COUNT=32
 CONFIG_SERIAL_ATMEL=y
 CONFIG_SERIAL_ATMEL_CONSOLE=y
-CONFIG_LEGACY_PTY_COUNT=32
 CONFIG_HW_RANDOM=y
 CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
@@ -290,7 +273,6 @@ CONFIG_NFS_V3_ACL=y
 CONFIG_NFS_V4=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=y
-CONFIG_SMB_FS=m
 CONFIG_CIFS=m
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_MAC_PARTITION=y
@@ -335,7 +317,6 @@ CONFIG_NLS_UTF8=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_DEBUG_KERNEL=y
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
 # CONFIG_FTRACE is not set
 CONFIG_CRYPTO_PCBC=y
 CONFIG_CRYPTO_SHA1=y
diff --git a/arch/arm/configs/at91sam9260ek_defconfig b/arch/arm/configs/at91sam9260_defconfig
index f8a9226413bf..505b3765f87e 100644
--- a/arch/arm/configs/at91sam9260ek_defconfig
+++ b/arch/arm/configs/at91sam9260_defconfig
@@ -12,11 +12,23 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_IOSCHED_CFQ is not set
 CONFIG_ARCH_AT91=y
 CONFIG_ARCH_AT91SAM9260=y
+CONFIG_ARCH_AT91SAM9260_SAM9XE=y
 CONFIG_MACH_AT91SAM9260EK=y
+CONFIG_MACH_CAM60=y
+CONFIG_MACH_SAM9_L9260=y
+CONFIG_MACH_AFEB9260=y
+CONFIG_MACH_USB_A9260=y
+CONFIG_MACH_QIL_A9260=y
+CONFIG_MACH_CPU9260=y
+CONFIG_MACH_FLEXIBITY=y
+CONFIG_MACH_SNAPPER_9260=y
+CONFIG_MACH_AT91SAM_DT=y
 CONFIG_AT91_PROGRAMMABLE_CLOCKS=y
 # CONFIG_ARM_THUMB is not set
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_ARM_APPENDED_DTB=y
+CONFIG_ARM_ATAG_DTB_COMPAT=y
 CONFIG_CMDLINE="mem=64M console=ttyS0,115200 initrd=0x21100000,3145728 root=/dev/ram0 rw"
 CONFIG_FPE_NWFPE=y
 CONFIG_NET=y
@@ -33,12 +45,10 @@ CONFIG_IP_PNP_BOOTP=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=8192
-CONFIG_ATMEL_SSC=y
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_MULTI_LUN=y
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
 CONFIG_MII=y
 CONFIG_MACB=y
 # CONFIG_INPUT_MOUSEDEV_PSAUX is not set
@@ -55,7 +65,6 @@ CONFIG_I2C_GPIO=y
 CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_NOWAYOUT=y
 CONFIG_AT91SAM9X_WATCHDOG=y
-# CONFIG_VGA_CONSOLE is not set
 # CONFIG_USB_HID is not set
 CONFIG_USB=y
 CONFIG_USB_DEVICEFS=y
@@ -71,7 +80,6 @@ CONFIG_USB_G_SERIAL=m
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_AT91SAM9=y
 CONFIG_EXT2_FS=y
-CONFIG_INOTIFY=y
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
 CONFIG_CRAMFS=y
diff --git a/arch/arm/configs/at91sam9g20ek_defconfig b/arch/arm/configs/at91sam9g20_defconfig
index 9e90e6d79297..9123568d9a8d 100644
--- a/arch/arm/configs/at91sam9g20ek_defconfig
+++ b/arch/arm/configs/at91sam9g20_defconfig
@@ -14,6 +14,15 @@ CONFIG_ARCH_AT91=y
 CONFIG_ARCH_AT91SAM9G20=y
 CONFIG_MACH_AT91SAM9G20EK=y
 CONFIG_MACH_AT91SAM9G20EK_2MMC=y
+CONFIG_MACH_CPU9G20=y
+CONFIG_MACH_ACMENETUSFOXG20=y
+CONFIG_MACH_PORTUXG20=y
+CONFIG_MACH_STAMP9G20=y
+CONFIG_MACH_PCONTROL_G20=y
+CONFIG_MACH_GSIA18S=y
+CONFIG_MACH_USB_A9G20=y
+CONFIG_MACH_SNAPPER_9260=y
+CONFIG_MACH_AT91SAM_DT=y
 CONFIG_AT91_PROGRAMMABLE_CLOCKS=y
 # CONFIG_ARM_THUMB is not set
 CONFIG_AEABI=y
@@ -21,9 +30,10 @@ CONFIG_LEDS=y
 CONFIG_LEDS_CPU=y
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_ARM_APPENDED_DTB=y
+CONFIG_ARM_ATAG_DTB_COMPAT=y
 CONFIG_CMDLINE="mem=64M console=ttyS0,115200 initrd=0x21100000,3145728 root=/dev/ram0 rw"
 CONFIG_FPE_NWFPE=y
-CONFIG_PM=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
@@ -37,8 +47,6 @@ CONFIG_IP_PNP_BOOTP=y
 # CONFIG_IPV6 is not set
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_MTD=y
-CONFIG_MTD_CONCAT=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
@@ -48,17 +56,13 @@ CONFIG_MTD_NAND_ATMEL=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=8192
-CONFIG_ATMEL_SSC=y
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_MULTI_LUN=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_NETDEVICES=y
-CONFIG_NET_ETHERNET=y
 CONFIG_MII=y
 CONFIG_MACB=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
 # CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 CONFIG_INPUT_MOUSEDEV_SCREEN_X=320
 CONFIG_INPUT_MOUSEDEV_SCREEN_Y=240
@@ -66,15 +70,14 @@ CONFIG_INPUT_EVDEV=y
 # CONFIG_KEYBOARD_ATKBD is not set
 CONFIG_KEYBOARD_GPIO=y
 # CONFIG_INPUT_MOUSE is not set
+CONFIG_LEGACY_PTY_COUNT=16
 CONFIG_SERIAL_ATMEL=y
 CONFIG_SERIAL_ATMEL_CONSOLE=y
-CONFIG_LEGACY_PTY_COUNT=16
 CONFIG_HW_RANDOM=y
 CONFIG_SPI=y
 CONFIG_SPI_ATMEL=y
 CONFIG_SPI_SPIDEV=y
 # CONFIG_HWMON is not set
-# CONFIG_VGA_CONSOLE is not set
 CONFIG_SOUND=y
 CONFIG_SND=y
 CONFIG_SND_SEQUENCER=y
@@ -82,7 +85,6 @@ CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
 CONFIG_SND_SEQUENCER_OSS=y
 # CONFIG_SND_VERBOSE_PROCFS is not set
-CONFIG_SND_AT73C213=y
 CONFIG_USB=y
 CONFIG_USB_DEVICEFS=y
 # CONFIG_USB_DEVICE_CLASS is not set
@@ -105,7 +107,6 @@ CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_AT91SAM9=y
 CONFIG_EXT2_FS=y
-CONFIG_INOTIFY=y
 CONFIG_MSDOS_FS=y
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
diff --git a/arch/arm/configs/at91sam9g45_defconfig b/arch/arm/configs/at91sam9g45_defconfig
index c5876d244f4b..606d48f3b8f8 100644
--- a/arch/arm/configs/at91sam9g45_defconfig
+++ b/arch/arm/configs/at91sam9g45_defconfig
@@ -18,6 +18,7 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_ARCH_AT91=y
 CONFIG_ARCH_AT91SAM9G45=y
 CONFIG_MACH_AT91SAM9M10G45EK=y
+CONFIG_MACH_AT91SAM_DT=y
 CONFIG_AT91_PROGRAMMABLE_CLOCKS=y
 CONFIG_AT91_SLOW_CLOCK=y
 CONFIG_AEABI=y
@@ -73,11 +74,8 @@ CONFIG_SCSI_MULTI_LUN=y
 # CONFIG_SCSI_LOWLEVEL is not set
 CONFIG_NETDEVICES=y
 CONFIG_MII=y
-CONFIG_DAVICOM_PHY=y
-CONFIG_NET_ETHERNET=y
 CONFIG_MACB=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
+CONFIG_DAVICOM_PHY=y
 CONFIG_LIBERTAS_THINFIRM=m
 CONFIG_LIBERTAS_THINFIRM_USB=m
 CONFIG_AT76C50X_USB=m
@@ -131,7 +129,6 @@ CONFIG_I2C_GPIO=y
 CONFIG_SPI=y
 CONFIG_SPI_ATMEL=y
 # CONFIG_HWMON is not set
-# CONFIG_MFD_SUPPORT is not set
 CONFIG_FB=y
 CONFIG_FB_ATMEL=y
 CONFIG_FB_UDL=m
diff --git a/arch/arm/configs/at91sam9rlek_defconfig b/arch/arm/configs/at91sam9rl_defconfig
index 75621e4d03fc..ad562ee64209 100644
--- a/arch/arm/configs/at91sam9rlek_defconfig
+++ b/arch/arm/configs/at91sam9rl_defconfig
@@ -23,8 +23,6 @@ CONFIG_NET=y
 CONFIG_UNIX=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_MTD=y
-CONFIG_MTD_CONCAT=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
@@ -35,7 +33,6 @@ CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=4
 CONFIG_BLK_DEV_RAM_SIZE=24576
-CONFIG_ATMEL_SSC=y
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_MULTI_LUN=y
@@ -62,13 +59,11 @@ CONFIG_WATCHDOG_NOWAYOUT=y
 CONFIG_AT91SAM9X_WATCHDOG=y
 CONFIG_FB=y
 CONFIG_FB_ATMEL=y
-# CONFIG_VGA_CONSOLE is not set
 CONFIG_MMC=y
 CONFIG_MMC_AT91=m
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_AT91SAM9=y
 CONFIG_EXT2_FS=y
-CONFIG_INOTIFY=y
 CONFIG_MSDOS_FS=y
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
diff --git a/arch/arm/configs/ezx_defconfig b/arch/arm/configs/ezx_defconfig
index 227a477346ed..d95763d5f0d8 100644
--- a/arch/arm/configs/ezx_defconfig
+++ b/arch/arm/configs/ezx_defconfig
@@ -287,7 +287,7 @@ CONFIG_USB=y
 # CONFIG_USB_DEVICE_CLASS is not set
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_GADGET=y
-CONFIG_USB_GADGET_PXA27X=y
+CONFIG_USB_PXA27X=y
 CONFIG_USB_ETH=m
 # CONFIG_USB_ETH_RNDIS is not set
 CONFIG_MMC=y
diff --git a/arch/arm/configs/imote2_defconfig b/arch/arm/configs/imote2_defconfig
index 176ec22af034..fd996bb13022 100644
--- a/arch/arm/configs/imote2_defconfig
+++ b/arch/arm/configs/imote2_defconfig
@@ -263,7 +263,7 @@ CONFIG_USB=y
 # CONFIG_USB_DEVICE_CLASS is not set
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_GADGET=y
-CONFIG_USB_GADGET_PXA27X=y
+CONFIG_USB_PXA27X=y
 CONFIG_USB_ETH=m
 # CONFIG_USB_ETH_RNDIS is not set
 CONFIG_MMC=y
diff --git a/arch/arm/configs/magician_defconfig b/arch/arm/configs/magician_defconfig
index a88e64d4e9a5..443675d317e6 100644
--- a/arch/arm/configs/magician_defconfig
+++ b/arch/arm/configs/magician_defconfig
@@ -132,7 +132,7 @@ CONFIG_USB_MON=m
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_GADGET_VBUS_DRAW=500
-CONFIG_USB_GADGET_PXA27X=y
+CONFIG_USB_PXA27X=y
 CONFIG_USB_ETH=m
 # CONFIG_USB_ETH_RNDIS is not set
 CONFIG_USB_GADGETFS=m
diff --git a/arch/arm/configs/omap1_defconfig b/arch/arm/configs/omap1_defconfig
index 7b63462b349d..a7e777581378 100644
--- a/arch/arm/configs/omap1_defconfig
+++ b/arch/arm/configs/omap1_defconfig
@@ -48,7 +48,6 @@ CONFIG_MACH_SX1=y
 CONFIG_MACH_NOKIA770=y
 CONFIG_MACH_AMS_DELTA=y
 CONFIG_MACH_OMAP_GENERIC=y
-CONFIG_OMAP_CLOCKS_SET_BY_BOOTLOADER=y
 CONFIG_OMAP_ARM_216MHZ=y
 CONFIG_OMAP_ARM_195MHZ=y
 CONFIG_OMAP_ARM_192MHZ=y
diff --git a/arch/arm/configs/u300_defconfig b/arch/arm/configs/u300_defconfig
index 4a5a12681be2..374000ec4e4e 100644
--- a/arch/arm/configs/u300_defconfig
+++ b/arch/arm/configs/u300_defconfig
@@ -14,8 +14,6 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_ARCH_U300=y
 CONFIG_MACH_U300=y
 CONFIG_MACH_U300_BS335=y
-CONFIG_MACH_U300_DUAL_RAM=y
-CONFIG_U300_DEBUG=y
 CONFIG_MACH_U300_SPIDUMMY=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
@@ -26,19 +24,21 @@ CONFIG_ZBOOT_ROM_BSS=0x0
 CONFIG_CMDLINE="root=/dev/ram0 rw rootfstype=rootfs console=ttyAMA0,115200n8 lpj=515072"
 CONFIG_CPU_IDLE=y
 CONFIG_FPE_NWFPE=y
-CONFIG_PM=y
 # CONFIG_SUSPEND is not set
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_PREVENT_FIRMWARE_BUILD is not set
-# CONFIG_MISC_DEVICES is not set
+CONFIG_MTD=y
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_NAND=y
+CONFIG_MTD_NAND_FSMC=y
 # CONFIG_INPUT_MOUSEDEV is not set
 CONFIG_INPUT_EVDEV=y
 # CONFIG_KEYBOARD_ATKBD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
+CONFIG_LEGACY_PTY_COUNT=16
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
-CONFIG_LEGACY_PTY_COUNT=16
 # CONFIG_HW_RANDOM is not set
 CONFIG_I2C=y
 # CONFIG_HWMON is not set
@@ -51,6 +51,7 @@ CONFIG_BACKLIGHT_CLASS_DEVICE=y
 # CONFIG_HID_SUPPORT is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_MMC=y
+CONFIG_MMC_CLKGATE=y
 CONFIG_MMC_ARMMMCI=y
 CONFIG_RTC_CLASS=y
 # CONFIG_RTC_HCTOSYS is not set
@@ -65,10 +66,8 @@ CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_FS=y
-CONFIG_DEBUG_KERNEL=y
 # CONFIG_SCHED_DEBUG is not set
 CONFIG_TIMER_STATS=y
 # CONFIG_DEBUG_PREEMPT is not set
 CONFIG_DEBUG_INFO=y
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
 # CONFIG_CRC32 is not set
diff --git a/arch/arm/configs/u8500_defconfig b/arch/arm/configs/u8500_defconfig
index 97d31a4663da..2d7b6e7b7271 100644
--- a/arch/arm/configs/u8500_defconfig
+++ b/arch/arm/configs/u8500_defconfig
@@ -10,7 +10,7 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_ARCH_U8500=y
 CONFIG_UX500_SOC_DB5500=y
 CONFIG_UX500_SOC_DB8500=y
-CONFIG_MACH_U8500=y
+CONFIG_MACH_HREFV60=y
 CONFIG_MACH_SNOWBALL=y
 CONFIG_MACH_U5500=y
 CONFIG_NO_HZ=y
@@ -24,6 +24,7 @@ CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
 CONFIG_VFP=y
 CONFIG_NEON=y
+CONFIG_PM_RUNTIME=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
@@ -41,11 +42,8 @@ CONFIG_MISC_DEVICES=y
 CONFIG_AB8500_PWM=y
 CONFIG_SENSORS_BH1780=y
 CONFIG_NETDEVICES=y
-CONFIG_SMSC_PHY=y
-CONFIG_NET_ETHERNET=y
 CONFIG_SMSC911X=y
-# CONFIG_NETDEV_1000 is not set
-# CONFIG_NETDEV_10000 is not set
+CONFIG_SMSC_PHY=y
 # CONFIG_WLAN is not set
 # CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 CONFIG_INPUT_EVDEV=y
@@ -72,15 +70,12 @@ CONFIG_SPI=y
 CONFIG_SPI_PL022=y
 CONFIG_GPIO_STMPE=y
 CONFIG_GPIO_TC3589X=y
-# CONFIG_HWMON is not set
 CONFIG_MFD_STMPE=y
 CONFIG_MFD_TC3589X=y
+CONFIG_AB5500_CORE=y
 CONFIG_AB8500_CORE=y
 CONFIG_REGULATOR_AB8500=y
 # CONFIG_HID_SUPPORT is not set
-CONFIG_USB_MUSB_HDRC=y
-CONFIG_USB_GADGET_MUSB_HDRC=y
-CONFIG_MUSB_PIO_ONLY=y
 CONFIG_USB_GADGET=y
 CONFIG_AB8500_USB=y
 CONFIG_MMC=y
@@ -97,6 +92,7 @@ CONFIG_DMADEVICES=y
 CONFIG_STE_DMA40=y
 CONFIG_STAGING=y
 CONFIG_TOUCHSCREEN_SYNAPTICS_I2C_RMI4=y
+CONFIG_HSEM_U8500=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT2_FS_XATTR=y
 CONFIG_EXT2_FS_POSIX_ACL=y
diff --git a/arch/arm/configs/zeus_defconfig b/arch/arm/configs/zeus_defconfig
index 59577ad3f4ef..547a3c1e59db 100644
--- a/arch/arm/configs/zeus_defconfig
+++ b/arch/arm/configs/zeus_defconfig
@@ -140,7 +140,7 @@ CONFIG_USB_SERIAL=m
 CONFIG_USB_SERIAL_GENERIC=y
 CONFIG_USB_SERIAL_MCT_U232=m
 CONFIG_USB_GADGET=m
-CONFIG_USB_GADGET_PXA27X=y
+CONFIG_USB_PXA27X=y
 CONFIG_USB_ETH=m
 CONFIG_USB_GADGETFS=m
 CONFIG_USB_FILE_STORAGE=m
diff --git a/arch/arm/include/asm/pmu.h b/arch/arm/include/asm/pmu.h
index 71d99b83cdb9..0bda22c094a6 100644
--- a/arch/arm/include/asm/pmu.h
+++ b/arch/arm/include/asm/pmu.h
@@ -55,16 +55,6 @@ reserve_pmu(enum arm_pmu_type type);
 extern void
 release_pmu(enum arm_pmu_type type);
 
-/**
- * init_pmu() - Initialise the PMU.
- *
- * Initialise the system ready for PMU enabling. This should typically set the
- * IRQ affinity and nothing else. The users (oprofile/perf events etc) will do
- * the actual hardware initialisation.
- */
-extern int
-init_pmu(enum arm_pmu_type type);
-
 #else /* CONFIG_CPU_HAS_PMU */
 
 #include <linux/err.h>
diff --git a/arch/arm/include/asm/topology.h b/arch/arm/include/asm/topology.h
index a7e457ed27c3..58b8b84adcd2 100644
--- a/arch/arm/include/asm/topology.h
+++ b/arch/arm/include/asm/topology.h
@@ -25,7 +25,7 @@ extern struct cputopo_arm cpu_topology[NR_CPUS];
 
 void init_cpu_topology(void);
 void store_cpu_topology(unsigned int cpuid);
-const struct cpumask *cpu_coregroup_mask(unsigned int cpu);
+const struct cpumask *cpu_coregroup_mask(int cpu);
 
 #else
 
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 9ad50c4208ae..b145f16c91bc 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -497,7 +497,7 @@ ENDPROC(__und_usr)
         .popsection
         .pushsection __ex_table,"a"
         .long   1b, 4b
-#if __LINUX_ARM_ARCH__ >= 7
+#if CONFIG_ARM_THUMB && __LINUX_ARM_ARCH__ >= 6 && CONFIG_CPU_V7
         .long   2b, 4b
         .long   3b, 4b
 #endif
diff --git a/arch/arm/kernel/kprobes-arm.c b/arch/arm/kernel/kprobes-arm.c
index 9fe8910308af..8a30c89da70e 100644
--- a/arch/arm/kernel/kprobes-arm.c
+++ b/arch/arm/kernel/kprobes-arm.c
@@ -519,10 +519,12 @@ static const union decode_item arm_cccc_0000_____1001_table[] = {
 static const union decode_item arm_cccc_0001_____1001_table[] = {
         /* Synchronization primitives                                   */
 
+#if __LINUX_ARM_ARCH__ < 6
+        /* Deprecated on ARMv6 and may be UNDEFINED on v7               */
         /* SMP/SWPB             cccc 0001 0x00 xxxx xxxx xxxx 1001 xxxx */
         DECODE_EMULATEX (0x0fb000f0, 0x01000090, emulate_rd12rn16rm0_rwflags_nopc,
                                                  REGS(NOPC, NOPC, 0, 0, NOPC)),
-
+#endif
         /* LDREX/STREX{,D,B,H}  cccc 0001 1xxx xxxx xxxx xxxx 1001 xxxx */
         /* And unallocated instructions...                              */
         DECODE_END
diff --git a/arch/arm/kernel/kprobes-test-arm.c b/arch/arm/kernel/kprobes-test-arm.c
index fc82de8bdcce..ba32b393b3f0 100644
--- a/arch/arm/kernel/kprobes-test-arm.c
+++ b/arch/arm/kernel/kprobes-test-arm.c
@@ -427,18 +427,25 @@ void kprobe_arm_test_cases(void)
 
         TEST_GROUP("Synchronization primitives")
 
-        /*
-         * Use hard coded constants for SWP instructions to avoid warnings
-         * about deprecated instructions.
-         */
-        TEST_RP( ".word 0xe108e097 @ swp        lr, r",7,VAL2,", [r",8,0,"]")
-        TEST_R(  ".word 0x610d0091 @ swpvs      r0, r",1,VAL1,", [sp]")
-        TEST_RP( ".word 0xe10cd09e @ swp        sp, r",14,VAL2,", [r",12,13*4,"]")
+#if __LINUX_ARM_ARCH__ < 6
+        TEST_RP("swp    lr, r",7,VAL2,", [r",8,0,"]")
+        TEST_R( "swpvs  r0, r",1,VAL1,", [sp]")
+        TEST_RP("swp    sp, r",14,VAL2,", [r",12,13*4,"]")
+#else
+        TEST_UNSUPPORTED(".word 0xe108e097 @ swp        lr, r7, [r8]")
+        TEST_UNSUPPORTED(".word 0x610d0091 @ swpvs      r0, r1, [sp]")
+        TEST_UNSUPPORTED(".word 0xe10cd09e @ swp        sp, r14 [r12]")
+#endif
         TEST_UNSUPPORTED(".word 0xe102f091 @ swp pc, r1, [r2]")
         TEST_UNSUPPORTED(".word 0xe102009f @ swp r0, pc, [r2]")
         TEST_UNSUPPORTED(".word 0xe10f0091 @ swp r0, r1, [pc]")
-        TEST_RP( ".word 0xe148e097 @ swpb       lr, r",7,VAL2,", [r",8,0,"]")
-        TEST_R(  ".word 0x614d0091 @ swpvsb     r0, r",1,VAL1,", [sp]")
+#if __LINUX_ARM_ARCH__ < 6
+        TEST_RP("swpb   lr, r",7,VAL2,", [r",8,0,"]")
+        TEST_R( "swpvsb r0, r",1,VAL1,", [sp]")
+#else
+        TEST_UNSUPPORTED(".word 0xe148e097 @ swpb       lr, r7, [r8]")
+        TEST_UNSUPPORTED(".word 0x614d0091 @ swpvsb     r0, r1, [sp]")
+#endif
         TEST_UNSUPPORTED(".word 0xe142f091 @ swpb pc, r1, [r2]")
 
         TEST_UNSUPPORTED(".word 0xe1100090") /* Unallocated space */
@@ -550,7 +557,7 @@ void kprobe_arm_test_cases(void)
         TEST_RPR(  "strccd      r",8, VAL2,", [r",13,0, ", r",12,48,"]")
         TEST_RPR(  "strd        r",4, VAL1,", [r",2, 24,", r",3, 48,"]!")
         TEST_RPR(  "strcsd      r",12,VAL2,", [r",11,48,", -r",10,24,"]!")
-        TEST_RPR(  "strd        r",2, VAL1,", [r",3, 24,"], r",4,48,"")
+        TEST_RPR(  "strd        r",2, VAL1,", [r",5, 24,"], r",4,48,"")
         TEST_RPR(  "strd        r",10,VAL2,", [r",9, 48,"], -r",7,24,"")
         TEST_UNSUPPORTED(".word 0xe1afc0fa      @ strd r12, [pc, r10]!")
 
diff --git a/arch/arm/kernel/kprobes-test-thumb.c b/arch/arm/kernel/kprobes-test-thumb.c
index 5e726c31c45a..5d8b85792222 100644
--- a/arch/arm/kernel/kprobes-test-thumb.c
+++ b/arch/arm/kernel/kprobes-test-thumb.c
@@ -222,8 +222,8 @@ void kprobe_thumb16_test_cases(void)
 DONT_TEST_IN_ITBLOCK(
         TEST_BF_R(  "cbnz       r",0,0, ", 2f")
         TEST_BF_R(  "cbz        r",2,-1,", 2f")
-        TEST_BF_RX( "cbnz       r",4,1, ", 2f",0x20)
-        TEST_BF_RX( "cbz        r",7,0, ", 2f",0x40)
+        TEST_BF_RX( "cbnz       r",4,1, ", 2f", SPACE_0x20)
+        TEST_BF_RX( "cbz        r",7,0, ", 2f", SPACE_0x40)
 )
         TEST_R("sxth    r0, r",7, HH1,"")
         TEST_R("sxth    r7, r",0, HH2,"")
@@ -246,7 +246,7 @@ DONT_TEST_IN_ITBLOCK(
         TESTCASE_START(code)            \
         TEST_ARG_PTR(13, offset)        \
         TEST_ARG_END("")                \
-        TEST_BRANCH_F(code,0)           \
+        TEST_BRANCH_F(code)             \
         TESTCASE_END
 
         TEST("push      {r0}")
@@ -319,8 +319,8 @@ CONDITION_INSTRUCTIONS(8,
 
         TEST_BF(  "b    2f")
         TEST_BB(  "b    2b")
-        TEST_BF_X("b    2f", 0x400)
-        TEST_BB_X("b    2b", 0x400)
+        TEST_BF_X("b    2f", SPACE_0x400)
+        TEST_BB_X("b    2b", SPACE_0x400)
 
         TEST_GROUP("Testing instructions in IT blocks")
 
@@ -746,7 +746,7 @@ CONDITION_INSTRUCTIONS(22,
         TEST_BB("bne.w  2b")
         TEST_BF("bgt.w  2f")
         TEST_BB("blt.w  2b")
-        TEST_BF_X("bpl.w        2f",0x1000)
+        TEST_BF_X("bpl.w        2f", SPACE_0x1000)
 )
 
         TEST_UNSUPPORTED("msr   cpsr, r0")
@@ -786,11 +786,11 @@ CONDITION_INSTRUCTIONS(22,
 
         TEST_BF(  "b.w  2f")
         TEST_BB(  "b.w  2b")
-        TEST_BF_X("b.w  2f", 0x1000)
+        TEST_BF_X("b.w  2f", SPACE_0x1000)
 
         TEST_BF(  "bl.w 2f")
         TEST_BB(  "bl.w 2b")
-        TEST_BB_X("bl.w 2b", 0x1000)
+        TEST_BB_X("bl.w 2b", SPACE_0x1000)
 
         TEST_X( "blx    __dummy_arm_subroutine",
                 ".arm                           \n\t"
diff --git a/arch/arm/kernel/kprobes-test.h b/arch/arm/kernel/kprobes-test.h
index 0dc5d77b9356..e28a869b1ae4 100644
--- a/arch/arm/kernel/kprobes-test.h
+++ b/arch/arm/kernel/kprobes-test.h
@@ -149,23 +149,31 @@ struct test_arg_end {
         "1:     "instruction"                           \n\t"   \
         "       nop                                     \n\t"
 
-#define TEST_BRANCH_F(instruction, xtra_dist)                   \
+#define TEST_BRANCH_F(instruction)                              \
         TEST_INSTRUCTION(instruction)                           \
-        ".if "#xtra_dist"                               \n\t"   \
         "       b       99f                             \n\t"   \
-        ".space "#xtra_dist"                            \n\t"   \
-        ".endif                                         \n\t"   \
+        "2:     nop                                     \n\t"
+
+#define TEST_BRANCH_B(instruction)                              \
+        "       b       50f                             \n\t"   \
+        "       b       99f                             \n\t"   \
+        "2:     nop                                     \n\t"   \
+        "       b       99f                             \n\t"   \
+        TEST_INSTRUCTION(instruction)
+
+#define TEST_BRANCH_FX(instruction, codex)                      \
+        TEST_INSTRUCTION(instruction)                           \
+        "       b       99f                             \n\t"   \
+        codex"                                          \n\t"   \
         "       b       99f                             \n\t"   \
         "2:     nop                                     \n\t"
 
-#define TEST_BRANCH_B(instruction, xtra_dist)                   \
+#define TEST_BRANCH_BX(instruction, codex)                      \
         "       b       50f                             \n\t"   \
         "       b       99f                             \n\t"   \
         "2:     nop                                     \n\t"   \
         "       b       99f                             \n\t"   \
-        ".if "#xtra_dist"                               \n\t"   \
-        ".space "#xtra_dist"                            \n\t"   \
-        ".endif                                         \n\t"   \
+        codex"                                          \n\t"   \
         TEST_INSTRUCTION(instruction)
 
 #define TESTCASE_END                                            \
@@ -301,47 +309,60 @@ struct test_arg_end {
         TESTCASE_START(code1 #reg1 code2)       \
         TEST_ARG_PTR(reg1, val1)                \
         TEST_ARG_END("")                        \
-        TEST_BRANCH_F(code1 #reg1 code2, 0)     \
+        TEST_BRANCH_F(code1 #reg1 code2)        \
         TESTCASE_END
 
-#define TEST_BF_X(code, xtra_dist)              \
+#define TEST_BF(code)                           \
         TESTCASE_START(code)                    \
         TEST_ARG_END("")                        \
-        TEST_BRANCH_F(code, xtra_dist)          \
+        TEST_BRANCH_F(code)                     \
         TESTCASE_END
 
-#define TEST_BB_X(code, xtra_dist)              \
+#define TEST_BB(code)                           \
         TESTCASE_START(code)                    \
         TEST_ARG_END("")                        \
-        TEST_BRANCH_B(code, xtra_dist)          \
+        TEST_BRANCH_B(code)                     \
         TESTCASE_END
 
-#define TEST_BF_RX(code1, reg, val, code2, xtra_dist)   \
-        TESTCASE_START(code1 #reg code2)                \
-        TEST_ARG_REG(reg, val)                          \
-        TEST_ARG_END("")                                \
-        TEST_BRANCH_F(code1 #reg code2, xtra_dist)      \
+#define TEST_BF_R(code1, reg, val, code2)       \
+        TESTCASE_START(code1 #reg code2)        \
+        TEST_ARG_REG(reg, val)                  \
+        TEST_ARG_END("")                        \
+        TEST_BRANCH_F(code1 #reg code2)         \
         TESTCASE_END
 
-#define TEST_BB_RX(code1, reg, val, code2, xtra_dist)   \
-        TESTCASE_START(code1 #reg code2)                \
-        TEST_ARG_REG(reg, val)                          \
-        TEST_ARG_END("")                                \
-        TEST_BRANCH_B(code1 #reg code2, xtra_dist)      \
+#define TEST_BB_R(code1, reg, val, code2)       \
+        TESTCASE_START(code1 #reg code2)        \
+        TEST_ARG_REG(reg, val)                  \
+        TEST_ARG_END("")                        \
+        TEST_BRANCH_B(code1 #reg code2)         \
         TESTCASE_END
 
-#define TEST_BF(code)   TEST_BF_X(code, 0)
-#define TEST_BB(code)   TEST_BB_X(code, 0)
-
-#define TEST_BF_R(code1, reg, val, code2) TEST_BF_RX(code1, reg, val, code2, 0)
-#define TEST_BB_R(code1, reg, val, code2) TEST_BB_RX(code1, reg, val, code2, 0)
-
 #define TEST_BF_RR(code1, reg1, val1, code2, reg2, val2, code3) \
         TESTCASE_START(code1 #reg1 code2 #reg2 code3)           \
         TEST_ARG_REG(reg1, val1)                                \
         TEST_ARG_REG(reg2, val2)                                \
         TEST_ARG_END("")                                        \
-        TEST_BRANCH_F(code1 #reg1 code2 #reg2 code3, 0)         \
+        TEST_BRANCH_F(code1 #reg1 code2 #reg2 code3)            \
+        TESTCASE_END
+
+#define TEST_BF_X(code, codex)                  \
+        TESTCASE_START(code)                    \
+        TEST_ARG_END("")                        \
+        TEST_BRANCH_FX(code, codex)             \
+        TESTCASE_END
+
+#define TEST_BB_X(code, codex)                  \
+        TESTCASE_START(code)                    \
+        TEST_ARG_END("")                        \
+        TEST_BRANCH_BX(code, codex)             \
+        TESTCASE_END
+
+#define TEST_BF_RX(code1, reg, val, code2, codex)       \
+        TESTCASE_START(code1 #reg code2)                \
+        TEST_ARG_REG(reg, val)                          \
+        TEST_ARG_END("")                                \
+        TEST_BRANCH_FX(code1 #reg code2, codex)         \
         TESTCASE_END
 
 #define TEST_X(code, codex)                     \
@@ -372,6 +393,25 @@ struct test_arg_end {
         TESTCASE_END
 
 
+/*
+ * Macros for defining space directives spread over multiple lines.
+ * These are required so the compiler guesses better the length of inline asm
+ * code and will spill the literal pool early enough to avoid generating PC
+ * relative loads with out of range offsets.
+ */
+#define TWICE(x)        x x
+#define SPACE_0x8       TWICE(".space 4\n\t")
+#define SPACE_0x10      TWICE(SPACE_0x8)
+#define SPACE_0x20      TWICE(SPACE_0x10)
+#define SPACE_0x40      TWICE(SPACE_0x20)
+#define SPACE_0x80      TWICE(SPACE_0x40)
+#define SPACE_0x100     TWICE(SPACE_0x80)
+#define SPACE_0x200     TWICE(SPACE_0x100)
+#define SPACE_0x400     TWICE(SPACE_0x200)
+#define SPACE_0x800     TWICE(SPACE_0x400)
+#define SPACE_0x1000    TWICE(SPACE_0x800)
+
+
 /* Various values used in test cases... */
 #define N(val)  (val ^ 0xffffffff)
 #define VAL1    0x12345678
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 24e2347be6b1..c475379199b1 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -343,8 +343,14 @@ validate_group(struct perf_event *event)
 {
         struct perf_event *sibling, *leader = event->group_leader;
         struct pmu_hw_events fake_pmu;
+        DECLARE_BITMAP(fake_used_mask, ARMPMU_MAX_HWEVENTS);
 
-        memset(&fake_pmu, 0, sizeof(fake_pmu));
+        /*
+         * Initialise the fake PMU. We only need to populate the
+         * used_mask for the purposes of validation.
+         */
+        memset(fake_used_mask, 0, sizeof(fake_used_mask));
+        fake_pmu.used_mask = fake_used_mask;
 
         if (!validate_event(&fake_pmu, leader))
                 return -ENOSPC;
@@ -396,6 +402,9 @@ armpmu_reserve_hardware(struct arm_pmu *armpmu)
         int i, err, irq, irqs;
         struct platform_device *pmu_device = armpmu->plat_device;
 
+        if (!pmu_device)
+                return -ENODEV;
+
         err = reserve_pmu(armpmu->type);
         if (err) {
                 pr_warning("unable to reserve pmu\n");
diff --git a/arch/arm/kernel/pmu.c b/arch/arm/kernel/pmu.c
index 2c3407ee8576..2334bf8a650a 100644
--- a/arch/arm/kernel/pmu.c
+++ b/arch/arm/kernel/pmu.c
@@ -33,3 +33,4 @@ release_pmu(enum arm_pmu_type type)
 {
         clear_bit_unlock(type, pmu_lock);
 }
+EXPORT_SYMBOL_GPL(release_pmu);
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 75316f0dd02a..3d0c6fb74ae4 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -192,6 +192,9 @@ void cpu_idle(void)
 #endif
 
                         local_irq_disable();
+#ifdef CONFIG_PL310_ERRATA_769419
+                        wmb();
+#endif
                         if (hlt_counter) {
                                 local_irq_enable();
                                 cpu_relax();
diff --git a/arch/arm/kernel/topology.c b/arch/arm/kernel/topology.c
index 1040c00405d0..8200deaa14f6 100644
--- a/arch/arm/kernel/topology.c
+++ b/arch/arm/kernel/topology.c
@@ -43,7 +43,7 @@
 
 struct cputopo_arm cpu_topology[NR_CPUS];
 
-const struct cpumask *cpu_coregroup_mask(unsigned int cpu)
+const struct cpumask *cpu_coregroup_mask(int cpu)
 {
         return &cpu_topology[cpu].core_sibling;
 }
diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h
index 10d868a5a481..d6408d1ee543 100644
--- a/arch/arm/lib/bitops.h
+++ b/arch/arm/lib/bitops.h
@@ -1,5 +1,9 @@
+#include <asm/unwind.h>
+
 #if __LINUX_ARM_ARCH__ >= 6
-        .macro  bitop, instr
+        .macro  bitop, name, instr
+ENTRY(  \name           )
+UNWIND( .fnstart        )
         ands    ip, r1, #3
         strneb  r1, [ip]                @ assert word-aligned
         mov     r2, #1
@@ -13,9 +17,13 @@
         cmp     r0, #0
         bne     1b
         bx      lr
+UNWIND( .fnend          )
+ENDPROC(\name           )
         .endm
 
-        .macro  testop, instr, store
+        .macro  testop, name, instr, store
+ENTRY(  \name           )
+UNWIND( .fnstart        )
         ands    ip, r1, #3
         strneb  r1, [ip]                @ assert word-aligned
         mov     r2, #1
@@ -34,9 +42,13 @@
         cmp     r0, #0
         movne   r0, #1
 2:      bx      lr
+UNWIND( .fnend          )
+ENDPROC(\name           )
         .endm
 #else
-        .macro  bitop, instr
+        .macro  bitop, name, instr
+ENTRY(  \name           )
+UNWIND( .fnstart        )
         ands    ip, r1, #3
         strneb  r1, [ip]                @ assert word-aligned
         and     r2, r0, #31
@@ -49,6 +61,8 @@
         str     r2, [r1, r0, lsl #2]
         restore_irqs ip
         mov     pc, lr
+UNWIND( .fnend          )
+ENDPROC(\name           )
         .endm
 
 /**
@@ -59,7 +73,9 @@
  * Note: we can trivially conditionalise the store instruction
  * to avoid dirtying the data cache.
  */
-        .macro  testop, instr, store
+        .macro  testop, name, instr, store
+ENTRY(  \name           )
+UNWIND( .fnstart        )
         ands    ip, r1, #3
         strneb  r1, [ip]                @ assert word-aligned
         and     r3, r0, #31
@@ -73,5 +89,7 @@
         moveq   r0, #0
         restore_irqs ip
         mov     pc, lr
+UNWIND( .fnend          )
+ENDPROC(\name           )
         .endm
 #endif
diff --git a/arch/arm/lib/changebit.S b/arch/arm/lib/changebit.S
index 68ed5b62e839..f4027862172f 100644
--- a/arch/arm/lib/changebit.S
+++ b/arch/arm/lib/changebit.S
@@ -12,6 +12,4 @@
 #include "bitops.h"
                 .text
 
-ENTRY(_change_bit)
-        bitop   eor
-ENDPROC(_change_bit)
+bitop   _change_bit, eor
diff --git a/arch/arm/lib/clearbit.S b/arch/arm/lib/clearbit.S
index 4c04c3b51eeb..f6b75fb64d30 100644
--- a/arch/arm/lib/clearbit.S
+++ b/arch/arm/lib/clearbit.S
@@ -12,6 +12,4 @@
 #include "bitops.h"
                 .text
 
-ENTRY(_clear_bit)
-        bitop   bic
-ENDPROC(_clear_bit)
+bitop   _clear_bit, bic
diff --git a/arch/arm/lib/setbit.S b/arch/arm/lib/setbit.S
index bbee5c66a23e..618fedae4b37 100644
--- a/arch/arm/lib/setbit.S
+++ b/arch/arm/lib/setbit.S
@@ -12,6 +12,4 @@
 #include "bitops.h"
                 .text
 
-ENTRY(_set_bit)
-        bitop   orr
-ENDPROC(_set_bit)
+bitop   _set_bit, orr
diff --git a/arch/arm/lib/testchangebit.S b/arch/arm/lib/testchangebit.S
index 15a4d431f229..4becdc3a59cb 100644
--- a/arch/arm/lib/testchangebit.S
+++ b/arch/arm/lib/testchangebit.S
@@ -12,6 +12,4 @@
 #include "bitops.h"
                 .text
 
-ENTRY(_test_and_change_bit)
-        testop  eor, str
-ENDPROC(_test_and_change_bit)
+testop  _test_and_change_bit, eor, str
diff --git a/arch/arm/lib/testclearbit.S b/arch/arm/lib/testclearbit.S
index 521b66b5b95d..918841dcce7a 100644
--- a/arch/arm/lib/testclearbit.S
+++ b/arch/arm/lib/testclearbit.S
@@ -12,6 +12,4 @@
 #include "bitops.h"
                 .text
 
-ENTRY(_test_and_clear_bit)
-        testop  bicne, strne
-ENDPROC(_test_and_clear_bit)
+testop  _test_and_clear_bit, bicne, strne
diff --git a/arch/arm/lib/testsetbit.S b/arch/arm/lib/testsetbit.S
index 1c98cc2185bb..8d1b2fe9e487 100644
--- a/arch/arm/lib/testsetbit.S
+++ b/arch/arm/lib/testsetbit.S
@@ -12,6 +12,4 @@
 #include "bitops.h"
                 .text
 
-ENTRY(_test_and_set_bit)
-        testop  orreq, streq
-ENDPROC(_test_and_set_bit)
+testop  _test_and_set_bit, orreq, streq
diff --git a/arch/arm/mach-exynos/cpuidle.c b/arch/arm/mach-exynos/cpuidle.c
index 35f6502144ae..4ebb382c5979 100644
--- a/arch/arm/mach-exynos/cpuidle.c
+++ b/arch/arm/mach-exynos/cpuidle.c
@@ -12,6 +12,8 @@
 #include <linux/init.h>
 #include <linux/cpuidle.h>
 #include <linux/io.h>
+#include <linux/export.h>
+#include <linux/time.h>
 
 #include <asm/proc-fns.h>
 
diff --git a/arch/arm/mach-highbank/highbank.c b/arch/arm/mach-highbank/highbank.c
index b82dcf08e747..88660d500f5b 100644
--- a/arch/arm/mach-highbank/highbank.c
+++ b/arch/arm/mach-highbank/highbank.c
@@ -22,6 +22,7 @@
 #include <linux/of_irq.h>
 #include <linux/of_platform.h>
 #include <linux/of_address.h>
+#include <linux/smp.h>
 
 #include <asm/cacheflush.h>
 #include <asm/unified.h>
@@ -72,6 +73,9 @@ static void __init highbank_map_io(void)
 
 void highbank_set_cpu_jump(int cpu, void *jump_addr)
 {
+#ifdef CONFIG_SMP
+        cpu = cpu_logical_map(cpu);
+#endif
         writel(BSYM(virt_to_phys(jump_addr)), HB_JUMP_TABLE_VIRT(cpu));
         __cpuc_flush_dcache_area(HB_JUMP_TABLE_VIRT(cpu), 16);
         outer_clean_range(HB_JUMP_TABLE_PHYS(cpu),
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index 5f7f9c2a34ae..c44aa974e79c 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -10,11 +10,6 @@ config HAVE_IMX_MMDC
 config HAVE_IMX_SRC
         bool
 
-#
-# ARCH_MX31 and ARCH_MX35 are left for compatibility
-# Some usages assume that having one of them implies not having (e.g.) ARCH_MX2.
-# To easily distinguish good and reviewed from unreviewed usages new (and IMHO
-# more sensible) names are used: SOC_IMX31 and SOC_IMX35
 config ARCH_MX1
         bool
 
@@ -27,12 +22,6 @@ config ARCH_MX25
 config MACH_MX27
         bool
 
-config ARCH_MX31
-        bool
-
-config ARCH_MX35
-        bool
-
 config SOC_IMX1
         bool
         select ARCH_MX1
@@ -72,7 +61,6 @@ config SOC_IMX31
         select CPU_V6
         select IMX_HAVE_PLATFORM_MXC_RNGA
         select ARCH_MXC_AUDMUX_V2
-        select ARCH_MX31
         select MXC_AVIC
         select SMP_ON_UP if SMP
 
@@ -82,7 +70,6 @@ config SOC_IMX35
         select ARCH_MXC_IOMUX_V3
         select ARCH_MXC_AUDMUX_V2
         select HAVE_EPIT
-        select ARCH_MX35
         select MXC_AVIC
         select SMP_ON_UP if SMP
 
diff --git a/arch/arm/mach-imx/clock-imx6q.c b/arch/arm/mach-imx/clock-imx6q.c
index 613a1b993bff..039a7abb165a 100644
--- a/arch/arm/mach-imx/clock-imx6q.c
+++ b/arch/arm/mach-imx/clock-imx6q.c
@@ -1953,14 +1953,17 @@ static struct map_desc imx6q_clock_desc[] = {
         imx_map_entry(MX6Q, ANATOP, MT_DEVICE),
 };
 
+void __init imx6q_clock_map_io(void)
+{
+        iotable_init(imx6q_clock_desc, ARRAY_SIZE(imx6q_clock_desc));
+}
+
 int __init mx6q_clocks_init(void)
 {
         struct device_node *np;
         void __iomem *base;
         int i, irq;
 
-        iotable_init(imx6q_clock_desc, ARRAY_SIZE(imx6q_clock_desc));
-
         /* retrieve the freqency of fixed clocks from device tree */
         for_each_compatible_node(np, NULL, "fixed-clock") {
                 u32 rate;
diff --git a/arch/arm/mach-imx/mach-imx6q.c b/arch/arm/mach-imx/mach-imx6q.c
index 8bf5fa349484..9cd860a27af5 100644
--- a/arch/arm/mach-imx/mach-imx6q.c
+++ b/arch/arm/mach-imx/mach-imx6q.c
@@ -34,6 +34,7 @@ static void __init imx6q_map_io(void)
 {
         imx_lluart_map_io();
         imx_scu_map_io();
+        imx6q_clock_map_io();
 }
 
 static void __init imx6q_gpio_add_irq_domain(struct device_node *np,
diff --git a/arch/arm/mach-imx/mm-imx3.c b/arch/arm/mach-imx/mm-imx3.c
index 9f0e82ec3398..31807d2a8b7b 100644
--- a/arch/arm/mach-imx/mm-imx3.c
+++ b/arch/arm/mach-imx/mm-imx3.c
@@ -33,29 +33,32 @@
 static void imx3_idle(void)
 {
         unsigned long reg = 0;
-        __asm__ __volatile__(
-                /* disable I and D cache */
-                "mrc p15, 0, %0, c1, c0, 0\n"
-                "bic %0, %0, #0x00001000\n"
-                "bic %0, %0, #0x00000004\n"
-                "mcr p15, 0, %0, c1, c0, 0\n"
-                /* invalidate I cache */
-                "mov %0, #0\n"
-                "mcr p15, 0, %0, c7, c5, 0\n"
-                /* clear and invalidate D cache */
-                "mov %0, #0\n"
-                "mcr p15, 0, %0, c7, c14, 0\n"
-                /* WFI */
-                "mov %0, #0\n"
-                "mcr p15, 0, %0, c7, c0, 4\n"
-                "nop\n" "nop\n" "nop\n" "nop\n"
-                "nop\n" "nop\n" "nop\n"
-                /* enable I and D cache */
-                "mrc p15, 0, %0, c1, c0, 0\n"
-                "orr %0, %0, #0x00001000\n"
-                "orr %0, %0, #0x00000004\n"
-                "mcr p15, 0, %0, c1, c0, 0\n"
-                : "=r" (reg));
+
+        if (!need_resched())
+                __asm__ __volatile__(
+                        /* disable I and D cache */
+                        "mrc p15, 0, %0, c1, c0, 0\n"
+                        "bic %0, %0, #0x00001000\n"
+                        "bic %0, %0, #0x00000004\n"
+                        "mcr p15, 0, %0, c1, c0, 0\n"
+                        /* invalidate I cache */
+                        "mov %0, #0\n"
+                        "mcr p15, 0, %0, c7, c5, 0\n"
+                        /* clear and invalidate D cache */
+                        "mov %0, #0\n"
+                        "mcr p15, 0, %0, c7, c14, 0\n"
+                        /* WFI */
+                        "mov %0, #0\n"
+                        "mcr p15, 0, %0, c7, c0, 4\n"
+                        "nop\n" "nop\n" "nop\n" "nop\n"
+                        "nop\n" "nop\n" "nop\n"
+                        /* enable I and D cache */
+                        "mrc p15, 0, %0, c1, c0, 0\n"
+                        "orr %0, %0, #0x00001000\n"
+                        "orr %0, %0, #0x00000004\n"
+                        "mcr p15, 0, %0, c1, c0, 0\n"
+                        : "=r" (reg));
+        local_irq_enable();
 }
 
 static void __iomem *imx3_ioremap(unsigned long phys_addr, size_t size,
@@ -108,6 +111,7 @@ void imx3_init_l2x0(void)
         l2x0_init(l2x0_base, 0x00030024, 0x00000000);
 }
 
+#ifdef CONFIG_SOC_IMX31
 static struct map_desc mx31_io_desc[] __initdata = {
         imx_map_entry(MX31, X_MEMC, MT_DEVICE),
         imx_map_entry(MX31, AVIC, MT_DEVICE_NONSHARED),
@@ -126,33 +130,11 @@ void __init mx31_map_io(void)
         iotable_init(mx31_io_desc, ARRAY_SIZE(mx31_io_desc));
 }
 
-static struct map_desc mx35_io_desc[] __initdata = {
-        imx_map_entry(MX35, X_MEMC, MT_DEVICE),
-        imx_map_entry(MX35, AVIC, MT_DEVICE_NONSHARED),
-        imx_map_entry(MX35, AIPS1, MT_DEVICE_NONSHARED),
-        imx_map_entry(MX35, AIPS2, MT_DEVICE_NONSHARED),
-        imx_map_entry(MX35, SPBA0, MT_DEVICE_NONSHARED),
-};
-
-void __init mx35_map_io(void)
-{
-        iotable_init(mx35_io_desc, ARRAY_SIZE(mx35_io_desc));
-}
-
 void __init imx31_init_early(void)
 {
         mxc_set_cpu_type(MXC_CPU_MX31);
         mxc_arch_reset_init(MX31_IO_ADDRESS(MX31_WDOG_BASE_ADDR));
-        imx_idle = imx3_idle;
-        imx_ioremap = imx3_ioremap;
-}
-
-void __init imx35_init_early(void)
-{
-        mxc_set_cpu_type(MXC_CPU_MX35);
-        mxc_iomux_v3_init(MX35_IO_ADDRESS(MX35_IOMUXC_BASE_ADDR));
-        mxc_arch_reset_init(MX35_IO_ADDRESS(MX35_WDOG_BASE_ADDR));
-        imx_idle = imx3_idle;
+        pm_idle = imx3_idle;
         imx_ioremap = imx3_ioremap;
 }
 
@@ -161,11 +143,6 @@ void __init mx31_init_irq(void)
         mxc_init_irq(MX31_IO_ADDRESS(MX31_AVIC_BASE_ADDR));
 }
 
-void __init mx35_init_irq(void)
-{
-        mxc_init_irq(MX35_IO_ADDRESS(MX35_AVIC_BASE_ADDR));
-}
-
 static struct sdma_script_start_addrs imx31_to1_sdma_script __initdata = {
         .per_2_per_addr = 1677,
 };
@@ -199,6 +176,35 @@ void __init imx31_soc_init(void)
 
         imx_add_imx_sdma("imx31-sdma", MX31_SDMA_BASE_ADDR, MX31_INT_SDMA, &imx31_sdma_pdata);
 }
+#endif /* ifdef CONFIG_SOC_IMX31 */
+
+#ifdef CONFIG_SOC_IMX35
+static struct map_desc mx35_io_desc[] __initdata = {
+        imx_map_entry(MX35, X_MEMC, MT_DEVICE),
+        imx_map_entry(MX35, AVIC, MT_DEVICE_NONSHARED),
+        imx_map_entry(MX35, AIPS1, MT_DEVICE_NONSHARED),
+        imx_map_entry(MX35, AIPS2, MT_DEVICE_NONSHARED),
+        imx_map_entry(MX35, SPBA0, MT_DEVICE_NONSHARED),
+};
+
+void __init mx35_map_io(void)
+{
+        iotable_init(mx35_io_desc, ARRAY_SIZE(mx35_io_desc));
+}
+
+void __init imx35_init_early(void)
+{
+        mxc_set_cpu_type(MXC_CPU_MX35);
+        mxc_iomux_v3_init(MX35_IO_ADDRESS(MX35_IOMUXC_BASE_ADDR));
+        mxc_arch_reset_init(MX35_IO_ADDRESS(MX35_WDOG_BASE_ADDR));
+        pm_idle = imx3_idle;
+        imx_ioremap = imx3_ioremap;
+}
+
+void __init mx35_init_irq(void)
+{
+        mxc_init_irq(MX35_IO_ADDRESS(MX35_AVIC_BASE_ADDR));
+}
 
 static struct sdma_script_start_addrs imx35_to1_sdma_script __initdata = {
         .ap_2_ap_addr = 642,
@@ -254,3 +260,4 @@ void __init imx35_soc_init(void)
 
         imx_add_imx_sdma("imx35-sdma", MX35_SDMA_BASE_ADDR, MX35_INT_SDMA, &imx35_sdma_pdata);
 }
+#endif /* ifdef CONFIG_SOC_IMX35 */
diff --git a/arch/arm/mach-imx/src.c b/arch/arm/mach-imx/src.c
index 36cacbd0dcc2..a8e33681b732 100644
--- a/arch/arm/mach-imx/src.c
+++ b/arch/arm/mach-imx/src.c
@@ -14,6 +14,7 @@
 #include <linux/io.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
+#include <linux/smp.h>
 #include <asm/unified.h>
 
 #define SRC_SCR                         0x000
@@ -23,10 +24,15 @@
 
 static void __iomem *src_base;
 
+#ifndef CONFIG_SMP
+#define cpu_logical_map(cpu)            0
+#endif
+
 void imx_enable_cpu(int cpu, bool enable)
 {
         u32 mask, val;
 
+        cpu = cpu_logical_map(cpu);
         mask = 1 << (BP_SRC_SCR_CORE1_ENABLE + cpu - 1);
         val = readl_relaxed(src_base + SRC_SCR);
         val = enable ? val | mask : val & ~mask;
@@ -35,6 +41,7 @@ void imx_enable_cpu(int cpu, bool enable)
 
 void imx_set_cpu_jump(int cpu, void *jump_addr)
 {
+        cpu = cpu_logical_map(cpu);
         writel_relaxed(BSYM(virt_to_phys(jump_addr)),
                        src_base + SRC_GPR1 + cpu * 8);
 }
diff --git a/arch/arm/mach-mmp/gplugd.c b/arch/arm/mach-mmp/gplugd.c
index 69156568bc41..4665767a4f79 100644
--- a/arch/arm/mach-mmp/gplugd.c
+++ b/arch/arm/mach-mmp/gplugd.c
@@ -182,7 +182,7 @@ static void __init gplugd_init(void)
 
         /* on-chip devices */
         pxa168_add_uart(3);
-        pxa168_add_ssp(0);
+        pxa168_add_ssp(1);
         pxa168_add_twsi(0, NULL, ARRAY_AND_SIZE(gplugd_i2c_board_info));
 
         pxa168_add_eth(&gplugd_eth_platform_data);
diff --git a/arch/arm/mach-mmp/include/mach/gpio-pxa.h b/arch/arm/mach-mmp/include/mach/gpio-pxa.h
index d14eeaf16322..99b4ce1b6562 100644
--- a/arch/arm/mach-mmp/include/mach/gpio-pxa.h
+++ b/arch/arm/mach-mmp/include/mach/gpio-pxa.h
@@ -7,7 +7,7 @@
 #define GPIO_REGS_VIRT  (APB_VIRT_BASE + 0x19000)
 
 #define BANK_OFF(n)     (((n) < 3) ? (n) << 2 : 0x100 + (((n) - 3) << 2))
-#define GPIO_REG(x)     (GPIO_REGS_VIRT + (x))
+#define GPIO_REG(x)     (*(volatile u32 *)(GPIO_REGS_VIRT + (x)))
 
 #define NR_BUILTIN_GPIO         IRQ_GPIO_NUM
 
diff --git a/arch/arm/mach-mx5/cpu.c b/arch/arm/mach-mx5/cpu.c
index 5c5328257dca..5e2e7a843860 100644
--- a/arch/arm/mach-mx5/cpu.c
+++ b/arch/arm/mach-mx5/cpu.c
@@ -16,7 +16,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <mach/hardware.h>
-#include <asm/io.h>
+#include <linux/io.h>
 
 static int mx5_cpu_rev = -1;
 
@@ -67,7 +67,8 @@ static int __init mx51_neon_fixup(void)
         if (!cpu_is_mx51())
                 return 0;
 
-        if (mx51_revision() < IMX_CHIP_REVISION_3_0 && (elf_hwcap & HWCAP_NEON)) {
+        if (mx51_revision() < IMX_CHIP_REVISION_3_0 &&
+                        (elf_hwcap & HWCAP_NEON)) {
                 elf_hwcap &= ~HWCAP_NEON;
                 pr_info("Turning off NEON support, detected broken NEON implementation\n");
         }
diff --git a/arch/arm/mach-mx5/mm.c b/arch/arm/mach-mx5/mm.c
index 26eacc9d0d90..df4a508f240a 100644
--- a/arch/arm/mach-mx5/mm.c
+++ b/arch/arm/mach-mx5/mm.c
@@ -23,7 +23,9 @@
 
 static void imx5_idle(void)
 {
-        mx5_cpu_lp_set(WAIT_UNCLOCKED_POWER_OFF);
+        if (!need_resched())
+                mx5_cpu_lp_set(WAIT_UNCLOCKED_POWER_OFF);
+        local_irq_enable();
 }
 
 /*
@@ -89,7 +91,7 @@ void __init imx51_init_early(void)
         mxc_set_cpu_type(MXC_CPU_MX51);
         mxc_iomux_v3_init(MX51_IO_ADDRESS(MX51_IOMUXC_BASE_ADDR));
         mxc_arch_reset_init(MX51_IO_ADDRESS(MX51_WDOG1_BASE_ADDR));
-        imx_idle = imx5_idle;
+        pm_idle = imx5_idle;
 }
 
 void __init imx53_init_early(void)
diff --git a/arch/arm/mach-mxs/clock-mx28.c b/arch/arm/mach-mxs/clock-mx28.c
index 229ae3494216..da6e4aad177c 100644
--- a/arch/arm/mach-mxs/clock-mx28.c
+++ b/arch/arm/mach-mxs/clock-mx28.c
@@ -404,7 +404,7 @@ static int name##_set_rate(struct clk *clk, unsigned long rate)		\
         reg = __raw_readl(CLKCTRL_BASE_ADDR + HW_CLKCTRL_##dr);         \
         reg &= ~BM_CLKCTRL_##dr##_DIV;                                  \
         reg |= div << BP_CLKCTRL_##dr##_DIV;                            \
-        if (reg | (1 << clk->enable_shift)) {                           \
+        if (reg & (1 << clk->enable_shift)) {                           \
                 pr_err("%s: clock is gated\n", __func__);               \
                 return -EINVAL;                                         \
         }                                                               \
diff --git a/arch/arm/mach-omap1/Kconfig b/arch/arm/mach-omap1/Kconfig
index e0a028161dde..73f287d6429b 100644
--- a/arch/arm/mach-omap1/Kconfig
+++ b/arch/arm/mach-omap1/Kconfig
@@ -171,14 +171,6 @@ config MACH_OMAP_GENERIC
 comment "OMAP CPU Speed"
         depends on ARCH_OMAP1
 
-config OMAP_CLOCKS_SET_BY_BOOTLOADER
-        bool "OMAP clocks set by bootloader"
-        depends on ARCH_OMAP1
-        help
-          Enable this option to prevent the kernel from overriding the clock
-          frequencies programmed by bootloader for MPU, DSP, MMUs, TC,
-          internal LCD controller and MPU peripherals.
-
 config OMAP_ARM_216MHZ
         bool "OMAP ARM 216 MHz CPU (1710 only)"
         depends on ARCH_OMAP1 && ARCH_OMAP16XX
diff --git a/arch/arm/mach-omap1/board-ams-delta.c b/arch/arm/mach-omap1/board-ams-delta.c
index 51bae31cf361..b0f15d234a12 100644
--- a/arch/arm/mach-omap1/board-ams-delta.c
+++ b/arch/arm/mach-omap1/board-ams-delta.c
@@ -302,8 +302,6 @@ static void __init ams_delta_init(void)
         omap_cfg_reg(J19_1610_CAM_D6);
         omap_cfg_reg(J18_1610_CAM_D7);
 
-        iotable_init(ams_delta_io_desc, ARRAY_SIZE(ams_delta_io_desc));
-
         omap_board_config = ams_delta_config;
         omap_board_config_size = ARRAY_SIZE(ams_delta_config);
         omap_serial_init();
@@ -373,10 +371,16 @@ static int __init ams_delta_modem_init(void)
 }
 arch_initcall(ams_delta_modem_init);
 
+static void __init ams_delta_map_io(void)
+{
+        omap15xx_map_io();
+        iotable_init(ams_delta_io_desc, ARRAY_SIZE(ams_delta_io_desc));
+}
+
 MACHINE_START(AMS_DELTA, "Amstrad E3 (Delta)")
         /* Maintainer: Jonathan McDowell <noodles@earth.li> */
         .atag_offset    = 0x100,
-        .map_io         = omap15xx_map_io,
+        .map_io         = ams_delta_map_io,
         .init_early     = omap1_init_early,
         .reserve        = omap_reserve,
         .init_irq       = omap1_init_irq,
diff --git a/arch/arm/mach-omap1/clock.h b/arch/arm/mach-omap1/clock.h
index eaf09efb91ca..16b1423b454a 100644
--- a/arch/arm/mach-omap1/clock.h
+++ b/arch/arm/mach-omap1/clock.h
@@ -17,7 +17,8 @@
 
 #include <plat/clock.h>
 
-extern int __init omap1_clk_init(void);
+int omap1_clk_init(void);
+void omap1_clk_late_init(void);
 extern int omap1_clk_enable(struct clk *clk);
 extern void omap1_clk_disable(struct clk *clk);
 extern long omap1_clk_round_rate(struct clk *clk, unsigned long rate);
diff --git a/arch/arm/mach-omap1/clock_data.c b/arch/arm/mach-omap1/clock_data.c
index 92400b9eb69f..1297bb58869c 100644
--- a/arch/arm/mach-omap1/clock_data.c
+++ b/arch/arm/mach-omap1/clock_data.c
@@ -767,6 +767,15 @@ static struct clk_functions omap1_clk_functions = {
         .clk_disable_unused     = omap1_clk_disable_unused,
 };
 
+static void __init omap1_show_rates(void)
+{
+        pr_notice("Clocking rate (xtal/DPLL1/MPU): "
+                        "%ld.%01ld/%ld.%01ld/%ld.%01ld MHz\n",
+                ck_ref.rate / 1000000, (ck_ref.rate / 100000) % 10,
+                ck_dpll1.rate / 1000000, (ck_dpll1.rate / 100000) % 10,
+                arm_ck.rate / 1000000, (arm_ck.rate / 100000) % 10);
+}
+
 int __init omap1_clk_init(void)
 {
         struct omap_clk *c;
@@ -835,9 +844,12 @@ int __init omap1_clk_init(void)
         /* We want to be in syncronous scalable mode */
         omap_writew(0x1000, ARM_SYSST);
 
-#ifdef CONFIG_OMAP_CLOCKS_SET_BY_BOOTLOADER
-        /* Use values set by bootloader. Determine PLL rate and recalculate
-         * dependent clocks as if kernel had changed PLL or divisors.
+
+        /*
+         * Initially use the values set by bootloader. Determine PLL rate and
+         * recalculate dependent clocks as if kernel had changed PLL or
+         * divisors. See also omap1_clk_late_init() that can reprogram dpll1
+         * after the SRAM is initialized.
          */
         {
                 unsigned pll_ctl_val = omap_readw(DPLL_CTL);
@@ -862,25 +874,10 @@ int __init omap1_clk_init(void)
                         }
                 }
         }
-#else
-        /* Find the highest supported frequency and enable it */
-        if (omap1_select_table_rate(&virtual_ck_mpu, ~0)) {
-                printk(KERN_ERR "System frequencies not set. Check your config.\n");
-                /* Guess sane values (60MHz) */
-                omap_writew(0x2290, DPLL_CTL);
-                omap_writew(cpu_is_omap7xx() ? 0x3005 : 0x1005, ARM_CKCTL);
-                ck_dpll1.rate = 60000000;
-        }
-#endif
         propagate_rate(&ck_dpll1);
         /* Cache rates for clocks connected to ck_ref (not dpll1) */
         propagate_rate(&ck_ref);
-        printk(KERN_INFO "Clocking rate (xtal/DPLL1/MPU): "
-                "%ld.%01ld/%ld.%01ld/%ld.%01ld MHz\n",
-               ck_ref.rate / 1000000, (ck_ref.rate / 100000) % 10,
-               ck_dpll1.rate / 1000000, (ck_dpll1.rate / 100000) % 10,
-               arm_ck.rate / 1000000, (arm_ck.rate / 100000) % 10);
-
+        omap1_show_rates();
         if (machine_is_omap_perseus2() || machine_is_omap_fsample()) {
                 /* Select slicer output as OMAP input clock */
                 omap_writew(omap_readw(OMAP7XX_PCC_UPLD_CTRL) & ~0x1,
@@ -925,3 +922,21 @@ int __init omap1_clk_init(void)
 
         return 0;
 }
+
+#define OMAP1_DPLL1_SANE_VALUE  60000000
+
+void __init omap1_clk_late_init(void)
+{
+        if (ck_dpll1.rate >= OMAP1_DPLL1_SANE_VALUE)
+                return;
+
+        /* Find the highest supported frequency and enable it */
+        if (omap1_select_table_rate(&virtual_ck_mpu, ~0)) {
+                pr_err("System frequencies not set, using default. Check your config.\n");
+                omap_writew(0x2290, DPLL_CTL);
+                omap_writew(cpu_is_omap7xx() ? 0x3005 : 0x1005, ARM_CKCTL);
+                ck_dpll1.rate = OMAP1_DPLL1_SANE_VALUE;
+        }
+        propagate_rate(&ck_dpll1);
+        omap1_show_rates();
+}
diff --git a/arch/arm/mach-omap1/devices.c b/arch/arm/mach-omap1/devices.c
index 48ef9888e820..475cb2f50d87 100644
--- a/arch/arm/mach-omap1/devices.c
+++ b/arch/arm/mach-omap1/devices.c
@@ -30,6 +30,8 @@
 #include <plat/omap7xx.h>
 #include <plat/mcbsp.h>
 
+#include "clock.h"
+
 /*-------------------------------------------------------------------------*/
 
 #if defined(CONFIG_RTC_DRV_OMAP) || defined(CONFIG_RTC_DRV_OMAP_MODULE)
@@ -293,6 +295,7 @@ static int __init omap1_init_devices(void)
                 return -ENODEV;
 
         omap_sram_init();
+        omap1_clk_late_init();
 
         /* please keep these calls, and their implementations above,
          * in alphabetical order so they're easier to sort through.
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 503414718905..e1293aa513d3 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -334,6 +334,7 @@ config MACH_OMAP4_PANDA
 config OMAP3_EMU
         bool "OMAP3 debugging peripherals"
         depends on ARCH_OMAP3
+        select ARM_AMBA
         select OC_ETM
         help
           Say Y here to enable debugging hardware of omap3
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index 69ab1c069134..b009f17dee56 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -4,7 +4,7 @@
 
 # Common support
 obj-y := id.o io.o control.o mux.o devices.o serial.o gpmc.o timer.o pm.o \
-         common.o gpio.o dma.o wd_timer.o
+         common.o gpio.o dma.o wd_timer.o display.o
 
 omap-2-3-common                         = irq.o sdrc.o
 hwmod-common                            = omap_hwmod.o \
@@ -264,7 +264,4 @@ smsc911x-$(CONFIG_SMSC911X)		:= gpmc-smsc911x.o
 obj-y                                   += $(smsc911x-m) $(smsc911x-y)
 obj-$(CONFIG_ARCH_OMAP4)                += hwspinlock.o
 
-disp-$(CONFIG_OMAP2_DSS)                := display.o
-obj-y                                   += $(disp-m) $(disp-y)
-
 obj-y                                   += common-board-devices.o twl-common.o
diff --git a/arch/arm/mach-omap2/cpuidle34xx.c b/arch/arm/mach-omap2/cpuidle34xx.c
index 1fe35c24fba2..942bb4f19f9f 100644
--- a/arch/arm/mach-omap2/cpuidle34xx.c
+++ b/arch/arm/mach-omap2/cpuidle34xx.c
@@ -24,6 +24,7 @@
 
 #include <linux/sched.h>
 #include <linux/cpuidle.h>
+#include <linux/export.h>
 
 #include <plat/prcm.h>
 #include <plat/irqs.h>
diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
index adb2756e242f..dce9905d64bb 100644
--- a/arch/arm/mach-omap2/display.c
+++ b/arch/arm/mach-omap2/display.c
@@ -27,8 +27,35 @@
 #include <plat/omap_hwmod.h>
 #include <plat/omap_device.h>
 #include <plat/omap-pm.h>
+#include <plat/common.h>
 
 #include "control.h"
+#include "display.h"
+
+#define DISPC_CONTROL           0x0040
+#define DISPC_CONTROL2          0x0238
+#define DISPC_IRQSTATUS         0x0018
+
+#define DSS_SYSCONFIG           0x10
+#define DSS_SYSSTATUS           0x14
+#define DSS_CONTROL             0x40
+#define DSS_SDI_CONTROL         0x44
+#define DSS_PLL_CONTROL         0x48
+
+#define LCD_EN_MASK             (0x1 << 0)
+#define DIGIT_EN_MASK           (0x1 << 1)
+
+#define FRAMEDONE_IRQ_SHIFT     0
+#define EVSYNC_EVEN_IRQ_SHIFT   2
+#define EVSYNC_ODD_IRQ_SHIFT    3
+#define FRAMEDONE2_IRQ_SHIFT    22
+#define FRAMEDONETV_IRQ_SHIFT   24
+
+/*
+ * FRAMEDONE_IRQ_TIMEOUT: how long (in milliseconds) to wait during DISPC
+ *     reset before deciding that something has gone wrong
+ */
+#define FRAMEDONE_IRQ_TIMEOUT           100
 
 static struct platform_device omap_display_device = {
         .name          = "omapdss",
@@ -172,3 +199,135 @@ int __init omap_display_init(struct omap_dss_board_info *board_data)
 
         return r;
 }
+
+static void dispc_disable_outputs(void)
+{
+        u32 v, irq_mask = 0;
+        bool lcd_en, digit_en, lcd2_en = false;
+        int i;
+        struct omap_dss_dispc_dev_attr *da;
+        struct omap_hwmod *oh;
+
+        oh = omap_hwmod_lookup("dss_dispc");
+        if (!oh) {
+                WARN(1, "display: could not disable outputs during reset - could not find dss_dispc hwmod\n");
+                return;
+        }
+
+        if (!oh->dev_attr) {
+                pr_err("display: could not disable outputs during reset due to missing dev_attr\n");
+                return;
+        }
+
+        da = (struct omap_dss_dispc_dev_attr *)oh->dev_attr;
+
+        /* store value of LCDENABLE and DIGITENABLE bits */
+        v = omap_hwmod_read(oh, DISPC_CONTROL);
+        lcd_en = v & LCD_EN_MASK;
+        digit_en = v & DIGIT_EN_MASK;
+
+        /* store value of LCDENABLE for LCD2 */
+        if (da->manager_count > 2) {
+                v = omap_hwmod_read(oh, DISPC_CONTROL2);
+                lcd2_en = v & LCD_EN_MASK;
+        }
+
+        if (!(lcd_en | digit_en | lcd2_en))
+                return; /* no managers currently enabled */
+
+        /*
+         * If any manager was enabled, we need to disable it before
+         * DSS clocks are disabled or DISPC module is reset
+         */
+        if (lcd_en)
+                irq_mask |= 1 << FRAMEDONE_IRQ_SHIFT;
+
+        if (digit_en) {
+                if (da->has_framedonetv_irq) {
+                        irq_mask |= 1 << FRAMEDONETV_IRQ_SHIFT;
+                } else {
+                        irq_mask |= 1 << EVSYNC_EVEN_IRQ_SHIFT |
+                                1 << EVSYNC_ODD_IRQ_SHIFT;
+                }
+        }
+
+        if (lcd2_en)
+                irq_mask |= 1 << FRAMEDONE2_IRQ_SHIFT;
+
+        /*
+         * clear any previous FRAMEDONE, FRAMEDONETV,
+         * EVSYNC_EVEN/ODD or FRAMEDONE2 interrupts
+         */
+        omap_hwmod_write(irq_mask, oh, DISPC_IRQSTATUS);
+
+        /* disable LCD and TV managers */
+        v = omap_hwmod_read(oh, DISPC_CONTROL);
+        v &= ~(LCD_EN_MASK | DIGIT_EN_MASK);
+        omap_hwmod_write(v, oh, DISPC_CONTROL);
+
+        /* disable LCD2 manager */
+        if (da->manager_count > 2) {
+                v = omap_hwmod_read(oh, DISPC_CONTROL2);
+                v &= ~LCD_EN_MASK;
+                omap_hwmod_write(v, oh, DISPC_CONTROL2);
+        }
+
+        i = 0;
+        while ((omap_hwmod_read(oh, DISPC_IRQSTATUS) & irq_mask) !=
+               irq_mask) {
+                i++;
+                if (i > FRAMEDONE_IRQ_TIMEOUT) {
+                        pr_err("didn't get FRAMEDONE1/2 or TV interrupt\n");
+                        break;
+                }
+                mdelay(1);
+        }
+}
+
+#define MAX_MODULE_SOFTRESET_WAIT       10000
+int omap_dss_reset(struct omap_hwmod *oh)
+{
+        struct omap_hwmod_opt_clk *oc;
+        int c = 0;
+        int i, r;
+
+        if (!(oh->class->sysc->sysc_flags & SYSS_HAS_RESET_STATUS)) {
+                pr_err("dss_core: hwmod data doesn't contain reset data\n");
+                return -EINVAL;
+        }
+
+        for (i = oh->opt_clks_cnt, oc = oh->opt_clks; i > 0; i--, oc++)
+                if (oc->_clk)
+                        clk_enable(oc->_clk);
+
+        dispc_disable_outputs();
+
+        /* clear SDI registers */
+        if (cpu_is_omap3430()) {
+                omap_hwmod_write(0x0, oh, DSS_SDI_CONTROL);
+                omap_hwmod_write(0x0, oh, DSS_PLL_CONTROL);
+        }
+
+        /*
+         * clear DSS_CONTROL register to switch DSS clock sources to
+         * PRCM clock, if any
+         */
+        omap_hwmod_write(0x0, oh, DSS_CONTROL);
+
+        omap_test_timeout((omap_hwmod_read(oh, oh->class->sysc->syss_offs)
+                                & SYSS_RESETDONE_MASK),
+                        MAX_MODULE_SOFTRESET_WAIT, c);
+
+        if (c == MAX_MODULE_SOFTRESET_WAIT)
+                pr_warning("dss_core: waiting for reset to finish failed\n");
+        else
+                pr_debug("dss_core: softreset done\n");
+
+        for (i = oh->opt_clks_cnt, oc = oh->opt_clks; i > 0; i--, oc++)
+                if (oc->_clk)
+                        clk_disable(oc->_clk);
+
+        r = (c == MAX_MODULE_SOFTRESET_WAIT) ? -ETIMEDOUT : 0;
+
+        return r;
+}
diff --git a/arch/arm/mach-omap2/display.h b/arch/arm/mach-omap2/display.h
new file mode 100644
index 000000000000..b871b017b352
--- /dev/null
+++ b/arch/arm/mach-omap2/display.h
@@ -0,0 +1,29 @@
+/*
+ * display.h - OMAP2+ integration-specific DSS header
+ *
+ * Copyright (C) 2011 Texas Instruments, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __ARCH_ARM_MACH_OMAP2_DISPLAY_H
+#define __ARCH_ARM_MACH_OMAP2_DISPLAY_H
+
+#include <linux/kernel.h>
+
+struct omap_dss_dispc_dev_attr {
+        u8      manager_count;
+        bool    has_framedonetv_irq;
+};
+
+#endif
diff --git a/arch/arm/mach-omap2/io.h b/arch/arm/mach-omap2/io.h
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/arch/arm/mach-omap2/io.h
+++ /dev/null
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 6b3088db83b7..207a2ff9a8c4 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -749,7 +749,7 @@ static int _count_mpu_irqs(struct omap_hwmod *oh)
                 ohii = &oh->mpu_irqs[i++];
         } while (ohii->irq != -1);
 
-        return i;
+        return i-1;
 }
 
 /**
@@ -772,7 +772,7 @@ static int _count_sdma_reqs(struct omap_hwmod *oh)
                 ohdi = &oh->sdma_reqs[i++];
         } while (ohdi->dma_req != -1);
 
-        return i;
+        return i-1;
 }
 
 /**
@@ -795,7 +795,7 @@ static int _count_ocp_if_addr_spaces(struct omap_hwmod_ocp_if *os)
                 mem = &os->addr[i++];
         } while (mem->pa_start != mem->pa_end);
 
-        return i;
+        return i-1;
 }
 
 /**
diff --git a/arch/arm/mach-omap2/omap_hwmod_2420_data.c b/arch/arm/mach-omap2/omap_hwmod_2420_data.c
index 6d7206213525..a5409ce3f323 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2420_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2420_data.c
@@ -875,6 +875,10 @@ static struct omap_hwmod_ocp_if *omap2420_dss_slaves[] = {
 };
 
 static struct omap_hwmod_opt_clk dss_opt_clks[] = {
+        /*
+         * The DSS HW needs all DSS clocks enabled during reset. The dss_core
+         * driver does not use these clocks.
+         */
         { .role = "tv_clk", .clk = "dss_54m_fck" },
         { .role = "sys_clk", .clk = "dss2_fck" },
 };
@@ -899,7 +903,7 @@ static struct omap_hwmod omap2420_dss_core_hwmod = {
         .slaves_cnt     = ARRAY_SIZE(omap2420_dss_slaves),
         .masters        = omap2420_dss_masters,
         .masters_cnt    = ARRAY_SIZE(omap2420_dss_masters),
-        .flags          = HWMOD_NO_IDLEST,
+        .flags          = HWMOD_NO_IDLEST | HWMOD_CONTROL_OPT_CLKS_IN_RESET,
 };
 
