260 files changed, 2888 insertions, 1872 deletions

diff --git a/Documentation/watchdog/watchdog-parameters.txt b/Documentation/watchdog/watchdog-parameters.txt
index 41c95cc1dc1f..17ddd822b456 100644
--- a/Documentation/watchdog/watchdog-parameters.txt
+++ b/Documentation/watchdog/watchdog-parameters.txt
@@ -125,6 +125,11 @@ ibmasr:
 nowayout: Watchdog cannot be stopped once started
         (default=kernel config parameter)
 -------------------------------------------------
+imx2_wdt:
+timeout: Watchdog timeout in seconds (default 60 s)
+nowayout: Watchdog cannot be stopped once started
+        (default=kernel config parameter)
+-------------------------------------------------
 indydog:
 nowayout: Watchdog cannot be stopped once started
         (default=kernel config parameter)
diff --git a/MAINTAINERS b/MAINTAINERS
index 6c73b3bc7f34..a07a49deb47b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -896,11 +896,13 @@ S:	Maintained
 
 ARM/SAMSUNG ARM ARCHITECTURES
 M:      Ben Dooks <ben-linux@fluff.org>
+M:      Kukjin Kim <kgene.kim@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.fluff.org/ben/linux/
 S:      Maintained
-F:      arch/arm/plat-s3c/
+F:      arch/arm/plat-samsung/
 F:      arch/arm/plat-s3c24xx/
+F:      arch/arm/plat-s5p/
 
 ARM/S3C2410 ARM ARCHITECTURE
 M:      Ben Dooks <ben-linux@fluff.org>
@@ -1148,7 +1150,7 @@ F:	drivers/mmc/host/atmel-mci.c
 F:      drivers/mmc/host/atmel-mci-regs.h
 
 ATMEL AT91 / AT32 SERIAL DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
 S:      Supported
 F:      drivers/serial/atmel_serial.c
 
@@ -1160,18 +1162,18 @@ F:	drivers/video/atmel_lcdfb.c
 F:      include/video/atmel_lcdc.h
 
 ATMEL MACB ETHERNET DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
 S:      Supported
 F:      drivers/net/macb.*
 
 ATMEL SPI DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
 S:      Supported
 F:      drivers/spi/atmel_spi.*
 
 ATMEL USBA UDC DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
-L:      kernel@avr32linux.org
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://avr32linux.org/twiki/bin/view/Main/AtmelUsbDeviceDriver
 S:      Supported
 F:      drivers/usb/gadget/atmel_usba_udc.*
@@ -2109,11 +2111,18 @@ F:	drivers/edac/i5000_edac.c
 
 EDAC-I5400
 M:      Mauro Carvalho Chehab <mchehab@redhat.com>
-L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 F:      drivers/edac/i5400_edac.c
 
+EDAC-I7CORE
+M:      Mauro Carvalho Chehab <mchehab@redhat.com>
+L:      linux-edac@vger.kernel.org
+W:      bluesmoke.sourceforge.net
+S:      Maintained
+F:      drivers/edac/i7core_edac.c linux/edac_mce.h drivers/edac/edac_mce.c
+
 EDAC-I82975X
 M:      Ranganathan Desikan <ravi@jetztechnologies.com>
 M:      "Arvind R." <arvind@jetztechnologies.com>
@@ -3380,7 +3389,7 @@ KPROBES
 M:      Ananth N Mavinakayanahalli <ananth@in.ibm.com>
 M:      Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
 M:      "David S. Miller" <davem@davemloft.net>
-M:      Masami Hiramatsu <mhiramat@redhat.com>
+M:      Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
 S:      Maintained
 F:      Documentation/kprobes.txt
 F:      include/linux/kprobes.h
@@ -4628,6 +4637,12 @@ M:	Robert Jarzmik <robert.jarzmik@free.fr>
 L:      rtc-linux@googlegroups.com
 S:      Maintained
 
+QLOGIC QLA1280 SCSI DRIVER
+M:      Michael Reed <mdr@sgi.com>
+L:      linux-scsi@vger.kernel.org
+S:      Maintained
+F:      drivers/scsi/qla1280.[ch]
+
 QLOGIC QLA2XXX FC-SCSI DRIVER
 M:      Andrew Vasquez <andrew.vasquez@qlogic.com>
 M:      linux-driver@qlogic.com
diff --git a/Makefile b/Makefile
index 662e820cfc4a..f9835c80a274 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 35
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Sheep on Meth
 
 # *DOCUMENTATION*
@@ -883,80 +883,10 @@ PHONY += $(vmlinux-dirs)
 $(vmlinux-dirs): prepare scripts
         $(Q)$(MAKE) $(build)=$@
 
-# Build the kernel release string
-#
-# The KERNELRELEASE value built here is stored in the file
-# include/config/kernel.release, and is used when executing several
-# make targets, such as "make install" or "make modules_install."
-#
-# The eventual kernel release string consists of the following fields,
-# shown in a hierarchical format to show how smaller parts are concatenated
-# to form the larger and final value, with values coming from places like
-# the Makefile, kernel config options, make command line options and/or
-# SCM tag information.
-#
-#       $(KERNELVERSION)
-#         $(VERSION)                    eg, 2
-#         $(PATCHLEVEL)                 eg, 6
-#         $(SUBLEVEL)                   eg, 18
-#         $(EXTRAVERSION)               eg, -rc6
-#       $(localver-full)
-#         $(localver)
-#           localversion*               (files without backups, containing '~')
-#           $(CONFIG_LOCALVERSION)      (from kernel config setting)
-#         $(LOCALVERSION)               (from make command line, if provided)
-#         $(localver-extra)
-#           $(scm-identifier)           (unique SCM tag, if one exists)
-#             ./scripts/setlocalversion (only with CONFIG_LOCALVERSION_AUTO)
-#             .scmversion               (only with CONFIG_LOCALVERSION_AUTO)
-#           +                           (only without CONFIG_LOCALVERSION_AUTO
-#                                        and without LOCALVERSION= and
-#                                        repository is at non-tagged commit)
-#
-# For kernels without CONFIG_LOCALVERSION_AUTO compiled from an SCM that has
-# been revised beyond a tagged commit, `+' is appended to the version string
-# when not overridden by using "make LOCALVERSION=".  This indicates that the
-# kernel is not a vanilla release version and has been modified.
-
-pattern = ".*/localversion[^~]*"
-string  = $(shell cat /dev/null \
-           `find $(objtree) $(srctree) -maxdepth 1 -regex $(pattern) | sort -u`)
-
-localver = $(subst $(space),, $(string) \
-                              $(patsubst "%",%,$(CONFIG_LOCALVERSION)))
-
-# scripts/setlocalversion is called to create a unique identifier if the source
-# is managed by a known SCM and the repository has been revised since the last
-# tagged (release) commit.  The format of the identifier is determined by the
-# SCM's implementation.
-#
-# .scmversion is used when generating rpm packages so we do not loose
-# the version information from the SCM when we do the build of the kernel
-# from the copied source
-ifeq ($(wildcard .scmversion),)
-        scm-identifier = $(shell $(CONFIG_SHELL) \
-                         $(srctree)/scripts/setlocalversion $(srctree))
-else
-        scm-identifier = $(shell cat .scmversion 2> /dev/null)
-endif
-
-ifdef CONFIG_LOCALVERSION_AUTO
-        localver-extra = $(scm-identifier)
-else
-        ifneq ($(scm-identifier),)
-                ifeq ("$(origin LOCALVERSION)", "undefined")
-                        localver-extra = +
-                endif
-        endif
-endif
-
-localver-full = $(localver)$(LOCALVERSION)$(localver-extra)
-
 # Store (new) KERNELRELASE string in include/config/kernel.release
-kernelrelease = $(KERNELVERSION)$(localver-full)
 include/config/kernel.release: include/config/auto.conf FORCE
         $(Q)rm -f $@
-        $(Q)echo $(kernelrelease) > $@
+        $(Q)echo "$(KERNELVERSION)$$($(CONFIG_SHELL) $(srctree)/scripts/setlocalversion $(srctree))" > $@
 
 
 # Things we need to do before we recursively start building the kernel
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 1f254bd6c937..98922f7d2d12 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -955,7 +955,8 @@ config XSCALE_PMU
         default y
 
 config CPU_HAS_PMU
-        depends on CPU_V6 || CPU_V7 || XSCALE_PMU
+        depends on (CPU_V6 || CPU_V7 || XSCALE_PMU) && \
+                   (!ARCH_OMAP3 || OMAP3_EMU)
         default y
         bool
 
diff --git a/arch/arm/include/asm/mach/udc_pxa2xx.h b/arch/arm/include/asm/mach/udc_pxa2xx.h
index f3eabf1ecec3..833306ee9e7f 100644
--- a/arch/arm/include/asm/mach/udc_pxa2xx.h
+++ b/arch/arm/include/asm/mach/udc_pxa2xx.h
@@ -21,8 +21,8 @@ struct pxa2xx_udc_mach_info {
          * here.  Note that sometimes the signals go through inverters...
          */
         bool    gpio_vbus_inverted;
-        u16     gpio_vbus;                      /* high == vbus present */
+        int     gpio_vbus;                      /* high == vbus present */
         bool    gpio_pullup_inverted;
-        u16     gpio_pullup;                    /* high == pullup activated */
+        int     gpio_pullup;                    /* high == pullup activated */
 };
 
diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
index 6a89567ffc5b..7bed3daf83b8 100644
--- a/arch/arm/include/asm/processor.h
+++ b/arch/arm/include/asm/processor.h
@@ -91,7 +91,11 @@ extern void release_thread(struct task_struct *);
 
 unsigned long get_wchan(struct task_struct *p);
 
+#if __LINUX_ARM_ARCH__ == 6
+#define cpu_relax()                     smp_mb()
+#else
 #define cpu_relax()                     barrier()
+#endif
 
 /*
  * Create a new kernel thread
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index c45768614c8a..de12536d687f 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -201,7 +201,7 @@ armpmu_event_update(struct perf_event *event,
 {
         int shift = 64 - 32;
         s64 prev_raw_count, new_raw_count;
-        s64 delta;
+        u64 delta;
 
 again:
         prev_raw_count = atomic64_read(&hwc->prev_count);
diff --git a/arch/arm/mach-mx3/mach-mx31lilly.c b/arch/arm/mach-mx3/mach-mx31lilly.c
index d3d5877c750e..b2c7f512070f 100644
--- a/arch/arm/mach-mx3/mach-mx31lilly.c
+++ b/arch/arm/mach-mx3/mach-mx31lilly.c
@@ -115,6 +115,8 @@ static struct platform_device physmap_flash_device = {
 
 /* USB */
 
+#if defined(CONFIG_USB_ULPI)
+
 #define USB_PAD_CFG (PAD_CTL_DRV_MAX | PAD_CTL_SRE_FAST | PAD_CTL_HYS_CMOS | \
                         PAD_CTL_ODE_CMOS | PAD_CTL_100K_PU)
 
@@ -244,10 +246,20 @@ static struct mxc_usbh_platform_data usbh2_pdata = {
         .flags  = MXC_EHCI_POWER_PINS_ENABLED,
 };
 
-static struct platform_device *devices[] __initdata = {
-        &smsc91x_device,
-        &physmap_flash_device,
-};
+static void lilly1131_usb_init(void)
+{
+        usbotg_pdata.otg = otg_ulpi_create(&mxc_ulpi_access_ops,
+                                USB_OTG_DRV_VBUS | USB_OTG_DRV_VBUS_EXT);
+        usbh2_pdata.otg = otg_ulpi_create(&mxc_ulpi_access_ops,
+                                USB_OTG_DRV_VBUS | USB_OTG_DRV_VBUS_EXT);
+
+        mxc_register_device(&mxc_usbh1, &usbh1_pdata);
+        mxc_register_device(&mxc_usbh2, &usbh2_pdata);
+}
+
+#else
+static inline void lilly1131_usb_init(void) {}
+#endif /* CONFIG_USB_ULPI */
 
 /* SPI */
 
@@ -279,6 +291,11 @@ static struct spi_board_info mc13783_dev __initdata = {
         .platform_data  = &mc13783_pdata,
 };
 
+static struct platform_device *devices[] __initdata = {
+        &smsc91x_device,
+        &physmap_flash_device,
+};
+
 static int mx31lilly_baseboard;
 core_param(mx31lilly_baseboard, mx31lilly_baseboard, int, 0444);
 
@@ -321,13 +338,7 @@ static void __init mx31lilly_board_init(void)
         platform_add_devices(devices, ARRAY_SIZE(devices));
 
         /* USB */
-        usbotg_pdata.otg = otg_ulpi_create(&mxc_ulpi_access_ops,
-                                USB_OTG_DRV_VBUS | USB_OTG_DRV_VBUS_EXT);
-        usbh2_pdata.otg = otg_ulpi_create(&mxc_ulpi_access_ops,
-                                USB_OTG_DRV_VBUS | USB_OTG_DRV_VBUS_EXT);
-
-        mxc_register_device(&mxc_usbh1, &usbh1_pdata);
-        mxc_register_device(&mxc_usbh2, &usbh2_pdata);
+        lilly1131_usb_init();
 }
 
 static void __init mx31lilly_timer_init(void)
diff --git a/arch/arm/mach-omap2/board-omap3stalker.c b/arch/arm/mach-omap2/board-omap3stalker.c
index f848ba8dbc16..a04cffd691c5 100644
--- a/arch/arm/mach-omap2/board-omap3stalker.c
+++ b/arch/arm/mach-omap2/board-omap3stalker.c
@@ -538,9 +538,7 @@ static void ads7846_dev_init(void)
                 printk(KERN_ERR "can't get ads7846 pen down GPIO\n");
 
         gpio_direction_input(OMAP3_STALKER_TS_GPIO);
-
-        omap_set_gpio_debounce(OMAP3_STALKER_TS_GPIO, 1);
-        omap_set_gpio_debounce_time(OMAP3_STALKER_TS_GPIO, 0xa);
+        gpio_set_debounce(OMAP3_STALKER_TS_GPIO, 310);
 }
 
 static int ads7846_get_pendown_state(void)
diff --git a/arch/arm/mach-omap2/clock44xx_data.c b/arch/arm/mach-omap2/clock44xx_data.c
index 02804224517b..e10db7a90cb2 100644
--- a/arch/arm/mach-omap2/clock44xx_data.c
+++ b/arch/arm/mach-omap2/clock44xx_data.c
@@ -1369,6 +1369,7 @@ static struct clk emif1_ick = {
         .ops            = &clkops_omap2_dflt,
         .enable_reg     = OMAP4430_CM_MEMIF_EMIF_1_CLKCTRL,
         .enable_bit     = OMAP4430_MODULEMODE_HWCTRL,
+        .flags          = ENABLE_ON_INIT,
         .clkdm_name     = "l3_emif_clkdm",
         .parent         = &ddrphy_ck,
         .recalc         = &followparent_recalc,
@@ -1379,6 +1380,7 @@ static struct clk emif2_ick = {
         .ops            = &clkops_omap2_dflt,
         .enable_reg     = OMAP4430_CM_MEMIF_EMIF_2_CLKCTRL,
         .enable_bit     = OMAP4430_MODULEMODE_HWCTRL,
+        .flags          = ENABLE_ON_INIT,
         .clkdm_name     = "l3_emif_clkdm",
         .parent         = &ddrphy_ck,
         .recalc         = &followparent_recalc,
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 95c9a5f774e1..b7a4133267d8 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -409,10 +409,11 @@ static int _init_main_clk(struct omap_hwmod *oh)
                 return 0;
 
         oh->_clk = omap_clk_get_by_name(oh->main_clk);
-        if (!oh->_clk)
+        if (!oh->_clk) {
                 pr_warning("omap_hwmod: %s: cannot clk_get main_clk %s\n",
                            oh->name, oh->main_clk);
                 return -EINVAL;
+        }
 
         if (!oh->_clk->clkdm)
                 pr_warning("omap_hwmod: %s: missing clockdomain for %s.\n",
@@ -444,10 +445,11 @@ static int _init_interface_clks(struct omap_hwmod *oh)
                         continue;
 
                 c = omap_clk_get_by_name(os->clk);
-                if (!c)
+                if (!c) {
                         pr_warning("omap_hwmod: %s: cannot clk_get interface_clk %s\n",
                                    oh->name, os->clk);
                         ret = -EINVAL;
+                }
                 os->_clk = c;
         }
 
@@ -470,10 +472,11 @@ static int _init_opt_clks(struct omap_hwmod *oh)
 
         for (i = oh->opt_clks_cnt, oc = oh->opt_clks; i > 0; i--, oc++) {
                 c = omap_clk_get_by_name(oc->clk);
-                if (!c)
+                if (!c) {
                         pr_warning("omap_hwmod: %s: cannot clk_get opt_clk %s\n",
                                    oh->name, oc->clk);
                         ret = -EINVAL;
+                }
                 oc->_clk = c;
         }
 
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 2e967716cc3f..b88737fd6cfe 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -99,7 +99,7 @@ static void omap3_enable_io_chain(void)
                 /* Do a readback to assure write has been done */
                 prm_read_mod_reg(WKUP_MOD, PM_WKEN);
 
-                while (!(prm_read_mod_reg(WKUP_MOD, PM_WKST) &
+                while (!(prm_read_mod_reg(WKUP_MOD, PM_WKEN) &
                          OMAP3430_ST_IO_CHAIN_MASK)) {
                         timeout++;
                         if (timeout > 1000) {
@@ -108,7 +108,7 @@ static void omap3_enable_io_chain(void)
                                 return;
                         }
                         prm_set_mod_reg_bits(OMAP3430_ST_IO_CHAIN_MASK,
-                                             WKUP_MOD, PM_WKST);
+                                             WKUP_MOD, PM_WKEN);
                 }
         }
 }
diff --git a/arch/arm/mach-omap2/usb-ehci.c b/arch/arm/mach-omap2/usb-ehci.c
index c68f799e83c5..d72d1ac30333 100644
--- a/arch/arm/mach-omap2/usb-ehci.c
+++ b/arch/arm/mach-omap2/usb-ehci.c
@@ -20,6 +20,8 @@
 #include <linux/delay.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/dma-mapping.h>
+
 #include <asm/io.h>
 #include <plat/mux.h>
 
diff --git a/arch/arm/mach-pxa/mioa701.c b/arch/arm/mach-pxa/mioa701.c
index d60db87dde08..fa6a708b4099 100644
--- a/arch/arm/mach-pxa/mioa701.c
+++ b/arch/arm/mach-pxa/mioa701.c
@@ -697,7 +697,7 @@ static struct i2c_board_info __initdata mioa701_pi2c_devices[] = {
 };
 
 /* Board I2C devices. */
-static struct i2c_board_info __initdata mioa701_i2c_devices[] = {
+static struct i2c_board_info mioa701_i2c_devices[] = {
         {
                 I2C_BOARD_INFO("mt9m111", 0x5d),
         },
diff --git a/arch/arm/mach-pxa/z2.c b/arch/arm/mach-pxa/z2.c
index f5d1ae3db3a4..d303c6929d32 100644
--- a/arch/arm/mach-pxa/z2.c
+++ b/arch/arm/mach-pxa/z2.c
@@ -3,8 +3,9 @@
  *
  *  Support for the Zipit Z2 Handheld device.
  *
- *  Author:     Ken McGuire
- *  Created:    Jan 25, 2009
+ *  Copyright (C) 2009-2010 Marek Vasut <marek.vasut@gmail.com>
+ *
+ *  Based on research and code by: Ken McGuire
  *  Based on mainstone.c as modified for the Zipit Z2.
  *
  *  This program is free software; you can redistribute it and/or modify
@@ -157,21 +158,14 @@ static struct mtd_partition z2_flash_parts[] = {
         {
                 .name   = "U-Boot Bootloader",
                 .offset = 0x0,
-                .size   = 0x20000,
-        },
-        {
-                .name   = "Linux Kernel",
-                .offset = 0x20000,
-                .size   = 0x220000,
-        },
-        {
-                .name   = "Filesystem",
-                .offset = 0x240000,
-                .size   = 0x5b0000,
-        },
-        {
+                .size   = 0x40000,
+        }, {
                 .name   = "U-Boot Environment",
-                .offset = 0x7f0000,
+                .offset = 0x40000,
+                .size   = 0x60000,
+        }, {
+                .name   = "Flash",
+                .offset = 0x60000,
                 .size   = MTDPART_SIZ_FULL,
         },
 };
diff --git a/arch/arm/mach-realview/Kconfig b/arch/arm/mach-realview/Kconfig
index ee5e392430e8..b4575ae9648e 100644
--- a/arch/arm/mach-realview/Kconfig
+++ b/arch/arm/mach-realview/Kconfig
@@ -18,6 +18,7 @@ config REALVIEW_EB_ARM11MP
         bool "Support ARM11MPCore tile"
         depends on MACH_REALVIEW_EB
         select CPU_V6
+        select ARCH_HAS_BARRIERS if SMP
         help
           Enable support for the ARM11MPCore tile on the Realview platform.
 
@@ -35,6 +36,7 @@ config MACH_REALVIEW_PB11MP
         select CPU_V6
         select ARM_GIC
         select HAVE_PATA_PLATFORM
+        select ARCH_HAS_BARRIERS if SMP
         help
           Include support for the ARM(R) RealView MPCore Platform Baseboard.
           PB11MPCore is a platform with an on-board ARM11MPCore and has
diff --git a/arch/arm/mach-realview/include/mach/barriers.h b/arch/arm/mach-realview/include/mach/barriers.h
new file mode 100644
index 000000000000..0c5d749d7b5f
--- /dev/null
+++ b/arch/arm/mach-realview/include/mach/barriers.h
@@ -0,0 +1,8 @@
+/*
+ * Barriers redefined for RealView ARM11MPCore platforms with L220 cache
+ * controller to work around hardware errata causing the outer_sync()
+ * operation to deadlock the system.
+ */
+#define mb()            dsb()
+#define rmb()           dmb()
+#define wmb()           mb()
diff --git a/arch/arm/mach-realview/realview_eb.c b/arch/arm/mach-realview/realview_eb.c
index 422ccd70d5f5..4425018fab82 100644
--- a/arch/arm/mach-realview/realview_eb.c
+++ b/arch/arm/mach-realview/realview_eb.c
@@ -32,6 +32,7 @@
 #include <asm/leds.h>
 #include <asm/mach-types.h>
 #include <asm/pmu.h>
+#include <asm/pgtable.h>
 #include <asm/hardware/gic.h>
 #include <asm/hardware/cache-l2x0.h>
 #include <asm/localtimer.h>
@@ -457,7 +458,7 @@ static void __init realview_eb_init(void)
 
 MACHINE_START(REALVIEW_EB, "ARM-RealView EB")
         /* Maintainer: ARM Ltd/Deep Blue Solutions Ltd */
-        .phys_io        = REALVIEW_EB_UART0_BASE,
+        .phys_io        = REALVIEW_EB_UART0_BASE & SECTION_MASK,
         .io_pg_offst    = (IO_ADDRESS(REALVIEW_EB_UART0_BASE) >> 18) & 0xfffc,
         .boot_params    = PHYS_OFFSET + 0x00000100,
         .fixup          = realview_fixup,
diff --git a/arch/arm/mach-realview/realview_pb1176.c b/arch/arm/mach-realview/realview_pb1176.c
index 96568ebfa2bb..099a1f125cf8 100644
--- a/arch/arm/mach-realview/realview_pb1176.c
+++ b/arch/arm/mach-realview/realview_pb1176.c
@@ -32,6 +32,7 @@
 #include <asm/leds.h>
 #include <asm/mach-types.h>
 #include <asm/pmu.h>
+#include <asm/pgtable.h>
 #include <asm/hardware/gic.h>
 #include <asm/hardware/cache-l2x0.h>
 
@@ -351,7 +352,7 @@ static void __init realview_pb1176_init(void)
 
 MACHINE_START(REALVIEW_PB1176, "ARM-RealView PB1176")
         /* Maintainer: ARM Ltd/Deep Blue Solutions Ltd */
-        .phys_io        = REALVIEW_PB1176_UART0_BASE,
+        .phys_io        = REALVIEW_PB1176_UART0_BASE & SECTION_MASK,
         .io_pg_offst    = (IO_ADDRESS(REALVIEW_PB1176_UART0_BASE) >> 18) & 0xfffc,
         .boot_params    = PHYS_OFFSET + 0x00000100,
         .fixup          = realview_pb1176_fixup,
diff --git a/arch/arm/mach-realview/realview_pb11mp.c b/arch/arm/mach-realview/realview_pb11mp.c
index 7fbefbbebaf0..0e07a5ccb75f 100644
--- a/arch/arm/mach-realview/realview_pb11mp.c
+++ b/arch/arm/mach-realview/realview_pb11mp.c
@@ -32,6 +32,7 @@
 #include <asm/leds.h>
 #include <asm/mach-types.h>
 #include <asm/pmu.h>
+#include <asm/pgtable.h>
 #include <asm/hardware/gic.h>
 #include <asm/hardware/cache-l2x0.h>
 #include <asm/localtimer.h>
@@ -373,7 +374,7 @@ static void __init realview_pb11mp_init(void)
 
 MACHINE_START(REALVIEW_PB11MP, "ARM-RealView PB11MPCore")
         /* Maintainer: ARM Ltd/Deep Blue Solutions Ltd */
-        .phys_io        = REALVIEW_PB11MP_UART0_BASE,
+        .phys_io        = REALVIEW_PB11MP_UART0_BASE & SECTION_MASK,
         .io_pg_offst    = (IO_ADDRESS(REALVIEW_PB11MP_UART0_BASE) >> 18) & 0xfffc,
         .boot_params    = PHYS_OFFSET + 0x00000100,
         .fixup          = realview_fixup,
diff --git a/arch/arm/mach-realview/realview_pba8.c b/arch/arm/mach-realview/realview_pba8.c
index d3c113b3dfce..ac2f06f1ca50 100644
--- a/arch/arm/mach-realview/realview_pba8.c
+++ b/arch/arm/mach-realview/realview_pba8.c
@@ -31,6 +31,7 @@
 #include <asm/leds.h>
 #include <asm/mach-types.h>
 #include <asm/pmu.h>
+#include <asm/pgtable.h>
 #include <asm/hardware/gic.h>
 
 #include <asm/mach/arch.h>
@@ -323,7 +324,7 @@ static void __init realview_pba8_init(void)
 
 MACHINE_START(REALVIEW_PBA8, "ARM-RealView PB-A8")
         /* Maintainer: ARM Ltd/Deep Blue Solutions Ltd */
-        .phys_io        = REALVIEW_PBA8_UART0_BASE,
+        .phys_io        = REALVIEW_PBA8_UART0_BASE & SECTION_MASK,
         .io_pg_offst    = (IO_ADDRESS(REALVIEW_PBA8_UART0_BASE) >> 18) & 0xfffc,
         .boot_params    = PHYS_OFFSET + 0x00000100,
         .fixup          = realview_fixup,
diff --git a/arch/arm/mach-realview/realview_pbx.c b/arch/arm/mach-realview/realview_pbx.c
index a235ba30996b..08fd683adc4c 100644
--- a/arch/arm/mach-realview/realview_pbx.c
+++ b/arch/arm/mach-realview/realview_pbx.c
@@ -31,6 +31,7 @@
 #include <asm/mach-types.h>
 #include <asm/pmu.h>
 #include <asm/smp_twd.h>
+#include <asm/pgtable.h>
 #include <asm/hardware/gic.h>
 #include <asm/hardware/cache-l2x0.h>
 
@@ -409,7 +410,7 @@ static void __init realview_pbx_init(void)
 
 MACHINE_START(REALVIEW_PBX, "ARM-RealView PBX")
         /* Maintainer: ARM Ltd/Deep Blue Solutions Ltd */
-        .phys_io        = REALVIEW_PBX_UART0_BASE,
+        .phys_io        = REALVIEW_PBX_UART0_BASE & SECTION_MASK,
         .io_pg_offst    = (IO_ADDRESS(REALVIEW_PBX_UART0_BASE) >> 18) & 0xfffc,
         .boot_params    = PHYS_OFFSET + 0x00000100,
         .fixup          = realview_pbx_fixup,
diff --git a/arch/arm/mach-s5p6442/clock.c b/arch/arm/mach-s5p6442/clock.c
index 3aadbf42c112..087e57f20ad5 100644
--- a/arch/arm/mach-s5p6442/clock.c
+++ b/arch/arm/mach-s5p6442/clock.c
@@ -294,7 +294,7 @@ void __init_or_cpufreq s5p6442_setup_clocks(void)
         mpll = s5p_get_pll45xx(xtal, __raw_readl(S5P_MPLL_CON), pll_4502);
         epll = s5p_get_pll45xx(xtal, __raw_readl(S5P_EPLL_CON), pll_4500);
 
-        printk(KERN_INFO "S5P6440: PLL settings, A=%ld, M=%ld, E=%ld",
+        printk(KERN_INFO "S5P6442: PLL settings, A=%ld, M=%ld, E=%ld",
                         apll, mpll, epll);
 
         clk_fout_apll.rate = apll;
diff --git a/arch/arm/mach-s5pv210/clock.c b/arch/arm/mach-s5pv210/clock.c
index 154bca4abc09..af91fefef2c6 100644
--- a/arch/arm/mach-s5pv210/clock.c
+++ b/arch/arm/mach-s5pv210/clock.c
@@ -183,6 +183,11 @@ static int s5pv210_clk_mask0_ctrl(struct clk *clk, int enable)
         return s5p_gatectrl(S5P_CLK_SRC_MASK0, clk, enable);
 }
 
+static int s5pv210_clk_mask1_ctrl(struct clk *clk, int enable)
+{
+        return s5p_gatectrl(S5P_CLK_SRC_MASK1, clk, enable);
+}
+
 static struct clk clk_sclk_hdmi27m = {
         .name           = "sclk_hdmi27m",
         .id             = -1,
@@ -406,14 +411,14 @@ static struct clk init_clocks_disable[] = {
                 .id             = 0,
                 .parent         = &clk_p,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<4),
+                .ctrlbit        = (1 << 5),
         }, {
                 .name           = "i2s_v32",
                 .id             = 1,
                 .parent         = &clk_p,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<4),
-        }
+                .ctrlbit        = (1 << 6),
+        },
 };
 
 static struct clk init_clocks[] = {
@@ -429,25 +434,25 @@ static struct clk init_clocks[] = {
                 .id             = 0,
                 .parent         = &clk_pclk_psys.clk,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<7),
+                .ctrlbit        = (1 << 17),
         }, {
                 .name           = "uart",
                 .id             = 1,
                 .parent         = &clk_pclk_psys.clk,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<8),
+                .ctrlbit        = (1 << 18),
         }, {
                 .name           = "uart",
                 .id             = 2,
                 .parent         = &clk_pclk_psys.clk,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<9),
+                .ctrlbit        = (1 << 19),
         }, {
                 .name           = "uart",
                 .id             = 3,
                 .parent         = &clk_pclk_psys.clk,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<10),
+                .ctrlbit        = (1 << 20),
         },
 };
 
@@ -497,8 +502,8 @@ static struct clksrc_clk clk_sclk_dac = {
         .clk            = {
                 .name           = "sclk_dac",
                 .id             = -1,
-                .ctrlbit        = (1 << 10),
-                .enable         = s5pv210_clk_ip1_ctrl,
+                .enable         = s5pv210_clk_mask0_ctrl,
+                .ctrlbit        = (1 << 2),
         },
         .sources        = &clkset_sclk_dac,
         .reg_src        = { .reg = S5P_CLK_SRC1, .shift = 8, .size = 1 },
@@ -527,8 +532,8 @@ static struct clksrc_clk clk_sclk_hdmi = {
         .clk            = {
                 .name           = "sclk_hdmi",
                 .id             = -1,
-                .enable         = s5pv210_clk_ip1_ctrl,
-                .ctrlbit        = (1 << 11),
+                .enable         = s5pv210_clk_mask0_ctrl,
+                .ctrlbit        = (1 << 0),
         },
         .sources        = &clkset_sclk_hdmi,
         .reg_src        = { .reg = S5P_CLK_SRC1, .shift = 0, .size = 1 },
@@ -565,8 +570,8 @@ static struct clksrc_clk clk_sclk_audio0 = {
         .clk            = {
                 .name           = "sclk_audio",
                 .id             = 0,
-                .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1 << 4),
+                .enable         = s5pv210_clk_mask0_ctrl,
+                .ctrlbit        = (1 << 24),
         },
         .sources = &clkset_sclk_audio0,
         .reg_src = { .reg = S5P_CLK_SRC6, .shift = 0, .size = 4 },
@@ -594,8 +599,8 @@ static struct clksrc_clk clk_sclk_audio1 = {
         .clk            = {
                 .name           = "sclk_audio",
                 .id             = 1,
-                .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1 << 5),
+                .enable         = s5pv210_clk_mask0_ctrl,
+                .ctrlbit        = (1 << 25),
         },
         .sources = &clkset_sclk_audio1,
         .reg_src = { .reg = S5P_CLK_SRC6, .shift = 4, .size = 4 },
@@ -623,8 +628,8 @@ static struct clksrc_clk clk_sclk_audio2 = {
         .clk            = {
                 .name           = "sclk_audio",
                 .id             = 2,
-                .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1 << 6),
+                .enable         = s5pv210_clk_mask0_ctrl,
+                .ctrlbit        = (1 << 26),
         },
         .sources = &clkset_sclk_audio2,
         .reg_src = { .reg = S5P_CLK_SRC6, .shift = 8, .size = 4 },
@@ -680,8 +685,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk    = {
                         .name           = "uclk1",
                         .id             = 0,
-                        .ctrlbit        = (1<<17),
-                        .enable         = s5pv210_clk_ip3_ctrl,
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 12),
                 },
                 .sources = &clkset_uart,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 16, .size = 4 },
@@ -690,8 +695,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "uclk1",
                         .id             = 1,
-                        .enable         = s5pv210_clk_ip3_ctrl,
-                        .ctrlbit        = (1 << 18),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 13),
                 },
                 .sources = &clkset_uart,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 20, .size = 4 },
@@ -700,8 +705,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "uclk1",
                         .id             = 2,
-                        .enable         = s5pv210_clk_ip3_ctrl,
-                        .ctrlbit        = (1 << 19),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 14),
                 },
                 .sources = &clkset_uart,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 24, .size = 4 },
@@ -710,8 +715,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "uclk1",
                         .id             = 3,
-                        .enable         = s5pv210_clk_ip3_ctrl,
-                        .ctrlbit        = (1 << 20),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 15),
                 },
                 .sources = &clkset_uart,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 28, .size = 4 },
@@ -720,8 +725,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk    = {
                         .name           = "sclk_mixer",
                         .id             = -1,
-                        .enable         = s5pv210_clk_ip1_ctrl,
-                        .ctrlbit        = (1 << 9),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 1),
                 },
                 .sources = &clkset_sclk_mixer,
                 .reg_src = { .reg = S5P_CLK_SRC1, .shift = 4, .size = 1 },
@@ -738,8 +743,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk    = {
                         .name           = "sclk_fimc",
                         .id             = 0,
-                        .enable         = s5pv210_clk_ip0_ctrl,
-                        .ctrlbit        = (1 << 24),
+                        .enable         = s5pv210_clk_mask1_ctrl,
+                        .ctrlbit        = (1 << 2),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC3, .shift = 12, .size = 4 },
@@ -748,8 +753,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk    = {
                         .name           = "sclk_fimc",
                         .id             = 1,
-                        .enable         = s5pv210_clk_ip0_ctrl,
-                        .ctrlbit        = (1 << 25),
+                        .enable         = s5pv210_clk_mask1_ctrl,
+                        .ctrlbit        = (1 << 3),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC3, .shift = 16, .size = 4 },
@@ -758,8 +763,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk    = {
                         .name           = "sclk_fimc",
                         .id             = 2,
-                        .enable         = s5pv210_clk_ip0_ctrl,
-                        .ctrlbit        = (1 << 26),
+                        .enable         = s5pv210_clk_mask1_ctrl,
+                        .ctrlbit        = (1 << 4),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC3, .shift = 20, .size = 4 },
@@ -768,6 +773,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_cam",
                         .id             = 0,
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 3),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC1, .shift = 12, .size = 4 },
@@ -776,6 +783,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_cam",
                         .id             = 1,
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 4),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC1, .shift = 16, .size = 4 },
@@ -784,8 +793,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_fimd",
                         .id             = -1,
-                        .enable         = s5pv210_clk_ip1_ctrl,
-                        .ctrlbit        = (1 << 0),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 5),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC1, .shift = 20, .size = 4 },
@@ -794,8 +803,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_mmc",
                         .id             = 0,
-                        .enable         = s5pv210_clk_ip2_ctrl,
-                        .ctrlbit        = (1 << 16),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 8),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 0, .size = 4 },
@@ -804,8 +813,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_mmc",
                         .id             = 1,
-                        .enable         = s5pv210_clk_ip2_ctrl,
-                        .ctrlbit        = (1 << 17),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 9),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 4, .size = 4 },
@@ -814,8 +823,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_mmc",
                         .id             = 2,
-                        .enable         = s5pv210_clk_ip2_ctrl,
-                        .ctrlbit        = (1 << 18),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 10),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 8, .size = 4 },
@@ -824,8 +833,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_mmc",
                         .id             = 3,
-                        .enable         = s5pv210_clk_ip2_ctrl,
-                        .ctrlbit        = (1 << 19),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 11),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 12, .size = 4 },
@@ -864,8 +873,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_csis",
                         .id             = -1,
-                        .enable         = s5pv210_clk_ip0_ctrl,
-                        .ctrlbit        = (1 << 31),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 6),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC1, .shift = 24, .size = 4 },
@@ -874,8 +883,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_spi",
                         .id             = 0,
-                        .enable         = s5pv210_clk_ip3_ctrl,
-                        .ctrlbit        = (1 << 12),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 16),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC5, .shift = 0, .size = 4 },
@@ -884,8 +893,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_spi",
                         .id             = 1,
-                        .enable         = s5pv210_clk_ip3_ctrl,
-                        .ctrlbit        = (1 << 13),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 17),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC5, .shift = 4, .size = 4 },
@@ -894,8 +903,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_pwi",
                         .id             = -1,
-                        .enable         = &s5pv210_clk_ip4_ctrl,
-                        .ctrlbit        = (1 << 2),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 29),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC6, .shift = 20, .size = 4 },
@@ -904,8 +913,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_pwm",
                         .id             = -1,
-                        .enable         = s5pv210_clk_ip3_ctrl,
-                        .ctrlbit        = (1 << 23),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 19),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC5, .shift = 12, .size = 4 },
diff --git a/arch/arm/mach-vexpress/ct-ca9x4.c b/arch/arm/mach-vexpress/ct-ca9x4.c
index 9b11eedba65f..6353459bb567 100644
--- a/arch/arm/mach-vexpress/ct-ca9x4.c
+++ b/arch/arm/mach-vexpress/ct-ca9x4.c
@@ -10,6 +10,7 @@
 #include <linux/amba/clcd.h>
 
 #include <asm/clkdev.h>
+#include <asm/pgtable.h>
 #include <asm/hardware/arm_timer.h>
 #include <asm/hardware/cache-l2x0.h>
 #include <asm/hardware/gic.h>
@@ -236,7 +237,7 @@ static void ct_ca9x4_init(void)
 }
 
 MACHINE_START(VEXPRESS, "ARM-Versatile Express CA9x4")
-        .phys_io        = V2M_UART0,
+        .phys_io        = V2M_UART0 & SECTION_MASK,
         .io_pg_offst    = (__MMIO_P2V(V2M_UART0) >> 18) & 0xfffc,
         .boot_params    = PHYS_OFFSET + 0x00000100,
         .map_io         = ct_ca9x4_map_io,
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 346ae14824a5..101105e52610 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -735,6 +735,25 @@ config NEEDS_SYSCALL_FOR_CMPXCHG
           Forget about fast user space cmpxchg support.
           It is just not possible.
 
+config DMA_CACHE_RWFO
+        bool "Enable read/write for ownership DMA cache maintenance"
+        depends on CPU_V6 && SMP
+        default y
+        help
+          The Snoop Control Unit on ARM11MPCore does not detect the
+          cache maintenance operations and the dma_{map,unmap}_area()
+          functions may leave stale cache entries on other CPUs. By
+          enabling this option, Read or Write For Ownership in the ARMv6
+          DMA cache maintenance functions is performed. These LDR/STR
+          instructions change the cache line state to shared or modified
+          so that the cache operation has the desired effect.
+
+          Note that the workaround is only valid on processors that do
+          not perform speculative loads into the D-cache. For such
+          processors, if cache maintenance operations are not broadcast
+          in hardware, other workarounds are needed (e.g. cache
+          maintenance broadcasting in software via FIQ).
+
 config OUTER_CACHE
         bool
 
@@ -794,6 +813,8 @@ config ARM_L1_CACHE_SHIFT
 
 config ARM_DMA_MEM_BUFFERABLE
         bool "Use non-cacheable memory for DMA" if CPU_V6 && !CPU_V7
+        depends on !(MACH_REALVIEW_PB1176 || REALVIEW_EB_ARM11MP || \
+                     MACH_REALVIEW_PB11MP)
         default y if CPU_V6 || CPU_V7
         help
           Historically, the kernel has used strongly ordered mappings to
diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S
index e46ecd847138..86aa689ef1aa 100644
--- a/arch/arm/mm/cache-v6.S
+++ b/arch/arm/mm/cache-v6.S
@@ -211,8 +211,9 @@ v6_dma_inv_range:
         mcrne   p15, 0, r1, c7, c15, 1          @ clean & invalidate unified line
 #endif
 1:
-#ifdef CONFIG_SMP
-        str     r0, [r0]                        @ write for ownership
+#ifdef CONFIG_DMA_CACHE_RWFO
+        ldr     r2, [r0]                        @ read for ownership
+        str     r2, [r0]                        @ write for ownership
 #endif
 #ifdef HARVARD_CACHE
         mcr     p15, 0, r0, c7, c6, 1           @ invalidate D line
@@ -234,7 +235,7 @@ v6_dma_inv_range:
 v6_dma_clean_range:
         bic     r0, r0, #D_CACHE_LINE_SIZE - 1
 1:
-#ifdef CONFIG_SMP
+#ifdef CONFIG_DMA_CACHE_RWFO
         ldr     r2, [r0]                        @ read for ownership
 #endif
 #ifdef HARVARD_CACHE
@@ -257,7 +258,7 @@ v6_dma_clean_range:
 ENTRY(v6_dma_flush_range)
         bic     r0, r0, #D_CACHE_LINE_SIZE - 1
 1:
-#ifdef CONFIG_SMP
+#ifdef CONFIG_DMA_CACHE_RWFO
         ldr     r2, [r0]                        @ read for ownership
         str     r2, [r0]                        @ write for ownership
 #endif
@@ -283,9 +284,13 @@ ENTRY(v6_dma_map_area)
         add     r1, r1, r0
         teq     r2, #DMA_FROM_DEVICE
         beq     v6_dma_inv_range
+#ifndef CONFIG_DMA_CACHE_RWFO
+        b       v6_dma_clean_range
+#else
         teq     r2, #DMA_TO_DEVICE
         beq     v6_dma_clean_range
         b       v6_dma_flush_range
+#endif
 ENDPROC(v6_dma_map_area)
 
 /*
@@ -295,6 +300,11 @@ ENDPROC(v6_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(v6_dma_unmap_area)
+#ifndef CONFIG_DMA_CACHE_RWFO
+        add     r1, r1, r0
+        teq     r2, #DMA_TO_DEVICE
+        bne     v6_dma_inv_range
+#endif
         mov     pc, lr
 ENDPROC(v6_dma_unmap_area)
 
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 13fa536d82e6..9e7742f0a102 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -24,15 +24,6 @@
 #include <asm/tlbflush.h>
 #include <asm/sizes.h>
 
-/* Sanity check size */
-#if (CONSISTENT_DMA_SIZE % SZ_2M)
-#error "CONSISTENT_DMA_SIZE must be multiple of 2MiB"
-#endif
-
-#define CONSISTENT_OFFSET(x)    (((unsigned long)(x) - CONSISTENT_BASE) >> PAGE_SHIFT)
-#define CONSISTENT_PTE_INDEX(x) (((unsigned long)(x) - CONSISTENT_BASE) >> PGDIR_SHIFT)
-#define NUM_CONSISTENT_PTES (CONSISTENT_DMA_SIZE >> PGDIR_SHIFT)
-
 static u64 get_coherent_dma_mask(struct device *dev)
 {
         u64 mask = ISA_DMA_THRESHOLD;
@@ -123,6 +114,15 @@ static void __dma_free_buffer(struct page *page, size_t size)
 }
 
 #ifdef CONFIG_MMU
+/* Sanity check size */
+#if (CONSISTENT_DMA_SIZE % SZ_2M)
+#error "CONSISTENT_DMA_SIZE must be multiple of 2MiB"
+#endif
+
+#define CONSISTENT_OFFSET(x)    (((unsigned long)(x) - CONSISTENT_BASE) >> PAGE_SHIFT)
+#define CONSISTENT_PTE_INDEX(x) (((unsigned long)(x) - CONSISTENT_BASE) >> PGDIR_SHIFT)
+#define NUM_CONSISTENT_PTES (CONSISTENT_DMA_SIZE >> PGDIR_SHIFT)
+
 /*
  * These are the page tables (2MB each) covering uncached, DMA consistent allocations
  */
diff --git a/arch/arm/plat-omap/dmtimer.c b/arch/arm/plat-omap/dmtimer.c
index c64875f11fac..44bafdab2dce 100644
--- a/arch/arm/plat-omap/dmtimer.c
+++ b/arch/arm/plat-omap/dmtimer.c
@@ -541,11 +541,11 @@ void omap_dm_timer_stop(struct omap_dm_timer *timer)
                   * timer is stopped
                   */
                 udelay(3500000 / clk_get_rate(timer->fclk) + 1);
-                /* Ack possibly pending interrupt */
-                omap_dm_timer_write_reg(timer, OMAP_TIMER_STAT_REG,
-                                OMAP_TIMER_INT_OVERFLOW);
 #endif
         }
+        /* Ack possibly pending interrupt */
+        omap_dm_timer_write_reg(timer, OMAP_TIMER_STAT_REG,
+                        OMAP_TIMER_INT_OVERFLOW);
 }
 EXPORT_SYMBOL_GPL(omap_dm_timer_stop);
 
diff --git a/arch/arm/plat-omap/gpio.c b/arch/arm/plat-omap/gpio.c
index 393e9219a5b6..9b7e3545f325 100644
--- a/arch/arm/plat-omap/gpio.c
+++ b/arch/arm/plat-omap/gpio.c
@@ -673,6 +673,7 @@ static void _set_gpio_debounce(struct gpio_bank *bank, unsigned gpio,
                 if (cpu_is_omap34xx() || cpu_is_omap44xx())
                         clk_disable(bank->dbck);
         }
+        bank->dbck_enable_mask = val;
 
         __raw_writel(val, reg);
 }
diff --git a/arch/arm/plat-omap/iovmm.c b/arch/arm/plat-omap/iovmm.c
index e43983ba59c5..8ce0de247c71 100644
--- a/arch/arm/plat-omap/iovmm.c
+++ b/arch/arm/plat-omap/iovmm.c
@@ -140,8 +140,10 @@ static struct sg_table *sgtable_alloc(const size_t bytes, u32 flags)
                 return ERR_PTR(-ENOMEM);
 
         err = sg_alloc_table(sgt, nr_entries, GFP_KERNEL);
-        if (err)
+        if (err) {
+                kfree(sgt);
                 return ERR_PTR(err);
+        }
 
         pr_debug("%s: sgt:%p(%d entries)\n", __func__, sgt, nr_entries);
 
diff --git a/arch/arm/plat-pxa/Makefile b/arch/arm/plat-pxa/Makefile
index 6187edfbcb77..a17cc0c6a6b0 100644
--- a/arch/arm/plat-pxa/Makefile
+++ b/arch/arm/plat-pxa/Makefile
@@ -2,8 +2,9 @@
 # Makefile for code common across different PXA processor families
 #
 
-obj-y   := dma.o pmu.o
+obj-y   := dma.o
 
+obj-$(CONFIG_ARCH_PXA)          += pmu.o
 obj-$(CONFIG_GENERIC_GPIO)      += gpio.o
 obj-$(CONFIG_PXA3xx)            += mfp.o
 obj-$(CONFIG_ARCH_MMP)          += mfp.o
diff --git a/arch/arm/plat-s5p/irq-eint.c b/arch/arm/plat-s5p/irq-eint.c
index e56c8075df97..f36cd3327025 100644
--- a/arch/arm/plat-s5p/irq-eint.c
+++ b/arch/arm/plat-s5p/irq-eint.c
@@ -71,7 +71,7 @@ static int s5p_irq_eint_set_type(unsigned int irq, unsigned int type)
                 break;
 
         case IRQ_TYPE_EDGE_FALLING:
-                newvalue = S5P_EXTINT_RISEEDGE;
+                newvalue = S5P_EXTINT_FALLEDGE;
                 break;
 
         case IRQ_TYPE_EDGE_BOTH:
diff --git a/arch/arm/plat-samsung/include/plat/sdhci.h b/arch/arm/plat-samsung/include/plat/sdhci.h
index 13f9fb20900a..016674fa20dd 100644
--- a/arch/arm/plat-samsung/include/plat/sdhci.h
+++ b/arch/arm/plat-samsung/include/plat/sdhci.h
@@ -166,8 +166,10 @@ static inline void s3c6410_default_sdhci2(void) { }
 #else
 static inline void s3c6410_default_sdhci0(void) { }
 static inline void s3c6410_default_sdhci1(void) { }
+static inline void s3c6410_default_sdhci2(void) { }
 static inline void s3c6400_default_sdhci0(void) { }
 static inline void s3c6400_default_sdhci1(void) { }
+static inline void s3c6400_default_sdhci2(void) { }
 
 #endif /* CONFIG_S3C64XX_SETUP_SDHCI */
 
@@ -239,7 +241,7 @@ static inline void s5pv210_default_sdhci0(void)
         s3c_hsmmc0_def_platdata.cfg_card = s5pv210_setup_sdhci_cfg_card;
 }
 #else
-static inline void s5pc100_default_sdhci0(void) { }
+static inline void s5pv210_default_sdhci0(void) { }
 #endif /* CONFIG_S3C_DEV_HSMMC */
 
 #ifdef CONFIG_S3C_DEV_HSMMC1
diff --git a/arch/ia64/mm/tlb.c b/arch/ia64/mm/tlb.c
index 5dfd916e9ea6..7b3cdc6c6d91 100644
--- a/arch/ia64/mm/tlb.c
+++ b/arch/ia64/mm/tlb.c
@@ -121,7 +121,7 @@ static inline void down_spin(struct spinaphore *ss)
         ia64_invala();
 
         for (;;) {
-                asm volatile ("ld4.c.nc %0=[%1]" : "=r"(serve) : "r"(&ss->serve) : "memory");
+                asm volatile ("ld8.c.nc %0=[%1]" : "=r"(serve) : "r"(&ss->serve) : "memory");
                 if (time_before(t, serve))
                         return;
                 cpu_relax();
diff --git a/arch/mips/alchemy/common/power.c b/arch/mips/alchemy/common/power.c
index 14eb8c492da2..5ef06a164a82 100644
--- a/arch/mips/alchemy/common/power.c
+++ b/arch/mips/alchemy/common/power.c
@@ -193,9 +193,15 @@ static void restore_core_regs(void)
 
 void au_sleep(void)
 {
-        save_core_regs();
-        au1xxx_save_and_sleep();
-        restore_core_regs();
+        int cpuid = alchemy_get_cputype();
+        if (cpuid != ALCHEMY_CPU_UNKNOWN) {
+                save_core_regs();
+                if (cpuid <= ALCHEMY_CPU_AU1500)
+                        alchemy_sleep_au1000();
+                else if (cpuid <= ALCHEMY_CPU_AU1200)
+                        alchemy_sleep_au1550();
+                restore_core_regs();
+        }
 }
 
 #endif  /* CONFIG_PM */
diff --git a/arch/mips/alchemy/common/sleeper.S b/arch/mips/alchemy/common/sleeper.S
index 4f4b16741d12..77f3c743b716 100644
--- a/arch/mips/alchemy/common/sleeper.S
+++ b/arch/mips/alchemy/common/sleeper.S
@@ -22,10 +22,9 @@
         .set noat
         .align  5
 
-/* Save all of the processor general registers and go to sleep.
- * A wakeup condition will get us back here to restore the registers.
- */
-LEAF(au1xxx_save_and_sleep)
+
+/* preparatory stuff */
+.macro  SETUP_SLEEP
         subu    sp, PT_SIZE
         sw      $1, PT_R1(sp)
         sw      $2, PT_R2(sp)
@@ -69,12 +68,32 @@ LEAF(au1xxx_save_and_sleep)
          */
         lui     t3, 0xb190              /* sys_xxx */
         sw      sp, 0x0018(t3)
-        la      k0, 3f                  /* resume path */
+        la      k0, alchemy_sleep_wakeup        /* resume path */
         sw      k0, 0x001c(t3)
+.endm
 
-        /* Put SDRAM into self refresh:  Preload instructions into cache,
-         * issue a precharge, auto/self refresh, then sleep commands to it.
-         */
+.macro  DO_SLEEP
+        /* put power supply and processor to sleep */
+        sw      zero, 0x0078(t3)        /* sys_slppwr */
+        sync
+        sw      zero, 0x007c(t3)        /* sys_sleep */
+        sync
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+.endm
+
+/* sleep code for Au1000/Au1100/Au1500 memory controller type */
+LEAF(alchemy_sleep_au1000)
+
+        SETUP_SLEEP
+
+        /* cache following instructions, as memory gets put to sleep */
         la      t0, 1f
         .set    mips3
         cache   0x14, 0(t0)
@@ -84,17 +103,32 @@ LEAF(au1xxx_save_and_sleep)
         .set    mips0
 
 1:      lui     a0, 0xb400              /* mem_xxx */
-#if defined(CONFIG_SOC_AU1000) || defined(CONFIG_SOC_AU1100) || \
-    defined(CONFIG_SOC_AU1500)
         sw      zero, 0x001c(a0)        /* Precharge */
         sync
         sw      zero, 0x0020(a0)        /* Auto Refresh */
         sync
         sw      zero, 0x0030(a0)        /* Sleep */
         sync
-#endif
 
