87 files changed, 939 insertions, 513 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index 60299a9a7adb..8dca9d89c6c1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2239,8 +2239,7 @@ S:	Maintained
 F:      drivers/media/video/gspca/pac207.c
 GSPCA SN9C20X SUBDRIVER
-P:      Brian Johnson
+M:      Brian Johnson <brijohn@gmail.com>
-M:      brijohn@gmail.com
 L:      linux-media@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
 S:      Maintained
diff --git a/arch/ia64/kernel/dma-mapping.c b/arch/ia64/kernel/dma-mapping.c
index 39a3cd0a4173..f2c1600da097 100644
--- a/arch/ia64/kernel/dma-mapping.c
+++ b/arch/ia64/kernel/dma-mapping.c
@@ -10,7 +10,9 @@ EXPORT_SYMBOL(dma_ops);
 static int __init dma_init(void)
 {
-       dma_debug_init(PREALLOC_DMA_DEBUG_ENTRIES);
+        dma_debug_init(PREALLOC_DMA_DEBUG_ENTRIES);
+        return 0;
 }
 fs_initcall(dma_init);
diff --git a/arch/ia64/lib/ip_fast_csum.S b/arch/ia64/lib/ip_fast_csum.S
index 1f86aeb2c948..620d9dc5220f 100644
--- a/arch/ia64/lib/ip_fast_csum.S
+++ b/arch/ia64/lib/ip_fast_csum.S
@@ -96,20 +96,22 @@ END(ip_fast_csum)
 GLOBAL_ENTRY(csum_ipv6_magic)
        ld4     r20=[in0],4
        ld4     r21=[in1],4
-        dep     r15=in3,in2,32,16
+        zxt4    in2=in2
        ;;
        ld4     r22=[in0],4
        ld4     r23=[in1],4
-        mux1    r15=r15,@rev
+        dep     r15=in3,in2,32,16
        ;;
        ld4     r24=[in0],4
        ld4     r25=[in1],4
-        shr.u   r15=r15,16
+        mux1    r15=r15,@rev
        add     r16=r20,r21
        add     r17=r22,r23
+        zxt4    in4=in4
        ;;
        ld4     r26=[in0],4
        ld4     r27=[in1],4
+        shr.u   r15=r15,16
        add     r18=r24,r25
        add     r8=r16,r17
        ;;
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index 528f0ff9b273..8b58bf0b7d5a 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -532,7 +532,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
                /* Kill the user process later */
                regs->iaoq[0] = 0 | 3;
                regs->iaoq[1] = regs->iaoq[0] + 4;
-                regs->iasq[0] = regs->iasq[0] = regs->sr[7];
+                regs->iasq[0] = regs->iasq[1] = regs->sr[7];
                regs->gr[0] &= ~PSW_B;
                return;
        }
diff --git a/arch/powerpc/kernel/power7-pmu.c b/arch/powerpc/kernel/power7-pmu.c
index 388cf57ad827..018d094d92f9 100644
--- a/arch/powerpc/kernel/power7-pmu.c
+++ b/arch/powerpc/kernel/power7-pmu.c
@@ -317,7 +317,7 @@ static int power7_generic_events[] = {
 */
 static int power7_cache_events[C(MAX)][C(OP_MAX)][C(RESULT_MAX)] = {
        [C(L1D)] = {            /*      RESULT_ACCESS   RESULT_MISS */
-                [C(OP_READ)] = {        0x400f0,        0xc880  },
+                [C(OP_READ)] = {        0xc880,         0x400f0 },
                [C(OP_WRITE)] = {       0,              0x300f0 },
                [C(OP_PREFETCH)] = {    0xd8b8,         0       },
        },
@@ -327,8 +327,8 @@ static int power7_cache_events[C(MAX)][C(OP_MAX)][C(RESULT_MAX)] = {
                [C(OP_PREFETCH)] = {    0x408a,         0       },
        },
        [C(LL)] = {             /*      RESULT_ACCESS   RESULT_MISS */
-                [C(OP_READ)] = {        0x6080,         0x6084  },
+                [C(OP_READ)] = {        0x16080,        0x26080 },
-                [C(OP_WRITE)] = {       0x6082,         0x6086  },
+                [C(OP_WRITE)] = {       0x16082,        0x26082 },
                [C(OP_PREFETCH)] = {    0,              0       },
        },
        [C(DTLB)] = {           /*      RESULT_ACCESS   RESULT_MISS */
diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
index f0ee79055409..8daab33fc17d 100644
--- a/arch/sparc/kernel/irq_64.c
+++ b/arch/sparc/kernel/irq_64.c
@@ -886,7 +886,7 @@ void notrace init_irqwork_curcpu(void)
 * Therefore you cannot make any OBP calls, not even prom_printf,
 * from these two routines.
 */
-static void __cpuinit register_one_mondo(unsigned long paddr, unsigned long type, unsigned long qmask)
+static void __cpuinit notrace register_one_mondo(unsigned long paddr, unsigned long type, unsigned long qmask)
 {
        unsigned long num_entries = (qmask + 1) / 64;
        unsigned long status;
diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
index 2c0cc72d295b..b75bf502cd42 100644
--- a/arch/sparc/kernel/nmi.c
+++ b/arch/sparc/kernel/nmi.c
@@ -103,7 +103,7 @@ notrace __kprobes void perfctr_irq(int irq, struct pt_regs *regs)
        }
        if (!touched && __get_cpu_var(last_irq_sum) == sum) {
                local_inc(&__get_cpu_var(alert_counter));
-                if (local_read(&__get_cpu_var(alert_counter)) == 5 * nmi_hz)
+                if (local_read(&__get_cpu_var(alert_counter)) == 30 * nmi_hz)
                        die_nmi("BUG: NMI Watchdog detected LOCKUP",
                                regs, panic_on_timeout);
        } else {
diff --git a/arch/sparc/prom/misc_64.c b/arch/sparc/prom/misc_64.c
index eedffb4fec2d..39fc6af21b7c 100644
--- a/arch/sparc/prom/misc_64.c
+++ b/arch/sparc/prom/misc_64.c
@@ -88,7 +88,7 @@ void prom_cmdline(void)
 /* Drop into the prom, but completely terminate the program.
 * No chance of continuing.
 */
-void prom_halt(void)
+void notrace prom_halt(void)
 {
 #ifdef CONFIG_SUN_LDOMS
        if (ldom_domaining_enabled)
diff --git a/arch/sparc/prom/printf.c b/arch/sparc/prom/printf.c
index 660943ee4c2a..ca869266b9f3 100644
--- a/arch/sparc/prom/printf.c
+++ b/arch/sparc/prom/printf.c
@@ -14,14 +14,14 @@
 */
 #include <linux/kernel.h>
+#include <linux/compiler.h>
 #include <asm/openprom.h>
 #include <asm/oplib.h>
 static char ppbuf[1024];
-void
+void notrace prom_write(const char *buf, unsigned int n)
-prom_write(const char *buf, unsigned int n)
 {
        char ch;
@@ -33,8 +33,7 @@ prom_write(const char *buf, unsigned int n)
        }
 }
-void
+void notrace prom_printf(const char *fmt, ...)
-prom_printf(const char *fmt, ...)
 {
        va_list args;
        int i;
diff --git a/arch/x86/kernel/apic/probe_64.c b/arch/x86/kernel/apic/probe_64.c
index bc3e880f9b82..fcec2f1d34a1 100644
--- a/arch/x86/kernel/apic/probe_64.c
+++ b/arch/x86/kernel/apic/probe_64.c
@@ -44,6 +44,11 @@ static struct apic *apic_probe[] __initdata = {
        NULL,
 };
+static int apicid_phys_pkg_id(int initial_apic_id, int index_msb)
+{
+        return hard_smp_processor_id() >> index_msb;
+}
 /*
 * Check the APIC IDs in bios_cpu_apicid and choose the APIC mode.
 */
@@ -69,6 +74,11 @@ void __init default_setup_apic_routing(void)
                printk(KERN_INFO "Setting APIC routing to %s\n", apic->name);
        }
+        if (is_vsmp_box()) {
+                /* need to update phys_pkg_id */
+                apic->phys_pkg_id = apicid_phys_pkg_id;
+        }
        /*
         * Now that apic routing model is selected, configure the
         * fault handling for intr remapping.
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index e90540a46a0b..eb33aaa8415d 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -215,6 +215,7 @@ static __init void xen_init_cpuid_mask(void)
                          (1 << X86_FEATURE_ACPI));  /* disable ACPI */
        ax = 1;
+        cx = 0;
        xen_cpuid(&ax, &bx, &cx, &dx);
        /* cpuid claims we support xsave; try enabling it to see what happens */
@@ -1059,6 +1060,7 @@ asmlinkage void __init xen_start_kernel(void)
        /* set up basic CPUID stuff */
        cpu_detect(&new_cpu_data);
        new_cpu_data.hard_math = 1;
+        new_cpu_data.wp_works_ok = 1;
        new_cpu_data.x86_capability[0] = cpuid_edx(1);
 #endif
diff --git a/crypto/algapi.c b/crypto/algapi.c
index 56c62e2858d5..df0863d56995 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -692,7 +692,7 @@ out:
 }
 EXPORT_SYMBOL_GPL(crypto_enqueue_request);
-struct crypto_async_request *crypto_dequeue_request(struct crypto_queue *queue)
+void *__crypto_dequeue_request(struct crypto_queue *queue, unsigned int offset)
 {
        struct list_head *request;
@@ -707,7 +707,14 @@ struct crypto_async_request *crypto_dequeue_request(struct crypto_queue *queue)
        request = queue->list.next;
        list_del(request);
-        return list_entry(request, struct crypto_async_request, list);
+        return (char *)list_entry(request, struct crypto_async_request, list) -
+               offset;
+}
+EXPORT_SYMBOL_GPL(__crypto_dequeue_request);
+struct crypto_async_request *crypto_dequeue_request(struct crypto_queue *queue)
+{
+        return __crypto_dequeue_request(queue, 0);
 }
 EXPORT_SYMBOL_GPL(crypto_dequeue_request);
diff --git a/drivers/acpi/acpica/exstorob.c b/drivers/acpi/acpica/exstorob.c
index 67340cc70142..257706e7734f 100644
--- a/drivers/acpi/acpica/exstorob.c
+++ b/drivers/acpi/acpica/exstorob.c
@@ -70,6 +70,12 @@ acpi_ex_store_buffer_to_buffer(union acpi_operand_object *source_desc,
        ACPI_FUNCTION_TRACE_PTR(ex_store_buffer_to_buffer, source_desc);
+        /* If Source and Target are the same, just return */
+        if (source_desc == target_desc) {
+                return_ACPI_STATUS(AE_OK);
+        }
        /* We know that source_desc is a buffer by now */
        buffer = ACPI_CAST_PTR(u8, source_desc->buffer.pointer);
@@ -161,6 +167,12 @@ acpi_ex_store_string_to_string(union acpi_operand_object *source_desc,
        ACPI_FUNCTION_TRACE_PTR(ex_store_string_to_string, source_desc);
+        /* If Source and Target are the same, just return */
+        if (source_desc == target_desc) {
+                return_ACPI_STATUS(AE_OK);
+        }
        /* We know that source_desc is a string by now */
        buffer = ACPI_CAST_PTR(u8, source_desc->string.pointer);
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 8851315ce858..60ea984c84a0 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -2004,8 +2004,11 @@ static int acpi_video_bus_put_one_device(struct acpi_video_device *device)
        status = acpi_remove_notify_handler(device->dev->handle,
                                            ACPI_DEVICE_NOTIFY,
                                            acpi_video_device_notify);
-        sysfs_remove_link(&device->backlight->dev.kobj, "device");
+        if (device->backlight) {
-        backlight_device_unregister(device->backlight);
+                sysfs_remove_link(&device->backlight->dev.kobj, "device");
+                backlight_device_unregister(device->backlight);
+                device->backlight = NULL;
+        }
        if (device->cdev) {
                sysfs_remove_link(&device->dev->dev.kobj,
                                  "thermal_cooling");
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 56b8a3ff1286..9ac4e378992e 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -664,6 +664,8 @@ static int piix_pata_prereset(struct ata_link *link, unsigned long deadline)
        return ata_sff_prereset(link, deadline);
 }
+static DEFINE_SPINLOCK(piix_lock);
 /**
 *      piix_set_piomode - Initialize host controller PATA PIO timings
 *      @ap: Port whose timings we are configuring
@@ -677,8 +679,9 @@ static int piix_pata_prereset(struct ata_link *link, unsigned long deadline)
 static void piix_set_piomode(struct ata_port *ap, struct ata_device *adev)
 {
-        unsigned int pio        = adev->pio_mode - XFER_PIO_0;
        struct pci_dev *dev     = to_pci_dev(ap->host->dev);
+        unsigned long flags;
+        unsigned int pio        = adev->pio_mode - XFER_PIO_0;
        unsigned int is_slave   = (adev->devno != 0);
        unsigned int master_port= ap->port_no ? 0x42 : 0x40;
        unsigned int slave_port = 0x44;
@@ -708,6 +711,8 @@ static void piix_set_piomode(struct ata_port *ap, struct ata_device *adev)
        if (adev->class == ATA_DEV_ATA)
                control |= 4;   /* PPE enable */
+        spin_lock_irqsave(&piix_lock, flags);
        /* PIO configuration clears DTE unconditionally.  It will be
         * programmed in set_dmamode which is guaranteed to be called
         * after set_piomode if any DMA mode is available.
@@ -747,6 +752,8 @@ static void piix_set_piomode(struct ata_port *ap, struct ata_device *adev)
                udma_enable &= ~(1 << (2 * ap->port_no + adev->devno));
                pci_write_config_byte(dev, 0x48, udma_enable);
        }
+        spin_unlock_irqrestore(&piix_lock, flags);
 }
 /**
@@ -764,6 +771,7 @@ static void piix_set_piomode(struct ata_port *ap, struct ata_device *adev)
 static void do_pata_set_dmamode(struct ata_port *ap, struct ata_device *adev, int isich)
 {
        struct pci_dev *dev     = to_pci_dev(ap->host->dev);
+        unsigned long flags;
        u8 master_port          = ap->port_no ? 0x42 : 0x40;
        u16 master_data;
        u8 speed                = adev->dma_mode;
@@ -777,6 +785,8 @@ static void do_pata_set_dmamode(struct ata_port *ap, struct ata_device *adev, in
                            { 2, 1 },
                            { 2, 3 }, };
+        spin_lock_irqsave(&piix_lock, flags);
        pci_read_config_word(dev, master_port, &master_data);
        if (ap->udma_mask)
                pci_read_config_byte(dev, 0x48, &udma_enable);
@@ -867,6 +877,8 @@ static void do_pata_set_dmamode(struct ata_port *ap, struct ata_device *adev, in
        /* Don't scribble on 0x48 if the controller does not support UDMA */
        if (ap->udma_mask)
                pci_write_config_byte(dev, 0x48, udma_enable);
+        spin_unlock_irqrestore(&piix_lock, flags);
 }
 /**
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index 973be2f44195..4e28b35024ec 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -300,8 +300,7 @@ static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
                        if (space < 2)
                                return -1;
                        tty->canon_column = tty->column = 0;
-                        tty_put_char(tty, '\r');
+                        tty->ops->write(tty, "\r\n", 2);
-                        tty_put_char(tty, c);
                        return 2;
                }
                tty->canon_column = tty->column;
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index d083c73d784a..b33d6688e910 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -109,21 +109,13 @@ static int pty_space(struct tty_struct *to)
 *      the other side of the pty/tty pair.
 */
-static int pty_write(struct tty_struct *tty, const unsigned char *buf,
+static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
-                                                                int count)
 {
        struct tty_struct *to = tty->link;
-        int c;
        if (tty->stopped)
                return 0;
-        /* This isn't locked but our 8K is quite sloppy so no
-           big deal */
-        c = pty_space(to);
-        if (c > count)
-                c = count;
        if (c > 0) {
                /* Stuff the data into the input queue of the other end */
                c = tty_insert_flip_string(to, buf, c);
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index fd69086d08d5..2968ed6a9c49 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1250,20 +1250,11 @@ static int cpufreq_suspend(struct sys_device *sysdev, pm_message_t pmsg)
 {
        int ret = 0;
-#ifdef __powerpc__
        int cpu = sysdev->id;
-        unsigned int cur_freq = 0;
        struct cpufreq_policy *cpu_policy;
        dprintk("suspending cpu %u\n", cpu);
-        /*
-         * This whole bogosity is here because Powerbooks are made of fail.
-         * No sane platform should need any of the code below to be run.
-         * (it's entirely the wrong thing to do, as driver->get may
-         *  reenable interrupts on some architectures).