 /* l4_core -> dss_dispc */
@@ -939,6 +943,7 @@ static struct omap_hwmod omap2420_dss_dispc_hwmod = {
         .slaves         = omap2420_dss_dispc_slaves,
         .slaves_cnt     = ARRAY_SIZE(omap2420_dss_dispc_slaves),
         .flags          = HWMOD_NO_IDLEST,
+        .dev_attr       = &omap2_3_dss_dispc_dev_attr
 };
 
 /* l4_core -> dss_rfbi */
@@ -961,6 +966,10 @@ static struct omap_hwmod_ocp_if *omap2420_dss_rfbi_slaves[] = {
         &omap2420_l4_core__dss_rfbi,
 };
 
+static struct omap_hwmod_opt_clk dss_rfbi_opt_clks[] = {
+        { .role = "ick", .clk = "dss_ick" },
+};
+
 static struct omap_hwmod omap2420_dss_rfbi_hwmod = {
         .name           = "dss_rfbi",
         .class          = &omap2_rfbi_hwmod_class,
@@ -972,6 +981,8 @@ static struct omap_hwmod omap2420_dss_rfbi_hwmod = {
                         .module_offs = CORE_MOD,
                 },
         },
+        .opt_clks       = dss_rfbi_opt_clks,
+        .opt_clks_cnt   = ARRAY_SIZE(dss_rfbi_opt_clks),
         .slaves         = omap2420_dss_rfbi_slaves,
         .slaves_cnt     = ARRAY_SIZE(omap2420_dss_rfbi_slaves),
         .flags          = HWMOD_NO_IDLEST,
@@ -981,7 +992,7 @@ static struct omap_hwmod omap2420_dss_rfbi_hwmod = {
 static struct omap_hwmod_ocp_if omap2420_l4_core__dss_venc = {
         .master         = &omap2420_l4_core_hwmod,
         .slave          = &omap2420_dss_venc_hwmod,
-        .clk            = "dss_54m_fck",
+        .clk            = "dss_ick",
         .addr           = omap2_dss_venc_addrs,
         .fw = {
                 .omap2 = {
@@ -1001,7 +1012,7 @@ static struct omap_hwmod_ocp_if *omap2420_dss_venc_slaves[] = {
 static struct omap_hwmod omap2420_dss_venc_hwmod = {
         .name           = "dss_venc",
         .class          = &omap2_venc_hwmod_class,
-        .main_clk       = "dss1_fck",
+        .main_clk       = "dss_54m_fck",
         .prcm           = {
                 .omap2 = {
                         .prcm_reg_id = 1,
diff --git a/arch/arm/mach-omap2/omap_hwmod_2430_data.c b/arch/arm/mach-omap2/omap_hwmod_2430_data.c
index a2580d01c3ff..c4f56cb60d7d 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2430_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2430_data.c
@@ -942,6 +942,10 @@ static struct omap_hwmod_ocp_if *omap2430_dss_slaves[] = {
 };
 
 static struct omap_hwmod_opt_clk dss_opt_clks[] = {
+        /*
+         * The DSS HW needs all DSS clocks enabled during reset. The dss_core
+         * driver does not use these clocks.
+         */
         { .role = "tv_clk", .clk = "dss_54m_fck" },
         { .role = "sys_clk", .clk = "dss2_fck" },
 };
@@ -966,7 +970,7 @@ static struct omap_hwmod omap2430_dss_core_hwmod = {
         .slaves_cnt     = ARRAY_SIZE(omap2430_dss_slaves),
         .masters        = omap2430_dss_masters,
         .masters_cnt    = ARRAY_SIZE(omap2430_dss_masters),
-        .flags          = HWMOD_NO_IDLEST,
+        .flags          = HWMOD_NO_IDLEST | HWMOD_CONTROL_OPT_CLKS_IN_RESET,
 };
 
 /* l4_core -> dss_dispc */
@@ -1000,6 +1004,7 @@ static struct omap_hwmod omap2430_dss_dispc_hwmod = {
         .slaves         = omap2430_dss_dispc_slaves,
         .slaves_cnt     = ARRAY_SIZE(omap2430_dss_dispc_slaves),
         .flags          = HWMOD_NO_IDLEST,
+        .dev_attr       = &omap2_3_dss_dispc_dev_attr
 };
 
 /* l4_core -> dss_rfbi */
@@ -1016,6 +1021,10 @@ static struct omap_hwmod_ocp_if *omap2430_dss_rfbi_slaves[] = {
         &omap2430_l4_core__dss_rfbi,
 };
 
+static struct omap_hwmod_opt_clk dss_rfbi_opt_clks[] = {
+        { .role = "ick", .clk = "dss_ick" },
+};
+
 static struct omap_hwmod omap2430_dss_rfbi_hwmod = {
         .name           = "dss_rfbi",
         .class          = &omap2_rfbi_hwmod_class,
@@ -1027,6 +1036,8 @@ static struct omap_hwmod omap2430_dss_rfbi_hwmod = {
                         .module_offs = CORE_MOD,
                 },
         },
+        .opt_clks       = dss_rfbi_opt_clks,
+        .opt_clks_cnt   = ARRAY_SIZE(dss_rfbi_opt_clks),
         .slaves         = omap2430_dss_rfbi_slaves,
         .slaves_cnt     = ARRAY_SIZE(omap2430_dss_rfbi_slaves),
         .flags          = HWMOD_NO_IDLEST,
@@ -1036,7 +1047,7 @@ static struct omap_hwmod omap2430_dss_rfbi_hwmod = {
 static struct omap_hwmod_ocp_if omap2430_l4_core__dss_venc = {
         .master         = &omap2430_l4_core_hwmod,
         .slave          = &omap2430_dss_venc_hwmod,
-        .clk            = "dss_54m_fck",
+        .clk            = "dss_ick",
         .addr           = omap2_dss_venc_addrs,
         .flags          = OCPIF_SWSUP_IDLE,
         .user           = OCP_USER_MPU | OCP_USER_SDMA,
@@ -1050,7 +1061,7 @@ static struct omap_hwmod_ocp_if *omap2430_dss_venc_slaves[] = {
 static struct omap_hwmod omap2430_dss_venc_hwmod = {
         .name           = "dss_venc",
         .class          = &omap2_venc_hwmod_class,
-        .main_clk       = "dss1_fck",
+        .main_clk       = "dss_54m_fck",
         .prcm           = {
                 .omap2 = {
                         .prcm_reg_id = 1,
diff --git a/arch/arm/mach-omap2/omap_hwmod_2xxx_3xxx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_2xxx_3xxx_ipblock_data.c
index c451729d289a..c11273da5dcc 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2xxx_3xxx_ipblock_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2xxx_3xxx_ipblock_data.c
@@ -11,6 +11,7 @@
 #include <plat/omap_hwmod.h>
 #include <plat/serial.h>
 #include <plat/dma.h>
+#include <plat/common.h>
 
 #include <mach/irqs.h>
 
@@ -43,13 +44,15 @@ static struct omap_hwmod_class_sysconfig omap2_dss_sysc = {
         .rev_offs       = 0x0000,
         .sysc_offs      = 0x0010,
         .syss_offs      = 0x0014,
-        .sysc_flags     = (SYSC_HAS_SOFTRESET | SYSC_HAS_AUTOIDLE),
+        .sysc_flags     = (SYSC_HAS_SOFTRESET | SYSC_HAS_AUTOIDLE |
+                           SYSS_HAS_RESET_STATUS),
         .sysc_fields    = &omap_hwmod_sysc_type1,
 };
 
 struct omap_hwmod_class omap2_dss_hwmod_class = {
         .name   = "dss",
         .sysc   = &omap2_dss_sysc,
+        .reset  = omap_dss_reset,
 };
 
 /*
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index bc9035ec87fc..7f8915ad5099 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -1369,9 +1369,14 @@ static struct omap_hwmod_ocp_if *omap3xxx_dss_slaves[] = {
 };
 
 static struct omap_hwmod_opt_clk dss_opt_clks[] = {
-        { .role = "tv_clk", .clk = "dss_tv_fck" },
-        { .role = "video_clk", .clk = "dss_96m_fck" },
+        /*
+         * The DSS HW needs all DSS clocks enabled during reset. The dss_core
+         * driver does not use these clocks.
+         */
         { .role = "sys_clk", .clk = "dss2_alwon_fck" },
+        { .role = "tv_clk", .clk = "dss_tv_fck" },
+        /* required only on OMAP3430 */
+        { .role = "tv_dac_clk", .clk = "dss_96m_fck" },
 };
 
 static struct omap_hwmod omap3430es1_dss_core_hwmod = {
@@ -1394,11 +1399,12 @@ static struct omap_hwmod omap3430es1_dss_core_hwmod = {
         .slaves_cnt     = ARRAY_SIZE(omap3430es1_dss_slaves),
         .masters        = omap3xxx_dss_masters,
         .masters_cnt    = ARRAY_SIZE(omap3xxx_dss_masters),
-        .flags          = HWMOD_NO_IDLEST,
+        .flags          = HWMOD_NO_IDLEST | HWMOD_CONTROL_OPT_CLKS_IN_RESET,
 };
 
 static struct omap_hwmod omap3xxx_dss_core_hwmod = {
         .name           = "dss_core",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .class          = &omap2_dss_hwmod_class,
         .main_clk       = "dss1_alwon_fck", /* instead of dss_fck */
         .sdma_reqs      = omap3xxx_dss_sdma_chs,
@@ -1456,6 +1462,7 @@ static struct omap_hwmod omap3xxx_dss_dispc_hwmod = {
         .slaves         = omap3xxx_dss_dispc_slaves,
         .slaves_cnt     = ARRAY_SIZE(omap3xxx_dss_dispc_slaves),
         .flags          = HWMOD_NO_IDLEST,
+        .dev_attr       = &omap2_3_dss_dispc_dev_attr
 };
 
 /*
@@ -1486,6 +1493,7 @@ static struct omap_hwmod_addr_space omap3xxx_dss_dsi1_addrs[] = {
 static struct omap_hwmod_ocp_if omap3xxx_l4_core__dss_dsi1 = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap3xxx_dss_dsi1_hwmod,
+        .clk            = "dss_ick",
         .addr           = omap3xxx_dss_dsi1_addrs,
         .fw = {
                 .omap2 = {
@@ -1502,6 +1510,10 @@ static struct omap_hwmod_ocp_if *omap3xxx_dss_dsi1_slaves[] = {
         &omap3xxx_l4_core__dss_dsi1,
 };
 
+static struct omap_hwmod_opt_clk dss_dsi1_opt_clks[] = {
+        { .role = "sys_clk", .clk = "dss2_alwon_fck" },
+};
+
 static struct omap_hwmod omap3xxx_dss_dsi1_hwmod = {
         .name           = "dss_dsi1",
         .class          = &omap3xxx_dsi_hwmod_class,
@@ -1514,6 +1526,8 @@ static struct omap_hwmod omap3xxx_dss_dsi1_hwmod = {
                         .module_offs = OMAP3430_DSS_MOD,
                 },
         },
+        .opt_clks       = dss_dsi1_opt_clks,
+        .opt_clks_cnt   = ARRAY_SIZE(dss_dsi1_opt_clks),
         .slaves         = omap3xxx_dss_dsi1_slaves,
         .slaves_cnt     = ARRAY_SIZE(omap3xxx_dss_dsi1_slaves),
         .flags          = HWMOD_NO_IDLEST,
@@ -1540,6 +1554,10 @@ static struct omap_hwmod_ocp_if *omap3xxx_dss_rfbi_slaves[] = {
         &omap3xxx_l4_core__dss_rfbi,
 };
 
+static struct omap_hwmod_opt_clk dss_rfbi_opt_clks[] = {
+        { .role = "ick", .clk = "dss_ick" },
+};
+
 static struct omap_hwmod omap3xxx_dss_rfbi_hwmod = {
         .name           = "dss_rfbi",
         .class          = &omap2_rfbi_hwmod_class,
@@ -1551,6 +1569,8 @@ static struct omap_hwmod omap3xxx_dss_rfbi_hwmod = {
                         .module_offs = OMAP3430_DSS_MOD,
                 },
         },
+        .opt_clks       = dss_rfbi_opt_clks,
+        .opt_clks_cnt   = ARRAY_SIZE(dss_rfbi_opt_clks),
         .slaves         = omap3xxx_dss_rfbi_slaves,
         .slaves_cnt     = ARRAY_SIZE(omap3xxx_dss_rfbi_slaves),
         .flags          = HWMOD_NO_IDLEST,
@@ -1560,7 +1580,7 @@ static struct omap_hwmod omap3xxx_dss_rfbi_hwmod = {
 static struct omap_hwmod_ocp_if omap3xxx_l4_core__dss_venc = {
         .master         = &omap3xxx_l4_core_hwmod,
         .slave          = &omap3xxx_dss_venc_hwmod,
-        .clk            = "dss_tv_fck",
+        .clk            = "dss_ick",
         .addr           = omap2_dss_venc_addrs,
         .fw = {
                 .omap2 = {
@@ -1578,10 +1598,15 @@ static struct omap_hwmod_ocp_if *omap3xxx_dss_venc_slaves[] = {
         &omap3xxx_l4_core__dss_venc,
 };
 
+static struct omap_hwmod_opt_clk dss_venc_opt_clks[] = {
+        /* required only on OMAP3430 */
+        { .role = "tv_dac_clk", .clk = "dss_96m_fck" },
+};
+
 static struct omap_hwmod omap3xxx_dss_venc_hwmod = {
         .name           = "dss_venc",
         .class          = &omap2_venc_hwmod_class,
-        .main_clk       = "dss1_alwon_fck",
+        .main_clk       = "dss_tv_fck",
         .prcm           = {
                 .omap2 = {
                         .prcm_reg_id = 1,
@@ -1589,6 +1614,8 @@ static struct omap_hwmod omap3xxx_dss_venc_hwmod = {
                         .module_offs = OMAP3430_DSS_MOD,
                 },
         },
+        .opt_clks       = dss_venc_opt_clks,
+        .opt_clks_cnt   = ARRAY_SIZE(dss_venc_opt_clks),
         .slaves         = omap3xxx_dss_venc_slaves,
         .slaves_cnt     = ARRAY_SIZE(omap3xxx_dss_venc_slaves),
         .flags          = HWMOD_NO_IDLEST,
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index 7695e5d43316..daaf165af696 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -30,6 +30,7 @@
 #include <plat/mmc.h>
 #include <plat/i2c.h>
 #include <plat/dmtimer.h>
+#include <plat/common.h>
 
 #include "omap_hwmod_common_data.h"
 
@@ -1187,6 +1188,7 @@ static struct omap_hwmod_class_sysconfig omap44xx_dss_sysc = {
 static struct omap_hwmod_class omap44xx_dss_hwmod_class = {
         .name   = "dss",
         .sysc   = &omap44xx_dss_sysc,
+        .reset  = omap_dss_reset,
 };
 
 /* dss */
@@ -1240,12 +1242,12 @@ static struct omap_hwmod_ocp_if *omap44xx_dss_slaves[] = {
 static struct omap_hwmod_opt_clk dss_opt_clks[] = {
         { .role = "sys_clk", .clk = "dss_sys_clk" },
         { .role = "tv_clk", .clk = "dss_tv_clk" },
-        { .role = "dss_clk", .clk = "dss_dss_clk" },
-        { .role = "video_clk", .clk = "dss_48mhz_clk" },
+        { .role = "hdmi_clk", .clk = "dss_48mhz_clk" },
 };
 
 static struct omap_hwmod omap44xx_dss_hwmod = {
         .name           = "dss_core",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .class          = &omap44xx_dss_hwmod_class,
         .clkdm_name     = "l3_dss_clkdm",
         .main_clk       = "dss_dss_clk",
@@ -1325,6 +1327,11 @@ static struct omap_hwmod_addr_space omap44xx_dss_dispc_addrs[] = {
         { }
 };
 
+static struct omap_dss_dispc_dev_attr omap44xx_dss_dispc_dev_attr = {
+        .manager_count          = 3,
+        .has_framedonetv_irq    = 1
+};
+
 /* l4_per -> dss_dispc */
 static struct omap_hwmod_ocp_if omap44xx_l4_per__dss_dispc = {
         .master         = &omap44xx_l4_per_hwmod,
@@ -1340,12 +1347,6 @@ static struct omap_hwmod_ocp_if *omap44xx_dss_dispc_slaves[] = {
         &omap44xx_l4_per__dss_dispc,
 };
 
-static struct omap_hwmod_opt_clk dss_dispc_opt_clks[] = {
-        { .role = "sys_clk", .clk = "dss_sys_clk" },
-        { .role = "tv_clk", .clk = "dss_tv_clk" },
-        { .role = "hdmi_clk", .clk = "dss_48mhz_clk" },
-};
-
 static struct omap_hwmod omap44xx_dss_dispc_hwmod = {
         .name           = "dss_dispc",
         .class          = &omap44xx_dispc_hwmod_class,
@@ -1359,10 +1360,9 @@ static struct omap_hwmod omap44xx_dss_dispc_hwmod = {
                         .context_offs = OMAP4_RM_DSS_DSS_CONTEXT_OFFSET,
                 },
         },
-        .opt_clks       = dss_dispc_opt_clks,
-        .opt_clks_cnt   = ARRAY_SIZE(dss_dispc_opt_clks),
         .slaves         = omap44xx_dss_dispc_slaves,
         .slaves_cnt     = ARRAY_SIZE(omap44xx_dss_dispc_slaves),
+        .dev_attr       = &omap44xx_dss_dispc_dev_attr
 };
 
 /*
@@ -1624,7 +1624,7 @@ static struct omap_hwmod omap44xx_dss_hdmi_hwmod = {
         .clkdm_name     = "l3_dss_clkdm",
         .mpu_irqs       = omap44xx_dss_hdmi_irqs,
         .sdma_reqs      = omap44xx_dss_hdmi_sdma_reqs,
-        .main_clk       = "dss_dss_clk",
+        .main_clk       = "dss_48mhz_clk",
         .prcm = {
                 .omap4 = {
                         .clkctrl_offs = OMAP4_CM_DSS_DSS_CLKCTRL_OFFSET,
@@ -1785,7 +1785,7 @@ static struct omap_hwmod omap44xx_dss_venc_hwmod = {
         .name           = "dss_venc",
         .class          = &omap44xx_venc_hwmod_class,
         .clkdm_name     = "l3_dss_clkdm",
-        .main_clk       = "dss_dss_clk",
+        .main_clk       = "dss_tv_clk",
         .prcm = {
                 .omap4 = {
                         .clkctrl_offs = OMAP4_CM_DSS_DSS_CLKCTRL_OFFSET,
diff --git a/arch/arm/mach-omap2/omap_hwmod_common_data.c b/arch/arm/mach-omap2/omap_hwmod_common_data.c
index de832ebc93a9..51e5418899fb 100644
--- a/arch/arm/mach-omap2/omap_hwmod_common_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_common_data.c
@@ -49,3 +49,7 @@ struct omap_hwmod_sysc_fields omap_hwmod_sysc_type2 = {
         .srst_shift     = SYSC_TYPE2_SOFTRESET_SHIFT,
 };
 
+struct omap_dss_dispc_dev_attr omap2_3_dss_dispc_dev_attr = {
+        .manager_count          = 2,
+        .has_framedonetv_irq    = 0
+};
diff --git a/arch/arm/mach-omap2/omap_hwmod_common_data.h b/arch/arm/mach-omap2/omap_hwmod_common_data.h
index 39a7c37f4587..ad5d8f04c0b8 100644
--- a/arch/arm/mach-omap2/omap_hwmod_common_data.h
+++ b/arch/arm/mach-omap2/omap_hwmod_common_data.h
@@ -16,6 +16,8 @@
 
 #include <plat/omap_hwmod.h>
 
+#include "display.h"
+
 /* Common address space across OMAP2xxx */
 extern struct omap_hwmod_addr_space omap2xxx_uart1_addr_space[];
 extern struct omap_hwmod_addr_space omap2xxx_uart2_addr_space[];
@@ -111,4 +113,6 @@ extern struct omap_hwmod_class omap2xxx_dma_hwmod_class;
 extern struct omap_hwmod_class omap2xxx_mailbox_hwmod_class;
 extern struct omap_hwmod_class omap2xxx_mcspi_class;
 
+extern struct omap_dss_dispc_dev_attr omap2_3_dss_dispc_dev_attr;
+
 #endif
diff --git a/arch/arm/mach-omap2/omap_l3_noc.c b/arch/arm/mach-omap2/omap_l3_noc.c
index 6a66aa5e2a5b..d15225ff5c49 100644
--- a/arch/arm/mach-omap2/omap_l3_noc.c
+++ b/arch/arm/mach-omap2/omap_l3_noc.c
@@ -237,7 +237,7 @@ static int __devexit omap4_l3_remove(struct platform_device *pdev)
 static const struct of_device_id l3_noc_match[] = {
         {.compatible = "ti,omap4-l3-noc", },
         {},
-}
+};
 MODULE_DEVICE_TABLE(of, l3_noc_match);
 #else
 #define l3_noc_match NULL
diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
index 1e79bdf313e3..00bff46ca48b 100644
--- a/arch/arm/mach-omap2/pm.c
+++ b/arch/arm/mach-omap2/pm.c
@@ -24,6 +24,7 @@
 #include "powerdomain.h"
 #include "clockdomain.h"
 #include "pm.h"
+#include "twl-common.h"
 
 static struct omap_device_pm_latency *pm_lats;
 
@@ -226,11 +227,8 @@ postcore_initcall(omap2_common_pm_init);
 
 static int __init omap2_common_pm_late_init(void)
 {
-        /* Init the OMAP TWL parameters */
-        omap3_twl_init();
-        omap4_twl_init();
-
         /* Init the voltage layer */
+        omap_pmic_late_init();
         omap_voltage_late_init();
 
         /* Initialize the voltages */
diff --git a/arch/arm/mach-omap2/smartreflex.c b/arch/arm/mach-omap2/smartreflex.c
index 6a4f6839a7d9..cf246b39bac7 100644
--- a/arch/arm/mach-omap2/smartreflex.c
+++ b/arch/arm/mach-omap2/smartreflex.c
@@ -139,7 +139,7 @@ static irqreturn_t sr_interrupt(int irq, void *data)
                 sr_write_reg(sr_info, ERRCONFIG_V1, status);
         } else if (sr_info->ip_type == SR_TYPE_V2) {
                 /* Read the status bits */
-                sr_read_reg(sr_info, IRQSTATUS);
+                status = sr_read_reg(sr_info, IRQSTATUS);
 
                 /* Clear them by writing back */
                 sr_write_reg(sr_info, IRQSTATUS, status);
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index 522435772168..10b20c652e5d 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -30,6 +30,7 @@
 #include <plat/usb.h>
 
 #include "twl-common.h"
+#include "pm.h"
 
 static struct i2c_board_info __initdata pmic_i2c_board_info = {
         .addr           = 0x48,
@@ -48,6 +49,16 @@ void __init omap_pmic_init(int bus, u32 clkrate,
         omap_register_i2c_bus(bus, clkrate, &pmic_i2c_board_info, 1);
 }
 
+void __init omap_pmic_late_init(void)
+{
+        /* Init the OMAP TWL parameters (if PMIC has been registerd) */
+        if (!pmic_i2c_board_info.irq)
+                return;
+
+        omap3_twl_init();
+        omap4_twl_init();
+}
+
 #if defined(CONFIG_ARCH_OMAP3)
 static struct twl4030_usb_data omap3_usb_pdata = {
         .usb_mode       = T2_USB_MODE_ULPI,
diff --git a/arch/arm/mach-omap2/twl-common.h b/arch/arm/mach-omap2/twl-common.h
index 5e83a5bd37fb..275dde8cb27a 100644
--- a/arch/arm/mach-omap2/twl-common.h
+++ b/arch/arm/mach-omap2/twl-common.h
@@ -1,6 +1,8 @@
 #ifndef __OMAP_PMIC_COMMON__
 #define __OMAP_PMIC_COMMON__
 
+#include <plat/irqs.h>
+
 #define TWL_COMMON_PDATA_USB            (1 << 0)
 #define TWL_COMMON_PDATA_BCI            (1 << 1)
 #define TWL_COMMON_PDATA_MADC           (1 << 2)
@@ -30,6 +32,7 @@ struct twl4030_platform_data;
 
 void omap_pmic_init(int bus, u32 clkrate, const char *pmic_type, int pmic_irq,
                     struct twl4030_platform_data *pmic_data);
+void omap_pmic_late_init(void);
 
 static inline void omap2_pmic_init(const char *pmic_type,
                                    struct twl4030_platform_data *pmic_data)
diff --git a/arch/arm/mach-pxa/balloon3.c b/arch/arm/mach-pxa/balloon3.c
index fc0b8544e174..4b81f59a4cba 100644
--- a/arch/arm/mach-pxa/balloon3.c
+++ b/arch/arm/mach-pxa/balloon3.c
@@ -307,7 +307,7 @@ static inline void balloon3_mmc_init(void) {}
 /******************************************************************************
  * USB Gadget
  ******************************************************************************/
-#if defined(CONFIG_USB_GADGET_PXA27X)||defined(CONFIG_USB_GADGET_PXA27X_MODULE)
+#if defined(CONFIG_USB_PXA27X)||defined(CONFIG_USB_PXA27X_MODULE)
 static void balloon3_udc_command(int cmd)
 {
         if (cmd == PXA2XX_UDC_CMD_CONNECT)
diff --git a/arch/arm/mach-pxa/colibri-pxa320.c b/arch/arm/mach-pxa/colibri-pxa320.c
index 692e1ffc5586..d23b92b80488 100644
--- a/arch/arm/mach-pxa/colibri-pxa320.c
+++ b/arch/arm/mach-pxa/colibri-pxa320.c
@@ -146,7 +146,7 @@ static void __init colibri_pxa320_init_eth(void)
 static inline void __init colibri_pxa320_init_eth(void) {}
 #endif /* CONFIG_AX88796 */
 
-#if defined(CONFIG_USB_GADGET_PXA27X)||defined(CONFIG_USB_GADGET_PXA27X_MODULE)
+#if defined(CONFIG_USB_PXA27X)||defined(CONFIG_USB_PXA27X_MODULE)
 static struct gpio_vbus_mach_info colibri_pxa320_gpio_vbus_info = {
         .gpio_vbus              = mfp_to_gpio(MFP_PIN_GPIO96),
         .gpio_pullup            = -1,
diff --git a/arch/arm/mach-pxa/gumstix.c b/arch/arm/mach-pxa/gumstix.c
index 9c8208ca0415..ffdd70dad327 100644
--- a/arch/arm/mach-pxa/gumstix.c
+++ b/arch/arm/mach-pxa/gumstix.c
@@ -106,7 +106,7 @@ static void __init gumstix_mmc_init(void)
 }
 #endif
 
-#ifdef CONFIG_USB_GADGET_PXA25X
+#ifdef CONFIG_USB_PXA25X
 static struct gpio_vbus_mach_info gumstix_udc_info = {
         .gpio_vbus              = GPIO_GUMSTIX_USB_GPIOn,
         .gpio_pullup            = GPIO_GUMSTIX_USB_GPIOx,
diff --git a/arch/arm/mach-pxa/include/mach/palm27x.h b/arch/arm/mach-pxa/include/mach/palm27x.h
index f80bbe246afe..d4eac3d6ffb5 100644
--- a/arch/arm/mach-pxa/include/mach/palm27x.h
+++ b/arch/arm/mach-pxa/include/mach/palm27x.h
@@ -37,8 +37,8 @@ extern void __init palm27x_lcd_init(int power,
 #define palm27x_lcd_init(power, mode)   do {} while (0)
 #endif
 
-#if     defined(CONFIG_USB_GADGET_PXA27X) || \
-        defined(CONFIG_USB_GADGET_PXA27X_MODULE)
+#if     defined(CONFIG_USB_PXA27X) || \
+        defined(CONFIG_USB_PXA27X_MODULE)
 extern void __init palm27x_udc_init(int vbus, int pullup,
                                         int vbus_inverted);
 #else
diff --git a/arch/arm/mach-pxa/palm27x.c b/arch/arm/mach-pxa/palm27x.c
index 325c245c0a0d..fbc10d7b95d1 100644
--- a/arch/arm/mach-pxa/palm27x.c
+++ b/arch/arm/mach-pxa/palm27x.c
@@ -164,8 +164,8 @@ void __init palm27x_lcd_init(int power, struct pxafb_mode_info *mode)
 /******************************************************************************
  * USB Gadget
  ******************************************************************************/
-#if     defined(CONFIG_USB_GADGET_PXA27X) || \
-        defined(CONFIG_USB_GADGET_PXA27X_MODULE)
+#if     defined(CONFIG_USB_PXA27X) || \
+        defined(CONFIG_USB_PXA27X_MODULE)
 static struct gpio_vbus_mach_info palm27x_udc_info = {
         .gpio_vbus_inverted     = 1,
 };
diff --git a/arch/arm/mach-pxa/palmtc.c b/arch/arm/mach-pxa/palmtc.c
index 6ec7caefb37c..2c24c67fd92b 100644
--- a/arch/arm/mach-pxa/palmtc.c
+++ b/arch/arm/mach-pxa/palmtc.c
@@ -338,7 +338,7 @@ static inline void palmtc_mkp_init(void) {}
 /******************************************************************************
  * UDC
  ******************************************************************************/
-#if defined(CONFIG_USB_GADGET_PXA25X)||defined(CONFIG_USB_GADGET_PXA25X_MODULE)
+#if defined(CONFIG_USB_PXA25X)||defined(CONFIG_USB_PXA25X_MODULE)
 static struct gpio_vbus_mach_info palmtc_udc_info = {
         .gpio_vbus              = GPIO_NR_PALMTC_USB_DETECT_N,
         .gpio_vbus_inverted     = 1,
diff --git a/arch/arm/mach-pxa/vpac270.c b/arch/arm/mach-pxa/vpac270.c
index a7539a6ed1ff..ca0c6615028c 100644
--- a/arch/arm/mach-pxa/vpac270.c
+++ b/arch/arm/mach-pxa/vpac270.c
@@ -343,7 +343,7 @@ static inline void vpac270_uhc_init(void) {}
 /******************************************************************************
  * USB Gadget
  ******************************************************************************/
-#if defined(CONFIG_USB_GADGET_PXA27X)||defined(CONFIG_USB_GADGET_PXA27X_MODULE)
+#if defined(CONFIG_USB_PXA27X)||defined(CONFIG_USB_PXA27X_MODULE)
 static struct gpio_vbus_mach_info vpac270_gpio_vbus_info = {
         .gpio_vbus              = GPIO41_VPAC270_UDC_DETECT,
         .gpio_pullup            = -1,
diff --git a/arch/arm/mach-s3c64xx/mach-crag6410-module.c b/arch/arm/mach-s3c64xx/mach-crag6410-module.c
index 66668565ee75..f208154b1382 100644
--- a/arch/arm/mach-s3c64xx/mach-crag6410-module.c
+++ b/arch/arm/mach-s3c64xx/mach-crag6410-module.c
@@ -8,7 +8,7 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/module.h>
+#include <linux/export.h>
 #include <linux/interrupt.h>
 #include <linux/i2c.h>
 
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index 8ac9e9f84790..b1e192ba8c24 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -61,7 +61,7 @@ static inline void cache_sync(void)
 {
         void __iomem *base = l2x0_base;
 
-#ifdef CONFIG_ARM_ERRATA_753970
+#ifdef CONFIG_PL310_ERRATA_753970
         /* write to an unmmapped register */
         writel_relaxed(0, base + L2X0_DUMMY_REG);
 #else
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index e4e7f6cba1ab..1aa664a1999f 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -168,7 +168,7 @@ static int __init consistent_init(void)
         pte_t *pte;
         int i = 0;
         unsigned long base = consistent_base;
-        unsigned long num_ptes = (CONSISTENT_END - base) >> PGDIR_SHIFT;
+        unsigned long num_ptes = (CONSISTENT_END - base) >> PMD_SHIFT;
 
         consistent_pte = kmalloc(num_ptes * sizeof(pte_t), GFP_KERNEL);
         if (!consistent_pte) {
@@ -332,6 +332,15 @@ __dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, gfp_t gfp,
         struct page *page;
         void *addr;
 
+        /*
+         * Following is a work-around (a.k.a. hack) to prevent pages
+         * with __GFP_COMP being passed to split_page() which cannot
+         * handle them.  The real problem is that this flag probably
+         * should be 0 on ARM as it is not supported on this
+         * platform; see CONFIG_HUGETLBFS.
+         */
+        gfp &= ~(__GFP_COMP);
+
         *handle = ~0;
         size = PAGE_ALIGN(size);
 
diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 74be05f3e03a..44b628e4d6ea 100644
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -9,8 +9,7 @@
 #include <linux/io.h>
 #include <linux/personality.h>
 #include <linux/random.h>
-#include <asm/cputype.h>
-#include <asm/system.h>
+#include <asm/cachetype.h>
 
 #define COLOUR_ALIGN(addr,pgoff)                \
         ((((addr)+SHMLBA-1)&~(SHMLBA-1)) +      \
@@ -32,25 +31,15 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma;
         unsigned long start_addr;
-#if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_V6K)
-        unsigned int cache_type;
-        int do_align = 0, aliasing = 0;
+        int do_align = 0;
+        int aliasing = cache_is_vipt_aliasing();
 
         /*
          * We only need to do colour alignment if either the I or D
-         * caches alias.  This is indicated by bits 9 and 21 of the
-         * cache type register.
+         * caches alias.
          */
-        cache_type = read_cpuid_cachetype();
-        if (cache_type != read_cpuid_id()) {
-                aliasing = (cache_type | cache_type >> 12) & (1 << 11);
-                if (aliasing)
-                        do_align = filp || flags & MAP_SHARED;
-        }
-#else
-#define do_align 0
-#define aliasing 0
-#endif
+        if (aliasing)
+                do_align = filp || (flags & MAP_SHARED);
 
         /*
          * We enforce the MAP_FIXED case.
diff --git a/arch/arm/plat-mxc/include/mach/common.h b/arch/arm/plat-mxc/include/mach/common.h
index 83b745a5e1b7..c75f254abd85 100644
--- a/arch/arm/plat-mxc/include/mach/common.h
+++ b/arch/arm/plat-mxc/include/mach/common.h
@@ -85,7 +85,6 @@ enum mxc_cpu_pwr_mode {
 };
 
 extern void mx5_cpu_lp_set(enum mxc_cpu_pwr_mode mode);
-extern void (*imx_idle)(void);
 extern void imx_print_silicon_rev(const char *cpu, int srev);
 
 void avic_handle_irq(struct pt_regs *);
@@ -133,4 +132,5 @@ extern void imx53_qsb_common_init(void);
 extern void imx53_smd_common_init(void);
 extern int imx6q_set_lpm(enum mxc_cpu_pwr_mode mode);
 extern void imx6q_pm_init(void);
+extern void imx6q_clock_map_io(void);
 #endif
diff --git a/arch/arm/plat-mxc/include/mach/mxc.h b/arch/arm/plat-mxc/include/mach/mxc.h
index 00a78193c681..a4d36d601d55 100644
--- a/arch/arm/plat-mxc/include/mach/mxc.h
+++ b/arch/arm/plat-mxc/include/mach/mxc.h
@@ -50,20 +50,6 @@
 #define IMX_CHIP_REVISION_3_3           0x33
 #define IMX_CHIP_REVISION_UNKNOWN       0xff
 
-#define IMX_CHIP_REVISION_1_0_STRING            "1.0"
-#define IMX_CHIP_REVISION_1_1_STRING            "1.1"
-#define IMX_CHIP_REVISION_1_2_STRING            "1.2"
-#define IMX_CHIP_REVISION_1_3_STRING            "1.3"
-#define IMX_CHIP_REVISION_2_0_STRING            "2.0"
-#define IMX_CHIP_REVISION_2_1_STRING            "2.1"
-#define IMX_CHIP_REVISION_2_2_STRING            "2.2"
-#define IMX_CHIP_REVISION_2_3_STRING            "2.3"
-#define IMX_CHIP_REVISION_3_0_STRING            "3.0"
-#define IMX_CHIP_REVISION_3_1_STRING            "3.1"
-#define IMX_CHIP_REVISION_3_2_STRING            "3.2"
-#define IMX_CHIP_REVISION_3_3_STRING            "3.3"
-#define IMX_CHIP_REVISION_UNKNOWN_STRING        "unknown"
-
 #ifndef __ASSEMBLY__
 extern unsigned int __mxc_cpu_type;
 #endif
diff --git a/arch/arm/plat-mxc/include/mach/system.h b/arch/arm/plat-mxc/include/mach/system.h
index cf88b3593fba..b9895d250167 100644
--- a/arch/arm/plat-mxc/include/mach/system.h
+++ b/arch/arm/plat-mxc/include/mach/system.h
@@ -17,14 +17,9 @@
 #ifndef __ASM_ARCH_MXC_SYSTEM_H__
 #define __ASM_ARCH_MXC_SYSTEM_H__
 
-extern void (*imx_idle)(void);
-
 static inline void arch_idle(void)
 {
-        if (imx_idle != NULL)
-                (imx_idle)();
-        else
-                cpu_do_idle();
+        cpu_do_idle();
 }
 
 void arch_reset(char mode, const char *cmd);
diff --git a/arch/arm/plat-mxc/system.c b/arch/arm/plat-mxc/system.c
index 9dad8dcc2ea9..d65fb31a55ca 100644
--- a/arch/arm/plat-mxc/system.c
+++ b/arch/arm/plat-mxc/system.c
@@ -21,6 +21,7 @@
 #include <linux/io.h>
 #include <linux/err.h>
 #include <linux/delay.h>
+#include <linux/module.h>
 
 #include <mach/hardware.h>
 #include <mach/common.h>
@@ -28,8 +29,8 @@
 #include <asm/system.h>
 #include <asm/mach-types.h>
 
-void (*imx_idle)(void) = NULL;
 void __iomem *(*imx_ioremap)(unsigned long, size_t, unsigned int) = NULL;
+EXPORT_SYMBOL_GPL(imx_ioremap);
 
 static void __iomem *wdog_base;
 
diff --git a/arch/arm/plat-omap/include/plat/clock.h b/arch/arm/plat-omap/include/plat/clock.h
index 197ca03c3f7d..eb73ab40e955 100644
--- a/arch/arm/plat-omap/include/plat/clock.h
+++ b/arch/arm/plat-omap/include/plat/clock.h
@@ -165,8 +165,8 @@ struct dpll_data {
         u8                      auto_recal_bit;
         u8                      recal_en_bit;
         u8                      recal_st_bit;
-        u8                      flags;
 #  endif
+        u8                      flags;
 };
 
 #endif
diff --git a/arch/arm/plat-omap/include/plat/common.h b/arch/arm/plat-omap/include/plat/common.h
index c50df4814f6f..3ff3e36580f2 100644
--- a/arch/arm/plat-omap/include/plat/common.h
+++ b/arch/arm/plat-omap/include/plat/common.h
@@ -30,6 +30,7 @@
 #include <linux/delay.h>
 
 #include <plat/i2c.h>
+#include <plat/omap_hwmod.h>
 
 struct sys_timer;
 
@@ -55,6 +56,8 @@ void am35xx_init_early(void);
 void ti816x_init_early(void);
 void omap4430_init_early(void);
 
+extern int omap_dss_reset(struct omap_hwmod *);
+
 void omap_sram_init(void);
 
 /*
diff --git a/arch/arm/plat-s3c24xx/cpu-freq-debugfs.c b/arch/arm/plat-s3c24xx/cpu-freq-debugfs.c
index a9276667c2fb..c7adad0e8de0 100644
--- a/arch/arm/plat-s3c24xx/cpu-freq-debugfs.c
+++ b/arch/arm/plat-s3c24xx/cpu-freq-debugfs.c
@@ -12,7 +12,7 @@
 */
 
 #include <linux/init.h>
-#include <linux/module.h>
+#include <linux/export.h>
 #include <linux/interrupt.h>
 #include <linux/ioport.h>
 #include <linux/cpufreq.h>
diff --git a/arch/arm/plat-s5p/sysmmu.c b/arch/arm/plat-s5p/sysmmu.c
index e1cbc728c775..c8bec9c7655d 100644
--- a/arch/arm/plat-s5p/sysmmu.c
+++ b/arch/arm/plat-s5p/sysmmu.c
@@ -11,6 +11,7 @@
 #include <linux/io.h>
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
+#include <linux/export.h>
 
 #include <asm/pgtable.h>
 
diff --git a/arch/arm/plat-samsung/include/plat/gpio-cfg.h b/arch/arm/plat-samsung/include/plat/gpio-cfg.h
index d48245bb02b3..df8155b9d4d1 100644
--- a/arch/arm/plat-samsung/include/plat/gpio-cfg.h
+++ b/arch/arm/plat-samsung/include/plat/gpio-cfg.h
@@ -24,6 +24,8 @@
 #ifndef __PLAT_GPIO_CFG_H
 #define __PLAT_GPIO_CFG_H __FILE__
 
+#include<linux/types.h>
+
 typedef unsigned int __bitwise__ samsung_gpio_pull_t;
 typedef unsigned int __bitwise__ s5p_gpio_drvstr_t;
 
diff --git a/arch/arm/plat-samsung/pd.c b/arch/arm/plat-samsung/pd.c
index efe1d564473e..312b510d86b7 100644
--- a/arch/arm/plat-samsung/pd.c
+++ b/arch/arm/plat-samsung/pd.c
@@ -11,7 +11,7 @@
 */
 
 #include <linux/init.h>
-#include <linux/module.h>
+#include <linux/export.h>
 #include <linux/platform_device.h>
 #include <linux/err.h>
 #include <linux/pm_runtime.h>
diff --git a/arch/arm/plat-samsung/pwm.c b/arch/arm/plat-samsung/pwm.c
index dc1185dcf80d..c559d8438c70 100644
--- a/arch/arm/plat-samsung/pwm.c
+++ b/arch/arm/plat-samsung/pwm.c
@@ -11,7 +11,7 @@
  * the Free Software Foundation; either version 2 of the License.
 */
 
-#include <linux/module.h>
+#include <linux/export.h>
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 5bdeef969847..ccbe16f47227 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -1123,5 +1123,6 @@ blissc			MACH_BLISSC		BLISSC			3491
 thales_adc              MACH_THALES_ADC         THALES_ADC              3492
 ubisys_p9d_evp          MACH_UBISYS_P9D_EVP     UBISYS_P9D_EVP          3493
 atdgp318                MACH_ATDGP318           ATDGP318                3494
+m28evk                  MACH_M28EVK             M28EVK                  3613
 smdk4212                MACH_SMDK4212           SMDK4212                3638
 smdk4412                MACH_SMDK4412           SMDK4412                3765
diff --git a/arch/powerpc/boot/dts/p1023rds.dts b/arch/powerpc/boot/dts/p1023rds.dts
index d9b776740a67..d3b478242ea9 100644
--- a/arch/powerpc/boot/dts/p1023rds.dts
+++ b/arch/powerpc/boot/dts/p1023rds.dts
@@ -449,6 +449,7 @@
                         interrupt-parent = <&mpic>;
                         interrupts = <16 2>;
                         interrupt-map-mask = <0xf800 0 0 7>;
+                        /* IRQ[0:3] are pulled up on board, set to active-low */
                         interrupt-map = <
                                 /* IDSEL 0x0 */
                                 0000 0 0 1 &mpic 0 1
@@ -488,11 +489,15 @@
                         interrupt-parent = <&mpic>;
                         interrupts = <16 2>;
                         interrupt-map-mask = <0xf800 0 0 7>;
+                        /*
+                         * IRQ[4:6] only for PCIe, set to active-high,
+                         * IRQ[7] is pulled up on board, set to active-low
+                         */
                         interrupt-map = <
                                 /* IDSEL 0x0 */
-                                0000 0 0 1 &mpic 4 1
-                                0000 0 0 2 &mpic 5 1
-                                0000 0 0 3 &mpic 6 1
+                                0000 0 0 1 &mpic 4 2
+                                0000 0 0 2 &mpic 5 2
+                                0000 0 0 3 &mpic 6 2
                                 0000 0 0 4 &mpic 7 1
                                 >;
                         ranges = <0x2000000 0x0 0xa0000000
@@ -527,12 +532,16 @@
                         interrupt-parent = <&mpic>;
                         interrupts = <16 2>;
                         interrupt-map-mask = <0xf800 0 0 7>;
+                        /*
+                         * IRQ[8:10] are pulled up on board, set to active-low
+                         * IRQ[11] only for PCIe, set to active-high,
+                         */
                         interrupt-map = <
                                 /* IDSEL 0x0 */
                                 0000 0 0 1 &mpic 8 1
                                 0000 0 0 2 &mpic 9 1
                                 0000 0 0 3 &mpic 10 1
-                                0000 0 0 4 &mpic 11 1
+                                0000 0 0 4 &mpic 11 2
                                 >;
                         ranges = <0x2000000 0x0 0x80000000
                                   0x2000000 0x0 0x80000000
diff --git a/arch/powerpc/configs/ppc44x_defconfig b/arch/powerpc/configs/ppc44x_defconfig
index 6cdf1c0d2c8a..3b98d7354341 100644
--- a/arch/powerpc/configs/ppc44x_defconfig
+++ b/arch/powerpc/configs/ppc44x_defconfig
@@ -52,6 +52,8 @@ CONFIG_MTD_CFI=y
 CONFIG_MTD_JEDECPROBE=y
 CONFIG_MTD_CFI_AMDSTD=y
 CONFIG_MTD_PHYSMAP_OF=y
+CONFIG_MTD_NAND=m
+CONFIG_MTD_NAND_NDFC=m
 CONFIG_MTD_UBI=m
 CONFIG_MTD_UBI_GLUEBI=m
 CONFIG_PROC_DEVICETREE=y
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 5964371303ac..8558b572e55d 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -15,6 +15,7 @@
 #include <linux/of_fdt.h>
 #include <linux/memblock.h>
 #include <linux/bootmem.h>
+#include <linux/moduleparam.h>
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
 #include <asm/tlb.h>
diff --git a/arch/powerpc/platforms/85xx/Kconfig b/arch/powerpc/platforms/85xx/Kconfig
index 45023e26aea3..d7946be298b6 100644
--- a/arch/powerpc/platforms/85xx/Kconfig
+++ b/arch/powerpc/platforms/85xx/Kconfig
@@ -203,7 +203,7 @@ config P3060_QDS
         select PPC_E500MC
         select PHYS_64BIT
         select SWIOTLB
-        select MPC8xxx_GPIO
+        select GPIO_MPC8XXX
         select HAS_RAPIDIO
         select PPC_EPAPR_HV_PIC
         help
diff --git a/arch/powerpc/platforms/85xx/p3060_qds.c b/arch/powerpc/platforms/85xx/p3060_qds.c
index 01dcf44871e9..081cf4ac1881 100644
--- a/arch/powerpc/platforms/85xx/p3060_qds.c
+++ b/arch/powerpc/platforms/85xx/p3060_qds.c
@@ -70,7 +70,7 @@ define_machine(p3060_qds) {
         .power_save             = e500_idle,
 };
 
-machine_device_initcall(p3060_qds, declare_of_platform_devices);
+machine_device_initcall(p3060_qds, corenet_ds_publish_devices);
 
 #ifdef CONFIG_SWIOTLB
 machine_arch_initcall(p3060_qds, swiotlb_setup_bus_notifier);
diff --git a/arch/powerpc/sysdev/ehv_pic.c b/arch/powerpc/sysdev/ehv_pic.c
index af1a5df46b3e..b6731e4a6646 100644
--- a/arch/powerpc/sysdev/ehv_pic.c
+++ b/arch/powerpc/sysdev/ehv_pic.c
@@ -280,6 +280,7 @@ void __init ehv_pic_init(void)
 
         if (!ehv_pic->irqhost) {
                 of_node_put(np);
+                kfree(ehv_pic);
                 return;
         }
 
diff --git a/arch/powerpc/sysdev/fsl_lbc.c b/arch/powerpc/sysdev/fsl_lbc.c
index c4d96fa32ba5..d5c3c90ee698 100644
--- a/arch/powerpc/sysdev/fsl_lbc.c
+++ b/arch/powerpc/sysdev/fsl_lbc.c
@@ -328,6 +328,7 @@ static int __devinit fsl_lbc_ctrl_probe(struct platform_device *dev)
 err:
         iounmap(fsl_lbc_ctrl_dev->regs);
         kfree(fsl_lbc_ctrl_dev);
+        fsl_lbc_ctrl_dev = NULL;
         return ret;
 }
 
diff --git a/arch/powerpc/sysdev/qe_lib/qe.c b/arch/powerpc/sysdev/qe_lib/qe.c
index 3363fbc964f8..ceb09cbd2329 100644
--- a/arch/powerpc/sysdev/qe_lib/qe.c
+++ b/arch/powerpc/sysdev/qe_lib/qe.c
@@ -216,7 +216,7 @@ int qe_setbrg(enum qe_clock brg, unsigned int rate, unsigned int multiplier)
         /* Errata QE_General4, which affects some MPC832x and MPC836x SOCs, says
            that the BRG divisor must be even if you're not using divide-by-16
            mode. */
-        if (!div16 && (divisor & 1))
+        if (!div16 && (divisor & 1) && (divisor > 3))
                 divisor++;
 
         tempval = ((divisor - 1) << QE_BRGC_DIVISOR_SHIFT) |
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 127408069ca7..631b9477b99c 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -932,7 +932,8 @@ static int erst_check_table(struct acpi_table_erst *erst_tab)
 static int erst_open_pstore(struct pstore_info *psi);
 static int erst_close_pstore(struct pstore_info *psi);
 static ssize_t erst_reader(u64 *id, enum pstore_type_id *type,
-                           struct timespec *time, struct pstore_info *psi);
+                           struct timespec *time, char **buf,
+                           struct pstore_info *psi);
 static int erst_writer(enum pstore_type_id type, u64 *id, unsigned int part,
                        size_t size, struct pstore_info *psi);
 static int erst_clearer(enum pstore_type_id type, u64 id,
@@ -986,17 +987,23 @@ static int erst_close_pstore(struct pstore_info *psi)
 }
 
 static ssize_t erst_reader(u64 *id, enum pstore_type_id *type,
-                           struct timespec *time, struct pstore_info *psi)
+                           struct timespec *time, char **buf,
+                           struct pstore_info *psi)
 {
         int rc;
         ssize_t len = 0;
         u64 record_id;
-        struct cper_pstore_record *rcd = (struct cper_pstore_record *)
-                                        (erst_info.buf - sizeof(*rcd));
+        struct cper_pstore_record *rcd;
+        size_t rcd_len = sizeof(*rcd) + erst_info.bufsize;
 
         if (erst_disable)
                 return -ENODEV;
 
+        rcd = kmalloc(rcd_len, GFP_KERNEL);
+        if (!rcd) {
+                rc = -ENOMEM;
+                goto out;
+        }
 skip:
         rc = erst_get_record_id_next(&reader_pos, &record_id);
         if (rc)
@@ -1004,22 +1011,27 @@ skip:
 
         /* no more record */
         if (record_id == APEI_ERST_INVALID_RECORD_ID) {
-                rc = -1;
+                rc = -EINVAL;
                 goto out;
         }
 
-        len = erst_read(record_id, &rcd->hdr, sizeof(*rcd) +
-                        erst_info.bufsize);
+        len = erst_read(record_id, &rcd->hdr, rcd_len);
         /* The record may be cleared by others, try read next record */
         if (len == -ENOENT)
                 goto skip;
-        else if (len < 0) {
-                rc = -1;
+        else if (len < sizeof(*rcd)) {
+                rc = -EIO;
                 goto out;
         }
         if (uuid_le_cmp(rcd->hdr.creator_id, CPER_CREATOR_PSTORE) != 0)
                 goto skip;
 
+        *buf = kmalloc(len, GFP_KERNEL);
+        if (*buf == NULL) {
+                rc = -ENOMEM;
+                goto out;
+        }
+        memcpy(*buf, rcd->data, len - sizeof(*rcd));
         *id = record_id;
         if (uuid_le_cmp(rcd->sec_hdr.section_type,
                         CPER_SECTION_TYPE_DMESG) == 0)
@@ -1037,6 +1049,7 @@ skip:
         time->tv_nsec = 0;
 
 out:
+        kfree(rcd);
         return (rc < 0) ? rc : (len - sizeof(*rcd));
 }
 
diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c
index 5c6f56f21443..dcd8babae9eb 100644
--- a/drivers/crypto/mv_cesa.c
+++ b/drivers/crypto/mv_cesa.c
@@ -343,11 +343,13 @@ static void mv_process_hash_current(int first_block)
                 else
                         op.config |= CFG_MID_FRAG;
 
-                writel(req_ctx->state[0], cpg->reg + DIGEST_INITIAL_VAL_A);
-                writel(req_ctx->state[1], cpg->reg + DIGEST_INITIAL_VAL_B);
-                writel(req_ctx->state[2], cpg->reg + DIGEST_INITIAL_VAL_C);
-                writel(req_ctx->state[3], cpg->reg + DIGEST_INITIAL_VAL_D);
-                writel(req_ctx->state[4], cpg->reg + DIGEST_INITIAL_VAL_E);
+                if (first_block) {
+                        writel(req_ctx->state[0], cpg->reg + DIGEST_INITIAL_VAL_A);
+                        writel(req_ctx->state[1], cpg->reg + DIGEST_INITIAL_VAL_B);
+                        writel(req_ctx->state[2], cpg->reg + DIGEST_INITIAL_VAL_C);
+                        writel(req_ctx->state[3], cpg->reg + DIGEST_INITIAL_VAL_D);
+                        writel(req_ctx->state[4], cpg->reg + DIGEST_INITIAL_VAL_E);
+                }
         }
 
         memcpy(cpg->sram + SRAM_CONFIG, &op, sizeof(struct sec_accel_config));
diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c
index 8af8e864a9cf..73464a62adf7 100644
--- a/drivers/edac/mpc85xx_edac.c
+++ b/drivers/edac/mpc85xx_edac.c
@@ -1128,7 +1128,7 @@ static struct of_device_id mpc85xx_mc_err_of_match[] = {
         { .compatible = "fsl,p1020-memory-controller", },
         { .compatible = "fsl,p1021-memory-controller", },
         { .compatible = "fsl,p2020-memory-controller", },
-        { .compatible = "fsl,p4080-memory-controller", },
+        { .compatible = "fsl,qoriq-memory-controller", },
         {},
 };
 MODULE_DEVICE_TABLE(of, mpc85xx_mc_err_of_match);
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index 8370f72d87ff..b0a81173a268 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -457,7 +457,8 @@ static int efi_pstore_close(struct pstore_info *psi)
 }
 
 static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
-                               struct timespec *timespec, struct pstore_info *psi)
+                               struct timespec *timespec,
+                               char **buf, struct pstore_info *psi)
 {
         efi_guid_t vendor = LINUX_EFI_CRASH_GUID;
         struct efivars *efivars = psi->data;
@@ -478,7 +479,11 @@ static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
                                 timespec->tv_nsec = 0;
                                 get_var_data_locked(efivars, &efivars->walk_entry->var);
                                 size = efivars->walk_entry->var.DataSize;
-                                memcpy(psi->buf, efivars->walk_entry->var.Data, size);
+                                *buf = kmalloc(size, GFP_KERNEL);
+                                if (*buf == NULL)
+                                        return -ENOMEM;
+                                memcpy(*buf, efivars->walk_entry->var.Data,
+                                       size);
                                 efivars->walk_entry = list_entry(efivars->walk_entry->list.next,
                                                    struct efivar_entry, list);
                                 return size;
@@ -576,7 +581,8 @@ static int efi_pstore_close(struct pstore_info *psi)
 }
 
 static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type,
-                               struct timespec *time, struct pstore_info *psi)
+                               struct timespec *timespec,
+                               char **buf, struct pstore_info *psi)
 {
         return -1;
 }
diff --git a/drivers/firmware/sigma.c b/drivers/firmware/sigma.c
index f10fc521951b..1eedb6f7fdab 100644
--- a/drivers/firmware/sigma.c
+++ b/drivers/firmware/sigma.c
@@ -14,13 +14,34 @@
 #include <linux/module.h>
 #include <linux/sigma.h>
 
-/* Return: 0==OK, <0==error, =1 ==no more actions */
+static size_t sigma_action_size(struct sigma_action *sa)
+{
+        size_t payload = 0;
+
+        switch (sa->instr) {
+        case SIGMA_ACTION_WRITEXBYTES:
+        case SIGMA_ACTION_WRITESINGLE:
+        case SIGMA_ACTION_WRITESAFELOAD:
+                payload = sigma_action_len(sa);
+                break;
+        default:
+                break;
+        }
+
+        payload = ALIGN(payload, 2);
+
+        return payload + sizeof(struct sigma_action);
+}
+
+/*
+ * Returns a negative error value in case of an error, 0 if processing of
+ * the firmware should be stopped after this action, 1 otherwise.
+ */
 static int
-process_sigma_action(struct i2c_client *client, struct sigma_firmware *ssfw)
+process_sigma_action(struct i2c_client *client, struct sigma_action *sa)
 {
-        struct sigma_action *sa = (void *)(ssfw->fw->data + ssfw->pos);
         size_t len = sigma_action_len(sa);
-        int ret = 0;
+        int ret;
 
         pr_debug("%s: instr:%i addr:%#x len:%zu\n", __func__,
                 sa->instr, sa->addr, len);
@@ -29,44 +50,50 @@ process_sigma_action(struct i2c_client *client, struct sigma_firmware *ssfw)
         case SIGMA_ACTION_WRITEXBYTES:
         case SIGMA_ACTION_WRITESINGLE:
         case SIGMA_ACTION_WRITESAFELOAD:
-                if (ssfw->fw->size < ssfw->pos + len)
-                        return -EINVAL;
                 ret = i2c_master_send(client, (void *)&sa->addr, len);
                 if (ret < 0)
                         return -EINVAL;
                 break;
-
         case SIGMA_ACTION_DELAY:
-                ret = 0;
                 udelay(len);
                 len = 0;
                 break;
-
         case SIGMA_ACTION_END:
-                return 1;
-
+                return 0;
         default:
                 return -EINVAL;
         }
 
-        /* when arrive here ret=0 or sent data */
-        ssfw->pos += sigma_action_size(sa, len);
-        return ssfw->pos == ssfw->fw->size;
+        return 1;
 }
 
 static int
 process_sigma_actions(struct i2c_client *client, struct sigma_firmware *ssfw)
 {
-        pr_debug("%s: processing %p\n", __func__, ssfw);
+        struct sigma_action *sa;
+        size_t size;
+        int ret;
+
+        while (ssfw->pos + sizeof(*sa) <= ssfw->fw->size) {
+                sa = (struct sigma_action *)(ssfw->fw->data + ssfw->pos);
+
+                size = sigma_action_size(sa);
+                ssfw->pos += size;
+                if (ssfw->pos > ssfw->fw->size || size == 0)
+                        break;
+
+                ret = process_sigma_action(client, sa);
 
-        while (1) {
-                int ret = process_sigma_action(client, ssfw);
                 pr_debug("%s: action returned %i\n", __func__, ret);
-                if (ret == 1)
-                        return 0;
-                else if (ret)
+
+                if (ret <= 0)
                         return ret;
         }
+
+        if (ssfw->pos != ssfw->fw->size)
+                return -EINVAL;
+
+        return 0;
 }
 
 int process_sigma_firmware(struct i2c_client *client, const char *name)
@@ -89,16 +116,24 @@ int process_sigma_firmware(struct i2c_client *client, const char *name)
 
         /* then verify the header */
         ret = -EINVAL;
-        if (fw->size < sizeof(*ssfw_head))
+
+        /*
+         * Reject too small or unreasonable large files. The upper limit has been
+         * chosen a bit arbitrarily, but it should be enough for all practical
+         * purposes and having the limit makes it easier to avoid integer
+         * overflows later in the loading process.
+         */
+        if (fw->size < sizeof(*ssfw_head) || fw->size >= 0x4000000)
                 goto done;
 
         ssfw_head = (void *)fw->data;
         if (memcmp(ssfw_head->magic, SIGMA_MAGIC, ARRAY_SIZE(ssfw_head->magic)))
                 goto done;
 
-        crc = crc32(0, fw->data, fw->size);
+        crc = crc32(0, fw->data + sizeof(*ssfw_head),
+                        fw->size - sizeof(*ssfw_head));
         pr_debug("%s: crc=%x\n", __func__, crc);
-        if (crc != ssfw_head->crc)
+        if (crc != le32_to_cpu(ssfw_head->crc))
                 goto done;
 
         ssfw.pos = sizeof(*ssfw_head);
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index 147df8ae79db..d3f3e8f54561 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -546,7 +546,7 @@ static void pca953x_irq_teardown(struct pca953x_chip *chip)
  * Translate OpenFirmware node properties into platform_data
  * WARNING: This is DEPRECATED and will be removed eventually!
  */
-void
+static void
 pca953x_get_alt_pdata(struct i2c_client *client, int *gpio_base, int *invert)
 {
         struct device_node *node;
@@ -574,7 +574,7 @@ pca953x_get_alt_pdata(struct i2c_client *client, int *gpio_base, int *invert)
                 *invert = *val;
 }
 #else
-void
+static void
 pca953x_get_alt_pdata(struct i2c_client *client, int *gpio_base, int *invert)
 {
         *gpio_base = -1;
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 3969f7553fe7..d2619d72cece 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -456,6 +456,30 @@ done:
 EXPORT_SYMBOL(drm_crtc_helper_set_mode);
 
 
+static int
+drm_crtc_helper_disable(struct drm_crtc *crtc)
+{
+        struct drm_device *dev = crtc->dev;
+        struct drm_connector *connector;
+        struct drm_encoder *encoder;
+
+        /* Decouple all encoders and their attached connectors from this crtc */
+        list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+                if (encoder->crtc != crtc)
+                        continue;
+
+                list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+                        if (connector->encoder != encoder)
+                                continue;
+
+                        connector->encoder = NULL;
+                }
+        }
+
+        drm_helper_disable_unused_functions(dev);
+        return 0;
+}
+
 /**
  * drm_crtc_helper_set_config - set a new config from userspace
  * @crtc: CRTC to setup
@@ -510,8 +534,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                                 (int)set->num_connectors, set->x, set->y);
         } else {
                 DRM_DEBUG_KMS("[CRTC:%d] [NOFB]\n", set->crtc->base.id);
-                set->mode = NULL;
-                set->num_connectors = 0;
+                return drm_crtc_helper_disable(set->crtc);
         }
 
         dev = set->crtc->dev;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_buf.c b/drivers/gpu/drm/exynos/exynos_drm_buf.c
index 6f8afea94fc9..2bb07bca511a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_buf.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_buf.c
@@ -27,82 +27,84 @@
 #include "drm.h"
 
 #include "exynos_drm_drv.h"
+#include "exynos_drm_gem.h"
 #include "exynos_drm_buf.h"
 
-static DEFINE_MUTEX(exynos_drm_buf_lock);
-
 static int lowlevel_buffer_allocate(struct drm_device *dev,
-                struct exynos_drm_buf_entry *entry)
+                struct exynos_drm_gem_buf *buffer)
 {
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        entry->vaddr = dma_alloc_writecombine(dev->dev, entry->size,
-                        (dma_addr_t *)&entry->paddr, GFP_KERNEL);
-        if (!entry->paddr) {
+        buffer->kvaddr = dma_alloc_writecombine(dev->dev, buffer->size,
+                        &buffer->dma_addr, GFP_KERNEL);
+        if (!buffer->kvaddr) {
                 DRM_ERROR("failed to allocate buffer.\n");
                 return -ENOMEM;
         }
 
-        DRM_DEBUG_KMS("allocated : vaddr(0x%x), paddr(0x%x), size(0x%x)\n",
-                        (unsigned int)entry->vaddr, entry->paddr, entry->size);
+        DRM_DEBUG_KMS("vaddr(0x%lx), dma_addr(0x%lx), size(0x%lx)\n",
+                        (unsigned long)buffer->kvaddr,
+                        (unsigned long)buffer->dma_addr,
+                        buffer->size);
 
         return 0;
 }
 
 static void lowlevel_buffer_deallocate(struct drm_device *dev,
-                struct exynos_drm_buf_entry *entry)
+                struct exynos_drm_gem_buf *buffer)
 {
         DRM_DEBUG_KMS("%s.\n", __FILE__);
 
-        if (entry->paddr && entry->vaddr && entry->size)
-                dma_free_writecombine(dev->dev, entry->size, entry->vaddr,
-                                entry->paddr);
+        if (buffer->dma_addr && buffer->size)
+                dma_free_writecombine(dev->dev, buffer->size, buffer->kvaddr,
+                                (dma_addr_t)buffer->dma_addr);
         else
-                DRM_DEBUG_KMS("entry data is null.\n");
+                DRM_DEBUG_KMS("buffer data are invalid.\n");
 }
 
-struct exynos_drm_buf_entry *exynos_drm_buf_create(struct drm_device *dev,
+struct exynos_drm_gem_buf *exynos_drm_buf_create(struct drm_device *dev,
                 unsigned int size)
 {
-        struct exynos_drm_buf_entry *entry;
+        struct exynos_drm_gem_buf *buffer;
 
         DRM_DEBUG_KMS("%s.\n", __FILE__);
+        DRM_DEBUG_KMS("desired size = 0x%x\n", size);
 
-        entry = kzalloc(sizeof(*entry), GFP_KERNEL);
-        if (!entry) {
-                DRM_ERROR("failed to allocate exynos_drm_buf_entry.\n");
+        buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
+        if (!buffer) {
+                DRM_ERROR("failed to allocate exynos_drm_gem_buf.\n");
                 return ERR_PTR(-ENOMEM);
         }
 
-        entry->size = size;
+        buffer->size = size;
 
         /*
          * allocate memory region with size and set the memory information
-         * to vaddr and paddr of a entry object.
+         * to vaddr and dma_addr of a buffer object.
          */
-        if (lowlevel_buffer_allocate(dev, entry) < 0) {
-                kfree(entry);
-                entry = NULL;
+        if (lowlevel_buffer_allocate(dev, buffer) < 0) {
+                kfree(buffer);
+                buffer = NULL;
                 return ERR_PTR(-ENOMEM);
         }
 
-        return entry;
+        return buffer;
 }
 
 void exynos_drm_buf_destroy(struct drm_device *dev,
-                struct exynos_drm_buf_entry *entry)
+                struct exynos_drm_gem_buf *buffer)
 {
         DRM_DEBUG_KMS("%s.\n", __FILE__);
 
-        if (!entry) {
-                DRM_DEBUG_KMS("entry is null.\n");
+        if (!buffer) {
+                DRM_DEBUG_KMS("buffer is null.\n");
                 return;
         }
 
-        lowlevel_buffer_deallocate(dev, entry);
+        lowlevel_buffer_deallocate(dev, buffer);
 
-        kfree(entry);
-        entry = NULL;
+        kfree(buffer);
+        buffer = NULL;
 }
 
 MODULE_AUTHOR("Inki Dae <inki.dae@samsung.com>");
diff --git a/drivers/gpu/drm/exynos/exynos_drm_buf.h b/drivers/gpu/drm/exynos/exynos_drm_buf.h
index 045d59eab01a..6e91f9caa5db 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_buf.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_buf.h
@@ -26,28 +26,15 @@
 #ifndef _EXYNOS_DRM_BUF_H_
 #define _EXYNOS_DRM_BUF_H_
 
-/*
- * exynos drm buffer entry structure.
- *
- * @paddr: physical address of allocated memory.
- * @vaddr: kernel virtual address of allocated memory.
- * @size: size of allocated memory.
- */
-struct exynos_drm_buf_entry {
-        dma_addr_t paddr;
-        void __iomem *vaddr;
-        unsigned int size;
-};
-
 /* allocate physical memory. */
-struct exynos_drm_buf_entry *exynos_drm_buf_create(struct drm_device *dev,
+struct exynos_drm_gem_buf *exynos_drm_buf_create(struct drm_device *dev,
                 unsigned int size);
 
-/* get physical memory information of a drm framebuffer. */
-struct exynos_drm_buf_entry *exynos_drm_fb_get_buf(struct drm_framebuffer *fb);
+/* get memory information of a drm framebuffer. */
+struct exynos_drm_gem_buf *exynos_drm_fb_get_buf(struct drm_framebuffer *fb);
 
 /* remove allocated physical memory. */
 void exynos_drm_buf_destroy(struct drm_device *dev,
-                struct exynos_drm_buf_entry *entry);
+                struct exynos_drm_gem_buf *buffer);
 
 #endif
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.c b/drivers/gpu/drm/exynos/exynos_drm_connector.c
index 985d9e768728..d620b0784257 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_connector.c
@@ -37,6 +37,8 @@
 
 struct exynos_drm_connector {
         struct drm_connector    drm_connector;
+        uint32_t                encoder_id;
+        struct exynos_drm_manager *manager;
 };
 
 /* convert exynos_video_timings to drm_display_mode */
@@ -47,6 +49,7 @@ convert_to_display_mode(struct drm_display_mode *mode,
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         mode->clock = timing->pixclock / 1000;
+        mode->vrefresh = timing->refresh;
 
         mode->hdisplay = timing->xres;
         mode->hsync_start = mode->hdisplay + timing->left_margin;
@@ -57,6 +60,12 @@ convert_to_display_mode(struct drm_display_mode *mode,
         mode->vsync_start = mode->vdisplay + timing->upper_margin;
         mode->vsync_end = mode->vsync_start + timing->vsync_len;
         mode->vtotal = mode->vsync_end + timing->lower_margin;
+
+        if (timing->vmode & FB_VMODE_INTERLACED)
+                mode->flags |= DRM_MODE_FLAG_INTERLACE;
+
+        if (timing->vmode & FB_VMODE_DOUBLE)
+                mode->flags |= DRM_MODE_FLAG_DBLSCAN;
 }
 
 /* convert drm_display_mode to exynos_video_timings */
@@ -69,7 +78,7 @@ convert_to_video_timing(struct fb_videomode *timing,
         memset(timing, 0, sizeof(*timing));
 
         timing->pixclock = mode->clock * 1000;
-        timing->refresh = mode->vrefresh;
+        timing->refresh = drm_mode_vrefresh(mode);
 
         timing->xres = mode->hdisplay;
         timing->left_margin = mode->hsync_start - mode->hdisplay;
@@ -92,15 +101,16 @@ convert_to_video_timing(struct fb_videomode *timing,
 
 static int exynos_drm_connector_get_modes(struct drm_connector *connector)
 {
-        struct exynos_drm_manager *manager =
-                                exynos_drm_get_manager(connector->encoder);
-        struct exynos_drm_display *display = manager->display;
+        struct exynos_drm_connector *exynos_connector =
+                                        to_exynos_connector(connector);
+        struct exynos_drm_manager *manager = exynos_connector->manager;
+        struct exynos_drm_display_ops *display_ops = manager->display_ops;
         unsigned int count;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (!display) {
-                DRM_DEBUG_KMS("display is null.\n");
+        if (!display_ops) {
+                DRM_DEBUG_KMS("display_ops is null.\n");
                 return 0;
         }
 
@@ -112,7 +122,7 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
          * P.S. in case of lcd panel, count is always 1 if success
          * because lcd panel has only one mode.
          */
-        if (display->get_edid) {
+        if (display_ops->get_edid) {
                 int ret;
                 void *edid;
 
@@ -122,7 +132,7 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
                         return 0;
                 }
 
-                ret = display->get_edid(manager->dev, connector,
+                ret = display_ops->get_edid(manager->dev, connector,
                                                 edid, MAX_EDID);
                 if (ret < 0) {
                         DRM_ERROR("failed to get edid data.\n");
@@ -140,8 +150,8 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
                 struct drm_display_mode *mode = drm_mode_create(connector->dev);
                 struct fb_videomode *timing;
 
-                if (display->get_timing)
-                        timing = display->get_timing(manager->dev);
+                if (display_ops->get_timing)
+                        timing = display_ops->get_timing(manager->dev);
                 else {
                         drm_mode_destroy(connector->dev, mode);
                         return 0;
@@ -162,9 +172,10 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
 static int exynos_drm_connector_mode_valid(struct drm_connector *connector,
                                             struct drm_display_mode *mode)
 {
-        struct exynos_drm_manager *manager =
-                                exynos_drm_get_manager(connector->encoder);
-        struct exynos_drm_display *display = manager->display;
+        struct exynos_drm_connector *exynos_connector =
+                                        to_exynos_connector(connector);
+        struct exynos_drm_manager *manager = exynos_connector->manager;
+        struct exynos_drm_display_ops *display_ops = manager->display_ops;
         struct fb_videomode timing;
         int ret = MODE_BAD;
 
@@ -172,8 +183,8 @@ static int exynos_drm_connector_mode_valid(struct drm_connector *connector,
 
         convert_to_video_timing(&timing, mode);
 
-        if (display && display->check_timing)
-                if (!display->check_timing(manager->dev, (void *)&timing))
+        if (display_ops && display_ops->check_timing)
+                if (!display_ops->check_timing(manager->dev, (void *)&timing))
                         ret = MODE_OK;
 
         return ret;
@@ -181,9 +192,25 @@ static int exynos_drm_connector_mode_valid(struct drm_connector *connector,
 
 struct drm_encoder *exynos_drm_best_encoder(struct drm_connector *connector)
 {
+        struct drm_device *dev = connector->dev;
+        struct exynos_drm_connector *exynos_connector =
+                                        to_exynos_connector(connector);
+        struct drm_mode_object *obj;
+        struct drm_encoder *encoder;
+
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        return connector->encoder;
+        obj = drm_mode_object_find(dev, exynos_connector->encoder_id,
+                                   DRM_MODE_OBJECT_ENCODER);
+        if (!obj) {
+                DRM_DEBUG_KMS("Unknown ENCODER ID %d\n",
+                                exynos_connector->encoder_id);
+                return NULL;
+        }
+
+        encoder = obj_to_encoder(obj);
+
+        return encoder;
 }
 
 static struct drm_connector_helper_funcs exynos_connector_helper_funcs = {
@@ -196,15 +223,17 @@ static struct drm_connector_helper_funcs exynos_connector_helper_funcs = {
 static enum drm_connector_status
 exynos_drm_connector_detect(struct drm_connector *connector, bool force)
 {
-        struct exynos_drm_manager *manager =
-                                exynos_drm_get_manager(connector->encoder);
-        struct exynos_drm_display *display = manager->display;
+        struct exynos_drm_connector *exynos_connector =
+                                        to_exynos_connector(connector);
+        struct exynos_drm_manager *manager = exynos_connector->manager;
+        struct exynos_drm_display_ops *display_ops =
+                                        manager->display_ops;
         enum drm_connector_status status = connector_status_disconnected;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        if (display && display->is_connected) {
-                if (display->is_connected(manager->dev))
+        if (display_ops && display_ops->is_connected) {
+                if (display_ops->is_connected(manager->dev))
                         status = connector_status_connected;
                 else
                         status = connector_status_disconnected;
@@ -251,9 +280,11 @@ struct drm_connector *exynos_drm_connector_create(struct drm_device *dev,
 
         connector = &exynos_connector->drm_connector;
 
-        switch (manager->display->type) {
+        switch (manager->display_ops->type) {
         case EXYNOS_DISPLAY_TYPE_HDMI:
                 type = DRM_MODE_CONNECTOR_HDMIA;
+                connector->interlace_allowed = true;
+                connector->polled = DRM_CONNECTOR_POLL_HPD;
                 break;
         default:
                 type = DRM_MODE_CONNECTOR_Unknown;
@@ -267,7 +298,10 @@ struct drm_connector *exynos_drm_connector_create(struct drm_device *dev,
         if (err)
                 goto err_connector;
 
+        exynos_connector->encoder_id = encoder->base.id;
+        exynos_connector->manager = manager;
         connector->encoder = encoder;
+
         err = drm_mode_connector_attach_encoder(connector, encoder);
         if (err) {
                 DRM_ERROR("failed to attach a connector to a encoder\n");
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index 9337e5e2dbb6..ee43cc220853 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -29,36 +29,17 @@
 #include "drmP.h"
 #include "drm_crtc_helper.h"
 
+#include "exynos_drm_crtc.h"
 #include "exynos_drm_drv.h"
 #include "exynos_drm_fb.h"
 #include "exynos_drm_encoder.h"
+#include "exynos_drm_gem.h"
 #include "exynos_drm_buf.h"
 
 #define to_exynos_crtc(x)       container_of(x, struct exynos_drm_crtc,\
                                 drm_crtc)
 
 /*
- * Exynos specific crtc postion structure.
- *
- * @fb_x: offset x on a framebuffer to be displyed
- *      - the unit is screen coordinates.
- * @fb_y: offset y on a framebuffer to be displayed
- *      - the unit is screen coordinates.
- * @crtc_x: offset x on hardware screen.
- * @crtc_y: offset y on hardware screen.
- * @crtc_w: width of hardware screen.
- * @crtc_h: height of hardware screen.
- */
-struct exynos_drm_crtc_pos {
-        unsigned int fb_x;
-        unsigned int fb_y;
-        unsigned int crtc_x;
-        unsigned int crtc_y;
-        unsigned int crtc_w;
-        unsigned int crtc_h;
-};
-
-/*
  * Exynos specific crtc structure.
  *
  * @drm_crtc: crtc object.
@@ -85,30 +66,31 @@ static void exynos_drm_crtc_apply(struct drm_crtc *crtc)
 
         exynos_drm_fn_encoder(crtc, overlay,
                         exynos_drm_encoder_crtc_mode_set);
-        exynos_drm_fn_encoder(crtc, NULL, exynos_drm_encoder_crtc_commit);
+        exynos_drm_fn_encoder(crtc, &exynos_crtc->pipe,
+                        exynos_drm_encoder_crtc_commit);
 }
 
-static int exynos_drm_overlay_update(struct exynos_drm_overlay *overlay,
-                                       struct drm_framebuffer *fb,
-                                       struct drm_display_mode *mode,
-                                       struct exynos_drm_crtc_pos *pos)
+int exynos_drm_overlay_update(struct exynos_drm_overlay *overlay,
+                              struct drm_framebuffer *fb,
+                              struct drm_display_mode *mode,
+                              struct exynos_drm_crtc_pos *pos)
 {
-        struct exynos_drm_buf_entry *entry;
+        struct exynos_drm_gem_buf *buffer;
         unsigned int actual_w;
         unsigned int actual_h;
 
-        entry = exynos_drm_fb_get_buf(fb);
-        if (!entry) {
-                DRM_LOG_KMS("entry is null.\n");
+        buffer = exynos_drm_fb_get_buf(fb);
+        if (!buffer) {
+                DRM_LOG_KMS("buffer is null.\n");
                 return -EFAULT;
         }
 