-#if defined(CONFIG_SOC_AU1550) || defined(CONFIG_SOC_AU1200)
+        DO_SLEEP
+
+END(alchemy_sleep_au1000)
+
+/* sleep code for Au1550/Au1200 memory controller type */
+LEAF(alchemy_sleep_au1550)
+
+        SETUP_SLEEP
+
+        /* cache following instructions, as memory gets put to sleep */
+        la      t0, 1f
+        .set    mips3
+        cache   0x14, 0(t0)
+        cache   0x14, 32(t0)
+        cache   0x14, 64(t0)
+        cache   0x14, 96(t0)
+        .set    mips0
+
+1:      lui     a0, 0xb400              /* mem_xxx */
         sw      zero, 0x08c0(a0)        /* Precharge */
         sync
         sw      zero, 0x08d0(a0)        /* Self Refresh */
@@ -114,26 +148,17 @@ LEAF(au1xxx_save_and_sleep)
         and     t1, t0, t1              /* clear CE[1:0] */
         sw      t1, 0x0840(a0)          /* mem_sdconfiga */
         sync
-#endif
 
-        /* put power supply and processor to sleep */
-        sw      zero, 0x0078(t3)        /* sys_slppwr */
-        sync
-        sw      zero, 0x007c(t3)        /* sys_sleep */
-        sync
-        nop
-        nop
-        nop
-        nop
-        nop
-        nop
-        nop
-        nop
+        DO_SLEEP
+
+END(alchemy_sleep_au1550)
+
 
         /* This is where we return upon wakeup.
          * Reload all of the registers and return.
          */
-3:      lw      k0, 0x20(sp)
+LEAF(alchemy_sleep_wakeup)
+        lw      k0, 0x20(sp)
         mtc0    k0, CP0_STATUS
         lw      k0, 0x1c(sp)
         mtc0    k0, CP0_CONTEXT
@@ -169,4 +194,4 @@ LEAF(au1xxx_save_and_sleep)
         lw      $31, PT_R31(sp)
         jr      ra
          addiu  sp, PT_SIZE
-END(au1xxx_save_and_sleep)
+END(alchemy_sleep_wakeup)
diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c
index 566f2d7f2ea3..8f31d1d59683 100644
--- a/arch/mips/ar7/platform.c
+++ b/arch/mips/ar7/platform.c
@@ -542,7 +542,7 @@ static int __init ar7_register_uarts(void)
         if (IS_ERR(bus_clk))
                 panic("unable to get bus clk\n");
 
-        uart_port.type          = PORT_16550A;
+        uart_port.type          = PORT_AR7;
         uart_port.uartclk       = clk_get_rate(bus_clk) / 2;
         uart_port.iotype        = UPIO_MEM32;
         uart_port.regshift      = 2;
diff --git a/arch/mips/bcm47xx/Makefile b/arch/mips/bcm47xx/Makefile
index 35294b12d638..7465e8a72d9a 100644
--- a/arch/mips/bcm47xx/Makefile
+++ b/arch/mips/bcm47xx/Makefile
@@ -3,4 +3,4 @@
 # under Linux.
 #
 
-obj-y := gpio.o irq.o prom.o serial.o setup.o time.o wgt634u.o
+obj-y := gpio.o irq.o nvram.o prom.o serial.o setup.o time.o wgt634u.o
diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
new file mode 100644
index 000000000000..06e03b222f6d
--- /dev/null
+++ b/arch/mips/bcm47xx/nvram.c
@@ -0,0 +1,94 @@
+/*
+ * BCM947xx nvram variable access
+ *
+ * Copyright (C) 2005 Broadcom Corporation
+ * Copyright (C) 2006 Felix Fietkau <nbd@openwrt.org>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/ssb/ssb.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <asm/addrspace.h>
+#include <asm/mach-bcm47xx/nvram.h>
+#include <asm/mach-bcm47xx/bcm47xx.h>
+
+static char nvram_buf[NVRAM_SPACE];
+
+/* Probe for NVRAM header */
+static void __init early_nvram_init(void)
+{
+        struct ssb_mipscore *mcore = &ssb_bcm47xx.mipscore;
+        struct nvram_header *header;
+        int i;
+        u32 base, lim, off;
+        u32 *src, *dst;
+
+        base = mcore->flash_window;
+        lim = mcore->flash_window_size;
+
+        off = FLASH_MIN;
+        while (off <= lim) {
+                /* Windowed flash access */
+                header = (struct nvram_header *)
+                        KSEG1ADDR(base + off - NVRAM_SPACE);
+                if (header->magic == NVRAM_HEADER)
+                        goto found;
+                off <<= 1;
+        }
+
+        /* Try embedded NVRAM at 4 KB and 1 KB as last resorts */
+        header = (struct nvram_header *) KSEG1ADDR(base + 4096);
+        if (header->magic == NVRAM_HEADER)
+                goto found;
+
+        header = (struct nvram_header *) KSEG1ADDR(base + 1024);
+        if (header->magic == NVRAM_HEADER)
+                goto found;
+
+        return;
+
+found:
+        src = (u32 *) header;
+        dst = (u32 *) nvram_buf;
+        for (i = 0; i < sizeof(struct nvram_header); i += 4)
+                *dst++ = *src++;
+        for (; i < header->len && i < NVRAM_SPACE; i += 4)
+                *dst++ = le32_to_cpu(*src++);
+}
+
+int nvram_getenv(char *name, char *val, size_t val_len)
+{
+        char *var, *value, *end, *eq;
+
+        if (!name)
+                return 1;
+
+        if (!nvram_buf[0])
+                early_nvram_init();
+
+        /* Look for name=value and return value */
+        var = &nvram_buf[sizeof(struct nvram_header)];
+        end = nvram_buf + sizeof(nvram_buf) - 2;
+        end[0] = end[1] = '\0';
+        for (; *var; var = value + strlen(value) + 1) {
+                eq = strchr(var, '=');
+                if (!eq)
+                        break;
+                value = eq + 1;
+                if ((eq - var) == strlen(name) &&
+                        strncmp(var, name, (eq - var)) == 0) {
+                        snprintf(val, val_len, "%s", value);
+                        return 0;
+                }
+        }
+        return 1;
+}
+EXPORT_SYMBOL(nvram_getenv);
diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
index d442e11625fa..b1aee33efd11 100644
--- a/arch/mips/bcm47xx/setup.c
+++ b/arch/mips/bcm47xx/setup.c
@@ -1,8 +1,8 @@
 /*
  *  Copyright (C) 2004 Florian Schirmer <jolt@tuxbox.org>
- *  Copyright (C) 2005 Waldemar Brodkorb <wbx@openwrt.org>
  *  Copyright (C) 2006 Felix Fietkau <nbd@openwrt.org>
  *  Copyright (C) 2006 Michael Buesch <mb@bu3sch.de>
+ *  Copyright (C) 2010 Waldemar Brodkorb <wbx@openadk.org>
  *
  *  This program is free software; you can redistribute  it and/or modify it
  *  under  the terms of  the GNU General  Public License as published by the
@@ -33,6 +33,7 @@
 #include <asm/time.h>
 #include <bcm47xx.h>
 #include <asm/fw/cfe/cfe_api.h>
+#include <asm/mach-bcm47xx/nvram.h>
 
 struct ssb_bus ssb_bcm47xx;
 EXPORT_SYMBOL(ssb_bcm47xx);
@@ -81,28 +82,42 @@ static int bcm47xx_get_invariants(struct ssb_bus *bus,
         /* Fill boardinfo structure */
         memset(&(iv->boardinfo), 0 , sizeof(struct ssb_boardinfo));
 
-        if (cfe_getenv("boardvendor", buf, sizeof(buf)) >= 0)
+        if (cfe_getenv("boardvendor", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("boardvendor", buf, sizeof(buf)) >= 0)
                 iv->boardinfo.type = (u16)simple_strtoul(buf, NULL, 0);
-        if (cfe_getenv("boardtype", buf, sizeof(buf)) >= 0)
+        if (cfe_getenv("boardtype", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("boardtype", buf, sizeof(buf)) >= 0)
                 iv->boardinfo.type = (u16)simple_strtoul(buf, NULL, 0);
-        if (cfe_getenv("boardrev", buf, sizeof(buf)) >= 0)
+        if (cfe_getenv("boardrev", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("boardrev", buf, sizeof(buf)) >= 0)
                 iv->boardinfo.rev = (u16)simple_strtoul(buf, NULL, 0);
 
         /* Fill sprom structure */
         memset(&(iv->sprom), 0, sizeof(struct ssb_sprom));
         iv->sprom.revision = 3;
 
-        if (cfe_getenv("et0macaddr", buf, sizeof(buf)) >= 0)
+        if (cfe_getenv("et0macaddr", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("et0macaddr", buf, sizeof(buf)) >= 0)
                 str2eaddr(buf, iv->sprom.et0mac);
-        if (cfe_getenv("et1macaddr", buf, sizeof(buf)) >= 0)
+
+        if (cfe_getenv("et1macaddr", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("et1macaddr", buf, sizeof(buf)) >= 0)
                 str2eaddr(buf, iv->sprom.et1mac);
-        if (cfe_getenv("et0phyaddr", buf, sizeof(buf)) >= 0)
-                iv->sprom.et0phyaddr = simple_strtoul(buf, NULL, 10);
-        if (cfe_getenv("et1phyaddr", buf, sizeof(buf)) >= 0)
-                iv->sprom.et1phyaddr = simple_strtoul(buf, NULL, 10);
-        if (cfe_getenv("et0mdcport", buf, sizeof(buf)) >= 0)
+
+        if (cfe_getenv("et0phyaddr", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("et0phyaddr", buf, sizeof(buf)) >= 0)
+                iv->sprom.et0phyaddr = simple_strtoul(buf, NULL, 0);
+
+        if (cfe_getenv("et1phyaddr", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("et1phyaddr", buf, sizeof(buf)) >= 0)
+                iv->sprom.et1phyaddr = simple_strtoul(buf, NULL, 0);
+
+        if (cfe_getenv("et0mdcport", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("et0mdcport", buf, sizeof(buf)) >= 0)
                 iv->sprom.et0mdcport = simple_strtoul(buf, NULL, 10);
-        if (cfe_getenv("et1mdcport", buf, sizeof(buf)) >= 0)
+
+        if (cfe_getenv("et1mdcport", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("et1mdcport", buf, sizeof(buf)) >= 0)
                 iv->sprom.et1mdcport = simple_strtoul(buf, NULL, 10);
 
         return 0;
diff --git a/arch/mips/include/asm/mach-ar7/ar7.h b/arch/mips/include/asm/mach-ar7/ar7.h
index f1cf38943497..483ffea9ecb1 100644
--- a/arch/mips/include/asm/mach-ar7/ar7.h
+++ b/arch/mips/include/asm/mach-ar7/ar7.h
@@ -50,7 +50,7 @@
 #define UR8_REGS_WDT    (AR7_REGS_BASE + 0x0b00)
 #define UR8_REGS_UART1  (AR7_REGS_BASE + 0x0f00)
 
-#define AR7_RESET_PEREPHERIAL   0x0
+#define AR7_RESET_PERIPHERAL    0x0
 #define AR7_RESET_SOFTWARE      0x4
 #define AR7_RESET_STATUS        0x8
 
@@ -128,7 +128,7 @@ static inline int ar7_has_high_cpmac(void)
 static inline void ar7_device_enable(u32 bit)
 {
         void *reset_reg =
-                (void *)KSEG1ADDR(AR7_REGS_RESET + AR7_RESET_PEREPHERIAL);
+                (void *)KSEG1ADDR(AR7_REGS_RESET + AR7_RESET_PERIPHERAL);
         writel(readl(reset_reg) | (1 << bit), reset_reg);
         msleep(20);
 }
@@ -136,7 +136,7 @@ static inline void ar7_device_enable(u32 bit)
 static inline void ar7_device_disable(u32 bit)
 {
         void *reset_reg =
-                (void *)KSEG1ADDR(AR7_REGS_RESET + AR7_RESET_PEREPHERIAL);
+                (void *)KSEG1ADDR(AR7_REGS_RESET + AR7_RESET_PERIPHERAL);
         writel(readl(reset_reg) & ~(1 << bit), reset_reg);
         msleep(20);
 }
diff --git a/arch/mips/include/asm/mach-ar7/gpio.h b/arch/mips/include/asm/mach-ar7/gpio.h
index 73f9b162c970..abc317c0372e 100644
--- a/arch/mips/include/asm/mach-ar7/gpio.h
+++ b/arch/mips/include/asm/mach-ar7/gpio.h
@@ -24,7 +24,7 @@
 #define AR7_GPIO_MAX 32
 #define NR_BUILTIN_GPIO AR7_GPIO_MAX
 
-#define gpio_to_irq(gpio)       NULL
+#define gpio_to_irq(gpio)       -1
 
 #define gpio_get_value __gpio_get_value
 #define gpio_set_value __gpio_set_value
diff --git a/arch/mips/include/asm/mach-au1x00/au1000.h b/arch/mips/include/asm/mach-au1x00/au1000.h
index e76941db2312..a6976619160a 100644
--- a/arch/mips/include/asm/mach-au1x00/au1000.h
+++ b/arch/mips/include/asm/mach-au1x00/au1000.h
@@ -188,7 +188,8 @@ extern unsigned long get_au1x00_uart_baud_base(void);
 extern unsigned long au1xxx_calc_clock(void);
 
 /* PM: arch/mips/alchemy/common/sleeper.S, power.c, irq.c */
-void au1xxx_save_and_sleep(void);
+void alchemy_sleep_au1000(void);
+void alchemy_sleep_au1550(void);
 void au_sleep(void);
 
 
diff --git a/arch/mips/include/asm/mach-bcm47xx/nvram.h b/arch/mips/include/asm/mach-bcm47xx/nvram.h
new file mode 100644
index 000000000000..0d8cc146f7a4
--- /dev/null
+++ b/arch/mips/include/asm/mach-bcm47xx/nvram.h
@@ -0,0 +1,36 @@
+/*
+ *  Copyright (C) 2005, Broadcom Corporation
+ *  Copyright (C) 2006, Felix Fietkau <nbd@openwrt.org>
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ */
+
+#ifndef __NVRAM_H
+#define __NVRAM_H
+
+#include <linux/types.h>
+
+struct nvram_header {
+        u32 magic;
+        u32 len;
+        u32 crc_ver_init;       /* 0:7 crc, 8:15 ver, 16:31 sdram_init */
+        u32 config_refresh;     /* 0:15 sdram_config, 16:31 sdram_refresh */
+        u32 config_ncdl;        /* ncdl values for memc */
+};
+
+#define NVRAM_HEADER            0x48534C46      /* 'FLSH' */
+#define NVRAM_VERSION           1
+#define NVRAM_HEADER_SIZE       20
+#define NVRAM_SPACE             0x8000
+
+#define FLASH_MIN               0x00020000      /* Minimum flash size */
+
+#define NVRAM_MAX_VALUE_LEN 255
+#define NVRAM_MAX_PARAM_LEN 64
+
+extern int nvram_getenv(char *name, char *val, size_t val_len);
+
+#endif
diff --git a/arch/mips/include/asm/mach-bcm63xx/gpio.h b/arch/mips/include/asm/mach-bcm63xx/gpio.h
index 7cda8c0a3979..1eb534de8e3b 100644
--- a/arch/mips/include/asm/mach-bcm63xx/gpio.h
+++ b/arch/mips/include/asm/mach-bcm63xx/gpio.h
@@ -3,7 +3,7 @@
 
 #include <bcm63xx_gpio.h>
 
-#define gpio_to_irq(gpio)       NULL
+#define gpio_to_irq(gpio)       -1
 
 #define gpio_get_value __gpio_get_value
 #define gpio_set_value __gpio_set_value
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index e9e64e0ff7aa..5a84a1f11231 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -2,7 +2,7 @@
  * Code for replacing ftrace calls with jumps.
  *
  * Copyright (C) 2007-2008 Steven Rostedt <srostedt@redhat.com>
- * Copyright (C) 2009 DSLab, Lanzhou University, China
+ * Copyright (C) 2009, 2010 DSLab, Lanzhou University, China
  * Author: Wu Zhangjin <wuzhangjin@gmail.com>
  *
  * Thanks goes to Steven Rostedt for writing the original x86 version.
@@ -12,18 +12,62 @@
 #include <linux/init.h>
 #include <linux/ftrace.h>
 
-#include <asm/cacheflush.h>
 #include <asm/asm.h>
 #include <asm/asm-offsets.h>
+#include <asm/cacheflush.h>
+#include <asm/uasm.h>
+
+/*
+ * If the Instruction Pointer is in module space (0xc0000000), return true;
+ * otherwise, it is in kernel space (0x80000000), return false.
+ *
+ * FIXME: This will not work when the kernel space and module space are the
+ * same. If they are the same, we need to modify scripts/recordmcount.pl,
+ * ftrace_make_nop/call() and the other related parts to ensure the
+ * enabling/disabling of the calling site to _mcount is right for both kernel
+ * and module.
+ */
+
+static inline int in_module(unsigned long ip)
+{
+        return ip & 0x40000000;
+}
 
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 #define JAL 0x0c000000          /* jump & link: ip --> ra, jump to target */
 #define ADDR_MASK 0x03ffffff    /*  op_code|addr : 31...26|25 ....0 */
-#define jump_insn_encode(op_code, addr) \
-        ((unsigned int)((op_code) | (((addr) >> 2) & ADDR_MASK)))
 
-static unsigned int ftrace_nop = 0x00000000;
+#define INSN_B_1F_4 0x10000004  /* b 1f; offset = 4 */
+#define INSN_B_1F_5 0x10000005  /* b 1f; offset = 5 */
+#define INSN_NOP 0x00000000     /* nop */
+#define INSN_JAL(addr)  \
+        ((unsigned int)(JAL | (((addr) >> 2) & ADDR_MASK)))
+
+static unsigned int insn_jal_ftrace_caller __read_mostly;
+static unsigned int insn_lui_v1_hi16_mcount __read_mostly;
+static unsigned int insn_j_ftrace_graph_caller __maybe_unused __read_mostly;
+
+static inline void ftrace_dyn_arch_init_insns(void)
+{
+        u32 *buf;
+        unsigned int v1;
+
+        /* lui v1, hi16_mcount */
+        v1 = 3;
+        buf = (u32 *)&insn_lui_v1_hi16_mcount;
+        UASM_i_LA_mostly(&buf, v1, MCOUNT_ADDR);
+
+        /* jal (ftrace_caller + 8), jump over the first two instruction */
+        buf = (u32 *)&insn_jal_ftrace_caller;
+        uasm_i_jal(&buf, (FTRACE_ADDR + 8));
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        /* j ftrace_graph_caller */
+        buf = (u32 *)&insn_j_ftrace_graph_caller;
+        uasm_i_j(&buf, (unsigned long)ftrace_graph_caller);
+#endif
+}
 
 static int ftrace_modify_code(unsigned long ip, unsigned int new_code)
 {
@@ -40,67 +84,56 @@ static int ftrace_modify_code(unsigned long ip, unsigned int new_code)
         return 0;
 }
 
-static int lui_v1;
-static int jal_mcount;
-
 int ftrace_make_nop(struct module *mod,
                     struct dyn_ftrace *rec, unsigned long addr)
 {
         unsigned int new;
-        int faulted;
         unsigned long ip = rec->ip;
 
-        /* We have compiled module with -mlong-calls, but compiled the kernel
-         * without it, we need to cope with them respectively. */
-        if (ip & 0x40000000) {
-                /* record it for ftrace_make_call */
-                if (lui_v1 == 0) {
-                        /* lui_v1 = *(unsigned int *)ip; */
-                        safe_load_code(lui_v1, ip, faulted);
-
-                        if (unlikely(faulted))
-                                return -EFAULT;
-                }
-
-                /* lui v1, hi_16bit_of_mcount        --> b 1f (0x10000004)
+        /*
+         * We have compiled module with -mlong-calls, but compiled the kernel
+         * without it, we need to cope with them respectively.
+         */
+        if (in_module(ip)) {
+#if defined(KBUILD_MCOUNT_RA_ADDRESS) && defined(CONFIG_32BIT)
+                /*
+                 * lui v1, hi_16bit_of_mcount        --> b 1f (0x10000005)
+                 * addiu v1, v1, low_16bit_of_mcount
+                 * move at, ra
+                 * move $12, ra_address
+                 * jalr v1
+                 *  sub sp, sp, 8
+                 *                                  1: offset = 5 instructions
+                 */
+                new = INSN_B_1F_5;
+#else
+                /*
+                 * lui v1, hi_16bit_of_mcount        --> b 1f (0x10000004)
                  * addiu v1, v1, low_16bit_of_mcount
                  * move at, ra
                  * jalr v1
-                 * nop
-                 *                                   1f: (ip + 12)
+                 *  nop | move $12, ra_address | sub sp, sp, 8
+                 *                                  1: offset = 4 instructions
                  */
-                new = 0x10000004;
+                new = INSN_B_1F_4;
+#endif
         } else {
-                /* record/calculate it for ftrace_make_call */
-                if (jal_mcount == 0) {
-                        /* We can record it directly like this:
-                         *     jal_mcount = *(unsigned int *)ip;
-                         * Herein, jump over the first two nop instructions */
-                        jal_mcount = jump_insn_encode(JAL, (MCOUNT_ADDR + 8));
-                }
-
-                /* move at, ra
-                 * jalr v1              --> nop
+                /*
+                 * move at, ra
+                 * jal _mcount          --> nop
                  */
-                new = ftrace_nop;
+                new = INSN_NOP;
         }
         return ftrace_modify_code(ip, new);
 }
 
-static int modified;    /* initialized as 0 by default */
-
 int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
 {
         unsigned int new;
         unsigned long ip = rec->ip;
 
-        /* We just need to remove the "b ftrace_stub" at the fist time! */
-        if (modified == 0) {
-                modified = 1;
-                ftrace_modify_code(addr, ftrace_nop);
-        }
         /* ip, module: 0xc0000000, kernel: 0x80000000 */
-        new = (ip & 0x40000000) ? lui_v1 : jal_mcount;
+        new = in_module(ip) ? insn_lui_v1_hi16_mcount : insn_jal_ftrace_caller;
 
         return ftrace_modify_code(ip, new);
 }
@@ -111,44 +144,48 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
 {
         unsigned int new;
 
-        new = jump_insn_encode(JAL, (unsigned long)func);
+        new = INSN_JAL((unsigned long)func);
 
         return ftrace_modify_code(FTRACE_CALL_IP, new);
 }
 
 int __init ftrace_dyn_arch_init(void *data)
 {
+        /* Encode the instructions when booting */
+        ftrace_dyn_arch_init_insns();
+
+        /* Remove "b ftrace_stub" to ensure ftrace_caller() is executed */
+        ftrace_modify_code(MCOUNT_ADDR, INSN_NOP);
+
         /* The return code is retured via data */
         *(unsigned long *)data = 0;
 
         return 0;
 }
-#endif                          /* CONFIG_DYNAMIC_FTRACE */
+#endif  /* CONFIG_DYNAMIC_FTRACE */
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 extern void ftrace_graph_call(void);
-#define JMP     0x08000000      /* jump to target directly */
-#define CALL_FTRACE_GRAPH_CALLER \
-        jump_insn_encode(JMP, (unsigned long)(&ftrace_graph_caller))
 #define FTRACE_GRAPH_CALL_IP    ((unsigned long)(&ftrace_graph_call))
 
 int ftrace_enable_ftrace_graph_caller(void)
 {
         return ftrace_modify_code(FTRACE_GRAPH_CALL_IP,
-                                  CALL_FTRACE_GRAPH_CALLER);
+                        insn_j_ftrace_graph_caller);
 }
 
 int ftrace_disable_ftrace_graph_caller(void)
 {
-        return ftrace_modify_code(FTRACE_GRAPH_CALL_IP, ftrace_nop);
+        return ftrace_modify_code(FTRACE_GRAPH_CALL_IP, INSN_NOP);
 }
 
-#endif                          /* !CONFIG_DYNAMIC_FTRACE */
+#endif  /* CONFIG_DYNAMIC_FTRACE */
 
 #ifndef KBUILD_MCOUNT_RA_ADDRESS
+
 #define S_RA_SP (0xafbf << 16)  /* s{d,w} ra, offset(sp) */
 #define S_R_SP  (0xafb0 << 16)  /* s{d,w} R, offset(sp) */
 #define OFFSET_MASK     0xffff  /* stack offset range: 0 ~ PT_SIZE */
@@ -162,17 +199,17 @@ unsigned long ftrace_get_parent_addr(unsigned long self_addr,
         unsigned int code;
         int faulted;
 
-        /* in module or kernel? */
-        if (self_addr & 0x40000000) {
-                /* module: move to the instruction "lui v1, HI_16BIT_OF_MCOUNT" */
-                ip = self_addr - 20;
-        } else {
-                /* kernel: move to the instruction "move ra, at" */
-                ip = self_addr - 12;
-        }
+        /*
+         * For module, move the ip from calling site of mcount to the
+         * instruction "lui v1, hi_16bit_of_mcount"(offset is 20), but for
+         * kernel, move to the instruction "move ra, at"(offset is 12)
+         */
+        ip = self_addr - (in_module(self_addr) ? 20 : 12);
 
-        /* search the text until finding the non-store instruction or "s{d,w}
-         * ra, offset(sp)" instruction */
+        /*
+         * search the text until finding the non-store instruction or "s{d,w}
+         * ra, offset(sp)" instruction
+         */
         do {
                 ip -= 4;
 
@@ -181,10 +218,11 @@ unsigned long ftrace_get_parent_addr(unsigned long self_addr,
 
                 if (unlikely(faulted))
                         return 0;
-
-                /* If we hit the non-store instruction before finding where the
+                /*
+                 * If we hit the non-store instruction before finding where the
                  * ra is stored, then this is a leaf function and it does not
-                 * store the ra on the stack. */
+                 * store the ra on the stack
+                 */
                 if ((code & S_R_SP) != S_R_SP)
                         return parent_addr;
 
@@ -202,7 +240,7 @@ unsigned long ftrace_get_parent_addr(unsigned long self_addr,
         return 0;
 }
 
-#endif
+#endif  /* !KBUILD_MCOUNT_RA_ADDRESS */
 
 /*
  * Hook the return address and push it in the stack of return addrs
@@ -220,7 +258,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 return;
 
-        /* "parent" is the stack address saved the return address of the caller
+        /*
+         * "parent" is the stack address saved the return address of the caller
          * of _mcount.
          *
          * if the gcc < 4.5, a leaf function does not save the return address
@@ -242,10 +281,11 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
                 goto out;
 #ifndef KBUILD_MCOUNT_RA_ADDRESS
         parent = (unsigned long *)ftrace_get_parent_addr(self_addr, old,
-                                                         (unsigned long)parent,
-                                                         fp);
-        /* If fails when getting the stack address of the non-leaf function's
-         * ra, stop function graph tracer and return */
+                        (unsigned long)parent, fp);
+        /*
+         * If fails when getting the stack address of the non-leaf function's
+         * ra, stop function graph tracer and return
+         */
         if (parent == 0)
                 goto out;
 #endif
@@ -272,4 +312,4 @@ out:
         ftrace_graph_stop();
         WARN_ON(1);
 }
-#endif                          /* CONFIG_FUNCTION_GRAPH_TRACER */
+#endif  /* CONFIG_FUNCTION_GRAPH_TRACER */
diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S
index 6851fc97a511..6bfcb7a00ec6 100644
--- a/arch/mips/kernel/mcount.S
+++ b/arch/mips/kernel/mcount.S
@@ -6,6 +6,7 @@
  * more details.
  *
  * Copyright (C) 2009 Lemote Inc. & DSLab, Lanzhou University, China
+ * Copyright (C) 2010 DSLab, Lanzhou University, China
  * Author: Wu Zhangjin <wuzhangjin@gmail.com>
  */
 
@@ -45,8 +46,6 @@
         PTR_L   a5, PT_R9(sp)
         PTR_L   a6, PT_R10(sp)
         PTR_L   a7, PT_R11(sp)
-#endif
-#ifdef CONFIG_64BIT
         PTR_ADDIU       sp, PT_SIZE
 #else
         PTR_ADDIU       sp, (PT_SIZE + 8)
@@ -58,6 +57,12 @@
          move ra, AT
         .endm
 
+/*
+ * The -mmcount-ra-address option of gcc 4.5 uses register $12 to pass
+ * the location of the parent's return address.
+ */
+#define MCOUNT_RA_ADDRESS_REG   $12
+
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 NESTED(ftrace_caller, PT_SIZE, ra)
@@ -71,14 +76,14 @@ _mcount:
 
         MCOUNT_SAVE_REGS
 #ifdef KBUILD_MCOUNT_RA_ADDRESS
-        PTR_S   t0, PT_R12(sp)  /* t0 saved the location of the return address(at) by -mmcount-ra-address */
+        PTR_S   MCOUNT_RA_ADDRESS_REG, PT_R12(sp)
 #endif
 
-        move    a0, ra          /* arg1: next ip, selfaddr */
+        move    a0, ra          /* arg1: self return address */
         .globl ftrace_call
 ftrace_call:
         nop     /* a placeholder for the call to a real tracing function */
-         move   a1, AT          /* arg2: the caller's next ip, parent */
+         move   a1, AT          /* arg2: parent's return address */
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
         .globl ftrace_graph_call
@@ -119,9 +124,9 @@ NESTED(_mcount, PT_SIZE, ra)
 static_trace:
         MCOUNT_SAVE_REGS
 
-        move    a0, ra          /* arg1: next ip, selfaddr */
+        move    a0, ra          /* arg1: self return address */
         jalr    t2              /* (1) call *ftrace_trace_function */
-         move   a1, AT          /* arg2: the caller's next ip, parent */
+         move   a1, AT          /* arg2: parent's return address */
 
         MCOUNT_RESTORE_REGS
         .globl ftrace_stub
@@ -134,28 +139,34 @@ ftrace_stub:
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 
 NESTED(ftrace_graph_caller, PT_SIZE, ra)
-#ifdef CONFIG_DYNAMIC_FTRACE
-        PTR_L   a1, PT_R31(sp)  /* load the original ra from the stack */
-#ifdef KBUILD_MCOUNT_RA_ADDRESS
-        PTR_L   t0, PT_R12(sp)  /* load the original t0 from the stack */
-#endif
-#else
+#ifndef CONFIG_DYNAMIC_FTRACE
         MCOUNT_SAVE_REGS
-        move    a1, ra          /* arg2: next ip, selfaddr */
 #endif
 
+        /* arg1: Get the location of the parent's return address */
 #ifdef KBUILD_MCOUNT_RA_ADDRESS
-        bnez    t0, 1f          /* non-leaf func: t0 saved the location of the return address */
+#ifdef CONFIG_DYNAMIC_FTRACE
+        PTR_L   a0, PT_R12(sp)
+#else
+        move    a0, MCOUNT_RA_ADDRESS_REG
+#endif
+        bnez    a0, 1f  /* non-leaf func: stored in MCOUNT_RA_ADDRESS_REG */
          nop
-        PTR_LA  t0, PT_R1(sp)   /* leaf func: get the location of at(old ra) from our own stack */
-1:      move    a0, t0          /* arg1: the location of the return address */
+#endif
+        PTR_LA  a0, PT_R1(sp)   /* leaf func: the location in current stack */
+1:
+
+        /* arg2: Get self return address */
+#ifdef CONFIG_DYNAMIC_FTRACE
+        PTR_L   a1, PT_R31(sp)
 #else
-        PTR_LA  a0, PT_R1(sp)   /* arg1: &AT -> a0 */
+        move    a1, ra
 #endif
-        jal     prepare_ftrace_return
+
+        /* arg3: Get frame pointer of current stack */
 #ifdef CONFIG_FRAME_POINTER
-         move   a2, fp          /* arg3: frame pointer */
-#else
+         move   a2, fp
+#else /* ! CONFIG_FRAME_POINTER */
 #ifdef CONFIG_64BIT
          PTR_LA a2, PT_SIZE(sp)
 #else
@@ -163,6 +174,8 @@ NESTED(ftrace_graph_caller, PT_SIZE, ra)
 #endif
 #endif
 
+        jal     prepare_ftrace_return
+         nop
         MCOUNT_RESTORE_REGS
         RETURN_BACK
         END(ftrace_graph_caller)
diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c
index f5981c499109..2340f11dc29c 100644
--- a/arch/mips/kernel/mips-mt-fpaff.c
+++ b/arch/mips/kernel/mips-mt-fpaff.c
@@ -3,6 +3,7 @@
  * Copyright (C) 2005 Mips Technologies, Inc
  */
 #include <linux/cpu.h>
+#include <linux/cpuset.h>
 #include <linux/cpumask.h>
 #include <linux/delay.h>
 #include <linux/kernel.h>
@@ -39,6 +40,21 @@ static inline struct task_struct *find_process_by_pid(pid_t pid)
         return pid ? find_task_by_vpid(pid) : current;
 }
 
+/*
+ * check the target process has a UID that matches the current process's
+ */
+static bool check_same_owner(struct task_struct *p)
+{
+        const struct cred *cred = current_cred(), *pcred;
+        bool match;
+
+        rcu_read_lock();
+        pcred = __task_cred(p);
+        match = (cred->euid == pcred->euid ||
+                 cred->euid == pcred->uid);
+        rcu_read_unlock();
+        return match;
+}
 
 /*
  * mipsmt_sys_sched_setaffinity - set the cpu affinity of a process
@@ -46,12 +62,10 @@ static inline struct task_struct *find_process_by_pid(pid_t pid)
 asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len,
                                       unsigned long __user *user_mask_ptr)
 {
-        cpumask_t new_mask;
-        cpumask_t effective_mask;
-        int retval;
-        struct task_struct *p;
+        cpumask_var_t cpus_allowed, new_mask, effective_mask;
         struct thread_info *ti;
-        uid_t euid;
+        struct task_struct *p;
+        int retval;
 
         if (len < sizeof(new_mask))
                 return -EINVAL;
@@ -60,53 +74,74 @@ asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len,
                 return -EFAULT;
 
         get_online_cpus();
-        read_lock(&tasklist_lock);
+        rcu_read_lock();
 
         p = find_process_by_pid(pid);
         if (!p) {
-                read_unlock(&tasklist_lock);
+                rcu_read_unlock();
                 put_online_cpus();
                 return -ESRCH;
         }
 
-        /*
-         * It is not safe to call set_cpus_allowed with the
-         * tasklist_lock held.  We will bump the task_struct's
-         * usage count and drop tasklist_lock before invoking
-         * set_cpus_allowed.
-         */
+        /* Prevent p going away */
         get_task_struct(p);
+        rcu_read_unlock();
 
-        euid = current_euid();
+        if (!alloc_cpumask_var(&cpus_allowed, GFP_KERNEL)) {
+                retval = -ENOMEM;
+                goto out_put_task;
+        }
+        if (!alloc_cpumask_var(&new_mask, GFP_KERNEL)) {
+                retval = -ENOMEM;
+                goto out_free_cpus_allowed;
+        }
+        if (!alloc_cpumask_var(&effective_mask, GFP_KERNEL)) {
+                retval = -ENOMEM;
+                goto out_free_new_mask;
+        }
         retval = -EPERM;
-        if (euid != p->cred->euid && euid != p->cred->uid &&
-            !capable(CAP_SYS_NICE)) {
-                read_unlock(&tasklist_lock);
+        if (!check_same_owner(p) && !capable(CAP_SYS_NICE))
                 goto out_unlock;
-        }
 
         retval = security_task_setscheduler(p, 0, NULL);
         if (retval)
                 goto out_unlock;
 
         /* Record new user-specified CPU set for future reference */
-        p->thread.user_cpus_allowed = new_mask;
-
-        /* Unlock the task list */
-        read_unlock(&tasklist_lock);
+        cpumask_copy(&p->thread.user_cpus_allowed, new_mask);
 
+ again:
         /* Compute new global allowed CPU set if necessary */
         ti = task_thread_info(p);
         if (test_ti_thread_flag(ti, TIF_FPUBOUND) &&
-            cpus_intersects(new_mask, mt_fpu_cpumask)) {
-                cpus_and(effective_mask, new_mask, mt_fpu_cpumask);
-                retval = set_cpus_allowed_ptr(p, &effective_mask);
+            cpus_intersects(*new_mask, mt_fpu_cpumask)) {
+                cpus_and(*effective_mask, *new_mask, mt_fpu_cpumask);
+                retval = set_cpus_allowed_ptr(p, effective_mask);
         } else {
+                cpumask_copy(effective_mask, new_mask);
                 clear_ti_thread_flag(ti, TIF_FPUBOUND);
-                retval = set_cpus_allowed_ptr(p, &new_mask);
+                retval = set_cpus_allowed_ptr(p, new_mask);
         }
 
+        if (!retval) {
+                cpuset_cpus_allowed(p, cpus_allowed);
+                if (!cpumask_subset(effective_mask, cpus_allowed)) {
+                        /*
+                         * We must have raced with a concurrent cpuset
+                         * update. Just reset the cpus_allowed to the
+                         * cpuset's cpus_allowed
+                         */
+                        cpumask_copy(new_mask, cpus_allowed);
+                        goto again;
+                }
+        }
 out_unlock:
+        free_cpumask_var(effective_mask);
+out_free_new_mask:
+        free_cpumask_var(new_mask);
+out_free_cpus_allowed:
+        free_cpumask_var(cpus_allowed);
+out_put_task:
         put_task_struct(p);
         put_online_cpus();
         return retval;
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 8bdd6a663c7f..852780868fb4 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -976,7 +976,7 @@ asmlinkage void do_cpu(struct pt_regs *regs)
 
         case 2:
                 raw_notifier_call_chain(&cu2_chain, CU2_EXCEPTION, regs);
-                break;
+                return;
 
         case 3:
                 break;
diff --git a/arch/mips/loongson/Kconfig b/arch/mips/loongson/Kconfig
index 3df1967dea08..c97ca69b94e0 100644
--- a/arch/mips/loongson/Kconfig
+++ b/arch/mips/loongson/Kconfig
@@ -23,6 +23,7 @@ config LEMOTE_FULOONG2E
         select GENERIC_HARDIRQS_NO__DO_IRQ
         select GENERIC_ISA_DMA_SUPPORT_BROKEN
         select CPU_HAS_WB
+        select LOONGSON_MC146818
         help
           Lemote Fuloong(2e) mini-PC board based on the Chinese Loongson-2E CPU and
           an FPGA northbridge
@@ -51,6 +52,7 @@ config LEMOTE_MACH2F
         select SYS_SUPPORTS_64BIT_KERNEL
         select SYS_SUPPORTS_HIGHMEM
         select SYS_SUPPORTS_LITTLE_ENDIAN
+        select LOONGSON_MC146818
         help
           Lemote Loongson 2F family machines utilize the 2F revision of
           Loongson processor and the AMD CS5536 south bridge.
@@ -83,3 +85,7 @@ config LOONGSON_UART_BASE
         bool
         default y
         depends on EARLY_PRINTK || SERIAL_8250
+
+config LOONGSON_MC146818
+        bool
+        default n
diff --git a/arch/mips/loongson/common/Makefile b/arch/mips/loongson/common/Makefile
index cdd2e812ba1a..e526488df655 100644
--- a/arch/mips/loongson/common/Makefile
+++ b/arch/mips/loongson/common/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_GENERIC_GPIO) += gpio.o
 obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
 obj-$(CONFIG_SERIAL_8250) += serial.o
 obj-$(CONFIG_LOONGSON_UART_BASE) += uart_base.o
+obj-$(CONFIG_LOONGSON_MC146818) += rtc.o
 
 #
 # Enable CS5536 Virtual Support Module(VSM) to virtulize the PCI configure
diff --git a/arch/mips/loongson/common/cs5536/cs5536_ehci.c b/arch/mips/loongson/common/cs5536/cs5536_ehci.c
index eaf8b86e3318..5b5cbba699b3 100644
--- a/arch/mips/loongson/common/cs5536/cs5536_ehci.c
+++ b/arch/mips/loongson/common/cs5536/cs5536_ehci.c
@@ -49,6 +49,8 @@ void pci_ehci_write_reg(int reg, u32 value)
                         lo |= SOFT_BAR_EHCI_FLAG;
                         _wrmsr(GLCP_MSR_REG(GLCP_SOFT_COM), hi, lo);
                 } else if ((value & 0x01) == 0x00) {
+                        _rdmsr(USB_MSR_REG(USB_EHCI), &hi, &lo);
+                        lo = value;
                         _wrmsr(USB_MSR_REG(USB_EHCI), hi, lo);
 
                         value &= 0xfffffff0;
diff --git a/arch/mips/loongson/common/cs5536/cs5536_ide.c b/arch/mips/loongson/common/cs5536/cs5536_ide.c
index 9a96b5664c78..681d1291a2c7 100644
--- a/arch/mips/loongson/common/cs5536/cs5536_ide.c
+++ b/arch/mips/loongson/common/cs5536/cs5536_ide.c
@@ -51,6 +51,7 @@ void pci_ide_write_reg(int reg, u32 value)
                         lo |= SOFT_BAR_IDE_FLAG;
                         _wrmsr(GLCP_MSR_REG(GLCP_SOFT_COM), hi, lo);
                 } else if (value & 0x01) {
+                        _rdmsr(IDE_MSR_REG(IDE_IO_BAR), &hi, &lo);
                         lo = (value & 0xfffffff0) | 0x1;
                         _wrmsr(IDE_MSR_REG(IDE_IO_BAR), hi, lo);
 
@@ -65,19 +66,30 @@ void pci_ide_write_reg(int reg, u32 value)
                         _rdmsr(DIVIL_MSR_REG(DIVIL_BALL_OPTS), &hi, &lo);
                         lo |= 0x01;
                         _wrmsr(DIVIL_MSR_REG(DIVIL_BALL_OPTS), hi, lo);
-                } else
+                } else {
+                        _rdmsr(IDE_MSR_REG(IDE_CFG), &hi, &lo);
+                        lo = value;
                         _wrmsr(IDE_MSR_REG(IDE_CFG), hi, lo);
+                }
                 break;
         case PCI_IDE_DTC_REG:
+                _rdmsr(IDE_MSR_REG(IDE_DTC), &hi, &lo);
+                lo = value;
                 _wrmsr(IDE_MSR_REG(IDE_DTC), hi, lo);
                 break;
         case PCI_IDE_CAST_REG:
+                _rdmsr(IDE_MSR_REG(IDE_CAST), &hi, &lo);
+                lo = value;
                 _wrmsr(IDE_MSR_REG(IDE_CAST), hi, lo);
                 break;
         case PCI_IDE_ETC_REG:
+                _rdmsr(IDE_MSR_REG(IDE_ETC), &hi, &lo);
+                lo = value;
                 _wrmsr(IDE_MSR_REG(IDE_ETC), hi, lo);
                 break;
         case PCI_IDE_PM_REG:
+                _rdmsr(IDE_MSR_REG(IDE_INTERNAL_PM), &hi, &lo);
+                lo = value;
                 _wrmsr(IDE_MSR_REG(IDE_INTERNAL_PM), hi, lo);
                 break;
         default:
@@ -167,6 +179,7 @@ u32 pci_ide_read_reg(int reg)
         case PCI_IDE_ETC_REG:
                 _rdmsr(IDE_MSR_REG(IDE_ETC), &hi, &lo);
                 conf_data = lo;
+                break;
         case PCI_IDE_PM_REG:
                 _rdmsr(IDE_MSR_REG(IDE_INTERNAL_PM), &hi, &lo);
                 conf_data = lo;
diff --git a/arch/mips/loongson/common/cs5536/cs5536_isa.c b/arch/mips/loongson/common/cs5536/cs5536_isa.c
index f5c0818831b2..4d9f65abeaff 100644
--- a/arch/mips/loongson/common/cs5536/cs5536_isa.c
+++ b/arch/mips/loongson/common/cs5536/cs5536_isa.c
@@ -61,7 +61,7 @@ static void divil_lbar_enable(void)
         for (offset = DIVIL_LBAR_SMB; offset <= DIVIL_LBAR_PMS; offset++) {
                 _rdmsr(DIVIL_MSR_REG(offset), &hi, &lo);
                 hi |= 0x01;
-                _wrmsr(DIVIL_MSR_REG(DIVIL_LBAR_SMB), hi, lo);
+                _wrmsr(DIVIL_MSR_REG(offset), hi, lo);
         }
 }
 
@@ -76,7 +76,7 @@ static void divil_lbar_disable(void)
         for (offset = DIVIL_LBAR_SMB; offset <= DIVIL_LBAR_PMS; offset++) {
                 _rdmsr(DIVIL_MSR_REG(offset), &hi, &lo);
                 hi &= ~0x01;
-                _wrmsr(DIVIL_MSR_REG(DIVIL_LBAR_SMB), hi, lo);
+                _wrmsr(DIVIL_MSR_REG(offset), hi, lo);
         }
 }
 
diff --git a/arch/mips/loongson/common/cs5536/cs5536_ohci.c b/arch/mips/loongson/common/cs5536/cs5536_ohci.c
index db5900aadd6b..bdedf512baf7 100644
--- a/arch/mips/loongson/common/cs5536/cs5536_ohci.c
+++ b/arch/mips/loongson/common/cs5536/cs5536_ohci.c
@@ -49,6 +49,8 @@ void pci_ohci_write_reg(int reg, u32 value)
                         lo |= SOFT_BAR_OHCI_FLAG;
                         _wrmsr(GLCP_MSR_REG(GLCP_SOFT_COM), hi, lo);
                 } else if ((value & 0x01) == 0x00) {
+                        _rdmsr(USB_MSR_REG(USB_OHCI), &hi, &lo);
+                        lo = value;
                         _wrmsr(USB_MSR_REG(USB_OHCI), hi, lo);
 
                         value &= 0xfffffff0;
diff --git a/arch/mips/loongson/common/rtc.c b/arch/mips/loongson/common/rtc.c
new file mode 100644
index 000000000000..a90d87c01555
--- /dev/null
+++ b/arch/mips/loongson/common/rtc.c
@@ -0,0 +1,43 @@
+/*
+ *  Lemote Fuloong platform support
+ *
+ *  Copyright(c) 2010 Arnaud Patard <apatard@mandriva.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <linux/mc146818rtc.h>
+
+struct resource loongson_rtc_resources[] = {
+        {
+                .start  = RTC_PORT(0),
+                .end    = RTC_PORT(1),
+                .flags  = IORESOURCE_IO,
+        }, {
+                .start  = RTC_IRQ,
+                .end    = RTC_IRQ,
+                .flags  = IORESOURCE_IRQ,
+        }
+};
+
+static struct platform_device loongson_rtc_device = {
+        .name           = "rtc_cmos",
+        .id             = -1,
+        .resource       = loongson_rtc_resources,
+        .num_resources  = ARRAY_SIZE(loongson_rtc_resources),
+};
+
+
+static int __init loongson_rtc_platform_init(void)
+{
+        platform_device_register(&loongson_rtc_device);
+        return 0;
+}
+
+device_initcall(loongson_rtc_platform_init);
diff --git a/arch/mips/math-emu/dp_simple.c b/arch/mips/math-emu/dp_simple.c
index d9ae1dbabda7..b90974246e5b 100644
--- a/arch/mips/math-emu/dp_simple.c
+++ b/arch/mips/math-emu/dp_simple.c
@@ -78,6 +78,7 @@ ieee754dp ieee754dp_abs(ieee754dp x)
         DPSIGN(x) = 0;
 
         if (xc == IEEE754_CLASS_SNAN) {
+                SETCX(IEEE754_INVALID_OPERATION);
                 return ieee754dp_nanxcpt(ieee754dp_indef(), "abs");
         }
 
diff --git a/arch/mips/math-emu/sp_simple.c b/arch/mips/math-emu/sp_simple.c
index 3175477d36f6..2fd53c920e99 100644
--- a/arch/mips/math-emu/sp_simple.c
+++ b/arch/mips/math-emu/sp_simple.c
@@ -78,6 +78,7 @@ ieee754sp ieee754sp_abs(ieee754sp x)
         SPSIGN(x) = 0;
 
         if (xc == IEEE754_CLASS_SNAN) {
+                SETCX(IEEE754_INVALID_OPERATION);
                 return ieee754sp_nanxcpt(ieee754sp_indef(), "abs");
         }
 
diff --git a/arch/mips/oprofile/op_model_loongson2.c b/arch/mips/oprofile/op_model_loongson2.c
index d0d24e047676..60d3ea602118 100644
--- a/arch/mips/oprofile/op_model_loongson2.c
+++ b/arch/mips/oprofile/op_model_loongson2.c
@@ -43,6 +43,12 @@ static struct loongson2_register_config {
 static char *oprofid = "LoongsonPerf";
 static irqreturn_t loongson2_perfcount_handler(int irq, void *dev_id);
 
+static void reset_counters(void *arg)
+{
+        write_c0_perfctrl(0);
+        write_c0_perfcnt(0);
+}
+
 static void loongson2_reg_setup(struct op_counter_config *cfg)
 {
         unsigned int ctrl = 0;
@@ -139,7 +145,7 @@ static int __init loongson2_init(void)
 
 static void loongson2_exit(void)
 {
-        write_c0_perfctrl(0);
+        reset_counters(NULL);
         free_irq(LOONGSON2_PERFCNT_IRQ, oprofid);
 }
 
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 328774bd41ee..6506bf4fbff1 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -400,7 +400,7 @@ config IRQ_ALL_CPUS
 
 config SPARSE_IRQ
         bool "Support sparse irq numbering"
-        default y
+        default n
         help
           This enables support for sparse irqs. This is useful for distro
           kernels that want to define a high CONFIG_NR_CPUS value but still
@@ -409,7 +409,7 @@ config SPARSE_IRQ
           ( Sparse IRQs can also be beneficial on NUMA boxes, as they spread
             out the irq_desc[] array in a more NUMA-friendly way. )
 
-          If you don't know what to do here, say Y.
+          If you don't know what to do here, say N.
 
 config NUMA
         bool "NUMA support"
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 42dcd3f4ad7b..77cfe7a29e25 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -92,10 +92,10 @@ endif
 else
         KBUILD_CFLAGS += $(call cc-option,-mtune=power4)
 endif
-else
-LDFLAGS_MODULE  += arch/powerpc/lib/crtsavres.o
 endif
 
+LDFLAGS_MODULE  += arch/powerpc/lib/crtsavres.o
+
 ifeq ($(CONFIG_TUNE_CELL),y)
         KBUILD_CFLAGS += $(call cc-option,-mtune=cell)
 endif
diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h
index 5d8be0416227..0175a676b34b 100644
--- a/arch/powerpc/include/asm/ptrace.h
+++ b/arch/powerpc/include/asm/ptrace.h
@@ -24,11 +24,7 @@
  * 2 of the License, or (at your option) any later version.
  */
 
-#ifdef __KERNEL__
 #include <linux/types.h>
-#else
-#include <stdint.h>
-#endif
 
 #ifndef __ASSEMBLY__
 
@@ -364,13 +360,13 @@ static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs,
 #ifndef __ASSEMBLY__
 
 struct ppc_debug_info {
-        uint32_t version;               /* Only version 1 exists to date */
-        uint32_t num_instruction_bps;
-        uint32_t num_data_bps;
-        uint32_t num_condition_regs;
-        uint32_t data_bp_alignment;
-        uint32_t sizeof_condition;      /* size of the DVC register */
-        uint64_t features;
+        __u32 version;                  /* Only version 1 exists to date */
+        __u32 num_instruction_bps;
+        __u32 num_data_bps;
+        __u32 num_condition_regs;
+        __u32 data_bp_alignment;
+        __u32 sizeof_condition;         /* size of the DVC register */
+        __u64 features;
 };
 
 #endif /* __ASSEMBLY__ */
@@ -386,13 +382,13 @@ struct ppc_debug_info {
 #ifndef __ASSEMBLY__
 
 struct ppc_hw_breakpoint {
-        uint32_t version;               /* currently, version must be 1 */
-        uint32_t trigger_type;          /* only some combinations allowed */
-        uint32_t addr_mode;             /* address match mode */
-        uint32_t condition_mode;        /* break/watchpoint condition flags */
-        uint64_t addr;                  /* break/watchpoint address */
-        uint64_t addr2;                 /* range end or mask */
-        uint64_t condition_value;       /* contents of the DVC register */
+        __u32 version;          /* currently, version must be 1 */
+        __u32 trigger_type;     /* only some combinations allowed */
+        __u32 addr_mode;        /* address match mode */
+        __u32 condition_mode;   /* break/watchpoint condition flags */
+        __u64 addr;             /* break/watchpoint address */
+        __u64 addr2;            /* range end or mask */
+        __u64 condition_value;  /* contents of the DVC register */
 };
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index b46f2e09bd81..29df48f2b61a 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -447,7 +447,7 @@ void default_machine_crash_shutdown(struct pt_regs *regs)
         crash_kexec_prepare_cpus(crashing_cpu);
         cpu_set(crashing_cpu, cpus_in_crash);
         crash_kexec_stop_spus();
-#ifdef CONFIG_PPC_STD_MMU_64
+#if defined(CONFIG_PPC_STD_MMU_64) && defined(CONFIG_SMP)
         crash_kexec_wait_realmode(crashing_cpu);
 #endif
         if (ppc_md.kexec_cpu_down)
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 3333bbdd23ef..77be3d058a65 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -295,7 +295,10 @@ void fixup_irqs(const struct cpumask *map)
 
         for_each_irq(irq) {
                 desc = irq_to_desc(irq);
-                if (desc && desc->status & IRQ_PER_CPU)
+                if (!desc)
+                        continue;
+
+                if (desc->status & IRQ_PER_CPU)
                         continue;
 
                 cpumask_and(mask, desc->affinity, map);
diff --git a/arch/powerpc/kernel/perf_event.c b/arch/powerpc/kernel/perf_event.c
index 43b83c35cf54..5c14ffe51258 100644
--- a/arch/powerpc/kernel/perf_event.c
+++ b/arch/powerpc/kernel/perf_event.c
@@ -791,8 +791,11 @@ static void power_pmu_disable(struct perf_event *event)
         cpuhw = &__get_cpu_var(cpu_hw_events);
         for (i = 0; i < cpuhw->n_events; ++i) {
                 if (event == cpuhw->event[i]) {
-                        while (++i < cpuhw->n_events)
+                        while (++i < cpuhw->n_events) {
                                 cpuhw->event[i-1] = cpuhw->event[i];
+                                cpuhw->events[i-1] = cpuhw->events[i];
+                                cpuhw->flags[i-1] = cpuhw->flags[i];
+                        }
                         --cpuhw->n_events;
                         ppmu->disable_pmc(event->hw.idx - 1, cpuhw->mmcr);
                         if (event->hw.idx) {
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 97d4bd9442d3..3b6f8ae9b8cc 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -872,7 +872,7 @@ static void __init prom_send_capabilities(void)
                                     "ibm_architecture_vec structure inconsistent: 0x%x !\n",
                                     *cores);
                 } else {
-                        *cores = NR_CPUS / prom_count_smt_threads();
+                        *cores = DIV_ROUND_UP(NR_CPUS, prom_count_smt_threads());
                         prom_printf("Max number of cores passed to firmware: 0x%x\n",
                                     (unsigned long)*cores);
                 }
diff --git a/arch/powerpc/kernel/prom_init_check.sh b/arch/powerpc/kernel/prom_init_check.sh
index 1ac136b128f0..9f82f4937892 100644
--- a/arch/powerpc/kernel/prom_init_check.sh
+++ b/arch/powerpc/kernel/prom_init_check.sh
@@ -52,12 +52,18 @@ do
         if [ "${UNDEF:0:9}" = "_restgpr_" ]; then
                 OK=1
         fi
+        if [ "${UNDEF:0:10}" = "_restgpr0_" ]; then
+                OK=1
+        fi
         if [ "${UNDEF:0:11}" = "_rest32gpr_" ]; then
                 OK=1
         fi
         if [ "${UNDEF:0:9}" = "_savegpr_" ]; then
                 OK=1
         fi
+        if [ "${UNDEF:0:10}" = "_savegpr0_" ]; then
+                OK=1
+        fi
         if [ "${UNDEF:0:11}" = "_save32gpr_" ]; then
                 OK=1
         fi
diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
index 3040dac18a37..111da1c03a11 100644
--- a/arch/powerpc/lib/Makefile
+++ b/arch/powerpc/lib/Makefile
@@ -12,8 +12,8 @@ CFLAGS_REMOVE_code-patching.o = -pg
 CFLAGS_REMOVE_feature-fixups.o = -pg
 
 obj-y                   := string.o alloc.o \
-                           checksum_$(CONFIG_WORD_SIZE).o
-obj-$(CONFIG_PPC32)     += div64.o copy_32.o crtsavres.o
+                           checksum_$(CONFIG_WORD_SIZE).o crtsavres.o
+obj-$(CONFIG_PPC32)     += div64.o copy_32.o
 obj-$(CONFIG_HAS_IOMEM) += devres.o
 
 obj-$(CONFIG_PPC64)     += copypage_64.o copyuser_64.o \
diff --git a/arch/powerpc/lib/crtsavres.S b/arch/powerpc/lib/crtsavres.S
index 70a9cd8a3008..1c893f05d224 100644
--- a/arch/powerpc/lib/crtsavres.S
+++ b/arch/powerpc/lib/crtsavres.S
@@ -6,6 +6,7 @@
  *   Written By Michael Meissner
  *
  * Based on gcc/config/rs6000/crtsavres.asm from gcc
+ * 64 bit additions from reading the PPC elf64abi document.
  *
  * This file is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -44,6 +45,8 @@
 