-         */
        if (!cpu_online(cpu))
                return 0;
@@ -1282,47 +1273,13 @@ static int cpufreq_suspend(struct sys_device *sysdev, pm_message_t pmsg)
        if (cpufreq_driver->suspend) {
                ret = cpufreq_driver->suspend(cpu_policy, pmsg);
-                if (ret) {
+                if (ret)
                        printk(KERN_ERR "cpufreq: suspend failed in ->suspend "
                                        "step on CPU %u\n", cpu_policy->cpu);
-                        goto out;
-                }
-        }
-        if (cpufreq_driver->flags & CPUFREQ_CONST_LOOPS)
-                goto out;
-        if (cpufreq_driver->get)
-                cur_freq = cpufreq_driver->get(cpu_policy->cpu);
-        if (!cur_freq || !cpu_policy->cur) {
-                printk(KERN_ERR "cpufreq: suspend failed to assert current "
-                       "frequency is what timing core thinks it is.\n");
-                goto out;
-        }
-        if (unlikely(cur_freq != cpu_policy->cur)) {
-                struct cpufreq_freqs freqs;
-                if (!(cpufreq_driver->flags & CPUFREQ_PM_NO_WARN))
-                        dprintk("Warning: CPU frequency is %u, "
-                               "cpufreq assumed %u kHz.\n",
-                               cur_freq, cpu_policy->cur);
-                freqs.cpu = cpu;
-                freqs.old = cpu_policy->cur;
-                freqs.new = cur_freq;
-                srcu_notifier_call_chain(&cpufreq_transition_notifier_list,
-                                    CPUFREQ_SUSPENDCHANGE, &freqs);
-                adjust_jiffies(CPUFREQ_SUSPENDCHANGE, &freqs);
-                cpu_policy->cur = cur_freq;
        }
 out:
        cpufreq_cpu_put(cpu_policy);
-#endif  /* __powerpc__ */
        return ret;
 }
@@ -1330,24 +1287,21 @@ out:
 *      cpufreq_resume -  restore proper CPU frequency handling after resume
 *
 *      1.) resume CPUfreq hardware support (cpufreq_driver->resume())
- *      2.) if ->target and !CPUFREQ_CONST_LOOPS: verify we're in sync
+ *      2.) schedule call cpufreq_update_policy() ASAP as interrupts are
- *      3.) schedule call cpufreq_update_policy() ASAP as interrupts are
+ *          restored. It will verify that the current freq is in sync with
- *          restored.
+ *          what we believe it to be. This is a bit later than when it
+ *          should be, but nonethteless it's better than calling
+ *          cpufreq_driver->get() here which might re-enable interrupts...
 */
 static int cpufreq_resume(struct sys_device *sysdev)
 {
        int ret = 0;
-#ifdef __powerpc__
        int cpu = sysdev->id;
        struct cpufreq_policy *cpu_policy;
        dprintk("resuming cpu %u\n", cpu);
-        /* As with the ->suspend method, all the code below is
-         * only necessary because Powerbooks suck.
-         * See commit 42d4dc3f4e1e for jokes. */
        if (!cpu_online(cpu))
                return 0;
@@ -1373,45 +1327,10 @@ static int cpufreq_resume(struct sys_device *sysdev)
                }
        }
-        if (!(cpufreq_driver->flags & CPUFREQ_CONST_LOOPS)) {
-                unsigned int cur_freq = 0;
-                if (cpufreq_driver->get)
-                        cur_freq = cpufreq_driver->get(cpu_policy->cpu);
-                if (!cur_freq || !cpu_policy->cur) {
-                        printk(KERN_ERR "cpufreq: resume failed to assert "
-                                        "current frequency is what timing core "
-                                        "thinks it is.\n");
-                        goto out;
-                }
-                if (unlikely(cur_freq != cpu_policy->cur)) {
-                        struct cpufreq_freqs freqs;
-                        if (!(cpufreq_driver->flags & CPUFREQ_PM_NO_WARN))
-                                dprintk("Warning: CPU frequency "
-                                       "is %u, cpufreq assumed %u kHz.\n",
-                                       cur_freq, cpu_policy->cur);
-                        freqs.cpu = cpu;
-                        freqs.old = cpu_policy->cur;
-                        freqs.new = cur_freq;
-                        srcu_notifier_call_chain(
-                                        &cpufreq_transition_notifier_list,
-                                        CPUFREQ_RESUMECHANGE, &freqs);
-                        adjust_jiffies(CPUFREQ_RESUMECHANGE, &freqs);
-                        cpu_policy->cur = cur_freq;
-                }
-        }
-out:
        schedule_work(&cpu_policy->update);
 fail:
        cpufreq_cpu_put(cpu_policy);
-#endif  /* __powerpc__ */
        return ret;
 }
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 7537f57d8a87..5b4f87e55621 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -222,6 +222,7 @@ typedef struct drm_i915_private {
        unsigned int edp_support:1;
        int lvds_ssc_freq;
+        int crt_ddc_bus; /* -1 = unknown, else GPIO to use for CRT DDC */
        struct drm_i915_fence_reg fence_regs[16]; /* assume 965 */
        int fence_reg_start; /* 4 if userland hasn't ioctl'd us yet */
        int num_fence_regs; /* 8 on pre-965, 16 otherwise */
@@ -384,6 +385,9 @@ typedef struct drm_i915_private {
                 */
                struct list_head inactive_list;
+                /** LRU list of objects with fence regs on them. */
+                struct list_head fence_list;
                /**
                 * List of breadcrumbs associated with GPU requests currently
                 * outstanding.
@@ -451,6 +455,9 @@ struct drm_i915_gem_object {
        /** This object's place on the active/flushing/inactive lists */
        struct list_head list;
+        /** This object's place on the fenced object LRU */
+        struct list_head fence_list;
        /**
         * This is set if the object is on the active or flushing lists
         * (has pending rendering), and is not set if it's on inactive (ready
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 140bee142fc2..0c07a755b3a3 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -978,6 +978,7 @@ int
 i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
                          struct drm_file *file_priv)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_set_domain *args = data;
        struct drm_gem_object *obj;
        uint32_t read_domains = args->read_domains;
@@ -1010,8 +1011,18 @@ i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
                 obj, obj->size, read_domains, write_domain);
 #endif
        if (read_domains & I915_GEM_DOMAIN_GTT) {
+                struct drm_i915_gem_object *obj_priv = obj->driver_private;
                ret = i915_gem_object_set_to_gtt_domain(obj, write_domain != 0);
+                /* Update the LRU on the fence for the CPU access that's
+                 * about to occur.
+                 */
+                if (obj_priv->fence_reg != I915_FENCE_REG_NONE) {
+                        list_move_tail(&obj_priv->fence_list,
+                                       &dev_priv->mm.fence_list);
+                }
                /* Silently promote "you're not bound, there was nothing to do"
                 * to success, since the client was just asking us to
                 * make sure everything was done.
@@ -1155,8 +1166,7 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        }
        /* Need a new fence register? */
-        if (obj_priv->fence_reg == I915_FENCE_REG_NONE &&
+        if (obj_priv->tiling_mode != I915_TILING_NONE) {
-            obj_priv->tiling_mode != I915_TILING_NONE) {
                ret = i915_gem_object_get_fence_reg(obj);
                if (ret) {
                        mutex_unlock(&dev->struct_mutex);
@@ -2208,6 +2218,12 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
        struct drm_i915_gem_object *old_obj_priv = NULL;
        int i, ret, avail;
+        /* Just update our place in the LRU if our fence is getting used. */
+        if (obj_priv->fence_reg != I915_FENCE_REG_NONE) {
+                list_move_tail(&obj_priv->fence_list, &dev_priv->mm.fence_list);
+                return 0;
+        }
        switch (obj_priv->tiling_mode) {
        case I915_TILING_NONE:
                WARN(1, "allocating a fence for non-tiled object?\n");
@@ -2229,7 +2245,6 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
        }
        /* First try to find a free reg */
-try_again:
        avail = 0;
        for (i = dev_priv->fence_reg_start; i < dev_priv->num_fence_regs; i++) {
                reg = &dev_priv->fence_regs[i];
@@ -2243,52 +2258,41 @@ try_again:
        /* None available, try to steal one or wait for a user to finish */
        if (i == dev_priv->num_fence_regs) {
-                uint32_t seqno = dev_priv->mm.next_gem_seqno;
+                struct drm_gem_object *old_obj = NULL;
                if (avail == 0)
                        return -ENOSPC;
-                for (i = dev_priv->fence_reg_start;
+                list_for_each_entry(old_obj_priv, &dev_priv->mm.fence_list,
-                     i < dev_priv->num_fence_regs; i++) {
+                                    fence_list) {
-                        uint32_t this_seqno;
+                        old_obj = old_obj_priv->obj;
-                        reg = &dev_priv->fence_regs[i];
+                        reg = &dev_priv->fence_regs[old_obj_priv->fence_reg];
-                        old_obj_priv = reg->obj->driver_private;
                        if (old_obj_priv->pin_count)
                                continue;
+                        /* Take a reference, as otherwise the wait_rendering
+                         * below may cause the object to get freed out from
+                         * under us.
+                         */
+                        drm_gem_object_reference(old_obj);
                        /* i915 uses fences for GPU access to tiled buffers */
                        if (IS_I965G(dev) || !old_obj_priv->active)
                                break;
-                        /* find the seqno of the first available fence */
+                        /* This brings the object to the head of the LRU if it
-                        this_seqno = old_obj_priv->last_rendering_seqno;
+                         * had been written to.  The only way this should
-                        if (this_seqno != 0 &&
+                         * result in us waiting longer than the expected
-                            reg->obj->write_domain == 0 &&
+                         * optimal amount of time is if there was a
-                            i915_seqno_passed(seqno, this_seqno))
+                         * fence-using buffer later that was read-only.
-                                seqno = this_seqno;
+                         */
-                }
+                        i915_gem_object_flush_gpu_write_domain(old_obj);
+                        ret = i915_gem_object_wait_rendering(old_obj);
-                /*
+                        if (ret != 0)
-                 * Now things get ugly... we have to wait for one of the
-                 * objects to finish before trying again.
-                 */
-                if (i == dev_priv->num_fence_regs) {
-                        if (seqno == dev_priv->mm.next_gem_seqno) {
-                                i915_gem_flush(dev,
-                                               I915_GEM_GPU_DOMAINS,
-                                               I915_GEM_GPU_DOMAINS);
-                                seqno = i915_add_request(dev, NULL,
-                                                         I915_GEM_GPU_DOMAINS);
-                                if (seqno == 0)
-                                        return -ENOMEM;
-                        }
-                        ret = i915_wait_request(dev, seqno);
-                        if (ret)
                                return ret;
-                        goto try_again;
+                        break;
                }
                /*
@@ -2296,10 +2300,15 @@ try_again:
                 * for this object next time we need it.
                 */
                i915_gem_release_mmap(reg->obj);
+                i = old_obj_priv->fence_reg;
                old_obj_priv->fence_reg = I915_FENCE_REG_NONE;
+                list_del_init(&old_obj_priv->fence_list);
+                drm_gem_object_unreference(old_obj);
        }
        obj_priv->fence_reg = i;
+        list_add_tail(&obj_priv->fence_list, &dev_priv->mm.fence_list);
        reg->obj = obj;
        if (IS_I965G(dev))
@@ -2342,6 +2351,7 @@ i915_gem_clear_fence_reg(struct drm_gem_object *obj)
        dev_priv->fence_regs[obj_priv->fence_reg].obj = NULL;
        obj_priv->fence_reg = I915_FENCE_REG_NONE;
+        list_del_init(&obj_priv->fence_list);
 }
 /**
@@ -3595,9 +3605,7 @@ i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
         * Pre-965 chips need a fence register set up in order to
         * properly handle tiled surfaces.
         */
-        if (!IS_I965G(dev) &&
+        if (!IS_I965G(dev) && obj_priv->tiling_mode != I915_TILING_NONE) {
-            obj_priv->fence_reg == I915_FENCE_REG_NONE &&
-            obj_priv->tiling_mode != I915_TILING_NONE) {
                ret = i915_gem_object_get_fence_reg(obj);
                if (ret != 0) {
                        if (ret != -EBUSY && ret != -ERESTARTSYS)
@@ -3806,6 +3814,7 @@ int i915_gem_init_object(struct drm_gem_object *obj)
        obj_priv->obj = obj;
        obj_priv->fence_reg = I915_FENCE_REG_NONE;
        INIT_LIST_HEAD(&obj_priv->list);
+        INIT_LIST_HEAD(&obj_priv->fence_list);
        return 0;
 }
@@ -4253,6 +4262,7 @@ i915_gem_load(struct drm_device *dev)
        INIT_LIST_HEAD(&dev_priv->mm.flushing_list);
        INIT_LIST_HEAD(&dev_priv->mm.inactive_list);
        INIT_LIST_HEAD(&dev_priv->mm.request_list);
+        INIT_LIST_HEAD(&dev_priv->mm.fence_list);
        INIT_DELAYED_WORK(&dev_priv->mm.retire_work,
                          i915_gem_retire_work_handler);
        dev_priv->mm.next_gem_seqno = 1;
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 300aee3296c2..f806fcc54e09 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -59,6 +59,16 @@ find_section(struct bdb_header *bdb, int section_id)
        return NULL;
 }
+static u16
+get_blocksize(void *p)
+{
+        u16 *block_ptr, block_size;
+        block_ptr = (u16 *)((char *)p - 2);
+        block_size = *block_ptr;
+        return block_size;
+}
 static void
 fill_detail_timing_data(struct drm_display_mode *panel_fixed_mode,
                        struct lvds_dvo_timing *dvo_timing)
@@ -215,6 +225,41 @@ parse_general_features(struct drm_i915_private *dev_priv,
 }
 static void
+parse_general_definitions(struct drm_i915_private *dev_priv,
+                          struct bdb_header *bdb)
+{
+        struct bdb_general_definitions *general;
+        const int crt_bus_map_table[] = {
+                GPIOB,
+                GPIOA,
+                GPIOC,
+                GPIOD,
+                GPIOE,
+                GPIOF,
+        };
+        /* Set sensible defaults in case we can't find the general block
+           or it is the wrong chipset */
+        dev_priv->crt_ddc_bus = -1;
+        general = find_section(bdb, BDB_GENERAL_DEFINITIONS);
+        if (general) {
+                u16 block_size = get_blocksize(general);
+                if (block_size >= sizeof(*general)) {
+                        int bus_pin = general->crt_ddc_gmbus_pin;
+                        DRM_DEBUG("crt_ddc_bus_pin: %d\n", bus_pin);
+                        if ((bus_pin >= 1) && (bus_pin <= 6)) {
+                                dev_priv->crt_ddc_bus =
+                                        crt_bus_map_table[bus_pin-1];
+                        }
+                } else {
+                        DRM_DEBUG("BDB_GD too small (%d). Invalid.\n",
+                                  block_size);
+                }
+        }
+}
+static void
 parse_sdvo_device_mapping(struct drm_i915_private *dev_priv,
                       struct bdb_header *bdb)
 {
@@ -222,7 +267,7 @@ parse_sdvo_device_mapping(struct drm_i915_private *dev_priv,
        struct bdb_general_definitions *p_defs;
        struct child_device_config *p_child;
        int i, child_device_num, count;
-        u16     block_size, *block_ptr;
+        u16     block_size;
        p_defs = find_section(bdb, BDB_GENERAL_DEFINITIONS);
        if (!p_defs) {
@@ -240,8 +285,7 @@ parse_sdvo_device_mapping(struct drm_i915_private *dev_priv,
                return;
        }
        /* get the block size of general definitions */
-        block_ptr = (u16 *)((char *)p_defs - 2);
+        block_size = get_blocksize(p_defs);
-        block_size = *block_ptr;
        /* get the number of child device */
        child_device_num = (block_size - sizeof(*p_defs)) /
                                sizeof(*p_child);
@@ -362,6 +406,7 @@ intel_init_bios(struct drm_device *dev)
        /* Grab useful general definitions */
        parse_general_features(dev_priv, bdb);
+        parse_general_definitions(dev_priv, bdb);
        parse_lfp_panel_data(dev_priv, bdb);
        parse_sdvo_panel_data(dev_priv, bdb);
        parse_sdvo_device_mapping(dev_priv, bdb);
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 4cf8e2e88a40..590f81c8f594 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -508,6 +508,7 @@ void intel_crt_init(struct drm_device *dev)
 {
        struct drm_connector *connector;
        struct intel_output *intel_output;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 i2c_reg;
        intel_output = kzalloc(sizeof(struct intel_output), GFP_KERNEL);
@@ -527,8 +528,12 @@ void intel_crt_init(struct drm_device *dev)
        /* Set up the DDC bus. */
        if (IS_IGDNG(dev))
                i2c_reg = PCH_GPIOA;
-        else
+        else {
                i2c_reg = GPIOA;
+                /* Use VBT information for CRT DDC if available */
+                if (dev_priv->crt_ddc_bus != -1)
+                        i2c_reg = dev_priv->crt_ddc_bus;
+        }
        intel_output->ddc_bus = intel_i2c_create(dev, i2c_reg, "CRTDDC_A");
        if (!intel_output->ddc_bus) {
                dev_printk(KERN_ERR, &dev->pdev->dev, "DDC bus registration "
@@ -537,6 +542,10 @@ void intel_crt_init(struct drm_device *dev)
        }
        intel_output->type = INTEL_OUTPUT_ANALOG;
+        intel_output->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
+                                   (1 << INTEL_ANALOG_CLONE_BIT) |
+                                   (1 << INTEL_SDVO_LVDS_CLONE_BIT);
+        intel_output->crtc_mask = (1 << 0) | (1 << 1);
        connector->interlace_allowed = 0;
        connector->doublescan_allowed = 0;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index d6fce2133413..3fadb5358858 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -666,7 +666,7 @@ intel_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
        intel_clock_t clock;
        int err = target;
-        if (IS_I9XX(dev) && intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS) &&
+        if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS) &&
            (I915_READ(LVDS)) != 0) {
                /*
                 * For LVDS, if the panel is on, just rely on its current
@@ -2396,7 +2396,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                if (is_sdvo) {
                        dpll |= DPLL_DVO_HIGH_SPEED;
                        sdvo_pixel_multiply = adjusted_mode->clock / mode->clock;
