718 files changed, 7986 insertions, 6133 deletions

diff --git a/Documentation/ABI/testing/sysfs-bus-pci b/Documentation/ABI/testing/sysfs-bus-pci
index 428676cfa61e..25be3250f7d6 100644
--- a/Documentation/ABI/testing/sysfs-bus-pci
+++ b/Documentation/ABI/testing/sysfs-bus-pci
@@ -133,46 +133,6 @@ Description:
                 The symbolic link points to the PCI device sysfs entry of the
                 Physical Function this device associates with.
 
-
-What:           /sys/bus/pci/slots/...
-Date:           April 2005 (possibly older)
-KernelVersion:  2.6.12 (possibly older)
-Contact:        linux-pci@vger.kernel.org
-Description:
-                When the appropriate driver is loaded, it will create a
-                directory per claimed physical PCI slot in
-                /sys/bus/pci/slots/.  The names of these directories are
-                specific to the driver, which in turn, are specific to the
-                platform, but in general, should match the label on the
-                machine's physical chassis.
-
-                The drivers that can create slot directories include the
-                PCI hotplug drivers, and as of 2.6.27, the pci_slot driver.
-
-                The slot directories contain, at a minimum, a file named
-                'address' which contains the PCI bus:device:function tuple.
-                Other files may appear as well, but are specific to the
-                driver.
-
-What:           /sys/bus/pci/slots/.../function[0-7]
-Date:           March 2010
-KernelVersion:  2.6.35
-Contact:        linux-pci@vger.kernel.org
-Description:
-                If PCI slot directories (as described above) are created,
-                and the physical slot is actually populated with a device,
-                symbolic links in the slot directory pointing to the
-                device's PCI functions are created as well.
-
-What:           /sys/bus/pci/devices/.../slot
-Date:           March 2010
-KernelVersion:  2.6.35
-Contact:        linux-pci@vger.kernel.org
-Description:
-                If PCI slot directories (as described above) are created,
-                a symbolic link pointing to the slot directory will be
-                created as well.
-
 What:           /sys/bus/pci/slots/.../module
 Date:           June 2009
 Contact:        linux-pci@vger.kernel.org
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 1808f1157f30..82d6aeb5228f 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2048,7 +2048,9 @@ and is between 256 and 4096 characters. It is defined in the file
                         WARNING: Forcing ASPM on may cause system lockups.
 
         pcie_pme=       [PCIE,PM] Native PCIe PME signaling options:
-                off     Do not use native PCIe PME signaling.
+                        Format: {auto|force}[,nomsi]
+                auto    Use native PCIe PME signaling if the BIOS allows the
+                        kernel to control PCIe config registers of root ports.
                 force   Use native PCIe PME signaling even if the BIOS refuses
                         to allow the kernel to control the relevant PCIe config
                         registers.
diff --git a/Documentation/video4linux/CARDLIST.tuner b/Documentation/video4linux/CARDLIST.tuner
index 9b2e0dd6017e..e67c1db96854 100644
--- a/Documentation/video4linux/CARDLIST.tuner
+++ b/Documentation/video4linux/CARDLIST.tuner
@@ -82,3 +82,4 @@ tuner=81 - Partsnic (Daewoo) PTI-5NF05
 tuner=82 - Philips CU1216L
 tuner=83 - NXP TDA18271
 tuner=84 - Sony BTF-Pxn01Z
+tuner=85 - Philips FQ1236 MK5
diff --git a/Documentation/watchdog/watchdog-parameters.txt b/Documentation/watchdog/watchdog-parameters.txt
index 41c95cc1dc1f..17ddd822b456 100644
--- a/Documentation/watchdog/watchdog-parameters.txt
+++ b/Documentation/watchdog/watchdog-parameters.txt
@@ -125,6 +125,11 @@ ibmasr:
 nowayout: Watchdog cannot be stopped once started
         (default=kernel config parameter)
 -------------------------------------------------
+imx2_wdt:
+timeout: Watchdog timeout in seconds (default 60 s)
+nowayout: Watchdog cannot be stopped once started
+        (default=kernel config parameter)
+-------------------------------------------------
 indydog:
 nowayout: Watchdog cannot be stopped once started
         (default=kernel config parameter)
diff --git a/MAINTAINERS b/MAINTAINERS
index 67accd730ac9..58848125b8bf 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -896,11 +896,13 @@ S:	Maintained
 
 ARM/SAMSUNG ARM ARCHITECTURES
 M:      Ben Dooks <ben-linux@fluff.org>
+M:      Kukjin Kim <kgene.kim@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.fluff.org/ben/linux/
 S:      Maintained
-F:      arch/arm/plat-s3c/
+F:      arch/arm/plat-samsung/
 F:      arch/arm/plat-s3c24xx/
+F:      arch/arm/plat-s5p/
 
 ARM/S3C2410 ARM ARCHITECTURE
 M:      Ben Dooks <ben-linux@fluff.org>
@@ -1148,7 +1150,7 @@ F:	drivers/mmc/host/atmel-mci.c
 F:      drivers/mmc/host/atmel-mci-regs.h
 
 ATMEL AT91 / AT32 SERIAL DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
 S:      Supported
 F:      drivers/serial/atmel_serial.c
 
@@ -1160,18 +1162,18 @@ F:	drivers/video/atmel_lcdfb.c
 F:      include/video/atmel_lcdc.h
 
 ATMEL MACB ETHERNET DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
 S:      Supported
 F:      drivers/net/macb.*
 
 ATMEL SPI DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
 S:      Supported
 F:      drivers/spi/atmel_spi.*
 
 ATMEL USBA UDC DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
-L:      kernel@avr32linux.org
+M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://avr32linux.org/twiki/bin/view/Main/AtmelUsbDeviceDriver
 S:      Supported
 F:      drivers/usb/gadget/atmel_usba_udc.*
@@ -1581,7 +1583,7 @@ F:	include/linux/coda*.h
 
 COMMON INTERNET FILE SYSTEM (CIFS)
 M:      Steve French <sfrench@samba.org>
-L:      linux-cifs-client@lists.samba.org (moderated for non-subscribers)
+L:      linux-cifs@vger.kernel.org
 L:      samba-technical@lists.samba.org (moderated for non-subscribers)
 W:      http://linux-cifs.samba.org/
 Q:      http://patchwork.ozlabs.org/project/linux-cifs-client/list/
@@ -2109,11 +2111,20 @@ F:	drivers/edac/i5000_edac.c
 
 EDAC-I5400
 M:      Mauro Carvalho Chehab <mchehab@redhat.com>
-L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
+L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 F:      drivers/edac/i5400_edac.c
 
+EDAC-I7CORE
+M:      Mauro Carvalho Chehab <mchehab@redhat.com>
+L:      linux-edac@vger.kernel.org
+W:      bluesmoke.sourceforge.net
+S:      Maintained
+F:      drivers/edac/i7core_edac.c
+F:      drivers/edac/edac_mce.c
+F:      include/linux/edac_mce.h
+
 EDAC-I82975X
 M:      Ranganathan Desikan <ravi@jetztechnologies.com>
 M:      "Arvind R." <arvind@jetztechnologies.com>
@@ -2887,6 +2898,13 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git
 S:      Maintained
 F:      drivers/input/
 
+INPUT MULTITOUCH (MT) PROTOCOL
+M:      Henrik Rydberg <rydberg@euromail.se>
+L:      linux-input@vger.kernel.org
+S:      Maintained
+F:      Documentation/input/multi-touch-protocol.txt
+K:      \b(ABS|SYN)_MT_
+
 INTEL IDLE DRIVER
 M:      Len Brown <lenb@kernel.org>
 L:      linux-pm@lists.linux-foundation.org
@@ -2978,22 +2996,14 @@ F:	drivers/net/ixgb/
 F:      drivers/net/ixgbe/
 
 INTEL PRO/WIRELESS 2100 NETWORK CONNECTION SUPPORT
-M:      Zhu Yi <yi.zhu@intel.com>
-M:      Reinette Chatre <reinette.chatre@intel.com>
-M:      Intel Linux Wireless <ilw@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
-W:      http://ipw2100.sourceforge.net
-S:      Odd Fixes
+S:      Orphan
 F:      Documentation/networking/README.ipw2100
 F:      drivers/net/wireless/ipw2x00/ipw2100.*
 
 INTEL PRO/WIRELESS 2915ABG NETWORK CONNECTION SUPPORT
-M:      Zhu Yi <yi.zhu@intel.com>
-M:      Reinette Chatre <reinette.chatre@intel.com>
-M:      Intel Linux Wireless <ilw@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
-W:      http://ipw2200.sourceforge.net
-S:      Odd Fixes
+S:      Orphan
 F:      Documentation/networking/README.ipw2200
 F:      drivers/net/wireless/ipw2x00/ipw2200.*
 
@@ -3019,8 +3029,8 @@ F:	drivers/net/wimax/i2400m/
 F:      include/linux/wimax/i2400m.h
 
 INTEL WIRELESS WIFI LINK (iwlwifi)
-M:      Zhu Yi <yi.zhu@intel.com>
 M:      Reinette Chatre <reinette.chatre@intel.com>
+M:      Wey-Yi Guy <wey-yi.w.guy@intel.com>
 M:      Intel Linux Wireless <ilw@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
 W:      http://intellinuxwireless.org
@@ -3030,7 +3040,6 @@ F:	drivers/net/wireless/iwlwifi/
 
 INTEL WIRELESS MULTICOMM 3200 WIFI (iwmc3200wifi)
 M:      Samuel Ortiz <samuel.ortiz@intel.com>
-M:      Zhu Yi <yi.zhu@intel.com>
 M:      Intel Linux Wireless <ilw@linux.intel.com>
 L:      linux-wireless@vger.kernel.org
 S:      Supported
@@ -3382,7 +3391,7 @@ KPROBES
 M:      Ananth N Mavinakayanahalli <ananth@in.ibm.com>
 M:      Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
 M:      "David S. Miller" <davem@davemloft.net>
-M:      Masami Hiramatsu <mhiramat@redhat.com>
+M:      Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
 S:      Maintained
 F:      Documentation/kprobes.txt
 F:      include/linux/kprobes.h
@@ -4215,6 +4224,7 @@ OPEN FIRMWARE AND FLATTENED DEVICE TREE
 M:      Grant Likely <grant.likely@secretlab.ca>
 L:      devicetree-discuss@lists.ozlabs.org
 W:      http://fdt.secretlab.ca
+T:      git git://git.secretlab.ca/git/linux-2.6.git
 S:      Maintained
 F:      drivers/of
 F:      include/linux/of*.h
@@ -4629,6 +4639,12 @@ M:	Robert Jarzmik <robert.jarzmik@free.fr>
 L:      rtc-linux@googlegroups.com
 S:      Maintained
 
+QLOGIC QLA1280 SCSI DRIVER
+M:      Michael Reed <mdr@sgi.com>
+L:      linux-scsi@vger.kernel.org
+S:      Maintained
+F:      drivers/scsi/qla1280.[ch]
+
 QLOGIC QLA2XXX FC-SCSI DRIVER
 M:      Andrew Vasquez <andrew.vasquez@qlogic.com>
 M:      linux-driver@qlogic.com
@@ -5387,6 +5403,7 @@ M:	David Brownell <dbrownell@users.sourceforge.net>
 M:      Grant Likely <grant.likely@secretlab.ca>
 L:      spi-devel-general@lists.sourceforge.net
 Q:      http://patchwork.kernel.org/project/spi-devel-general/list/
+T:      git git://git.secretlab.ca/git/linux-2.6.git
 S:      Maintained
 F:      Documentation/spi/
 F:      drivers/spi/
diff --git a/Makefile b/Makefile
index 654c31aaec64..f9835c80a274 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 35
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc4
 NAME = Sheep on Meth
 
 # *DOCUMENTATION*
@@ -883,80 +883,10 @@ PHONY += $(vmlinux-dirs)
 $(vmlinux-dirs): prepare scripts
         $(Q)$(MAKE) $(build)=$@
 
-# Build the kernel release string
-#
-# The KERNELRELEASE value built here is stored in the file
-# include/config/kernel.release, and is used when executing several
-# make targets, such as "make install" or "make modules_install."
-#
-# The eventual kernel release string consists of the following fields,
-# shown in a hierarchical format to show how smaller parts are concatenated
-# to form the larger and final value, with values coming from places like
-# the Makefile, kernel config options, make command line options and/or
-# SCM tag information.
-#
-#       $(KERNELVERSION)
-#         $(VERSION)                    eg, 2
-#         $(PATCHLEVEL)                 eg, 6
-#         $(SUBLEVEL)                   eg, 18
-#         $(EXTRAVERSION)               eg, -rc6
-#       $(localver-full)
-#         $(localver)
-#           localversion*               (files without backups, containing '~')
-#           $(CONFIG_LOCALVERSION)      (from kernel config setting)
-#         $(LOCALVERSION)               (from make command line, if provided)
-#         $(localver-extra)
-#           $(scm-identifier)           (unique SCM tag, if one exists)
-#             ./scripts/setlocalversion (only with CONFIG_LOCALVERSION_AUTO)
-#             .scmversion               (only with CONFIG_LOCALVERSION_AUTO)
-#           +                           (only without CONFIG_LOCALVERSION_AUTO
-#                                        and without LOCALVERSION= and
-#                                        repository is at non-tagged commit)
-#
-# For kernels without CONFIG_LOCALVERSION_AUTO compiled from an SCM that has
-# been revised beyond a tagged commit, `+' is appended to the version string
-# when not overridden by using "make LOCALVERSION=".  This indicates that the
-# kernel is not a vanilla release version and has been modified.
-
-pattern = ".*/localversion[^~]*"
-string  = $(shell cat /dev/null \
-           `find $(objtree) $(srctree) -maxdepth 1 -regex $(pattern) | sort -u`)
-
-localver = $(subst $(space),, $(string) \
-                              $(patsubst "%",%,$(CONFIG_LOCALVERSION)))
-
-# scripts/setlocalversion is called to create a unique identifier if the source
-# is managed by a known SCM and the repository has been revised since the last
-# tagged (release) commit.  The format of the identifier is determined by the
-# SCM's implementation.
-#
-# .scmversion is used when generating rpm packages so we do not loose
-# the version information from the SCM when we do the build of the kernel
-# from the copied source
-ifeq ($(wildcard .scmversion),)
-        scm-identifier = $(shell $(CONFIG_SHELL) \
-                         $(srctree)/scripts/setlocalversion $(srctree))
-else
-        scm-identifier = $(shell cat .scmversion 2> /dev/null)
-endif
-
-ifdef CONFIG_LOCALVERSION_AUTO
-        localver-extra = $(scm-identifier)
-else
-        ifneq ($(scm-identifier),)
-                ifeq ($(LOCALVERSION),)
-                        localver-extra = +
-                endif
-        endif
-endif
-
-localver-full = $(localver)$(LOCALVERSION)$(localver-extra)
-
 # Store (new) KERNELRELASE string in include/config/kernel.release
-kernelrelease = $(KERNELVERSION)$(localver-full)
 include/config/kernel.release: include/config/auto.conf FORCE
         $(Q)rm -f $@
-        $(Q)echo $(kernelrelease) > $@
+        $(Q)echo "$(KERNELVERSION)$$($(CONFIG_SHELL) $(srctree)/scripts/setlocalversion $(srctree))" > $@
 
 
 # Things we need to do before we recursively start building the kernel
@@ -1095,7 +1025,7 @@ all: modules
 #       using awk while concatenating to the final file.
 
 PHONY += modules
-modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux)
+modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
         $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
         @$(kecho) '  Building modules, stage 2.';
         $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
@@ -1117,7 +1047,7 @@ PHONY += modules_install
 modules_install: _modinst_ _modinst_post
 
 PHONY += _modinst_
-_modinst_: modules.builtin
+_modinst_:
         @if [ -z "`$(DEPMOD) -V 2>/dev/null | grep module-init-tools`" ]; then \
                 echo "Warning: you may need to install module-init-tools"; \
                 echo "See http://www.codemonkey.org.uk/docs/post-halloween-2.6.txt";\
diff --git a/arch/alpha/include/asm/bitops.h b/arch/alpha/include/asm/bitops.h
index 1dce24bc455a..adfab8a21dfe 100644
--- a/arch/alpha/include/asm/bitops.h
+++ b/arch/alpha/include/asm/bitops.h
@@ -410,7 +410,7 @@ static inline unsigned long __arch_hweight64(unsigned long w)
         return __kernel_ctpop(w);
 }
 
-static inline unsigned int __arch_weight32(unsigned int w)
+static inline unsigned int __arch_hweight32(unsigned int w)
 {
         return __arch_hweight64(w);
 }
diff --git a/arch/alpha/kernel/Makefile b/arch/alpha/kernel/Makefile
index 7739a62440a7..5a62fb46ef20 100644
--- a/arch/alpha/kernel/Makefile
+++ b/arch/alpha/kernel/Makefile
@@ -35,7 +35,7 @@ endif
 
 obj-y    += irq_pyxis.o irq_i8259.o irq_srm.o
 obj-y    += err_ev6.o
-obj-y    += es1888.o smc37c669.o smc37c93x.o ns87312.o gct.o
+obj-y    += es1888.o smc37c669.o smc37c93x.o pc873xx.o gct.o
 obj-y    += srmcons.o
 
 else
@@ -63,11 +63,11 @@ obj-$(CONFIG_ALPHA_WILDFIRE)	+= core_wildfire.o
 # Board support
 obj-$(CONFIG_ALPHA_ALCOR)       += sys_alcor.o irq_i8259.o irq_srm.o
 obj-$(CONFIG_ALPHA_CABRIOLET)   += sys_cabriolet.o irq_i8259.o irq_srm.o \
-                                   ns87312.o
+                                   pc873xx.o
 obj-$(CONFIG_ALPHA_EB164)       += sys_cabriolet.o irq_i8259.o irq_srm.o \
-                                   ns87312.o
+                                   pc873xx.o
 obj-$(CONFIG_ALPHA_EB66P)       += sys_cabriolet.o irq_i8259.o irq_srm.o \
-                                   ns87312.o
+                                   pc873xx.o
 obj-$(CONFIG_ALPHA_LX164)       += sys_cabriolet.o irq_i8259.o irq_srm.o \
                                    smc37c93x.o
 obj-$(CONFIG_ALPHA_PC164)       += sys_cabriolet.o irq_i8259.o irq_srm.o \
@@ -90,14 +90,14 @@ obj-$(CONFIG_ALPHA_RUFFIAN)	+= sys_ruffian.o irq_pyxis.o irq_i8259.o
 obj-$(CONFIG_ALPHA_RX164)       += sys_rx164.o irq_i8259.o
 obj-$(CONFIG_ALPHA_SABLE)       += sys_sable.o
 obj-$(CONFIG_ALPHA_LYNX)        += sys_sable.o
-obj-$(CONFIG_ALPHA_BOOK1)       += sys_sio.o irq_i8259.o irq_srm.o ns87312.o
-obj-$(CONFIG_ALPHA_AVANTI)      += sys_sio.o irq_i8259.o irq_srm.o ns87312.o
-obj-$(CONFIG_ALPHA_NONAME)      += sys_sio.o irq_i8259.o irq_srm.o ns87312.o
-obj-$(CONFIG_ALPHA_P2K)         += sys_sio.o irq_i8259.o irq_srm.o ns87312.o
-obj-$(CONFIG_ALPHA_XL)          += sys_sio.o irq_i8259.o irq_srm.o ns87312.o
+obj-$(CONFIG_ALPHA_BOOK1)       += sys_sio.o irq_i8259.o irq_srm.o pc873xx.o
+obj-$(CONFIG_ALPHA_AVANTI)      += sys_sio.o irq_i8259.o irq_srm.o pc873xx.o
+obj-$(CONFIG_ALPHA_NONAME)      += sys_sio.o irq_i8259.o irq_srm.o pc873xx.o
+obj-$(CONFIG_ALPHA_P2K)         += sys_sio.o irq_i8259.o irq_srm.o pc873xx.o
+obj-$(CONFIG_ALPHA_XL)          += sys_sio.o irq_i8259.o irq_srm.o pc873xx.o
 obj-$(CONFIG_ALPHA_SX164)       += sys_sx164.o irq_pyxis.o irq_i8259.o \
                                    irq_srm.o smc37c669.o
-obj-$(CONFIG_ALPHA_TAKARA)      += sys_takara.o irq_i8259.o ns87312.o
+obj-$(CONFIG_ALPHA_TAKARA)      += sys_takara.o irq_i8259.o pc873xx.o
 obj-$(CONFIG_ALPHA_WILDFIRE)    += sys_wildfire.o irq_i8259.o
 
 # Error support
diff --git a/arch/alpha/kernel/ns87312.c b/arch/alpha/kernel/ns87312.c
deleted file mode 100644
index 342b56d24c20..000000000000
--- a/arch/alpha/kernel/ns87312.c
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- *      linux/arch/alpha/kernel/ns87312.c
- */
-
-#include <linux/init.h>
-#include <asm/io.h>
-#include "proto.h"
-
-
-/*
- * The SRM console *disables* the IDE interface, this code ensures it's
- * enabled.
- *
- * This code bangs on a control register of the 87312 Super I/O chip
- * that implements parallel port/serial ports/IDE/FDI.  Depending on
- * the motherboard, the Super I/O chip can be configured through a
- * pair of registers that are located either at I/O ports 0x26e/0x26f
- * or 0x398/0x399.  Unfortunately, autodetecting which base address is
- * in use works only once (right after a reset).  The Super I/O chip
- * has the additional quirk that configuration register data must be
- * written twice (I believe this is a safety feature to prevent
- * accidental modification---fun, isn't it?).
- */
-
-void __init
-ns87312_enable_ide(long ide_base)
-{
-        int data;
-        unsigned long flags;
-
-        local_irq_save(flags);
-        outb(0, ide_base);              /* set the index register for reg #0 */
-        data = inb(ide_base+1);         /* read the current contents */
-        outb(0, ide_base);              /* set the index register for reg #0 */
-        outb(data | 0x40, ide_base+1);  /* turn on IDE */
-        outb(data | 0x40, ide_base+1);  /* turn on IDE, really! */
-        local_irq_restore(flags);
-}
diff --git a/arch/alpha/kernel/pc873xx.c b/arch/alpha/kernel/pc873xx.c
new file mode 100644
index 000000000000..27dcbff85613
--- /dev/null
+++ b/arch/alpha/kernel/pc873xx.c
@@ -0,0 +1,88 @@
+#include <linux/ioport.h>
+#include <asm/io.h>
+
+#include "pc873xx.h"
+
+static unsigned pc873xx_probelist[] = {0x398, 0x26e, 0};
+
+static char *pc873xx_names[] = {
+        "PC87303", "PC87306", "PC87312", "PC87332", "PC87334"
+};
+
+static unsigned int base, model;
+
+
+unsigned int __init pc873xx_get_base()
+{
+        return base;
+}
+
+char *__init pc873xx_get_model()
+{
+        return pc873xx_names[model];
+}
+
+static unsigned char __init pc873xx_read(unsigned int base, int reg)
+{
+        outb(reg, base);
+        return inb(base + 1);
+}
+
+static void __init pc873xx_write(unsigned int base, int reg, unsigned char data)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        outb(reg, base);
+        outb(data, base + 1);
+        outb(data, base + 1);           /* Must be written twice */
+        local_irq_restore(flags);
+}
+
+int __init pc873xx_probe(void)
+{
+        int val, index = 0;
+
+        while ((base = pc873xx_probelist[index++])) {
+
+                if (request_region(base, 2, "Super IO PC873xx") == NULL)
+                        continue;
+
+                val = pc873xx_read(base, REG_SID);
+                if ((val & 0xf0) == 0x10) {
+                        model = PC87332;
+                        break;
+                } else if ((val & 0xf8) == 0x70) {
+                        model = PC87306;
+                        break;
+                } else if ((val & 0xf8) == 0x50) {
+                        model = PC87334;
+                        break;
+                } else if ((val & 0xf8) == 0x40) {
+                        model = PC87303;
+                        break;
+                }
+
+                release_region(base, 2);
+        }
+
+        return (base == 0) ? -1 : 1;
+}
+
+void __init pc873xx_enable_epp19(void)
+{
+        unsigned char data;
+
+        printk(KERN_INFO "PC873xx enabling EPP v1.9\n");
+        data = pc873xx_read(base, REG_PCR);
+        pc873xx_write(base, REG_PCR, (data & 0xFC) | 0x02);
+}
+
+void __init pc873xx_enable_ide(void)
+{
+        unsigned char data;
+
+        printk(KERN_INFO "PC873xx enabling IDE interrupt\n");
+        data = pc873xx_read(base, REG_FER);
+        pc873xx_write(base, REG_FER, data | 0x40);
+}
diff --git a/arch/alpha/kernel/pc873xx.h b/arch/alpha/kernel/pc873xx.h
new file mode 100644
index 000000000000..25e16956fe3e
--- /dev/null
+++ b/arch/alpha/kernel/pc873xx.h
@@ -0,0 +1,35 @@
+
+#ifndef _PC873xx_H_
+#define _PC873xx_H_
+
+/*
+ * Control Register Values
+ */
+#define REG_FER 0x00
+#define REG_FAR 0x01
+#define REG_PTR 0x02
+#define REG_FCR 0x03
+#define REG_PCR 0x04
+#define REG_KRR 0x05
+#define REG_PMC 0x06
+#define REG_TUP 0x07
+#define REG_SID 0x08
+#define REG_ASC 0x09
+#define REG_IRC 0x0e
+
+/*
+ * Model numbers
+ */
+#define PC87303 0
+#define PC87306 1
+#define PC87312 2
+#define PC87332 3
+#define PC87334 4
+
+int pc873xx_probe(void);
+unsigned int pc873xx_get_base(void);
+char *pc873xx_get_model(void);
+void pc873xx_enable_epp19(void);
+void pc873xx_enable_ide(void);
+
+#endif
diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
index a5fffc882c72..738fc824e2ea 100644
--- a/arch/alpha/kernel/pci-sysfs.c
+++ b/arch/alpha/kernel/pci-sysfs.c
@@ -53,7 +53,6 @@ static int __pci_mmap_fits(struct pci_dev *pdev, int num,
 
 /**
  * pci_mmap_resource - map a PCI resource into user memory space
- * @filp: open sysfs file
  * @kobj: kobject for mapping
  * @attr: struct bin_attribute for the file being mapped
  * @vma: struct vm_area_struct passed into the mmap
@@ -61,7 +60,7 @@ static int __pci_mmap_fits(struct pci_dev *pdev, int num,
  *
  * Use the bus mapping routines to map a PCI resource into userspace.
  */
-static int pci_mmap_resource(struct file *filp, struct kobject *kobj,
+static int pci_mmap_resource(struct kobject *kobj,
                              struct bin_attribute *attr,
                              struct vm_area_struct *vma, int sparse)
 {
diff --git a/arch/alpha/kernel/sys_sio.c b/arch/alpha/kernel/sys_sio.c
index d4327e461c22..85b4aea01ef8 100644
--- a/arch/alpha/kernel/sys_sio.c
+++ b/arch/alpha/kernel/sys_sio.c
@@ -34,6 +34,7 @@
 #include "irq_impl.h"
 #include "pci_impl.h"
 #include "machvec_impl.h"
+#include "pc873xx.h"
 