 #ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
 
+#ifndef CONFIG_PPC64
+
 /* Routines for saving integer registers, called by the compiler.  */
 /* Called with r11 pointing to the stack header word of the caller of the */
 /* function, just beyond the end of the integer save area.  */
@@ -226,4 +229,130 @@ _GLOBAL(_rest32gpr_31_x)
         mtlr    0
         mr      1,11
         blr
+
+#else /* CONFIG_PPC64 */
+
+.globl  _savegpr0_14
+_savegpr0_14:
+        std     r14,-144(r1)
+.globl  _savegpr0_15
+_savegpr0_15:
+        std     r15,-136(r1)
+.globl  _savegpr0_16
+_savegpr0_16:
+        std     r16,-128(r1)
+.globl  _savegpr0_17
+_savegpr0_17:
+        std     r17,-120(r1)
+.globl  _savegpr0_18
+_savegpr0_18:
+        std     r18,-112(r1)
+.globl  _savegpr0_19
+_savegpr0_19:
+        std     r19,-104(r1)
+.globl  _savegpr0_20
+_savegpr0_20:
+        std     r20,-96(r1)
+.globl  _savegpr0_21
+_savegpr0_21:
+        std     r21,-88(r1)
+.globl  _savegpr0_22
+_savegpr0_22:
+        std     r22,-80(r1)
+.globl  _savegpr0_23
+_savegpr0_23:
+        std     r23,-72(r1)
+.globl  _savegpr0_24
+_savegpr0_24:
+        std     r24,-64(r1)
+.globl  _savegpr0_25
+_savegpr0_25:
+        std     r25,-56(r1)
+.globl  _savegpr0_26
+_savegpr0_26:
+        std     r26,-48(r1)
+.globl  _savegpr0_27
+_savegpr0_27:
+        std     r27,-40(r1)
+.globl  _savegpr0_28
+_savegpr0_28:
+        std     r28,-32(r1)
+.globl  _savegpr0_29
+_savegpr0_29:
+        std     r29,-24(r1)
+.globl  _savegpr0_30
+_savegpr0_30:
+        std     r30,-16(r1)
+.globl  _savegpr0_31
+_savegpr0_31:
+        std     r31,-8(r1)
+        std     r0,16(r1)
+        blr
+
+.globl  _restgpr0_14
+_restgpr0_14:
+        ld      r14,-144(r1)
+.globl  _restgpr0_15
+_restgpr0_15:
+        ld      r15,-136(r1)
+.globl  _restgpr0_16
+_restgpr0_16:
+        ld      r16,-128(r1)
+.globl  _restgpr0_17
+_restgpr0_17:
+        ld      r17,-120(r1)
+.globl  _restgpr0_18
+_restgpr0_18:
+        ld      r18,-112(r1)
+.globl  _restgpr0_19
+_restgpr0_19:
+        ld      r19,-104(r1)
+.globl  _restgpr0_20
+_restgpr0_20:
+        ld      r20,-96(r1)
+.globl  _restgpr0_21
+_restgpr0_21:
+        ld      r21,-88(r1)
+.globl  _restgpr0_22
+_restgpr0_22:
+        ld      r22,-80(r1)
+.globl  _restgpr0_23
+_restgpr0_23:
+        ld      r23,-72(r1)
+.globl  _restgpr0_24
+_restgpr0_24:
+        ld      r24,-64(r1)
+.globl  _restgpr0_25
+_restgpr0_25:
+        ld      r25,-56(r1)
+.globl  _restgpr0_26
+_restgpr0_26:
+        ld      r26,-48(r1)
+.globl  _restgpr0_27
+_restgpr0_27:
+        ld      r27,-40(r1)
+.globl  _restgpr0_28
+_restgpr0_28:
+        ld      r28,-32(r1)
+.globl  _restgpr0_29
+_restgpr0_29:
+        ld      r0,16(r1)
+        ld      r29,-24(r1)
+        mtlr    r0
+        ld      r30,-16(r1)
+        ld      r31,-8(r1)
+        blr
+
+.globl  _restgpr0_30
+_restgpr0_30:
+        ld      r30,-16(r1)
+.globl  _restgpr0_31
+_restgpr0_31:
+        ld      r0,16(r1)
+        ld      r31,-8(r1)
+        mtlr    r0
+        blr
+
+#endif /* CONFIG_PPC64 */
+
 #endif
diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c
index e640175b65ae..0d08d0171392 100644
--- a/arch/powerpc/lib/feature-fixups.c
+++ b/arch/powerpc/lib/feature-fixups.c
@@ -12,6 +12,7 @@
  *  2 of the License, or (at your option) any later version.
  */
 
+#include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/init.h>
@@ -288,8 +289,8 @@ static void test_alternative_case_with_external_branch(void)
 
 static void test_cpu_macros(void)
 {
-        extern void ftr_fixup_test_FTR_macros;
-        extern void ftr_fixup_test_FTR_macros_expected;
+        extern u8 ftr_fixup_test_FTR_macros;
+        extern u8 ftr_fixup_test_FTR_macros_expected;
         unsigned long size = &ftr_fixup_test_FTR_macros_expected -
                              &ftr_fixup_test_FTR_macros;
 
@@ -301,8 +302,8 @@ static void test_cpu_macros(void)
 static void test_fw_macros(void)
 {
 #ifdef CONFIG_PPC64
-        extern void ftr_fixup_test_FW_FTR_macros;
-        extern void ftr_fixup_test_FW_FTR_macros_expected;
+        extern u8 ftr_fixup_test_FW_FTR_macros;
+        extern u8 ftr_fixup_test_FW_FTR_macros_expected;
         unsigned long size = &ftr_fixup_test_FW_FTR_macros_expected -
                              &ftr_fixup_test_FW_FTR_macros;
 
@@ -314,10 +315,10 @@ static void test_fw_macros(void)
 
 static void test_lwsync_macros(void)
 {
-        extern void lwsync_fixup_test;
-        extern void end_lwsync_fixup_test;
-        extern void lwsync_fixup_test_expected_LWSYNC;
-        extern void lwsync_fixup_test_expected_SYNC;
+        extern u8 lwsync_fixup_test;
+        extern u8 end_lwsync_fixup_test;
+        extern u8 lwsync_fixup_test_expected_LWSYNC;
+        extern u8 lwsync_fixup_test_expected_SYNC;
         unsigned long size = &end_lwsync_fixup_test -
                              &lwsync_fixup_test;
 
diff --git a/arch/powerpc/platforms/iseries/pci.c b/arch/powerpc/platforms/iseries/pci.c
index 3fc2e6494b8b..ab3962b0d246 100644
--- a/arch/powerpc/platforms/iseries/pci.c
+++ b/arch/powerpc/platforms/iseries/pci.c
@@ -445,7 +445,11 @@ void __init iSeries_pcibios_fixup_resources(struct pci_dev *pdev)
         }
 
         allocate_device_bars(pdev);
-        iseries_device_information(pdev, bus, *sub_bus);
+        if (likely(sub_bus))
+                iseries_device_information(pdev, bus, *sub_bus);
+        else
+                printk(KERN_ERR "PCI: Device node %s has missing or invalid "
+                                "linux,subbus property\n", node->full_name);
 }
 
 /*
diff --git a/arch/um/os-Linux/mem.c b/arch/um/os-Linux/mem.c
index 93a11d7edfa0..e696144d2be3 100644
--- a/arch/um/os-Linux/mem.c
+++ b/arch/um/os-Linux/mem.c
@@ -10,6 +10,7 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <string.h>
+#include <sys/stat.h>
 #include <sys/mman.h>
 #include <sys/param.h>
 #include "init.h"
diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
index 611df11ba15e..c2897b7b4a3b 100644
--- a/arch/x86/kernel/cpu/perf_event_amd.c
+++ b/arch/x86/kernel/cpu/perf_event_amd.c
@@ -102,8 +102,8 @@ static const u64 amd_perfmon_event_map[] =
   [PERF_COUNT_HW_INSTRUCTIONS]          = 0x00c0,
   [PERF_COUNT_HW_CACHE_REFERENCES]      = 0x0080,
   [PERF_COUNT_HW_CACHE_MISSES]          = 0x0081,
-  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]   = 0x00c4,
-  [PERF_COUNT_HW_BRANCH_MISSES]         = 0x00c5,
+  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]   = 0x00c2,
+  [PERF_COUNT_HW_BRANCH_MISSES]         = 0x00c3,
 };
 
 static u64 amd_pmu_event_map(int hw_event)
diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
index 0b96b5589f08..078d4ec1a9d9 100644
--- a/arch/x86/kernel/pci-calgary_64.c
+++ b/arch/x86/kernel/pci-calgary_64.c
@@ -110,7 +110,7 @@ int use_calgary __read_mostly = 0;
  * x3950 (PCIE): 8 chassis, 32 PHBs per chassis   = 256
  * x3950 (PCIX): 8 chassis, 16 PHBs per chassis   = 128
  */
-#define MAX_PHB_BUS_NUM         384
+#define MAX_PHB_BUS_NUM         256
 
 #define PHBS_PER_CALGARY          4
 
@@ -1056,8 +1056,6 @@ static int __init calgary_init_one(struct pci_dev *dev)
         struct iommu_table *tbl;
         int ret;
 
-        BUG_ON(dev->bus->number >= MAX_PHB_BUS_NUM);
-
         bbar = busno_to_bbar(dev->bus->number);
         ret = calgary_setup_tar(dev, bbar);
         if (ret)
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 142d70c74b02..725ef4d17cd5 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -526,6 +526,7 @@ asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
 dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
 {
         struct task_struct *tsk = current;
+        int user_icebp = 0;
         unsigned long dr6;
         int si_code;
 
@@ -534,6 +535,14 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
         /* Filter out all the reserved bits which are preset to 1 */
         dr6 &= ~DR6_RESERVED;
 
+        /*
+         * If dr6 has no reason to give us about the origin of this trap,
+         * then it's very likely the result of an icebp/int01 trap.
+         * User wants a sigtrap for that.
+         */
+        if (!dr6 && user_mode(regs))
+                user_icebp = 1;
+
         /* Catch kmemcheck conditions first of all! */
         if ((dr6 & DR_STEP) && kmemcheck_trap(regs))
                 return;
@@ -575,7 +584,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
                 regs->flags &= ~X86_EFLAGS_TF;
         }
         si_code = get_si_code(tsk->thread.debugreg6);
-        if (tsk->thread.debugreg6 & (DR_STEP | DR_TRAP_BITS))
+        if (tsk->thread.debugreg6 & (DR_STEP | DR_TRAP_BITS) || user_icebp)
                 send_sigtrap(tsk, regs, error_code, si_code);
         preempt_conditional_cli(regs);
 
diff --git a/arch/x86/mm/pat_rbtree.c b/arch/x86/mm/pat_rbtree.c
index f20eeec85a86..8acaddd0fb21 100644
--- a/arch/x86/mm/pat_rbtree.c
+++ b/arch/x86/mm/pat_rbtree.c
@@ -34,8 +34,7 @@
  * memtype_lock protects the rbtree.
  */
 
-static void memtype_rb_augment_cb(struct rb_node *node);
-static struct rb_root memtype_rbroot = RB_AUGMENT_ROOT(&memtype_rb_augment_cb);
+static struct rb_root memtype_rbroot = RB_ROOT;
 
 static int is_node_overlap(struct memtype *node, u64 start, u64 end)
 {
@@ -56,7 +55,7 @@ static u64 get_subtree_max_end(struct rb_node *node)
 }
 
 /* Update 'subtree_max_end' for a node, based on node and its children */
-static void update_node_max_end(struct rb_node *node)
+static void memtype_rb_augment_cb(struct rb_node *node, void *__unused)
 {
         struct memtype *data;
         u64 max_end, child_max_end;
@@ -78,25 +77,6 @@ static void update_node_max_end(struct rb_node *node)
         data->subtree_max_end = max_end;
 }
 
-/* Update 'subtree_max_end' for a node and all its ancestors */
-static void update_path_max_end(struct rb_node *node)
-{
-        u64 old_max_end, new_max_end;
-
-        while (node) {
-                struct memtype *data = container_of(node, struct memtype, rb);
-
-                old_max_end = data->subtree_max_end;
-                update_node_max_end(node);
-                new_max_end = data->subtree_max_end;
-
-                if (new_max_end == old_max_end)
-                        break;
-
-                node = rb_parent(node);
-        }
-}
-
 /* Find the first (lowest start addr) overlapping range from rb tree */
 static struct memtype *memtype_rb_lowest_match(struct rb_root *root,
                                 u64 start, u64 end)
@@ -190,12 +170,6 @@ failure:
         return -EBUSY;
 }
 
-static void memtype_rb_augment_cb(struct rb_node *node)
-{
-        if (node)
-                update_path_max_end(node);
-}
-
 static void memtype_rb_insert(struct rb_root *root, struct memtype *newdata)
 {
         struct rb_node **node = &(root->rb_node);
@@ -213,6 +187,7 @@ static void memtype_rb_insert(struct rb_root *root, struct memtype *newdata)
 
         rb_link_node(&newdata->rb, parent, node);
         rb_insert_color(&newdata->rb, root);
+        rb_augment_insert(&newdata->rb, memtype_rb_augment_cb, NULL);
 }
 
 int rbt_memtype_check_insert(struct memtype *new, unsigned long *ret_type)
@@ -234,13 +209,16 @@ int rbt_memtype_check_insert(struct memtype *new, unsigned long *ret_type)
 
 struct memtype *rbt_memtype_erase(u64 start, u64 end)
 {
+        struct rb_node *deepest;
         struct memtype *data;
 
         data = memtype_rb_exact_match(&memtype_rbroot, start, end);
         if (!data)
                 goto out;
 
+        deepest = rb_augment_erase_begin(&data->rb);
         rb_erase(&data->rb, &memtype_rbroot);
+        rb_augment_erase_end(deepest, memtype_rb_augment_cb, NULL);
 out:
         return data;
 }
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 2ebc39115507..864dd46c346f 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -781,7 +781,7 @@ static int __init erst_init(void)
         status = acpi_get_table(ACPI_SIG_ERST, 0,
                                 (struct acpi_table_header **)&erst_tab);
         if (status == AE_NOT_FOUND) {
-                pr_err(ERST_PFX "Table is not found!\n");
+                pr_info(ERST_PFX "Table is not found!\n");
                 goto err;
         } else if (ACPI_FAILURE(status)) {
                 const char *msg = acpi_format_exception(status);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 8ca16f54e1ed..f2522534ae63 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1053,6 +1053,16 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (pdev->vendor == PCI_VENDOR_ID_MARVELL && !marvell_enable)
                 return -ENODEV;
 
+        /*
+         * For some reason, MCP89 on MacBook 7,1 doesn't work with
+         * ahci, use ata_generic instead.
+         */
+        if (pdev->vendor == PCI_VENDOR_ID_NVIDIA &&
+            pdev->device == PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA &&
+            pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+            pdev->subsystem_device == 0xcb89)
+                return -ENODEV;
+
         /* Promise's PDC42819 is a SAS/SATA controller that has an AHCI mode.
          * At the moment, we can only use the AHCI mode. Let the users know
          * that for SAS drives they're out of luck.
diff --git a/drivers/ata/ata_generic.c b/drivers/ata/ata_generic.c
index 573158a9668d..7107a6929deb 100644
--- a/drivers/ata/ata_generic.c
+++ b/drivers/ata/ata_generic.c
@@ -32,6 +32,11 @@
  *      A generic parallel ATA driver using libata
  */
 
+enum {
+        ATA_GEN_CLASS_MATCH             = (1 << 0),
+        ATA_GEN_FORCE_DMA               = (1 << 1),
+};
+
 /**
  *      generic_set_mode        -       mode setting
  *      @link: link to set up
@@ -46,13 +51,17 @@
 static int generic_set_mode(struct ata_link *link, struct ata_device **unused)
 {
         struct ata_port *ap = link->ap;
+        const struct pci_device_id *id = ap->host->private_data;
         int dma_enabled = 0;
         struct ata_device *dev;
         struct pci_dev *pdev = to_pci_dev(ap->host->dev);
 
-        /* Bits 5 and 6 indicate if DMA is active on master/slave */
-        if (ap->ioaddr.bmdma_addr)
+        if (id->driver_data & ATA_GEN_FORCE_DMA) {
+                dma_enabled = 0xff;
+        } else if (ap->ioaddr.bmdma_addr) {
+                /* Bits 5 and 6 indicate if DMA is active on master/slave */
                 dma_enabled = ioread8(ap->ioaddr.bmdma_addr + ATA_DMA_STATUS);
+        }
 
         if (pdev->vendor == PCI_VENDOR_ID_CENATEK)
                 dma_enabled = 0xFF;
@@ -126,7 +135,7 @@ static int ata_generic_init_one(struct pci_dev *dev, const struct pci_device_id
         const struct ata_port_info *ppi[] = { &info, NULL };
 
         /* Don't use the generic entry unless instructed to do so */
-        if (id->driver_data == 1 && all_generic_ide == 0)
+        if ((id->driver_data & ATA_GEN_CLASS_MATCH) && all_generic_ide == 0)
                 return -ENODEV;
 
         /* Devices that need care */
@@ -155,7 +164,7 @@ static int ata_generic_init_one(struct pci_dev *dev, const struct pci_device_id
                         return rc;
                 pcim_pin_device(dev);
         }
-        return ata_pci_bmdma_init_one(dev, ppi, &generic_sht, NULL, 0);
+        return ata_pci_bmdma_init_one(dev, ppi, &generic_sht, (void *)id, 0);
 }
 
 static struct pci_device_id ata_generic[] = {
@@ -167,7 +176,15 @@ static struct pci_device_id ata_generic[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_HINT,   PCI_DEVICE_ID_HINT_VXPROII_IDE), },
         { PCI_DEVICE(PCI_VENDOR_ID_VIA,    PCI_DEVICE_ID_VIA_82C561), },
         { PCI_DEVICE(PCI_VENDOR_ID_OPTI,   PCI_DEVICE_ID_OPTI_82C558), },
-        { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE), },
+        { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE),
+          .driver_data = ATA_GEN_FORCE_DMA },
+        /*
+         * For some reason, MCP89 on MacBook 7,1 doesn't work with
+         * ahci, use ata_generic instead.
+         */
+        { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA,
+          PCI_VENDOR_ID_APPLE, 0xcb89,
+          .driver_data = ATA_GEN_FORCE_DMA },
 #if !defined(CONFIG_PATA_TOSHIBA) && !defined(CONFIG_PATA_TOSHIBA_MODULE)
         { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_1), },
         { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_2),  },
@@ -175,7 +192,8 @@ static struct pci_device_id ata_generic[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_5),  },
 #endif  
         /* Must come last. If you add entries adjust this table appropriately */
-        { PCI_ANY_ID,           PCI_ANY_ID,                        PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL, 1},
+        { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL),
+          .driver_data = ATA_GEN_CLASS_MATCH },
         { 0, },
 };
 
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 261f86d102e8..81e772a94d59 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -324,6 +324,7 @@ static ssize_t ahci_store_em_buffer(struct device *dev,
         struct ahci_host_priv *hpriv = ap->host->private_data;
         void __iomem *mmio = hpriv->mmio;
         void __iomem *em_mmio = mmio + hpriv->em_loc;
+        const unsigned char *msg_buf = buf;
         u32 em_ctl, msg;
         unsigned long flags;
         int i;
@@ -343,8 +344,8 @@ static ssize_t ahci_store_em_buffer(struct device *dev,
         }
 
         for (i = 0; i < size; i += 4) {
-                msg = buf[i] | buf[i + 1] << 8 |
-                      buf[i + 2] << 16 | buf[i + 3] << 24;
+                msg = msg_buf[i] | msg_buf[i + 1] << 8 |
+                      msg_buf[i + 2] << 16 | msg_buf[i + 3] << 24;
                 writel(msg, em_mmio + i);
         }
 
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index 6f907ebed2d5..6d34f405a2f3 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -37,7 +37,7 @@
 #include <linux/wait.h>
 
 #include <linux/skbuff.h>
-#include <asm/io.h>
+#include <linux/io.h>
 
 #include <pcmcia/cs_types.h>
 #include <pcmcia/cs.h>
diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index 40aec0fb8596..42d69d4de05c 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -244,7 +244,7 @@ static struct sk_buff *bcsp_prepare_pkt(struct bcsp_struct *bcsp, u8 *data,
         if (rel) {
                 hdr[0] |= 0x80 + bcsp->msgq_txseq;
                 BT_DBG("Sending packet with seqno %u", bcsp->msgq_txseq);
-                bcsp->msgq_txseq = ++(bcsp->msgq_txseq) & 0x07;
+                bcsp->msgq_txseq = (bcsp->msgq_txseq + 1) & 0x07;
         }
 
         if (bcsp->use_crc)
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 4b51982fd23a..d2abf5143983 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -97,20 +97,18 @@ EXPORT_SYMBOL(agp_flush_chipset);
 void agp_alloc_page_array(size_t size, struct agp_memory *mem)
 {
         mem->pages = NULL;
-        mem->vmalloc_flag = false;
 
         if (size <= 2*PAGE_SIZE)
-                mem->pages = kmalloc(size, GFP_KERNEL | __GFP_NORETRY);
+                mem->pages = kmalloc(size, GFP_KERNEL | __GFP_NOWARN);
         if (mem->pages == NULL) {
                 mem->pages = vmalloc(size);
-                mem->vmalloc_flag = true;
         }
 }
 EXPORT_SYMBOL(agp_alloc_page_array);
 
 void agp_free_page_array(struct agp_memory *mem)
 {
-        if (mem->vmalloc_flag) {
+        if (is_vmalloc_addr(mem->pages)) {
                 vfree(mem->pages);
         } else {
                 kfree(mem->pages);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 35603dd4e6c5..094bdc355b1f 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -302,6 +302,12 @@ struct smi_info {
 
 static int force_kipmid[SI_MAX_PARMS];
 static int num_force_kipmid;
+#ifdef CONFIG_PCI
+static int pci_registered;
+#endif
+#ifdef CONFIG_PPC_OF
+static int of_registered;
+#endif
 
 static unsigned int kipmid_max_busy_us[SI_MAX_PARMS];
 static int num_max_busy_us;
@@ -1018,7 +1024,7 @@ static int ipmi_thread(void *data)
                 else if (smi_result == SI_SM_IDLE)
                         schedule_timeout_interruptible(100);
                 else
-                        schedule_timeout_interruptible(0);
+                        schedule_timeout_interruptible(1);
         }
         return 0;
 }
@@ -3314,6 +3320,8 @@ static __devinit int init_ipmi_si(void)
         rv = pci_register_driver(&ipmi_pci_driver);
         if (rv)
                 printk(KERN_ERR PFX "Unable to register PCI driver: %d\n", rv);
+        else
+                pci_registered = 1;
 #endif
 
 #ifdef CONFIG_ACPI
@@ -3330,6 +3338,7 @@ static __devinit int init_ipmi_si(void)
 
 #ifdef CONFIG_PPC_OF
         of_register_platform_driver(&ipmi_of_platform_driver);
+        of_registered = 1;
 #endif
 
         /* We prefer devices with interrupts, but in the case of a machine
@@ -3383,11 +3392,13 @@ static __devinit int init_ipmi_si(void)
         if (unload_when_empty && list_empty(&smi_infos)) {
                 mutex_unlock(&smi_infos_lock);
 #ifdef CONFIG_PCI
-                pci_unregister_driver(&ipmi_pci_driver);
+                if (pci_registered)
+                        pci_unregister_driver(&ipmi_pci_driver);
 #endif
 
 #ifdef CONFIG_PPC_OF
-                of_unregister_platform_driver(&ipmi_of_platform_driver);
+                if (of_registered)
+                        of_unregister_platform_driver(&ipmi_of_platform_driver);
 #endif
                 driver_unregister(&ipmi_driver.driver);
                 printk(KERN_WARNING PFX
@@ -3478,14 +3489,16 @@ static __exit void cleanup_ipmi_si(void)
                 return;
 
 #ifdef CONFIG_PCI
-        pci_unregister_driver(&ipmi_pci_driver);
+        if (pci_registered)
+                pci_unregister_driver(&ipmi_pci_driver);
 #endif
 #ifdef CONFIG_ACPI
         pnp_unregister_driver(&ipmi_pnp_driver);
 #endif
 
 #ifdef CONFIG_PPC_OF
-        of_unregister_platform_driver(&ipmi_of_platform_driver);
+        if (of_registered)
+                of_unregister_platform_driver(&ipmi_of_platform_driver);
 #endif
 
         mutex_lock(&smi_infos_lock);
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index 52ff8aa63f84..1b128702d300 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -143,7 +143,7 @@ static inline int which_bucket(unsigned int duration)
          * This allows us to calculate
          * E(duration)|iowait
          */
-        if (nr_iowait_cpu())
+        if (nr_iowait_cpu(smp_processor_id()))
                 bucket = BUCKETS/2;
 
         if (duration < 10)
@@ -175,7 +175,7 @@ static inline int performance_multiplier(void)
         mult += 2 * get_loadavg();
 
         /* for IO wait tasks (per cpu!) we add 5x each */
-        mult += 10 * nr_iowait_cpu();
+        mult += 10 * nr_iowait_cpu(smp_processor_id());
 
         return mult;
 }
diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
index 5a22ca6927e5..7c3747902a37 100644
--- a/drivers/dma/ppc4xx/adma.c
+++ b/drivers/dma/ppc4xx/adma.c
@@ -4257,10 +4257,12 @@ static int ppc440spe_adma_setup_irqs(struct ppc440spe_adma_device *adev,
                                      struct ppc440spe_adma_chan *chan,
                                      int *initcode)
 {
+        struct of_device *ofdev;
         struct device_node *np;
         int ret;
 
-        np = container_of(adev->dev, struct of_device, dev)->node;
+        ofdev = container_of(adev->dev, struct of_device, dev);
+        np = ofdev->dev.of_node;
         if (adev->id != PPC440SPE_XOR_ID) {
                 adev->err_irq = irq_of_parse_and_map(np, 1);
                 if (adev->err_irq == NO_IRQ) {
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index cf17dbb8014f..ac9f7985096d 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -1958,20 +1958,20 @@ static int get_channel_from_ecc_syndrome(struct mem_ctl_info *mci, u16 syndrome)
         u32 value = 0;
         int err_sym = 0;
 
-        amd64_read_pci_cfg(pvt->misc_f3_ctl, 0x180, &value);
+        if (boot_cpu_data.x86 == 0x10) {
 
-        /* F3x180[EccSymbolSize]=1, x8 symbols */
-        if (boot_cpu_data.x86 == 0x10 &&
-            boot_cpu_data.x86_model > 7 &&
-            value & BIT(25)) {
-                err_sym = decode_syndrome(syndrome, x8_vectors,
-                                          ARRAY_SIZE(x8_vectors), 8);
-                return map_err_sym_to_channel(err_sym, 8);
-        } else {
-                err_sym = decode_syndrome(syndrome, x4_vectors,
-                                          ARRAY_SIZE(x4_vectors), 4);
-                return map_err_sym_to_channel(err_sym, 4);
+                amd64_read_pci_cfg(pvt->misc_f3_ctl, 0x180, &value);
+
+                /* F3x180[EccSymbolSize]=1 => x8 symbols */
+                if (boot_cpu_data.x86_model > 7 &&
+                    value & BIT(25)) {
+                        err_sym = decode_syndrome(syndrome, x8_vectors,
+                                                  ARRAY_SIZE(x8_vectors), 8);
+                        return map_err_sym_to_channel(err_sym, 8);
+                }
         }
+        err_sym = decode_syndrome(syndrome, x4_vectors, ARRAY_SIZE(x4_vectors), 4);
+        return map_err_sym_to_channel(err_sym, 4);
 }
 
 /*
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index 6b8b7b41ec5f..cc9357da0e34 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1233,10 +1233,28 @@ static void __init i7core_xeon_pci_fixup(struct pci_id_table *table)
                         for (i = 0; i < MAX_SOCKET_BUSES; i++)
                                 pcibios_scan_specific_bus(255-i);
                 }
+                pci_dev_put(pdev);
                 table++;
         }
 }
 
+static unsigned i7core_pci_lastbus(void)
+{
+        int last_bus = 0, bus;
+        struct pci_bus *b = NULL;
+
+        while ((b = pci_find_next_bus(b)) != NULL) {
+                bus = b->number;
+                debugf0("Found bus %d\n", bus);
+                if (bus > last_bus)
+                        last_bus = bus;
+        }
+
+        debugf0("Last bus %d\n", last_bus);
+
+        return last_bus;
+}
+
 /*
  *      i7core_get_devices      Find and perform 'get' operation on the MCH's
  *                      device/functions we want to reference for this driver
@@ -1244,7 +1262,8 @@ static void __init i7core_xeon_pci_fixup(struct pci_id_table *table)
  *                      Need to 'get' device 16 func 1 and func 2
  */
 int i7core_get_onedevice(struct pci_dev **prev, int devno,
-                         struct pci_id_descr *dev_descr, unsigned n_devs)
+                         struct pci_id_descr *dev_descr, unsigned n_devs,
+                         unsigned last_bus)
 {
         struct i7core_dev *i7core_dev;
 
@@ -1291,10 +1310,7 @@ int i7core_get_onedevice(struct pci_dev **prev, int devno,
         }
         bus = pdev->bus->number;
 
-        if (bus == 0x3f)
-                socket = 0;
-        else
-                socket = 255 - bus;
+        socket = last_bus - bus;
 
         i7core_dev = get_i7core_dev(socket);
         if (!i7core_dev) {
@@ -1358,17 +1374,21 @@ int i7core_get_onedevice(struct pci_dev **prev, int devno,
 
 static int i7core_get_devices(struct pci_id_table *table)
 {
-        int i, rc;
+        int i, rc, last_bus;
         struct pci_dev *pdev = NULL;
         struct pci_id_descr *dev_descr;
 
+        last_bus = i7core_pci_lastbus();
+
         while (table && table->descr) {
                 dev_descr = table->descr;
                 for (i = 0; i < table->n_devs; i++) {
                         pdev = NULL;
                         do {
-                                rc = i7core_get_onedevice(&pdev, i, &dev_descr[i],
-                                                          table->n_devs);
+                                rc = i7core_get_onedevice(&pdev, i,
+                                                          &dev_descr[i],
+                                                          table->n_devs,
+                                                          last_bus);
                                 if (rc < 0) {
                                         if (i == 0) {
                                                 i = table->n_devs;
@@ -1927,21 +1947,26 @@ fail:
  *              0 for FOUND a device
  *              < 0 for error code
  */
+
+static int probed = 0;
+
 static int __devinit i7core_probe(struct pci_dev *pdev,
                                   const struct pci_device_id *id)
 {
-        int dev_idx = id->driver_data;
         int rc;
         struct i7core_dev *i7core_dev;
 
+        /* get the pci devices we want to reserve for our use */
+        mutex_lock(&i7core_edac_lock);
+
         /*
          * All memory controllers are allocated at the first pass.
          */
-        if (unlikely(dev_idx >= 1))
+        if (unlikely(probed >= 1)) {
+                mutex_unlock(&i7core_edac_lock);
                 return -EINVAL;
-
-        /* get the pci devices we want to reserve for our use */
-        mutex_lock(&i7core_edac_lock);
+        }
+        probed++;
 
         rc = i7core_get_devices(pci_dev_table);
         if (unlikely(rc < 0))
@@ -2013,6 +2038,8 @@ static void __devexit i7core_remove(struct pci_dev *pdev)
                                       i7core_dev->socket);
                 }
         }
+        probed--;
+
         mutex_unlock(&i7core_edac_lock);
 }
 
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 724038dab4ca..7face915b963 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -1,5 +1,5 @@
 #
-# GPIO infrastructure and expanders
+# platform-neutral GPIO infrastructure and expanders
 #
 
 config ARCH_WANT_OPTIONAL_GPIOLIB
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index 51c3cdd41b5a..e53dcff49b4f 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -1,4 +1,8 @@
-# gpio support: dedicated expander chips, etc
+# generic gpio support: dedicated expander chips, etc
+#
+# NOTE: platform-specific GPIO drivers don't belong in the
+# drivers/gpio directory; put them with other platform setup
+# code, IRQ controllers, board init, etc.
 
 ccflags-$(CONFIG_DEBUG_GPIO)    += -DDEBUG
 
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 08c4c926e65f..719662034bbf 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -146,7 +146,7 @@ static bool drm_fb_helper_connector_parse_command_line(struct drm_fb_helper_conn
                                 cvt = 1;
                         break;
                 case 'R':
-                        if (!cvt)
+                        if (cvt)
                                 rb = 1;
                         break;
                 case 'm':
@@ -315,8 +315,9 @@ static void drm_fb_helper_on(struct fb_info *info)
         struct drm_device *dev = fb_helper->dev;
         struct drm_crtc *crtc;
         struct drm_crtc_helper_funcs *crtc_funcs;
+        struct drm_connector *connector;
         struct drm_encoder *encoder;
-        int i;
+        int i, j;
 
         /*
          * For each CRTC in this fb, turn the crtc on then,
@@ -332,7 +333,14 @@ static void drm_fb_helper_on(struct fb_info *info)
 
                 crtc_funcs->dpms(crtc, DRM_MODE_DPMS_ON);
 
-
+                /* Walk the connectors & encoders on this fb turning them on */
+                for (j = 0; j < fb_helper->connector_count; j++) {
+                        connector = fb_helper->connector_info[j]->connector;
+                        connector->dpms = DRM_MODE_DPMS_ON;
+                        drm_connector_property_set_value(connector,
+                                                         dev->mode_config.dpms_property,
+                                                         DRM_MODE_DPMS_ON);
+                }
                 /* Found a CRTC on this fb, now find encoders */
                 list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
                         if (encoder->crtc == crtc) {
@@ -352,8 +360,9 @@ static void drm_fb_helper_off(struct fb_info *info, int dpms_mode)
         struct drm_device *dev = fb_helper->dev;
         struct drm_crtc *crtc;
         struct drm_crtc_helper_funcs *crtc_funcs;
+        struct drm_connector *connector;
         struct drm_encoder *encoder;
-        int i;
+        int i, j;
 
         /*
          * For each CRTC in this fb, find all associated encoders
@@ -367,6 +376,14 @@ static void drm_fb_helper_off(struct fb_info *info, int dpms_mode)
                 if (!crtc->enabled)
                         continue;
 
+                /* Walk the connectors on this fb and mark them off */
+                for (j = 0; j < fb_helper->connector_count; j++) {
+                        connector = fb_helper->connector_info[j]->connector;
+                        connector->dpms = dpms_mode;
+                        drm_connector_property_set_value(connector,
+                                                         dev->mode_config.dpms_property,
+                                                         dpms_mode);
+                }
                 /* Found a CRTC on this fb, now find encoders */
                 list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
                         if (encoder->crtc == crtc) {
@@ -1024,11 +1041,18 @@ static struct drm_display_mode *drm_pick_cmdline_mode(struct drm_fb_helper_conne
         }
 
 create_mode:
-        mode = drm_cvt_mode(fb_helper_conn->connector->dev, cmdline_mode->xres,
-                            cmdline_mode->yres,
-                            cmdline_mode->refresh_specified ? cmdline_mode->refresh : 60,
-                            cmdline_mode->rb, cmdline_mode->interlace,
-                            cmdline_mode->margins);
+        if (cmdline_mode->cvt)
+                mode = drm_cvt_mode(fb_helper_conn->connector->dev,
+                                    cmdline_mode->xres, cmdline_mode->yres,
+                                    cmdline_mode->refresh_specified ? cmdline_mode->refresh : 60,
+                                    cmdline_mode->rb, cmdline_mode->interlace,
+                                    cmdline_mode->margins);
+        else
+                mode = drm_gtf_mode(fb_helper_conn->connector->dev,
+                                    cmdline_mode->xres, cmdline_mode->yres,
+                                    cmdline_mode->refresh_specified ? cmdline_mode->refresh : 60,
+                                    cmdline_mode->interlace,
+                                    cmdline_mode->margins);
         drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
         list_add(&mode->head, &fb_helper_conn->connector->modes);
         return mode;
diff --git a/drivers/gpu/drm/i915/dvo_tfp410.c b/drivers/gpu/drm/i915/dvo_tfp410.c
index 66c697bc9b22..56f66426207f 100644
--- a/drivers/gpu/drm/i915/dvo_tfp410.c
+++ b/drivers/gpu/drm/i915/dvo_tfp410.c
@@ -208,7 +208,7 @@ static enum drm_connector_status tfp410_detect(struct intel_dvo_device *dvo)
         uint8_t ctl2;
 
         if (tfp410_readb(dvo, TFP410_CTL_2, &ctl2)) {
-                if (ctl2 & TFP410_CTL_2_HTPLG)
+                if (ctl2 & TFP410_CTL_2_RSEN)
                         ret = connector_status_connected;
                 else
                         ret = connector_status_disconnected;
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 52510ad8b25d..aee83fa178f6 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -620,7 +620,7 @@ static int i915_sr_status(struct seq_file *m, void *unused)
         drm_i915_private_t *dev_priv = dev->dev_private;
         bool sr_enabled = false;
 
-        if (IS_I965G(dev) || IS_I945G(dev) || IS_I945GM(dev))
+        if (IS_I965GM(dev) || IS_I945G(dev) || IS_I945GM(dev))
                 sr_enabled = I915_READ(FW_BLC_SELF) & FW_BLC_SELF_EN;
         else if (IS_I915GM(dev))
                 sr_enabled = I915_READ(INSTPM) & INSTPM_SELF_EN;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 59a2bf8592ec..f00c5ae9556c 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -128,9 +128,11 @@ static int i915_dma_cleanup(struct drm_device * dev)
         if (dev->irq_enabled)
                 drm_irq_uninstall(dev);
 
+        mutex_lock(&dev->struct_mutex);
         intel_cleanup_ring_buffer(dev, &dev_priv->render_ring);
         if (HAS_BSD(dev))
                 intel_cleanup_ring_buffer(dev, &dev_priv->bsd_ring);
+        mutex_unlock(&dev->struct_mutex);
 
         /* Clear the HWS virtual address at teardown */
         if (I915_NEED_GFX_HWS(dev))
@@ -1229,7 +1231,7 @@ static void i915_warn_stolen(struct drm_device *dev)
 static void i915_setup_compression(struct drm_device *dev, int size)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_mm_node *compressed_fb, *compressed_llb;
+        struct drm_mm_node *compressed_fb, *uninitialized_var(compressed_llb);
         unsigned long cfb_base;
         unsigned long ll_base = 0;
 
@@ -1410,6 +1412,10 @@ static int i915_load_modeset_init(struct drm_device *dev,
         if (ret)
                 goto cleanup_vga_client;
 
+        /* IIR "flip pending" bit means done if this bit is set */
+        if (IS_GEN3(dev) && (I915_READ(ECOSKPD) & ECO_FLIP_DONE))
+                dev_priv->flip_pending_is_done = true;
+
         intel_modeset_init(dev);
 
         ret = drm_irq_install(dev);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 276583159847..d147ab2f5bfc 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -596,6 +596,7 @@ typedef struct drm_i915_private {
         struct drm_crtc *plane_to_crtc_mapping[2];
         struct drm_crtc *pipe_to_crtc_mapping[2];
         wait_queue_head_t pending_flip_queue;
+        bool flip_pending_is_done;
 
         /* Reclocking support */
         bool render_reclock_avail;
@@ -1076,7 +1077,7 @@ extern int intel_trans_dp_port_sel (struct drm_crtc *crtc);
         drm_i915_private_t *dev_priv = dev->dev_private;                \
         if (I915_VERBOSE)                                               \
                 DRM_DEBUG("   BEGIN_LP_RING %x\n", (int)(n));           \
-        intel_ring_begin(dev, &dev_priv->render_ring, 4*(n));           \
+        intel_ring_begin(dev, &dev_priv->render_ring, (n));             \
 } while (0)
 
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 9ded3dae6c87..074385882ccf 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2239,7 +2239,7 @@ i915_gem_object_get_pages(struct drm_gem_object *obj,
         mapping = inode->i_mapping;
         for (i = 0; i < page_count; i++) {
                 page = read_cache_page_gfp(mapping, i,
-                                           mapping_gfp_mask (mapping) |
+                                           GFP_HIGHUSER |
                                            __GFP_COLD |
                                            gfpmask);
                 if (IS_ERR(page))
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 2479be001e40..dba53d4b9fb3 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -940,22 +940,30 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                 if (HAS_BSD(dev) && (iir & I915_BSD_USER_INTERRUPT))
                         DRM_WAKEUP(&dev_priv->bsd_ring.irq_queue);
 
-                if (iir & I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT)
+                if (iir & I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT) {
                         intel_prepare_page_flip(dev, 0);
+                        if (dev_priv->flip_pending_is_done)
+                                intel_finish_page_flip_plane(dev, 0);
+                }
 
-                if (iir & I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT)
+                if (iir & I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT) {
                         intel_prepare_page_flip(dev, 1);
+                        if (dev_priv->flip_pending_is_done)
+                                intel_finish_page_flip_plane(dev, 1);
+                }
 
                 if (pipea_stats & vblank_status) {
                         vblank++;
                         drm_handle_vblank(dev, 0);
-                        intel_finish_page_flip(dev, 0);
+                        if (!dev_priv->flip_pending_is_done)
+                                intel_finish_page_flip(dev, 0);
                 }
 
                 if (pipeb_stats & vblank_status) {
                         vblank++;
                         drm_handle_vblank(dev, 1);
-                        intel_finish_page_flip(dev, 1);
+                        if (!dev_priv->flip_pending_is_done)
+                                intel_finish_page_flip(dev, 1);
                 }
 
                 if ((pipea_stats & I915_LEGACY_BLC_EVENT_STATUS) ||
@@ -1387,29 +1395,10 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
         dev_priv->pipestat[1] = 0;
 
         if (I915_HAS_HOTPLUG(dev)) {
-                u32 hotplug_en = I915_READ(PORT_HOTPLUG_EN);
-
-                /* Note HDMI and DP share bits */
-                if (dev_priv->hotplug_supported_mask & HDMIB_HOTPLUG_INT_STATUS)
-                        hotplug_en |= HDMIB_HOTPLUG_INT_EN;
-                if (dev_priv->hotplug_supported_mask & HDMIC_HOTPLUG_INT_STATUS)
-                        hotplug_en |= HDMIC_HOTPLUG_INT_EN;
-                if (dev_priv->hotplug_supported_mask & HDMID_HOTPLUG_INT_STATUS)
-                        hotplug_en |= HDMID_HOTPLUG_INT_EN;
-                if (dev_priv->hotplug_supported_mask & SDVOC_HOTPLUG_INT_STATUS)
-                        hotplug_en |= SDVOC_HOTPLUG_INT_EN;
-                if (dev_priv->hotplug_supported_mask & SDVOB_HOTPLUG_INT_STATUS)
-                        hotplug_en |= SDVOB_HOTPLUG_INT_EN;
-                if (dev_priv->hotplug_supported_mask & CRT_HOTPLUG_INT_STATUS)
-                        hotplug_en |= CRT_HOTPLUG_INT_EN;
-                /* Ignore TV since it's buggy */
-
-                I915_WRITE(PORT_HOTPLUG_EN, hotplug_en);
-
                 /* Enable in IER... */
                 enable_mask |= I915_DISPLAY_PORT_INTERRUPT;
                 /* and unmask in IMR */
-                i915_enable_irq(dev_priv, I915_DISPLAY_PORT_INTERRUPT);
+                dev_priv->irq_mask_reg &= ~I915_DISPLAY_PORT_INTERRUPT;
         }
 
         /*
@@ -1427,16 +1416,41 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
         }
         I915_WRITE(EMR, error_mask);
 
-        /* Disable pipe interrupt enables, clear pending pipe status */
-        I915_WRITE(PIPEASTAT, I915_READ(PIPEASTAT) & 0x8000ffff);
-        I915_WRITE(PIPEBSTAT, I915_READ(PIPEBSTAT) & 0x8000ffff);
-        /* Clear pending interrupt status */
-        I915_WRITE(IIR, I915_READ(IIR));
-
-        I915_WRITE(IER, enable_mask);
         I915_WRITE(IMR, dev_priv->irq_mask_reg);
+        I915_WRITE(IER, enable_mask);
         (void) I915_READ(IER);
 
+        if (I915_HAS_HOTPLUG(dev)) {
+                u32 hotplug_en = I915_READ(PORT_HOTPLUG_EN);
+
+                /* Note HDMI and DP share bits */
+                if (dev_priv->hotplug_supported_mask & HDMIB_HOTPLUG_INT_STATUS)
+                        hotplug_en |= HDMIB_HOTPLUG_INT_EN;
+                if (dev_priv->hotplug_supported_mask & HDMIC_HOTPLUG_INT_STATUS)
+                        hotplug_en |= HDMIC_HOTPLUG_INT_EN;
+                if (dev_priv->hotplug_supported_mask & HDMID_HOTPLUG_INT_STATUS)
+                        hotplug_en |= HDMID_HOTPLUG_INT_EN;
+                if (dev_priv->hotplug_supported_mask & SDVOC_HOTPLUG_INT_STATUS)
+                        hotplug_en |= SDVOC_HOTPLUG_INT_EN;
+                if (dev_priv->hotplug_supported_mask & SDVOB_HOTPLUG_INT_STATUS)
+                        hotplug_en |= SDVOB_HOTPLUG_INT_EN;
+                if (dev_priv->hotplug_supported_mask & CRT_HOTPLUG_INT_STATUS) {
+                        hotplug_en |= CRT_HOTPLUG_INT_EN;
+
+                        /* Programming the CRT detection parameters tends
+                           to generate a spurious hotplug event about three
+                           seconds later.  So just do it once.
+                        */
+                        if (IS_G4X(dev))
+                                hotplug_en |= CRT_HOTPLUG_ACTIVATION_PERIOD_64;
+                        hotplug_en |= CRT_HOTPLUG_VOLTAGE_COMPARE_50;
+                }
+
+                /* Ignore TV since it's buggy */
+
+                I915_WRITE(PORT_HOTPLUG_EN, hotplug_en);
+        }
+
         opregion_enable_asle(dev);
 
         return 0;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 64b0a3afd92b..150400f40534 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -178,6 +178,7 @@
 #define   MI_OVERLAY_OFF        (0x2<<21)
 #define MI_LOAD_SCAN_LINES_INCL MI_INSTR(0x12, 0)
 #define MI_DISPLAY_FLIP         MI_INSTR(0x14, 2)
+#define MI_DISPLAY_FLIP_I915    MI_INSTR(0x14, 1)
 #define   MI_DISPLAY_FLIP_PLANE(n) ((n) << 20)
 #define MI_STORE_DWORD_IMM      MI_INSTR(0x20, 1)
 #define   MI_MEM_VIRTUAL        (1 << 22) /* 965+ only */
@@ -368,6 +369,9 @@
 #define   CM0_RC_OP_FLUSH_DISABLE (1<<0)
 #define BB_ADDR         0x02140 /* 8 bytes */
 #define GFX_FLSH_CNTL   0x02170 /* 915+ only */
+#define ECOSKPD         0x021d0
+#define   ECO_GATING_CX_ONLY    (1<<3)
+#define   ECO_FLIP_DONE         (1<<0)
 
 /* GEN6 interrupt control */
 #define GEN6_RENDER_HWSTAM      0x2098
@@ -1130,7 +1134,6 @@
 #define CRT_HOTPLUG_DETECT_DELAY_2G             (1 << 4)
 #define CRT_HOTPLUG_DETECT_VOLTAGE_325MV        (0 << 2)
 #define CRT_HOTPLUG_DETECT_VOLTAGE_475MV        (1 << 2)
-#define CRT_HOTPLUG_MASK                        (0x3fc) /* Bits 9-2 */
 
 #define PORT_HOTPLUG_STAT       0x61114
 #define   HDMIB_HOTPLUG_INT_STATUS              (1 << 29)
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 22ff38455731..ee0732b222a1 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -234,14 +234,8 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
         else
                 tries = 1;
         hotplug_en = orig = I915_READ(PORT_HOTPLUG_EN);
-        hotplug_en &= CRT_HOTPLUG_MASK;
         hotplug_en |= CRT_HOTPLUG_FORCE_DETECT;
 
-        if (IS_G4X(dev))
-                hotplug_en |= CRT_HOTPLUG_ACTIVATION_PERIOD_64;
-
-        hotplug_en |= CRT_HOTPLUG_VOLTAGE_COMPARE_50;
-
         for (i = 0; i < tries ; i++) {
                 unsigned long timeout;
                 /* turn on the FORCE_DETECT */
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index cc8131ff319f..68dcf36e2793 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2970,11 +2970,13 @@ static void i965_update_wm(struct drm_device *dev, int planea_clock,
                 if (srwm < 0)
                         srwm = 1;
                 srwm &= 0x3f;
-                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
+                if (IS_I965GM(dev))
+                        I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
         } else {
                 /* Turn off self refresh if both pipes are enabled */
-                I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
-                                        & ~FW_BLC_SELF_EN);
+                if (IS_I965GM(dev))
+                        I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
+                                   & ~FW_BLC_SELF_EN);
         }
 
         DRM_DEBUG_KMS("Setting FIFO watermarks - A: 8, B: 8, C: 8, SR %d\n",
@@ -4483,6 +4485,7 @@ static void intel_idle_update(struct work_struct *work)
         struct drm_device *dev = dev_priv->dev;
         struct drm_crtc *crtc;
         struct intel_crtc *intel_crtc;
+        int enabled = 0;
 
         if (!i915_powersave)
                 return;
@@ -4491,21 +4494,22 @@ static void intel_idle_update(struct work_struct *work)
 
         i915_update_gfx_val(dev_priv);
 
-        if (IS_I945G(dev) || IS_I945GM(dev)) {
-                DRM_DEBUG_DRIVER("enable memory self refresh on 945\n");
-                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN_MASK | FW_BLC_SELF_EN);
-        }
-
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                 /* Skip inactive CRTCs */
                 if (!crtc->fb)
                         continue;
 
+                enabled++;
                 intel_crtc = to_intel_crtc(crtc);
                 if (!intel_crtc->busy)
                         intel_decrease_pllclock(crtc);
         }
 
+        if ((enabled == 1) && (IS_I945G(dev) || IS_I945GM(dev))) {
+                DRM_DEBUG_DRIVER("enable memory self refresh on 945\n");
+                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN_MASK | FW_BLC_SELF_EN);
+        }
+
         mutex_unlock(&dev->struct_mutex);
 }
 
@@ -4601,10 +4605,10 @@ static void intel_unpin_work_fn(struct work_struct *__work)
         kfree(work);
 }
 
-void intel_finish_page_flip(struct drm_device *dev, int pipe)
+static void do_intel_finish_page_flip(struct drm_device *dev,
+                                      struct drm_crtc *crtc)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         struct intel_unpin_work *work;
         struct drm_i915_gem_object *obj_priv;
@@ -4648,6 +4652,22 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
         schedule_work(&work->work);
 }
 
+void intel_finish_page_flip(struct drm_device *dev, int pipe)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
+
+        do_intel_finish_page_flip(dev, crtc);
+}
+
+void intel_finish_page_flip_plane(struct drm_device *dev, int plane)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_crtc *crtc = dev_priv->plane_to_crtc_mapping[plane];
+
+        do_intel_finish_page_flip(dev, crtc);
+}
+
 void intel_prepare_page_flip(struct drm_device *dev, int plane)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
@@ -4678,6 +4698,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
         unsigned long flags;
         int pipesrc_reg = (intel_crtc->pipe == 0) ? PIPEASRC : PIPEBSRC;
         int ret, pipesrc;
+        u32 flip_mask;
 
         work = kzalloc(sizeof *work, GFP_KERNEL);
         if (work == NULL)
@@ -4731,15 +4752,28 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
         atomic_inc(&obj_priv->pending_flip);
         work->pending_flip_obj = obj;
 