-                        if (IS_I945G(dev) || IS_I945GM(dev))
+                        if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
                                dpll |= (sdvo_pixel_multiply - 1) << SDVO_MULTIPLIER_SHIFT_HIRES;
                        else if (IS_IGDNG(dev))
                                dpll |= (sdvo_pixel_multiply - 1) << PLL_REF_SDVO_HDMI_MULTIPLIER_SHIFT;
@@ -3170,7 +3170,7 @@ static int intel_connector_clones(struct drm_device *dev, int type_mask)
        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                struct intel_output *intel_output = to_intel_output(connector);
-                if (type_mask & (1 << intel_output->type))
+                if (type_mask & intel_output->clone_mask)
                        index_mask |= (1 << entry);
                entry++;
        }
@@ -3218,30 +3218,30 @@ static void intel_setup_outputs(struct drm_device *dev)
                        intel_dp_init(dev, PCH_DP_D);
        } else if (IS_I9XX(dev)) {
-                int found;
+                bool found = false;
-                u32 reg;
                if (I915_READ(SDVOB) & SDVO_DETECTED) {
                        found = intel_sdvo_init(dev, SDVOB);
                        if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
                                intel_hdmi_init(dev, SDVOB);
                        if (!found && SUPPORTS_INTEGRATED_DP(dev))
                                intel_dp_init(dev, DP_B);
                }
                /* Before G4X SDVOC doesn't have its own detect register */
-                if (IS_G4X(dev))
-                        reg = SDVOC;
-                else
-                        reg = SDVOB;
-                if (I915_READ(reg) & SDVO_DETECTED) {
+                if (I915_READ(SDVOB) & SDVO_DETECTED)
                        found = intel_sdvo_init(dev, SDVOC);
-                        if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
+                if (!found && (I915_READ(SDVOC) & SDVO_DETECTED)) {
+                        if (SUPPORTS_INTEGRATED_HDMI(dev))
                                intel_hdmi_init(dev, SDVOC);
-                        if (!found && SUPPORTS_INTEGRATED_DP(dev))
+                        if (SUPPORTS_INTEGRATED_DP(dev))
                                intel_dp_init(dev, DP_C);
                }
                if (SUPPORTS_INTEGRATED_DP(dev) && (I915_READ(DP_D) & DP_DETECTED))
                        intel_dp_init(dev, DP_D);
        } else
@@ -3253,51 +3253,10 @@ static void intel_setup_outputs(struct drm_device *dev)
        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                struct intel_output *intel_output = to_intel_output(connector);
                struct drm_encoder *encoder = &intel_output->enc;
-                int crtc_mask = 0, clone_mask = 0;
-                /* valid crtcs */
+                encoder->possible_crtcs = intel_output->crtc_mask;
-                switch(intel_output->type) {
+                encoder->possible_clones = intel_connector_clones(dev,
-                case INTEL_OUTPUT_HDMI:
+                                                intel_output->clone_mask);
-                        crtc_mask = ((1 << 0)|
-                                     (1 << 1));
-                        clone_mask = ((1 << INTEL_OUTPUT_HDMI));
-                        break;
-                case INTEL_OUTPUT_DVO:
-                case INTEL_OUTPUT_SDVO:
-                        crtc_mask = ((1 << 0)|
-                                     (1 << 1));
-                        clone_mask = ((1 << INTEL_OUTPUT_ANALOG) |
-                                      (1 << INTEL_OUTPUT_DVO) |
-                                      (1 << INTEL_OUTPUT_SDVO));
-                        break;
-                case INTEL_OUTPUT_ANALOG:
-                        crtc_mask = ((1 << 0)|
-                                     (1 << 1));
-                        clone_mask = ((1 << INTEL_OUTPUT_ANALOG) |
-                                      (1 << INTEL_OUTPUT_DVO) |
-                                      (1 << INTEL_OUTPUT_SDVO));
-                        break;
-                case INTEL_OUTPUT_LVDS:
-                        crtc_mask = (1 << 1);
-                        clone_mask = (1 << INTEL_OUTPUT_LVDS);
-                        break;
-                case INTEL_OUTPUT_TVOUT:
-                        crtc_mask = ((1 << 0) |
-                                     (1 << 1));
-                        clone_mask = (1 << INTEL_OUTPUT_TVOUT);
-                        break;
-                case INTEL_OUTPUT_DISPLAYPORT:
-                        crtc_mask = ((1 << 0) |
-                                     (1 << 1));
-                        clone_mask = (1 << INTEL_OUTPUT_DISPLAYPORT);
-                        break;
-                case INTEL_OUTPUT_EDP:
-                        crtc_mask = (1 << 1);
-                        clone_mask = (1 << INTEL_OUTPUT_EDP);
-                        break;
-                }
-                encoder->possible_crtcs = crtc_mask;
-                encoder->possible_clones = intel_connector_clones(dev, clone_mask);
        }
 }
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index a6ff15ac548a..f2afc4af4bc9 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1254,6 +1254,18 @@ intel_dp_init(struct drm_device *dev, int output_reg)
        else
                intel_output->type = INTEL_OUTPUT_DISPLAYPORT;
+        if (output_reg == DP_B)
+                intel_output->clone_mask = (1 << INTEL_DP_B_CLONE_BIT);
+        else if (output_reg == DP_C)
+                intel_output->clone_mask = (1 << INTEL_DP_C_CLONE_BIT);
+        else if (output_reg == DP_D)
+                intel_output->clone_mask = (1 << INTEL_DP_D_CLONE_BIT);
+        if (IS_eDP(intel_output)) {
+                intel_output->crtc_mask = (1 << 1);
+                intel_output->clone_mask = (1 << INTEL_OUTPUT_EDP);
+        } else
+                intel_output->crtc_mask = (1 << 0) | (1 << 1);
        connector->interlace_allowed = true;
        connector->doublescan_allowed = 0;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index d6f92ea1b553..25aa6facc12d 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -57,6 +57,24 @@
 #define INTEL_OUTPUT_DISPLAYPORT 7
 #define INTEL_OUTPUT_EDP 8
+/* Intel Pipe Clone Bit */
+#define INTEL_HDMIB_CLONE_BIT 1
+#define INTEL_HDMIC_CLONE_BIT 2
+#define INTEL_HDMID_CLONE_BIT 3
+#define INTEL_HDMIE_CLONE_BIT 4
+#define INTEL_HDMIF_CLONE_BIT 5
+#define INTEL_SDVO_NON_TV_CLONE_BIT 6
+#define INTEL_SDVO_TV_CLONE_BIT 7
+#define INTEL_SDVO_LVDS_CLONE_BIT 8
+#define INTEL_ANALOG_CLONE_BIT 9
+#define INTEL_TV_CLONE_BIT 10
+#define INTEL_DP_B_CLONE_BIT 11
+#define INTEL_DP_C_CLONE_BIT 12
+#define INTEL_DP_D_CLONE_BIT 13
+#define INTEL_LVDS_CLONE_BIT 14
+#define INTEL_DVO_TMDS_CLONE_BIT 15
+#define INTEL_DVO_LVDS_CLONE_BIT 16
 #define INTEL_DVO_CHIP_NONE 0
 #define INTEL_DVO_CHIP_LVDS 1
 #define INTEL_DVO_CHIP_TMDS 2
@@ -86,6 +104,8 @@ struct intel_output {
        bool needs_tv_clock;
        void *dev_priv;
        void (*hot_plug)(struct intel_output *);
+        int crtc_mask;
+        int clone_mask;
 };
 struct intel_crtc {
diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index 13bff20930e8..a4d2606de778 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -435,14 +435,20 @@ void intel_dvo_init(struct drm_device *dev)
                        continue;
                intel_output->type = INTEL_OUTPUT_DVO;
+                intel_output->crtc_mask = (1 << 0) | (1 << 1);
                switch (dvo->type) {
                case INTEL_DVO_CHIP_TMDS:
+                        intel_output->clone_mask =
+                                (1 << INTEL_DVO_TMDS_CLONE_BIT) |
+                                (1 << INTEL_ANALOG_CLONE_BIT);
                        drm_connector_init(dev, connector,
                                           &intel_dvo_connector_funcs,
                                           DRM_MODE_CONNECTOR_DVII);
                        encoder_type = DRM_MODE_ENCODER_TMDS;
                        break;
                case INTEL_DVO_CHIP_LVDS:
+                        intel_output->clone_mask =
+                                (1 << INTEL_DVO_LVDS_CLONE_BIT);
                        drm_connector_init(dev, connector,
                                           &intel_dvo_connector_funcs,
                                           DRM_MODE_CONNECTOR_LVDS);
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 1842290cded3..fa304e136010 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -230,22 +230,28 @@ void intel_hdmi_init(struct drm_device *dev, int sdvox_reg)
        connector->interlace_allowed = 0;
        connector->doublescan_allowed = 0;
+        intel_output->crtc_mask = (1 << 0) | (1 << 1);
        /* Set up the DDC bus. */
-        if (sdvox_reg == SDVOB)
+        if (sdvox_reg == SDVOB) {
+                intel_output->clone_mask = (1 << INTEL_HDMIB_CLONE_BIT);
                intel_output->ddc_bus = intel_i2c_create(dev, GPIOE, "HDMIB");
-        else if (sdvox_reg == SDVOC)
+        } else if (sdvox_reg == SDVOC) {
+                intel_output->clone_mask = (1 << INTEL_HDMIC_CLONE_BIT);
                intel_output->ddc_bus = intel_i2c_create(dev, GPIOD, "HDMIC");
-        else if (sdvox_reg == HDMIB)
+        } else if (sdvox_reg == HDMIB) {
+                intel_output->clone_mask = (1 << INTEL_HDMID_CLONE_BIT);
                intel_output->ddc_bus = intel_i2c_create(dev, PCH_GPIOE,
                                                                "HDMIB");
-        else if (sdvox_reg == HDMIC)
+        } else if (sdvox_reg == HDMIC) {
+                intel_output->clone_mask = (1 << INTEL_HDMIE_CLONE_BIT);
                intel_output->ddc_bus = intel_i2c_create(dev, PCH_GPIOD,
                                                                "HDMIC");
-        else if (sdvox_reg == HDMID)
+        } else if (sdvox_reg == HDMID) {
+                intel_output->clone_mask = (1 << INTEL_HDMIF_CLONE_BIT);
                intel_output->ddc_bus = intel_i2c_create(dev, PCH_GPIOF,
                                                                "HDMID");
+        }
        if (!intel_output->ddc_bus)
                goto err_connector;
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 3f445a80c552..8df02ef89261 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -916,6 +916,8 @@ void intel_lvds_init(struct drm_device *dev)
        drm_mode_connector_attach_encoder(&intel_output->base, &intel_output->enc);
        intel_output->type = INTEL_OUTPUT_LVDS;
+        intel_output->clone_mask = (1 << INTEL_LVDS_CLONE_BIT);
+        intel_output->crtc_mask = (1 << 1);
        drm_encoder_helper_add(encoder, &intel_lvds_helper_funcs);
        drm_connector_helper_add(connector, &intel_lvds_connector_helper_funcs);
        connector->display_info.subpixel_order = SubPixelHorizontalRGB;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 5371d9332554..d3b74ba62b4a 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -1458,7 +1458,7 @@ intel_sdvo_multifunc_encoder(struct intel_output *intel_output)
                (SDVO_OUTPUT_RGB0 | SDVO_OUTPUT_RGB1))
                caps++;
        if (sdvo_priv->caps.output_flags &
-                (SDVO_OUTPUT_SVID0 | SDVO_OUTPUT_SVID0))
+                (SDVO_OUTPUT_SVID0 | SDVO_OUTPUT_SVID1))
                caps++;
        if (sdvo_priv->caps.output_flags &
                (SDVO_OUTPUT_CVBS0 | SDVO_OUTPUT_CVBS1))
@@ -1967,6 +1967,9 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                        intel_sdvo_set_colorimetry(intel_output,
                                                   SDVO_COLORIMETRY_RGB256);
                        connector->connector_type = DRM_MODE_CONNECTOR_HDMIA;
+                        intel_output->clone_mask =
+                                        (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
+                                        (1 << INTEL_ANALOG_CLONE_BIT);
                }
        } else if (flags & SDVO_OUTPUT_SVID0) {
@@ -1975,11 +1978,14 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                connector->connector_type = DRM_MODE_CONNECTOR_SVIDEO;
                sdvo_priv->is_tv = true;
                intel_output->needs_tv_clock = true;
+                intel_output->clone_mask = 1 << INTEL_SDVO_TV_CLONE_BIT;
        } else if (flags & SDVO_OUTPUT_RGB0) {
                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB0;
                encoder->encoder_type = DRM_MODE_ENCODER_DAC;
                connector->connector_type = DRM_MODE_CONNECTOR_VGA;
+                intel_output->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
+                                        (1 << INTEL_ANALOG_CLONE_BIT);
        } else if (flags & SDVO_OUTPUT_RGB1) {
                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB1;
@@ -1991,12 +1997,16 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                encoder->encoder_type = DRM_MODE_ENCODER_LVDS;
                connector->connector_type = DRM_MODE_CONNECTOR_LVDS;
                sdvo_priv->is_lvds = true;
+                intel_output->clone_mask = (1 << INTEL_ANALOG_CLONE_BIT) |
+                                        (1 << INTEL_SDVO_LVDS_CLONE_BIT);
        } else if (flags & SDVO_OUTPUT_LVDS1) {
                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS1;
                encoder->encoder_type = DRM_MODE_ENCODER_LVDS;
                connector->connector_type = DRM_MODE_CONNECTOR_LVDS;
                sdvo_priv->is_lvds = true;
+                intel_output->clone_mask = (1 << INTEL_ANALOG_CLONE_BIT) |
+                                        (1 << INTEL_SDVO_LVDS_CLONE_BIT);
        } else {
                unsigned char bytes[2];
@@ -2009,6 +2019,7 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                                  bytes[0], bytes[1]);
                ret = false;
        }
+        intel_output->crtc_mask = (1 << 0) | (1 << 1);
        if (ret && registered)
                ret = drm_sysfs_connector_add(connector) == 0 ? true : false;
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index da4ab4dc1630..2fbe13a0de81 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1718,6 +1718,7 @@ intel_tv_init(struct drm_device *dev)
        if (!intel_output) {
                return;
        }
        connector = &intel_output->base;
        drm_connector_init(dev, connector, &intel_tv_connector_funcs,
@@ -1729,6 +1730,7 @@ intel_tv_init(struct drm_device *dev)
        drm_mode_connector_attach_encoder(&intel_output->base, &intel_output->enc);
        tv_priv = (struct intel_tv_priv *)(intel_output + 1);
        intel_output->type = INTEL_OUTPUT_TVOUT;
+        intel_output->clone_mask = (1 << INTEL_TV_CLONE_BIT);
        intel_output->enc.possible_crtcs = ((1 << 0) | (1 << 1));
        intel_output->enc.possible_clones = (1 << INTEL_OUTPUT_TVOUT);
        intel_output->dev_priv = tv_priv;
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 95fe0452dae4..6c6a09b1c0fe 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -880,6 +880,14 @@ static unsigned int atkbd_hp_zv6100_forced_release_keys[] = {
 };
 /*
+ * Perform fixup for HP (Compaq) Presario R4000 R4100 R4200 that don't generate
+ * release for their volume buttons
+ */
+static unsigned int atkbd_hp_r4000_forced_release_keys[] = {
+        0xae, 0xb0, -1U
+};
+/*
 * Samsung NC10,NC20 with Fn+F? key release not working
 */
 static unsigned int atkbd_samsung_forced_release_keys[] = {
@@ -1537,6 +1545,33 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
                .driver_data = atkbd_hp_zv6100_forced_release_keys,
        },
        {
+                .ident = "HP Presario R4000",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Presario R4000"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_hp_r4000_forced_release_keys,
+        },
+        {
+                .ident = "HP Presario R4100",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Presario R4100"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_hp_r4000_forced_release_keys,
+        },
+        {
+                .ident = "HP Presario R4200",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Presario R4200"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_hp_r4000_forced_release_keys,
+        },
+        {
                .ident = "Inventec Symphony",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "INVENTEC"),
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index ae04d8a494e5..ccbf23ece8e3 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -382,6 +382,14 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "Vostro1510"),
                },
        },
+        {
+                .ident = "Acer Aspire 5536",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5536"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
+                },
+        },
        { }
 };
diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
index 3710ff88fc10..556acff3952f 100644
--- a/drivers/md/dm-exception-store.c
+++ b/drivers/md/dm-exception-store.c
@@ -171,6 +171,14 @@ static int set_chunk_size(struct dm_exception_store *store,
         */
        chunk_size_ulong = round_up(chunk_size_ulong, PAGE_SIZE >> 9);
+        return dm_exception_store_set_chunk_size(store, chunk_size_ulong,
+                                                 error);
+}
+int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
+                                      unsigned long chunk_size_ulong,
+                                      char **error)
+{
        /* Check chunk_size is a power of 2 */
        if (!is_power_of_2(chunk_size_ulong)) {
                *error = "Chunk size is not a power of 2";
@@ -183,6 +191,11 @@ static int set_chunk_size(struct dm_exception_store *store,
                return -EINVAL;
        }
+        if (chunk_size_ulong > INT_MAX >> SECTOR_SHIFT) {
+                *error = "Chunk size is too high";
+                return -EINVAL;
+        }
        store->chunk_size = chunk_size_ulong;
        store->chunk_mask = chunk_size_ulong - 1;
        store->chunk_shift = ffs(chunk_size_ulong) - 1;
diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
index 2442c8c07898..812c71872ba0 100644
--- a/drivers/md/dm-exception-store.h
+++ b/drivers/md/dm-exception-store.h
@@ -168,6 +168,10 @@ static inline chunk_t sector_to_chunk(struct dm_exception_store *store,
 int dm_exception_store_type_register(struct dm_exception_store_type *type);
 int dm_exception_store_type_unregister(struct dm_exception_store_type *type);
+int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
+                                      unsigned long chunk_size_ulong,
+                                      char **error);
 int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
                              unsigned *args_used,
                              struct dm_exception_store **store);
diff --git a/drivers/md/dm-log-userspace-base.c b/drivers/md/dm-log-userspace-base.c
index e69b96560997..6e186b1a062d 100644
--- a/drivers/md/dm-log-userspace-base.c
+++ b/drivers/md/dm-log-userspace-base.c
@@ -21,6 +21,7 @@ struct log_c {
        struct dm_target *ti;
        uint32_t region_size;
        region_t region_count;
+        uint64_t luid;
        char uuid[DM_UUID_LEN];
        char *usr_argv_str;
@@ -63,7 +64,7 @@ static int userspace_do_request(struct log_c *lc, const char *uuid,
         * restored.