-        overlay->paddr = entry->paddr;
-        overlay->vaddr = entry->vaddr;
+        overlay->dma_addr = buffer->dma_addr;
+        overlay->vaddr = buffer->kvaddr;
 
-        DRM_DEBUG_KMS("vaddr = 0x%lx, paddr = 0x%lx\n",
+        DRM_DEBUG_KMS("vaddr = 0x%lx, dma_addr = 0x%lx\n",
                         (unsigned long)overlay->vaddr,
-                        (unsigned long)overlay->paddr);
+                        (unsigned long)overlay->dma_addr);
 
         actual_w = min((mode->hdisplay - pos->crtc_x), pos->crtc_w);
         actual_h = min((mode->vdisplay - pos->crtc_y), pos->crtc_h);
@@ -171,9 +153,26 @@ static int exynos_drm_crtc_update(struct drm_crtc *crtc)
 
 static void exynos_drm_crtc_dpms(struct drm_crtc *crtc, int mode)
 {
-        DRM_DEBUG_KMS("%s\n", __FILE__);
+        struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
 
-        /* TODO */
+        DRM_DEBUG_KMS("crtc[%d] mode[%d]\n", crtc->base.id, mode);
+
+        switch (mode) {
+        case DRM_MODE_DPMS_ON:
+                exynos_drm_fn_encoder(crtc, &exynos_crtc->pipe,
+                                exynos_drm_encoder_crtc_commit);
+                break;
+        case DRM_MODE_DPMS_STANDBY:
+        case DRM_MODE_DPMS_SUSPEND:
+        case DRM_MODE_DPMS_OFF:
+                /* TODO */
+                exynos_drm_fn_encoder(crtc, NULL,
+                                exynos_drm_encoder_crtc_disable);
+                break;
+        default:
+                DRM_DEBUG_KMS("unspecified mode %d\n", mode);
+                break;
+        }
 }
 
 static void exynos_drm_crtc_prepare(struct drm_crtc *crtc)
@@ -185,9 +184,12 @@ static void exynos_drm_crtc_prepare(struct drm_crtc *crtc)
 
 static void exynos_drm_crtc_commit(struct drm_crtc *crtc)
 {
+        struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc);
+
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        /* drm framework doesn't check NULL. */
+        exynos_drm_fn_encoder(crtc, &exynos_crtc->pipe,
+                        exynos_drm_encoder_crtc_commit);
 }
 
 static bool
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.h b/drivers/gpu/drm/exynos/exynos_drm_crtc.h
index c584042d6d2c..25f72a62cb88 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.h
@@ -35,4 +35,29 @@ int exynos_drm_crtc_create(struct drm_device *dev, unsigned int nr);
 int exynos_drm_crtc_enable_vblank(struct drm_device *dev, int crtc);
 void exynos_drm_crtc_disable_vblank(struct drm_device *dev, int crtc);
 
+/*
+ * Exynos specific crtc postion structure.
+ *
+ * @fb_x: offset x on a framebuffer to be displyed
+ *      - the unit is screen coordinates.
+ * @fb_y: offset y on a framebuffer to be displayed
+ *      - the unit is screen coordinates.
+ * @crtc_x: offset x on hardware screen.
+ * @crtc_y: offset y on hardware screen.
+ * @crtc_w: width of hardware screen.
+ * @crtc_h: height of hardware screen.
+ */
+struct exynos_drm_crtc_pos {
+        unsigned int fb_x;
+        unsigned int fb_y;
+        unsigned int crtc_x;
+        unsigned int crtc_y;
+        unsigned int crtc_w;
+        unsigned int crtc_h;
+};
+
+int exynos_drm_overlay_update(struct exynos_drm_overlay *overlay,
+                              struct drm_framebuffer *fb,
+                              struct drm_display_mode *mode,
+                              struct exynos_drm_crtc_pos *pos);
 #endif
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 83810cbe3c17..53e2216de61d 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -27,6 +27,7 @@
 
 #include "drmP.h"
 #include "drm.h"
+#include "drm_crtc_helper.h"
 
 #include <drm/exynos_drm.h>
 
@@ -61,6 +62,9 @@ static int exynos_drm_load(struct drm_device *dev, unsigned long flags)
 
         drm_mode_config_init(dev);
 
+        /* init kms poll for handling hpd */
+        drm_kms_helper_poll_init(dev);
+
         exynos_drm_mode_config_init(dev);
 
         /*
@@ -116,6 +120,7 @@ static int exynos_drm_unload(struct drm_device *dev)
         exynos_drm_fbdev_fini(dev);
         exynos_drm_device_unregister(dev);
         drm_vblank_cleanup(dev);
+        drm_kms_helper_poll_fini(dev);
         drm_mode_config_cleanup(dev);
         kfree(dev->dev_private);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index c03683f2ae72..5e02e6ecc2e0 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -29,6 +29,7 @@
 #ifndef _EXYNOS_DRM_DRV_H_
 #define _EXYNOS_DRM_DRV_H_
 
+#include <linux/module.h>
 #include "drm.h"
 
 #define MAX_CRTC        2
@@ -79,8 +80,8 @@ struct exynos_drm_overlay_ops {
  * @scan_flag: interlace or progressive way.
  *      (it could be DRM_MODE_FLAG_*)
  * @bpp: pixel size.(in bit)
- * @paddr: bus(accessed by dma) physical memory address to this overlay
- *              and this is physically continuous.
+ * @dma_addr: bus(accessed by dma) address to the memory region allocated
+ *      for a overlay.
  * @vaddr: virtual memory addresss to this overlay.
  * @default_win: a window to be enabled.
  * @color_key: color key on or off.
@@ -108,7 +109,7 @@ struct exynos_drm_overlay {
         unsigned int scan_flag;
         unsigned int bpp;
         unsigned int pitch;
-        dma_addr_t paddr;
+        dma_addr_t dma_addr;
         void __iomem *vaddr;
 
         bool default_win;
@@ -130,7 +131,7 @@ struct exynos_drm_overlay {
  * @check_timing: check if timing is valid or not.
  * @power_on: display device on or off.
  */
-struct exynos_drm_display {
+struct exynos_drm_display_ops {
         enum exynos_drm_output_type type;
         bool (*is_connected)(struct device *dev);
         int (*get_edid)(struct device *dev, struct drm_connector *connector,
@@ -146,12 +147,14 @@ struct exynos_drm_display {
  * @mode_set: convert drm_display_mode to hw specific display mode and
  *            would be called by encoder->mode_set().
  * @commit: set current hw specific display mode to hw.
+ * @disable: disable hardware specific display mode.
  * @enable_vblank: specific driver callback for enabling vblank interrupt.
  * @disable_vblank: specific driver callback for disabling vblank interrupt.
  */
 struct exynos_drm_manager_ops {
         void (*mode_set)(struct device *subdrv_dev, void *mode);
         void (*commit)(struct device *subdrv_dev);
+        void (*disable)(struct device *subdrv_dev);
         int (*enable_vblank)(struct device *subdrv_dev);
         void (*disable_vblank)(struct device *subdrv_dev);
 };
@@ -178,7 +181,7 @@ struct exynos_drm_manager {
         int pipe;
         struct exynos_drm_manager_ops *ops;
         struct exynos_drm_overlay_ops *overlay_ops;
-        struct exynos_drm_display *display;
+        struct exynos_drm_display_ops *display_ops;
 };
 
 /*
diff --git a/drivers/gpu/drm/exynos/exynos_drm_encoder.c b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
index 7cf6fa86a67e..153061415baf 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_encoder.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
@@ -53,15 +53,36 @@ static void exynos_drm_encoder_dpms(struct drm_encoder *encoder, int mode)
         struct drm_device *dev = encoder->dev;
         struct drm_connector *connector;
         struct exynos_drm_manager *manager = exynos_drm_get_manager(encoder);
+        struct exynos_drm_manager_ops *manager_ops = manager->ops;
 
         DRM_DEBUG_KMS("%s, encoder dpms: %d\n", __FILE__, mode);
 
+        switch (mode) {
+        case DRM_MODE_DPMS_ON:
+                if (manager_ops && manager_ops->commit)
+                        manager_ops->commit(manager->dev);
+                break;
+        case DRM_MODE_DPMS_STANDBY:
+        case DRM_MODE_DPMS_SUSPEND:
+        case DRM_MODE_DPMS_OFF:
+                /* TODO */
+                if (manager_ops && manager_ops->disable)
+                        manager_ops->disable(manager->dev);
+                break;
+        default:
+                DRM_ERROR("unspecified mode %d\n", mode);
+                break;
+        }
+
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 if (connector->encoder == encoder) {
-                        struct exynos_drm_display *display = manager->display;
+                        struct exynos_drm_display_ops *display_ops =
+                                                        manager->display_ops;
 
-                        if (display && display->power_on)
-                                display->power_on(manager->dev, mode);
+                        DRM_DEBUG_KMS("connector[%d] dpms[%d]\n",
+                                        connector->base.id, mode);
+                        if (display_ops && display_ops->power_on)
+                                display_ops->power_on(manager->dev, mode);
                 }
         }
 }
@@ -116,15 +137,11 @@ static void exynos_drm_encoder_commit(struct drm_encoder *encoder)
 {
         struct exynos_drm_manager *manager = exynos_drm_get_manager(encoder);
         struct exynos_drm_manager_ops *manager_ops = manager->ops;
-        struct exynos_drm_overlay_ops *overlay_ops = manager->overlay_ops;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         if (manager_ops && manager_ops->commit)
                 manager_ops->commit(manager->dev);
-
-        if (overlay_ops && overlay_ops->commit)
-                overlay_ops->commit(manager->dev);
 }
 
 static struct drm_crtc *
@@ -208,10 +225,23 @@ void exynos_drm_fn_encoder(struct drm_crtc *crtc, void *data,
 {
         struct drm_device *dev = crtc->dev;
         struct drm_encoder *encoder;
+        struct exynos_drm_private *private = dev->dev_private;
+        struct exynos_drm_manager *manager;
 
         list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
-                if (encoder->crtc != crtc)
-                        continue;
+                /*
+                 * if crtc is detached from encoder, check pipe,
+                 * otherwise check crtc attached to encoder
+                 */
+                if (!encoder->crtc) {
+                        manager = to_exynos_encoder(encoder)->manager;
+                        if (manager->pipe < 0 ||
+                                        private->crtc[manager->pipe] != crtc)
+                                continue;
+                } else {
+                        if (encoder->crtc != crtc)
+                                continue;
+                }
 
                 fn(encoder, data);
         }
@@ -250,8 +280,18 @@ void exynos_drm_encoder_crtc_commit(struct drm_encoder *encoder, void *data)
         struct exynos_drm_manager *manager =
                 to_exynos_encoder(encoder)->manager;
         struct exynos_drm_overlay_ops *overlay_ops = manager->overlay_ops;
+        int crtc = *(int *)data;
+
+        DRM_DEBUG_KMS("%s\n", __FILE__);
+
+        /*
+         * when crtc is detached from encoder, this pipe is used
+         * to select manager operation
+         */
+        manager->pipe = crtc;
 
-        overlay_ops->commit(manager->dev);
+        if (overlay_ops && overlay_ops->commit)
+                overlay_ops->commit(manager->dev);
 }
 
 void exynos_drm_encoder_crtc_mode_set(struct drm_encoder *encoder, void *data)
@@ -261,7 +301,28 @@ void exynos_drm_encoder_crtc_mode_set(struct drm_encoder *encoder, void *data)
         struct exynos_drm_overlay_ops *overlay_ops = manager->overlay_ops;
         struct exynos_drm_overlay *overlay = data;
 
-        overlay_ops->mode_set(manager->dev, overlay);
+        if (overlay_ops && overlay_ops->mode_set)
+                overlay_ops->mode_set(manager->dev, overlay);
+}
+
+void exynos_drm_encoder_crtc_disable(struct drm_encoder *encoder, void *data)
+{
+        struct exynos_drm_manager *manager =
+                to_exynos_encoder(encoder)->manager;
+        struct exynos_drm_overlay_ops *overlay_ops = manager->overlay_ops;
+
+        DRM_DEBUG_KMS("\n");
+
+        if (overlay_ops && overlay_ops->disable)
+                overlay_ops->disable(manager->dev);
+
+        /*
+         * crtc is already detached from encoder and last
+         * function for detaching is properly done, so
+         * clear pipe from manager to prevent repeated call
+         */
+        if (!encoder->crtc)
+                manager->pipe = -1;
 }
 
 MODULE_AUTHOR("Inki Dae <inki.dae@samsung.com>");
diff --git a/drivers/gpu/drm/exynos/exynos_drm_encoder.h b/drivers/gpu/drm/exynos/exynos_drm_encoder.h
index 5ecd645d06a9..a22acfbf0e4e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_encoder.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_encoder.h
@@ -41,5 +41,6 @@ void exynos_drm_enable_vblank(struct drm_encoder *encoder, void *data);
 void exynos_drm_disable_vblank(struct drm_encoder *encoder, void *data);
 void exynos_drm_encoder_crtc_commit(struct drm_encoder *encoder, void *data);
 void exynos_drm_encoder_crtc_mode_set(struct drm_encoder *encoder, void *data);
+void exynos_drm_encoder_crtc_disable(struct drm_encoder *encoder, void *data);
 
 #endif
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index 48d29cfd5240..5bf4a1ac7f82 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -29,7 +29,9 @@
 #include "drmP.h"
 #include "drm_crtc.h"
 #include "drm_crtc_helper.h"
+#include "drm_fb_helper.h"
 
+#include "exynos_drm_drv.h"
 #include "exynos_drm_fb.h"
 #include "exynos_drm_buf.h"
 #include "exynos_drm_gem.h"
@@ -41,14 +43,14 @@
  *
  * @fb: drm framebuffer obejct.
  * @exynos_gem_obj: exynos specific gem object containing a gem object.
- * @entry: pointer to exynos drm buffer entry object.
- *      - containing only the information to physically continuous memory
- *      region allocated at default framebuffer creation.
+ * @buffer: pointer to exynos_drm_gem_buffer object.
+ *      - contain the memory information to memory region allocated
+ *      at default framebuffer creation.
  */
 struct exynos_drm_fb {
         struct drm_framebuffer          fb;
         struct exynos_drm_gem_obj       *exynos_gem_obj;
-        struct exynos_drm_buf_entry     *entry;
+        struct exynos_drm_gem_buf       *buffer;
 };
 
 static void exynos_drm_fb_destroy(struct drm_framebuffer *fb)
@@ -63,8 +65,8 @@ static void exynos_drm_fb_destroy(struct drm_framebuffer *fb)
          * default framebuffer has no gem object so
          * a buffer of the default framebuffer should be released at here.
          */
-        if (!exynos_fb->exynos_gem_obj && exynos_fb->entry)
-                exynos_drm_buf_destroy(fb->dev, exynos_fb->entry);
+        if (!exynos_fb->exynos_gem_obj && exynos_fb->buffer)
+                exynos_drm_buf_destroy(fb->dev, exynos_fb->buffer);
 
         kfree(exynos_fb);
         exynos_fb = NULL;
@@ -143,29 +145,29 @@ exynos_drm_fb_init(struct drm_file *file_priv, struct drm_device *dev,
          */
         if (!mode_cmd->handle) {
                 if (!file_priv) {
-                        struct exynos_drm_buf_entry *entry;
+                        struct exynos_drm_gem_buf *buffer;
 
                         /*
                          * in case that file_priv is NULL, it allocates
                          * only buffer and this buffer would be used
                          * for default framebuffer.
                          */
-                        entry = exynos_drm_buf_create(dev, size);
-                        if (IS_ERR(entry)) {
-                                ret = PTR_ERR(entry);
+                        buffer = exynos_drm_buf_create(dev, size);
+                        if (IS_ERR(buffer)) {
+                                ret = PTR_ERR(buffer);
                                 goto err_buffer;
                         }
 
-                        exynos_fb->entry = entry;
+                        exynos_fb->buffer = buffer;
 
-                        DRM_LOG_KMS("default fb: paddr = 0x%lx, size = 0x%x\n",
-                                        (unsigned long)entry->paddr, size);
+                        DRM_LOG_KMS("default: dma_addr = 0x%lx, size = 0x%x\n",
+                                        (unsigned long)buffer->dma_addr, size);
 
                         goto out;
                 } else {
-                        exynos_gem_obj = exynos_drm_gem_create(file_priv, dev,
-                                                        size,
-                                                        &mode_cmd->handle);
+                        exynos_gem_obj = exynos_drm_gem_create(dev, file_priv,
+                                                        &mode_cmd->handle,
+                                                        size);
                         if (IS_ERR(exynos_gem_obj)) {
                                 ret = PTR_ERR(exynos_gem_obj);
                                 goto err_buffer;
@@ -189,10 +191,10 @@ exynos_drm_fb_init(struct drm_file *file_priv, struct drm_device *dev,
          * so that default framebuffer has no its own gem object,
          * only its own buffer object.
          */
-        exynos_fb->entry = exynos_gem_obj->entry;
+        exynos_fb->buffer = exynos_gem_obj->buffer;
 
-        DRM_LOG_KMS("paddr = 0x%lx, size = 0x%x, gem object = 0x%x\n",
-                        (unsigned long)exynos_fb->entry->paddr, size,
+        DRM_LOG_KMS("dma_addr = 0x%lx, size = 0x%x, gem object = 0x%x\n",
+                        (unsigned long)exynos_fb->buffer->dma_addr, size,
                         (unsigned int)&exynos_gem_obj->base);
 
 out:
@@ -220,26 +222,36 @@ struct drm_framebuffer *exynos_drm_fb_create(struct drm_device *dev,
         return exynos_drm_fb_init(file_priv, dev, mode_cmd);
 }
 
-struct exynos_drm_buf_entry *exynos_drm_fb_get_buf(struct drm_framebuffer *fb)
+struct exynos_drm_gem_buf *exynos_drm_fb_get_buf(struct drm_framebuffer *fb)
 {
         struct exynos_drm_fb *exynos_fb = to_exynos_fb(fb);
-        struct exynos_drm_buf_entry *entry;
+        struct exynos_drm_gem_buf *buffer;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        entry = exynos_fb->entry;
-        if (!entry)
+        buffer = exynos_fb->buffer;
+        if (!buffer)
                 return NULL;
 
-        DRM_DEBUG_KMS("vaddr = 0x%lx, paddr = 0x%lx\n",
-                        (unsigned long)entry->vaddr,
-                        (unsigned long)entry->paddr);
+        DRM_DEBUG_KMS("vaddr = 0x%lx, dma_addr = 0x%lx\n",
+                        (unsigned long)buffer->kvaddr,
+                        (unsigned long)buffer->dma_addr);
 
-        return entry;
+        return buffer;
+}
+
+static void exynos_drm_output_poll_changed(struct drm_device *dev)
+{
+        struct exynos_drm_private *private = dev->dev_private;
+        struct drm_fb_helper *fb_helper = private->fb_helper;
+
+        if (fb_helper)
+                drm_fb_helper_hotplug_event(fb_helper);
 }
 
 static struct drm_mode_config_funcs exynos_drm_mode_config_funcs = {
         .fb_create = exynos_drm_fb_create,
+        .output_poll_changed = exynos_drm_output_poll_changed,
 };
 
 void exynos_drm_mode_config_init(struct drm_device *dev)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index 1f4b3d1a7713..836f41008187 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -33,6 +33,7 @@
 
 #include "exynos_drm_drv.h"
 #include "exynos_drm_fb.h"
+#include "exynos_drm_gem.h"
 #include "exynos_drm_buf.h"
 
 #define MAX_CONNECTOR           4
@@ -85,15 +86,13 @@ static struct fb_ops exynos_drm_fb_ops = {
 };
 
 static int exynos_drm_fbdev_update(struct drm_fb_helper *helper,
-                                     struct drm_framebuffer *fb,
-                                     unsigned int fb_width,
-                                     unsigned int fb_height)
+                                     struct drm_framebuffer *fb)
 {
         struct fb_info *fbi = helper->fbdev;
         struct drm_device *dev = helper->dev;
         struct exynos_drm_fbdev *exynos_fb = to_exynos_fbdev(helper);
-        struct exynos_drm_buf_entry *entry;
-        unsigned int size = fb_width * fb_height * (fb->bits_per_pixel >> 3);
+        struct exynos_drm_gem_buf *buffer;
+        unsigned int size = fb->width * fb->height * (fb->bits_per_pixel >> 3);
         unsigned long offset;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
@@ -101,20 +100,20 @@ static int exynos_drm_fbdev_update(struct drm_fb_helper *helper,
         exynos_fb->fb = fb;
 
         drm_fb_helper_fill_fix(fbi, fb->pitch, fb->depth);
-        drm_fb_helper_fill_var(fbi, helper, fb_width, fb_height);
+        drm_fb_helper_fill_var(fbi, helper, fb->width, fb->height);
 
-        entry = exynos_drm_fb_get_buf(fb);
-        if (!entry) {
-                DRM_LOG_KMS("entry is null.\n");
+        buffer = exynos_drm_fb_get_buf(fb);
+        if (!buffer) {
+                DRM_LOG_KMS("buffer is null.\n");
                 return -EFAULT;
         }
 
         offset = fbi->var.xoffset * (fb->bits_per_pixel >> 3);
         offset += fbi->var.yoffset * fb->pitch;
 
-        dev->mode_config.fb_base = entry->paddr;
-        fbi->screen_base = entry->vaddr + offset;
-        fbi->fix.smem_start = entry->paddr + offset;
+        dev->mode_config.fb_base = (resource_size_t)buffer->dma_addr;
+        fbi->screen_base = buffer->kvaddr + offset;
+        fbi->fix.smem_start = (unsigned long)(buffer->dma_addr + offset);
         fbi->screen_size = size;
         fbi->fix.smem_len = size;
 
@@ -171,8 +170,7 @@ static int exynos_drm_fbdev_create(struct drm_fb_helper *helper,
                 goto out;
         }
 
-        ret = exynos_drm_fbdev_update(helper, helper->fb, sizes->fb_width,
-                        sizes->fb_height);
+        ret = exynos_drm_fbdev_update(helper, helper->fb);
         if (ret < 0)
                 fb_dealloc_cmap(&fbi->cmap);
 
@@ -235,8 +233,7 @@ static int exynos_drm_fbdev_recreate(struct drm_fb_helper *helper,
         }
 
         helper->fb = exynos_fbdev->fb;
-        return exynos_drm_fbdev_update(helper, helper->fb, sizes->fb_width,
-                        sizes->fb_height);
+        return exynos_drm_fbdev_update(helper, helper->fb);
 }
 
 static int exynos_drm_fbdev_probe(struct drm_fb_helper *helper,
@@ -405,6 +402,18 @@ int exynos_drm_fbdev_reinit(struct drm_device *dev)
         fb_helper = private->fb_helper;
 
         if (fb_helper) {
+                struct list_head temp_list;
+
+                INIT_LIST_HEAD(&temp_list);
+
+                /*
+                 * fb_helper is reintialized but kernel fb is reused
+                 * so kernel_fb_list need to be backuped and restored
+                 */
+                if (!list_empty(&fb_helper->kernel_fb_list))
+                        list_replace_init(&fb_helper->kernel_fb_list,
+                                        &temp_list);
+
                 drm_fb_helper_fini(fb_helper);
 
                 ret = drm_fb_helper_init(dev, fb_helper,
@@ -414,6 +423,9 @@ int exynos_drm_fbdev_reinit(struct drm_device *dev)
                         return ret;
                 }
 
+                if (!list_empty(&temp_list))
+                        list_replace(&temp_list, &fb_helper->kernel_fb_list);
+
                 ret = drm_fb_helper_single_add_all_connectors(fb_helper);
                 if (ret < 0) {
                         DRM_ERROR("failed to add fb helper to connectors\n");
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 4659c88cdd9b..db3b3d9e731d 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -64,7 +64,7 @@ struct fimd_win_data {
         unsigned int            fb_width;
         unsigned int            fb_height;
         unsigned int            bpp;
-        dma_addr_t              paddr;
+        dma_addr_t              dma_addr;
         void __iomem            *vaddr;
         unsigned int            buf_offsize;
         unsigned int            line_size;      /* bytes */
@@ -124,7 +124,7 @@ static int fimd_display_power_on(struct device *dev, int mode)
         return 0;
 }
 
-static struct exynos_drm_display fimd_display = {
+static struct exynos_drm_display_ops fimd_display_ops = {
         .type = EXYNOS_DISPLAY_TYPE_LCD,
         .is_connected = fimd_display_is_connected,
         .get_timing = fimd_get_timing,
@@ -177,6 +177,40 @@ static void fimd_commit(struct device *dev)
         writel(val, ctx->regs + VIDCON0);
 }
 
+static void fimd_disable(struct device *dev)
+{
+        struct fimd_context *ctx = get_fimd_context(dev);
+        struct exynos_drm_subdrv *subdrv = &ctx->subdrv;
+        struct drm_device *drm_dev = subdrv->drm_dev;
+        struct exynos_drm_manager *manager = &subdrv->manager;
+        u32 val;
+
+        DRM_DEBUG_KMS("%s\n", __FILE__);
+
+        /* fimd dma off */
+        val = readl(ctx->regs + VIDCON0);
+        val &= ~(VIDCON0_ENVID | VIDCON0_ENVID_F);
+        writel(val, ctx->regs + VIDCON0);
+
+        /*
+         * if vblank is enabled status with dma off then
+         * it disables vsync interrupt.
+         */
+        if (drm_dev->vblank_enabled[manager->pipe] &&
+                atomic_read(&drm_dev->vblank_refcount[manager->pipe])) {
+                drm_vblank_put(drm_dev, manager->pipe);
+
+                /*
+                 * if vblank_disable_allowed is 0 then disable
+                 * vsync interrupt right now else the vsync interrupt
+                 * would be disabled by drm timer once a current process
+                 * gives up ownershop of vblank event.
+                 */
+                if (!drm_dev->vblank_disable_allowed)
+                        drm_vblank_off(drm_dev, manager->pipe);
+        }
+}
+
 static int fimd_enable_vblank(struct device *dev)
 {
         struct fimd_context *ctx = get_fimd_context(dev);
@@ -220,6 +254,7 @@ static void fimd_disable_vblank(struct device *dev)
 
 static struct exynos_drm_manager_ops fimd_manager_ops = {
         .commit = fimd_commit,
+        .disable = fimd_disable,
         .enable_vblank = fimd_enable_vblank,
         .disable_vblank = fimd_disable_vblank,
 };
@@ -251,7 +286,7 @@ static void fimd_win_mode_set(struct device *dev,
         win_data->ovl_height = overlay->crtc_height;
         win_data->fb_width = overlay->fb_width;
         win_data->fb_height = overlay->fb_height;
-        win_data->paddr = overlay->paddr + offset;
+        win_data->dma_addr = overlay->dma_addr + offset;
         win_data->vaddr = overlay->vaddr + offset;
         win_data->bpp = overlay->bpp;
         win_data->buf_offsize = (overlay->fb_width - overlay->crtc_width) *
@@ -263,7 +298,7 @@ static void fimd_win_mode_set(struct device *dev,
         DRM_DEBUG_KMS("ovl_width = %d, ovl_height = %d\n",
                         win_data->ovl_width, win_data->ovl_height);
         DRM_DEBUG_KMS("paddr = 0x%lx, vaddr = 0x%lx\n",
-                        (unsigned long)win_data->paddr,
+                        (unsigned long)win_data->dma_addr,
                         (unsigned long)win_data->vaddr);
         DRM_DEBUG_KMS("fb_width = %d, crtc_width = %d\n",
                         overlay->fb_width, overlay->crtc_width);
@@ -376,16 +411,16 @@ static void fimd_win_commit(struct device *dev)
         writel(val, ctx->regs + SHADOWCON);
 
         /* buffer start address */
-        val = win_data->paddr;
+        val = (unsigned long)win_data->dma_addr;
         writel(val, ctx->regs + VIDWx_BUF_START(win, 0));
 
         /* buffer end address */
         size = win_data->fb_width * win_data->ovl_height * (win_data->bpp >> 3);
-        val = win_data->paddr + size;
+        val = (unsigned long)(win_data->dma_addr + size);
         writel(val, ctx->regs + VIDWx_BUF_END(win, 0));
 
         DRM_DEBUG_KMS("start addr = 0x%lx, end addr = 0x%lx, size = 0x%lx\n",
-                        (unsigned long)win_data->paddr, val, size);
+                        (unsigned long)win_data->dma_addr, val, size);
         DRM_DEBUG_KMS("ovl_width = %d, ovl_height = %d\n",
                         win_data->ovl_width, win_data->ovl_height);
 
@@ -447,7 +482,6 @@ static void fimd_win_commit(struct device *dev)
 static void fimd_win_disable(struct device *dev)
 {
         struct fimd_context *ctx = get_fimd_context(dev);
-        struct fimd_win_data *win_data;
         int win = ctx->default_win;
         u32 val;
 
@@ -456,8 +490,6 @@ static void fimd_win_disable(struct device *dev)
         if (win < 0 || win > WINDOWS_NR)
                 return;
 
-        win_data = &ctx->win_data[win];
-
         /* protect windows */
         val = readl(ctx->regs + SHADOWCON);
         val |= SHADOWCON_WINx_PROTECT(win);
@@ -528,6 +560,16 @@ static irqreturn_t fimd_irq_handler(int irq, void *dev_id)
                 /* VSYNC interrupt */
                 writel(VIDINTCON1_INT_FRAME, ctx->regs + VIDINTCON1);
 
+        /*
+         * in case that vblank_disable_allowed is 1, it could induce
+         * the problem that manager->pipe could be -1 because with
+         * disable callback, vsync interrupt isn't disabled and at this moment,
+         * vsync interrupt could occur. the vsync interrupt would be disabled
+         * by timer handler later.
+         */
+        if (manager->pipe == -1)
+                return IRQ_HANDLED;
+
         drm_handle_vblank(drm_dev, manager->pipe);
         fimd_finish_pageflip(drm_dev, manager->pipe);
 
@@ -548,13 +590,6 @@ static int fimd_subdrv_probe(struct drm_device *drm_dev, struct device *dev)
          */
         drm_dev->irq_enabled = 1;
 
-        /*
-         * with vblank_disable_allowed = 1, vblank interrupt will be disabled
-         * by drm timer once a current process gives up ownership of
-         * vblank event.(drm_vblank_put function was called)
-         */
-        drm_dev->vblank_disable_allowed = 1;
-
         return 0;
 }
 
@@ -731,7 +766,7 @@ static int __devinit fimd_probe(struct platform_device *pdev)
         subdrv->manager.pipe = -1;
         subdrv->manager.ops = &fimd_manager_ops;
         subdrv->manager.overlay_ops = &fimd_overlay_ops;
-        subdrv->manager.display = &fimd_display;
+        subdrv->manager.display_ops = &fimd_display_ops;
         subdrv->manager.dev = dev;
 
         platform_set_drvdata(pdev, ctx);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index a8e7a88906ed..aba0fe47f7ea 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -62,40 +62,28 @@ static unsigned int get_gem_mmap_offset(struct drm_gem_object *obj)
         return (unsigned int)obj->map_list.hash.key << PAGE_SHIFT;
 }
 
-struct exynos_drm_gem_obj *exynos_drm_gem_create(struct drm_file *file_priv,
-                struct drm_device *dev, unsigned int size,
-                unsigned int *handle)
+static struct exynos_drm_gem_obj
+                *exynos_drm_gem_init(struct drm_device *drm_dev,
+                        struct drm_file *file_priv, unsigned int *handle,
+                        unsigned int size)
 {
         struct exynos_drm_gem_obj *exynos_gem_obj;
-        struct exynos_drm_buf_entry *entry;
         struct drm_gem_object *obj;
         int ret;
 
-        DRM_DEBUG_KMS("%s\n", __FILE__);
-
-        size = roundup(size, PAGE_SIZE);
-
         exynos_gem_obj = kzalloc(sizeof(*exynos_gem_obj), GFP_KERNEL);
         if (!exynos_gem_obj) {
                 DRM_ERROR("failed to allocate exynos gem object.\n");
                 return ERR_PTR(-ENOMEM);
         }
 
-        /* allocate the new buffer object and memory region. */
-        entry = exynos_drm_buf_create(dev, size);
-        if (!entry) {
-                kfree(exynos_gem_obj);
-                return ERR_PTR(-ENOMEM);
-        }
-
-        exynos_gem_obj->entry = entry;
-
         obj = &exynos_gem_obj->base;
 
-        ret = drm_gem_object_init(dev, obj, size);
+        ret = drm_gem_object_init(drm_dev, obj, size);
         if (ret < 0) {
-                DRM_ERROR("failed to initailize gem object.\n");
-                goto err_obj_init;
+                DRM_ERROR("failed to initialize gem object.\n");
+                ret = -EINVAL;
+                goto err_object_init;
         }
 
         DRM_DEBUG_KMS("created file object = 0x%x\n", (unsigned int)obj->filp);
@@ -127,24 +115,50 @@ err_handle_create:
 err_create_mmap_offset:
         drm_gem_object_release(obj);
 
-err_obj_init:
-        exynos_drm_buf_destroy(dev, exynos_gem_obj->entry);
-
+err_object_init:
         kfree(exynos_gem_obj);
 
         return ERR_PTR(ret);
 }
 
+struct exynos_drm_gem_obj *exynos_drm_gem_create(struct drm_device *dev,
+                                struct drm_file *file_priv,
+                                unsigned int *handle, unsigned long size)
+{
+
+        struct exynos_drm_gem_obj *exynos_gem_obj = NULL;
+        struct exynos_drm_gem_buf *buffer;
+
+        size = roundup(size, PAGE_SIZE);
+
+        DRM_DEBUG_KMS("%s: size = 0x%lx\n", __FILE__, size);
+
+        buffer = exynos_drm_buf_create(dev, size);
+        if (IS_ERR(buffer)) {
+                return ERR_CAST(buffer);
+        }
+
+        exynos_gem_obj = exynos_drm_gem_init(dev, file_priv, handle, size);
+        if (IS_ERR(exynos_gem_obj)) {
+                exynos_drm_buf_destroy(dev, buffer);
+                return exynos_gem_obj;
+        }
+
+        exynos_gem_obj->buffer = buffer;
+
+        return exynos_gem_obj;
+}
+
 int exynos_drm_gem_create_ioctl(struct drm_device *dev, void *data,
-                struct drm_file *file_priv)
+                                        struct drm_file *file_priv)
 {
         struct drm_exynos_gem_create *args = data;
-        struct exynos_drm_gem_obj *exynos_gem_obj;
+        struct exynos_drm_gem_obj *exynos_gem_obj = NULL;
 
-        DRM_DEBUG_KMS("%s : size = 0x%x\n", __FILE__, args->size);
+        DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        exynos_gem_obj = exynos_drm_gem_create(file_priv, dev, args->size,
-                        &args->handle);
+        exynos_gem_obj = exynos_drm_gem_create(dev, file_priv,
+                                                &args->handle, args->size);
         if (IS_ERR(exynos_gem_obj))
                 return PTR_ERR(exynos_gem_obj);
 
@@ -175,7 +189,7 @@ static int exynos_drm_gem_mmap_buffer(struct file *filp,
 {
         struct drm_gem_object *obj = filp->private_data;
         struct exynos_drm_gem_obj *exynos_gem_obj = to_exynos_gem_obj(obj);
-        struct exynos_drm_buf_entry *entry;
+        struct exynos_drm_gem_buf *buffer;
         unsigned long pfn, vm_size;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
@@ -187,20 +201,20 @@ static int exynos_drm_gem_mmap_buffer(struct file *filp,
 
         vm_size = vma->vm_end - vma->vm_start;
         /*
-         * a entry contains information to physically continuous memory
+         * a buffer contains information to physically continuous memory
          * allocated by user request or at framebuffer creation.
          */
-        entry = exynos_gem_obj->entry;
+        buffer = exynos_gem_obj->buffer;
 
         /* check if user-requested size is valid. */
-        if (vm_size > entry->size)
+        if (vm_size > buffer->size)
                 return -EINVAL;
 
         /*
          * get page frame number to physical memory to be mapped
          * to user space.
          */
-        pfn = exynos_gem_obj->entry->paddr >> PAGE_SHIFT;
+        pfn = ((unsigned long)exynos_gem_obj->buffer->dma_addr) >> PAGE_SHIFT;
 
         DRM_DEBUG_KMS("pfn = 0x%lx\n", pfn);
 
@@ -281,7 +295,7 @@ void exynos_drm_gem_free_object(struct drm_gem_object *gem_obj)
 
         exynos_gem_obj = to_exynos_gem_obj(gem_obj);
 
-        exynos_drm_buf_destroy(gem_obj->dev, exynos_gem_obj->entry);
+        exynos_drm_buf_destroy(gem_obj->dev, exynos_gem_obj->buffer);
 
         kfree(exynos_gem_obj);
 }
@@ -302,8 +316,8 @@ int exynos_drm_gem_dumb_create(struct drm_file *file_priv,
         args->pitch = args->width * args->bpp >> 3;
         args->size = args->pitch * args->height;
 
-        exynos_gem_obj = exynos_drm_gem_create(file_priv, dev, args->size,
-                                                        &args->handle);
+        exynos_gem_obj = exynos_drm_gem_create(dev, file_priv, &args->handle,
+                                                        args->size);
         if (IS_ERR(exynos_gem_obj))
                 return PTR_ERR(exynos_gem_obj);
 
@@ -360,7 +374,8 @@ int exynos_drm_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 
         mutex_lock(&dev->struct_mutex);
 
-        pfn = (exynos_gem_obj->entry->paddr >> PAGE_SHIFT) + page_offset;
+        pfn = (((unsigned long)exynos_gem_obj->buffer->dma_addr) >>
+                        PAGE_SHIFT) + page_offset;
 
         ret = vm_insert_mixed(vma, (unsigned long)vmf->virtual_address, pfn);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.h b/drivers/gpu/drm/exynos/exynos_drm_gem.h
index e5fc0148277b..ef8797334e6d 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.h
@@ -30,13 +30,29 @@
                         struct exynos_drm_gem_obj, base)
 
 /*
+ * exynos drm gem buffer structure.
+ *
+ * @kvaddr: kernel virtual address to allocated memory region.
+ * @dma_addr: bus address(accessed by dma) to allocated memory region.
+ *      - this address could be physical address without IOMMU and
+ *      device address with IOMMU.
+ * @size: size of allocated memory region.
+ */
+struct exynos_drm_gem_buf {
+        void __iomem            *kvaddr;
+        dma_addr_t              dma_addr;
+        unsigned long           size;
+};
+
+/*
  * exynos drm buffer structure.
  *
  * @base: a gem object.
  *      - a new handle to this gem object would be created
  *      by drm_gem_handle_create().
- * @entry: pointer to exynos drm buffer entry object.
- *      - containing the information to physically
+ * @buffer: a pointer to exynos_drm_gem_buffer object.
+ *      - contain the information to memory region allocated
+ *      by user request or at framebuffer creation.
  *      continuous memory region allocated by user request
  *      or at framebuffer creation.
  *
@@ -45,13 +61,13 @@
  */
 struct exynos_drm_gem_obj {
         struct drm_gem_object base;
-        struct exynos_drm_buf_entry *entry;
+        struct exynos_drm_gem_buf *buffer;
 };
 
 /* create a new buffer and get a new gem handle. */
-struct exynos_drm_gem_obj *exynos_drm_gem_create(struct drm_file *file_priv,
-                struct drm_device *dev, unsigned int size,
-                unsigned int *handle);
+struct exynos_drm_gem_obj *exynos_drm_gem_create(struct drm_device *dev,
+                struct drm_file *file_priv,
+                unsigned int *handle, unsigned long size);
 
 /*
  * request gem object creation and buffer allocation as the size
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index ddbabefb4273..b12fd2c80812 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -369,3 +369,48 @@ nouveau_finish_page_flip(struct nouveau_channel *chan,
         spin_unlock_irqrestore(&dev->event_lock, flags);
         return 0;
 }
+
+int
+nouveau_display_dumb_create(struct drm_file *file_priv, struct drm_device *dev,
+                            struct drm_mode_create_dumb *args)
+{
+        struct nouveau_bo *bo;
+        int ret;
+
+        args->pitch = roundup(args->width * (args->bpp / 8), 256);
+        args->size = args->pitch * args->height;
+        args->size = roundup(args->size, PAGE_SIZE);
+
+        ret = nouveau_gem_new(dev, args->size, 0, TTM_PL_FLAG_VRAM, 0, 0, &bo);
+        if (ret)
+                return ret;
+
+        ret = drm_gem_handle_create(file_priv, bo->gem, &args->handle);
+        drm_gem_object_unreference_unlocked(bo->gem);
+        return ret;
+}
+
+int
+nouveau_display_dumb_destroy(struct drm_file *file_priv, struct drm_device *dev,
+                             uint32_t handle)
+{
+        return drm_gem_handle_delete(file_priv, handle);
+}
+
+int
+nouveau_display_dumb_map_offset(struct drm_file *file_priv,
+                                struct drm_device *dev,
+                                uint32_t handle, uint64_t *poffset)
+{
+        struct drm_gem_object *gem;
+
+        gem = drm_gem_object_lookup(dev, file_priv, handle);
+        if (gem) {
+                struct nouveau_bo *bo = gem->driver_private;
+                *poffset = bo->bo.addr_space_offset;
+                drm_gem_object_unreference_unlocked(gem);
+                return 0;
+        }
+
+        return -ENOENT;
+}
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.c b/drivers/gpu/drm/nouveau/nouveau_drv.c
index 9f7bb1295262..9791d13c9e3b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.c
@@ -433,6 +433,10 @@ static struct drm_driver driver = {
         .gem_open_object = nouveau_gem_object_open,
         .gem_close_object = nouveau_gem_object_close,
 
+        .dumb_create = nouveau_display_dumb_create,
+        .dumb_map_offset = nouveau_display_dumb_map_offset,
+        .dumb_destroy = nouveau_display_dumb_destroy,
+
         .name = DRIVER_NAME,
         .desc = DRIVER_DESC,
 #ifdef GIT_REVISION
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 29837da1098b..4c0be3a4ed88 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -1418,6 +1418,12 @@ int nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
                            struct drm_pending_vblank_event *event);
 int nouveau_finish_page_flip(struct nouveau_channel *,
                              struct nouveau_page_flip_state *);
+int nouveau_display_dumb_create(struct drm_file *, struct drm_device *,
+                                struct drm_mode_create_dumb *args);
+int nouveau_display_dumb_map_offset(struct drm_file *, struct drm_device *,
+                                    uint32_t handle, uint64_t *offset);
+int nouveau_display_dumb_destroy(struct drm_file *, struct drm_device *,
+                                 uint32_t handle);
 
 /* nv10_gpio.c */
 int nv10_gpio_get(struct drm_device *dev, enum dcb_gpio_tag tag);
diff --git a/drivers/gpu/drm/nouveau/nouveau_object.c b/drivers/gpu/drm/nouveau/nouveau_object.c
index 02222c540aee..960c0ae0c0c3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_object.c
+++ b/drivers/gpu/drm/nouveau/nouveau_object.c
@@ -680,7 +680,7 @@ nouveau_gpuobj_channel_init_pramin(struct nouveau_channel *chan)
                 return ret;
         }
 
-        ret = drm_mm_init(&chan->ramin_heap, base, size);
+        ret = drm_mm_init(&chan->ramin_heap, base, size - base);
         if (ret) {
                 NV_ERROR(dev, "Error creating PRAMIN heap: %d\n", ret);
                 nouveau_gpuobj_ref(NULL, &chan->ramin);
diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
index b75258a9fe44..c8a463b76c89 100644
--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
@@ -67,7 +67,10 @@ nouveau_sgdma_clear(struct ttm_backend *be)
                         pci_unmap_page(dev->pdev, nvbe->pages[nvbe->nr_pages],
                                        PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
                 }
+                nvbe->unmap_pages = false;
         }
+
+        nvbe->pages = NULL;
 }
 
 static void
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index d23ca00e7d62..06de250fe617 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -616,7 +616,7 @@ nv50_display_unk10_handler(struct drm_device *dev)
         struct drm_nouveau_private *dev_priv = dev->dev_private;
         struct nv50_display *disp = nv50_display(dev);
         u32 unk30 = nv_rd32(dev, 0x610030), mc;
-        int i, crtc, or, type = OUTPUT_ANY;
+        int i, crtc, or = 0, type = OUTPUT_ANY;
 
         NV_DEBUG_KMS(dev, "0x610030: 0x%08x\n", unk30);
         disp->irq.dcb = NULL;
@@ -708,7 +708,7 @@ nv50_display_unk20_handler(struct drm_device *dev)
         struct nv50_display *disp = nv50_display(dev);
         u32 unk30 = nv_rd32(dev, 0x610030), tmp, pclk, script, mc = 0;
         struct dcb_entry *dcb;
-        int i, crtc, or, type = OUTPUT_ANY;
+        int i, crtc, or = 0, type = OUTPUT_ANY;
 
         NV_DEBUG_KMS(dev, "0x610030: 0x%08x\n", unk30);
         dcb = disp->irq.dcb;
diff --git a/drivers/gpu/drm/nouveau/nvc0_graph.c b/drivers/gpu/drm/nouveau/nvc0_graph.c
index a74e501afd25..ecfafd70cf0e 100644
--- a/drivers/gpu/drm/nouveau/nvc0_graph.c
+++ b/drivers/gpu/drm/nouveau/nvc0_graph.c
@@ -381,6 +381,8 @@ nvc0_graph_init_gpc_0(struct drm_device *dev)
         u8  tpnr[GPC_MAX];
         int i, gpc, tpc;
 
+        nv_wr32(dev, TP_UNIT(0, 0, 0x5c), 1); /* affects TFB offset queries */
+
         /*
          *      TP      ROP UNKVAL(magic_not_rop_nr)
          * 450: 4/0/0/0 2        3
diff --git a/drivers/gpu/drm/nouveau/nvd0_display.c b/drivers/gpu/drm/nouveau/nvd0_display.c
index 23d63b4b3d77..cb006a718e70 100644
--- a/drivers/gpu/drm/nouveau/nvd0_display.c
+++ b/drivers/gpu/drm/nouveau/nvd0_display.c
@@ -780,7 +780,7 @@ nvd0_sor_dpms(struct drm_encoder *encoder, int mode)
                         continue;
 
                 if (nv_partner != nv_encoder &&
-                    nv_partner->dcb->or == nv_encoder->or) {
+                    nv_partner->dcb->or == nv_encoder->dcb->or) {
                         if (nv_partner->last_dpms == DRM_MODE_DPMS_ON)
                                 return;
                         break;
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 87631fede1f8..2b97262e3ab1 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1107,9 +1107,40 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
                 return -EINVAL;
         }
 
-        if (tiling_flags & RADEON_TILING_MACRO)
+        if (tiling_flags & RADEON_TILING_MACRO) {
+                if (rdev->family >= CHIP_CAYMAN)
+                        tmp = rdev->config.cayman.tile_config;
+                else
+                        tmp = rdev->config.evergreen.tile_config;
+
+                switch ((tmp & 0xf0) >> 4) {
+                case 0: /* 4 banks */
+                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_4_BANK);
+                        break;
+                case 1: /* 8 banks */
+                default:
+                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_8_BANK);
+                        break;
+                case 2: /* 16 banks */
+                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_16_BANK);
+                        break;
+                }
+
+                switch ((tmp & 0xf000) >> 12) {
+                case 0: /* 1KB rows */
+                default:
+                        fb_format |= EVERGREEN_GRPH_TILE_SPLIT(EVERGREEN_ADDR_SURF_TILE_SPLIT_1KB);
+                        break;
+                case 1: /* 2KB rows */
+                        fb_format |= EVERGREEN_GRPH_TILE_SPLIT(EVERGREEN_ADDR_SURF_TILE_SPLIT_2KB);
+                        break;
+                case 2: /* 4KB rows */
+                        fb_format |= EVERGREEN_GRPH_TILE_SPLIT(EVERGREEN_ADDR_SURF_TILE_SPLIT_4KB);
+                        break;
+                }
+
                 fb_format |= EVERGREEN_GRPH_ARRAY_MODE(EVERGREEN_GRPH_ARRAY_2D_TILED_THIN1);
-        else if (tiling_flags & RADEON_TILING_MICRO)
+        } else if (tiling_flags & RADEON_TILING_MICRO)
                 fb_format |= EVERGREEN_GRPH_ARRAY_MODE(EVERGREEN_GRPH_ARRAY_1D_TILED_THIN1);
 
         switch (radeon_crtc->crtc_id) {
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 1d603a3335db..5e00d1670aa9 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -82,6 +82,7 @@ u32 evergreen_page_flip(struct radeon_device *rdev, int crtc_id, u64 crtc_base)
 {
         struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id];
         u32 tmp = RREG32(EVERGREEN_GRPH_UPDATE + radeon_crtc->crtc_offset);
+        int i;
 
         /* Lock the graphics update lock */
         tmp |= EVERGREEN_GRPH_UPDATE_LOCK;
@@ -99,7 +100,11 @@ u32 evergreen_page_flip(struct radeon_device *rdev, int crtc_id, u64 crtc_base)
                (u32)crtc_base);
 
         /* Wait for update_pending to go high. */
-        while (!(RREG32(EVERGREEN_GRPH_UPDATE + radeon_crtc->crtc_offset) & EVERGREEN_GRPH_SURFACE_UPDATE_PENDING));
+        for (i = 0; i < rdev->usec_timeout; i++) {
+                if (RREG32(EVERGREEN_GRPH_UPDATE + radeon_crtc->crtc_offset) & EVERGREEN_GRPH_SURFACE_UPDATE_PENDING)
+                        break;
+                udelay(1);
+        }
         DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n");
 
         /* Unlock the lock, so double-buffering can take place inside vblank */
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 38e1bda73d33..cd4590aae154 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -38,6 +38,7 @@ struct evergreen_cs_track {
         u32                     group_size;
         u32                     nbanks;
         u32                     npipes;
+        u32                     row_size;
         /* value we track */
         u32                     nsamples;
         u32                     cb_color_base_last[12];
@@ -77,6 +78,44 @@ struct evergreen_cs_track {
         struct radeon_bo        *db_s_write_bo;
 };
 
+static u32 evergreen_cs_get_aray_mode(u32 tiling_flags)
+{
+        if (tiling_flags & RADEON_TILING_MACRO)
+                return ARRAY_2D_TILED_THIN1;
+        else if (tiling_flags & RADEON_TILING_MICRO)
+                return ARRAY_1D_TILED_THIN1;
+        else
+                return ARRAY_LINEAR_GENERAL;
+}
+
+static u32 evergreen_cs_get_num_banks(u32 nbanks)
+{
+        switch (nbanks) {
+        case 2:
+                return ADDR_SURF_2_BANK;
+        case 4:
+                return ADDR_SURF_4_BANK;
+        case 8:
+        default:
+                return ADDR_SURF_8_BANK;
+        case 16:
+                return ADDR_SURF_16_BANK;
+        }
+}
+
+static u32 evergreen_cs_get_tile_split(u32 row_size)
+{
+        switch (row_size) {
+        case 1:
+        default:
+                return ADDR_SURF_TILE_SPLIT_1KB;
+        case 2:
+                return ADDR_SURF_TILE_SPLIT_2KB;
+        case 4:
+                return ADDR_SURF_TILE_SPLIT_4KB;
+        }
+}
+
 static void evergreen_cs_track_init(struct evergreen_cs_track *track)
 {
         int i;
@@ -490,12 +529,11 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                         }
                         ib[idx] &= ~Z_ARRAY_MODE(0xf);
                         track->db_z_info &= ~Z_ARRAY_MODE(0xf);
+                        ib[idx] |= Z_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
+                        track->db_z_info |= Z_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
                         if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
-                                ib[idx] |= Z_ARRAY_MODE(ARRAY_2D_TILED_THIN1);
-                                track->db_z_info |= Z_ARRAY_MODE(ARRAY_2D_TILED_THIN1);
-                        } else {
-                                ib[idx] |= Z_ARRAY_MODE(ARRAY_1D_TILED_THIN1);
-                                track->db_z_info |= Z_ARRAY_MODE(ARRAY_1D_TILED_THIN1);
+                                ib[idx] |= DB_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
+                                ib[idx] |= DB_TILE_SPLIT(evergreen_cs_get_tile_split(track->row_size));
                         }
                 }
                 break;
@@ -618,13 +656,8 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                                 "0x%04X\n", reg);
                                 return -EINVAL;
                         }
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
-                                ib[idx] |= CB_ARRAY_MODE(ARRAY_2D_TILED_THIN1);
-                                track->cb_color_info[tmp] |= CB_ARRAY_MODE(ARRAY_2D_TILED_THIN1);
-                        } else if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO) {
-                                ib[idx] |= CB_ARRAY_MODE(ARRAY_1D_TILED_THIN1);
-                                track->cb_color_info[tmp] |= CB_ARRAY_MODE(ARRAY_1D_TILED_THIN1);
-                        }
+                        ib[idx] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
+                        track->cb_color_info[tmp] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
                 }
                 break;
         case CB_COLOR8_INFO:
@@ -640,13 +673,8 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
                                                 "0x%04X\n", reg);
                                 return -EINVAL;
                         }
-                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
-                                ib[idx] |= CB_ARRAY_MODE(ARRAY_2D_TILED_THIN1);
-                                track->cb_color_info[tmp] |= CB_ARRAY_MODE(ARRAY_2D_TILED_THIN1);
-                        } else if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO) {
-                                ib[idx] |= CB_ARRAY_MODE(ARRAY_1D_TILED_THIN1);
-                                track->cb_color_info[tmp] |= CB_ARRAY_MODE(ARRAY_1D_TILED_THIN1);
-                        }
+                        ib[idx] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
+                        track->cb_color_info[tmp] |= CB_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
                 }
                 break;
         case CB_COLOR0_PITCH:
@@ -701,6 +729,16 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
         case CB_COLOR9_ATTRIB:
         case CB_COLOR10_ATTRIB:
         case CB_COLOR11_ATTRIB:
+                r = evergreen_cs_packet_next_reloc(p, &reloc);
+                if (r) {
+                        dev_warn(p->dev, "bad SET_CONTEXT_REG "
+                                        "0x%04X\n", reg);
+                        return -EINVAL;
+                }
+                if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
+                        ib[idx] |= CB_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
+                        ib[idx] |= CB_TILE_SPLIT(evergreen_cs_get_tile_split(track->row_size));
+                }
                 break;
         case CB_COLOR0_DIM:
         case CB_COLOR1_DIM:
@@ -1318,10 +1356,14 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                 }
                                 ib[idx+1+(i*8)+2] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
                                 if (!p->keep_tiling_flags) {
-                                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
-                                                ib[idx+1+(i*8)+1] |= TEX_ARRAY_MODE(ARRAY_2D_TILED_THIN1);
-                                        else if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
-                                                ib[idx+1+(i*8)+1] |= TEX_ARRAY_MODE(ARRAY_1D_TILED_THIN1);
+                                        ib[idx+1+(i*8)+1] |=
+                                                TEX_ARRAY_MODE(evergreen_cs_get_aray_mode(reloc->lobj.tiling_flags));
+                                        if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO) {
+                                                ib[idx+1+(i*8)+6] |=
+                                                        TEX_TILE_SPLIT(evergreen_cs_get_tile_split(track->row_size));
+                                                ib[idx+1+(i*8)+7] |=
+                                                        TEX_NUM_BANKS(evergreen_cs_get_num_banks(track->nbanks));
+                                        }
                                 }
                                 texture = reloc->robj;
                                 /* tex mip base */
@@ -1422,6 +1464,7 @@ int evergreen_cs_parse(struct radeon_cs_parser *p)
 {
         struct radeon_cs_packet pkt;
         struct evergreen_cs_track *track;
+        u32 tmp;
         int r;
 
         if (p->track == NULL) {
@@ -1430,9 +1473,63 @@ int evergreen_cs_parse(struct radeon_cs_parser *p)
                 if (track == NULL)
                         return -ENOMEM;
                 evergreen_cs_track_init(track);
-                track->npipes = p->rdev->config.evergreen.tiling_npipes;
-                track->nbanks = p->rdev->config.evergreen.tiling_nbanks;
-                track->group_size = p->rdev->config.evergreen.tiling_group_size;
+                if (p->rdev->family >= CHIP_CAYMAN)
+                        tmp = p->rdev->config.cayman.tile_config;
+                else
+                        tmp = p->rdev->config.evergreen.tile_config;
+
+                switch (tmp & 0xf) {
+                case 0:
+                        track->npipes = 1;
+                        break;
+                case 1:
+                default:
+                        track->npipes = 2;
+                        break;
+                case 2:
+                        track->npipes = 4;
+                        break;
+                case 3:
+                        track->npipes = 8;
+                        break;
+                }
+
+                switch ((tmp & 0xf0) >> 4) {
+                case 0:
+                        track->nbanks = 4;
+                        break;
+                case 1:
+                default:
+                        track->nbanks = 8;
+                        break;
+                case 2:
+                        track->nbanks = 16;
+                        break;
+                }
+
+                switch ((tmp & 0xf00) >> 8) {
+                case 0:
+                        track->group_size = 256;
+                        break;
+                case 1:
+                default:
+                        track->group_size = 512;
+                        break;
+                }
+
+                switch ((tmp & 0xf000) >> 12) {
+                case 0:
+                        track->row_size = 1;
+                        break;
+                case 1:
+                default:
+                        track->row_size = 2;
+                        break;
+                case 2:
+                        track->row_size = 4;
+                        break;
+                }
+
                 p->track = track;
         }
         do {
diff --git a/drivers/gpu/drm/radeon/evergreen_reg.h b/drivers/gpu/drm/radeon/evergreen_reg.h
index c781c92c3451..7d7f2155e34c 100644
--- a/drivers/gpu/drm/radeon/evergreen_reg.h
+++ b/drivers/gpu/drm/radeon/evergreen_reg.h
@@ -42,6 +42,17 @@
 #       define EVERGREEN_GRPH_DEPTH_8BPP                0
 #       define EVERGREEN_GRPH_DEPTH_16BPP               1
 #       define EVERGREEN_GRPH_DEPTH_32BPP               2
+#       define EVERGREEN_GRPH_NUM_BANKS(x)              (((x) & 0x3) << 2)
+#       define EVERGREEN_ADDR_SURF_2_BANK               0
+#       define EVERGREEN_ADDR_SURF_4_BANK               1
+#       define EVERGREEN_ADDR_SURF_8_BANK               2
+#       define EVERGREEN_ADDR_SURF_16_BANK              3
+#       define EVERGREEN_GRPH_Z(x)                      (((x) & 0x3) << 4)
+#       define EVERGREEN_GRPH_BANK_WIDTH(x)             (((x) & 0x3) << 6)
+#       define EVERGREEN_ADDR_SURF_BANK_WIDTH_1         0
+#       define EVERGREEN_ADDR_SURF_BANK_WIDTH_2         1
+#       define EVERGREEN_ADDR_SURF_BANK_WIDTH_4         2
+#       define EVERGREEN_ADDR_SURF_BANK_WIDTH_8         3
 #       define EVERGREEN_GRPH_FORMAT(x)                 (((x) & 0x7) << 8)
 /* 8 BPP */
 #       define EVERGREEN_GRPH_FORMAT_INDEXED            0
@@ -61,6 +72,24 @@
 #       define EVERGREEN_GRPH_FORMAT_8B_BGRA1010102     5
 #       define EVERGREEN_GRPH_FORMAT_RGB111110          6
 #       define EVERGREEN_GRPH_FORMAT_BGR101111          7
+#       define EVERGREEN_GRPH_BANK_HEIGHT(x)            (((x) & 0x3) << 11)
+#       define EVERGREEN_ADDR_SURF_BANK_HEIGHT_1        0
+#       define EVERGREEN_ADDR_SURF_BANK_HEIGHT_2        1
+#       define EVERGREEN_ADDR_SURF_BANK_HEIGHT_4        2
+#       define EVERGREEN_ADDR_SURF_BANK_HEIGHT_8        3
+#       define EVERGREEN_GRPH_TILE_SPLIT(x)             (((x) & 0x7) << 13)
+#       define EVERGREEN_ADDR_SURF_TILE_SPLIT_64B       0
+#       define EVERGREEN_ADDR_SURF_TILE_SPLIT_128B      1
+#       define EVERGREEN_ADDR_SURF_TILE_SPLIT_256B      2
+#       define EVERGREEN_ADDR_SURF_TILE_SPLIT_512B      3
+#       define EVERGREEN_ADDR_SURF_TILE_SPLIT_1KB       4
+#       define EVERGREEN_ADDR_SURF_TILE_SPLIT_2KB       5
+#       define EVERGREEN_ADDR_SURF_TILE_SPLIT_4KB       6
+#       define EVERGREEN_GRPH_MACRO_TILE_ASPECT(x)      (((x) & 0x3) << 18)
+#       define EVERGREEN_ADDR_SURF_MACRO_TILE_ASPECT_1  0
+#       define EVERGREEN_ADDR_SURF_MACRO_TILE_ASPECT_2  1
+#       define EVERGREEN_ADDR_SURF_MACRO_TILE_ASPECT_4  2
+#       define EVERGREEN_ADDR_SURF_MACRO_TILE_ASPECT_8  3
 #       define EVERGREEN_GRPH_ARRAY_MODE(x)             (((x) & 0x7) << 20)
 #       define EVERGREEN_GRPH_ARRAY_LINEAR_GENERAL      0
 #       define EVERGREEN_GRPH_ARRAY_LINEAR_ALIGNED      1
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index b937c49054d9..e00039e59a75 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -899,6 +899,10 @@
 #define DB_HTILE_DATA_BASE                              0x28014
 #define DB_Z_INFO                                       0x28040
 #       define Z_ARRAY_MODE(x)                          ((x) << 4)
+#       define DB_TILE_SPLIT(x)                         (((x) & 0x7) << 8)
+#       define DB_NUM_BANKS(x)                          (((x) & 0x3) << 12)
+#       define DB_BANK_WIDTH(x)                         (((x) & 0x3) << 16)
+#       define DB_BANK_HEIGHT(x)                        (((x) & 0x3) << 20)
 #define DB_STENCIL_INFO                                 0x28044
 #define DB_Z_READ_BASE                                  0x28048
 #define DB_STENCIL_READ_BASE                            0x2804c
@@ -951,6 +955,29 @@
 #       define CB_SF_EXPORT_FULL                        0
 #       define CB_SF_EXPORT_NORM                        1
 #define CB_COLOR0_ATTRIB                                0x28c74
+#       define CB_TILE_SPLIT(x)                         (((x) & 0x7) << 5)
+#       define ADDR_SURF_TILE_SPLIT_64B                 0
+#       define ADDR_SURF_TILE_SPLIT_128B                1
+#       define ADDR_SURF_TILE_SPLIT_256B                2
+#       define ADDR_SURF_TILE_SPLIT_512B                3
+#       define ADDR_SURF_TILE_SPLIT_1KB                 4
+#       define ADDR_SURF_TILE_SPLIT_2KB                 5
+#       define ADDR_SURF_TILE_SPLIT_4KB                 6
+#       define CB_NUM_BANKS(x)                          (((x) & 0x3) << 10)
+#       define ADDR_SURF_2_BANK                         0
+#       define ADDR_SURF_4_BANK                         1
+#       define ADDR_SURF_8_BANK                         2
+#       define ADDR_SURF_16_BANK                        3
+#       define CB_BANK_WIDTH(x)                         (((x) & 0x3) << 13)
+#       define ADDR_SURF_BANK_WIDTH_1                   0
+#       define ADDR_SURF_BANK_WIDTH_2                   1
+#       define ADDR_SURF_BANK_WIDTH_4                   2
+#       define ADDR_SURF_BANK_WIDTH_8                   3
+#       define CB_BANK_HEIGHT(x)                        (((x) & 0x3) << 16)
+#       define ADDR_SURF_BANK_HEIGHT_1                  0
+#       define ADDR_SURF_BANK_HEIGHT_2                  1
+#       define ADDR_SURF_BANK_HEIGHT_4                  2
+#       define ADDR_SURF_BANK_HEIGHT_8                  3
 #define CB_COLOR0_DIM                                   0x28c78
 /* only CB0-7 blocks have these regs */
 #define CB_COLOR0_CMASK                                 0x28c7c
@@ -1137,7 +1164,11 @@
 #       define SQ_SEL_1                                 5
 #define SQ_TEX_RESOURCE_WORD5_0                         0x30014
 #define SQ_TEX_RESOURCE_WORD6_0                         0x30018
+#       define TEX_TILE_SPLIT(x)                        (((x) & 0x7) << 29)
 #define SQ_TEX_RESOURCE_WORD7_0                         0x3001c
+#       define TEX_BANK_WIDTH(x)                        (((x) & 0x3) << 8)
+#       define TEX_BANK_HEIGHT(x)                       (((x) & 0x3) << 10)
+#       define TEX_NUM_BANKS(x)                         (((x) & 0x3) << 16)
 
 #define SQ_VTX_CONSTANT_WORD0_0                         0x30000
 #define SQ_VTX_CONSTANT_WORD1_0                         0x30004
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index ad158ea49901..bfc08f6320f8 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -187,13 +187,18 @@ u32 r100_page_flip(struct radeon_device *rdev, int crtc_id, u64 crtc_base)
 {
         struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id];
         u32 tmp = ((u32)crtc_base) | RADEON_CRTC_OFFSET__OFFSET_LOCK;
+        int i;
 
         /* Lock the graphics update lock */
         /* update the scanout addresses */
         WREG32(RADEON_CRTC_OFFSET + radeon_crtc->crtc_offset, tmp);
 
         /* Wait for update_pending to go high. */
-        while (!(RREG32(RADEON_CRTC_OFFSET + radeon_crtc->crtc_offset) & RADEON_CRTC_OFFSET__GUI_TRIG_OFFSET));
+        for (i = 0; i < rdev->usec_timeout; i++) {
+                if (RREG32(RADEON_CRTC_OFFSET + radeon_crtc->crtc_offset) & RADEON_CRTC_OFFSET__GUI_TRIG_OFFSET)
+                        break;
+                udelay(1);
+        }
         DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n");
 
         /* Unlock the lock, so double-buffering can take place inside vblank */
diff --git a/drivers/gpu/drm/radeon/radeon_acpi.c b/drivers/gpu/drm/radeon/radeon_acpi.c
index 3f6636bb2d7f..3516a6081dcf 100644
--- a/drivers/gpu/drm/radeon/radeon_acpi.c
+++ b/drivers/gpu/drm/radeon/radeon_acpi.c
@@ -35,7 +35,8 @@ static int radeon_atif_call(acpi_handle handle)
 
         /* Fail only if calling the method fails and ATIF is supported */
         if (ACPI_FAILURE(status) && status != AE_NOT_FOUND) {
-                printk(KERN_DEBUG "failed to evaluate ATIF got %s\n", acpi_format_exception(status));
+                DRM_DEBUG_DRIVER("failed to evaluate ATIF got %s\n",
+                                 acpi_format_exception(status));
                 kfree(buffer.pointer);
                 return 1;
         }
@@ -50,13 +51,13 @@ int radeon_acpi_init(struct radeon_device *rdev)
         acpi_handle handle;
         int ret;
 
-        /* No need to proceed if we're sure that ATIF is not supported */
-        if (!ASIC_IS_AVIVO(rdev) || !rdev->bios)
-                return 0;
-
         /* Get the device handle */
         handle = DEVICE_ACPI_HANDLE(&rdev->pdev->dev);
 
+        /* No need to proceed if we're sure that ATIF is not supported */
+        if (!ASIC_IS_AVIVO(rdev) || !rdev->bios || !handle)
+                return 0;
+
         /* Call the ATIF method */
         ret = radeon_atif_call(handle);
         if (ret)
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 481b99e89f65..b1053d640423 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -62,6 +62,7 @@ u32 rs600_page_flip(struct radeon_device *rdev, int crtc_id, u64 crtc_base)
 {
         struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id];
         u32 tmp = RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset);
+        int i;
 
         /* Lock the graphics update lock */
         tmp |= AVIVO_D1GRPH_UPDATE_LOCK;
@@ -74,7 +75,11 @@ u32 rs600_page_flip(struct radeon_device *rdev, int crtc_id, u64 crtc_base)
                (u32)crtc_base);
 
         /* Wait for update_pending to go high. */
-        while (!(RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING));
+        for (i = 0; i < rdev->usec_timeout; i++) {
+                if (RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING)
+                        break;
+                udelay(1);
+        }
         DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n");
 
         /* Unlock the lock, so double-buffering can take place inside vblank */
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index a983f410ab89..23ae1c60ab3d 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -47,6 +47,7 @@ u32 rv770_page_flip(struct radeon_device *rdev, int crtc_id, u64 crtc_base)
 {
         struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc_id];
         u32 tmp = RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset);
+        int i;
 
         /* Lock the graphics update lock */
         tmp |= AVIVO_D1GRPH_UPDATE_LOCK;
@@ -66,7 +67,11 @@ u32 rv770_page_flip(struct radeon_device *rdev, int crtc_id, u64 crtc_base)
                (u32)crtc_base);
 
         /* Wait for update_pending to go high. */
-        while (!(RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING));
+        for (i = 0; i < rdev->usec_timeout; i++) {
+                if (RREG32(AVIVO_D1GRPH_UPDATE + radeon_crtc->crtc_offset) & AVIVO_D1GRPH_SURFACE_UPDATE_PENDING)
+                        break;
+                udelay(1);
+        }
         DRM_DEBUG("Update pending now high. Unlocking vupdate_lock.\n");
 
         /* Unlock the lock, so double-buffering can take place inside vblank */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 880e285d7578..37d40545ed77 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1809,7 +1809,8 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
         }
 
         rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
-        rects = kzalloc(rects_size, GFP_KERNEL);
+        rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
+                        GFP_KERNEL);
         if (unlikely(!rects)) {
                 ret = -ENOMEM;
                 goto out_unlock;
@@ -1824,10 +1825,10 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
         }
 
         for (i = 0; i < arg->num_outputs; ++i) {
-                if (rects->x < 0 ||
-                    rects->y < 0 ||
-                    rects->x + rects->w > mode_config->max_width ||
-                    rects->y + rects->h > mode_config->max_height) {
+                if (rects[i].x < 0 ||
+                    rects[i].y < 0 ||
+                    rects[i].x + rects[i].w > mode_config->max_width ||
+                    rects[i].y + rects[i].h > mode_config->max_height) {
                         DRM_ERROR("Invalid GUI layout.\n");
                         ret = -EINVAL;
                         goto out_free;
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 848a56c0279c..af353842f75f 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1771,8 +1771,8 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC5UH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC4UM) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0001) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0002) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0003) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GENERAL_TOUCH, 0x0004) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GLAB, USB_DEVICE_ID_4_PHIDGETSERVO_30) },
         { HID_USB_DEVICE(USB_VENDOR_ID_GLAB, USB_DEVICE_ID_1_PHIDGETSERVO_30) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 06ce996b8b65..4a441a6f9967 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -266,7 +266,7 @@
 #define USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR  0x0002
 
 #define USB_VENDOR_ID_GENERAL_TOUCH     0x0dfc
-#define USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS 0x0001
+#define USB_DEVICE_ID_GENERAL_TOUCH_WIN7_TWOFINGERS 0x0003
 
 #define USB_VENDOR_ID_GLAB              0x06c2
 #define USB_DEVICE_ID_4_PHIDGETSERVO_30 0x0038
diff --git a/drivers/hwmon/ad7314.c b/drivers/hwmon/ad7314.c
index 318e38e85376..5d760f3d21c2 100644
--- a/drivers/hwmon/ad7314.c
+++ b/drivers/hwmon/ad7314.c
@@ -160,7 +160,6 @@ MODULE_DEVICE_TABLE(spi, ad7314_id);
 static struct spi_driver ad7314_driver = {
         .driver = {
                 .name = "ad7314",
-                .bus = &spi_bus_type,
                 .owner = THIS_MODULE,
         },
         .probe = ad7314_probe,
diff --git a/drivers/hwmon/ads7871.c b/drivers/hwmon/ads7871.c
index 52319340e182..04450f8bf5da 100644
--- a/drivers/hwmon/ads7871.c
+++ b/drivers/hwmon/ads7871.c
@@ -227,7 +227,6 @@ static int __devexit ads7871_remove(struct spi_device *spi)
 static struct spi_driver ads7871_driver = {
         .driver = {
                 .name = DEVICE_NAME,
-                .bus = &spi_bus_type,
                 .owner = THIS_MODULE,
         },
 
diff --git a/drivers/hwmon/exynos4_tmu.c b/drivers/hwmon/exynos4_tmu.c
index faa0884f61f6..f2359a0093bd 100644
--- a/drivers/hwmon/exynos4_tmu.c
+++ b/drivers/hwmon/exynos4_tmu.c
@@ -506,17 +506,7 @@ static struct platform_driver exynos4_tmu_driver = {
         .resume = exynos4_tmu_resume,
 };
 
-static int __init exynos4_tmu_driver_init(void)
-{
-        return platform_driver_register(&exynos4_tmu_driver);
-}
-module_init(exynos4_tmu_driver_init);
-
-static void __exit exynos4_tmu_driver_exit(void)
-{
-        platform_driver_unregister(&exynos4_tmu_driver);
-}
-module_exit(exynos4_tmu_driver_exit);
+module_platform_driver(exynos4_tmu_driver);
 
 MODULE_DESCRIPTION("EXYNOS4 TMU Driver");
 MODULE_AUTHOR("Donggeun Kim <dg77.kim@samsung.com>");
diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c
index 89aa9fb743af..9ba38f318ffb 100644
--- a/drivers/hwmon/gpio-fan.c
+++ b/drivers/hwmon/gpio-fan.c
@@ -539,18 +539,7 @@ static struct platform_driver gpio_fan_driver = {
         },
 };
 
-static int __init gpio_fan_init(void)
-{
-        return platform_driver_register(&gpio_fan_driver);
-}
-
-static void __exit gpio_fan_exit(void)
-{
-        platform_driver_unregister(&gpio_fan_driver);
-}
-
-module_init(gpio_fan_init);
-module_exit(gpio_fan_exit);
+module_platform_driver(gpio_fan_driver);
 
 MODULE_AUTHOR("Simon Guinot <sguinot@lacie.com>");
 MODULE_DESCRIPTION("GPIO FAN driver");
diff --git a/drivers/hwmon/jz4740-hwmon.c b/drivers/hwmon/jz4740-hwmon.c
index fea292d43407..7a48b1eb4233 100644
--- a/drivers/hwmon/jz4740-hwmon.c
+++ b/drivers/hwmon/jz4740-hwmon.c
@@ -212,17 +212,7 @@ struct platform_driver jz4740_hwmon_driver = {
         },
 };
 
-static int __init jz4740_hwmon_init(void)
-{
-        return platform_driver_register(&jz4740_hwmon_driver);
-}
-module_init(jz4740_hwmon_init);
-
-static void __exit jz4740_hwmon_exit(void)
-{
-        platform_driver_unregister(&jz4740_hwmon_driver);
-}
-module_exit(jz4740_hwmon_exit);
+module_platform_driver(jz4740_hwmon_driver);
 
 MODULE_DESCRIPTION("JZ4740 SoC HWMON driver");
 MODULE_AUTHOR("Lars-Peter Clausen <lars@metafoo.de>");
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index eab11615dced..9b382ec2c3bd 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -432,19 +432,7 @@ static struct platform_driver ntc_thermistor_driver = {
         .id_table = ntc_thermistor_id,
 };
 
-static int __init ntc_thermistor_init(void)
-{
-        return platform_driver_register(&ntc_thermistor_driver);
-}
-
-module_init(ntc_thermistor_init);
-
-static void __exit ntc_thermistor_cleanup(void)
-{
-        platform_driver_unregister(&ntc_thermistor_driver);
-}
-
-module_exit(ntc_thermistor_cleanup);
+module_platform_driver(ntc_thermistor_driver);
 
 MODULE_DESCRIPTION("NTC Thermistor Driver");
 MODULE_AUTHOR("MyungJoo Ham <myungjoo.ham@samsung.com>");
diff --git a/drivers/hwmon/s3c-hwmon.c b/drivers/hwmon/s3c-hwmon.c
index b39f52e2752a..f6c26d19f521 100644
--- a/drivers/hwmon/s3c-hwmon.c
+++ b/drivers/hwmon/s3c-hwmon.c
@@ -393,18 +393,7 @@ static struct platform_driver s3c_hwmon_driver = {
         .remove         = __devexit_p(s3c_hwmon_remove),
 };
 
-static int __init s3c_hwmon_init(void)
-{
-        return platform_driver_register(&s3c_hwmon_driver);
-}
-
-static void __exit s3c_hwmon_exit(void)
-{
-        platform_driver_unregister(&s3c_hwmon_driver);
-}
-
-module_init(s3c_hwmon_init);
-module_exit(s3c_hwmon_exit);
+module_platform_driver(s3c_hwmon_driver);
 
 MODULE_AUTHOR("Ben Dooks <ben@simtec.co.uk>");
 MODULE_DESCRIPTION("S3C ADC HWMon driver");
diff --git a/drivers/hwmon/sch5627.c b/drivers/hwmon/sch5627.c
index e3b5c6039c25..79b6dabe3161 100644
--- a/drivers/hwmon/sch5627.c
+++ b/drivers/hwmon/sch5627.c
@@ -590,19 +590,8 @@ static struct platform_driver sch5627_driver = {
         .remove         = sch5627_remove,
 };
 
-static int __init sch5627_init(void)
-{
-        return platform_driver_register(&sch5627_driver);
-}
-
-static void __exit sch5627_exit(void)
-{
-        platform_driver_unregister(&sch5627_driver);
-}
+module_platform_driver(sch5627_driver);
 
 MODULE_DESCRIPTION("SMSC SCH5627 Hardware Monitoring Driver");
 MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
 MODULE_LICENSE("GPL");
-
-module_init(sch5627_init);
-module_exit(sch5627_exit);
diff --git a/drivers/hwmon/sch5636.c b/drivers/hwmon/sch5636.c
index 244407aa79fc..9d5236fb09b4 100644
--- a/drivers/hwmon/sch5636.c
+++ b/drivers/hwmon/sch5636.c
@@ -521,19 +521,8 @@ static struct platform_driver sch5636_driver = {
         .remove         = sch5636_remove,
 };
 
-static int __init sch5636_init(void)
-{
-        return platform_driver_register(&sch5636_driver);
-}
-
-static void __exit sch5636_exit(void)
-{
-        platform_driver_unregister(&sch5636_driver);
-}
+module_platform_driver(sch5636_driver);
 
 MODULE_DESCRIPTION("SMSC SCH5636 Hardware Monitoring Driver");
 MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
 MODULE_LICENSE("GPL");
-
-module_init(sch5636_init);
-module_exit(sch5636_exit);
diff --git a/drivers/hwmon/twl4030-madc-hwmon.c b/drivers/hwmon/twl4030-madc-hwmon.c
index 57240740b161..0018c7dd0097 100644
--- a/drivers/hwmon/twl4030-madc-hwmon.c
+++ b/drivers/hwmon/twl4030-madc-hwmon.c
@@ -136,19 +136,7 @@ static struct platform_driver twl4030_madc_hwmon_driver = {
                    },
 };
 