+        if (intel_crtc->plane)
+                flip_mask = I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
+        else
+                flip_mask = I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT;
+
+        /* Wait for any previous flip to finish */
+        if (IS_GEN3(dev))
+                while (I915_READ(ISR) & flip_mask)
+                        ;
+
         BEGIN_LP_RING(4);
-        OUT_RING(MI_DISPLAY_FLIP |
-                 MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
-        OUT_RING(fb->pitch);
         if (IS_I965G(dev)) {
+                OUT_RING(MI_DISPLAY_FLIP |
+                         MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
+                OUT_RING(fb->pitch);
                 OUT_RING(obj_priv->gtt_offset | obj_priv->tiling_mode);
                 pipesrc = I915_READ(pipesrc_reg); 
                 OUT_RING(pipesrc & 0x0fff0fff);
         } else {
+                OUT_RING(MI_DISPLAY_FLIP_I915 |
+                         MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
+                OUT_RING(fb->pitch);
                 OUT_RING(obj_priv->gtt_offset);
                 OUT_RING(MI_NOOP);
         }
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 49b54f05d3cf..1aac59e83bff 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -136,6 +136,12 @@ intel_dp_link_required(struct drm_device *dev,
 }
 
 static int
+intel_dp_max_data_rate(int max_link_clock, int max_lanes)
+{
+        return (max_link_clock * max_lanes * 8) / 10;
+}
+
+static int
 intel_dp_mode_valid(struct drm_connector *connector,
                     struct drm_display_mode *mode)
 {
@@ -144,8 +150,11 @@ intel_dp_mode_valid(struct drm_connector *connector,
         int max_link_clock = intel_dp_link_clock(intel_dp_max_link_bw(intel_encoder));
         int max_lanes = intel_dp_max_lane_count(intel_encoder);
 
-        if (intel_dp_link_required(connector->dev, intel_encoder, mode->clock)
-                        > max_link_clock * max_lanes)
+        /* only refuse the mode on non eDP since we have seen some wierd eDP panels
+           which are outside spec tolerances but somehow work by magic */
+        if (!IS_eDP(intel_encoder) &&
+            (intel_dp_link_required(connector->dev, intel_encoder, mode->clock)
+             > intel_dp_max_data_rate(max_link_clock, max_lanes)))
                 return MODE_CLOCK_HIGH;
 
         if (mode->clock < 10000)
@@ -506,7 +515,7 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
 
         for (lane_count = 1; lane_count <= max_lane_count; lane_count <<= 1) {
                 for (clock = 0; clock <= max_clock; clock++) {
-                        int link_avail = intel_dp_link_clock(bws[clock]) * lane_count;
+                        int link_avail = intel_dp_max_data_rate(intel_dp_link_clock(bws[clock]), lane_count);
 
                         if (intel_dp_link_required(encoder->dev, intel_encoder, mode->clock)
                                         <= link_avail) {
@@ -521,6 +530,18 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
                         }
                 }
         }
+
+        if (IS_eDP(intel_encoder)) {
+                /* okay we failed just pick the highest */
+                dp_priv->lane_count = max_lane_count;
+                dp_priv->link_bw = bws[max_clock];
+                adjusted_mode->clock = intel_dp_link_clock(dp_priv->link_bw);
+                DRM_DEBUG_KMS("Force picking display port link bw %02x lane "
+                              "count %d clock %d\n",
+                              dp_priv->link_bw, dp_priv->lane_count,
+                              adjusted_mode->clock);
+                return true;
+        }
         return false;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index df931f787665..72206f37c4fb 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -224,6 +224,7 @@ extern void intel_fbdev_fini(struct drm_device *dev);
 
 extern void intel_prepare_page_flip(struct drm_device *dev, int plane);
 extern void intel_finish_page_flip(struct drm_device *dev, int pipe);
+extern void intel_finish_page_flip_plane(struct drm_device *dev, int plane);
 
 extern void intel_setup_overlay(struct drm_device *dev);
 extern void intel_cleanup_overlay(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 6a1accd83aec..31df55f0a0a7 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -983,8 +983,8 @@ void intel_lvds_init(struct drm_device *dev)
 
         drm_connector_attach_property(&intel_connector->base,
                                       dev->mode_config.scaling_mode_property,
-                                      DRM_MODE_SCALE_FULLSCREEN);
-        lvds_priv->fitting_mode = DRM_MODE_SCALE_FULLSCREEN;
+                                      DRM_MODE_SCALE_ASPECT);
+        lvds_priv->fitting_mode = DRM_MODE_SCALE_ASPECT;
         /*
          * LVDS discovery:
          * 1) check for EDID on DDC
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index cea4f1a8709e..26362f8495a8 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -94,7 +94,7 @@ render_ring_flush(struct drm_device *dev,
 #if WATCH_EXEC
                 DRM_INFO("%s: queue flush %08x to ring\n", __func__, cmd);
 #endif
-                intel_ring_begin(dev, ring, 8);
+                intel_ring_begin(dev, ring, 2);
                 intel_ring_emit(dev, ring, cmd);
                 intel_ring_emit(dev, ring, MI_NOOP);
                 intel_ring_advance(dev, ring);
@@ -358,7 +358,7 @@ bsd_ring_flush(struct drm_device *dev,
                 u32     invalidate_domains,
                 u32     flush_domains)
 {
-        intel_ring_begin(dev, ring, 8);
+        intel_ring_begin(dev, ring, 2);
         intel_ring_emit(dev, ring, MI_FLUSH);
         intel_ring_emit(dev, ring, MI_NOOP);
         intel_ring_advance(dev, ring);
@@ -687,6 +687,7 @@ int intel_wrap_ring_buffer(struct drm_device *dev,
                 *virt++ = MI_NOOP;
 
         ring->tail = 0;
+        ring->space = ring->head - 8;
 
         return 0;
 }
@@ -721,8 +722,9 @@ int intel_wait_ring_buffer(struct drm_device *dev,
 }
 
 void intel_ring_begin(struct drm_device *dev,
-                struct intel_ring_buffer *ring, int n)
+                struct intel_ring_buffer *ring, int num_dwords)
 {
+        int n = 4*num_dwords;
         if (unlikely(ring->tail + n > ring->size))
                 intel_wrap_ring_buffer(dev, ring);
         if (unlikely(ring->space < n))
@@ -752,7 +754,7 @@ void intel_fill_struct(struct drm_device *dev,
 {
         unsigned int *virt = ring->virtual_start + ring->tail;
         BUG_ON((len&~(4-1)) != 0);
-        intel_ring_begin(dev, ring, len);
+        intel_ring_begin(dev, ring, len/4);
         memcpy(virt, data, len);
         ring->tail += len;
         ring->tail &= ring->size - 1;
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index f3f2827017ef..8c2d6478a221 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -498,7 +498,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                 if ((rdev->family == CHIP_RS600) ||
                     (rdev->family == CHIP_RS690) ||
                     (rdev->family == CHIP_RS740))
-                        pll->flags |= (RADEON_PLL_USE_FRAC_FB_DIV |
+                        pll->flags |= (/*RADEON_PLL_USE_FRAC_FB_DIV |*/
                                        RADEON_PLL_PREFER_CLOSEST_LOWER);
 
                 if (ASIC_IS_DCE32(rdev) && mode->clock > 200000)        /* range limits??? */
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 4b6623df3b96..1caf625e472b 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -607,7 +607,7 @@ static void evergreen_mc_program(struct radeon_device *rdev)
         WREG32(MC_VM_FB_LOCATION, tmp);
         WREG32(HDP_NONSURFACE_BASE, (rdev->mc.vram_start >> 8));
         WREG32(HDP_NONSURFACE_INFO, (2 << 7));
-        WREG32(HDP_NONSURFACE_SIZE, (rdev->mc.mc_vram_size - 1) | 0x3FF);
+        WREG32(HDP_NONSURFACE_SIZE, 0x3FFFFFFF);
         if (rdev->flags & RADEON_IS_AGP) {
                 WREG32(MC_VM_AGP_TOP, rdev->mc.gtt_end >> 16);
                 WREG32(MC_VM_AGP_BOT, rdev->mc.gtt_start >> 16);
@@ -1222,11 +1222,11 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
                 ps_thread_count = 128;
 
         sq_thread_resource_mgmt = NUM_PS_THREADS(ps_thread_count);
-        sq_thread_resource_mgmt |= NUM_VS_THREADS(((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8;
-        sq_thread_resource_mgmt |= NUM_GS_THREADS(((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8;
-        sq_thread_resource_mgmt |= NUM_ES_THREADS(((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8;
-        sq_thread_resource_mgmt_2 = NUM_HS_THREADS(((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8;
-        sq_thread_resource_mgmt_2 |= NUM_LS_THREADS(((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8;
+        sq_thread_resource_mgmt |= NUM_VS_THREADS((((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8);
+        sq_thread_resource_mgmt |= NUM_GS_THREADS((((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8);
+        sq_thread_resource_mgmt |= NUM_ES_THREADS((((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8);
+        sq_thread_resource_mgmt_2 = NUM_HS_THREADS((((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8);
+        sq_thread_resource_mgmt_2 |= NUM_LS_THREADS((((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8);
 
         sq_stack_resource_mgmt_1 = NUM_PS_STACK_ENTRIES((rdev->config.evergreen.max_stack_entries * 1) / 6);
         sq_stack_resource_mgmt_1 |= NUM_VS_STACK_ENTRIES((rdev->config.evergreen.max_stack_entries * 1) / 6);
@@ -1260,6 +1260,9 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         WREG32(VGT_GS_VERTEX_REUSE, 16);
         WREG32(PA_SC_LINE_STIPPLE_STATE, 0);
 
+        WREG32(VGT_VERTEX_REUSE_BLOCK_CNTL, 14);
+        WREG32(VGT_OUT_DEALLOC_CNTL, 16);
+
         WREG32(CB_PERF_CTR0_SEL_0, 0);
         WREG32(CB_PERF_CTR0_SEL_1, 0);
         WREG32(CB_PERF_CTR1_SEL_0, 0);
@@ -1269,6 +1272,26 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         WREG32(CB_PERF_CTR3_SEL_0, 0);
         WREG32(CB_PERF_CTR3_SEL_1, 0);
 
+        /* clear render buffer base addresses */
+        WREG32(CB_COLOR0_BASE, 0);
+        WREG32(CB_COLOR1_BASE, 0);
+        WREG32(CB_COLOR2_BASE, 0);
+        WREG32(CB_COLOR3_BASE, 0);
+        WREG32(CB_COLOR4_BASE, 0);
+        WREG32(CB_COLOR5_BASE, 0);
+        WREG32(CB_COLOR6_BASE, 0);
+        WREG32(CB_COLOR7_BASE, 0);
+        WREG32(CB_COLOR8_BASE, 0);
+        WREG32(CB_COLOR9_BASE, 0);
+        WREG32(CB_COLOR10_BASE, 0);
+        WREG32(CB_COLOR11_BASE, 0);
+
+        /* set the shader const cache sizes to 0 */
+        for (i = SQ_ALU_CONST_BUFFER_SIZE_PS_0; i < 0x28200; i += 4)
+                WREG32(i, 0);
+        for (i = SQ_ALU_CONST_BUFFER_SIZE_HS_0; i < 0x29000; i += 4)
+                WREG32(i, 0);
+
         hdp_host_path_cntl = RREG32(HDP_HOST_PATH_CNTL);
         WREG32(HDP_HOST_PATH_CNTL, hdp_host_path_cntl);
 
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 64516b950891..010963d4570f 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -1197,7 +1197,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                         DRM_ERROR("bad SET_RESOURCE (tex)\n");
                                         return -EINVAL;
                                 }
-                                ib[idx+1+(i*8)+3] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                                ib[idx+1+(i*8)+2] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
                                 if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
                                         ib[idx+1+(i*8)+1] |= TEX_ARRAY_MODE(ARRAY_2D_TILED_THIN1);
                                 else if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
@@ -1209,7 +1209,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                         DRM_ERROR("bad SET_RESOURCE (tex)\n");
                                         return -EINVAL;
                                 }
-                                ib[idx+1+(i*8)+4] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                                ib[idx+1+(i*8)+3] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
                                 mipmap = reloc->robj;
                                 r = evergreen_check_texture_resource(p,  idx+1+(i*8),
                                                 texture, mipmap);
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index 79683f6b4452..a1cd621780e2 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -713,6 +713,9 @@
 #define SQ_GSVS_RING_OFFSET_2                           0x28930
 #define SQ_GSVS_RING_OFFSET_3                           0x28934
 
+#define SQ_ALU_CONST_BUFFER_SIZE_PS_0                   0x28140
+#define SQ_ALU_CONST_BUFFER_SIZE_HS_0                   0x28f80
+
 #define SQ_ALU_CONST_CACHE_PS_0                         0x28940
 #define SQ_ALU_CONST_CACHE_PS_1                         0x28944
 #define SQ_ALU_CONST_CACHE_PS_2                         0x28948
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index cf89aa2eb28c..3970e62eaab8 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -1628,6 +1628,7 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                 case RADEON_TXFORMAT_RGB332:
                 case RADEON_TXFORMAT_Y8:
                         track->textures[i].cpp = 1;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case RADEON_TXFORMAT_AI88:
                 case RADEON_TXFORMAT_ARGB1555:
@@ -1639,12 +1640,14 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                 case RADEON_TXFORMAT_LDUDV655:
                 case RADEON_TXFORMAT_DUDV88:
                         track->textures[i].cpp = 2;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case RADEON_TXFORMAT_ARGB8888:
                 case RADEON_TXFORMAT_RGBA8888:
                 case RADEON_TXFORMAT_SHADOW32:
                 case RADEON_TXFORMAT_LDUDUV8888:
                         track->textures[i].cpp = 4;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case RADEON_TXFORMAT_DXT1:
                         track->textures[i].cpp = 1;
@@ -2604,12 +2607,6 @@ int r100_set_surface_reg(struct radeon_device *rdev, int reg,
         int surf_index = reg * 16;
         int flags = 0;
 
-        /* r100/r200 divide by 16 */
-        if (rdev->family < CHIP_R300)
-                flags = pitch / 16;
-        else
-                flags = pitch / 8;
-
         if (rdev->family <= CHIP_RS200) {
                 if ((tiling_flags & (RADEON_TILING_MACRO|RADEON_TILING_MICRO))
                                  == (RADEON_TILING_MACRO|RADEON_TILING_MICRO))
@@ -2633,6 +2630,20 @@ int r100_set_surface_reg(struct radeon_device *rdev, int reg,
         if (tiling_flags & RADEON_TILING_SWAP_32BIT)
                 flags |= RADEON_SURF_AP0_SWP_32BPP | RADEON_SURF_AP1_SWP_32BPP;
 
+        /* when we aren't tiling the pitch seems to needs to be furtherdivided down. - tested on power5 + rn50 server */
+        if (tiling_flags & (RADEON_TILING_SWAP_16BIT | RADEON_TILING_SWAP_32BIT)) {
+                if (!(tiling_flags & (RADEON_TILING_MACRO | RADEON_TILING_MICRO)))
+                        if (ASIC_IS_RN50(rdev))
+                                pitch /= 16;
+        }
+
+        /* r100/r200 divide by 16 */
+        if (rdev->family < CHIP_R300)
+                flags |= pitch / 16;
+        else
+                flags |= pitch / 8;
+
+
         DRM_DEBUG("writing surface %d %d %x %x\n", reg, flags, offset, offset+obj_size-1);
         WREG32(RADEON_SURFACE0_INFO + surf_index, flags);
         WREG32(RADEON_SURFACE0_LOWER_BOUND + surf_index, offset);
@@ -3147,33 +3158,6 @@ static inline void r100_cs_track_texture_print(struct r100_cs_track_texture *t)
         DRM_ERROR("compress format            %d\n", t->compress_format);
 }
 
-static int r100_cs_track_cube(struct radeon_device *rdev,
-                              struct r100_cs_track *track, unsigned idx)
-{
-        unsigned face, w, h;
-        struct radeon_bo *cube_robj;
-        unsigned long size;
-
-        for (face = 0; face < 5; face++) {
-                cube_robj = track->textures[idx].cube_info[face].robj;
-                w = track->textures[idx].cube_info[face].width;
-                h = track->textures[idx].cube_info[face].height;
-
-                size = w * h;
-                size *= track->textures[idx].cpp;
-
-                size += track->textures[idx].cube_info[face].offset;
-
-                if (size > radeon_bo_size(cube_robj)) {
-                        DRM_ERROR("Cube texture offset greater than object size %lu %lu\n",
-                                  size, radeon_bo_size(cube_robj));
-                        r100_cs_track_texture_print(&track->textures[idx]);
-                        return -1;
-                }
-        }
-        return 0;
-}
-
 static int r100_track_compress_size(int compress_format, int w, int h)
 {
         int block_width, block_height, block_bytes;
@@ -3204,6 +3188,37 @@ static int r100_track_compress_size(int compress_format, int w, int h)
         return sz;
 }
 
+static int r100_cs_track_cube(struct radeon_device *rdev,
+                              struct r100_cs_track *track, unsigned idx)
+{
+        unsigned face, w, h;
+        struct radeon_bo *cube_robj;
+        unsigned long size;
+        unsigned compress_format = track->textures[idx].compress_format;
+
+        for (face = 0; face < 5; face++) {
+                cube_robj = track->textures[idx].cube_info[face].robj;
+                w = track->textures[idx].cube_info[face].width;
+                h = track->textures[idx].cube_info[face].height;
+
+                if (compress_format) {
+                        size = r100_track_compress_size(compress_format, w, h);
+                } else
+                        size = w * h;
+                size *= track->textures[idx].cpp;
+
+                size += track->textures[idx].cube_info[face].offset;
+
+                if (size > radeon_bo_size(cube_robj)) {
+                        DRM_ERROR("Cube texture offset greater than object size %lu %lu\n",
+                                  size, radeon_bo_size(cube_robj));
+                        r100_cs_track_texture_print(&track->textures[idx]);
+                        return -1;
+                }
+        }
+        return 0;
+}
+
 static int r100_cs_track_texture_check(struct radeon_device *rdev,
                                        struct r100_cs_track *track)
 {
diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c
index 85617c311212..0266d72e0a4c 100644
--- a/drivers/gpu/drm/radeon/r200.c
+++ b/drivers/gpu/drm/radeon/r200.c
@@ -415,6 +415,8 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                 /* 2D, 3D, CUBE */
                 switch (tmp) {
                 case 0:
+                case 3:
+                case 4:
                 case 5:
                 case 6:
                 case 7:
@@ -450,6 +452,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                 case R200_TXFORMAT_RGB332:
                 case R200_TXFORMAT_Y8:
                         track->textures[i].cpp = 1;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R200_TXFORMAT_AI88:
                 case R200_TXFORMAT_ARGB1555:
@@ -461,6 +464,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                 case R200_TXFORMAT_DVDU88:
                 case R200_TXFORMAT_AVYU4444:
                         track->textures[i].cpp = 2;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R200_TXFORMAT_ARGB8888:
                 case R200_TXFORMAT_RGBA8888:
@@ -468,6 +472,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                 case R200_TXFORMAT_BGR111110:
                 case R200_TXFORMAT_LDVDU8888:
                         track->textures[i].cpp = 4;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R200_TXFORMAT_DXT1:
                         track->textures[i].cpp = 1;
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index b2f9efe2897c..7e81db5eb804 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -881,6 +881,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 case R300_TX_FORMAT_Y4X4:
                 case R300_TX_FORMAT_Z3Y3X2:
                         track->textures[i].cpp = 1;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R300_TX_FORMAT_X16:
                 case R300_TX_FORMAT_Y8X8:
@@ -892,6 +893,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 case R300_TX_FORMAT_B8G8_B8G8:
                 case R300_TX_FORMAT_G8R8_G8B8:
                         track->textures[i].cpp = 2;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R300_TX_FORMAT_Y16X16:
                 case R300_TX_FORMAT_Z11Y11X10:
@@ -902,14 +904,17 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 case R300_TX_FORMAT_FL_I32:
                 case 0x1e:
                         track->textures[i].cpp = 4;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R300_TX_FORMAT_W16Z16Y16X16:
                 case R300_TX_FORMAT_FL_R16G16B16A16:
                 case R300_TX_FORMAT_FL_I32A32:
                         track->textures[i].cpp = 8;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R300_TX_FORMAT_FL_R32G32B32A32:
                         track->textures[i].cpp = 16;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R300_TX_FORMAT_DXT1:
                         track->textures[i].cpp = 1;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 0e91871f45be..3d6645ce2151 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -130,9 +130,14 @@ void r600_pm_get_dynpm_state(struct radeon_device *rdev)
                                                         break;
                                                 }
                                         }
-                                } else
-                                        rdev->pm.requested_power_state_index =
-                                                rdev->pm.current_power_state_index - 1;
+                                } else {
+                                        if (rdev->pm.current_power_state_index == 0)
+                                                rdev->pm.requested_power_state_index =
+                                                        rdev->pm.num_power_states - 1;
+                                        else
+                                                rdev->pm.requested_power_state_index =
+                                                        rdev->pm.current_power_state_index - 1;
+                                }
                         }
                         rdev->pm.requested_clock_mode_index = 0;
                         /* don't use the power state if crtcs are active and no display flag is set */
@@ -1097,7 +1102,7 @@ static void r600_mc_program(struct radeon_device *rdev)
         WREG32(MC_VM_FB_LOCATION, tmp);
         WREG32(HDP_NONSURFACE_BASE, (rdev->mc.vram_start >> 8));
         WREG32(HDP_NONSURFACE_INFO, (2 << 7));
-        WREG32(HDP_NONSURFACE_SIZE, rdev->mc.mc_vram_size | 0x3FF);
+        WREG32(HDP_NONSURFACE_SIZE, 0x3FFFFFFF);
         if (rdev->flags & RADEON_IS_AGP) {
                 WREG32(MC_VM_AGP_TOP, rdev->mc.gtt_end >> 22);
                 WREG32(MC_VM_AGP_BOT, rdev->mc.gtt_start >> 22);
@@ -1219,8 +1224,10 @@ int r600_mc_init(struct radeon_device *rdev)
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
         r600_vram_gtt_location(rdev, &rdev->mc);
 
-        if (rdev->flags & RADEON_IS_IGP)
+        if (rdev->flags & RADEON_IS_IGP) {
+                rs690_pm_info(rdev);
                 rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
+        }
         radeon_update_bandwidth_info(rdev);
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 8e1d44ca26ec..ab61aaa887bb 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -177,6 +177,7 @@ void radeon_pm_resume(struct radeon_device *rdev);
 void radeon_combios_get_power_modes(struct radeon_device *rdev);
 void radeon_atombios_get_power_modes(struct radeon_device *rdev);
 void radeon_atom_set_voltage(struct radeon_device *rdev, u16 level);
+void rs690_pm_info(struct radeon_device *rdev);
 
 /*
  * Fences.
@@ -619,7 +620,8 @@ enum radeon_dynpm_state {
         DYNPM_STATE_DISABLED,
         DYNPM_STATE_MINIMUM,
         DYNPM_STATE_PAUSED,
-        DYNPM_STATE_ACTIVE
+        DYNPM_STATE_ACTIVE,
+        DYNPM_STATE_SUSPENDED,
 };
 enum radeon_dynpm_action {
         DYNPM_ACTION_NONE,
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 87f7e2cc52d4..646f96f97c77 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -780,6 +780,13 @@ int radeon_asic_init(struct radeon_device *rdev)
         case CHIP_R423:
         case CHIP_RV410:
                 rdev->asic = &r420_asic;
+                /* handle macs */
+                if (rdev->bios == NULL) {
+                        rdev->asic->get_engine_clock = &radeon_legacy_get_engine_clock;
+                        rdev->asic->set_engine_clock = &radeon_legacy_set_engine_clock;
+                        rdev->asic->get_memory_clock = &radeon_legacy_get_memory_clock;
+                        rdev->asic->set_memory_clock = NULL;
+                }
                 break;
         case CHIP_RS400:
         case CHIP_RS480:
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index fbba938f8048..2c9213739999 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -48,6 +48,10 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev)
         resource_size_t vram_base;
         resource_size_t size = 256 * 1024; /* ??? */
 
+        if (!(rdev->flags & RADEON_IS_IGP))
+                if (!radeon_card_posted(rdev))
+                        return false;
+
         rdev->bios = NULL;
         vram_base = drm_get_resource_start(rdev->ddev, 0);
         bios = ioremap(vram_base, size);
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 1bee2f9e24a5..d1c1d8dd93ce 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -1411,6 +1411,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
                         rdev->mode_info.connector_table = CT_IMAC_G5_ISIGHT;
                 } else
 #endif /* CONFIG_PPC_PMAC */
+#ifdef CONFIG_PPC64
+                if (ASIC_IS_RN50(rdev))
+                        rdev->mode_info.connector_table = CT_RN50_POWER;
+                else
+#endif
                         rdev->mode_info.connector_table = CT_GENERIC;
         }
 
@@ -1853,6 +1858,33 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
                                             CONNECTOR_OBJECT_ID_SVIDEO,
                                             &hpd);
                 break;
+        case CT_RN50_POWER:
+                DRM_INFO("Connector Table: %d (rn50-power)\n",
+                         rdev->mode_info.connector_table);
+                /* VGA - primary dac */
+                ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
+                hpd.hpd = RADEON_HPD_NONE;
+                radeon_add_legacy_encoder(dev,
+                                          radeon_get_encoder_id(dev,
+                                                                ATOM_DEVICE_CRT1_SUPPORT,
+                                                                1),
+                                          ATOM_DEVICE_CRT1_SUPPORT);
+                radeon_add_legacy_connector(dev, 0, ATOM_DEVICE_CRT1_SUPPORT,
+                                            DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
+                                            CONNECTOR_OBJECT_ID_VGA,
+                                            &hpd);
+                ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_CRT2_DDC);
+                hpd.hpd = RADEON_HPD_NONE;
+                radeon_add_legacy_encoder(dev,
+                                          radeon_get_encoder_id(dev,
+                                                                ATOM_DEVICE_CRT2_SUPPORT,
+                                                                2),
+                                          ATOM_DEVICE_CRT2_SUPPORT);
+                radeon_add_legacy_connector(dev, 1, ATOM_DEVICE_CRT2_SUPPORT,
+                                            DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
+                                            CONNECTOR_OBJECT_ID_VGA,
+                                            &hpd);
+                break;
         default:
                 DRM_INFO("Connector table: %d (invalid)\n",
                          rdev->mode_info.connector_table);
@@ -1906,15 +1938,6 @@ static bool radeon_apply_legacy_quirks(struct drm_device *dev,
                         return false;
         }
 
-        /* Some RV100 cards with 2 VGA ports show up with DVI+VGA */
-        if (dev->pdev->device == 0x5159 &&
-            dev->pdev->subsystem_vendor == 0x1002 &&
-            dev->pdev->subsystem_device == 0x013a) {
-                if (*legacy_connector == CONNECTOR_DVI_I_LEGACY)
-                        *legacy_connector = CONNECTOR_CRT_LEGACY;
-
-        }
-
         /* X300 card with extra non-existent DVI port */
         if (dev->pdev->device == 0x5B60 &&
             dev->pdev->subsystem_vendor == 0x17af &&
@@ -3019,6 +3042,14 @@ void radeon_combios_asic_init(struct drm_device *dev)
                 combios_write_ram_size(dev);
         }
 
+        /* quirk for rs4xx HP nx6125 laptop to make it resume
+         * - it hangs on resume inside the dynclk 1 table.
+         */
+        if (rdev->family == CHIP_RS480 &&
+            rdev->pdev->subsystem_vendor == 0x103c &&
+            rdev->pdev->subsystem_device == 0x308b)
+                return;
+
         /* DYN CLK 1 */
         table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
         if (table)
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 0c7ccc6961a3..f58f8bd8f77b 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -785,7 +785,9 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
                                         if (connector == list_connector)
                                                 continue;
                                         list_radeon_connector = to_radeon_connector(list_connector);
-                                        if (radeon_connector->devices == list_radeon_connector->devices) {
+                                        if (list_radeon_connector->shared_ddc &&
+                                            (list_radeon_connector->ddc_bus->rec.i2c_id ==
+                                             radeon_connector->ddc_bus->rec.i2c_id)) {
                                                 if (drm_detect_hdmi_monitor(radeon_connector->edid)) {
                                                         if (connector->connector_type == DRM_MODE_CONNECTOR_DVID) {
                                                                 kfree(radeon_connector->edid);
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index b7023fff89eb..4eb67c0e0996 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -194,7 +194,7 @@ unpin:
 fail:
         drm_gem_object_unreference_unlocked(obj);
 
-        return 0;
+        return ret;
 }
 
 int radeon_crtc_cursor_move(struct drm_crtc *crtc,
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index f10faed21567..5f317317aba2 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -779,6 +779,7 @@ int radeon_suspend_kms(struct drm_device *dev, pm_message_t state)
 
 int radeon_resume_kms(struct drm_device *dev)
 {
+        struct drm_connector *connector;
         struct radeon_device *rdev = dev->dev_private;
 
         if (rdev->powered_down)
@@ -797,6 +798,12 @@ int radeon_resume_kms(struct drm_device *dev)
         radeon_resume(rdev);
         radeon_pm_resume(rdev);
         radeon_restore_bios_scratch_regs(rdev);
+
+        /* turn on display hw */
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
+        }
+
         radeon_fbdev_set_suspend(rdev, 0);
         release_console_sem();
 
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 1ebb100015b7..e0b30b264c28 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -1072,6 +1072,8 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
         if (is_dig) {
                 switch (mode) {
                 case DRM_MODE_DPMS_ON:
+                        if (!ASIC_IS_DCE4(rdev))
+                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                         if (atombios_get_encoder_mode(encoder) == ATOM_ENCODER_MODE_DP) {
                                 struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
 
@@ -1079,8 +1081,6 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
                                 if (ASIC_IS_DCE4(rdev))
                                         atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_ON);
                         }
-                        if (!ASIC_IS_DCE4(rdev))
-                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                         break;
                 case DRM_MODE_DPMS_STANDBY:
                 case DRM_MODE_DPMS_SUSPEND:
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 5b07b8848e09..bad77f40a9da 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -928,16 +928,14 @@ static void radeon_legacy_tv_dac_mode_set(struct drm_encoder *encoder,
         if (ASIC_IS_R300(rdev)) {
                 gpiopad_a = RREG32(RADEON_GPIOPAD_A) | 1;
                 disp_output_cntl = RREG32(RADEON_DISP_OUTPUT_CNTL);
-        }
-
-        if (rdev->family == CHIP_R200 || ASIC_IS_R300(rdev))
-                disp_tv_out_cntl = RREG32(RADEON_DISP_TV_OUT_CNTL);
-        else
+        } else if (rdev->family != CHIP_R200)
                 disp_hw_debug = RREG32(RADEON_DISP_HW_DEBUG);
-
-        if (rdev->family == CHIP_R200)
+        else if (rdev->family == CHIP_R200)
                 fp2_gen_cntl = RREG32(RADEON_FP2_GEN_CNTL);
 
+        if (rdev->family >= CHIP_R200)
+                disp_tv_out_cntl = RREG32(RADEON_DISP_TV_OUT_CNTL);
+
         if (is_tv) {
                 uint32_t dac_cntl;
 
@@ -1002,15 +1000,13 @@ static void radeon_legacy_tv_dac_mode_set(struct drm_encoder *encoder,
         if (ASIC_IS_R300(rdev)) {
                 WREG32_P(RADEON_GPIOPAD_A, gpiopad_a, ~1);
                 WREG32(RADEON_DISP_OUTPUT_CNTL, disp_output_cntl);
-        }
+        } else if (rdev->family != CHIP_R200)
+                WREG32(RADEON_DISP_HW_DEBUG, disp_hw_debug);
+        else if (rdev->family == CHIP_R200)
+                WREG32(RADEON_FP2_GEN_CNTL, fp2_gen_cntl);
 
         if (rdev->family >= CHIP_R200)
                 WREG32(RADEON_DISP_TV_OUT_CNTL, disp_tv_out_cntl);
-        else
-                WREG32(RADEON_DISP_HW_DEBUG, disp_hw_debug);
-
-        if (rdev->family == CHIP_R200)
-                WREG32(RADEON_FP2_GEN_CNTL, fp2_gen_cntl);
 
         if (is_tv)
                 radeon_legacy_tv_mode_set(encoder, mode, adjusted_mode);
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 67358baf28b2..95696aa57ac8 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -206,6 +206,7 @@ enum radeon_connector_table {
         CT_MINI_INTERNAL,
         CT_IMAC_G5_ISIGHT,
         CT_EMAC,
+        CT_RN50_POWER,
 };
 
 enum radeon_dvo_chip {
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 63f679a04b25..115d26b762cc 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -397,13 +397,20 @@ static ssize_t radeon_set_pm_method(struct device *dev,
                 rdev->pm.dynpm_planned_action = DYNPM_ACTION_DEFAULT;
                 mutex_unlock(&rdev->pm.mutex);
         } else if (strncmp("profile", buf, strlen("profile")) == 0) {
+                bool flush_wq = false;
+
                 mutex_lock(&rdev->pm.mutex);
-                rdev->pm.pm_method = PM_METHOD_PROFILE;
+                if (rdev->pm.pm_method == PM_METHOD_DYNPM) {
+                        cancel_delayed_work(&rdev->pm.dynpm_idle_work);
+                        flush_wq = true;
+                }
                 /* disable dynpm */
                 rdev->pm.dynpm_state = DYNPM_STATE_DISABLED;
                 rdev->pm.dynpm_planned_action = DYNPM_ACTION_NONE;
-                cancel_delayed_work(&rdev->pm.dynpm_idle_work);
+                rdev->pm.pm_method = PM_METHOD_PROFILE;
                 mutex_unlock(&rdev->pm.mutex);
+                if (flush_wq)
+                        flush_workqueue(rdev->wq);
         } else {
                 DRM_ERROR("invalid power method!\n");
                 goto fail;
@@ -418,9 +425,18 @@ static DEVICE_ATTR(power_method, S_IRUGO | S_IWUSR, radeon_get_pm_method, radeon
 
 void radeon_pm_suspend(struct radeon_device *rdev)
 {
+        bool flush_wq = false;
+
         mutex_lock(&rdev->pm.mutex);
-        cancel_delayed_work(&rdev->pm.dynpm_idle_work);
+        if (rdev->pm.pm_method == PM_METHOD_DYNPM) {
+                cancel_delayed_work(&rdev->pm.dynpm_idle_work);
+                if (rdev->pm.dynpm_state == DYNPM_STATE_ACTIVE)
+                        rdev->pm.dynpm_state = DYNPM_STATE_SUSPENDED;
+                flush_wq = true;
+        }
         mutex_unlock(&rdev->pm.mutex);
+        if (flush_wq)
+                flush_workqueue(rdev->wq);
 }
 
 void radeon_pm_resume(struct radeon_device *rdev)
@@ -432,6 +448,12 @@ void radeon_pm_resume(struct radeon_device *rdev)
         rdev->pm.current_sclk = rdev->clock.default_sclk;
         rdev->pm.current_mclk = rdev->clock.default_mclk;
         rdev->pm.current_vddc = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.voltage;
+        if (rdev->pm.pm_method == PM_METHOD_DYNPM
+            && rdev->pm.dynpm_state == DYNPM_STATE_SUSPENDED) {
+                rdev->pm.dynpm_state = DYNPM_STATE_ACTIVE;
+                queue_delayed_work(rdev->wq, &rdev->pm.dynpm_idle_work,
+                                        msecs_to_jiffies(RADEON_IDLE_LOOP_MS));
+        }
         mutex_unlock(&rdev->pm.mutex);
         radeon_pm_compute_clocks(rdev);
 }
@@ -486,6 +508,8 @@ int radeon_pm_init(struct radeon_device *rdev)
 void radeon_pm_fini(struct radeon_device *rdev)
 {
         if (rdev->pm.num_power_states > 1) {
+                bool flush_wq = false;
+
                 mutex_lock(&rdev->pm.mutex);
                 if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
                         rdev->pm.profile = PM_PROFILE_DEFAULT;
@@ -493,13 +517,16 @@ void radeon_pm_fini(struct radeon_device *rdev)
                         radeon_pm_set_clocks(rdev);
                 } else if (rdev->pm.pm_method == PM_METHOD_DYNPM) {
                         /* cancel work */
-                        cancel_delayed_work_sync(&rdev->pm.dynpm_idle_work);
+                        cancel_delayed_work(&rdev->pm.dynpm_idle_work);
+                        flush_wq = true;
                         /* reset default clocks */
                         rdev->pm.dynpm_state = DYNPM_STATE_DISABLED;
                         rdev->pm.dynpm_planned_action = DYNPM_ACTION_DEFAULT;
                         radeon_pm_set_clocks(rdev);
                 }
                 mutex_unlock(&rdev->pm.mutex);
+                if (flush_wq)
+                        flush_workqueue(rdev->wq);
 
                 device_remove_file(rdev->dev, &dev_attr_power_profile);
                 device_remove_file(rdev->dev, &dev_attr_power_method);
@@ -720,12 +747,12 @@ static void radeon_dynpm_idle_work_handler(struct work_struct *work)
                         radeon_pm_get_dynpm_state(rdev);
                         radeon_pm_set_clocks(rdev);
                 }
+
+                queue_delayed_work(rdev->wq, &rdev->pm.dynpm_idle_work,
+                                        msecs_to_jiffies(RADEON_IDLE_LOOP_MS));
         }
         mutex_unlock(&rdev->pm.mutex);
         ttm_bo_unlock_delayed_workqueue(&rdev->mman.bdev, resched);
-
-        queue_delayed_work(rdev->wq, &rdev->pm.dynpm_idle_work,
-                                        msecs_to_jiffies(RADEON_IDLE_LOOP_MS));
 }
 
 /*
diff --git a/drivers/gpu/drm/radeon/reg_srcs/evergreen b/drivers/gpu/drm/radeon/reg_srcs/evergreen
index b5c757f68d3c..f78fd592544d 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/evergreen
+++ b/drivers/gpu/drm/radeon/reg_srcs/evergreen
@@ -80,8 +80,8 @@ evergreen 0x9400
 0x00028010 DB_RENDER_OVERRIDE2
 0x00028028 DB_STENCIL_CLEAR
 0x0002802C DB_DEPTH_CLEAR
-0x00028034 PA_SC_SCREEN_SCISSOR_BR
 0x00028030 PA_SC_SCREEN_SCISSOR_TL
+0x00028034 PA_SC_SCREEN_SCISSOR_BR
 0x0002805C DB_DEPTH_SLICE
 0x00028140 SQ_ALU_CONST_BUFFER_SIZE_PS_0
 0x00028144 SQ_ALU_CONST_BUFFER_SIZE_PS_1
@@ -460,8 +460,8 @@ evergreen 0x9400
 0x00028844 SQ_PGM_RESOURCES_PS
 0x00028848 SQ_PGM_RESOURCES_2_PS
 0x0002884C SQ_PGM_EXPORTS_PS
-0x0002885C SQ_PGM_RESOURCES_VS
-0x00028860 SQ_PGM_RESOURCES_2_VS
+0x00028860 SQ_PGM_RESOURCES_VS
+0x00028864 SQ_PGM_RESOURCES_2_VS
 0x00028878 SQ_PGM_RESOURCES_GS
 0x0002887C SQ_PGM_RESOURCES_2_GS
 0x00028890 SQ_PGM_RESOURCES_ES
@@ -469,8 +469,8 @@ evergreen 0x9400
 0x000288A8 SQ_PGM_RESOURCES_FS
 0x000288BC SQ_PGM_RESOURCES_HS
 0x000288C0 SQ_PGM_RESOURCES_2_HS
-0x000288D0 SQ_PGM_RESOURCES_LS
-0x000288D4 SQ_PGM_RESOURCES_2_LS
+0x000288D4 SQ_PGM_RESOURCES_LS
+0x000288D8 SQ_PGM_RESOURCES_2_LS
 0x000288E8 SQ_LDS_ALLOC
 0x000288EC SQ_LDS_ALLOC_PS
 0x000288F0 SQ_VTX_SEMANTIC_CLEAR
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index bcc33195ebc2..f4f0a61bcdce 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -79,7 +79,13 @@ void rs690_pm_info(struct radeon_device *rdev)
                         tmp.full = dfixed_const(100);
                         rdev->pm.igp_sideport_mclk.full = dfixed_const(info->info.ulBootUpMemoryClock);
                         rdev->pm.igp_sideport_mclk.full = dfixed_div(rdev->pm.igp_sideport_mclk, tmp);
-                        rdev->pm.igp_system_mclk.full = dfixed_const(le16_to_cpu(info->info.usK8MemoryClock));
+                        if (info->info.usK8MemoryClock)
+                                rdev->pm.igp_system_mclk.full = dfixed_const(le16_to_cpu(info->info.usK8MemoryClock));
+                        else if (rdev->clock.default_mclk) {
+                                rdev->pm.igp_system_mclk.full = dfixed_const(rdev->clock.default_mclk);
+                                rdev->pm.igp_system_mclk.full = dfixed_div(rdev->pm.igp_system_mclk, tmp);
+                        } else
+                                rdev->pm.igp_system_mclk.full = dfixed_const(400);
                         rdev->pm.igp_ht_link_clk.full = dfixed_const(le16_to_cpu(info->info.usFSBClock));
                         rdev->pm.igp_ht_link_width.full = dfixed_const(info->info.ucHTLinkWidth);
                         break;
@@ -87,34 +93,31 @@ void rs690_pm_info(struct radeon_device *rdev)
                         tmp.full = dfixed_const(100);
                         rdev->pm.igp_sideport_mclk.full = dfixed_const(info->info_v2.ulBootUpSidePortClock);
                         rdev->pm.igp_sideport_mclk.full = dfixed_div(rdev->pm.igp_sideport_mclk, tmp);
-                        rdev->pm.igp_system_mclk.full = dfixed_const(info->info_v2.ulBootUpUMAClock);
+                        if (info->info_v2.ulBootUpUMAClock)
+                                rdev->pm.igp_system_mclk.full = dfixed_const(info->info_v2.ulBootUpUMAClock);
+                        else if (rdev->clock.default_mclk)
+                                rdev->pm.igp_system_mclk.full = dfixed_const(rdev->clock.default_mclk);
+                        else
+                                rdev->pm.igp_system_mclk.full = dfixed_const(66700);
                         rdev->pm.igp_system_mclk.full = dfixed_div(rdev->pm.igp_system_mclk, tmp);
                         rdev->pm.igp_ht_link_clk.full = dfixed_const(info->info_v2.ulHTLinkFreq);
                         rdev->pm.igp_ht_link_clk.full = dfixed_div(rdev->pm.igp_ht_link_clk, tmp);
                         rdev->pm.igp_ht_link_width.full = dfixed_const(le16_to_cpu(info->info_v2.usMinHTLinkWidth));
                         break;
                 default:
-                        tmp.full = dfixed_const(100);
                         /* We assume the slower possible clock ie worst case */
-                        /* DDR 333Mhz */
-                        rdev->pm.igp_sideport_mclk.full = dfixed_const(333);
-                        /* FIXME: system clock ? */
-                        rdev->pm.igp_system_mclk.full = dfixed_const(100);
-                        rdev->pm.igp_system_mclk.full = dfixed_div(rdev->pm.igp_system_mclk, tmp);
-                        rdev->pm.igp_ht_link_clk.full = dfixed_const(200);
+                        rdev->pm.igp_sideport_mclk.full = dfixed_const(200);
+                        rdev->pm.igp_system_mclk.full = dfixed_const(200);
+                        rdev->pm.igp_ht_link_clk.full = dfixed_const(1000);
                         rdev->pm.igp_ht_link_width.full = dfixed_const(8);
                         DRM_ERROR("No integrated system info for your GPU, using safe default\n");
                         break;
                 }
         } else {
-                tmp.full = dfixed_const(100);
                 /* We assume the slower possible clock ie worst case */
-                /* DDR 333Mhz */
-                rdev->pm.igp_sideport_mclk.full = dfixed_const(333);
-                /* FIXME: system clock ? */
-                rdev->pm.igp_system_mclk.full = dfixed_const(100);
-                rdev->pm.igp_system_mclk.full = dfixed_div(rdev->pm.igp_system_mclk, tmp);
-                rdev->pm.igp_ht_link_clk.full = dfixed_const(200);
+                rdev->pm.igp_sideport_mclk.full = dfixed_const(200);
+                rdev->pm.igp_system_mclk.full = dfixed_const(200);
+                rdev->pm.igp_ht_link_clk.full = dfixed_const(1000);
                 rdev->pm.igp_ht_link_width.full = dfixed_const(8);
                 DRM_ERROR("No integrated system info for your GPU, using safe default\n");
         }
@@ -228,10 +231,6 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
         fixed20_12 a, b, c;
         fixed20_12 pclk, request_fifo_depth, tolerable_latency, estimated_width;
         fixed20_12 consumption_time, line_time, chunk_time, read_delay_latency;
-        /* FIXME: detect IGP with sideport memory, i don't think there is any
-         * such product available
-         */
-        bool sideport = false;
 
         if (!crtc->base.enabled) {
                 /* FIXME: wouldn't it better to set priority mark to maximum */
@@ -300,7 +299,7 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
 
         /* Maximun bandwidth is the minimun bandwidth of all component */
         rdev->pm.max_bandwidth = rdev->pm.core_bandwidth;
-        if (sideport) {
+        if (rdev->mc.igp_sideport_enabled) {
                 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
                         rdev->pm.sideport_bandwidth.full)
                         rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index cec536c222c5..b7fd82064922 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -224,7 +224,7 @@ static void rv770_mc_program(struct radeon_device *rdev)
         WREG32(MC_VM_FB_LOCATION, tmp);
         WREG32(HDP_NONSURFACE_BASE, (rdev->mc.vram_start >> 8));
         WREG32(HDP_NONSURFACE_INFO, (2 << 7));
-        WREG32(HDP_NONSURFACE_SIZE, (rdev->mc.mc_vram_size - 1) | 0x3FF);
+        WREG32(HDP_NONSURFACE_SIZE, 0x3FFFFFFF);
         if (rdev->flags & RADEON_IS_AGP) {
                 WREG32(MC_VM_AGP_TOP, rdev->mc.gtt_end >> 16);
                 WREG32(MC_VM_AGP_BOT, rdev->mc.gtt_start >> 16);
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index ef910694bd63..b1d67dc973dc 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -104,7 +104,6 @@ struct ttm_pool_opts {
 struct ttm_pool_manager {
         struct kobject          kobj;
         struct shrinker         mm_shrink;
-        atomic_t                page_alloc_inited;
         struct ttm_pool_opts    options;
 
         union {
@@ -142,7 +141,7 @@ static void ttm_pool_kobj_release(struct kobject *kobj)
 {
         struct ttm_pool_manager *m =
                 container_of(kobj, struct ttm_pool_manager, kobj);
-        (void)m;
+        kfree(m);
 }
 
 static ssize_t ttm_pool_store(struct kobject *kobj,
@@ -214,9 +213,7 @@ static struct kobj_type ttm_pool_kobj_type = {
         .default_attrs = ttm_pool_attrs,
 };
 
-static struct ttm_pool_manager _manager = {
-        .page_alloc_inited      = ATOMIC_INIT(0)
-};
+static struct ttm_pool_manager *_manager;
 
 #ifndef CONFIG_X86
 static int set_pages_array_wb(struct page **pages, int addrinarray)
@@ -271,7 +268,7 @@ static struct ttm_page_pool *ttm_get_pool(int flags,
         if (flags & TTM_PAGE_FLAG_DMA32)
                 pool_index |= 0x2;
 
-        return &_manager.pools[pool_index];
+        return &_manager->pools[pool_index];
 }
 
 /* set memory back to wb and free the pages. */
@@ -387,7 +384,7 @@ static int ttm_pool_get_num_unused_pages(void)
         unsigned i;
         int total = 0;
         for (i = 0; i < NUM_POOLS; ++i)
-                total += _manager.pools[i].npages;
+                total += _manager->pools[i].npages;
 
         return total;
 }
@@ -408,7 +405,7 @@ static int ttm_pool_mm_shrink(int shrink_pages, gfp_t gfp_mask)
                 unsigned nr_free = shrink_pages;
                 if (shrink_pages == 0)
                         break;
-                pool = &_manager.pools[(i + pool_offset)%NUM_POOLS];
+                pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
                 shrink_pages = ttm_page_pool_free(pool, nr_free);
         }
         /* return estimated number of unused pages in pool */
@@ -576,10 +573,10 @@ static void ttm_page_pool_fill_locked(struct ttm_page_pool *pool,
 
         /* If allocation request is small and there is not enough
          * pages in pool we fill the pool first */
-        if (count < _manager.options.small
+        if (count < _manager->options.small
                 && count > pool->npages) {
                 struct list_head new_pages;
-                unsigned alloc_size = _manager.options.alloc_size;
+                unsigned alloc_size = _manager->options.alloc_size;
 
                 /**
                  * Can't change page caching if in irqsave context. We have to
@@ -667,7 +664,7 @@ int ttm_get_pages(struct list_head *pages, int flags,
 {
         struct ttm_page_pool *pool = ttm_get_pool(flags, cstate);
         struct page *p = NULL;
-        int gfp_flags = 0;
+        int gfp_flags = GFP_USER;
         int r;
 
         /* set zero flag for page allocation if required */
@@ -759,8 +756,8 @@ void ttm_put_pages(struct list_head *pages, unsigned page_count, int flags,
         pool->npages += page_count;
         /* Check that we don't go over the pool limit */
         page_count = 0;
-        if (pool->npages > _manager.options.max_size) {
-                page_count = pool->npages - _manager.options.max_size;
+        if (pool->npages > _manager->options.max_size) {
+                page_count = pool->npages - _manager->options.max_size;
                 /* free at least NUM_PAGES_TO_ALLOC number of pages
                  * to reduce calls to set_memory_wb */
                 if (page_count < NUM_PAGES_TO_ALLOC)
@@ -785,33 +782,36 @@ static void ttm_page_pool_init_locked(struct ttm_page_pool *pool, int flags,
 int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages)
 {
         int ret;
-        if (atomic_add_return(1, &_manager.page_alloc_inited) > 1)
-                return 0;
+
+        WARN_ON(_manager);
 
         printk(KERN_INFO TTM_PFX "Initializing pool allocator.\n");
 
-        ttm_page_pool_init_locked(&_manager.wc_pool, GFP_HIGHUSER, "wc");
+        _manager = kzalloc(sizeof(*_manager), GFP_KERNEL);
 
-        ttm_page_pool_init_locked(&_manager.uc_pool, GFP_HIGHUSER, "uc");
+        ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc");
 
-        ttm_page_pool_init_locked(&_manager.wc_pool_dma32, GFP_USER | GFP_DMA32,
-                        "wc dma");
+        ttm_page_pool_init_locked(&_manager->uc_pool, GFP_HIGHUSER, "uc");
 
-        ttm_page_pool_init_locked(&_manager.uc_pool_dma32, GFP_USER | GFP_DMA32,
-                        "uc dma");
+        ttm_page_pool_init_locked(&_manager->wc_pool_dma32,
+                                  GFP_USER | GFP_DMA32, "wc dma");
 
-        _manager.options.max_size = max_pages;
-        _manager.options.small = SMALL_ALLOCATION;
-        _manager.options.alloc_size = NUM_PAGES_TO_ALLOC;
+        ttm_page_pool_init_locked(&_manager->uc_pool_dma32,
+                                  GFP_USER | GFP_DMA32, "uc dma");
 
-        kobject_init(&_manager.kobj, &ttm_pool_kobj_type);
-        ret = kobject_add(&_manager.kobj, &glob->kobj, "pool");
+        _manager->options.max_size = max_pages;
+        _manager->options.small = SMALL_ALLOCATION;
+        _manager->options.alloc_size = NUM_PAGES_TO_ALLOC;
+
+        ret = kobject_init_and_add(&_manager->kobj, &ttm_pool_kobj_type,
+                                   &glob->kobj, "pool");
         if (unlikely(ret != 0)) {
-                kobject_put(&_manager.kobj);
+                kobject_put(&_manager->kobj);
+                _manager = NULL;
                 return ret;
         }
 
-        ttm_pool_mm_shrink_init(&_manager);
+        ttm_pool_mm_shrink_init(_manager);
 
         return 0;
 }
@@ -820,16 +820,14 @@ void ttm_page_alloc_fini()
 {
         int i;
 
-        if (atomic_sub_return(1, &_manager.page_alloc_inited) > 0)
-                return;
-
         printk(KERN_INFO TTM_PFX "Finalizing pool allocator.\n");
-        ttm_pool_mm_shrink_fini(&_manager);
+        ttm_pool_mm_shrink_fini(_manager);
 
         for (i = 0; i < NUM_POOLS; ++i)
-                ttm_page_pool_free(&_manager.pools[i], FREE_ALL_PAGES);
+                ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES);
 