         */
 retry:
-        r = dm_consult_userspace(uuid, request_type, data,
+        r = dm_consult_userspace(uuid, lc->luid, request_type, data,
                                 data_size, rdata, rdata_size);
        if (r != -ESRCH)
@@ -74,14 +75,15 @@ retry:
                set_current_state(TASK_INTERRUPTIBLE);
                schedule_timeout(2*HZ);
                DMWARN("Attempting to contact userspace log server...");
-                r = dm_consult_userspace(uuid, DM_ULOG_CTR, lc->usr_argv_str,
+                r = dm_consult_userspace(uuid, lc->luid, DM_ULOG_CTR,
+                                         lc->usr_argv_str,
                                         strlen(lc->usr_argv_str) + 1,
                                         NULL, NULL);
                if (!r)
                        break;
        }
        DMINFO("Reconnected to userspace log server... DM_ULOG_CTR complete");
-        r = dm_consult_userspace(uuid, DM_ULOG_RESUME, NULL,
+        r = dm_consult_userspace(uuid, lc->luid, DM_ULOG_RESUME, NULL,
                                 0, NULL, NULL);
        if (!r)
                goto retry;
@@ -111,10 +113,9 @@ static int build_constructor_string(struct dm_target *ti,
                return -ENOMEM;
        }
-        for (i = 0, str_size = 0; i < argc; i++)
+        str_size = sprintf(str, "%llu", (unsigned long long)ti->len);
-                str_size += sprintf(str + str_size, "%s ", argv[i]);
+        for (i = 0; i < argc; i++)
-        str_size += sprintf(str + str_size, "%llu",
+                str_size += sprintf(str + str_size, " %s", argv[i]);
-                            (unsigned long long)ti->len);
        *ctr_str = str;
        return str_size;
@@ -154,6 +155,9 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
                return -ENOMEM;
        }
+        /* The ptr value is sufficient for local unique id */
+        lc->luid = (uint64_t)lc;
        lc->ti = ti;
        if (strlen(argv[0]) > (DM_UUID_LEN - 1)) {
@@ -173,7 +177,7 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
        }
        /* Send table string */
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_CTR,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_CTR,
                                 ctr_str, str_size, NULL, NULL);
        if (r == -ESRCH) {
@@ -183,7 +187,7 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
        /* Since the region size does not change, get it now */
        rdata_size = sizeof(rdata);
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_GET_REGION_SIZE,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_GET_REGION_SIZE,
                                 NULL, 0, (char *)&rdata, &rdata_size);
        if (r) {
@@ -212,7 +216,7 @@ static void userspace_dtr(struct dm_dirty_log *log)
        int r;
        struct log_c *lc = log->context;
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_DTR,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_DTR,
                                 NULL, 0,
                                 NULL, NULL);
@@ -227,7 +231,7 @@ static int userspace_presuspend(struct dm_dirty_log *log)
        int r;
        struct log_c *lc = log->context;
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_PRESUSPEND,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_PRESUSPEND,
                                 NULL, 0,
                                 NULL, NULL);
@@ -239,7 +243,7 @@ static int userspace_postsuspend(struct dm_dirty_log *log)
        int r;
        struct log_c *lc = log->context;
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_POSTSUSPEND,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_POSTSUSPEND,
                                 NULL, 0,
                                 NULL, NULL);
@@ -252,7 +256,7 @@ static int userspace_resume(struct dm_dirty_log *log)
        struct log_c *lc = log->context;
        lc->in_sync_hint = 0;
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_RESUME,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_RESUME,
                                 NULL, 0,
                                 NULL, NULL);
@@ -561,6 +565,7 @@ static int userspace_status(struct dm_dirty_log *log, status_type_t status_type,
                            char *result, unsigned maxlen)
 {
        int r = 0;
+        char *table_args;
        size_t sz = (size_t)maxlen;
        struct log_c *lc = log->context;
@@ -577,8 +582,12 @@ static int userspace_status(struct dm_dirty_log *log, status_type_t status_type,
                break;
        case STATUSTYPE_TABLE:
                sz = 0;
-                DMEMIT("%s %u %s %s", log->type->name, lc->usr_argc + 1,
+                table_args = strstr(lc->usr_argv_str, " ");
-                       lc->uuid, lc->usr_argv_str);
+                BUG_ON(!table_args); /* There will always be a ' ' */
+                table_args++;
+                DMEMIT("%s %u %s %s ", log->type->name, lc->usr_argc,
+                       lc->uuid, table_args);
                break;
        }
        return (r) ? 0 : (int)sz;
diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
index 8ce74d95ae4d..ba0edad2d048 100644
--- a/drivers/md/dm-log-userspace-transfer.c
+++ b/drivers/md/dm-log-userspace-transfer.c
@@ -147,7 +147,8 @@ static void cn_ulog_callback(void *data)
 /**
 * dm_consult_userspace
- * @uuid: log's uuid (must be DM_UUID_LEN in size)
+ * @uuid: log's universal unique identifier (must be DM_UUID_LEN in size)
+ * @luid: log's local unique identifier
 * @request_type:  found in include/linux/dm-log-userspace.h
 * @data: data to tx to the server
 * @data_size: size of data in bytes
@@ -163,7 +164,7 @@ static void cn_ulog_callback(void *data)
 *
 * Returns: 0 on success, -EXXX on failure
 **/
-int dm_consult_userspace(const char *uuid, int request_type,
+int dm_consult_userspace(const char *uuid, uint64_t luid, int request_type,
                         char *data, size_t data_size,
                         char *rdata, size_t *rdata_size)
 {
@@ -190,6 +191,7 @@ resend:
        memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - overhead_size);
        memcpy(tfr->uuid, uuid, DM_UUID_LEN);
+        tfr->luid = luid;
        tfr->seq = dm_ulog_seq++;
        /*
diff --git a/drivers/md/dm-log-userspace-transfer.h b/drivers/md/dm-log-userspace-transfer.h
index c26d8e4e2710..04ee874f9153 100644
--- a/drivers/md/dm-log-userspace-transfer.h
+++ b/drivers/md/dm-log-userspace-transfer.h
@@ -11,7 +11,7 @@
 int dm_ulog_tfr_init(void);
 void dm_ulog_tfr_exit(void);
-int dm_consult_userspace(const char *uuid, int request_type,
+int dm_consult_userspace(const char *uuid, uint64_t luid, int request_type,
                         char *data, size_t data_size,
                         char *rdata, size_t *rdata_size);
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 9726577cde49..33f179e66bf5 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -648,7 +648,13 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
         */
        dm_rh_inc_pending(ms->rh, &sync);
        dm_rh_inc_pending(ms->rh, &nosync);
-        ms->log_failure = dm_rh_flush(ms->rh) ? 1 : 0;
+        /*
+         * If the flush fails on a previous call and succeeds here,
+         * we must not reset the log_failure variable.  We need
+         * userspace interaction to do that.
+         */
+        ms->log_failure = dm_rh_flush(ms->rh) ? 1 : ms->log_failure;
        /*
         * Dispatch io.
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 6e3fe4f14934..d5b2e08750d5 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -106,6 +106,13 @@ struct pstore {
        void *zero_area;
        /*
+         * An area used for header. The header can be written
+         * concurrently with metadata (when invalidating the snapshot),
+         * so it needs a separate buffer.
+         */
+        void *header_area;
+        /*
         * Used to keep track of which metadata area the data in
         * 'chunk' refers to.
         */
@@ -148,16 +155,27 @@ static int alloc_area(struct pstore *ps)
         */
        ps->area = vmalloc(len);
        if (!ps->area)
-                return r;
+                goto err_area;
        ps->zero_area = vmalloc(len);
-        if (!ps->zero_area) {
+        if (!ps->zero_area)
-                vfree(ps->area);
+                goto err_zero_area;
-                return r;
-        }
        memset(ps->zero_area, 0, len);
+        ps->header_area = vmalloc(len);
+        if (!ps->header_area)
+                goto err_header_area;
        return 0;
+err_header_area:
+        vfree(ps->zero_area);
+err_zero_area:
+        vfree(ps->area);
+err_area:
+        return r;
 }
 static void free_area(struct pstore *ps)
@@ -169,6 +187,10 @@ static void free_area(struct pstore *ps)
        if (ps->zero_area)
                vfree(ps->zero_area);
        ps->zero_area = NULL;
+        if (ps->header_area)
+                vfree(ps->header_area);
+        ps->header_area = NULL;
 }
 struct mdata_req {
@@ -188,7 +210,8 @@ static void do_metadata(struct work_struct *work)
 /*
 * Read or write a chunk aligned and sized block of data from a device.
 */
-static int chunk_io(struct pstore *ps, chunk_t chunk, int rw, int metadata)
+static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, int rw,
+                    int metadata)
 {
        struct dm_io_region where = {
                .bdev = ps->store->cow->bdev,
@@ -198,7 +221,7 @@ static int chunk_io(struct pstore *ps, chunk_t chunk, int rw, int metadata)
        struct dm_io_request io_req = {
                .bi_rw = rw,
                .mem.type = DM_IO_VMA,
-                .mem.ptr.vma = ps->area,
+                .mem.ptr.vma = area,
                .client = ps->io_client,
                .notify.fn = NULL,
        };
@@ -240,7 +263,7 @@ static int area_io(struct pstore *ps, int rw)
        chunk = area_location(ps, ps->current_area);
-        r = chunk_io(ps, chunk, rw, 0);
+        r = chunk_io(ps, ps->area, chunk, rw, 0);
        if (r)
                return r;
@@ -254,20 +277,7 @@ static void zero_memory_area(struct pstore *ps)
 static int zero_disk_area(struct pstore *ps, chunk_t area)
 {
-        struct dm_io_region where = {
+        return chunk_io(ps, ps->zero_area, area_location(ps, area), WRITE, 0);
-                .bdev = ps->store->cow->bdev,
-                .sector = ps->store->chunk_size * area_location(ps, area),
-                .count = ps->store->chunk_size,
-        };
-        struct dm_io_request io_req = {
-                .bi_rw = WRITE,
-                .mem.type = DM_IO_VMA,
-                .mem.ptr.vma = ps->zero_area,
-                .client = ps->io_client,
-                .notify.fn = NULL,
-        };
-        return dm_io(&io_req, 1, &where, NULL);
 }
 static int read_header(struct pstore *ps, int *new_snapshot)
@@ -276,6 +286,7 @@ static int read_header(struct pstore *ps, int *new_snapshot)
        struct disk_header *dh;
        chunk_t chunk_size;
        int chunk_size_supplied = 1;
+        char *chunk_err;
        /*
         * Use default chunk size (or hardsect_size, if larger) if none supplied
@@ -297,11 +308,11 @@ static int read_header(struct pstore *ps, int *new_snapshot)
        if (r)
                return r;
-        r = chunk_io(ps, 0, READ, 1);
+        r = chunk_io(ps, ps->header_area, 0, READ, 1);
        if (r)
                goto bad;
-        dh = (struct disk_header *) ps->area;
+        dh = ps->header_area;
        if (le32_to_cpu(dh->magic) == 0) {
                *new_snapshot = 1;
@@ -319,20 +330,25 @@ static int read_header(struct pstore *ps, int *new_snapshot)
        ps->version = le32_to_cpu(dh->version);
        chunk_size = le32_to_cpu(dh->chunk_size);
-        if (!chunk_size_supplied || ps->store->chunk_size == chunk_size)
+        if (ps->store->chunk_size == chunk_size)
                return 0;
-        DMWARN("chunk size %llu in device metadata overrides "
+        if (chunk_size_supplied)
-               "table chunk size of %llu.",
+                DMWARN("chunk size %llu in device metadata overrides "
-               (unsigned long long)chunk_size,
+                       "table chunk size of %llu.",
-               (unsigned long long)ps->store->chunk_size);
+                       (unsigned long long)chunk_size,
+                       (unsigned long long)ps->store->chunk_size);
        /* We had a bogus chunk_size. Fix stuff up. */
        free_area(ps);
-        ps->store->chunk_size = chunk_size;
+        r = dm_exception_store_set_chunk_size(ps->store, chunk_size,
-        ps->store->chunk_mask = chunk_size - 1;
+                                              &chunk_err);
-        ps->store->chunk_shift = ffs(chunk_size) - 1;
+        if (r) {
+                DMERR("invalid on-disk chunk size %llu: %s.",
+                      (unsigned long long)chunk_size, chunk_err);
+                return r;
+        }
        r = dm_io_client_resize(sectors_to_pages(ps->store->chunk_size),
                                ps->io_client);
@@ -351,15 +367,15 @@ static int write_header(struct pstore *ps)
 {
        struct disk_header *dh;
-        memset(ps->area, 0, ps->store->chunk_size << SECTOR_SHIFT);
+        memset(ps->header_area, 0, ps->store->chunk_size << SECTOR_SHIFT);
-        dh = (struct disk_header *) ps->area;
+        dh = ps->header_area;
        dh->magic = cpu_to_le32(SNAP_MAGIC);
        dh->valid = cpu_to_le32(ps->valid);
        dh->version = cpu_to_le32(ps->version);
        dh->chunk_size = cpu_to_le32(ps->store->chunk_size);
-        return chunk_io(ps, 0, WRITE, 1);
+        return chunk_io(ps, ps->header_area, 0, WRITE, 1);
 }
 /*
@@ -679,6 +695,8 @@ static int persistent_ctr(struct dm_exception_store *store,
        ps->valid = 1;
        ps->version = SNAPSHOT_DISK_VERSION;
        ps->area = NULL;
+        ps->zero_area = NULL;
+        ps->header_area = NULL;
        ps->next_free = 2;      /* skipping the header and first area */
        ps->current_committed = 0;
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index d573165cd2b7..57f1bf7f3b7a 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -1176,6 +1176,15 @@ static int snapshot_status(struct dm_target *ti, status_type_t type,
        return 0;
 }
+static int snapshot_iterate_devices(struct dm_target *ti,
+                                    iterate_devices_callout_fn fn, void *data)
+{
+        struct dm_snapshot *snap = ti->private;
+        return fn(ti, snap->origin, 0, ti->len, data);
+}
 /*-----------------------------------------------------------------
 * Origin methods
 *---------------------------------------------------------------*/
@@ -1410,20 +1419,29 @@ static int origin_status(struct dm_target *ti, status_type_t type, char *result,
        return 0;
 }
+static int origin_iterate_devices(struct dm_target *ti,
+                                  iterate_devices_callout_fn fn, void *data)
+{
+        struct dm_dev *dev = ti->private;
+        return fn(ti, dev, 0, ti->len, data);
+}
 static struct target_type origin_target = {
        .name    = "snapshot-origin",
-        .version = {1, 6, 0},
+        .version = {1, 7, 0},
        .module  = THIS_MODULE,
        .ctr     = origin_ctr,
        .dtr     = origin_dtr,
        .map     = origin_map,
        .resume  = origin_resume,
        .status  = origin_status,
+        .iterate_devices = origin_iterate_devices,
 };
 static struct target_type snapshot_target = {
        .name    = "snapshot",
-        .version = {1, 6, 0},
+        .version = {1, 7, 0},
        .module  = THIS_MODULE,
        .ctr     = snapshot_ctr,
        .dtr     = snapshot_dtr,
@@ -1431,6 +1449,7 @@ static struct target_type snapshot_target = {
        .end_io  = snapshot_end_io,
        .resume  = snapshot_resume,
        .status  = snapshot_status,
+        .iterate_devices = snapshot_iterate_devices,
 };
 static int __init dm_snapshot_init(void)
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index 4e0e5937e42a..3e563d251733 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -329,9 +329,19 @@ static int stripe_iterate_devices(struct dm_target *ti,
        return ret;
 }
+static void stripe_io_hints(struct dm_target *ti,
+                            struct queue_limits *limits)
+{
+        struct stripe_c *sc = ti->private;
+        unsigned chunk_size = (sc->chunk_mask + 1) << 9;
+        blk_limits_io_min(limits, chunk_size);
+        limits->io_opt = chunk_size * sc->stripes;
+}
 static struct target_type stripe_target = {
        .name   = "striped",
-        .version = {1, 2, 0},
+        .version = {1, 3, 0},
        .module = THIS_MODULE,
        .ctr    = stripe_ctr,
        .dtr    = stripe_dtr,
@@ -339,6 +349,7 @@ static struct target_type stripe_target = {
        .end_io = stripe_end_io,
        .status = stripe_status,
        .iterate_devices = stripe_iterate_devices,
+        .io_hints = stripe_io_hints,
 };
 int __init dm_stripe_init(void)
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index d952b3441913..1a6cb3c7822e 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -343,10 +343,10 @@ static void close_dev(struct dm_dev_internal *d, struct mapped_device *md)
 }
 /*
- * If possible, this checks an area of a destination device is valid.