 #if defined(ALPHA_RESTORE_SRM_SETUP)
 /* Save LCA configuration data as the console had it set up.  */
@@ -208,7 +209,27 @@ noname_init_pci(void)
         common_init_pci();
         sio_pci_route();
         sio_fixup_irq_levels(sio_collect_irq_levels());
-        ns87312_enable_ide(0x26e);
+
+        if (pc873xx_probe() == -1) {
+                printk(KERN_ERR "Probing for PC873xx Super IO chip failed.\n");
+        } else {
+                printk(KERN_INFO "Found %s Super IO chip at 0x%x\n",
+                        pc873xx_get_model(), pc873xx_get_base());
+
+                /* Enabling things in the Super IO chip doesn't actually
+                 * configure and enable things, the legacy drivers still
+                 * need to do the actual configuration and enabling.
+                 * This only unblocks them.
+                 */
+
+#if !defined(CONFIG_ALPHA_AVANTI)
+                /* Don't bother on the Avanti family.
+                 * None of them had on-board IDE.
+                 */
+                pc873xx_enable_ide();
+#endif
+                pc873xx_enable_epp19();
+        }
 }
 
 static inline void __init
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 1f254bd6c937..98922f7d2d12 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -955,7 +955,8 @@ config XSCALE_PMU
         default y
 
 config CPU_HAS_PMU
-        depends on CPU_V6 || CPU_V7 || XSCALE_PMU
+        depends on (CPU_V6 || CPU_V7 || XSCALE_PMU) && \
+                   (!ARCH_OMAP3 || OMAP3_EMU)
         default y
         bool
 
diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
index a52a27c1d9be..6f80665f477e 100644
--- a/arch/arm/common/sa1111.c
+++ b/arch/arm/common/sa1111.c
@@ -951,8 +951,6 @@ static int sa1111_resume(struct platform_device *dev)
         if (!save)
                 return 0;
 
-        spin_lock_irqsave(&sachip->lock, flags);
-
         /*
          * Ensure that the SA1111 is still here.
          * FIXME: shouldn't do this here.
@@ -969,6 +967,13 @@ static int sa1111_resume(struct platform_device *dev)
          * First of all, wake up the chip.
          */
         sa1111_wake(sachip);
+
+        /*
+         * Only lock for write ops. Also, sa1111_wake must be called with
+         * released spinlock!
+         */
+        spin_lock_irqsave(&sachip->lock, flags);
+
         sa1111_writel(0, sachip->base + SA1111_INTC + SA1111_INTEN0);
         sa1111_writel(0, sachip->base + SA1111_INTC + SA1111_INTEN1);
 
diff --git a/arch/arm/include/asm/mach/udc_pxa2xx.h b/arch/arm/include/asm/mach/udc_pxa2xx.h
index f3eabf1ecec3..833306ee9e7f 100644
--- a/arch/arm/include/asm/mach/udc_pxa2xx.h
+++ b/arch/arm/include/asm/mach/udc_pxa2xx.h
@@ -21,8 +21,8 @@ struct pxa2xx_udc_mach_info {
          * here.  Note that sometimes the signals go through inverters...
          */
         bool    gpio_vbus_inverted;
-        u16     gpio_vbus;                      /* high == vbus present */
+        int     gpio_vbus;                      /* high == vbus present */
         bool    gpio_pullup_inverted;
-        u16     gpio_pullup;                    /* high == pullup activated */
+        int     gpio_pullup;                    /* high == pullup activated */
 };
 
diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
index 6a89567ffc5b..7bed3daf83b8 100644
--- a/arch/arm/include/asm/processor.h
+++ b/arch/arm/include/asm/processor.h
@@ -91,7 +91,11 @@ extern void release_thread(struct task_struct *);
 
 unsigned long get_wchan(struct task_struct *p);
 
+#if __LINUX_ARM_ARCH__ == 6
+#define cpu_relax()                     smp_mb()
+#else
 #define cpu_relax()                     barrier()
+#endif
 
 /*
  * Create a new kernel thread
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index c45768614c8a..de12536d687f 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -201,7 +201,7 @@ armpmu_event_update(struct perf_event *event,
 {
         int shift = 64 - 32;
         s64 prev_raw_count, new_raw_count;
-        s64 delta;
+        u64 delta;
 
 again:
         prev_raw_count = atomic64_read(&hwc->prev_count);
diff --git a/arch/arm/mach-msm/dma.c b/arch/arm/mach-msm/dma.c
index d029d1f5f9e2..02cae5e2951c 100644
--- a/arch/arm/mach-msm/dma.c
+++ b/arch/arm/mach-msm/dma.c
@@ -17,6 +17,7 @@
 #include <linux/err.h>
 #include <linux/io.h>
 #include <linux/interrupt.h>
+#include <linux/completion.h>
 #include <mach/dma.h>
 
 #define MSM_DMOV_CHANNEL_COUNT 16
diff --git a/arch/arm/mach-mx3/mach-mx31lilly.c b/arch/arm/mach-mx3/mach-mx31lilly.c
index d3d5877c750e..b2c7f512070f 100644
--- a/arch/arm/mach-mx3/mach-mx31lilly.c
+++ b/arch/arm/mach-mx3/mach-mx31lilly.c
@@ -115,6 +115,8 @@ static struct platform_device physmap_flash_device = {
 
 /* USB */
 
+#if defined(CONFIG_USB_ULPI)
+
 #define USB_PAD_CFG (PAD_CTL_DRV_MAX | PAD_CTL_SRE_FAST | PAD_CTL_HYS_CMOS | \
                         PAD_CTL_ODE_CMOS | PAD_CTL_100K_PU)
 
@@ -244,10 +246,20 @@ static struct mxc_usbh_platform_data usbh2_pdata = {
         .flags  = MXC_EHCI_POWER_PINS_ENABLED,
 };
 
-static struct platform_device *devices[] __initdata = {
-        &smsc91x_device,
-        &physmap_flash_device,
-};
+static void lilly1131_usb_init(void)
+{
+        usbotg_pdata.otg = otg_ulpi_create(&mxc_ulpi_access_ops,
+                                USB_OTG_DRV_VBUS | USB_OTG_DRV_VBUS_EXT);
+        usbh2_pdata.otg = otg_ulpi_create(&mxc_ulpi_access_ops,
+                                USB_OTG_DRV_VBUS | USB_OTG_DRV_VBUS_EXT);
+
+        mxc_register_device(&mxc_usbh1, &usbh1_pdata);
+        mxc_register_device(&mxc_usbh2, &usbh2_pdata);
+}
+
+#else
+static inline void lilly1131_usb_init(void) {}
+#endif /* CONFIG_USB_ULPI */
 
 /* SPI */
 
@@ -279,6 +291,11 @@ static struct spi_board_info mc13783_dev __initdata = {
         .platform_data  = &mc13783_pdata,
 };
 
+static struct platform_device *devices[] __initdata = {
+        &smsc91x_device,
+        &physmap_flash_device,
+};
+
 static int mx31lilly_baseboard;
 core_param(mx31lilly_baseboard, mx31lilly_baseboard, int, 0444);
 
@@ -321,13 +338,7 @@ static void __init mx31lilly_board_init(void)
         platform_add_devices(devices, ARRAY_SIZE(devices));
 
         /* USB */
-        usbotg_pdata.otg = otg_ulpi_create(&mxc_ulpi_access_ops,
-                                USB_OTG_DRV_VBUS | USB_OTG_DRV_VBUS_EXT);
-        usbh2_pdata.otg = otg_ulpi_create(&mxc_ulpi_access_ops,
-                                USB_OTG_DRV_VBUS | USB_OTG_DRV_VBUS_EXT);
-
-        mxc_register_device(&mxc_usbh1, &usbh1_pdata);
-        mxc_register_device(&mxc_usbh2, &usbh2_pdata);
+        lilly1131_usb_init();
 }
 
 static void __init mx31lilly_timer_init(void)
diff --git a/arch/arm/mach-nomadik/clock.c b/arch/arm/mach-nomadik/clock.c
index 2c471fc451d7..f035f4185274 100644
--- a/arch/arm/mach-nomadik/clock.c
+++ b/arch/arm/mach-nomadik/clock.c
@@ -32,7 +32,10 @@ void clk_disable(struct clk *clk)
 }
 EXPORT_SYMBOL(clk_disable);
 
-/* We have a fixed clock alone, for now */
+static struct clk clk_24 = {
+        .rate = 2400000,
+};
+
 static struct clk clk_48 = {
         .rate = 48 * 1000 * 1000,
 };
@@ -50,6 +53,8 @@ static struct clk clk_default;
         }
 
 static struct clk_lookup lookups[] = {
+        CLK(&clk_24, "mtu0"),
+        CLK(&clk_24, "mtu1"),
         CLK(&clk_48, "uart0"),
         CLK(&clk_48, "uart1"),
         CLK(&clk_default, "gpio.0"),
@@ -59,10 +64,8 @@ static struct clk_lookup lookups[] = {
         CLK(&clk_default, "rng"),
 };
 
-static int __init clk_init(void)
+int __init clk_init(void)
 {
         clkdev_add_table(lookups, ARRAY_SIZE(lookups));
         return 0;
 }
-
-arch_initcall(clk_init);
diff --git a/arch/arm/mach-nomadik/clock.h b/arch/arm/mach-nomadik/clock.h
index 5563985a2cc7..78da2e7c3985 100644
--- a/arch/arm/mach-nomadik/clock.h
+++ b/arch/arm/mach-nomadik/clock.h
@@ -11,3 +11,5 @@
 struct clk {
         unsigned long           rate;
 };
+
+int __init clk_init(void);
diff --git a/arch/arm/mach-nomadik/cpu-8815.c b/arch/arm/mach-nomadik/cpu-8815.c
index 91c3c901b469..ac58e3b03b1a 100644
--- a/arch/arm/mach-nomadik/cpu-8815.c
+++ b/arch/arm/mach-nomadik/cpu-8815.c
@@ -31,6 +31,8 @@
 #include <asm/cacheflush.h>
 #include <asm/hardware/cache-l2x0.h>
 
+#include "clock.h"
+
 #define __MEM_4K_RESOURCE(x) \
         .res = {.start = (x), .end = (x) + SZ_4K - 1, .flags = IORESOURCE_MEM}
 
@@ -143,6 +145,12 @@ void __init cpu8815_init_irq(void)
         /* This modified VIC cell has two register blocks, at 0 and 0x20 */
         vic_init(io_p2v(NOMADIK_IC_BASE + 0x00), IRQ_VIC_START +  0, ~0, 0);
         vic_init(io_p2v(NOMADIK_IC_BASE + 0x20), IRQ_VIC_START + 32, ~0, 0);
+
+        /*
+         * Init clocks here so that they are available for system timer
+         * initialization.
+         */
+        clk_init();
 }
 
 /*
diff --git a/arch/arm/mach-omap2/board-omap3stalker.c b/arch/arm/mach-omap2/board-omap3stalker.c
index f848ba8dbc16..a04cffd691c5 100644
--- a/arch/arm/mach-omap2/board-omap3stalker.c
+++ b/arch/arm/mach-omap2/board-omap3stalker.c
@@ -538,9 +538,7 @@ static void ads7846_dev_init(void)
                 printk(KERN_ERR "can't get ads7846 pen down GPIO\n");
 
         gpio_direction_input(OMAP3_STALKER_TS_GPIO);
-
-        omap_set_gpio_debounce(OMAP3_STALKER_TS_GPIO, 1);
-        omap_set_gpio_debounce_time(OMAP3_STALKER_TS_GPIO, 0xa);
+        gpio_set_debounce(OMAP3_STALKER_TS_GPIO, 310);
 }
 
 static int ads7846_get_pendown_state(void)
diff --git a/arch/arm/mach-omap2/clock44xx_data.c b/arch/arm/mach-omap2/clock44xx_data.c
index 02804224517b..e10db7a90cb2 100644
--- a/arch/arm/mach-omap2/clock44xx_data.c
+++ b/arch/arm/mach-omap2/clock44xx_data.c
@@ -1369,6 +1369,7 @@ static struct clk emif1_ick = {
         .ops            = &clkops_omap2_dflt,
         .enable_reg     = OMAP4430_CM_MEMIF_EMIF_1_CLKCTRL,
         .enable_bit     = OMAP4430_MODULEMODE_HWCTRL,
+        .flags          = ENABLE_ON_INIT,
         .clkdm_name     = "l3_emif_clkdm",
         .parent         = &ddrphy_ck,
         .recalc         = &followparent_recalc,
@@ -1379,6 +1380,7 @@ static struct clk emif2_ick = {
         .ops            = &clkops_omap2_dflt,
         .enable_reg     = OMAP4430_CM_MEMIF_EMIF_2_CLKCTRL,
         .enable_bit     = OMAP4430_MODULEMODE_HWCTRL,
+        .flags          = ENABLE_ON_INIT,
         .clkdm_name     = "l3_emif_clkdm",
         .parent         = &ddrphy_ck,
         .recalc         = &followparent_recalc,
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 95c9a5f774e1..b7a4133267d8 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -409,10 +409,11 @@ static int _init_main_clk(struct omap_hwmod *oh)
                 return 0;
 
         oh->_clk = omap_clk_get_by_name(oh->main_clk);
-        if (!oh->_clk)
+        if (!oh->_clk) {
                 pr_warning("omap_hwmod: %s: cannot clk_get main_clk %s\n",
                            oh->name, oh->main_clk);
                 return -EINVAL;
+        }
 
         if (!oh->_clk->clkdm)
                 pr_warning("omap_hwmod: %s: missing clockdomain for %s.\n",
@@ -444,10 +445,11 @@ static int _init_interface_clks(struct omap_hwmod *oh)
                         continue;
 
                 c = omap_clk_get_by_name(os->clk);
-                if (!c)
+                if (!c) {
                         pr_warning("omap_hwmod: %s: cannot clk_get interface_clk %s\n",
                                    oh->name, os->clk);
                         ret = -EINVAL;
+                }
                 os->_clk = c;
         }
 
@@ -470,10 +472,11 @@ static int _init_opt_clks(struct omap_hwmod *oh)
 
         for (i = oh->opt_clks_cnt, oc = oh->opt_clks; i > 0; i--, oc++) {
                 c = omap_clk_get_by_name(oc->clk);
-                if (!c)
+                if (!c) {
                         pr_warning("omap_hwmod: %s: cannot clk_get opt_clk %s\n",
                                    oh->name, oc->clk);
                         ret = -EINVAL;
+                }
                 oc->_clk = c;
         }
 
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 2e967716cc3f..b88737fd6cfe 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -99,7 +99,7 @@ static void omap3_enable_io_chain(void)
                 /* Do a readback to assure write has been done */
                 prm_read_mod_reg(WKUP_MOD, PM_WKEN);
 
-                while (!(prm_read_mod_reg(WKUP_MOD, PM_WKST) &
+                while (!(prm_read_mod_reg(WKUP_MOD, PM_WKEN) &
                          OMAP3430_ST_IO_CHAIN_MASK)) {
                         timeout++;
                         if (timeout > 1000) {
@@ -108,7 +108,7 @@ static void omap3_enable_io_chain(void)
                                 return;
                         }
                         prm_set_mod_reg_bits(OMAP3430_ST_IO_CHAIN_MASK,
-                                             WKUP_MOD, PM_WKST);
+                                             WKUP_MOD, PM_WKEN);
                 }
         }
 }
diff --git a/arch/arm/mach-omap2/usb-ehci.c b/arch/arm/mach-omap2/usb-ehci.c
index c68f799e83c5..d72d1ac30333 100644
--- a/arch/arm/mach-omap2/usb-ehci.c
+++ b/arch/arm/mach-omap2/usb-ehci.c
@@ -20,6 +20,8 @@
 #include <linux/delay.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/dma-mapping.h>
+
 #include <asm/io.h>
 #include <plat/mux.h>
 
diff --git a/arch/arm/mach-pxa/mioa701.c b/arch/arm/mach-pxa/mioa701.c
index d60db87dde08..fa6a708b4099 100644
--- a/arch/arm/mach-pxa/mioa701.c
+++ b/arch/arm/mach-pxa/mioa701.c
@@ -697,7 +697,7 @@ static struct i2c_board_info __initdata mioa701_pi2c_devices[] = {
 };
 
 /* Board I2C devices. */
-static struct i2c_board_info __initdata mioa701_i2c_devices[] = {
+static struct i2c_board_info mioa701_i2c_devices[] = {
         {
                 I2C_BOARD_INFO("mt9m111", 0x5d),
         },
diff --git a/arch/arm/mach-pxa/palmtc.c b/arch/arm/mach-pxa/palmtc.c
index 033b567e50bb..ce1104d1bc17 100644
--- a/arch/arm/mach-pxa/palmtc.c
+++ b/arch/arm/mach-pxa/palmtc.c
@@ -263,11 +263,11 @@ const struct matrix_keymap_data palmtc_keymap_data = {
         .keymap_size            = ARRAY_SIZE(palmtc_matrix_keys),
 };
 
-const static unsigned int palmtc_keypad_row_gpios[] = {
+static const unsigned int palmtc_keypad_row_gpios[] = {
         0, 9, 10, 11
 };
 
-const static unsigned int palmtc_keypad_col_gpios[] = {
+static const unsigned int palmtc_keypad_col_gpios[] = {
         18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 79, 80
 };
 
diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
index 4d2413ed0ffa..c1048a35f187 100644
--- a/arch/arm/mach-pxa/spitz.c
+++ b/arch/arm/mach-pxa/spitz.c
@@ -818,6 +818,9 @@ static struct i2c_board_info akita_i2c_board_info[] = {
                 .type           = "max7310",
                 .addr           = 0x18,
                 .platform_data  = &akita_ioexp,
+        }, {
+                .type           = "wm8750",
+                .addr           = 0x1b,
         },
 };
 
diff --git a/arch/arm/mach-pxa/z2.c b/arch/arm/mach-pxa/z2.c
index f5d1ae3db3a4..d303c6929d32 100644
--- a/arch/arm/mach-pxa/z2.c
+++ b/arch/arm/mach-pxa/z2.c
@@ -3,8 +3,9 @@
  *
  *  Support for the Zipit Z2 Handheld device.
  *
- *  Author:     Ken McGuire
- *  Created:    Jan 25, 2009
+ *  Copyright (C) 2009-2010 Marek Vasut <marek.vasut@gmail.com>
+ *
+ *  Based on research and code by: Ken McGuire
  *  Based on mainstone.c as modified for the Zipit Z2.
  *
  *  This program is free software; you can redistribute it and/or modify
@@ -157,21 +158,14 @@ static struct mtd_partition z2_flash_parts[] = {
         {
                 .name   = "U-Boot Bootloader",
                 .offset = 0x0,
-                .size   = 0x20000,
-        },
-        {
-                .name   = "Linux Kernel",
-                .offset = 0x20000,
-                .size   = 0x220000,
-        },
-        {
-                .name   = "Filesystem",
-                .offset = 0x240000,
-                .size   = 0x5b0000,
-        },
-        {
+                .size   = 0x40000,
+        }, {
                 .name   = "U-Boot Environment",
-                .offset = 0x7f0000,
+                .offset = 0x40000,
+                .size   = 0x60000,
+        }, {
+                .name   = "Flash",
+                .offset = 0x60000,
                 .size   = MTDPART_SIZ_FULL,
         },
 };
diff --git a/arch/arm/mach-realview/Kconfig b/arch/arm/mach-realview/Kconfig
index ee5e392430e8..b4575ae9648e 100644
--- a/arch/arm/mach-realview/Kconfig
+++ b/arch/arm/mach-realview/Kconfig
@@ -18,6 +18,7 @@ config REALVIEW_EB_ARM11MP
         bool "Support ARM11MPCore tile"
         depends on MACH_REALVIEW_EB
         select CPU_V6
+        select ARCH_HAS_BARRIERS if SMP
         help
           Enable support for the ARM11MPCore tile on the Realview platform.
 
@@ -35,6 +36,7 @@ config MACH_REALVIEW_PB11MP
         select CPU_V6
         select ARM_GIC
         select HAVE_PATA_PLATFORM
+        select ARCH_HAS_BARRIERS if SMP
         help
           Include support for the ARM(R) RealView MPCore Platform Baseboard.
           PB11MPCore is a platform with an on-board ARM11MPCore and has
diff --git a/arch/arm/mach-realview/include/mach/barriers.h b/arch/arm/mach-realview/include/mach/barriers.h
new file mode 100644
index 000000000000..0c5d749d7b5f
--- /dev/null
+++ b/arch/arm/mach-realview/include/mach/barriers.h
@@ -0,0 +1,8 @@
+/*
+ * Barriers redefined for RealView ARM11MPCore platforms with L220 cache
+ * controller to work around hardware errata causing the outer_sync()
+ * operation to deadlock the system.
+ */
+#define mb()            dsb()
+#define rmb()           dmb()
+#define wmb()           mb()
diff --git a/arch/arm/mach-realview/realview_eb.c b/arch/arm/mach-realview/realview_eb.c
index 422ccd70d5f5..4425018fab82 100644
--- a/arch/arm/mach-realview/realview_eb.c
+++ b/arch/arm/mach-realview/realview_eb.c
@@ -32,6 +32,7 @@
 #include <asm/leds.h>
 #include <asm/mach-types.h>
 #include <asm/pmu.h>
+#include <asm/pgtable.h>
 #include <asm/hardware/gic.h>
 #include <asm/hardware/cache-l2x0.h>
 #include <asm/localtimer.h>
@@ -457,7 +458,7 @@ static void __init realview_eb_init(void)
 
 MACHINE_START(REALVIEW_EB, "ARM-RealView EB")
         /* Maintainer: ARM Ltd/Deep Blue Solutions Ltd */
-        .phys_io        = REALVIEW_EB_UART0_BASE,
+        .phys_io        = REALVIEW_EB_UART0_BASE & SECTION_MASK,
         .io_pg_offst    = (IO_ADDRESS(REALVIEW_EB_UART0_BASE) >> 18) & 0xfffc,
         .boot_params    = PHYS_OFFSET + 0x00000100,
         .fixup          = realview_fixup,
diff --git a/arch/arm/mach-realview/realview_pb1176.c b/arch/arm/mach-realview/realview_pb1176.c
index 96568ebfa2bb..099a1f125cf8 100644
--- a/arch/arm/mach-realview/realview_pb1176.c
+++ b/arch/arm/mach-realview/realview_pb1176.c
@@ -32,6 +32,7 @@
 #include <asm/leds.h>
 #include <asm/mach-types.h>
 #include <asm/pmu.h>
+#include <asm/pgtable.h>
 #include <asm/hardware/gic.h>
 #include <asm/hardware/cache-l2x0.h>
 
@@ -351,7 +352,7 @@ static void __init realview_pb1176_init(void)
 
 MACHINE_START(REALVIEW_PB1176, "ARM-RealView PB1176")
         /* Maintainer: ARM Ltd/Deep Blue Solutions Ltd */
-        .phys_io        = REALVIEW_PB1176_UART0_BASE,
+        .phys_io        = REALVIEW_PB1176_UART0_BASE & SECTION_MASK,
         .io_pg_offst    = (IO_ADDRESS(REALVIEW_PB1176_UART0_BASE) >> 18) & 0xfffc,
         .boot_params    = PHYS_OFFSET + 0x00000100,
         .fixup          = realview_pb1176_fixup,
diff --git a/arch/arm/mach-realview/realview_pb11mp.c b/arch/arm/mach-realview/realview_pb11mp.c
index 7fbefbbebaf0..0e07a5ccb75f 100644
--- a/arch/arm/mach-realview/realview_pb11mp.c
+++ b/arch/arm/mach-realview/realview_pb11mp.c
@@ -32,6 +32,7 @@
 #include <asm/leds.h>
 #include <asm/mach-types.h>
 #include <asm/pmu.h>
+#include <asm/pgtable.h>
 #include <asm/hardware/gic.h>
 #include <asm/hardware/cache-l2x0.h>
 #include <asm/localtimer.h>
@@ -373,7 +374,7 @@ static void __init realview_pb11mp_init(void)
 
 MACHINE_START(REALVIEW_PB11MP, "ARM-RealView PB11MPCore")
         /* Maintainer: ARM Ltd/Deep Blue Solutions Ltd */
-        .phys_io        = REALVIEW_PB11MP_UART0_BASE,
+        .phys_io        = REALVIEW_PB11MP_UART0_BASE & SECTION_MASK,
         .io_pg_offst    = (IO_ADDRESS(REALVIEW_PB11MP_UART0_BASE) >> 18) & 0xfffc,
         .boot_params    = PHYS_OFFSET + 0x00000100,
         .fixup          = realview_fixup,
diff --git a/arch/arm/mach-realview/realview_pba8.c b/arch/arm/mach-realview/realview_pba8.c
index d3c113b3dfce..ac2f06f1ca50 100644
--- a/arch/arm/mach-realview/realview_pba8.c
+++ b/arch/arm/mach-realview/realview_pba8.c
@@ -31,6 +31,7 @@
 #include <asm/leds.h>
 #include <asm/mach-types.h>
 #include <asm/pmu.h>
+#include <asm/pgtable.h>
 #include <asm/hardware/gic.h>
 
 #include <asm/mach/arch.h>
@@ -323,7 +324,7 @@ static void __init realview_pba8_init(void)
 
 MACHINE_START(REALVIEW_PBA8, "ARM-RealView PB-A8")
         /* Maintainer: ARM Ltd/Deep Blue Solutions Ltd */
-        .phys_io        = REALVIEW_PBA8_UART0_BASE,
+        .phys_io        = REALVIEW_PBA8_UART0_BASE & SECTION_MASK,
         .io_pg_offst    = (IO_ADDRESS(REALVIEW_PBA8_UART0_BASE) >> 18) & 0xfffc,
         .boot_params    = PHYS_OFFSET + 0x00000100,
         .fixup          = realview_fixup,
diff --git a/arch/arm/mach-realview/realview_pbx.c b/arch/arm/mach-realview/realview_pbx.c
index a235ba30996b..08fd683adc4c 100644
--- a/arch/arm/mach-realview/realview_pbx.c
+++ b/arch/arm/mach-realview/realview_pbx.c
@@ -31,6 +31,7 @@
 #include <asm/mach-types.h>
 #include <asm/pmu.h>
 #include <asm/smp_twd.h>
+#include <asm/pgtable.h>
 #include <asm/hardware/gic.h>
 #include <asm/hardware/cache-l2x0.h>
 
@@ -409,7 +410,7 @@ static void __init realview_pbx_init(void)
 
 MACHINE_START(REALVIEW_PBX, "ARM-RealView PBX")
         /* Maintainer: ARM Ltd/Deep Blue Solutions Ltd */
-        .phys_io        = REALVIEW_PBX_UART0_BASE,
+        .phys_io        = REALVIEW_PBX_UART0_BASE & SECTION_MASK,
         .io_pg_offst    = (IO_ADDRESS(REALVIEW_PBX_UART0_BASE) >> 18) & 0xfffc,
         .boot_params    = PHYS_OFFSET + 0x00000100,
         .fixup          = realview_pbx_fixup,
diff --git a/arch/arm/mach-s5p6442/clock.c b/arch/arm/mach-s5p6442/clock.c
index 3aadbf42c112..087e57f20ad5 100644
--- a/arch/arm/mach-s5p6442/clock.c
+++ b/arch/arm/mach-s5p6442/clock.c
@@ -294,7 +294,7 @@ void __init_or_cpufreq s5p6442_setup_clocks(void)
         mpll = s5p_get_pll45xx(xtal, __raw_readl(S5P_MPLL_CON), pll_4502);
         epll = s5p_get_pll45xx(xtal, __raw_readl(S5P_EPLL_CON), pll_4500);
 