-static int __init twl4030_madc_hwmon_init(void)
-{
-        return platform_driver_register(&twl4030_madc_hwmon_driver);
-}
-
-module_init(twl4030_madc_hwmon_init);
-
-static void __exit twl4030_madc_hwmon_exit(void)
-{
-        platform_driver_unregister(&twl4030_madc_hwmon_driver);
-}
-
-module_exit(twl4030_madc_hwmon_exit);
+module_platform_driver(twl4030_madc_hwmon_driver);
 
 MODULE_DESCRIPTION("TWL4030 ADC Hwmon driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/hwmon/ultra45_env.c b/drivers/hwmon/ultra45_env.c
index 3cd07bf42dca..b9a87e89bab4 100644
--- a/drivers/hwmon/ultra45_env.c
+++ b/drivers/hwmon/ultra45_env.c
@@ -309,15 +309,4 @@ static struct platform_driver env_driver = {
         .remove         = __devexit_p(env_remove),
 };
 
-static int __init env_init(void)
-{
-        return platform_driver_register(&env_driver);
-}
-
-static void __exit env_exit(void)
-{
-        platform_driver_unregister(&env_driver);
-}
-
-module_init(env_init);
-module_exit(env_exit);
+module_platform_driver(env_driver);
diff --git a/drivers/hwmon/wm831x-hwmon.c b/drivers/hwmon/wm831x-hwmon.c
index 97b1f834a471..9b598ed26020 100644
--- a/drivers/hwmon/wm831x-hwmon.c
+++ b/drivers/hwmon/wm831x-hwmon.c
@@ -209,17 +209,7 @@ static struct platform_driver wm831x_hwmon_driver = {
         },
 };
 
-static int __init wm831x_hwmon_init(void)
-{
-        return platform_driver_register(&wm831x_hwmon_driver);
-}
-module_init(wm831x_hwmon_init);
-
-static void __exit wm831x_hwmon_exit(void)
-{
-        platform_driver_unregister(&wm831x_hwmon_driver);
-}
-module_exit(wm831x_hwmon_exit);
+module_platform_driver(wm831x_hwmon_driver);
 
 MODULE_AUTHOR("Mark Brown <broonie@opensource.wolfsonmicro.com>");
 MODULE_DESCRIPTION("WM831x Hardware Monitoring");
diff --git a/drivers/hwmon/wm8350-hwmon.c b/drivers/hwmon/wm8350-hwmon.c
index 13290595ca86..3ff67edbdc44 100644
--- a/drivers/hwmon/wm8350-hwmon.c
+++ b/drivers/hwmon/wm8350-hwmon.c
@@ -133,17 +133,7 @@ static struct platform_driver wm8350_hwmon_driver = {
         },
 };
 
-static int __init wm8350_hwmon_init(void)
-{
-        return platform_driver_register(&wm8350_hwmon_driver);
-}
-module_init(wm8350_hwmon_init);
-
-static void __exit wm8350_hwmon_exit(void)
-{
-        platform_driver_unregister(&wm8350_hwmon_driver);
-}
-module_exit(wm8350_hwmon_exit);
+module_platform_driver(wm8350_hwmon_driver);
 
 MODULE_AUTHOR("Mark Brown <broonie@opensource.wolfsonmicro.com>");
 MODULE_DESCRIPTION("WM8350 Hardware Monitoring");
diff --git a/drivers/i2c/busses/i2c-nuc900.c b/drivers/i2c/busses/i2c-nuc900.c
index 835e47b39bc2..03b615778887 100644
--- a/drivers/i2c/busses/i2c-nuc900.c
+++ b/drivers/i2c/busses/i2c-nuc900.c
@@ -593,7 +593,7 @@ static int __devinit nuc900_i2c_probe(struct platform_device *pdev)
         i2c->adap.algo_data = i2c;
         i2c->adap.dev.parent = &pdev->dev;
 
-        mfp_set_groupg(&pdev->dev);
+        mfp_set_groupg(&pdev->dev, NULL);
 
         clk_get_rate(i2c->clk);
 
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index 691276bafd78..e9cf51b1343b 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -216,7 +216,9 @@ static int addr4_resolve(struct sockaddr_in *src_in,
 
         neigh = neigh_lookup(&arp_tbl, &rt->rt_gateway, rt->dst.dev);
         if (!neigh || !(neigh->nud_state & NUD_VALID)) {
+                rcu_read_lock();
                 neigh_event_send(dst_get_neighbour(&rt->dst), NULL);
+                rcu_read_unlock();
                 ret = -ENODATA;
                 if (neigh)
                         goto release;
@@ -274,15 +276,16 @@ static int addr6_resolve(struct sockaddr_in6 *src_in,
                 goto put;
         }
 
+        rcu_read_lock();
         neigh = dst_get_neighbour(dst);
         if (!neigh || !(neigh->nud_state & NUD_VALID)) {
                 if (neigh)
                         neigh_event_send(neigh, NULL);
                 ret = -ENODATA;
-                goto put;
+        } else {
+                ret = rdma_copy_addr(addr, dst->dev, neigh->ha);
         }
-
-        ret = rdma_copy_addr(addr, dst->dev, neigh->ha);
+        rcu_read_unlock();
 put:
         dst_release(dst);
         return ret;
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index de6d0774e609..c88b12beef25 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -1375,8 +1375,10 @@ static int pass_accept_req(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                 goto reject;
         }
         dst = &rt->dst;
+        rcu_read_lock();
         neigh = dst_get_neighbour(dst);
         l2t = t3_l2t_get(tdev, neigh, neigh->dev);
+        rcu_read_unlock();
         if (!l2t) {
                 printk(KERN_ERR MOD "%s - failed to allocate l2t entry!\n",
                        __func__);
@@ -1946,10 +1948,12 @@ int iwch_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         }
         ep->dst = &rt->dst;
 
+        rcu_read_lock();
         neigh = dst_get_neighbour(ep->dst);
 
         /* get a l2t entry */
         ep->l2t = t3_l2t_get(ep->com.tdev, neigh, neigh->dev);
+        rcu_read_unlock();
         if (!ep->l2t) {
                 printk(KERN_ERR MOD "%s - cannot alloc l2e.\n", __func__);
                 err = -ENOMEM;
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index b36cdac9c558..0747004313ad 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -542,8 +542,10 @@ static void send_mpa_req(struct c4iw_ep *ep, struct sk_buff *skb,
                      (mpa_rev_to_use == 2 ? MPA_ENHANCED_RDMA_CONN : 0);
         mpa->private_data_size = htons(ep->plen);
         mpa->revision = mpa_rev_to_use;
-        if (mpa_rev_to_use == 1)
+        if (mpa_rev_to_use == 1) {
                 ep->tried_with_mpa_v1 = 1;
+                ep->retry_with_mpa_v1 = 0;
+        }
 
         if (mpa_rev_to_use == 2) {
                 mpa->private_data_size +=
@@ -1594,6 +1596,7 @@ static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb)
                 goto reject;
         }
         dst = &rt->dst;
+        rcu_read_lock();
         neigh = dst_get_neighbour(dst);
         if (neigh->dev->flags & IFF_LOOPBACK) {
                 pdev = ip_dev_find(&init_net, peer_ip);
@@ -1620,6 +1623,7 @@ static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb)
                 rss_qid = dev->rdev.lldi.rxq_ids[
                           cxgb4_port_idx(neigh->dev) * step];
         }
+        rcu_read_unlock();
         if (!l2t) {
                 printk(KERN_ERR MOD "%s - failed to allocate l2t entry!\n",
                        __func__);
@@ -1820,6 +1824,7 @@ static int c4iw_reconnect(struct c4iw_ep *ep)
         }
         ep->dst = &rt->dst;
 
+        rcu_read_lock();
         neigh = dst_get_neighbour(ep->dst);
 
         /* get a l2t entry */
@@ -1856,6 +1861,7 @@ static int c4iw_reconnect(struct c4iw_ep *ep)
                 ep->rss_qid = ep->com.dev->rdev.lldi.rxq_ids[
                         cxgb4_port_idx(neigh->dev) * step];
         }
+        rcu_read_unlock();
         if (!ep->l2t) {
                 printk(KERN_ERR MOD "%s - cannot alloc l2e.\n", __func__);
                 err = -ENOMEM;
@@ -2301,6 +2307,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         }
         ep->dst = &rt->dst;
 
+        rcu_read_lock();
         neigh = dst_get_neighbour(ep->dst);
 
         /* get a l2t entry */
@@ -2339,6 +2346,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                 ep->retry_with_mpa_v1 = 0;
                 ep->tried_with_mpa_v1 = 0;
         }
+        rcu_read_unlock();
         if (!ep->l2t) {
                 printk(KERN_ERR MOD "%s - cannot alloc l2e.\n", __func__);
                 err = -ENOMEM;
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index f35a935267e7..0f1607c8325a 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -311,7 +311,7 @@ void c4iw_count_rcqes(struct t4_cq *cq, struct t4_wq *wq, int *count)
         while (ptr != cq->sw_pidx) {
                 cqe = &cq->sw_queue[ptr];
                 if (RQ_TYPE(cqe) && (CQE_OPCODE(cqe) != FW_RI_READ_RESP) &&
-                    (CQE_QPID(cqe) == wq->rq.qid) && cqe_completes_wr(cqe, wq))
+                    (CQE_QPID(cqe) == wq->sq.qid) && cqe_completes_wr(cqe, wq))
                         (*count)++;
                 if (++ptr == cq->size)
                         ptr = 0;
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index dfce9ea98a39..0a52d72371ee 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -1377,9 +1377,11 @@ static int nes_addr_resolve_neigh(struct nes_vnic *nesvnic, u32 dst_ip, int arpi
                 neigh_release(neigh);
         }
 
-        if ((neigh == NULL) || (!(neigh->nud_state & NUD_VALID)))
+        if ((neigh == NULL) || (!(neigh->nud_state & NUD_VALID))) {
+                rcu_read_lock();
                 neigh_event_send(dst_get_neighbour(&rt->dst), NULL);
-
+                rcu_read_unlock();
+        }
         ip_rt_put(rt);
         return rc;
 }
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 5bd2162b95dc..1d5895941e19 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -2307,19 +2307,11 @@ static int qib_7322_bringup_serdes(struct qib_pportdata *ppd)
                 SYM_LSB(IBCCtrlA_0, MaxPktLen);
         ppd->cpspec->ibcctrl_a = ibc; /* without linkcmd or linkinitcmd! */
 
-        /* initially come up waiting for TS1, without sending anything. */
-        val = ppd->cpspec->ibcctrl_a | (QLOGIC_IB_IBCC_LINKINITCMD_DISABLE <<
-                QLOGIC_IB_IBCC_LINKINITCMD_SHIFT);
-
-        ppd->cpspec->ibcctrl_a = val;
         /*
          * Reset the PCS interface to the serdes (and also ibc, which is still
          * in reset from above).  Writes new value of ibcctrl_a as last step.
          */
         qib_7322_mini_pcs_reset(ppd);
-        qib_write_kreg(dd, kr_scratch, 0ULL);
-        /* clear the linkinit cmds */
-        ppd->cpspec->ibcctrl_a &= ~SYM_MASK(IBCCtrlA_0, LinkInitCmd);
 
         if (!ppd->cpspec->ibcctrl_b) {
                 unsigned lse = ppd->link_speed_enabled;
@@ -2385,6 +2377,14 @@ static int qib_7322_bringup_serdes(struct qib_pportdata *ppd)
         ppd->cpspec->ibcctrl_a |= SYM_MASK(IBCCtrlA_0, IBLinkEn);
         set_vls(ppd);
 
+        /* initially come up DISABLED, without sending anything. */
+        val = ppd->cpspec->ibcctrl_a | (QLOGIC_IB_IBCC_LINKINITCMD_DISABLE <<
+                                        QLOGIC_IB_IBCC_LINKINITCMD_SHIFT);
+        qib_write_kreg_port(ppd, krp_ibcctrl_a, val);
+        qib_write_kreg(dd, kr_scratch, 0ULL);
+        /* clear the linkinit cmds */
+        ppd->cpspec->ibcctrl_a = val & ~SYM_MASK(IBCCtrlA_0, LinkInitCmd);
+
         /* be paranoid against later code motion, etc. */
         spin_lock_irqsave(&dd->cspec->rcvmod_lock, flags);
         ppd->p_rcvctrl |= SYM_MASK(RcvCtrl_0, RcvIBPortEnable);
@@ -5241,7 +5241,7 @@ static int qib_7322_ib_updown(struct qib_pportdata *ppd, int ibup, u64 ibcs)
                            off */
                         if (ppd->dd->flags & QIB_HAS_QSFP) {
                                 qd->t_insert = get_jiffies_64();
-                                schedule_work(&qd->work);
+                                queue_work(ib_wq, &qd->work);
                         }
                         spin_lock_irqsave(&ppd->sdma_lock, flags);
                         if (__qib_sdma_running(ppd))
diff --git a/drivers/infiniband/hw/qib/qib_qsfp.c b/drivers/infiniband/hw/qib/qib_qsfp.c
index e06c4ed383f1..fa71b1e666c5 100644
--- a/drivers/infiniband/hw/qib/qib_qsfp.c
+++ b/drivers/infiniband/hw/qib/qib_qsfp.c
@@ -480,18 +480,6 @@ void qib_qsfp_init(struct qib_qsfp_data *qd,
         udelay(20); /* Generous RST dwell */
 
         dd->f_gpio_mod(dd, mask, mask, mask);
-        /* Spec says module can take up to two seconds! */
-        mask = QSFP_GPIO_MOD_PRS_N;
-        if (qd->ppd->hw_pidx)
-                mask <<= QSFP_GPIO_PORT2_SHIFT;
-
-        /* Do not try to wait here. Better to let event handle it */
-        if (!qib_qsfp_mod_present(qd->ppd))
-                goto bail;
-        /* We see a module, but it may be unwise to look yet. Just schedule */
-        qd->t_insert = get_jiffies_64();
-        queue_work(ib_wq, &qd->work);
-bail:
         return;
 }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 0ef9af94997d..4115be54ba3b 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -57,21 +57,24 @@ struct ipoib_ah *ipoib_create_ah(struct net_device *dev,
                                  struct ib_pd *pd, struct ib_ah_attr *attr)
 {
         struct ipoib_ah *ah;
+        struct ib_ah *vah;
 
         ah = kmalloc(sizeof *ah, GFP_KERNEL);
         if (!ah)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         ah->dev       = dev;
         ah->last_send = 0;
         kref_init(&ah->ref);
 
-        ah->ah = ib_create_ah(pd, attr);
-        if (IS_ERR(ah->ah)) {
+        vah = ib_create_ah(pd, attr);
+        if (IS_ERR(vah)) {
                 kfree(ah);
-                ah = NULL;
-        } else
+                ah = (struct ipoib_ah *)vah;
+        } else {
+                ah->ah = vah;
                 ipoib_dbg(netdev_priv(dev), "Created ah %p\n", ah->ah);
+        }
 
         return ah;
 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 7567b6000230..83695b48b010 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -432,7 +432,7 @@ static void path_rec_completion(int status,
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        if (ah) {
+        if (!IS_ERR_OR_NULL(ah)) {
                 path->pathrec = *pathrec;
 
                 old_ah   = path->ah;
@@ -555,6 +555,7 @@ static int path_rec_start(struct net_device *dev,
         return 0;
 }
 
+/* called with rcu_read_lock */
 static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
@@ -636,6 +637,7 @@ err_drop:
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
+/* called with rcu_read_lock */
 static void ipoib_path_lookup(struct sk_buff *skb, struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = netdev_priv(skb->dev);
@@ -720,13 +722,14 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct neighbour *n = NULL;
         unsigned long flags;
 
+        rcu_read_lock();
         if (likely(skb_dst(skb)))
                 n = dst_get_neighbour(skb_dst(skb));
 
         if (likely(n)) {
                 if (unlikely(!*to_ipoib_neigh(n))) {
                         ipoib_path_lookup(skb, dev);
-                        return NETDEV_TX_OK;
+                        goto unlock;
                 }
 
                 neigh = *to_ipoib_neigh(n);
@@ -749,17 +752,17 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         ipoib_neigh_free(dev, neigh);
                         spin_unlock_irqrestore(&priv->lock, flags);
                         ipoib_path_lookup(skb, dev);
-                        return NETDEV_TX_OK;
+                        goto unlock;
                 }
 
                 if (ipoib_cm_get(neigh)) {
                         if (ipoib_cm_up(neigh)) {
                                 ipoib_cm_send(dev, skb, ipoib_cm_get(neigh));
-                                return NETDEV_TX_OK;
+                                goto unlock;
                         }
                 } else if (neigh->ah) {
                         ipoib_send(dev, skb, neigh->ah, IPOIB_QPN(n->ha));
-                        return NETDEV_TX_OK;
+                        goto unlock;
                 }
 
                 if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
@@ -793,13 +796,14 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                            phdr->hwaddr + 4);
                                 dev_kfree_skb_any(skb);
                                 ++dev->stats.tx_dropped;
-                                return NETDEV_TX_OK;
+                                goto unlock;
                         }
 
                         unicast_arp_send(skb, dev, phdr);
                 }
         }
-
+unlock:
+        rcu_read_unlock();
         return NETDEV_TX_OK;
 }
 
@@ -837,7 +841,7 @@ static int ipoib_hard_header(struct sk_buff *skb,
         dst = skb_dst(skb);
         n = NULL;
         if (dst)
-                n = dst_get_neighbour(dst);
+                n = dst_get_neighbour_raw(dst);
         if ((!dst || !n) && daddr) {
                 struct ipoib_pseudoheader *phdr =
                         (struct ipoib_pseudoheader *) skb_push(skb, sizeof *phdr);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 1b7a97686356..873bff97e69e 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -240,8 +240,11 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
                 av.grh.dgid = mcast->mcmember.mgid;
 
                 ah = ipoib_create_ah(dev, priv->pd, &av);
-                if (!ah) {
-                        ipoib_warn(priv, "ib_address_create failed\n");
+                if (IS_ERR(ah)) {
+                        ipoib_warn(priv, "ib_address_create failed %ld\n",
+                                -PTR_ERR(ah));
+                        /* use original error */
+                        return PTR_ERR(ah);
                 } else {
                         spin_lock_irq(&priv->lock);
                         mcast->ah = ah;
@@ -266,7 +269,7 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
 
                 skb->dev = dev;
                 if (dst)
-                        n = dst_get_neighbour(dst);
+                        n = dst_get_neighbour_raw(dst);
                 if (!dst || !n) {
                         /* put pseudoheader back on for next time */
                         skb_push(skb, sizeof (struct ipoib_pseudoheader));
@@ -722,6 +725,8 @@ out:
         if (mcast && mcast->ah) {
                 struct dst_entry *dst = skb_dst(skb);
                 struct neighbour *n = NULL;
+
+                rcu_read_lock();
                 if (dst)
                         n = dst_get_neighbour(dst);
                 if (n && !*to_ipoib_neigh(n)) {
@@ -734,7 +739,7 @@ out:
                                 list_add_tail(&neigh->list, &mcast->neigh_list);
                         }
                 }
-
+                rcu_read_unlock();
                 spin_unlock_irqrestore(&priv->lock, flags);
                 ipoib_send(dev, skb, mcast->ah, IB_MULTICAST_QPN);
                 return;
diff --git a/drivers/isdn/divert/divert_procfs.c b/drivers/isdn/divert/divert_procfs.c
index 33ec9e467772..9021182c4b76 100644
--- a/drivers/isdn/divert/divert_procfs.c
+++ b/drivers/isdn/divert/divert_procfs.c
@@ -242,6 +242,12 @@ static int isdn_divert_ioctl_unlocked(struct file *file, uint cmd, ulong arg)
                 case IIOCDOCFINT:
                         if (!divert_if.drv_to_name(dioctl.cf_ctrl.drvid))
                                 return (-EINVAL);       /* invalid driver */
+                        if (strnlen(dioctl.cf_ctrl.msn, sizeof(dioctl.cf_ctrl.msn)) ==
+                                        sizeof(dioctl.cf_ctrl.msn))
+                                return -EINVAL;
+                        if (strnlen(dioctl.cf_ctrl.fwd_nr, sizeof(dioctl.cf_ctrl.fwd_nr)) ==
+                                        sizeof(dioctl.cf_ctrl.fwd_nr))
+                                return -EINVAL;
                         if ((i = cf_command(dioctl.cf_ctrl.drvid,
                                             (cmd == IIOCDOCFACT) ? 1 : (cmd == IIOCDOCFDIS) ? 0 : 2,
                                             dioctl.cf_ctrl.cfproc,
diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
index 1f73d7f7e024..2339d7396b9e 100644
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -2756,6 +2756,9 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg)
                         char *c,
                         *e;
 
+                        if (strnlen(cfg->drvid, sizeof(cfg->drvid)) ==
+                                        sizeof(cfg->drvid))
+                                return -EINVAL;
                         drvidx = -1;
                         chidx = -1;
                         strcpy(drvid, cfg->drvid);
diff --git a/drivers/net/arcnet/Kconfig b/drivers/net/arcnet/Kconfig
index a73d9dc80ff6..84fb6349a59a 100644
--- a/drivers/net/arcnet/Kconfig
+++ b/drivers/net/arcnet/Kconfig
@@ -4,7 +4,7 @@
 
 menuconfig ARCNET
         depends on NETDEVICES && (ISA || PCI || PCMCIA)
-        bool "ARCnet support"
+        tristate "ARCnet support"
         ---help---
           If you have a network card of this type, say Y and check out the
           (arguably) beautiful poetry in
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b0c577256487..7f8756825b8a 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2553,30 +2553,6 @@ re_arm:
         }
 }
 
-static __be32 bond_glean_dev_ip(struct net_device *dev)
-{
-        struct in_device *idev;
-        struct in_ifaddr *ifa;
-        __be32 addr = 0;
-
-        if (!dev)
-                return 0;
-
-        rcu_read_lock();
-        idev = __in_dev_get_rcu(dev);
-        if (!idev)
-                goto out;
-
-        ifa = idev->ifa_list;
-        if (!ifa)
-                goto out;
-
-        addr = ifa->ifa_local;
-out:
-        rcu_read_unlock();
-        return addr;
-}
-
 static int bond_has_this_ip(struct bonding *bond, __be32 ip)
 {
         struct vlan_entry *vlan;
@@ -3322,6 +3298,10 @@ static int bond_inetaddr_event(struct notifier_block *this, unsigned long event,
         struct bonding *bond;
         struct vlan_entry *vlan;
 
+        /* we only care about primary address */
+        if(ifa->ifa_flags & IFA_F_SECONDARY)
+                return NOTIFY_DONE;
+
         list_for_each_entry(bond, &bn->dev_list, bond_list) {
                 if (bond->dev == event_dev) {
                         switch (event) {
@@ -3329,7 +3309,7 @@ static int bond_inetaddr_event(struct notifier_block *this, unsigned long event,
                                 bond->master_ip = ifa->ifa_local;
                                 return NOTIFY_OK;
                         case NETDEV_DOWN:
-                                bond->master_ip = bond_glean_dev_ip(bond->dev);
+                                bond->master_ip = 0;
                                 return NOTIFY_OK;
                         default:
                                 return NOTIFY_DONE;
@@ -3345,8 +3325,7 @@ static int bond_inetaddr_event(struct notifier_block *this, unsigned long event,
                                         vlan->vlan_ip = ifa->ifa_local;
                                         return NOTIFY_OK;
                                 case NETDEV_DOWN:
-                                        vlan->vlan_ip =
-                                                bond_glean_dev_ip(vlan_dev);
+                                        vlan->vlan_ip = 0;
                                         return NOTIFY_OK;
                                 default:
                                         return NOTIFY_DONE;
diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
index 905bce0b3a43..2c7f5036f570 100644
--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -20,7 +20,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/netdevice.h>
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 4cf835dbc122..3fb66d09ece5 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -608,7 +608,7 @@ static void b44_tx(struct b44 *bp)
                                  skb->len,
                                  DMA_TO_DEVICE);
                 rp->skb = NULL;
-                dev_kfree_skb(skb);
+                dev_kfree_skb_irq(skb);
         }
 
         bp->tx_cons = cons;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index bce203fa4b9e..882f48f0a03c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -10327,6 +10327,43 @@ static int bnx2x_54618se_config_init(struct bnx2x_phy *phy,
         return 0;
 }
 
+
+static void bnx2x_5461x_set_link_led(struct bnx2x_phy *phy,
+                                       struct link_params *params, u8 mode)
+{
+        struct bnx2x *bp = params->bp;
+        u16 temp;
+
+        bnx2x_cl22_write(bp, phy,
+                MDIO_REG_GPHY_SHADOW,
+                MDIO_REG_GPHY_SHADOW_LED_SEL1);
+        bnx2x_cl22_read(bp, phy,
+                MDIO_REG_GPHY_SHADOW,
+                &temp);
+        temp &= 0xff00;
+
+        DP(NETIF_MSG_LINK, "54618x set link led (mode=%x)\n", mode);
+        switch (mode) {
+        case LED_MODE_FRONT_PANEL_OFF:
+        case LED_MODE_OFF:
+                temp |= 0x00ee;
+                break;
+        case LED_MODE_OPER:
+                temp |= 0x0001;
+                break;
+        case LED_MODE_ON:
+                temp |= 0x00ff;
+                break;
+        default:
+                break;
+        }
+        bnx2x_cl22_write(bp, phy,
+                MDIO_REG_GPHY_SHADOW,
+                MDIO_REG_GPHY_SHADOW_WR_ENA | temp);
+        return;
+}
+
+
 static void bnx2x_54618se_link_reset(struct bnx2x_phy *phy,
                                      struct link_params *params)
 {
@@ -11103,7 +11140,7 @@ static struct bnx2x_phy phy_54618se = {
         .config_loopback = (config_loopback_t)bnx2x_54618se_config_loopback,
         .format_fw_ver  = (format_fw_ver_t)NULL,
         .hw_reset       = (hw_reset_t)NULL,
-        .set_link_led   = (set_link_led_t)NULL,
+        .set_link_led   = (set_link_led_t)bnx2x_5461x_set_link_led,
         .phy_specific_func = (phy_specific_func_t)NULL
 };
 /*****************************************************************/
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
index fc7bd0f23c0b..e58073ef33b4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
@@ -6990,6 +6990,7 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_REG_INTR_MASK                              0x1b
 #define MDIO_REG_INTR_MASK_LINK_STATUS                  (0x1 << 1)
 #define MDIO_REG_GPHY_SHADOW                            0x1c
+#define MDIO_REG_GPHY_SHADOW_LED_SEL1                   (0x0d << 10)
 #define MDIO_REG_GPHY_SHADOW_LED_SEL2                   (0x0e << 10)
 #define MDIO_REG_GPHY_SHADOW_WR_ENA                     (0x1 << 15)
 #define MDIO_REG_GPHY_SHADOW_AUTO_DET_MED               (0x1e << 10)
diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index 438f4580bf66..2a22f5256353 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -613,7 +613,7 @@ static int dm9000_set_wol(struct net_device *dev, struct ethtool_wolinfo *w)
 
                 if (!dm->wake_state)
                         irq_set_irq_wake(dm->irq_wake, 1);
-                else if (dm->wake_state & !opts)
+                else if (dm->wake_state && !opts)
                         irq_set_irq_wake(dm->irq_wake, 0);
         }
 
diff --git a/drivers/net/ethernet/freescale/Kconfig b/drivers/net/ethernet/freescale/Kconfig
index c520cfd3b298..5272f9d4dda9 100644
--- a/drivers/net/ethernet/freescale/Kconfig
+++ b/drivers/net/ethernet/freescale/Kconfig
@@ -24,6 +24,7 @@ config FEC
         bool "FEC ethernet controller (of ColdFire and some i.MX CPUs)"
         depends on (M523x || M527x || M5272 || M528x || M520x || M532x || \
                    ARCH_MXC || ARCH_MXS)
+        default ARCH_MXC || ARCH_MXS if ARM
         select PHYLIB
         ---help---
           Say Y here if you want to use the built-in 10/100 Fast ethernet
diff --git a/drivers/net/ethernet/ibm/ehea/ehea.h b/drivers/net/ethernet/ibm/ehea/ehea.h
index 410d6a1984ed..6650068c996c 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea.h
+++ b/drivers/net/ethernet/ibm/ehea/ehea.h
@@ -61,9 +61,9 @@
 #ifdef EHEA_SMALL_QUEUES
 #define EHEA_MAX_CQE_COUNT      1023
 #define EHEA_DEF_ENTRIES_SQ     1023
-#define EHEA_DEF_ENTRIES_RQ1    4095
+#define EHEA_DEF_ENTRIES_RQ1    1023
 #define EHEA_DEF_ENTRIES_RQ2    1023
-#define EHEA_DEF_ENTRIES_RQ3    1023
+#define EHEA_DEF_ENTRIES_RQ3    511
 #else
 #define EHEA_MAX_CQE_COUNT      4080
 #define EHEA_DEF_ENTRIES_SQ     4080
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 37b70f7052b6..bfeccbfde236 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -371,7 +371,8 @@ static void ehea_update_stats(struct work_struct *work)
 out_herr:
         free_page((unsigned long)cb2);
 resched:
-        schedule_delayed_work(&port->stats_work, msecs_to_jiffies(1000));
+        schedule_delayed_work(&port->stats_work,
+                              round_jiffies_relative(msecs_to_jiffies(1000)));
 }
 
 static void ehea_refill_rq1(struct ehea_port_res *pr, int index, int nr_of_wqes)
@@ -2434,7 +2435,8 @@ static int ehea_open(struct net_device *dev)
         }
 
         mutex_unlock(&port->port_lock);
-        schedule_delayed_work(&port->stats_work, msecs_to_jiffies(1000));
+        schedule_delayed_work(&port->stats_work,
+                              round_jiffies_relative(msecs_to_jiffies(1000)));
 
         return ret;
 }
diff --git a/drivers/net/ethernet/ibm/iseries_veth.c b/drivers/net/ethernet/ibm/iseries_veth.c
index 4326681df382..acc31af6594a 100644
--- a/drivers/net/ethernet/ibm/iseries_veth.c
+++ b/drivers/net/ethernet/ibm/iseries_veth.c
@@ -1421,7 +1421,7 @@ static void veth_receive(struct veth_lpar_connection *cnx,
 
                 /* FIXME: do we need this? */
                 memset(local_list, 0, sizeof(local_list));
-                memset(remote_list, 0, sizeof(VETH_MAX_FRAMES_PER_MSG));
+                memset(remote_list, 0, sizeof(remote_list));
 
                 /* a 0 address marks the end of the valid entries */
                 if (senddata->addr[startchunk] == 0)
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 7becff1f387d..76b84573566b 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -1745,6 +1745,112 @@ jme_phy_off(struct jme_adapter *jme)
 }
 
 static int
+jme_phy_specreg_read(struct jme_adapter *jme, u32 specreg)
+{
+        u32 phy_addr;
+
+        phy_addr = JM_PHY_SPEC_REG_READ | specreg;
+        jme_mdio_write(jme->dev, jme->mii_if.phy_id, JM_PHY_SPEC_ADDR_REG,
+                        phy_addr);
+        return jme_mdio_read(jme->dev, jme->mii_if.phy_id,
+                        JM_PHY_SPEC_DATA_REG);
+}
+
+static void
+jme_phy_specreg_write(struct jme_adapter *jme, u32 ext_reg, u32 phy_data)
+{
+        u32 phy_addr;
+
+        phy_addr = JM_PHY_SPEC_REG_WRITE | ext_reg;
+        jme_mdio_write(jme->dev, jme->mii_if.phy_id, JM_PHY_SPEC_DATA_REG,
+                        phy_data);
+        jme_mdio_write(jme->dev, jme->mii_if.phy_id, JM_PHY_SPEC_ADDR_REG,
+                        phy_addr);
+}
+
+static int
+jme_phy_calibration(struct jme_adapter *jme)
+{
+        u32 ctrl1000, phy_data;
+
+        jme_phy_off(jme);
+        jme_phy_on(jme);
+        /*  Enabel PHY test mode 1 */
+        ctrl1000 = jme_mdio_read(jme->dev, jme->mii_if.phy_id, MII_CTRL1000);
+        ctrl1000 &= ~PHY_GAD_TEST_MODE_MSK;
+        ctrl1000 |= PHY_GAD_TEST_MODE_1;
+        jme_mdio_write(jme->dev, jme->mii_if.phy_id, MII_CTRL1000, ctrl1000);
+
+        phy_data = jme_phy_specreg_read(jme, JM_PHY_EXT_COMM_2_REG);
+        phy_data &= ~JM_PHY_EXT_COMM_2_CALI_MODE_0;
+        phy_data |= JM_PHY_EXT_COMM_2_CALI_LATCH |
+                        JM_PHY_EXT_COMM_2_CALI_ENABLE;
+        jme_phy_specreg_write(jme, JM_PHY_EXT_COMM_2_REG, phy_data);
+        msleep(20);
+        phy_data = jme_phy_specreg_read(jme, JM_PHY_EXT_COMM_2_REG);
+        phy_data &= ~(JM_PHY_EXT_COMM_2_CALI_ENABLE |
+                        JM_PHY_EXT_COMM_2_CALI_MODE_0 |
+                        JM_PHY_EXT_COMM_2_CALI_LATCH);
+        jme_phy_specreg_write(jme, JM_PHY_EXT_COMM_2_REG, phy_data);
+
+        /*  Disable PHY test mode */
+        ctrl1000 = jme_mdio_read(jme->dev, jme->mii_if.phy_id, MII_CTRL1000);
+        ctrl1000 &= ~PHY_GAD_TEST_MODE_MSK;
+        jme_mdio_write(jme->dev, jme->mii_if.phy_id, MII_CTRL1000, ctrl1000);
+        return 0;
+}
+
+static int
+jme_phy_setEA(struct jme_adapter *jme)
+{
+        u32 phy_comm0 = 0, phy_comm1 = 0;
+        u8 nic_ctrl;
+
+        pci_read_config_byte(jme->pdev, PCI_PRIV_SHARE_NICCTRL, &nic_ctrl);
+        if ((nic_ctrl & 0x3) == JME_FLAG_PHYEA_ENABLE)
+                return 0;
+
+        switch (jme->pdev->device) {
+        case PCI_DEVICE_ID_JMICRON_JMC250:
+                if (((jme->chip_main_rev == 5) &&
+                        ((jme->chip_sub_rev == 0) || (jme->chip_sub_rev == 1) ||
+                        (jme->chip_sub_rev == 3))) ||
+                        (jme->chip_main_rev >= 6)) {
+                        phy_comm0 = 0x008A;
+                        phy_comm1 = 0x4109;
+                }
+                if ((jme->chip_main_rev == 3) &&
+                        ((jme->chip_sub_rev == 1) || (jme->chip_sub_rev == 2)))
+                        phy_comm0 = 0xE088;
+                break;
+        case PCI_DEVICE_ID_JMICRON_JMC260:
+                if (((jme->chip_main_rev == 5) &&
+                        ((jme->chip_sub_rev == 0) || (jme->chip_sub_rev == 1) ||
+                        (jme->chip_sub_rev == 3))) ||
+                        (jme->chip_main_rev >= 6)) {
+                        phy_comm0 = 0x008A;
+                        phy_comm1 = 0x4109;
+                }
+                if ((jme->chip_main_rev == 3) &&
+                        ((jme->chip_sub_rev == 1) || (jme->chip_sub_rev == 2)))
+                        phy_comm0 = 0xE088;
+                if ((jme->chip_main_rev == 2) && (jme->chip_sub_rev == 0))
+                        phy_comm0 = 0x608A;
+                if ((jme->chip_main_rev == 2) && (jme->chip_sub_rev == 2))
+                        phy_comm0 = 0x408A;
+                break;
+        default:
+                return -ENODEV;
+        }
+        if (phy_comm0)
+                jme_phy_specreg_write(jme, JM_PHY_EXT_COMM_0_REG, phy_comm0);
+        if (phy_comm1)
+                jme_phy_specreg_write(jme, JM_PHY_EXT_COMM_1_REG, phy_comm1);
+
+        return 0;
+}
+
+static int
 jme_open(struct net_device *netdev)
 {
         struct jme_adapter *jme = netdev_priv(netdev);
@@ -1769,7 +1875,8 @@ jme_open(struct net_device *netdev)
                 jme_set_settings(netdev, &jme->old_ecmd);
         else
                 jme_reset_phy_processor(jme);
-
+        jme_phy_calibration(jme);
+        jme_phy_setEA(jme);
         jme_reset_link(jme);
 
         return 0;
@@ -3184,7 +3291,8 @@ jme_resume(struct device *dev)
                 jme_set_settings(netdev, &jme->old_ecmd);
         else
                 jme_reset_phy_processor(jme);
-
+        jme_phy_calibration(jme);
+        jme_phy_setEA(jme);
         jme_start_irq(jme);
         netif_device_attach(netdev);
 
@@ -3239,4 +3347,3 @@ MODULE_DESCRIPTION("JMicron JMC2x0 PCI Express Ethernet driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 MODULE_DEVICE_TABLE(pci, jme_pci_tbl);
-
diff --git a/drivers/net/ethernet/jme.h b/drivers/net/ethernet/jme.h
index 02ea27c1dcb5..4304072bd3c5 100644
--- a/drivers/net/ethernet/jme.h
+++ b/drivers/net/ethernet/jme.h
@@ -760,6 +760,25 @@ enum jme_rxmcs_bits {
                                   RXMCS_CHECKSUM,
 };
 
+/*      Extern PHY common register 2    */
+
+#define PHY_GAD_TEST_MODE_1                     0x00002000
+#define PHY_GAD_TEST_MODE_MSK                   0x0000E000
+#define JM_PHY_SPEC_REG_READ                    0x00004000
+#define JM_PHY_SPEC_REG_WRITE                   0x00008000
+#define PHY_CALIBRATION_DELAY                   20
+#define JM_PHY_SPEC_ADDR_REG                    0x1E
+#define JM_PHY_SPEC_DATA_REG                    0x1F
+
+#define JM_PHY_EXT_COMM_0_REG                   0x30
+#define JM_PHY_EXT_COMM_1_REG                   0x31
+#define JM_PHY_EXT_COMM_2_REG                   0x32
+#define JM_PHY_EXT_COMM_2_CALI_ENABLE           0x01
+#define JM_PHY_EXT_COMM_2_CALI_MODE_0           0x02
+#define JM_PHY_EXT_COMM_2_CALI_LATCH            0x10
+#define PCI_PRIV_SHARE_NICCTRL                  0xF5
+#define JME_FLAG_PHYEA_ENABLE                   0x2
+
 /*
  * Wakeup Frame setup interface registers
  */
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge.h b/drivers/net/ethernet/qlogic/qlge/qlge.h
index 8731f79c9efc..b8478aab050e 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge.h
+++ b/drivers/net/ethernet/qlogic/qlge/qlge.h
@@ -58,10 +58,8 @@
 
 
 #define TX_DESC_PER_IOCB 8
-/* The maximum number of frags we handle is based
- * on PAGE_SIZE...
- */
-#if (PAGE_SHIFT == 12) || (PAGE_SHIFT == 13)    /* 4k & 8k pages */
+
+#if ((MAX_SKB_FRAGS - TX_DESC_PER_IOCB) + 2) > 0
 #define TX_DESC_PER_OAL ((MAX_SKB_FRAGS - TX_DESC_PER_IOCB) + 2)
 #else /* all other page sizes */
 #define TX_DESC_PER_OAL 0
@@ -1353,7 +1351,7 @@ struct tx_ring_desc {
         struct ob_mac_iocb_req *queue_entry;
         u32 index;
         struct oal oal;
-        struct map_list map[MAX_SKB_FRAGS + 1];
+        struct map_list map[MAX_SKB_FRAGS + 2];
         int map_cnt;
         struct tx_ring_desc *next;
 };
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 8ea770a89f25..72cd190b9c1a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -781,10 +781,15 @@ static void stmmac_mmc_setup(struct stmmac_priv *priv)
         unsigned int mode = MMC_CNTRL_RESET_ON_READ | MMC_CNTRL_COUNTER_RESET |
                             MMC_CNTRL_PRESET | MMC_CNTRL_FULL_HALF_PRESET;
 
-        /* Do not manage MMC IRQ (FIXME) */
+        /* Mask MMC irq, counters are managed in SW and registers
+         * are cleared on each READ eventually. */
         dwmac_mmc_intr_all_mask(priv->ioaddr);
-        dwmac_mmc_ctrl(priv->ioaddr, mode);
-        memset(&priv->mmc, 0, sizeof(struct stmmac_counters));
+
+        if (priv->dma_cap.rmon) {
+                dwmac_mmc_ctrl(priv->ioaddr, mode);
+                memset(&priv->mmc, 0, sizeof(struct stmmac_counters));
+        } else
+                pr_info(" No MAC Management Counters available");
 }
 
 static u32 stmmac_get_synopsys_id(struct stmmac_priv *priv)
@@ -1012,8 +1017,7 @@ static int stmmac_open(struct net_device *dev)
         memset(&priv->xstats, 0, sizeof(struct stmmac_extra_stats));
         priv->xstats.threshold = tc;
 
-        if (priv->dma_cap.rmon)
-                stmmac_mmc_setup(priv);
+        stmmac_mmc_setup(priv);
 
         /* Start the ball rolling... */
         DBG(probe, DEBUG, "%s: DMA RX/TX processes started...\n", dev->name);
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index bb88e12101c7..a70244306c94 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -3,7 +3,7 @@
 #
 
 menuconfig PHYLIB
-        bool "PHY Device support and infrastructure"
+        tristate "PHY Device support and infrastructure"
         depends on !S390
         depends on NETDEVICES
         help
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 2f91acccb7db..8873c6e6fb96 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1827,7 +1827,8 @@ static void ath9k_set_power_sleep(struct ath_hw *ah, int setChip)
         }
 
         /* Clear Bit 14 of AR_WA after putting chip into Full Sleep mode. */
-        REG_WRITE(ah, AR_WA, ah->WARegVal & ~AR_WA_D3_L1_DISABLE);
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                REG_WRITE(ah, AR_WA, ah->WARegVal & ~AR_WA_D3_L1_DISABLE);
 }
 
 /*
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index f18df82eeb92..78d0d6988553 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -588,8 +588,6 @@ static void p54spi_op_stop(struct ieee80211_hw *dev)
 
         WARN_ON(priv->fw_state != FW_STATE_READY);
 
-        cancel_work_sync(&priv->work);
-
         p54spi_power_off(priv);
         spin_lock_irqsave(&priv->tx_lock, flags);
         INIT_LIST_HEAD(&priv->tx_pending);
@@ -597,6 +595,8 @@ static void p54spi_op_stop(struct ieee80211_hw *dev)
 
         priv->fw_state = FW_STATE_OFF;
         mutex_unlock(&priv->mutex);
+
+        cancel_work_sync(&priv->work);
 }
 
 static int __devinit p54spi_probe(struct spi_device *spi)
@@ -656,6 +656,7 @@ static int __devinit p54spi_probe(struct spi_device *spi)
         init_completion(&priv->fw_comp);
         INIT_LIST_HEAD(&priv->tx_pending);
         mutex_init(&priv->mutex);
+        spin_lock_init(&priv->tx_lock);
         SET_IEEE80211_DEV(hw, &spi->dev);
         priv->common.open = p54spi_op_start;
         priv->common.stop = p54spi_op_stop;
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index d97a2caf582b..bc2ba80c47bb 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -778,7 +778,7 @@ prism54_get_essid(struct net_device *ndev, struct iw_request_info *info,
                 dwrq->flags = 0;
                 dwrq->length = 0;
         }
-        essid->octets[essid->length] = '\0';
+        essid->octets[dwrq->length] = '\0';
         memcpy(extra, essid->octets, dwrq->length);
         kfree(essid);
 
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 3f183a15186e..1ba079dffb11 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -3771,7 +3771,7 @@ static void rt2800_efuse_read(struct rt2x00_dev *rt2x00dev, unsigned int i)
         /* Apparently the data is read from end to start */
         rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3, &reg);
         /* The returned value is in CPU order, but eeprom is le */
-        rt2x00dev->eeprom[i] = cpu_to_le32(reg);
+        *(u32 *)&rt2x00dev->eeprom[i] = cpu_to_le32(reg);
         rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2, &reg);
         *(u32 *)&rt2x00dev->eeprom[i + 2] = cpu_to_le32(reg);
         rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1, &reg);
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index db5262844543..55c8e50f45fd 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -395,7 +395,7 @@ void rtl_lps_enter(struct ieee80211_hw *hw)
         if (mac->link_state != MAC80211_LINKED)
                 return;
 
-        spin_lock(&rtlpriv->locks.lps_lock);
+        spin_lock_irq(&rtlpriv->locks.lps_lock);
 
         /* Idle for a while if we connect to AP a while ago. */
         if (mac->cnt_after_linked >= 2) {
@@ -407,7 +407,7 @@ void rtl_lps_enter(struct ieee80211_hw *hw)
                 }
         }
 
-        spin_unlock(&rtlpriv->locks.lps_lock);
+        spin_unlock_irq(&rtlpriv->locks.lps_lock);
 }
 
 /*Leave the leisure power save mode.*/
@@ -416,8 +416,9 @@ void rtl_lps_leave(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+        unsigned long flags;
 
-        spin_lock(&rtlpriv->locks.lps_lock);
+        spin_lock_irqsave(&rtlpriv->locks.lps_lock, flags);
 
         if (ppsc->fwctrl_lps) {
                 if (ppsc->dot11_psmode != EACTIVE) {
@@ -438,7 +439,7 @@ void rtl_lps_leave(struct ieee80211_hw *hw)
                         rtl_lps_set_psmode(hw, EACTIVE);
                 }
         }
-        spin_unlock(&rtlpriv->locks.lps_lock);
+        spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flags);
 }
 
 /* For sw LPS*/
@@ -539,9 +540,9 @@ void rtl_swlps_rf_awake(struct ieee80211_hw *hw)
                 RT_CLEAR_PS_LEVEL(ppsc, RT_PS_LEVEL_ASPM);
         }
 
-        spin_lock(&rtlpriv->locks.lps_lock);
+        spin_lock_irq(&rtlpriv->locks.lps_lock);
         rtl_ps_set_rf_state(hw, ERFON, RF_CHANGE_BY_PS);
-        spin_unlock(&rtlpriv->locks.lps_lock);
+        spin_unlock_irq(&rtlpriv->locks.lps_lock);
 }
 
 void rtl_swlps_rfon_wq_callback(void *data)
@@ -574,9 +575,9 @@ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw)
         if (rtlpriv->link_info.busytraffic)
                 return;
 
-        spin_lock(&rtlpriv->locks.lps_lock);
+        spin_lock_irq(&rtlpriv->locks.lps_lock);
         rtl_ps_set_rf_state(hw, ERFSLEEP, RF_CHANGE_BY_PS);
-        spin_unlock(&rtlpriv->locks.lps_lock);
+        spin_unlock_irq(&rtlpriv->locks.lps_lock);
 
         if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_ASPM &&
                 !RT_IN_PS_LEVEL(ppsc, RT_PS_LEVEL_ASPM)) {
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 0cb594c86090..1ae270eed51a 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -1021,7 +1021,7 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
                 pending_idx = *((u16 *)skb->data);
                 xen_netbk_idx_release(netbk, pending_idx);
                 for (j = start; j < i; j++) {
-                        pending_idx = frag_get_pending_idx(&shinfo->frags[i]);
+                        pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
                         xen_netbk_idx_release(netbk, pending_idx);
                 }
 
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 791270b8bd1c..19c0115092dd 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -424,6 +424,8 @@ void __init of_irq_init(const struct of_device_id *matches)
 
                 desc->dev = np;
                 desc->interrupt_parent = of_irq_find_parent(np);
+                if (desc->interrupt_parent == np)
+                        desc->interrupt_parent = NULL;
                 list_add_tail(&desc->list, &intc_desc_list);
         }
 
diff --git a/drivers/regulator/aat2870-regulator.c b/drivers/regulator/aat2870-regulator.c
index 5abeb3ac3e8d..298c6c6a2795 100644
--- a/drivers/regulator/aat2870-regulator.c
+++ b/drivers/regulator/aat2870-regulator.c
@@ -160,7 +160,7 @@ static struct aat2870_regulator *aat2870_get_regulator(int id)
                         break;
         }
 
-        if (!ri)
+        if (i == ARRAY_SIZE(aat2870_regulators))
                 return NULL;
 
         ri->enable_addr = AAT2870_LDO_EN;
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 669d02160221..938398f3e869 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -2799,8 +2799,8 @@ void regulator_unregister(struct regulator_dev *rdev)
         list_del(&rdev->list);
         if (rdev->supply)
                 regulator_put(rdev->supply);
-        device_unregister(&rdev->dev);
         kfree(rdev->constraints);
+        device_unregister(&rdev->dev);
         mutex_unlock(&regulator_list_mutex);
 }
 EXPORT_SYMBOL_GPL(regulator_unregister);
diff --git a/drivers/regulator/twl-regulator.c b/drivers/regulator/twl-regulator.c
index ee8747f4fa08..11cc308d66e9 100644
--- a/drivers/regulator/twl-regulator.c
+++ b/drivers/regulator/twl-regulator.c
@@ -71,6 +71,7 @@ struct twlreg_info {
 #define VREG_TYPE               1
 #define VREG_REMAP              2
 #define VREG_DEDICATED          3       /* LDO control */
+#define VREG_VOLTAGE_SMPS_4030  9
 /* TWL6030 register offsets */
 #define VREG_TRANS              1
 #define VREG_STATE              2
@@ -514,6 +515,32 @@ static struct regulator_ops twl4030ldo_ops = {
         .get_status     = twl4030reg_get_status,
 };
 
+static int
+twl4030smps_set_voltage(struct regulator_dev *rdev, int min_uV, int max_uV,
+                        unsigned *selector)
+{
+        struct twlreg_info *info = rdev_get_drvdata(rdev);
+        int vsel = DIV_ROUND_UP(min_uV - 600000, 12500);
+
+        twlreg_write(info, TWL_MODULE_PM_RECEIVER, VREG_VOLTAGE_SMPS_4030,
+                vsel);
+        return 0;
+}
+
+static int twl4030smps_get_voltage(struct regulator_dev *rdev)
+{
+        struct twlreg_info *info = rdev_get_drvdata(rdev);
+        int vsel = twlreg_read(info, TWL_MODULE_PM_RECEIVER,
+                VREG_VOLTAGE_SMPS_4030);
+
+        return vsel * 12500 + 600000;
+}
+
+static struct regulator_ops twl4030smps_ops = {
+        .set_voltage    = twl4030smps_set_voltage,
+        .get_voltage    = twl4030smps_get_voltage,
+};
+
 static int twl6030ldo_list_voltage(struct regulator_dev *rdev, unsigned index)
 {
         struct twlreg_info      *info = rdev_get_drvdata(rdev);
@@ -856,6 +883,21 @@ static struct regulator_ops twlsmps_ops = {
                 }, \
         }
 
+#define TWL4030_ADJUSTABLE_SMPS(label, offset, num, turnon_delay, remap_conf) \
+        { \
+        .base = offset, \
+        .id = num, \
+        .delay = turnon_delay, \
+        .remap = remap_conf, \
+        .desc = { \
+                .name = #label, \
+                .id = TWL4030_REG_##label, \
+                .ops = &twl4030smps_ops, \
+                .type = REGULATOR_VOLTAGE, \
+                .owner = THIS_MODULE, \
+                }, \
+        }
+
 #define TWL6030_ADJUSTABLE_LDO(label, offset, min_mVolts, max_mVolts) { \
         .base = offset, \
         .min_mV = min_mVolts, \
@@ -947,8 +989,8 @@ static struct twlreg_info twl_regs[] = {
         TWL4030_ADJUSTABLE_LDO(VINTANA2, 0x43, 12, 100, 0x08),
         TWL4030_FIXED_LDO(VINTDIG, 0x47, 1500, 13, 100, 0x08),
         TWL4030_ADJUSTABLE_LDO(VIO, 0x4b, 14, 1000, 0x08),
-        TWL4030_ADJUSTABLE_LDO(VDD1, 0x55, 15, 1000, 0x08),
-        TWL4030_ADJUSTABLE_LDO(VDD2, 0x63, 16, 1000, 0x08),
+        TWL4030_ADJUSTABLE_SMPS(VDD1, 0x55, 15, 1000, 0x08),
+        TWL4030_ADJUSTABLE_SMPS(VDD2, 0x63, 16, 1000, 0x08),
         TWL4030_FIXED_LDO(VUSB1V5, 0x71, 1500, 17, 100, 0x08),
         TWL4030_FIXED_LDO(VUSB1V8, 0x74, 1800, 18, 100, 0x08),
         TWL4030_FIXED_LDO(VUSB3V1, 0x77, 3100, 19, 150, 0x08),
diff --git a/drivers/spi/spi-nuc900.c b/drivers/spi/spi-nuc900.c
index e763254741c2..21c70b2b8311 100644
--- a/drivers/spi/spi-nuc900.c
+++ b/drivers/spi/spi-nuc900.c
@@ -426,7 +426,7 @@ static int __devinit nuc900_spi_probe(struct platform_device *pdev)
                 goto err_clk;
         }
 
-        mfp_set_groupg(&pdev->dev);
+        mfp_set_groupg(&pdev->dev, NULL);
         nuc900_init_spi(hw);
 
         err = spi_bitbang_start(&hw->bitbang);
diff --git a/drivers/staging/iio/industrialio-core.c b/drivers/staging/iio/industrialio-core.c
index 26564094e33b..aec9311b108c 100644
--- a/drivers/staging/iio/industrialio-core.c
+++ b/drivers/staging/iio/industrialio-core.c
@@ -242,25 +242,24 @@ static const struct file_operations iio_event_chrdev_fileops = {
 
 static int iio_event_getfd(struct iio_dev *indio_dev)
 {
+        struct iio_event_interface *ev_int = indio_dev->event_interface;
         int fd;
 
-        if (indio_dev->event_interface == NULL)
+        if (ev_int == NULL)
                 return -ENODEV;
 
-        mutex_lock(&indio_dev->event_interface->event_list_lock);
-        if (test_and_set_bit(IIO_BUSY_BIT_POS,
-                             &indio_dev->event_interface->flags)) {
-                mutex_unlock(&indio_dev->event_interface->event_list_lock);
+        mutex_lock(&ev_int->event_list_lock);
+        if (test_and_set_bit(IIO_BUSY_BIT_POS, &ev_int->flags)) {
+                mutex_unlock(&ev_int->event_list_lock);
                 return -EBUSY;
         }
-        mutex_unlock(&indio_dev->event_interface->event_list_lock);
+        mutex_unlock(&ev_int->event_list_lock);
         fd = anon_inode_getfd("iio:event",
-                                &iio_event_chrdev_fileops,
-                                indio_dev->event_interface, O_RDONLY);
+                                &iio_event_chrdev_fileops, ev_int, O_RDONLY);
         if (fd < 0) {
-                mutex_lock(&indio_dev->event_interface->event_list_lock);
+                mutex_lock(&ev_int->event_list_lock);
                 clear_bit(IIO_BUSY_BIT_POS, &ev_int->flags);
-                mutex_unlock(&indio_dev->event_interface->event_list_lock);
+                mutex_unlock(&ev_int->event_list_lock);
         }
         return fd;
 }
diff --git a/drivers/video/da8xx-fb.c b/drivers/video/da8xx-fb.c
index 55f91d9ab00b..29577bf1f559 100644
--- a/drivers/video/da8xx-fb.c
+++ b/drivers/video/da8xx-fb.c
@@ -116,6 +116,7 @@
 /* Clock registers available only on Version 2 */
 #define  LCD_CLK_ENABLE_REG                     0x6c
 #define  LCD_CLK_RESET_REG                      0x70
+#define  LCD_CLK_MAIN_RESET                     BIT(3)
 
 #define LCD_NUM_BUFFERS 2
 
@@ -244,6 +245,10 @@ static inline void lcd_enable_raster(void)
 {
         u32 reg;
 
+        /* Bring LCDC out of reset */
+        if (lcd_revision == LCD_VERSION_2)
+                lcdc_write(0, LCD_CLK_RESET_REG);
+
         reg = lcdc_read(LCD_RASTER_CTRL_REG);
         if (!(reg & LCD_RASTER_ENABLE))
                 lcdc_write(reg | LCD_RASTER_ENABLE, LCD_RASTER_CTRL_REG);
@@ -257,6 +262,10 @@ static inline void lcd_disable_raster(void)
         reg = lcdc_read(LCD_RASTER_CTRL_REG);
         if (reg & LCD_RASTER_ENABLE)
                 lcdc_write(reg & ~LCD_RASTER_ENABLE, LCD_RASTER_CTRL_REG);
+
+        if (lcd_revision == LCD_VERSION_2)
+                /* Write 1 to reset LCDC */
+                lcdc_write(LCD_CLK_MAIN_RESET, LCD_CLK_RESET_REG);
 }
 
 static void lcd_blit(int load_mode, struct da8xx_fb_par *par)
@@ -584,8 +593,12 @@ static void lcd_reset(struct da8xx_fb_par *par)
         lcdc_write(0, LCD_DMA_CTRL_REG);
         lcdc_write(0, LCD_RASTER_CTRL_REG);
 
-        if (lcd_revision == LCD_VERSION_2)
+        if (lcd_revision == LCD_VERSION_2) {
                 lcdc_write(0, LCD_INT_ENABLE_SET_REG);
+                /* Write 1 to reset */
+                lcdc_write(LCD_CLK_MAIN_RESET, LCD_CLK_RESET_REG);
+                lcdc_write(0, LCD_CLK_RESET_REG);
+        }
 }
 
 static void lcd_calc_clk_divider(struct da8xx_fb_par *par)
diff --git a/drivers/video/omap/dispc.c b/drivers/video/omap/dispc.c
index 0ccd7adf47bb..6f61e781f15a 100644
--- a/drivers/video/omap/dispc.c
+++ b/drivers/video/omap/dispc.c
@@ -19,6 +19,7 @@
  * 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  */
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/dma-mapping.h>
 #include <linux/mm.h>
 #include <linux/vmalloc.h>
diff --git a/drivers/video/omap2/dss/dispc.c b/drivers/video/omap2/dss/dispc.c
index 3532782551cb..5c81533eacaa 100644
--- a/drivers/video/omap2/dss/dispc.c
+++ b/drivers/video/omap2/dss/dispc.c
@@ -1720,12 +1720,11 @@ static int dispc_ovl_calc_scaling(enum omap_plane plane,
         const int maxdownscale = dss_feat_get_param_max(FEAT_PARAM_DOWNSCALE);
         unsigned long fclk = 0;
 
-        if ((ovl->caps & OMAP_DSS_OVL_CAP_SCALE) == 0) {
-                if (width != out_width || height != out_height)
-                        return -EINVAL;
-                else
-                        return 0;
-        }
+        if (width == out_width && height == out_height)
+                return 0;
+
+        if ((ovl->caps & OMAP_DSS_OVL_CAP_SCALE) == 0)
+                return -EINVAL;
 
         if (out_width < width / maxdownscale ||
                         out_width > width * 8)
diff --git a/drivers/video/omap2/dss/hdmi.c b/drivers/video/omap2/dss/hdmi.c
index 3262f0f1fa35..c56378c555b0 100644
--- a/drivers/video/omap2/dss/hdmi.c
+++ b/drivers/video/omap2/dss/hdmi.c
@@ -269,7 +269,7 @@ static void update_hdmi_timings(struct hdmi_config *cfg,
 unsigned long hdmi_get_pixel_clock(void)
 {
         /* HDMI Pixel Clock in Mhz */
-        return hdmi.ip_data.cfg.timings.timings.pixel_clock * 10000;
+        return hdmi.ip_data.cfg.timings.timings.pixel_clock * 1000;
 }
 
 static void hdmi_compute_pll(struct omap_dss_device *dssdev, int phy,
diff --git a/drivers/video/via/share.h b/drivers/video/via/share.h
index 69d882cbe709..c01c1c162726 100644
--- a/drivers/video/via/share.h
+++ b/drivers/video/via/share.h
@@ -559,8 +559,8 @@
 #define M1200X720_R60_VSP       POSITIVE
 
 /* 1200x900@60 Sync Polarity (DCON) */
-#define M1200X900_R60_HSP       NEGATIVE
-#define M1200X900_R60_VSP       NEGATIVE
+#define M1200X900_R60_HSP       POSITIVE
+#define M1200X900_R60_VSP       POSITIVE
 
 /* 1280x600@60 Sync Polarity (GTF Mode) */
 #define M1280x600_R60_HSP       NEGATIVE
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 04a5dfcee5a1..50634abef9b4 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2369,6 +2369,9 @@ int btrfs_block_rsv_check(struct btrfs_root *root,
 int btrfs_block_rsv_refill(struct btrfs_root *root,
                           struct btrfs_block_rsv *block_rsv,
                           u64 min_reserved);
+int btrfs_block_rsv_refill_noflush(struct btrfs_root *root,
+                                   struct btrfs_block_rsv *block_rsv,
+                                   u64 min_reserved);
 int btrfs_block_rsv_migrate(struct btrfs_block_rsv *src_rsv,
                             struct btrfs_block_rsv *dst_rsv,
                             u64 num_bytes);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 930ae8949737..f0d5718d2587 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3888,9 +3888,9 @@ int btrfs_block_rsv_check(struct btrfs_root *root,
         return ret;
 }
 
-int btrfs_block_rsv_refill(struct btrfs_root *root,
-                          struct btrfs_block_rsv *block_rsv,
-                          u64 min_reserved)
+static inline int __btrfs_block_rsv_refill(struct btrfs_root *root,
+                                           struct btrfs_block_rsv *block_rsv,
+                                           u64 min_reserved, int flush)
 {
         u64 num_bytes = 0;
         int ret = -ENOSPC;
@@ -3909,7 +3909,7 @@ int btrfs_block_rsv_refill(struct btrfs_root *root,
         if (!ret)
                 return 0;
 
-        ret = reserve_metadata_bytes(root, block_rsv, num_bytes, 1);
+        ret = reserve_metadata_bytes(root, block_rsv, num_bytes, flush);
         if (!ret) {
                 block_rsv_add_bytes(block_rsv, num_bytes, 0);
                 return 0;
@@ -3918,6 +3918,20 @@ int btrfs_block_rsv_refill(struct btrfs_root *root,
         return ret;
 }
 
+int btrfs_block_rsv_refill(struct btrfs_root *root,
+                           struct btrfs_block_rsv *block_rsv,
+                           u64 min_reserved)
+{
+        return __btrfs_block_rsv_refill(root, block_rsv, min_reserved, 1);
+}
+
+int btrfs_block_rsv_refill_noflush(struct btrfs_root *root,
+                                   struct btrfs_block_rsv *block_rsv,
+                                   u64 min_reserved)
+{
+        return __btrfs_block_rsv_refill(root, block_rsv, min_reserved, 0);
+}
+
 int btrfs_block_rsv_migrate(struct btrfs_block_rsv *src_rsv,
                             struct btrfs_block_rsv *dst_rsv,
                             u64 num_bytes)
@@ -5265,7 +5279,7 @@ alloc:
                 spin_lock(&block_group->free_space_ctl->tree_lock);
                 if (cached &&
                     block_group->free_space_ctl->free_space <
-                    num_bytes + empty_size) {
+                    num_bytes + empty_cluster + empty_size) {
                         spin_unlock(&block_group->free_space_ctl->tree_lock);
                         goto loop;
                 }
@@ -5286,12 +5300,10 @@ alloc:
                          * people trying to start a new cluster
                          */
                         spin_lock(&last_ptr->refill_lock);
-                        if (last_ptr->block_group &&
-                            (last_ptr->block_group->ro ||
-                            !block_group_bits(last_ptr->block_group, data))) {
-                                offset = 0;
+                        if (!last_ptr->block_group ||
+                            last_ptr->block_group->ro ||
+                            !block_group_bits(last_ptr->block_group, data))
                                 goto refill_cluster;
-                        }
 
                         offset = btrfs_alloc_from_cluster(block_group, last_ptr,
                                                  num_bytes, search_start);
@@ -5342,7 +5354,7 @@ refill_cluster:
                         /* allocate a cluster in this block group */
                         ret = btrfs_find_space_cluster(trans, root,
                                                block_group, last_ptr,
-                                               offset, num_bytes,
+                                               search_start, num_bytes,
                                                empty_cluster + empty_size);
                         if (ret == 0) {
                                 /*
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 9472d3de5e52..be1bf627a14b 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2287,14 +2287,20 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                 if (!uptodate) {
                         int failed_mirror;
                         failed_mirror = (int)(unsigned long)bio->bi_bdev;
-                        if (tree->ops && tree->ops->readpage_io_failed_hook)
-                                ret = tree->ops->readpage_io_failed_hook(
-                                                bio, page, start, end,
-                                                failed_mirror, state);
-                        else
-                                ret = bio_readpage_error(bio, page, start, end,
-                                                         failed_mirror, NULL);
+                        /*
+                         * The generic bio_readpage_error handles errors the
+                         * following way: If possible, new read requests are
+                         * created and submitted and will end up in
+                         * end_bio_extent_readpage as well (if we're lucky, not
+                         * in the !uptodate case). In that case it returns 0 and
+                         * we just go on with the next page in our bio. If it
+                         * can't handle the error it will return -EIO and we
+                         * remain responsible for that page.
+                         */
+                        ret = bio_readpage_error(bio, page, start, end,
+                                                        failed_mirror, NULL);
                         if (ret == 0) {
+error_handled:
                                 uptodate =
                                         test_bit(BIO_UPTODATE, &bio->bi_flags);
                                 if (err)
@@ -2302,6 +2308,13 @@ static void end_bio_extent_readpage(struct bio *bio, int err)
                                 uncache_state(&cached);
                                 continue;
                         }
+                        if (tree->ops && tree->ops->readpage_io_failed_hook) {
+                                ret = tree->ops->readpage_io_failed_hook(
+                                                        bio, page, start, end,
+                                                        failed_mirror, state);
+                                if (ret == 0)
+                                        goto error_handled;
+                        }
                 }
 
                 if (uptodate) {
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 6e5b7e463698..ec23d43d0c35 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1470,6 +1470,7 @@ static void add_new_bitmap(struct btrfs_free_space_ctl *ctl,
 {
         info->offset = offset_to_bitmap(ctl, offset);
         info->bytes = 0;
+        INIT_LIST_HEAD(&info->list);
         link_free_space(ctl, info);
         ctl->total_bitmaps++;
 
@@ -2319,6 +2320,7 @@ again:
 
         if (!found) {
                 start = i;
+                cluster->max_size = 0;
                 found = true;
         }
 
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 526dd51a1966..2c984f7d4c2a 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3490,7 +3490,7 @@ void btrfs_evict_inode(struct inode *inode)
          * doing the truncate.
          */
         while (1) {
-                ret = btrfs_block_rsv_refill(root, rsv, min_size);
+                ret = btrfs_block_rsv_refill_noflush(root, rsv, min_size);
 
                 /*
                  * Try and steal from the global reserve since we will
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index a90e749ed6d2..72d461656f60 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1278,7 +1278,7 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
                 }
                 ret = btrfs_grow_device(trans, device, new_size);
                 btrfs_commit_transaction(trans, root);
-        } else {
+        } else if (new_size < old_size) {
                 ret = btrfs_shrink_device(device, new_size);
         }
 
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index fab420db5121..c27bcb67f330 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -256,6 +256,11 @@ static int scrub_print_warning_inode(u64 inum, u64 offset, u64 root, void *ctx)
         btrfs_release_path(swarn->path);
 
         ipath = init_ipath(4096, local_root, swarn->path);
+        if (IS_ERR(ipath)) {
+                ret = PTR_ERR(ipath);
+                ipath = NULL;
+                goto err;
+        }
         ret = paths_from_inode(inum, ipath);
 
         if (ret < 0)
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 17ee7fc5e64e..e28ad4baf483 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1057,7 +1057,7 @@ static int btrfs_calc_avail_data_space(struct btrfs_root *root, u64 *free_bytes)
         int i = 0, nr_devices;
         int ret;
 
-        nr_devices = fs_info->fs_devices->rw_devices;
+        nr_devices = fs_info->fs_devices->open_devices;
         BUG_ON(!nr_devices);
 
         devices_info = kmalloc(sizeof(*devices_info) * nr_devices,
@@ -1079,8 +1079,8 @@ static int btrfs_calc_avail_data_space(struct btrfs_root *root, u64 *free_bytes)
         else
                 min_stripe_size = BTRFS_STRIPE_LEN;
 
-        list_for_each_entry(device, &fs_devices->alloc_list, dev_alloc_list) {
-                if (!device->in_fs_metadata)
+        list_for_each_entry(device, &fs_devices->devices, dev_list) {
+                if (!device->in_fs_metadata || !device->bdev)
                         continue;
 
                 avail_space = device->total_bytes - device->bytes_used;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index fffec40d5996..848f436df29f 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -2807,8 +2807,8 @@ out:
         spin_unlock_irqrestore(&ei->i_completed_io_lock, flags);
 
         /* queue the work to convert unwritten extents to written */
-        queue_work(wq, &io_end->work);
         iocb->private = NULL;
+        queue_work(wq, &io_end->work);
 
         /* XXX: probably should move into the real I/O completion handler */
         inode_dio_done(inode);
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index ed553c60de82..3165aebb43c8 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -5699,7 +5699,7 @@ int ocfs2_remove_btree_range(struct inode *inode,
                                            OCFS2_JOURNAL_ACCESS_WRITE);
         if (ret) {
                 mlog_errno(ret);
-                goto out;
+                goto out_commit;
         }
 
         dquot_free_space_nodirty(inode,
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index c1efe939c774..78b68af3b0e3 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -290,7 +290,15 @@ static int ocfs2_readpage(struct file *file, struct page *page)
         }
 
         if (down_read_trylock(&oi->ip_alloc_sem) == 0) {
+                /*
+                 * Unlock the page and cycle ip_alloc_sem so that we don't
+                 * busyloop waiting for ip_alloc_sem to unlock
+                 */
                 ret = AOP_TRUNCATED_PAGE;
+                unlock_page(page);
+                unlock = 0;
+                down_read(&oi->ip_alloc_sem);
+                up_read(&oi->ip_alloc_sem);
                 goto out_inode_unlock;
         }
 
@@ -563,6 +571,7 @@ static void ocfs2_dio_end_io(struct kiocb *iocb,
 {
         struct inode *inode = iocb->ki_filp->f_path.dentry->d_inode;
         int level;
+        wait_queue_head_t *wq = ocfs2_ioend_wq(inode);
 
         /* this io's submitter should not have unlocked this before we could */
         BUG_ON(!ocfs2_iocb_is_rw_locked(iocb));
@@ -570,6 +579,15 @@ static void ocfs2_dio_end_io(struct kiocb *iocb,
         if (ocfs2_iocb_is_sem_locked(iocb))
                 ocfs2_iocb_clear_sem_locked(iocb);
 
+        if (ocfs2_iocb_is_unaligned_aio(iocb)) {
+                ocfs2_iocb_clear_unaligned_aio(iocb);
+
+                if (atomic_dec_and_test(&OCFS2_I(inode)->ip_unaligned_aio) &&
+                    waitqueue_active(wq)) {
+                        wake_up_all(wq);
+                }
+        }
+
         ocfs2_iocb_clear_rw_locked(iocb);
 
         level = ocfs2_iocb_rw_locked_level(iocb);
@@ -863,6 +881,12 @@ struct ocfs2_write_ctxt {
         struct page                     *w_target_page;
 
         /*
+         * w_target_locked is used for page_mkwrite path indicating no unlocking
+         * against w_target_page in ocfs2_write_end_nolock.
+         */
+        unsigned int                    w_target_locked:1;
+
+        /*
          * ocfs2_write_end() uses this to know what the real range to
          * write in the target should be.
          */
@@ -895,6 +919,24 @@ void ocfs2_unlock_and_free_pages(struct page **pages, int num_pages)
 
 static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
 {
+        int i;
+
+        /*
+         * w_target_locked is only set to true in the page_mkwrite() case.
+         * The intent is to allow us to lock the target page from write_begin()
+         * to write_end(). The caller must hold a ref on w_target_page.
+         */
+        if (wc->w_target_locked) {
+                BUG_ON(!wc->w_target_page);
+                for (i = 0; i < wc->w_num_pages; i++) {
+                        if (wc->w_target_page == wc->w_pages[i]) {
+                                wc->w_pages[i] = NULL;
+                                break;
+                        }
+                }
+                mark_page_accessed(wc->w_target_page);
+                page_cache_release(wc->w_target_page);
+        }
         ocfs2_unlock_and_free_pages(wc->w_pages, wc->w_num_pages);
 
         brelse(wc->w_di_bh);
@@ -1132,20 +1174,17 @@ static int ocfs2_grab_pages_for_write(struct address_space *mapping,
                          */
                         lock_page(mmap_page);
 
+                        /* Exit and let the caller retry */
                         if (mmap_page->mapping != mapping) {
+                                WARN_ON(mmap_page->mapping);
                                 unlock_page(mmap_page);
-                                /*
-                                 * Sanity check - the locking in
-                                 * ocfs2_pagemkwrite() should ensure
-                                 * that this code doesn't trigger.
-                                 */
-                                ret = -EINVAL;
-                                mlog_errno(ret);
+                                ret = -EAGAIN;
                                 goto out;
                         }
 
                         page_cache_get(mmap_page);
                         wc->w_pages[i] = mmap_page;
+                        wc->w_target_locked = true;
                 } else {
                         wc->w_pages[i] = find_or_create_page(mapping, index,
                                                              GFP_NOFS);
@@ -1160,6 +1199,8 @@ static int ocfs2_grab_pages_for_write(struct address_space *mapping,
                         wc->w_target_page = wc->w_pages[i];
         }
 out:
+        if (ret)
+                wc->w_target_locked = false;
         return ret;
 }
 
@@ -1817,11 +1858,23 @@ try_again:
          */
         ret = ocfs2_grab_pages_for_write(mapping, wc, wc->w_cpos, pos, len,
                                          cluster_of_pages, mmap_page);
-        if (ret) {
+        if (ret && ret != -EAGAIN) {
                 mlog_errno(ret);
                 goto out_quota;
         }
 
+        /*
+         * ocfs2_grab_pages_for_write() returns -EAGAIN if it could not lock
+         * the target page. In this case, we exit with no error and no target
+         * page. This will trigger the caller, page_mkwrite(), to re-try
+         * the operation.
+         */
+        if (ret == -EAGAIN) {
+                BUG_ON(wc->w_target_page);
+                ret = 0;
+                goto out_quota;
+        }
+
         ret = ocfs2_write_cluster_by_desc(mapping, data_ac, meta_ac, wc, pos,
                                           len);
         if (ret) {
diff --git a/fs/ocfs2/aops.h b/fs/ocfs2/aops.h
index 75cf3ad987a6..ffb2da370a99 100644
--- a/fs/ocfs2/aops.h
+++ b/fs/ocfs2/aops.h
@@ -78,6 +78,7 @@ enum ocfs2_iocb_lock_bits {
         OCFS2_IOCB_RW_LOCK = 0,
         OCFS2_IOCB_RW_LOCK_LEVEL,
         OCFS2_IOCB_SEM,
+        OCFS2_IOCB_UNALIGNED_IO,
         OCFS2_IOCB_NUM_LOCKS
 };
 
@@ -91,4 +92,17 @@ enum ocfs2_iocb_lock_bits {
         clear_bit(OCFS2_IOCB_SEM, (unsigned long *)&iocb->private)
 #define ocfs2_iocb_is_sem_locked(iocb) \
         test_bit(OCFS2_IOCB_SEM, (unsigned long *)&iocb->private)
+
+#define ocfs2_iocb_set_unaligned_aio(iocb) \
+        set_bit(OCFS2_IOCB_UNALIGNED_IO, (unsigned long *)&iocb->private)
+#define ocfs2_iocb_clear_unaligned_aio(iocb) \
+        clear_bit(OCFS2_IOCB_UNALIGNED_IO, (unsigned long *)&iocb->private)
+#define ocfs2_iocb_is_unaligned_aio(iocb) \
+        test_bit(OCFS2_IOCB_UNALIGNED_IO, (unsigned long *)&iocb->private)
+
+#define OCFS2_IOEND_WQ_HASH_SZ  37
+#define ocfs2_ioend_wq(v)   (&ocfs2__ioend_wq[((unsigned long)(v)) %\
+                                            OCFS2_IOEND_WQ_HASH_SZ])
+extern wait_queue_head_t ocfs2__ioend_wq[OCFS2_IOEND_WQ_HASH_SZ];
+
 #endif /* OCFS2_FILE_H */
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 9a3e6bbff27b..a4e855e3690e 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -216,6 +216,7 @@ struct o2hb_region {
 
         struct list_head        hr_all_item;
         unsigned                hr_unclean_stop:1,
+                                hr_aborted_start:1,
                                 hr_item_pinned:1,
                                 hr_item_dropped:1;
 
@@ -254,6 +255,10 @@ struct o2hb_region {
          * a more complete api that doesn't lead to this sort of fragility. */
         atomic_t                hr_steady_iterations;
 
+        /* terminate o2hb thread if it does not reach steady state
+         * (hr_steady_iterations == 0) within hr_unsteady_iterations */
+        atomic_t                hr_unsteady_iterations;
+
         char                    hr_dev_name[BDEVNAME_SIZE];
 
         unsigned int            hr_timeout_ms;
@@ -324,6 +329,10 @@ static void o2hb_write_timeout(struct work_struct *work)
 
 static void o2hb_arm_write_timeout(struct o2hb_region *reg)
 {
+        /* Arm writeout only after thread reaches steady state */
+        if (atomic_read(&reg->hr_steady_iterations) != 0)
+                return;
+
         mlog(ML_HEARTBEAT, "Queue write timeout for %u ms\n",
              O2HB_MAX_WRITE_TIMEOUT_MS);
 
@@ -537,9 +546,14 @@ static int o2hb_verify_crc(struct o2hb_region *reg,
         return read == computed;
 }
 
-/* We want to make sure that nobody is heartbeating on top of us --
- * this will help detect an invalid configuration. */
-static void o2hb_check_last_timestamp(struct o2hb_region *reg)
+/*
+ * Compare the slot data with what we wrote in the last iteration.
+ * If the match fails, print an appropriate error message. This is to
+ * detect errors like... another node hearting on the same slot,
+ * flaky device that is losing writes, etc.
+ * Returns 1 if check succeeds, 0 otherwise.
+ */
+static int o2hb_check_own_slot(struct o2hb_region *reg)
 {
         struct o2hb_disk_slot *slot;
         struct o2hb_disk_heartbeat_block *hb_block;
@@ -548,13 +562,13 @@ static void o2hb_check_last_timestamp(struct o2hb_region *reg)
         slot = &reg->hr_slots[o2nm_this_node()];
         /* Don't check on our 1st timestamp */
         if (!slot->ds_last_time)
-                return;
+                return 0;
 
         hb_block = slot->ds_raw_block;
         if (le64_to_cpu(hb_block->hb_seq) == slot->ds_last_time &&
             le64_to_cpu(hb_block->hb_generation) == slot->ds_last_generation &&
             hb_block->hb_node == slot->ds_node_num)
-                return;
+                return 1;
 