+ * If possible, this checks an area of a destination device is invalid.
 */
-static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
+static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
-                                sector_t start, sector_t len, void *data)
+                                  sector_t start, sector_t len, void *data)
 {
        struct queue_limits *limits = data;
        struct block_device *bdev = dev->bdev;
@@ -357,36 +357,40 @@ static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
        char b[BDEVNAME_SIZE];
        if (!dev_size)
-                return 1;
+                return 0;
        if ((start >= dev_size) || (start + len > dev_size)) {
-                DMWARN("%s: %s too small for target",
+                DMWARN("%s: %s too small for target: "
-                       dm_device_name(ti->table->md), bdevname(bdev, b));
+                       "start=%llu, len=%llu, dev_size=%llu",
-                return 0;
+                       dm_device_name(ti->table->md), bdevname(bdev, b),
+                       (unsigned long long)start,
+                       (unsigned long long)len,
+                       (unsigned long long)dev_size);
+                return 1;
        }
        if (logical_block_size_sectors <= 1)
-                return 1;
+                return 0;
        if (start & (logical_block_size_sectors - 1)) {
                DMWARN("%s: start=%llu not aligned to h/w "
-                       "logical block size %hu of %s",
+                       "logical block size %u of %s",
                       dm_device_name(ti->table->md),
                       (unsigned long long)start,
                       limits->logical_block_size, bdevname(bdev, b));
-                return 0;
+                return 1;
        }
        if (len & (logical_block_size_sectors - 1)) {
                DMWARN("%s: len=%llu not aligned to h/w "
-                       "logical block size %hu of %s",
+                       "logical block size %u of %s",
                       dm_device_name(ti->table->md),
                       (unsigned long long)len,
                       limits->logical_block_size, bdevname(bdev, b));
-                return 0;
+                return 1;
        }
-        return 1;
+        return 0;
 }
 /*
@@ -496,8 +500,15 @@ int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
        }
        if (blk_stack_limits(limits, &q->limits, start << 9) < 0)
-                DMWARN("%s: target device %s is misaligned",
+                DMWARN("%s: target device %s is misaligned: "
-                       dm_device_name(ti->table->md), bdevname(bdev, b));
+                       "physical_block_size=%u, logical_block_size=%u, "
+                       "alignment_offset=%u, start=%llu",
+                       dm_device_name(ti->table->md), bdevname(bdev, b),
+                       q->limits.physical_block_size,
+                       q->limits.logical_block_size,
+                       q->limits.alignment_offset,
+                       (unsigned long long) start << 9);
        /*
         * Check if merge fn is supported.
@@ -698,7 +709,7 @@ static int validate_hardware_logical_block_alignment(struct dm_table *table,
        if (remaining) {
                DMWARN("%s: table line %u (start sect %llu len %llu) "
-                       "not aligned to h/w logical block size %hu",
+                       "not aligned to h/w logical block size %u",
                       dm_device_name(table->md), i,
                       (unsigned long long) ti->begin,
                       (unsigned long long) ti->len,
@@ -996,12 +1007,16 @@ int dm_calculate_queue_limits(struct dm_table *table,
                ti->type->iterate_devices(ti, dm_set_device_limits,
                                          &ti_limits);
+                /* Set I/O hints portion of queue limits */
+                if (ti->type->io_hints)
+                        ti->type->io_hints(ti, &ti_limits);
                /*
                 * Check each device area is consistent with the target's
                 * overall queue limits.
                 */
-                if (!ti->type->iterate_devices(ti, device_area_is_valid,
+                if (ti->type->iterate_devices(ti, device_area_is_invalid,
-                                               &ti_limits))
+                                              &ti_limits))
                        return -EINVAL;
 combine_limits:
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 8a311ea0d441..b4845b14740d 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -738,16 +738,22 @@ static void rq_completed(struct mapped_device *md, int run_queue)
        dm_put(md);
 }
+static void free_rq_clone(struct request *clone)
+{
+        struct dm_rq_target_io *tio = clone->end_io_data;
+        blk_rq_unprep_clone(clone);
+        free_rq_tio(tio);
+}
 static void dm_unprep_request(struct request *rq)
 {
        struct request *clone = rq->special;
-        struct dm_rq_target_io *tio = clone->end_io_data;
        rq->special = NULL;
        rq->cmd_flags &= ~REQ_DONTPREP;
-        blk_rq_unprep_clone(clone);
+        free_rq_clone(clone);
-        free_rq_tio(tio);
 }
 /*
@@ -825,8 +831,7 @@ static void dm_end_request(struct request *clone, int error)
                        rq->sense_len = clone->sense_len;
        }
-        BUG_ON(clone->bio);
+        free_rq_clone(clone);
-        free_rq_tio(tio);
        blk_end_request_all(rq, error);
diff --git a/drivers/media/dvb/siano/Kconfig b/drivers/media/dvb/siano/Kconfig
index 88847d1dcbb5..8c1aed77ea30 100644
--- a/drivers/media/dvb/siano/Kconfig
+++ b/drivers/media/dvb/siano/Kconfig
@@ -2,25 +2,33 @@
 # Siano Mobile Silicon Digital TV device configuration
 #
-config DVB_SIANO_SMS1XXX
+config SMS_SIANO_MDTV
-        tristate "Siano SMS1XXX USB dongle support"
+        tristate "Siano SMS1xxx based MDTV receiver"
-        depends on DVB_CORE && USB && INPUT
+        depends on DVB_CORE && INPUT
        ---help---
-          Choose Y here if you have a USB dongle with a SMS1XXX chipset.
+          Choose Y or M here if you have MDTV receiver with a Siano chipset.
-          To compile this driver as a module, choose M here: the
+          To compile this driver as a module, choose M here
-          module will be called sms1xxx.
+          (The module will be called smsmdtv).
-config DVB_SIANO_SMS1XXX_SMS_IDS
+          Further documentation on this driver can be found on the WWW
-        bool "Enable support for Siano Mobile Silicon default USB IDs"
+          at http://www.siano-ms.com/
-        depends on DVB_SIANO_SMS1XXX
-        default y
+if SMS_SIANO_MDTV
-        ---help---
+menu "Siano module components"
-          Choose Y here if you have a USB dongle with a SMS1XXX chipset
-          that uses Siano Mobile Silicon's default usb vid:pid.
-          Choose N here if you would prefer to use Siano's external driver.
+# Hardware interfaces support
-          Further documentation on this driver can be found on the WWW at
+config SMS_USB_DRV
-          <http://www.siano-ms.com/>.
+        tristate "USB interface support"
+        depends on DVB_CORE && USB
+        ---help---
+          Choose if you would like to have Siano's support for USB interface
+config SMS_SDIO_DRV
+        tristate "SDIO interface support"
+        depends on DVB_CORE && MMC
+        ---help---
+          Choose if you would like to have Siano's support for SDIO interface
+endmenu
+endif # SMS_SIANO_MDTV
diff --git a/drivers/media/dvb/siano/Makefile b/drivers/media/dvb/siano/Makefile
index c6644d909433..c54140b5ab5a 100644
--- a/drivers/media/dvb/siano/Makefile
+++ b/drivers/media/dvb/siano/Makefile
@@ -1,8 +1,9 @@
-sms1xxx-objs := smscoreapi.o sms-cards.o smsendian.o smsir.o
-obj-$(CONFIG_DVB_SIANO_SMS1XXX) += sms1xxx.o
+smsmdtv-objs := smscoreapi.o sms-cards.o smsendian.o smsir.o
-obj-$(CONFIG_DVB_SIANO_SMS1XXX) += smsusb.o
-obj-$(CONFIG_DVB_SIANO_SMS1XXX) += smsdvb.o
+obj-$(CONFIG_SMS_SIANO_MDTV) += smsmdtv.o smsdvb.o
+obj-$(CONFIG_SMS_USB_DRV) += smsusb.o
+obj-$(CONFIG_SMS_SDIO_DRV) += smssdio.o
 EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
diff --git a/drivers/media/dvb/siano/smsdvb.c b/drivers/media/dvb/siano/smsdvb.c
index 3ee1c3902c56..266033ae2784 100644
--- a/drivers/media/dvb/siano/smsdvb.c
+++ b/drivers/media/dvb/siano/smsdvb.c
@@ -325,6 +325,16 @@ static int smsdvb_sendrequest_and_wait(struct smsdvb_client_t *client,
                                                0 : -ETIME;
 }
+static inline int led_feedback(struct smsdvb_client_t *client)
+{
+        if (client->fe_status & FE_HAS_LOCK)
+                return sms_board_led_feedback(client->coredev,
+                        (client->sms_stat_dvb.ReceptionData.BER
+                        == 0) ? SMS_LED_HI : SMS_LED_LO);
+        else
+                return sms_board_led_feedback(client->coredev, SMS_LED_OFF);
+}
 static int smsdvb_read_status(struct dvb_frontend *fe, fe_status_t *stat)
 {
        struct smsdvb_client_t *client;
@@ -332,6 +342,8 @@ static int smsdvb_read_status(struct dvb_frontend *fe, fe_status_t *stat)
        *stat = client->fe_status;
+        led_feedback(client);
        return 0;
 }
@@ -342,6 +354,8 @@ static int smsdvb_read_ber(struct dvb_frontend *fe, u32 *ber)
        *ber = client->sms_stat_dvb.ReceptionData.BER;
+        led_feedback(client);
        return 0;
 }
@@ -359,6 +373,8 @@ static int smsdvb_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
                                (client->sms_stat_dvb.ReceptionData.InBandPwr
                                + 95) * 3 / 2;
+        led_feedback(client);
        return 0;
 }
@@ -369,6 +385,8 @@ static int smsdvb_read_snr(struct dvb_frontend *fe, u16 *snr)
        *snr = client->sms_stat_dvb.ReceptionData.SNR;
+        led_feedback(client);
        return 0;
 }
@@ -379,6 +397,8 @@ static int smsdvb_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
        *ucblocks = client->sms_stat_dvb.ReceptionData.ErrorTSPackets;
+        led_feedback(client);
        return 0;
 }
@@ -404,6 +424,8 @@ static int smsdvb_set_frontend(struct dvb_frontend *fe,
                u32             Data[3];
        } Msg;
+        int ret;
        client->fe_status = FE_HAS_SIGNAL;
        client->event_fe_state = -1;
        client->event_unc_state = -1;
@@ -426,6 +448,23 @@ static int smsdvb_set_frontend(struct dvb_frontend *fe,
        case BANDWIDTH_AUTO: return -EOPNOTSUPP;
        default: return -EINVAL;
        }
+        /* Disable LNA, if any. An error is returned if no LNA is present */
+        ret = sms_board_lna_control(client->coredev, 0);
+        if (ret == 0) {
+                fe_status_t status;
+                /* tune with LNA off at first */
+                ret = smsdvb_sendrequest_and_wait(client, &Msg, sizeof(Msg),
+                                                  &client->tune_done);
+                smsdvb_read_status(fe, &status);
+                if (status & FE_HAS_LOCK)
+                        return ret;
+                /* previous tune didnt lock - enable LNA and tune again */
+                sms_board_lna_control(client->coredev, 1);
+        }
        return smsdvb_sendrequest_and_wait(client, &Msg, sizeof(Msg),
                                           &client->tune_done);
@@ -451,6 +490,8 @@ static int smsdvb_init(struct dvb_frontend *fe)
        struct smsdvb_client_t *client =
                container_of(fe, struct smsdvb_client_t, frontend);
+        sms_board_power(client->coredev, 1);
        sms_board_dvb3_event(client, DVB3_EVENT_INIT);
        return 0;
 }
@@ -460,6 +501,9 @@ static int smsdvb_sleep(struct dvb_frontend *fe)
        struct smsdvb_client_t *client =
                container_of(fe, struct smsdvb_client_t, frontend);
+        sms_board_led_feedback(client->coredev, SMS_LED_OFF);
+        sms_board_power(client->coredev, 0);
        sms_board_dvb3_event(client, DVB3_EVENT_SLEEP);
        return 0;
diff --git a/drivers/media/dvb/siano/smssdio.c b/drivers/media/dvb/siano/smssdio.c
index dfaa49a53f32..d1d652e7f890 100644
--- a/drivers/media/dvb/siano/smssdio.c
+++ b/drivers/media/dvb/siano/smssdio.c
@@ -46,6 +46,7 @@
 #define SMSSDIO_DATA            0x00
 #define SMSSDIO_INT             0x04
+#define SMSSDIO_BLOCK_SIZE      128
 static const struct sdio_device_id smssdio_ids[] = {
        {SDIO_DEVICE(SDIO_VENDOR_ID_SIANO, SDIO_DEVICE_ID_SIANO_STELLAR),
@@ -85,7 +86,8 @@ static int smssdio_sendrequest(void *context, void *buffer, size_t size)
        sdio_claim_host(smsdev->func);
        while (size >= smsdev->func->cur_blksize) {
-                ret = sdio_write_blocks(smsdev->func, SMSSDIO_DATA, buffer, 1);
+                ret = sdio_memcpy_toio(smsdev->func, SMSSDIO_DATA,
+                                        buffer, smsdev->func->cur_blksize);
                if (ret)
                        goto out;
@@ -94,8 +96,8 @@ static int smssdio_sendrequest(void *context, void *buffer, size_t size)
        }
        if (size) {
-                ret = sdio_write_bytes(smsdev->func, SMSSDIO_DATA,
+                ret = sdio_memcpy_toio(smsdev->func, SMSSDIO_DATA,
-                                       buffer, size);
+                                        buffer, size);
        }
 out:
@@ -125,23 +127,23 @@ static void smssdio_interrupt(struct sdio_func *func)
         */
        isr = sdio_readb(func, SMSSDIO_INT, &ret);
        if (ret) {
-                dev_err(&smsdev->func->dev,
+                sms_err("Unable to read interrupt register!\n");
-                        "Unable to read interrupt register!\n");
                return;
        }
        if (smsdev->split_cb == NULL) {
                cb = smscore_getbuffer(smsdev->coredev);
                if (!cb) {
-                        dev_err(&smsdev->func->dev,
+                        sms_err("Unable to allocate data buffer!\n");
-                                "Unable to allocate data buffer!\n");
                        return;
                }
-                ret = sdio_read_blocks(smsdev->func, cb->p, SMSSDIO_DATA, 1);
+                ret = sdio_memcpy_fromio(smsdev->func,
+                                         cb->p,
+                                         SMSSDIO_DATA,
+                                         SMSSDIO_BLOCK_SIZE);
                if (ret) {
-                        dev_err(&smsdev->func->dev,
+                        sms_err("Error %d reading initial block!\n", ret);
-                                "Error %d reading initial block!\n", ret);
                        return;
                }
@@ -152,7 +154,10 @@ static void smssdio_interrupt(struct sdio_func *func)
                        return;
                }
-                size = hdr->msgLength - smsdev->func->cur_blksize;
+                if (hdr->msgLength > smsdev->func->cur_blksize)
+                        size = hdr->msgLength - smsdev->func->cur_blksize;
+                else
+                        size = 0;
        } else {
                cb = smsdev->split_cb;
                hdr = cb->p;
@@ -162,23 +167,24 @@ static void smssdio_interrupt(struct sdio_func *func)
                smsdev->split_cb = NULL;
        }
-        if (hdr->msgLength > smsdev->func->cur_blksize) {
+        if (size) {
                void *buffer;
-                size = ALIGN(size, 128);
+                buffer = cb->p + (hdr->msgLength - size);
-                buffer = cb->p + hdr->msgLength;
+                size = ALIGN(size, SMSSDIO_BLOCK_SIZE);
-                BUG_ON(smsdev->func->cur_blksize != 128);
+                BUG_ON(smsdev->func->cur_blksize != SMSSDIO_BLOCK_SIZE);
                /*
                 * First attempt to transfer all of it in one go...