-        printk(KERN_INFO "S5P6440: PLL settings, A=%ld, M=%ld, E=%ld",
+        printk(KERN_INFO "S5P6442: PLL settings, A=%ld, M=%ld, E=%ld",
                         apll, mpll, epll);
 
         clk_fout_apll.rate = apll;
diff --git a/arch/arm/mach-s5pv210/clock.c b/arch/arm/mach-s5pv210/clock.c
index 154bca4abc09..af91fefef2c6 100644
--- a/arch/arm/mach-s5pv210/clock.c
+++ b/arch/arm/mach-s5pv210/clock.c
@@ -183,6 +183,11 @@ static int s5pv210_clk_mask0_ctrl(struct clk *clk, int enable)
         return s5p_gatectrl(S5P_CLK_SRC_MASK0, clk, enable);
 }
 
+static int s5pv210_clk_mask1_ctrl(struct clk *clk, int enable)
+{
+        return s5p_gatectrl(S5P_CLK_SRC_MASK1, clk, enable);
+}
+
 static struct clk clk_sclk_hdmi27m = {
         .name           = "sclk_hdmi27m",
         .id             = -1,
@@ -406,14 +411,14 @@ static struct clk init_clocks_disable[] = {
                 .id             = 0,
                 .parent         = &clk_p,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<4),
+                .ctrlbit        = (1 << 5),
         }, {
                 .name           = "i2s_v32",
                 .id             = 1,
                 .parent         = &clk_p,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<4),
-        }
+                .ctrlbit        = (1 << 6),
+        },
 };
 
 static struct clk init_clocks[] = {
@@ -429,25 +434,25 @@ static struct clk init_clocks[] = {
                 .id             = 0,
                 .parent         = &clk_pclk_psys.clk,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<7),
+                .ctrlbit        = (1 << 17),
         }, {
                 .name           = "uart",
                 .id             = 1,
                 .parent         = &clk_pclk_psys.clk,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<8),
+                .ctrlbit        = (1 << 18),
         }, {
                 .name           = "uart",
                 .id             = 2,
                 .parent         = &clk_pclk_psys.clk,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<9),
+                .ctrlbit        = (1 << 19),
         }, {
                 .name           = "uart",
                 .id             = 3,
                 .parent         = &clk_pclk_psys.clk,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<10),
+                .ctrlbit        = (1 << 20),
         },
 };
 
@@ -497,8 +502,8 @@ static struct clksrc_clk clk_sclk_dac = {
         .clk            = {
                 .name           = "sclk_dac",
                 .id             = -1,
-                .ctrlbit        = (1 << 10),
-                .enable         = s5pv210_clk_ip1_ctrl,
+                .enable         = s5pv210_clk_mask0_ctrl,
+                .ctrlbit        = (1 << 2),
         },
         .sources        = &clkset_sclk_dac,
         .reg_src        = { .reg = S5P_CLK_SRC1, .shift = 8, .size = 1 },
@@ -527,8 +532,8 @@ static struct clksrc_clk clk_sclk_hdmi = {
         .clk            = {
                 .name           = "sclk_hdmi",
                 .id             = -1,
-                .enable         = s5pv210_clk_ip1_ctrl,
-                .ctrlbit        = (1 << 11),
+                .enable         = s5pv210_clk_mask0_ctrl,
+                .ctrlbit        = (1 << 0),
         },
         .sources        = &clkset_sclk_hdmi,
         .reg_src        = { .reg = S5P_CLK_SRC1, .shift = 0, .size = 1 },
@@ -565,8 +570,8 @@ static struct clksrc_clk clk_sclk_audio0 = {
         .clk            = {
                 .name           = "sclk_audio",
                 .id             = 0,
-                .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1 << 4),
+                .enable         = s5pv210_clk_mask0_ctrl,
+                .ctrlbit        = (1 << 24),
         },
         .sources = &clkset_sclk_audio0,
         .reg_src = { .reg = S5P_CLK_SRC6, .shift = 0, .size = 4 },
@@ -594,8 +599,8 @@ static struct clksrc_clk clk_sclk_audio1 = {
         .clk            = {
                 .name           = "sclk_audio",
                 .id             = 1,
-                .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1 << 5),
+                .enable         = s5pv210_clk_mask0_ctrl,
+                .ctrlbit        = (1 << 25),
         },
         .sources = &clkset_sclk_audio1,
         .reg_src = { .reg = S5P_CLK_SRC6, .shift = 4, .size = 4 },
@@ -623,8 +628,8 @@ static struct clksrc_clk clk_sclk_audio2 = {
         .clk            = {
                 .name           = "sclk_audio",
                 .id             = 2,
-                .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1 << 6),
+                .enable         = s5pv210_clk_mask0_ctrl,
+                .ctrlbit        = (1 << 26),
         },
         .sources = &clkset_sclk_audio2,
         .reg_src = { .reg = S5P_CLK_SRC6, .shift = 8, .size = 4 },
@@ -680,8 +685,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk    = {
                         .name           = "uclk1",
                         .id             = 0,
-                        .ctrlbit        = (1<<17),
-                        .enable         = s5pv210_clk_ip3_ctrl,
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 12),
                 },
                 .sources = &clkset_uart,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 16, .size = 4 },
@@ -690,8 +695,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "uclk1",
                         .id             = 1,
-                        .enable         = s5pv210_clk_ip3_ctrl,
-                        .ctrlbit        = (1 << 18),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 13),
                 },
                 .sources = &clkset_uart,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 20, .size = 4 },
@@ -700,8 +705,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "uclk1",
                         .id             = 2,
-                        .enable         = s5pv210_clk_ip3_ctrl,
-                        .ctrlbit        = (1 << 19),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 14),
                 },
                 .sources = &clkset_uart,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 24, .size = 4 },
@@ -710,8 +715,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "uclk1",
                         .id             = 3,
-                        .enable         = s5pv210_clk_ip3_ctrl,
-                        .ctrlbit        = (1 << 20),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 15),
                 },
                 .sources = &clkset_uart,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 28, .size = 4 },
@@ -720,8 +725,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk    = {
                         .name           = "sclk_mixer",
                         .id             = -1,
-                        .enable         = s5pv210_clk_ip1_ctrl,
-                        .ctrlbit        = (1 << 9),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 1),
                 },
                 .sources = &clkset_sclk_mixer,
                 .reg_src = { .reg = S5P_CLK_SRC1, .shift = 4, .size = 1 },
@@ -738,8 +743,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk    = {
                         .name           = "sclk_fimc",
                         .id             = 0,
-                        .enable         = s5pv210_clk_ip0_ctrl,
-                        .ctrlbit        = (1 << 24),
+                        .enable         = s5pv210_clk_mask1_ctrl,
+                        .ctrlbit        = (1 << 2),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC3, .shift = 12, .size = 4 },
@@ -748,8 +753,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk    = {
                         .name           = "sclk_fimc",
                         .id             = 1,
-                        .enable         = s5pv210_clk_ip0_ctrl,
-                        .ctrlbit        = (1 << 25),
+                        .enable         = s5pv210_clk_mask1_ctrl,
+                        .ctrlbit        = (1 << 3),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC3, .shift = 16, .size = 4 },
@@ -758,8 +763,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk    = {
                         .name           = "sclk_fimc",
                         .id             = 2,
-                        .enable         = s5pv210_clk_ip0_ctrl,
-                        .ctrlbit        = (1 << 26),
+                        .enable         = s5pv210_clk_mask1_ctrl,
+                        .ctrlbit        = (1 << 4),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC3, .shift = 20, .size = 4 },
@@ -768,6 +773,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_cam",
                         .id             = 0,
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 3),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC1, .shift = 12, .size = 4 },
@@ -776,6 +783,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_cam",
                         .id             = 1,
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 4),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC1, .shift = 16, .size = 4 },
@@ -784,8 +793,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_fimd",
                         .id             = -1,
-                        .enable         = s5pv210_clk_ip1_ctrl,
-                        .ctrlbit        = (1 << 0),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 5),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC1, .shift = 20, .size = 4 },
@@ -794,8 +803,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_mmc",
                         .id             = 0,
-                        .enable         = s5pv210_clk_ip2_ctrl,
-                        .ctrlbit        = (1 << 16),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 8),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 0, .size = 4 },
@@ -804,8 +813,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_mmc",
                         .id             = 1,
-                        .enable         = s5pv210_clk_ip2_ctrl,
-                        .ctrlbit        = (1 << 17),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 9),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 4, .size = 4 },
@@ -814,8 +823,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_mmc",
                         .id             = 2,
-                        .enable         = s5pv210_clk_ip2_ctrl,
-                        .ctrlbit        = (1 << 18),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 10),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 8, .size = 4 },
@@ -824,8 +833,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_mmc",
                         .id             = 3,
-                        .enable         = s5pv210_clk_ip2_ctrl,
-                        .ctrlbit        = (1 << 19),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 11),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC4, .shift = 12, .size = 4 },
@@ -864,8 +873,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_csis",
                         .id             = -1,
-                        .enable         = s5pv210_clk_ip0_ctrl,
-                        .ctrlbit        = (1 << 31),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 6),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC1, .shift = 24, .size = 4 },
@@ -874,8 +883,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_spi",
                         .id             = 0,
-                        .enable         = s5pv210_clk_ip3_ctrl,
-                        .ctrlbit        = (1 << 12),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 16),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC5, .shift = 0, .size = 4 },
@@ -884,8 +893,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_spi",
                         .id             = 1,
-                        .enable         = s5pv210_clk_ip3_ctrl,
-                        .ctrlbit        = (1 << 13),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 17),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC5, .shift = 4, .size = 4 },
@@ -894,8 +903,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_pwi",
                         .id             = -1,
-                        .enable         = &s5pv210_clk_ip4_ctrl,
-                        .ctrlbit        = (1 << 2),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 29),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC6, .shift = 20, .size = 4 },
@@ -904,8 +913,8 @@ static struct clksrc_clk clksrcs[] = {
                 .clk            = {
                         .name           = "sclk_pwm",
                         .id             = -1,
-                        .enable         = s5pv210_clk_ip3_ctrl,
-                        .ctrlbit        = (1 << 23),
+                        .enable         = s5pv210_clk_mask0_ctrl,
+                        .ctrlbit        = (1 << 19),
                 },
                 .sources = &clkset_group2,
                 .reg_src = { .reg = S5P_CLK_SRC5, .shift = 12, .size = 4 },
diff --git a/arch/arm/mach-ux500/Makefile b/arch/arm/mach-ux500/Makefile
index c7bc4199e3a8..4556aea9c3c5 100644
--- a/arch/arm/mach-ux500/Makefile
+++ b/arch/arm/mach-ux500/Makefile
@@ -7,4 +7,5 @@ obj-$(CONFIG_UX500_SOC_DB5500)	+= cpu-db5500.o devices-db5500.o
 obj-$(CONFIG_UX500_SOC_DB8500)  += cpu-db8500.o devices-db8500.o
 obj-$(CONFIG_MACH_U8500_MOP)    += board-mop500.o
 obj-$(CONFIG_MACH_U5500)        += board-u5500.o
-obj-$(CONFIG_SMP)               += platsmp.o headsmp.o localtimer.o
+obj-$(CONFIG_SMP)               += platsmp.o headsmp.o
+obj-$(CONFIG_LOCAL_TIMERS)      += localtimer.o
diff --git a/arch/arm/mach-ux500/clock.c b/arch/arm/mach-ux500/clock.c
index 6544855af2f1..fe84b9021c7a 100644
--- a/arch/arm/mach-ux500/clock.c
+++ b/arch/arm/mach-ux500/clock.c
@@ -16,6 +16,7 @@
 
 #include <asm/clkdev.h>
 
+#include <plat/mtu.h>
 #include <mach/hardware.h>
 #include "clock.h"
 
@@ -59,6 +60,9 @@
 #define PRCM_DMACLK_MGT         0x074
 #define PRCM_B2R2CLK_MGT        0x078
 #define PRCM_TVCLK_MGT          0x07C
+#define PRCM_TCR                0x1C8
+#define PRCM_TCR_STOPPED        (1 << 16)
+#define PRCM_TCR_DOZE_MODE      (1 << 17)
 #define PRCM_UNIPROCLK_MGT      0x278
 #define PRCM_SSPCLK_MGT         0x280
 #define PRCM_RNGCLK_MGT         0x284
@@ -120,10 +124,95 @@ void clk_disable(struct clk *clk)
 }
 EXPORT_SYMBOL(clk_disable);
 
+/*
+ * The MTU has a separate, rather complex muxing setup
+ * with alternative parents (peripheral cluster or
+ * ULP or fixed 32768 Hz) depending on settings
+ */
+static unsigned long clk_mtu_get_rate(struct clk *clk)
+{
+        void __iomem *addr = __io_address(U8500_PRCMU_BASE)
+                + PRCM_TCR;
+        u32 tcr = readl(addr);
+        int mtu = (int) clk->data;
+        /*
+         * One of these is selected eventually
+         * TODO: Replace the constant with a reference
+         * to the ULP source once this is modeled.
+         */
+        unsigned long clk32k = 32768;
+        unsigned long mturate;
+        unsigned long retclk;
+
+        /* Get the rate from the parent as a default */
+        if (clk->parent_periph)
+                mturate = clk_get_rate(clk->parent_periph);
+        else if (clk->parent_cluster)
+                mturate = clk_get_rate(clk->parent_cluster);
+        else
+                /* We need to be connected SOMEWHERE */
+                BUG();
+
+        /*
+         * Are we in doze mode?
+         * In this mode the parent peripheral or the fixed 32768 Hz
+         * clock is fed into the block.
+         */
+        if (!(tcr & PRCM_TCR_DOZE_MODE)) {
+                /*
+                 * Here we're using the clock input from the APE ULP
+                 * clock domain. But first: are the timers stopped?
+                 */
+                if (tcr & PRCM_TCR_STOPPED) {
+                        clk32k = 0;
+                        mturate = 0;
+                } else {
+                        /* Else default mode: 0 and 2.4 MHz */
+                        clk32k = 0;
+                        if (cpu_is_u5500())
+                                /* DB5500 divides by 8 */
+                                mturate /= 8;
+                        else if (cpu_is_u8500ed()) {
+                                /*
+                                 * This clocking setting must not be used
+                                 * in the ED chip, it is simply not
+                                 * connected anywhere!
+                                 */
+                                mturate = 0;
+                                BUG();
+                        } else
+                                /*
+                                 * In this mode the ulp38m4 clock is divided
+                                 * by a factor 16, on the DB8500 typically
+                                 * 38400000 / 16 ~ 2.4 MHz.
+                                 * TODO: Replace the constant with a reference
+                                 * to the ULP source once this is modeled.
+                                 */
+                                mturate = 38400000 / 16;
+                }
+        }
+
+        /* Return the clock selected for this MTU */
+        if (tcr & (1 << mtu))
+                retclk = clk32k;
+        else
+                retclk = mturate;
+
+        pr_info("MTU%d clock rate: %lu Hz\n", mtu, retclk);
+        return retclk;
+}
+
 unsigned long clk_get_rate(struct clk *clk)
 {
         unsigned long rate;
 
+        /*
+         * If there is a custom getrate callback for this clock,
+         * it will take precedence.
+         */
+        if (clk->get_rate)
+                return clk->get_rate(clk);
+
         if (clk->ops && clk->ops->get_rate)
                 return clk->ops->get_rate(clk);
 
@@ -341,8 +430,9 @@ static DEFINE_PRCC_CLK(5, usb_v1, 	0,  0, NULL);
 
 /* Peripheral Cluster #6 */
 
-static DEFINE_PRCC_CLK(6, mtu1_v1,      8, -1, NULL);
-static DEFINE_PRCC_CLK(6, mtu0_v1,      7, -1, NULL);
+/* MTU ID in data */
+static DEFINE_PRCC_CLK_CUSTOM(6, mtu1_v1, 8, -1, NULL, clk_mtu_get_rate, 1);
+static DEFINE_PRCC_CLK_CUSTOM(6, mtu0_v1, 7, -1, NULL, clk_mtu_get_rate, 0);
 static DEFINE_PRCC_CLK(6, cfgreg_v1,    6,  6, NULL);
 static DEFINE_PRCC_CLK(6, dmc_ed,       6,  6, NULL);
 static DEFINE_PRCC_CLK(6, hash1,        5, -1, NULL);
@@ -357,8 +447,9 @@ static DEFINE_PRCC_CLK(6, rng_v1, 	0,  0, &clk_rngclk);
 /* Peripheral Cluster #7 */
 
 static DEFINE_PRCC_CLK(7, tzpc0_ed,     4, -1, NULL);
-static DEFINE_PRCC_CLK(7, mtu1_ed,      3, -1, NULL);
-static DEFINE_PRCC_CLK(7, mtu0_ed,      2, -1, NULL);
+/* MTU ID in data */
+static DEFINE_PRCC_CLK_CUSTOM(7, mtu1_ed, 3, -1, NULL, clk_mtu_get_rate, 1);
+static DEFINE_PRCC_CLK_CUSTOM(7, mtu0_ed, 2, -1, NULL, clk_mtu_get_rate, 0);
 static DEFINE_PRCC_CLK(7, wdg_ed,       1, -1, NULL);
 static DEFINE_PRCC_CLK(7, cfgreg_ed,    0, -1, NULL);
 
@@ -503,15 +594,17 @@ static struct clk_lookup u8500_v1_clks[] = {
         CLK(uiccclk,    "uicc",         NULL),
 };
 
-static int __init clk_init(void)
+int __init clk_init(void)
 {
         if (cpu_is_u8500ed()) {
                 clk_prcmu_ops.enable = clk_prcmu_ed_enable;
                 clk_prcmu_ops.disable = clk_prcmu_ed_disable;
+                clk_per6clk.rate = 100000000;
         } else if (cpu_is_u5500()) {
                 /* Clock tree for U5500 not implemented yet */
                 clk_prcc_ops.enable = clk_prcc_ops.disable = NULL;
                 clk_prcmu_ops.enable = clk_prcmu_ops.disable = NULL;
+                clk_per6clk.rate = 26000000;
         }
 
         clkdev_add_table(u8500_common_clks, ARRAY_SIZE(u8500_common_clks));
@@ -522,4 +615,3 @@ static int __init clk_init(void)
 
         return 0;
 }
-arch_initcall(clk_init);
diff --git a/arch/arm/mach-ux500/clock.h b/arch/arm/mach-ux500/clock.h
index e4f99b65026f..a05802501527 100644
--- a/arch/arm/mach-ux500/clock.h
+++ b/arch/arm/mach-ux500/clock.h
@@ -28,6 +28,9 @@ struct clkops {
  * @ops:                pointer to clkops struct used to control this clock
  * @name:               name, for debugging
  * @enabled:            refcount. positive if enabled, zero if disabled
+ * @get_rate:           custom callback for getting the clock rate
+ * @data:               custom per-clock data for example for the get_rate
+ *                      callback
  * @rate:               fixed rate for clocks which don't implement
  *                      ops->getrate
  * @prcmu_cg_off:       address offset of the combined enable/disable register
@@ -67,6 +70,8 @@ struct clk {
         const struct clkops     *ops;
         const char              *name;
         unsigned int            enabled;
+        unsigned long           (*get_rate)(struct clk *);
+        void                    *data;
 
         unsigned long           rate;
         struct list_head        list;
@@ -117,9 +122,26 @@ struct clk clk_##_name = {						\
                 .parent_periph  = _kernclk                              \
         }
 
+#define DEFINE_PRCC_CLK_CUSTOM(_pclust, _name, _bus_en, _kernel_en, _kernclk, _callback, _data) \
+struct clk clk_##_name = {                                              \
+                .name           = #_name,                               \
+                .ops            = &clk_prcc_ops,                        \
+                .cluster        = _pclust,                              \
+                .prcc_bus       = _bus_en,                              \
+                .prcc_kernel    = _kernel_en,                           \
+                .parent_cluster = &clk_per##_pclust##clk,               \
+                .parent_periph  = _kernclk,                             \
+                .get_rate       = _callback,                            \
+                .data           = (void *) _data                        \
+        }
+
+
 #define CLK(_clk, _devname, _conname)                   \
         {                                               \
                 .clk    = &clk_##_clk,                  \
                 .dev_id = _devname,                     \
                 .con_id = _conname,                     \
         }
+
+int __init clk_db8500_ed_fixup(void);
+int __init clk_init(void);
diff --git a/arch/arm/mach-ux500/cpu.c b/arch/arm/mach-ux500/cpu.c
index d81ad023963c..e0fd747e447a 100644
--- a/arch/arm/mach-ux500/cpu.c
+++ b/arch/arm/mach-ux500/cpu.c
@@ -62,6 +62,12 @@ void __init ux500_init_irq(void)
 {
         gic_dist_init(0, __io_address(UX500_GIC_DIST_BASE), 29);
         gic_cpu_init(0, __io_address(UX500_GIC_CPU_BASE));
+
+        /*
+         * Init clocks here so that they are available for system timer
+         * initialization.
+         */
+        clk_init();
 }
 
 #ifdef CONFIG_CACHE_L2X0
diff --git a/arch/arm/mach-vexpress/ct-ca9x4.c b/arch/arm/mach-vexpress/ct-ca9x4.c
index e6f73030d5f0..6353459bb567 100644
--- a/arch/arm/mach-vexpress/ct-ca9x4.c
+++ b/arch/arm/mach-vexpress/ct-ca9x4.c
@@ -2,6 +2,7 @@
  * Versatile Express Core Tile Cortex A9x4 Support
  */
 #include <linux/init.h>
+#include <linux/gfp.h>
 #include <linux/device.h>
 #include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
@@ -9,6 +10,7 @@
 #include <linux/amba/clcd.h>
 
 #include <asm/clkdev.h>
+#include <asm/pgtable.h>
 #include <asm/hardware/arm_timer.h>
 #include <asm/hardware/cache-l2x0.h>
 #include <asm/hardware/gic.h>
@@ -235,7 +237,7 @@ static void ct_ca9x4_init(void)
 }
 
 MACHINE_START(VEXPRESS, "ARM-Versatile Express CA9x4")
-        .phys_io        = V2M_UART0,
+        .phys_io        = V2M_UART0 & SECTION_MASK,
         .io_pg_offst    = (__MMIO_P2V(V2M_UART0) >> 18) & 0xfffc,
         .boot_params    = PHYS_OFFSET + 0x00000100,
         .map_io         = ct_ca9x4_map_io,
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 346ae14824a5..101105e52610 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -735,6 +735,25 @@ config NEEDS_SYSCALL_FOR_CMPXCHG
           Forget about fast user space cmpxchg support.
           It is just not possible.
 
+config DMA_CACHE_RWFO
+        bool "Enable read/write for ownership DMA cache maintenance"
+        depends on CPU_V6 && SMP
+        default y
+        help
+          The Snoop Control Unit on ARM11MPCore does not detect the
+          cache maintenance operations and the dma_{map,unmap}_area()
+          functions may leave stale cache entries on other CPUs. By
+          enabling this option, Read or Write For Ownership in the ARMv6
+          DMA cache maintenance functions is performed. These LDR/STR
+          instructions change the cache line state to shared or modified
+          so that the cache operation has the desired effect.
+
+          Note that the workaround is only valid on processors that do
+          not perform speculative loads into the D-cache. For such
+          processors, if cache maintenance operations are not broadcast
+          in hardware, other workarounds are needed (e.g. cache
+          maintenance broadcasting in software via FIQ).
+
 config OUTER_CACHE
         bool
 
@@ -794,6 +813,8 @@ config ARM_L1_CACHE_SHIFT
 
 config ARM_DMA_MEM_BUFFERABLE
         bool "Use non-cacheable memory for DMA" if CPU_V6 && !CPU_V7
+        depends on !(MACH_REALVIEW_PB1176 || REALVIEW_EB_ARM11MP || \
+                     MACH_REALVIEW_PB11MP)
         default y if CPU_V6 || CPU_V7
         help
           Historically, the kernel has used strongly ordered mappings to
diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S
index e46ecd847138..86aa689ef1aa 100644
--- a/arch/arm/mm/cache-v6.S
+++ b/arch/arm/mm/cache-v6.S
@@ -211,8 +211,9 @@ v6_dma_inv_range:
         mcrne   p15, 0, r1, c7, c15, 1          @ clean & invalidate unified line
 #endif
 1:
-#ifdef CONFIG_SMP
-        str     r0, [r0]                        @ write for ownership
+#ifdef CONFIG_DMA_CACHE_RWFO
+        ldr     r2, [r0]                        @ read for ownership
+        str     r2, [r0]                        @ write for ownership
 #endif
 #ifdef HARVARD_CACHE
         mcr     p15, 0, r0, c7, c6, 1           @ invalidate D line
@@ -234,7 +235,7 @@ v6_dma_inv_range:
 v6_dma_clean_range:
         bic     r0, r0, #D_CACHE_LINE_SIZE - 1
 1:
-#ifdef CONFIG_SMP
+#ifdef CONFIG_DMA_CACHE_RWFO
         ldr     r2, [r0]                        @ read for ownership
 #endif
 #ifdef HARVARD_CACHE
@@ -257,7 +258,7 @@ v6_dma_clean_range:
 ENTRY(v6_dma_flush_range)
         bic     r0, r0, #D_CACHE_LINE_SIZE - 1
 1:
-#ifdef CONFIG_SMP
+#ifdef CONFIG_DMA_CACHE_RWFO
         ldr     r2, [r0]                        @ read for ownership
         str     r2, [r0]                        @ write for ownership
 #endif
@@ -283,9 +284,13 @@ ENTRY(v6_dma_map_area)
         add     r1, r1, r0
         teq     r2, #DMA_FROM_DEVICE
         beq     v6_dma_inv_range
+#ifndef CONFIG_DMA_CACHE_RWFO
+        b       v6_dma_clean_range
+#else
         teq     r2, #DMA_TO_DEVICE
         beq     v6_dma_clean_range
         b       v6_dma_flush_range
+#endif
 ENDPROC(v6_dma_map_area)
 