-        kobject_put(&_manager.kobj);
+        kobject_put(&_manager->kobj);
+        _manager = NULL;
 }
 
 int ttm_page_alloc_debugfs(struct seq_file *m, void *data)
@@ -837,14 +835,14 @@ int ttm_page_alloc_debugfs(struct seq_file *m, void *data)
         struct ttm_page_pool *p;
         unsigned i;
         char *h[] = {"pool", "refills", "pages freed", "size"};
-        if (atomic_read(&_manager.page_alloc_inited) == 0) {
+        if (!_manager) {
                 seq_printf(m, "No pool allocator running.\n");
                 return 0;
         }
         seq_printf(m, "%6s %12s %13s %8s\n",
                         h[0], h[1], h[2], h[3]);
         for (i = 0; i < NUM_POOLS; ++i) {
-                p = &_manager.pools[i];
+                p = &_manager->pools[i];
 
                 seq_printf(m, "%6s %12ld %13ld %8d\n",
                                 p->name, p->nrefills,
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 40fdc41446cc..df483076eda6 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -340,7 +340,8 @@ static void rlb_update_entry_from_arp(struct bonding *bond, struct arp_pkt *arp)
 
         if ((client_info->assigned) &&
             (client_info->ip_src == arp->ip_dst) &&
-            (client_info->ip_dst == arp->ip_src)) {
+            (client_info->ip_dst == arp->ip_src) &&
+            (compare_ether_addr_64bits(client_info->mac_dst, arp->mac_src))) {
                 /* update the clients MAC address */
                 memcpy(client_info->mac_dst, arp->mac_src, ETH_ALEN);
                 client_info->ntt = 1;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 5e12462a9d5e..c3d98dde2f86 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -168,7 +168,7 @@ static int arp_ip_count;
 static int bond_mode    = BOND_MODE_ROUNDROBIN;
 static int xmit_hashtype = BOND_XMIT_POLICY_LAYER2;
 static int lacp_fast;
-
+static int disable_netpoll = 1;
 
 const struct bond_parm_tbl bond_lacp_tbl[] = {
 {       "slow",         AD_LACP_SLOW},
@@ -1742,15 +1742,23 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         bond_set_carrier(bond);
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        if (slaves_support_netpoll(bond_dev)) {
-                bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
-                if (bond_dev->npinfo)
-                        slave_dev->npinfo = bond_dev->npinfo;
-        } else if (!(bond_dev->priv_flags & IFF_DISABLE_NETPOLL)) {
+        /*
+         * Netpoll and bonding is broken, make sure it is not initialized
+         * until it is fixed.
+         */
+        if (disable_netpoll) {
                 bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
-                pr_info("New slave device %s does not support netpoll\n",
-                        slave_dev->name);
-                pr_info("Disabling netpoll support for %s\n", bond_dev->name);
+        } else {
+                if (slaves_support_netpoll(bond_dev)) {
+                        bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
+                        if (bond_dev->npinfo)
+                                slave_dev->npinfo = bond_dev->npinfo;
+                } else if (!(bond_dev->priv_flags & IFF_DISABLE_NETPOLL)) {
+                        bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
+                        pr_info("New slave device %s does not support netpoll\n",
+                                slave_dev->name);
+                        pr_info("Disabling netpoll support for %s\n", bond_dev->name);
+                }
         }
 #endif
         read_unlock(&bond->lock);
@@ -1950,8 +1958,11 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
         read_lock_bh(&bond->lock);
-        if (slaves_support_netpoll(bond_dev))
-                bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
+
+         /* Make sure netpoll over stays disabled until fixed. */
+        if (!disable_netpoll)
+                if (slaves_support_netpoll(bond_dev))
+                                bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
         read_unlock_bh(&bond->lock);
         if (slave_dev->netdev_ops->ndo_netpoll_cleanup)
                 slave_dev->netdev_ops->ndo_netpoll_cleanup(slave_dev);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index ce30c62a97f7..7b5d9764f317 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -3684,10 +3684,6 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
         /* signal that we are down to the interrupt handler */
         set_bit(__IXGBE_DOWN, &adapter->state);
 
-        /* power down the optics */
-        if (hw->phy.multispeed_fiber)
-                hw->mac.ops.disable_tx_laser(hw);
-
         /* disable receive for all VFs and wait one second */
         if (adapter->num_vfs) {
                 /* ping all the active vfs to let them know we are going down */
@@ -3742,6 +3738,10 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
                                 (IXGBE_READ_REG(hw, IXGBE_DMATXCTL) &
                                  ~IXGBE_DMATXCTL_TE));
 
+        /* power down the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.disable_tx_laser(hw);
+
         /* clear n-tuple filters that are cached */
         ethtool_ntuple_flush(netdev);
 
@@ -4001,7 +4001,7 @@ static void ixgbe_set_num_queues(struct ixgbe_adapter *adapter)
 
 done:
         /* Notify the stack of the (possibly) reduced Tx Queue count. */
-        adapter->netdev->real_num_tx_queues = adapter->num_tx_queues;
+        netif_set_real_num_tx_queues(adapter->netdev, adapter->num_tx_queues);
 }
 
 static void ixgbe_acquire_msix_vectors(struct ixgbe_adapter *adapter,
@@ -5195,7 +5195,6 @@ static int __ixgbe_shutdown(struct pci_dev *pdev, bool *enable_wake)
                 ixgbe_free_all_tx_resources(adapter);
                 ixgbe_free_all_rx_resources(adapter);
         }
-        ixgbe_clear_interrupt_scheme(adapter);
 
 #ifdef CONFIG_PM
         retval = pci_save_state(pdev);
@@ -5230,6 +5229,8 @@ static int __ixgbe_shutdown(struct pci_dev *pdev, bool *enable_wake)
 
         *enable_wake = !!wufc;
 
+        ixgbe_clear_interrupt_scheme(adapter);
+
         ixgbe_release_hw_control(adapter);
 
         pci_disable_device(pdev);
@@ -6023,7 +6024,6 @@ static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
 static void ixgbe_atr(struct ixgbe_adapter *adapter, struct sk_buff *skb,
                       int queue, u32 tx_flags)
 {
-        /* Right now, we support IPv4 only */
         struct ixgbe_atr_input atr_input;
         struct tcphdr *th;
         struct iphdr *iph = ip_hdr(skb);
@@ -6032,6 +6032,9 @@ static void ixgbe_atr(struct ixgbe_adapter *adapter, struct sk_buff *skb,
         u32 src_ipv4_addr, dst_ipv4_addr;
         u8 l4type = 0;
 
+        /* Right now, we support IPv4 only */
+        if (skb->protocol != htons(ETH_P_IP))
+                return;
         /* check if we're UDP or TCP */
         if (iph->protocol == IPPROTO_TCP) {
                 th = tcp_hdr(skb);
diff --git a/drivers/net/ll_temac_main.c b/drivers/net/ll_temac_main.c
index 52dcc8495647..6474c4973d3a 100644
--- a/drivers/net/ll_temac_main.c
+++ b/drivers/net/ll_temac_main.c
@@ -964,7 +964,7 @@ temac_of_probe(struct of_device *op, const struct of_device_id *match)
         np = of_parse_phandle(op->dev.of_node, "llink-connected", 0);
         if (!np) {
                 dev_err(&op->dev, "could not find DMA node\n");
-                goto nodev;
+                goto err_iounmap;
         }
 
         /* Setup the DMA register accesses, could be DCR or memory mapped */
@@ -978,7 +978,7 @@ temac_of_probe(struct of_device *op, const struct of_device_id *match)
                         dev_dbg(&op->dev, "MEM base: %p\n", lp->sdma_regs);
                 } else {
                         dev_err(&op->dev, "unable to map DMA registers\n");
-                        goto nodev;
+                        goto err_iounmap;
                 }
         }
 
@@ -987,7 +987,7 @@ temac_of_probe(struct of_device *op, const struct of_device_id *match)
         if ((lp->rx_irq == NO_IRQ) || (lp->tx_irq == NO_IRQ)) {
                 dev_err(&op->dev, "could not determine irqs\n");
                 rc = -ENOMEM;
-                goto nodev;
+                goto err_iounmap_2;
         }
 
         of_node_put(np); /* Finished with the DMA node; drop the reference */
@@ -997,7 +997,7 @@ temac_of_probe(struct of_device *op, const struct of_device_id *match)
         if ((!addr) || (size != 6)) {
                 dev_err(&op->dev, "could not find MAC address\n");
                 rc = -ENODEV;
-                goto nodev;
+                goto err_iounmap_2;
         }
         temac_set_mac_address(ndev, (void *)addr);
 
@@ -1013,7 +1013,7 @@ temac_of_probe(struct of_device *op, const struct of_device_id *match)
         rc = sysfs_create_group(&lp->dev->kobj, &temac_attr_group);
         if (rc) {
                 dev_err(lp->dev, "Error creating sysfs files\n");
-                goto nodev;
+                goto err_iounmap_2;
         }
 
         rc = register_netdev(lp->ndev);
@@ -1026,6 +1026,11 @@ temac_of_probe(struct of_device *op, const struct of_device_id *match)
 
  err_register_ndev:
         sysfs_remove_group(&lp->dev->kobj, &temac_attr_group);
+ err_iounmap_2:
+        if (lp->sdma_regs)
+                iounmap(lp->sdma_regs);
+ err_iounmap:
+        iounmap(lp->regs);
  nodev:
         free_netdev(ndev);
         ndev = NULL;
@@ -1044,6 +1049,9 @@ static int __devexit temac_of_remove(struct of_device *op)
                 of_node_put(lp->phy_node);
         lp->phy_node = NULL;
         dev_set_drvdata(&op->dev, NULL);
+        iounmap(lp->regs);
+        if (lp->sdma_regs)
+                iounmap(lp->sdma_regs);
         free_netdev(ndev);
         return 0;
 }
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index e345ec8cb473..73bb8ea6f54a 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -289,6 +289,7 @@ struct mv643xx_eth_shared_private {
         unsigned int t_clk;
         int extended_rx_coal_limit;
         int tx_bw_control;
+        int tx_csum_limit;
 };
 
 #define TX_BW_CONTROL_ABSENT            0
@@ -776,13 +777,16 @@ static int txq_submit_skb(struct tx_queue *txq, struct sk_buff *skb)
         l4i_chk = 0;
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                int hdr_len;
                 int tag_bytes;
 
                 BUG_ON(skb->protocol != htons(ETH_P_IP) &&
                        skb->protocol != htons(ETH_P_8021Q));
 
-                tag_bytes = (void *)ip_hdr(skb) - (void *)skb->data - ETH_HLEN;
-                if (unlikely(tag_bytes & ~12)) {
+                hdr_len = (void *)ip_hdr(skb) - (void *)skb->data;
+                tag_bytes = hdr_len - ETH_HLEN;
+                if (skb->len - hdr_len > mp->shared->tx_csum_limit ||
+                    unlikely(tag_bytes & ~12)) {
                         if (skb_checksum_help(skb) == 0)
                                 goto no_csum;
                         kfree_skb(skb);
@@ -2666,6 +2670,7 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev)
          * Detect hardware parameters.
          */
         msp->t_clk = (pd != NULL && pd->t_clk != 0) ? pd->t_clk : 133000000;
+        msp->tx_csum_limit = pd->tx_csum_limit ? pd->tx_csum_limit : 9 * 1024;
         infer_hw_params(msp);
 
         platform_set_drvdata(pdev, msp);
diff --git a/drivers/net/ne.c b/drivers/net/ne.c
index b8e2923a1d69..1063093b3afc 100644
--- a/drivers/net/ne.c
+++ b/drivers/net/ne.c
@@ -806,8 +806,10 @@ static int __init ne_drv_probe(struct platform_device *pdev)
                 dev->base_addr = res->start;
                 dev->irq = platform_get_irq(pdev, 0);
         } else {
-                if (this_dev < 0 || this_dev >= MAX_NE_CARDS)
+                if (this_dev < 0 || this_dev >= MAX_NE_CARDS) {
+                        free_netdev(dev);
                         return -EINVAL;
+                }
                 dev->base_addr = io[this_dev];
                 dev->irq = irq[this_dev];
                 dev->mem_end = bad[this_dev];
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index fa4b24c49f42..d10bcefc0e45 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -4611,8 +4611,7 @@ static void ql_timer(unsigned long data)
                 return;
         }
 
-        qdev->timer.expires = jiffies + (5*HZ);
-        add_timer(&qdev->timer);
+        mod_timer(&qdev->timer, jiffies + (5*HZ));
 }
 
 static int __devinit qlge_probe(struct pci_dev *pdev,
@@ -4713,6 +4712,8 @@ static void ql_eeh_close(struct net_device *ndev)
                 netif_stop_queue(ndev);
         }
 
+        /* Disabling the timer */
+        del_timer_sync(&qdev->timer);
         if (test_bit(QL_ADAPTER_UP, &qdev->flags))
                 cancel_delayed_work_sync(&qdev->asic_reset_work);
         cancel_delayed_work_sync(&qdev->mpi_reset_work);
@@ -4808,8 +4809,7 @@ static void qlge_io_resume(struct pci_dev *pdev)
                 netif_err(qdev, ifup, qdev->ndev,
                           "Device was not running prior to EEH.\n");
         }
-        qdev->timer.expires = jiffies + (5*HZ);
-        add_timer(&qdev->timer);
+        mod_timer(&qdev->timer, jiffies + (5*HZ));
         netif_device_attach(ndev);
 }
 
@@ -4871,8 +4871,7 @@ static int qlge_resume(struct pci_dev *pdev)
                         return err;
         }
 
-        qdev->timer.expires = jiffies + (5*HZ);
-        add_timer(&qdev->timer);
+        mod_timer(&qdev->timer, jiffies + (5*HZ));
         netif_device_attach(ndev);
 
         return 0;
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 668327ccd8d0..1d37f0c310ca 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -3130,7 +3130,6 @@ static void tx_intr_handler(struct fifo_info *fifo_data)
                 pkt_cnt++;
 
                 /* Updating the statistics block */
-                nic->dev->stats.tx_bytes += skb->len;
                 swstats->mem_freed += skb->truesize;
                 dev_kfree_skb_irq(skb);
 
@@ -4901,48 +4900,81 @@ static void s2io_updt_stats(struct s2io_nic *sp)
  *  Return value:
  *  pointer to the updated net_device_stats structure.
  */
-
 static struct net_device_stats *s2io_get_stats(struct net_device *dev)
 {
         struct s2io_nic *sp = netdev_priv(dev);
-        struct config_param *config = &sp->config;
         struct mac_info *mac_control = &sp->mac_control;
         struct stat_block *stats = mac_control->stats_info;
-        int i;
+        u64 delta;
 
         /* Configure Stats for immediate updt */
         s2io_updt_stats(sp);
 
-        /* Using sp->stats as a staging area, because reset (due to mtu
-           change, for example) will clear some hardware counters */
-        dev->stats.tx_packets += le32_to_cpu(stats->tmac_frms) -
-                sp->stats.tx_packets;
-        sp->stats.tx_packets = le32_to_cpu(stats->tmac_frms);
-
-        dev->stats.tx_errors += le32_to_cpu(stats->tmac_any_err_frms) -
-                sp->stats.tx_errors;
-        sp->stats.tx_errors = le32_to_cpu(stats->tmac_any_err_frms);
-
-        dev->stats.rx_errors += le64_to_cpu(stats->rmac_drop_frms) -
-                sp->stats.rx_errors;
-        sp->stats.rx_errors = le64_to_cpu(stats->rmac_drop_frms);
-
-        dev->stats.multicast = le32_to_cpu(stats->rmac_vld_mcst_frms) -
-                sp->stats.multicast;
-        sp->stats.multicast = le32_to_cpu(stats->rmac_vld_mcst_frms);
-
-        dev->stats.rx_length_errors = le64_to_cpu(stats->rmac_long_frms) -
-                sp->stats.rx_length_errors;
-        sp->stats.rx_length_errors = le64_to_cpu(stats->rmac_long_frms);
+        /* A device reset will cause the on-adapter statistics to be zero'ed.
+         * This can be done while running by changing the MTU.  To prevent the
+         * system from having the stats zero'ed, the driver keeps a copy of the
+         * last update to the system (which is also zero'ed on reset).  This
+         * enables the driver to accurately know the delta between the last
+         * update and the current update.
+         */
+        delta = ((u64) le32_to_cpu(stats->rmac_vld_frms_oflow) << 32 |
+                le32_to_cpu(stats->rmac_vld_frms)) - sp->stats.rx_packets;
+        sp->stats.rx_packets += delta;
+        dev->stats.rx_packets += delta;
+
+        delta = ((u64) le32_to_cpu(stats->tmac_frms_oflow) << 32 |
+                le32_to_cpu(stats->tmac_frms)) - sp->stats.tx_packets;
+        sp->stats.tx_packets += delta;
+        dev->stats.tx_packets += delta;
+
+        delta = ((u64) le32_to_cpu(stats->rmac_data_octets_oflow) << 32 |
+                le32_to_cpu(stats->rmac_data_octets)) - sp->stats.rx_bytes;
+        sp->stats.rx_bytes += delta;
+        dev->stats.rx_bytes += delta;
+
+        delta = ((u64) le32_to_cpu(stats->tmac_data_octets_oflow) << 32 |
+                le32_to_cpu(stats->tmac_data_octets)) - sp->stats.tx_bytes;
+        sp->stats.tx_bytes += delta;
+        dev->stats.tx_bytes += delta;
+
+        delta = le64_to_cpu(stats->rmac_drop_frms) - sp->stats.rx_errors;
+        sp->stats.rx_errors += delta;
+        dev->stats.rx_errors += delta;
+
+        delta = ((u64) le32_to_cpu(stats->tmac_any_err_frms_oflow) << 32 |
+                le32_to_cpu(stats->tmac_any_err_frms)) - sp->stats.tx_errors;
+        sp->stats.tx_errors += delta;
+        dev->stats.tx_errors += delta;
+
+        delta = le64_to_cpu(stats->rmac_drop_frms) - sp->stats.rx_dropped;
+        sp->stats.rx_dropped += delta;
+        dev->stats.rx_dropped += delta;
+
+        delta = le64_to_cpu(stats->tmac_drop_frms) - sp->stats.tx_dropped;
+        sp->stats.tx_dropped += delta;
+        dev->stats.tx_dropped += delta;
+
+        /* The adapter MAC interprets pause frames as multicast packets, but
+         * does not pass them up.  This erroneously increases the multicast
+         * packet count and needs to be deducted when the multicast frame count
+         * is queried.
+         */
+        delta = (u64) le32_to_cpu(stats->rmac_vld_mcst_frms_oflow) << 32 |
+                le32_to_cpu(stats->rmac_vld_mcst_frms);
+        delta -= le64_to_cpu(stats->rmac_pause_ctrl_frms);
+        delta -= sp->stats.multicast;
+        sp->stats.multicast += delta;
+        dev->stats.multicast += delta;
 
-        /* collect per-ring rx_packets and rx_bytes */
-        dev->stats.rx_packets = dev->stats.rx_bytes = 0;
-        for (i = 0; i < config->rx_ring_num; i++) {
-                struct ring_info *ring = &mac_control->rings[i];
+        delta = ((u64) le32_to_cpu(stats->rmac_usized_frms_oflow) << 32 |
+                le32_to_cpu(stats->rmac_usized_frms)) +
+                le64_to_cpu(stats->rmac_long_frms) - sp->stats.rx_length_errors;
+        sp->stats.rx_length_errors += delta;
+        dev->stats.rx_length_errors += delta;
 
-                dev->stats.rx_packets += ring->rx_packets;
-                dev->stats.rx_bytes += ring->rx_bytes;
-        }
+        delta = le64_to_cpu(stats->rmac_fcs_err_frms) - sp->stats.rx_crc_errors;
+        sp->stats.rx_crc_errors += delta;
+        dev->stats.rx_crc_errors += delta;
 
         return &dev->stats;
 }
@@ -7455,15 +7487,11 @@ static int rx_osm_handler(struct ring_info *ring_data, struct RxD_t * rxdp)
                 }
         }
 
-        /* Updating statistics */
-        ring_data->rx_packets++;
         rxdp->Host_Control = 0;
         if (sp->rxd_mode == RXD_MODE_1) {
                 int len = RXD_GET_BUFFER0_SIZE_1(rxdp->Control_2);
 
-                ring_data->rx_bytes += len;
                 skb_put(skb, len);
-
         } else if (sp->rxd_mode == RXD_MODE_3B) {
                 int get_block = ring_data->rx_curr_get_info.block_index;
                 int get_off = ring_data->rx_curr_get_info.offset;
@@ -7472,7 +7500,6 @@ static int rx_osm_handler(struct ring_info *ring_data, struct RxD_t * rxdp)
                 unsigned char *buff = skb_push(skb, buf0_len);
 
                 struct buffAdd *ba = &ring_data->ba[get_block][get_off];
-                ring_data->rx_bytes += buf0_len + buf2_len;
                 memcpy(buff, ba->ba_0, buf0_len);
                 skb_put(skb, buf2_len);
         }
diff --git a/drivers/net/s2io.h b/drivers/net/s2io.h
index 47c36e0994f5..5e52c75892df 100644
--- a/drivers/net/s2io.h
+++ b/drivers/net/s2io.h
@@ -745,10 +745,6 @@ struct ring_info {
 
         /* Buffer Address store. */
         struct buffAdd **ba;
-
-        /* per-Ring statistics */
-        unsigned long rx_packets;
-        unsigned long rx_bytes;
 } ____cacheline_aligned;
 
 /* Fifo specific structure */
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index 1f3acc3a5dfd..79eee3062083 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -2671,6 +2671,7 @@ static struct platform_driver sbmac_driver = {
         .remove = __exit_p(sbmac_remove),
         .driver = {
                 .name = sbmac_string,
+                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index 28d3ee175e7b..dd8a4adf48ca 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -104,10 +104,8 @@ static void rndis_msg_indicate(struct usbnet *dev, struct rndis_indicate *msg,
 int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen)
 {
         struct cdc_state        *info = (void *) &dev->data;
-        struct usb_cdc_notification notification;
         int                     master_ifnum;
         int                     retval;
-        int                     partial;
         unsigned                count;
         __le32                  rsp;
         u32                     xid = 0, msg_len, request_id;
@@ -135,17 +133,13 @@ int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen)
         if (unlikely(retval < 0 || xid == 0))
                 return retval;
 
-        /* Some devices don't respond on the control channel until
-         * polled on the status channel, so do that first. */
-        retval = usb_interrupt_msg(
-                dev->udev,
-                usb_rcvintpipe(dev->udev, dev->status->desc.bEndpointAddress),
-                &notification, sizeof(notification), &partial,
-                RNDIS_CONTROL_TIMEOUT_MS);
-        if (unlikely(retval < 0))
-                return retval;
+        // FIXME Seems like some devices discard responses when
+        // we time out and cancel our "get response" requests...
+        // so, this is fragile.  Probably need to poll for status.
 
-        /* Poll the control channel; the request probably completed immediately */
+        /* ignore status endpoint, just poll the control channel;
+         * the request probably completed immediately
+         */
         rsp = buf->msg_type | RNDIS_MSG_COMPLETION;
         for (count = 0; count < 10; count++) {
                 memset(buf, 0, CONTROL_BUFFER_SIZE);
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index a95c73de5824..81c76ada8e56 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1293,6 +1293,9 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
                 goto out;
         }
 
+        /* netdev_printk() needs this so do it as early as possible */
+        SET_NETDEV_DEV(net, &udev->dev);
+
         dev = netdev_priv(net);
         dev->udev = xdev;
         dev->intf = udev;
@@ -1377,8 +1380,6 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
                 dev->rx_urb_size = dev->hard_mtu;
         dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
 
-        SET_NETDEV_DEV(net, &udev->dev);
-
         if ((dev->driver_info->flags & FLAG_WLAN) != 0)
                 SET_NETDEV_DEVTYPE(net, &wlan_type);
         if ((dev->driver_info->flags & FLAG_WWAN) != 0)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 1edb7a61983c..bb6b67f6b0cc 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -415,7 +415,7 @@ static int add_recvbuf_mergeable(struct virtnet_info *vi, gfp_t gfp)
 static bool try_fill_recv(struct virtnet_info *vi, gfp_t gfp)
 {
         int err;
-        bool oom = false;
+        bool oom;
 
         do {
                 if (vi->mergeable_rx_bufs)
@@ -425,10 +425,9 @@ static bool try_fill_recv(struct virtnet_info *vi, gfp_t gfp)
                 else
                         err = add_recvbuf_small(vi, gfp);
 
-                if (err < 0) {
-                        oom = true;
+                oom = err == -ENOMEM;
+                if (err < 0)
                         break;
-                }
                 ++vi->num;
         } while (err > 0);
         if (unlikely(vi->num > vi->max))
@@ -563,7 +562,6 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct virtnet_info *vi = netdev_priv(dev);
         int capacity;
 
-again:
         /* Free up any pending old buffers before queueing new ones. */
         free_old_xmit_skbs(vi);
 
@@ -572,14 +570,20 @@ again:
 
         /* This can happen with OOM and indirect buffers. */
         if (unlikely(capacity < 0)) {
-                netif_stop_queue(dev);
-                dev_warn(&dev->dev, "Unexpected full queue\n");
-                if (unlikely(!virtqueue_enable_cb(vi->svq))) {
-                        virtqueue_disable_cb(vi->svq);
-                        netif_start_queue(dev);
-                        goto again;
+                if (net_ratelimit()) {
+                        if (likely(capacity == -ENOMEM)) {
+                                dev_warn(&dev->dev,
+                                         "TX queue failure: out of memory\n");
+                        } else {
+                                dev->stats.tx_fifo_errors++;
+                                dev_warn(&dev->dev,
+                                         "Unexpected TX queue failure: %d\n",
+                                         capacity);
+                        }
                 }
-                return NETDEV_TX_BUSY;
+                dev->stats.tx_dropped++;
+                kfree_skb(skb);
+                return NETDEV_TX_OK;
         }
         virtqueue_kick(vi->svq);
 
diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
index d14e207de1df..fc8b2d7a0919 100644
--- a/drivers/net/vxge/vxge-main.c
+++ b/drivers/net/vxge/vxge-main.c
@@ -4517,9 +4517,9 @@ vxge_starter(void)
         char version[32];
         snprintf(version, 32, "%s", DRV_VERSION);
 
-        printk(KERN_CRIT "%s: Copyright(c) 2002-2009 Neterion Inc\n",
+        printk(KERN_INFO "%s: Copyright(c) 2002-2009 Neterion Inc\n",
                 VXGE_DRIVER_NAME);
-        printk(KERN_CRIT "%s: Driver version: %s\n",
+        printk(KERN_INFO "%s: Driver version: %s\n",
                         VXGE_DRIVER_NAME, version);
 
         verify_bandwidth();
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index fbb7dec6ddeb..5ea87736a6ae 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -445,6 +445,7 @@ void ath_deinit_leds(struct ath_softc *sc);
 #define SC_OP_TSF_RESET              BIT(11)
 #define SC_OP_BT_PRIORITY_DETECTED   BIT(12)
 #define SC_OP_BT_SCAN                BIT(13)
+#define SC_OP_ANI_RUN                BIT(14)
 
 /* Powersave flags */
 #define PS_WAIT_FOR_BEACON        BIT(0)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index abfa0493236f..1e2a68ea9355 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -336,6 +336,10 @@ set_timer:
 static void ath_start_ani(struct ath_common *common)
 {
         unsigned long timestamp = jiffies_to_msecs(jiffies);
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
+
+        if (!(sc->sc_flags & SC_OP_ANI_RUN))
+                return;
 
         common->ani.longcal_timer = timestamp;
         common->ani.shortcal_timer = timestamp;
@@ -872,11 +876,13 @@ static void ath9k_bss_assoc_info(struct ath_softc *sc,
                 /* Reset rssi stats */
                 sc->sc_ah->stats.avgbrssi = ATH_RSSI_DUMMY_MARKER;
 
+                sc->sc_flags |= SC_OP_ANI_RUN;
                 ath_start_ani(common);
         } else {
                 ath_print(common, ATH_DBG_CONFIG, "Bss Info DISASSOC\n");
                 common->curaid = 0;
                 /* Stop ANI */
+                sc->sc_flags &= ~SC_OP_ANI_RUN;
                 del_timer_sync(&common->ani.timer);
         }
 }
@@ -1478,8 +1484,10 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
 
         if (vif->type == NL80211_IFTYPE_AP    ||
             vif->type == NL80211_IFTYPE_ADHOC ||
-            vif->type == NL80211_IFTYPE_MONITOR)
+            vif->type == NL80211_IFTYPE_MONITOR) {
+                sc->sc_flags |= SC_OP_ANI_RUN;
                 ath_start_ani(common);
+        }
 
 out:
         mutex_unlock(&sc->mutex);
@@ -1500,6 +1508,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
         mutex_lock(&sc->mutex);
 
         /* Stop ANI */
+        sc->sc_flags &= ~SC_OP_ANI_RUN;
         del_timer_sync(&common->ani.timer);
 
         /* Reclaim beacon resources */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
index 44ef5d93befc..01658cf82d39 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
@@ -212,11 +212,7 @@ static void iwlagn_chain_noise_reset(struct iwl_priv *priv)
 static void iwlagn_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
                         __le32 *tx_flags)
 {
-        if ((info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
-            (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
-                *tx_flags |= TX_CMD_FLG_RTS_CTS_MSK;
-        else
-                *tx_flags &= ~TX_CMD_FLG_RTS_CTS_MSK;
+        *tx_flags |= TX_CMD_FLG_RTS_CTS_MSK;
 }
 
 /* Calc max signal level (dBm) among 3 possible receivers */
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 426e95567de3..5bbc5298ef96 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1314,7 +1314,6 @@ void iwl_configure_filter(struct ieee80211_hw *hw,
                         changed_flags, *total_flags);
 
         CHK(FIF_OTHER_BSS | FIF_PROMISC_IN_BSS, RXON_FILTER_PROMISC_MSK);
-        CHK(FIF_ALLMULTI, RXON_FILTER_ACCEPT_GRP_MSK);
         CHK(FIF_CONTROL, RXON_FILTER_CTL2HOST_MSK);
         CHK(FIF_BCN_PRBRESP_PROMISC, RXON_FILTER_BCON_AWARE_MSK);
 
@@ -1329,6 +1328,12 @@ void iwl_configure_filter(struct ieee80211_hw *hw,
 
         mutex_unlock(&priv->mutex);
 
+        /*
+         * Receiving all multicast frames is always enabled by the
+         * default flags setup in iwl_connection_init_rx_config()
+         * since we currently do not support programming multicast
+         * filters into the device.
+         */
         *total_flags &= FIF_OTHER_BSS | FIF_ALLMULTI | FIF_PROMISC_IN_BSS |
                         FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
 }
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 9fc339845538..eac961463be2 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -1356,6 +1356,7 @@ static int __devinit pcmcia_bus_add_socket(struct device *dev,
         INIT_LIST_HEAD(&socket->devices_list);
         memset(&socket->pcmcia_state, 0, sizeof(u8));
         socket->device_count = 0;
+        atomic_set(&socket->present, 0);
 
         ret = pccard_register_pcmcia(socket, &pcmcia_bus_callback);
         if (ret) {
@@ -1364,8 +1365,6 @@ static int __devinit pcmcia_bus_add_socket(struct device *dev,
                 return ret;
         }
 
-        atomic_set(&socket->present, 0);
-
         return 0;
 }
 
diff --git a/drivers/power/z2_battery.c b/drivers/power/z2_battery.c
index 9cca465436e3..85064a9f649e 100644
--- a/drivers/power/z2_battery.c
+++ b/drivers/power/z2_battery.c
@@ -9,19 +9,13 @@
  *
  */
 
-#include <linux/init.h>
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/power_supply.h>
-#include <linux/i2c.h>
-#include <linux/spinlock.h>
-#include <linux/interrupt.h>
 #include <linux/gpio.h>
+#include <linux/i2c.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
-#include <asm/irq.h>
-#include <asm/mach/irq.h>
+#include <linux/power_supply.h>
+#include <linux/slab.h>
 #include <linux/z2_battery.h>
 
 #define Z2_DEFAULT_NAME "Z2"
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index de033b7ac21f..d827ce570a8c 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -777,7 +777,7 @@ static int __devinit ds1307_probe(struct i2c_client *client,
 
 read_rtc:
         /* read RTC registers */
-        tmp = ds1307->read_block_data(ds1307->client, 0, 8, buf);
+        tmp = ds1307->read_block_data(ds1307->client, ds1307->offset, 8, buf);
         if (tmp != 8) {
                 pr_debug("read error %d\n", tmp);
                 err = -EIO;
@@ -862,7 +862,7 @@ read_rtc:
                 if (ds1307->regs[DS1307_REG_HOUR] & DS1307_BIT_PM)
                         tmp += 12;
                 i2c_smbus_write_byte_data(client,
-                                DS1307_REG_HOUR,
+                                ds1307->offset + DS1307_REG_HOUR,
                                 bin2bcd(tmp));
         }
 
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index 9eb62a256e9a..cd6cf575902e 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -930,6 +930,83 @@ static void cpm_uart_config_port(struct uart_port *port, int flags)
         }
 }
 
+#if defined(CONFIG_CONSOLE_POLL) || defined(CONFIG_SERIAL_CPM_CONSOLE)
+/*
+ * Write a string to the serial port
+ * Note that this is called with interrupts already disabled
+ */
+static void cpm_uart_early_write(struct uart_cpm_port *pinfo,
+                const char *string, u_int count)
+{
+        unsigned int i;
+        cbd_t __iomem *bdp, *bdbase;
+        unsigned char *cpm_outp_addr;
+
+        /* Get the address of the host memory buffer.
+         */
+        bdp = pinfo->tx_cur;
+        bdbase = pinfo->tx_bd_base;
+
+        /*
+         * Now, do each character.  This is not as bad as it looks
+         * since this is a holding FIFO and not a transmitting FIFO.
+         * We could add the complexity of filling the entire transmit
+         * buffer, but we would just wait longer between accesses......
+         */
+        for (i = 0; i < count; i++, string++) {
+                /* Wait for transmitter fifo to empty.
+                 * Ready indicates output is ready, and xmt is doing
+                 * that, not that it is ready for us to send.
+                 */
+                while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+                        ;
+
+                /* Send the character out.
+                 * If the buffer address is in the CPM DPRAM, don't
+                 * convert it.
+                 */
+                cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr),
+                                        pinfo);
+                *cpm_outp_addr = *string;
+
+                out_be16(&bdp->cbd_datlen, 1);
+                setbits16(&bdp->cbd_sc, BD_SC_READY);
+
+                if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
+                        bdp = bdbase;
+                else
+                        bdp++;
+
+                /* if a LF, also do CR... */
+                if (*string == 10) {
+                        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+                                ;
+
+                        cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr),
+                                                pinfo);
+                        *cpm_outp_addr = 13;
+
+                        out_be16(&bdp->cbd_datlen, 1);
+                        setbits16(&bdp->cbd_sc, BD_SC_READY);
+
+                        if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
+                                bdp = bdbase;
+                        else
+                                bdp++;
+                }
+        }
+
+        /*
+         * Finally, Wait for transmitter & holding register to empty
+         *  and restore the IER
+         */
+        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+                ;
+
+        pinfo->tx_cur = bdp;
+}
+#endif
+
 #ifdef CONFIG_CONSOLE_POLL
 /* Serial polling routines for writing and reading from the uart while
  * in an interrupt or debug context.
@@ -999,7 +1076,7 @@ static void cpm_put_poll_char(struct uart_port *port,
         static char ch[2];
 
         ch[0] = (char)c;
-        cpm_uart_early_write(pinfo->port.line, ch, 1);
+        cpm_uart_early_write(pinfo, ch, 1);
 }
 #endif /* CONFIG_CONSOLE_POLL */
 
@@ -1130,9 +1207,6 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                                    u_int count)
 {
         struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index];
-        unsigned int i;
-        cbd_t __iomem *bdp, *bdbase;
-        unsigned char *cp;
         unsigned long flags;
         int nolock = oops_in_progress;
 
@@ -1142,66 +1216,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                 spin_lock_irqsave(&pinfo->port.lock, flags);
         }
 
-        /* Get the address of the host memory buffer.
-         */
-        bdp = pinfo->tx_cur;
-        bdbase = pinfo->tx_bd_base;
-
-        /*
-         * Now, do each character.  This is not as bad as it looks
-         * since this is a holding FIFO and not a transmitting FIFO.
-         * We could add the complexity of filling the entire transmit
-         * buffer, but we would just wait longer between accesses......
-         */
-        for (i = 0; i < count; i++, s++) {
-                /* Wait for transmitter fifo to empty.
-                 * Ready indicates output is ready, and xmt is doing
-                 * that, not that it is ready for us to send.
-                 */
-                while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
-                        ;
-
-                /* Send the character out.
-                 * If the buffer address is in the CPM DPRAM, don't
-                 * convert it.
-                 */
-                cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo);
-                *cp = *s;
-
-                out_be16(&bdp->cbd_datlen, 1);
-                setbits16(&bdp->cbd_sc, BD_SC_READY);
-
-                if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
-                        bdp = bdbase;
-                else
-                        bdp++;
-
-                /* if a LF, also do CR... */
-                if (*s == 10) {
-                        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
-                                ;
-
-                        cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo);
-                        *cp = 13;
-
-                        out_be16(&bdp->cbd_datlen, 1);
-                        setbits16(&bdp->cbd_sc, BD_SC_READY);
-
-                        if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
-                                bdp = bdbase;
-                        else
-                                bdp++;
-                }
-        }
-
-        /*
-         * Finally, Wait for transmitter & holding register to empty
-         *  and restore the IER
-         */
-        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
-                ;
-
-        pinfo->tx_cur = bdp;
+        cpm_uart_early_write(pinfo, s, count);
 
         if (unlikely(nolock)) {
                 local_irq_restore(flags);
diff --git a/drivers/staging/batman-adv/bat_sysfs.c b/drivers/staging/batman-adv/bat_sysfs.c
index e2c000b80ca0..212bc21e6d68 100644
--- a/drivers/staging/batman-adv/bat_sysfs.c
+++ b/drivers/staging/batman-adv/bat_sysfs.c
@@ -225,9 +225,9 @@ static struct bat_attribute *mesh_attrs[] = {
         NULL,
 };
 
-static ssize_t transtable_local_read(struct kobject *kobj,
-                               struct bin_attribute *bin_attr,
-                               char *buff, loff_t off, size_t count)
+static ssize_t transtable_local_read(struct file *filp, struct kobject *kobj,
+                                  struct bin_attribute *bin_attr,
+                                  char *buff, loff_t off, size_t count)
 {
         struct device *dev = to_dev(kobj->parent);
         struct net_device *net_dev = to_net_dev(dev);
@@ -235,9 +235,9 @@ static ssize_t transtable_local_read(struct kobject *kobj,
         return hna_local_fill_buffer_text(net_dev, buff, count, off);
 }
 
-static ssize_t transtable_global_read(struct kobject *kobj,
-                               struct bin_attribute *bin_attr,
-                               char *buff, loff_t off, size_t count)
+static ssize_t transtable_global_read(struct file *filp, struct kobject *kobj,
+                                  struct bin_attribute *bin_attr,
+                                  char *buff, loff_t off, size_t count)
 {
         struct device *dev = to_dev(kobj->parent);
         struct net_device *net_dev = to_net_dev(dev);
@@ -245,9 +245,9 @@ static ssize_t transtable_global_read(struct kobject *kobj,
         return hna_global_fill_buffer_text(net_dev, buff, count, off);
 }
 
-static ssize_t originators_read(struct kobject *kobj,
-                               struct bin_attribute *bin_attr,
-                               char *buff, loff_t off, size_t count)
+static ssize_t originators_read(struct file *filp, struct kobject *kobj,
+                                  struct bin_attribute *bin_attr,
+                                  char *buff, loff_t off, size_t count)
 {
         struct device *dev = to_dev(kobj->parent);
         struct net_device *net_dev = to_net_dev(dev);
@@ -255,9 +255,9 @@ static ssize_t originators_read(struct kobject *kobj,
         return orig_fill_buffer_text(net_dev, buff, count, off);
 }
 
-static ssize_t vis_data_read(struct kobject *kobj,
-                             struct bin_attribute *bin_attr,
-                             char *buff, loff_t off, size_t count)
+static ssize_t vis_data_read(struct file *filp, struct kobject *kobj,
+                                  struct bin_attribute *bin_attr,
+                                  char *buff, loff_t off, size_t count)
 {
         struct device *dev = to_dev(kobj->parent);
         struct net_device *net_dev = to_net_dev(dev);
diff --git a/drivers/staging/batman-adv/device.c b/drivers/staging/batman-adv/device.c
index 7eb6559e0315..32204b5572d0 100644
--- a/drivers/staging/batman-adv/device.c
+++ b/drivers/staging/batman-adv/device.c
@@ -196,7 +196,7 @@ ssize_t bat_device_read(struct file *file, char __user *buf, size_t count,
         kfree(device_packet);
 
         if (error)
-                return error;
+                return -EFAULT;
 
         return sizeof(struct icmp_packet);
 }
diff --git a/drivers/staging/comedi/drivers/adl_pci9111.c b/drivers/staging/comedi/drivers/adl_pci9111.c
index 36a254cd4413..39d112b708e3 100644
--- a/drivers/staging/comedi/drivers/adl_pci9111.c
+++ b/drivers/staging/comedi/drivers/adl_pci9111.c
@@ -824,9 +824,12 @@ static int pci9111_ai_do_cmd(struct comedi_device *dev,
                 plx9050_interrupt_control(dev_private->lcr_io_base, true, true,
                                           false, true, true);
 
-                dev_private->scan_delay =
-                    (async_cmd->scan_begin_arg / (async_cmd->convert_arg *
-                                                  async_cmd->chanlist_len)) - 1;
+                if (async_cmd->scan_begin_src == TRIG_TIMER) {
+                        dev_private->scan_delay =
+                                (async_cmd->scan_begin_arg /
+                                 (async_cmd->convert_arg *
+                                  async_cmd->chanlist_len)) - 1;
+                }
 
                 break;
 
diff --git a/drivers/staging/comedi/drivers/cb_pcidda.c b/drivers/staging/comedi/drivers/cb_pcidda.c
index 81829d6fd287..c374bee25068 100644
--- a/drivers/staging/comedi/drivers/cb_pcidda.c
+++ b/drivers/staging/comedi/drivers/cb_pcidda.c
@@ -52,7 +52,6 @@ Please report success/failure with other different cards to
 #include "8255.h"
 
 #define PCI_VENDOR_ID_CB        0x1307  /*  PCI vendor number of ComputerBoards */
-#define N_BOARDS        10      /*  Number of boards in cb_pcidda_boards */
 #define EEPROM_SIZE     128     /*  number of entries in eeprom */
 #define MAX_AO_CHANNELS 8       /*  maximum number of ao channels for supported boards */
 
@@ -307,7 +306,7 @@ static int cb_pcidda_attach(struct comedi_device *dev,
                                         continue;
                                 }
                         }
-                        for (index = 0; index < N_BOARDS; index++) {
+                        for (index = 0; index < ARRAY_SIZE(cb_pcidda_boards); index++) {
                                 if (cb_pcidda_boards[index].device_id ==
                                     pcidev->device) {
                                         goto found;
diff --git a/drivers/staging/hv/channel_mgmt.c b/drivers/staging/hv/channel_mgmt.c
index 3f53b4d1e4cf..12db555a3a5d 100644
--- a/drivers/staging/hv/channel_mgmt.c
+++ b/drivers/staging/hv/channel_mgmt.c
@@ -23,6 +23,7 @@
 #include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/completion.h>
 #include "osd.h"
 #include "logging.h"
 #include "vmbus_private.h"
@@ -293,6 +294,25 @@ void FreeVmbusChannel(struct vmbus_channel *Channel)
                               Channel);
 }
 
+
+DECLARE_COMPLETION(hv_channel_ready);
+
+/*
+ * Count initialized channels, and ensure all channels are ready when hv_vmbus
+ * module loading completes.
+ */
+static void count_hv_channel(void)
+{
+        static int counter;
+        unsigned long flags;
+
+        spin_lock_irqsave(&gVmbusConnection.channel_lock, flags);
+        if (++counter == MAX_MSG_TYPES)
+                complete(&hv_channel_ready);
+        spin_unlock_irqrestore(&gVmbusConnection.channel_lock, flags);
+}
+
+
 /*
  * VmbusChannelProcessOffer - Process the offer by creating a channel/device
  * associated with this offer
@@ -373,22 +393,21 @@ static void VmbusChannelProcessOffer(void *context)
                  * can cleanup properly
                  */
                 newChannel->State = CHANNEL_OPEN_STATE;
-                cnt = 0;
 
-                while (cnt != MAX_MSG_TYPES) {
+                /* Open IC channels */
+                for (cnt = 0; cnt < MAX_MSG_TYPES; cnt++) {
                         if (memcmp(&newChannel->OfferMsg.Offer.InterfaceType,
                                    &hv_cb_utils[cnt].data,
-                                   sizeof(struct hv_guid)) == 0) {
+                                   sizeof(struct hv_guid)) == 0 &&
+                                VmbusChannelOpen(newChannel, 2 * PAGE_SIZE,
+                                                 2 * PAGE_SIZE, NULL, 0,
+                                                 hv_cb_utils[cnt].callback,
+                                                 newChannel) == 0) {
+                                hv_cb_utils[cnt].channel = newChannel;
                                 DPRINT_INFO(VMBUS, "%s",
-                                            hv_cb_utils[cnt].log_msg);
-
-                                if (VmbusChannelOpen(newChannel, 2 * PAGE_SIZE,
-                                                    2 * PAGE_SIZE, NULL, 0,
-                                                    hv_cb_utils[cnt].callback,
-                                                    newChannel) == 0)
-                                        hv_cb_utils[cnt].channel = newChannel;
+                                                hv_cb_utils[cnt].log_msg);
+                                count_hv_channel();
                         }
-                        cnt++;
                 }
         }
         DPRINT_EXIT(VMBUS);
diff --git a/drivers/staging/hv/hv_utils.c b/drivers/staging/hv/hv_utils.c
index 8a49aafea37a..2adc9b48ca9c 100644
--- a/drivers/staging/hv/hv_utils.c
+++ b/drivers/staging/hv/hv_utils.c
@@ -24,6 +24,8 @@
 #include <linux/slab.h>
 #include <linux/sysctl.h>
 #include <linux/reboot.h>
+#include <linux/dmi.h>
+#include <linux/pci.h>
 
 #include "logging.h"
 #include "osd.h"
@@ -251,10 +253,36 @@ static void heartbeat_onchannelcallback(void *context)
         DPRINT_EXIT(VMBUS);
 }
 
+static const struct pci_device_id __initconst
+hv_utils_pci_table[] __maybe_unused = {
+        { PCI_DEVICE(0x1414, 0x5353) }, /* Hyper-V emulated VGA controller */
+        { 0 }
+};
+MODULE_DEVICE_TABLE(pci, hv_utils_pci_table);
+
+
+static const struct dmi_system_id __initconst
+hv_utils_dmi_table[] __maybe_unused  = {
+        {
+                .ident = "Hyper-V",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Virtual Machine"),
+                        DMI_MATCH(DMI_BOARD_NAME, "Virtual Machine"),
+                },
+        },
+        { },
+};
+MODULE_DEVICE_TABLE(dmi, hv_utils_dmi_table);
+
+
 static int __init init_hyperv_utils(void)
 {
         printk(KERN_INFO "Registering HyperV Utility Driver\n");
 
+        if (!dmi_check_system(hv_utils_dmi_table))
+                return -ENODEV;
+
         hv_cb_utils[HV_SHUTDOWN_MSG].channel->OnChannelCallback =
                 &shutdown_onchannelcallback;
         hv_cb_utils[HV_SHUTDOWN_MSG].callback = &shutdown_onchannelcallback;
diff --git a/drivers/staging/hv/vmbus.h b/drivers/staging/hv/vmbus.h
index 0c6ee0f487f3..3c14b2926e00 100644
--- a/drivers/staging/hv/vmbus.h
+++ b/drivers/staging/hv/vmbus.h
@@ -74,4 +74,6 @@ int vmbus_child_driver_register(struct driver_context *driver_ctx);
 void vmbus_child_driver_unregister(struct driver_context *driver_ctx);
 void vmbus_get_interface(struct vmbus_channel_interface *interface);
 
+extern struct completion hv_channel_ready;
+
 #endif /* _VMBUS_H_ */
diff --git a/drivers/staging/hv/vmbus_drv.c b/drivers/staging/hv/vmbus_drv.c
index c21731a12ca7..22c80ece6388 100644
--- a/drivers/staging/hv/vmbus_drv.c
+++ b/drivers/staging/hv/vmbus_drv.c
@@ -27,6 +27,7 @@
 #include <linux/pci.h>
 #include <linux/dmi.h>
 #include <linux/slab.h>
+#include <linux/completion.h>
 #include "version_info.h"
 #include "osd.h"
 #include "logging.h"
@@ -356,6 +357,8 @@ static int vmbus_bus_init(int (*drv_init)(struct hv_driver *drv))
 
         vmbus_drv_obj->GetChannelOffers();
 
+        wait_for_completion(&hv_channel_ready);
+
 cleanup:
         DPRINT_EXIT(VMBUS_DRV);
 
diff --git a/drivers/staging/mrst-touchscreen/intel-mid-touch.c b/drivers/staging/mrst-touchscreen/intel-mid-touch.c
index 1db00975a594..abba22f921be 100644
--- a/drivers/staging/mrst-touchscreen/intel-mid-touch.c
+++ b/drivers/staging/mrst-touchscreen/intel-mid-touch.c
@@ -817,9 +817,9 @@ static int mrstouch_remove(struct spi_device *spi)
         free_irq(mrstouchdevp->irq, mrstouchdevp);
         input_unregister_device(mrstouchdevp->input);
         input_free_device(mrstouchdevp->input);
-        kfree(mrstouchdevp);
         if (mrstouchdevp->pendet_thrd)
                 kthread_stop(mrstouchdevp->pendet_thrd);
+        kfree(mrstouchdevp);
         return 0;
 }
 
diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
index b740662d095a..674769d2b59b 100644
--- a/drivers/staging/rt2860/usb_main_dev.c
+++ b/drivers/staging/rt2860/usb_main_dev.c
@@ -77,6 +77,7 @@ struct usb_device_id rtusb_usb_id[] = {
         {USB_DEVICE(0x083A, 0x7522)},   /* Arcadyan */
         {USB_DEVICE(0x0CDE, 0x0022)},   /* ZCOM */
         {USB_DEVICE(0x0586, 0x3416)},   /* Zyxel */
+        {USB_DEVICE(0x0586, 0x341a)},   /* Zyxel NWD-270N */
         {USB_DEVICE(0x0CDE, 0x0025)},   /* Zyxel */
         {USB_DEVICE(0x1740, 0x9701)},   /* EnGenius */
         {USB_DEVICE(0x1740, 0x9702)},   /* EnGenius */
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
index dacefea78113..49ab9fa9ffa7 100644
--- a/drivers/staging/rtl8187se/r8180_core.c
+++ b/drivers/staging/rtl8187se/r8180_core.c
@@ -66,8 +66,6 @@ static int hwseqnum = 0;
 static int hwwep = 0;
 static int channels = 0x3fff;
 
-#define eqMacAddr(a, b)         (((a)[0] == (b)[0] && (a)[1] == (b)[1] && (a)[2] == (b)[2] && (a)[3] == (b)[3] && (a)[4] == (b)[4] && (a)[5] == (b)[5]) ? 1 : 0)
-#define cpMacAddr(des, src)             ((des)[0] = (src)[0], (des)[1] = (src)[1], (des)[2] = (src)[2], (des)[3] = (src)[3], (des)[4] = (src)[4], (des)[5] = (src)[5])
 MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(pci, rtl8180_pci_id_tbl);
 MODULE_AUTHOR("Andrea Merello <andreamrl@tiscali.it>");
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index 447d6474a70c..1b6890611fb6 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -112,28 +112,29 @@ u32 rt_global_debug_component = \
 #define CAM_CONTENT_COUNT 8
 
 static const struct usb_device_id rtl8192_usb_id_tbl[] = {
-        /* Realtek */
-        {USB_DEVICE(0x0bda, 0x8171)},
-        {USB_DEVICE(0x0bda, 0x8192)},
-        {USB_DEVICE(0x0bda, 0x8709)},
-        /* Corega */
-        {USB_DEVICE(0x07aa, 0x0043)},
-        /* Belkin */
-        {USB_DEVICE(0x050d, 0x805E)},
-        {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */
-        /* Sitecom */
-        {USB_DEVICE(0x0df6, 0x0031)},
-        {USB_DEVICE(0x0df6, 0x004b)},   /* WL-349 */
-        /* EnGenius */
-        {USB_DEVICE(0x1740, 0x9201)},
-        /* Dlink */
-        {USB_DEVICE(0x2001, 0x3301)},
-        /* Zinwell */
-        {USB_DEVICE(0x5a57, 0x0290)},
-        /* Guillemot */
-        {USB_DEVICE(0x06f8, 0xe031)},
-        //92SU
+        {USB_DEVICE(0x0bda, 0x8171)}, /* Realtek */
         {USB_DEVICE(0x0bda, 0x8172)},
+        {USB_DEVICE(0x0bda, 0x8173)},
+        {USB_DEVICE(0x0bda, 0x8174)},
+        {USB_DEVICE(0x0bda, 0x8712)},
+        {USB_DEVICE(0x0bda, 0x8713)},
+        {USB_DEVICE(0x07aa, 0x0047)},
+        {USB_DEVICE(0x07d1, 0x3303)},
+        {USB_DEVICE(0x07d1, 0x3302)},
+        {USB_DEVICE(0x07d1, 0x3300)},
+        {USB_DEVICE(0x1740, 0x9603)},
+        {USB_DEVICE(0x1740, 0x9605)},
+        {USB_DEVICE(0x050d, 0x815F)},
+        {USB_DEVICE(0x06f8, 0xe031)},
+        {USB_DEVICE(0x7392, 0x7611)},
+        {USB_DEVICE(0x7392, 0x7612)},
+        {USB_DEVICE(0x7392, 0x7622)},
+        {USB_DEVICE(0x0DF6, 0x0045)},
+        {USB_DEVICE(0x0E66, 0x0015)},
+        {USB_DEVICE(0x0E66, 0x0016)},
+        {USB_DEVICE(0x0b05, 0x1786)},
+        /* these are not in the official list */
+        {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */
         {}
 };
 
diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index 2bede271a2f0..f38472c2e75c 100644
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -121,6 +121,8 @@ static const struct usb_device_id rtl8192_usb_id_tbl[] = {
         {USB_DEVICE(0x2001, 0x3301)},
         /* Zinwell */
         {USB_DEVICE(0x5a57, 0x0290)},
+        /* LG */
+        {USB_DEVICE(0x043e, 0x7a01)},
         {}
 };
 
diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c
index 52408164036f..6a499f0eb594 100644
--- a/drivers/staging/usbip/usbip_common.c
+++ b/drivers/staging/usbip/usbip_common.c
@@ -378,47 +378,67 @@ int usbip_thread(void *param)
         complete_and_exit(&ut->thread_done, 0);
 }
 
+static void stop_rx_thread(struct usbip_device *ud)
+{
+        if (ud->tcp_rx.thread != NULL) {
+                send_sig(SIGKILL, ud->tcp_rx.thread, 1);
+                wait_for_completion(&ud->tcp_rx.thread_done);
+                usbip_udbg("rx_thread for ud %p has finished\n", ud);
+        }
+}
+
+static void stop_tx_thread(struct usbip_device *ud)
+{
+        if (ud->tcp_tx.thread != NULL) {
+                send_sig(SIGKILL, ud->tcp_tx.thread, 1);
+                wait_for_completion(&ud->tcp_tx.thread_done);
+                usbip_udbg("tx_thread for ud %p has finished\n", ud);
+        }
+}
+
 int usbip_start_threads(struct usbip_device *ud)
 {
         /*
          * threads are invoked per one device (per one connection).
          */
         struct task_struct *th;
+        int err = 0;
 
         th = kthread_run(usbip_thread, (void *)&ud->tcp_rx, "usbip");
         if (IS_ERR(th)) {
                 printk(KERN_WARNING
                         "Unable to start control thread\n");
-                return PTR_ERR(th);
+                err = PTR_ERR(th);
+                goto ust_exit;
         }
+
         th = kthread_run(usbip_thread, (void *)&ud->tcp_tx, "usbip");
         if (IS_ERR(th)) {
                 printk(KERN_WARNING
                         "Unable to start control thread\n");
-                return PTR_ERR(th);
+                err = PTR_ERR(th);
+                goto tx_thread_err;
         }
 