                 */
-                ret = sdio_read_blocks(smsdev->func, buffer,
+                ret = sdio_memcpy_fromio(smsdev->func,
-                                       SMSSDIO_DATA, size / 128);
+                                         buffer,
+                                         SMSSDIO_DATA,
+                                         size);
                if (ret && ret != -EINVAL) {
                        smscore_putbuffer(smsdev->coredev, cb);
-                        dev_err(&smsdev->func->dev,
+                        sms_err("Error %d reading data from card!\n", ret);
-                                "Error %d reading data from card!\n", ret);
                        return;
                }
@@ -191,12 +197,12 @@ static void smssdio_interrupt(struct sdio_func *func)
                 */
                if (ret == -EINVAL) {
                        while (size) {
-                                ret = sdio_read_blocks(smsdev->func,
+                                ret = sdio_memcpy_fromio(smsdev->func,
-                                                       buffer, SMSSDIO_DATA, 1);
+                                                  buffer, SMSSDIO_DATA,
+                                                  smsdev->func->cur_blksize);
                                if (ret) {
                                        smscore_putbuffer(smsdev->coredev, cb);
-                                        dev_err(&smsdev->func->dev,
+                                        sms_err("Error %d reading "
-                                                "Error %d reading "
                                                "data from card!\n", ret);
                                        return;
                                }
@@ -269,7 +275,7 @@ static int smssdio_probe(struct sdio_func *func,
        if (ret)
                goto release;
-        ret = sdio_set_block_size(func, 128);
+        ret = sdio_set_block_size(func, SMSSDIO_BLOCK_SIZE);
        if (ret)
                goto disable;
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index ed281f565945..1c2e544eda73 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -1730,6 +1730,25 @@ static inline void em28xx_set_model(struct em28xx *dev)
                                       EM28XX_I2C_FREQ_100_KHZ;
 }
+/* FIXME: Should be replaced by a proper mt9m111 driver */
+static int em28xx_initialize_mt9m111(struct em28xx *dev)
+{
+        int i;
+        unsigned char regs[][3] = {
+                { 0x0d, 0x00, 0x01, },  /* reset and use defaults */
+                { 0x0d, 0x00, 0x00, },
+                { 0x0a, 0x00, 0x21, },
+                { 0x21, 0x04, 0x00, },  /* full readout speed, no row/col skipping */
+        };
+        for (i = 0; i < ARRAY_SIZE(regs); i++)
+                i2c_master_send(&dev->i2c_client, &regs[i][0], 3);
+        return 0;
+}
 /* FIXME: Should be replaced by a proper mt9m001 driver */
 static int em28xx_initialize_mt9m001(struct em28xx *dev)
 {
@@ -1758,7 +1777,7 @@ static int em28xx_initialize_mt9m001(struct em28xx *dev)
 /* HINT method: webcam I2C chips
 *
- * This method work for webcams with Micron sensors
+ * This method works for webcams with Micron sensors
 */
 static int em28xx_hint_sensor(struct em28xx *dev)
 {
@@ -1804,6 +1823,23 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                dev->vinctl = 0x00;
                break;
+        case 0x143a:    /* MT9M111 as found in the ECS G200 */
+                dev->model = EM2750_BOARD_UNKNOWN;
+                em28xx_set_model(dev);
+                sensor_name = "mt9m111";
+                dev->board.xclk = EM28XX_XCLK_FREQUENCY_48MHZ;
+                dev->em28xx_sensor = EM28XX_MT9M111;
+                em28xx_initialize_mt9m111(dev);
+                dev->sensor_xres = 640;
+                dev->sensor_yres = 512;
+                dev->vinmode = 0x0a;
+                dev->vinctl = 0x00;
+                break;
        case 0x8431:
                dev->model = EM2750_BOARD_UNKNOWN;
                em28xx_set_model(dev);
@@ -1820,7 +1856,7 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                break;
        default:
-                printk("Unknown Micron Sensor 0x%04x\n", be16_to_cpu(version));
+                printk("Unknown Micron Sensor 0x%04x\n", version);
                return -EINVAL;
        }
@@ -2346,7 +2382,9 @@ void em28xx_card_setup(struct em28xx *dev)
        }
        em28xx_tuner_setup(dev);
-        em28xx_ir_init(dev);
+        if(!disable_ir)
+                em28xx_ir_init(dev);
 }
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 8c2dc38bca9f..a2add61f7d59 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -367,6 +367,7 @@ enum em28xx_sensor {
        EM28XX_NOSENSOR = 0,
        EM28XX_MT9V011,
        EM28XX_MT9M001,
+        EM28XX_MT9M111,
 };
 enum em28xx_adecoder {
diff --git a/drivers/media/video/gspca/Kconfig b/drivers/media/video/gspca/Kconfig
index 34f46f2bc040..e994dcac43ff 100644
--- a/drivers/media/video/gspca/Kconfig
+++ b/drivers/media/video/gspca/Kconfig
@@ -114,7 +114,7 @@ config USB_GSPCA_SN9C20X
 config USB_GSPCA_SN9C20X_EVDEV
       bool "Enable evdev support"
-       depends on USB_GSPCA_SN9C20X
+        depends on USB_GSPCA_SN9C20X && INPUT
       ---help---
         Say Y here in order to enable evdev support for sn9c20x webcam button.
diff --git a/drivers/media/video/zr364xx.c b/drivers/media/video/zr364xx.c
index fc976f42f432..2622a6e63da1 100644
--- a/drivers/media/video/zr364xx.c
+++ b/drivers/media/video/zr364xx.c
@@ -695,7 +695,7 @@ static int zr364xx_release(struct file *file)
        for (i = 0; i < 2; i++) {
                err =
                    send_control_msg(udev, 1, init[cam->method][i].value,
-                                     0, init[i][cam->method].bytes,
+                                     0, init[cam->method][i].bytes,
                                     init[cam->method][i].size);
                if (err < 0) {
                        dev_err(&udev->dev, "error during release sequence\n");
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index e212f2c5448b..24f7ca5e17de 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -491,6 +491,7 @@ static int gfar_remove(struct of_device *ofdev)
        dev_set_drvdata(&ofdev->dev, NULL);
+        unregister_netdev(dev);
        iounmap(priv->regs);
        free_netdev(priv->ndev);
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 6dcac73b4d29..f593fbbb4e52 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -2874,45 +2874,27 @@ static int ipw_fw_dma_add_command_block(struct ipw_priv *priv,
        return 0;
 }
-static int ipw_fw_dma_add_buffer(struct ipw_priv *priv,
+static int ipw_fw_dma_add_buffer(struct ipw_priv *priv, dma_addr_t *src_address,
-                                 u32 src_phys, u32 dest_address, u32 length)
+                                 int nr, u32 dest_address, u32 len)
 {
-        u32 bytes_left = length;
+        int ret, i;
-        u32 src_offset = 0;
+        u32 size;
-        u32 dest_offset = 0;
-        int status = 0;
        IPW_DEBUG_FW(">> \n");
-        IPW_DEBUG_FW_INFO("src_phys=0x%x dest_address=0x%x length=0x%x\n",
+        IPW_DEBUG_FW_INFO("nr=%d dest_address=0x%x len=0x%x\n",
-                          src_phys, dest_address, length);
+                          nr, dest_address, len);
-        while (bytes_left > CB_MAX_LENGTH) {
-                status = ipw_fw_dma_add_command_block(priv,
+        for (i = 0; i < nr; i++) {
-                                                      src_phys + src_offset,
+                size = min_t(u32, len - i * CB_MAX_LENGTH, CB_MAX_LENGTH);
-                                                      dest_address +
+                ret = ipw_fw_dma_add_command_block(priv, src_address[i],
-                                                      dest_offset,
+                                                   dest_address +
-                                                      CB_MAX_LENGTH, 0, 0);
+                                                   i * CB_MAX_LENGTH, size,
-                if (status) {
+                                                   0, 0);
+                if (ret) {
                        IPW_DEBUG_FW_INFO(": Failed\n");
                        return -1;
                } else
                        IPW_DEBUG_FW_INFO(": Added new cb\n");
-                src_offset += CB_MAX_LENGTH;
-                dest_offset += CB_MAX_LENGTH;
-                bytes_left -= CB_MAX_LENGTH;
-        }
-        /* add the buffer tail */
-        if (bytes_left > 0) {
-                status =
-                    ipw_fw_dma_add_command_block(priv, src_phys + src_offset,
-                                                 dest_address + dest_offset,
-                                                 bytes_left, 0, 0);
-                if (status) {
-                        IPW_DEBUG_FW_INFO(": Failed on the buffer tail\n");
-                        return -1;
-                } else
-                        IPW_DEBUG_FW_INFO
-                            (": Adding new cb - the buffer tail\n");
        }
        IPW_DEBUG_FW("<< \n");
@@ -3160,59 +3142,91 @@ static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
 static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
 {
-        int rc = -1;
+        int ret = -1;
        int offset = 0;
        struct fw_chunk *chunk;
-        dma_addr_t shared_phys;
+        int total_nr = 0;
-        u8 *shared_virt;
+        int i;
+        struct pci_pool *pool;
+        u32 *virts[CB_NUMBER_OF_ELEMENTS_SMALL];
+        dma_addr_t phys[CB_NUMBER_OF_ELEMENTS_SMALL];
        IPW_DEBUG_TRACE("<< : \n");
-        shared_virt = pci_alloc_consistent(priv->pci_dev, len, &shared_phys);
-        if (!shared_virt)
+        pool = pci_pool_create("ipw2200", priv->pci_dev, CB_MAX_LENGTH, 0, 0);
+        if (!pool) {
+                IPW_ERROR("pci_pool_create failed\n");
                return -ENOMEM;
+        }
-        memmove(shared_virt, data, len);
        /* Start the Dma */
-        rc = ipw_fw_dma_enable(priv);
+        ret = ipw_fw_dma_enable(priv);
        /* the DMA is already ready this would be a bug. */
        BUG_ON(priv->sram_desc.last_cb_index > 0);
        do {
+                u32 chunk_len;
+                u8 *start;
+                int size;
+                int nr = 0;
                chunk = (struct fw_chunk *)(data + offset);
                offset += sizeof(struct fw_chunk);
+                chunk_len = le32_to_cpu(chunk->length);
+                start = data + offset;
+                nr = (chunk_len + CB_MAX_LENGTH - 1) / CB_MAX_LENGTH;
+                for (i = 0; i < nr; i++) {
+                        virts[total_nr] = pci_pool_alloc(pool, GFP_KERNEL,
+                                                         &phys[total_nr]);
+                        if (!virts[total_nr]) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
+                        size = min_t(u32, chunk_len - i * CB_MAX_LENGTH,
+                                     CB_MAX_LENGTH);
+                        memcpy(virts[total_nr], start, size);
+                        start += size;
+                        total_nr++;
+                        /* We don't support fw chunk larger than 64*8K */
+                        BUG_ON(total_nr > CB_NUMBER_OF_ELEMENTS_SMALL);
+                }
                /* build DMA packet and queue up for sending */
                /* dma to chunk->address, the chunk->length bytes from data +
                 * offeset*/
                /* Dma loading */
-                rc = ipw_fw_dma_add_buffer(priv, shared_phys + offset,
+                ret = ipw_fw_dma_add_buffer(priv, &phys[total_nr - nr],
-                                           le32_to_cpu(chunk->address),
+                                            nr, le32_to_cpu(chunk->address),
-                                           le32_to_cpu(chunk->length));
+                                            chunk_len);
-                if (rc) {
+                if (ret) {
                        IPW_DEBUG_INFO("dmaAddBuffer Failed\n");
                        goto out;
                }
-                offset += le32_to_cpu(chunk->length);
+                offset += chunk_len;
        } while (offset < len);
        /* Run the DMA and wait for the answer */
-        rc = ipw_fw_dma_kick(priv);
+        ret = ipw_fw_dma_kick(priv);
-        if (rc) {
+        if (ret) {
                IPW_ERROR("dmaKick Failed\n");
                goto out;
        }
-        rc = ipw_fw_dma_wait(priv);
+        ret = ipw_fw_dma_wait(priv);
-        if (rc) {
+        if (ret) {
                IPW_ERROR("dmaWaitSync Failed\n");
                goto out;
        }
-      out:
+ out:
-        pci_free_consistent(priv->pci_dev, len, shared_virt, shared_phys);
+        for (i = 0; i < total_nr; i++)
-        return rc;
+                pci_pool_free(pool, virts[i], phys[i]);
+        pci_pool_destroy(pool);
+        return ret;
 }
 /* stop nic */
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index e3a87210e947..e03fe98f0619 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -598,6 +598,29 @@ int pci_iov_resource_bar(struct pci_dev *dev, int resno,
 }
 /**
+ * pci_sriov_resource_alignment - get resource alignment for VF BAR
+ * @dev: the PCI device
+ * @resno: the resource number
+ *
+ * Returns the alignment of the VF BAR found in the SR-IOV capability.
+ * This is not the same as the resource size which is defined as
+ * the VF BAR size multiplied by the number of VFs.  The alignment
+ * is just the VF BAR size.
+ */
+int pci_sriov_resource_alignment(struct pci_dev *dev, int resno)
+{
+        struct resource tmp;
+        enum pci_bar_type type;
+        int reg = pci_iov_resource_bar(dev, resno, &type);
+        
+        if (!reg)
+                return 0;
+         __pci_read_base(dev, type, &tmp, reg);
+        return resource_alignment(&tmp);
+}
+/**
 * pci_restore_iov_state - restore the state of the IOV capability
 * @dev: the PCI device
 */
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index f73bcbedf37c..5ff4d25bf0e9 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -243,6 +243,7 @@ extern int pci_iov_init(struct pci_dev *dev);
 extern void pci_iov_release(struct pci_dev *dev);
 extern int pci_iov_resource_bar(struct pci_dev *dev, int resno,
                                enum pci_bar_type *type);
+extern int pci_sriov_resource_alignment(struct pci_dev *dev, int resno);
 extern void pci_restore_iov_state(struct pci_dev *dev);
 extern int pci_iov_bus_range(struct pci_bus *bus);
@@ -298,4 +299,16 @@ static inline int pci_ats_enabled(struct pci_dev *dev)
 }
 #endif /* CONFIG_PCI_IOV */
+static inline int pci_resource_alignment(struct pci_dev *dev,
+                                         struct resource *res)
+{
+#ifdef CONFIG_PCI_IOV
+        int resno = res - dev->resource;
+        if (resno >= PCI_IOV_RESOURCES && resno <= PCI_IOV_RESOURCE_END)
+                return pci_sriov_resource_alignment(dev, resno);
+#endif
+        return resource_alignment(res);
+}
 #endif /* DRIVERS_PCI_H */
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index b636e245445d..7c443b4583ab 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -25,7 +25,7 @@
 #include <linux/ioport.h>
 #include <linux/cache.h>
 #include <linux/slab.h>
+#include "pci.h"
 static void pbus_assign_resources_sorted(const struct pci_bus *bus)
 {
@@ -384,7 +384,7 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask, unsigned long
                                continue;
                        r_size = resource_size(r);
                        /* For bridges size != alignment */
-                        align = resource_alignment(r);
+                        align = pci_resource_alignment(dev, r);
                        order = __ffs(align) - 20;
                        if (order > 11) {
                                dev_warn(&dev->dev, "BAR %d bad alignment %llx: "
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 1898c7b47907..88cdd1a937d6 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -144,7 +144,7 @@ static int __pci_assign_resource(struct pci_bus *bus, struct pci_dev *dev,
        size = resource_size(res);
        min = (res->flags & IORESOURCE_IO) ? PCIBIOS_MIN_IO : PCIBIOS_MIN_MEM;
-        align = resource_alignment(res);
+        align = pci_resource_alignment(dev, res);
        /* First, try exact prefetching match.. */
        ret = pci_bus_alloc_resource(bus, res, size, align, min,
@@ -178,7 +178,7 @@ int pci_assign_resource(struct pci_dev *dev, int resno)
        struct pci_bus *bus;
        int ret;
-        align = resource_alignment(res);
+        align = pci_resource_alignment(dev, res);
        if (!align) {
                dev_info(&dev->dev, "BAR %d: can't allocate resource (bogus "
                        "alignment) %pR flags %#lx\n",
@@ -259,7 +259,7 @@ void pdev_sort_resources(struct pci_dev *dev, struct resource_list *head)
                if (!(r->flags) || r->parent)
                        continue;
-                r_align = resource_alignment(r);
+                r_align = pci_resource_alignment(dev, r);
                if (!r_align) {
                        dev_warn(&dev->dev, "BAR %d: bogus alignment "
                                "%pR flags %#lx\n",
@@ -271,7 +271,7 @@ void pdev_sort_resources(struct pci_dev *dev, struct resource_list *head)
                        struct resource_list *ln = list->next;
                        if (ln)
-                                align = resource_alignment(ln->res);
+                                align = pci_resource_alignment(ln->dev, ln->res);
                        if (r_align > align) {
                                tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index 81d31ea507d1..51c0a8bee414 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -335,6 +335,7 @@ static void bt_rfkill_poll(struct rfkill *rfkill, void *data)
        if (hci_result != HCI_SUCCESS) {
                /* Can't do anything useful */
                mutex_unlock(&dev->mutex);
+                return;
        }
        new_rfk_state = value;
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index aa39ae83f019..3da18d453488 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -77,7 +77,7 @@ static int autofs4_mount_busy(struct vfsmount *mnt, struct dentry *dentry)
        }
        /* Update the expiry counter if fs is busy */
-        if (!may_umount_tree(mnt)) {
+        if (!may_umount_tree(path.mnt)) {
                struct autofs_info *ino = autofs4_dentry_ino(top);
                ino->last_used = jiffies;
                goto done;
diff --git a/fs/compat.c b/fs/compat.c
index 94502dab972a..6d6f98fe64a0 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1485,20 +1485,15 @@ int compat_do_execve(char * filename,
        if (!bprm)
                goto out_files;
-        retval = -ERESTARTNOINTR;
+        retval = prepare_bprm_creds(bprm);
-        if (mutex_lock_interruptible(&current->cred_guard_mutex))
+        if (retval)
                goto out_free;
-        current->in_execve = 1;
-        retval = -ENOMEM;
-        bprm->cred = prepare_exec_creds();
-        if (!bprm->cred)
-                goto out_unlock;
        retval = check_unsafe_exec(bprm);
        if (retval < 0)
-                goto out_unlock;
+                goto out_free;
        clear_in_exec = retval;
+        current->in_execve = 1;
        file = open_exec(filename);
        retval = PTR_ERR(file);
@@ -1547,7 +1542,6 @@ int compat_do_execve(char * filename,
        /* execve succeeded */
        current->fs->in_exec = 0;
        current->in_execve = 0;
-        mutex_unlock(&current->cred_guard_mutex);
        acct_update_integrals(current);
        free_bprm(bprm);
        if (displaced)
@@ -1567,10 +1561,7 @@ out_file:
 out_unmark:
        if (clear_in_exec)
                current->fs->in_exec = 0;
-out_unlock:
        current->in_execve = 0;
-        mutex_unlock(&current->cred_guard_mutex);
 out_free:
        free_bprm(bprm);
diff --git a/fs/exec.c b/fs/exec.c
index fb4f3cdda78c..172ceb6edde4 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1016,6 +1016,35 @@ out:
 EXPORT_SYMBOL(flush_old_exec);
 /*
+ * Prepare credentials and lock ->cred_guard_mutex.