 #define ERRSTR1         "Another node is heartbeating on device"
 #define ERRSTR2         "Heartbeat generation mismatch on device"
@@ -574,6 +588,8 @@ static void o2hb_check_last_timestamp(struct o2hb_region *reg)
              (unsigned long long)slot->ds_last_time, hb_block->hb_node,
              (unsigned long long)le64_to_cpu(hb_block->hb_generation),
              (unsigned long long)le64_to_cpu(hb_block->hb_seq));
+
+        return 0;
 }
 
 static inline void o2hb_prepare_block(struct o2hb_region *reg,
@@ -719,17 +735,24 @@ static void o2hb_shutdown_slot(struct o2hb_disk_slot *slot)
         o2nm_node_put(node);
 }
 
-static void o2hb_set_quorum_device(struct o2hb_region *reg,
-                                   struct o2hb_disk_slot *slot)
+static void o2hb_set_quorum_device(struct o2hb_region *reg)
 {
-        assert_spin_locked(&o2hb_live_lock);
-
         if (!o2hb_global_heartbeat_active())
                 return;
 
-        if (test_bit(reg->hr_region_num, o2hb_quorum_region_bitmap))
+        /* Prevent race with o2hb_heartbeat_group_drop_item() */
+        if (kthread_should_stop())
+                return;
+
+        /* Tag region as quorum only after thread reaches steady state */
+        if (atomic_read(&reg->hr_steady_iterations) != 0)
                 return;
 
+        spin_lock(&o2hb_live_lock);
+
+        if (test_bit(reg->hr_region_num, o2hb_quorum_region_bitmap))
+                goto unlock;
+
         /*
          * A region can be added to the quorum only when it sees all
          * live nodes heartbeat on it. In other words, the region has been
@@ -737,13 +760,10 @@ static void o2hb_set_quorum_device(struct o2hb_region *reg,
          */
         if (memcmp(reg->hr_live_node_bitmap, o2hb_live_node_bitmap,
                    sizeof(o2hb_live_node_bitmap)))
-                return;
-
-        if (slot->ds_changed_samples < O2HB_LIVE_THRESHOLD)
-                return;
+                goto unlock;
 
-        printk(KERN_NOTICE "o2hb: Region %s is now a quorum device\n",
-               config_item_name(&reg->hr_item));
+        printk(KERN_NOTICE "o2hb: Region %s (%s) is now a quorum device\n",
+               config_item_name(&reg->hr_item), reg->hr_dev_name);
 
         set_bit(reg->hr_region_num, o2hb_quorum_region_bitmap);
 
@@ -754,6 +774,8 @@ static void o2hb_set_quorum_device(struct o2hb_region *reg,
         if (o2hb_pop_count(&o2hb_quorum_region_bitmap,
                            O2NM_MAX_REGIONS) > O2HB_PIN_CUT_OFF)
                 o2hb_region_unpin(NULL);
+unlock:
+        spin_unlock(&o2hb_live_lock);
 }
 
 static int o2hb_check_slot(struct o2hb_region *reg,
@@ -925,8 +947,6 @@ fire_callbacks:
                 slot->ds_equal_samples = 0;
         }
 out:
-        o2hb_set_quorum_device(reg, slot);
-
         spin_unlock(&o2hb_live_lock);
 
         o2hb_run_event_list(&event);
@@ -957,7 +977,8 @@ static int o2hb_highest_node(unsigned long *nodes,
 
 static int o2hb_do_disk_heartbeat(struct o2hb_region *reg)
 {
-        int i, ret, highest_node, change = 0;
+        int i, ret, highest_node;
+        int membership_change = 0, own_slot_ok = 0;
         unsigned long configured_nodes[BITS_TO_LONGS(O2NM_MAX_NODES)];
         unsigned long live_node_bitmap[BITS_TO_LONGS(O2NM_MAX_NODES)];
         struct o2hb_bio_wait_ctxt write_wc;
@@ -966,7 +987,7 @@ static int o2hb_do_disk_heartbeat(struct o2hb_region *reg)
                                        sizeof(configured_nodes));
         if (ret) {
                 mlog_errno(ret);
-                return ret;
+                goto bail;
         }
 
         /*
@@ -982,8 +1003,9 @@ static int o2hb_do_disk_heartbeat(struct o2hb_region *reg)
 
         highest_node = o2hb_highest_node(configured_nodes, O2NM_MAX_NODES);
         if (highest_node >= O2NM_MAX_NODES) {
-                mlog(ML_NOTICE, "ocfs2_heartbeat: no configured nodes found!\n");
-                return -EINVAL;
+                mlog(ML_NOTICE, "o2hb: No configured nodes found!\n");
+                ret = -EINVAL;
+                goto bail;
         }
 
         /* No sense in reading the slots of nodes that don't exist
@@ -993,29 +1015,27 @@ static int o2hb_do_disk_heartbeat(struct o2hb_region *reg)
         ret = o2hb_read_slots(reg, highest_node + 1);
         if (ret < 0) {
                 mlog_errno(ret);
-                return ret;
+                goto bail;
         }
 
         /* With an up to date view of the slots, we can check that no
          * other node has been improperly configured to heartbeat in
          * our slot. */
-        o2hb_check_last_timestamp(reg);
+        own_slot_ok = o2hb_check_own_slot(reg);
 
         /* fill in the proper info for our next heartbeat */
         o2hb_prepare_block(reg, reg->hr_generation);
 
-        /* And fire off the write. Note that we don't wait on this I/O
-         * until later. */
         ret = o2hb_issue_node_write(reg, &write_wc);
         if (ret < 0) {
                 mlog_errno(ret);
-                return ret;
+                goto bail;
         }
 
         i = -1;
         while((i = find_next_bit(configured_nodes,
                                  O2NM_MAX_NODES, i + 1)) < O2NM_MAX_NODES) {
-                change |= o2hb_check_slot(reg, &reg->hr_slots[i]);
+                membership_change |= o2hb_check_slot(reg, &reg->hr_slots[i]);
         }
 
         /*
@@ -1030,18 +1050,39 @@ static int o2hb_do_disk_heartbeat(struct o2hb_region *reg)
                  * disk */
                 mlog(ML_ERROR, "Write error %d on device \"%s\"\n",
                      write_wc.wc_error, reg->hr_dev_name);
-                return write_wc.wc_error;
+                ret = write_wc.wc_error;
+                goto bail;
         }
 
-        o2hb_arm_write_timeout(reg);
+        /* Skip disarming the timeout if own slot has stale/bad data */
+        if (own_slot_ok) {
+                o2hb_set_quorum_device(reg);
+                o2hb_arm_write_timeout(reg);
+        }
 
+bail:
         /* let the person who launched us know when things are steady */
-        if (!change && (atomic_read(&reg->hr_steady_iterations) != 0)) {
-                if (atomic_dec_and_test(&reg->hr_steady_iterations))
+        if (atomic_read(&reg->hr_steady_iterations) != 0) {
+                if (!ret && own_slot_ok && !membership_change) {
+                        if (atomic_dec_and_test(&reg->hr_steady_iterations))
+                                wake_up(&o2hb_steady_queue);
+                }
+        }
+
+        if (atomic_read(&reg->hr_steady_iterations) != 0) {
+                if (atomic_dec_and_test(&reg->hr_unsteady_iterations)) {
+                        printk(KERN_NOTICE "o2hb: Unable to stabilize "
+                               "heartbeart on region %s (%s)\n",
+                               config_item_name(&reg->hr_item),
+                               reg->hr_dev_name);
+                        atomic_set(&reg->hr_steady_iterations, 0);
+                        reg->hr_aborted_start = 1;
                         wake_up(&o2hb_steady_queue);
+                        ret = -EIO;
+                }
         }
 
-        return 0;
+        return ret;
 }
 
 /* Subtract b from a, storing the result in a. a *must* have a larger
@@ -1095,7 +1136,8 @@ static int o2hb_thread(void *data)
         /* Pin node */
         o2nm_depend_this_node();
 
-        while (!kthread_should_stop() && !reg->hr_unclean_stop) {
+        while (!kthread_should_stop() &&
+               !reg->hr_unclean_stop && !reg->hr_aborted_start) {
                 /* We track the time spent inside
                  * o2hb_do_disk_heartbeat so that we avoid more than
                  * hr_timeout_ms between disk writes. On busy systems
@@ -1103,10 +1145,7 @@ static int o2hb_thread(void *data)
                  * likely to time itself out. */
                 do_gettimeofday(&before_hb);
 
-                i = 0;
-                do {
-                        ret = o2hb_do_disk_heartbeat(reg);
-                } while (ret && ++i < 2);
+                ret = o2hb_do_disk_heartbeat(reg);
 
                 do_gettimeofday(&after_hb);
                 elapsed_msec = o2hb_elapsed_msecs(&before_hb, &after_hb);
@@ -1117,7 +1156,8 @@ static int o2hb_thread(void *data)
                      after_hb.tv_sec, (unsigned long) after_hb.tv_usec,
                      elapsed_msec);
 
-                if (elapsed_msec < reg->hr_timeout_ms) {
+                if (!kthread_should_stop() &&
+                    elapsed_msec < reg->hr_timeout_ms) {
                         /* the kthread api has blocked signals for us so no
                          * need to record the return value. */
                         msleep_interruptible(reg->hr_timeout_ms - elapsed_msec);
@@ -1134,20 +1174,20 @@ static int o2hb_thread(void *data)
          * to timeout on this region when we could just as easily
          * write a clear generation - thus indicating to them that
          * this node has left this region.
-         *
-         * XXX: Should we skip this on unclean_stop? */
-        o2hb_prepare_block(reg, 0);
-        ret = o2hb_issue_node_write(reg, &write_wc);
-        if (ret == 0) {
-                o2hb_wait_on_io(reg, &write_wc);
-        } else {
-                mlog_errno(ret);
+         */
+        if (!reg->hr_unclean_stop && !reg->hr_aborted_start) {
+                o2hb_prepare_block(reg, 0);
+                ret = o2hb_issue_node_write(reg, &write_wc);
+                if (ret == 0)
+                        o2hb_wait_on_io(reg, &write_wc);
+                else
+                        mlog_errno(ret);
         }
 
         /* Unpin node */
         o2nm_undepend_this_node();
 
-        mlog(ML_HEARTBEAT|ML_KTHREAD, "hb thread exiting\n");
+        mlog(ML_HEARTBEAT|ML_KTHREAD, "o2hb thread exiting\n");
 
         return 0;
 }
@@ -1158,6 +1198,7 @@ static int o2hb_debug_open(struct inode *inode, struct file *file)
         struct o2hb_debug_buf *db = inode->i_private;
         struct o2hb_region *reg;
         unsigned long map[BITS_TO_LONGS(O2NM_MAX_NODES)];
+        unsigned long lts;
         char *buf = NULL;
         int i = -1;
         int out = 0;
@@ -1194,9 +1235,11 @@ static int o2hb_debug_open(struct inode *inode, struct file *file)
 
         case O2HB_DB_TYPE_REGION_ELAPSED_TIME:
                 reg = (struct o2hb_region *)db->db_data;
-                out += snprintf(buf + out, PAGE_SIZE - out, "%u\n",
-                                jiffies_to_msecs(jiffies -
-                                                 reg->hr_last_timeout_start));
+                lts = reg->hr_last_timeout_start;
+                /* If 0, it has never been set before */
+                if (lts)
+                        lts = jiffies_to_msecs(jiffies - lts);
+                out += snprintf(buf + out, PAGE_SIZE - out, "%lu\n", lts);
                 goto done;
 
         case O2HB_DB_TYPE_REGION_PINNED:
@@ -1426,6 +1469,8 @@ static void o2hb_region_release(struct config_item *item)
         struct page *page;
         struct o2hb_region *reg = to_o2hb_region(item);
 
+        mlog(ML_HEARTBEAT, "hb region release (%s)\n", reg->hr_dev_name);
+
         if (reg->hr_tmp_block)
                 kfree(reg->hr_tmp_block);
 
@@ -1792,7 +1837,10 @@ static ssize_t o2hb_region_dev_write(struct o2hb_region *reg,
                         live_threshold <<= 1;
                 spin_unlock(&o2hb_live_lock);
         }
-        atomic_set(&reg->hr_steady_iterations, live_threshold + 1);
+        ++live_threshold;
+        atomic_set(&reg->hr_steady_iterations, live_threshold);
+        /* unsteady_iterations is double the steady_iterations */
+        atomic_set(&reg->hr_unsteady_iterations, (live_threshold << 1));
 
         hb_task = kthread_run(o2hb_thread, reg, "o2hb-%s",
                               reg->hr_item.ci_name);
@@ -1809,14 +1857,12 @@ static ssize_t o2hb_region_dev_write(struct o2hb_region *reg,
         ret = wait_event_interruptible(o2hb_steady_queue,
                                 atomic_read(&reg->hr_steady_iterations) == 0);
         if (ret) {
-                /* We got interrupted (hello ptrace!).  Clean up */
-                spin_lock(&o2hb_live_lock);
-                hb_task = reg->hr_task;
-                reg->hr_task = NULL;
-                spin_unlock(&o2hb_live_lock);
+                atomic_set(&reg->hr_steady_iterations, 0);
+                reg->hr_aborted_start = 1;
+        }
 
-                if (hb_task)
-                        kthread_stop(hb_task);
+        if (reg->hr_aborted_start) {
+                ret = -EIO;
                 goto out;
         }
 
@@ -1833,8 +1879,8 @@ static ssize_t o2hb_region_dev_write(struct o2hb_region *reg,
                 ret = -EIO;
 
         if (hb_task && o2hb_global_heartbeat_active())
-                printk(KERN_NOTICE "o2hb: Heartbeat started on region %s\n",
-                       config_item_name(&reg->hr_item));
+                printk(KERN_NOTICE "o2hb: Heartbeat started on region %s (%s)\n",
+                       config_item_name(&reg->hr_item), reg->hr_dev_name);
 
 out:
         if (filp)
@@ -2092,13 +2138,6 @@ static void o2hb_heartbeat_group_drop_item(struct config_group *group,
 
         /* stop the thread when the user removes the region dir */
         spin_lock(&o2hb_live_lock);
-        if (o2hb_global_heartbeat_active()) {
-                clear_bit(reg->hr_region_num, o2hb_region_bitmap);
-                clear_bit(reg->hr_region_num, o2hb_live_region_bitmap);
-                if (test_bit(reg->hr_region_num, o2hb_quorum_region_bitmap))
-                        quorum_region = 1;
-                clear_bit(reg->hr_region_num, o2hb_quorum_region_bitmap);
-        }
         hb_task = reg->hr_task;
         reg->hr_task = NULL;
         reg->hr_item_dropped = 1;
@@ -2107,19 +2146,30 @@ static void o2hb_heartbeat_group_drop_item(struct config_group *group,
         if (hb_task)
                 kthread_stop(hb_task);
 
+        if (o2hb_global_heartbeat_active()) {
+                spin_lock(&o2hb_live_lock);
+                clear_bit(reg->hr_region_num, o2hb_region_bitmap);
+                clear_bit(reg->hr_region_num, o2hb_live_region_bitmap);
+                if (test_bit(reg->hr_region_num, o2hb_quorum_region_bitmap))
+                        quorum_region = 1;
+                clear_bit(reg->hr_region_num, o2hb_quorum_region_bitmap);
+                spin_unlock(&o2hb_live_lock);
+                printk(KERN_NOTICE "o2hb: Heartbeat %s on region %s (%s)\n",
+                       ((atomic_read(&reg->hr_steady_iterations) == 0) ?
+                        "stopped" : "start aborted"), config_item_name(item),
+                       reg->hr_dev_name);
+        }
+
         /*
          * If we're racing a dev_write(), we need to wake them.  They will
          * check reg->hr_task
          */
         if (atomic_read(&reg->hr_steady_iterations) != 0) {
+                reg->hr_aborted_start = 1;
                 atomic_set(&reg->hr_steady_iterations, 0);
                 wake_up(&o2hb_steady_queue);
         }
 
-        if (o2hb_global_heartbeat_active())
-                printk(KERN_NOTICE "o2hb: Heartbeat stopped on region %s\n",
-                       config_item_name(&reg->hr_item));
-
         config_item_put(item);
 
         if (!o2hb_global_heartbeat_active() || !quorum_region)
diff --git a/fs/ocfs2/cluster/netdebug.c b/fs/ocfs2/cluster/netdebug.c
index 3a5835904b3d..dc45deb19e68 100644
--- a/fs/ocfs2/cluster/netdebug.c
+++ b/fs/ocfs2/cluster/netdebug.c
@@ -47,6 +47,7 @@
 #define SC_DEBUG_NAME           "sock_containers"
 #define NST_DEBUG_NAME          "send_tracking"
 #define STATS_DEBUG_NAME        "stats"
+#define NODES_DEBUG_NAME        "connected_nodes"
 
 #define SHOW_SOCK_CONTAINERS    0
 #define SHOW_SOCK_STATS         1
@@ -55,6 +56,7 @@ static struct dentry *o2net_dentry;
 static struct dentry *sc_dentry;
 static struct dentry *nst_dentry;
 static struct dentry *stats_dentry;
+static struct dentry *nodes_dentry;
 
 static DEFINE_SPINLOCK(o2net_debug_lock);
 
@@ -491,53 +493,87 @@ static const struct file_operations sc_seq_fops = {
         .release = sc_fop_release,
 };
 
-int o2net_debugfs_init(void)
+static int o2net_fill_bitmap(char *buf, int len)
 {
-        o2net_dentry = debugfs_create_dir(O2NET_DEBUG_DIR, NULL);
-        if (!o2net_dentry) {
-                mlog_errno(-ENOMEM);
-                goto bail;
-        }
+        unsigned long map[BITS_TO_LONGS(O2NM_MAX_NODES)];
+        int i = -1, out = 0;
 
-        nst_dentry = debugfs_create_file(NST_DEBUG_NAME, S_IFREG|S_IRUSR,
-                                         o2net_dentry, NULL,
-                                         &nst_seq_fops);
-        if (!nst_dentry) {
-                mlog_errno(-ENOMEM);
-                goto bail;
-        }
+        o2net_fill_node_map(map, sizeof(map));
 
-        sc_dentry = debugfs_create_file(SC_DEBUG_NAME, S_IFREG|S_IRUSR,
-                                        o2net_dentry, NULL,
-                                        &sc_seq_fops);
-        if (!sc_dentry) {
-                mlog_errno(-ENOMEM);
-                goto bail;
-        }
+        while ((i = find_next_bit(map, O2NM_MAX_NODES, i + 1)) < O2NM_MAX_NODES)
+                out += snprintf(buf + out, PAGE_SIZE - out, "%d ", i);
+        out += snprintf(buf + out, PAGE_SIZE - out, "\n");
 
-        stats_dentry = debugfs_create_file(STATS_DEBUG_NAME, S_IFREG|S_IRUSR,
-                                           o2net_dentry, NULL,
-                                           &stats_seq_fops);
-        if (!stats_dentry) {
-                mlog_errno(-ENOMEM);
-                goto bail;
-        }
+        return out;
+}
+
+static int nodes_fop_open(struct inode *inode, struct file *file)
+{
+        char *buf;
+
+        buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        i_size_write(inode, o2net_fill_bitmap(buf, PAGE_SIZE));
+
+        file->private_data = buf;
 
         return 0;
-bail:
-        debugfs_remove(stats_dentry);
-        debugfs_remove(sc_dentry);
-        debugfs_remove(nst_dentry);
-        debugfs_remove(o2net_dentry);
-        return -ENOMEM;
 }
 
+static int o2net_debug_release(struct inode *inode, struct file *file)
+{
+        kfree(file->private_data);
+        return 0;
+}
+
+static ssize_t o2net_debug_read(struct file *file, char __user *buf,
+                                size_t nbytes, loff_t *ppos)
+{
+        return simple_read_from_buffer(buf, nbytes, ppos, file->private_data,
+                                       i_size_read(file->f_mapping->host));
+}
+
+static const struct file_operations nodes_fops = {
+        .open           = nodes_fop_open,
+        .release        = o2net_debug_release,
+        .read           = o2net_debug_read,
+        .llseek         = generic_file_llseek,
+};
+
 void o2net_debugfs_exit(void)
 {
+        debugfs_remove(nodes_dentry);
         debugfs_remove(stats_dentry);
         debugfs_remove(sc_dentry);
         debugfs_remove(nst_dentry);
         debugfs_remove(o2net_dentry);
 }
 
+int o2net_debugfs_init(void)
+{
+        mode_t mode = S_IFREG|S_IRUSR;
+
+        o2net_dentry = debugfs_create_dir(O2NET_DEBUG_DIR, NULL);
+        if (o2net_dentry)
+                nst_dentry = debugfs_create_file(NST_DEBUG_NAME, mode,
+                                        o2net_dentry, NULL, &nst_seq_fops);
+        if (nst_dentry)
+                sc_dentry = debugfs_create_file(SC_DEBUG_NAME, mode,
+                                        o2net_dentry, NULL, &sc_seq_fops);
+        if (sc_dentry)
+                stats_dentry = debugfs_create_file(STATS_DEBUG_NAME, mode,
+                                        o2net_dentry, NULL, &stats_seq_fops);
+        if (stats_dentry)
+                nodes_dentry = debugfs_create_file(NODES_DEBUG_NAME, mode,
+                                        o2net_dentry, NULL, &nodes_fops);
+        if (nodes_dentry)
+                return 0;
+
+        o2net_debugfs_exit();
+        mlog_errno(-ENOMEM);
+        return -ENOMEM;
+}
+
 #endif  /* CONFIG_DEBUG_FS */
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index ad7d0c155de4..044e7b58d31c 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -546,7 +546,7 @@ static void o2net_set_nn_state(struct o2net_node *nn,
         }
 
         if (was_valid && !valid) {
-                printk(KERN_NOTICE "o2net: no longer connected to "
+                printk(KERN_NOTICE "o2net: No longer connected to "
                        SC_NODEF_FMT "\n", SC_NODEF_ARGS(old_sc));
                 o2net_complete_nodes_nsw(nn);
         }
@@ -556,7 +556,7 @@ static void o2net_set_nn_state(struct o2net_node *nn,
                 cancel_delayed_work(&nn->nn_connect_expired);
                 printk(KERN_NOTICE "o2net: %s " SC_NODEF_FMT "\n",
                        o2nm_this_node() > sc->sc_node->nd_num ?
-                                "connected to" : "accepted connection from",
+                       "Connected to" : "Accepted connection from",
                        SC_NODEF_ARGS(sc));
         }
 
@@ -644,7 +644,7 @@ static void o2net_state_change(struct sock *sk)
                         o2net_sc_queue_work(sc, &sc->sc_connect_work);
                         break;
                 default:
-                        printk(KERN_INFO "o2net: connection to " SC_NODEF_FMT
+                        printk(KERN_INFO "o2net: Connection to " SC_NODEF_FMT
                               " shutdown, state %d\n",
                               SC_NODEF_ARGS(sc), sk->sk_state);
                         o2net_sc_queue_work(sc, &sc->sc_shutdown_work);
@@ -1035,6 +1035,25 @@ static int o2net_tx_can_proceed(struct o2net_node *nn,
         return ret;
 }
 
+/* Get a map of all nodes to which this node is currently connected to */
+void o2net_fill_node_map(unsigned long *map, unsigned bytes)
+{
+        struct o2net_sock_container *sc;
+        int node, ret;
+
+        BUG_ON(bytes < (BITS_TO_LONGS(O2NM_MAX_NODES) * sizeof(unsigned long)));
+
+        memset(map, 0, bytes);
+        for (node = 0; node < O2NM_MAX_NODES; ++node) {
+                o2net_tx_can_proceed(o2net_nn_from_num(node), &sc, &ret);
+                if (!ret) {
+                        set_bit(node, map);
+                        sc_put(sc);
+                }
+        }
+}
+EXPORT_SYMBOL_GPL(o2net_fill_node_map);
+
 int o2net_send_message_vec(u32 msg_type, u32 key, struct kvec *caller_vec,
                            size_t caller_veclen, u8 target_node, int *status)
 {
@@ -1285,11 +1304,11 @@ static int o2net_check_handshake(struct o2net_sock_container *sc)
         struct o2net_node *nn = o2net_nn_from_num(sc->sc_node->nd_num);
 
         if (hand->protocol_version != cpu_to_be64(O2NET_PROTOCOL_VERSION)) {
-                mlog(ML_NOTICE, SC_NODEF_FMT " advertised net protocol "
-                     "version %llu but %llu is required, disconnecting\n",
-                     SC_NODEF_ARGS(sc),
-                     (unsigned long long)be64_to_cpu(hand->protocol_version),
-                     O2NET_PROTOCOL_VERSION);
+                printk(KERN_NOTICE "o2net: " SC_NODEF_FMT " Advertised net "
+                       "protocol version %llu but %llu is required. "
+                       "Disconnecting.\n", SC_NODEF_ARGS(sc),
+                       (unsigned long long)be64_to_cpu(hand->protocol_version),
+                       O2NET_PROTOCOL_VERSION);
 
                 /* don't bother reconnecting if its the wrong version. */
                 o2net_ensure_shutdown(nn, sc, -ENOTCONN);
@@ -1303,33 +1322,33 @@ static int o2net_check_handshake(struct o2net_sock_container *sc)
          */
         if (be32_to_cpu(hand->o2net_idle_timeout_ms) !=
                                 o2net_idle_timeout()) {
-                mlog(ML_NOTICE, SC_NODEF_FMT " uses a network idle timeout of "
-                     "%u ms, but we use %u ms locally.  disconnecting\n",
-                     SC_NODEF_ARGS(sc),
-                     be32_to_cpu(hand->o2net_idle_timeout_ms),
-                     o2net_idle_timeout());
+                printk(KERN_NOTICE "o2net: " SC_NODEF_FMT " uses a network "
+                       "idle timeout of %u ms, but we use %u ms locally. "
+                       "Disconnecting.\n", SC_NODEF_ARGS(sc),
+                       be32_to_cpu(hand->o2net_idle_timeout_ms),
+                       o2net_idle_timeout());
                 o2net_ensure_shutdown(nn, sc, -ENOTCONN);
                 return -1;
         }
 
         if (be32_to_cpu(hand->o2net_keepalive_delay_ms) !=
                         o2net_keepalive_delay()) {
-                mlog(ML_NOTICE, SC_NODEF_FMT " uses a keepalive delay of "
-                     "%u ms, but we use %u ms locally.  disconnecting\n",
-                     SC_NODEF_ARGS(sc),
-                     be32_to_cpu(hand->o2net_keepalive_delay_ms),
-                     o2net_keepalive_delay());
+                printk(KERN_NOTICE "o2net: " SC_NODEF_FMT " uses a keepalive "
+                       "delay of %u ms, but we use %u ms locally. "
+                       "Disconnecting.\n", SC_NODEF_ARGS(sc),
+                       be32_to_cpu(hand->o2net_keepalive_delay_ms),
+                       o2net_keepalive_delay());
                 o2net_ensure_shutdown(nn, sc, -ENOTCONN);
                 return -1;
         }
 
         if (be32_to_cpu(hand->o2hb_heartbeat_timeout_ms) !=
                         O2HB_MAX_WRITE_TIMEOUT_MS) {
-                mlog(ML_NOTICE, SC_NODEF_FMT " uses a heartbeat timeout of "
-                     "%u ms, but we use %u ms locally.  disconnecting\n",
-                     SC_NODEF_ARGS(sc),
-                     be32_to_cpu(hand->o2hb_heartbeat_timeout_ms),
-                     O2HB_MAX_WRITE_TIMEOUT_MS);
+                printk(KERN_NOTICE "o2net: " SC_NODEF_FMT " uses a heartbeat "
+                       "timeout of %u ms, but we use %u ms locally. "
+                       "Disconnecting.\n", SC_NODEF_ARGS(sc),
+                       be32_to_cpu(hand->o2hb_heartbeat_timeout_ms),
+                       O2HB_MAX_WRITE_TIMEOUT_MS);
                 o2net_ensure_shutdown(nn, sc, -ENOTCONN);
                 return -1;
         }
@@ -1540,28 +1559,16 @@ static void o2net_idle_timer(unsigned long data)
 {
         struct o2net_sock_container *sc = (struct o2net_sock_container *)data;
         struct o2net_node *nn = o2net_nn_from_num(sc->sc_node->nd_num);
-
 #ifdef CONFIG_DEBUG_FS
-        ktime_t now = ktime_get();
+        unsigned long msecs = ktime_to_ms(ktime_get()) -
+                ktime_to_ms(sc->sc_tv_timer);
+#else
+        unsigned long msecs = o2net_idle_timeout();
 #endif
 
-        printk(KERN_NOTICE "o2net: connection to " SC_NODEF_FMT " has been idle for %u.%u "
-             "seconds, shutting it down.\n", SC_NODEF_ARGS(sc),
-                     o2net_idle_timeout() / 1000,
-                     o2net_idle_timeout() % 1000);
-
-#ifdef CONFIG_DEBUG_FS
-        mlog(ML_NOTICE, "Here are some times that might help debug the "
-             "situation: (Timer: %lld, Now %lld, DataReady %lld, Advance %lld-%lld, "
-             "Key 0x%08x, Func %u, FuncTime %lld-%lld)\n",
-             (long long)ktime_to_us(sc->sc_tv_timer), (long long)ktime_to_us(now),
-             (long long)ktime_to_us(sc->sc_tv_data_ready),
-             (long long)ktime_to_us(sc->sc_tv_advance_start),
-             (long long)ktime_to_us(sc->sc_tv_advance_stop),
-             sc->sc_msg_key, sc->sc_msg_type,
-             (long long)ktime_to_us(sc->sc_tv_func_start),
-             (long long)ktime_to_us(sc->sc_tv_func_stop));
-#endif
+        printk(KERN_NOTICE "o2net: Connection to " SC_NODEF_FMT " has been "
+               "idle for %lu.%lu secs, shutting it down.\n", SC_NODEF_ARGS(sc),
+               msecs / 1000, msecs % 1000);
 
         /*
          * Initialize the nn_timeout so that the next connection attempt
@@ -1694,8 +1701,8 @@ static void o2net_start_connect(struct work_struct *work)
 
 out:
         if (ret) {
-                mlog(ML_NOTICE, "connect attempt to " SC_NODEF_FMT " failed "
-                     "with errno %d\n", SC_NODEF_ARGS(sc), ret);
+                printk(KERN_NOTICE "o2net: Connect attempt to " SC_NODEF_FMT
+                       " failed with errno %d\n", SC_NODEF_ARGS(sc), ret);
                 /* 0 err so that another will be queued and attempted
                  * from set_nn_state */
                 if (sc)
@@ -1718,8 +1725,8 @@ static void o2net_connect_expired(struct work_struct *work)
 
         spin_lock(&nn->nn_lock);
         if (!nn->nn_sc_valid) {
-                mlog(ML_ERROR, "no connection established with node %u after "
-                     "%u.%u seconds, giving up and returning errors.\n",
+                printk(KERN_NOTICE "o2net: No connection established with "
+                       "node %u after %u.%u seconds, giving up.\n",
                      o2net_num_from_nn(nn),
                      o2net_idle_timeout() / 1000,
                      o2net_idle_timeout() % 1000);
@@ -1862,21 +1869,21 @@ static int o2net_accept_one(struct socket *sock)
 
         node = o2nm_get_node_by_ip(sin.sin_addr.s_addr);
         if (node == NULL) {
-                mlog(ML_NOTICE, "attempt to connect from unknown node at %pI4:%d\n",
-                     &sin.sin_addr.s_addr, ntohs(sin.sin_port));
+                printk(KERN_NOTICE "o2net: Attempt to connect from unknown "
+                       "node at %pI4:%d\n", &sin.sin_addr.s_addr,
+                       ntohs(sin.sin_port));
                 ret = -EINVAL;
                 goto out;
         }
 
         if (o2nm_this_node() >= node->nd_num) {
                 local_node = o2nm_get_node_by_num(o2nm_this_node());
-                mlog(ML_NOTICE, "unexpected connect attempt seen at node '%s' ("
-                     "%u, %pI4:%d) from node '%s' (%u, %pI4:%d)\n",
-                     local_node->nd_name, local_node->nd_num,
-                     &(local_node->nd_ipv4_address),
-                     ntohs(local_node->nd_ipv4_port),
-                     node->nd_name, node->nd_num, &sin.sin_addr.s_addr,
-                     ntohs(sin.sin_port));
+                printk(KERN_NOTICE "o2net: Unexpected connect attempt seen "
+                       "at node '%s' (%u, %pI4:%d) from node '%s' (%u, "
+                       "%pI4:%d)\n", local_node->nd_name, local_node->nd_num,
+                       &(local_node->nd_ipv4_address),
+                       ntohs(local_node->nd_ipv4_port), node->nd_name,
+                       node->nd_num, &sin.sin_addr.s_addr, ntohs(sin.sin_port));
                 ret = -EINVAL;
                 goto out;
         }
@@ -1901,10 +1908,10 @@ static int o2net_accept_one(struct socket *sock)
                 ret = 0;
         spin_unlock(&nn->nn_lock);
         if (ret) {
-                mlog(ML_NOTICE, "attempt to connect from node '%s' at "
-                     "%pI4:%d but it already has an open connection\n",
-                     node->nd_name, &sin.sin_addr.s_addr,
-                     ntohs(sin.sin_port));
+                printk(KERN_NOTICE "o2net: Attempt to connect from node '%s' "
+                       "at %pI4:%d but it already has an open connection\n",
+                       node->nd_name, &sin.sin_addr.s_addr,
+                       ntohs(sin.sin_port));
                 goto out;
         }
 
@@ -1984,7 +1991,7 @@ static int o2net_open_listening_sock(__be32 addr, __be16 port)
 
         ret = sock_create(PF_INET, SOCK_STREAM, IPPROTO_TCP, &sock);
         if (ret < 0) {
-                mlog(ML_ERROR, "unable to create socket, ret=%d\n", ret);
+                printk(KERN_ERR "o2net: Error %d while creating socket\n", ret);
                 goto out;
         }
 
@@ -2001,16 +2008,15 @@ static int o2net_open_listening_sock(__be32 addr, __be16 port)
         sock->sk->sk_reuse = 1;
         ret = sock->ops->bind(sock, (struct sockaddr *)&sin, sizeof(sin));
         if (ret < 0) {
-                mlog(ML_ERROR, "unable to bind socket at %pI4:%u, "
-                     "ret=%d\n", &addr, ntohs(port), ret);
+                printk(KERN_ERR "o2net: Error %d while binding socket at "
+                       "%pI4:%u\n", ret, &addr, ntohs(port)); 
                 goto out;
         }
 
         ret = sock->ops->listen(sock, 64);
-        if (ret < 0) {
-                mlog(ML_ERROR, "unable to listen on %pI4:%u, ret=%d\n",
-                     &addr, ntohs(port), ret);
-        }
+        if (ret < 0)
+                printk(KERN_ERR "o2net: Error %d while listening on %pI4:%u\n",
+                       ret, &addr, ntohs(port));
 
 out:
         if (ret) {
diff --git a/fs/ocfs2/cluster/tcp.h b/fs/ocfs2/cluster/tcp.h
index fd6179eb26d4..5bada2a69b50 100644
--- a/fs/ocfs2/cluster/tcp.h
+++ b/fs/ocfs2/cluster/tcp.h
@@ -106,6 +106,8 @@ int o2net_register_handler(u32 msg_type, u32 key, u32 max_len,
                            struct list_head *unreg_list);
 void o2net_unregister_handler_list(struct list_head *list);
 
+void o2net_fill_node_map(unsigned long *map, unsigned bytes);
+
 struct o2nm_node;
 int o2net_register_hb_callbacks(void);
 void o2net_unregister_hb_callbacks(void);
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index e2878b5895fb..8fe4e2892ab9 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -1184,8 +1184,7 @@ static int __ocfs2_delete_entry(handle_t *handle, struct inode *dir,
                         if (pde)
                                 le16_add_cpu(&pde->rec_len,
                                                 le16_to_cpu(de->rec_len));
-                        else
-                                de->inode = 0;
+                        de->inode = 0;
                         dir->i_version++;
                         ocfs2_journal_dirty(handle, bh);
                         goto bail;
diff --git a/fs/ocfs2/dlm/dlmcommon.h b/fs/ocfs2/dlm/dlmcommon.h
index d602abb51b61..a5952ceecba5 100644
--- a/fs/ocfs2/dlm/dlmcommon.h
+++ b/fs/ocfs2/dlm/dlmcommon.h
@@ -859,8 +859,8 @@ void dlm_complete_recovery_thread(struct dlm_ctxt *dlm);
 void dlm_wait_for_recovery(struct dlm_ctxt *dlm);
 void dlm_kick_recovery_thread(struct dlm_ctxt *dlm);
 int dlm_is_node_dead(struct dlm_ctxt *dlm, u8 node);
-int dlm_wait_for_node_death(struct dlm_ctxt *dlm, u8 node, int timeout);
-int dlm_wait_for_node_recovery(struct dlm_ctxt *dlm, u8 node, int timeout);
+void dlm_wait_for_node_death(struct dlm_ctxt *dlm, u8 node, int timeout);
+void dlm_wait_for_node_recovery(struct dlm_ctxt *dlm, u8 node, int timeout);
 
 void dlm_put(struct dlm_ctxt *dlm);
 struct dlm_ctxt *dlm_grab(struct dlm_ctxt *dlm);
@@ -877,9 +877,8 @@ static inline void dlm_lockres_get(struct dlm_lock_resource *res)
         kref_get(&res->refs);
 }
 void dlm_lockres_put(struct dlm_lock_resource *res);
-void __dlm_unhash_lockres(struct dlm_lock_resource *res);
-void __dlm_insert_lockres(struct dlm_ctxt *dlm,
-                          struct dlm_lock_resource *res);
+void __dlm_unhash_lockres(struct dlm_ctxt *dlm, struct dlm_lock_resource *res);
+void __dlm_insert_lockres(struct dlm_ctxt *dlm, struct dlm_lock_resource *res);
 struct dlm_lock_resource * __dlm_lookup_lockres_full(struct dlm_ctxt *dlm,
                                                      const char *name,
                                                      unsigned int len,
@@ -902,46 +901,15 @@ struct dlm_lock_resource *dlm_new_lockres(struct dlm_ctxt *dlm,
                                           const char *name,
                                           unsigned int namelen);
 
-#define dlm_lockres_set_refmap_bit(bit,res)  \
-        __dlm_lockres_set_refmap_bit(bit,res,__FILE__,__LINE__)
-#define dlm_lockres_clear_refmap_bit(bit,res)  \
-        __dlm_lockres_clear_refmap_bit(bit,res,__FILE__,__LINE__)
+void dlm_lockres_set_refmap_bit(struct dlm_ctxt *dlm,
+                                struct dlm_lock_resource *res, int bit);
+void dlm_lockres_clear_refmap_bit(struct dlm_ctxt *dlm,
+                                  struct dlm_lock_resource *res, int bit);
 
-static inline void __dlm_lockres_set_refmap_bit(int bit,
-                                                struct dlm_lock_resource *res,
-                                                const char *file,
-                                                int line)
-{
-        //printk("%s:%d:%.*s: setting bit %d\n", file, line,
-        //     res->lockname.len, res->lockname.name, bit);
-        set_bit(bit, res->refmap);
-}
-
-static inline void __dlm_lockres_clear_refmap_bit(int bit,
-                                                  struct dlm_lock_resource *res,
-                                                  const char *file,
-                                                  int line)
-{
-        //printk("%s:%d:%.*s: clearing bit %d\n", file, line,
-        //     res->lockname.len, res->lockname.name, bit);
-        clear_bit(bit, res->refmap);
-}
-
-void __dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm,
-                                   struct dlm_lock_resource *res,
-                                   const char *file,
-                                   int line);
-void __dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
-                                   struct dlm_lock_resource *res,
-                                   int new_lockres,
-                                   const char *file,
-                                   int line);
-#define dlm_lockres_drop_inflight_ref(d,r)  \
-        __dlm_lockres_drop_inflight_ref(d,r,__FILE__,__LINE__)
-#define dlm_lockres_grab_inflight_ref(d,r)  \
-        __dlm_lockres_grab_inflight_ref(d,r,0,__FILE__,__LINE__)
-#define dlm_lockres_grab_inflight_ref_new(d,r)  \
-        __dlm_lockres_grab_inflight_ref(d,r,1,__FILE__,__LINE__)
+void dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm,
+                                   struct dlm_lock_resource *res);
+void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
+                                   struct dlm_lock_resource *res);
 
 void dlm_queue_ast(struct dlm_ctxt *dlm, struct dlm_lock *lock);
 void dlm_queue_bast(struct dlm_ctxt *dlm, struct dlm_lock *lock);
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 6ed6b95dcf93..92f2ead0fab6 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -157,16 +157,18 @@ static int dlm_protocol_compare(struct dlm_protocol_version *existing,
 
 static void dlm_unregister_domain_handlers(struct dlm_ctxt *dlm);
 
-void __dlm_unhash_lockres(struct dlm_lock_resource *lockres)
+void __dlm_unhash_lockres(struct dlm_ctxt *dlm, struct dlm_lock_resource *res)
 {
-        if (!hlist_unhashed(&lockres->hash_node)) {
-                hlist_del_init(&lockres->hash_node);
-                dlm_lockres_put(lockres);
-        }
+        if (hlist_unhashed(&res->hash_node))
+                return;
+
+        mlog(0, "%s: Unhash res %.*s\n", dlm->name, res->lockname.len,
+             res->lockname.name);
+        hlist_del_init(&res->hash_node);
+        dlm_lockres_put(res);
 }
 
-void __dlm_insert_lockres(struct dlm_ctxt *dlm,
-                       struct dlm_lock_resource *res)
+void __dlm_insert_lockres(struct dlm_ctxt *dlm, struct dlm_lock_resource *res)
 {
         struct hlist_head *bucket;
         struct qstr *q;
@@ -180,6 +182,9 @@ void __dlm_insert_lockres(struct dlm_ctxt *dlm,
         dlm_lockres_get(res);
 
         hlist_add_head(&res->hash_node, bucket);
+
+        mlog(0, "%s: Hash res %.*s\n", dlm->name, res->lockname.len,
+             res->lockname.name);
 }
 
 struct dlm_lock_resource * __dlm_lookup_lockres_full(struct dlm_ctxt *dlm,
@@ -539,17 +544,17 @@ again:
 
 static void __dlm_print_nodes(struct dlm_ctxt *dlm)
 {
-        int node = -1;
+        int node = -1, num = 0;
 
         assert_spin_locked(&dlm->spinlock);
 
-        printk(KERN_NOTICE "o2dlm: Nodes in domain %s: ", dlm->name);
-
+        printk("( ");
         while ((node = find_next_bit(dlm->domain_map, O2NM_MAX_NODES,
                                      node + 1)) < O2NM_MAX_NODES) {
                 printk("%d ", node);
+                ++num;
         }
-        printk("\n");
+        printk(") %u nodes\n", num);
 }
 
 static int dlm_exit_domain_handler(struct o2net_msg *msg, u32 len, void *data,
@@ -566,11 +571,10 @@ static int dlm_exit_domain_handler(struct o2net_msg *msg, u32 len, void *data,
 
         node = exit_msg->node_idx;
 
-        printk(KERN_NOTICE "o2dlm: Node %u leaves domain %s\n", node, dlm->name);
-
         spin_lock(&dlm->spinlock);
         clear_bit(node, dlm->domain_map);
         clear_bit(node, dlm->exit_domain_map);
+        printk(KERN_NOTICE "o2dlm: Node %u leaves domain %s ", node, dlm->name);
         __dlm_print_nodes(dlm);
 
         /* notify anything attached to the heartbeat events */
@@ -755,6 +759,7 @@ void dlm_unregister_domain(struct dlm_ctxt *dlm)
 
                 dlm_mark_domain_leaving(dlm);
                 dlm_leave_domain(dlm);
+                printk(KERN_NOTICE "o2dlm: Leaving domain %s\n", dlm->name);
                 dlm_force_free_mles(dlm);
                 dlm_complete_dlm_shutdown(dlm);
         }
@@ -970,7 +975,7 @@ static int dlm_assert_joined_handler(struct o2net_msg *msg, u32 len, void *data,
                 clear_bit(assert->node_idx, dlm->exit_domain_map);
                 __dlm_set_joining_node(dlm, DLM_LOCK_RES_OWNER_UNKNOWN);
 
-                printk(KERN_NOTICE "o2dlm: Node %u joins domain %s\n",
+                printk(KERN_NOTICE "o2dlm: Node %u joins domain %s ",
                        assert->node_idx, dlm->name);
                 __dlm_print_nodes(dlm);
 
@@ -1701,8 +1706,10 @@ static int dlm_try_to_join_domain(struct dlm_ctxt *dlm)
 bail:
         spin_lock(&dlm->spinlock);
         __dlm_set_joining_node(dlm, DLM_LOCK_RES_OWNER_UNKNOWN);
-        if (!status)
+        if (!status) {
+                printk(KERN_NOTICE "o2dlm: Joining domain %s ", dlm->name);
                 __dlm_print_nodes(dlm);
+        }
         spin_unlock(&dlm->spinlock);
 
         if (ctxt) {
@@ -2131,13 +2138,6 @@ struct dlm_ctxt * dlm_register_domain(const char *domain,
                 goto leave;
         }
 
-        if (!o2hb_check_local_node_heartbeating()) {
-                mlog(ML_ERROR, "the local node has not been configured, or is "
-                     "not heartbeating\n");
-                ret = -EPROTO;
-                goto leave;
-        }
-
         mlog(0, "register called for domain \"%s\"\n", domain);
 
 retry:
diff --git a/fs/ocfs2/dlm/dlmlock.c b/fs/ocfs2/dlm/dlmlock.c
index 8d39e0fd66f7..975810b98492 100644
--- a/fs/ocfs2/dlm/dlmlock.c
+++ b/fs/ocfs2/dlm/dlmlock.c
@@ -183,10 +183,6 @@ static enum dlm_status dlmlock_master(struct dlm_ctxt *dlm,
                         kick_thread = 1;
                 }
         }
-        /* reduce the inflight count, this may result in the lockres
-         * being purged below during calc_usage */
-        if (lock->ml.node == dlm->node_num)
-                dlm_lockres_drop_inflight_ref(dlm, res);
 
         spin_unlock(&res->spinlock);
         wake_up(&res->wq);
@@ -231,10 +227,16 @@ static enum dlm_status dlmlock_remote(struct dlm_ctxt *dlm,
              lock->ml.type, res->lockname.len,
              res->lockname.name, flags);
 
+        /*
+         * Wait if resource is getting recovered, remastered, etc.
+         * If the resource was remastered and new owner is self, then exit.
+         */
         spin_lock(&res->spinlock);
-
-        /* will exit this call with spinlock held */
         __dlm_wait_on_lockres(res);
+        if (res->owner == dlm->node_num) {
+                spin_unlock(&res->spinlock);
+                return DLM_RECOVERING;
+        }
         res->state |= DLM_LOCK_RES_IN_PROGRESS;
 
         /* add lock to local (secondary) queue */
@@ -319,27 +321,23 @@ static enum dlm_status dlm_send_remote_lock_request(struct dlm_ctxt *dlm,
         tmpret = o2net_send_message(DLM_CREATE_LOCK_MSG, dlm->key, &create,
                                     sizeof(create), res->owner, &status);
         if (tmpret >= 0) {
-                // successfully sent and received
-                ret = status;  // this is already a dlm_status
+                ret = status;
                 if (ret == DLM_REJECTED) {
-                        mlog(ML_ERROR, "%s:%.*s: BUG.  this is a stale lockres "
-                             "no longer owned by %u.  that node is coming back "
-                             "up currently.\n", dlm->name, create.namelen,
+                        mlog(ML_ERROR, "%s: res %.*s, Stale lockres no longer "
+                             "owned by node %u. That node is coming back up "
+                             "currently.\n", dlm->name, create.namelen,
                              create.name, res->owner);
                         dlm_print_one_lock_resource(res);
                         BUG();
                 }
         } else {
-                mlog(ML_ERROR, "Error %d when sending message %u (key 0x%x) to "
-                     "node %u\n", tmpret, DLM_CREATE_LOCK_MSG, dlm->key,
-                     res->owner);
-                if (dlm_is_host_down(tmpret)) {
+                mlog(ML_ERROR, "%s: res %.*s, Error %d send CREATE LOCK to "
+                     "node %u\n", dlm->name, create.namelen, create.name,
+                     tmpret, res->owner);
+                if (dlm_is_host_down(tmpret))
                         ret = DLM_RECOVERING;
-                        mlog(0, "node %u died so returning DLM_RECOVERING "
-                             "from lock message!\n", res->owner);
-                } else {
+                else
                         ret = dlm_err_to_dlm_status(tmpret);
-                }
         }
 
         return ret;
@@ -440,7 +438,7 @@ struct dlm_lock * dlm_new_lock(int type, u8 node, u64 cookie,
                 /* zero memory only if kernel-allocated */
                 lksb = kzalloc(sizeof(*lksb), GFP_NOFS);
                 if (!lksb) {
-                        kfree(lock);
+                        kmem_cache_free(dlm_lock_cache, lock);
                         return NULL;
                 }
                 kernel_allocated = 1;
@@ -718,18 +716,10 @@ retry_lock:
 
                 if (status == DLM_RECOVERING || status == DLM_MIGRATING ||
                     status == DLM_FORWARD) {
-                        mlog(0, "retrying lock with migration/"
-                             "recovery/in progress\n");
                         msleep(100);
-                        /* no waiting for dlm_reco_thread */
                         if (recovery) {
                                 if (status != DLM_RECOVERING)
                                         goto retry_lock;
-
-                                mlog(0, "%s: got RECOVERING "
-                                     "for $RECOVERY lock, master "
-                                     "was %u\n", dlm->name,
-                                     res->owner);
                                 /* wait to see the node go down, then
                                  * drop down and allow the lockres to
                                  * get cleaned up.  need to remaster. */
@@ -741,6 +731,14 @@ retry_lock:
                         }
                 }
 
+                /* Inflight taken in dlm_get_lock_resource() is dropped here */
+                spin_lock(&res->spinlock);
+                dlm_lockres_drop_inflight_ref(dlm, res);
+                spin_unlock(&res->spinlock);
+
+                dlm_lockres_calc_usage(dlm, res);
+                dlm_kick_thread(dlm, res);
+
                 if (status != DLM_NORMAL) {
                         lock->lksb->flags &= ~DLM_LKSB_GET_LVB;
                         if (status != DLM_NOTQUEUED)
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 11eefb8c12e9..005261c333b0 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -631,39 +631,54 @@ error:
         return NULL;
 }
 
-void __dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
-                                   struct dlm_lock_resource *res,
-                                   int new_lockres,
-                                   const char *file,
-                                   int line)
+void dlm_lockres_set_refmap_bit(struct dlm_ctxt *dlm,
+                                struct dlm_lock_resource *res, int bit)
 {
-        if (!new_lockres)
-                assert_spin_locked(&res->spinlock);
+        assert_spin_locked(&res->spinlock);
+
+        mlog(0, "res %.*s, set node %u, %ps()\n", res->lockname.len,
+             res->lockname.name, bit, __builtin_return_address(0));
+
+        set_bit(bit, res->refmap);
+}
+
+void dlm_lockres_clear_refmap_bit(struct dlm_ctxt *dlm,
+                                  struct dlm_lock_resource *res, int bit)
+{
+        assert_spin_locked(&res->spinlock);
+
+        mlog(0, "res %.*s, clr node %u, %ps()\n", res->lockname.len,
+             res->lockname.name, bit, __builtin_return_address(0));
+
+        clear_bit(bit, res->refmap);
+}
+
+
+void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
+                                   struct dlm_lock_resource *res)
+{
+        assert_spin_locked(&res->spinlock);
 
-        if (!test_bit(dlm->node_num, res->refmap)) {
-                BUG_ON(res->inflight_locks != 0);
-                dlm_lockres_set_refmap_bit(dlm->node_num, res);
-        }
         res->inflight_locks++;
-        mlog(0, "%s:%.*s: inflight++: now %u\n",
-             dlm->name, res->lockname.len, res->lockname.name,
-             res->inflight_locks);
+
+        mlog(0, "%s: res %.*s, inflight++: now %u, %ps()\n", dlm->name,
+             res->lockname.len, res->lockname.name, res->inflight_locks,
+             __builtin_return_address(0));
 }
 
-void __dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm,
-                                   struct dlm_lock_resource *res,
-                                   const char *file,
-                                   int line)
+void dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm,
+                                   struct dlm_lock_resource *res)
 {
         assert_spin_locked(&res->spinlock);
 
         BUG_ON(res->inflight_locks == 0);
+
         res->inflight_locks--;
-        mlog(0, "%s:%.*s: inflight--: now %u\n",
-             dlm->name, res->lockname.len, res->lockname.name,
-             res->inflight_locks);
-        if (res->inflight_locks == 0)
-                dlm_lockres_clear_refmap_bit(dlm->node_num, res);
+
+        mlog(0, "%s: res %.*s, inflight--: now %u, %ps()\n", dlm->name,
+             res->lockname.len, res->lockname.name, res->inflight_locks,
+             __builtin_return_address(0));
+
         wake_up(&res->wq);
 }
 
@@ -697,7 +712,6 @@ struct dlm_lock_resource * dlm_get_lock_resource(struct dlm_ctxt *dlm,
         unsigned int hash;
         int tries = 0;
         int bit, wait_on_recovery = 0;
-        int drop_inflight_if_nonlocal = 0;
 
         BUG_ON(!lockid);
 
@@ -709,36 +723,33 @@ lookup:
         spin_lock(&dlm->spinlock);
         tmpres = __dlm_lookup_lockres_full(dlm, lockid, namelen, hash);
         if (tmpres) {
-                int dropping_ref = 0;
-
                 spin_unlock(&dlm->spinlock);
-
                 spin_lock(&tmpres->spinlock);
-                /* We wait for the other thread that is mastering the resource */
+                /* Wait on the thread that is mastering the resource */
                 if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) {
                         __dlm_wait_on_lockres(tmpres);
                         BUG_ON(tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN);
+                        spin_unlock(&tmpres->spinlock);
+                        dlm_lockres_put(tmpres);
+                        tmpres = NULL;
+                        goto lookup;
                 }
 
-                if (tmpres->owner == dlm->node_num) {
-                        BUG_ON(tmpres->state & DLM_LOCK_RES_DROPPING_REF);
-                        dlm_lockres_grab_inflight_ref(dlm, tmpres);
-                } else if (tmpres->state & DLM_LOCK_RES_DROPPING_REF)
-                        dropping_ref = 1;
-                spin_unlock(&tmpres->spinlock);
-
-                /* wait until done messaging the master, drop our ref to allow
-                 * the lockres to be purged, start over. */
-                if (dropping_ref) {
-                        spin_lock(&tmpres->spinlock);
-                        __dlm_wait_on_lockres_flags(tmpres, DLM_LOCK_RES_DROPPING_REF);
+                /* Wait on the resource purge to complete before continuing */
+                if (tmpres->state & DLM_LOCK_RES_DROPPING_REF) {
+                        BUG_ON(tmpres->owner == dlm->node_num);
+                        __dlm_wait_on_lockres_flags(tmpres,
+                                                    DLM_LOCK_RES_DROPPING_REF);
                         spin_unlock(&tmpres->spinlock);
                         dlm_lockres_put(tmpres);
                         tmpres = NULL;
                         goto lookup;
                 }
 
-                mlog(0, "found in hash!\n");
+                /* Grab inflight ref to pin the resource */
+                dlm_lockres_grab_inflight_ref(dlm, tmpres);
+
+                spin_unlock(&tmpres->spinlock);
                 if (res)
                         dlm_lockres_put(res);
                 res = tmpres;
@@ -829,8 +840,8 @@ lookup:
                  * but they might own this lockres.  wait on them. */
                 bit = find_next_bit(dlm->recovery_map, O2NM_MAX_NODES, 0);
                 if (bit < O2NM_MAX_NODES) {
-                        mlog(ML_NOTICE, "%s:%.*s: at least one node (%d) to "
-                             "recover before lock mastery can begin\n",
+                        mlog(0, "%s: res %.*s, At least one node (%d) "
+                             "to recover before lock mastery can begin\n",
                              dlm->name, namelen, (char *)lockid, bit);
                         wait_on_recovery = 1;
                 }
@@ -843,12 +854,11 @@ lookup:
 
         /* finally add the lockres to its hash bucket */
         __dlm_insert_lockres(dlm, res);
-        /* since this lockres is new it doesn't not require the spinlock */
-        dlm_lockres_grab_inflight_ref_new(dlm, res);
 
-        /* if this node does not become the master make sure to drop
-         * this inflight reference below */
-        drop_inflight_if_nonlocal = 1;
+        /* Grab inflight ref to pin the resource */
+        spin_lock(&res->spinlock);
+        dlm_lockres_grab_inflight_ref(dlm, res);
+        spin_unlock(&res->spinlock);
 
         /* get an extra ref on the mle in case this is a BLOCK
          * if so, the creator of the BLOCK may try to put the last
@@ -864,8 +874,8 @@ redo_request:
                  * dlm spinlock would be detectable be a change on the mle,
                  * so we only need to clear out the recovery map once. */
                 if (dlm_is_recovery_lock(lockid, namelen)) {
-                        mlog(ML_NOTICE, "%s: recovery map is not empty, but "
-                             "must master $RECOVERY lock now\n", dlm->name);
+                        mlog(0, "%s: Recovery map is not empty, but must "
+                             "master $RECOVERY lock now\n", dlm->name);
                         if (!dlm_pre_master_reco_lockres(dlm, res))
                                 wait_on_recovery = 0;
                         else {
@@ -883,8 +893,8 @@ redo_request:
                 spin_lock(&dlm->spinlock);
                 bit = find_next_bit(dlm->recovery_map, O2NM_MAX_NODES, 0);
                 if (bit < O2NM_MAX_NODES) {
-                        mlog(ML_NOTICE, "%s:%.*s: at least one node (%d) to "
-                             "recover before lock mastery can begin\n",
+                        mlog(0, "%s: res %.*s, At least one node (%d) "
+                             "to recover before lock mastery can begin\n",
                              dlm->name, namelen, (char *)lockid, bit);
                         wait_on_recovery = 1;
                 } else
@@ -913,8 +923,8 @@ redo_request:
                          * yet, keep going until it does.  this is how the
                          * master will know that asserts are needed back to
                          * the lower nodes. */
-                        mlog(0, "%s:%.*s: requests only up to %u but master "
-                             "is %u, keep going\n", dlm->name, namelen,
+                        mlog(0, "%s: res %.*s, Requests only up to %u but "
+                             "master is %u, keep going\n", dlm->name, namelen,
                              lockid, nodenum, mle->master);
                 }
         }
@@ -924,13 +934,12 @@ wait:
         ret = dlm_wait_for_lock_mastery(dlm, res, mle, &blocked);
         if (ret < 0) {
                 wait_on_recovery = 1;
-                mlog(0, "%s:%.*s: node map changed, redo the "
-                     "master request now, blocked=%d\n",
-                     dlm->name, res->lockname.len,
+                mlog(0, "%s: res %.*s, Node map changed, redo the master "
+                     "request now, blocked=%d\n", dlm->name, res->lockname.len,
                      res->lockname.name, blocked);
                 if (++tries > 20) {
-                        mlog(ML_ERROR, "%s:%.*s: spinning on "
-                             "dlm_wait_for_lock_mastery, blocked=%d\n",
+                        mlog(ML_ERROR, "%s: res %.*s, Spinning on "
+                             "dlm_wait_for_lock_mastery, blocked = %d\n",
                              dlm->name, res->lockname.len,
                              res->lockname.name, blocked);
                         dlm_print_one_lock_resource(res);
@@ -940,7 +949,8 @@ wait:
                 goto redo_request;
         }
 
-        mlog(0, "lockres mastered by %u\n", res->owner);
+        mlog(0, "%s: res %.*s, Mastered by %u\n", dlm->name, res->lockname.len,
+             res->lockname.name, res->owner);
         /* make sure we never continue without this */
         BUG_ON(res->owner == O2NM_MAX_NODES);
 
@@ -952,8 +962,6 @@ wait:
 
 wake_waiters:
         spin_lock(&res->spinlock);
-        if (res->owner != dlm->node_num && drop_inflight_if_nonlocal)
-                dlm_lockres_drop_inflight_ref(dlm, res);
         res->state &= ~DLM_LOCK_RES_IN_PROGRESS;
         spin_unlock(&res->spinlock);
         wake_up(&res->wq);
@@ -1426,9 +1434,7 @@ way_up_top:
                 }
 
                 if (res->owner == dlm->node_num) {
-                        mlog(0, "%s:%.*s: setting bit %u in refmap\n",
-                             dlm->name, namelen, name, request->node_idx);
-                        dlm_lockres_set_refmap_bit(request->node_idx, res);
+                        dlm_lockres_set_refmap_bit(dlm, res, request->node_idx);
                         spin_unlock(&res->spinlock);
                         response = DLM_MASTER_RESP_YES;
                         if (mle)
@@ -1493,10 +1499,8 @@ way_up_top:
                                  * go back and clean the mles on any
                                  * other nodes */
                                 dispatch_assert = 1;
-                                dlm_lockres_set_refmap_bit(request->node_idx, res);
-                                mlog(0, "%s:%.*s: setting bit %u in refmap\n",
-                                     dlm->name, namelen, name,
-                                     request->node_idx);
+                                dlm_lockres_set_refmap_bit(dlm, res,
+                                                           request->node_idx);
                         } else
                                 response = DLM_MASTER_RESP_NO;
                 } else {
@@ -1702,7 +1706,7 @@ again:
                              "lockres, set the bit in the refmap\n",
                              namelen, lockname, to);
                         spin_lock(&res->spinlock);
-                        dlm_lockres_set_refmap_bit(to, res);
+                        dlm_lockres_set_refmap_bit(dlm, res, to);
                         spin_unlock(&res->spinlock);
                 }
         }
@@ -2187,8 +2191,6 @@ int dlm_drop_lockres_ref(struct dlm_ctxt *dlm, struct dlm_lock_resource *res)
         namelen = res->lockname.len;
         BUG_ON(namelen > O2NM_MAX_NAME_LEN);
 
-        mlog(0, "%s:%.*s: sending deref to %d\n",
-             dlm->name, namelen, lockname, res->owner);
         memset(&deref, 0, sizeof(deref));
         deref.node_idx = dlm->node_num;
         deref.namelen = namelen;
@@ -2197,14 +2199,12 @@ int dlm_drop_lockres_ref(struct dlm_ctxt *dlm, struct dlm_lock_resource *res)
         ret = o2net_send_message(DLM_DEREF_LOCKRES_MSG, dlm->key,
                                  &deref, sizeof(deref), res->owner, &r);
         if (ret < 0)
-                mlog(ML_ERROR, "Error %d when sending message %u (key 0x%x) to "
-                     "node %u\n", ret, DLM_DEREF_LOCKRES_MSG, dlm->key,
-                     res->owner);
+                mlog(ML_ERROR, "%s: res %.*s, error %d send DEREF to node %u\n",
+                     dlm->name, namelen, lockname, ret, res->owner);
         else if (r < 0) {
                 /* BAD.  other node says I did not have a ref. */
-                mlog(ML_ERROR,"while dropping ref on %s:%.*s "
-                    "(master=%u) got %d.\n", dlm->name, namelen,
-                    lockname, res->owner, r);
+                mlog(ML_ERROR, "%s: res %.*s, DEREF to node %u got %d\n",
+                     dlm->name, namelen, lockname, res->owner, r);
                 dlm_print_one_lock_resource(res);
                 BUG();
         }
@@ -2260,7 +2260,7 @@ int dlm_deref_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
         else {
                 BUG_ON(res->state & DLM_LOCK_RES_DROPPING_REF);
                 if (test_bit(node, res->refmap)) {
-                        dlm_lockres_clear_refmap_bit(node, res);
+                        dlm_lockres_clear_refmap_bit(dlm, res, node);
                         cleared = 1;
                 }
         }
@@ -2320,7 +2320,7 @@ static void dlm_deref_lockres_worker(struct dlm_work_item *item, void *data)
         BUG_ON(res->state & DLM_LOCK_RES_DROPPING_REF);
         if (test_bit(node, res->refmap)) {
                 __dlm_wait_on_lockres_flags(res, DLM_LOCK_RES_SETREF_INPROG);
-                dlm_lockres_clear_refmap_bit(node, res);
+                dlm_lockres_clear_refmap_bit(dlm, res, node);
                 cleared = 1;
         }
         spin_unlock(&res->spinlock);
@@ -2802,7 +2802,8 @@ static void dlm_remove_nonlocal_locks(struct dlm_ctxt *dlm,
                                 BUG_ON(!list_empty(&lock->bast_list));
                                 BUG_ON(lock->ast_pending);
                                 BUG_ON(lock->bast_pending);
-                                dlm_lockres_clear_refmap_bit(lock->ml.node, res);
+                                dlm_lockres_clear_refmap_bit(dlm, res,
+                                                             lock->ml.node);
                                 list_del_init(&lock->list);
                                 dlm_lock_put(lock);
                                 /* In a normal unlock, we would have added a
@@ -2823,7 +2824,7 @@ static void dlm_remove_nonlocal_locks(struct dlm_ctxt *dlm,
                         mlog(0, "%s:%.*s: node %u had a ref to this "
                              "migrating lockres, clearing\n", dlm->name,
                              res->lockname.len, res->lockname.name, bit);
-                        dlm_lockres_clear_refmap_bit(bit, res);
+                        dlm_lockres_clear_refmap_bit(dlm, res, bit);
                 }
                 bit++;
         }
@@ -2916,9 +2917,9 @@ static int dlm_do_migrate_request(struct dlm_ctxt *dlm,
                                          &migrate, sizeof(migrate), nodenum,
                                          &status);
                 if (ret < 0) {
-                        mlog(ML_ERROR, "Error %d when sending message %u (key "
-                             "0x%x) to node %u\n", ret, DLM_MIGRATE_REQUEST_MSG,
-                             dlm->key, nodenum);
+                        mlog(ML_ERROR, "%s: res %.*s, Error %d send "
+                             "MIGRATE_REQUEST to node %u\n", dlm->name,
+                             migrate.namelen, migrate.name, ret, nodenum);
                         if (!dlm_is_host_down(ret)) {
                                 mlog(ML_ERROR, "unhandled error=%d!\n", ret);
                                 BUG();
@@ -2937,7 +2938,7 @@ static int dlm_do_migrate_request(struct dlm_ctxt *dlm,
                              dlm->name, res->lockname.len, res->lockname.name,
                              nodenum);
                         spin_lock(&res->spinlock);
-                        dlm_lockres_set_refmap_bit(nodenum, res);
+                        dlm_lockres_set_refmap_bit(dlm, res, nodenum);
                         spin_unlock(&res->spinlock);
                 }
         }
@@ -3271,7 +3272,7 @@ int dlm_finish_migration(struct dlm_ctxt *dlm, struct dlm_lock_resource *res,
          * mastery reference here since old_master will briefly have
          * a reference after the migration completes */
         spin_lock(&res->spinlock);
-        dlm_lockres_set_refmap_bit(old_master, res);
+        dlm_lockres_set_refmap_bit(dlm, res, old_master);
         spin_unlock(&res->spinlock);
 
         mlog(0, "now time to do a migrate request to other nodes\n");
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 7efab6d28a21..01ebfd0bdad7 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -362,40 +362,38 @@ static int dlm_is_node_recovered(struct dlm_ctxt *dlm, u8 node)
 }
 
 
-int dlm_wait_for_node_death(struct dlm_ctxt *dlm, u8 node, int timeout)
+void dlm_wait_for_node_death(struct dlm_ctxt *dlm, u8 node, int timeout)
 {
-        if (timeout) {
-                mlog(ML_NOTICE, "%s: waiting %dms for notification of "
-                     "death of node %u\n", dlm->name, timeout, node);
+        if (dlm_is_node_dead(dlm, node))
+                return;
+
+        printk(KERN_NOTICE "o2dlm: Waiting on the death of node %u in "
+               "domain %s\n", node, dlm->name);
+
+        if (timeout)
                 wait_event_timeout(dlm->dlm_reco_thread_wq,
-                           dlm_is_node_dead(dlm, node),
-                           msecs_to_jiffies(timeout));
-        } else {
-                mlog(ML_NOTICE, "%s: waiting indefinitely for notification "
-                     "of death of node %u\n", dlm->name, node);
+                                   dlm_is_node_dead(dlm, node),
+                                   msecs_to_jiffies(timeout));
+        else
                 wait_event(dlm->dlm_reco_thread_wq,
                            dlm_is_node_dead(dlm, node));
-        }
-        /* for now, return 0 */
-        return 0;
 }
 
-int dlm_wait_for_node_recovery(struct dlm_ctxt *dlm, u8 node, int timeout)
+void dlm_wait_for_node_recovery(struct dlm_ctxt *dlm, u8 node, int timeout)
 {
-        if (timeout) {
-                mlog(0, "%s: waiting %dms for notification of "
-                     "recovery of node %u\n", dlm->name, timeout, node);
+        if (dlm_is_node_recovered(dlm, node))
+                return;
+
+        printk(KERN_NOTICE "o2dlm: Waiting on the recovery of node %u in "
+               "domain %s\n", node, dlm->name);
+
+        if (timeout)
                 wait_event_timeout(dlm->dlm_reco_thread_wq,
-                           dlm_is_node_recovered(dlm, node),
-                           msecs_to_jiffies(timeout));
-        } else {
-                mlog(0, "%s: waiting indefinitely for notification "
-                     "of recovery of node %u\n", dlm->name, node);
+                                   dlm_is_node_recovered(dlm, node),
+                                   msecs_to_jiffies(timeout));
+        else
                 wait_event(dlm->dlm_reco_thread_wq,
                            dlm_is_node_recovered(dlm, node));
-        }
-        /* for now, return 0 */
-        return 0;
 }
 
 /* callers of the top-level api calls (dlmlock/dlmunlock) should
@@ -430,6 +428,8 @@ static void dlm_begin_recovery(struct dlm_ctxt *dlm)
 {
         spin_lock(&dlm->spinlock);
         BUG_ON(dlm->reco.state & DLM_RECO_STATE_ACTIVE);
+        printk(KERN_NOTICE "o2dlm: Begin recovery on domain %s for node %u\n",
+               dlm->name, dlm->reco.dead_node);
         dlm->reco.state |= DLM_RECO_STATE_ACTIVE;
         spin_unlock(&dlm->spinlock);
 }
@@ -440,9 +440,18 @@ static void dlm_end_recovery(struct dlm_ctxt *dlm)
         BUG_ON(!(dlm->reco.state & DLM_RECO_STATE_ACTIVE));
         dlm->reco.state &= ~DLM_RECO_STATE_ACTIVE;
         spin_unlock(&dlm->spinlock);
+        printk(KERN_NOTICE "o2dlm: End recovery on domain %s\n", dlm->name);
         wake_up(&dlm->reco.event);
 }
 
+static void dlm_print_recovery_master(struct dlm_ctxt *dlm)
+{
+        printk(KERN_NOTICE "o2dlm: Node %u (%s) is the Recovery Master for the "
+               "dead node %u in domain %s\n", dlm->reco.new_master,
+               (dlm->node_num == dlm->reco.new_master ? "me" : "he"),
+               dlm->reco.dead_node, dlm->name);
+}
+
 static int dlm_do_recovery(struct dlm_ctxt *dlm)
 {
         int status = 0;
@@ -505,9 +514,8 @@ static int dlm_do_recovery(struct dlm_ctxt *dlm)
                 }
                 mlog(0, "another node will master this recovery session.\n");
         }
-        mlog(0, "dlm=%s (%d), new_master=%u, this node=%u, dead_node=%u\n",
-             dlm->name, task_pid_nr(dlm->dlm_reco_thread_task), dlm->reco.new_master,
-             dlm->node_num, dlm->reco.dead_node);
+
+        dlm_print_recovery_master(dlm);
 
         /* it is safe to start everything back up here
          * because all of the dead node's lock resources
@@ -518,15 +526,13 @@ static int dlm_do_recovery(struct dlm_ctxt *dlm)
         return 0;
 
 master_here:
-        mlog(ML_NOTICE, "(%d) Node %u is the Recovery Master for the Dead Node "
-             "%u for Domain %s\n", task_pid_nr(dlm->dlm_reco_thread_task),
-             dlm->node_num, dlm->reco.dead_node, dlm->name);
+        dlm_print_recovery_master(dlm);
 
         status = dlm_remaster_locks(dlm, dlm->reco.dead_node);
         if (status < 0) {
                 /* we should never hit this anymore */
-                mlog(ML_ERROR, "error %d remastering locks for node %u, "
-                     "retrying.\n", status, dlm->reco.dead_node);
+                mlog(ML_ERROR, "%s: Error %d remastering locks for node %u, "
+                     "retrying.\n", dlm->name, status, dlm->reco.dead_node);
                 /* yield a bit to allow any final network messages
                  * to get handled on remaining nodes */
                 msleep(100);
@@ -567,7 +573,7 @@ static int dlm_remaster_locks(struct dlm_ctxt *dlm, u8 dead_node)
                 BUG_ON(ndata->state != DLM_RECO_NODE_DATA_INIT);
                 ndata->state = DLM_RECO_NODE_DATA_REQUESTING;
 
-                mlog(0, "requesting lock info from node %u\n",
+                mlog(0, "%s: Requesting lock info from node %u\n", dlm->name,
                      ndata->node_num);
 
                 if (ndata->node_num == dlm->node_num) {
@@ -640,7 +646,7 @@ static int dlm_remaster_locks(struct dlm_ctxt *dlm, u8 dead_node)
                 spin_unlock(&dlm_reco_state_lock);
         }
 
-        mlog(0, "done requesting all lock info\n");
+        mlog(0, "%s: Done requesting all lock info\n", dlm->name);
 
         /* nodes should be sending reco data now
          * just need to wait */
@@ -802,10 +808,9 @@ static int dlm_request_all_locks(struct dlm_ctxt *dlm, u8 request_from,
 
         /* negative status is handled by caller */
         if (ret < 0)
-                mlog(ML_ERROR, "Error %d when sending message %u (key "
-                     "0x%x) to node %u\n", ret, DLM_LOCK_REQUEST_MSG,
-                     dlm->key, request_from);
-
+                mlog(ML_ERROR, "%s: Error %d send LOCK_REQUEST to node %u "
+                     "to recover dead node %u\n", dlm->name, ret,
+                     request_from, dead_node);
         // return from here, then
         // sleep until all received or error
         return ret;
@@ -956,9 +961,9 @@ static int dlm_send_all_done_msg(struct dlm_ctxt *dlm, u8 dead_node, u8 send_to)
         ret = o2net_send_message(DLM_RECO_DATA_DONE_MSG, dlm->key, &done_msg,
                                  sizeof(done_msg), send_to, &tmpret);
         if (ret < 0) {
-                mlog(ML_ERROR, "Error %d when sending message %u (key "
-                     "0x%x) to node %u\n", ret, DLM_RECO_DATA_DONE_MSG,
-                     dlm->key, send_to);
+                mlog(ML_ERROR, "%s: Error %d send RECO_DATA_DONE to node %u "
+                     "to recover dead node %u\n", dlm->name, ret, send_to,
+                     dead_node);
                 if (!dlm_is_host_down(ret)) {
                         BUG();
                 }
@@ -1127,9 +1132,11 @@ static int dlm_send_mig_lockres_msg(struct dlm_ctxt *dlm,
         if (ret < 0) {
                 /* XXX: negative status is not handled.
                  * this will end up killing this node. */
-                mlog(ML_ERROR, "Error %d when sending message %u (key "
-                     "0x%x) to node %u\n", ret, DLM_MIG_LOCKRES_MSG,
-                     dlm->key, send_to);
+                mlog(ML_ERROR, "%s: res %.*s, Error %d send MIG_LOCKRES to "
+                     "node %u (%s)\n", dlm->name, mres->lockname_len,
+                     mres->lockname, ret, send_to,
+                     (orig_flags & DLM_MRES_MIGRATION ?
+                      "migration" : "recovery"));
         } else {
                 /* might get an -ENOMEM back here */
                 ret = status;
@@ -1767,7 +1774,7 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm,
                              dlm->name, mres->lockname_len, mres->lockname,
                              from);
                         spin_lock(&res->spinlock);
-                        dlm_lockres_set_refmap_bit(from, res);
+                        dlm_lockres_set_refmap_bit(dlm, res, from);
                         spin_unlock(&res->spinlock);
                         added++;
                         break;
@@ -1965,7 +1972,7 @@ skip_lvb:
                         mlog(0, "%s:%.*s: added lock for node %u, "
                              "setting refmap bit\n", dlm->name,
                              res->lockname.len, res->lockname.name, ml->node);
-                        dlm_lockres_set_refmap_bit(ml->node, res);
+                        dlm_lockres_set_refmap_bit(dlm, res, ml->node);
                         added++;
                 }
                 spin_unlock(&res->spinlock);
@@ -2084,6 +2091,9 @@ static void dlm_finish_local_lockres_recovery(struct dlm_ctxt *dlm,
 
         list_for_each_entry_safe(res, next, &dlm->reco.resources, recovering) {
                 if (res->owner == dead_node) {
+                        mlog(0, "%s: res %.*s, Changing owner from %u to %u\n",
+                             dlm->name, res->lockname.len, res->lockname.name,
+                             res->owner, new_master);
                         list_del_init(&res->recovering);
                         spin_lock(&res->spinlock);
                         /* new_master has our reference from
@@ -2105,40 +2115,30 @@ static void dlm_finish_local_lockres_recovery(struct dlm_ctxt *dlm,
         for (i = 0; i < DLM_HASH_BUCKETS; i++) {
                 bucket = dlm_lockres_hash(dlm, i);
                 hlist_for_each_entry(res, hash_iter, bucket, hash_node) {
-                        if (res->state & DLM_LOCK_RES_RECOVERING) {
-                                if (res->owner == dead_node) {
-                                        mlog(0, "(this=%u) res %.*s owner=%u "
-                                             "was not on recovering list, but "
-                                             "clearing state anyway\n",
-                                             dlm->node_num, res->lockname.len,
-                                             res->lockname.name, new_master);
-                                } else if (res->owner == dlm->node_num) {
-                                        mlog(0, "(this=%u) res %.*s owner=%u "
-                                             "was not on recovering list, "
-                                             "owner is THIS node, clearing\n",
-                                             dlm->node_num, res->lockname.len,
-                                             res->lockname.name, new_master);
-                                } else
-                                        continue;
+                        if (!(res->state & DLM_LOCK_RES_RECOVERING))
+                                continue;
 