 /*
@@ -295,6 +300,11 @@ ENDPROC(v6_dma_map_area)
  *      - dir   - DMA direction
  */
 ENTRY(v6_dma_unmap_area)
+#ifndef CONFIG_DMA_CACHE_RWFO
+        add     r1, r1, r0
+        teq     r2, #DMA_TO_DEVICE
+        bne     v6_dma_inv_range
+#endif
         mov     pc, lr
 ENDPROC(v6_dma_unmap_area)
 
diff --git a/arch/arm/mm/copypage-feroceon.c b/arch/arm/mm/copypage-feroceon.c
index 5eb4fd93893d..ac163de7dc01 100644
--- a/arch/arm/mm/copypage-feroceon.c
+++ b/arch/arm/mm/copypage-feroceon.c
@@ -18,7 +18,7 @@ feroceon_copy_user_page(void *kto, const void *kfrom)
 {
         asm("\
         stmfd   sp!, {r4-r9, lr}                \n\
-        mov     ip, %0                          \n\
+        mov     ip, %2                          \n\
 1:      mov     lr, r1                          \n\
         ldmia   r1!, {r2 - r9}                  \n\
         pld     [lr, #32]                       \n\
@@ -64,7 +64,7 @@ feroceon_copy_user_page(void *kto, const void *kfrom)
         mcr     p15, 0, ip, c7, c10, 4          @ drain WB\n\
         ldmfd   sp!, {r4-r9, pc}"
         :
-        : "I" (PAGE_SIZE));
+        : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE));
 }
 
 void feroceon_copy_user_highpage(struct page *to, struct page *from,
diff --git a/arch/arm/mm/copypage-v4wb.c b/arch/arm/mm/copypage-v4wb.c
index 7c2eb55cd4a9..cb589cbb2b6c 100644
--- a/arch/arm/mm/copypage-v4wb.c
+++ b/arch/arm/mm/copypage-v4wb.c
@@ -27,7 +27,7 @@ v4wb_copy_user_page(void *kto, const void *kfrom)
 {
         asm("\
         stmfd   sp!, {r4, lr}                   @ 2\n\
-        mov     r2, %0                          @ 1\n\
+        mov     r2, %2                          @ 1\n\
         ldmia   r1!, {r3, r4, ip, lr}           @ 4\n\
 1:      mcr     p15, 0, r0, c7, c6, 1           @ 1   invalidate D line\n\
         stmia   r0!, {r3, r4, ip, lr}           @ 4\n\
@@ -44,7 +44,7 @@ v4wb_copy_user_page(void *kto, const void *kfrom)
         mcr     p15, 0, r1, c7, c10, 4          @ 1   drain WB\n\
         ldmfd    sp!, {r4, pc}                  @ 3"
         :
-        : "I" (PAGE_SIZE / 64));
+        : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64));
 }
 
 void v4wb_copy_user_highpage(struct page *to, struct page *from,
diff --git a/arch/arm/mm/copypage-v4wt.c b/arch/arm/mm/copypage-v4wt.c
index 172e6a55458e..30c7d048a324 100644
--- a/arch/arm/mm/copypage-v4wt.c
+++ b/arch/arm/mm/copypage-v4wt.c
@@ -25,7 +25,7 @@ v4wt_copy_user_page(void *kto, const void *kfrom)
 {
         asm("\
         stmfd   sp!, {r4, lr}                   @ 2\n\
-        mov     r2, %0                          @ 1\n\
+        mov     r2, %2                          @ 1\n\
         ldmia   r1!, {r3, r4, ip, lr}           @ 4\n\
 1:      stmia   r0!, {r3, r4, ip, lr}           @ 4\n\
         ldmia   r1!, {r3, r4, ip, lr}           @ 4+1\n\
@@ -40,7 +40,7 @@ v4wt_copy_user_page(void *kto, const void *kfrom)
         mcr     p15, 0, r2, c7, c7, 0           @ flush ID cache\n\
         ldmfd   sp!, {r4, pc}                   @ 3"
         :
-        : "I" (PAGE_SIZE / 64));
+        : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64));
 }
 
 void v4wt_copy_user_highpage(struct page *to, struct page *from,
diff --git a/arch/arm/mm/copypage-xsc3.c b/arch/arm/mm/copypage-xsc3.c
index 747ad4140fc7..f9cde0702f1e 100644
--- a/arch/arm/mm/copypage-xsc3.c
+++ b/arch/arm/mm/copypage-xsc3.c
@@ -34,7 +34,7 @@ xsc3_mc_copy_user_page(void *kto, const void *kfrom)
 {
         asm("\
         stmfd   sp!, {r4, r5, lr}               \n\
-        mov     lr, %0                          \n\
+        mov     lr, %2                          \n\
                                                 \n\
         pld     [r1, #0]                        \n\
         pld     [r1, #32]                       \n\
@@ -67,7 +67,7 @@ xsc3_mc_copy_user_page(void *kto, const void *kfrom)
                                                 \n\
         ldmfd   sp!, {r4, r5, pc}"
         :
-        : "I" (PAGE_SIZE / 64 - 1));
+        : "r" (kto), "r" (kfrom), "I" (PAGE_SIZE / 64 - 1));
 }
 
 void xsc3_mc_copy_user_highpage(struct page *to, struct page *from,
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 13fa536d82e6..9e7742f0a102 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -24,15 +24,6 @@
 #include <asm/tlbflush.h>
 #include <asm/sizes.h>
 
-/* Sanity check size */
-#if (CONSISTENT_DMA_SIZE % SZ_2M)
-#error "CONSISTENT_DMA_SIZE must be multiple of 2MiB"
-#endif
-
-#define CONSISTENT_OFFSET(x)    (((unsigned long)(x) - CONSISTENT_BASE) >> PAGE_SHIFT)
-#define CONSISTENT_PTE_INDEX(x) (((unsigned long)(x) - CONSISTENT_BASE) >> PGDIR_SHIFT)
-#define NUM_CONSISTENT_PTES (CONSISTENT_DMA_SIZE >> PGDIR_SHIFT)
-
 static u64 get_coherent_dma_mask(struct device *dev)
 {
         u64 mask = ISA_DMA_THRESHOLD;
@@ -123,6 +114,15 @@ static void __dma_free_buffer(struct page *page, size_t size)
 }
 
 #ifdef CONFIG_MMU
+/* Sanity check size */
+#if (CONSISTENT_DMA_SIZE % SZ_2M)
+#error "CONSISTENT_DMA_SIZE must be multiple of 2MiB"
+#endif
+
+#define CONSISTENT_OFFSET(x)    (((unsigned long)(x) - CONSISTENT_BASE) >> PAGE_SHIFT)
+#define CONSISTENT_PTE_INDEX(x) (((unsigned long)(x) - CONSISTENT_BASE) >> PGDIR_SHIFT)
+#define NUM_CONSISTENT_PTES (CONSISTENT_DMA_SIZE >> PGDIR_SHIFT)
+
 /*
  * These are the page tables (2MB each) covering uncached, DMA consistent allocations
  */
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index 92f5801f99c1..cbfb2edcf7d1 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -393,6 +393,9 @@ do_translation_fault(unsigned long addr, unsigned int fsr,
         if (addr < TASK_SIZE)
                 return do_page_fault(addr, fsr, regs);
 
+        if (user_mode(regs))
+                goto bad_area;
+
         index = pgd_index(addr);
 
         /*
diff --git a/arch/arm/mm/highmem.c b/arch/arm/mm/highmem.c
index 77b030f5ec09..086816b205b8 100644
--- a/arch/arm/mm/highmem.c
+++ b/arch/arm/mm/highmem.c
@@ -48,7 +48,16 @@ void *kmap_atomic(struct page *page, enum km_type type)
 
         debug_kmap_atomic(type);
 
-        kmap = kmap_high_get(page);
+#ifdef CONFIG_DEBUG_HIGHMEM
+        /*
+         * There is no cache coherency issue when non VIVT, so force the
+         * dedicated kmap usage for better debugging purposes in that case.
+         */
+        if (!cache_is_vivt())
+                kmap = NULL;
+        else
+#endif
+                kmap = kmap_high_get(page);
         if (kmap)
                 return kmap;
 
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 1ba6cf5a2c02..f6a999465323 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -678,10 +678,10 @@ void __init mem_init(void)
 void free_initmem(void)
 {
 #ifdef CONFIG_HAVE_TCM
-        extern char *__tcm_start, *__tcm_end;
+        extern char __tcm_start, __tcm_end;
 
-        totalram_pages += free_area(__phys_to_pfn(__pa(__tcm_start)),
-                                    __phys_to_pfn(__pa(__tcm_end)),
+        totalram_pages += free_area(__phys_to_pfn(__pa(&__tcm_start)),
+                                    __phys_to_pfn(__pa(&__tcm_end)),
                                     "TCM link");
 #endif
 
diff --git a/arch/arm/plat-nomadik/timer.c b/arch/arm/plat-nomadik/timer.c
index 0ff3798769ab..08aaa4a7f65f 100644
--- a/arch/arm/plat-nomadik/timer.c
+++ b/arch/arm/plat-nomadik/timer.c
@@ -13,7 +13,9 @@
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/clockchips.h>
+#include <linux/clk.h>
 #include <linux/jiffies.h>
+#include <linux/err.h>
 #include <asm/mach/time.h>
 
 #include <plat/mtu.h>
@@ -124,13 +126,25 @@ static struct irqaction nmdk_timer_irq = {
 void __init nmdk_timer_init(void)
 {
         unsigned long rate;
-        u32 cr = MTU_CRn_32BITS;;
+        struct clk *clk0;
+        struct clk *clk1;
+        u32 cr;
+
+        clk0 = clk_get_sys("mtu0", NULL);
+        BUG_ON(IS_ERR(clk0));
+
+        clk1 = clk_get_sys("mtu1", NULL);
+        BUG_ON(IS_ERR(clk1));
+
+        clk_enable(clk0);
+        clk_enable(clk1);
 
         /*
          * Tick rate is 2.4MHz for Nomadik and 110MHz for ux500:
          * use a divide-by-16 counter if it's more than 16MHz
          */
-        rate = CLOCK_TICK_RATE;
+        cr = MTU_CRn_32BITS;;
+        rate = clk_get_rate(clk0);
         if (rate > 16 << 20) {
                 rate /= 16;
                 cr |= MTU_CRn_PRESCALE_16;
@@ -153,6 +167,14 @@ void __init nmdk_timer_init(void)
                        nmdk_clksrc.name);
 
         /* Timer 1 is used for events, fix according to rate */
+        cr = MTU_CRn_32BITS;
+        rate = clk_get_rate(clk1);
+        if (rate > 16 << 20) {
+                rate /= 16;
+                cr |= MTU_CRn_PRESCALE_16;
+        } else {
+                cr |= MTU_CRn_PRESCALE_1;
+        }
         writel(cr | MTU_CRn_ONESHOT, mtu_base + MTU_CR(1)); /* off, currently */
         nmdk_clkevt.mult = div_sc(rate, NSEC_PER_SEC, nmdk_clkevt.shift);
         nmdk_clkevt.max_delta_ns =
diff --git a/arch/arm/plat-omap/dmtimer.c b/arch/arm/plat-omap/dmtimer.c
index c64875f11fac..44bafdab2dce 100644
--- a/arch/arm/plat-omap/dmtimer.c
+++ b/arch/arm/plat-omap/dmtimer.c
@@ -541,11 +541,11 @@ void omap_dm_timer_stop(struct omap_dm_timer *timer)
                   * timer is stopped
                   */
                 udelay(3500000 / clk_get_rate(timer->fclk) + 1);
-                /* Ack possibly pending interrupt */
-                omap_dm_timer_write_reg(timer, OMAP_TIMER_STAT_REG,
-                                OMAP_TIMER_INT_OVERFLOW);
 #endif
         }
+        /* Ack possibly pending interrupt */
+        omap_dm_timer_write_reg(timer, OMAP_TIMER_STAT_REG,
+                        OMAP_TIMER_INT_OVERFLOW);
 }
 EXPORT_SYMBOL_GPL(omap_dm_timer_stop);
 
diff --git a/arch/arm/plat-omap/gpio.c b/arch/arm/plat-omap/gpio.c
index 393e9219a5b6..9b7e3545f325 100644
--- a/arch/arm/plat-omap/gpio.c
+++ b/arch/arm/plat-omap/gpio.c
@@ -673,6 +673,7 @@ static void _set_gpio_debounce(struct gpio_bank *bank, unsigned gpio,
                 if (cpu_is_omap34xx() || cpu_is_omap44xx())
                         clk_disable(bank->dbck);
         }
+        bank->dbck_enable_mask = val;
 
         __raw_writel(val, reg);
 }
diff --git a/arch/arm/plat-omap/iovmm.c b/arch/arm/plat-omap/iovmm.c
index e43983ba59c5..8ce0de247c71 100644
--- a/arch/arm/plat-omap/iovmm.c
+++ b/arch/arm/plat-omap/iovmm.c
@@ -140,8 +140,10 @@ static struct sg_table *sgtable_alloc(const size_t bytes, u32 flags)
                 return ERR_PTR(-ENOMEM);
 
         err = sg_alloc_table(sgt, nr_entries, GFP_KERNEL);
-        if (err)
+        if (err) {
+                kfree(sgt);
                 return ERR_PTR(err);
+        }
 
         pr_debug("%s: sgt:%p(%d entries)\n", __func__, sgt, nr_entries);
 
diff --git a/arch/arm/plat-pxa/Makefile b/arch/arm/plat-pxa/Makefile
index 6187edfbcb77..a17cc0c6a6b0 100644
--- a/arch/arm/plat-pxa/Makefile
+++ b/arch/arm/plat-pxa/Makefile
@@ -2,8 +2,9 @@
 # Makefile for code common across different PXA processor families
 #
 
-obj-y   := dma.o pmu.o
+obj-y   := dma.o
 
+obj-$(CONFIG_ARCH_PXA)          += pmu.o
 obj-$(CONFIG_GENERIC_GPIO)      += gpio.o
 obj-$(CONFIG_PXA3xx)            += mfp.o
 obj-$(CONFIG_ARCH_MMP)          += mfp.o
diff --git a/arch/arm/plat-s5p/irq-eint.c b/arch/arm/plat-s5p/irq-eint.c
index e56c8075df97..f36cd3327025 100644
--- a/arch/arm/plat-s5p/irq-eint.c
+++ b/arch/arm/plat-s5p/irq-eint.c
@@ -71,7 +71,7 @@ static int s5p_irq_eint_set_type(unsigned int irq, unsigned int type)
                 break;
 
         case IRQ_TYPE_EDGE_FALLING:
-                newvalue = S5P_EXTINT_RISEEDGE;
+                newvalue = S5P_EXTINT_FALLEDGE;
                 break;
 
         case IRQ_TYPE_EDGE_BOTH:
diff --git a/arch/arm/plat-samsung/include/plat/sdhci.h b/arch/arm/plat-samsung/include/plat/sdhci.h
index 13f9fb20900a..016674fa20dd 100644
--- a/arch/arm/plat-samsung/include/plat/sdhci.h
+++ b/arch/arm/plat-samsung/include/plat/sdhci.h
@@ -166,8 +166,10 @@ static inline void s3c6410_default_sdhci2(void) { }
 #else
 static inline void s3c6410_default_sdhci0(void) { }
 static inline void s3c6410_default_sdhci1(void) { }
+static inline void s3c6410_default_sdhci2(void) { }
 static inline void s3c6400_default_sdhci0(void) { }
 static inline void s3c6400_default_sdhci1(void) { }
+static inline void s3c6400_default_sdhci2(void) { }
 
 #endif /* CONFIG_S3C64XX_SETUP_SDHCI */
 
@@ -239,7 +241,7 @@ static inline void s5pv210_default_sdhci0(void)
         s3c_hsmmc0_def_platdata.cfg_card = s5pv210_setup_sdhci_cfg_card;
 }
 #else
-static inline void s5pc100_default_sdhci0(void) { }
+static inline void s5pv210_default_sdhci0(void) { }
 #endif /* CONFIG_S3C_DEV_HSMMC */
 
 #ifdef CONFIG_S3C_DEV_HSMMC1
diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
index 66dc2d03b7fc..d66cead97d28 100644
--- a/arch/arm/vfp/vfphw.S
+++ b/arch/arm/vfp/vfphw.S
@@ -277,7 +277,7 @@ ENTRY(vfp_put_double)
 #ifdef CONFIG_VFPv3
         @ d16 - d31 registers
         .irp    dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
-1:      mcrr    p11, 3, r1, r2, c\dr    @ fmdrr r1, r2, d\dr
+1:      mcrr    p11, 3, r0, r1, c\dr    @ fmdrr r0, r1, d\dr
         mov     pc, lr
         .org    1b + 8
         .endr
diff --git a/arch/frv/kernel/gdb-stub.c b/arch/frv/kernel/gdb-stub.c
index 84d103c33c9c..a4dba6b20bd0 100644
--- a/arch/frv/kernel/gdb-stub.c
+++ b/arch/frv/kernel/gdb-stub.c
@@ -1789,6 +1789,12 @@ void gdbstub(int sigval)
                         flush_cache = 1;
                         break;
 
+                        /* pNN: Read value of reg N and return it */
+                case 'p':
+                        /* return no value, indicating that we don't support
+                         * this command and that gdb should use 'g' instead */
+                        break;
+
                         /* PNN,=RRRRRRRR: Write value R to reg N return OK */
                 case 'P':
                         ptr = &input_buffer[1];
diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
index d5f4e9161201..21b701374f72 100644
--- a/arch/ia64/kvm/kvm-ia64.c
+++ b/arch/ia64/kvm/kvm-ia64.c
@@ -144,6 +144,7 @@ int kvm_arch_hardware_enable(void *garbage)
                                 VP_INIT_ENV : VP_INIT_ENV_INITALIZE,
                         __pa(kvm_vm_buffer), KVM_VM_BUFFER_BASE, &tmp_base);
         if (status != 0) {
+                spin_unlock(&vp_lock);
                 printk(KERN_WARNING"kvm: Failed to Enable VT Support!!!!\n");
                 return -EINVAL;
         }
diff --git a/arch/ia64/mm/tlb.c b/arch/ia64/mm/tlb.c
index 5dfd916e9ea6..7b3cdc6c6d91 100644
--- a/arch/ia64/mm/tlb.c
+++ b/arch/ia64/mm/tlb.c
@@ -121,7 +121,7 @@ static inline void down_spin(struct spinaphore *ss)
         ia64_invala();
 
         for (;;) {
-                asm volatile ("ld4.c.nc %0=[%1]" : "=r"(serve) : "r"(&ss->serve) : "memory");
+                asm volatile ("ld8.c.nc %0=[%1]" : "=r"(serve) : "r"(&ss->serve) : "memory");
                 if (time_before(t, serve))
                         return;
                 cpu_relax();
diff --git a/arch/microblaze/include/asm/page.h b/arch/microblaze/include/asm/page.h
index de493f86d28f..464ff32bee3d 100644
--- a/arch/microblaze/include/asm/page.h
+++ b/arch/microblaze/include/asm/page.h
@@ -34,6 +34,8 @@
 /* MS be sure that SLAB allocates aligned objects */
 #define ARCH_KMALLOC_MINALIGN   L1_CACHE_BYTES
 
+#define ARCH_SLAB_MINALIGN      L1_CACHE_BYTES
+
 #define PAGE_UP(addr)   (((addr)+((PAGE_SIZE)-1))&(~((PAGE_SIZE)-1)))
 #define PAGE_DOWN(addr) ((addr)&(~((PAGE_SIZE)-1)))
 
diff --git a/arch/microblaze/kernel/dma.c b/arch/microblaze/kernel/dma.c
index 9dcd90b5df55..79c74659f204 100644
--- a/arch/microblaze/kernel/dma.c
+++ b/arch/microblaze/kernel/dma.c
@@ -90,7 +90,6 @@ static int dma_direct_map_sg(struct device *dev, struct scatterlist *sgl,
         /* FIXME this part of code is untested */
         for_each_sg(sgl, sg, nents, i) {
                 sg->dma_address = sg_phys(sg) + get_dma_direct_offset(dev);
-                sg->dma_length = sg->length;
                 __dma_sync_page(page_to_phys(sg_page(sg)), sg->offset,
                                                         sg->length, direction);
         }
diff --git a/arch/microblaze/pci/pci-common.c b/arch/microblaze/pci/pci-common.c
index 9cb782b8e036..23be25fec4d6 100644
--- a/arch/microblaze/pci/pci-common.c
+++ b/arch/microblaze/pci/pci-common.c
@@ -1277,6 +1277,7 @@ void pcibios_allocate_bus_resources(struct pci_bus *bus)
                 printk(KERN_WARNING "PCI: Cannot allocate resource region "
                        "%d of PCI bridge %d, will remap\n", i, bus->number);
 clear_resource:
+                res->start = res->end = 0;
                 res->flags = 0;
         }
 
diff --git a/arch/mips/alchemy/common/power.c b/arch/mips/alchemy/common/power.c
index 14eb8c492da2..5ef06a164a82 100644
--- a/arch/mips/alchemy/common/power.c
+++ b/arch/mips/alchemy/common/power.c
@@ -193,9 +193,15 @@ static void restore_core_regs(void)
 
 void au_sleep(void)
 {
-        save_core_regs();
-        au1xxx_save_and_sleep();
-        restore_core_regs();
+        int cpuid = alchemy_get_cputype();
+        if (cpuid != ALCHEMY_CPU_UNKNOWN) {
+                save_core_regs();
+                if (cpuid <= ALCHEMY_CPU_AU1500)
+                        alchemy_sleep_au1000();
+                else if (cpuid <= ALCHEMY_CPU_AU1200)
+                        alchemy_sleep_au1550();
+                restore_core_regs();
+        }
 }
 
 #endif  /* CONFIG_PM */
diff --git a/arch/mips/alchemy/common/sleeper.S b/arch/mips/alchemy/common/sleeper.S
index 4f4b16741d12..77f3c743b716 100644
--- a/arch/mips/alchemy/common/sleeper.S
+++ b/arch/mips/alchemy/common/sleeper.S
@@ -22,10 +22,9 @@
         .set noat
         .align  5
 
-/* Save all of the processor general registers and go to sleep.
- * A wakeup condition will get us back here to restore the registers.
- */
-LEAF(au1xxx_save_and_sleep)
+
+/* preparatory stuff */
+.macro  SETUP_SLEEP
         subu    sp, PT_SIZE
         sw      $1, PT_R1(sp)
         sw      $2, PT_R2(sp)
@@ -69,12 +68,32 @@ LEAF(au1xxx_save_and_sleep)
          */
         lui     t3, 0xb190              /* sys_xxx */
         sw      sp, 0x0018(t3)
-        la      k0, 3f                  /* resume path */
+        la      k0, alchemy_sleep_wakeup        /* resume path */
         sw      k0, 0x001c(t3)
+.endm
 
-        /* Put SDRAM into self refresh:  Preload instructions into cache,
-         * issue a precharge, auto/self refresh, then sleep commands to it.
-         */
+.macro  DO_SLEEP
+        /* put power supply and processor to sleep */
+        sw      zero, 0x0078(t3)        /* sys_slppwr */
+        sync
+        sw      zero, 0x007c(t3)        /* sys_sleep */
+        sync
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+.endm
+
+/* sleep code for Au1000/Au1100/Au1500 memory controller type */
+LEAF(alchemy_sleep_au1000)
+
+        SETUP_SLEEP
+
+        /* cache following instructions, as memory gets put to sleep */
         la      t0, 1f
         .set    mips3
         cache   0x14, 0(t0)
@@ -84,17 +103,32 @@ LEAF(au1xxx_save_and_sleep)
         .set    mips0
 
 1:      lui     a0, 0xb400              /* mem_xxx */
-#if defined(CONFIG_SOC_AU1000) || defined(CONFIG_SOC_AU1100) || \
-    defined(CONFIG_SOC_AU1500)
         sw      zero, 0x001c(a0)        /* Precharge */
         sync
         sw      zero, 0x0020(a0)        /* Auto Refresh */
         sync
         sw      zero, 0x0030(a0)        /* Sleep */
         sync
-#endif
 
-#if defined(CONFIG_SOC_AU1550) || defined(CONFIG_SOC_AU1200)
+        DO_SLEEP
+
+END(alchemy_sleep_au1000)
+
+/* sleep code for Au1550/Au1200 memory controller type */
+LEAF(alchemy_sleep_au1550)
+
+        SETUP_SLEEP
+
+        /* cache following instructions, as memory gets put to sleep */
+        la      t0, 1f
+        .set    mips3
+        cache   0x14, 0(t0)
+        cache   0x14, 32(t0)
+        cache   0x14, 64(t0)
+        cache   0x14, 96(t0)
+        .set    mips0
+
+1:      lui     a0, 0xb400              /* mem_xxx */
         sw      zero, 0x08c0(a0)        /* Precharge */
         sync
         sw      zero, 0x08d0(a0)        /* Self Refresh */
@@ -114,26 +148,17 @@ LEAF(au1xxx_save_and_sleep)
         and     t1, t0, t1              /* clear CE[1:0] */
         sw      t1, 0x0840(a0)          /* mem_sdconfiga */
         sync
-#endif
 
-        /* put power supply and processor to sleep */
-        sw      zero, 0x0078(t3)        /* sys_slppwr */
-        sync
-        sw      zero, 0x007c(t3)        /* sys_sleep */
-        sync
-        nop
-        nop
-        nop
-        nop
-        nop
-        nop
-        nop
-        nop
+        DO_SLEEP
+
+END(alchemy_sleep_au1550)
+
 
         /* This is where we return upon wakeup.
          * Reload all of the registers and return.
          */
-3:      lw      k0, 0x20(sp)
+LEAF(alchemy_sleep_wakeup)
+        lw      k0, 0x20(sp)
         mtc0    k0, CP0_STATUS
         lw      k0, 0x1c(sp)
         mtc0    k0, CP0_CONTEXT
@@ -169,4 +194,4 @@ LEAF(au1xxx_save_and_sleep)
         lw      $31, PT_R31(sp)
         jr      ra
          addiu  sp, PT_SIZE
-END(au1xxx_save_and_sleep)
+END(alchemy_sleep_wakeup)
diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c
index 566f2d7f2ea3..8f31d1d59683 100644
--- a/arch/mips/ar7/platform.c
+++ b/arch/mips/ar7/platform.c
@@ -542,7 +542,7 @@ static int __init ar7_register_uarts(void)
         if (IS_ERR(bus_clk))
                 panic("unable to get bus clk\n");
 
-        uart_port.type          = PORT_16550A;
+        uart_port.type          = PORT_AR7;
         uart_port.uartclk       = clk_get_rate(bus_clk) / 2;
         uart_port.iotype        = UPIO_MEM32;
         uart_port.regshift      = 2;
diff --git a/arch/mips/bcm47xx/Makefile b/arch/mips/bcm47xx/Makefile
index 35294b12d638..7465e8a72d9a 100644
--- a/arch/mips/bcm47xx/Makefile
+++ b/arch/mips/bcm47xx/Makefile
@@ -3,4 +3,4 @@
 # under Linux.
 #
 