+ * install_exec_creds() commits the new creds and drops the lock.
+ * Or, if exec fails before, free_bprm() should release ->cred and
+ * and unlock.
+ */
+int prepare_bprm_creds(struct linux_binprm *bprm)
+{
+        if (mutex_lock_interruptible(&current->cred_guard_mutex))
+                return -ERESTARTNOINTR;
+        bprm->cred = prepare_exec_creds();
+        if (likely(bprm->cred))
+                return 0;
+        mutex_unlock(&current->cred_guard_mutex);
+        return -ENOMEM;
+}
+void free_bprm(struct linux_binprm *bprm)
+{
+        free_arg_pages(bprm);
+        if (bprm->cred) {
+                mutex_unlock(&current->cred_guard_mutex);
+                abort_creds(bprm->cred);
+        }
+        kfree(bprm);
+}
+/*
 * install the new credentials for this executable
 */
 void install_exec_creds(struct linux_binprm *bprm)
@@ -1024,12 +1053,13 @@ void install_exec_creds(struct linux_binprm *bprm)
        commit_creds(bprm->cred);
        bprm->cred = NULL;
+        /*
-        /* cred_guard_mutex must be held at least to this point to prevent
+         * cred_guard_mutex must be held at least to this point to prevent
         * ptrace_attach() from altering our determination of the task's
-         * credentials; any time after this it may be unlocked */
+         * credentials; any time after this it may be unlocked.
+         */
        security_bprm_committed_creds(bprm);
+        mutex_unlock(&current->cred_guard_mutex);
 }
 EXPORT_SYMBOL(install_exec_creds);
@@ -1246,14 +1276,6 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 EXPORT_SYMBOL(search_binary_handler);
-void free_bprm(struct linux_binprm *bprm)
-{
-        free_arg_pages(bprm);
-        if (bprm->cred)
-                abort_creds(bprm->cred);
-        kfree(bprm);
-}
 /*
 * sys_execve() executes a new program.
 */
@@ -1277,20 +1299,15 @@ int do_execve(char * filename,
        if (!bprm)
                goto out_files;
-        retval = -ERESTARTNOINTR;
+        retval = prepare_bprm_creds(bprm);
-        if (mutex_lock_interruptible(&current->cred_guard_mutex))
+        if (retval)
                goto out_free;
-        current->in_execve = 1;
-        retval = -ENOMEM;
-        bprm->cred = prepare_exec_creds();
-        if (!bprm->cred)
-                goto out_unlock;
        retval = check_unsafe_exec(bprm);
        if (retval < 0)
-                goto out_unlock;
+                goto out_free;
        clear_in_exec = retval;
+        current->in_execve = 1;
        file = open_exec(filename);
        retval = PTR_ERR(file);
@@ -1340,7 +1357,6 @@ int do_execve(char * filename,
        /* execve succeeded */
        current->fs->in_exec = 0;
        current->in_execve = 0;
-        mutex_unlock(&current->cred_guard_mutex);
        acct_update_integrals(current);
        free_bprm(bprm);
        if (displaced)
@@ -1360,10 +1376,7 @@ out_file:
 out_unmark:
        if (clear_in_exec)
                current->fs->in_exec = 0;
-out_unlock:
        current->in_execve = 0;
-        mutex_unlock(&current->cred_guard_mutex);
 out_free:
        free_bprm(bprm);
diff --git a/fs/ext2/namei.c b/fs/ext2/namei.c
index e1dedb0f7873..78d9b925fc94 100644
--- a/fs/ext2/namei.c
+++ b/fs/ext2/namei.c
@@ -362,6 +362,10 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
        if (dir_de) {
                if (old_dir != new_dir)
                        ext2_set_link(old_inode, dir_de, dir_page, new_dir, 0);
+                else {
+                        kunmap(dir_page);
+                        page_cache_release(dir_page);
+                }
                inode_dec_link_count(old_dir);
        }
        return 0;
diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index 7e0b61be212e..c668bca579c1 100644
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -209,6 +209,7 @@ int nilfs_btnode_prepare_change_key(struct address_space *btnc,
                 * We cannot call radix_tree_preload for the kernels older
                 * than 2.6.23, because it is not exported for modules.
                 */
+retry:
                err = radix_tree_preload(GFP_NOFS & ~__GFP_HIGHMEM);
                if (err)
                        goto failed_unlock;
@@ -219,7 +220,6 @@ int nilfs_btnode_prepare_change_key(struct address_space *btnc,
                                       (unsigned long long)oldkey,
                                       (unsigned long long)newkey);
-retry:
                spin_lock_irq(&btnc->tree_lock);
                err = radix_tree_insert(&btnc->page_tree, newkey, obh->b_page);
                spin_unlock_irq(&btnc->tree_lock);
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 0e781bc88d1e..dcd2040d330c 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -154,7 +154,8 @@ static struct fsnotify_event *get_one_event(struct fsnotify_group *group,
        event = fsnotify_peek_notify_event(group);
-        event_size += roundup(event->name_len, event_size);
+        if (event->name_len)
+                event_size += roundup(event->name_len + 1, event_size);
        if (event_size > count)
                return ERR_PTR(-EINVAL);
@@ -180,7 +181,7 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
        struct fsnotify_event_private_data *fsn_priv;
        struct inotify_event_private_data *priv;
        size_t event_size = sizeof(struct inotify_event);
-        size_t name_len;
+        size_t name_len = 0;
        /* we get the inotify watch descriptor from the event private data */
        spin_lock(&event->lock);
@@ -196,10 +197,12 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
                inotify_free_event_priv(fsn_priv);
        }
-        /* round up event->name_len so it is a multiple of event_size
+        /*
+         * round up event->name_len so it is a multiple of event_size
         * plus an extra byte for the terminating '\0'.
         */
-        name_len = roundup(event->name_len + 1, event_size);
+        if (event->name_len)
+                name_len = roundup(event->name_len + 1, event_size);
        inotify_event.len = name_len;
        inotify_event.mask = inotify_mask_to_arg(event->mask);
@@ -325,8 +328,9 @@ static long inotify_ioctl(struct file *file, unsigned int cmd,
                list_for_each_entry(holder, &group->notification_list, event_list) {
                        event = holder->event;
                        send_len += sizeof(struct inotify_event);
-                        send_len += roundup(event->name_len,
+                        if (event->name_len)
-                                             sizeof(struct inotify_event));
+                                send_len += roundup(event->name_len + 1,
+                                                sizeof(struct inotify_event));
                }
                mutex_unlock(&group->notification_mutex);
                ret = put_user(send_len, (int __user *) p);
@@ -587,6 +591,10 @@ retry:
        /* match the ref from fsnotify_init_markentry() */
        fsnotify_put_mark(&tmp_ientry->fsn_entry);
+        /* if this mark added a new event update the group mask */
+        if (mask & ~group->mask)
+                fsnotify_recalc_group_mask(group);
 out_err:
        if (ret < 0)
                kmem_cache_free(inotify_inode_mark_cachep, tmp_ientry);
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index b401654011a2..8a1e61545f41 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -1747,8 +1747,8 @@ int ocfs2_write_begin_nolock(struct address_space *mapping,
         * we know zeros will only be needed in the first and/or last cluster.
         */
        if (clusters_to_alloc || extents_to_split ||
-            wc->w_desc[0].c_needs_zero ||
+            (wc->w_clen && (wc->w_desc[0].c_needs_zero ||
-            wc->w_desc[wc->w_clen - 1].c_needs_zero)
+                            wc->w_desc[wc->w_clen - 1].c_needs_zero)))
                cluster_of_pages = 1;
        else
                cluster_of_pages = 0;
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index 2f28b7de2c8d..b4957c7d9fe2 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -85,6 +85,17 @@ static int ocfs2_dentry_revalidate(struct dentry *dentry,
                goto bail;
        }
+        /*
+         * If the last lookup failed to create dentry lock, let us
+         * redo it.
+         */
+        if (!dentry->d_fsdata) {
+                mlog(0, "Inode %llu doesn't have dentry lock, "
+                     "returning false\n",
+                     (unsigned long long)OCFS2_I(inode)->ip_blkno);
+                goto bail;
+        }
        ret = 1;
 bail:
diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/linux-2.6/xfs_ioctl32.c
index 0882d166239a..eafcc7c18706 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl32.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl32.c
@@ -619,7 +619,7 @@ xfs_file_compat_ioctl(
        case XFS_IOC_GETVERSION_32:
                cmd = _NATIVE_IOC(cmd, long);
                return xfs_file_ioctl(filp, cmd, p);
-        case XFS_IOC_SWAPEXT: {
+        case XFS_IOC_SWAPEXT_32: {
                struct xfs_swapext        sxp;
                struct compat_xfs_swapext __user *sxu = arg;
diff --git a/include/crypto/algapi.h b/include/crypto/algapi.h
index 010545436efa..5a2bd1cc9656 100644
--- a/include/crypto/algapi.h
+++ b/include/crypto/algapi.h
@@ -137,6 +137,7 @@ struct crypto_instance *crypto_alloc_instance(const char *name,
 void crypto_init_queue(struct crypto_queue *queue, unsigned int max_qlen);
 int crypto_enqueue_request(struct crypto_queue *queue,
                           struct crypto_async_request *request);
+void *__crypto_dequeue_request(struct crypto_queue *queue, unsigned int offset);
 struct crypto_async_request *crypto_dequeue_request(struct crypto_queue *queue);
 int crypto_tfm_in_queue(struct crypto_queue *queue, struct crypto_tfm *tfm);
diff --git a/include/crypto/internal/skcipher.h b/include/crypto/internal/skcipher.h
index 2ba42cd7d6aa..3a748a6bf772 100644
--- a/include/crypto/internal/skcipher.h
+++ b/include/crypto/internal/skcipher.h
@@ -79,8 +79,8 @@ static inline int skcipher_enqueue_givcrypt(
 static inline struct skcipher_givcrypt_request *skcipher_dequeue_givcrypt(
        struct crypto_queue *queue)
 {
-        return container_of(ablkcipher_dequeue_request(queue),
+        return __crypto_dequeue_request(
-                            struct skcipher_givcrypt_request, creq);
+                queue, offsetof(struct skcipher_givcrypt_request, creq.base));
 }
 static inline void *skcipher_givcrypt_reqctx(
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index 61ee18c1bdb4..2046b5b8af48 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -117,6 +117,7 @@ extern int setup_arg_pages(struct linux_binprm * bprm,
                           int executable_stack);
 extern int bprm_mm_init(struct linux_binprm *bprm);
 extern int copy_strings_kernel(int argc,char ** argv,struct linux_binprm *bprm);
+extern int prepare_bprm_creds(struct linux_binprm *bprm);
 extern void install_exec_creds(struct linux_binprm *bprm);
 extern void do_coredump(long signr, int exit_code, struct pt_regs *regs);
 extern int set_binfmt(struct linux_binfmt *new);
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 655e7721580a..df7607e6dce8 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -91,6 +91,9 @@ typedef int (*dm_iterate_devices_fn) (struct dm_target *ti,
                                      iterate_devices_callout_fn fn,
                                      void *data);
+typedef void (*dm_io_hints_fn) (struct dm_target *ti,
+                                struct queue_limits *limits);
 /*
 * Returns:
 *    0: The target can handle the next I/O immediately.
@@ -151,6 +154,7 @@ struct target_type {
        dm_merge_fn merge;
        dm_busy_fn busy;
        dm_iterate_devices_fn iterate_devices;
+        dm_io_hints_fn io_hints;
        /* For internal device-mapper use. */
        struct list_head list;
diff --git a/include/linux/dm-log-userspace.h b/include/linux/dm-log-userspace.h
index 642e3017b51f..8a1f972c0fe9 100644
--- a/include/linux/dm-log-userspace.h
+++ b/include/linux/dm-log-userspace.h
@@ -371,7 +371,18 @@
        (DM_ULOG_REQUEST_MASK & (request_type))
 struct dm_ulog_request {
-        char uuid[DM_UUID_LEN]; /* Ties a request to a specific mirror log */
+        /*
+         * The local unique identifier (luid) and the universally unique
+         * identifier (uuid) are used to tie a request to a specific
+         * mirror log.  A single machine log could probably make due with
+         * just the 'luid', but a cluster-aware log must use the 'uuid' and
+         * the 'luid'.  The uuid is what is required for node to node
+         * communication concerning a particular log, but the 'luid' helps
+         * differentiate between logs that are being swapped and have the
+         * same 'uuid'.  (Think "live" and "inactive" device-mapper tables.)
+         */
+        uint64_t luid;
+        char uuid[DM_UUID_LEN];
        char padding[7];        /* Padding because DM_UUID_LEN = 129 */
        int32_t error;          /* Used to report back processing errors */
diff --git a/include/linux/lmb.h b/include/linux/lmb.h
index c46c89505dac..2442e3f3d033 100644
--- a/include/linux/lmb.h
+++ b/include/linux/lmb.h
@@ -51,7 +51,7 @@ extern u64 __init lmb_alloc_base(u64 size,
 extern u64 __init __lmb_alloc_base(u64 size,
                u64 align, u64 max_addr);
 extern u64 __init lmb_phys_mem_size(void);
-extern u64 __init lmb_end_of_DRAM(void);
+extern u64 lmb_end_of_DRAM(void);
 extern void __init lmb_enforce_memory_limit(u64 memory_limit);
 extern int __init lmb_is_reserved(u64 addr);
 extern int lmb_find(struct lmb_property *res);
diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
index 13e1adf55c4c..6273fa97b527 100644
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -240,6 +240,21 @@ static inline int cancel_delayed_work(struct delayed_work *work)
        return ret;
 }
+/*
+ * Like above, but uses del_timer() instead of del_timer_sync(). This means,
+ * if it returns 0 the timer function may be running and the queueing is in
+ * progress.