-                                if (!list_empty(&res->recovering)) {
-                                        mlog(0, "%s:%.*s: lockres was "
-                                             "marked RECOVERING, owner=%u\n",
-                                             dlm->name, res->lockname.len,
-                                             res->lockname.name, res->owner);
-                                        list_del_init(&res->recovering);
-                                        dlm_lockres_put(res);
-                                }
-                                spin_lock(&res->spinlock);
-                                /* new_master has our reference from
-                                 * the lock state sent during recovery */
-                                dlm_change_lockres_owner(dlm, res, new_master);
-                                res->state &= ~DLM_LOCK_RES_RECOVERING;
-                                if (__dlm_lockres_has_locks(res))
-                                        __dlm_dirty_lockres(dlm, res);
-                                spin_unlock(&res->spinlock);
-                                wake_up(&res->wq);
+                        if (res->owner != dead_node &&
+                            res->owner != dlm->node_num)
+                                continue;
+
+                        if (!list_empty(&res->recovering)) {
+                                list_del_init(&res->recovering);
+                                dlm_lockres_put(res);
                         }
+
+                        /* new_master has our reference from
+                         * the lock state sent during recovery */
+                        mlog(0, "%s: res %.*s, Changing owner from %u to %u\n",
+                             dlm->name, res->lockname.len, res->lockname.name,
+                             res->owner, new_master);
+                        spin_lock(&res->spinlock);
+                        dlm_change_lockres_owner(dlm, res, new_master);
+                        res->state &= ~DLM_LOCK_RES_RECOVERING;
+                        if (__dlm_lockres_has_locks(res))
+                                __dlm_dirty_lockres(dlm, res);
+                        spin_unlock(&res->spinlock);
+                        wake_up(&res->wq);
                 }
         }
 }
@@ -2252,12 +2252,12 @@ static void dlm_free_dead_locks(struct dlm_ctxt *dlm,
                              res->lockname.len, res->lockname.name, freed, dead_node);
                         __dlm_print_one_lock_resource(res);
                 }
-                dlm_lockres_clear_refmap_bit(dead_node, res);
+                dlm_lockres_clear_refmap_bit(dlm, res, dead_node);
         } else if (test_bit(dead_node, res->refmap)) {
                 mlog(0, "%s:%.*s: dead node %u had a ref, but had "
                      "no locks and had not purged before dying\n", dlm->name,
                      res->lockname.len, res->lockname.name, dead_node);
-                dlm_lockres_clear_refmap_bit(dead_node, res);
+                dlm_lockres_clear_refmap_bit(dlm, res, dead_node);
         }
 
         /* do not kick thread yet */
@@ -2324,9 +2324,9 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
                         dlm_revalidate_lvb(dlm, res, dead_node);
                         if (res->owner == dead_node) {
                                 if (res->state & DLM_LOCK_RES_DROPPING_REF) {
-                                        mlog(ML_NOTICE, "Ignore %.*s for "
+                                        mlog(ML_NOTICE, "%s: res %.*s, Skip "
                                              "recovery as it is being freed\n",
-                                             res->lockname.len,
+                                             dlm->name, res->lockname.len,
                                              res->lockname.name);
                                 } else
                                         dlm_move_lockres_to_recovery_list(dlm,
diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
index 1d6d1d22c471..e73c833fc2a1 100644
--- a/fs/ocfs2/dlm/dlmthread.c
+++ b/fs/ocfs2/dlm/dlmthread.c
@@ -94,24 +94,26 @@ int __dlm_lockres_unused(struct dlm_lock_resource *res)
 {
         int bit;
 
+        assert_spin_locked(&res->spinlock);
+
         if (__dlm_lockres_has_locks(res))
                 return 0;
 
+        /* Locks are in the process of being created */
+        if (res->inflight_locks)
+                return 0;
+
         if (!list_empty(&res->dirty) || res->state & DLM_LOCK_RES_DIRTY)
                 return 0;
 
         if (res->state & DLM_LOCK_RES_RECOVERING)
                 return 0;
 
+        /* Another node has this resource with this node as the master */
         bit = find_next_bit(res->refmap, O2NM_MAX_NODES, 0);
         if (bit < O2NM_MAX_NODES)
                 return 0;
 
-        /*
-         * since the bit for dlm->node_num is not set, inflight_locks better
-         * be zero
-         */
-        BUG_ON(res->inflight_locks != 0);
         return 1;
 }
 
@@ -185,8 +187,6 @@ static void dlm_purge_lockres(struct dlm_ctxt *dlm,
                 /* clear our bit from the master's refmap, ignore errors */
                 ret = dlm_drop_lockres_ref(dlm, res);
                 if (ret < 0) {
-                        mlog(ML_ERROR, "%s: deref %.*s failed %d\n", dlm->name,
-                             res->lockname.len, res->lockname.name, ret);
                         if (!dlm_is_host_down(ret))
                                 BUG();
                 }
@@ -209,7 +209,7 @@ static void dlm_purge_lockres(struct dlm_ctxt *dlm,
                 BUG();
         }
 
-        __dlm_unhash_lockres(res);
+        __dlm_unhash_lockres(dlm, res);
 
         /* lockres is not in the hash now.  drop the flag and wake up
          * any processes waiting in dlm_get_lock_resource. */
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index e1ed5e502ff2..81a4cd22f80b 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -1692,7 +1692,7 @@ int ocfs2_open_lock(struct inode *inode)
         mlog(0, "inode %llu take PRMODE open lock\n",
              (unsigned long long)OCFS2_I(inode)->ip_blkno);
 
-        if (ocfs2_mount_local(osb))
+        if (ocfs2_is_hard_readonly(osb) || ocfs2_mount_local(osb))
                 goto out;
 
         lockres = &OCFS2_I(inode)->ip_open_lockres;
@@ -1718,6 +1718,12 @@ int ocfs2_try_open_lock(struct inode *inode, int write)
              (unsigned long long)OCFS2_I(inode)->ip_blkno,
              write ? "EXMODE" : "PRMODE");
 
+        if (ocfs2_is_hard_readonly(osb)) {
+                if (write)
+                        status = -EROFS;
+                goto out;
+        }
+
         if (ocfs2_mount_local(osb))
                 goto out;
 
@@ -2298,7 +2304,7 @@ int ocfs2_inode_lock_full_nested(struct inode *inode,
         if (ocfs2_is_hard_readonly(osb)) {
                 if (ex)
                         status = -EROFS;
-                goto bail;
+                goto getbh;
         }
 
         if (ocfs2_mount_local(osb))
@@ -2356,7 +2362,7 @@ local:
                         mlog_errno(status);
                 goto bail;
         }
-
+getbh:
         if (ret_bh) {
                 status = ocfs2_assign_bh(inode, ret_bh, local_bh);
                 if (status < 0) {
@@ -2628,8 +2634,11 @@ int ocfs2_dentry_lock(struct dentry *dentry, int ex)
 
         BUG_ON(!dl);
 
-        if (ocfs2_is_hard_readonly(osb))
-                return -EROFS;
+        if (ocfs2_is_hard_readonly(osb)) {
+                if (ex)
+                        return -EROFS;
+                return 0;
+        }
 
         if (ocfs2_mount_local(osb))
                 return 0;
@@ -2647,7 +2656,7 @@ void ocfs2_dentry_unlock(struct dentry *dentry, int ex)
         struct ocfs2_dentry_lock *dl = dentry->d_fsdata;
         struct ocfs2_super *osb = OCFS2_SB(dentry->d_sb);
 
-        if (!ocfs2_mount_local(osb))
+        if (!ocfs2_is_hard_readonly(osb) && !ocfs2_mount_local(osb))
                 ocfs2_cluster_unlock(osb, &dl->dl_lockres, level);
 }
 
diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
index 23457b491e8c..2f5b92ef0e53 100644
--- a/fs/ocfs2/extent_map.c
+++ b/fs/ocfs2/extent_map.c
@@ -832,6 +832,102 @@ out:
         return ret;
 }
 
+int ocfs2_seek_data_hole_offset(struct file *file, loff_t *offset, int origin)
+{
+        struct inode *inode = file->f_mapping->host;
+        int ret;
+        unsigned int is_last = 0, is_data = 0;
+        u16 cs_bits = OCFS2_SB(inode->i_sb)->s_clustersize_bits;
+        u32 cpos, cend, clen, hole_size;
+        u64 extoff, extlen;
+        struct buffer_head *di_bh = NULL;
+        struct ocfs2_extent_rec rec;
+
+        BUG_ON(origin != SEEK_DATA && origin != SEEK_HOLE);
+
+        ret = ocfs2_inode_lock(inode, &di_bh, 0);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
+
+        down_read(&OCFS2_I(inode)->ip_alloc_sem);
+
+        if (*offset >= inode->i_size) {
+                ret = -ENXIO;
+                goto out_unlock;
+        }
+
+        if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+                if (origin == SEEK_HOLE)
+                        *offset = inode->i_size;
+                goto out_unlock;
+        }
+
+        clen = 0;
+        cpos = *offset >> cs_bits;
+        cend = ocfs2_clusters_for_bytes(inode->i_sb, inode->i_size);
+
+        while (cpos < cend && !is_last) {
+                ret = ocfs2_get_clusters_nocache(inode, di_bh, cpos, &hole_size,
+                                                 &rec, &is_last);
+                if (ret) {
+                        mlog_errno(ret);
+                        goto out_unlock;
+                }
+
+                extoff = cpos;
+                extoff <<= cs_bits;
+
+                if (rec.e_blkno == 0ULL) {
+                        clen = hole_size;
+                        is_data = 0;
+                } else {
+                        clen = le16_to_cpu(rec.e_leaf_clusters) -
+                                (cpos - le32_to_cpu(rec.e_cpos));
+                        is_data = (rec.e_flags & OCFS2_EXT_UNWRITTEN) ?  0 : 1;
+                }
+
+                if ((!is_data && origin == SEEK_HOLE) ||
+                    (is_data && origin == SEEK_DATA)) {
+                        if (extoff > *offset)
+                                *offset = extoff;
+                        goto out_unlock;
+                }
+
+                if (!is_last)
+                        cpos += clen;
+        }
+
+        if (origin == SEEK_HOLE) {
+                extoff = cpos;
+                extoff <<= cs_bits;
+                extlen = clen;
+                extlen <<=  cs_bits;
+
+                if ((extoff + extlen) > inode->i_size)
+                        extlen = inode->i_size - extoff;
+                extoff += extlen;
+                if (extoff > *offset)
+                        *offset = extoff;
+                goto out_unlock;
+        }
+
+        ret = -ENXIO;
+
+out_unlock:
+
+        brelse(di_bh);
+
+        up_read(&OCFS2_I(inode)->ip_alloc_sem);
+
+        ocfs2_inode_unlock(inode, 0);
+out:
+        if (ret && ret != -ENXIO)
+                ret = -ENXIO;
+        return ret;
+}
+
 int ocfs2_read_virt_blocks(struct inode *inode, u64 v_block, int nr,
                            struct buffer_head *bhs[], int flags,
                            int (*validate)(struct super_block *sb,
diff --git a/fs/ocfs2/extent_map.h b/fs/ocfs2/extent_map.h
index e79d41c2c909..67ea57d2fd59 100644
--- a/fs/ocfs2/extent_map.h
+++ b/fs/ocfs2/extent_map.h
@@ -53,6 +53,8 @@ int ocfs2_extent_map_get_blocks(struct inode *inode, u64 v_blkno, u64 *p_blkno,
 int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                  u64 map_start, u64 map_len);
 
+int ocfs2_seek_data_hole_offset(struct file *file, loff_t *offset, int origin);
+
 int ocfs2_xattr_get_clusters(struct inode *inode, u32 v_cluster,
                              u32 *p_cluster, u32 *num_clusters,
                              struct ocfs2_extent_list *el,
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index de4ea1af041b..6e396683c3d4 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1950,6 +1950,9 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
         if (ret < 0)
                 mlog_errno(ret);
 
+        if (file->f_flags & O_SYNC)
+                handle->h_sync = 1;
+
         ocfs2_commit_trans(osb, handle);
 
 out_inode_unlock:
@@ -2052,6 +2055,23 @@ out:
         return ret;
 }
 
+static void ocfs2_aiodio_wait(struct inode *inode)
+{
+        wait_queue_head_t *wq = ocfs2_ioend_wq(inode);
+
+        wait_event(*wq, (atomic_read(&OCFS2_I(inode)->ip_unaligned_aio) == 0));
+}
+
+static int ocfs2_is_io_unaligned(struct inode *inode, size_t count, loff_t pos)
+{
+        int blockmask = inode->i_sb->s_blocksize - 1;
+        loff_t final_size = pos + count;
+
+        if ((pos & blockmask) || (final_size & blockmask))
+                return 1;
+        return 0;
+}
+
 static int ocfs2_prepare_inode_for_refcount(struct inode *inode,
                                             struct file *file,
                                             loff_t pos, size_t count,
@@ -2230,6 +2250,7 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
         int full_coherency = !(osb->s_mount_opt &
                                OCFS2_MOUNT_COHERENCY_BUFFERED);
+        int unaligned_dio = 0;
 
         trace_ocfs2_file_aio_write(inode, file, file->f_path.dentry,
                 (unsigned long long)OCFS2_I(inode)->ip_blkno,
@@ -2297,6 +2318,10 @@ relock:
                 goto out;
         }
 
+        if (direct_io && !is_sync_kiocb(iocb))
+                unaligned_dio = ocfs2_is_io_unaligned(inode, iocb->ki_left,
+                                                      *ppos);
+
         /*
          * We can't complete the direct I/O as requested, fall back to
          * buffered I/O.
@@ -2311,6 +2336,18 @@ relock:
                 goto relock;
         }
 
+        if (unaligned_dio) {
+                /*
+                 * Wait on previous unaligned aio to complete before
+                 * proceeding.
+                 */
+                ocfs2_aiodio_wait(inode);
+
+                /* Mark the iocb as needing a decrement in ocfs2_dio_end_io */
+                atomic_inc(&OCFS2_I(inode)->ip_unaligned_aio);
+                ocfs2_iocb_set_unaligned_aio(iocb);
+        }
+
         /*
          * To later detect whether a journal commit for sync writes is
          * necessary, we sample i_size, and cluster count here.
@@ -2382,8 +2419,12 @@ out_dio:
         if ((ret == -EIOCBQUEUED) || (!ocfs2_iocb_is_rw_locked(iocb))) {
                 rw_level = -1;
                 have_alloc_sem = 0;
+                unaligned_dio = 0;
         }
 
+        if (unaligned_dio)
+                atomic_dec(&OCFS2_I(inode)->ip_unaligned_aio);
+
 out:
         if (rw_level != -1)
                 ocfs2_rw_unlock(inode, rw_level);
@@ -2591,6 +2632,57 @@ bail:
         return ret;
 }
 
+/* Refer generic_file_llseek_unlocked() */
+static loff_t ocfs2_file_llseek(struct file *file, loff_t offset, int origin)
+{
+        struct inode *inode = file->f_mapping->host;
+        int ret = 0;
+
+        mutex_lock(&inode->i_mutex);
+
+        switch (origin) {
+        case SEEK_SET:
+                break;
+        case SEEK_END:
+                offset += inode->i_size;
+                break;
+        case SEEK_CUR:
+                if (offset == 0) {
+                        offset = file->f_pos;
+                        goto out;
+                }
+                offset += file->f_pos;
+                break;
+        case SEEK_DATA:
+        case SEEK_HOLE:
+                ret = ocfs2_seek_data_hole_offset(file, &offset, origin);
+                if (ret)
+                        goto out;
+                break;
+        default:
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (offset < 0 && !(file->f_mode & FMODE_UNSIGNED_OFFSET))
+                ret = -EINVAL;
+        if (!ret && offset > inode->i_sb->s_maxbytes)
+                ret = -EINVAL;
+        if (ret)
+                goto out;
+
+        if (offset != file->f_pos) {
+                file->f_pos = offset;
+                file->f_version = 0;
+        }
+
+out:
+        mutex_unlock(&inode->i_mutex);
+        if (ret)
+                return ret;
+        return offset;
+}
+
 const struct inode_operations ocfs2_file_iops = {
         .setattr        = ocfs2_setattr,
         .getattr        = ocfs2_getattr,
@@ -2615,7 +2707,7 @@ const struct inode_operations ocfs2_special_file_iops = {
  * ocfs2_fops_no_plocks and ocfs2_dops_no_plocks!
  */
 const struct file_operations ocfs2_fops = {
-        .llseek         = generic_file_llseek,
+        .llseek         = ocfs2_file_llseek,
         .read           = do_sync_read,
         .write          = do_sync_write,
         .mmap           = ocfs2_mmap,
@@ -2663,7 +2755,7 @@ const struct file_operations ocfs2_dops = {
  * the cluster.
  */
 const struct file_operations ocfs2_fops_no_plocks = {
-        .llseek         = generic_file_llseek,
+        .llseek         = ocfs2_file_llseek,
         .read           = do_sync_read,
         .write          = do_sync_write,
         .mmap           = ocfs2_mmap,
diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index a22d2c098890..17454a904d7b 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -951,7 +951,7 @@ static void ocfs2_cleanup_delete_inode(struct inode *inode,
         trace_ocfs2_cleanup_delete_inode(
                 (unsigned long long)OCFS2_I(inode)->ip_blkno, sync_data);
         if (sync_data)
-                write_inode_now(inode, 1);
+                filemap_write_and_wait(inode->i_mapping);
         truncate_inode_pages(&inode->i_data, 0);
 }
 
diff --git a/fs/ocfs2/inode.h b/fs/ocfs2/inode.h
index 1c508b149b3a..88924a3133fa 100644
--- a/fs/ocfs2/inode.h
+++ b/fs/ocfs2/inode.h
@@ -43,6 +43,9 @@ struct ocfs2_inode_info
         /* protects extended attribute changes on this inode */
         struct rw_semaphore             ip_xattr_sem;
 
+        /* Number of outstanding AIO's which are not page aligned */
+        atomic_t                        ip_unaligned_aio;
+
         /* These fields are protected by ip_lock */
         spinlock_t                      ip_lock;
         u32                             ip_open_count;
diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
index bc91072b7219..726ff265b296 100644
--- a/fs/ocfs2/ioctl.c
+++ b/fs/ocfs2/ioctl.c
@@ -122,7 +122,7 @@ static int ocfs2_set_inode_attr(struct inode *inode, unsigned flags,
         if ((oldflags & OCFS2_IMMUTABLE_FL) || ((flags ^ oldflags) &
                 (OCFS2_APPEND_FL | OCFS2_IMMUTABLE_FL))) {
                 if (!capable(CAP_LINUX_IMMUTABLE))
-                        goto bail_unlock;
+                        goto bail_commit;
         }
 
         ocfs2_inode->ip_attr = flags;
@@ -132,6 +132,7 @@ static int ocfs2_set_inode_attr(struct inode *inode, unsigned flags,
         if (status < 0)
                 mlog_errno(status);
 
+bail_commit:
         ocfs2_commit_trans(osb, handle);
 bail_unlock:
         ocfs2_inode_unlock(inode, 1);
@@ -381,7 +382,7 @@ int ocfs2_info_handle_freeinode(struct inode *inode,
         if (!oifi) {
                 status = -ENOMEM;
                 mlog_errno(status);
-                goto bail;
+                goto out_err;
         }
 
         if (o2info_from_user(*oifi, req))
@@ -431,7 +432,7 @@ bail:
                 o2info_set_request_error(&oifi->ifi_req, req);
 
         kfree(oifi);
-
+out_err:
         return status;
 }
 
@@ -666,7 +667,7 @@ int ocfs2_info_handle_freefrag(struct inode *inode,
         if (!oiff) {
                 status = -ENOMEM;
                 mlog_errno(status);
-                goto bail;
+                goto out_err;
         }
 
         if (o2info_from_user(*oiff, req))
@@ -716,7 +717,7 @@ bail:
                 o2info_set_request_error(&oiff->iff_req, req);
 
         kfree(oiff);
-
+out_err:
         return status;
 }
 
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index 295d56454e8b..0a42ae96dca7 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -1544,9 +1544,9 @@ static int ocfs2_replay_journal(struct ocfs2_super *osb,
         /* we need to run complete recovery for offline orphan slots */
         ocfs2_replay_map_set_state(osb, REPLAY_NEEDED);
 
-        mlog(ML_NOTICE, "Recovering node %d from slot %d on device (%u,%u)\n",
-             node_num, slot_num,
-             MAJOR(osb->sb->s_dev), MINOR(osb->sb->s_dev));
+        printk(KERN_NOTICE "ocfs2: Begin replay journal (node %d, slot %d) on "\
+               "device (%u,%u)\n", node_num, slot_num, MAJOR(osb->sb->s_dev),
+               MINOR(osb->sb->s_dev));
 
         OCFS2_I(inode)->ip_clusters = le32_to_cpu(fe->i_clusters);
 
@@ -1601,6 +1601,9 @@ static int ocfs2_replay_journal(struct ocfs2_super *osb,
 
         jbd2_journal_destroy(journal);
 
+        printk(KERN_NOTICE "ocfs2: End replay journal (node %d, slot %d) on "\
+               "device (%u,%u)\n", node_num, slot_num, MAJOR(osb->sb->s_dev),
+               MINOR(osb->sb->s_dev));
 done:
         /* drop the lock on this nodes journal */
         if (got_lock)
@@ -1808,6 +1811,20 @@ static inline unsigned long ocfs2_orphan_scan_timeout(void)
  * every slot, queuing a recovery of the slot on the ocfs2_wq thread. This
  * is done to catch any orphans that are left over in orphan directories.
  *
+ * It scans all slots, even ones that are in use. It does so to handle the
+ * case described below:
+ *
+ *   Node 1 has an inode it was using. The dentry went away due to memory
+ *   pressure.  Node 1 closes the inode, but it's on the free list. The node
+ *   has the open lock.
+ *   Node 2 unlinks the inode. It grabs the dentry lock to notify others,
+ *   but node 1 has no dentry and doesn't get the message. It trylocks the
+ *   open lock, sees that another node has a PR, and does nothing.
+ *   Later node 2 runs its orphan dir. It igets the inode, trylocks the
+ *   open lock, sees the PR still, and does nothing.
+ *   Basically, we have to trigger an orphan iput on node 1. The only way
+ *   for this to happen is if node 1 runs node 2's orphan dir.
+ *
  * ocfs2_queue_orphan_scan gets called every ORPHAN_SCAN_SCHEDULE_TIMEOUT
  * seconds.  It gets an EX lock on os_lockres and checks sequence number
  * stored in LVB. If the sequence number has changed, it means some other
diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
index 68cf2f6d3c6a..a3385b63ff5e 100644
--- a/fs/ocfs2/journal.h
+++ b/fs/ocfs2/journal.h
@@ -441,10 +441,11 @@ static inline int ocfs2_mknod_credits(struct super_block *sb, int is_dir,
 #define OCFS2_SIMPLE_DIR_EXTEND_CREDITS (2)
 
 /* file update (nlink, etc) + directory mtime/ctime + dir entry block + quota
- * update on dir + index leaf + dx root update for free list */
+ * update on dir + index leaf + dx root update for free list +
+ * previous dirblock update in the free list */
 static inline int ocfs2_link_credits(struct super_block *sb)
 {
-        return 2*OCFS2_INODE_UPDATE_CREDITS + 3 +
+        return 2*OCFS2_INODE_UPDATE_CREDITS + 4 +
                ocfs2_quota_trans_credits(sb);
 }
 
diff --git a/fs/ocfs2/mmap.c b/fs/ocfs2/mmap.c
index 3e9393ca39eb..9cd41083e991 100644
--- a/fs/ocfs2/mmap.c
+++ b/fs/ocfs2/mmap.c
@@ -61,7 +61,7 @@ static int ocfs2_fault(struct vm_area_struct *area, struct vm_fault *vmf)
 static int __ocfs2_page_mkwrite(struct file *file, struct buffer_head *di_bh,
                                 struct page *page)
 {
-        int ret;
+        int ret = VM_FAULT_NOPAGE;
         struct inode *inode = file->f_path.dentry->d_inode;
         struct address_space *mapping = inode->i_mapping;
         loff_t pos = page_offset(page);
@@ -71,32 +71,25 @@ static int __ocfs2_page_mkwrite(struct file *file, struct buffer_head *di_bh,
         void *fsdata;
         loff_t size = i_size_read(inode);
 
-        /*
-         * Another node might have truncated while we were waiting on
-         * cluster locks.
-         * We don't check size == 0 before the shift. This is borrowed
-         * from do_generic_file_read.
-         */
         last_index = (size - 1) >> PAGE_CACHE_SHIFT;
-        if (unlikely(!size || page->index > last_index)) {
-                ret = -EINVAL;
-                goto out;
-        }
 
         /*
-         * The i_size check above doesn't catch the case where nodes
-         * truncated and then re-extended the file. We'll re-check the
-         * page mapping after taking the page lock inside of
-         * ocfs2_write_begin_nolock().
+         * There are cases that lead to the page no longer bebongs to the
+         * mapping.
+         * 1) pagecache truncates locally due to memory pressure.
+         * 2) pagecache truncates when another is taking EX lock against 
+         * inode lock. see ocfs2_data_convert_worker.
+         * 
+         * The i_size check doesn't catch the case where nodes truncated and
+         * then re-extended the file. We'll re-check the page mapping after
+         * taking the page lock inside of ocfs2_write_begin_nolock().
+         *
+         * Let VM retry with these cases.
          */
-        if (!PageUptodate(page) || page->mapping != inode->i_mapping) {
-                /*
-                 * the page has been umapped in ocfs2_data_downconvert_worker.
-                 * So return 0 here and let VFS retry.
-                 */
-                ret = 0;
+        if ((page->mapping != inode->i_mapping) ||
+            (!PageUptodate(page)) ||
+            (page_offset(page) >= size))
                 goto out;
-        }
 
         /*
          * Call ocfs2_write_begin() and ocfs2_write_end() to take
@@ -116,17 +109,21 @@ static int __ocfs2_page_mkwrite(struct file *file, struct buffer_head *di_bh,
         if (ret) {
                 if (ret != -ENOSPC)
                         mlog_errno(ret);
+                if (ret == -ENOMEM)
+                        ret = VM_FAULT_OOM;
+                else
+                        ret = VM_FAULT_SIGBUS;
                 goto out;
         }
 
-        ret = ocfs2_write_end_nolock(mapping, pos, len, len, locked_page,
-                                     fsdata);
-        if (ret < 0) {
-                mlog_errno(ret);
+        if (!locked_page) {
+                ret = VM_FAULT_NOPAGE;
                 goto out;
         }
+        ret = ocfs2_write_end_nolock(mapping, pos, len, len, locked_page,
+                                     fsdata);
         BUG_ON(ret != len);
-        ret = 0;
+        ret = VM_FAULT_LOCKED;
 out:
         return ret;
 }
@@ -168,8 +165,6 @@ static int ocfs2_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
 
 out:
         ocfs2_unblock_signals(&oldset);
-        if (ret)
-                ret = VM_FAULT_SIGBUS;
         return ret;
 }
 
diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
index d53cb706f14c..184c76b8c293 100644
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -745,7 +745,7 @@ static int ocfs2_move_extent(struct ocfs2_move_extents_context *context,
          */
         ocfs2_probe_alloc_group(inode, gd_bh, &goal_bit, len, move_max_hop,
                                 new_phys_cpos);
-        if (!new_phys_cpos) {
+        if (!*new_phys_cpos) {
                 ret = -ENOSPC;
                 goto out_commit;
         }
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 409285854f64..d355e6e36b36 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -836,18 +836,65 @@ static inline unsigned int ocfs2_clusters_to_megabytes(struct super_block *sb,
 
 static inline void _ocfs2_set_bit(unsigned int bit, unsigned long *bitmap)
 {
-        __test_and_set_bit_le(bit, bitmap);
+        __set_bit_le(bit, bitmap);
 }
 #define ocfs2_set_bit(bit, addr) _ocfs2_set_bit((bit), (unsigned long *)(addr))
 
 static inline void _ocfs2_clear_bit(unsigned int bit, unsigned long *bitmap)
 {
-        __test_and_clear_bit_le(bit, bitmap);
+        __clear_bit_le(bit, bitmap);
 }
 #define ocfs2_clear_bit(bit, addr) _ocfs2_clear_bit((bit), (unsigned long *)(addr))
 
 #define ocfs2_test_bit test_bit_le
 #define ocfs2_find_next_zero_bit find_next_zero_bit_le
 #define ocfs2_find_next_bit find_next_bit_le
+
+static inline void *correct_addr_and_bit_unaligned(int *bit, void *addr)
+{
+#if BITS_PER_LONG == 64
+        *bit += ((unsigned long) addr & 7UL) << 3;
+        addr = (void *) ((unsigned long) addr & ~7UL);
+#elif BITS_PER_LONG == 32
+        *bit += ((unsigned long) addr & 3UL) << 3;
+        addr = (void *) ((unsigned long) addr & ~3UL);
+#else
+#error "how many bits you are?!"
+#endif
+        return addr;
+}
+
+static inline void ocfs2_set_bit_unaligned(int bit, void *bitmap)
+{
+        bitmap = correct_addr_and_bit_unaligned(&bit, bitmap);
+        ocfs2_set_bit(bit, bitmap);
+}
+
+static inline void ocfs2_clear_bit_unaligned(int bit, void *bitmap)
+{
+        bitmap = correct_addr_and_bit_unaligned(&bit, bitmap);
+        ocfs2_clear_bit(bit, bitmap);
+}
+
+static inline int ocfs2_test_bit_unaligned(int bit, void *bitmap)
+{
+        bitmap = correct_addr_and_bit_unaligned(&bit, bitmap);
+        return ocfs2_test_bit(bit, bitmap);
+}
+
+static inline int ocfs2_find_next_zero_bit_unaligned(void *bitmap, int max,
+                                                        int start)
+{
+        int fix = 0, ret, tmpmax;
+        bitmap = correct_addr_and_bit_unaligned(&fix, bitmap);
+        tmpmax = max + fix;
+        start += fix;
+
+        ret = ocfs2_find_next_zero_bit(bitmap, tmpmax, start) - fix;
+        if (ret > max)
+                return max;
+        return ret;
+}
+
 #endif  /* OCFS2_H */
 
diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index dc8007fc9247..f100bf70a906 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -404,7 +404,9 @@ struct ocfs2_quota_recovery *ocfs2_begin_quota_recovery(
         int status = 0;
         struct ocfs2_quota_recovery *rec;
 
-        mlog(ML_NOTICE, "Beginning quota recovery in slot %u\n", slot_num);
+        printk(KERN_NOTICE "ocfs2: Beginning quota recovery on device (%s) for "
+               "slot %u\n", osb->dev_str, slot_num);
+
         rec = ocfs2_alloc_quota_recovery();
         if (!rec)
                 return ERR_PTR(-ENOMEM);
@@ -549,8 +551,8 @@ static int ocfs2_recover_local_quota_file(struct inode *lqinode,
                                 goto out_commit;
                         }
                         lock_buffer(qbh);
-                        WARN_ON(!ocfs2_test_bit(bit, dchunk->dqc_bitmap));
-                        ocfs2_clear_bit(bit, dchunk->dqc_bitmap);
+                        WARN_ON(!ocfs2_test_bit_unaligned(bit, dchunk->dqc_bitmap));
+                        ocfs2_clear_bit_unaligned(bit, dchunk->dqc_bitmap);
                         le32_add_cpu(&dchunk->dqc_free, 1);
                         unlock_buffer(qbh);
                         ocfs2_journal_dirty(handle, qbh);
@@ -596,7 +598,9 @@ int ocfs2_finish_quota_recovery(struct ocfs2_super *osb,
         struct inode *lqinode;
         unsigned int flags;
 
-        mlog(ML_NOTICE, "Finishing quota recovery in slot %u\n", slot_num);
+        printk(KERN_NOTICE "ocfs2: Finishing quota recovery on device (%s) for "
+               "slot %u\n", osb->dev_str, slot_num);
+
         mutex_lock(&sb_dqopt(sb)->dqonoff_mutex);
         for (type = 0; type < MAXQUOTAS; type++) {
                 if (list_empty(&(rec->r_list[type])))
@@ -612,8 +616,9 @@ int ocfs2_finish_quota_recovery(struct ocfs2_super *osb,
                 /* Someone else is holding the lock? Then he must be
                  * doing the recovery. Just skip the file... */
                 if (status == -EAGAIN) {
-                        mlog(ML_NOTICE, "skipping quota recovery for slot %d "
-                             "because quota file is locked.\n", slot_num);
+                        printk(KERN_NOTICE "ocfs2: Skipping quota recovery on "
+                               "device (%s) for slot %d because quota file is "
+                               "locked.\n", osb->dev_str, slot_num);
                         status = 0;
                         goto out_put;
                 } else if (status < 0) {
@@ -944,7 +949,7 @@ static struct ocfs2_quota_chunk *ocfs2_find_free_entry(struct super_block *sb,
                       * ol_quota_entries_per_block(sb);
         }
 
-        found = ocfs2_find_next_zero_bit(dchunk->dqc_bitmap, len, 0);
+        found = ocfs2_find_next_zero_bit_unaligned(dchunk->dqc_bitmap, len, 0);
         /* We failed? */
         if (found == len) {
                 mlog(ML_ERROR, "Did not find empty entry in chunk %d with %u"
@@ -1208,7 +1213,7 @@ static void olq_alloc_dquot(struct buffer_head *bh, void *private)
         struct ocfs2_local_disk_chunk *dchunk;
 
         dchunk = (struct ocfs2_local_disk_chunk *)bh->b_data;
-        ocfs2_set_bit(*offset, dchunk->dqc_bitmap);
+        ocfs2_set_bit_unaligned(*offset, dchunk->dqc_bitmap);
         le32_add_cpu(&dchunk->dqc_free, -1);
 }
 
@@ -1289,7 +1294,7 @@ int ocfs2_local_release_dquot(handle_t *handle, struct dquot *dquot)
                         (od->dq_chunk->qc_headerbh->b_data);
         /* Mark structure as freed */
         lock_buffer(od->dq_chunk->qc_headerbh);
-        ocfs2_clear_bit(offset, dchunk->dqc_bitmap);
+        ocfs2_clear_bit_unaligned(offset, dchunk->dqc_bitmap);
         le32_add_cpu(&dchunk->dqc_free, 1);
         unlock_buffer(od->dq_chunk->qc_headerbh);
         ocfs2_journal_dirty(handle, od->dq_chunk->qc_headerbh);
diff --git a/fs/ocfs2/slot_map.c b/fs/ocfs2/slot_map.c
index 26fc0014d509..1424c151cccc 100644
--- a/fs/ocfs2/slot_map.c
+++ b/fs/ocfs2/slot_map.c
@@ -493,8 +493,8 @@ int ocfs2_find_slot(struct ocfs2_super *osb)
                         goto bail;
                 }
         } else
-                mlog(ML_NOTICE, "slot %d is already allocated to this node!\n",
-                     slot);
+                printk(KERN_INFO "ocfs2: Slot %d on device (%s) was already "
+                       "allocated to this node!\n", slot, osb->dev_str);
 
         ocfs2_set_slot(si, slot, osb->node_num);
         osb->slot_num = slot;
diff --git a/fs/ocfs2/stack_o2cb.c b/fs/ocfs2/stack_o2cb.c
index 19965b00c43c..94368017edb3 100644
--- a/fs/ocfs2/stack_o2cb.c
+++ b/fs/ocfs2/stack_o2cb.c
@@ -28,6 +28,7 @@
 #include "cluster/masklog.h"
 #include "cluster/nodemanager.h"
 #include "cluster/heartbeat.h"
+#include "cluster/tcp.h"
 
 #include "stackglue.h"
 
@@ -256,6 +257,61 @@ static void o2cb_dump_lksb(struct ocfs2_dlm_lksb *lksb)
 }
 
 /*
+ * Check if this node is heartbeating and is connected to all other
+ * heartbeating nodes.
+ */
+static int o2cb_cluster_check(void)
+{
+        u8 node_num;
+        int i;
+        unsigned long hbmap[BITS_TO_LONGS(O2NM_MAX_NODES)];
+        unsigned long netmap[BITS_TO_LONGS(O2NM_MAX_NODES)];
+
+        node_num = o2nm_this_node();
+        if (node_num == O2NM_MAX_NODES) {
+                printk(KERN_ERR "o2cb: This node has not been configured.\n");
+                return -EINVAL;
+        }
+
+        /*
+         * o2dlm expects o2net sockets to be created. If not, then
+         * dlm_join_domain() fails with a stack of errors which are both cryptic
+         * and incomplete. The idea here is to detect upfront whether we have
+         * managed to connect to all nodes or not. If not, then list the nodes
+         * to allow the user to check the configuration (incorrect IP, firewall,
+         * etc.) Yes, this is racy. But its not the end of the world.
+         */
+#define O2CB_MAP_STABILIZE_COUNT        60
+        for (i = 0; i < O2CB_MAP_STABILIZE_COUNT; ++i) {
+                o2hb_fill_node_map(hbmap, sizeof(hbmap));
+                if (!test_bit(node_num, hbmap)) {
+                        printk(KERN_ERR "o2cb: %s heartbeat has not been "
+                               "started.\n", (o2hb_global_heartbeat_active() ?
+                                              "Global" : "Local"));
+                        return -EINVAL;
+                }
+                o2net_fill_node_map(netmap, sizeof(netmap));
+                /* Force set the current node to allow easy compare */
+                set_bit(node_num, netmap);
+                if (!memcmp(hbmap, netmap, sizeof(hbmap)))
+                        return 0;
+                if (i < O2CB_MAP_STABILIZE_COUNT)
+                        msleep(1000);
+        }
+
+        printk(KERN_ERR "o2cb: This node could not connect to nodes:");
+        i = -1;
+        while ((i = find_next_bit(hbmap, O2NM_MAX_NODES,
+                                  i + 1)) < O2NM_MAX_NODES) {
+                if (!test_bit(i, netmap))
+                        printk(" %u", i);
+        }
+        printk(".\n");
+
+        return -ENOTCONN;
+}
+
+/*
  * Called from the dlm when it's about to evict a node. This is how the
  * classic stack signals node death.
  */
@@ -263,8 +319,8 @@ static void o2dlm_eviction_cb(int node_num, void *data)
 {
         struct ocfs2_cluster_connection *conn = data;
 
-        mlog(ML_NOTICE, "o2dlm has evicted node %d from group %.*s\n",
-             node_num, conn->cc_namelen, conn->cc_name);
+        printk(KERN_NOTICE "o2cb: o2dlm has evicted node %d from domain %.*s\n",
+               node_num, conn->cc_namelen, conn->cc_name);
 
         conn->cc_recovery_handler(node_num, conn->cc_recovery_data);
 }
@@ -280,12 +336,11 @@ static int o2cb_cluster_connect(struct ocfs2_cluster_connection *conn)
         BUG_ON(conn == NULL);
         BUG_ON(conn->cc_proto == NULL);
 
-        /* for now we only have one cluster/node, make sure we see it
-         * in the heartbeat universe */
-        if (!o2hb_check_local_node_heartbeating()) {
-                if (o2hb_global_heartbeat_active())
-                        mlog(ML_ERROR, "Global heartbeat not started\n");
-                rc = -EINVAL;
+        /* Ensure cluster stack is up and all nodes are connected */
+        rc = o2cb_cluster_check();
+        if (rc) {
+                printk(KERN_ERR "o2cb: Cluster check failed. Fix errors "
+                       "before retrying.\n");
                 goto out;
         }
 
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 56f61027236b..4994f8b0e604 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -54,6 +54,7 @@
 #include "ocfs1_fs_compat.h"
 
 #include "alloc.h"
+#include "aops.h"
 #include "blockcheck.h"
 #include "dlmglue.h"
 #include "export.h"
@@ -1107,9 +1108,9 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent)
 
                 ocfs2_set_ro_flag(osb, 1);
 
-                printk(KERN_NOTICE "Readonly device detected. No cluster "
-                       "services will be utilized for this mount. Recovery "
-                       "will be skipped.\n");
+                printk(KERN_NOTICE "ocfs2: Readonly device (%s) detected. "
+                       "Cluster services will not be used for this mount. "
+                       "Recovery will be skipped.\n", osb->dev_str);
         }
 
         if (!ocfs2_is_hard_readonly(osb)) {
@@ -1616,12 +1617,17 @@ static int ocfs2_show_options(struct seq_file *s, struct vfsmount *mnt)
         return 0;
 }
 
+wait_queue_head_t ocfs2__ioend_wq[OCFS2_IOEND_WQ_HASH_SZ];
+
 static int __init ocfs2_init(void)
 {
-        int status;
+        int status, i;
 
         ocfs2_print_version();
 
+        for (i = 0; i < OCFS2_IOEND_WQ_HASH_SZ; i++)
+                init_waitqueue_head(&ocfs2__ioend_wq[i]);
+
         status = init_ocfs2_uptodate_cache();
         if (status < 0) {
                 mlog_errno(status);
@@ -1760,7 +1766,7 @@ static void ocfs2_inode_init_once(void *data)
         ocfs2_extent_map_init(&oi->vfs_inode);
         INIT_LIST_HEAD(&oi->ip_io_markers);
         oi->ip_dir_start_lookup = 0;
-
+        atomic_set(&oi->ip_unaligned_aio, 0);
         init_rwsem(&oi->ip_alloc_sem);
         init_rwsem(&oi->ip_xattr_sem);
         mutex_init(&oi->ip_io_mutex);
@@ -1974,7 +1980,8 @@ static void ocfs2_dismount_volume(struct super_block *sb, int mnt_err)
          * If we failed before we got a uuid_str yet, we can't stop
          * heartbeat.  Otherwise, do it.
          */
-        if (!mnt_err && !ocfs2_mount_local(osb) && osb->uuid_str)
+        if (!mnt_err && !ocfs2_mount_local(osb) && osb->uuid_str &&
+            !ocfs2_is_hard_readonly(osb))
                 hangup_needed = 1;
 
         if (osb->cconn)
@@ -2353,7 +2360,7 @@ static int ocfs2_initialize_super(struct super_block *sb,
                 mlog_errno(status);
                 goto bail;
         }
-        cleancache_init_shared_fs((char *)&uuid_net_key, sb);
+        cleancache_init_shared_fs((char *)&di->id2.i_super.s_uuid, sb);
 
 bail:
         return status;
@@ -2462,8 +2469,8 @@ static int ocfs2_check_volume(struct ocfs2_super *osb)
                         goto finally;
                 }
         } else {
-                mlog(ML_NOTICE, "File system was not unmounted cleanly, "
-                     "recovering volume.\n");
+                printk(KERN_NOTICE "ocfs2: File system on device (%s) was not "
+                       "unmounted cleanly, recovering it.\n", osb->dev_str);
         }
 
         local = ocfs2_mount_local(osb);
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 194fb22ef79d..aa9e8777b09a 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -2376,16 +2376,18 @@ static int ocfs2_remove_value_outside(struct inode*inode,
                 }
 
                 ret = ocfs2_xattr_value_truncate(inode, vb, 0, &ctxt);
-                if (ret < 0) {
-                        mlog_errno(ret);
-                        break;
-                }
 
                 ocfs2_commit_trans(osb, ctxt.handle);
                 if (ctxt.meta_ac) {
                         ocfs2_free_alloc_context(ctxt.meta_ac);
                         ctxt.meta_ac = NULL;
                 }
+
+                if (ret < 0) {
+                        mlog_errno(ret);
+                        break;
+                }
+
         }
 
         if (ctxt.meta_ac)
diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index 2bd620f0d796..57bbf9078ac8 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -167,6 +167,7 @@ int pstore_register(struct pstore_info *psi)
         }
 
         psinfo = psi;
+        mutex_init(&psinfo->read_mutex);
         spin_unlock(&pstore_lock);
 
         if (owner && !try_module_get(owner)) {
@@ -195,30 +196,32 @@ EXPORT_SYMBOL_GPL(pstore_register);
 void pstore_get_records(int quiet)
 {
         struct pstore_info *psi = psinfo;
+        char                    *buf = NULL;
         ssize_t                 size;
         u64                     id;
         enum pstore_type_id     type;
         struct timespec         time;
         int                     failed = 0, rc;
-        unsigned long           flags;
 
         if (!psi)
                 return;
 
-        spin_lock_irqsave(&psinfo->buf_lock, flags);
+        mutex_lock(&psi->read_mutex);
         rc = psi->open(psi);
         if (rc)
                 goto out;
 
-        while ((size = psi->read(&id, &type, &time, psi)) > 0) {
-                rc = pstore_mkfile(type, psi->name, id, psi->buf, (size_t)size,
+        while ((size = psi->read(&id, &type, &time, &buf, psi)) > 0) {
+                rc = pstore_mkfile(type, psi->name, id, buf, (size_t)size,
                                   time, psi);
+                kfree(buf);
+                buf = NULL;
                 if (rc && (rc != -EEXIST || !quiet))
                         failed++;
         }
         psi->close(psi);
 out:
-        spin_unlock_irqrestore(&psinfo->buf_lock, flags);
+        mutex_unlock(&psi->read_mutex);
 
         if (failed)
                 printk(KERN_WARNING "pstore: failed to load %d record(s) from '%s'\n",
diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
index b6c4b3795c4a..76e4266d2e7e 100644
--- a/fs/xfs/xfs_acl.c
+++ b/fs/xfs/xfs_acl.c
@@ -42,6 +42,8 @@ xfs_acl_from_disk(struct xfs_acl *aclp)
         int count, i;
 
         count = be32_to_cpu(aclp->acl_cnt);
+        if (count > XFS_ACL_MAX_ENTRIES)
+                return ERR_PTR(-EFSCORRUPTED);
 
         acl = posix_acl_alloc(count, GFP_KERNEL);
         if (!acl)
diff --git a/fs/xfs/xfs_attr_leaf.c b/fs/xfs/xfs_attr_leaf.c
index d4906e7c9787..c1b55e596551 100644
--- a/fs/xfs/xfs_attr_leaf.c
+++ b/fs/xfs/xfs_attr_leaf.c
@@ -110,6 +110,7 @@ xfs_attr_namesp_match(int arg_flags, int ondisk_flags)
 /*
  * Query whether the requested number of additional bytes of extended
  * attribute space will be able to fit inline.
+ *
  * Returns zero if not, else the di_forkoff fork offset to be used in the
  * literal area for attribute data once the new bytes have been added.
  *
@@ -122,7 +123,7 @@ xfs_attr_shortform_bytesfit(xfs_inode_t *dp, int bytes)
         int offset;
         int minforkoff; /* lower limit on valid forkoff locations */
         int maxforkoff; /* upper limit on valid forkoff locations */
-        int dsize;      
+        int dsize;
         xfs_mount_t *mp = dp->i_mount;
 
         offset = (XFS_LITINO(mp) - bytes) >> 3; /* rounded down */
@@ -136,47 +137,60 @@ xfs_attr_shortform_bytesfit(xfs_inode_t *dp, int bytes)
                 return (offset >= minforkoff) ? minforkoff : 0;
         }
 
-        if (!(mp->m_flags & XFS_MOUNT_ATTR2)) {
-                if (bytes <= XFS_IFORK_ASIZE(dp))
-                        return dp->i_d.di_forkoff;
+        /*
+         * If the requested numbers of bytes is smaller or equal to the
+         * current attribute fork size we can always proceed.
+         *
+         * Note that if_bytes in the data fork might actually be larger than
+         * the current data fork size is due to delalloc extents. In that
+         * case either the extent count will go down when they are converted
+         * to real extents, or the delalloc conversion will take care of the
+         * literal area rebalancing.
+         */
+        if (bytes <= XFS_IFORK_ASIZE(dp))
+                return dp->i_d.di_forkoff;
+
+        /*
+         * For attr2 we can try to move the forkoff if there is space in the
+         * literal area, but for the old format we are done if there is no
+         * space in the fixed attribute fork.
+         */
+        if (!(mp->m_flags & XFS_MOUNT_ATTR2))
                 return 0;
-        }
 
         dsize = dp->i_df.if_bytes;
-        
+
         switch (dp->i_d.di_format) {
         case XFS_DINODE_FMT_EXTENTS:
-                /* 
+                /*
                  * If there is no attr fork and the data fork is extents, 
-                 * determine if creating the default attr fork will result 
-                 * in the extents form migrating to btree. If so, the 
-                 * minimum offset only needs to be the space required for 
+                 * determine if creating the default attr fork will result
+                 * in the extents form migrating to btree. If so, the
+                 * minimum offset only needs to be the space required for
                  * the btree root.
-                 */ 
+                 */
                 if (!dp->i_d.di_forkoff && dp->i_df.if_bytes >
                     xfs_default_attroffset(dp))
                         dsize = XFS_BMDR_SPACE_CALC(MINDBTPTRS);
                 break;
-                
         case XFS_DINODE_FMT_BTREE:
                 /*
-                 * If have data btree then keep forkoff if we have one,
-                 * otherwise we are adding a new attr, so then we set 
-                 * minforkoff to where the btree root can finish so we have 
+                 * If we have a data btree then keep forkoff if we have one,
+                 * otherwise we are adding a new attr, so then we set
+                 * minforkoff to where the btree root can finish so we have
                  * plenty of room for attrs
                  */
                 if (dp->i_d.di_forkoff) {
-                        if (offset < dp->i_d.di_forkoff) 
+                        if (offset < dp->i_d.di_forkoff)
                                 return 0;
-                        else 
-                                return dp->i_d.di_forkoff;
-                } else
-                        dsize = XFS_BMAP_BROOT_SPACE(dp->i_df.if_broot);
+                        return dp->i_d.di_forkoff;
+                }
+                dsize = XFS_BMAP_BROOT_SPACE(dp->i_df.if_broot);
                 break;
         }
-        
-        /* 
-         * A data fork btree root must have space for at least 
+
+        /*
+         * A data fork btree root must have space for at least
          * MINDBTPTRS key/ptr pairs if the data fork is small or empty.
          */
         minforkoff = MAX(dsize, XFS_BMDR_SPACE_CALC(MINDBTPTRS));
@@ -186,10 +200,10 @@ xfs_attr_shortform_bytesfit(xfs_inode_t *dp, int bytes)
         maxforkoff = XFS_LITINO(mp) - XFS_BMDR_SPACE_CALC(MINABTPTRS);
         maxforkoff = maxforkoff >> 3;   /* rounded down */
 
-        if (offset >= minforkoff && offset < maxforkoff)
-                return offset;
         if (offset >= maxforkoff)
                 return maxforkoff;
+        if (offset >= minforkoff)
+                return offset;
         return 0;
 }
 
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index c0237c602f11..755ee8164880 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2835,6 +2835,27 @@ corrupt_out:
         return XFS_ERROR(EFSCORRUPTED);
 }
 
+void
+xfs_promote_inode(
+        struct xfs_inode        *ip)
+{
+        struct xfs_buf          *bp;
+
+        ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_ILOCK_SHARED));
+
+        bp = xfs_incore(ip->i_mount->m_ddev_targp, ip->i_imap.im_blkno,
+                        ip->i_imap.im_len, XBF_TRYLOCK);
+        if (!bp)
+                return;
+
+        if (XFS_BUF_ISDELAYWRITE(bp)) {
+                xfs_buf_delwri_promote(bp);
+                wake_up_process(ip->i_mount->m_ddev_targp->bt_task);
+        }
+
+        xfs_buf_relse(bp);
+}
+
 /*
  * Return a pointer to the extent record at file index idx.
  */
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 760140d1dd66..b4cd4739f98e 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -498,6 +498,7 @@ int		xfs_iunlink(struct xfs_trans *, xfs_inode_t *);
 void            xfs_iext_realloc(xfs_inode_t *, int, int);
 void            xfs_iunpin_wait(xfs_inode_t *);
 int             xfs_iflush(xfs_inode_t *, uint);
+void            xfs_promote_inode(struct xfs_inode *);
 void            xfs_lock_inodes(xfs_inode_t **, int, uint);
 void            xfs_lock_two_inodes(xfs_inode_t *, xfs_inode_t *, uint);
 
diff --git a/fs/xfs/xfs_sync.c b/fs/xfs/xfs_sync.c
index aa3dc1a4d53d..be5c51d8f757 100644
--- a/fs/xfs/xfs_sync.c
+++ b/fs/xfs/xfs_sync.c
@@ -770,6 +770,17 @@ restart:
         if (!xfs_iflock_nowait(ip)) {
                 if (!(sync_mode & SYNC_WAIT))
                         goto out;
+
+                /*
+                 * If we only have a single dirty inode in a cluster there is
+                 * a fair chance that the AIL push may have pushed it into
+                 * the buffer, but xfsbufd won't touch it until 30 seconds
+                 * from now, and thus we will lock up here.
+                 *
+                 * Promote the inode buffer to the front of the delwri list
+                 * and wake up xfsbufd now.
+                 */
+                xfs_promote_inode(ip);
                 xfs_iflock(ip);
         }
 
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index f81676f1b310..4e4fbb820e20 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -197,6 +197,14 @@
         {0x1002, 0x6770, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6778, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6779, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6840, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6841, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6842, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6843, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6849, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6850, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6858, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6859, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6880, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6888, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6889, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
diff --git a/include/drm/exynos_drm.h b/include/drm/exynos_drm.h
index 1d161cb3aca5..12050434d57a 100644
--- a/include/drm/exynos_drm.h
+++ b/include/drm/exynos_drm.h
@@ -32,17 +32,16 @@
 /**
  * User-desired buffer creation information structure.
  *
- * @size: requested size for the object.
+ * @size: user-desired memory allocation size.
  *      - this size value would be page-aligned internally.
  * @flags: user request for setting memory type or cache attributes.
- * @handle: returned handle for the object.
- * @pad: just padding to be 64-bit aligned.
+ * @handle: returned a handle to created gem object.
+ *      - this handle will be set by gem module of kernel side.
  */
 struct drm_exynos_gem_create {
-        unsigned int size;
+        uint64_t size;
         unsigned int flags;
         unsigned int handle;
-        unsigned int pad;
 };
 
 /**
diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
index 139c4db55f17..c86c940d1de3 100644
--- a/include/linux/clocksource.h
+++ b/include/linux/clocksource.h
@@ -156,6 +156,7 @@ extern u64 timecounter_cyc2time(struct timecounter *tc,
  * @mult:               cycle to nanosecond multiplier
  * @shift:              cycle to nanosecond divisor (power of two)
  * @max_idle_ns:        max idle time permitted by the clocksource (nsecs)
+ * @maxadj              maximum adjustment value to mult (~11%)
  * @flags:              flags describing special properties
  * @archdata:           arch-specific data
  * @suspend:            suspend function for the clocksource, if necessary
@@ -172,7 +173,7 @@ struct clocksource {
         u32 mult;
         u32 shift;
         u64 max_idle_ns;
-
+        u32 maxadj;
 #ifdef CONFIG_ARCH_CLOCKSOURCE_DATA
         struct arch_clocksource_data archdata;
 #endif
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index cbeb5867cff7..a82ad4dd306a 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2536,6 +2536,8 @@ extern void		net_disable_timestamp(void);
 extern void *dev_seq_start(struct seq_file *seq, loff_t *pos);
 extern void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos);
 extern void dev_seq_stop(struct seq_file *seq, void *v);
+extern int dev_seq_open_ops(struct inode *inode, struct file *file,
+                            const struct seq_operations *ops);
 #endif
 
 extern int netdev_class_create_file(struct class_attribute *class_attr);
diff --git a/include/linux/pkt_sched.h b/include/linux/pkt_sched.h
index c5336705921f..7281d5acf2f9 100644
--- a/include/linux/pkt_sched.h
+++ b/include/linux/pkt_sched.h
@@ -30,7 +30,7 @@
  */
 
 struct tc_stats {
-        __u64   bytes;                  /* NUmber of enqueues bytes */
+        __u64   bytes;                  /* Number of enqueued bytes */
         __u32   packets;                /* Number of enqueued packets   */
         __u32   drops;                  /* Packets dropped because of lack of resources */
         __u32   overlimits;             /* Number of throttle events when this
@@ -297,7 +297,7 @@ struct tc_htb_glob {
         __u32 debug;            /* debug flags */
 
         /* stats */
-        __u32 direct_pkts; /* count of non shapped packets */
+        __u32 direct_pkts; /* count of non shaped packets */
 };
 enum {
         TCA_HTB_UNSPEC,
@@ -503,7 +503,7 @@ enum {
 };
 #define NETEM_LOSS_MAX (__NETEM_LOSS_MAX - 1)
 
-/* State transition probablities for 4 state model */
+/* State transition probabilities for 4 state model */
 struct tc_netem_gimodel {
         __u32   p13;
         __u32   p31;
diff --git a/include/linux/pm.h b/include/linux/pm.h
index 5c4c8b18c8b7..3f3ed83a9aa5 100644
--- a/include/linux/pm.h
+++ b/include/linux/pm.h
@@ -54,118 +54,145 @@ typedef struct pm_message {
 /**
  * struct dev_pm_ops - device PM callbacks
  *
- * Several driver power state transitions are externally visible, affecting
+ * Several device power state transitions are externally visible, affecting
  * the state of pending I/O queues and (for drivers that touch hardware)
  * interrupts, wakeups, DMA, and other hardware state.  There may also be
- * internal transitions to various low power modes, which are transparent
+ * internal transitions to various low-power modes which are transparent
  * to the rest of the driver stack (such as a driver that's ON gating off
  * clocks which are not in active use).
  *
- * The externally visible transitions are handled with the help of the following
- * callbacks included in this structure:
- *
- * @prepare: Prepare the device for the upcoming transition, but do NOT change
- *      its hardware state.  Prevent new children of the device from being
- *      registered after @prepare() returns (the driver's subsystem and
- *      generally the rest of the kernel is supposed to prevent new calls to the
- *      probe method from being made too once @prepare() has succeeded).  If
- *      @prepare() detects a situation it cannot handle (e.g. registration of a
- *      child already in progress), it may return -EAGAIN, so that the PM core
- *      can execute it once again (e.g. after the new child has been registered)
- *      to recover from the race condition.  This method is executed for all
- *      kinds of suspend transitions and is followed by one of the suspend
- *      callbacks: @suspend(), @freeze(), or @poweroff().
- *      The PM core executes @prepare() for all devices before starting to
- *      execute suspend callbacks for any of them, so drivers may assume all of
- *      the other devices to be present and functional while @prepare() is being
- *      executed.  In particular, it is safe to make GFP_KERNEL memory
- *      allocations from within @prepare().  However, drivers may NOT assume
- *      anything about the availability of the user space at that time and it
- *      is not correct to request firmware from within @prepare() (it's too
- *      late to do that).  [To work around this limitation, drivers may
- *      register suspend and hibernation notifiers that are executed before the
- *      freezing of tasks.]
+ * The externally visible transitions are handled with the help of callbacks
+ * included in this structure in such a way that two levels of callbacks are
+ * involved.  First, the PM core executes callbacks provided by PM domains,
+ * device types, classes and bus types.  They are the subsystem-level callbacks
+ * supposed to execute callbacks provided by device drivers, although they may
+ * choose not to do that.  If the driver callbacks are executed, they have to
+ * collaborate with the subsystem-level callbacks to achieve the goals
+ * appropriate for the given system transition, given transition phase and the
+ * subsystem the device belongs to.
+ *
+ * @prepare: The principal role of this callback is to prevent new children of
+ *      the device from being registered after it has returned (the driver's
+ *      subsystem and generally the rest of the kernel is supposed to prevent
+ *      new calls to the probe method from being made too once @prepare() has
+ *      succeeded).  If @prepare() detects a situation it cannot handle (e.g.
+ *      registration of a child already in progress), it may return -EAGAIN, so
+ *      that the PM core can execute it once again (e.g. after a new child has
+ *      been registered) to recover from the race condition.
+ *      This method is executed for all kinds of suspend transitions and is
+ *      followed by one of the suspend callbacks: @suspend(), @freeze(), or
+ *      @poweroff().  The PM core executes subsystem-level @prepare() for all
+ *      devices before starting to invoke suspend callbacks for any of them, so
+ *      generally devices may be assumed to be functional or to respond to
+ *      runtime resume requests while @prepare() is being executed.  However,
+ *      device drivers may NOT assume anything about the availability of user
+ *      space at that time and it is NOT valid to request firmware from within
+ *      @prepare() (it's too late to do that).  It also is NOT valid to allocate
+ *      substantial amounts of memory from @prepare() in the GFP_KERNEL mode.
+ *      [To work around these limitations, drivers may register suspend and
+ *      hibernation notifiers to be executed before the freezing of tasks.]
  *
  * @complete: Undo the changes made by @prepare().  This method is executed for
  *      all kinds of resume transitions, following one of the resume callbacks:
  *      @resume(), @thaw(), @restore().  Also called if the state transition
- *      fails before the driver's suspend callback (@suspend(), @freeze(),
- *      @poweroff()) can be executed (e.g. if the suspend callback fails for one
+ *      fails before the driver's suspend callback: @suspend(), @freeze() or
+ *      @poweroff(), can be executed (e.g. if the suspend callback fails for one
  *      of the other devices that the PM core has unsuccessfully attempted to
  *      suspend earlier).
- *      The PM core executes @complete() after it has executed the appropriate
- *      resume callback for all devices.
+ *      The PM core executes subsystem-level @complete() after it has executed
+ *      the appropriate resume callbacks for all devices.
  *
  * @suspend: Executed before putting the system into a sleep state in which the
- *      contents of main memory are preserved.  Quiesce the device, put it into
- *      a low power state appropriate for the upcoming system state (such as
- *      PCI_D3hot), and enable wakeup events as appropriate.
+ *      contents of main memory are preserved.  The exact action to perform
+ *      depends on the device's subsystem (PM domain, device type, class or bus
+ *      type), but generally the device must be quiescent after subsystem-level
+ *      @suspend() has returned, so that it doesn't do any I/O or DMA.
+ *      Subsystem-level @suspend() is executed for all devices after invoking
+ *      subsystem-level @prepare() for all of them.
  *
  * @resume: Executed after waking the system up from a sleep state in which the
- *      contents of main memory were preserved.  Put the device into the
- *      appropriate state, according to the information saved in memory by the
- *      preceding @suspend().  The driver starts working again, responding to
- *      hardware events and software requests.  The hardware may have gone
- *      through a power-off reset, or it may have maintained state from the
- *      previous suspend() which the driver may rely on while resuming.  On most
- *      platforms, there are no restrictions on availability of resources like
- *      clocks during @resume().
+ *      contents of main memory were preserved.  The exact action to perform
+ *      depends on the device's subsystem, but generally the driver is expected
+ *      to start working again, responding to hardware events and software
+ *      requests (the device itself may be left in a low-power state, waiting
+ *      for a runtime resume to occur).  The state of the device at the time its
+ *      driver's @resume() callback is run depends on the platform and subsystem
+ *      the device belongs to.  On most platforms, there are no restrictions on
+ *      availability of resources like clocks during @resume().
+ *      Subsystem-level @resume() is executed for all devices after invoking
+ *      subsystem-level @resume_noirq() for all of them.
  *
  * @freeze: Hibernation-specific, executed before creating a hibernation image.
- *      Quiesce operations so that a consistent image can be created, but do NOT
- *      otherwise put the device into a low power device state and do NOT emit
- *      system wakeup events.  Save in main memory the device settings to be
- *      used by @restore() during the subsequent resume from hibernation or by
- *      the subsequent @thaw(), if the creation of the image or the restoration
- *      of main memory contents from it fails.
+ *      Analogous to @suspend(), but it should not enable the device to signal
+ *      wakeup events or change its power state.  The majority of subsystems
+ *      (with the notable exception of the PCI bus type) expect the driver-level
+ *      @freeze() to save the device settings in memory to be used by @restore()
+ *      during the subsequent resume from hibernation.
+ *      Subsystem-level @freeze() is executed for all devices after invoking
+ *      subsystem-level @prepare() for all of them.
  *
  * @thaw: Hibernation-specific, executed after creating a hibernation image OR
- *      if the creation of the image fails.  Also executed after a failing
+ *      if the creation of an image has failed.  Also executed after a failing
  *      attempt to restore the contents of main memory from such an image.
  *      Undo the changes made by the preceding @freeze(), so the device can be
  *      operated in the same way as immediately before the call to @freeze().
+ *      Subsystem-level @thaw() is executed for all devices after invoking
+ *      subsystem-level @thaw_noirq() for all of them.  It also may be executed
+ *      directly after @freeze() in case of a transition error.
  *
  * @poweroff: Hibernation-specific, executed after saving a hibernation image.
- *      Quiesce the device, put it into a low power state appropriate for the
- *      upcoming system state (such as PCI_D3hot), and enable wakeup events as
- *      appropriate.
+ *      Analogous to @suspend(), but it need not save the device's settings in
+ *      memory.
+ *      Subsystem-level @poweroff() is executed for all devices after invoking
+ *      subsystem-level @prepare() for all of them.
  *
  * @restore: Hibernation-specific, executed after restoring the contents of main
- *      memory from a hibernation image.  Driver starts working again,
- *      responding to hardware events and software requests.  Drivers may NOT
- *      make ANY assumptions about the hardware state right prior to @restore().
- *      On most platforms, there are no restrictions on availability of
- *      resources like clocks during @restore().
- *
- * @suspend_noirq: Complete the operations of ->suspend() by carrying out any
- *      actions required for suspending the device that need interrupts to be
- *      disabled
- *
- * @resume_noirq: Prepare for the execution of ->resume() by carrying out any
- *      actions required for resuming the device that need interrupts to be
- *      disabled
- *
- * @freeze_noirq: Complete the operations of ->freeze() by carrying out any
- *      actions required for freezing the device that need interrupts to be
- *      disabled
- *
- * @thaw_noirq: Prepare for the execution of ->thaw() by carrying out any
- *      actions required for thawing the device that need interrupts to be
- *      disabled
- *
- * @poweroff_noirq: Complete the operations of ->poweroff() by carrying out any
- *      actions required for handling the device that need interrupts to be
- *      disabled
- *
- * @restore_noirq: Prepare for the execution of ->restore() by carrying out any
- *      actions required for restoring the operations of the device that need
- *      interrupts to be disabled
+ *      memory from a hibernation image, analogous to @resume().
+ *
+ * @suspend_noirq: Complete the actions started by @suspend().  Carry out any
+ *      additional operations required for suspending the device that might be
+ *      racing with its driver's interrupt handler, which is guaranteed not to
+ *      run while @suspend_noirq() is being executed.
+ *      It generally is expected that the device will be in a low-power state
+ *      (appropriate for the target system sleep state) after subsystem-level
+ *      @suspend_noirq() has returned successfully.  If the device can generate
+ *      system wakeup signals and is enabled to wake up the system, it should be
+ *      configured to do so at that time.  However, depending on the platform
+ *      and device's subsystem, @suspend() may be allowed to put the device into
+ *      the low-power state and configure it to generate wakeup signals, in
+ *      which case it generally is not necessary to define @suspend_noirq().
+ *
+ * @resume_noirq: Prepare for the execution of @resume() by carrying out any
+ *      operations required for resuming the device that might be racing with
+ *      its driver's interrupt handler, which is guaranteed not to run while
+ *      @resume_noirq() is being executed.
+ *
+ * @freeze_noirq: Complete the actions started by @freeze().  Carry out any
+ *      additional operations required for freezing the device that might be
+ *      racing with its driver's interrupt handler, which is guaranteed not to
+ *      run while @freeze_noirq() is being executed.
+ *      The power state of the device should not be changed by either @freeze()
+ *      or @freeze_noirq() and it should not be configured to signal system
+ *      wakeup by any of these callbacks.
+ *
+ * @thaw_noirq: Prepare for the execution of @thaw() by carrying out any
+ *      operations required for thawing the device that might be racing with its
+ *      driver's interrupt handler, which is guaranteed not to run while
+ *      @thaw_noirq() is being executed.
+ *
+ * @poweroff_noirq: Complete the actions started by @poweroff().  Analogous to
+ *      @suspend_noirq(), but it need not save the device's settings in memory.
+ *
+ * @restore_noirq: Prepare for the execution of @restore() by carrying out any
+ *      operations required for thawing the device that might be racing with its
+ *      driver's interrupt handler, which is guaranteed not to run while
+ *      @restore_noirq() is being executed.  Analogous to @resume_noirq().
  *
  * All of the above callbacks, except for @complete(), return error codes.
  * However, the error codes returned by the resume operations, @resume(),
- * @thaw(), @restore(), @resume_noirq(), @thaw_noirq(), and @restore_noirq() do
+ * @thaw(), @restore(), @resume_noirq(), @thaw_noirq(), and @restore_noirq(), do
  * not cause the PM core to abort the resume transition during which they are
- * returned.  The error codes returned in that cases are only printed by the PM
+ * returned.  The error codes returned in those cases are only printed by the PM
  * core to the system logs for debugging purposes.  Still, it is recommended
  * that drivers only return error codes from their resume methods in case of an
  * unrecoverable failure (i.e. when the device being handled refuses to resume
@@ -174,31 +201,43 @@ typedef struct pm_message {
  * their children.
  *
  * It is allowed to unregister devices while the above callbacks are being
- * executed.  However, it is not allowed to unregister a device from within any
- * of its own callbacks.
+ * executed.  However, a callback routine must NOT try to unregister the device
+ * it was called for, although it may unregister children of that device (for
+ * example, if it detects that a child was unplugged while the system was
+ * asleep).
+ *
+ * Refer to Documentation/power/devices.txt for more information about the role
+ * of the above callbacks in the system suspend process.
  *
- * There also are the following callbacks related to run-time power management
- * of devices:
+ * There also are callbacks related to runtime power management of devices.
+ * Again, these callbacks are executed by the PM core only for subsystems
+ * (PM domains, device types, classes and bus types) and the subsystem-level
+ * callbacks are supposed to invoke the driver callbacks.  Moreover, the exact
+ * actions to be performed by a device driver's callbacks generally depend on
+ * the platform and subsystem the device belongs to.
  *
  * @runtime_suspend: Prepare the device for a condition in which it won't be
  *      able to communicate with the CPU(s) and RAM due to power management.
- *      This need not mean that the device should be put into a low power state.
+ *      This need not mean that the device should be put into a low-power state.
  *      For example, if the device is behind a link which is about to be turned
  *      off, the device may remain at full power.  If the device does go to low
- *      power and is capable of generating run-time wake-up events, remote
- *      wake-up (i.e., a hardware mechanism allowing the device to request a
- *      change of its power state via a wake-up event, such as PCI PME) should
- *      be enabled for it.
+ *      power and is capable of generating runtime wakeup events, remote wakeup
+ *      (i.e., a hardware mechanism allowing the device to request a change of
+ *      its power state via an interrupt) should be enabled for it.
  *
  * @runtime_resume: Put the device into the fully active state in response to a
- *      wake-up event generated by hardware or at the request of software.  If
- *      necessary, put the device into the full power state and restore its
+ *      wakeup event generated by hardware or at the request of software.  If
+ *      necessary, put the device into the full-power state and restore its
  *      registers, so that it is fully operational.
  *
- * @runtime_idle: Device appears to be inactive and it might be put into a low
- *      power state if all of the necessary conditions are satisfied.  Check
+ * @runtime_idle: Device appears to be inactive and it might be put into a
+ *      low-power state if all of the necessary conditions are satisfied.  Check
  *      these conditions and handle the device as appropriate, possibly queueing
  *      a suspend request for it.  The return value is ignored by the PM core.
+ *
+ * Refer to Documentation/power/runtime_pm.txt for more information about the
+ * role of the above callbacks in device runtime power management.
+ *
  */
 
 struct dev_pm_ops {
diff --git a/include/linux/pstore.h b/include/linux/pstore.h
index ea567321ae3c..2ca8cde5459d 100644
--- a/include/linux/pstore.h
+++ b/include/linux/pstore.h
@@ -35,10 +35,12 @@ struct pstore_info {
         spinlock_t      buf_lock;       /* serialize access to 'buf' */
         char            *buf;
         size_t          bufsize;
+        struct mutex    read_mutex;     /* serialize open/read/close */
         int             (*open)(struct pstore_info *psi);
         int             (*close)(struct pstore_info *psi);
         ssize_t         (*read)(u64 *id, enum pstore_type_id *type,
-                        struct timespec *time, struct pstore_info *psi);
+                        struct timespec *time, char **buf,
+                        struct pstore_info *psi);
         int             (*write)(enum pstore_type_id type, u64 *id,
                         unsigned int part, size_t size, struct pstore_info *psi);
         int             (*erase)(enum pstore_type_id type, u64 id,
diff --git a/include/linux/sigma.h b/include/linux/sigma.h
index e2accb3164d8..d0de882c0d96 100644
--- a/include/linux/sigma.h
+++ b/include/linux/sigma.h
@@ -24,7 +24,7 @@ struct sigma_firmware {
 struct sigma_firmware_header {
         unsigned char magic[7];
         u8 version;
-        u32 crc;
+        __le32 crc;
 };
 
 enum {
@@ -40,19 +40,14 @@ enum {
 struct sigma_action {
         u8 instr;
         u8 len_hi;
-        u16 len;
-        u16 addr;
+        __le16 len;
+        __be16 addr;
         unsigned char payload[];
 };
 
 static inline u32 sigma_action_len(struct sigma_action *sa)
 {
-        return (sa->len_hi << 16) | sa->len;
-}
-
-static inline size_t sigma_action_size(struct sigma_action *sa, u32 payload_len)
-{
-        return sizeof(*sa) + payload_len + (payload_len % 2);
+        return (sa->len_hi << 16) | le16_to_cpu(sa->len);
 }
 
 extern int process_sigma_firmware(struct i2c_client *client, const char *name);
diff --git a/include/net/dst.h b/include/net/dst.h
index 4fb6c4381791..6faec1a60216 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -205,12 +205,7 @@ dst_feature(const struct dst_entry *dst, u32 feature)
 
 static inline u32 dst_mtu(const struct dst_entry *dst)
 {
-        u32 mtu = dst_metric_raw(dst, RTAX_MTU);
-
-        if (!mtu)
-                mtu = dst->ops->default_mtu(dst);
-
-        return mtu;
+        return dst->ops->mtu(dst);
 }
 
 /* RTT metrics are stored in milliseconds for user ABI, but used as jiffies */
diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
index 9adb99845a56..e1c2ee0eef47 100644
--- a/include/net/dst_ops.h
+++ b/include/net/dst_ops.h
@@ -17,7 +17,7 @@ struct dst_ops {
         int                     (*gc)(struct dst_ops *ops);
         struct dst_entry *      (*check)(struct dst_entry *, __u32 cookie);
         unsigned int            (*default_advmss)(const struct dst_entry *);
-        unsigned int            (*default_mtu)(const struct dst_entry *);
+        unsigned int            (*mtu)(const struct dst_entry *);
         u32 *                   (*cow_metrics)(struct dst_entry *, unsigned long);
         void                    (*destroy)(struct dst_entry *);
         void                    (*ifdown)(struct dst_entry *,
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index b897d6e6d0a5..f941964a9931 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -31,6 +31,7 @@
 /** struct ip_options - IP Options
  *
  * @faddr - Saved first hop address
+ * @nexthop - Saved nexthop address in LSRR and SSRR
  * @is_data - Options in __data, rather than skb
  * @is_strictroute - Strict source route
  * @srr_is_hit - Packet destination addr was our one
@@ -41,6 +42,7 @@
  */
 struct ip_options {
         __be32          faddr;
+        __be32          nexthop;
         unsigned char   optlen;
         unsigned char   srr;
         unsigned char   rr;
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 78c83e62218f..e9ff3fc5e688 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -35,6 +35,7 @@ struct inet_peer {
 
         u32                     metrics[RTAX_MAX];
         u32                     rate_tokens;    /* rate limiting for ICMP */
+        int                     redirect_genid;
         unsigned long           rate_last;
         unsigned long           pmtu_expires;
         u32                     pmtu_orig;
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h
index 4283508b3e18..a88fb6939387 100644
--- a/include/net/netfilter/nf_conntrack_ecache.h
+++ b/include/net/netfilter/nf_conntrack_ecache.h
@@ -67,18 +67,18 @@ struct nf_ct_event_notifier {
         int (*fcn)(unsigned int events, struct nf_ct_event *item);
 };
 
-extern struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb;
-extern int nf_conntrack_register_notifier(struct nf_ct_event_notifier *nb);
-extern void nf_conntrack_unregister_notifier(struct nf_ct_event_notifier *nb);
+extern int nf_conntrack_register_notifier(struct net *net, struct nf_ct_event_notifier *nb);
+extern void nf_conntrack_unregister_notifier(struct net *net, struct nf_ct_event_notifier *nb);
 
 extern void nf_ct_deliver_cached_events(struct nf_conn *ct);
 
 static inline void
 nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
 {
+        struct net *net = nf_ct_net(ct);
         struct nf_conntrack_ecache *e;
 
-        if (nf_conntrack_event_cb == NULL)
+        if (net->ct.nf_conntrack_event_cb == NULL)
                 return;
 
         e = nf_ct_ecache_find(ct);
@@ -95,11 +95,12 @@ nf_conntrack_eventmask_report(unsigned int eventmask,
                               int report)
 {
         int ret = 0;
+        struct net *net = nf_ct_net(ct);
         struct nf_ct_event_notifier *notify;
         struct nf_conntrack_ecache *e;
 
         rcu_read_lock();
-        notify = rcu_dereference(nf_conntrack_event_cb);
+        notify = rcu_dereference(net->ct.nf_conntrack_event_cb);
         if (notify == NULL)
                 goto out_unlock;
 
@@ -164,9 +165,8 @@ struct nf_exp_event_notifier {
         int (*fcn)(unsigned int events, struct nf_exp_event *item);
 };
 
-extern struct nf_exp_event_notifier __rcu *nf_expect_event_cb;
-extern int nf_ct_expect_register_notifier(struct nf_exp_event_notifier *nb);
-extern void nf_ct_expect_unregister_notifier(struct nf_exp_event_notifier *nb);
+extern int nf_ct_expect_register_notifier(struct net *net, struct nf_exp_event_notifier *nb);
+extern void nf_ct_expect_unregister_notifier(struct net *net, struct nf_exp_event_notifier *nb);
 
 static inline void
 nf_ct_expect_event_report(enum ip_conntrack_expect_events event,
@@ -174,11 +174,12 @@ nf_ct_expect_event_report(enum ip_conntrack_expect_events event,
                           u32 pid,
                           int report)
 {
+        struct net *net = nf_ct_exp_net(exp);
         struct nf_exp_event_notifier *notify;
         struct nf_conntrack_ecache *e;
 
         rcu_read_lock();
-        notify = rcu_dereference(nf_expect_event_cb);
+        notify = rcu_dereference(net->ct.nf_expect_event_cb);
         if (notify == NULL)
                 goto out_unlock;
 