-obj-y := gpio.o irq.o prom.o serial.o setup.o time.o wgt634u.o
+obj-y := gpio.o irq.o nvram.o prom.o serial.o setup.o time.o wgt634u.o
diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
new file mode 100644
index 000000000000..06e03b222f6d
--- /dev/null
+++ b/arch/mips/bcm47xx/nvram.c
@@ -0,0 +1,94 @@
+/*
+ * BCM947xx nvram variable access
+ *
+ * Copyright (C) 2005 Broadcom Corporation
+ * Copyright (C) 2006 Felix Fietkau <nbd@openwrt.org>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/ssb/ssb.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <asm/addrspace.h>
+#include <asm/mach-bcm47xx/nvram.h>
+#include <asm/mach-bcm47xx/bcm47xx.h>
+
+static char nvram_buf[NVRAM_SPACE];
+
+/* Probe for NVRAM header */
+static void __init early_nvram_init(void)
+{
+        struct ssb_mipscore *mcore = &ssb_bcm47xx.mipscore;
+        struct nvram_header *header;
+        int i;
+        u32 base, lim, off;
+        u32 *src, *dst;
+
+        base = mcore->flash_window;
+        lim = mcore->flash_window_size;
+
+        off = FLASH_MIN;
+        while (off <= lim) {
+                /* Windowed flash access */
+                header = (struct nvram_header *)
+                        KSEG1ADDR(base + off - NVRAM_SPACE);
+                if (header->magic == NVRAM_HEADER)
+                        goto found;
+                off <<= 1;
+        }
+
+        /* Try embedded NVRAM at 4 KB and 1 KB as last resorts */
+        header = (struct nvram_header *) KSEG1ADDR(base + 4096);
+        if (header->magic == NVRAM_HEADER)
+                goto found;
+
+        header = (struct nvram_header *) KSEG1ADDR(base + 1024);
+        if (header->magic == NVRAM_HEADER)
+                goto found;
+
+        return;
+
+found:
+        src = (u32 *) header;
+        dst = (u32 *) nvram_buf;
+        for (i = 0; i < sizeof(struct nvram_header); i += 4)
+                *dst++ = *src++;
+        for (; i < header->len && i < NVRAM_SPACE; i += 4)
+                *dst++ = le32_to_cpu(*src++);
+}
+
+int nvram_getenv(char *name, char *val, size_t val_len)
+{
+        char *var, *value, *end, *eq;
+
+        if (!name)
+                return 1;
+
+        if (!nvram_buf[0])
+                early_nvram_init();
+
+        /* Look for name=value and return value */
+        var = &nvram_buf[sizeof(struct nvram_header)];
+        end = nvram_buf + sizeof(nvram_buf) - 2;
+        end[0] = end[1] = '\0';
+        for (; *var; var = value + strlen(value) + 1) {
+                eq = strchr(var, '=');
+                if (!eq)
+                        break;
+                value = eq + 1;
+                if ((eq - var) == strlen(name) &&
+                        strncmp(var, name, (eq - var)) == 0) {
+                        snprintf(val, val_len, "%s", value);
+                        return 0;
+                }
+        }
+        return 1;
+}
+EXPORT_SYMBOL(nvram_getenv);
diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
index d442e11625fa..b1aee33efd11 100644
--- a/arch/mips/bcm47xx/setup.c
+++ b/arch/mips/bcm47xx/setup.c
@@ -1,8 +1,8 @@
 /*
  *  Copyright (C) 2004 Florian Schirmer <jolt@tuxbox.org>
- *  Copyright (C) 2005 Waldemar Brodkorb <wbx@openwrt.org>
  *  Copyright (C) 2006 Felix Fietkau <nbd@openwrt.org>
  *  Copyright (C) 2006 Michael Buesch <mb@bu3sch.de>
+ *  Copyright (C) 2010 Waldemar Brodkorb <wbx@openadk.org>
  *
  *  This program is free software; you can redistribute  it and/or modify it
  *  under  the terms of  the GNU General  Public License as published by the
@@ -33,6 +33,7 @@
 #include <asm/time.h>
 #include <bcm47xx.h>
 #include <asm/fw/cfe/cfe_api.h>
+#include <asm/mach-bcm47xx/nvram.h>
 
 struct ssb_bus ssb_bcm47xx;
 EXPORT_SYMBOL(ssb_bcm47xx);
@@ -81,28 +82,42 @@ static int bcm47xx_get_invariants(struct ssb_bus *bus,
         /* Fill boardinfo structure */
         memset(&(iv->boardinfo), 0 , sizeof(struct ssb_boardinfo));
 
-        if (cfe_getenv("boardvendor", buf, sizeof(buf)) >= 0)
+        if (cfe_getenv("boardvendor", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("boardvendor", buf, sizeof(buf)) >= 0)
                 iv->boardinfo.type = (u16)simple_strtoul(buf, NULL, 0);
-        if (cfe_getenv("boardtype", buf, sizeof(buf)) >= 0)
+        if (cfe_getenv("boardtype", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("boardtype", buf, sizeof(buf)) >= 0)
                 iv->boardinfo.type = (u16)simple_strtoul(buf, NULL, 0);
-        if (cfe_getenv("boardrev", buf, sizeof(buf)) >= 0)
+        if (cfe_getenv("boardrev", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("boardrev", buf, sizeof(buf)) >= 0)
                 iv->boardinfo.rev = (u16)simple_strtoul(buf, NULL, 0);
 
         /* Fill sprom structure */
         memset(&(iv->sprom), 0, sizeof(struct ssb_sprom));
         iv->sprom.revision = 3;
 
-        if (cfe_getenv("et0macaddr", buf, sizeof(buf)) >= 0)
+        if (cfe_getenv("et0macaddr", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("et0macaddr", buf, sizeof(buf)) >= 0)
                 str2eaddr(buf, iv->sprom.et0mac);
-        if (cfe_getenv("et1macaddr", buf, sizeof(buf)) >= 0)
+
+        if (cfe_getenv("et1macaddr", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("et1macaddr", buf, sizeof(buf)) >= 0)
                 str2eaddr(buf, iv->sprom.et1mac);
-        if (cfe_getenv("et0phyaddr", buf, sizeof(buf)) >= 0)
-                iv->sprom.et0phyaddr = simple_strtoul(buf, NULL, 10);
-        if (cfe_getenv("et1phyaddr", buf, sizeof(buf)) >= 0)
-                iv->sprom.et1phyaddr = simple_strtoul(buf, NULL, 10);
-        if (cfe_getenv("et0mdcport", buf, sizeof(buf)) >= 0)
+
+        if (cfe_getenv("et0phyaddr", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("et0phyaddr", buf, sizeof(buf)) >= 0)
+                iv->sprom.et0phyaddr = simple_strtoul(buf, NULL, 0);
+
+        if (cfe_getenv("et1phyaddr", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("et1phyaddr", buf, sizeof(buf)) >= 0)
+                iv->sprom.et1phyaddr = simple_strtoul(buf, NULL, 0);
+
+        if (cfe_getenv("et0mdcport", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("et0mdcport", buf, sizeof(buf)) >= 0)
                 iv->sprom.et0mdcport = simple_strtoul(buf, NULL, 10);
-        if (cfe_getenv("et1mdcport", buf, sizeof(buf)) >= 0)
+
+        if (cfe_getenv("et1mdcport", buf, sizeof(buf)) >= 0 ||
+            nvram_getenv("et1mdcport", buf, sizeof(buf)) >= 0)
                 iv->sprom.et1mdcport = simple_strtoul(buf, NULL, 10);
 
         return 0;
diff --git a/arch/mips/include/asm/mach-ar7/ar7.h b/arch/mips/include/asm/mach-ar7/ar7.h
index f1cf38943497..483ffea9ecb1 100644
--- a/arch/mips/include/asm/mach-ar7/ar7.h
+++ b/arch/mips/include/asm/mach-ar7/ar7.h
@@ -50,7 +50,7 @@
 #define UR8_REGS_WDT    (AR7_REGS_BASE + 0x0b00)
 #define UR8_REGS_UART1  (AR7_REGS_BASE + 0x0f00)
 
-#define AR7_RESET_PEREPHERIAL   0x0
+#define AR7_RESET_PERIPHERAL    0x0
 #define AR7_RESET_SOFTWARE      0x4
 #define AR7_RESET_STATUS        0x8
 
@@ -128,7 +128,7 @@ static inline int ar7_has_high_cpmac(void)
 static inline void ar7_device_enable(u32 bit)
 {
         void *reset_reg =
-                (void *)KSEG1ADDR(AR7_REGS_RESET + AR7_RESET_PEREPHERIAL);
+                (void *)KSEG1ADDR(AR7_REGS_RESET + AR7_RESET_PERIPHERAL);
         writel(readl(reset_reg) | (1 << bit), reset_reg);
         msleep(20);
 }
@@ -136,7 +136,7 @@ static inline void ar7_device_enable(u32 bit)
 static inline void ar7_device_disable(u32 bit)
 {
         void *reset_reg =
-                (void *)KSEG1ADDR(AR7_REGS_RESET + AR7_RESET_PEREPHERIAL);
+                (void *)KSEG1ADDR(AR7_REGS_RESET + AR7_RESET_PERIPHERAL);
         writel(readl(reset_reg) & ~(1 << bit), reset_reg);
         msleep(20);
 }
diff --git a/arch/mips/include/asm/mach-ar7/gpio.h b/arch/mips/include/asm/mach-ar7/gpio.h
index 73f9b162c970..abc317c0372e 100644
--- a/arch/mips/include/asm/mach-ar7/gpio.h
+++ b/arch/mips/include/asm/mach-ar7/gpio.h
@@ -24,7 +24,7 @@
 #define AR7_GPIO_MAX 32
 #define NR_BUILTIN_GPIO AR7_GPIO_MAX
 
-#define gpio_to_irq(gpio)       NULL
+#define gpio_to_irq(gpio)       -1
 
 #define gpio_get_value __gpio_get_value
 #define gpio_set_value __gpio_set_value
diff --git a/arch/mips/include/asm/mach-au1x00/au1000.h b/arch/mips/include/asm/mach-au1x00/au1000.h
index e76941db2312..a6976619160a 100644
--- a/arch/mips/include/asm/mach-au1x00/au1000.h
+++ b/arch/mips/include/asm/mach-au1x00/au1000.h
@@ -188,7 +188,8 @@ extern unsigned long get_au1x00_uart_baud_base(void);
 extern unsigned long au1xxx_calc_clock(void);
 
 /* PM: arch/mips/alchemy/common/sleeper.S, power.c, irq.c */
-void au1xxx_save_and_sleep(void);
+void alchemy_sleep_au1000(void);
+void alchemy_sleep_au1550(void);
 void au_sleep(void);
 
 
diff --git a/arch/mips/include/asm/mach-bcm47xx/nvram.h b/arch/mips/include/asm/mach-bcm47xx/nvram.h
new file mode 100644
index 000000000000..0d8cc146f7a4
--- /dev/null
+++ b/arch/mips/include/asm/mach-bcm47xx/nvram.h
@@ -0,0 +1,36 @@
+/*
+ *  Copyright (C) 2005, Broadcom Corporation
+ *  Copyright (C) 2006, Felix Fietkau <nbd@openwrt.org>
+ *
+ *  This program is free software; you can redistribute  it and/or modify it
+ *  under  the terms of  the GNU General  Public License as published by the
+ *  Free Software Foundation;  either version 2 of the  License, or (at your
+ *  option) any later version.
+ */
+
+#ifndef __NVRAM_H
+#define __NVRAM_H
+
+#include <linux/types.h>
+
+struct nvram_header {
+        u32 magic;
+        u32 len;
+        u32 crc_ver_init;       /* 0:7 crc, 8:15 ver, 16:31 sdram_init */
+        u32 config_refresh;     /* 0:15 sdram_config, 16:31 sdram_refresh */
+        u32 config_ncdl;        /* ncdl values for memc */
+};
+
+#define NVRAM_HEADER            0x48534C46      /* 'FLSH' */
+#define NVRAM_VERSION           1
+#define NVRAM_HEADER_SIZE       20
+#define NVRAM_SPACE             0x8000
+
+#define FLASH_MIN               0x00020000      /* Minimum flash size */
+
+#define NVRAM_MAX_VALUE_LEN 255
+#define NVRAM_MAX_PARAM_LEN 64
+
+extern int nvram_getenv(char *name, char *val, size_t val_len);
+
+#endif
diff --git a/arch/mips/include/asm/mach-bcm63xx/gpio.h b/arch/mips/include/asm/mach-bcm63xx/gpio.h
index 7cda8c0a3979..1eb534de8e3b 100644
--- a/arch/mips/include/asm/mach-bcm63xx/gpio.h
+++ b/arch/mips/include/asm/mach-bcm63xx/gpio.h
@@ -3,7 +3,7 @@
 
 #include <bcm63xx_gpio.h>
 
-#define gpio_to_irq(gpio)       NULL
+#define gpio_to_irq(gpio)       -1
 
 #define gpio_get_value __gpio_get_value
 #define gpio_set_value __gpio_set_value
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index e9e64e0ff7aa..5a84a1f11231 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -2,7 +2,7 @@
  * Code for replacing ftrace calls with jumps.
  *
  * Copyright (C) 2007-2008 Steven Rostedt <srostedt@redhat.com>
- * Copyright (C) 2009 DSLab, Lanzhou University, China
+ * Copyright (C) 2009, 2010 DSLab, Lanzhou University, China
  * Author: Wu Zhangjin <wuzhangjin@gmail.com>
  *
  * Thanks goes to Steven Rostedt for writing the original x86 version.
@@ -12,18 +12,62 @@
 #include <linux/init.h>
 #include <linux/ftrace.h>
 
-#include <asm/cacheflush.h>
 #include <asm/asm.h>
 #include <asm/asm-offsets.h>
+#include <asm/cacheflush.h>
+#include <asm/uasm.h>
+
+/*
+ * If the Instruction Pointer is in module space (0xc0000000), return true;
+ * otherwise, it is in kernel space (0x80000000), return false.
+ *
+ * FIXME: This will not work when the kernel space and module space are the
+ * same. If they are the same, we need to modify scripts/recordmcount.pl,
+ * ftrace_make_nop/call() and the other related parts to ensure the
+ * enabling/disabling of the calling site to _mcount is right for both kernel
+ * and module.
+ */
+
+static inline int in_module(unsigned long ip)
+{
+        return ip & 0x40000000;
+}
 
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 #define JAL 0x0c000000          /* jump & link: ip --> ra, jump to target */
 #define ADDR_MASK 0x03ffffff    /*  op_code|addr : 31...26|25 ....0 */
-#define jump_insn_encode(op_code, addr) \
-        ((unsigned int)((op_code) | (((addr) >> 2) & ADDR_MASK)))
 
-static unsigned int ftrace_nop = 0x00000000;
+#define INSN_B_1F_4 0x10000004  /* b 1f; offset = 4 */
+#define INSN_B_1F_5 0x10000005  /* b 1f; offset = 5 */
+#define INSN_NOP 0x00000000     /* nop */
+#define INSN_JAL(addr)  \
+        ((unsigned int)(JAL | (((addr) >> 2) & ADDR_MASK)))
+
+static unsigned int insn_jal_ftrace_caller __read_mostly;
+static unsigned int insn_lui_v1_hi16_mcount __read_mostly;
+static unsigned int insn_j_ftrace_graph_caller __maybe_unused __read_mostly;
+
+static inline void ftrace_dyn_arch_init_insns(void)
+{
+        u32 *buf;
+        unsigned int v1;
+
+        /* lui v1, hi16_mcount */
+        v1 = 3;
+        buf = (u32 *)&insn_lui_v1_hi16_mcount;
+        UASM_i_LA_mostly(&buf, v1, MCOUNT_ADDR);
+
+        /* jal (ftrace_caller + 8), jump over the first two instruction */
+        buf = (u32 *)&insn_jal_ftrace_caller;
+        uasm_i_jal(&buf, (FTRACE_ADDR + 8));
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        /* j ftrace_graph_caller */
+        buf = (u32 *)&insn_j_ftrace_graph_caller;
+        uasm_i_j(&buf, (unsigned long)ftrace_graph_caller);
+#endif
+}
 
 static int ftrace_modify_code(unsigned long ip, unsigned int new_code)
 {
@@ -40,67 +84,56 @@ static int ftrace_modify_code(unsigned long ip, unsigned int new_code)
         return 0;
 }
 
-static int lui_v1;
-static int jal_mcount;
-
 int ftrace_make_nop(struct module *mod,
                     struct dyn_ftrace *rec, unsigned long addr)
 {
         unsigned int new;
-        int faulted;
         unsigned long ip = rec->ip;
 
-        /* We have compiled module with -mlong-calls, but compiled the kernel
-         * without it, we need to cope with them respectively. */
-        if (ip & 0x40000000) {
-                /* record it for ftrace_make_call */
-                if (lui_v1 == 0) {
-                        /* lui_v1 = *(unsigned int *)ip; */
-                        safe_load_code(lui_v1, ip, faulted);
-
-                        if (unlikely(faulted))
-                                return -EFAULT;
-                }
-
-                /* lui v1, hi_16bit_of_mcount        --> b 1f (0x10000004)
+        /*
+         * We have compiled module with -mlong-calls, but compiled the kernel
+         * without it, we need to cope with them respectively.
+         */
+        if (in_module(ip)) {
+#if defined(KBUILD_MCOUNT_RA_ADDRESS) && defined(CONFIG_32BIT)
+                /*
+                 * lui v1, hi_16bit_of_mcount        --> b 1f (0x10000005)
+                 * addiu v1, v1, low_16bit_of_mcount
+                 * move at, ra
+                 * move $12, ra_address
+                 * jalr v1
+                 *  sub sp, sp, 8
+                 *                                  1: offset = 5 instructions
+                 */
+                new = INSN_B_1F_5;
+#else
+                /*
+                 * lui v1, hi_16bit_of_mcount        --> b 1f (0x10000004)
                  * addiu v1, v1, low_16bit_of_mcount
                  * move at, ra
                  * jalr v1
-                 * nop
-                 *                                   1f: (ip + 12)
+                 *  nop | move $12, ra_address | sub sp, sp, 8
+                 *                                  1: offset = 4 instructions
                  */
-                new = 0x10000004;
+                new = INSN_B_1F_4;
+#endif
         } else {
-                /* record/calculate it for ftrace_make_call */
-                if (jal_mcount == 0) {
-                        /* We can record it directly like this:
-                         *     jal_mcount = *(unsigned int *)ip;
-                         * Herein, jump over the first two nop instructions */
-                        jal_mcount = jump_insn_encode(JAL, (MCOUNT_ADDR + 8));
-                }
-
-                /* move at, ra
-                 * jalr v1              --> nop
+                /*
+                 * move at, ra
+                 * jal _mcount          --> nop
                  */
-                new = ftrace_nop;
+                new = INSN_NOP;
         }
         return ftrace_modify_code(ip, new);
 }
 
-static int modified;    /* initialized as 0 by default */
-
 int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
 {
         unsigned int new;
         unsigned long ip = rec->ip;
 
-        /* We just need to remove the "b ftrace_stub" at the fist time! */
-        if (modified == 0) {
-                modified = 1;
-                ftrace_modify_code(addr, ftrace_nop);
-        }
         /* ip, module: 0xc0000000, kernel: 0x80000000 */
-        new = (ip & 0x40000000) ? lui_v1 : jal_mcount;
+        new = in_module(ip) ? insn_lui_v1_hi16_mcount : insn_jal_ftrace_caller;
 
         return ftrace_modify_code(ip, new);
 }
@@ -111,44 +144,48 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
 {
         unsigned int new;
 
-        new = jump_insn_encode(JAL, (unsigned long)func);
+        new = INSN_JAL((unsigned long)func);
 
         return ftrace_modify_code(FTRACE_CALL_IP, new);
 }
 
 int __init ftrace_dyn_arch_init(void *data)
 {
+        /* Encode the instructions when booting */
+        ftrace_dyn_arch_init_insns();
+
+        /* Remove "b ftrace_stub" to ensure ftrace_caller() is executed */
+        ftrace_modify_code(MCOUNT_ADDR, INSN_NOP);
+
         /* The return code is retured via data */
         *(unsigned long *)data = 0;
 
         return 0;
 }
-#endif                          /* CONFIG_DYNAMIC_FTRACE */
+#endif  /* CONFIG_DYNAMIC_FTRACE */
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 extern void ftrace_graph_call(void);
-#define JMP     0x08000000      /* jump to target directly */
-#define CALL_FTRACE_GRAPH_CALLER \
-        jump_insn_encode(JMP, (unsigned long)(&ftrace_graph_caller))
 #define FTRACE_GRAPH_CALL_IP    ((unsigned long)(&ftrace_graph_call))
 
 int ftrace_enable_ftrace_graph_caller(void)
 {
         return ftrace_modify_code(FTRACE_GRAPH_CALL_IP,
-                                  CALL_FTRACE_GRAPH_CALLER);
+                        insn_j_ftrace_graph_caller);
 }
 
 int ftrace_disable_ftrace_graph_caller(void)
 {
-        return ftrace_modify_code(FTRACE_GRAPH_CALL_IP, ftrace_nop);
+        return ftrace_modify_code(FTRACE_GRAPH_CALL_IP, INSN_NOP);
 }
 
-#endif                          /* !CONFIG_DYNAMIC_FTRACE */
+#endif  /* CONFIG_DYNAMIC_FTRACE */
 
 #ifndef KBUILD_MCOUNT_RA_ADDRESS
+
 #define S_RA_SP (0xafbf << 16)  /* s{d,w} ra, offset(sp) */
 #define S_R_SP  (0xafb0 << 16)  /* s{d,w} R, offset(sp) */
 #define OFFSET_MASK     0xffff  /* stack offset range: 0 ~ PT_SIZE */
@@ -162,17 +199,17 @@ unsigned long ftrace_get_parent_addr(unsigned long self_addr,
         unsigned int code;
         int faulted;
 
-        /* in module or kernel? */
-        if (self_addr & 0x40000000) {
-                /* module: move to the instruction "lui v1, HI_16BIT_OF_MCOUNT" */
-                ip = self_addr - 20;
-        } else {
-                /* kernel: move to the instruction "move ra, at" */
-                ip = self_addr - 12;
-        }
+        /*
+         * For module, move the ip from calling site of mcount to the
+         * instruction "lui v1, hi_16bit_of_mcount"(offset is 20), but for
+         * kernel, move to the instruction "move ra, at"(offset is 12)
+         */
+        ip = self_addr - (in_module(self_addr) ? 20 : 12);
 
-        /* search the text until finding the non-store instruction or "s{d,w}
-         * ra, offset(sp)" instruction */
+        /*
+         * search the text until finding the non-store instruction or "s{d,w}
+         * ra, offset(sp)" instruction
+         */
         do {
                 ip -= 4;
 
@@ -181,10 +218,11 @@ unsigned long ftrace_get_parent_addr(unsigned long self_addr,
 
                 if (unlikely(faulted))
                         return 0;
-
-                /* If we hit the non-store instruction before finding where the
+                /*
+                 * If we hit the non-store instruction before finding where the
                  * ra is stored, then this is a leaf function and it does not
-                 * store the ra on the stack. */
+                 * store the ra on the stack
+                 */
                 if ((code & S_R_SP) != S_R_SP)
                         return parent_addr;
 
@@ -202,7 +240,7 @@ unsigned long ftrace_get_parent_addr(unsigned long self_addr,
         return 0;
 }
 
-#endif
+#endif  /* !KBUILD_MCOUNT_RA_ADDRESS */
 
 /*
  * Hook the return address and push it in the stack of return addrs
@@ -220,7 +258,8 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 return;
 
-        /* "parent" is the stack address saved the return address of the caller
+        /*
+         * "parent" is the stack address saved the return address of the caller
          * of _mcount.
          *
          * if the gcc < 4.5, a leaf function does not save the return address
@@ -242,10 +281,11 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
                 goto out;
 #ifndef KBUILD_MCOUNT_RA_ADDRESS
         parent = (unsigned long *)ftrace_get_parent_addr(self_addr, old,
-                                                         (unsigned long)parent,
-                                                         fp);
-        /* If fails when getting the stack address of the non-leaf function's
-         * ra, stop function graph tracer and return */
+                        (unsigned long)parent, fp);
+        /*
+         * If fails when getting the stack address of the non-leaf function's
+         * ra, stop function graph tracer and return
+         */
         if (parent == 0)
                 goto out;
 #endif
@@ -272,4 +312,4 @@ out:
         ftrace_graph_stop();
         WARN_ON(1);
 }
-#endif                          /* CONFIG_FUNCTION_GRAPH_TRACER */
+#endif  /* CONFIG_FUNCTION_GRAPH_TRACER */
diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S
index 6851fc97a511..6bfcb7a00ec6 100644
--- a/arch/mips/kernel/mcount.S
+++ b/arch/mips/kernel/mcount.S
@@ -6,6 +6,7 @@
  * more details.
  *
  * Copyright (C) 2009 Lemote Inc. & DSLab, Lanzhou University, China
+ * Copyright (C) 2010 DSLab, Lanzhou University, China
  * Author: Wu Zhangjin <wuzhangjin@gmail.com>
  */
 
@@ -45,8 +46,6 @@
         PTR_L   a5, PT_R9(sp)
         PTR_L   a6, PT_R10(sp)
         PTR_L   a7, PT_R11(sp)
-#endif
-#ifdef CONFIG_64BIT
         PTR_ADDIU       sp, PT_SIZE
 #else
         PTR_ADDIU       sp, (PT_SIZE + 8)
@@ -58,6 +57,12 @@
          move ra, AT
         .endm
 
+/*
+ * The -mmcount-ra-address option of gcc 4.5 uses register $12 to pass
+ * the location of the parent's return address.
+ */
+#define MCOUNT_RA_ADDRESS_REG   $12
+
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 NESTED(ftrace_caller, PT_SIZE, ra)
@@ -71,14 +76,14 @@ _mcount:
 
         MCOUNT_SAVE_REGS
 #ifdef KBUILD_MCOUNT_RA_ADDRESS
-        PTR_S   t0, PT_R12(sp)  /* t0 saved the location of the return address(at) by -mmcount-ra-address */
+        PTR_S   MCOUNT_RA_ADDRESS_REG, PT_R12(sp)
 #endif
 
-        move    a0, ra          /* arg1: next ip, selfaddr */
+        move    a0, ra          /* arg1: self return address */
         .globl ftrace_call
 ftrace_call:
         nop     /* a placeholder for the call to a real tracing function */
-         move   a1, AT          /* arg2: the caller's next ip, parent */
+         move   a1, AT          /* arg2: parent's return address */
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
         .globl ftrace_graph_call
@@ -119,9 +124,9 @@ NESTED(_mcount, PT_SIZE, ra)
 static_trace:
         MCOUNT_SAVE_REGS
 
-        move    a0, ra          /* arg1: next ip, selfaddr */
+        move    a0, ra          /* arg1: self return address */
         jalr    t2              /* (1) call *ftrace_trace_function */
-         move   a1, AT          /* arg2: the caller's next ip, parent */
+         move   a1, AT          /* arg2: parent's return address */
 
         MCOUNT_RESTORE_REGS
         .globl ftrace_stub
@@ -134,28 +139,34 @@ ftrace_stub:
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 
 NESTED(ftrace_graph_caller, PT_SIZE, ra)
-#ifdef CONFIG_DYNAMIC_FTRACE
-        PTR_L   a1, PT_R31(sp)  /* load the original ra from the stack */
-#ifdef KBUILD_MCOUNT_RA_ADDRESS
-        PTR_L   t0, PT_R12(sp)  /* load the original t0 from the stack */
-#endif
-#else
+#ifndef CONFIG_DYNAMIC_FTRACE
         MCOUNT_SAVE_REGS
-        move    a1, ra          /* arg2: next ip, selfaddr */
 #endif
 
+        /* arg1: Get the location of the parent's return address */
 #ifdef KBUILD_MCOUNT_RA_ADDRESS
-        bnez    t0, 1f          /* non-leaf func: t0 saved the location of the return address */
+#ifdef CONFIG_DYNAMIC_FTRACE
+        PTR_L   a0, PT_R12(sp)
+#else
+        move    a0, MCOUNT_RA_ADDRESS_REG
+#endif
+        bnez    a0, 1f  /* non-leaf func: stored in MCOUNT_RA_ADDRESS_REG */
          nop
-        PTR_LA  t0, PT_R1(sp)   /* leaf func: get the location of at(old ra) from our own stack */
-1:      move    a0, t0          /* arg1: the location of the return address */
+#endif
+        PTR_LA  a0, PT_R1(sp)   /* leaf func: the location in current stack */
+1:
+
+        /* arg2: Get self return address */
+#ifdef CONFIG_DYNAMIC_FTRACE
+        PTR_L   a1, PT_R31(sp)
 #else
-        PTR_LA  a0, PT_R1(sp)   /* arg1: &AT -> a0 */
+        move    a1, ra
 #endif
-        jal     prepare_ftrace_return
+
+        /* arg3: Get frame pointer of current stack */
 #ifdef CONFIG_FRAME_POINTER
-         move   a2, fp          /* arg3: frame pointer */
-#else
+         move   a2, fp
+#else /* ! CONFIG_FRAME_POINTER */
 #ifdef CONFIG_64BIT
          PTR_LA a2, PT_SIZE(sp)
 #else
@@ -163,6 +174,8 @@ NESTED(ftrace_graph_caller, PT_SIZE, ra)
 #endif
 #endif
 