+ */
+static inline int __cancel_delayed_work(struct delayed_work *work)
+{
+        int ret;
+        ret = del_timer(&work->timer);
+        if (ret)
+                work_clear_pending(&work->work);
+        return ret;
+}
 extern int cancel_delayed_work_sync(struct delayed_work *work);
 /* Obsolete. use cancel_delayed_work_sync() */
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 7eafb8d54470..82a3191375f5 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -61,8 +61,8 @@ psched_tdiff_bounded(psched_time_t tv1, psched_time_t tv2, psched_time_t bound)
 }
 struct qdisc_watchdog {
-        struct tasklet_hrtimer  timer;
+        struct hrtimer  timer;
-        struct Qdisc            *qdisc;
+        struct Qdisc    *qdisc;
 };
 extern void qdisc_watchdog_init(struct qdisc_watchdog *wd, struct Qdisc *qdisc);
diff --git a/kernel/module.c b/kernel/module.c
index eccb561dd8a3..2d537186191f 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1274,6 +1274,10 @@ static void add_notes_attrs(struct module *mod, unsigned int nsect,
        struct module_notes_attrs *notes_attrs;
        struct bin_attribute *nattr;
+        /* failed to create section attributes, so can't create notes */
+        if (!mod->sect_attrs)
+                return;
        /* Count notes sections and allocate structures.  */
        notes = 0;
        for (i = 0; i < nsect; i++)
@@ -2355,8 +2359,7 @@ static noinline struct module *load_module(void __user *umod,
        if (err < 0)
                goto unlink;
        add_sect_attrs(mod, hdr->e_shnum, secstrings, sechdrs);
-        if (mod->sect_attrs)
+        add_notes_attrs(mod, hdr->e_shnum, secstrings, sechdrs);
-                add_notes_attrs(mod, hdr->e_shnum, secstrings, sechdrs);
        /* Get rid of temporary copy */
        vfree(hdr);
diff --git a/kernel/perf_counter.c b/kernel/perf_counter.c
index f274e1959885..d7cbc579fc80 100644
--- a/kernel/perf_counter.c
+++ b/kernel/perf_counter.c
@@ -50,7 +50,7 @@ static atomic_t nr_task_counters __read_mostly;
 *  1 - disallow cpu counters to unpriv
 *  2 - disallow kernel profiling to unpriv
 */
-int sysctl_perf_counter_paranoid __read_mostly;
+int sysctl_perf_counter_paranoid __read_mostly = 1;
 static inline bool perf_paranoid_cpu(void)
 {
@@ -4066,6 +4066,7 @@ perf_counter_alloc(struct perf_counter_attr *attr,
        hwc->sample_period = attr->sample_period;
        if (attr->freq && attr->sample_freq)
                hwc->sample_period = 1;
+        hwc->last_period = hwc->sample_period;
        atomic64_set(&hwc->period_left, hwc->sample_period);
diff --git a/mm/nommu.c b/mm/nommu.c
index 4bde489ec431..66e81e7e9fe9 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1352,6 +1352,7 @@ unsigned long do_mmap_pgoff(struct file *file,
        }
        vma->vm_region = region;
+        add_nommu_region(region);
        /* set up the mapping */
        if (file && vma->vm_flags & VM_SHARED)
@@ -1361,8 +1362,6 @@ unsigned long do_mmap_pgoff(struct file *file,
        if (ret < 0)
                goto error_put_region;
-        add_nommu_region(region);
        /* okay... we have a mapping; now we have to register it */
        result = vma->vm_start;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 5cc986eb9f6f..a0de15f46987 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -817,13 +817,15 @@ __rmqueue_fallback(struct zone *zone, int order, int start_migratetype)
                         * agressive about taking ownership of free pages
                         */
                        if (unlikely(current_order >= (pageblock_order >> 1)) ||
-                                        start_migratetype == MIGRATE_RECLAIMABLE) {
+                                        start_migratetype == MIGRATE_RECLAIMABLE ||
+                                        page_group_by_mobility_disabled) {
                                unsigned long pages;
                                pages = move_freepages_block(zone, page,
                                                                start_migratetype);
                                /* Claim the whole block if over half of it is free */
-                                if (pages >= (1 << (pageblock_order-1)))
+                                if (pages >= (1 << (pageblock_order-1)) ||
+                                                page_group_by_mobility_disabled)
                                        set_pageblock_migratetype(page,
                                                                start_migratetype);
diff --git a/mm/percpu.c b/mm/percpu.c
index 5fe37842e0ea..3311c8919f37 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -197,7 +197,12 @@ static unsigned long pcpu_chunk_addr(struct pcpu_chunk *chunk,
 static bool pcpu_chunk_page_occupied(struct pcpu_chunk *chunk,
                                     int page_idx)
 {
-        return *pcpu_chunk_pagep(chunk, 0, page_idx) != NULL;
+        /*
+         * Any possible cpu id can be used here, so there's no need to
+         * worry about preemption or cpu hotplug.
+         */
+        return *pcpu_chunk_pagep(chunk, raw_smp_processor_id(),
+                                 page_idx) != NULL;
 }
 /* set the pointer to a chunk in a page struct */
@@ -297,6 +302,14 @@ static struct pcpu_chunk *pcpu_chunk_addr_search(void *addr)
                return pcpu_first_chunk;
        }
+        /*
+         * The address is relative to unit0 which might be unused and
+         * thus unmapped.  Offset the address to the unit space of the
+         * current processor before looking it up in the vmalloc
+         * space.  Note that any possible cpu id can be used here, so
+         * there's no need to worry about preemption or cpu hotplug.
+         */
+        addr += raw_smp_processor_id() * pcpu_unit_size;
        return pcpu_get_page_chunk(vmalloc_to_page(addr));
 }
diff --git a/mm/slub.c b/mm/slub.c
index b9f1491a58a1..b6276753626e 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2594,8 +2594,6 @@ static inline int kmem_cache_close(struct kmem_cache *s)
 */
 void kmem_cache_destroy(struct kmem_cache *s)
 {
-        if (s->flags & SLAB_DESTROY_BY_RCU)
-                rcu_barrier();
        down_write(&slub_lock);
        s->refcount--;
        if (!s->refcount) {
@@ -2606,6 +2604,8 @@ void kmem_cache_destroy(struct kmem_cache *s)
                                "still has objects.\n", s->name, __func__);
                        dump_stack();
                }
+                if (s->flags & SLAB_DESTROY_BY_RCU)
+                        rcu_barrier();
                sysfs_slab_remove(s);
        } else
                up_write(&slub_lock);
diff --git a/net/core/sock.c b/net/core/sock.c
index bbb25be7ddfe..76334228ed1c 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1025,6 +1025,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
                sk->sk_prot = sk->sk_prot_creator = prot;
                sock_lock_init(sk);
                sock_net_set(sk, get_net(net));
+                atomic_set(&sk->sk_wmem_alloc, 1);
        }
        return sk;
@@ -1872,7 +1873,6 @@ void sock_init_data(struct socket *sock, struct sock *sk)
         */
        smp_wmb();
        atomic_set(&sk->sk_refcnt, 1);
-        atomic_set(&sk->sk_wmem_alloc, 1);
        atomic_set(&sk->sk_drops, 0);
 }
 EXPORT_SYMBOL(sock_init_data);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 92e6f3a52c13..fdb694e9f759 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -458,7 +458,7 @@ EXPORT_SYMBOL(qdisc_warn_nonwc);
 static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
 {
        struct qdisc_watchdog *wd = container_of(timer, struct qdisc_watchdog,
-                                                 timer.timer);
+                                                 timer);
        wd->qdisc->flags &= ~TCQ_F_THROTTLED;
        __netif_schedule(qdisc_root(wd->qdisc));
@@ -468,8 +468,8 @@ static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
 void qdisc_watchdog_init(struct qdisc_watchdog *wd, struct Qdisc *qdisc)
 {
-        tasklet_hrtimer_init(&wd->timer, qdisc_watchdog,
+        hrtimer_init(&wd->timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
-                             CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+        wd->timer.function = qdisc_watchdog;
        wd->qdisc = qdisc;
 }
 EXPORT_SYMBOL(qdisc_watchdog_init);
@@ -485,13 +485,13 @@ void qdisc_watchdog_schedule(struct qdisc_watchdog *wd, psched_time_t expires)
        wd->qdisc->flags |= TCQ_F_THROTTLED;
        time = ktime_set(0, 0);
        time = ktime_add_ns(time, PSCHED_TICKS2NS(expires));
-        tasklet_hrtimer_start(&wd->timer, time, HRTIMER_MODE_ABS);
+        hrtimer_start(&wd->timer, time, HRTIMER_MODE_ABS);
 }
 EXPORT_SYMBOL(qdisc_watchdog_schedule);
 void qdisc_watchdog_cancel(struct qdisc_watchdog *wd)
 {
-        tasklet_hrtimer_cancel(&wd->timer);
+        hrtimer_cancel(&wd->timer);
        wd->qdisc->flags &= ~TCQ_F_THROTTLED;
 }
 EXPORT_SYMBOL(qdisc_watchdog_cancel);
@@ -1456,6 +1456,8 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags);
        tcm = NLMSG_DATA(nlh);
        tcm->tcm_family = AF_UNSPEC;
+        tcm->tcm__pad1 = 0;
+        tcm->tcm__pad2 = 0;
        tcm->tcm_ifindex = qdisc_dev(q)->ifindex;
        tcm->tcm_parent = q->handle;
        tcm->tcm_handle = q->handle;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 149b0405c5ec..d5798e17a832 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -163,7 +163,7 @@ struct cbq_sched_data
        psched_time_t           now_rt;         /* Cached real time */
        unsigned                pmask;
-        struct tasklet_hrtimer  delay_timer;
+        struct hrtimer          delay_timer;
        struct qdisc_watchdog   watchdog;       /* Watchdog timer,
                                                   started when CBQ has
                                                   backlog, but cannot
@@ -503,8 +503,6 @@ static void cbq_ovl_delay(struct cbq_class *cl)
                cl->undertime = q->now + delay;
                if (delay > 0) {
-                        struct hrtimer *ht;
                        sched += delay + cl->penalty;
                        cl->penalized = sched;
                        cl->cpriority = TC_CBQ_MAXPRIO;
@@ -512,12 +510,12 @@ static void cbq_ovl_delay(struct cbq_class *cl)
                        expires = ktime_set(0, 0);
                        expires = ktime_add_ns(expires, PSCHED_TICKS2NS(sched));
-                        ht = &q->delay_timer.timer;
+                        if (hrtimer_try_to_cancel(&q->delay_timer) &&
-                        if (hrtimer_try_to_cancel(ht) &&
+                            ktime_to_ns(ktime_sub(
-                            ktime_to_ns(ktime_sub(hrtimer_get_expires(ht),
+                                        hrtimer_get_expires(&q->delay_timer),
-                                                  expires)) > 0)
+                                        expires)) > 0)
-                                hrtimer_set_expires(ht, expires);
+                                hrtimer_set_expires(&q->delay_timer, expires);
-                        hrtimer_restart(ht);
+                        hrtimer_restart(&q->delay_timer);
                        cl->delayed = 1;
                        cl->xstats.overactions++;
                        return;
@@ -593,7 +591,7 @@ static psched_tdiff_t cbq_undelay_prio(struct cbq_sched_data *q, int prio,
 static enum hrtimer_restart cbq_undelay(struct hrtimer *timer)
 {
        struct cbq_sched_data *q = container_of(timer, struct cbq_sched_data,
-                                                delay_timer.timer);
+                                                delay_timer);
        struct Qdisc *sch = q->watchdog.qdisc;
        psched_time_t now;
        psched_tdiff_t delay = 0;
@@ -623,7 +621,7 @@ static enum hrtimer_restart cbq_undelay(struct hrtimer *timer)
                time = ktime_set(0, 0);
                time = ktime_add_ns(time, PSCHED_TICKS2NS(now + delay));
-                tasklet_hrtimer_start(&q->delay_timer, time, HRTIMER_MODE_ABS);
+                hrtimer_start(&q->delay_timer, time, HRTIMER_MODE_ABS);
        }
        sch->flags &= ~TCQ_F_THROTTLED;
@@ -1216,7 +1214,7 @@ cbq_reset(struct Qdisc* sch)
        q->tx_class = NULL;
        q->tx_borrowed = NULL;
        qdisc_watchdog_cancel(&q->watchdog);
-        tasklet_hrtimer_cancel(&q->delay_timer);
+        hrtimer_cancel(&q->delay_timer);
        q->toplevel = TC_CBQ_MAXLEVEL;
        q->now = psched_get_time();
        q->now_rt = q->now;
@@ -1399,8 +1397,7 @@ static int cbq_init(struct Qdisc *sch, struct nlattr *opt)
        q->link.minidle = -0x7FFFFFFF;
        qdisc_watchdog_init(&q->watchdog, sch);
-        tasklet_hrtimer_init(&q->delay_timer, cbq_undelay,
+        hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
-                             CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
        q->delay_timer.function = cbq_undelay;
        q->toplevel = TC_CBQ_MAXLEVEL;
        q->now = psched_get_time();
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index ebfcf9b89909..df1039f077c2 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -937,6 +937,7 @@ static inline void
 rpc_task_force_reencode(struct rpc_task *task)
 {
        task->tk_rqstp->rq_snd_buf.len = 0;
+        task->tk_rqstp->rq_bytes_sent = 0;
 }
 static inline void
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 6f683e451f2b..30eeb304351c 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6423,9 +6423,9 @@ static struct hda_verb alc885_mbp_ch2_init[] = {
 };
 /*
- * 6ch mode
+ * 4ch mode
 */
-static struct hda_verb alc885_mbp_ch6_init[] = {
+static struct hda_verb alc885_mbp_ch4_init[] = {
        { 0x1a, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT },
        { 0x1a, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
        { 0x1a, AC_VERB_SET_CONNECT_SEL, 0x01 },
@@ -6434,9 +6434,9 @@ static struct hda_verb alc885_mbp_ch6_init[] = {
        { } /* end */
 };
-static struct hda_channel_mode alc885_mbp_6ch_modes[2] = {
+static struct hda_channel_mode alc885_mbp_4ch_modes[2] = {
        { 2, alc885_mbp_ch2_init },
-        { 6, alc885_mbp_ch6_init },
+        { 4, alc885_mbp_ch4_init },
 };
 /*
@@ -6497,10 +6497,11 @@ static struct snd_kcontrol_new alc882_base_mixer[] = {
 };
 static struct snd_kcontrol_new alc885_mbp3_mixer[] = {
-        HDA_CODEC_VOLUME("Front Playback Volume", 0x0c, 0x00, HDA_OUTPUT),
+        HDA_CODEC_VOLUME("Speaker Playback Volume", 0x0c, 0x00, HDA_OUTPUT),
-        HDA_BIND_MUTE   ("Front Playback Switch", 0x0c, 0x02, HDA_INPUT),
+        HDA_BIND_MUTE   ("Speaker Playback Switch", 0x0c, 0x02, HDA_INPUT),
-        HDA_CODEC_MUTE  ("Speaker Playback Switch", 0x14, 0x00, HDA_OUTPUT),
+        HDA_CODEC_VOLUME("Headphone Playback Volume", 0x0e, 0x00, HDA_OUTPUT),
-        HDA_CODEC_VOLUME("Line-Out Playback Volume", 0x0d, 0x00, HDA_OUTPUT),
+        HDA_BIND_MUTE   ("Headphone Playback Switch", 0x0e, 0x02, HDA_INPUT),
+        HDA_CODEC_VOLUME("Surround Playback Volume", 0x0d, 0x00, HDA_OUTPUT),
        HDA_CODEC_VOLUME("Line Playback Volume", 0x0b, 0x02, HDA_INPUT),
        HDA_CODEC_MUTE  ("Line Playback Switch", 0x0b, 0x02, HDA_INPUT),
        HDA_CODEC_VOLUME("Mic Playback Volume", 0x0b, 0x00, HDA_INPUT),
@@ -6814,14 +6815,18 @@ static struct hda_verb alc885_mbp3_init_verbs[] = {
        {0x0d, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_ZERO},
        {0x0d, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
        {0x0d, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)},
+        /* HP mixer */
+        {0x0e, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_ZERO},
+        {0x0e, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
+        {0x0e, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(1)},
        /* Front Pin: output 0 (0x0c) */
        {0x14, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
        {0x14, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
        {0x14, AC_VERB_SET_CONNECT_SEL, 0x00},
-        /* HP Pin: output 0 (0x0d) */
+        /* HP Pin: output 0 (0x0e) */
        {0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, 0xc4},
-        {0x15, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE},
+        {0x15, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
-        {0x15, AC_VERB_SET_CONNECT_SEL, 0x00},
+        {0x15, AC_VERB_SET_CONNECT_SEL, 0x02},
        {0x15, AC_VERB_SET_UNSOLICITED_ENABLE, ALC880_HP_EVENT | AC_USRSP_EN},
        /* Mic (rear) pin: input vref at 80% */
        {0x18, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF80},
@@ -7195,10 +7200,11 @@ static struct alc_config_preset alc882_presets[] = {
                .mixers = { alc885_mbp3_mixer, alc882_chmode_mixer },
                .init_verbs = { alc885_mbp3_init_verbs,
                                alc880_gpio1_init_verbs },
-                .num_dacs = ARRAY_SIZE(alc882_dac_nids),
+                .num_dacs = 2,
                .dac_nids = alc882_dac_nids,
-                .channel_mode = alc885_mbp_6ch_modes,
+                .hp_nid = 0x04,
-                .num_channel_mode = ARRAY_SIZE(alc885_mbp_6ch_modes),
+                .channel_mode = alc885_mbp_4ch_modes,
+                .num_channel_mode = ARRAY_SIZE(alc885_mbp_4ch_modes),
                .input_mux = &alc882_capture_source,
                .dig_out_nid = ALC882_DIGOUT_NID,
                .dig_in_nid = ALC882_DIGIN_NID,
diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index 9008b4b013aa..e8f10b10cceb 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -1395,6 +1395,7 @@ static int patch_vt1708(struct hda_codec *codec)
        if (!spec->adc_nids && spec->input_mux) {
                spec->adc_nids = vt1708_adc_nids;
                spec->num_adc_nids = ARRAY_SIZE(vt1708_adc_nids);
+                get_mux_nids(codec);
                spec->mixers[spec->num_mixers] = vt1708_capture_mixer;
                spec->num_mixers++;
        }