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index 0249399e51a7..7a911eca0f18 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -18,6 +18,8 @@ struct netns_ct {
         struct hlist_nulls_head unconfirmed;
         struct hlist_nulls_head dying;
         struct ip_conntrack_stat __percpu *stat;
+        struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb;
+        struct nf_exp_event_notifier __rcu *nf_expect_event_cb;
         int                     sysctl_events;
         unsigned int            sysctl_events_retry_timeout;
         int                     sysctl_acct;
diff --git a/include/net/red.h b/include/net/red.h
index 3319f16b3beb..b72a3b833936 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -116,7 +116,7 @@ struct red_parms {
         u32             qR;             /* Cached random number */
 
         unsigned long   qavg;           /* Average queue length: A scaled */
-        psched_time_t   qidlestart;     /* Start of current idle period */
+        ktime_t         qidlestart;     /* Start of current idle period */
 };
 
 static inline u32 red_rmask(u8 Plog)
@@ -148,17 +148,17 @@ static inline void red_set_parms(struct red_parms *p,
 
 static inline int red_is_idling(struct red_parms *p)
 {
-        return p->qidlestart != PSCHED_PASTPERFECT;
+        return p->qidlestart.tv64 != 0;
 }
 
 static inline void red_start_of_idle_period(struct red_parms *p)
 {
-        p->qidlestart = psched_get_time();
+        p->qidlestart = ktime_get();
 }
 
 static inline void red_end_of_idle_period(struct red_parms *p)
 {
-        p->qidlestart = PSCHED_PASTPERFECT;
+        p->qidlestart.tv64 = 0;
 }
 
 static inline void red_restart(struct red_parms *p)
@@ -170,13 +170,10 @@ static inline void red_restart(struct red_parms *p)
 
 static inline unsigned long red_calc_qavg_from_idle_time(struct red_parms *p)
 {
-        psched_time_t now;
-        long us_idle;
+        s64 delta = ktime_us_delta(ktime_get(), p->qidlestart);
+        long us_idle = min_t(s64, delta, p->Scell_max);
         int  shift;
 
-        now = psched_get_time();
-        us_idle = psched_tdiff_bounded(now, p->qidlestart, p->Scell_max);
-
         /*
          * The problem: ideally, average length queue recalcultion should
          * be done over constant clock intervals. This is too expensive, so
diff --git a/include/net/route.h b/include/net/route.h
index db7b3432f07c..91855d185b53 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -71,12 +71,12 @@ struct rtable {
         struct fib_info         *fi; /* for client ref to shared metrics */
 };
 
-static inline bool rt_is_input_route(struct rtable *rt)
+static inline bool rt_is_input_route(const struct rtable *rt)
 {
         return rt->rt_route_iif != 0;
 }
 
-static inline bool rt_is_output_route(struct rtable *rt)
+static inline bool rt_is_output_route(const struct rtable *rt)
 {
         return rt->rt_route_iif == 0;
 }
diff --git a/include/video/omapdss.h b/include/video/omapdss.h
index b66ebb2032c6..378c7ed6760b 100644
--- a/include/video/omapdss.h
+++ b/include/video/omapdss.h
@@ -307,15 +307,8 @@ struct omap_dss_board_info {
         void (*dsi_disable_pads)(int dsi_id, unsigned lane_mask);
 };
 
-#if defined(CONFIG_OMAP2_DSS_MODULE) || defined(CONFIG_OMAP2_DSS)
 /* Init with the board info */
 extern int omap_display_init(struct omap_dss_board_info *board_data);
-#else
-static inline int omap_display_init(struct omap_dss_board_info *board_data)
-{
-        return 0;
-}
-#endif
 
 struct omap_display_platform_data {
         struct omap_dss_board_info *board_data;
diff --git a/kernel/cgroup_freezer.c b/kernel/cgroup_freezer.c
index 5e828a2ca8e6..213c0351dad8 100644
--- a/kernel/cgroup_freezer.c
+++ b/kernel/cgroup_freezer.c
@@ -153,6 +153,13 @@ static void freezer_destroy(struct cgroup_subsys *ss,
         kfree(cgroup_freezer(cgroup));
 }
 
+/* task is frozen or will freeze immediately when next it gets woken */
+static bool is_task_frozen_enough(struct task_struct *task)
+{
+        return frozen(task) ||
+                (task_is_stopped_or_traced(task) && freezing(task));
+}
+
 /*
  * The call to cgroup_lock() in the freezer.state write method prevents
  * a write to that file racing against an attach, and hence the
@@ -231,7 +238,7 @@ static void update_if_frozen(struct cgroup *cgroup,
         cgroup_iter_start(cgroup, &it);
         while ((task = cgroup_iter_next(cgroup, &it))) {
                 ntotal++;
-                if (frozen(task))
+                if (is_task_frozen_enough(task))
                         nfrozen++;
         }
 
@@ -284,7 +291,7 @@ static int try_to_freeze_cgroup(struct cgroup *cgroup, struct freezer *freezer)
         while ((task = cgroup_iter_next(cgroup, &it))) {
                 if (!freeze_task(task, true))
                         continue;
-                if (frozen(task))
+                if (is_task_frozen_enough(task))
                         continue;
                 if (!freezing(task) && !freezer_should_skip(task))
                         num_cant_freeze_now++;
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 422e567eecf6..ae34bf51682b 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -885,10 +885,13 @@ static void __remove_hrtimer(struct hrtimer *timer,
                              struct hrtimer_clock_base *base,
                              unsigned long newstate, int reprogram)
 {
+        struct timerqueue_node *next_timer;
         if (!(timer->state & HRTIMER_STATE_ENQUEUED))
                 goto out;
 
-        if (&timer->node == timerqueue_getnext(&base->active)) {
+        next_timer = timerqueue_getnext(&base->active);
+        timerqueue_del(&base->active, &timer->node);
+        if (&timer->node == next_timer) {
 #ifdef CONFIG_HIGH_RES_TIMERS
                 /* Reprogram the clock event device. if enabled */
                 if (reprogram && hrtimer_hres_active()) {
@@ -901,7 +904,6 @@ static void __remove_hrtimer(struct hrtimer *timer,
                 }
 #endif
         }
-        timerqueue_del(&base->active, &timer->node);
         if (!timerqueue_getnext(&base->active))
                 base->cpu_base->active_bases &= ~(1 << base->index);
 out:
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 67ce837ae52c..0e2b179bc7b3 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1596,7 +1596,7 @@ int request_percpu_irq(unsigned int irq, irq_handler_t handler,
                 return -ENOMEM;
 
         action->handler = handler;
-        action->flags = IRQF_PERCPU;
+        action->flags = IRQF_PERCPU | IRQF_NO_SUSPEND;
         action->name = devname;
         action->percpu_dev_id = dev_id;
 
diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
index b5f4742693c0..dc813a948be2 100644
--- a/kernel/irq/spurious.c
+++ b/kernel/irq/spurious.c
@@ -84,7 +84,9 @@ static int try_one_irq(int irq, struct irq_desc *desc, bool force)
          */
         action = desc->action;
         if (!action || !(action->flags & IRQF_SHARED) ||
-            (action->flags & __IRQF_TIMER) || !action->next)
+            (action->flags & __IRQF_TIMER) ||
+            (action->handler(irq, action->dev_id) == IRQ_HANDLED) ||
+            !action->next)
                 goto out;
 
         /* Already running on another processor */
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index 196c01268ebd..a6b0503574ee 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -347,7 +347,7 @@ int hibernation_snapshot(int platform_mode)
 
         error = freeze_kernel_threads();
         if (error)
-                goto Close;
+                goto Cleanup;
 
         if (hibernation_test(TEST_FREEZER) ||
                 hibernation_testmode(HIBERNATION_TESTPROC)) {
@@ -357,12 +357,14 @@ int hibernation_snapshot(int platform_mode)
                  * successful freezer test.
                  */
                 freezer_test_done = true;
-                goto Close;
+                goto Cleanup;
         }
 
         error = dpm_prepare(PMSG_FREEZE);
-        if (error)
-                goto Complete_devices;
+        if (error) {
+                dpm_complete(msg);
+                goto Cleanup;
+        }
 
         suspend_console();
         pm_restrict_gfp_mask();
@@ -391,8 +393,6 @@ int hibernation_snapshot(int platform_mode)
                 pm_restore_gfp_mask();
 
         resume_console();
-
- Complete_devices:
         dpm_complete(msg);
 
  Close:
@@ -402,6 +402,10 @@ int hibernation_snapshot(int platform_mode)
  Recover_platform:
         platform_recover(platform_mode);
         goto Resume_devices;
+
+ Cleanup:
+        swsusp_free();
+        goto Close;
 }
 
 /**
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index cf52fda2e096..cfc65e1eb9fb 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -492,6 +492,22 @@ void clocksource_touch_watchdog(void)
 }
 
 /**
+ * clocksource_max_adjustment- Returns max adjustment amount
+ * @cs:         Pointer to clocksource
+ *
+ */
+static u32 clocksource_max_adjustment(struct clocksource *cs)
+{
+        u64 ret;
+        /*
+         * We won't try to correct for more then 11% adjustments (110,000 ppm),
+         */
+        ret = (u64)cs->mult * 11;
+        do_div(ret,100);
+        return (u32)ret;
+}
+
+/**
  * clocksource_max_deferment - Returns max time the clocksource can be deferred
  * @cs:         Pointer to clocksource
  *
@@ -503,25 +519,28 @@ static u64 clocksource_max_deferment(struct clocksource *cs)
         /*
          * Calculate the maximum number of cycles that we can pass to the
          * cyc2ns function without overflowing a 64-bit signed result. The
-         * maximum number of cycles is equal to ULLONG_MAX/cs->mult which
-         * is equivalent to the below.
-         * max_cycles < (2^63)/cs->mult
-         * max_cycles < 2^(log2((2^63)/cs->mult))
-         * max_cycles < 2^(log2(2^63) - log2(cs->mult))
-         * max_cycles < 2^(63 - log2(cs->mult))
-         * max_cycles < 1 << (63 - log2(cs->mult))
+         * maximum number of cycles is equal to ULLONG_MAX/(cs->mult+cs->maxadj)
+         * which is equivalent to the below.
+         * max_cycles < (2^63)/(cs->mult + cs->maxadj)
+         * max_cycles < 2^(log2((2^63)/(cs->mult + cs->maxadj)))
+         * max_cycles < 2^(log2(2^63) - log2(cs->mult + cs->maxadj))
+         * max_cycles < 2^(63 - log2(cs->mult + cs->maxadj))
+         * max_cycles < 1 << (63 - log2(cs->mult + cs->maxadj))
          * Please note that we add 1 to the result of the log2 to account for
          * any rounding errors, ensure the above inequality is satisfied and
          * no overflow will occur.
          */
-        max_cycles = 1ULL << (63 - (ilog2(cs->mult) + 1));
+        max_cycles = 1ULL << (63 - (ilog2(cs->mult + cs->maxadj) + 1));
 
         /*
          * The actual maximum number of cycles we can defer the clocksource is
          * determined by the minimum of max_cycles and cs->mask.
+         * Note: Here we subtract the maxadj to make sure we don't sleep for
+         * too long if there's a large negative adjustment.
          */
         max_cycles = min_t(u64, max_cycles, (u64) cs->mask);
-        max_nsecs = clocksource_cyc2ns(max_cycles, cs->mult, cs->shift);
+        max_nsecs = clocksource_cyc2ns(max_cycles, cs->mult - cs->maxadj,
+                                        cs->shift);
 
         /*
          * To ensure that the clocksource does not wrap whilst we are idle,
@@ -640,7 +659,6 @@ static void clocksource_enqueue(struct clocksource *cs)
 void __clocksource_updatefreq_scale(struct clocksource *cs, u32 scale, u32 freq)
 {
         u64 sec;
-
         /*
          * Calc the maximum number of seconds which we can run before
          * wrapping around. For clocksources which have a mask > 32bit
@@ -661,6 +679,20 @@ void __clocksource_updatefreq_scale(struct clocksource *cs, u32 scale, u32 freq)
 
         clocks_calc_mult_shift(&cs->mult, &cs->shift, freq,
                                NSEC_PER_SEC / scale, sec * scale);
+
+        /*
+         * for clocksources that have large mults, to avoid overflow.
+         * Since mult may be adjusted by ntp, add an safety extra margin
+         *
+         */
+        cs->maxadj = clocksource_max_adjustment(cs);
+        while ((cs->mult + cs->maxadj < cs->mult)
+                || (cs->mult - cs->maxadj > cs->mult)) {
+                cs->mult >>= 1;
+                cs->shift--;
+                cs->maxadj = clocksource_max_adjustment(cs);
+        }
+
         cs->max_idle_ns = clocksource_max_deferment(cs);
 }
 EXPORT_SYMBOL_GPL(__clocksource_updatefreq_scale);
@@ -701,6 +733,12 @@ EXPORT_SYMBOL_GPL(__clocksource_register_scale);
  */
 int clocksource_register(struct clocksource *cs)
 {
+        /* calculate max adjustment for given mult/shift */
+        cs->maxadj = clocksource_max_adjustment(cs);
+        WARN_ONCE(cs->mult + cs->maxadj < cs->mult,
+                "Clocksource %s might overflow on 11%% adjustment\n",
+                cs->name);
+
         /* calculate max idle time permitted for this clocksource */
         cs->max_idle_ns = clocksource_max_deferment(cs);
 
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 2b021b0e8507..237841378c03 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -249,6 +249,8 @@ ktime_t ktime_get(void)
                 secs = xtime.tv_sec + wall_to_monotonic.tv_sec;
                 nsecs = xtime.tv_nsec + wall_to_monotonic.tv_nsec;
                 nsecs += timekeeping_get_ns();
+                /* If arch requires, add in gettimeoffset() */
+                nsecs += arch_gettimeoffset();
 
         } while (read_seqretry(&xtime_lock, seq));
         /*
@@ -280,6 +282,8 @@ void ktime_get_ts(struct timespec *ts)
                 *ts = xtime;
                 tomono = wall_to_monotonic;
                 nsecs = timekeeping_get_ns();
+                /* If arch requires, add in gettimeoffset() */
+                nsecs += arch_gettimeoffset();
 
         } while (read_seqretry(&xtime_lock, seq));
 
@@ -802,14 +806,44 @@ static void timekeeping_adjust(s64 offset)
         s64 error, interval = timekeeper.cycle_interval;
         int adj;
 
+        /*
+         * The point of this is to check if the error is greater then half
+         * an interval.
+         *
+         * First we shift it down from NTP_SHIFT to clocksource->shifted nsecs.
+         *
+         * Note we subtract one in the shift, so that error is really error*2.
+         * This "saves" dividing(shifting) intererval twice, but keeps the
+         * (error > interval) comparision as still measuring if error is
+         * larger then half an interval.
+         *
+         * Note: It does not "save" on aggrivation when reading the code.
+         */
         error = timekeeper.ntp_error >> (timekeeper.ntp_error_shift - 1);
         if (error > interval) {
+                /*
+                 * We now divide error by 4(via shift), which checks if
+                 * the error is greater then twice the interval.
+                 * If it is greater, we need a bigadjust, if its smaller,
+                 * we can adjust by 1.
+                 */
                 error >>= 2;
+                /*
+                 * XXX - In update_wall_time, we round up to the next
+                 * nanosecond, and store the amount rounded up into
+                 * the error. This causes the likely below to be unlikely.
+                 *
+                 * The properfix is to avoid rounding up by using
+                 * the high precision timekeeper.xtime_nsec instead of
+                 * xtime.tv_nsec everywhere. Fixing this will take some
+                 * time.
+                 */
                 if (likely(error <= interval))
                         adj = 1;
                 else
                         adj = timekeeping_bigadjust(error, &interval, &offset);
         } else if (error < -interval) {
+                /* See comment above, this is just switched for the negative */
                 error >>= 2;
                 if (likely(error >= -interval)) {
                         adj = -1;
@@ -817,9 +851,65 @@ static void timekeeping_adjust(s64 offset)
                         offset = -offset;
                 } else
                         adj = timekeeping_bigadjust(error, &interval, &offset);
-        } else
+        } else /* No adjustment needed */
                 return;
 
+        WARN_ONCE(timekeeper.clock->maxadj &&
+                        (timekeeper.mult + adj > timekeeper.clock->mult +
+                                                timekeeper.clock->maxadj),
+                        "Adjusting %s more then 11%% (%ld vs %ld)\n",
+                        timekeeper.clock->name, (long)timekeeper.mult + adj,
+                        (long)timekeeper.clock->mult +
+                                timekeeper.clock->maxadj);
+        /*
+         * So the following can be confusing.
+         *
+         * To keep things simple, lets assume adj == 1 for now.
+         *
+         * When adj != 1, remember that the interval and offset values
+         * have been appropriately scaled so the math is the same.
+         *
+         * The basic idea here is that we're increasing the multiplier
+         * by one, this causes the xtime_interval to be incremented by
+         * one cycle_interval. This is because:
+         *      xtime_interval = cycle_interval * mult
+         * So if mult is being incremented by one:
+         *      xtime_interval = cycle_interval * (mult + 1)
+         * Its the same as:
+         *      xtime_interval = (cycle_interval * mult) + cycle_interval
+         * Which can be shortened to:
+         *      xtime_interval += cycle_interval
+         *
+         * So offset stores the non-accumulated cycles. Thus the current
+         * time (in shifted nanoseconds) is:
+         *      now = (offset * adj) + xtime_nsec
+         * Now, even though we're adjusting the clock frequency, we have
+         * to keep time consistent. In other words, we can't jump back
+         * in time, and we also want to avoid jumping forward in time.
+         *
+         * So given the same offset value, we need the time to be the same
+         * both before and after the freq adjustment.
+         *      now = (offset * adj_1) + xtime_nsec_1
+         *      now = (offset * adj_2) + xtime_nsec_2
+         * So:
+         *      (offset * adj_1) + xtime_nsec_1 =
+         *              (offset * adj_2) + xtime_nsec_2
+         * And we know:
+         *      adj_2 = adj_1 + 1
+         * So:
+         *      (offset * adj_1) + xtime_nsec_1 =
+         *              (offset * (adj_1+1)) + xtime_nsec_2
+         *      (offset * adj_1) + xtime_nsec_1 =
+         *              (offset * adj_1) + offset + xtime_nsec_2
+         * Canceling the sides:
+         *      xtime_nsec_1 = offset + xtime_nsec_2
+         * Which gives us:
+         *      xtime_nsec_2 = xtime_nsec_1 - offset
+         * Which simplfies to:
+         *      xtime_nsec -= offset
+         *
+         * XXX - TODO: Doc ntp_error calculation.
+         */
         timekeeper.mult += adj;
         timekeeper.xtime_interval += interval;
         timekeeper.xtime_nsec -= offset;
diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
index ea534960a04b..12a48a88c0d8 100644
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -50,14 +50,13 @@ static struct page **pcpu_get_pages_and_bitmap(struct pcpu_chunk *chunk,
 
         if (!pages || !bitmap) {
                 if (may_alloc && !pages)
-                        pages = pcpu_mem_alloc(pages_size);
+                        pages = pcpu_mem_zalloc(pages_size);
                 if (may_alloc && !bitmap)
-                        bitmap = pcpu_mem_alloc(bitmap_size);
+                        bitmap = pcpu_mem_zalloc(bitmap_size);
                 if (!pages || !bitmap)
                         return NULL;
         }
 
-        memset(pages, 0, pages_size);
         bitmap_copy(bitmap, chunk->populated, pcpu_unit_pages);
 
         *bitmapp = bitmap;
@@ -143,8 +142,8 @@ static void pcpu_pre_unmap_flush(struct pcpu_chunk *chunk,
                                  int page_start, int page_end)
 {
         flush_cache_vunmap(
-                pcpu_chunk_addr(chunk, pcpu_first_unit_cpu, page_start),
-                pcpu_chunk_addr(chunk, pcpu_last_unit_cpu, page_end));
+                pcpu_chunk_addr(chunk, pcpu_low_unit_cpu, page_start),
+                pcpu_chunk_addr(chunk, pcpu_high_unit_cpu, page_end));
 }
 
 static void __pcpu_unmap_pages(unsigned long addr, int nr_pages)
@@ -206,8 +205,8 @@ static void pcpu_post_unmap_tlb_flush(struct pcpu_chunk *chunk,
                                       int page_start, int page_end)
 {
         flush_tlb_kernel_range(
-                pcpu_chunk_addr(chunk, pcpu_first_unit_cpu, page_start),
-                pcpu_chunk_addr(chunk, pcpu_last_unit_cpu, page_end));
+                pcpu_chunk_addr(chunk, pcpu_low_unit_cpu, page_start),
+                pcpu_chunk_addr(chunk, pcpu_high_unit_cpu, page_end));
 }
 
 static int __pcpu_map_pages(unsigned long addr, struct page **pages,
@@ -284,8 +283,8 @@ static void pcpu_post_map_flush(struct pcpu_chunk *chunk,
                                 int page_start, int page_end)
 {
         flush_cache_vmap(
-                pcpu_chunk_addr(chunk, pcpu_first_unit_cpu, page_start),
-                pcpu_chunk_addr(chunk, pcpu_last_unit_cpu, page_end));
+                pcpu_chunk_addr(chunk, pcpu_low_unit_cpu, page_start),
+                pcpu_chunk_addr(chunk, pcpu_high_unit_cpu, page_end));
 }
 
 /**
diff --git a/mm/percpu.c b/mm/percpu.c
index bf80e55dbed7..3bb810a72006 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -116,9 +116,9 @@ static int pcpu_atom_size __read_mostly;
 static int pcpu_nr_slots __read_mostly;
 static size_t pcpu_chunk_struct_size __read_mostly;
 
-/* cpus with the lowest and highest unit numbers */
-static unsigned int pcpu_first_unit_cpu __read_mostly;
-static unsigned int pcpu_last_unit_cpu __read_mostly;
+/* cpus with the lowest and highest unit addresses */
+static unsigned int pcpu_low_unit_cpu __read_mostly;
+static unsigned int pcpu_high_unit_cpu __read_mostly;
 
 /* the address of the first chunk which starts with the kernel static area */
 void *pcpu_base_addr __read_mostly;
@@ -273,11 +273,11 @@ static void __maybe_unused pcpu_next_pop(struct pcpu_chunk *chunk,
              (rs) = (re) + 1, pcpu_next_pop((chunk), &(rs), &(re), (end)))
 
 /**
- * pcpu_mem_alloc - allocate memory
+ * pcpu_mem_zalloc - allocate memory
  * @size: bytes to allocate
  *
  * Allocate @size bytes.  If @size is smaller than PAGE_SIZE,
- * kzalloc() is used; otherwise, vmalloc() is used.  The returned
+ * kzalloc() is used; otherwise, vzalloc() is used.  The returned
  * memory is always zeroed.
  *
  * CONTEXT:
@@ -286,7 +286,7 @@ static void __maybe_unused pcpu_next_pop(struct pcpu_chunk *chunk,
  * RETURNS:
  * Pointer to the allocated area on success, NULL on failure.
  */
-static void *pcpu_mem_alloc(size_t size)
+static void *pcpu_mem_zalloc(size_t size)
 {
         if (WARN_ON_ONCE(!slab_is_available()))
                 return NULL;
@@ -302,7 +302,7 @@ static void *pcpu_mem_alloc(size_t size)
  * @ptr: memory to free
  * @size: size of the area
  *
- * Free @ptr.  @ptr should have been allocated using pcpu_mem_alloc().
+ * Free @ptr.  @ptr should have been allocated using pcpu_mem_zalloc().
  */
 static void pcpu_mem_free(void *ptr, size_t size)
 {
@@ -384,7 +384,7 @@ static int pcpu_extend_area_map(struct pcpu_chunk *chunk, int new_alloc)
         size_t old_size = 0, new_size = new_alloc * sizeof(new[0]);
         unsigned long flags;
 
-        new = pcpu_mem_alloc(new_size);
+        new = pcpu_mem_zalloc(new_size);
         if (!new)
                 return -ENOMEM;
 
@@ -604,11 +604,12 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void)
 {
         struct pcpu_chunk *chunk;
 
-        chunk = pcpu_mem_alloc(pcpu_chunk_struct_size);
+        chunk = pcpu_mem_zalloc(pcpu_chunk_struct_size);
         if (!chunk)
                 return NULL;
 
-        chunk->map = pcpu_mem_alloc(PCPU_DFL_MAP_ALLOC * sizeof(chunk->map[0]));
+        chunk->map = pcpu_mem_zalloc(PCPU_DFL_MAP_ALLOC *
+                                                sizeof(chunk->map[0]));
         if (!chunk->map) {
                 kfree(chunk);
                 return NULL;
@@ -977,6 +978,17 @@ bool is_kernel_percpu_address(unsigned long addr)
  * address.  The caller is responsible for ensuring @addr stays valid
  * until this function finishes.
  *
+ * percpu allocator has special setup for the first chunk, which currently
+ * supports either embedding in linear address space or vmalloc mapping,
+ * and, from the second one, the backing allocator (currently either vm or
+ * km) provides translation.
+ *
+ * The addr can be tranlated simply without checking if it falls into the
+ * first chunk. But the current code reflects better how percpu allocator
+ * actually works, and the verification can discover both bugs in percpu
+ * allocator itself and per_cpu_ptr_to_phys() callers. So we keep current
+ * code.
+ *
  * RETURNS:
  * The physical address for @addr.
  */
@@ -984,19 +996,19 @@ phys_addr_t per_cpu_ptr_to_phys(void *addr)
 {
         void __percpu *base = __addr_to_pcpu_ptr(pcpu_base_addr);
         bool in_first_chunk = false;
-        unsigned long first_start, first_end;
+        unsigned long first_low, first_high;
         unsigned int cpu;
 
         /*
-         * The following test on first_start/end isn't strictly
+         * The following test on unit_low/high isn't strictly
          * necessary but will speed up lookups of addresses which
          * aren't in the first chunk.
          */
-        first_start = pcpu_chunk_addr(pcpu_first_chunk, pcpu_first_unit_cpu, 0);
-        first_end = pcpu_chunk_addr(pcpu_first_chunk, pcpu_last_unit_cpu,
-                                    pcpu_unit_pages);
-        if ((unsigned long)addr >= first_start &&
-            (unsigned long)addr < first_end) {
+        first_low = pcpu_chunk_addr(pcpu_first_chunk, pcpu_low_unit_cpu, 0);
+        first_high = pcpu_chunk_addr(pcpu_first_chunk, pcpu_high_unit_cpu,
+                                     pcpu_unit_pages);
+        if ((unsigned long)addr >= first_low &&
+            (unsigned long)addr < first_high) {
                 for_each_possible_cpu(cpu) {
                         void *start = per_cpu_ptr(base, cpu);
 
@@ -1233,7 +1245,9 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
 
         for (cpu = 0; cpu < nr_cpu_ids; cpu++)
                 unit_map[cpu] = UINT_MAX;
-        pcpu_first_unit_cpu = NR_CPUS;
+
+        pcpu_low_unit_cpu = NR_CPUS;
+        pcpu_high_unit_cpu = NR_CPUS;
 
         for (group = 0, unit = 0; group < ai->nr_groups; group++, unit += i) {
                 const struct pcpu_group_info *gi = &ai->groups[group];
@@ -1253,9 +1267,13 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
                         unit_map[cpu] = unit + i;
                         unit_off[cpu] = gi->base_offset + i * ai->unit_size;
 
-                        if (pcpu_first_unit_cpu == NR_CPUS)
-                                pcpu_first_unit_cpu = cpu;
-                        pcpu_last_unit_cpu = cpu;
+                        /* determine low/high unit_cpu */
+                        if (pcpu_low_unit_cpu == NR_CPUS ||
+                            unit_off[cpu] < unit_off[pcpu_low_unit_cpu])
+                                pcpu_low_unit_cpu = cpu;
+                        if (pcpu_high_unit_cpu == NR_CPUS ||
+                            unit_off[cpu] > unit_off[pcpu_high_unit_cpu])
+                                pcpu_high_unit_cpu = cpu;
                 }
         }
         pcpu_nr_units = unit;
@@ -1889,7 +1907,7 @@ void __init percpu_init_late(void)
 
                 BUILD_BUG_ON(size > PAGE_SIZE);
 
-                map = pcpu_mem_alloc(size);
+                map = pcpu_mem_zalloc(size);
                 BUG_ON(!map);
 
                 spin_lock_irqsave(&pcpu_lock, flags);
diff --git a/mm/slub.c b/mm/slub.c
index 7d2a996c307e..ed3334d9b6da 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1862,7 +1862,7 @@ static void unfreeze_partials(struct kmem_cache *s)
 {
         struct kmem_cache_node *n = NULL;
         struct kmem_cache_cpu *c = this_cpu_ptr(s->cpu_slab);
-        struct page *page;
+        struct page *page, *discard_page = NULL;
 
         while ((page = c->partial)) {
                 enum slab_modes { M_PARTIAL, M_FREE };
@@ -1904,7 +1904,8 @@ static void unfreeze_partials(struct kmem_cache *s)
                                 if (l == M_PARTIAL)
                                         remove_partial(n, page);
                                 else
-                                        add_partial(n, page, 1);
+                                        add_partial(n, page,
+                                                DEACTIVATE_TO_TAIL);
 
                                 l = m;
                         }
@@ -1915,14 +1916,22 @@ static void unfreeze_partials(struct kmem_cache *s)
                                 "unfreezing slab"));
 
                 if (m == M_FREE) {
-                        stat(s, DEACTIVATE_EMPTY);
-                        discard_slab(s, page);
-                        stat(s, FREE_SLAB);
+                        page->next = discard_page;
+                        discard_page = page;
                 }
         }
 
         if (n)
                 spin_unlock(&n->list_lock);
+
+        while (discard_page) {
+                page = discard_page;
+                discard_page = discard_page->next;
+
+                stat(s, DEACTIVATE_EMPTY);
+                discard_slab(s, page);
+                stat(s, FREE_SLAB);
+        }
 }
 
 /*
@@ -1969,7 +1978,7 @@ int put_cpu_partial(struct kmem_cache *s, struct page *page, int drain)
                 page->pobjects = pobjects;
                 page->next = oldpage;
 
-        } while (this_cpu_cmpxchg(s->cpu_slab->partial, oldpage, page) != oldpage);
+        } while (irqsafe_cpu_cmpxchg(s->cpu_slab->partial, oldpage, page) != oldpage);
         stat(s, CPU_PARTIAL_FREE);
         return pobjects;
 }
@@ -4435,30 +4444,31 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
 
                 for_each_possible_cpu(cpu) {
                         struct kmem_cache_cpu *c = per_cpu_ptr(s->cpu_slab, cpu);
+                        int node = ACCESS_ONCE(c->node);
                         struct page *page;
 
-                        if (!c || c->node < 0)
+                        if (node < 0)
                                 continue;
-
-                        if (c->page) {
-                                        if (flags & SO_TOTAL)
-                                                x = c->page->objects;
+                        page = ACCESS_ONCE(c->page);
+                        if (page) {
+                                if (flags & SO_TOTAL)
+                                        x = page->objects;
                                 else if (flags & SO_OBJECTS)
-                                        x = c->page->inuse;
+                                        x = page->inuse;
                                 else
                                         x = 1;
 
                                 total += x;
-                                nodes[c->node] += x;
+                                nodes[node] += x;
                         }
                         page = c->partial;
 
                         if (page) {
                                 x = page->pobjects;
-                                total += x;
-                                nodes[c->node] += x;
+                                total += x;
+                                nodes[node] += x;
                         }
-                        per_cpu[c->node]++;
+                        per_cpu[node]++;
                 }
         }
 
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index e5f9ece3c9a0..a1daf8227ed1 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -18,6 +18,7 @@
 #include <net/sock.h>
 
 #include "br_private.h"
+#include "br_private_stp.h"
 
 static inline size_t br_nlmsg_size(void)
 {
@@ -188,6 +189,11 @@ static int br_rtm_setlink(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
 
         p->state = new_state;
         br_log_state(p);
+
+        spin_lock_bh(&p->br->lock);
+        br_port_state_selection(p->br);
+        spin_unlock_bh(&p->br->lock);
+
         br_ifinfo_notify(RTM_NEWLINK, p);
 
         return 0;
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index ad0a3f7cf6cc..dd147d78a588 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -399,25 +399,24 @@ void br_port_state_selection(struct net_bridge *br)
         struct net_bridge_port *p;
         unsigned int liveports = 0;
 
-        /* Don't change port states if userspace is handling STP */
-        if (br->stp_enabled == BR_USER_STP)
-                return;
-
         list_for_each_entry(p, &br->port_list, list) {
                 if (p->state == BR_STATE_DISABLED)
                         continue;
 
-                if (p->port_no == br->root_port) {
-                        p->config_pending = 0;
-                        p->topology_change_ack = 0;
-                        br_make_forwarding(p);
-                } else if (br_is_designated_port(p)) {
-                        del_timer(&p->message_age_timer);
-                        br_make_forwarding(p);
-                } else {
-                        p->config_pending = 0;
-                        p->topology_change_ack = 0;
-                        br_make_blocking(p);
+                /* Don't change port states if userspace is handling STP */
+                if (br->stp_enabled != BR_USER_STP) {
+                        if (p->port_no == br->root_port) {
+                                p->config_pending = 0;
+                                p->topology_change_ack = 0;
+                                br_make_forwarding(p);
+                        } else if (br_is_designated_port(p)) {
+                                del_timer(&p->message_age_timer);
+                                br_make_forwarding(p);
+                        } else {
+                                p->config_pending = 0;
+                                p->topology_change_ack = 0;
+                                br_make_blocking(p);
+                        }
                 }
 
                 if (p->state == BR_STATE_FORWARDING)
diff --git a/net/caif/cffrml.c b/net/caif/cffrml.c
index f39921171d0d..d3ca87bf23b7 100644
--- a/net/caif/cffrml.c
+++ b/net/caif/cffrml.c
@@ -136,20 +136,21 @@ static int cffrml_receive(struct cflayer *layr, struct cfpkt *pkt)
 
 static int cffrml_transmit(struct cflayer *layr, struct cfpkt *pkt)
 {
-        int tmp;
         u16 chks;
         u16 len;
+        __le16 data;
+
         struct cffrml *this = container_obj(layr);
         if (this->dofcs) {
                 chks = cfpkt_iterate(pkt, cffrml_checksum, 0xffff);
-                tmp = cpu_to_le16(chks);
-                cfpkt_add_trail(pkt, &tmp, 2);
+                data = cpu_to_le16(chks);
+                cfpkt_add_trail(pkt, &data, 2);
         } else {
                 cfpkt_pad_trail(pkt, 2);
         }
         len = cfpkt_getlen(pkt);
-        tmp = cpu_to_le16(len);
-        cfpkt_add_head(pkt, &tmp, 2);
+        data = cpu_to_le16(len);
+        cfpkt_add_head(pkt, &data, 2);
         cfpkt_info(pkt)->hdr_len += 2;
         if (cfpkt_erroneous(pkt)) {
                 pr_err("Packet is erroneous!\n");
diff --git a/net/core/dev.c b/net/core/dev.c
index 6ba50a1e404c..5a13edfc9f73 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1396,7 +1396,7 @@ rollback:
         for_each_net(net) {
                 for_each_netdev(net, dev) {
                         if (dev == last)
-                                break;
+                                goto outroll;
 
                         if (dev->flags & IFF_UP) {
                                 nb->notifier_call(nb, NETDEV_GOING_DOWN, dev);
@@ -1407,6 +1407,7 @@ rollback:
                 }
         }
 
+outroll:
         raw_notifier_chain_unregister(&netdev_chain, nb);
         goto unlock;
 }
@@ -4282,6 +4283,12 @@ static int dev_seq_open(struct inode *inode, struct file *file)
                             sizeof(struct dev_iter_state));
 }
 
+int dev_seq_open_ops(struct inode *inode, struct file *file,
+                     const struct seq_operations *ops)
+{
+        return seq_open_net(inode, file, ops, sizeof(struct dev_iter_state));
+}
+
 static const struct file_operations dev_seq_fops = {
         .owner   = THIS_MODULE,
         .open    = dev_seq_open,
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index 277faef9148d..febba516db62 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -696,8 +696,7 @@ static const struct seq_operations dev_mc_seq_ops = {
 
 static int dev_mc_seq_open(struct inode *inode, struct file *file)
 {
-        return seq_open_net(inode, file, &dev_mc_seq_ops,
-                            sizeof(struct seq_net_private));
+        return dev_seq_open_ops(inode, file, &dev_mc_seq_ops);
 }
 
 static const struct file_operations dev_mc_seq_fops = {
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 039d51e6c284..5ac07d31fbc9 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2397,7 +2397,10 @@ static struct pneigh_entry *pneigh_get_next(struct seq_file *seq,
         struct net *net = seq_file_net(seq);
         struct neigh_table *tbl = state->tbl;
 
-        pn = pn->next;
+        do {
+                pn = pn->next;
+        } while (pn && !net_eq(pneigh_net(pn), net));
+
         while (!pn) {
                 if (++state->bucket > PNEIGH_HASHMASK)
                         break;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 18a3cebb753d..3c30ee4a5710 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2230,7 +2230,7 @@ static int skb_prepare_for_shift(struct sk_buff *skb)
  * @shiftlen: shift up to this many bytes
  *
  * Attempts to shift up to shiftlen worth of bytes, which may be less than
- * the length of the skb, from tgt to skb. Returns number bytes shifted.
+ * the length of the skb, from skb to tgt. Returns number bytes shifted.
  * It's up to caller to free skb if everything was shifted.
  *
  * If @tgt runs out of frags, the whole operation is aborted.
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 90a919afbed7..3f4e5414c8e5 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -111,6 +111,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         rt = ip_route_newports(fl4, rt, orig_sport, orig_dport,
                                inet->inet_sport, inet->inet_dport, sk);
         if (IS_ERR(rt)) {
+                err = PTR_ERR(rt);
                 rt = NULL;
                 goto failure;
         }
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index a77d16158eb6..94f4ec036669 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -112,7 +112,7 @@ static unsigned long dn_rt_deadline;
 static int dn_dst_gc(struct dst_ops *ops);
 static struct dst_entry *dn_dst_check(struct dst_entry *, __u32);
 static unsigned int dn_dst_default_advmss(const struct dst_entry *dst);
-static unsigned int dn_dst_default_mtu(const struct dst_entry *dst);
+static unsigned int dn_dst_mtu(const struct dst_entry *dst);
 static void dn_dst_destroy(struct dst_entry *);
 static struct dst_entry *dn_dst_negative_advice(struct dst_entry *);
 static void dn_dst_link_failure(struct sk_buff *);
@@ -135,7 +135,7 @@ static struct dst_ops dn_dst_ops = {
         .gc =                   dn_dst_gc,
         .check =                dn_dst_check,
         .default_advmss =       dn_dst_default_advmss,
-        .default_mtu =          dn_dst_default_mtu,
+        .mtu =                  dn_dst_mtu,
         .cow_metrics =          dst_cow_metrics_generic,
         .destroy =              dn_dst_destroy,
         .negative_advice =      dn_dst_negative_advice,
@@ -825,9 +825,11 @@ static unsigned int dn_dst_default_advmss(const struct dst_entry *dst)
         return dn_mss_from_pmtu(dst->dev, dst_mtu(dst));
 }
 
-static unsigned int dn_dst_default_mtu(const struct dst_entry *dst)
+static unsigned int dn_dst_mtu(const struct dst_entry *dst)
 {
-        return dst->dev->mtu;
+        unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
+
+        return mtu ? : dst->dev->mtu;
 }
 
 static struct neighbour *dn_dst_neigh_lookup(const struct dst_entry *dst, const void *daddr)
diff --git a/net/decnet/dn_timer.c b/net/decnet/dn_timer.c
index 67f691bd4acf..d9c150cc59a9 100644
--- a/net/decnet/dn_timer.c
+++ b/net/decnet/dn_timer.c
@@ -36,16 +36,13 @@ static void dn_slow_timer(unsigned long arg);
 
 void dn_start_slow_timer(struct sock *sk)
 {
-        sk->sk_timer.expires    = jiffies + SLOW_INTERVAL;
-        sk->sk_timer.function   = dn_slow_timer;
-        sk->sk_timer.data       = (unsigned long)sk;
-
-        add_timer(&sk->sk_timer);
+        setup_timer(&sk->sk_timer, dn_slow_timer, (unsigned long)sk);
+        sk_reset_timer(sk, &sk->sk_timer, jiffies + SLOW_INTERVAL);
 }
 
 void dn_stop_slow_timer(struct sock *sk)
 {
-        del_timer(&sk->sk_timer);
+        sk_stop_timer(sk, &sk->sk_timer);
 }
 
 static void dn_slow_timer(unsigned long arg)
@@ -53,12 +50,10 @@ static void dn_slow_timer(unsigned long arg)
         struct sock *sk = (struct sock *)arg;
         struct dn_scp *scp = DN_SK(sk);
 
-        sock_hold(sk);
         bh_lock_sock(sk);
 
         if (sock_owned_by_user(sk)) {
-                sk->sk_timer.expires = jiffies + HZ / 10;
-                add_timer(&sk->sk_timer);
+                sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ / 10);
                 goto out;
         }
 
@@ -100,9 +95,7 @@ static void dn_slow_timer(unsigned long arg)
                         scp->keepalive_fxn(sk);
         }
 
-        sk->sk_timer.expires = jiffies + SLOW_INTERVAL;
-
-        add_timer(&sk->sk_timer);
+        sk_reset_timer(sk, &sk->sk_timer, jiffies + SLOW_INTERVAL);
 out:
         bh_unlock_sock(sk);
         sock_put(sk);
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index c6b5092f29a1..65f01dc47565 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1490,7 +1490,9 @@ static int devinet_conf_proc(ctl_table *ctl, int write,
                              void __user *buffer,
                              size_t *lenp, loff_t *ppos)
 {
+        int old_value = *(int *)ctl->data;
         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+        int new_value = *(int *)ctl->data;
 
         if (write) {
                 struct ipv4_devconf *cnf = ctl->extra1;
@@ -1501,6 +1503,9 @@ static int devinet_conf_proc(ctl_table *ctl, int write,
 
                 if (cnf == net->ipv4.devconf_dflt)
                         devinet_copy_dflt_conf(net, i);
+                if (i == IPV4_DEVCONF_ACCEPT_LOCAL - 1)
+                        if ((new_value == 0) && (old_value != 0))
+                                rt_cache_flush(net, 0);
         }
 
         return ret;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index c7472eff2d51..b2ca095cb9da 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1716,7 +1716,8 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
         if (err) {
                 int j;
 
-                pmc->sfcount[sfmode]--;
+                if (!delta)
+                        pmc->sfcount[sfmode]--;
                 for (j=0; j<i; j++)
                         (void) ip_mc_del1_src(pmc, sfmode, &psfsrc[j]);
         } else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 68e8ac514383..ccee270a9b65 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -108,9 +108,6 @@ static int inet_csk_diag_fill(struct sock *sk,
                        icsk->icsk_ca_ops->name);
         }
 
-        if ((ext & (1 << (INET_DIAG_TOS - 1))) && (sk->sk_family != AF_INET6))
-                RTA_PUT_U8(skb, INET_DIAG_TOS, inet->tos);
-
         r->idiag_family = sk->sk_family;
         r->idiag_state = sk->sk_state;
         r->idiag_timer = 0;
@@ -125,16 +122,23 @@ static int inet_csk_diag_fill(struct sock *sk,
         r->id.idiag_src[0] = inet->inet_rcv_saddr;
         r->id.idiag_dst[0] = inet->inet_daddr;
 
+        /* IPv6 dual-stack sockets use inet->tos for IPv4 connections,
+         * hence this needs to be included regardless of socket family.
+         */
+        if (ext & (1 << (INET_DIAG_TOS - 1)))
+                RTA_PUT_U8(skb, INET_DIAG_TOS, inet->tos);
+
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
         if (r->idiag_family == AF_INET6) {
                 const struct ipv6_pinfo *np = inet6_sk(sk);
 
+                if (ext & (1 << (INET_DIAG_TCLASS - 1)))
+                        RTA_PUT_U8(skb, INET_DIAG_TCLASS, np->tclass);
+
                 ipv6_addr_copy((struct in6_addr *)r->id.idiag_src,
                                &np->rcv_saddr);
                 ipv6_addr_copy((struct in6_addr *)r->id.idiag_dst,
                                &np->daddr);
-                if (ext & (1 << (INET_DIAG_TCLASS - 1)))
-                        RTA_PUT_U8(skb, INET_DIAG_TCLASS, np->tclass);
         }
 #endif
 
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 3b34d1c86270..29a07b6c7168 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -84,7 +84,7 @@ int ip_forward(struct sk_buff *skb)
 
         rt = skb_rtable(skb);
 
-        if (opt->is_strictroute && ip_hdr(skb)->daddr != rt->rt_gateway)
+        if (opt->is_strictroute && opt->nexthop != rt->rt_gateway)
                 goto sr_failed;
 
         if (unlikely(skb->len > dst_mtu(&rt->dst) && !skb_is_gso(skb) &&
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 05d20cca9d66..1e60f7679075 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -568,12 +568,13 @@ void ip_forward_options(struct sk_buff *skb)
                      ) {
                         if (srrptr + 3 > srrspace)
                                 break;
-                        if (memcmp(&ip_hdr(skb)->daddr, &optptr[srrptr-1], 4) == 0)
+                        if (memcmp(&opt->nexthop, &optptr[srrptr-1], 4) == 0)
                                 break;
                 }
                 if (srrptr + 3 <= srrspace) {
                         opt->is_changed = 1;
                         ip_rt_get_source(&optptr[srrptr-1], skb, rt);
+                        ip_hdr(skb)->daddr = opt->nexthop;
                         optptr[2] = srrptr+4;
                 } else if (net_ratelimit())
                         printk(KERN_CRIT "ip_forward(): Argh! Destination lost!\n");
@@ -640,7 +641,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
         }
         if (srrptr <= srrspace) {
                 opt->srr_is_hit = 1;
-                iph->daddr = nexthop;
+                opt->nexthop = nexthop;
                 opt->is_changed = 1;
         }
         return 0;
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 9899619ab9b8..4f47e064e262 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -64,7 +64,8 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
         /* Change in oif may mean change in hh_len. */
         hh_len = skb_dst(skb)->dev->hard_header_len;
         if (skb_headroom(skb) < hh_len &&
-            pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC))
+            pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
+                                0, GFP_ATOMIC))
                 return -1;
 
         return 0;
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 1dfc18a03fd4..f19f2182894c 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -325,7 +325,6 @@ config IP_NF_TARGET_TTL
 # raw + specific targets
 config IP_NF_RAW
         tristate  'raw table support (required for NOTRACK/TRACE)'
-        depends on NETFILTER_ADVANCED
         help
           This option adds a `raw' table to iptables. This table is the very
           first in the netfilter framework and hooks in at the PREROUTING
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 0c74da8a0473..ca5e237df029 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -131,6 +131,7 @@ static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
 static int ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly       = 256;
 static int rt_chain_length_max __read_mostly    = 20;
+static int redirect_genid;
 
 /*
  *      Interface to generic destination cache.
@@ -138,7 +139,7 @@ static int rt_chain_length_max __read_mostly	= 20;
 
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int      ipv4_default_advmss(const struct dst_entry *dst);
-static unsigned int      ipv4_default_mtu(const struct dst_entry *dst);
+static unsigned int      ipv4_mtu(const struct dst_entry *dst);
 static void              ipv4_dst_destroy(struct dst_entry *dst);
 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
 static void              ipv4_link_failure(struct sk_buff *skb);
@@ -193,7 +194,7 @@ static struct dst_ops ipv4_dst_ops = {
         .gc =                   rt_garbage_collect,
         .check =                ipv4_dst_check,
         .default_advmss =       ipv4_default_advmss,
-        .default_mtu =          ipv4_default_mtu,
+        .mtu =                  ipv4_mtu,
         .cow_metrics =          ipv4_cow_metrics,
         .destroy =              ipv4_dst_destroy,
         .ifdown =               ipv4_dst_ifdown,
@@ -416,9 +417,13 @@ static int rt_cache_seq_show(struct seq_file *seq, void *v)
         else {
                 struct rtable *r = v;
                 struct neighbour *n;
-                int len;
+                int len, HHUptod;
 
+                rcu_read_lock();
                 n = dst_get_neighbour(&r->dst);
+                HHUptod = (n && (n->nud_state & NUD_CONNECTED)) ? 1 : 0;
+                rcu_read_unlock();
+
                 seq_printf(seq, "%s\t%08X\t%08X\t%8X\t%d\t%u\t%d\t"
                               "%08X\t%d\t%u\t%u\t%02X\t%d\t%1d\t%08X%n",
                         r->dst.dev ? r->dst.dev->name : "*",
@@ -432,7 +437,7 @@ static int rt_cache_seq_show(struct seq_file *seq, void *v)
                               dst_metric(&r->dst, RTAX_RTTVAR)),
                         r->rt_key_tos,
                         -1,
-                        (n && (n->nud_state & NUD_CONNECTED)) ? 1 : 0,
+                        HHUptod,
                         r->rt_spec_dst, &len);
 
                 seq_printf(seq, "%*s\n", 127 - len, "");
@@ -837,6 +842,7 @@ static void rt_cache_invalidate(struct net *net)
 
         get_random_bytes(&shuffle, sizeof(shuffle));
         atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
+        redirect_genid++;
 }
 
 /*
@@ -1391,8 +1397,10 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
 
                                 peer = rt->peer;
                                 if (peer) {
-                                        if (peer->redirect_learned.a4 != new_gw) {
+                                        if (peer->redirect_learned.a4 != new_gw ||
+                                            peer->redirect_genid != redirect_genid) {
                                                 peer->redirect_learned.a4 = new_gw;
+                                                peer->redirect_genid = redirect_genid;
                                                 atomic_inc(&__rt_peer_genid);
                                         }
                                         check_peer_redir(&rt->dst, peer);
@@ -1685,12 +1693,8 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
 }
 
 
-static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
+static struct rtable *ipv4_validate_peer(struct rtable *rt)
 {
-        struct rtable *rt = (struct rtable *) dst;
-
-        if (rt_is_expired(rt))
-                return NULL;
         if (rt->rt_peer_genid != rt_peer_genid()) {
                 struct inet_peer *peer;
 
@@ -1699,17 +1703,29 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
 
                 peer = rt->peer;
                 if (peer) {
-                        check_peer_pmtu(dst, peer);
+                        check_peer_pmtu(&rt->dst, peer);
 
+                        if (peer->redirect_genid != redirect_genid)
+                                peer->redirect_learned.a4 = 0;
                         if (peer->redirect_learned.a4 &&
                             peer->redirect_learned.a4 != rt->rt_gateway) {
-                                if (check_peer_redir(dst, peer))
+                                if (check_peer_redir(&rt->dst, peer))
                                         return NULL;
                         }
                 }
 
                 rt->rt_peer_genid = rt_peer_genid();
         }
+        return rt;
+}
+
+static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
+{
+        struct rtable *rt = (struct rtable *) dst;
+
+        if (rt_is_expired(rt))
+                return NULL;
+        dst = (struct dst_entry *) ipv4_validate_peer(rt);
         return dst;
 }
 
@@ -1814,12 +1830,17 @@ static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
         return advmss;
 }
 
-static unsigned int ipv4_default_mtu(const struct dst_entry *dst)
+static unsigned int ipv4_mtu(const struct dst_entry *dst)
 {
-        unsigned int mtu = dst->dev->mtu;
+        const struct rtable *rt = (const struct rtable *) dst;
+        unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
+
+        if (mtu && rt_is_output_route(rt))
+                return mtu;
+
+        mtu = dst->dev->mtu;
 
         if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
-                const struct rtable *rt = (const struct rtable *) dst;
 
                 if (rt->rt_gateway != rt->rt_dst && mtu > 576)
                         mtu = 576;
@@ -1852,6 +1873,8 @@ static void rt_init_metrics(struct rtable *rt, const struct flowi4 *fl4,
                 dst_init_metrics(&rt->dst, peer->metrics, false);
 
                 check_peer_pmtu(&rt->dst, peer);
+                if (peer->redirect_genid != redirect_genid)
+                        peer->redirect_learned.a4 = 0;
                 if (peer->redirect_learned.a4 &&
                     peer->redirect_learned.a4 != rt->rt_gateway) {
                         rt->rt_gateway = peer->redirect_learned.a4;
@@ -2357,6 +2380,9 @@ int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                     rth->rt_mark == skb->mark &&
                     net_eq(dev_net(rth->dst.dev), net) &&
                     !rt_is_expired(rth)) {
+                        rth = ipv4_validate_peer(rth);
+                        if (!rth)
+                                continue;
                         if (noref) {
                                 dst_use_noref(&rth->dst, jiffies);
                                 skb_dst_set_noref(skb, &rth->dst);
@@ -2732,6 +2758,9 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *flp4)
                             (IPTOS_RT_MASK | RTO_ONLINK)) &&
                     net_eq(dev_net(rth->dst.dev), net) &&
                     !rt_is_expired(rth)) {
+                        rth = ipv4_validate_peer(rth);
+                        if (!rth)
+                                continue;
                         dst_use(&rth->dst, jiffies);
                         RT_CACHE_STAT_INC(out_hit);
                         rcu_read_unlock_bh();
@@ -2755,9 +2784,11 @@ static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 coo
         return NULL;
 }
 
-static unsigned int ipv4_blackhole_default_mtu(const struct dst_entry *dst)
+static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst)
 {
-        return 0;
+        unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
+
+        return mtu ? : dst->dev->mtu;
 }
 
 static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
@@ -2775,7 +2806,7 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
         .protocol               =       cpu_to_be16(ETH_P_IP),
         .destroy                =       ipv4_dst_destroy,
         .check                  =       ipv4_blackhole_dst_check,
-        .default_mtu            =       ipv4_blackhole_default_mtu,
+        .mtu                    =       ipv4_blackhole_mtu,
         .default_advmss         =       ipv4_default_advmss,
         .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
         .cow_metrics            =       ipv4_rt_blackhole_cow_metrics,
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ab0966df1e2a..5a65eeac1d29 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1164,7 +1164,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct inet_sock *inet = inet_sk(sk);
         struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
         struct sk_buff *skb;
-        unsigned int ulen;
+        unsigned int ulen, copied;
         int peeked;
         int err;
         int is_udplite = IS_UDPLITE(sk);
@@ -1186,9 +1186,10 @@ try_again:
                 goto out;
 
         ulen = skb->len - sizeof(struct udphdr);
-        if (len > ulen)
-                len = ulen;
-        else if (len < ulen)
+        copied = len;
+        if (copied > ulen)
+                copied = ulen;
+        else if (copied < ulen)
                 msg->msg_flags |= MSG_TRUNC;
 
         /*
@@ -1197,14 +1198,14 @@ try_again:
          * coverage checksum (UDP-Lite), do it before the copy.
          */
 
-        if (len < ulen || UDP_SKB_CB(skb)->partial_cov) {
+        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
                 if (udp_lib_checksum_complete(skb))
                         goto csum_copy_err;
         }
 
         if (skb_csum_unnecessary(skb))
                 err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
-                                              msg->msg_iov, len);
+                                              msg->msg_iov, copied);
         else {
                 err = skb_copy_and_csum_datagram_iovec(skb,
                                                        sizeof(struct udphdr),
@@ -1233,7 +1234,7 @@ try_again:
         if (inet->cmsg_flags)
                 ip_cmsg_recv(msg, skb);
 
-        err = len;
+        err = copied;
         if (flags & MSG_TRUNC)
                 err = ulen;
 
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index fee46d5a2f12..1567fb120392 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -85,7 +85,7 @@ struct dst_entry *inet6_csk_route_req(struct sock *sk,
  * request_sock (formerly open request) hash tables.
  */
 static u32 inet6_synq_hash(const struct in6_addr *raddr, const __be16 rport,
-                           const u32 rnd, const u16 synq_hsize)
+                           const u32 rnd, const u32 synq_hsize)
 {
         u32 c;
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index c99e3ee9781f..26cb08c84b74 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -503,7 +503,7 @@ done:
                         goto e_inval;
                 if (val > 255 || val < -1)
                         goto e_inval;
-                np->mcast_hops = val;
+                np->mcast_hops = (val == -1 ? IPV6_DEFAULT_MCASTHOPS : val);
                 retv = 0;
                 break;
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 44e5b7f2a6c1..0cb78d7ddaf5 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1571,7 +1571,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
         }
         if (!rt->rt6i_peer)
                 rt6_bind_peer(rt, 1);
-        if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
+        if (!inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
                 goto release;
 
         if (dev->addr_len) {
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 448464844a25..f792b34cbe9c 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -186,7 +186,6 @@ config IP6_NF_MANGLE
 
 config IP6_NF_RAW
         tristate  'raw table support (required for TRACE)'
-        depends on NETFILTER_ADVANCED
         help
           This option adds a `raw' table to ip6tables. This table is the very
           first in the netfilter framework and hooks in at the PREROUTING
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8473016bba4a..3399dd326287 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -77,7 +77,7 @@ static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
                                     const struct in6_addr *dest);
 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int      ip6_default_advmss(const struct dst_entry *dst);
-static unsigned int      ip6_default_mtu(const struct dst_entry *dst);
+static unsigned int      ip6_mtu(const struct dst_entry *dst);
 static struct dst_entry *ip6_negative_advice(struct dst_entry *);
 static void             ip6_dst_destroy(struct dst_entry *);
 static void             ip6_dst_ifdown(struct dst_entry *,
@@ -144,7 +144,7 @@ static struct dst_ops ip6_dst_ops_template = {
         .gc_thresh              =       1024,
         .check                  =       ip6_dst_check,
         .default_advmss         =       ip6_default_advmss,
-        .default_mtu            =       ip6_default_mtu,
+        .mtu                    =       ip6_mtu,
         .cow_metrics            =       ipv6_cow_metrics,
         .destroy                =       ip6_dst_destroy,
         .ifdown                 =       ip6_dst_ifdown,
@@ -155,9 +155,11 @@ static struct dst_ops ip6_dst_ops_template = {
         .neigh_lookup           =       ip6_neigh_lookup,
 };
 
-static unsigned int ip6_blackhole_default_mtu(const struct dst_entry *dst)
+static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst)
 {
-        return 0;
+        unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
+
+        return mtu ? : dst->dev->mtu;
 }
 
 static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
@@ -175,7 +177,7 @@ static struct dst_ops ip6_dst_blackhole_ops = {
         .protocol               =       cpu_to_be16(ETH_P_IPV6),
         .destroy                =       ip6_dst_destroy,
         .check                  =       ip6_dst_check,
-        .default_mtu            =       ip6_blackhole_default_mtu,
+        .mtu                    =       ip6_blackhole_mtu,
         .default_advmss         =       ip6_default_advmss,
         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
         .cow_metrics            =       ip6_rt_blackhole_cow_metrics,
@@ -1041,10 +1043,15 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
         return mtu;
 }
 
-static unsigned int ip6_default_mtu(const struct dst_entry *dst)
+static unsigned int ip6_mtu(const struct dst_entry *dst)
 {
-        unsigned int mtu = IPV6_MIN_MTU;
         struct inet6_dev *idev;
+        unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
+
+        if (mtu)
+                return mtu;
+
+        mtu = IPV6_MIN_MTU;
 
         rcu_read_lock();
         idev = __in6_dev_get(dst->dev);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 36131d122a6f..2dea4bb7b54a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1255,6 +1255,13 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         if (!want_cookie || tmp_opt.tstamp_ok)
                 TCP_ECN_create_request(req, tcp_hdr(skb));
 
+        treq->iif = sk->sk_bound_dev_if;
+
+        /* So that link locals have meaning */
+        if (!sk->sk_bound_dev_if &&
+            ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
+                treq->iif = inet6_iif(skb);
+
         if (!isn) {
                 struct inet_peer *peer = NULL;
 
@@ -1264,12 +1271,6 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                         atomic_inc(&skb->users);
                         treq->pktopts = skb;
                 }
-                treq->iif = sk->sk_bound_dev_if;
-
-                /* So that link locals have meaning */
-                if (!sk->sk_bound_dev_if &&
-                    ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
-                        treq->iif = inet6_iif(skb);
 
                 if (want_cookie) {
                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 846f4757eb8d..8c2541915183 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -340,7 +340,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
         struct sk_buff *skb;
-        unsigned int ulen;
+        unsigned int ulen, copied;
         int peeked;
         int err;
         int is_udplite = IS_UDPLITE(sk);
@@ -363,9 +363,10 @@ try_again:
                 goto out;
 
         ulen = skb->len - sizeof(struct udphdr);
-        if (len > ulen)
-                len = ulen;
-        else if (len < ulen)
+        copied = len;
+        if (copied > ulen)
+                copied = ulen;
+        else if (copied < ulen)
                 msg->msg_flags |= MSG_TRUNC;
 
         is_udp4 = (skb->protocol == htons(ETH_P_IP));
@@ -376,14 +377,14 @@ try_again:
          * coverage checksum (UDP-Lite), do it before the copy.
          */
 
-        if (len < ulen || UDP_SKB_CB(skb)->partial_cov) {
+        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
                 if (udp_lib_checksum_complete(skb))
                         goto csum_copy_err;
         }
 
         if (skb_csum_unnecessary(skb))
                 err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
-                                              msg->msg_iov,len);
+                                              msg->msg_iov, copied       );
         else {
                 err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
                 if (err == -EINVAL)
@@ -432,7 +433,7 @@ try_again:
                         datagram_recv_ctl(sk, msg, skb);
         }
 
-        err = len;
+        err = copied;
         if (flags & MSG_TRUNC)
                 err = ulen;
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index cf0f308abf5e..89ff8c67943e 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1072,7 +1072,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
 
         /* Get routing info from the tunnel socket */
         skb_dst_drop(skb);
-        skb_dst_set(skb, dst_clone(__sk_dst_get(sk)));
+        skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
 
         inet = inet_sk(sk);
         fl = &inet->cork.fl;
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index b3f65520e7a7..b064e4df12c6 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -161,6 +161,12 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                 return -ENOENT;
         }
 
+        /* if we're already stopping ignore any new requests to stop */
+        if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
+                spin_unlock_bh(&sta->lock);
+                return -EALREADY;
+        }
+
         if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
                 /* not even started yet! */
                 ieee80211_assign_tid_tx(sta, tid, NULL);
@@ -169,6 +175,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                 return 0;
         }
 
+        set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
+
         spin_unlock_bh(&sta->lock);
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -176,8 +184,6 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                sta->sta.addr, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
-
         del_timer_sync(&tid_tx->addba_resp_timer);
 
         /*
@@ -187,6 +193,20 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
          */
         clear_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
 
+        /*
+         * There might be a few packets being processed right now (on
+         * another CPU) that have already gotten past the aggregation
+         * check when it was still OPERATIONAL and consequently have
+         * IEEE80211_TX_CTL_AMPDU set. In that case, this code might
+         * call into the driver at the same time or even before the
+         * TX paths calls into it, which could confuse the driver.
+         *
+         * Wait for all currently running TX paths to finish before
+         * telling the driver. New packets will not go through since
+         * the aggregation session is no longer OPERATIONAL.
+         */
+        synchronize_net();
+
         tid_tx->stop_initiator = initiator;
         tid_tx->tx_stop = tx;
 
@@ -757,11 +777,27 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                 goto out;
         }
 
-        del_timer(&tid_tx->addba_resp_timer);
+        del_timer_sync(&tid_tx->addba_resp_timer);
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "switched off addBA timer for tid %d\n", tid);
 #endif
+
+        /*
+         * addba_resp_timer may have fired before we got here, and
+         * caused WANT_STOP to be set. If the stop then was already
+         * processed further, STOPPING might be set.
+         */
+        if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) ||
+            test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG
+                       "got addBA resp for tid %d but we already gave up\n",
+                       tid);
+#endif
+                goto out;
+        }
+
         /*
          * IEEE 802.11-2007 7.3.1.14:
          * In an ADDBA Response frame, when the Status Code field
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index c5f341798c16..3110cbdc501b 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -274,9 +274,9 @@ static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
 
                 PRINT_HT_CAP((htc->cap & BIT(10)), "HT Delayed Block Ack");
 
-                PRINT_HT_CAP((htc->cap & BIT(11)), "Max AMSDU length: "
-                             "3839 bytes");
                 PRINT_HT_CAP(!(htc->cap & BIT(11)), "Max AMSDU length: "
+                             "3839 bytes");
+                PRINT_HT_CAP((htc->cap & BIT(11)), "Max AMSDU length: "
                              "7935 bytes");
 
                 /*
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 80de436eae20..16518f386117 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -260,7 +260,7 @@ static void ieee80211_add_tx_radiotap_header(struct ieee80211_supported_band
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_radiotap_header *rthdr;
         unsigned char *pos;
-        __le16 txflags;
+        u16 txflags;
 
         rthdr = (struct ieee80211_radiotap_header *) skb_push(skb, rtap_len);
 
@@ -290,13 +290,13 @@ static void ieee80211_add_tx_radiotap_header(struct ieee80211_supported_band
         txflags = 0;
         if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
             !is_multicast_ether_addr(hdr->addr1))
-                txflags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
+                txflags |= IEEE80211_RADIOTAP_F_TX_FAIL;
 
         if ((info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
             (info->status.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
-                txflags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
+                txflags |= IEEE80211_RADIOTAP_F_TX_CTS;
         else if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
-                txflags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
+                txflags |= IEEE80211_RADIOTAP_F_TX_RTS;
 
         put_unaligned_le16(txflags, pos);
         pos += 2;
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 8260b13d93c9..d5597b759ba3 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -201,7 +201,6 @@ config NF_CONNTRACK_BROADCAST
 
 config NF_CONNTRACK_NETBIOS_NS
         tristate "NetBIOS name service protocol support"
-        depends on NETFILTER_ADVANCED
         select NF_CONNTRACK_BROADCAST
         help
           NetBIOS name service requests are sent as broadcast messages from an
@@ -542,7 +541,6 @@ config NETFILTER_XT_TARGET_NOTRACK
         tristate  '"NOTRACK" target support'
         depends on IP_NF_RAW || IP6_NF_RAW
         depends on NF_CONNTRACK
-        depends on NETFILTER_ADVANCED
         help
           The NOTRACK target allows a select rule to specify
           which packets *not* to enter the conntrack/NAT
diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c
index 6ee10f5d59bd..37d667e3f6f8 100644
--- a/net/netfilter/ipset/ip_set_hash_ipport.c
+++ b/net/netfilter/ipset/ip_set_hash_ipport.c
@@ -158,7 +158,7 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[],
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
         struct hash_ipport4_elem data = { };
-        u32 ip, ip_to, p = 0, port, port_to;
+        u32 ip, ip_to = 0, p = 0, port, port_to;
         u32 timeout = h->timeout;
         bool with_ports = false;
         int ret;
diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c
index fb90e344e907..e69e2718fbe1 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportip.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportip.c
@@ -162,7 +162,7 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[],
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
         struct hash_ipportip4_elem data = { };
-        u32 ip, ip_to, p = 0, port, port_to;
+        u32 ip, ip_to = 0, p = 0, port, port_to;
         u32 timeout = h->timeout;
         bool with_ports = false;
         int ret;
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index deb3e3dfa5fc..64199b4e93c9 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -184,7 +184,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
         const struct ip_set_hash *h = set->data;
         ipset_adtfn adtfn = set->variant->adt[adt];
         struct hash_ipportnet4_elem data = { .cidr = HOST_MASK };
-        u32 ip, ip_to, p = 0, port, port_to;
+        u32 ip, ip_to = 0, p = 0, port, port_to;
         u32 ip2_from = 0, ip2_to, ip2_last, ip2;
         u32 timeout = h->timeout;
         bool with_ports = false;
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
index 6b368be937c6..b62c4148b921 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -27,22 +27,17 @@
 
 static DEFINE_MUTEX(nf_ct_ecache_mutex);
 
-struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb __read_mostly;
-EXPORT_SYMBOL_GPL(nf_conntrack_event_cb);
-
-struct nf_exp_event_notifier __rcu *nf_expect_event_cb __read_mostly;
-EXPORT_SYMBOL_GPL(nf_expect_event_cb);
-
 /* deliver cached events and clear cache entry - must be called with locally
  * disabled softirqs */
 void nf_ct_deliver_cached_events(struct nf_conn *ct)
 {
+        struct net *net = nf_ct_net(ct);
         unsigned long events;
         struct nf_ct_event_notifier *notify;
         struct nf_conntrack_ecache *e;
 
         rcu_read_lock();
-        notify = rcu_dereference(nf_conntrack_event_cb);
+        notify = rcu_dereference(net->ct.nf_conntrack_event_cb);
         if (notify == NULL)
                 goto out_unlock;
 
@@ -83,19 +78,20 @@ out_unlock:
 }
 EXPORT_SYMBOL_GPL(nf_ct_deliver_cached_events);
 
-int nf_conntrack_register_notifier(struct nf_ct_event_notifier *new)
+int nf_conntrack_register_notifier(struct net *net,
+                                   struct nf_ct_event_notifier *new)
 {
         int ret = 0;
         struct nf_ct_event_notifier *notify;
 
         mutex_lock(&nf_ct_ecache_mutex);
-        notify = rcu_dereference_protected(nf_conntrack_event_cb,
+        notify = rcu_dereference_protected(net->ct.nf_conntrack_event_cb,
                                            lockdep_is_held(&nf_ct_ecache_mutex));
         if (notify != NULL) {
                 ret = -EBUSY;
                 goto out_unlock;
         }
-        RCU_INIT_POINTER(nf_conntrack_event_cb, new);
+        RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, new);
         mutex_unlock(&nf_ct_ecache_mutex);
         return ret;
 
@@ -105,32 +101,34 @@ out_unlock:
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_register_notifier);
 
-void nf_conntrack_unregister_notifier(struct nf_ct_event_notifier *new)
+void nf_conntrack_unregister_notifier(struct net *net,
+                                      struct nf_ct_event_notifier *new)
 {
         struct nf_ct_event_notifier *notify;
 
         mutex_lock(&nf_ct_ecache_mutex);
-        notify = rcu_dereference_protected(nf_conntrack_event_cb,
+        notify = rcu_dereference_protected(net->ct.nf_conntrack_event_cb,
                                            lockdep_is_held(&nf_ct_ecache_mutex));
         BUG_ON(notify != new);
-        RCU_INIT_POINTER(nf_conntrack_event_cb, NULL);
+        RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, NULL);
         mutex_unlock(&nf_ct_ecache_mutex);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
 
-int nf_ct_expect_register_notifier(struct nf_exp_event_notifier *new)
+int nf_ct_expect_register_notifier(struct net *net,
+                                   struct nf_exp_event_notifier *new)
 {
         int ret = 0;
         struct nf_exp_event_notifier *notify;
 
         mutex_lock(&nf_ct_ecache_mutex);
-        notify = rcu_dereference_protected(nf_expect_event_cb,
+        notify = rcu_dereference_protected(net->ct.nf_expect_event_cb,
                                            lockdep_is_held(&nf_ct_ecache_mutex));
         if (notify != NULL) {
                 ret = -EBUSY;
                 goto out_unlock;
         }
-        RCU_INIT_POINTER(nf_expect_event_cb, new);
+        RCU_INIT_POINTER(net->ct.nf_expect_event_cb, new);
         mutex_unlock(&nf_ct_ecache_mutex);
         return ret;
 
@@ -140,15 +138,16 @@ out_unlock:
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_register_notifier);
 
-void nf_ct_expect_unregister_notifier(struct nf_exp_event_notifier *new)
+void nf_ct_expect_unregister_notifier(struct net *net,
+                                      struct nf_exp_event_notifier *new)
 {
         struct nf_exp_event_notifier *notify;
 
         mutex_lock(&nf_ct_ecache_mutex);
-        notify = rcu_dereference_protected(nf_expect_event_cb,
+        notify = rcu_dereference_protected(net->ct.nf_expect_event_cb,
                                            lockdep_is_held(&nf_ct_ecache_mutex));
         BUG_ON(notify != new);
-        RCU_INIT_POINTER(nf_expect_event_cb, NULL);
+        RCU_INIT_POINTER(net->ct.nf_expect_event_cb, NULL);
         mutex_unlock(&nf_ct_ecache_mutex);
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index e58aa9b1fe8a..ef21b221f036 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -4,7 +4,7 @@
  * (C) 2001 by Jay Schulist <jschlst@samba.org>
  * (C) 2002-2006 by Harald Welte <laforge@gnumonks.org>
  * (C) 2003 by Patrick Mchardy <kaber@trash.net>
- * (C) 2005-2008 by Pablo Neira Ayuso <pablo@netfilter.org>
+ * (C) 2005-2011 by Pablo Neira Ayuso <pablo@netfilter.org>
  *
  * Initial connection tracking via netlink development funded and
  * generally made possible by Network Robots, Inc. (www.networkrobots.com)
@@ -2163,6 +2163,54 @@ MODULE_ALIAS("ip_conntrack_netlink");
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
 
+static int __net_init ctnetlink_net_init(struct net *net)
+{
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
+        int ret;
+
+        ret = nf_conntrack_register_notifier(net, &ctnl_notifier);
+        if (ret < 0) {
+                pr_err("ctnetlink_init: cannot register notifier.\n");
+                goto err_out;
+        }
+
+        ret = nf_ct_expect_register_notifier(net, &ctnl_notifier_exp);
+        if (ret < 0) {
+                pr_err("ctnetlink_init: cannot expect register notifier.\n");
+                goto err_unreg_notifier;
+        }
+#endif
+        return 0;
+
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
+err_unreg_notifier:
+        nf_conntrack_unregister_notifier(net, &ctnl_notifier);
+err_out:
+        return ret;
+#endif
+}
+
+static void ctnetlink_net_exit(struct net *net)
+{
+#ifdef CONFIG_NF_CONNTRACK_EVENTS
+        nf_ct_expect_unregister_notifier(net, &ctnl_notifier_exp);
+        nf_conntrack_unregister_notifier(net, &ctnl_notifier);
+#endif
+}
+
+static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list)
+{
+        struct net *net;
+
+        list_for_each_entry(net, net_exit_list, exit_list)
+                ctnetlink_net_exit(net);
+}
+
+static struct pernet_operations ctnetlink_net_ops = {
+        .init           = ctnetlink_net_init,
+        .exit_batch     = ctnetlink_net_exit_batch,
+};
+
 static int __init ctnetlink_init(void)
 {
         int ret;
@@ -2180,28 +2228,15 @@ static int __init ctnetlink_init(void)
                 goto err_unreg_subsys;
         }
 
-#ifdef CONFIG_NF_CONNTRACK_EVENTS
-        ret = nf_conntrack_register_notifier(&ctnl_notifier);
-        if (ret < 0) {
-                pr_err("ctnetlink_init: cannot register notifier.\n");
+        if (register_pernet_subsys(&ctnetlink_net_ops)) {
+                pr_err("ctnetlink_init: cannot register pernet operations\n");
                 goto err_unreg_exp_subsys;
         }
 
-        ret = nf_ct_expect_register_notifier(&ctnl_notifier_exp);
-        if (ret < 0) {
-                pr_err("ctnetlink_init: cannot expect register notifier.\n");
-                goto err_unreg_notifier;
-        }
-#endif
-
         return 0;
 
-#ifdef CONFIG_NF_CONNTRACK_EVENTS
-err_unreg_notifier:
-        nf_conntrack_unregister_notifier(&ctnl_notifier);
 err_unreg_exp_subsys:
         nfnetlink_subsys_unregister(&ctnl_exp_subsys);
-#endif
 err_unreg_subsys:
         nfnetlink_subsys_unregister(&ctnl_subsys);
 err_out:
@@ -2213,11 +2248,7 @@ static void __exit ctnetlink_exit(void)
         pr_info("ctnetlink: unregistering from nfnetlink.\n");
 
         nf_ct_remove_userspace_expectations();
-#ifdef CONFIG_NF_CONNTRACK_EVENTS
-        nf_ct_expect_unregister_notifier(&ctnl_notifier_exp);
-        nf_conntrack_unregister_notifier(&ctnl_notifier);
-#endif
-
+        unregister_pernet_subsys(&ctnetlink_net_ops);
         nfnetlink_subsys_unregister(&ctnl_exp_subsys);
         nfnetlink_subsys_unregister(&ctnl_subsys);
 }
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 9c24de10a657..824f184f7a9b 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -111,8 +111,6 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
         struct netlbl_domaddr_map *addrmap = NULL;
         struct netlbl_domaddr4_map *map4 = NULL;
         struct netlbl_domaddr6_map *map6 = NULL;
-        const struct in_addr *addr4, *mask4;
-        const struct in6_addr *addr6, *mask6;
 
         entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
         if (entry == NULL)
@@ -133,9 +131,9 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                 INIT_LIST_HEAD(&addrmap->list6);
 
                 switch (family) {
-                case AF_INET:
-                        addr4 = addr;
-                        mask4 = mask;
+                case AF_INET: {
+                        const struct in_addr *addr4 = addr;
+                        const struct in_addr *mask4 = mask;
                         map4 = kzalloc(sizeof(*map4), GFP_ATOMIC);
                         if (map4 == NULL)
                                 goto cfg_unlbl_map_add_failure;
@@ -148,9 +146,11 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         if (ret_val != 0)
                                 goto cfg_unlbl_map_add_failure;
                         break;
-                case AF_INET6:
-                        addr6 = addr;
-                        mask6 = mask;
+                        }
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+                case AF_INET6: {
+                        const struct in6_addr *addr6 = addr;
+                        const struct in6_addr *mask6 = mask;
                         map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
                         if (map6 == NULL)
                                 goto cfg_unlbl_map_add_failure;
@@ -162,11 +162,13 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         map6->list.addr.s6_addr32[3] &= mask6->s6_addr32[3];
                         ipv6_addr_copy(&map6->list.mask, mask6);
                         map6->list.valid = 1;
-                        ret_val = netlbl_af4list_add(&map4->list,
-                                                     &addrmap->list4);
+                        ret_val = netlbl_af6list_add(&map6->list,
+                                                     &addrmap->list6);
                         if (ret_val != 0)
                                 goto cfg_unlbl_map_add_failure;
                         break;
+                        }
+#endif /* IPv6 */
                 default:
                         goto cfg_unlbl_map_add_failure;
                         break;
@@ -225,9 +227,11 @@ int netlbl_cfg_unlbl_static_add(struct net *net,
         case AF_INET:
                 addr_len = sizeof(struct in_addr);
                 break;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         case AF_INET6:
                 addr_len = sizeof(struct in6_addr);
                 break;
+#endif /* IPv6 */
         default:
                 return -EPFNOSUPPORT;
         }
@@ -266,9 +270,11 @@ int netlbl_cfg_unlbl_static_del(struct net *net,
         case AF_INET:
                 addr_len = sizeof(struct in_addr);
                 break;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         case AF_INET6:
                 addr_len = sizeof(struct in6_addr);
                 break;
+#endif /* IPv6 */
         default:
                 return -EPFNOSUPPORT;
         }
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 6649463da1b6..d617161f8dd3 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -209,8 +209,8 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt)
                                  ctl->Plog, ctl->Scell_log,
                                  nla_data(tb[TCA_RED_STAB]));
 
-        if (skb_queue_empty(&sch->q))
-                red_end_of_idle_period(&q->parms);
+        if (!q->qdisc->q.qlen)
+                red_start_of_idle_period(&q->parms);
 
         sch_tree_unlock(sch);
         return 0;
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index a3b7120fcc74..4f4c52c0eeb3 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -225,11 +225,11 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt)
 
 
 static int
-__teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *dev)
+__teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res,
+               struct net_device *dev, struct netdev_queue *txq,
+               struct neighbour *mn)
 {
-        struct netdev_queue *dev_queue = netdev_get_tx_queue(dev, 0);
-        struct teql_sched_data *q = qdisc_priv(dev_queue->qdisc);
-        struct neighbour *mn = dst_get_neighbour(skb_dst(skb));
+        struct teql_sched_data *q = qdisc_priv(txq->qdisc);
         struct neighbour *n = q->ncache;
 
         if (mn->tbl == NULL)
@@ -262,17 +262,26 @@ __teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *
 }
 
 static inline int teql_resolve(struct sk_buff *skb,
-                               struct sk_buff *skb_res, struct net_device *dev)
+                               struct sk_buff *skb_res,
+                               struct net_device *dev,
+                               struct netdev_queue *txq)
 {
-        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
+        struct dst_entry *dst = skb_dst(skb);
+        struct neighbour *mn;
+        int res;
+
         if (txq->qdisc == &noop_qdisc)
                 return -ENODEV;
 