         /* confirm threads are starting */
         wait_for_completion(&ud->tcp_rx.thread_done);
         wait_for_completion(&ud->tcp_tx.thread_done);
+
         return 0;
+
+tx_thread_err:
+        stop_rx_thread(ud);
+
+ust_exit:
+        return err;
 }
 EXPORT_SYMBOL_GPL(usbip_start_threads);
 
 void usbip_stop_threads(struct usbip_device *ud)
 {
         /* kill threads related to this sdev, if v.c. exists */
-        if (ud->tcp_rx.thread != NULL) {
-                send_sig(SIGKILL, ud->tcp_rx.thread, 1);
-                wait_for_completion(&ud->tcp_rx.thread_done);
-                usbip_udbg("rx_thread for ud %p has finished\n", ud);
-        }
-
-        if (ud->tcp_tx.thread != NULL) {
-                send_sig(SIGKILL, ud->tcp_tx.thread, 1);
-                wait_for_completion(&ud->tcp_tx.thread_done);
-                usbip_udbg("tx_thread for ud %p has finished\n", ud);
-        }
+        stop_rx_thread(ud);
+        stop_tx_thread(ud);
 }
 EXPORT_SYMBOL_GPL(usbip_stop_threads);
 
diff --git a/drivers/staging/wlags49_h2/wl_enc.c b/drivers/staging/wlags49_h2/wl_enc.c
index 48c44c8fdb28..26cf5486edd6 100644
--- a/drivers/staging/wlags49_h2/wl_enc.c
+++ b/drivers/staging/wlags49_h2/wl_enc.c
@@ -62,6 +62,7 @@
 /*******************************************************************************
  *  include files
  ******************************************************************************/
+#include <linux/string.h>
 #include <wl_version.h>
 
 #include <debug.h>
diff --git a/drivers/staging/wlags49_h2/wl_sysfs.h b/drivers/staging/wlags49_h2/wl_sysfs.h
index 6d96d03cf490..fa658c38001e 100644
--- a/drivers/staging/wlags49_h2/wl_sysfs.h
+++ b/drivers/staging/wlags49_h2/wl_sysfs.h
@@ -2,6 +2,6 @@
 extern void register_wlags_sysfs(struct net_device *);
 extern void unregister_wlags_sysfs(struct net_device *);
 #else
-static void register_wlags_sysfs(struct net_device *) { return; };
-static void unregister_wlags_sysfs(struct net_device *) { return; };
+static inline void register_wlags_sysfs(struct net_device *net) { }
+static inline void unregister_wlags_sysfs(struct net_device *net) { }
 #endif
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index de98a94d1853..a6bd53ace035 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -1272,8 +1272,7 @@ static int usb_resume_both(struct usb_device *udev, pm_message_t msg)
 
 static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
 {
-        int                     w, i;
-        struct usb_interface    *intf;
+        int     w;
 
         /* Remote wakeup is needed only when we actually go to sleep.
          * For things like FREEZE and QUIESCE, if the device is already
@@ -1285,16 +1284,10 @@ static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
                 return;
         }
 
-        /* If remote wakeup is permitted, see whether any interface drivers
+        /* Enable remote wakeup if it is allowed, even if no interface drivers
          * actually want it.
          */
-        w = 0;
-        if (device_may_wakeup(&udev->dev) && udev->actconfig) {
-                for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
-                        intf = udev->actconfig->interface[i];
-                        w |= intf->needs_remote_wakeup;
-                }
-        }
+        w = device_may_wakeup(&udev->dev);
 
         /* If the device is autosuspended with the wrong wakeup setting,
          * autoresume now so the setting can be changed.
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index a73e08fdab36..fd4c36ea5e46 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -416,8 +416,11 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
                         /* A length of zero means transfer the whole sg list */
                         len = length;
                         if (len == 0) {
-                                for_each_sg(sg, sg, nents, i)
-                                        len += sg->length;
+                                struct scatterlist      *sg2;
+                                int                     j;
+
+                                for_each_sg(sg, sg2, nents, j)
+                                        len += sg2->length;
                         }
                 } else {
                         /*
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index 38226e9a371d..95dd4662d6a8 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -469,8 +469,7 @@ static int eem_unwrap(struct gether *port,
                                 crc = get_unaligned_le32(skb->data + len
                                                         - ETH_FCS_LEN);
                                 crc2 = ~crc32_le(~0,
-                                                skb->data,
-                                                skb->len - ETH_FCS_LEN);
+                                                skb->data, len - ETH_FCS_LEN);
                         } else {
                                 crc = get_unaligned_be32(skb->data + len
                                                         - ETH_FCS_LEN);
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index 7d05a0be5c60..4ce899c9b165 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -321,8 +321,8 @@ struct fsg_dev;
 /* Data shared by all the FSG instances. */
 struct fsg_common {
         struct usb_gadget       *gadget;
-        struct fsg_dev          *fsg;
-        struct fsg_dev          *prev_fsg;
+        struct fsg_dev          *fsg, *new_fsg;
+        wait_queue_head_t       fsg_wait;
 
         /* filesem protects: backing files in use */
         struct rw_semaphore     filesem;
@@ -351,7 +351,6 @@ struct fsg_common {
         enum fsg_state          state;          /* For exception handling */
         unsigned int            exception_req_tag;
 
-        u8                      config, new_config;
         enum data_direction     data_dir;
         u32                     data_size;
         u32                     data_size_from_cmnd;
@@ -595,7 +594,7 @@ static int fsg_setup(struct usb_function *f,
         u16                     w_value = le16_to_cpu(ctrl->wValue);
         u16                     w_length = le16_to_cpu(ctrl->wLength);
 
-        if (!fsg->common->config)
+        if (!fsg_is_set(fsg->common))
                 return -EOPNOTSUPP;
 
         switch (ctrl->bRequest) {
@@ -2303,24 +2302,20 @@ static int alloc_request(struct fsg_common *common, struct usb_ep *ep,
         return -ENOMEM;
 }
 
-/*
- * Reset interface setting and re-init endpoint state (toggle etc).
- * Call with altsetting < 0 to disable the interface.  The only other
- * available altsetting is 0, which enables the interface.
- */
-static int do_set_interface(struct fsg_common *common, int altsetting)
+/* Reset interface setting and re-init endpoint state (toggle etc). */
+static int do_set_interface(struct fsg_common *common, struct fsg_dev *new_fsg)
 {
-        int     rc = 0;
-        int     i;
-        const struct usb_endpoint_descriptor    *d;
+        const struct usb_endpoint_descriptor *d;
+        struct fsg_dev *fsg;
+        int i, rc = 0;
 
         if (common->running)
                 DBG(common, "reset interface\n");
 
 reset:
         /* Deallocate the requests */
-        if (common->prev_fsg) {
-                struct fsg_dev *fsg = common->prev_fsg;
+        if (common->fsg) {
+                fsg = common->fsg;
 
                 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
                         struct fsg_buffhd *bh = &common->buffhds[i];
@@ -2345,88 +2340,53 @@ reset:
                         fsg->bulk_out_enabled = 0;
                 }
 
-                common->prev_fsg = 0;
+                common->fsg = NULL;
+                wake_up(&common->fsg_wait);
         }
 
         common->running = 0;
-        if (altsetting < 0 || rc != 0)
+        if (!new_fsg || rc)
                 return rc;
 
-        DBG(common, "set interface %d\n", altsetting);
+        common->fsg = new_fsg;
+        fsg = common->fsg;
 
-        if (fsg_is_set(common)) {
-                struct fsg_dev *fsg = common->fsg;
-                common->prev_fsg = common->fsg;
+        /* Enable the endpoints */
+        d = fsg_ep_desc(common->gadget,
+                        &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
+        rc = enable_endpoint(common, fsg->bulk_in, d);
+        if (rc)
+                goto reset;
+        fsg->bulk_in_enabled = 1;
+
+        d = fsg_ep_desc(common->gadget,
+                        &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
+        rc = enable_endpoint(common, fsg->bulk_out, d);
+        if (rc)
+                goto reset;
+        fsg->bulk_out_enabled = 1;
+        common->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
+        clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
 
-                /* Enable the endpoints */
-                d = fsg_ep_desc(common->gadget,
-                                &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
-                rc = enable_endpoint(common, fsg->bulk_in, d);
+        /* Allocate the requests */
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                struct fsg_buffhd       *bh = &common->buffhds[i];
+
+                rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
                 if (rc)
                         goto reset;
-                fsg->bulk_in_enabled = 1;
-
-                d = fsg_ep_desc(common->gadget,
-                                &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
-                rc = enable_endpoint(common, fsg->bulk_out, d);
+                rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
                 if (rc)
                         goto reset;
-                fsg->bulk_out_enabled = 1;
-                common->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
-                clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
-
-                /* Allocate the requests */
-                for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
-                        struct fsg_buffhd       *bh = &common->buffhds[i];
-
-                        rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
-                        if (rc)
-                                goto reset;
-                        rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
-                        if (rc)
-                                goto reset;
-                        bh->inreq->buf = bh->outreq->buf = bh->buf;
-                        bh->inreq->context = bh->outreq->context = bh;
-                        bh->inreq->complete = bulk_in_complete;
-                        bh->outreq->complete = bulk_out_complete;
-                }
-
-                common->running = 1;
-                for (i = 0; i < common->nluns; ++i)
-                        common->luns[i].unit_attention_data = SS_RESET_OCCURRED;
-                return rc;
-        } else {
-                return -EIO;
-        }
-}
-
-
-/*
- * Change our operational configuration.  This code must agree with the code
- * that returns config descriptors, and with interface altsetting code.
- *
- * It's also responsible for power management interactions.  Some
- * configurations might not work with our current power sources.
- * For now we just assume the gadget is always self-powered.
- */
-static int do_set_config(struct fsg_common *common, u8 new_config)
-{
-        int     rc = 0;
-
-        /* Disable the single interface */
-        if (common->config != 0) {
-                DBG(common, "reset config\n");
-                common->config = 0;
-                rc = do_set_interface(common, -1);
+                bh->inreq->buf = bh->outreq->buf = bh->buf;
+                bh->inreq->context = bh->outreq->context = bh;
+                bh->inreq->complete = bulk_in_complete;
+                bh->outreq->complete = bulk_out_complete;
         }
 
-        /* Enable the interface */
-        if (new_config != 0) {
-                common->config = new_config;
-                rc = do_set_interface(common, 0);
-                if (rc != 0)
-                        common->config = 0;     /* Reset on errors */
-        }
+        common->running = 1;
+        for (i = 0; i < common->nluns; ++i)
+                common->luns[i].unit_attention_data = SS_RESET_OCCURRED;
         return rc;
 }
 
@@ -2437,9 +2397,7 @@ static int do_set_config(struct fsg_common *common, u8 new_config)
 static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 {
         struct fsg_dev *fsg = fsg_from_func(f);
-        fsg->common->prev_fsg = fsg->common->fsg;
-        fsg->common->fsg = fsg;
-        fsg->common->new_config = 1;
+        fsg->common->new_fsg = fsg;
         raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
         return 0;
 }
@@ -2447,9 +2405,7 @@ static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 static void fsg_disable(struct usb_function *f)
 {
         struct fsg_dev *fsg = fsg_from_func(f);
-        fsg->common->prev_fsg = fsg->common->fsg;
-        fsg->common->fsg = fsg;
-        fsg->common->new_config = 0;
+        fsg->common->new_fsg = NULL;
         raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
 }
 
@@ -2459,19 +2415,17 @@ static void fsg_disable(struct usb_function *f)
 static void handle_exception(struct fsg_common *common)
 {
         siginfo_t               info;
-        int                     sig;
         int                     i;
         struct fsg_buffhd       *bh;
         enum fsg_state          old_state;
-        u8                      new_config;
         struct fsg_lun          *curlun;
         unsigned int            exception_req_tag;
-        int                     rc;
 
         /* Clear the existing signals.  Anything but SIGUSR1 is converted
          * into a high-priority EXIT exception. */
         for (;;) {
-                sig = dequeue_signal_lock(current, &current->blocked, &info);
+                int sig =
+                        dequeue_signal_lock(current, &current->blocked, &info);
                 if (!sig)
                         break;
                 if (sig != SIGUSR1) {
@@ -2482,7 +2436,7 @@ static void handle_exception(struct fsg_common *common)
         }
 
         /* Cancel all the pending transfers */
-        if (fsg_is_set(common)) {
+        if (likely(common->fsg)) {
                 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
                         bh = &common->buffhds[i];
                         if (bh->inreq_busy)
@@ -2523,7 +2477,6 @@ static void handle_exception(struct fsg_common *common)
         common->next_buffhd_to_fill = &common->buffhds[0];
         common->next_buffhd_to_drain = &common->buffhds[0];
         exception_req_tag = common->exception_req_tag;
-        new_config = common->new_config;
         old_state = common->state;
 
         if (old_state == FSG_STATE_ABORT_BULK_OUT)
@@ -2573,12 +2526,12 @@ static void handle_exception(struct fsg_common *common)
                 break;
 
         case FSG_STATE_CONFIG_CHANGE:
-                rc = do_set_config(common, new_config);
+                do_set_interface(common, common->new_fsg);
                 break;
 
         case FSG_STATE_EXIT:
         case FSG_STATE_TERMINATED:
-                do_set_config(common, 0);               /* Free resources */
+                do_set_interface(common, NULL);         /* Free resources */
                 spin_lock_irq(&common->lock);
                 common->state = FSG_STATE_TERMINATED;   /* Stop the thread */
                 spin_unlock_irq(&common->lock);
@@ -2863,6 +2816,7 @@ buffhds_first_it:
                 goto error_release;
         }
         init_completion(&common->thread_notifier);
+        init_waitqueue_head(&common->fsg_wait);
 #undef OR
 
 
@@ -2957,9 +2911,17 @@ static void fsg_common_release(struct kref *ref)
 static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
 {
         struct fsg_dev          *fsg = fsg_from_func(f);
+        struct fsg_common       *common = fsg->common;
 
         DBG(fsg, "unbind\n");
-        fsg_common_put(fsg->common);
+        if (fsg->common->fsg == fsg) {
+                fsg->common->new_fsg = NULL;
+                raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+                /* FIXME: make interruptible or killable somehow? */
+                wait_event(common->fsg_wait, common->fsg != fsg);
+        }
+
+        fsg_common_put(common);
         usb_free_descriptors(fsg->function.descriptors);
         usb_free_descriptors(fsg->function.hs_descriptors);
         kfree(fsg);
@@ -2970,7 +2932,6 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
 {
         struct fsg_dev          *fsg = fsg_from_func(f);
         struct usb_gadget       *gadget = c->cdev->gadget;
-        int                     rc;
         int                     i;
         struct usb_ep           *ep;
 
@@ -2996,6 +2957,11 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
         ep->driver_data = fsg->common;  /* claim the endpoint */
         fsg->bulk_out = ep;
 
+        /* Copy descriptors */
+        f->descriptors = usb_copy_descriptors(fsg_fs_function);
+        if (unlikely(!f->descriptors))
+                return -ENOMEM;
+
         if (gadget_is_dualspeed(gadget)) {
                 /* Assume endpoint addresses are the same for both speeds */
                 fsg_hs_bulk_in_desc.bEndpointAddress =
@@ -3003,16 +2969,17 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
                 fsg_hs_bulk_out_desc.bEndpointAddress =
                         fsg_fs_bulk_out_desc.bEndpointAddress;
                 f->hs_descriptors = usb_copy_descriptors(fsg_hs_function);
-                if (unlikely(!f->hs_descriptors))
+                if (unlikely(!f->hs_descriptors)) {
+                        usb_free_descriptors(f->descriptors);
                         return -ENOMEM;
+                }
         }
 
         return 0;
 
 autoconf_fail:
         ERROR(fsg, "unable to autoconfigure all endpoints\n");
-        rc = -ENOTSUPP;
-        return rc;
+        return -ENOTSUPP;
 }
 
 
@@ -3036,11 +3003,6 @@ static int fsg_add(struct usb_composite_dev *cdev,
 
         fsg->function.name        = FSG_DRIVER_DESC;
         fsg->function.strings     = fsg_strings_array;
-        fsg->function.descriptors = usb_copy_descriptors(fsg_fs_function);
-        if (unlikely(!fsg->function.descriptors)) {
-                rc = -ENOMEM;
-                goto error_free_fsg;
-        }
         fsg->function.bind        = fsg_bind;
         fsg->function.unbind      = fsg_unbind;
         fsg->function.setup       = fsg_setup;
@@ -3056,19 +3018,9 @@ static int fsg_add(struct usb_composite_dev *cdev,
 
         rc = usb_add_function(c, &fsg->function);
         if (unlikely(rc))
-                goto error_free_all;
-
-        fsg_common_get(fsg->common);
-        return 0;
-
-error_free_all:
-        usb_free_descriptors(fsg->function.descriptors);
-        /* fsg_bind() might have copied those; or maybe not? who cares
-         * -- free it just in case. */
-        usb_free_descriptors(fsg->function.hs_descriptors);
-error_free_fsg:
-        kfree(fsg);
-
+                kfree(fsg);
+        else
+                fsg_common_get(fsg->common);
         return rc;
 }
 
diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
index 4b0e4a040d6f..d1af253a9105 100644
--- a/drivers/usb/gadget/g_ffs.c
+++ b/drivers/usb/gadget/g_ffs.c
@@ -392,6 +392,17 @@ static int __gfs_do_config(struct usb_configuration *c,
         if (unlikely(ret < 0))
                 return ret;
 
+        /* After previous do_configs there may be some invalid
+         * pointers in c->interface array.  This happens every time
+         * a user space function with fewer interfaces than a user
+         * space function that was run before the new one is run.  The
+         * compasit's set_config() assumes that if there is no more
+         * then MAX_CONFIG_INTERFACES interfaces in a configuration
+         * then there is a NULL pointer after the last interface in
+         * c->interface array.  We need to make sure this is true. */
+        if (c->next_interface_id < ARRAY_SIZE(c->interface))
+                c->interface[c->next_interface_id] = NULL;
+
         return 0;
 }
 
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index 43abf55d8c60..4c3ac5c42237 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -82,7 +82,7 @@ static struct class *usb_gadget_class;
 struct printer_dev {
         spinlock_t              lock;           /* lock this structure */
         /* lock buffer lists during read/write calls */
-        spinlock_t              lock_printer_io;
+        struct mutex            lock_printer_io;
         struct usb_gadget       *gadget;
         struct usb_request      *req;           /* for control responses */
         u8                      config;
@@ -567,7 +567,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
 
         DBG(dev, "printer_read trying to read %d bytes\n", (int)len);
 
-        spin_lock(&dev->lock_printer_io);
+        mutex_lock(&dev->lock_printer_io);
         spin_lock_irqsave(&dev->lock, flags);
 
         /* We will use this flag later to check if a printer reset happened
@@ -601,7 +601,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                  * call or not.
                  */
                 if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
@@ -648,7 +648,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                 if (dev->reset_printer) {
                         list_add(&current_rx_req->list, &dev->rx_reqs);
                         spin_unlock_irqrestore(&dev->lock, flags);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
@@ -673,7 +673,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
         dev->current_rx_buf = current_rx_buf;
 
         spin_unlock_irqrestore(&dev->lock, flags);
-        spin_unlock(&dev->lock_printer_io);
+        mutex_unlock(&dev->lock_printer_io);
 
         DBG(dev, "printer_read returned %d bytes\n", (int)bytes_copied);
 
@@ -697,7 +697,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         if (len == 0)
                 return -EINVAL;
 
-        spin_lock(&dev->lock_printer_io);
+        mutex_lock(&dev->lock_printer_io);
         spin_lock_irqsave(&dev->lock, flags);
 
         /* Check if a printer reset happens while we have interrupts on */
@@ -713,7 +713,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                  * a NON-Blocking call or not.
                  */
                 if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
@@ -752,7 +752,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
                 if (copy_from_user(req->buf, buf, size)) {
                         list_add(&req->list, &dev->tx_reqs);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return bytes_copied;
                 }
 
@@ -766,14 +766,14 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                 if (dev->reset_printer) {
                         list_add(&req->list, &dev->tx_reqs);
                         spin_unlock_irqrestore(&dev->lock, flags);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
                 if (usb_ep_queue(dev->in_ep, req, GFP_ATOMIC)) {
                         list_add(&req->list, &dev->tx_reqs);
                         spin_unlock_irqrestore(&dev->lock, flags);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
@@ -782,7 +782,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         }
 
         spin_unlock_irqrestore(&dev->lock, flags);
-        spin_unlock(&dev->lock_printer_io);
+        mutex_unlock(&dev->lock_printer_io);
 
         DBG(dev, "printer_write sent %d bytes\n", (int)bytes_copied);
 
@@ -820,11 +820,11 @@ printer_poll(struct file *fd, poll_table *wait)
         unsigned long           flags;
         int                     status = 0;
 
-        spin_lock(&dev->lock_printer_io);
+        mutex_lock(&dev->lock_printer_io);
         spin_lock_irqsave(&dev->lock, flags);
         setup_rx_reqs(dev);
         spin_unlock_irqrestore(&dev->lock, flags);
-        spin_unlock(&dev->lock_printer_io);
+        mutex_unlock(&dev->lock_printer_io);
 
         poll_wait(fd, &dev->rx_wait, wait);
         poll_wait(fd, &dev->tx_wait, wait);
@@ -1461,7 +1461,7 @@ autoconf_fail:
         }
 
         spin_lock_init(&dev->lock);
-        spin_lock_init(&dev->lock_printer_io);
+        mutex_init(&dev->lock_printer_io);
         INIT_LIST_HEAD(&dev->tx_reqs);
         INIT_LIST_HEAD(&dev->tx_reqs_active);
         INIT_LIST_HEAD(&dev->rx_reqs);
@@ -1594,7 +1594,7 @@ cleanup(void)
 {
         int status;
 
-        spin_lock(&usb_printer_gadget.lock_printer_io);
+        mutex_lock(&usb_printer_gadget.lock_printer_io);
         class_destroy(usb_gadget_class);
         unregister_chrdev_region(g_printer_devno, 2);
 
@@ -1602,6 +1602,6 @@ cleanup(void)
         if (status)
                 ERROR(dev, "usb_gadget_unregister_driver %x\n", status);
 
-        spin_unlock(&usb_printer_gadget.lock_printer_io);
+        mutex_unlock(&usb_printer_gadget.lock_printer_io);
 }
 module_exit(cleanup);
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index d5f4c1d45c97..e724a051bfdd 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -1700,9 +1700,13 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
         if (!driver || driver != udc->driver || !driver->unbind)
                 return -EINVAL;
 
-        dprintk(DEBUG_NORMAL,"usb_gadget_register_driver() '%s'\n",
+        dprintk(DEBUG_NORMAL, "usb_gadget_unregister_driver() '%s'\n",
                 driver->driver.name);
 
+        /* report disconnect */
+        if (driver->disconnect)
+                driver->disconnect(&udc->gadget);
+
         driver->unbind(&udc->gadget);
 
         device_del(&udc->gadget.dev);
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index 16bdf77f582a..3e8dcb5455e3 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -536,17 +536,11 @@ recycle:
                 list_move(&req->list, &port->read_pool);
         }
 
-        /* Push from tty to ldisc; this is immediate with low_latency, and
-         * may trigger callbacks to this driver ... so drop the spinlock.
+        /* Push from tty to ldisc; without low_latency set this is handled by
+         * a workqueue, so we won't get callbacks and can hold port_lock
          */
         if (tty && do_push) {
-                spin_unlock_irq(&port->port_lock);
                 tty_flip_buffer_push(tty);
-                wake_up_interruptible(&tty->read_wait);
-                spin_lock_irq(&port->port_lock);
-
-                /* tty may have been closed */
-                tty = port->port_tty;
         }
 
 
@@ -784,11 +778,6 @@ static int gs_open(struct tty_struct *tty, struct file *file)
         port->open_count = 1;
         port->openclose = false;
 
-        /* low_latency means ldiscs work in tasklet context, without
-         * needing a workqueue schedule ... easier to keep up.
-         */
-        tty->low_latency = 1;
-
         /* if connected, start the I/O stream */
         if (port->port_usb) {
                 struct gserial  *gser = port->port_usb;
@@ -1195,6 +1184,7 @@ void gserial_cleanup(void)
         n_ports = 0;
 
         tty_unregister_driver(gs_tty_driver);
+        put_tty_driver(gs_tty_driver);
         gs_tty_driver = NULL;
 
         pr_debug("%s: cleaned up ttyGS* support\n", __func__);
diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
index 544ccfd7056e..bd4027745aa7 100644
--- a/drivers/usb/host/ehci-mxc.c
+++ b/drivers/usb/host/ehci-mxc.c
@@ -207,10 +207,17 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
         /* Initialize the transceiver */
         if (pdata->otg) {
                 pdata->otg->io_priv = hcd->regs + ULPI_VIEWPORT_OFFSET;
-                if (otg_init(pdata->otg) != 0)
-                        dev_err(dev, "unable to init transceiver\n");
-                else if (otg_set_vbus(pdata->otg, 1) != 0)
+                ret = otg_init(pdata->otg);
+                if (ret) {
+                        dev_err(dev, "unable to init transceiver, probably missing\n");
+                        ret = -ENODEV;
+                        goto err_add;
+                }
+                ret = otg_set_vbus(pdata->otg, 1);
+                if (ret) {
                         dev_err(dev, "unable to enable vbus on transceiver\n");
+                        goto err_add;
+                }
         }
 
         priv->hcd = hcd;
diff --git a/drivers/usb/host/isp1362-hcd.c b/drivers/usb/host/isp1362-hcd.c
index 20a0dfe0fe36..0587ad4ce5c2 100644
--- a/drivers/usb/host/isp1362-hcd.c
+++ b/drivers/usb/host/isp1362-hcd.c
@@ -2224,12 +2224,9 @@ static void remove_debug_file(struct isp1362_hcd *isp1362_hcd)
 
 /*-------------------------------------------------------------------------*/
 
-static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
+static void __isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
 {
         int tmp = 20;
-        unsigned long flags;
-
-        spin_lock_irqsave(&isp1362_hcd->lock, flags);
 
         isp1362_write_reg16(isp1362_hcd, HCSWRES, HCSWRES_MAGIC);
         isp1362_write_reg32(isp1362_hcd, HCCMDSTAT, OHCI_HCR);
@@ -2240,6 +2237,14 @@ static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
         }
         if (!tmp)
                 pr_err("Software reset timeout\n");
+}
+
+static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        __isp1362_sw_reset(isp1362_hcd);
         spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
 }
 
@@ -2418,7 +2423,7 @@ static void isp1362_hc_stop(struct usb_hcd *hcd)
         if (isp1362_hcd->board && isp1362_hcd->board->reset)
                 isp1362_hcd->board->reset(hcd->self.controller, 1);
         else
-                isp1362_sw_reset(isp1362_hcd);
+                __isp1362_sw_reset(isp1362_hcd);
 
         if (isp1362_hcd->board && isp1362_hcd->board->clock)
                 isp1362_hcd->board->clock(hcd->self.controller, 0);
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index 1a2bb4ce638f..77be3c24a427 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -1065,7 +1065,7 @@ static void r8a66597_usb_connect(struct r8a66597 *r8a66597, int port)
         else if (speed == LSMODE)
                 rh->port |= USB_PORT_STAT_LOW_SPEED;
 
-        rh->port &= USB_PORT_STAT_RESET;
+        rh->port &= ~USB_PORT_STAT_RESET;
         rh->port |= USB_PORT_STAT_ENABLE;
 }
 
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 9012098add6b..94e6934edb09 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -182,8 +182,12 @@ static void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
  * set, but other sections talk about dealing with the chain bit set.  This was
  * fixed in the 0.96 specification errata, but we have to assume that all 0.95
  * xHCI hardware can't handle the chain bit being cleared on a link TRB.
+ *
+ * @more_trbs_coming:   Will you enqueue more TRBs before calling
+ *                      prepare_transfer()?
  */
-static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer)
+static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring,
+                bool consumer, bool more_trbs_coming)
 {
         u32 chain;
         union xhci_trb *next;
@@ -199,15 +203,28 @@ static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
         while (last_trb(xhci, ring, ring->enq_seg, next)) {
                 if (!consumer) {
                         if (ring != xhci->event_ring) {
-                                if (chain) {
-                                        next->link.control |= TRB_CHAIN;
-
-                                        /* Give this link TRB to the hardware */
-                                        wmb();
-                                        next->link.control ^= TRB_CYCLE;
-                                } else {
+                                /*
+                                 * If the caller doesn't plan on enqueueing more
+                                 * TDs before ringing the doorbell, then we
+                                 * don't want to give the link TRB to the
+                                 * hardware just yet.  We'll give the link TRB
+                                 * back in prepare_ring() just before we enqueue
+                                 * the TD at the top of the ring.
+                                 */
+                                if (!chain && !more_trbs_coming)
                                         break;
+
+                                /* If we're not dealing with 0.95 hardware,
+                                 * carry over the chain bit of the previous TRB
+                                 * (which may mean the chain bit is cleared).
+                                 */
+                                if (!xhci_link_trb_quirk(xhci)) {
+                                        next->link.control &= ~TRB_CHAIN;
+                                        next->link.control |= chain;
                                 }
+                                /* Give this link TRB to the hardware */
+                                wmb();
+                                next->link.control ^= TRB_CYCLE;
                         }
                         /* Toggle the cycle bit after the last ring segment. */
                         if (last_trb_on_last_seg(xhci, ring, ring->enq_seg, next)) {
@@ -1707,9 +1724,12 @@ void xhci_handle_event(struct xhci_hcd *xhci)
 /*
  * Generic function for queueing a TRB on a ring.
  * The caller must have checked to make sure there's room on the ring.
+ *
+ * @more_trbs_coming:   Will you enqueue more TRBs before calling
+ *                      prepare_transfer()?
  */
 static void queue_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
-                bool consumer,
+                bool consumer, bool more_trbs_coming,
                 u32 field1, u32 field2, u32 field3, u32 field4)
 {
         struct xhci_generic_trb *trb;
@@ -1719,7 +1739,7 @@ static void queue_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
         trb->field[1] = field2;
         trb->field[2] = field3;
         trb->field[3] = field4;
-        inc_enq(xhci, ring, consumer);
+        inc_enq(xhci, ring, consumer, more_trbs_coming);
 }
 
 /*
@@ -1988,6 +2008,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         int trb_buff_len, this_sg_len, running_total;
         bool first_trb;
         u64 addr;
+        bool more_trbs_coming;
 
         struct xhci_generic_trb *start_trb;
         int start_cycle;
@@ -2073,7 +2094,11 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 length_field = TRB_LEN(trb_buff_len) |
                         remainder |
                         TRB_INTR_TARGET(0);
-                queue_trb(xhci, ep_ring, false,
+                if (num_trbs > 1)
+                        more_trbs_coming = true;
+                else
+                        more_trbs_coming = false;
+                queue_trb(xhci, ep_ring, false, more_trbs_coming,
                                 lower_32_bits(addr),
                                 upper_32_bits(addr),
                                 length_field,
@@ -2124,6 +2149,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         int num_trbs;
         struct xhci_generic_trb *start_trb;
         bool first_trb;
+        bool more_trbs_coming;
         int start_cycle;
         u32 field, length_field;
 
@@ -2212,7 +2238,11 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 length_field = TRB_LEN(trb_buff_len) |
                         remainder |
                         TRB_INTR_TARGET(0);
-                queue_trb(xhci, ep_ring, false,
+                if (num_trbs > 1)
+                        more_trbs_coming = true;
+                else
+                        more_trbs_coming = false;
+                queue_trb(xhci, ep_ring, false, more_trbs_coming,
                                 lower_32_bits(addr),
                                 upper_32_bits(addr),
                                 length_field,
@@ -2291,7 +2321,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         /* Queue setup TRB - see section 6.4.1.2.1 */
         /* FIXME better way to translate setup_packet into two u32 fields? */
         setup = (struct usb_ctrlrequest *) urb->setup_packet;
-        queue_trb(xhci, ep_ring, false,
+        queue_trb(xhci, ep_ring, false, true,
                         /* FIXME endianness is probably going to bite my ass here. */
                         setup->bRequestType | setup->bRequest << 8 | setup->wValue << 16,
                         setup->wIndex | setup->wLength << 16,
@@ -2307,7 +2337,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         if (urb->transfer_buffer_length > 0) {
                 if (setup->bRequestType & USB_DIR_IN)
                         field |= TRB_DIR_IN;
-                queue_trb(xhci, ep_ring, false,
+                queue_trb(xhci, ep_ring, false, true,
                                 lower_32_bits(urb->transfer_dma),
                                 upper_32_bits(urb->transfer_dma),
                                 length_field,
@@ -2324,7 +2354,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 field = 0;
         else
                 field = TRB_DIR_IN;
-        queue_trb(xhci, ep_ring, false,
+        queue_trb(xhci, ep_ring, false, false,
                         0,
                         0,
                         TRB_INTR_TARGET(0),
@@ -2361,7 +2391,7 @@ static int queue_command(struct xhci_hcd *xhci, u32 field1, u32 field2,
                                         "unfailable commands failed.\n");
                 return -ENOMEM;
         }
-        queue_trb(xhci, xhci->cmd_ring, false, field1, field2, field3,
+        queue_trb(xhci, xhci->cmd_ring, false, false, field1, field2, field3,
                         field4 | xhci->cmd_ring->cycle_state);
         return 0;
 }
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index fad70bc83555..3b795c56221f 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -219,8 +219,8 @@ static int musb_ulpi_write(struct otg_transceiver *otg,
         return 0;
 }
 #else
-#define musb_ulpi_read(a, b)            NULL
-#define musb_ulpi_write(a, b, c)        NULL
+#define musb_ulpi_read          NULL
+#define musb_ulpi_write         NULL
 #endif
 
 static struct otg_io_access_ops musb_ulpi_access = {
@@ -451,10 +451,6 @@ void musb_hnp_stop(struct musb *musb)
  * @param power
  */
 
-#define STAGE0_MASK (MUSB_INTR_RESUME | MUSB_INTR_SESSREQ \
-                | MUSB_INTR_VBUSERROR | MUSB_INTR_CONNECT \
-                | MUSB_INTR_RESET)
-
 static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                                 u8 devctl, u8 power)
 {
@@ -642,7 +638,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                 handled = IRQ_HANDLED;
         }
 
-
+#endif
         if (int_usb & MUSB_INTR_SUSPEND) {
                 DBG(1, "SUSPEND (%s) devctl %02x power %02x\n",
                                 otg_state_string(musb), devctl, power);
@@ -705,6 +701,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                 }
         }
 
+#ifdef CONFIG_USB_MUSB_HDRC_HCD
         if (int_usb & MUSB_INTR_CONNECT) {
                 struct usb_hcd *hcd = musb_to_hcd(musb);
                 void __iomem *mbase = musb->mregs;
@@ -1597,7 +1594,7 @@ irqreturn_t musb_interrupt(struct musb *musb)
         /* the core can interrupt us for multiple reasons; docs have
          * a generic interrupt flowchart to follow
          */
-        if (musb->int_usb & STAGE0_MASK)
+        if (musb->int_usb)
                 retval |= musb_stage0_irq(musb, musb->int_usb,
                                 devctl, power);
 
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index b22d02dea7d3..91d67794e350 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -470,7 +470,8 @@ struct musb_csr_regs {
 
 struct musb_context_registers {
 
-#ifdef CONFIG_PM
+#if defined(CONFIG_ARCH_OMAP2430) || defined(CONFIG_ARCH_OMAP3) || \
+    defined(CONFIG_ARCH_OMAP4)
         u32 otg_sysconfig, otg_forcestandby;
 #endif
         u8 power;
@@ -484,7 +485,8 @@ struct musb_context_registers {
         struct musb_csr_regs index_regs[MUSB_C_NUM_EPS];
 };
 
-#ifdef CONFIG_PM
+#if defined(CONFIG_ARCH_OMAP2430) || defined(CONFIG_ARCH_OMAP3) || \
+    defined(CONFIG_ARCH_OMAP4)
 extern void musb_platform_save_context(struct musb *musb,
                 struct musb_context_registers *musb_context);
 extern void musb_platform_restore_context(struct musb *musb,
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index 1008044a3bbc..dc66e4376d49 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -132,18 +132,9 @@ static void configure_channel(struct dma_channel *channel,
         if (mode) {
                 csr |= 1 << MUSB_HSDMA_MODE1_SHIFT;
                 BUG_ON(len < packet_sz);
-
-                if (packet_sz >= 64) {
-                        csr |= MUSB_HSDMA_BURSTMODE_INCR16
-                                        << MUSB_HSDMA_BURSTMODE_SHIFT;
-                } else if (packet_sz >= 32) {
-                        csr |= MUSB_HSDMA_BURSTMODE_INCR8
-                                        << MUSB_HSDMA_BURSTMODE_SHIFT;
-                } else if (packet_sz >= 16) {
-                        csr |= MUSB_HSDMA_BURSTMODE_INCR4
-                                        << MUSB_HSDMA_BURSTMODE_SHIFT;
-                }
         }
+        csr |= MUSB_HSDMA_BURSTMODE_INCR16
+                                << MUSB_HSDMA_BURSTMODE_SHIFT;
 
         csr |= (musb_channel->epnum << MUSB_HSDMA_ENDPOINT_SHIFT)
                 | (1 << MUSB_HSDMA_ENABLE_SHIFT)
diff --git a/drivers/usb/otg/ulpi.c b/drivers/usb/otg/ulpi.c
index b1b346932946..d331b222ad21 100644
--- a/drivers/usb/otg/ulpi.c
+++ b/drivers/usb/otg/ulpi.c
@@ -59,12 +59,17 @@ static int ulpi_set_flags(struct otg_transceiver *otg)
 
 static int ulpi_init(struct otg_transceiver *otg)
 {
-        int i, vid, pid;
-
-        vid = (otg_io_read(otg, ULPI_VENDOR_ID_HIGH) << 8) |
-               otg_io_read(otg, ULPI_VENDOR_ID_LOW);
-        pid = (otg_io_read(otg, ULPI_PRODUCT_ID_HIGH) << 8) |
-               otg_io_read(otg, ULPI_PRODUCT_ID_LOW);
+        int i, vid, pid, ret;
+        u32 ulpi_id = 0;
+
+        for (i = 0; i < 4; i++) {
+                ret = otg_io_read(otg, ULPI_PRODUCT_ID_HIGH - i);
+                if (ret < 0)
+                        return ret;
+                ulpi_id = (ulpi_id << 8) | ret;
+        }
+        vid = ulpi_id & 0xffff;
+        pid = ulpi_id >> 16;
 
         pr_info("ULPI transceiver vendor/product ID 0x%04x/0x%04x\n", vid, pid);
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 79dd1ae195e5..da7e334b0407 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -653,7 +653,6 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(EVOLUTION_VID, EVOLUTION_ER1_PID) },
         { USB_DEVICE(EVOLUTION_VID, EVO_HYBRID_PID) },
         { USB_DEVICE(EVOLUTION_VID, EVO_RCM4_PID) },
-        { USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ARTEMIS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16C_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 94d86c3febcb..bbc159a1df45 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -501,13 +501,6 @@
 #define CONTEC_COM1USBH_PID     0x8311  /* COM-1(USB)H */
 
 /*
- * Contec products (http://www.contec.com)
- * Submitted by Daniel Sangorrin
- */
-#define CONTEC_VID              0x06CE  /* Vendor ID */
-#define CONTEC_COM1USBH_PID     0x8311  /* COM-1(USB)H */
-
-/*
  * Definitions for B&B Electronics products.
  */
 #define BANDB_VID               0x0856  /* B&B Electronics Vendor ID */
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 04bb759536bb..93d72eb8cafc 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -139,6 +139,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                                         "Could not set interface, error %d\n",
                                         retval);
                                 retval = -ENODEV;
+                                kfree(data);
                         }
                         return retval;
                 }
@@ -155,6 +156,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                                         "Could not set interface, error %d\n",
                                         retval);
                                 retval = -ENODEV;
+                                kfree(data);
                         }
                         return retval;
                 }
@@ -163,6 +165,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
         default:
                 dev_err(&serial->dev->dev,
                         "unknown number of interfaces: %d\n", nintf);
+                kfree(data);
                 return -ENODEV;
         }
 
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index df5b6b971f26..57a593c58cf4 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -98,7 +98,8 @@ static void tx_poll_start(struct vhost_net *net, struct socket *sock)
 static void handle_tx(struct vhost_net *net)
 {
         struct vhost_virtqueue *vq = &net->dev.vqs[VHOST_NET_VQ_TX];
-        unsigned head, out, in, s;
+        unsigned out, in, s;
+        int head;
         struct msghdr msg = {
                 .msg_name = NULL,
                 .msg_namelen = 0,
@@ -135,6 +136,9 @@ static void handle_tx(struct vhost_net *net)
                                          ARRAY_SIZE(vq->iov),
                                          &out, &in,
                                          NULL, NULL);
+                /* On error, stop handling until the next kick. */
+                if (unlikely(head < 0))
+                        break;
                 /* Nothing new?  Wait for eventfd to tell us they refilled. */
                 if (head == vq->num) {
                         wmem = atomic_read(&sock->sk->sk_wmem_alloc);
@@ -192,7 +196,8 @@ static void handle_tx(struct vhost_net *net)
 static void handle_rx(struct vhost_net *net)
 {
         struct vhost_virtqueue *vq = &net->dev.vqs[VHOST_NET_VQ_RX];
-        unsigned head, out, in, log, s;
+        unsigned out, in, log, s;
+        int head;
         struct vhost_log *vq_log;
         struct msghdr msg = {
                 .msg_name = NULL,
@@ -228,6 +233,9 @@ static void handle_rx(struct vhost_net *net)
                                          ARRAY_SIZE(vq->iov),
                                          &out, &in,
                                          vq_log, &log);
+                /* On error, stop handling until the next kick. */
+                if (unlikely(head < 0))
+                        break;
                 /* OK, now we need to know about added descriptors. */
                 if (head == vq->num) {
                         if (unlikely(vhost_enable_notify(vq))) {
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 3b83382e06eb..0b99783083f6 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -736,12 +736,12 @@ static int translate_desc(struct vhost_dev *dev, u64 addr, u32 len,
         mem = rcu_dereference(dev->memory);
         while ((u64)len > s) {
                 u64 size;
-                if (ret >= iov_size) {
+                if (unlikely(ret >= iov_size)) {
                         ret = -ENOBUFS;
                         break;
                 }
                 reg = find_region(mem, addr, len);
-                if (!reg) {
+                if (unlikely(!reg)) {
                         ret = -EFAULT;
                         break;
                 }
@@ -780,18 +780,18 @@ static unsigned next_desc(struct vring_desc *desc)
         return next;
 }
 
-static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
-                             struct iovec iov[], unsigned int iov_size,
-                             unsigned int *out_num, unsigned int *in_num,
-                             struct vhost_log *log, unsigned int *log_num,
-                             struct vring_desc *indirect)
+static int get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
+                        struct iovec iov[], unsigned int iov_size,
+                        unsigned int *out_num, unsigned int *in_num,
+                        struct vhost_log *log, unsigned int *log_num,
+                        struct vring_desc *indirect)
 {
         struct vring_desc desc;
         unsigned int i = 0, count, found = 0;
         int ret;
 
         /* Sanity check */
-        if (indirect->len % sizeof desc) {
+        if (unlikely(indirect->len % sizeof desc)) {
                 vq_err(vq, "Invalid length in indirect descriptor: "
                        "len 0x%llx not multiple of 0x%zx\n",
                        (unsigned long long)indirect->len,
@@ -801,7 +801,7 @@ static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
 
         ret = translate_desc(dev, indirect->addr, indirect->len, vq->indirect,
                              ARRAY_SIZE(vq->indirect));
-        if (ret < 0) {
+        if (unlikely(ret < 0)) {
                 vq_err(vq, "Translation failure %d in indirect.\n", ret);
                 return ret;
         }
@@ -813,7 +813,7 @@ static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
         count = indirect->len / sizeof desc;
         /* Buffers are chained via a 16 bit next field, so
          * we can have at most 2^16 of these. */
-        if (count > USHRT_MAX + 1) {
+        if (unlikely(count > USHRT_MAX + 1)) {
                 vq_err(vq, "Indirect buffer length too big: %d\n",
                        indirect->len);
                 return -E2BIG;
@@ -821,19 +821,19 @@ static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
 
         do {
                 unsigned iov_count = *in_num + *out_num;
-                if (++found > count) {
+                if (unlikely(++found > count)) {
                         vq_err(vq, "Loop detected: last one at %u "
                                "indirect size %u\n",
                                i, count);
                         return -EINVAL;
                 }
-                if (memcpy_fromiovec((unsigned char *)&desc, vq->indirect,
-                                     sizeof desc)) {
+                if (unlikely(memcpy_fromiovec((unsigned char *)&desc, vq->indirect,
+                                              sizeof desc))) {
                         vq_err(vq, "Failed indirect descriptor: idx %d, %zx\n",
                                i, (size_t)indirect->addr + i * sizeof desc);
                         return -EINVAL;
                 }
-                if (desc.flags & VRING_DESC_F_INDIRECT) {
+                if (unlikely(desc.flags & VRING_DESC_F_INDIRECT)) {
                         vq_err(vq, "Nested indirect descriptor: idx %d, %zx\n",
                                i, (size_t)indirect->addr + i * sizeof desc);
                         return -EINVAL;
@@ -841,7 +841,7 @@ static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
 
                 ret = translate_desc(dev, desc.addr, desc.len, iov + iov_count,
                                      iov_size - iov_count);
-                if (ret < 0) {
+                if (unlikely(ret < 0)) {
                         vq_err(vq, "Translation failure %d indirect idx %d\n",
                                ret, i);
                         return ret;
@@ -857,7 +857,7 @@ static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
                 } else {
                         /* If it's an output descriptor, they're all supposed
                          * to come before any input descriptors. */
-                        if (*in_num) {
+                        if (unlikely(*in_num)) {
                                 vq_err(vq, "Indirect descriptor "
                                        "has out after in: idx %d\n", i);
                                 return -EINVAL;
@@ -873,12 +873,13 @@ static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
  * number of output then some number of input descriptors, it's actually two
  * iovecs, but we pack them into one and note how many of each there were.
  *
- * This function returns the descriptor number found, or vq->num (which
- * is never a valid descriptor number) if none was found. */
-unsigned vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
-                           struct iovec iov[], unsigned int iov_size,
-                           unsigned int *out_num, unsigned int *in_num,
-                           struct vhost_log *log, unsigned int *log_num)
+ * This function returns the descriptor number found, or vq->num (which is
+ * never a valid descriptor number) if none was found.  A negative code is
+ * returned on error. */
+int vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
+                      struct iovec iov[], unsigned int iov_size,
+                      unsigned int *out_num, unsigned int *in_num,
+                      struct vhost_log *log, unsigned int *log_num)
 {
         struct vring_desc desc;
         unsigned int i, head, found = 0;
@@ -887,16 +888,16 @@ unsigned vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
 
         /* Check it isn't doing very strange things with descriptor numbers. */
         last_avail_idx = vq->last_avail_idx;
-        if (get_user(vq->avail_idx, &vq->avail->idx)) {
+        if (unlikely(get_user(vq->avail_idx, &vq->avail->idx))) {
                 vq_err(vq, "Failed to access avail idx at %p\n",
                        &vq->avail->idx);
-                return vq->num;
+                return -EFAULT;
         }
 
-        if ((u16)(vq->avail_idx - last_avail_idx) > vq->num) {
+        if (unlikely((u16)(vq->avail_idx - last_avail_idx) > vq->num)) {
                 vq_err(vq, "Guest moved used index from %u to %u",
                        last_avail_idx, vq->avail_idx);
-                return vq->num;
+                return -EFAULT;
         }
 
         /* If there's nothing new since last we looked, return invalid. */
@@ -908,18 +909,19 @@ unsigned vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
 
         /* Grab the next descriptor number they're advertising, and increment
          * the index we've seen. */
-        if (get_user(head, &vq->avail->ring[last_avail_idx % vq->num])) {
+        if (unlikely(get_user(head,
+                              &vq->avail->ring[last_avail_idx % vq->num]))) {
                 vq_err(vq, "Failed to read head: idx %d address %p\n",
                        last_avail_idx,
                        &vq->avail->ring[last_avail_idx % vq->num]);
-                return vq->num;
+                return -EFAULT;
         }
 
         /* If their number is silly, that's an error. */
-        if (head >= vq->num) {
+        if (unlikely(head >= vq->num)) {
                 vq_err(vq, "Guest says index %u > %u is available",
                        head, vq->num);
-                return vq->num;
+                return -EINVAL;
         }
 
         /* When we start there are none of either input nor output. */
@@ -930,41 +932,41 @@ unsigned vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
         i = head;
         do {
                 unsigned iov_count = *in_num + *out_num;
-                if (i >= vq->num) {
+                if (unlikely(i >= vq->num)) {
                         vq_err(vq, "Desc index is %u > %u, head = %u",
                                i, vq->num, head);
-                        return vq->num;
+                        return -EINVAL;
                 }
-                if (++found > vq->num) {
+                if (unlikely(++found > vq->num)) {
                         vq_err(vq, "Loop detected: last one at %u "
                                "vq size %u head %u\n",
                                i, vq->num, head);
-                        return vq->num;
+                        return -EINVAL;
                 }
                 ret = copy_from_user(&desc, vq->desc + i, sizeof desc);
-                if (ret) {
+                if (unlikely(ret)) {
                         vq_err(vq, "Failed to get descriptor: idx %d addr %p\n",
                                i, vq->desc + i);
-                        return vq->num;
+                        return -EFAULT;
                 }
                 if (desc.flags & VRING_DESC_F_INDIRECT) {
                         ret = get_indirect(dev, vq, iov, iov_size,
                                            out_num, in_num,
                                            log, log_num, &desc);
-                        if (ret < 0) {
+                        if (unlikely(ret < 0)) {
                                 vq_err(vq, "Failure detected "
                                        "in indirect descriptor at idx %d\n", i);
-                                return vq->num;
+                                return ret;
                         }
                         continue;
                 }
 
                 ret = translate_desc(dev, desc.addr, desc.len, iov + iov_count,
                                      iov_size - iov_count);
-                if (ret < 0) {
+                if (unlikely(ret < 0)) {
                         vq_err(vq, "Translation failure %d descriptor idx %d\n",
                                ret, i);
-                        return vq->num;
+                        return ret;
                 }
                 if (desc.flags & VRING_DESC_F_WRITE) {
                         /* If this is an input descriptor,
@@ -978,10 +980,10 @@ unsigned vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
                 } else {
                         /* If it's an output descriptor, they're all supposed
                          * to come before any input descriptors. */
-                        if (*in_num) {
+                        if (unlikely(*in_num)) {
                                 vq_err(vq, "Descriptor has out after in: "
                                        "idx %d\n", i);
-                                return vq->num;
+                                return -EINVAL;
                         }
                         *out_num += ret;
                 }
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 44591ba9b07a..11ee13dba0f7 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -120,10 +120,10 @@ long vhost_dev_ioctl(struct vhost_dev *, unsigned int ioctl, unsigned long arg);
 int vhost_vq_access_ok(struct vhost_virtqueue *vq);
 int vhost_log_access_ok(struct vhost_dev *);
 
-unsigned vhost_get_vq_desc(struct vhost_dev *, struct vhost_virtqueue *,
-                           struct iovec iov[], unsigned int iov_count,
-                           unsigned int *out_num, unsigned int *in_num,
-                           struct vhost_log *log, unsigned int *log_num);
+int vhost_get_vq_desc(struct vhost_dev *, struct vhost_virtqueue *,
+                      struct iovec iov[], unsigned int iov_count,
+                      unsigned int *out_num, unsigned int *in_num,
+                      struct vhost_log *log, unsigned int *log_num);
 void vhost_discard_vq_desc(struct vhost_virtqueue *);
 
 int vhost_add_used(struct vhost_virtqueue *, unsigned int head, int len);
diff --git a/drivers/video/geode/gxfb_core.c b/drivers/video/geode/gxfb_core.c
index 76e7dac6f259..70b1d9d51c96 100644
--- a/drivers/video/geode/gxfb_core.c
+++ b/drivers/video/geode/gxfb_core.c
@@ -40,7 +40,7 @@ static int vram;
 static int vt_switch;
 
 /* Modes relevant to the GX (taken from modedb.c) */
-static struct fb_videomode gx_modedb[] __initdata = {
+static struct fb_videomode gx_modedb[] __devinitdata = {
         /* 640x480-60 VESA */
         { NULL, 60, 640, 480, 39682,  48, 16, 33, 10, 96, 2,
           0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
@@ -110,14 +110,15 @@ static struct fb_videomode gx_modedb[] __initdata = {
 #ifdef CONFIG_OLPC
 #include <asm/olpc.h>
 
-static struct fb_videomode gx_dcon_modedb[] __initdata = {
+static struct fb_videomode gx_dcon_modedb[] __devinitdata = {
         /* The only mode the DCON has is 1200x900 */
         { NULL, 50, 1200, 900, 17460, 24, 8, 4, 5, 8, 3,
           FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
           FB_VMODE_NONINTERLACED, 0 }
 };
 
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
         if (olpc_has_dcon()) {
                 *modedb = (struct fb_videomode *) gx_dcon_modedb;
@@ -129,7 +130,8 @@ static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
 }
 
 #else
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
         *modedb = (struct fb_videomode *) gx_modedb;
         *size = ARRAY_SIZE(gx_modedb);
@@ -226,7 +228,8 @@ static int gxfb_blank(int blank_mode, struct fb_info *info)
         return gx_blank_display(info, blank_mode);
 }
 
-static int __init gxfb_map_video_memory(struct fb_info *info, struct pci_dev *dev)
+static int __devinit gxfb_map_video_memory(struct fb_info *info,
+                struct pci_dev *dev)
 {
         struct gxfb_par *par = info->par;
         int ret;
@@ -290,7 +293,7 @@ static struct fb_ops gxfb_ops = {
         .fb_imageblit   = cfb_imageblit,
 };
 
-static struct fb_info * __init gxfb_init_fbinfo(struct device *dev)
+static struct fb_info *__devinit gxfb_init_fbinfo(struct device *dev)
 {
         struct gxfb_par *par;
         struct fb_info *info;
@@ -371,7 +374,8 @@ static int gxfb_resume(struct pci_dev *pdev)
 }
 #endif
 