+        jal     prepare_ftrace_return
+         nop
         MCOUNT_RESTORE_REGS
         RETURN_BACK
         END(ftrace_graph_caller)
diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c
index f5981c499109..2340f11dc29c 100644
--- a/arch/mips/kernel/mips-mt-fpaff.c
+++ b/arch/mips/kernel/mips-mt-fpaff.c
@@ -3,6 +3,7 @@
  * Copyright (C) 2005 Mips Technologies, Inc
  */
 #include <linux/cpu.h>
+#include <linux/cpuset.h>
 #include <linux/cpumask.h>
 #include <linux/delay.h>
 #include <linux/kernel.h>
@@ -39,6 +40,21 @@ static inline struct task_struct *find_process_by_pid(pid_t pid)
         return pid ? find_task_by_vpid(pid) : current;
 }
 
+/*
+ * check the target process has a UID that matches the current process's
+ */
+static bool check_same_owner(struct task_struct *p)
+{
+        const struct cred *cred = current_cred(), *pcred;
+        bool match;
+
+        rcu_read_lock();
+        pcred = __task_cred(p);
+        match = (cred->euid == pcred->euid ||
+                 cred->euid == pcred->uid);
+        rcu_read_unlock();
+        return match;
+}
 
 /*
  * mipsmt_sys_sched_setaffinity - set the cpu affinity of a process
@@ -46,12 +62,10 @@ static inline struct task_struct *find_process_by_pid(pid_t pid)
 asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len,
                                       unsigned long __user *user_mask_ptr)
 {
-        cpumask_t new_mask;
-        cpumask_t effective_mask;
-        int retval;
-        struct task_struct *p;
+        cpumask_var_t cpus_allowed, new_mask, effective_mask;
         struct thread_info *ti;
-        uid_t euid;
+        struct task_struct *p;
+        int retval;
 
         if (len < sizeof(new_mask))
                 return -EINVAL;
@@ -60,53 +74,74 @@ asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len,
                 return -EFAULT;
 
         get_online_cpus();
-        read_lock(&tasklist_lock);
+        rcu_read_lock();
 
         p = find_process_by_pid(pid);
         if (!p) {
-                read_unlock(&tasklist_lock);
+                rcu_read_unlock();
                 put_online_cpus();
                 return -ESRCH;
         }
 
-        /*
-         * It is not safe to call set_cpus_allowed with the
-         * tasklist_lock held.  We will bump the task_struct's
-         * usage count and drop tasklist_lock before invoking
-         * set_cpus_allowed.
-         */
+        /* Prevent p going away */
         get_task_struct(p);
+        rcu_read_unlock();
 
-        euid = current_euid();
+        if (!alloc_cpumask_var(&cpus_allowed, GFP_KERNEL)) {
+                retval = -ENOMEM;
+                goto out_put_task;
+        }
+        if (!alloc_cpumask_var(&new_mask, GFP_KERNEL)) {
+                retval = -ENOMEM;
+                goto out_free_cpus_allowed;
+        }
+        if (!alloc_cpumask_var(&effective_mask, GFP_KERNEL)) {
+                retval = -ENOMEM;
+                goto out_free_new_mask;
+        }
         retval = -EPERM;
-        if (euid != p->cred->euid && euid != p->cred->uid &&
-            !capable(CAP_SYS_NICE)) {
-                read_unlock(&tasklist_lock);
+        if (!check_same_owner(p) && !capable(CAP_SYS_NICE))
                 goto out_unlock;
-        }
 
         retval = security_task_setscheduler(p, 0, NULL);
         if (retval)
                 goto out_unlock;
 
         /* Record new user-specified CPU set for future reference */
-        p->thread.user_cpus_allowed = new_mask;
-
-        /* Unlock the task list */
-        read_unlock(&tasklist_lock);
+        cpumask_copy(&p->thread.user_cpus_allowed, new_mask);
 
+ again:
         /* Compute new global allowed CPU set if necessary */
         ti = task_thread_info(p);
         if (test_ti_thread_flag(ti, TIF_FPUBOUND) &&
-            cpus_intersects(new_mask, mt_fpu_cpumask)) {
-                cpus_and(effective_mask, new_mask, mt_fpu_cpumask);
-                retval = set_cpus_allowed_ptr(p, &effective_mask);
+            cpus_intersects(*new_mask, mt_fpu_cpumask)) {
+                cpus_and(*effective_mask, *new_mask, mt_fpu_cpumask);
+                retval = set_cpus_allowed_ptr(p, effective_mask);
         } else {
+                cpumask_copy(effective_mask, new_mask);
                 clear_ti_thread_flag(ti, TIF_FPUBOUND);
-                retval = set_cpus_allowed_ptr(p, &new_mask);
+                retval = set_cpus_allowed_ptr(p, new_mask);
         }
 
+        if (!retval) {
+                cpuset_cpus_allowed(p, cpus_allowed);
+                if (!cpumask_subset(effective_mask, cpus_allowed)) {
+                        /*
+                         * We must have raced with a concurrent cpuset
+                         * update. Just reset the cpus_allowed to the
+                         * cpuset's cpus_allowed
+                         */
+                        cpumask_copy(new_mask, cpus_allowed);
+                        goto again;
+                }
+        }
 out_unlock:
+        free_cpumask_var(effective_mask);
+out_free_new_mask:
+        free_cpumask_var(new_mask);
+out_free_cpus_allowed:
+        free_cpumask_var(cpus_allowed);
+out_put_task:
         put_task_struct(p);
         put_online_cpus();
         return retval;
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 8bdd6a663c7f..852780868fb4 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -976,7 +976,7 @@ asmlinkage void do_cpu(struct pt_regs *regs)
 
         case 2:
                 raw_notifier_call_chain(&cu2_chain, CU2_EXCEPTION, regs);
-                break;
+                return;
 
         case 3:
                 break;
diff --git a/arch/mips/loongson/Kconfig b/arch/mips/loongson/Kconfig
index 3df1967dea08..c97ca69b94e0 100644
--- a/arch/mips/loongson/Kconfig
+++ b/arch/mips/loongson/Kconfig
@@ -23,6 +23,7 @@ config LEMOTE_FULOONG2E
         select GENERIC_HARDIRQS_NO__DO_IRQ
         select GENERIC_ISA_DMA_SUPPORT_BROKEN
         select CPU_HAS_WB
+        select LOONGSON_MC146818
         help
           Lemote Fuloong(2e) mini-PC board based on the Chinese Loongson-2E CPU and
           an FPGA northbridge
@@ -51,6 +52,7 @@ config LEMOTE_MACH2F
         select SYS_SUPPORTS_64BIT_KERNEL
         select SYS_SUPPORTS_HIGHMEM
         select SYS_SUPPORTS_LITTLE_ENDIAN
+        select LOONGSON_MC146818
         help
           Lemote Loongson 2F family machines utilize the 2F revision of
           Loongson processor and the AMD CS5536 south bridge.
@@ -83,3 +85,7 @@ config LOONGSON_UART_BASE
         bool
         default y
         depends on EARLY_PRINTK || SERIAL_8250
+
+config LOONGSON_MC146818
+        bool
+        default n
diff --git a/arch/mips/loongson/common/Makefile b/arch/mips/loongson/common/Makefile
index cdd2e812ba1a..e526488df655 100644
--- a/arch/mips/loongson/common/Makefile
+++ b/arch/mips/loongson/common/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_GENERIC_GPIO) += gpio.o
 obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
 obj-$(CONFIG_SERIAL_8250) += serial.o
 obj-$(CONFIG_LOONGSON_UART_BASE) += uart_base.o
+obj-$(CONFIG_LOONGSON_MC146818) += rtc.o
 
 #
 # Enable CS5536 Virtual Support Module(VSM) to virtulize the PCI configure
diff --git a/arch/mips/loongson/common/cs5536/cs5536_ehci.c b/arch/mips/loongson/common/cs5536/cs5536_ehci.c
index eaf8b86e3318..5b5cbba699b3 100644
--- a/arch/mips/loongson/common/cs5536/cs5536_ehci.c
+++ b/arch/mips/loongson/common/cs5536/cs5536_ehci.c
@@ -49,6 +49,8 @@ void pci_ehci_write_reg(int reg, u32 value)
                         lo |= SOFT_BAR_EHCI_FLAG;
                         _wrmsr(GLCP_MSR_REG(GLCP_SOFT_COM), hi, lo);
                 } else if ((value & 0x01) == 0x00) {
+                        _rdmsr(USB_MSR_REG(USB_EHCI), &hi, &lo);
+                        lo = value;
                         _wrmsr(USB_MSR_REG(USB_EHCI), hi, lo);
 
                         value &= 0xfffffff0;
diff --git a/arch/mips/loongson/common/cs5536/cs5536_ide.c b/arch/mips/loongson/common/cs5536/cs5536_ide.c
index 9a96b5664c78..681d1291a2c7 100644
--- a/arch/mips/loongson/common/cs5536/cs5536_ide.c
+++ b/arch/mips/loongson/common/cs5536/cs5536_ide.c
@@ -51,6 +51,7 @@ void pci_ide_write_reg(int reg, u32 value)
                         lo |= SOFT_BAR_IDE_FLAG;
                         _wrmsr(GLCP_MSR_REG(GLCP_SOFT_COM), hi, lo);
                 } else if (value & 0x01) {
+                        _rdmsr(IDE_MSR_REG(IDE_IO_BAR), &hi, &lo);
                         lo = (value & 0xfffffff0) | 0x1;
                         _wrmsr(IDE_MSR_REG(IDE_IO_BAR), hi, lo);
 
@@ -65,19 +66,30 @@ void pci_ide_write_reg(int reg, u32 value)
                         _rdmsr(DIVIL_MSR_REG(DIVIL_BALL_OPTS), &hi, &lo);
                         lo |= 0x01;
                         _wrmsr(DIVIL_MSR_REG(DIVIL_BALL_OPTS), hi, lo);
-                } else
+                } else {
+                        _rdmsr(IDE_MSR_REG(IDE_CFG), &hi, &lo);
+                        lo = value;
                         _wrmsr(IDE_MSR_REG(IDE_CFG), hi, lo);
+                }
                 break;
         case PCI_IDE_DTC_REG:
+                _rdmsr(IDE_MSR_REG(IDE_DTC), &hi, &lo);
+                lo = value;
                 _wrmsr(IDE_MSR_REG(IDE_DTC), hi, lo);
                 break;
         case PCI_IDE_CAST_REG:
+                _rdmsr(IDE_MSR_REG(IDE_CAST), &hi, &lo);
+                lo = value;
                 _wrmsr(IDE_MSR_REG(IDE_CAST), hi, lo);
                 break;
         case PCI_IDE_ETC_REG:
+                _rdmsr(IDE_MSR_REG(IDE_ETC), &hi, &lo);
+                lo = value;
                 _wrmsr(IDE_MSR_REG(IDE_ETC), hi, lo);
                 break;
         case PCI_IDE_PM_REG:
+                _rdmsr(IDE_MSR_REG(IDE_INTERNAL_PM), &hi, &lo);
+                lo = value;
                 _wrmsr(IDE_MSR_REG(IDE_INTERNAL_PM), hi, lo);
                 break;
         default:
@@ -167,6 +179,7 @@ u32 pci_ide_read_reg(int reg)
         case PCI_IDE_ETC_REG:
                 _rdmsr(IDE_MSR_REG(IDE_ETC), &hi, &lo);
                 conf_data = lo;
+                break;
         case PCI_IDE_PM_REG:
                 _rdmsr(IDE_MSR_REG(IDE_INTERNAL_PM), &hi, &lo);
                 conf_data = lo;
diff --git a/arch/mips/loongson/common/cs5536/cs5536_isa.c b/arch/mips/loongson/common/cs5536/cs5536_isa.c
index f5c0818831b2..4d9f65abeaff 100644
--- a/arch/mips/loongson/common/cs5536/cs5536_isa.c
+++ b/arch/mips/loongson/common/cs5536/cs5536_isa.c
@@ -61,7 +61,7 @@ static void divil_lbar_enable(void)
         for (offset = DIVIL_LBAR_SMB; offset <= DIVIL_LBAR_PMS; offset++) {
                 _rdmsr(DIVIL_MSR_REG(offset), &hi, &lo);
                 hi |= 0x01;
-                _wrmsr(DIVIL_MSR_REG(DIVIL_LBAR_SMB), hi, lo);
+                _wrmsr(DIVIL_MSR_REG(offset), hi, lo);
         }
 }
 
@@ -76,7 +76,7 @@ static void divil_lbar_disable(void)
         for (offset = DIVIL_LBAR_SMB; offset <= DIVIL_LBAR_PMS; offset++) {
                 _rdmsr(DIVIL_MSR_REG(offset), &hi, &lo);
                 hi &= ~0x01;
-                _wrmsr(DIVIL_MSR_REG(DIVIL_LBAR_SMB), hi, lo);
+                _wrmsr(DIVIL_MSR_REG(offset), hi, lo);
         }
 }
 
diff --git a/arch/mips/loongson/common/cs5536/cs5536_ohci.c b/arch/mips/loongson/common/cs5536/cs5536_ohci.c
index db5900aadd6b..bdedf512baf7 100644
--- a/arch/mips/loongson/common/cs5536/cs5536_ohci.c
+++ b/arch/mips/loongson/common/cs5536/cs5536_ohci.c
@@ -49,6 +49,8 @@ void pci_ohci_write_reg(int reg, u32 value)
                         lo |= SOFT_BAR_OHCI_FLAG;
                         _wrmsr(GLCP_MSR_REG(GLCP_SOFT_COM), hi, lo);
                 } else if ((value & 0x01) == 0x00) {
+                        _rdmsr(USB_MSR_REG(USB_OHCI), &hi, &lo);
+                        lo = value;
                         _wrmsr(USB_MSR_REG(USB_OHCI), hi, lo);
 
                         value &= 0xfffffff0;
diff --git a/arch/mips/loongson/common/rtc.c b/arch/mips/loongson/common/rtc.c
new file mode 100644
index 000000000000..a90d87c01555
--- /dev/null
+++ b/arch/mips/loongson/common/rtc.c
@@ -0,0 +1,43 @@
+/*
+ *  Lemote Fuloong platform support
+ *
+ *  Copyright(c) 2010 Arnaud Patard <apatard@mandriva.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/platform_device.h>
+#include <linux/mc146818rtc.h>
+
+struct resource loongson_rtc_resources[] = {
+        {
+                .start  = RTC_PORT(0),
+                .end    = RTC_PORT(1),
+                .flags  = IORESOURCE_IO,
+        }, {
+                .start  = RTC_IRQ,
+                .end    = RTC_IRQ,
+                .flags  = IORESOURCE_IRQ,
+        }
+};
+
+static struct platform_device loongson_rtc_device = {
+        .name           = "rtc_cmos",
+        .id             = -1,
+        .resource       = loongson_rtc_resources,
+        .num_resources  = ARRAY_SIZE(loongson_rtc_resources),
+};
+
+
+static int __init loongson_rtc_platform_init(void)
+{
+        platform_device_register(&loongson_rtc_device);
+        return 0;
+}
+
+device_initcall(loongson_rtc_platform_init);
diff --git a/arch/mips/math-emu/dp_simple.c b/arch/mips/math-emu/dp_simple.c
index d9ae1dbabda7..b90974246e5b 100644
--- a/arch/mips/math-emu/dp_simple.c
+++ b/arch/mips/math-emu/dp_simple.c
@@ -78,6 +78,7 @@ ieee754dp ieee754dp_abs(ieee754dp x)
         DPSIGN(x) = 0;
 
         if (xc == IEEE754_CLASS_SNAN) {
+                SETCX(IEEE754_INVALID_OPERATION);
                 return ieee754dp_nanxcpt(ieee754dp_indef(), "abs");
         }
 
diff --git a/arch/mips/math-emu/sp_simple.c b/arch/mips/math-emu/sp_simple.c
index 3175477d36f6..2fd53c920e99 100644
--- a/arch/mips/math-emu/sp_simple.c
+++ b/arch/mips/math-emu/sp_simple.c
@@ -78,6 +78,7 @@ ieee754sp ieee754sp_abs(ieee754sp x)
         SPSIGN(x) = 0;
 
         if (xc == IEEE754_CLASS_SNAN) {
+                SETCX(IEEE754_INVALID_OPERATION);
                 return ieee754sp_nanxcpt(ieee754sp_indef(), "abs");
         }
 
diff --git a/arch/mips/oprofile/op_model_loongson2.c b/arch/mips/oprofile/op_model_loongson2.c
index d0d24e047676..60d3ea602118 100644
--- a/arch/mips/oprofile/op_model_loongson2.c
+++ b/arch/mips/oprofile/op_model_loongson2.c
@@ -43,6 +43,12 @@ static struct loongson2_register_config {
 static char *oprofid = "LoongsonPerf";
 static irqreturn_t loongson2_perfcount_handler(int irq, void *dev_id);
 
+static void reset_counters(void *arg)
+{
+        write_c0_perfctrl(0);
+        write_c0_perfcnt(0);
+}
+
 static void loongson2_reg_setup(struct op_counter_config *cfg)
 {
         unsigned int ctrl = 0;
@@ -139,7 +145,7 @@ static int __init loongson2_init(void)
 
 static void loongson2_exit(void)
 {
-        write_c0_perfctrl(0);
+        reset_counters(NULL);
         free_irq(LOONGSON2_PERFCNT_IRQ, oprofid);
 }
 
diff --git a/arch/mn10300/unit-asb2305/pci-asb2305.c b/arch/mn10300/unit-asb2305/pci-asb2305.c
index d6119b879a98..45b40ac6c464 100644
--- a/arch/mn10300/unit-asb2305/pci-asb2305.c
+++ b/arch/mn10300/unit-asb2305/pci-asb2305.c
@@ -117,6 +117,7 @@ static void __init pcibios_allocate_bus_resources(struct list_head *bus_list)
                                          * Invalidate the resource to prevent
                                          * child resource allocations in this
                                          * range. */
+                                        r->start = r->end = 0;
                                         r->flags = 0;
                                 }
                         }
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 328774bd41ee..6506bf4fbff1 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -400,7 +400,7 @@ config IRQ_ALL_CPUS
 
 config SPARSE_IRQ
         bool "Support sparse irq numbering"
-        default y
+        default n
         help
           This enables support for sparse irqs. This is useful for distro
           kernels that want to define a high CONFIG_NR_CPUS value but still
@@ -409,7 +409,7 @@ config SPARSE_IRQ
           ( Sparse IRQs can also be beneficial on NUMA boxes, as they spread
             out the irq_desc[] array in a more NUMA-friendly way. )
 
-          If you don't know what to do here, say Y.
+          If you don't know what to do here, say N.
 
 config NUMA
         bool "NUMA support"
diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug
index 53696da4518f..2d38a50e66ba 100644
--- a/arch/powerpc/Kconfig.debug
+++ b/arch/powerpc/Kconfig.debug
@@ -135,13 +135,6 @@ config DEBUGGER
         depends on KGDB || XMON
         default y
 
-config IRQSTACKS
-        bool "Use separate kernel stacks when processing interrupts"
-        help
-          If you say Y here the kernel will use separate kernel stacks
-          for handling hard and soft interrupts.  This can help avoid
-          overflowing the process kernel stacks.
-
 config VIRQ_DEBUG
         bool "Expose hardware/virtual IRQ mapping via debugfs"
         depends on DEBUG_FS
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 42dcd3f4ad7b..77cfe7a29e25 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -92,10 +92,10 @@ endif
 else
         KBUILD_CFLAGS += $(call cc-option,-mtune=power4)
 endif
-else
-LDFLAGS_MODULE  += arch/powerpc/lib/crtsavres.o
 endif
 
+LDFLAGS_MODULE  += arch/powerpc/lib/crtsavres.o
+
 ifeq ($(CONFIG_TUNE_CELL),y)
         KBUILD_CFLAGS += $(call cc-option,-mtune=cell)
 endif
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index ad0df7d0a643..fae8192c8fcc 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -141,7 +141,7 @@ $(patsubst %.S,%.o, $(filter %.S, $(src-boot))): %.o: %.S FORCE
 $(obj)/wrapper.a: $(obj-wlib) FORCE
         $(call if_changed,bootar)
 
-hostprogs-y     := addnote addRamDisk hack-coff mktree
+hostprogs-y     := addnote hack-coff mktree
 