-        if (dev->header_ops == NULL ||
-            skb_dst(skb) == NULL ||
-            dst_get_neighbour(skb_dst(skb)) == NULL)
+        if (!dev->header_ops || !dst)
                 return 0;
-        return __teql_resolve(skb, skb_res, dev);
+
+        rcu_read_lock();
+        mn = dst_get_neighbour(dst);
+        res = mn ? __teql_resolve(skb, skb_res, dev, txq, mn) : 0;
+        rcu_read_unlock();
+
+        return res;
 }
 
 static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
@@ -307,7 +316,7 @@ restart:
                         continue;
                 }
 
-                switch (teql_resolve(skb, skb_res, slave)) {
+                switch (teql_resolve(skb, skb_res, slave, slave_txq)) {
                 case 0:
                         if (__netif_tx_trylock(slave_txq)) {
                                 unsigned int length = qdisc_pkt_len(skb);
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 865e68fef21c..bf812048cf6f 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -82,7 +82,7 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
         struct sctp_auth_bytes *key;
 
         /* Verify that we are not going to overflow INT_MAX */
-        if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes))
+        if (key_len > (INT_MAX - sizeof(struct sctp_auth_bytes)))
                 return NULL;
 
         /* Allocate the shared key */
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 2d78d95955ab..55472c48825e 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -496,7 +496,7 @@ static int xs_nospace(struct rpc_task *task)
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = req->rq_xprt;
         struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
-        int ret = 0;
+        int ret = -EAGAIN;
 
         dprintk("RPC: %5u xmit incomplete (%u left of %u)\n",
                         task->tk_pid, req->rq_slen - req->rq_bytes_sent,
@@ -508,7 +508,6 @@ static int xs_nospace(struct rpc_task *task)
         /* Don't race with disconnect */
         if (xprt_connected(xprt)) {
                 if (test_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags)) {
-                        ret = -EAGAIN;
                         /*
                          * Notify TCP that we're limited by the application
                          * window size
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 466fbcc5cf77..b595a3d8679f 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1957,6 +1957,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         if ((UNIXCB(skb).pid  != siocb->scm->pid) ||
                             (UNIXCB(skb).cred != siocb->scm->cred)) {
                                 skb_queue_head(&sk->sk_receive_queue, skb);
+                                sk->sk_data_ready(sk, skb->len);
                                 break;
                         }
                 } else {
@@ -1974,6 +1975,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 chunk = min_t(unsigned int, skb->len, size);
                 if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
                         skb_queue_head(&sk->sk_receive_queue, skb);
+                        sk->sk_data_ready(sk, skb->len);
                         if (copied == 0)
                                 copied = -EFAULT;
                         break;
@@ -1991,6 +1993,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         /* put the skb back if we didn't use it up.. */
                         if (skb->len) {
                                 skb_queue_head(&sk->sk_receive_queue, skb);
+                                sk->sk_data_ready(sk, skb->len);
                                 break;
                         }
 
@@ -2006,6 +2009,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                         /* put message back and return */
                         skb_queue_head(&sk->sk_receive_queue, skb);
+                        sk->sk_data_ready(sk, skb->len);
                         break;
                 }
         } while (size);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index b3a476fe8272..ffafda5022c2 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -89,8 +89,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 
-        [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
-        [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
+        [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
+        [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 
         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index e71f5a66574e..77e926738014 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2037,6 +2037,10 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
         }
 
         request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+        if (!request_wiphy) {
+                reg_set_request_processed();
+                return -ENODEV;
+        }
 
         if (!last_request->intersect) {
                 int r;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 552df27dcf53..2118d6446630 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2382,9 +2382,11 @@ static unsigned int xfrm_default_advmss(const struct dst_entry *dst)
         return dst_metric_advmss(dst->path);
 }
 
-static unsigned int xfrm_default_mtu(const struct dst_entry *dst)
+static unsigned int xfrm_mtu(const struct dst_entry *dst)
 {
-        return dst_mtu(dst->path);
+        unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
+
+        return mtu ? : dst_mtu(dst->path);
 }
 
 static struct neighbour *xfrm_neigh_lookup(const struct dst_entry *dst, const void *daddr)
@@ -2411,8 +2413,8 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
                         dst_ops->check = xfrm_dst_check;
                 if (likely(dst_ops->default_advmss == NULL))
                         dst_ops->default_advmss = xfrm_default_advmss;
-                if (likely(dst_ops->default_mtu == NULL))
-                        dst_ops->default_mtu = xfrm_default_mtu;
+                if (likely(dst_ops->mtu == NULL))
+                        dst_ops->mtu = xfrm_mtu;
                 if (likely(dst_ops->negative_advice == NULL))
                         dst_ops->negative_advice = xfrm_negative_advice;
                 if (likely(dst_ops->link_failure == NULL))
diff --git a/sound/pci/cs5535audio/cs5535audio_pcm.c b/sound/pci/cs5535audio/cs5535audio_pcm.c
index e083122ca55a..dbf94b189e75 100644
--- a/sound/pci/cs5535audio/cs5535audio_pcm.c
+++ b/sound/pci/cs5535audio/cs5535audio_pcm.c
@@ -148,7 +148,7 @@ static int cs5535audio_build_dma_packets(struct cs5535audio *cs5535au,
                 struct cs5535audio_dma_desc *desc =
                         &((struct cs5535audio_dma_desc *) dma->desc_buf.area)[i];
                 desc->addr = cpu_to_le32(addr);
-                desc->size = cpu_to_le32(period_bytes);
+                desc->size = cpu_to_le16(period_bytes);
                 desc->ctlreserved = cpu_to_le16(PRD_EOP);
                 desc_addr += sizeof(struct cs5535audio_dma_desc);
                 addr += period_bytes;
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index e44b107fdc75..4562e9de6a1a 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -4046,9 +4046,9 @@ int snd_hda_check_board_codec_sid_config(struct hda_codec *codec,
 
         /* Search for codec ID */
         for (q = tbl; q->subvendor; q++) {
-                unsigned long vendorid = (q->subdevice) | (q->subvendor << 16);
-
-                if (vendorid == codec->subsystem_id)
+                unsigned int mask = 0xffff0000 | q->subdevice_mask;
+                unsigned int id = (q->subdevice | (q->subvendor << 16)) & mask;
+                if ((codec->subsystem_id & mask) == id)
                         break;
         }
 
diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index 7ae7578bdcc0..c1da422e085a 100644
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -347,18 +347,28 @@ int snd_hdmi_get_eld(struct hdmi_eld *eld,
 
         for (i = 0; i < size; i++) {
                 unsigned int val = hdmi_get_eld_data(codec, nid, i);
+                /*
+                 * Graphics driver might be writing to ELD buffer right now.
+                 * Just abort. The caller will repoll after a while.
+                 */
                 if (!(val & AC_ELDD_ELD_VALID)) {
-                        if (!i) {
-                                snd_printd(KERN_INFO
-                                           "HDMI: invalid ELD data\n");
-                                ret = -EINVAL;
-                                goto error;
-                        }
                         snd_printd(KERN_INFO
                                   "HDMI: invalid ELD data byte %d\n", i);
-                        val = 0;
-                } else
-                        val &= AC_ELDD_ELD_DATA;
+                        ret = -EINVAL;
+                        goto error;
+                }
+                val &= AC_ELDD_ELD_DATA;
+                /*
+                 * The first byte cannot be zero. This can happen on some DVI
+                 * connections. Some Intel chips may also need some 250ms delay
+                 * to return non-zero ELD data, even when the graphics driver
+                 * correctly writes ELD content before setting ELD_valid bit.
+                 */
+                if (!val && !i) {
+                        snd_printdd(KERN_INFO "HDMI: 0 ELD data\n");
+                        ret = -EINVAL;
+                        goto error;
+                }
                 buf[i] = val;
         }
 
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 096507d2ca9a..7d98240def0b 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2508,7 +2508,6 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
         SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS M2V", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB),
-        SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1297, 0x3166, "Shuttle", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB),
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 2fbab8e29576..70a7abda7e22 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -58,6 +58,8 @@ struct cs_spec {
         unsigned int gpio_mask;
         unsigned int gpio_dir;
         unsigned int gpio_data;
+        unsigned int gpio_eapd_hp; /* EAPD GPIO bit for headphones */
+        unsigned int gpio_eapd_speaker; /* EAPD GPIO bit for speakers */
 
         struct hda_pcm pcm_rec[2];      /* PCM information */
 
@@ -76,6 +78,7 @@ enum {
         CS420X_MBP53,
         CS420X_MBP55,
         CS420X_IMAC27,
+        CS420X_APPLE,
         CS420X_AUTO,
         CS420X_MODELS
 };
@@ -928,10 +931,9 @@ static void cs_automute(struct hda_codec *codec)
                                         spdif_present ? 0 : PIN_OUT);
                 }
         }
-        if (spec->board_config == CS420X_MBP53 ||
-            spec->board_config == CS420X_MBP55 ||
-            spec->board_config == CS420X_IMAC27) {
-                unsigned int gpio = hp_present ? 0x02 : 0x08;
+        if (spec->gpio_eapd_hp) {
+                unsigned int gpio = hp_present ?
+                        spec->gpio_eapd_hp : spec->gpio_eapd_speaker;
                 snd_hda_codec_write(codec, 0x01, 0,
                                     AC_VERB_SET_GPIO_DATA, gpio);
         }
@@ -1276,6 +1278,7 @@ static const char * const cs420x_models[CS420X_MODELS] = {
         [CS420X_MBP53] = "mbp53",
         [CS420X_MBP55] = "mbp55",
         [CS420X_IMAC27] = "imac27",
+        [CS420X_APPLE] = "apple",
         [CS420X_AUTO] = "auto",
 };
 
@@ -1285,7 +1288,13 @@ static const struct snd_pci_quirk cs420x_cfg_tbl[] = {
         SND_PCI_QUIRK(0x10de, 0x0d94, "MacBookAir 3,1(2)", CS420X_MBP55),
         SND_PCI_QUIRK(0x10de, 0xcb79, "MacBookPro 5,5", CS420X_MBP55),
         SND_PCI_QUIRK(0x10de, 0xcb89, "MacBookPro 7,1", CS420X_MBP55),
-        SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27),
+        /* this conflicts with too many other models */
+        /*SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27),*/
+        {} /* terminator */
+};
+
+static const struct snd_pci_quirk cs420x_codec_cfg_tbl[] = {
+        SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
         {} /* terminator */
 };
 
@@ -1367,6 +1376,10 @@ static int patch_cs420x(struct hda_codec *codec)
         spec->board_config =
                 snd_hda_check_board_config(codec, CS420X_MODELS,
                                            cs420x_models, cs420x_cfg_tbl);
+        if (spec->board_config < 0)
+                spec->board_config =
+                        snd_hda_check_board_codec_sid_config(codec,
+                                CS420X_MODELS, NULL, cs420x_codec_cfg_tbl);
         if (spec->board_config >= 0)
                 fix_pincfg(codec, spec->board_config, cs_pincfgs);
 
@@ -1374,10 +1387,11 @@ static int patch_cs420x(struct hda_codec *codec)
         case CS420X_IMAC27:
         case CS420X_MBP53:
         case CS420X_MBP55:
-                /* GPIO1 = headphones */
-                /* GPIO3 = speakers */
-                spec->gpio_mask = 0x0a;
-                spec->gpio_dir = 0x0a;
+        case CS420X_APPLE:
+                spec->gpio_eapd_hp = 2; /* GPIO1 = headphones */
+                spec->gpio_eapd_speaker = 8; /* GPIO3 = speakers */
+                spec->gpio_mask = spec->gpio_dir =
+                        spec->gpio_eapd_hp | spec->gpio_eapd_speaker;
                 break;
         }
 
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 9850c5b481ea..c505fd5d338c 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -69,6 +69,7 @@ struct hdmi_spec_per_pin {
         struct hda_codec *codec;
         struct hdmi_eld sink_eld;
         struct delayed_work work;
+        int repoll_count;
 };
 
 struct hdmi_spec {
@@ -748,7 +749,7 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec, int pin_idx,
  * Unsolicited events
  */
 
-static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, bool retry);
+static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll);
 
 static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
 {
@@ -766,7 +767,7 @@ static void hdmi_intrinsic_event(struct hda_codec *codec, unsigned int res)
         if (pin_idx < 0)
                 return;
 
-        hdmi_present_sense(&spec->pins[pin_idx], true);
+        hdmi_present_sense(&spec->pins[pin_idx], 1);
 }
 
 static void hdmi_non_intrinsic_event(struct hda_codec *codec, unsigned int res)
@@ -960,7 +961,7 @@ static int hdmi_read_pin_conn(struct hda_codec *codec, int pin_idx)
         return 0;
 }
 
-static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, bool retry)
+static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
 {
         struct hda_codec *codec = per_pin->codec;
         struct hdmi_eld *eld = &per_pin->sink_eld;
@@ -989,7 +990,7 @@ static void hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, bool retry)
         if (eld_valid) {
                 if (!snd_hdmi_get_eld(eld, codec, pin_nid))
                         snd_hdmi_show_eld(eld);
-                else if (retry) {
+                else if (repoll) {
                         queue_delayed_work(codec->bus->workq,
                                            &per_pin->work,
                                            msecs_to_jiffies(300));
@@ -1004,7 +1005,10 @@ static void hdmi_repoll_eld(struct work_struct *work)
         struct hdmi_spec_per_pin *per_pin =
         container_of(to_delayed_work(work), struct hdmi_spec_per_pin, work);
 
-        hdmi_present_sense(per_pin, false);
+        if (per_pin->repoll_count++ > 6)
+                per_pin->repoll_count = 0;
+
+        hdmi_present_sense(per_pin, per_pin->repoll_count);
 }
 
 static int hdmi_add_pin(struct hda_codec *codec, hda_nid_t pin_nid)
@@ -1235,7 +1239,7 @@ static int generic_hdmi_build_jack(struct hda_codec *codec, int pin_idx)
         if (err < 0)
                 return err;
 
-        hdmi_present_sense(per_pin, false);
+        hdmi_present_sense(per_pin, 0);
         return 0;
 }
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 336d14eb72af..cbde019d3d52 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -277,6 +277,12 @@ static bool alc_dyn_adc_pcm_resetup(struct hda_codec *codec, int cur)
         return false;
 }
 
+static inline hda_nid_t get_capsrc(struct alc_spec *spec, int idx)
+{
+        return spec->capsrc_nids ?
+                spec->capsrc_nids[idx] : spec->adc_nids[idx];
+}
+
 /* select the given imux item; either unmute exclusively or select the route */
 static int alc_mux_select(struct hda_codec *codec, unsigned int adc_idx,
                           unsigned int idx, bool force)
@@ -303,8 +309,7 @@ static int alc_mux_select(struct hda_codec *codec, unsigned int adc_idx,
                 adc_idx = spec->dyn_adc_idx[idx];
         }
 
-        nid = spec->capsrc_nids ?
-                spec->capsrc_nids[adc_idx] : spec->adc_nids[adc_idx];
+        nid = get_capsrc(spec, adc_idx);
 
         /* no selection? */
         num_conns = snd_hda_get_conn_list(codec, nid, NULL);
@@ -1054,8 +1059,19 @@ static bool alc_rebuild_imux_for_auto_mic(struct hda_codec *codec)
         spec->imux_pins[2] = spec->dock_mic_pin;
         for (i = 0; i < 3; i++) {
                 strcpy(imux->items[i].label, texts[i]);
-                if (spec->imux_pins[i])
+                if (spec->imux_pins[i]) {
+                        hda_nid_t pin = spec->imux_pins[i];
+                        int c;
+                        for (c = 0; c < spec->num_adc_nids; c++) {
+                                hda_nid_t cap = get_capsrc(spec, c);
+                                int idx = get_connection_index(codec, cap, pin);
+                                if (idx >= 0) {
+                                        imux->items[i].index = idx;
+                                        break;
+                                }
+                        }
                         imux->num_items = i + 1;
+                }
         }
         spec->num_mux_defs = 1;
         spec->input_mux = imux;
@@ -1957,10 +1973,8 @@ static int alc_build_controls(struct hda_codec *codec)
                 if (!kctl)
                         kctl = snd_hda_find_mixer_ctl(codec, "Input Source");
                 for (i = 0; kctl && i < kctl->count; i++) {
-                        const hda_nid_t *nids = spec->capsrc_nids;
-                        if (!nids)
-                                nids = spec->adc_nids;
-                        err = snd_hda_add_nid(codec, kctl, i, nids[i]);
+                        err = snd_hda_add_nid(codec, kctl, i,
+                                              get_capsrc(spec, i));
                         if (err < 0)
                                 return err;
                 }
@@ -2747,8 +2761,7 @@ static int alc_auto_create_input_ctls(struct hda_codec *codec)
                 }
 
                 for (c = 0; c < num_adcs; c++) {
-                        hda_nid_t cap = spec->capsrc_nids ?
-                                spec->capsrc_nids[c] : spec->adc_nids[c];
+                        hda_nid_t cap = get_capsrc(spec, c);
                         idx = get_connection_index(codec, cap, pin);
                         if (idx >= 0) {
                                 spec->imux_pins[imux->num_items] = pin;
@@ -3694,8 +3707,7 @@ static int init_capsrc_for_pin(struct hda_codec *codec, hda_nid_t pin)
         if (!pin)
                 return 0;
         for (i = 0; i < spec->num_adc_nids; i++) {
-                hda_nid_t cap = spec->capsrc_nids ?
-                        spec->capsrc_nids[i] : spec->adc_nids[i];
+                hda_nid_t cap = get_capsrc(spec, i);
                 int idx;
 
                 idx = get_connection_index(codec, cap, pin);
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 470f6f286e81..d8d2f9dccd9b 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1641,6 +1641,8 @@ static const struct snd_pci_quirk stac92hd73xx_codec_id_cfg_tbl[] = {
                       "Alienware M17x", STAC_ALIENWARE_M17X),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x043a,
                       "Alienware M17x", STAC_ALIENWARE_M17X),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0490,
+                      "Alienware M17x", STAC_ALIENWARE_M17X),
         {} /* terminator */
 };
 
@@ -4439,7 +4441,9 @@ static int stac92xx_init(struct hda_codec *codec)
                 int pinctl, def_conf;
 
                 /* power on when no jack detection is available */
-                if (!spec->hp_detect) {
+                /* or when the VREF is used for controlling LED */
+                if (!spec->hp_detect ||
+                    (spec->gpio_led > 8 && spec->gpio_led == nid)) {
                         stac_toggle_power_map(codec, nid, 1);
                         continue;
                 }
@@ -5053,20 +5057,6 @@ static int stac92xx_pre_resume(struct hda_codec *codec)
         return 0;
 }
 
-static int stac92xx_post_suspend(struct hda_codec *codec)
-{
-        struct sigmatel_spec *spec = codec->spec;
-        if (spec->gpio_led > 8) {
-                /* with vref-out pin used for mute led control
-                 * codec AFG is prevented from D3 state, but on
-                 * system suspend it can (and should) be used
-                 */
-                snd_hda_codec_read(codec, codec->afg, 0,
-                                AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
-        }
-        return 0;
-}
-
 static void stac92xx_set_power_state(struct hda_codec *codec, hda_nid_t fg,
                                 unsigned int power_state)
 {
@@ -5666,8 +5656,6 @@ again:
                 } else {
                         codec->patch_ops.set_power_state =
                                         stac92xx_set_power_state;
-                        codec->patch_ops.post_suspend =
-                                        stac92xx_post_suspend;
                 }
                 codec->patch_ops.pre_resume = stac92xx_pre_resume;
                 codec->patch_ops.check_power_status =
@@ -5981,8 +5969,6 @@ again:
                 } else {
                         codec->patch_ops.set_power_state =
                                         stac92xx_set_power_state;
-                        codec->patch_ops.post_suspend =
-                                        stac92xx_post_suspend;
                 }
                 codec->patch_ops.pre_resume = stac92xx_pre_resume;
                 codec->patch_ops.check_power_status =
diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index 431c0d417eeb..b5137629f8e9 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -208,6 +208,7 @@ struct via_spec {
         /* work to check hp jack state */
         struct hda_codec *codec;
         struct delayed_work vt1708_hp_work;
+        int hp_work_active;
         int vt1708_jack_detect;
         int vt1708_hp_present;
 
@@ -305,27 +306,35 @@ enum {
 static void analog_low_current_mode(struct hda_codec *codec);
 static bool is_aa_path_mute(struct hda_codec *codec);
 
-static void vt1708_start_hp_work(struct via_spec *spec)
+#define hp_detect_with_aa(codec) \
+        (snd_hda_get_bool_hint(codec, "analog_loopback_hp_detect") == 1 && \
+         !is_aa_path_mute(codec))
+
+static void vt1708_stop_hp_work(struct via_spec *spec)
 {
         if (spec->codec_type != VT1708 || spec->autocfg.hp_pins[0] == 0)
                 return;
-        snd_hda_codec_write(spec->codec, 0x1, 0, 0xf81,
-                            !spec->vt1708_jack_detect);
-        if (!delayed_work_pending(&spec->vt1708_hp_work))
-                schedule_delayed_work(&spec->vt1708_hp_work,
-                                      msecs_to_jiffies(100));
+        if (spec->hp_work_active) {
+                snd_hda_codec_write(spec->codec, 0x1, 0, 0xf81, 1);
+                cancel_delayed_work_sync(&spec->vt1708_hp_work);
+                spec->hp_work_active = 0;
+        }
 }
 
-static void vt1708_stop_hp_work(struct via_spec *spec)
+static void vt1708_update_hp_work(struct via_spec *spec)
 {
         if (spec->codec_type != VT1708 || spec->autocfg.hp_pins[0] == 0)
                 return;
-        if (snd_hda_get_bool_hint(spec->codec, "analog_loopback_hp_detect") == 1
-            && !is_aa_path_mute(spec->codec))
-                return;
-        snd_hda_codec_write(spec->codec, 0x1, 0, 0xf81,
-                            !spec->vt1708_jack_detect);
-        cancel_delayed_work_sync(&spec->vt1708_hp_work);
+        if (spec->vt1708_jack_detect &&
+            (spec->active_streams || hp_detect_with_aa(spec->codec))) {
+                if (!spec->hp_work_active) {
+                        snd_hda_codec_write(spec->codec, 0x1, 0, 0xf81, 0);
+                        schedule_delayed_work(&spec->vt1708_hp_work,
+                                              msecs_to_jiffies(100));
+                        spec->hp_work_active = 1;
+                }
+        } else if (!hp_detect_with_aa(spec->codec))
+                vt1708_stop_hp_work(spec);
 }
 
 static void set_widgets_power_state(struct hda_codec *codec)
@@ -343,12 +352,7 @@ static int analog_input_switch_put(struct snd_kcontrol *kcontrol,
 
         set_widgets_power_state(codec);
         analog_low_current_mode(snd_kcontrol_chip(kcontrol));
-        if (snd_hda_get_bool_hint(codec, "analog_loopback_hp_detect") == 1) {
-                if (is_aa_path_mute(codec))
-                        vt1708_start_hp_work(codec->spec);
-                else
-                        vt1708_stop_hp_work(codec->spec);
-        }
+        vt1708_update_hp_work(codec->spec);
         return change;
 }
 
@@ -1154,7 +1158,7 @@ static int via_playback_multi_pcm_prepare(struct hda_pcm_stream *hinfo,
         spec->cur_dac_stream_tag = stream_tag;
         spec->cur_dac_format = format;
         mutex_unlock(&spec->config_mutex);
-        vt1708_start_hp_work(spec);
+        vt1708_update_hp_work(spec);
         return 0;
 }
 
@@ -1174,7 +1178,7 @@ static int via_playback_hp_pcm_prepare(struct hda_pcm_stream *hinfo,
         spec->cur_hp_stream_tag = stream_tag;
         spec->cur_hp_format = format;
         mutex_unlock(&spec->config_mutex);
-        vt1708_start_hp_work(spec);
+        vt1708_update_hp_work(spec);
         return 0;
 }
 
@@ -1188,7 +1192,7 @@ static int via_playback_multi_pcm_cleanup(struct hda_pcm_stream *hinfo,
         snd_hda_multi_out_analog_cleanup(codec, &spec->multiout);
         spec->active_streams &= ~STREAM_MULTI_OUT;
         mutex_unlock(&spec->config_mutex);
-        vt1708_stop_hp_work(spec);
+        vt1708_update_hp_work(spec);
         return 0;
 }
 
@@ -1203,7 +1207,7 @@ static int via_playback_hp_pcm_cleanup(struct hda_pcm_stream *hinfo,
                 snd_hda_codec_setup_stream(codec, spec->hp_dac_nid, 0, 0, 0);
         spec->active_streams &= ~STREAM_INDEP_HP;
         mutex_unlock(&spec->config_mutex);
-        vt1708_stop_hp_work(spec);
+        vt1708_update_hp_work(spec);
         return 0;
 }
 
@@ -1645,7 +1649,8 @@ static void via_hp_automute(struct hda_codec *codec)
         int nums;
         struct via_spec *spec = codec->spec;
 
-        if (!spec->hp_independent_mode && spec->autocfg.hp_pins[0])
+        if (!spec->hp_independent_mode && spec->autocfg.hp_pins[0] &&
+            (spec->codec_type != VT1708 || spec->vt1708_jack_detect))
                 present = snd_hda_jack_detect(codec, spec->autocfg.hp_pins[0]);
 
         if (spec->smart51_enabled)
@@ -2612,8 +2617,6 @@ static int vt1708_jack_detect_get(struct snd_kcontrol *kcontrol,
 
         if (spec->codec_type != VT1708)
                 return 0;
-        spec->vt1708_jack_detect =
-                !((snd_hda_codec_read(codec, 0x1, 0, 0xf84, 0) >> 8) & 0x1);
         ucontrol->value.integer.value[0] = spec->vt1708_jack_detect;
         return 0;
 }
@@ -2623,18 +2626,22 @@ static int vt1708_jack_detect_put(struct snd_kcontrol *kcontrol,
 {
         struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
         struct via_spec *spec = codec->spec;
-        int change;
+        int val;
 
         if (spec->codec_type != VT1708)
                 return 0;
-        spec->vt1708_jack_detect = ucontrol->value.integer.value[0];
-        change = (0x1 & (snd_hda_codec_read(codec, 0x1, 0, 0xf84, 0) >> 8))
-                == !spec->vt1708_jack_detect;
-        if (spec->vt1708_jack_detect) {
+        val = !!ucontrol->value.integer.value[0];
+        if (spec->vt1708_jack_detect == val)
+                return 0;
+        spec->vt1708_jack_detect = val;
+        if (spec->vt1708_jack_detect &&
+            snd_hda_get_bool_hint(codec, "analog_loopback_hp_detect") != 1) {
                 mute_aa_path(codec, 1);
                 notify_aa_path_ctls(codec);
         }
-        return change;
+        via_hp_automute(codec);
+        vt1708_update_hp_work(spec);
+        return 1;
 }
 
 static const struct snd_kcontrol_new vt1708_jack_detect_ctl = {
@@ -2771,6 +2778,7 @@ static int via_init(struct hda_codec *codec)
         via_auto_init_unsol_event(codec);
 
         via_hp_automute(codec);
+        vt1708_update_hp_work(spec);
 
         return 0;
 }
@@ -2787,7 +2795,9 @@ static void vt1708_update_hp_jack_state(struct work_struct *work)
                 spec->vt1708_hp_present ^= 1;
                 via_hp_automute(spec->codec);
         }
-        vt1708_start_hp_work(spec);
+        if (spec->vt1708_jack_detect)
+                schedule_delayed_work(&spec->vt1708_hp_work,
+                                      msecs_to_jiffies(100));
 }
 
 static int get_mux_nids(struct hda_codec *codec)
diff --git a/sound/pci/lx6464es/lx_core.c b/sound/pci/lx6464es/lx_core.c
index 5c8717e29eeb..8c3e7fcefd99 100644
--- a/sound/pci/lx6464es/lx_core.c
+++ b/sound/pci/lx6464es/lx_core.c
@@ -78,10 +78,15 @@ unsigned long lx_dsp_reg_read(struct lx6464es *chip, int port)
         return ioread32(address);
 }
 
-void lx_dsp_reg_readbuf(struct lx6464es *chip, int port, u32 *data, u32 len)
+static void lx_dsp_reg_readbuf(struct lx6464es *chip, int port, u32 *data,
+                               u32 len)
 {
-        void __iomem *address = lx_dsp_register(chip, port);
-        memcpy_fromio(data, address, len*sizeof(u32));
+        u32 __iomem *address = lx_dsp_register(chip, port);
+        int i;
+
+        /* we cannot use memcpy_fromio */
+        for (i = 0; i != len; ++i)
+                data[i] = ioread32(address + i);
 }
 
 
@@ -91,11 +96,15 @@ void lx_dsp_reg_write(struct lx6464es *chip, int port, unsigned data)
         iowrite32(data, address);
 }
 
-void lx_dsp_reg_writebuf(struct lx6464es *chip, int port, const u32 *data,
-                         u32 len)
+static void lx_dsp_reg_writebuf(struct lx6464es *chip, int port,
+                                const u32 *data, u32 len)
 {
-        void __iomem *address = lx_dsp_register(chip, port);
-        memcpy_toio(address, data, len*sizeof(u32));
+        u32 __iomem *address = lx_dsp_register(chip, port);
+        int i;
+
+        /* we cannot use memcpy_to */
+        for (i = 0; i != len; ++i)
+                iowrite32(data[i], address + i);
 }
 
 
diff --git a/sound/pci/lx6464es/lx_core.h b/sound/pci/lx6464es/lx_core.h
index 1dd562980b6c..4d7ff797a646 100644
--- a/sound/pci/lx6464es/lx_core.h
+++ b/sound/pci/lx6464es/lx_core.h
@@ -72,10 +72,7 @@ enum {
 };
 
 unsigned long lx_dsp_reg_read(struct lx6464es *chip, int port);
-void lx_dsp_reg_readbuf(struct lx6464es *chip, int port, u32 *data, u32 len);
 void lx_dsp_reg_write(struct lx6464es *chip, int port, unsigned data);
-void lx_dsp_reg_writebuf(struct lx6464es *chip, int port, const u32 *data,
-                         u32 len);
 
 /* plx register access */
 enum {
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index e760adad9523..19ee2203cbb5 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -6518,7 +6518,7 @@ static int __devinit snd_hdspm_create(struct snd_card *card,
                         hdspm->io_type = AES32;
                         hdspm->card_name = "RME AES32";
                         hdspm->midiPorts = 2;
-                } else if ((hdspm->firmware_rev == 0xd5) ||
+                } else if ((hdspm->firmware_rev == 0xd2) ||
                         ((hdspm->firmware_rev >= 0xc8)  &&
                                 (hdspm->firmware_rev <= 0xcf))) {
                         hdspm->io_type = MADI;
diff --git a/sound/soc/atmel/Kconfig b/sound/soc/atmel/Kconfig
index bee3c94f58b0..d1fcc816ce97 100644
--- a/sound/soc/atmel/Kconfig
+++ b/sound/soc/atmel/Kconfig
@@ -1,6 +1,6 @@
 config SND_ATMEL_SOC
         tristate "SoC Audio for the Atmel System-on-Chip"
-        depends on ARCH_AT91 || AVR32
+        depends on ARCH_AT91
         help
           Say Y or M if you want to add support for codecs attached to
           the ATMEL SSC interface. You will also need
@@ -24,25 +24,6 @@ config SND_AT91_SOC_SAM9G20_WM8731
           Say Y if you want to add support for SoC audio on WM8731-based
           AT91sam9g20 evaluation board.
 
-config SND_AT32_SOC_PLAYPAQ
-        tristate "SoC Audio support for PlayPaq with WM8510"
-        depends on SND_ATMEL_SOC && BOARD_PLAYPAQ && AT91_PROGRAMMABLE_CLOCKS
-        select SND_ATMEL_SOC_SSC
-        select SND_SOC_WM8510
-        help
-          Say Y or M here if you want to add support for SoC audio
-          on the LRS PlayPaq.
-
-config SND_AT32_SOC_PLAYPAQ_SLAVE
-        bool "Run CODEC on PlayPaq in slave mode"
-        depends on SND_AT32_SOC_PLAYPAQ
-        default n
-        help
-          Say Y if you want to run with the AT32 SSC generating the BCLK
-          and FRAME signals on the PlayPaq.  Unless you want to play
-          with the AT32 as the SSC master, you probably want to say N here,
-          as this will give you better sound quality.
-
 config SND_AT91_SOC_AFEB9260
         tristate "SoC Audio support for AFEB9260 board"
         depends on ARCH_AT91 && MACH_AFEB9260 && SND_ATMEL_SOC
diff --git a/sound/soc/atmel/Makefile b/sound/soc/atmel/Makefile
index e7ea56bd5f82..a5c0bf19da78 100644
--- a/sound/soc/atmel/Makefile
+++ b/sound/soc/atmel/Makefile
@@ -8,9 +8,5 @@ obj-$(CONFIG_SND_ATMEL_SOC_SSC) += snd-soc-atmel_ssc_dai.o
 # AT91 Machine Support
 snd-soc-sam9g20-wm8731-objs := sam9g20_wm8731.o
 
-# AT32 Machine Support
-snd-soc-playpaq-objs := playpaq_wm8510.o
-
 obj-$(CONFIG_SND_AT91_SOC_SAM9G20_WM8731) += snd-soc-sam9g20-wm8731.o
-obj-$(CONFIG_SND_AT32_SOC_PLAYPAQ) += snd-soc-playpaq.o
 obj-$(CONFIG_SND_AT91_SOC_AFEB9260) += snd-soc-afeb9260.o
diff --git a/sound/soc/atmel/playpaq_wm8510.c b/sound/soc/atmel/playpaq_wm8510.c
deleted file mode 100644
index 73ae99ad4578..000000000000
--- a/sound/soc/atmel/playpaq_wm8510.c
+++ /dev/null
@@ -1,473 +0,0 @@
-/* sound/soc/at32/playpaq_wm8510.c
- * ASoC machine driver for PlayPaq using WM8510 codec
- *
- * Copyright (C) 2008 Long Range Systems
- *    Geoffrey Wossum <gwossum@acm.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This code is largely inspired by sound/soc/at91/eti_b1_wm8731.c
- *
- * NOTE: If you don't have the AT32 enhanced portmux configured (which
- * isn't currently in the mainline or Atmel patched kernel), you will
- * need to set the MCLK pin (PA30) to peripheral A in your board initialization
- * code.  Something like:
- *      at32_select_periph(GPIO_PIN_PA(30), GPIO_PERIPH_A, 0);
- *
- */
-
-/* #define DEBUG */
-
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/clk.h>
-#include <linux/timer.h>
-#include <linux/interrupt.h>
-#include <linux/platform_device.h>
-
-#include <sound/core.h>
-#include <sound/pcm.h>
-#include <sound/pcm_params.h>
-#include <sound/soc.h>
-
-#include <mach/at32ap700x.h>
-#include <mach/portmux.h>
-
-#include "../codecs/wm8510.h"
-#include "atmel-pcm.h"
-#include "atmel_ssc_dai.h"
-
-
-/*-------------------------------------------------------------------------*\
- * constants
-\*-------------------------------------------------------------------------*/
-#define MCLK_PIN                GPIO_PIN_PA(30)
-#define MCLK_PERIPH             GPIO_PERIPH_A
-
-
-/*-------------------------------------------------------------------------*\
- * data types
-\*-------------------------------------------------------------------------*/
-/* SSC clocking data */
-struct ssc_clock_data {
-        /* CMR div */
-        unsigned int cmr_div;
-
-        /* Frame period (as needed by xCMR.PERIOD) */
-        unsigned int period;
-
-        /* The SSC clock rate these settings where calculated for */
-        unsigned long ssc_rate;
-};
-
-
-/*-------------------------------------------------------------------------*\
- * module data
-\*-------------------------------------------------------------------------*/
-static struct clk *_gclk0;
-static struct clk *_pll0;
-
-#define CODEC_CLK (_gclk0)
-
-
-/*-------------------------------------------------------------------------*\
- * Sound SOC operations
-\*-------------------------------------------------------------------------*/
-#if defined CONFIG_SND_AT32_SOC_PLAYPAQ_SLAVE
-static struct ssc_clock_data playpaq_wm8510_calc_ssc_clock(
-        struct snd_pcm_hw_params *params,
-        struct snd_soc_dai *cpu_dai)
-{
-        struct at32_ssc_info *ssc_p = snd_soc_dai_get_drvdata(cpu_dai);
-        struct ssc_device *ssc = ssc_p->ssc;
-        struct ssc_clock_data cd;
-        unsigned int rate, width_bits, channels;
-        unsigned int bitrate, ssc_div;
-        unsigned actual_rate;
-
-
-        /*
-         * Figure out required bitrate
-         */
-        rate = params_rate(params);
-        channels = params_channels(params);
-        width_bits = snd_pcm_format_physical_width(params_format(params));
-        bitrate = rate * width_bits * channels;
-
-
-        /*
-         * Figure out required SSC divider and period for required bitrate
-         */
-        cd.ssc_rate = clk_get_rate(ssc->clk);
-        ssc_div = cd.ssc_rate / bitrate;
-        cd.cmr_div = ssc_div / 2;
-        if (ssc_div & 1) {
-                /* round cmr_div up */
-                cd.cmr_div++;
-        }
-        cd.period = width_bits - 1;
-
-
-        /*
-         * Find actual rate, compare to requested rate
-         */
-        actual_rate = (cd.ssc_rate / (cd.cmr_div * 2)) / (2 * (cd.period + 1));
-        pr_debug("playpaq_wm8510: Request rate = %u, actual rate = %u\n",
-                 rate, actual_rate);
-
-
-        return cd;
-}
-#endif /* CONFIG_SND_AT32_SOC_PLAYPAQ_SLAVE */
-
-
-
-static int playpaq_wm8510_hw_params(struct snd_pcm_substream *substream,
-                                    struct snd_pcm_hw_params *params)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct snd_soc_dai *codec_dai = rtd->codec_dai;
-        struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
-        struct at32_ssc_info *ssc_p = snd_soc_dai_get_drvdata(cpu_dai);
-        struct ssc_device *ssc = ssc_p->ssc;
-        unsigned int pll_out = 0, bclk = 0, mclk_div = 0;
-        int ret;
-
-
-        /* Due to difficulties with getting the correct clocks from the AT32's
-         * PLL0, we're going to let the CODEC be in charge of all the clocks
-         */
-#if !defined CONFIG_SND_AT32_SOC_PLAYPAQ_SLAVE
-        const unsigned int fmt = (SND_SOC_DAIFMT_I2S |
-                                  SND_SOC_DAIFMT_NB_NF |
-                                  SND_SOC_DAIFMT_CBM_CFM);
-#else
-        struct ssc_clock_data cd;
-        const unsigned int fmt = (SND_SOC_DAIFMT_I2S |
-                                  SND_SOC_DAIFMT_NB_NF |
-                                  SND_SOC_DAIFMT_CBS_CFS);
-#endif
-
-        if (ssc == NULL) {
-                pr_warning("playpaq_wm8510_hw_params: ssc is NULL!\n");
-                return -EINVAL;
-        }
-
-
-        /*
-         * Figure out PLL and BCLK dividers for WM8510
-         */
-        switch (params_rate(params)) {
-        case 48000:
-                pll_out = 24576000;
-                mclk_div = WM8510_MCLKDIV_2;
-                bclk = WM8510_BCLKDIV_8;
-                break;
-
-        case 44100:
-                pll_out = 22579200;
-                mclk_div = WM8510_MCLKDIV_2;
-                bclk = WM8510_BCLKDIV_8;
-                break;
-
-        case 22050:
-                pll_out = 22579200;
-                mclk_div = WM8510_MCLKDIV_4;
-                bclk = WM8510_BCLKDIV_8;
-                break;
-
-        case 16000:
-                pll_out = 24576000;
-                mclk_div = WM8510_MCLKDIV_6;
-                bclk = WM8510_BCLKDIV_8;
-                break;
-
-        case 11025:
-                pll_out = 22579200;
-                mclk_div = WM8510_MCLKDIV_8;
-                bclk = WM8510_BCLKDIV_8;
-                break;
-
-        case 8000:
-                pll_out = 24576000;
-                mclk_div = WM8510_MCLKDIV_12;
-                bclk = WM8510_BCLKDIV_8;
-                break;
-
-        default:
-                pr_warning("playpaq_wm8510: Unsupported sample rate %d\n",
-                           params_rate(params));
-                return -EINVAL;
-        }
-
-
-        /*
-         * set CPU and CODEC DAI configuration
-         */
-        ret = snd_soc_dai_set_fmt(codec_dai, fmt);
-        if (ret < 0) {
-                pr_warning("playpaq_wm8510: "
-                           "Failed to set CODEC DAI format (%d)\n",
-                           ret);
-                return ret;
-        }
-        ret = snd_soc_dai_set_fmt(cpu_dai, fmt);
-        if (ret < 0) {
-                pr_warning("playpaq_wm8510: "
-                           "Failed to set CPU DAI format (%d)\n",
-                           ret);
-                return ret;
-        }
-
-
-        /*
-         * Set CPU clock configuration
-         */
-#if defined CONFIG_SND_AT32_SOC_PLAYPAQ_SLAVE
-        cd = playpaq_wm8510_calc_ssc_clock(params, cpu_dai);
-        pr_debug("playpaq_wm8510: cmr_div = %d, period = %d\n",
-                 cd.cmr_div, cd.period);
-        ret = snd_soc_dai_set_clkdiv(cpu_dai, AT32_SSC_CMR_DIV, cd.cmr_div);
-        if (ret < 0) {
-                pr_warning("playpaq_wm8510: Failed to set CPU CMR_DIV (%d)\n",
-                           ret);
-                return ret;
-        }
-        ret = snd_soc_dai_set_clkdiv(cpu_dai, AT32_SSC_TCMR_PERIOD,
-                                          cd.period);
-        if (ret < 0) {
-                pr_warning("playpaq_wm8510: "
-                           "Failed to set CPU transmit period (%d)\n",
-                           ret);
-                return ret;
-        }
-#endif /* CONFIG_SND_AT32_SOC_PLAYPAQ_SLAVE */
-
-
-        /*
-         * Set CODEC clock configuration
-         */
-        pr_debug("playpaq_wm8510: "
-                 "pll_in = %ld, pll_out = %u, bclk = %x, mclk = %x\n",
-                 clk_get_rate(CODEC_CLK), pll_out, bclk, mclk_div);
-
-
-#if !defined CONFIG_SND_AT32_SOC_PLAYPAQ_SLAVE
-        ret = snd_soc_dai_set_clkdiv(codec_dai, WM8510_BCLKDIV, bclk);
-        if (ret < 0) {
-                pr_warning
-                    ("playpaq_wm8510: Failed to set CODEC DAI BCLKDIV (%d)\n",
-                     ret);
-                return ret;
-        }
-#endif /* CONFIG_SND_AT32_SOC_PLAYPAQ_SLAVE */
-
-
-        ret = snd_soc_dai_set_pll(codec_dai, 0, 0,
-                                         clk_get_rate(CODEC_CLK), pll_out);
-        if (ret < 0) {
-                pr_warning("playpaq_wm8510: Failed to set CODEC DAI PLL (%d)\n",
-                           ret);
-                return ret;
-        }
-
-
-        ret = snd_soc_dai_set_clkdiv(codec_dai, WM8510_MCLKDIV, mclk_div);
-        if (ret < 0) {
-                pr_warning("playpaq_wm8510: Failed to set CODEC MCLKDIV (%d)\n",
-                           ret);
-                return ret;
-        }
-
-
-        return 0;
-}
-
-
-
-static struct snd_soc_ops playpaq_wm8510_ops = {
-        .hw_params = playpaq_wm8510_hw_params,
-};
-
-
-
-static const struct snd_soc_dapm_widget playpaq_dapm_widgets[] = {
-        SND_SOC_DAPM_MIC("Int Mic", NULL),
-        SND_SOC_DAPM_SPK("Ext Spk", NULL),
-};
-
-
-
-static const struct snd_soc_dapm_route intercon[] = {
-        /* speaker connected to SPKOUT */
-        {"Ext Spk", NULL, "SPKOUTP"},
-        {"Ext Spk", NULL, "SPKOUTN"},
-
-        {"Mic Bias", NULL, "Int Mic"},
-        {"MICN", NULL, "Mic Bias"},
-        {"MICP", NULL, "Mic Bias"},
-};
-
-
-
-static int playpaq_wm8510_init(struct snd_soc_pcm_runtime *rtd)
-{
-        struct snd_soc_codec *codec = rtd->codec;
-        struct snd_soc_dapm_context *dapm = &codec->dapm;
-        int i;
-
-        /*
-         * Add DAPM widgets
-         */
-        for (i = 0; i < ARRAY_SIZE(playpaq_dapm_widgets); i++)
-                snd_soc_dapm_new_control(dapm, &playpaq_dapm_widgets[i]);
-
-
-
-        /*
-         * Setup audio path interconnects
-         */
-        snd_soc_dapm_add_routes(dapm, intercon, ARRAY_SIZE(intercon));
-
-
-
-        /* always connected pins */
-        snd_soc_dapm_enable_pin(dapm, "Int Mic");
-        snd_soc_dapm_enable_pin(dapm, "Ext Spk");
-
-
-
-        /* Make CSB show PLL rate */
-        snd_soc_dai_set_clkdiv(rtd->codec_dai, WM8510_OPCLKDIV,
-                                       WM8510_OPCLKDIV_1 | 4);
-
-        return 0;
-}
-
-
-
-static struct snd_soc_dai_link playpaq_wm8510_dai = {
-        .name = "WM8510",
-        .stream_name = "WM8510 PCM",
-        .cpu_dai_name= "atmel-ssc-dai.0",
-        .platform_name = "atmel-pcm-audio",
-        .codec_name = "wm8510-codec.0-0x1a",
-        .codec_dai_name = "wm8510-hifi",
-        .init = playpaq_wm8510_init,
-        .ops = &playpaq_wm8510_ops,
-};
-
-
-
-static struct snd_soc_card snd_soc_playpaq = {
-        .name = "LRS_PlayPaq_WM8510",
-        .dai_link = &playpaq_wm8510_dai,
-        .num_links = 1,
-};
-
-static struct platform_device *playpaq_snd_device;
-
-
-static int __init playpaq_asoc_init(void)
-{
-        int ret = 0;
-
-        /*
-         * Configure MCLK for WM8510
-         */
-        _gclk0 = clk_get(NULL, "gclk0");
-        if (IS_ERR(_gclk0)) {
-                _gclk0 = NULL;
-                ret = PTR_ERR(_gclk0);
-                goto err_gclk0;
-        }
-        _pll0 = clk_get(NULL, "pll0");
-        if (IS_ERR(_pll0)) {
-                _pll0 = NULL;
-                ret = PTR_ERR(_pll0);
-                goto err_pll0;
-        }
-        ret = clk_set_parent(_gclk0, _pll0);
-        if (ret) {
-                pr_warning("snd-soc-playpaq: "
-                           "Failed to set PLL0 as parent for DAC clock\n");
-                goto err_set_clk;
-        }
-        clk_set_rate(CODEC_CLK, 12000000);
-        clk_enable(CODEC_CLK);
-
-#if defined CONFIG_AT32_ENHANCED_PORTMUX
-        at32_select_periph(MCLK_PIN, MCLK_PERIPH, 0);
-#endif
-
-
-        /*
-         * Create and register platform device
-         */
-        playpaq_snd_device = platform_device_alloc("soc-audio", 0);
-        if (playpaq_snd_device == NULL) {
-                ret = -ENOMEM;
-                goto err_device_alloc;
-        }
-
-        platform_set_drvdata(playpaq_snd_device, &snd_soc_playpaq);
-
-        ret = platform_device_add(playpaq_snd_device);
-        if (ret) {
-                pr_warning("playpaq_wm8510: platform_device_add failed (%d)\n",
-                           ret);
-                goto err_device_add;
-        }
-
-        return 0;
-
-
-err_device_add:
-        if (playpaq_snd_device != NULL) {
-                platform_device_put(playpaq_snd_device);
-                playpaq_snd_device = NULL;
-        }
-err_device_alloc:
-err_set_clk:
-        if (_pll0 != NULL) {
-                clk_put(_pll0);
-                _pll0 = NULL;
-        }
-err_pll0:
-        if (_gclk0 != NULL) {
-                clk_put(_gclk0);
-                _gclk0 = NULL;
-        }
-        return ret;
-}
-
-
-static void __exit playpaq_asoc_exit(void)
-{
-        if (_gclk0 != NULL) {
-                clk_put(_gclk0);
-                _gclk0 = NULL;
-        }
-        if (_pll0 != NULL) {
-                clk_put(_pll0);
-                _pll0 = NULL;
-        }
-
-#if defined CONFIG_AT32_ENHANCED_PORTMUX
-        at32_free_pin(MCLK_PIN);
-#endif
-
-        platform_device_unregister(playpaq_snd_device);
-        playpaq_snd_device = NULL;
-}
-
-module_init(playpaq_asoc_init);
-module_exit(playpaq_asoc_exit);
-
-MODULE_AUTHOR("Geoffrey Wossum <gwossum@acm.org>");
-MODULE_DESCRIPTION("ASoC machine driver for LRS PlayPaq");
-MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/ad1836.h b/sound/soc/codecs/ad1836.h
index 444747f0db26..dd7be0dbbc58 100644
--- a/sound/soc/codecs/ad1836.h
+++ b/sound/soc/codecs/ad1836.h
@@ -34,7 +34,7 @@
 
 #define AD1836_ADC_CTRL2               13
 #define AD1836_ADC_WORD_LEN_MASK       0x30
-#define AD1836_ADC_WORD_OFFSET         5
+#define AD1836_ADC_WORD_OFFSET         4
 #define AD1836_ADC_SERFMT_MASK         (7 << 6)
 #define AD1836_ADC_SERFMT_PCK256       (0x4 << 6)
 #define AD1836_ADC_SERFMT_PCK128       (0x5 << 6)
diff --git a/sound/soc/codecs/adau1373.c b/sound/soc/codecs/adau1373.c
index 1ccf8dd47576..45c63028b40d 100644
--- a/sound/soc/codecs/adau1373.c
+++ b/sound/soc/codecs/adau1373.c
@@ -245,7 +245,7 @@ static const char *adau1373_bass_hpf_cutoff_text[] = {
 };
 
 static const unsigned int adau1373_bass_tlv[] = {
-        TLV_DB_RANGE_HEAD(4),
+        TLV_DB_RANGE_HEAD(3),
         0, 2, TLV_DB_SCALE_ITEM(-600, 600, 1),
         3, 4, TLV_DB_SCALE_ITEM(950, 250, 0),
         5, 7, TLV_DB_SCALE_ITEM(1400, 150, 0),
diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
index f1f237ecec2a..73f46eb459f1 100644
--- a/sound/soc/codecs/cs4270.c
+++ b/sound/soc/codecs/cs4270.c
@@ -601,7 +601,6 @@ static int cs4270_soc_suspend(struct snd_soc_codec *codec, pm_message_t mesg)
 static int cs4270_soc_resume(struct snd_soc_codec *codec)
 {
         struct cs4270_private *cs4270 = snd_soc_codec_get_drvdata(codec);
-        struct i2c_client *i2c_client = to_i2c_client(codec->dev);
         int reg;
 
         regulator_bulk_enable(ARRAY_SIZE(cs4270->supplies),
@@ -612,14 +611,7 @@ static int cs4270_soc_resume(struct snd_soc_codec *codec)
         ndelay(500);
 
         /* first restore the entire register cache ... */
-        for (reg = CS4270_FIRSTREG; reg <= CS4270_LASTREG; reg++) {
-                u8 val = snd_soc_read(codec, reg);
-
-                if (i2c_smbus_write_byte_data(i2c_client, reg, val)) {
-                        dev_err(codec->dev, "i2c write failed\n");
-                        return -EIO;
-                }
-        }
+        snd_soc_cache_sync(codec);
 
         /* ... then disable the power-down bits */
         reg = snd_soc_read(codec, CS4270_PWRCTL);
diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
index 23d1bd5dadda..69fde1506fe1 100644
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -434,7 +434,8 @@ static int cs4271_soc_suspend(struct snd_soc_codec *codec, pm_message_t mesg)
 {
         int ret;
         /* Set power-down bit */
-        ret = snd_soc_update_bits(codec, CS4271_MODE2, 0, CS4271_MODE2_PDN);
+        ret = snd_soc_update_bits(codec, CS4271_MODE2, CS4271_MODE2_PDN,
+                                  CS4271_MODE2_PDN);
         if (ret < 0)
                 return ret;
         return 0;
@@ -501,8 +502,9 @@ static int cs4271_probe(struct snd_soc_codec *codec)
                 return ret;
         }
 
-        ret = snd_soc_update_bits(codec, CS4271_MODE2, 0,
-                CS4271_MODE2_PDN | CS4271_MODE2_CPEN);
+        ret = snd_soc_update_bits(codec, CS4271_MODE2,
+                                  CS4271_MODE2_PDN | CS4271_MODE2_CPEN,
+                                  CS4271_MODE2_PDN | CS4271_MODE2_CPEN);
         if (ret < 0)
                 return ret;
         ret = snd_soc_update_bits(codec, CS4271_MODE2, CS4271_MODE2_PDN, 0);
diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c
index 8c3c8205d19e..1ee66361f61b 100644
--- a/sound/soc/codecs/cs42l51.c
+++ b/sound/soc/codecs/cs42l51.c
@@ -555,7 +555,7 @@ static int cs42l51_probe(struct snd_soc_codec *codec)
 
 static struct snd_soc_codec_driver soc_codec_device_cs42l51 = {
         .probe =        cs42l51_probe,
-        .reg_cache_size = CS42L51_NUMREGS,
+        .reg_cache_size = CS42L51_NUMREGS + 1,
         .reg_word_size = sizeof(u8),
 };
 
diff --git a/sound/soc/codecs/max9877.c b/sound/soc/codecs/max9877.c
index 9e7e964a5fa3..dcf6f2a1600a 100644
--- a/sound/soc/codecs/max9877.c
+++ b/sound/soc/codecs/max9877.c
@@ -106,13 +106,13 @@ static int max9877_set_2reg(struct snd_kcontrol *kcontrol,
         unsigned int mask = mc->max;
         unsigned int val = (ucontrol->value.integer.value[0] & mask);
         unsigned int val2 = (ucontrol->value.integer.value[1] & mask);
-        unsigned int change = 1;
+        unsigned int change = 0;
 
-        if (((max9877_regs[reg] >> shift) & mask) == val)
-                change = 0;
+        if (((max9877_regs[reg] >> shift) & mask) != val)
+                change = 1;
 
-        if (((max9877_regs[reg2] >> shift) & mask) == val2)
-                change = 0;
+        if (((max9877_regs[reg2] >> shift) & mask) != val2)
+                change = 1;
 
         if (change) {
                 max9877_regs[reg] &= ~(mask << shift);
diff --git a/sound/soc/codecs/rt5631.c b/sound/soc/codecs/rt5631.c
index 27a078cbb6eb..4646e808b90a 100644
--- a/sound/soc/codecs/rt5631.c
+++ b/sound/soc/codecs/rt5631.c
@@ -177,7 +177,7 @@ static const DECLARE_TLV_DB_SCALE(dac_vol_tlv, -95625, 375, 0);
 static const DECLARE_TLV_DB_SCALE(in_vol_tlv, -3450, 150, 0);
 /* {0, +20, +24, +30, +35, +40, +44, +50, +52}dB */
 static unsigned int mic_bst_tlv[] = {
-        TLV_DB_RANGE_HEAD(6),
+        TLV_DB_RANGE_HEAD(7),
         0, 0, TLV_DB_SCALE_ITEM(0, 0, 0),
         1, 1, TLV_DB_SCALE_ITEM(2000, 0, 0),
         2, 2, TLV_DB_SCALE_ITEM(2400, 0, 0),
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index d15695d1c273..bbcf921166f7 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -365,7 +365,7 @@ static const DECLARE_TLV_DB_SCALE(capture_6db_attenuate, -600, 600, 0);
 
 /* tlv for mic gain, 0db 20db 30db 40db */
 static const unsigned int mic_gain_tlv[] = {
-        TLV_DB_RANGE_HEAD(4),
+        TLV_DB_RANGE_HEAD(2),
         0, 0, TLV_DB_SCALE_ITEM(0, 0, 0),
         1, 3, TLV_DB_SCALE_ITEM(2000, 1000, 0),
 };
diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
index bb82408ab8e1..d2f37152f940 100644
--- a/sound/soc/codecs/sta32x.c
+++ b/sound/soc/codecs/sta32x.c
@@ -76,6 +76,8 @@ struct sta32x_priv {
 
         unsigned int mclk;
         unsigned int format;
+
+        u32 coef_shadow[STA32X_COEF_COUNT];
 };
 
 static const DECLARE_TLV_DB_SCALE(mvol_tlv, -12700, 50, 1);
@@ -227,6 +229,7 @@ static int sta32x_coefficient_put(struct snd_kcontrol *kcontrol,
                                   struct snd_ctl_elem_value *ucontrol)
 {
         struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+        struct sta32x_priv *sta32x = snd_soc_codec_get_drvdata(codec);
         int numcoef = kcontrol->private_value >> 16;
         int index = kcontrol->private_value & 0xffff;
         unsigned int cfud;
@@ -239,6 +242,11 @@ static int sta32x_coefficient_put(struct snd_kcontrol *kcontrol,
         snd_soc_write(codec, STA32X_CFUD, cfud);
 
         snd_soc_write(codec, STA32X_CFADDR2, index);
+        for (i = 0; i < numcoef && (index + i < STA32X_COEF_COUNT); i++)
+                sta32x->coef_shadow[index + i] =
+                          (ucontrol->value.bytes.data[3 * i] << 16)
+                        | (ucontrol->value.bytes.data[3 * i + 1] << 8)
+                        | (ucontrol->value.bytes.data[3 * i + 2]);
         for (i = 0; i < 3 * numcoef; i++)
                 snd_soc_write(codec, STA32X_B1CF1 + i,
                               ucontrol->value.bytes.data[i]);
@@ -252,6 +260,48 @@ static int sta32x_coefficient_put(struct snd_kcontrol *kcontrol,
         return 0;
 }
 
+int sta32x_sync_coef_shadow(struct snd_soc_codec *codec)
+{
+        struct sta32x_priv *sta32x = snd_soc_codec_get_drvdata(codec);
+        unsigned int cfud;
+        int i;
+
+        /* preserve reserved bits in STA32X_CFUD */
+        cfud = snd_soc_read(codec, STA32X_CFUD) & 0xf0;
+
+        for (i = 0; i < STA32X_COEF_COUNT; i++) {
+                snd_soc_write(codec, STA32X_CFADDR2, i);
+                snd_soc_write(codec, STA32X_B1CF1,
+                              (sta32x->coef_shadow[i] >> 16) & 0xff);
+                snd_soc_write(codec, STA32X_B1CF2,
+                              (sta32x->coef_shadow[i] >> 8) & 0xff);
+                snd_soc_write(codec, STA32X_B1CF3,
+                              (sta32x->coef_shadow[i]) & 0xff);
+                /* chip documentation does not say if the bits are
+                 * self-clearing, so do it explicitly */
+                snd_soc_write(codec, STA32X_CFUD, cfud);
+                snd_soc_write(codec, STA32X_CFUD, cfud | 0x01);
+        }
+        return 0;
+}
+
+int sta32x_cache_sync(struct snd_soc_codec *codec)
+{
+        unsigned int mute;
+        int rc;
+
+        if (!codec->cache_sync)
+                return 0;
+
+        /* mute during register sync */
+        mute = snd_soc_read(codec, STA32X_MMUTE);
+        snd_soc_write(codec, STA32X_MMUTE, mute | STA32X_MMUTE_MMUTE);
+        sta32x_sync_coef_shadow(codec);
+        rc = snd_soc_cache_sync(codec);
+        snd_soc_write(codec, STA32X_MMUTE, mute);
+        return rc;
+}
+
 #define SINGLE_COEF(xname, index) \
 {       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, \
         .info = sta32x_coefficient_info, \
@@ -661,7 +711,7 @@ static int sta32x_set_bias_level(struct snd_soc_codec *codec,
                                 return ret;
                         }
 
-                        snd_soc_cache_sync(codec);
+                        sta32x_cache_sync(codec);
                 }
 
                 /* Power up to mute */
@@ -790,6 +840,17 @@ static int sta32x_probe(struct snd_soc_codec *codec)
                             STA32X_CxCFG_OM_MASK,
                             2 << STA32X_CxCFG_OM_SHIFT);
 
+        /* initialize coefficient shadow RAM with reset values */
+        for (i = 4; i <= 49; i += 5)
+                sta32x->coef_shadow[i] = 0x400000;
+        for (i = 50; i <= 54; i++)
+                sta32x->coef_shadow[i] = 0x7fffff;
+        sta32x->coef_shadow[55] = 0x5a9df7;
+        sta32x->coef_shadow[56] = 0x7fffff;
+        sta32x->coef_shadow[59] = 0x7fffff;
+        sta32x->coef_shadow[60] = 0x400000;
+        sta32x->coef_shadow[61] = 0x400000;
+
         sta32x_set_bias_level(codec, SND_SOC_BIAS_STANDBY);
         /* Bias level configuration will have done an extra enable */
         regulator_bulk_disable(ARRAY_SIZE(sta32x->supplies), sta32x->supplies);
diff --git a/sound/soc/codecs/sta32x.h b/sound/soc/codecs/sta32x.h
index b97ee5a75667..d8e32a6262ee 100644
--- a/sound/soc/codecs/sta32x.h
+++ b/sound/soc/codecs/sta32x.h
@@ -19,6 +19,7 @@
 /* STA326 register addresses */
 
 #define STA32X_REGISTER_COUNT   0x2d
+#define STA32X_COEF_COUNT 62
 
 #define STA32X_CONFA    0x00
 #define STA32X_CONFB    0x01
diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
index 7e5ec03f6f8d..a7c9ae17fc7e 100644
--- a/sound/soc/codecs/wm8731.c
+++ b/sound/soc/codecs/wm8731.c
@@ -453,6 +453,7 @@ static int wm8731_set_bias_level(struct snd_soc_codec *codec,
                 snd_soc_write(codec, WM8731_PWR, 0xffff);
                 regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies),
                                        wm8731->supplies);
+                codec->cache_sync = 1;
                 break;
         }
         codec->dapm.bias_level = level;
diff --git a/sound/soc/codecs/wm8753.c b/sound/soc/codecs/wm8753.c
index a9504710bb69..3a629d0d690e 100644
--- a/sound/soc/codecs/wm8753.c
+++ b/sound/soc/codecs/wm8753.c
@@ -190,6 +190,9 @@ static int wm8753_set_dai(struct snd_kcontrol *kcontrol,
         struct wm8753_priv *wm8753 = snd_soc_codec_get_drvdata(codec);
         u16 ioctl;
 
+        if (wm8753->dai_func == ucontrol->value.integer.value[0])
+                return 0;
+
         if (codec->active)
                 return -EBUSY;
 
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 91d3c6dbeba3..53edd9a8c758 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -1973,7 +1973,7 @@ static int wm8962_reset(struct snd_soc_codec *codec)
 static const DECLARE_TLV_DB_SCALE(inpga_tlv, -2325, 75, 0);
 static const DECLARE_TLV_DB_SCALE(mixin_tlv, -1500, 300, 0);
 static const unsigned int mixinpga_tlv[] = {
-        TLV_DB_RANGE_HEAD(7),
+        TLV_DB_RANGE_HEAD(5),
         0, 1, TLV_DB_SCALE_ITEM(0, 600, 0),
         2, 2, TLV_DB_SCALE_ITEM(1300, 1300, 0),
         3, 4, TLV_DB_SCALE_ITEM(1800, 200, 0),
@@ -1988,7 +1988,7 @@ static const DECLARE_TLV_DB_SCALE(bypass_tlv, -1500, 300, 0);
 static const DECLARE_TLV_DB_SCALE(out_tlv, -12100, 100, 1);
 static const DECLARE_TLV_DB_SCALE(hp_tlv, -700, 100, 0);
 static const unsigned int classd_tlv[] = {
-        TLV_DB_RANGE_HEAD(7),
+        TLV_DB_RANGE_HEAD(2),
         0, 6, TLV_DB_SCALE_ITEM(0, 150, 0),
         7, 7, TLV_DB_SCALE_ITEM(1200, 0, 0),
 };
diff --git a/sound/soc/codecs/wm8993.c b/sound/soc/codecs/wm8993.c
index eec8e1435116..d1a142f48b09 100644
--- a/sound/soc/codecs/wm8993.c
+++ b/sound/soc/codecs/wm8993.c
@@ -512,7 +512,7 @@ static const DECLARE_TLV_DB_SCALE(drc_comp_threash, -4500, 75, 0);
 static const DECLARE_TLV_DB_SCALE(drc_comp_amp, -2250, 75, 0);
 static const DECLARE_TLV_DB_SCALE(drc_min_tlv, -1800, 600, 0);
 static const unsigned int drc_max_tlv[] = {
-        TLV_DB_RANGE_HEAD(4),
+        TLV_DB_RANGE_HEAD(2),
         0, 2, TLV_DB_SCALE_ITEM(1200, 600, 0),
         3, 3, TLV_DB_SCALE_ITEM(3600, 0, 0),
 };
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 9c982e47eb99..6c2988549003 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -2357,6 +2357,11 @@ static int wm8994_hw_params(struct snd_pcm_substream *substream,
         bclk |= best << WM8994_AIF1_BCLK_DIV_SHIFT;
 
         lrclk = bclk_rate / params_rate(params);
+        if (!lrclk) {
+                dev_err(dai->dev, "Unable to generate LRCLK from %dHz BCLK\n",
+                        bclk_rate);
+                return -EINVAL;
+        }
         dev_dbg(dai->dev, "Using LRCLK rate %d for actual LRCLK %dHz\n",
                 lrclk, bclk_rate / lrclk);
 
@@ -3178,6 +3183,8 @@ static int wm8994_codec_probe(struct snd_soc_codec *codec)
                 switch (wm8994->revision) {
                 case 0:
                 case 1:
+                case 2:
+                case 3:
                         wm8994->hubs.dcs_codes_l = -9;
                         wm8994->hubs.dcs_codes_r = -5;
                         break;
diff --git a/sound/soc/codecs/wm9081.c b/sound/soc/codecs/wm9081.c
index 3cd35a02c28c..4a398c3bfe84 100644
--- a/sound/soc/codecs/wm9081.c
+++ b/sound/soc/codecs/wm9081.c
@@ -807,7 +807,6 @@ static int wm9081_set_bias_level(struct snd_soc_codec *codec,
                         mdelay(100);
 
                         /* Normal bias enable & soft start off */
-                        reg |= WM9081_BIAS_ENA;
                         reg &= ~WM9081_VMID_RAMP;
                         snd_soc_write(codec, WM9081_VMID_CONTROL, reg);
 
@@ -818,7 +817,7 @@ static int wm9081_set_bias_level(struct snd_soc_codec *codec,
                 }
 
                 /* VMID 2*240k */
-                reg = snd_soc_read(codec, WM9081_BIAS_CONTROL_1);
+                reg = snd_soc_read(codec, WM9081_VMID_CONTROL);
                 reg &= ~WM9081_VMID_SEL_MASK;
                 reg |= 0x04;
                 snd_soc_write(codec, WM9081_VMID_CONTROL, reg);
@@ -830,14 +829,15 @@ static int wm9081_set_bias_level(struct snd_soc_codec *codec,
                 break;
 
         case SND_SOC_BIAS_OFF:
-                /* Startup bias source */
+                /* Startup bias source and disable bias */
                 reg = snd_soc_read(codec, WM9081_BIAS_CONTROL_1);
                 reg |= WM9081_BIAS_SRC;
+                reg &= ~WM9081_BIAS_ENA;
                 snd_soc_write(codec, WM9081_BIAS_CONTROL_1, reg);
 
-                /* Disable VMID and biases with soft ramping */
+                /* Disable VMID with soft ramping */
                 reg = snd_soc_read(codec, WM9081_VMID_CONTROL);
-                reg &= ~(WM9081_VMID_SEL_MASK | WM9081_BIAS_ENA);
+                reg &= ~WM9081_VMID_SEL_MASK;
                 reg |= WM9081_VMID_RAMP;
                 snd_soc_write(codec, WM9081_VMID_CONTROL, reg);
 
diff --git a/sound/soc/codecs/wm9090.c b/sound/soc/codecs/wm9090.c
index 2b5252c9e377..f94c06057c64 100644
--- a/sound/soc/codecs/wm9090.c
+++ b/sound/soc/codecs/wm9090.c
@@ -177,19 +177,19 @@ static void wait_for_dc_servo(struct snd_soc_codec *codec)
 }
 
 static const unsigned int in_tlv[] = {
-        TLV_DB_RANGE_HEAD(6),
+        TLV_DB_RANGE_HEAD(3),
         0, 0, TLV_DB_SCALE_ITEM(-600, 0, 0),
         1, 3, TLV_DB_SCALE_ITEM(-350, 350, 0),
         4, 6, TLV_DB_SCALE_ITEM(600, 600, 0),
 };
 static const unsigned int mix_tlv[] = {
-        TLV_DB_RANGE_HEAD(4),
+        TLV_DB_RANGE_HEAD(2),
         0, 2, TLV_DB_SCALE_ITEM(-1200, 300, 0),
         3, 3, TLV_DB_SCALE_ITEM(0, 0, 0),
 };
 static const DECLARE_TLV_DB_SCALE(out_tlv, -5700, 100, 0);
 static const unsigned int spkboost_tlv[] = {
-        TLV_DB_RANGE_HEAD(7),
+        TLV_DB_RANGE_HEAD(2),
         0, 6, TLV_DB_SCALE_ITEM(0, 150, 0),
         7, 7, TLV_DB_SCALE_ITEM(1200, 0, 0),
 };
diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
index 84f33d4ea2cd..48e61e912400 100644
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -40,7 +40,7 @@ static const DECLARE_TLV_DB_SCALE(outmix_tlv, -2100, 300, 0);
 static const DECLARE_TLV_DB_SCALE(spkmixout_tlv, -1800, 600, 1);
 static const DECLARE_TLV_DB_SCALE(outpga_tlv, -5700, 100, 0);
 static const unsigned int spkboost_tlv[] = {
-        TLV_DB_RANGE_HEAD(7),
+        TLV_DB_RANGE_HEAD(2),
         0, 6, TLV_DB_SCALE_ITEM(0, 150, 0),
         7, 7, TLV_DB_SCALE_ITEM(1200, 0, 0),
 };
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index 0268cf989736..83c4bd5b2dd7 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -694,6 +694,7 @@ static int __devinit fsl_ssi_probe(struct platform_device *pdev)
 
         /* Initialize the the device_attribute structure */
         dev_attr = &ssi_private->dev_attr;
+        sysfs_attr_init(&dev_attr->attr);
         dev_attr->attr.name = "statistics";
         dev_attr->attr.mode = S_IRUGO;
         dev_attr->show = fsl_sysfs_ssi_show;
diff --git a/sound/soc/fsl/mpc8610_hpcd.c b/sound/soc/fsl/mpc8610_hpcd.c
index 31af405bda84..ae49f1c78c6d 100644
--- a/sound/soc/fsl/mpc8610_hpcd.c
+++ b/sound/soc/fsl/mpc8610_hpcd.c
@@ -392,7 +392,8 @@ static int mpc8610_hpcd_probe(struct platform_device *pdev)
         }
 
         if (strcasecmp(sprop, "i2s-slave") == 0) {
-                machine_data->dai_format = SND_SOC_DAIFMT_I2S;
+                machine_data->dai_format =
+                        SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_CBM_CFM;
                 machine_data->codec_clk_direction = SND_SOC_CLOCK_OUT;
                 machine_data->cpu_clk_direction = SND_SOC_CLOCK_IN;
 
@@ -409,31 +410,38 @@ static int mpc8610_hpcd_probe(struct platform_device *pdev)
                 }
                 machine_data->clk_frequency = be32_to_cpup(iprop);
         } else if (strcasecmp(sprop, "i2s-master") == 0) {
-                machine_data->dai_format = SND_SOC_DAIFMT_I2S;
+                machine_data->dai_format =
+                        SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_CBS_CFS;
                 machine_data->codec_clk_direction = SND_SOC_CLOCK_IN;
                 machine_data->cpu_clk_direction = SND_SOC_CLOCK_OUT;
         } else if (strcasecmp(sprop, "lj-slave") == 0) {
-                machine_data->dai_format = SND_SOC_DAIFMT_LEFT_J;
+                machine_data->dai_format =
+                        SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_CBM_CFM;
                 machine_data->codec_clk_direction = SND_SOC_CLOCK_OUT;
                 machine_data->cpu_clk_direction = SND_SOC_CLOCK_IN;
         } else if (strcasecmp(sprop, "lj-master") == 0) {
-                machine_data->dai_format = SND_SOC_DAIFMT_LEFT_J;
+                machine_data->dai_format =
+                        SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_CBS_CFS;
                 machine_data->codec_clk_direction = SND_SOC_CLOCK_IN;
                 machine_data->cpu_clk_direction = SND_SOC_CLOCK_OUT;
         } else if (strcasecmp(sprop, "rj-slave") == 0) {
-                machine_data->dai_format = SND_SOC_DAIFMT_RIGHT_J;
+                machine_data->dai_format =
+                        SND_SOC_DAIFMT_RIGHT_J | SND_SOC_DAIFMT_CBM_CFM;
                 machine_data->codec_clk_direction = SND_SOC_CLOCK_OUT;
                 machine_data->cpu_clk_direction = SND_SOC_CLOCK_IN;
         } else if (strcasecmp(sprop, "rj-master") == 0) {
-                machine_data->dai_format = SND_SOC_DAIFMT_RIGHT_J;
+                machine_data->dai_format =
+                        SND_SOC_DAIFMT_RIGHT_J | SND_SOC_DAIFMT_CBS_CFS;
                 machine_data->codec_clk_direction = SND_SOC_CLOCK_IN;
                 machine_data->cpu_clk_direction = SND_SOC_CLOCK_OUT;
         } else if (strcasecmp(sprop, "ac97-slave") == 0) {
-                machine_data->dai_format = SND_SOC_DAIFMT_AC97;
+                machine_data->dai_format =
+                        SND_SOC_DAIFMT_AC97 | SND_SOC_DAIFMT_CBM_CFM;
                 machine_data->codec_clk_direction = SND_SOC_CLOCK_OUT;
                 machine_data->cpu_clk_direction = SND_SOC_CLOCK_IN;
         } else if (strcasecmp(sprop, "ac97-master") == 0) {
-                machine_data->dai_format = SND_SOC_DAIFMT_AC97;
+                machine_data->dai_format =
+                        SND_SOC_DAIFMT_AC97 | SND_SOC_DAIFMT_CBS_CFS;
                 machine_data->codec_clk_direction = SND_SOC_CLOCK_IN;
                 machine_data->cpu_clk_direction = SND_SOC_CLOCK_OUT;
         } else {
diff --git a/sound/soc/nuc900/nuc900-ac97.c b/sound/soc/nuc900/nuc900-ac97.c
index 9c0edad90d8b..a4e3237956e2 100644
--- a/sound/soc/nuc900/nuc900-ac97.c
+++ b/sound/soc/nuc900/nuc900-ac97.c
@@ -365,7 +365,8 @@ static int __devinit nuc900_ac97_drvprobe(struct platform_device *pdev)
         if (ret)
                 goto out3;
 
-        mfp_set_groupg(nuc900_audio->dev); /* enbale ac97 multifunction pin*/
+        /* enbale ac97 multifunction pin */
+        mfp_set_groupg(nuc900_audio->dev, "nuc900-audio");
 
         return 0;
 
diff --git a/sound/soc/samsung/smdk_wm8994.c b/sound/soc/samsung/smdk_wm8994.c
index f75e43997d5b..ad9ac42522e2 100644
--- a/sound/soc/samsung/smdk_wm8994.c
+++ b/sound/soc/samsung/smdk_wm8994.c
@@ -9,6 +9,7 @@
 
 #include "../codecs/wm8994.h"
 #include <sound/pcm_params.h>
+#include <linux/module.h>
 
  /*
   * Default CFG switch settings to use this driver:
diff --git a/sound/soc/samsung/speyside.c b/sound/soc/samsung/speyside.c
index 85bf541a771d..4b8e35410eb1 100644
--- a/sound/soc/samsung/speyside.c
+++ b/sound/soc/samsung/speyside.c
@@ -191,7 +191,7 @@ static int speyside_late_probe(struct snd_soc_card *card)
         snd_soc_dapm_ignore_suspend(&card->dapm, "Headset Mic");
         snd_soc_dapm_ignore_suspend(&card->dapm, "Main AMIC");
         snd_soc_dapm_ignore_suspend(&card->dapm, "Main DMIC");
-        snd_soc_dapm_ignore_suspend(&card->dapm, "Speaker");
+        snd_soc_dapm_ignore_suspend(&card->dapm, "Main Speaker");
         snd_soc_dapm_ignore_suspend(&card->dapm, "WM1250 Output");
         snd_soc_dapm_ignore_suspend(&card->dapm, "WM1250 Input");
 
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index a5d3685a5d38..a25fa63ce9a2 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -709,6 +709,12 @@ int snd_soc_resume(struct device *dev)
         struct snd_soc_card *card = dev_get_drvdata(dev);
         int i, ac97_control = 0;
 
+        /* If the initialization of this soc device failed, there is no codec
+         * associated with it. Just bail out in this case.
+         */
+        if (list_empty(&card->codec_dev_list))
+                return 0;
+
         /* AC97 devices might have other drivers hanging off them so
          * need to resume immediately.  Other drivers don't have that
          * problem and may take a substantial amount of time to resume
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index b61945f3af9e..32d2a21f2e3b 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -1633,6 +1633,37 @@ YAMAHA_DEVICE(0x7010, "UB99"),
         }
 },
 {
+        /* Roland GAIA SH-01 */
+        USB_DEVICE(0x0582, 0x0111),
+        .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+                .vendor_name = "Roland",
+                .product_name = "GAIA",
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_COMPOSITE,
+                .data = (const struct snd_usb_audio_quirk[]) {
+                        {
+                                .ifnum = 0,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 1,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 2,
+                                .type = QUIRK_MIDI_FIXED_ENDPOINT,
+                                .data = &(const struct snd_usb_midi_endpoint_info) {
+                                .out_cables = 0x0003,
+                                .in_cables  = 0x0003
+                                }
+                        },
+                        {
+                                .ifnum = -1
+                        }
+                }
+        }
+},
+{
         USB_DEVICE(0x0582, 0x0113),
         .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
                 /* .vendor_name = "BOSS", */