-static int __init gxfb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+static int __devinit gxfb_probe(struct pci_dev *pdev,
+                const struct pci_device_id *id)
 {
         struct gxfb_par *par;
         struct fb_info *info;
@@ -451,7 +455,7 @@ static int __init gxfb_probe(struct pci_dev *pdev, const struct pci_device_id *i
         return ret;
 }
 
-static void gxfb_remove(struct pci_dev *pdev)
+static void __devexit gxfb_remove(struct pci_dev *pdev)
 {
         struct fb_info *info = pci_get_drvdata(pdev);
         struct gxfb_par *par = info->par;
diff --git a/drivers/video/geode/lxfb_core.c b/drivers/video/geode/lxfb_core.c
index 1a18da86d3fa..39bdbedf43b4 100644
--- a/drivers/video/geode/lxfb_core.c
+++ b/drivers/video/geode/lxfb_core.c
@@ -35,7 +35,7 @@ static int vt_switch;
  * we try to make it something sane - 640x480-60 is sane
  */
 
-static struct fb_videomode geode_modedb[] __initdata = {
+static struct fb_videomode geode_modedb[] __devinitdata = {
         /* 640x480-60 */
         { NULL, 60, 640, 480, 39682, 48, 8, 25, 2, 88, 2,
           FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
@@ -219,14 +219,15 @@ static struct fb_videomode geode_modedb[] __initdata = {
 #ifdef CONFIG_OLPC
 #include <asm/olpc.h>
 
-static struct fb_videomode olpc_dcon_modedb[] __initdata = {
+static struct fb_videomode olpc_dcon_modedb[] __devinitdata = {
         /* The only mode the DCON has is 1200x900 */
         { NULL, 50, 1200, 900, 17460, 24, 8, 4, 5, 8, 3,
           FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
           FB_VMODE_NONINTERLACED, 0 }
 };
 
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
         if (olpc_has_dcon()) {
                 *modedb = (struct fb_videomode *) olpc_dcon_modedb;
@@ -238,7 +239,8 @@ static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
 }
 
 #else
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
         *modedb = (struct fb_videomode *) geode_modedb;
         *size = ARRAY_SIZE(geode_modedb);
@@ -334,7 +336,7 @@ static int lxfb_blank(int blank_mode, struct fb_info *info)
 }
 
 
-static int __init lxfb_map_video_memory(struct fb_info *info,
+static int __devinit lxfb_map_video_memory(struct fb_info *info,
                                         struct pci_dev *dev)
 {
         struct lxfb_par *par = info->par;
@@ -412,7 +414,7 @@ static struct fb_ops lxfb_ops = {
         .fb_imageblit   = cfb_imageblit,
 };
 
-static struct fb_info * __init lxfb_init_fbinfo(struct device *dev)
+static struct fb_info * __devinit lxfb_init_fbinfo(struct device *dev)
 {
         struct lxfb_par *par;
         struct fb_info *info;
@@ -496,7 +498,7 @@ static int lxfb_resume(struct pci_dev *pdev)
 #define lxfb_resume NULL
 #endif
 
-static int __init lxfb_probe(struct pci_dev *pdev,
+static int __devinit lxfb_probe(struct pci_dev *pdev,
                              const struct pci_device_id *id)
 {
         struct lxfb_par *par;
@@ -588,7 +590,7 @@ err:
         return ret;
 }
 
-static void lxfb_remove(struct pci_dev *pdev)
+static void __devexit lxfb_remove(struct pci_dev *pdev)
 {
         struct fb_info *info = pci_get_drvdata(pdev);
         struct lxfb_par *par = info->par;
diff --git a/drivers/video/nuc900fb.c b/drivers/video/nuc900fb.c
index d4cde79ea15e..81687ed26ba9 100644
--- a/drivers/video/nuc900fb.c
+++ b/drivers/video/nuc900fb.c
@@ -596,8 +596,6 @@ static int __devinit nuc900fb_probe(struct platform_device *pdev)
                 goto release_regs;
         }
 
-        nuc900_driver_clksrc_div(&pdev->dev, "ext", 0x2);
-
         fbi->clk = clk_get(&pdev->dev, NULL);
         if (!fbi->clk || IS_ERR(fbi->clk)) {
                 printk(KERN_ERR "nuc900-lcd:failed to get lcd clock source\n");
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index b6ab27ccf214..811384bec8de 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -68,11 +68,7 @@
  * Here we can be a bit looser than the data sections since this
  * needs to only meet arch ABI requirements.
  */
-#ifdef ARCH_SLAB_MINALIGN
-#define FLAT_STACK_ALIGN        (ARCH_SLAB_MINALIGN)
-#else
-#define FLAT_STACK_ALIGN        (sizeof(void *))
-#endif
+#define FLAT_STACK_ALIGN        max_t(unsigned long, sizeof(void *), ARCH_SLAB_MINALIGN)
 
 #define RELOC_FAILED 0xff00ff01         /* Relocation incorrect somewhere */
 #define UNLOADED_LIB 0x7ff000ff         /* Placeholder for unused library */
diff --git a/fs/ceph/auth_x.c b/fs/ceph/auth_x.c
index 83d4d2785ffe..3fe49042d8ad 100644
--- a/fs/ceph/auth_x.c
+++ b/fs/ceph/auth_x.c
@@ -493,7 +493,7 @@ static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result,
                 return -EAGAIN;
         }
 
-        op = le32_to_cpu(head->op);
+        op = le16_to_cpu(head->op);
         result = le32_to_cpu(head->result);
         dout("handle_reply op %d result %d\n", op, result);
         switch (op) {
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 619b61655ee5..74144d6389f0 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -244,8 +244,14 @@ static struct ceph_cap *get_cap(struct ceph_cap_reservation *ctx)
         struct ceph_cap *cap = NULL;
 
         /* temporary, until we do something about cap import/export */
-        if (!ctx)
-                return kmem_cache_alloc(ceph_cap_cachep, GFP_NOFS);
+        if (!ctx) {
+                cap = kmem_cache_alloc(ceph_cap_cachep, GFP_NOFS);
+                if (cap) {
+                        caps_use_count++;
+                        caps_total_count++;
+                }
+                return cap;
+        }
 
         spin_lock(&caps_list_lock);
         dout("get_cap ctx=%p (%d) %d = %d used + %d resv + %d avail\n",
@@ -2886,18 +2892,19 @@ int ceph_encode_inode_release(void **p, struct inode *inode,
         struct ceph_inode_info *ci = ceph_inode(inode);
         struct ceph_cap *cap;
         struct ceph_mds_request_release *rel = *p;
+        int used, dirty;
         int ret = 0;
-        int used = 0;
 
         spin_lock(&inode->i_lock);
         used = __ceph_caps_used(ci);
+        dirty = __ceph_caps_dirty(ci);
 
-        dout("encode_inode_release %p mds%d used %s drop %s unless %s\n", inode,
-             mds, ceph_cap_string(used), ceph_cap_string(drop),
+        dout("encode_inode_release %p mds%d used|dirty %s drop %s unless %s\n",
+             inode, mds, ceph_cap_string(used|dirty), ceph_cap_string(drop),
              ceph_cap_string(unless));
 
-        /* only drop unused caps */
-        drop &= ~used;
+        /* only drop unused, clean caps */
+        drop &= ~(used | dirty);
 
         cap = __get_cap_for_mds(ci, mds);
         if (cap && __cap_is_valid(cap)) {
diff --git a/fs/ceph/crush/mapper.c b/fs/ceph/crush/mapper.c
index 9ba54efb6543..a4eec133258e 100644
--- a/fs/ceph/crush/mapper.c
+++ b/fs/ceph/crush/mapper.c
@@ -238,7 +238,7 @@ static int bucket_straw_choose(struct crush_bucket_straw *bucket,
 
 static int crush_bucket_choose(struct crush_bucket *in, int x, int r)
 {
-        dprintk("choose %d x=%d r=%d\n", in->id, x, r);
+        dprintk(" crush_bucket_choose %d x=%d r=%d\n", in->id, x, r);
         switch (in->alg) {
         case CRUSH_BUCKET_UNIFORM:
                 return bucket_uniform_choose((struct crush_bucket_uniform *)in,
@@ -264,7 +264,7 @@ static int crush_bucket_choose(struct crush_bucket *in, int x, int r)
  */
 static int is_out(struct crush_map *map, __u32 *weight, int item, int x)
 {
-        if (weight[item] >= 0x1000)
+        if (weight[item] >= 0x10000)
                 return 0;
         if (weight[item] == 0)
                 return 1;
@@ -305,7 +305,9 @@ static int crush_choose(struct crush_map *map,
         int itemtype;
         int collide, reject;
         const int orig_tries = 5; /* attempts before we fall back to search */
-        dprintk("choose bucket %d x %d outpos %d\n", bucket->id, x, outpos);
+
+        dprintk("CHOOSE%s bucket %d x %d outpos %d numrep %d\n", recurse_to_leaf ? "_LEAF" : "",
+                bucket->id, x, outpos, numrep);
 
         for (rep = outpos; rep < numrep; rep++) {
                 /* keep trying until we get a non-out, non-colliding item */
@@ -366,6 +368,7 @@ static int crush_choose(struct crush_map *map,
                                         BUG_ON(item >= 0 ||
                                                (-1-item) >= map->max_buckets);
                                         in = map->buckets[-1-item];
+                                        retry_bucket = 1;
                                         continue;
                                 }
 
@@ -377,15 +380,25 @@ static int crush_choose(struct crush_map *map,
                                         }
                                 }
 
-                                if (recurse_to_leaf &&
-                                    item < 0 &&
-                                    crush_choose(map, map->buckets[-1-item],
-                                                 weight,
-                                                 x, outpos+1, 0,
-                                                 out2, outpos,
-                                                 firstn, 0, NULL) <= outpos) {
-                                        reject = 1;
-                                } else {
+                                reject = 0;
+                                if (recurse_to_leaf) {
+                                        if (item < 0) {
+                                                if (crush_choose(map,
+                                                         map->buckets[-1-item],
+                                                         weight,
+                                                         x, outpos+1, 0,
+                                                         out2, outpos,
+                                                         firstn, 0,
+                                                         NULL) <= outpos)
+                                                        /* didn't get leaf */
+                                                        reject = 1;
+                                        } else {
+                                                /* we already have a leaf! */
+                                                out2[outpos] = item;
+                                        }
+                                }
+
+                                if (!reject) {
                                         /* out? */
                                         if (itemtype == 0)
                                                 reject = is_out(map, weight,
@@ -424,12 +437,12 @@ reject:
                         continue;
                 }
 
-                dprintk("choose got %d\n", item);
+                dprintk("CHOOSE got %d\n", item);
                 out[outpos] = item;
                 outpos++;
         }
 
-        dprintk("choose returns %d\n", outpos);
+        dprintk("CHOOSE returns %d\n", outpos);
         return outpos;
 }
 
diff --git a/fs/ceph/debugfs.c b/fs/ceph/debugfs.c
index 3be33fb066cc..f2f5332ddbba 100644
--- a/fs/ceph/debugfs.c
+++ b/fs/ceph/debugfs.c
@@ -261,7 +261,7 @@ static int osdc_show(struct seq_file *s, void *pp)
 
 static int caps_show(struct seq_file *s, void *p)
 {
-        struct ceph_client *client = p;
+        struct ceph_client *client = s->private;
         int total, avail, used, reserved, min;
 
         ceph_reservation_status(client, &total, &avail, &used, &reserved, &min);
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index ab47f46ca282..8f9b9fe8ef9f 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -854,8 +854,8 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in,
                 d_drop(dn);
         realdn = d_materialise_unique(dn, in);
         if (IS_ERR(realdn)) {
-                pr_err("splice_dentry error %p inode %p ino %llx.%llx\n",
-                       dn, in, ceph_vinop(in));
+                pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n",
+                       PTR_ERR(realdn), dn, in, ceph_vinop(in));
                 if (prehash)
                         *prehash = false; /* don't rehash on error */
                 dn = realdn; /* note realdn contains the error */
@@ -1234,18 +1234,23 @@ retry_lookup:
                                 goto out;
                         }
                         dn = splice_dentry(dn, in, NULL);
+                        if (IS_ERR(dn))
+                                dn = NULL;
                 }
 
                 if (fill_inode(in, &rinfo->dir_in[i], NULL, session,
                                req->r_request_started, -1,
                                &req->r_caps_reservation) < 0) {
                         pr_err("fill_inode badness on %p\n", in);
-                        dput(dn);
-                        continue;
+                        goto next_item;
                 }
-                update_dentry_lease(dn, rinfo->dir_dlease[i],
-                                    req->r_session, req->r_request_started);
-                dput(dn);
+                if (dn)
+                        update_dentry_lease(dn, rinfo->dir_dlease[i],
+                                            req->r_session,
+                                            req->r_request_started);
+next_item:
+                if (dn)
+                        dput(dn);
         }
         req->r_did_prepopulate = true;
 
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 1766947fc07a..3ab79f6c4ce8 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2783,6 +2783,12 @@ void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc)
         drop_leases(mdsc);
         ceph_flush_dirty_caps(mdsc);
         wait_requests(mdsc);
+
+        /*
+         * wait for reply handlers to drop their request refs and
+         * their inode/dcache refs
+         */
+        ceph_msgr_flush();
 }
 
 /*
diff --git a/fs/ceph/messenger.c b/fs/ceph/messenger.c
index 64b8b1f7863d..9ad43a310a41 100644
--- a/fs/ceph/messenger.c
+++ b/fs/ceph/messenger.c
@@ -657,7 +657,7 @@ static void prepare_write_connect(struct ceph_messenger *msgr,
         dout("prepare_write_connect %p cseq=%d gseq=%d proto=%d\n", con,
              con->connect_seq, global_seq, proto);
 
-        con->out_connect.features = CEPH_FEATURE_SUPPORTED_CLIENT;
+        con->out_connect.features = cpu_to_le64(CEPH_FEATURE_SUPPORTED_CLIENT);
         con->out_connect.host_type = cpu_to_le32(CEPH_ENTITY_TYPE_CLIENT);
         con->out_connect.connect_seq = cpu_to_le32(con->connect_seq);
         con->out_connect.global_seq = cpu_to_le32(global_seq);
@@ -1396,10 +1396,12 @@ static int read_partial_message(struct ceph_connection *con)
         if (!con->in_msg) {
                 dout("got hdr type %d front %d data %d\n", con->in_hdr.type,
                      con->in_hdr.front_len, con->in_hdr.data_len);
+                skip = 0;
                 con->in_msg = ceph_alloc_msg(con, &con->in_hdr, &skip);
                 if (skip) {
                         /* skip this message */
                         dout("alloc_msg said skip message\n");
+                        BUG_ON(con->in_msg);
                         con->in_base_pos = -front_len - middle_len - data_len -
                                 sizeof(m->footer);
                         con->in_tag = CEPH_MSGR_TAG_READY;
diff --git a/fs/ceph/mon_client.c b/fs/ceph/mon_client.c
index 07a539906e67..cc115eafae11 100644
--- a/fs/ceph/mon_client.c
+++ b/fs/ceph/mon_client.c
@@ -725,7 +725,8 @@ static void handle_auth_reply(struct ceph_mon_client *monc,
                 dout("authenticated, starting session\n");
 
                 monc->client->msgr->inst.name.type = CEPH_ENTITY_TYPE_CLIENT;
-                monc->client->msgr->inst.name.num = monc->auth->global_id;
+                monc->client->msgr->inst.name.num =
+                                        cpu_to_le64(monc->auth->global_id);
 
                 __send_subscribe(monc);
                 __resend_generic_request(monc);
diff --git a/fs/ceph/osd_client.c b/fs/ceph/osd_client.c
index d25b4add85b4..92b7251a53f1 100644
--- a/fs/ceph/osd_client.c
+++ b/fs/ceph/osd_client.c
@@ -1344,7 +1344,7 @@ static void dispatch(struct ceph_connection *con, struct ceph_msg *msg)
         int type = le16_to_cpu(msg->hdr.type);
 
         if (!osd)
-                return;
+                goto out;
         osdc = osd->o_osdc;
 
         switch (type) {
@@ -1359,6 +1359,7 @@ static void dispatch(struct ceph_connection *con, struct ceph_msg *msg)
                 pr_err("received unknown message type %d %s\n", type,
                        ceph_msg_type_name(type));
         }
+out:
         ceph_msg_put(msg);
 }
 
diff --git a/fs/ceph/osdmap.c b/fs/ceph/osdmap.c
index ddc656fb5c05..50ce64ebd330 100644
--- a/fs/ceph/osdmap.c
+++ b/fs/ceph/osdmap.c
@@ -707,6 +707,7 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                 newcrush = crush_decode(*p, min(*p+len, end));
                 if (IS_ERR(newcrush))
                         return ERR_CAST(newcrush);
+                *p += len;
         }
 
         /* new flags? */
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 51e11bf5708f..9d175d623aab 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -733,12 +733,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
 {
         while (fa) {
                 struct fown_struct *fown;
+                unsigned long flags;
+
                 if (fa->magic != FASYNC_MAGIC) {
                         printk(KERN_ERR "kill_fasync: bad magic number in "
                                "fasync_struct!\n");
                         return;
                 }
-                spin_lock(&fa->fa_lock);
+                spin_lock_irqsave(&fa->fa_lock, flags);
                 if (fa->fa_file) {
                         fown = &fa->fa_file->f_owner;
                         /* Don't send SIGURG to processes which have not set a
@@ -747,7 +749,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
                         if (!(sig == SIGURG && fown->signum == 0))
                                 send_sigio(fown, fa->fa_fd, band);
                 }
-                spin_unlock(&fa->fa_lock);
+                spin_unlock_irqrestore(&fa->fa_lock, flags);
                 fa = rcu_dereference(fa->fa_next);
         }
 }
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index 46d4b5d72bd3..cb6306e63843 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -122,11 +122,20 @@ int task_statm(struct mm_struct *mm, int *shared, int *text,
         return size;
 }
 
+static void pad_len_spaces(struct seq_file *m, int len)
+{
+        len = 25 + sizeof(void*) * 6 - len;
+        if (len < 1)
+                len = 1;
+        seq_printf(m, "%*c", len, ' ');
+}
+
 /*
  * display a single VMA to a sequenced file
  */
 static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
 {
+        struct mm_struct *mm = vma->vm_mm;
         unsigned long ino = 0;
         struct file *file;
         dev_t dev = 0;
@@ -155,11 +164,14 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
                    MAJOR(dev), MINOR(dev), ino, &len);
 
         if (file) {
-                len = 25 + sizeof(void *) * 6 - len;
-                if (len < 1)
-                        len = 1;
-                seq_printf(m, "%*c", len, ' ');
+                pad_len_spaces(m, len);
                 seq_path(m, &file->f_path, "");
+        } else if (mm) {
+                if (vma->vm_start <= mm->start_stack &&
+                        vma->vm_end >= mm->start_stack) {
+                        pad_len_spaces(m, len);
+                        seq_puts(m, "[stack]");
+                }
         }
 
         seq_putc(m, '\n');
diff --git a/fs/sysv/ialloc.c b/fs/sysv/ialloc.c
index bbd69bdb0fa8..fcc498ec9b33 100644
--- a/fs/sysv/ialloc.c
+++ b/fs/sysv/ialloc.c
@@ -25,6 +25,7 @@
 #include <linux/stat.h>
 #include <linux/string.h>
 #include <linux/buffer_head.h>
+#include <linux/writeback.h>
 #include "sysv.h"
 
 /* We don't trust the value of
@@ -139,6 +140,9 @@ struct inode * sysv_new_inode(const struct inode * dir, mode_t mode)
         struct inode *inode;
         sysv_ino_t ino;
         unsigned count;
+        struct writeback_control wbc = {
+                .sync_mode = WB_SYNC_NONE
+        };
 
         inode = new_inode(sb);
         if (!inode)
@@ -168,7 +172,7 @@ struct inode * sysv_new_inode(const struct inode * dir, mode_t mode)
         insert_inode_hash(inode);
         mark_inode_dirty(inode);
 
-        sysv_write_inode(inode, 0);     /* ensure inode not allocated again */
+        sysv_write_inode(inode, &wbc);  /* ensure inode not allocated again */
         mark_inode_dirty(inode);        /* cleared by sysv_write_inode() */
         /* That's it. */
         unlock_super(sb);
diff --git a/fs/xfs/linux-2.6/xfs_export.c b/fs/xfs/linux-2.6/xfs_export.c
index 846b75aeb2ab..e7839ee49e43 100644
--- a/fs/xfs/linux-2.6/xfs_export.c
+++ b/fs/xfs/linux-2.6/xfs_export.c
@@ -128,13 +128,12 @@ xfs_nfs_get_inode(
                 return ERR_PTR(-ESTALE);
 
         /*
-         * The XFS_IGET_BULKSTAT means that an invalid inode number is just
-         * fine and not an indication of a corrupted filesystem.  Because
-         * clients can send any kind of invalid file handle, e.g. after
-         * a restore on the server we have to deal with this case gracefully.
+         * The XFS_IGET_UNTRUSTED means that an invalid inode number is just
+         * fine and not an indication of a corrupted filesystem as clients can
+         * send invalid file handles and we have to handle it gracefully..
          */
-        error = xfs_iget(mp, NULL, ino, XFS_IGET_BULKSTAT,
-                         XFS_ILOCK_SHARED, &ip, 0);
+        error = xfs_iget(mp, NULL, ino, XFS_IGET_UNTRUSTED,
+                         XFS_ILOCK_SHARED, &ip);
         if (error) {
                 /*
                  * EINVAL means the inode cluster doesn't exist anymore.
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index 699b60cbab9c..e59a81062830 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -679,10 +679,9 @@ xfs_ioc_bulkstat(
                 error = xfs_bulkstat_single(mp, &inlast,
                                                 bulkreq.ubuffer, &done);
         else    /* XFS_IOC_FSBULKSTAT */
-                error = xfs_bulkstat(mp, &inlast, &count,
-                        (bulkstat_one_pf)xfs_bulkstat_one, NULL,
-                        sizeof(xfs_bstat_t), bulkreq.ubuffer,
-                        BULKSTAT_FG_QUICK, &done);
+                error = xfs_bulkstat(mp, &inlast, &count, xfs_bulkstat_one,
+                                     sizeof(xfs_bstat_t), bulkreq.ubuffer,
+                                     &done);
 
         if (error)
                 return -error;
diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/linux-2.6/xfs_ioctl32.c
index 9287135e9bfc..52ed49e6465c 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl32.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl32.c
@@ -237,15 +237,12 @@ xfs_bulkstat_one_compat(
         xfs_ino_t       ino,            /* inode number to get data for */
         void            __user *buffer, /* buffer to place output in */
         int             ubsize,         /* size of buffer */
-        void            *private_data,  /* my private data */
-        xfs_daddr_t     bno,            /* starting bno of inode cluster */
         int             *ubused,        /* bytes used by me */
-        void            *dibuff,        /* on-disk inode buffer */
         int             *stat)          /* BULKSTAT_RV_... */
 {
         return xfs_bulkstat_one_int(mp, ino, buffer, ubsize,
-                                    xfs_bulkstat_one_fmt_compat, bno,
-                                    ubused, dibuff, stat);
+                                    xfs_bulkstat_one_fmt_compat,
+                                    ubused, stat);
 }
 
 /* copied from xfs_ioctl.c */
@@ -298,13 +295,11 @@ xfs_compat_ioc_bulkstat(
                 int res;
 
                 error = xfs_bulkstat_one_compat(mp, inlast, bulkreq.ubuffer,
-                                sizeof(compat_xfs_bstat_t),
-                                NULL, 0, NULL, NULL, &res);
+                                sizeof(compat_xfs_bstat_t), 0, &res);
         } else if (cmd == XFS_IOC_FSBULKSTAT_32) {
                 error = xfs_bulkstat(mp, &inlast, &count,
-                        xfs_bulkstat_one_compat, NULL,
-                        sizeof(compat_xfs_bstat_t), bulkreq.ubuffer,
-                        BULKSTAT_FG_QUICK, &done);
+                        xfs_bulkstat_one_compat, sizeof(compat_xfs_bstat_t),
+                        bulkreq.ubuffer, &done);
         } else
                 error = XFS_ERROR(EINVAL);
         if (error)
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 2d8b7bc792c9..8c117ff2e3ab 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -1632,10 +1632,7 @@ xfs_qm_dqusage_adjust(
         xfs_ino_t       ino,            /* inode number to get data for */
         void            __user *buffer, /* not used */
         int             ubsize,         /* not used */
-        void            *private_data,  /* not used */
-        xfs_daddr_t     bno,            /* starting block of inode cluster */
         int             *ubused,        /* not used */
-        void            *dip,           /* on-disk inode pointer (not used) */
         int             *res)           /* result code value */
 {
         xfs_inode_t     *ip;
@@ -1660,7 +1657,7 @@ xfs_qm_dqusage_adjust(
          * the case in all other instances. It's OK that we do this because
          * quotacheck is done only at mount time.
          */
-        if ((error = xfs_iget(mp, NULL, ino, 0, XFS_ILOCK_EXCL, &ip, bno))) {
+        if ((error = xfs_iget(mp, NULL, ino, 0, XFS_ILOCK_EXCL, &ip))) {
                 *res = BULKSTAT_RV_NOTHING;
                 return error;
         }
@@ -1796,12 +1793,13 @@ xfs_qm_quotacheck(
                  * Iterate thru all the inodes in the file system,
                  * adjusting the corresponding dquot counters in core.
                  */
-                if ((error = xfs_bulkstat(mp, &lastino, &count,
-                                     xfs_qm_dqusage_adjust, NULL,
-                                     structsz, NULL, BULKSTAT_FG_IGET, &done)))
+                error = xfs_bulkstat(mp, &lastino, &count,
+                                     xfs_qm_dqusage_adjust,
+                                     structsz, NULL, &done);
+                if (error)
                         break;
 
-        } while (! done);
+        } while (!done);
 
         /*
          * We've made all the changes that we need to make incore.
@@ -1889,14 +1887,14 @@ xfs_qm_init_quotainos(
                     mp->m_sb.sb_uquotino != NULLFSINO) {
                         ASSERT(mp->m_sb.sb_uquotino > 0);
                         if ((error = xfs_iget(mp, NULL, mp->m_sb.sb_uquotino,
-                                             0, 0, &uip, 0)))
+                                             0, 0, &uip)))
                                 return XFS_ERROR(error);
                 }
                 if (XFS_IS_OQUOTA_ON(mp) &&
                     mp->m_sb.sb_gquotino != NULLFSINO) {
                         ASSERT(mp->m_sb.sb_gquotino > 0);
                         if ((error = xfs_iget(mp, NULL, mp->m_sb.sb_gquotino,
-                                             0, 0, &gip, 0))) {
+                                             0, 0, &gip))) {
                                 if (uip)
                                         IRELE(uip);
                                 return XFS_ERROR(error);
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 92b002f1805f..b4487764e923 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -262,7 +262,7 @@ xfs_qm_scall_trunc_qfiles(
         }
 
         if ((flags & XFS_DQ_USER) && mp->m_sb.sb_uquotino != NULLFSINO) {
-                error = xfs_iget(mp, NULL, mp->m_sb.sb_uquotino, 0, 0, &qip, 0);
+                error = xfs_iget(mp, NULL, mp->m_sb.sb_uquotino, 0, 0, &qip);
                 if (!error) {
                         error = xfs_truncate_file(mp, qip);
                         IRELE(qip);
@@ -271,7 +271,7 @@ xfs_qm_scall_trunc_qfiles(
 
         if ((flags & (XFS_DQ_GROUP|XFS_DQ_PROJ)) &&
             mp->m_sb.sb_gquotino != NULLFSINO) {
-                error2 = xfs_iget(mp, NULL, mp->m_sb.sb_gquotino, 0, 0, &qip, 0);
+                error2 = xfs_iget(mp, NULL, mp->m_sb.sb_gquotino, 0, 0, &qip);
                 if (!error2) {
                         error2 = xfs_truncate_file(mp, qip);
                         IRELE(qip);
@@ -417,12 +417,12 @@ xfs_qm_scall_getqstat(
         }
         if (!uip && mp->m_sb.sb_uquotino != NULLFSINO) {
                 if (xfs_iget(mp, NULL, mp->m_sb.sb_uquotino,
-                                        0, 0, &uip, 0) == 0)
+                                        0, 0, &uip) == 0)
                         tempuqip = B_TRUE;
         }
         if (!gip && mp->m_sb.sb_gquotino != NULLFSINO) {
                 if (xfs_iget(mp, NULL, mp->m_sb.sb_gquotino,
-                                        0, 0, &gip, 0) == 0)
+                                        0, 0, &gip) == 0)
                         tempgqip = B_TRUE;
         }
         if (uip) {
@@ -1109,10 +1109,7 @@ xfs_qm_internalqcheck_adjust(
         xfs_ino_t       ino,            /* inode number to get data for */
         void            __user *buffer, /* not used */
         int             ubsize,         /* not used */
-        void            *private_data,  /* not used */
-        xfs_daddr_t     bno,            /* starting block of inode cluster */
         int             *ubused,        /* not used */
-        void            *dip,           /* not used */
         int             *res)           /* bulkstat result code */
 {
         xfs_inode_t             *ip;
@@ -1134,7 +1131,7 @@ xfs_qm_internalqcheck_adjust(
         ipreleased = B_FALSE;
  again:
         lock_flags = XFS_ILOCK_SHARED;
-        if ((error = xfs_iget(mp, NULL, ino, 0, lock_flags, &ip, bno))) {
+        if ((error = xfs_iget(mp, NULL, ino, 0, lock_flags, &ip))) {
                 *res = BULKSTAT_RV_NOTHING;
                 return (error);
         }
@@ -1205,15 +1202,15 @@ xfs_qm_internalqcheck(
                  * Iterate thru all the inodes in the file system,
                  * adjusting the corresponding dquot counters
                  */
-                if ((error = xfs_bulkstat(mp, &lastino, &count,
-                                 xfs_qm_internalqcheck_adjust, NULL,
-                                 0, NULL, BULKSTAT_FG_IGET, &done))) {
+                error = xfs_bulkstat(mp, &lastino, &count,
+                                 xfs_qm_internalqcheck_adjust,
+                                 0, NULL, &done);
+                if (error) {
+                        cmn_err(CE_DEBUG, "Bulkstat returned error 0x%x", error);
                         break;
                 }
-        } while (! done);
-        if (error) {
-                cmn_err(CE_DEBUG, "Bulkstat returned error 0x%x", error);
-        }
+        } while (!done);
+
         cmn_err(CE_DEBUG, "Checking results against system dquots");
         for (i = 0; i < qmtest_hashmask; i++) {
                 xfs_dqtest_t    *d, *n;
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index 5bba29a07812..7f159d2a429a 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -69,7 +69,9 @@ xfs_swapext(
                 goto out;
         }
 
-        if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) {
+        if (!(file->f_mode & FMODE_WRITE) ||
+            !(file->f_mode & FMODE_READ) ||
+            (file->f_flags & O_APPEND)) {
                 error = XFS_ERROR(EBADF);
                 goto out_put_file;
         }
@@ -81,6 +83,7 @@ xfs_swapext(
         }
 
         if (!(tmp_file->f_mode & FMODE_WRITE) ||
+            !(tmp_file->f_mode & FMODE_READ) ||
             (tmp_file->f_flags & O_APPEND)) {
                 error = XFS_ERROR(EBADF);
                 goto out_put_tmp_file;
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index 9d884c127bb9..c7142a064c48 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -1203,6 +1203,63 @@ error0:
         return error;
 }
 
+STATIC int
+xfs_imap_lookup(
+        struct xfs_mount        *mp,
+        struct xfs_trans        *tp,
+        xfs_agnumber_t          agno,
+        xfs_agino_t             agino,
+        xfs_agblock_t           agbno,
+        xfs_agblock_t           *chunk_agbno,
+        xfs_agblock_t           *offset_agbno,
+        int                     flags)
+{
+        struct xfs_inobt_rec_incore rec;
+        struct xfs_btree_cur    *cur;
+        struct xfs_buf          *agbp;
+        xfs_agino_t             startino;
+        int                     error;
+        int                     i;
+
+        error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
+        if (error) {
+                xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
+                                "xfs_ialloc_read_agi() returned "
+                                "error %d, agno %d",
+                                error, agno);
+                return error;
+        }
+
+        /*
+         * derive and lookup the exact inode record for the given agino. If the
+         * record cannot be found, then it's an invalid inode number and we
+         * should abort.
+         */
+        cur = xfs_inobt_init_cursor(mp, tp, agbp, agno);
+        startino = agino & ~(XFS_IALLOC_INODES(mp) - 1);
+        error = xfs_inobt_lookup(cur, startino, XFS_LOOKUP_EQ, &i);
+        if (!error) {
+                if (i)
+                        error = xfs_inobt_get_rec(cur, &rec, &i);
+                if (!error && i == 0)
+                        error = EINVAL;
+        }
+
+        xfs_trans_brelse(tp, agbp);
+        xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
+        if (error)
+                return error;
+
+        /* for untrusted inodes check it is allocated first */
+        if ((flags & XFS_IGET_UNTRUSTED) &&
+            (rec.ir_free & XFS_INOBT_MASK(agino - rec.ir_startino)))
+                return EINVAL;
+
+        *chunk_agbno = XFS_AGINO_TO_AGBNO(mp, rec.ir_startino);
+        *offset_agbno = agbno - *chunk_agbno;
+        return 0;
+}
+
 /*
  * Return the location of the inode in imap, for mapping it into a buffer.
  */
@@ -1235,8 +1292,11 @@ xfs_imap(
         if (agno >= mp->m_sb.sb_agcount || agbno >= mp->m_sb.sb_agblocks ||
             ino != XFS_AGINO_TO_INO(mp, agno, agino)) {
 #ifdef DEBUG
-                /* no diagnostics for bulkstat, ino comes from userspace */
-                if (flags & XFS_IGET_BULKSTAT)
+                /*
+                 * Don't output diagnostic information for untrusted inodes
+                 * as they can be invalid without implying corruption.
+                 */
+                if (flags & XFS_IGET_UNTRUSTED)
                         return XFS_ERROR(EINVAL);
                 if (agno >= mp->m_sb.sb_agcount) {
                         xfs_fs_cmn_err(CE_ALERT, mp,
@@ -1263,6 +1323,23 @@ xfs_imap(
                 return XFS_ERROR(EINVAL);
         }
 
+        blks_per_cluster = XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_blocklog;
+
+        /*
+         * For bulkstat and handle lookups, we have an untrusted inode number
+         * that we have to verify is valid. We cannot do this just by reading
+         * the inode buffer as it may have been unlinked and removed leaving
+         * inodes in stale state on disk. Hence we have to do a btree lookup
+         * in all cases where an untrusted inode number is passed.
+         */
+        if (flags & XFS_IGET_UNTRUSTED) {
+                error = xfs_imap_lookup(mp, tp, agno, agino, agbno,
+                                        &chunk_agbno, &offset_agbno, flags);
+                if (error)
+                        return error;
+                goto out_map;
+        }
+
         /*
          * If the inode cluster size is the same as the blocksize or
          * smaller we get to the buffer by simple arithmetics.
@@ -1277,24 +1354,6 @@ xfs_imap(
                 return 0;
         }
 
-        blks_per_cluster = XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_blocklog;
-
-        /*
-         * If we get a block number passed from bulkstat we can use it to
-         * find the buffer easily.
-         */
-        if (imap->im_blkno) {
-                offset = XFS_INO_TO_OFFSET(mp, ino);
-                ASSERT(offset < mp->m_sb.sb_inopblock);
-
-                cluster_agbno = xfs_daddr_to_agbno(mp, imap->im_blkno);
-                offset += (agbno - cluster_agbno) * mp->m_sb.sb_inopblock;
-
-                imap->im_len = XFS_FSB_TO_BB(mp, blks_per_cluster);
-                imap->im_boffset = (ushort)(offset << mp->m_sb.sb_inodelog);
-                return 0;
-        }
-
         /*
          * If the inode chunks are aligned then use simple maths to
          * find the location. Otherwise we have to do a btree
@@ -1304,50 +1363,13 @@ xfs_imap(
                 offset_agbno = agbno & mp->m_inoalign_mask;
                 chunk_agbno = agbno - offset_agbno;
         } else {
-                xfs_btree_cur_t *cur;   /* inode btree cursor */
-                xfs_inobt_rec_incore_t chunk_rec;
-                xfs_buf_t       *agbp;  /* agi buffer */
-                int             i;      /* temp state */
-
-                error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
-                if (error) {
-                        xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
-                                        "xfs_ialloc_read_agi() returned "
-                                        "error %d, agno %d",
-                                        error, agno);
-                        return error;
-                }
-
-                cur = xfs_inobt_init_cursor(mp, tp, agbp, agno);
-                error = xfs_inobt_lookup(cur, agino, XFS_LOOKUP_LE, &i);
-                if (error) {
-                        xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
-                                        "xfs_inobt_lookup() failed");
-                        goto error0;
-                }
-
-                error = xfs_inobt_get_rec(cur, &chunk_rec, &i);
-                if (error) {
-                        xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
-                                        "xfs_inobt_get_rec() failed");
-                        goto error0;
-                }
-                if (i == 0) {
-#ifdef DEBUG
-                        xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
-                                        "xfs_inobt_get_rec() failed");
-#endif /* DEBUG */
-                        error = XFS_ERROR(EINVAL);
-                }
- error0:
-                xfs_trans_brelse(tp, agbp);
-                xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
+                error = xfs_imap_lookup(mp, tp, agno, agino, agbno,
+                                        &chunk_agbno, &offset_agbno, flags);
                 if (error)
                         return error;
-                chunk_agbno = XFS_AGINO_TO_AGBNO(mp, chunk_rec.ir_startino);
-                offset_agbno = agbno - chunk_agbno;
         }
 
+out_map:
         ASSERT(agbno >= chunk_agbno);
         cluster_agbno = chunk_agbno +
                 ((offset_agbno / blks_per_cluster) * blks_per_cluster);
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index 75df75f43d48..8f8b91be2c99 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -259,7 +259,6 @@ xfs_iget_cache_miss(
         xfs_trans_t             *tp,
         xfs_ino_t               ino,
         struct xfs_inode        **ipp,
-        xfs_daddr_t             bno,
         int                     flags,
         int                     lock_flags)
 {
@@ -272,7 +271,7 @@ xfs_iget_cache_miss(
         if (!ip)
                 return ENOMEM;
 
-        error = xfs_iread(mp, tp, ip, bno, flags);
+        error = xfs_iread(mp, tp, ip, flags);
         if (error)
                 goto out_destroy;
 
@@ -358,8 +357,6 @@ out_destroy:
  *        within the file system for the inode being requested.
  * lock_flags -- flags indicating how to lock the inode.  See the comment
  *               for xfs_ilock() for a list of valid values.
- * bno -- the block number starting the buffer containing the inode,
- *        if known (as by bulkstat), else 0.
  */
 int
 xfs_iget(
@@ -368,8 +365,7 @@ xfs_iget(
         xfs_ino_t       ino,
         uint            flags,
         uint            lock_flags,
-        xfs_inode_t     **ipp,
-        xfs_daddr_t     bno)
+        xfs_inode_t     **ipp)
 {
         xfs_inode_t     *ip;
         int             error;
@@ -397,7 +393,7 @@ again:
                 read_unlock(&pag->pag_ici_lock);
                 XFS_STATS_INC(xs_ig_missed);
 
-                error = xfs_iget_cache_miss(mp, pag, tp, ino, &ip, bno,
+                error = xfs_iget_cache_miss(mp, pag, tp, ino, &ip,
                                                         flags, lock_flags);
                 if (error)
                         goto out_error_or_again;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index d53c39de7d05..b76a829d7e20 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -177,7 +177,7 @@ xfs_imap_to_bp(
                 if (unlikely(XFS_TEST_ERROR(!di_ok, mp,
                                                 XFS_ERRTAG_ITOBP_INOTOBP,
                                                 XFS_RANDOM_ITOBP_INOTOBP))) {
-                        if (iget_flags & XFS_IGET_BULKSTAT) {
+                        if (iget_flags & XFS_IGET_UNTRUSTED) {
                                 xfs_trans_brelse(tp, bp);
                                 return XFS_ERROR(EINVAL);
                         }
@@ -787,7 +787,6 @@ xfs_iread(
         xfs_mount_t     *mp,
         xfs_trans_t     *tp,
         xfs_inode_t     *ip,
-        xfs_daddr_t     bno,
         uint            iget_flags)
 {
         xfs_buf_t       *bp;
@@ -797,11 +796,9 @@ xfs_iread(
         /*
          * Fill in the location information in the in-core inode.
          */
-        ip->i_imap.im_blkno = bno;
         error = xfs_imap(mp, tp, ip->i_ino, &ip->i_imap, iget_flags);
         if (error)
                 return error;
-        ASSERT(bno == 0 || bno == ip->i_imap.im_blkno);
 
         /*
          * Get pointers to the on-disk inode and the buffer containing it.
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 9965e40a4615..78550df13cd6 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -442,7 +442,7 @@ static inline void xfs_ifunlock(xfs_inode_t *ip)
  * xfs_iget.c prototypes.
  */
 int             xfs_iget(struct xfs_mount *, struct xfs_trans *, xfs_ino_t,
-                         uint, uint, xfs_inode_t **, xfs_daddr_t);
+                         uint, uint, xfs_inode_t **);
 void            xfs_iput(xfs_inode_t *, uint);
 void            xfs_iput_new(xfs_inode_t *, uint);
 void            xfs_ilock(xfs_inode_t *, uint);
@@ -500,7 +500,7 @@ do { \
  * Flags for xfs_iget()
  */
 #define XFS_IGET_CREATE         0x1
-#define XFS_IGET_BULKSTAT       0x2
+#define XFS_IGET_UNTRUSTED      0x2
 
 int             xfs_inotobp(struct xfs_mount *, struct xfs_trans *,
                             xfs_ino_t, struct xfs_dinode **,
@@ -509,7 +509,7 @@ int		xfs_itobp(struct xfs_mount *, struct xfs_trans *,
                           struct xfs_inode *, struct xfs_dinode **,
                           struct xfs_buf **, uint);
 int             xfs_iread(struct xfs_mount *, struct xfs_trans *,
-                          struct xfs_inode *, xfs_daddr_t, uint);
+                          struct xfs_inode *, uint);
 void            xfs_dinode_to_disk(struct xfs_dinode *,
                                    struct xfs_icdinode *);
 void            xfs_idestroy_fork(struct xfs_inode *, int);
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index b1b801e4a28e..2b86f8610512 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -49,24 +49,40 @@ xfs_internal_inum(
                  (ino == mp->m_sb.sb_uquotino || ino == mp->m_sb.sb_gquotino)));
 }
 
-STATIC int
-xfs_bulkstat_one_iget(
-        xfs_mount_t     *mp,            /* mount point for filesystem */
-        xfs_ino_t       ino,            /* inode number to get data for */
-        xfs_daddr_t     bno,            /* starting bno of inode cluster */
-        xfs_bstat_t     *buf,           /* return buffer */
-        int             *stat)          /* BULKSTAT_RV_... */
+/*
+ * Return stat information for one inode.
+ * Return 0 if ok, else errno.
+ */
+int
+xfs_bulkstat_one_int(
+        struct xfs_mount        *mp,            /* mount point for filesystem */
+        xfs_ino_t               ino,            /* inode to get data for */
+        void __user             *buffer,        /* buffer to place output in */
+        int                     ubsize,         /* size of buffer */
+        bulkstat_one_fmt_pf     formatter,      /* formatter, copy to user */
+        int                     *ubused,        /* bytes used by me */
+        int                     *stat)          /* BULKSTAT_RV_... */
 {
-        xfs_icdinode_t  *dic;   /* dinode core info pointer */
-        xfs_inode_t     *ip;            /* incore inode pointer */
-        struct inode    *inode;
-        int             error;
+        struct xfs_icdinode     *dic;           /* dinode core info pointer */
+        struct xfs_inode        *ip;            /* incore inode pointer */
+        struct inode            *inode;
+        struct xfs_bstat        *buf;           /* return buffer */
+        int                     error = 0;      /* error value */
+
+        *stat = BULKSTAT_RV_NOTHING;
+
+        if (!buffer || xfs_internal_inum(mp, ino))
+                return XFS_ERROR(EINVAL);
+
+        buf = kmem_alloc(sizeof(*buf), KM_SLEEP | KM_MAYFAIL);
+        if (!buf)
+                return XFS_ERROR(ENOMEM);
 
         error = xfs_iget(mp, NULL, ino,
-                         XFS_IGET_BULKSTAT, XFS_ILOCK_SHARED, &ip, bno);
+                         XFS_IGET_UNTRUSTED, XFS_ILOCK_SHARED, &ip);
         if (error) {
                 *stat = BULKSTAT_RV_NOTHING;
-                return error;
+                goto out_free;
         }
 
         ASSERT(ip != NULL);
@@ -127,77 +143,16 @@ xfs_bulkstat_one_iget(
                 buf->bs_blocks = dic->di_nblocks + ip->i_delayed_blks;
                 break;
         }
-
         xfs_iput(ip, XFS_ILOCK_SHARED);
-        return error;
-}
 
-STATIC void
-xfs_bulkstat_one_dinode(
-        xfs_mount_t     *mp,            /* mount point for filesystem */
-        xfs_ino_t       ino,            /* inode number to get data for */
-        xfs_dinode_t    *dic,           /* dinode inode pointer */
-        xfs_bstat_t     *buf)           /* return buffer */
-{
-        /*
-         * The inode format changed when we moved the link count and
-         * made it 32 bits long.  If this is an old format inode,
-         * convert it in memory to look like a new one.  If it gets
-         * flushed to disk we will convert back before flushing or
-         * logging it.  We zero out the new projid field and the old link
-         * count field.  We'll handle clearing the pad field (the remains
-         * of the old uuid field) when we actually convert the inode to
-         * the new format. We don't change the version number so that we
-         * can distinguish this from a real new format inode.
-         */
-        if (dic->di_version == 1) {
-                buf->bs_nlink = be16_to_cpu(dic->di_onlink);
-                buf->bs_projid = 0;
-        } else {
-                buf->bs_nlink = be32_to_cpu(dic->di_nlink);
-                buf->bs_projid = be16_to_cpu(dic->di_projid);
-        }
+        error = formatter(buffer, ubsize, ubused, buf);
 
-        buf->bs_ino = ino;
-        buf->bs_mode = be16_to_cpu(dic->di_mode);
-        buf->bs_uid = be32_to_cpu(dic->di_uid);
-        buf->bs_gid = be32_to_cpu(dic->di_gid);
-        buf->bs_size = be64_to_cpu(dic->di_size);
-        buf->bs_atime.tv_sec = be32_to_cpu(dic->di_atime.t_sec);
-        buf->bs_atime.tv_nsec = be32_to_cpu(dic->di_atime.t_nsec);
-        buf->bs_mtime.tv_sec = be32_to_cpu(dic->di_mtime.t_sec);
-        buf->bs_mtime.tv_nsec = be32_to_cpu(dic->di_mtime.t_nsec);
-        buf->bs_ctime.tv_sec = be32_to_cpu(dic->di_ctime.t_sec);
-        buf->bs_ctime.tv_nsec = be32_to_cpu(dic->di_ctime.t_nsec);
-        buf->bs_xflags = xfs_dic2xflags(dic);
-        buf->bs_extsize = be32_to_cpu(dic->di_extsize) << mp->m_sb.sb_blocklog;
-        buf->bs_extents = be32_to_cpu(dic->di_nextents);
-        buf->bs_gen = be32_to_cpu(dic->di_gen);
-        memset(buf->bs_pad, 0, sizeof(buf->bs_pad));
-        buf->bs_dmevmask = be32_to_cpu(dic->di_dmevmask);
-        buf->bs_dmstate = be16_to_cpu(dic->di_dmstate);
-        buf->bs_aextents = be16_to_cpu(dic->di_anextents);
-        buf->bs_forkoff = XFS_DFORK_BOFF(dic);
+        if (!error)
+                *stat = BULKSTAT_RV_DIDONE;
 
-        switch (dic->di_format) {
-        case XFS_DINODE_FMT_DEV:
-                buf->bs_rdev = xfs_dinode_get_rdev(dic);
-                buf->bs_blksize = BLKDEV_IOSIZE;
-                buf->bs_blocks = 0;
-                break;
-        case XFS_DINODE_FMT_LOCAL:
-        case XFS_DINODE_FMT_UUID:
-                buf->bs_rdev = 0;
-                buf->bs_blksize = mp->m_sb.sb_blocksize;
-                buf->bs_blocks = 0;
-                break;
-        case XFS_DINODE_FMT_EXTENTS:
-        case XFS_DINODE_FMT_BTREE:
-                buf->bs_rdev = 0;
-                buf->bs_blksize = mp->m_sb.sb_blocksize;
-                buf->bs_blocks = be64_to_cpu(dic->di_nblocks);
-                break;
-        }
+ out_free:
+        kmem_free(buf);
+        return error;
 }
 
 /* Return 0 on success or positive error */
@@ -217,118 +172,17 @@ xfs_bulkstat_one_fmt(
         return 0;
 }
 
-/*
- * Return stat information for one inode.
- * Return 0 if ok, else errno.
- */
-int                                     /* error status */
-xfs_bulkstat_one_int(
-        xfs_mount_t     *mp,            /* mount point for filesystem */
-        xfs_ino_t       ino,            /* inode number to get data for */
-        void            __user *buffer, /* buffer to place output in */
-        int             ubsize,         /* size of buffer */
-        bulkstat_one_fmt_pf formatter,  /* formatter, copy to user */
-        xfs_daddr_t     bno,            /* starting bno of inode cluster */
-        int             *ubused,        /* bytes used by me */
-        void            *dibuff,        /* on-disk inode buffer */
-        int             *stat)          /* BULKSTAT_RV_... */
-{
-        xfs_bstat_t     *buf;           /* return buffer */
-        int             error = 0;      /* error value */
-        xfs_dinode_t    *dip;           /* dinode inode pointer */
-
-        dip = (xfs_dinode_t *)dibuff;
-        *stat = BULKSTAT_RV_NOTHING;
-
-        if (!buffer || xfs_internal_inum(mp, ino))
-                return XFS_ERROR(EINVAL);
-
-        buf = kmem_alloc(sizeof(*buf), KM_SLEEP);
-
-        if (dip == NULL) {
-                /* We're not being passed a pointer to a dinode.  This happens
-                 * if BULKSTAT_FG_IGET is selected.  Do the iget.
-                 */
-                error = xfs_bulkstat_one_iget(mp, ino, bno, buf, stat);
-                if (error)
-                        goto out_free;
-        } else {
-                xfs_bulkstat_one_dinode(mp, ino, dip, buf);
-        }
-
-        error = formatter(buffer, ubsize, ubused, buf);
-        if (error)
-                goto out_free;
-
-        *stat = BULKSTAT_RV_DIDONE;
-
- out_free:
-        kmem_free(buf);
-        return error;
-}
-
 int
 xfs_bulkstat_one(
         xfs_mount_t     *mp,            /* mount point for filesystem */
         xfs_ino_t       ino,            /* inode number to get data for */
         void            __user *buffer, /* buffer to place output in */
         int             ubsize,         /* size of buffer */
-        void            *private_data,  /* my private data */
-        xfs_daddr_t     bno,            /* starting bno of inode cluster */
         int             *ubused,        /* bytes used by me */
-        void            *dibuff,        /* on-disk inode buffer */
         int             *stat)          /* BULKSTAT_RV_... */
 {
         return xfs_bulkstat_one_int(mp, ino, buffer, ubsize,
-                                    xfs_bulkstat_one_fmt, bno,
-                                    ubused, dibuff, stat);
-}
-
-/*
- * Test to see whether we can use the ondisk inode directly, based
- * on the given bulkstat flags, filling in dipp accordingly.
- * Returns zero if the inode is dodgey.
- */
-STATIC int
-xfs_bulkstat_use_dinode(
-        xfs_mount_t     *mp,
-        int             flags,
-        xfs_buf_t       *bp,
-        int             clustidx,
-        xfs_dinode_t    **dipp)
-{
-        xfs_dinode_t    *dip;
-        unsigned int    aformat;
-
-        *dipp = NULL;
-        if (!bp || (flags & BULKSTAT_FG_IGET))
-                return 1;
-        dip = (xfs_dinode_t *)
-                        xfs_buf_offset(bp, clustidx << mp->m_sb.sb_inodelog);
-        /*
-         * Check the buffer containing the on-disk inode for di_mode == 0.
-         * This is to prevent xfs_bulkstat from picking up just reclaimed
-         * inodes that have their in-core state initialized but not flushed
-         * to disk yet. This is a temporary hack that would require a proper
-         * fix in the future.
-         */
-        if (be16_to_cpu(dip->di_magic) != XFS_DINODE_MAGIC ||
-            !XFS_DINODE_GOOD_VERSION(dip->di_version) ||
-            !dip->di_mode)
-                return 0;
-        if (flags & BULKSTAT_FG_QUICK) {
-                *dipp = dip;
-                return 1;
-        }
-        /* BULKSTAT_FG_INLINE: if attr fork is local, or not there, use it */
-        aformat = dip->di_aformat;
-        if ((XFS_DFORK_Q(dip) == 0) ||
-            (aformat == XFS_DINODE_FMT_LOCAL) ||
-            (aformat == XFS_DINODE_FMT_EXTENTS && !dip->di_anextents)) {
-                *dipp = dip;
-                return 1;
-        }
-        return 1;
+                                    xfs_bulkstat_one_fmt, ubused, stat);
 }
 
 #define XFS_BULKSTAT_UBLEFT(ubleft)     ((ubleft) >= statstruct_size)
@@ -342,10 +196,8 @@ xfs_bulkstat(
         xfs_ino_t               *lastinop, /* last inode returned */
         int                     *ubcountp, /* size of buffer/count returned */
         bulkstat_one_pf         formatter, /* func that'd fill a single buf */
-        void                    *private_data,/* private data for formatter */
         size_t                  statstruct_size, /* sizeof struct filling */
         char                    __user *ubuffer, /* buffer with inode stats */
-        int                     flags,  /* defined in xfs_itable.h */
         int                     *done)  /* 1 if there are more stats to get */
 {
         xfs_agblock_t           agbno=0;/* allocation group block number */
@@ -380,14 +232,12 @@ xfs_bulkstat(
         int                     ubelem; /* spaces used in user's buffer */
         int                     ubused; /* bytes used by formatter */
         xfs_buf_t               *bp;    /* ptr to on-disk inode cluster buf */
-        xfs_dinode_t            *dip;   /* ptr into bp for specific inode */
 