 targets         += $(patsubst $(obj)/%,%,$(obj-boot) wrapper.a)
 extra-y         := $(obj)/wrapper.a $(obj-plat) $(obj)/empty.o \
diff --git a/arch/powerpc/boot/addRamDisk.c b/arch/powerpc/boot/addRamDisk.c
deleted file mode 100644
index 893f446cbd22..000000000000
--- a/arch/powerpc/boot/addRamDisk.c
+++ /dev/null
@@ -1,311 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-#include <netinet/in.h>
-#include <unistd.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <string.h>
-#include <elf.h>
-
-#define ElfHeaderSize  (64 * 1024)
-#define ElfPages  (ElfHeaderSize / 4096)
-#define KERNELBASE (0xc000000000000000)
-#define _ALIGN_UP(addr,size)    (((addr)+((size)-1))&(~((size)-1)))
-
-struct addr_range {
-        unsigned long long addr;
-        unsigned long memsize;
-        unsigned long offset;
-};
-
-static int check_elf64(void *p, int size, struct addr_range *r)
-{
-        Elf64_Ehdr *elf64 = p;
-        Elf64_Phdr *elf64ph;
-
-        if (elf64->e_ident[EI_MAG0] != ELFMAG0 ||
-            elf64->e_ident[EI_MAG1] != ELFMAG1 ||
-            elf64->e_ident[EI_MAG2] != ELFMAG2 ||
-            elf64->e_ident[EI_MAG3] != ELFMAG3 ||
-            elf64->e_ident[EI_CLASS] != ELFCLASS64 ||
-            elf64->e_ident[EI_DATA] != ELFDATA2MSB ||
-            elf64->e_type != ET_EXEC || elf64->e_machine != EM_PPC64)
-                return 0;
-
-        if ((elf64->e_phoff + sizeof(Elf64_Phdr)) > size)
-                return 0;
-
-        elf64ph = (Elf64_Phdr *) ((unsigned long)elf64 +
-                                  (unsigned long)elf64->e_phoff);
-
-        r->memsize = (unsigned long)elf64ph->p_memsz;
-        r->offset = (unsigned long)elf64ph->p_offset;
-        r->addr = (unsigned long long)elf64ph->p_vaddr;
-
-#ifdef DEBUG
-        printf("PPC64 ELF file, ph:\n");
-        printf("p_type   0x%08x\n", elf64ph->p_type);
-        printf("p_flags  0x%08x\n", elf64ph->p_flags);
-        printf("p_offset 0x%016llx\n", elf64ph->p_offset);
-        printf("p_vaddr  0x%016llx\n", elf64ph->p_vaddr);
-        printf("p_paddr  0x%016llx\n", elf64ph->p_paddr);
-        printf("p_filesz 0x%016llx\n", elf64ph->p_filesz);
-        printf("p_memsz  0x%016llx\n", elf64ph->p_memsz);
-        printf("p_align  0x%016llx\n", elf64ph->p_align);
-        printf("... skipping 0x%08lx bytes of ELF header\n",
-               (unsigned long)elf64ph->p_offset);
-#endif
-
-        return 64;
-}
-static void get4k(FILE *file, char *buf )
-{
-        unsigned j;
-        unsigned num = fread(buf, 1, 4096, file);
-        for ( j=num; j<4096; ++j )
-                buf[j] = 0;
-}
-
-static void put4k(FILE *file, char *buf )
-{
-        fwrite(buf, 1, 4096, file);
-}
-
-static void death(const char *msg, FILE *fdesc, const char *fname)
-{
-        fprintf(stderr, msg);
-        fclose(fdesc);
-        unlink(fname);
-        exit(1);
-}
-
-int main(int argc, char **argv)
-{
-        char inbuf[4096];
-        struct addr_range vmlinux;
-        FILE *ramDisk;
-        FILE *inputVmlinux;
-        FILE *outputVmlinux;
-
-        char *rd_name, *lx_name, *out_name;
-
-        size_t i;
-        unsigned long ramFileLen;
-        unsigned long ramLen;
-        unsigned long roundR;
-        unsigned long offset_end;
-
-        unsigned long kernelLen;
-        unsigned long actualKernelLen;
-        unsigned long round;
-        unsigned long roundedKernelLen;
-        unsigned long ramStartOffs;
-        unsigned long ramPages;
-        unsigned long roundedKernelPages;
-        unsigned long hvReleaseData;
-        u_int32_t eyeCatcher = 0xc8a5d9c4;
-        unsigned long naca;
-        unsigned long xRamDisk;
-        unsigned long xRamDiskSize;
-        long padPages;
-  
-  
-        if (argc < 2) {
-                fprintf(stderr, "Name of RAM disk file missing.\n");
-                exit(1);
-        }
-        rd_name = argv[1];
-
-        if (argc < 3) {
-                fprintf(stderr, "Name of vmlinux file missing.\n");
-                exit(1);
-        }
-        lx_name = argv[2];
-
-        if (argc < 4) {
-                fprintf(stderr, "Name of vmlinux output file missing.\n");
-                exit(1);
-        }
-        out_name = argv[3];
-
-
-        ramDisk = fopen(rd_name, "r");
-        if ( ! ramDisk ) {
-                fprintf(stderr, "RAM disk file \"%s\" failed to open.\n", rd_name);
-                exit(1);
-        }
-
-        inputVmlinux = fopen(lx_name, "r");
-        if ( ! inputVmlinux ) {
-                fprintf(stderr, "vmlinux file \"%s\" failed to open.\n", lx_name);
-                exit(1);
-        }
-  
-        outputVmlinux = fopen(out_name, "w+");
-        if ( ! outputVmlinux ) {
-                fprintf(stderr, "output vmlinux file \"%s\" failed to open.\n", out_name);
-                exit(1);
-        }
-
-        i = fread(inbuf, 1, sizeof(inbuf), inputVmlinux);
-        if (i != sizeof(inbuf)) {
-                fprintf(stderr, "can not read vmlinux file %s: %u\n", lx_name, i);
-                exit(1);
-        }
-
-        i = check_elf64(inbuf, sizeof(inbuf), &vmlinux);
-        if (i == 0) {
-                fprintf(stderr, "You must have a linux kernel specified as argv[2]\n");
-                exit(1);
-        }
-
-        /* Input Vmlinux file */
-        fseek(inputVmlinux, 0, SEEK_END);
-        kernelLen = ftell(inputVmlinux);
-        fseek(inputVmlinux, 0, SEEK_SET);
-        printf("kernel file size = %lu\n", kernelLen);
-
-        actualKernelLen = kernelLen - ElfHeaderSize;
-
-        printf("actual kernel length (minus ELF header) = %lu\n", actualKernelLen);
-
-        round = actualKernelLen % 4096;
-        roundedKernelLen = actualKernelLen;
-        if ( round )
-                roundedKernelLen += (4096 - round);
-        printf("Vmlinux length rounded up to a 4k multiple = %ld/0x%lx \n", roundedKernelLen, roundedKernelLen);
-        roundedKernelPages = roundedKernelLen / 4096;
-        printf("Vmlinux pages to copy = %ld/0x%lx \n", roundedKernelPages, roundedKernelPages);
-
-        offset_end = _ALIGN_UP(vmlinux.memsize, 4096);
-        /* calc how many pages we need to insert between the vmlinux and the start of the ram disk */
-        padPages = offset_end/4096 - roundedKernelPages;
-
-        /* Check and see if the vmlinux is already larger than _end in System.map */
-        if (padPages < 0) {
-                /* vmlinux is larger than _end - adjust the offset to the start of the embedded ram disk */ 
-                offset_end = roundedKernelLen;
-                printf("vmlinux is larger than _end indicates it needs to be - offset_end = %lx \n", offset_end);
-                padPages = 0;
-                printf("will insert %lx pages between the vmlinux and the start of the ram disk \n", padPages);
-        }
-        else {
-                /* _end is larger than vmlinux - use the offset to _end that we calculated from the system map */
-                printf("vmlinux is smaller than _end indicates is needed - offset_end = %lx \n", offset_end);
-                printf("will insert %lx pages between the vmlinux and the start of the ram disk \n", padPages);
-        }
-
-
-
-        /* Input Ram Disk file */
-        // Set the offset that the ram disk will be started at.
-        ramStartOffs = offset_end;  /* determined from the input vmlinux file and the system map */
-        printf("Ram Disk will start at offset = 0x%lx \n", ramStartOffs);
-  
-        fseek(ramDisk, 0, SEEK_END);
-        ramFileLen = ftell(ramDisk);
-        fseek(ramDisk, 0, SEEK_SET);
-        printf("%s file size = %ld/0x%lx \n", rd_name, ramFileLen, ramFileLen);
-
-        ramLen = ramFileLen;
-
-        roundR = 4096 - (ramLen % 4096);
-        if ( roundR ) {
-                printf("Rounding RAM disk file up to a multiple of 4096, adding %ld/0x%lx \n", roundR, roundR);
-                ramLen += roundR;
-        }
-
-        printf("Rounded RAM disk size is %ld/0x%lx \n", ramLen, ramLen);
-        ramPages = ramLen / 4096;
-        printf("RAM disk pages to copy = %ld/0x%lx\n", ramPages, ramPages);
-
-
-
-  // Copy 64K ELF header
-        for (i=0; i<(ElfPages); ++i) {
-                get4k( inputVmlinux, inbuf );
-                put4k( outputVmlinux, inbuf );
-        }
-
-        /* Copy the vmlinux (as full pages). */
-        fseek(inputVmlinux, ElfHeaderSize, SEEK_SET);
-        for ( i=0; i<roundedKernelPages; ++i ) {
-                get4k( inputVmlinux, inbuf );
-                put4k( outputVmlinux, inbuf );
-        }
-  
-        /* Insert pad pages (if appropriate) that are needed between */
-        /* | the end of the vmlinux and the ram disk. */
-        for (i=0; i<padPages; ++i) {
-                memset(inbuf, 0, 4096);
-                put4k(outputVmlinux, inbuf);
-        }
-
-        /* Copy the ram disk (as full pages). */
-        for ( i=0; i<ramPages; ++i ) {
-                get4k( ramDisk, inbuf );
-                put4k( outputVmlinux, inbuf );
-        }
-
-        /* Close the input files */
-        fclose(ramDisk);
-        fclose(inputVmlinux);
-        /* And flush the written output file */
-        fflush(outputVmlinux);
-
-
-
-        /* Fixup the new vmlinux to contain the ram disk starting offset (xRamDisk) and the ram disk size (xRamDiskSize) */
-        /* fseek to the hvReleaseData pointer */
-        fseek(outputVmlinux, ElfHeaderSize + 0x24, SEEK_SET);
-        if (fread(&hvReleaseData, 4, 1, outputVmlinux) != 1) {
-                death("Could not read hvReleaseData pointer\n", outputVmlinux, out_name);
-        }
-        hvReleaseData = ntohl(hvReleaseData); /* Convert to native int */
-        printf("hvReleaseData is at %08lx\n", hvReleaseData);
-
-        /* fseek to the hvReleaseData */
-        fseek(outputVmlinux, ElfHeaderSize + hvReleaseData, SEEK_SET);
-        if (fread(inbuf, 0x40, 1, outputVmlinux) != 1) {
-                death("Could not read hvReleaseData\n", outputVmlinux, out_name);
-        }
-        /* Check hvReleaseData sanity */
-        if (memcmp(inbuf, &eyeCatcher, 4) != 0) {
-                death("hvReleaseData is invalid\n", outputVmlinux, out_name);
-        }
-        /* Get the naca pointer */
-        naca = ntohl(*((u_int32_t*) &inbuf[0x0C])) - KERNELBASE;
-        printf("Naca is at offset 0x%lx \n", naca);
-
-        /* fseek to the naca */
-        fseek(outputVmlinux, ElfHeaderSize + naca, SEEK_SET);
-        if (fread(inbuf, 0x18, 1, outputVmlinux) != 1) {
-                death("Could not read naca\n", outputVmlinux, out_name);
-        }
-        xRamDisk = ntohl(*((u_int32_t *) &inbuf[0x0c]));
-        xRamDiskSize = ntohl(*((u_int32_t *) &inbuf[0x14]));
-        /* Make sure a RAM disk isn't already present */
-        if ((xRamDisk != 0) || (xRamDiskSize != 0)) {
-                death("RAM disk is already attached to this kernel\n", outputVmlinux, out_name);
-        }
-        /* Fill in the values */
-        *((u_int32_t *) &inbuf[0x0c]) = htonl(ramStartOffs);
-        *((u_int32_t *) &inbuf[0x14]) = htonl(ramPages);
-
-        /* Write out the new naca */
-        fflush(outputVmlinux);
-        fseek(outputVmlinux, ElfHeaderSize + naca, SEEK_SET);
-        if (fwrite(inbuf, 0x18, 1, outputVmlinux) != 1) {
-                death("Could not write naca\n", outputVmlinux, out_name);
-        }
-        printf("Ram Disk of 0x%lx pages is attached to the kernel at offset 0x%08lx\n",
-               ramPages, ramStartOffs);
-
-        /* Done */
-        fclose(outputVmlinux);
-        /* Set permission to executable */
-        chmod(out_name, S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH);
-
-        return 0;
-}
-
diff --git a/arch/powerpc/boot/dts/lite5200.dts b/arch/powerpc/boot/dts/lite5200.dts
index 82ff2b13bc37..179a1785d645 100644
--- a/arch/powerpc/boot/dts/lite5200.dts
+++ b/arch/powerpc/boot/dts/lite5200.dts
@@ -134,12 +134,16 @@
                         compatible = "fsl,mpc5200-gpio";
                         reg = <0xb00 0x40>;
                         interrupts = <1 7 0>;
+                        gpio-controller;
+                        #gpio-cells = <2>;
                 };
 
                 gpio@c00 {
                         compatible = "fsl,mpc5200-gpio-wkup";
                         reg = <0xc00 0x40>;
                         interrupts = <1 8 0 0 3 0>;
+                        gpio-controller;
+                        #gpio-cells = <2>;
                 };
 
                 spi@f00 {
@@ -230,8 +234,8 @@
                         reg = <0x3000 0x400>;   // fec range, since we need to setup fec interrupts
                         interrupts = <2 5 0>;   // these are for "mii command finished", not link changes & co.
 
-                        phy0: ethernet-phy@1 {
-                                reg = <1>;
+                        phy0: ethernet-phy@0 {
+                                reg = <0>;
                         };
                 };
 
@@ -255,7 +259,13 @@
                         compatible = "fsl,mpc5200-i2c","fsl-i2c";
                         reg = <0x3d40 0x40>;
                         interrupts = <2 16 0>;
+
+                        eeprom@50 {
+                                compatible = "atmel,24c02";
+                                reg = <0x50>;
+                        };
                 };
+
                 sram@8000 {
                         compatible = "fsl,mpc5200-sram";
                         reg = <0x8000 0x4000>;
@@ -281,4 +291,18 @@
                           0x02000000 0 0xa0000000 0xa0000000 0 0x10000000
                           0x01000000 0 0x00000000 0xb0000000 0 0x01000000>;
         };
+
+        localbus {
+                compatible = "fsl,mpc5200-lpb","simple-bus";
+                #address-cells = <2>;
+                #size-cells = <1>;
+
+                ranges = <0 0 0xff000000 0x01000000>;
+
+                flash@0,0 {
+                        compatible = "amd,am29lv652d", "cfi-flash";
+                        reg = <0 0 0x01000000>;
+                        bank-width = <1>;
+                };
+        };
 };
diff --git a/arch/powerpc/boot/dts/lite5200b.dts b/arch/powerpc/boot/dts/lite5200b.dts
index e45a63be3a86..59702ace900f 100644
--- a/arch/powerpc/boot/dts/lite5200b.dts
+++ b/arch/powerpc/boot/dts/lite5200b.dts
@@ -259,6 +259,11 @@
                         compatible = "fsl,mpc5200b-i2c","fsl,mpc5200-i2c","fsl-i2c";
                         reg = <0x3d40 0x40>;
                         interrupts = <2 16 0>;
+
+                        eeprom@50 {
+                                compatible = "atmel,24c02";
+                                reg = <0x50>;
+                        };
                 };
 
                 sram@8000 {
diff --git a/arch/powerpc/configs/40x/acadia_defconfig b/arch/powerpc/configs/40x/acadia_defconfig
index 8e95f8d227b9..4aa17b676a3f 100644
--- a/arch/powerpc/configs/40x/acadia_defconfig
+++ b/arch/powerpc/configs/40x/acadia_defconfig
@@ -98,8 +98,7 @@ CONFIG_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/40x/ep405_defconfig b/arch/powerpc/configs/40x/ep405_defconfig
index 918f23fd2b18..9a5f1ab777ed 100644
--- a/arch/powerpc/configs/40x/ep405_defconfig
+++ b/arch/powerpc/configs/40x/ep405_defconfig
@@ -98,8 +98,7 @@ CONFIG_FAIR_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/40x/hcu4_defconfig b/arch/powerpc/configs/40x/hcu4_defconfig
index f87ef0382280..0b452135d1d4 100644
--- a/arch/powerpc/configs/40x/hcu4_defconfig
+++ b/arch/powerpc/configs/40x/hcu4_defconfig
@@ -98,8 +98,7 @@ CONFIG_FAIR_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/40x/kilauea_defconfig b/arch/powerpc/configs/40x/kilauea_defconfig
index 19fbcb075376..4d2de0bed60e 100644
--- a/arch/powerpc/configs/40x/kilauea_defconfig
+++ b/arch/powerpc/configs/40x/kilauea_defconfig
@@ -98,8 +98,7 @@ CONFIG_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/40x/makalu_defconfig b/arch/powerpc/configs/40x/makalu_defconfig
index eb41cd695979..a1f3f505e4a7 100644
--- a/arch/powerpc/configs/40x/makalu_defconfig
+++ b/arch/powerpc/configs/40x/makalu_defconfig
@@ -98,8 +98,7 @@ CONFIG_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/40x/virtex_defconfig b/arch/powerpc/configs/40x/virtex_defconfig
index 416e79ac0711..c76313577140 100644
--- a/arch/powerpc/configs/40x/virtex_defconfig
+++ b/arch/powerpc/configs/40x/virtex_defconfig
@@ -77,8 +77,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/40x/walnut_defconfig b/arch/powerpc/configs/40x/walnut_defconfig
index bfff0eae39d2..6597b2f1d1a8 100644
--- a/arch/powerpc/configs/40x/walnut_defconfig
+++ b/arch/powerpc/configs/40x/walnut_defconfig
@@ -98,8 +98,7 @@ CONFIG_FAIR_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/44x/arches_defconfig b/arch/powerpc/configs/44x/arches_defconfig
index 1f6d0490e28d..2d3dfb55fbed 100644
--- a/arch/powerpc/configs/44x/arches_defconfig
+++ b/arch/powerpc/configs/44x/arches_defconfig
@@ -98,8 +98,7 @@ CONFIG_RCU_FANOUT=32
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/44x/bamboo_defconfig b/arch/powerpc/configs/44x/bamboo_defconfig
index 788faac6c27a..51a00c46df19 100644
--- a/arch/powerpc/configs/44x/bamboo_defconfig
+++ b/arch/powerpc/configs/44x/bamboo_defconfig
@@ -102,8 +102,7 @@ CONFIG_FAIR_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/44x/canyonlands_defconfig b/arch/powerpc/configs/44x/canyonlands_defconfig
index 4ef8bcab61f8..1028b1bfb602 100644
--- a/arch/powerpc/configs/44x/canyonlands_defconfig
+++ b/arch/powerpc/configs/44x/canyonlands_defconfig
@@ -98,8 +98,7 @@ CONFIG_RCU_FANOUT=32
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/44x/ebony_defconfig b/arch/powerpc/configs/44x/ebony_defconfig
index ca17b1496e32..69f5633cbd4f 100644
--- a/arch/powerpc/configs/44x/ebony_defconfig
+++ b/arch/powerpc/configs/44x/ebony_defconfig
@@ -101,8 +101,7 @@ CONFIG_FAIR_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/44x/eiger_defconfig b/arch/powerpc/configs/44x/eiger_defconfig
index e3149bade0b2..dcd859c8b4a6 100644
--- a/arch/powerpc/configs/44x/eiger_defconfig
+++ b/arch/powerpc/configs/44x/eiger_defconfig
@@ -98,8 +98,7 @@ CONFIG_RCU_FANOUT=32
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/44x/katmai_defconfig b/arch/powerpc/configs/44x/katmai_defconfig
index af244e1d255e..a2c24d1e051e 100644
--- a/arch/powerpc/configs/44x/katmai_defconfig
+++ b/arch/powerpc/configs/44x/katmai_defconfig
@@ -97,8 +97,7 @@ CONFIG_RCU_FANOUT=32
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/44x/rainier_defconfig b/arch/powerpc/configs/44x/rainier_defconfig
index 8fed3b26af2e..3bb55b57077e 100644
--- a/arch/powerpc/configs/44x/rainier_defconfig
+++ b/arch/powerpc/configs/44x/rainier_defconfig
@@ -101,8 +101,7 @@ CONFIG_FAIR_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/44x/redwood_defconfig b/arch/powerpc/configs/44x/redwood_defconfig
index a67ec91a28c3..684f40dc8a41 100644
--- a/arch/powerpc/configs/44x/redwood_defconfig
+++ b/arch/powerpc/configs/44x/redwood_defconfig
@@ -98,8 +98,7 @@ CONFIG_RCU_FANOUT=32
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/44x/sam440ep_defconfig b/arch/powerpc/configs/44x/sam440ep_defconfig
index 886cb6aa6432..e202924e6173 100644
--- a/arch/powerpc/configs/44x/sam440ep_defconfig
+++ b/arch/powerpc/configs/44x/sam440ep_defconfig
@@ -103,8 +103,7 @@ CONFIG_FAIR_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/44x/sequoia_defconfig b/arch/powerpc/configs/44x/sequoia_defconfig
index 1b2f41dbcafb..c348a4662a9e 100644
--- a/arch/powerpc/configs/44x/sequoia_defconfig
+++ b/arch/powerpc/configs/44x/sequoia_defconfig
@@ -102,8 +102,7 @@ CONFIG_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/44x/taishan_defconfig b/arch/powerpc/configs/44x/taishan_defconfig
index 12041d355b8c..f4cb7e84cb83 100644
--- a/arch/powerpc/configs/44x/taishan_defconfig
+++ b/arch/powerpc/configs/44x/taishan_defconfig
@@ -101,8 +101,7 @@ CONFIG_FAIR_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/44x/virtex5_defconfig b/arch/powerpc/configs/44x/virtex5_defconfig
index 2518b8568c70..c7ead0ec00bc 100644
--- a/arch/powerpc/configs/44x/virtex5_defconfig
+++ b/arch/powerpc/configs/44x/virtex5_defconfig
@@ -80,8 +80,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/52xx/cm5200_defconfig b/arch/powerpc/configs/52xx/cm5200_defconfig
index 218d49b36a0c..7664c83c17c2 100644
--- a/arch/powerpc/configs/52xx/cm5200_defconfig
+++ b/arch/powerpc/configs/52xx/cm5200_defconfig
@@ -95,8 +95,7 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/52xx/lite5200b_defconfig b/arch/powerpc/configs/52xx/lite5200b_defconfig
index 90492ff25232..eac7c17eef34 100644
--- a/arch/powerpc/configs/52xx/lite5200b_defconfig
+++ b/arch/powerpc/configs/52xx/lite5200b_defconfig
@@ -96,8 +96,7 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/52xx/motionpro_defconfig b/arch/powerpc/configs/52xx/motionpro_defconfig
index dffc8cac825f..27afb6ecdf61 100644
--- a/arch/powerpc/configs/52xx/motionpro_defconfig
+++ b/arch/powerpc/configs/52xx/motionpro_defconfig
@@ -95,8 +95,7 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/52xx/pcm030_defconfig b/arch/powerpc/configs/52xx/pcm030_defconfig
index 3cb2a522046a..5fe39ddb4e14 100644
--- a/arch/powerpc/configs/52xx/pcm030_defconfig
+++ b/arch/powerpc/configs/52xx/pcm030_defconfig
@@ -98,8 +98,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 # CONFIG_BLK_DEV_INITRD is not set
diff --git a/arch/powerpc/configs/52xx/tqm5200_defconfig b/arch/powerpc/configs/52xx/tqm5200_defconfig
index 96181c62abfa..a108b84c0074 100644
--- a/arch/powerpc/configs/52xx/tqm5200_defconfig
+++ b/arch/powerpc/configs/52xx/tqm5200_defconfig
@@ -95,8 +95,7 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/86xx/gef_ppc9a_defconfig b/arch/powerpc/configs/86xx/gef_ppc9a_defconfig
index 183c59c6d896..b728a7d64250 100644
--- a/arch/powerpc/configs/86xx/gef_ppc9a_defconfig
+++ b/arch/powerpc/configs/86xx/gef_ppc9a_defconfig
@@ -103,8 +103,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 CONFIG_RELAY=y
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/86xx/gef_sbc310_defconfig b/arch/powerpc/configs/86xx/gef_sbc310_defconfig
index 1524d948a2ba..8e738de5f6a5 100644
--- a/arch/powerpc/configs/86xx/gef_sbc310_defconfig
+++ b/arch/powerpc/configs/86xx/gef_sbc310_defconfig
@@ -103,8 +103,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 CONFIG_RELAY=y
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/86xx/gef_sbc610_defconfig b/arch/powerpc/configs/86xx/gef_sbc610_defconfig
index 767c204c0603..59bf9e27d7f2 100644
--- a/arch/powerpc/configs/86xx/gef_sbc610_defconfig
+++ b/arch/powerpc/configs/86xx/gef_sbc610_defconfig
@@ -103,8 +103,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 CONFIG_RELAY=y
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/86xx/mpc8610_hpcd_defconfig b/arch/powerpc/configs/86xx/mpc8610_hpcd_defconfig
index 55b9e4e867ac..4e8b01e73245 100644
--- a/arch/powerpc/configs/86xx/mpc8610_hpcd_defconfig
+++ b/arch/powerpc/configs/86xx/mpc8610_hpcd_defconfig
@@ -98,8 +98,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/86xx/mpc8641_hpcn_defconfig b/arch/powerpc/configs/86xx/mpc8641_hpcn_defconfig
index 1be38eb05783..20fde6374aad 100644
--- a/arch/powerpc/configs/86xx/mpc8641_hpcn_defconfig
+++ b/arch/powerpc/configs/86xx/mpc8641_hpcn_defconfig
@@ -103,8 +103,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/86xx/sbc8641d_defconfig b/arch/powerpc/configs/86xx/sbc8641d_defconfig
index a63009457323..74f714d85936 100644
--- a/arch/powerpc/configs/86xx/sbc8641d_defconfig
+++ b/arch/powerpc/configs/86xx/sbc8641d_defconfig
@@ -102,8 +102,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 CONFIG_RELAY=y
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/adder875_defconfig b/arch/powerpc/configs/adder875_defconfig
index 9f89d5c9c0be..a670cee255b9 100644
--- a/arch/powerpc/configs/adder875_defconfig
+++ b/arch/powerpc/configs/adder875_defconfig
@@ -92,8 +92,7 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 # CONFIG_BLK_DEV_INITRD is not set
diff --git a/arch/powerpc/configs/amigaone_defconfig b/arch/powerpc/configs/amigaone_defconfig
index b63cc38df6b1..851287e78fc3 100644
--- a/arch/powerpc/configs/amigaone_defconfig
+++ b/arch/powerpc/configs/amigaone_defconfig
@@ -87,8 +87,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=15
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/c2k_defconfig b/arch/powerpc/configs/c2k_defconfig
index 4ab6074db3cf..b429a655b541 100644
--- a/arch/powerpc/configs/c2k_defconfig
+++ b/arch/powerpc/configs/c2k_defconfig
@@ -102,8 +102,7 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=17
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/cell_defconfig b/arch/powerpc/configs/cell_defconfig
index c6d2baa7aaeb..943371954317 100644
--- a/arch/powerpc/configs/cell_defconfig
+++ b/arch/powerpc/configs/cell_defconfig
@@ -83,8 +83,7 @@ CONFIG_CPUSETS=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUP_CPUACCT is not set
 # CONFIG_RESOURCE_COUNTERS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 CONFIG_PROC_PID_CPUSET=y
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
diff --git a/arch/powerpc/configs/celleb_defconfig b/arch/powerpc/configs/celleb_defconfig
index d2123779512a..6be6c09eba6d 100644
--- a/arch/powerpc/configs/celleb_defconfig
+++ b/arch/powerpc/configs/celleb_defconfig
@@ -78,8 +78,7 @@ CONFIG_LOG_BUF_SHIFT=15
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_USER_SCHED is not set
 # CONFIG_CGROUP_SCHED is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/chrp32_defconfig b/arch/powerpc/configs/chrp32_defconfig
index 5094a65a4493..2fdab660fce3 100644
--- a/arch/powerpc/configs/chrp32_defconfig
+++ b/arch/powerpc/configs/chrp32_defconfig
@@ -77,8 +77,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=15
 # CONFIG_CGROUPS is not set
 # CONFIG_GROUP_SCHED is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/ep8248e_defconfig b/arch/powerpc/configs/ep8248e_defconfig
index 81e904e9f392..6b708395a7c6 100644
--- a/arch/powerpc/configs/ep8248e_defconfig
+++ b/arch/powerpc/configs/ep8248e_defconfig
@@ -96,8 +96,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 # CONFIG_BLK_DEV_INITRD is not set
diff --git a/arch/powerpc/configs/ep88xc_defconfig b/arch/powerpc/configs/ep88xc_defconfig
index c5af46ef5f40..1cee889dd9ec 100644
--- a/arch/powerpc/configs/ep88xc_defconfig
+++ b/arch/powerpc/configs/ep88xc_defconfig
@@ -91,8 +91,7 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 # CONFIG_BLK_DEV_INITRD is not set
diff --git a/arch/powerpc/configs/g5_defconfig b/arch/powerpc/configs/g5_defconfig
index 826a65d3f002..57d3ffa3026a 100644
--- a/arch/powerpc/configs/g5_defconfig
+++ b/arch/powerpc/configs/g5_defconfig
@@ -82,8 +82,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=17
 # CONFIG_CGROUPS is not set
 # CONFIG_GROUP_SCHED is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/gamecube_defconfig b/arch/powerpc/configs/gamecube_defconfig
index 942e1193e9e4..1c2dbf07ac35 100644
--- a/arch/powerpc/configs/gamecube_defconfig
+++ b/arch/powerpc/configs/gamecube_defconfig
@@ -101,8 +101,7 @@ CONFIG_FAIR_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/holly_defconfig b/arch/powerpc/configs/holly_defconfig
index a211a79959ca..a60d61bee48d 100644
--- a/arch/powerpc/configs/holly_defconfig
+++ b/arch/powerpc/configs/holly_defconfig
@@ -73,7 +73,6 @@ CONFIG_SYSVIPC_SYSCTL=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
 # CONFIG_FAIR_GROUP_SCHED is not set
-CONFIG_SYSFS_DEPRECATED=y
 # CONFIG_RELAY is not set
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
diff --git a/arch/powerpc/configs/iseries_defconfig b/arch/powerpc/configs/iseries_defconfig
index 76982c51a4c7..151c8e14f3ab 100644
--- a/arch/powerpc/configs/iseries_defconfig
+++ b/arch/powerpc/configs/iseries_defconfig
@@ -81,8 +81,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=17
 # CONFIG_CGROUPS is not set
 # CONFIG_GROUP_SCHED is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/linkstation_defconfig b/arch/powerpc/configs/linkstation_defconfig
index 588a2add393f..8ecacf74d3e5 100644
--- a/arch/powerpc/configs/linkstation_defconfig
+++ b/arch/powerpc/configs/linkstation_defconfig
@@ -97,8 +97,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/maple_defconfig b/arch/powerpc/configs/maple_defconfig
index 8b244003b9e1..dc50eec58e78 100644
--- a/arch/powerpc/configs/maple_defconfig
+++ b/arch/powerpc/configs/maple_defconfig
@@ -78,8 +78,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=17
 # CONFIG_CGROUPS is not set
 # CONFIG_GROUP_SCHED is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/mgcoge_defconfig b/arch/powerpc/configs/mgcoge_defconfig
index 0cbd56fe2e1e..b36ebb7e843e 100644
--- a/arch/powerpc/configs/mgcoge_defconfig
+++ b/arch/powerpc/configs/mgcoge_defconfig
@@ -96,8 +96,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/mgsuvd_defconfig b/arch/powerpc/configs/mgsuvd_defconfig
index c1be26151021..0dd5015ea81d 100644
--- a/arch/powerpc/configs/mgsuvd_defconfig
+++ b/arch/powerpc/configs/mgsuvd_defconfig
@@ -90,8 +90,7 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=17
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/mpc512x_defconfig b/arch/powerpc/configs/mpc512x_defconfig
index a04727295d46..aa2654e6edeb 100644
--- a/arch/powerpc/configs/mpc512x_defconfig
+++ b/arch/powerpc/configs/mpc512x_defconfig
@@ -97,8 +97,7 @@ CONFIG_RCU_FANOUT=32
 CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/mpc5200_defconfig b/arch/powerpc/configs/mpc5200_defconfig
index 7012ac0134f0..f875ec21c91c 100644
--- a/arch/powerpc/configs/mpc5200_defconfig
+++ b/arch/powerpc/configs/mpc5200_defconfig
@@ -97,8 +97,7 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/mpc7448_hpc2_defconfig b/arch/powerpc/configs/mpc7448_hpc2_defconfig
index 27c63ceeb45a..b1e88fe1d9fb 100644
--- a/arch/powerpc/configs/mpc7448_hpc2_defconfig
+++ b/arch/powerpc/configs/mpc7448_hpc2_defconfig
@@ -95,8 +95,7 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/pasemi_defconfig b/arch/powerpc/configs/pasemi_defconfig
index 20ba0cfff8ba..74a7216183e8 100644
--- a/arch/powerpc/configs/pasemi_defconfig
+++ b/arch/powerpc/configs/pasemi_defconfig
@@ -98,8 +98,7 @@ CONFIG_RCU_FANOUT=64
 CONFIG_LOG_BUF_SHIFT=17
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/pmac32_defconfig b/arch/powerpc/configs/pmac32_defconfig
index ea8870a34482..753bb7912e28 100644
--- a/arch/powerpc/configs/pmac32_defconfig
+++ b/arch/powerpc/configs/pmac32_defconfig
@@ -93,8 +93,7 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/ppc40x_defconfig b/arch/powerpc/configs/ppc40x_defconfig
index 35b60683cde5..afb4d1bb2ba9 100644
--- a/arch/powerpc/configs/ppc40x_defconfig
+++ b/arch/powerpc/configs/ppc40x_defconfig
@@ -99,8 +99,7 @@ CONFIG_FAIR_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/ppc44x_defconfig b/arch/powerpc/configs/ppc44x_defconfig
index 46f5c47e9f85..bd3d23fb4dd3 100644
--- a/arch/powerpc/configs/ppc44x_defconfig
+++ b/arch/powerpc/configs/ppc44x_defconfig
@@ -103,8 +103,7 @@ CONFIG_FAIR_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index dad617e2a88c..369f4e02c5dd 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -93,8 +93,7 @@ CONFIG_CPUSETS=y
 # CONFIG_GROUP_SCHED is not set
 # CONFIG_CGROUP_CPUACCT is not set
 # CONFIG_RESOURCE_COUNTERS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 CONFIG_PROC_PID_CPUSET=y
 CONFIG_RELAY=y
 CONFIG_NAMESPACES=y
diff --git a/arch/powerpc/configs/ppc64e_defconfig b/arch/powerpc/configs/ppc64e_defconfig
index 8195f1650cbf..403e82e2e83c 100644
--- a/arch/powerpc/configs/ppc64e_defconfig
+++ b/arch/powerpc/configs/ppc64e_defconfig
@@ -107,8 +107,7 @@ CONFIG_CPUSETS=y
 CONFIG_PROC_PID_CPUSET=y
 # CONFIG_CGROUP_CPUACCT is not set
 # CONFIG_RESOURCE_COUNTERS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 CONFIG_RELAY=y
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/pq2fads_defconfig b/arch/powerpc/configs/pq2fads_defconfig
index 68c175ea427a..12c8ee8dd12b 100644
--- a/arch/powerpc/configs/pq2fads_defconfig
+++ b/arch/powerpc/configs/pq2fads_defconfig
@@ -96,8 +96,7 @@ CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/configs/prpmc2800_defconfig b/arch/powerpc/configs/prpmc2800_defconfig
index 93f4505b5ac2..a18f597c6e5f 100644
--- a/arch/powerpc/configs/prpmc2800_defconfig
+++ b/arch/powerpc/configs/prpmc2800_defconfig
@@ -98,8 +98,7 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 CONFIG_NAMESPACES=y
 # CONFIG_UTS_NS is not set
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index 16a14589bd40..16ae717d1958 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -92,8 +92,7 @@ CONFIG_CPUSETS=y
 # CONFIG_GROUP_SCHED is not set
 CONFIG_CGROUP_CPUACCT=y
 # CONFIG_RESOURCE_COUNTERS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 CONFIG_PROC_PID_CPUSET=y
 CONFIG_RELAY=y
 CONFIG_NAMESPACES=y
diff --git a/arch/powerpc/configs/storcenter_defconfig b/arch/powerpc/configs/storcenter_defconfig
index b1625801526e..01be0e207f40 100644
--- a/arch/powerpc/configs/storcenter_defconfig
+++ b/arch/powerpc/configs/storcenter_defconfig
@@ -95,8 +95,7 @@ CONFIG_RCU_FANOUT=32
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 # CONFIG_RELAY is not set
 # CONFIG_NAMESPACES is not set
 # CONFIG_BLK_DEV_INITRD is not set
diff --git a/arch/powerpc/configs/wii_defconfig b/arch/powerpc/configs/wii_defconfig
index c386828c639a..ee054f8118be 100644
--- a/arch/powerpc/configs/wii_defconfig
+++ b/arch/powerpc/configs/wii_defconfig
@@ -102,8 +102,7 @@ CONFIG_FAIR_GROUP_SCHED=y
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUPS is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 CONFIG_RELAY=y
 # CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
diff --git a/arch/powerpc/include/asm/irq.h b/arch/powerpc/include/asm/irq.h
index e054baef1845..ecba37a91749 100644
--- a/arch/powerpc/include/asm/irq.h
+++ b/arch/powerpc/include/asm/irq.h
@@ -358,7 +358,6 @@ extern void exc_lvl_ctx_init(void);
 #define exc_lvl_ctx_init()
 #endif
 