         /*
          * Get the last inode value, see if there's nothing to do.
          */
         ino = (xfs_ino_t)*lastinop;
         lastino = ino;
-        dip = NULL;
         agno = XFS_INO_TO_AGNO(mp, ino);
         agino = XFS_INO_TO_AGINO(mp, ino);
         if (agno >= mp->m_sb.sb_agcount ||
@@ -612,37 +462,6 @@ xfs_bulkstat(
                                                         irbp->ir_startino) +
                                                 ((chunkidx & nimask) >>
                                                  mp->m_sb.sb_inopblog);
-
-                                        if (flags & (BULKSTAT_FG_QUICK |
-                                                     BULKSTAT_FG_INLINE)) {
-                                                int offset;
-
-                                                ino = XFS_AGINO_TO_INO(mp, agno,
-                                                                       agino);
-                                                bno = XFS_AGB_TO_DADDR(mp, agno,
-                                                                       agbno);
-
-                                                /*
-                                                 * Get the inode cluster buffer
-                                                 */
-                                                if (bp)
-                                                        xfs_buf_relse(bp);
-
-                                                error = xfs_inotobp(mp, NULL, ino, &dip,
-                                                                    &bp, &offset,
-                                                                    XFS_IGET_BULKSTAT);
-
-                                                if (!error)
-                                                        clustidx = offset / mp->m_sb.sb_inodesize;
-                                                if (XFS_TEST_ERROR(error != 0,
-                                                                   mp, XFS_ERRTAG_BULKSTAT_READ_CHUNK,
-                                                                   XFS_RANDOM_BULKSTAT_READ_CHUNK)) {
-                                                        bp = NULL;
-                                                        ubleft = 0;
-                                                        rval = error;
-                                                        break;
-                                                }
-                                        }
                                 }
                                 ino = XFS_AGINO_TO_INO(mp, agno, agino);
                                 bno = XFS_AGB_TO_DADDR(mp, agno, agbno);
@@ -658,35 +477,13 @@ xfs_bulkstat(
                                  * when the chunk is used up.
                                  */
                                 irbp->ir_freecount++;
-                                if (!xfs_bulkstat_use_dinode(mp, flags, bp,
-                                                             clustidx, &dip)) {
-                                        lastino = ino;
-                                        continue;
-                                }
-                                /*
-                                 * If we need to do an iget, cannot hold bp.
-                                 * Drop it, until starting the next cluster.
-                                 */
-                                if ((flags & BULKSTAT_FG_INLINE) && !dip) {
-                                        if (bp)
-                                                xfs_buf_relse(bp);
-                                        bp = NULL;
-                                }
 
                                 /*
                                  * Get the inode and fill in a single buffer.
-                                 * BULKSTAT_FG_QUICK uses dip to fill it in.
-                                 * BULKSTAT_FG_IGET uses igets.
-                                 * BULKSTAT_FG_INLINE uses dip if we have an
-                                 * inline attr fork, else igets.
-                                 * See: xfs_bulkstat_one & xfs_dm_bulkstat_one.
-                                 * This is also used to count inodes/blks, etc
-                                 * in xfs_qm_quotacheck.
                                  */
                                 ubused = statstruct_size;
-                                error = formatter(mp, ino, ubufp,
-                                                ubleft, private_data,
-                                                bno, &ubused, dip, &fmterror);
+                                error = formatter(mp, ino, ubufp, ubleft,
+                                                  &ubused, &fmterror);
                                 if (fmterror == BULKSTAT_RV_NOTHING) {
                                         if (error && error != ENOENT &&
                                                 error != EINVAL) {
@@ -778,8 +575,7 @@ xfs_bulkstat_single(
          */
 
         ino = (xfs_ino_t)*lastinop;
-        error = xfs_bulkstat_one(mp, ino, buffer, sizeof(xfs_bstat_t),
-                                 NULL, 0, NULL, NULL, &res);
+        error = xfs_bulkstat_one(mp, ino, buffer, sizeof(xfs_bstat_t), 0, &res);
         if (error) {
                 /*
                  * Special case way failed, do it the "long" way
@@ -788,8 +584,7 @@ xfs_bulkstat_single(
                 (*lastinop)--;
                 count = 1;
                 if (xfs_bulkstat(mp, lastinop, &count, xfs_bulkstat_one,
-                                NULL, sizeof(xfs_bstat_t), buffer,
-                                BULKSTAT_FG_IGET, done))
+                                sizeof(xfs_bstat_t), buffer, done))
                         return error;
                 if (count == 0 || (xfs_ino_t)*lastinop != ino)
                         return error == EFSCORRUPTED ?
diff --git a/fs/xfs/xfs_itable.h b/fs/xfs/xfs_itable.h
index 20792bf45946..97295d91d170 100644
--- a/fs/xfs/xfs_itable.h
+++ b/fs/xfs/xfs_itable.h
@@ -27,10 +27,7 @@ typedef int (*bulkstat_one_pf)(struct xfs_mount	*mp,
                                xfs_ino_t        ino,
                                void             __user *buffer,
                                int              ubsize,
-                               void             *private_data,
-                               xfs_daddr_t      bno,
                                int              *ubused,
-                               void             *dip,
                                int              *stat);
 
 /*
@@ -41,13 +38,6 @@ typedef int (*bulkstat_one_pf)(struct xfs_mount	*mp,
 #define BULKSTAT_RV_GIVEUP      2
 
 /*
- * Values for bulkstat flag argument.
- */
-#define BULKSTAT_FG_IGET        0x1     /* Go through the buffer cache */
-#define BULKSTAT_FG_QUICK       0x2     /* No iget, walk the dinode cluster */
-#define BULKSTAT_FG_INLINE      0x4     /* No iget if inline attrs */
-
-/*
  * Return stat information in bulk (by-inode) for the filesystem.
  */
 int                                     /* error status */
@@ -56,10 +46,8 @@ xfs_bulkstat(
         xfs_ino_t       *lastino,       /* last inode returned */
         int             *count,         /* size of buffer/count returned */
         bulkstat_one_pf formatter,      /* func that'd fill a single buf */
-        void            *private_data,  /* private data for formatter */
         size_t          statstruct_size,/* sizeof struct that we're filling */
         char            __user *ubuffer,/* buffer with inode stats */
-        int             flags,          /* flag to control access method */
         int             *done);         /* 1 if there are more stats to get */
 
 int
@@ -82,9 +70,7 @@ xfs_bulkstat_one_int(
         void                    __user *buffer,
         int                     ubsize,
         bulkstat_one_fmt_pf     formatter,
-        xfs_daddr_t             bno,
         int                     *ubused,
-        void                    *dibuff,
         int                     *stat);
 
 int
@@ -93,10 +79,7 @@ xfs_bulkstat_one(
         xfs_ino_t               ino,
         void                    __user *buffer,
         int                     ubsize,
-        void                    *private_data,
-        xfs_daddr_t             bno,
         int                     *ubused,
-        void                    *dibuff,
         int                     *stat);
 
 typedef int (*inumbers_fmt_pf)(
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index ed0684cc50ee..9ac5cfab27b9 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -3198,7 +3198,7 @@ xlog_recover_process_one_iunlink(
         int                             error;
 
         ino = XFS_AGINO_TO_INO(mp, agno, agino);
-        error = xfs_iget(mp, NULL, ino, 0, 0, &ip, 0);
+        error = xfs_iget(mp, NULL, ino, 0, 0, &ip);
         if (error)
                 goto fail;
 
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index d59f4e8bedcf..69f62d8b2816 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -1300,7 +1300,7 @@ xfs_mountfs(
          * Get and sanity-check the root inode.
          * Save the pointer to it in the mount structure.
          */
-        error = xfs_iget(mp, NULL, sbp->sb_rootino, 0, XFS_ILOCK_EXCL, &rip, 0);
+        error = xfs_iget(mp, NULL, sbp->sb_rootino, 0, XFS_ILOCK_EXCL, &rip);
         if (error) {
                 cmn_err(CE_WARN, "XFS: failed to read root inode");
                 goto out_log_dealloc;
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 16445518506d..a2d32ce335aa 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -2277,12 +2277,12 @@ xfs_rtmount_inodes(
         sbp = &mp->m_sb;
         if (sbp->sb_rbmino == NULLFSINO)
                 return 0;
-        error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip, 0);
+        error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip);
         if (error)
                 return error;
         ASSERT(mp->m_rbmip != NULL);
         ASSERT(sbp->sb_rsumino != NULLFSINO);
-        error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip, 0);
+        error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip);
         if (error) {
                 IRELE(mp->m_rbmip);
                 return error;
diff --git a/fs/xfs/xfs_trans_inode.c b/fs/xfs/xfs_trans_inode.c
index 785ff101da0a..2559dfec946b 100644
--- a/fs/xfs/xfs_trans_inode.c
+++ b/fs/xfs/xfs_trans_inode.c
@@ -62,7 +62,7 @@ xfs_trans_iget(
 {
         int                     error;
 
-        error = xfs_iget(mp, tp, ino, flags, lock_flags, ipp, 0);
+        error = xfs_iget(mp, tp, ino, flags, lock_flags, ipp);
         if (!error && tp)
                 xfs_trans_ijoin(tp, *ipp, lock_flags);
         return error;
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index a06bd62504fc..c1646838898f 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -1269,7 +1269,7 @@ xfs_lookup(
         if (error)
                 goto out;
 
-        error = xfs_iget(dp->i_mount, NULL, inum, 0, 0, ipp, 0);
+        error = xfs_iget(dp->i_mount, NULL, inum, 0, 0, ipp);
         if (error)
                 goto out_free_name;
 
diff --git a/include/drm/ttm/ttm_page_alloc.h b/include/drm/ttm/ttm_page_alloc.h
index 8bb4de567b2c..116821448c38 100644
--- a/include/drm/ttm/ttm_page_alloc.h
+++ b/include/drm/ttm/ttm_page_alloc.h
@@ -56,10 +56,6 @@ void ttm_put_pages(struct list_head *pages,
                    enum ttm_caching_state cstate);
 /**
  * Initialize pool allocator.
- *
- * Pool allocator is internaly reference counted so it can be initialized
- * multiple times but ttm_page_alloc_fini has to be called same number of
- * times.
  */
 int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages);
 /**
diff --git a/include/linux/agp_backend.h b/include/linux/agp_backend.h
index 9101ed64f803..09ea4a1e9505 100644
--- a/include/linux/agp_backend.h
+++ b/include/linux/agp_backend.h
@@ -79,7 +79,6 @@ struct agp_memory {
         u32 physical;
         bool is_bound;
         bool is_flushed;
-        bool vmalloc_flag;
         /* list of agp_memory mapped to the aperture */
         struct list_head mapped_list;
         /* DMA-mapped addresses */
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 73dcf804bc94..0da5b187f124 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -58,8 +58,12 @@
  * naked functions because then mcount is called without stack and frame pointer
  * being set up and there is no chance to restore the lr register to the value
  * before mcount was called.
+ *
+ * The asm() bodies of naked functions often depend on standard calling conventions,
+ * therefore they must be noinline and noclone.  GCC 4.[56] currently fail to enforce
+ * this, so we must do so ourselves.  See GCC PR44290.
  */
-#define __naked                         __attribute__((naked)) notrace
+#define __naked                         __attribute__((naked)) noinline __noclone notrace
 
 #define __noreturn                      __attribute__((noreturn))
 
@@ -85,3 +89,7 @@
 #define _gcc_header(x) __gcc_header(linux/compiler-gcc##x.h)
 #define gcc_header(x) _gcc_header(x)
 #include gcc_header(__GNUC__)
+
+#if !defined(__noclone)
+#define __noclone       /* not needed */
+#endif
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index 94dea3ffbfa1..fcfa5b9a4317 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -48,6 +48,10 @@
  * unreleased.  Really, we need to have autoconf for the kernel.
  */
 #define unreachable() __builtin_unreachable()
+
+/* Mark a function definition as prohibited from being cloned. */
+#define __noclone       __attribute__((__noclone__))
+
 #endif
 
 #endif
diff --git a/include/linux/dynamic_debug.h b/include/linux/dynamic_debug.h
index b3cd4de9432b..52c0da4bdd18 100644
--- a/include/linux/dynamic_debug.h
+++ b/include/linux/dynamic_debug.h
@@ -40,7 +40,7 @@ int ddebug_add_module(struct _ddebug *tab, unsigned int n,
                                 const char *modname);
 
 #if defined(CONFIG_DYNAMIC_DEBUG)
-extern int ddebug_remove_module(char *mod_name);
+extern int ddebug_remove_module(const char *mod_name);
 
 #define __dynamic_dbg_enabled(dd)  ({        \
         int __ret = 0;                                                       \
@@ -73,7 +73,7 @@ extern int ddebug_remove_module(char *mod_name);
 
 #else
 
-static inline int ddebug_remove_module(char *mod)
+static inline int ddebug_remove_module(const char *mod)
 {
         return 0;
 }
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index 276b40a16835..b4207ca3ad52 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -379,6 +379,8 @@ struct ethtool_rxnfc {
         __u32                           flow_type;
         /* The rx flow hash value or the rule DB size */
         __u64                           data;
+        /* The following fields are not valid and must not be used for
+         * the ETHTOOL_{G,X}RXFH commands. */
         struct ethtool_rx_flow_spec     fs;
         __u32                           rule_cnt;
         __u32                           rule_locs[0];
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 907ace3a64c8..8e5a9dfb76bf 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -786,8 +786,6 @@ struct fb_tile_ops {
 #define FBINFO_MISC_USEREVENT          0x10000 /* event request
                                                   from userspace */
 #define FBINFO_MISC_TILEBLITTING       0x20000 /* use tile blitting */
-#define FBINFO_MISC_FIRMWARE           0x40000 /* a replaceable firmware
-                                                  inited framebuffer */
 
 /* A driver may set this flag to indicate that it does want a set_par to be
  * called every time when fbcon_switch is executed. The advantage is that with
@@ -801,6 +799,8 @@ struct fb_tile_ops {
  */
 #define FBINFO_MISC_ALWAYS_SETPAR   0x40000
 
+/* where the fb is a firmware driver, and can be replaced with a proper one */
+#define FBINFO_MISC_FIRMWARE        0x80000
 /*
  * Host and GPU endianness differ.
  */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 471e1ff5079a..68ca1b0491af 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1783,6 +1783,19 @@ extern int get_sb_pseudo(struct file_system_type *, char *,
         struct vfsmount *mnt);
 extern void simple_set_mnt(struct vfsmount *mnt, struct super_block *sb);
 
+static inline void sb_mark_dirty(struct super_block *sb)
+{
+        sb->s_dirt = 1;
+}
+static inline void sb_mark_clean(struct super_block *sb)
+{
+        sb->s_dirt = 0;
+}
+static inline int sb_is_dirty(struct super_block *sb)
+{
+        return sb->s_dirt;
+}
+
 /* Alas, no aliases. Too much hassle with bringing module.h everywhere */
 #define fops_get(fops) \
         (((fops) && try_module_get((fops)->owner) ? (fops) : NULL))
diff --git a/include/linux/mv643xx_eth.h b/include/linux/mv643xx_eth.h
index cbbbe9bfecad..30b0c4e78f91 100644
--- a/include/linux/mv643xx_eth.h
+++ b/include/linux/mv643xx_eth.h
@@ -19,6 +19,11 @@ struct mv643xx_eth_shared_platform_data {
         struct mbus_dram_target_info    *dram;
         struct platform_device  *shared_smi;
         unsigned int            t_clk;
+        /*
+         * Max packet size for Tx IP/Layer 4 checksum, when set to 0, default
+         * limit of 9KiB will be used.
+         */
+        int                     tx_csum_limit;
 };
 
 #define MV643XX_ETH_PHY_ADDR_DEFAULT    0
diff --git a/include/linux/net.h b/include/linux/net.h
index 2b4deeeb8646..dee0b11a8759 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -129,10 +129,9 @@ struct socket_wq {
  *  @type: socket type (%SOCK_STREAM, etc)
  *  @flags: socket flags (%SOCK_ASYNC_NOSPACE, etc)
  *  @ops: protocol specific socket operations
- *  @fasync_list: Asynchronous wake up list
  *  @file: File back pointer for gc
  *  @sk: internal networking protocol agnostic socket representation
- *  @wait: wait queue for several uses
+ *  @wq: wait queue for several uses
  */
 struct socket {
         socket_state            state;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 40291f375024..b21e4054c12c 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1656,6 +1656,9 @@ static inline int netif_is_multiqueue(const struct net_device *dev)
         return (dev->num_tx_queues > 1);
 }
 
+extern void netif_set_real_num_tx_queues(struct net_device *dev,
+                                         unsigned int txq);
+
 /* Use this variant when it is known for sure that it
  * is executing from hardware interrupt context or with hardware interrupts
  * disabled.
@@ -2329,7 +2332,7 @@ do {								\
 #endif
 
 #if defined(VERBOSE_DEBUG)
-#define netif_vdbg      netdev_dbg
+#define netif_vdbg      netif_dbg
 #else
 #define netif_vdbg(priv, type, dev, format, args...)            \
 ({                                                              \
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 4eb467910a45..3bedcc149c84 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1261,6 +1261,7 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE       0x0759
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_SMBUS     0x07D8
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP79_SMBUS     0x0AA2
+#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA      0x0D85
 
 #define PCI_VENDOR_ID_IMS               0x10e0
 #define PCI_DEVICE_ID_IMS_TT128         0x9128
diff --git a/include/linux/rbtree.h b/include/linux/rbtree.h
index fe1872e5b37e..7066acb2c530 100644
--- a/include/linux/rbtree.h
+++ b/include/linux/rbtree.h
@@ -110,7 +110,6 @@ struct rb_node
 struct rb_root
 {
         struct rb_node *rb_node;
-        void (*augment_cb)(struct rb_node *node);
 };
 
 
@@ -130,9 +129,7 @@ static inline void rb_set_color(struct rb_node *rb, int color)
         rb->rb_parent_color = (rb->rb_parent_color & ~1) | color;
 }
 
-#define RB_ROOT (struct rb_root) { NULL, NULL, }
-#define RB_AUGMENT_ROOT(x)      (struct rb_root) { NULL, x}
-
+#define RB_ROOT (struct rb_root) { NULL, }
 #define rb_entry(ptr, type, member) container_of(ptr, type, member)
 
 #define RB_EMPTY_ROOT(root)     ((root)->rb_node == NULL)
@@ -142,6 +139,14 @@ static inline void rb_set_color(struct rb_node *rb, int color)
 extern void rb_insert_color(struct rb_node *, struct rb_root *);
 extern void rb_erase(struct rb_node *, struct rb_root *);
 
+typedef void (*rb_augment_f)(struct rb_node *node, void *data);
+
+extern void rb_augment_insert(struct rb_node *node,
+                              rb_augment_f func, void *data);
+extern struct rb_node *rb_augment_erase_begin(struct rb_node *node);
+extern void rb_augment_erase_end(struct rb_node *node,
+                                 rb_augment_f func, void *data);
+
 /* Find logical next and previous nodes in a tree */
 extern struct rb_node *rb_next(const struct rb_node *);
 extern struct rb_node *rb_prev(const struct rb_node *);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index f118809c953f..747fcaedddb7 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -139,7 +139,7 @@ extern int nr_processes(void);
 extern unsigned long nr_running(void);
 extern unsigned long nr_uninterruptible(void);
 extern unsigned long nr_iowait(void);
-extern unsigned long nr_iowait_cpu(void);
+extern unsigned long nr_iowait_cpu(int cpu);
 extern unsigned long this_cpu_load(void);
 
 
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 03ca5d826757..433604bb3fe8 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -313,12 +313,24 @@ extern void qdisc_calculate_pkt_len(struct sk_buff *skb,
 extern void tcf_destroy(struct tcf_proto *tp);
 extern void tcf_destroy_chain(struct tcf_proto **fl);
 
-/* Reset all TX qdiscs of a device.  */
+/* Reset all TX qdiscs greater then index of a device.  */
+static inline void qdisc_reset_all_tx_gt(struct net_device *dev, unsigned int i)
+{
+        struct Qdisc *qdisc;
+
+        for (; i < dev->num_tx_queues; i++) {
+                qdisc = netdev_get_tx_queue(dev, i)->qdisc;
+                if (qdisc) {
+                        spin_lock_bh(qdisc_lock(qdisc));
+                        qdisc_reset(qdisc);
+                        spin_unlock_bh(qdisc_lock(qdisc));
+                }
+        }
+}
+
 static inline void qdisc_reset_all_tx(struct net_device *dev)
 {
-        unsigned int i;
-        for (i = 0; i < dev->num_tx_queues; i++)
-                qdisc_reset(netdev_get_tx_queue(dev, i)->qdisc);
+        qdisc_reset_all_tx_gt(dev, 0);
 }
 
 /* Are all TX queues of the device empty?  */
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 1913af67c43d..fc8f36dd0f5c 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1586,7 +1586,7 @@ static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
 static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
 {
         if (attrs[XFRMA_MARK])
-                memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(m));
+                memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
         else
                 m->v = m->m = 0;
 
diff --git a/init/main.c b/init/main.c
index ac2e4a5f59ee..a42fdf4aeba9 100644
--- a/init/main.c
+++ b/init/main.c
@@ -424,18 +424,26 @@ static void __init setup_command_line(char *command_line)
  * gcc-3.4 accidentally inlines this function, so use noinline.
  */
 
+static __initdata DECLARE_COMPLETION(kthreadd_done);
+
 static noinline void __init_refok rest_init(void)
         __releases(kernel_lock)
 {
         int pid;
 
         rcu_scheduler_starting();
+        /*
+         * We need to spawn init first so that it obtains pid 1, however
+         * the init task will end up wanting to create kthreads, which, if
+         * we schedule it before we create kthreadd, will OOPS.
+         */
         kernel_thread(kernel_init, NULL, CLONE_FS | CLONE_SIGHAND);
         numa_default_policy();
         pid = kernel_thread(kthreadd, NULL, CLONE_FS | CLONE_FILES);
         rcu_read_lock();
         kthreadd_task = find_task_by_pid_ns(pid, &init_pid_ns);
         rcu_read_unlock();
+        complete(&kthreadd_done);
         unlock_kernel();
 
         /*
@@ -857,6 +865,10 @@ static noinline int init_post(void)
 
 static int __init kernel_init(void * unused)
 {
+        /*
+         * Wait until kthreadd is all set-up.
+         */
+        wait_for_completion(&kthreadd_done);
         lock_kernel();
 
         /*
diff --git a/kernel/futex.c b/kernel/futex.c
index e7a35f1039e7..6a3a5fa1526d 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -429,20 +429,11 @@ static void free_pi_state(struct futex_pi_state *pi_state)
 static struct task_struct * futex_find_get_task(pid_t pid)
 {
         struct task_struct *p;
-        const struct cred *cred = current_cred(), *pcred;
 
         rcu_read_lock();
         p = find_task_by_vpid(pid);
-        if (!p) {
-                p = ERR_PTR(-ESRCH);
-        } else {
-                pcred = __task_cred(p);
-                if (cred->euid != pcred->euid &&
-                    cred->euid != pcred->uid)
-                        p = ERR_PTR(-ESRCH);
-                else
-                        get_task_struct(p);
-        }
+        if (p)
+                get_task_struct(p);
 
         rcu_read_unlock();
 
@@ -564,8 +555,8 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
         if (!pid)
                 return -ESRCH;
         p = futex_find_get_task(pid);
-        if (IS_ERR(p))
-                return PTR_ERR(p);
+        if (!p)
+                return -ESRCH;
 
         /*
          * We need to look at the task state flags to figure out,
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 474a84715eac..131b1703936f 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1089,9 +1089,10 @@ void crash_kexec(struct pt_regs *regs)
 
 size_t crash_get_memory_size(void)
 {
-        size_t size;
+        size_t size = 0;
         mutex_lock(&kexec_mutex);
-        size = crashk_res.end - crashk_res.start + 1;
+        if (crashk_res.end != crashk_res.start)
+                size = crashk_res.end - crashk_res.start + 1;
         mutex_unlock(&kexec_mutex);
         return size;
 }
@@ -1134,7 +1135,7 @@ int crash_shrink_memory(unsigned long new_size)
 
         free_reserved_phys_range(end, crashk_res.end);
 
-        if (start == end)
+        if ((start == end) && (crashk_res.parent != NULL))
                 release_resource(&crashk_res);
         crashk_res.end = end - 1;
 
diff --git a/kernel/module.c b/kernel/module.c
index 8c6b42840dd1..5d2d28197c82 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2062,6 +2062,12 @@ static void dynamic_debug_setup(struct _ddebug *debug, unsigned int num)
 #endif
 }
 
+static void dynamic_debug_remove(struct _ddebug *debug)
+{
+        if (debug)
+                ddebug_remove_module(debug->modname);
+}
+
 static void *module_alloc_update_bounds(unsigned long size)
 {
         void *ret = module_alloc(size);
@@ -2124,6 +2130,8 @@ static noinline struct module *load_module(void __user *umod,
         void *ptr = NULL; /* Stops spurious gcc warning */
         unsigned long symoffs, stroffs, *strmap;
         void __percpu *percpu;
+        struct _ddebug *debug = NULL;
+        unsigned int num_debug = 0;
 
         mm_segment_t old_fs;
 
@@ -2476,15 +2484,9 @@ static noinline struct module *load_module(void __user *umod,
         kfree(strmap);
         strmap = NULL;
 
-        if (!mod->taints) {
-                struct _ddebug *debug;
-                unsigned int num_debug;
-
+        if (!mod->taints)
                 debug = section_objs(hdr, sechdrs, secstrings, "__verbose",
                                      sizeof(*debug), &num_debug);
-                if (debug)
-                        dynamic_debug_setup(debug, num_debug);
-        }
 
         err = module_finalize(hdr, sechdrs, mod);
         if (err < 0)
@@ -2526,10 +2528,13 @@ static noinline struct module *load_module(void __user *umod,
                 goto unlock;
         }
 
+        if (debug)
+                dynamic_debug_setup(debug, num_debug);
+
         /* Find duplicate symbols */
         err = verify_export_symbols(mod);
         if (err < 0)
-                goto unlock;
+                goto ddebug;
 
         list_add_rcu(&mod->list, &modules);
         mutex_unlock(&module_mutex);
@@ -2557,6 +2562,8 @@ static noinline struct module *load_module(void __user *umod,
         mutex_lock(&module_mutex);
         /* Unlink carefully: kallsyms could be walking list. */
         list_del_rcu(&mod->list);
+ ddebug:
+        dynamic_debug_remove(debug);
  unlock:
         mutex_unlock(&module_mutex);
         synchronize_sched();
diff --git a/kernel/sched.c b/kernel/sched.c
index cb816e36cc8b..f52a8801b7a2 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -2873,9 +2873,9 @@ unsigned long nr_iowait(void)
         return sum;
 }
 
-unsigned long nr_iowait_cpu(void)
+unsigned long nr_iowait_cpu(int cpu)
 {
-        struct rq *this = this_rq();
+        struct rq *this = cpu_rq(cpu);
         return atomic_read(&this->nr_iowait);
 }
 
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 783fbadf2202..813993b5fb61 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -154,14 +154,14 @@ static void tick_nohz_update_jiffies(ktime_t now)
  * Updates the per cpu time idle statistics counters
  */
 static void
-update_ts_time_stats(struct tick_sched *ts, ktime_t now, u64 *last_update_time)
+update_ts_time_stats(int cpu, struct tick_sched *ts, ktime_t now, u64 *last_update_time)
 {
         ktime_t delta;
 
         if (ts->idle_active) {
                 delta = ktime_sub(now, ts->idle_entrytime);
                 ts->idle_sleeptime = ktime_add(ts->idle_sleeptime, delta);
-                if (nr_iowait_cpu() > 0)
+                if (nr_iowait_cpu(cpu) > 0)
                         ts->iowait_sleeptime = ktime_add(ts->iowait_sleeptime, delta);
                 ts->idle_entrytime = now;
         }
@@ -175,19 +175,19 @@ static void tick_nohz_stop_idle(int cpu, ktime_t now)
 {
         struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
 
-        update_ts_time_stats(ts, now, NULL);
+        update_ts_time_stats(cpu, ts, now, NULL);
         ts->idle_active = 0;
 
         sched_clock_idle_wakeup_event(0);
 }
 
-static ktime_t tick_nohz_start_idle(struct tick_sched *ts)
+static ktime_t tick_nohz_start_idle(int cpu, struct tick_sched *ts)
 {
         ktime_t now;
 
         now = ktime_get();
 
-        update_ts_time_stats(ts, now, NULL);
+        update_ts_time_stats(cpu, ts, now, NULL);
 
         ts->idle_entrytime = now;
         ts->idle_active = 1;
@@ -216,7 +216,7 @@ u64 get_cpu_idle_time_us(int cpu, u64 *last_update_time)
         if (!tick_nohz_enabled)
                 return -1;
 
-        update_ts_time_stats(ts, ktime_get(), last_update_time);
+        update_ts_time_stats(cpu, ts, ktime_get(), last_update_time);
 
         return ktime_to_us(ts->idle_sleeptime);
 }
@@ -242,7 +242,7 @@ u64 get_cpu_iowait_time_us(int cpu, u64 *last_update_time)
         if (!tick_nohz_enabled)
                 return -1;
 
-        update_ts_time_stats(ts, ktime_get(), last_update_time);
+        update_ts_time_stats(cpu, ts, ktime_get(), last_update_time);
 
         return ktime_to_us(ts->iowait_sleeptime);
 }
@@ -284,7 +284,7 @@ void tick_nohz_stop_sched_tick(int inidle)
          */
         ts->inidle = 1;
 
-        now = tick_nohz_start_idle(ts);
+        now = tick_nohz_start_idle(cpu, ts);
 
         /*
          * If this cpu is offline and it is the one which updates
diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index 3df8eb17a607..02afc2533728 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -692,7 +692,7 @@ static void ddebug_table_free(struct ddebug_table *dt)
  * Called in response to a module being unloaded.  Removes
  * any ddebug_table's which point at the module.
  */
-int ddebug_remove_module(char *mod_name)
+int ddebug_remove_module(const char *mod_name)
 {
         struct ddebug_table *dt, *nextdt;
         int ret = -ENOENT;
diff --git a/lib/genalloc.c b/lib/genalloc.c
index 736c3b06398e..1923f1490e72 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -128,7 +128,6 @@ unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size)
                 chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk);
 
                 end_bit = (chunk->end_addr - chunk->start_addr) >> order;
-                end_bit -= nbits + 1;
 
                 spin_lock_irqsave(&chunk->lock, flags);
                 start_bit = bitmap_find_next_zero_area(chunk->bits, end_bit, 0,
diff --git a/lib/rbtree.c b/lib/rbtree.c
index 15e10b1afdd2..4693f79195d3 100644
--- a/lib/rbtree.c
+++ b/lib/rbtree.c
@@ -44,11 +44,6 @@ static void __rb_rotate_left(struct rb_node *node, struct rb_root *root)
         else
                 root->rb_node = right;
         rb_set_parent(node, right);
-
-        if (root->augment_cb) {
-                root->augment_cb(node);
-                root->augment_cb(right);
-        }
 }
 
 static void __rb_rotate_right(struct rb_node *node, struct rb_root *root)
@@ -72,20 +67,12 @@ static void __rb_rotate_right(struct rb_node *node, struct rb_root *root)
         else
                 root->rb_node = left;
         rb_set_parent(node, left);
-
-        if (root->augment_cb) {
-                root->augment_cb(node);
-                root->augment_cb(left);
-        }
 }
 
 void rb_insert_color(struct rb_node *node, struct rb_root *root)
 {
         struct rb_node *parent, *gparent;
 
-        if (root->augment_cb)
-                root->augment_cb(node);
-
         while ((parent = rb_parent(node)) && rb_is_red(parent))
         {
                 gparent = rb_parent(parent);
@@ -240,15 +227,12 @@ void rb_erase(struct rb_node *node, struct rb_root *root)
         else
         {
                 struct rb_node *old = node, *left;
-                int old_parent_cb = 0;
-                int successor_parent_cb = 0;
 
                 node = node->rb_right;
                 while ((left = node->rb_left) != NULL)
                         node = left;
 
                 if (rb_parent(old)) {
-                        old_parent_cb = 1;
                         if (rb_parent(old)->rb_left == old)
                                 rb_parent(old)->rb_left = node;
                         else
@@ -263,10 +247,8 @@ void rb_erase(struct rb_node *node, struct rb_root *root)
                 if (parent == old) {
                         parent = node;
                 } else {
-                        successor_parent_cb = 1;
                         if (child)
                                 rb_set_parent(child, parent);
-
                         parent->rb_left = child;
 
                         node->rb_right = old->rb_right;
@@ -277,24 +259,6 @@ void rb_erase(struct rb_node *node, struct rb_root *root)
                 node->rb_left = old->rb_left;
                 rb_set_parent(old->rb_left, node);
 
-                if (root->augment_cb) {
-                        /*
-                         * Here, three different nodes can have new children.
-                         * The parent of the successor node that was selected
-                         * to replace the node to be erased.
-                         * The node that is getting erased and is now replaced
-                         * by its successor.
-                         * The parent of the node getting erased-replaced.
-                         */
-                        if (successor_parent_cb)
-                                root->augment_cb(parent);
-
-                        root->augment_cb(node);
-
-                        if (old_parent_cb)
-                                root->augment_cb(rb_parent(old));
-                }
-
                 goto color;
         }
 
@@ -303,19 +267,15 @@ void rb_erase(struct rb_node *node, struct rb_root *root)
 
         if (child)
                 rb_set_parent(child, parent);
-
-        if (parent) {
+        if (parent)
+        {
                 if (parent->rb_left == node)
                         parent->rb_left = child;
                 else
                         parent->rb_right = child;
-
-                if (root->augment_cb)
-                        root->augment_cb(parent);
-
-        } else {
-                root->rb_node = child;
         }
+        else
+                root->rb_node = child;
 
  color:
         if (color == RB_BLACK)
@@ -323,6 +283,74 @@ void rb_erase(struct rb_node *node, struct rb_root *root)
 }
 EXPORT_SYMBOL(rb_erase);
 
+static void rb_augment_path(struct rb_node *node, rb_augment_f func, void *data)
+{
+        struct rb_node *parent;
+
+up:
+        func(node, data);
+        parent = rb_parent(node);
+        if (!parent)
+                return;
+
+        if (node == parent->rb_left && parent->rb_right)
+                func(parent->rb_right, data);
+        else if (parent->rb_left)
+                func(parent->rb_left, data);
+
+        node = parent;
+        goto up;
+}
+
+/*
+ * after inserting @node into the tree, update the tree to account for
+ * both the new entry and any damage done by rebalance
+ */
+void rb_augment_insert(struct rb_node *node, rb_augment_f func, void *data)
+{
+        if (node->rb_left)
+                node = node->rb_left;
+        else if (node->rb_right)
+                node = node->rb_right;
+
+        rb_augment_path(node, func, data);
+}
+
+/*
+ * before removing the node, find the deepest node on the rebalance path
+ * that will still be there after @node gets removed
+ */
+struct rb_node *rb_augment_erase_begin(struct rb_node *node)
+{
+        struct rb_node *deepest;
+
+        if (!node->rb_right && !node->rb_left)
+                deepest = rb_parent(node);
+        else if (!node->rb_right)
+                deepest = node->rb_left;
+        else if (!node->rb_left)
+                deepest = node->rb_right;
+        else {
+                deepest = rb_next(node);
+                if (deepest->rb_right)
+                        deepest = deepest->rb_right;
+                else if (rb_parent(deepest) != node)
+                        deepest = rb_parent(deepest);
+        }
+
+        return deepest;
+}
+
+/*
+ * after removal, update the tree to account for the removed entry
+ * and any rebalance damage.
+ */
+void rb_augment_erase_end(struct rb_node *node, rb_augment_f func, void *data)
+{
+        if (node)
+                rb_augment_path(node, func, data);
+}
+
 /*
  * This function returns the first node (in sort order) of the tree.
  */
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index c6ece0a57595..20a8193a7af8 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1370,7 +1370,7 @@ static void memcg_wakeup_oom(struct mem_cgroup *mem)
 
 static void memcg_oom_recover(struct mem_cgroup *mem)
 {
-        if (mem->oom_kill_disable && atomic_read(&mem->oom_lock))
+        if (atomic_read(&mem->oom_lock))
                 memcg_wakeup_oom(mem);
 }
 
@@ -3781,6 +3781,8 @@ static int mem_cgroup_oom_control_write(struct cgroup *cgrp,
                 return -EINVAL;
         }
         mem->oom_kill_disable = val;
+        if (!val)
+                memcg_oom_recover(mem);
         cgroup_unlock();
         return 0;
 }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 5d6fb339de03..5bc0a96beb51 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2094,7 +2094,7 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
                 NODEMASK_SCRATCH(scratch);
 
                 if (!scratch)
-                        return;
+                        goto put_mpol;
                 /* contextualize the tmpfs mount point mempolicy */
                 new = mpol_new(mpol->mode, mpol->flags, &mpol->w.user_nodemask);
                 if (IS_ERR(new))
@@ -2103,19 +2103,20 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
                 task_lock(current);
                 ret = mpol_set_nodemask(new, &mpol->w.user_nodemask, scratch);
                 task_unlock(current);
-                mpol_put(mpol); /* drop our ref on sb mpol */
                 if (ret)
-                        goto put_free;
+                        goto put_new;
 
                 /* Create pseudo-vma that contains just the policy */
                 memset(&pvma, 0, sizeof(struct vm_area_struct));
                 pvma.vm_end = TASK_SIZE;        /* policy covers entire file */
                 mpol_set_shared_policy(sp, &pvma, new); /* adds ref */
 
-put_free:
+put_new:
                 mpol_put(new);                  /* drop initial ref */
 free_scratch:
                 NODEMASK_SCRATCH_FREE(scratch);
+put_mpol:
+                mpol_put(mpol); /* drop our incoming ref on sb mpol */
         }
 }
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 9d21d98ae5fa..27ae946363f1 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -99,6 +99,15 @@ static struct net_bridge_mdb_entry *__br_mdb_ip_get(
         return NULL;
 }
 
+static struct net_bridge_mdb_entry *br_mdb_ip_get(
+        struct net_bridge_mdb_htable *mdb, struct br_ip *dst)
+{
+        if (!mdb)
+                return NULL;
+
+        return __br_mdb_ip_get(mdb, dst, br_ip_hash(mdb, dst));
+}
+
 static struct net_bridge_mdb_entry *br_mdb_ip4_get(
         struct net_bridge_mdb_htable *mdb, __be32 dst)
 {
@@ -107,7 +116,7 @@ static struct net_bridge_mdb_entry *br_mdb_ip4_get(
         br_dst.u.ip4 = dst;
         br_dst.proto = htons(ETH_P_IP);
 
-        return __br_mdb_ip_get(mdb, &br_dst, __br_ip4_hash(mdb, dst));
+        return br_mdb_ip_get(mdb, &br_dst);
 }
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
@@ -119,23 +128,17 @@ static struct net_bridge_mdb_entry *br_mdb_ip6_get(
         ipv6_addr_copy(&br_dst.u.ip6, dst);
         br_dst.proto = htons(ETH_P_IPV6);
 
-        return __br_mdb_ip_get(mdb, &br_dst, __br_ip6_hash(mdb, dst));
+        return br_mdb_ip_get(mdb, &br_dst);
 }
 #endif
 
-static struct net_bridge_mdb_entry *br_mdb_ip_get(
-        struct net_bridge_mdb_htable *mdb, struct br_ip *dst)
-{
-        return __br_mdb_ip_get(mdb, dst, br_ip_hash(mdb, dst));
-}
-
 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
                                         struct sk_buff *skb)
 {
         struct net_bridge_mdb_htable *mdb = br->mdb;
         struct br_ip ip;
 
-        if (!mdb || br->multicast_disabled)
+        if (br->multicast_disabled)
                 return NULL;
 
         if (BR_INPUT_SKB_CB(skb)->igmp)
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 44420992f72f..8fb75f89c4aa 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -591,6 +591,9 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
 
         pskb_trim_rcsum(skb, len);
 
+        /* BUG: Should really parse the IP options here. */
+        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+
         nf_bridge_put(skb->nf_bridge);
         if (!nf_bridge_alloc(skb))
                 return NF_DROP;
diff --git a/net/core/dev.c b/net/core/dev.c
index 2b3bf53bc687..723a34710ad4 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1553,6 +1553,24 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
         rcu_read_unlock();
 }
 
+/*
+ * Routine to help set real_num_tx_queues. To avoid skbs mapped to queues
+ * greater then real_num_tx_queues stale skbs on the qdisc must be flushed.
+ */
+void netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
+{
+        unsigned int real_num = dev->real_num_tx_queues;
+
+        if (unlikely(txq > dev->num_tx_queues))
+                ;
+        else if (txq > real_num)
+                dev->real_num_tx_queues = txq;
+        else if (txq < real_num) {
+                dev->real_num_tx_queues = txq;
+                qdisc_reset_all_tx_gt(dev, txq);
+        }
+}
+EXPORT_SYMBOL(netif_set_real_num_tx_queues);
 
 static inline void __netif_reschedule(struct Qdisc *q)
 {
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index a0f4964033d2..75e4ffeb8cc9 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -318,23 +318,33 @@ out:
 }
 
 static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
-                                                void __user *useraddr)
+                                                u32 cmd, void __user *useraddr)
 {
-        struct ethtool_rxnfc cmd;
+        struct ethtool_rxnfc info;
+        size_t info_size = sizeof(info);
 
         if (!dev->ethtool_ops->set_rxnfc)
                 return -EOPNOTSUPP;
 
-        if (copy_from_user(&cmd, useraddr, sizeof(cmd)))
+        /* struct ethtool_rxnfc was originally defined for
+         * ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data
+         * members.  User-space might still be using that
+         * definition. */
+        if (cmd == ETHTOOL_SRXFH)
+                info_size = (offsetof(struct ethtool_rxnfc, data) +
+                             sizeof(info.data));
+
+        if (copy_from_user(&info, useraddr, info_size))
                 return -EFAULT;
 
-        return dev->ethtool_ops->set_rxnfc(dev, &cmd);
+        return dev->ethtool_ops->set_rxnfc(dev, &info);
 }
 
 static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
-                                                void __user *useraddr)
+                                                u32 cmd, void __user *useraddr)
 {
         struct ethtool_rxnfc info;
+        size_t info_size = sizeof(info);
         const struct ethtool_ops *ops = dev->ethtool_ops;
         int ret;
         void *rule_buf = NULL;
@@ -342,13 +352,22 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
         if (!ops->get_rxnfc)
                 return -EOPNOTSUPP;
 
-        if (copy_from_user(&info, useraddr, sizeof(info)))
+        /* struct ethtool_rxnfc was originally defined for
+         * ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data
+         * members.  User-space might still be using that
+         * definition. */
+        if (cmd == ETHTOOL_GRXFH)
+                info_size = (offsetof(struct ethtool_rxnfc, data) +
+                             sizeof(info.data));
+
+        if (copy_from_user(&info, useraddr, info_size))
                 return -EFAULT;
 
         if (info.cmd == ETHTOOL_GRXCLSRLALL) {
                 if (info.rule_cnt > 0) {
-                        rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
-                                           GFP_USER);
+                        if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
+                                rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+                                                   GFP_USER);
                         if (!rule_buf)
                                 return -ENOMEM;
                 }
@@ -359,7 +378,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
                 goto err_out;
 
         ret = -EFAULT;
-        if (copy_to_user(useraddr, &info, sizeof(info)))
+        if (copy_to_user(useraddr, &info, info_size))
                 goto err_out;
 
         if (rule_buf) {
@@ -1516,12 +1535,12 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GRXCLSRLCNT:
         case ETHTOOL_GRXCLSRULE:
         case ETHTOOL_GRXCLSRLALL:
-                rc = ethtool_get_rxnfc(dev, useraddr);
+                rc = ethtool_get_rxnfc(dev, ethcmd, useraddr);
                 break;
         case ETHTOOL_SRXFH:
         case ETHTOOL_SRXCLSRLDEL:
         case ETHTOOL_SRXCLSRLINS:
-                rc = ethtool_set_rxnfc(dev, useraddr);
+                rc = ethtool_set_rxnfc(dev, ethcmd, useraddr);
                 break;
         case ETHTOOL_GGRO:
                 rc = ethtool_get_gro(dev, useraddr);
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 1705476670ef..23883a48ebfb 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -108,6 +108,8 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
         u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
 
         memset(fl, 0, sizeof(struct flowi));
+        fl->mark = skb->mark;
+
         if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
                 switch (iph->protocol) {
                 case IPPROTO_UDP:
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 47d227713758..2933396e0281 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -97,9 +97,11 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
         fl.fl_ip_dport = otcph.source;
         security_skb_classify_flow(oldskb, &fl);
         dst = ip6_route_output(net, NULL, &fl);
-        if (dst == NULL)
+        if (dst == NULL || dst->error) {
+                dst_release(dst);
                 return;
-        if (dst->error || xfrm_lookup(net, &dst, &fl, NULL, 0))
+        }
+        if (xfrm_lookup(net, &dst, &fl, NULL, 0))
                 return;
 
         hh_len = (dst->dev->hard_header_len + 15)&~15;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 4a0e77e14468..6baeabbbca82 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -124,6 +124,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
         u8 nexthdr = nh[IP6CB(skb)->nhoff];
 
         memset(fl, 0, sizeof(struct flowi));
+        fl->mark = skb->mark;
+
         ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr);
         ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr);
 
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index f8779006986d..f6127b9f5aca 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -503,6 +503,11 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname)
                     strncmp(symname, "_rest32gpr_", sizeof("_rest32gpr_") - 1) == 0 ||
                     strncmp(symname, "_save32gpr_", sizeof("_save32gpr_") - 1) == 0)
                         return 1;
+        if (info->hdr->e_machine == EM_PPC64)
+                /* Special register function linked on all modules during final link of .ko */
+                if (strncmp(symname, "_restgpr0_", sizeof("_restgpr0_") - 1) == 0 ||
+                    strncmp(symname, "_savegpr0_", sizeof("_savegpr0_") - 1) == 0)
+                        return 1;
         /* Do not ignore this symbol */
         return 0;
 }
diff --git a/scripts/package/Makefile b/scripts/package/Makefile
index 62fcc3a7f4d3..3a681ef25306 100644
--- a/scripts/package/Makefile
+++ b/scripts/package/Makefile
@@ -44,7 +44,7 @@ rpm-pkg rpm: $(objtree)/kernel.spec FORCE
         fi
         $(MAKE) clean
         $(PREV) ln -sf $(srctree) $(KERNELPATH)
-        $(CONFIG_SHELL) $(srctree)/scripts/setlocalversion > $(objtree)/.scmversion
+        $(CONFIG_SHELL) $(srctree)/scripts/setlocalversion --scm-only > $(objtree)/.scmversion
         $(PREV) tar -cz $(RCS_TAR_IGNORE) -f $(KERNELPATH).tar.gz $(KERNELPATH)/.
         $(PREV) rm $(KERNELPATH)
         rm -f $(objtree)/.scmversion
diff --git a/scripts/setlocalversion b/scripts/setlocalversion
index 46989b88d734..d6a866ed1835 100755
--- a/scripts/setlocalversion
+++ b/scripts/setlocalversion
@@ -10,73 +10,158 @@
 #
 
 usage() {
-        echo "Usage: $0 [srctree]" >&2
+        echo "Usage: $0 [--scm-only] [srctree]" >&2
         exit 1
 }
 
-cd "${1:-.}" || usage
+scm_only=false
+srctree=.
+if test "$1" = "--scm-only"; then
+        scm_only=true
+        shift
+fi
+if test $# -gt 0; then
+        srctree=$1
+        shift
+fi
+if test $# -gt 0 -o ! -d "$srctree"; then
+        usage
+fi
 
-# Check for git and a git repo.
-if head=`git rev-parse --verify --short HEAD 2>/dev/null`; then
+scm_version()
+{
+        local short=false
 
-        # If we are at a tagged commit (like "v2.6.30-rc6"), we ignore it,
-        # because this version is defined in the top level Makefile.
-        if [ -z "`git describe --exact-match 2>/dev/null`" ]; then
+        cd "$srctree"
+        if test -e .scmversion; then
+                cat "$_"
+                return
+        fi
+        if test "$1" = "--short"; then
+                short=true
+        fi
 
-                # If we are past a tagged commit (like "v2.6.30-rc5-302-g72357d5"),
-                # we pretty print it.
-                if atag="`git describe 2>/dev/null`"; then
-                        echo "$atag" | awk -F- '{printf("-%05d-%s", $(NF-1),$(NF))}'
+        # Check for git and a git repo.
+        if head=`git rev-parse --verify --short HEAD 2>/dev/null`; then
+
+                # If we are at a tagged commit (like "v2.6.30-rc6"), we ignore
+                # it, because this version is defined in the top level Makefile.
+                if [ -z "`git describe --exact-match 2>/dev/null`" ]; then
+
+                        # If only the short version is requested, don't bother
+                        # running further git commands
+                        if $short; then
+                                echo "+"
+                                return
+                        fi
+                        # If we are past a tagged commit (like
+                        # "v2.6.30-rc5-302-g72357d5"), we pretty print it.
+                        if atag="`git describe 2>/dev/null`"; then
+                                echo "$atag" | awk -F- '{printf("-%05d-%s", $(NF-1),$(NF))}'
+
+                        # If we don't have a tag at all we print -g{commitish}.
+                        else
+                                printf '%s%s' -g $head
+                        fi
+                fi
 
-                # If we don't have a tag at all we print -g{commitish}.
-                else
-                        printf '%s%s' -g $head
+                # Is this git on svn?
+                if git config --get svn-remote.svn.url >/dev/null; then
+                        printf -- '-svn%s' "`git svn find-rev $head`"
                 fi
-        fi
 
-        # Is this git on svn?
-        if git config --get svn-remote.svn.url >/dev/null; then
-                printf -- '-svn%s' "`git svn find-rev $head`"
-        fi
+                # Update index only on r/w media
+                [ -w . ] && git update-index --refresh --unmerged > /dev/null
 
-        # Update index only on r/w media
-        [ -w . ] && git update-index --refresh --unmerged > /dev/null
+                # Check for uncommitted changes
+                if git diff-index --name-only HEAD | grep -v "^scripts/package" \
+                    | read dummy; then
+                        printf '%s' -dirty
+                fi
 
-        # Check for uncommitted changes
-        if git diff-index --name-only HEAD | grep -v "^scripts/package" \
-            | read dummy; then
-                printf '%s' -dirty
+                # All done with git
+                return
         fi
 
-        # All done with git
-        exit
-fi
+        # Check for mercurial and a mercurial repo.
+        if hgid=`hg id 2>/dev/null`; then
+                tag=`printf '%s' "$hgid" | cut -d' ' -f2`
+
+                # Do we have an untagged version?
+                if [ -z "$tag" -o "$tag" = tip ]; then
+                        id=`printf '%s' "$hgid" | sed 's/[+ ].*//'`
+                        printf '%s%s' -hg "$id"
+                fi
 
-# Check for mercurial and a mercurial repo.
-if hgid=`hg id 2>/dev/null`; then
-        tag=`printf '%s' "$hgid" | cut -d' ' -f2`
+                # Are there uncommitted changes?
+                # These are represented by + after the changeset id.
+                case "$hgid" in
+                        *+|*+\ *) printf '%s' -dirty ;;
+                esac
 
-        # Do we have an untagged version?
-        if [ -z "$tag" -o "$tag" = tip ]; then
-                id=`printf '%s' "$hgid" | sed 's/[+ ].*//'`
-                printf '%s%s' -hg "$id"
+                # All done with mercurial
+                return
         fi
 
-        # Are there uncommitted changes?
-        # These are represented by + after the changeset id.
-        case "$hgid" in
-                *+|*+\ *) printf '%s' -dirty ;;
-        esac
+        # Check for svn and a svn repo.
+        if rev=`svn info 2>/dev/null | grep '^Last Changed Rev'`; then
+                rev=`echo $rev | awk '{print $NF}'`
+                printf -- '-svn%s' "$rev"
 
-        # All done with mercurial
+                # All done with svn
+                return
+        fi
+}
+
+collect_files()
+{
+        local file res
+
+        for file; do
+                case "$file" in
+                *\~*)
+                        continue
+                        ;;
+                esac
+                if test -e "$file"; then
+                        res="$res$(cat "$file")"
+                fi
+        done
+        echo "$res"
+}
+
+if $scm_only; then
+        scm_version
         exit
 fi
 
-# Check for svn and a svn repo.
-if rev=`svn info 2>/dev/null | grep '^Last Changed Rev'`; then
-        rev=`echo $rev | awk '{print $NF}'`
-        printf -- '-svn%s' "$rev"
+if test -e include/config/auto.conf; then
+        source "$_"
+else
+        echo "Error: kernelrelease not valid - run 'make prepare' to update it"
+        exit 1
+fi
 
-        # All done with svn
-        exit
+# localversion* files in the build and source directory
+res="$(collect_files localversion*)"
+if test ! "$srctree" -ef .; then
+        res="$res$(collect_files "$srctree"/localversion*)"
+fi
+
+# CONFIG_LOCALVERSION and LOCALVERSION (if set)
+res="${res}${CONFIG_LOCALVERSION}${LOCALVERSION}"
+
+# scm version string if not at a tagged commit
+if test "$CONFIG_LOCALVERSION_AUTO" = "y"; then
+        # full scm version string
+        res="$res$(scm_version)"
+else
+        # apped a plus sign if the repository is not in a clean tagged
+        # state and  LOCALVERSION= is not specified
+        if test "${LOCALVERSION+set}" != "set"; then
+                scm=$(scm_version --short)
+                res="$res${scm:++}"
+        fi
 fi
+
+echo "$res"
diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
index 1f7ecd47f499..9a448b47400c 100644
--- a/tools/perf/util/thread.c
+++ b/tools/perf/util/thread.c
@@ -7,6 +7,15 @@
 #include "util.h"
 #include "debug.h"
 
+/* Skip "." and ".." directories */
+static int filter(const struct dirent *dir)
+{
+        if (dir->d_name[0] == '.')
+                return 0;
+        else
+                return 1;
+}
+
 int find_all_tid(int pid, pid_t ** all_tid)
 {
         char name[256];
@@ -16,7 +25,7 @@ int find_all_tid(int pid, pid_t ** all_tid)
         int i;
 
         sprintf(name, "/proc/%d/task", pid);
-        items = scandir(name, &namelist, NULL, NULL);
+        items = scandir(name, &namelist, filter, NULL);
         if (items <= 0)
                 return -ENOENT;
         *all_tid = malloc(sizeof(pid_t) * items);