-#ifdef CONFIG_IRQSTACKS
 /*
  * Per-cpu stacks for handling hard and soft interrupts.
  */
@@ -369,11 +368,6 @@ extern void irq_ctx_init(void);
 extern void call_do_softirq(struct thread_info *tp);
 extern int call_handle_irq(int irq, void *p1,
                            struct thread_info *tp, void *func);
-#else
-#define irq_ctx_init()
-
-#endif /* CONFIG_IRQSTACKS */
-
 extern void do_IRQ(struct pt_regs *regs);
 
 #endif /* _ASM_IRQ_H */
diff --git a/arch/powerpc/include/asm/kdump.h b/arch/powerpc/include/asm/kdump.h
index 5ebfe5d3c61f..6857af58b02e 100644
--- a/arch/powerpc/include/asm/kdump.h
+++ b/arch/powerpc/include/asm/kdump.h
@@ -3,8 +3,17 @@
 
 #include <asm/page.h>
 
-/* Kdump kernel runs at 32 MB, change at your peril. */
+/*
+ * If CONFIG_RELOCATABLE is enabled we can place the kdump kernel anywhere.
+ * To keep enough space in the RMO for the first stage kernel on 64bit, we
+ * place it at 64MB. If CONFIG_RELOCATABLE is not enabled we must place
+ * the second stage at 32MB.
+ */
+#if defined(CONFIG_RELOCATABLE) && defined(CONFIG_PPC64)
+#define KDUMP_KERNELBASE        0x4000000
+#else
 #define KDUMP_KERNELBASE        0x2000000
+#endif
 
 /* How many bytes to reserve at zero for kdump. The reserve limit should
  * be greater or equal to the trampoline's end address.
diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h
index 5d8be0416227..0175a676b34b 100644
--- a/arch/powerpc/include/asm/ptrace.h
+++ b/arch/powerpc/include/asm/ptrace.h
@@ -24,11 +24,7 @@
  * 2 of the License, or (at your option) any later version.
  */
 
-#ifdef __KERNEL__
 #include <linux/types.h>
-#else
-#include <stdint.h>
-#endif
 
 #ifndef __ASSEMBLY__
 
@@ -364,13 +360,13 @@ static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs,
 #ifndef __ASSEMBLY__
 
 struct ppc_debug_info {
-        uint32_t version;               /* Only version 1 exists to date */
-        uint32_t num_instruction_bps;
-        uint32_t num_data_bps;
-        uint32_t num_condition_regs;
-        uint32_t data_bp_alignment;
-        uint32_t sizeof_condition;      /* size of the DVC register */
-        uint64_t features;
+        __u32 version;                  /* Only version 1 exists to date */
+        __u32 num_instruction_bps;
+        __u32 num_data_bps;
+        __u32 num_condition_regs;
+        __u32 data_bp_alignment;
+        __u32 sizeof_condition;         /* size of the DVC register */
+        __u64 features;
 };
 
 #endif /* __ASSEMBLY__ */
@@ -386,13 +382,13 @@ struct ppc_debug_info {
 #ifndef __ASSEMBLY__
 
 struct ppc_hw_breakpoint {
-        uint32_t version;               /* currently, version must be 1 */
-        uint32_t trigger_type;          /* only some combinations allowed */
-        uint32_t addr_mode;             /* address match mode */
-        uint32_t condition_mode;        /* break/watchpoint condition flags */
-        uint64_t addr;                  /* break/watchpoint address */
-        uint64_t addr2;                 /* range end or mask */
-        uint64_t condition_value;       /* contents of the DVC register */
+        __u32 version;          /* currently, version must be 1 */
+        __u32 trigger_type;     /* only some combinations allowed */
+        __u32 addr_mode;        /* address match mode */
+        __u32 condition_mode;   /* break/watchpoint condition flags */
+        __u64 addr;             /* break/watchpoint address */
+        __u64 addr2;            /* range end or mask */
+        __u64 condition_value;  /* contents of the DVC register */
 };
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index b46f2e09bd81..29df48f2b61a 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -447,7 +447,7 @@ void default_machine_crash_shutdown(struct pt_regs *regs)
         crash_kexec_prepare_cpus(crashing_cpu);
         cpu_set(crashing_cpu, cpus_in_crash);
         crash_kexec_stop_spus();
-#ifdef CONFIG_PPC_STD_MMU_64
+#if defined(CONFIG_PPC_STD_MMU_64) && defined(CONFIG_SMP)
         crash_kexec_wait_realmode(crashing_cpu);
 #endif
         if (ppc_md.kexec_cpu_down)
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 30817d9b20cb..77be3d058a65 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -295,7 +295,10 @@ void fixup_irqs(const struct cpumask *map)
 
         for_each_irq(irq) {
                 desc = irq_to_desc(irq);
-                if (desc && desc->status & IRQ_PER_CPU)
+                if (!desc)
+                        continue;
+
+                if (desc->status & IRQ_PER_CPU)
                         continue;
 
                 cpumask_and(mask, desc->affinity, map);
@@ -317,7 +320,6 @@ void fixup_irqs(const struct cpumask *map)
 }
 #endif
 
-#ifdef CONFIG_IRQSTACKS
 static inline void handle_one_irq(unsigned int irq)
 {
         struct thread_info *curtp, *irqtp;
@@ -358,12 +360,6 @@ static inline void handle_one_irq(unsigned int irq)
         if (irqtp->flags)
                 set_bits(irqtp->flags, &curtp->flags);
 }
-#else
-static inline void handle_one_irq(unsigned int irq)
-{
-        generic_handle_irq(irq);
-}
-#endif
 
 static inline void check_stack_overflow(void)
 {
@@ -455,7 +451,6 @@ void exc_lvl_ctx_init(void)
 }
 #endif
 
-#ifdef CONFIG_IRQSTACKS
 struct thread_info *softirq_ctx[NR_CPUS] __read_mostly;
 struct thread_info *hardirq_ctx[NR_CPUS] __read_mostly;
 
@@ -492,10 +487,6 @@ static inline void do_softirq_onstack(void)
         irqtp->task = NULL;
 }
 
-#else
-#define do_softirq_onstack()    __do_softirq()
-#endif /* CONFIG_IRQSTACKS */
-
 void do_softirq(void)
 {
         unsigned long flags;
diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
index 26f9900f773c..ed31a29c4ff7 100644
--- a/arch/powerpc/kernel/machine_kexec_64.c
+++ b/arch/powerpc/kernel/machine_kexec_64.c
@@ -182,28 +182,12 @@ static void kexec_prepare_cpus_wait(int wait_state)
 
         my_cpu = get_cpu();
         /* Make sure each CPU has atleast made it to the state we need */
-        for (i=0; i < NR_CPUS; i++) {
+        for_each_online_cpu(i) {
                 if (i == my_cpu)
                         continue;
 
                 while (paca[i].kexec_state < wait_state) {
                         barrier();
-                        if (!cpu_possible(i)) {
-                                printk("kexec: cpu %d hw_cpu_id %d is not"
-                                                " possible, ignoring\n",
-                                                i, paca[i].hw_cpu_id);
-                                break;
-                        }
-                        if (!cpu_online(i)) {
-                                /* Fixme: this can be spinning in
-                                 * pSeries_secondary_wait with a paca
-                                 * waiting for it to go online.
-                                 */
-                                printk("kexec: cpu %d hw_cpu_id %d is not"
-                                                " online, ignoring\n",
-                                                i, paca[i].hw_cpu_id);
-                                break;
-                        }
                         if (i != notified) {
                                 printk( "kexec: waiting for cpu %d (physical"
                                                 " %d) to enter %i state\n",
diff --git a/arch/powerpc/kernel/misc_32.S b/arch/powerpc/kernel/misc_32.S
index dc66d52dcff5..6bbd7a604d24 100644
--- a/arch/powerpc/kernel/misc_32.S
+++ b/arch/powerpc/kernel/misc_32.S
@@ -33,7 +33,6 @@
 
         .text
 
-#ifdef CONFIG_IRQSTACKS
 _GLOBAL(call_do_softirq)
         mflr    r0
         stw     r0,4(r1)
@@ -56,7 +55,6 @@ _GLOBAL(call_handle_irq)
         lwz     r0,4(r1)
         mtlr    r0
         blr
-#endif /* CONFIG_IRQSTACKS */
 
 /*
  * This returns the high 64 bits of the product of two 64-bit numbers.
diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index a2b18dffa03e..e5144906a56d 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -28,7 +28,6 @@
 
         .text
 
-#ifdef CONFIG_IRQSTACKS
 _GLOBAL(call_do_softirq)
         mflr    r0
         std     r0,16(r1)
@@ -52,7 +51,6 @@ _GLOBAL(call_handle_irq)
         ld      r0,16(r1)
         mtlr    r0
         blr
-#endif /* CONFIG_IRQSTACKS */
 
         .section        ".toc","aw"
 PPC64_CACHES:
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index 6646005dffb1..5b38f6ae2b29 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -1309,6 +1309,7 @@ void pcibios_allocate_bus_resources(struct pci_bus *bus)
                 printk(KERN_WARNING "PCI: Cannot allocate resource region "
                        "%d of PCI bridge %d, will remap\n", i, bus->number);
 clear_resource:
+                res->start = res->end = 0;
                 res->flags = 0;
         }
 
diff --git a/arch/powerpc/kernel/perf_event.c b/arch/powerpc/kernel/perf_event.c
index 43b83c35cf54..5c14ffe51258 100644
--- a/arch/powerpc/kernel/perf_event.c
+++ b/arch/powerpc/kernel/perf_event.c
@@ -791,8 +791,11 @@ static void power_pmu_disable(struct perf_event *event)
         cpuhw = &__get_cpu_var(cpu_hw_events);
         for (i = 0; i < cpuhw->n_events; ++i) {
                 if (event == cpuhw->event[i]) {
-                        while (++i < cpuhw->n_events)
+                        while (++i < cpuhw->n_events) {
                                 cpuhw->event[i-1] = cpuhw->event[i];
+                                cpuhw->events[i-1] = cpuhw->events[i];
+                                cpuhw->flags[i-1] = cpuhw->flags[i];
+                        }
                         --cpuhw->n_events;
                         ppmu->disable_pmc(event->hw.idx - 1, cpuhw->mmcr);
                         if (event->hw.idx) {
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 9d255b4f0a0e..773424df828a 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1005,7 +1005,6 @@ out:
         return error;
 }
 
-#ifdef CONFIG_IRQSTACKS
 static inline int valid_irq_stack(unsigned long sp, struct task_struct *p,
                                   unsigned long nbytes)
 {
@@ -1030,10 +1029,6 @@ static inline int valid_irq_stack(unsigned long sp, struct task_struct *p,
         return 0;
 }
 
-#else
-#define valid_irq_stack(sp, p, nb)      0
-#endif /* CONFIG_IRQSTACKS */
-
 int validate_sp(unsigned long sp, struct task_struct *p,
                        unsigned long nbytes)
 {
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 97d4bd9442d3..3b6f8ae9b8cc 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -872,7 +872,7 @@ static void __init prom_send_capabilities(void)
                                     "ibm_architecture_vec structure inconsistent: 0x%x !\n",
                                     *cores);
                 } else {
-                        *cores = NR_CPUS / prom_count_smt_threads();
+                        *cores = DIV_ROUND_UP(NR_CPUS, prom_count_smt_threads());
                         prom_printf("Max number of cores passed to firmware: 0x%x\n",
                                     (unsigned long)*cores);
                 }
diff --git a/arch/powerpc/kernel/prom_init_check.sh b/arch/powerpc/kernel/prom_init_check.sh
index 1ac136b128f0..9f82f4937892 100644
--- a/arch/powerpc/kernel/prom_init_check.sh
+++ b/arch/powerpc/kernel/prom_init_check.sh
@@ -52,12 +52,18 @@ do
         if [ "${UNDEF:0:9}" = "_restgpr_" ]; then
                 OK=1
         fi
+        if [ "${UNDEF:0:10}" = "_restgpr0_" ]; then
+                OK=1
+        fi
         if [ "${UNDEF:0:11}" = "_rest32gpr_" ]; then
                 OK=1
         fi
         if [ "${UNDEF:0:9}" = "_savegpr_" ]; then
                 OK=1
         fi
+        if [ "${UNDEF:0:10}" = "_savegpr0_" ]; then
+                OK=1
+        fi
         if [ "${UNDEF:0:11}" = "_save32gpr_" ]; then
                 OK=1
         fi
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index bfc2abafac44..67a84d8f118d 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -94,12 +94,8 @@ struct flash_block_list {
         struct flash_block_list *next;
         struct flash_block blocks[FLASH_BLOCKS_PER_NODE];
 };
-struct flash_block_list_header { /* just the header of flash_block_list */
-        unsigned long num_blocks;
-        struct flash_block_list *next;
-};
 
-static struct flash_block_list_header rtas_firmware_flash_list = {0, NULL};
+static struct flash_block_list *rtas_firmware_flash_list;
 
 /* Use slab cache to guarantee 4k alignment */
 static struct kmem_cache *flash_block_cache = NULL;
@@ -108,13 +104,14 @@ static struct kmem_cache *flash_block_cache = NULL;
 
 /* Local copy of the flash block list.
  * We only allow one open of the flash proc file and create this
- * list as we go.  This list will be put in the
- * rtas_firmware_flash_list var once it is fully read.
+ * list as we go.  The rtas_firmware_flash_list varable will be
+ * set once the data is fully read.
  *
  * For convenience as we build the list we use virtual addrs,
  * we do not fill in the version number, and the length field
  * is treated as the number of entries currently in the block
- * (i.e. not a byte count).  This is all fixed on release.
+ * (i.e. not a byte count).  This is all fixed when calling 
+ * the flash routine.
  */
 
 /* Status int must be first member of struct */
@@ -201,16 +198,16 @@ static int rtas_flash_release(struct inode *inode, struct file *file)
         if (uf->flist) {    
                 /* File was opened in write mode for a new flash attempt */
                 /* Clear saved list */
-                if (rtas_firmware_flash_list.next) {
-                        free_flash_list(rtas_firmware_flash_list.next);
-                        rtas_firmware_flash_list.next = NULL;
+                if (rtas_firmware_flash_list) {
+                        free_flash_list(rtas_firmware_flash_list);
+                        rtas_firmware_flash_list = NULL;
                 }
 
                 if (uf->status != FLASH_AUTH)  
                         uf->status = flash_list_valid(uf->flist);
 
                 if (uf->status == FLASH_IMG_READY) 
-                        rtas_firmware_flash_list.next = uf->flist;
+                        rtas_firmware_flash_list = uf->flist;
                 else
                         free_flash_list(uf->flist);
 
@@ -593,7 +590,7 @@ static void rtas_flash_firmware(int reboot_type)
         unsigned long rtas_block_list;
         int i, status, update_token;
 
-        if (rtas_firmware_flash_list.next == NULL)
+        if (rtas_firmware_flash_list == NULL)
                 return;         /* nothing to do */
 
         if (reboot_type != SYS_RESTART) {
@@ -610,20 +607,25 @@ static void rtas_flash_firmware(int reboot_type)
                 return;
         }
 
-        /* NOTE: the "first" block list is a global var with no data
-         * blocks in the kernel data segment.  We do this because
-         * we want to ensure this block_list addr is under 4GB.
+        /*
+         * NOTE: the "first" block must be under 4GB, so we create
+         * an entry with no data blocks in the reserved buffer in
+         * the kernel data segment.
          */
-        rtas_firmware_flash_list.num_blocks = 0;
-        flist = (struct flash_block_list *)&rtas_firmware_flash_list;
+        spin_lock(&rtas_data_buf_lock);
+        flist = (struct flash_block_list *)&rtas_data_buf[0];
+        flist->num_blocks = 0;
+        flist->next = rtas_firmware_flash_list;
         rtas_block_list = virt_to_abs(flist);
         if (rtas_block_list >= 4UL*1024*1024*1024) {
                 printk(KERN_ALERT "FLASH: kernel bug...flash list header addr above 4GB\n");
+                spin_unlock(&rtas_data_buf_lock);
                 return;
         }
 
         printk(KERN_ALERT "FLASH: preparing saved firmware image for flash\n");
         /* Update the block_list in place. */
+        rtas_firmware_flash_list = NULL; /* too hard to backout on error */
         image_size = 0;
         for (f = flist; f; f = next) {
                 /* Translate data addrs to absolute */
@@ -664,6 +666,7 @@ static void rtas_flash_firmware(int reboot_type)
                 printk(KERN_ALERT "FLASH: unknown flash return code %d\n", status);
                 break;
         }
+        spin_unlock(&rtas_data_buf_lock);
 }
 
 static void remove_flash_pde(struct proc_dir_entry *dp)
diff --git a/arch/powerpc/kernel/setup_32.c b/arch/powerpc/kernel/setup_32.c
index 8f58986c2ad9..7d84b210f168 100644
--- a/arch/powerpc/kernel/setup_32.c
+++ b/arch/powerpc/kernel/setup_32.c
@@ -241,7 +241,6 @@ int __init ppc_init(void)
 
 arch_initcall(ppc_init);
 
-#ifdef CONFIG_IRQSTACKS
 static void __init irqstack_early_init(void)
 {
         unsigned int i;
@@ -255,9 +254,6 @@ static void __init irqstack_early_init(void)
                         __va(lmb_alloc(THREAD_SIZE, THREAD_SIZE));
         }
 }
-#else
-#define irqstack_early_init()
-#endif
 
 #if defined(CONFIG_BOOKE) || defined(CONFIG_40x)
 static void __init exc_lvl_early_init(void)
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index f3fb5a79de52..643dcac40fcb 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -432,7 +432,6 @@ static u64 slb0_limit(void)
         return 1UL << SID_SHIFT;
 }
 
-#ifdef CONFIG_IRQSTACKS
 static void __init irqstack_early_init(void)
 {
         u64 limit = slb0_limit();
@@ -451,9 +450,6 @@ static void __init irqstack_early_init(void)
                                             THREAD_SIZE, limit));
         }
 }
-#else
-#define irqstack_early_init()
-#endif
 
 #ifdef CONFIG_PPC_BOOK3E
 static void __init exc_lvl_early_init(void)
diff --git a/arch/powerpc/kvm/e500.c b/arch/powerpc/kvm/e500.c
index bc2b4004eb26..e8a00b0c4449 100644
--- a/arch/powerpc/kvm/e500.c
+++ b/arch/powerpc/kvm/e500.c
@@ -164,7 +164,7 @@ static int __init kvmppc_e500_init(void)
         return kvm_init(NULL, sizeof(struct kvmppc_vcpu_e500), 0, THIS_MODULE);
 }
 
-static void __init kvmppc_e500_exit(void)
+static void __exit kvmppc_e500_exit(void)
 {
         kvmppc_booke_exit();
 }
diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
index 3040dac18a37..111da1c03a11 100644
--- a/arch/powerpc/lib/Makefile
+++ b/arch/powerpc/lib/Makefile
@@ -12,8 +12,8 @@ CFLAGS_REMOVE_code-patching.o = -pg
 CFLAGS_REMOVE_feature-fixups.o = -pg
 
 obj-y                   := string.o alloc.o \
-                           checksum_$(CONFIG_WORD_SIZE).o
-obj-$(CONFIG_PPC32)     += div64.o copy_32.o crtsavres.o
+                           checksum_$(CONFIG_WORD_SIZE).o crtsavres.o
+obj-$(CONFIG_PPC32)     += div64.o copy_32.o
 obj-$(CONFIG_HAS_IOMEM) += devres.o
 
 obj-$(CONFIG_PPC64)     += copypage_64.o copyuser_64.o \
diff --git a/arch/powerpc/lib/crtsavres.S b/arch/powerpc/lib/crtsavres.S
index 70a9cd8a3008..1c893f05d224 100644
--- a/arch/powerpc/lib/crtsavres.S
+++ b/arch/powerpc/lib/crtsavres.S
@@ -6,6 +6,7 @@
  *   Written By Michael Meissner
  *
  * Based on gcc/config/rs6000/crtsavres.asm from gcc
+ * 64 bit additions from reading the PPC elf64abi document.
  *
  * This file is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -44,6 +45,8 @@
 
 #ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
 
+#ifndef CONFIG_PPC64
+
 /* Routines for saving integer registers, called by the compiler.  */
 /* Called with r11 pointing to the stack header word of the caller of the */
 /* function, just beyond the end of the integer save area.  */
@@ -226,4 +229,130 @@ _GLOBAL(_rest32gpr_31_x)
         mtlr    0
         mr      1,11
         blr
+
+#else /* CONFIG_PPC64 */
+
+.globl  _savegpr0_14
+_savegpr0_14:
+        std     r14,-144(r1)
+.globl  _savegpr0_15
+_savegpr0_15:
+        std     r15,-136(r1)
+.globl  _savegpr0_16
+_savegpr0_16:
+        std     r16,-128(r1)
+.globl  _savegpr0_17
+_savegpr0_17:
+        std     r17,-120(r1)
+.globl  _savegpr0_18
+_savegpr0_18:
+        std     r18,-112(r1)
+.globl  _savegpr0_19
+_savegpr0_19:
+        std     r19,-104(r1)
+.globl  _savegpr0_20
+_savegpr0_20:
+        std     r20,-96(r1)
+.globl  _savegpr0_21
+_savegpr0_21:
+        std     r21,-88(r1)
+.globl  _savegpr0_22
+_savegpr0_22:
+        std     r22,-80(r1)
+.globl  _savegpr0_23
+_savegpr0_23:
+        std     r23,-72(r1)
+.globl  _savegpr0_24
+_savegpr0_24:
+        std     r24,-64(r1)
+.globl  _savegpr0_25
+_savegpr0_25:
+        std     r25,-56(r1)
+.globl  _savegpr0_26
+_savegpr0_26:
+        std     r26,-48(r1)
+.globl  _savegpr0_27
+_savegpr0_27:
+        std     r27,-40(r1)
+.globl  _savegpr0_28
+_savegpr0_28:
+        std     r28,-32(r1)
+.globl  _savegpr0_29
+_savegpr0_29:
+        std     r29,-24(r1)
+.globl  _savegpr0_30
+_savegpr0_30:
+        std     r30,-16(r1)
+.globl  _savegpr0_31
+_savegpr0_31:
+        std     r31,-8(r1)
+        std     r0,16(r1)
+        blr
+
+.globl  _restgpr0_14
+_restgpr0_14:
+        ld      r14,-144(r1)
+.globl  _restgpr0_15
+_restgpr0_15:
+        ld      r15,-136(r1)
+.globl  _restgpr0_16
+_restgpr0_16:
+        ld      r16,-128(r1)
+.globl  _restgpr0_17
+_restgpr0_17:
+        ld      r17,-120(r1)
+.globl  _restgpr0_18
+_restgpr0_18:
+        ld      r18,-112(r1)
+.globl  _restgpr0_19
+_restgpr0_19:
+        ld      r19,-104(r1)
+.globl  _restgpr0_20
+_restgpr0_20:
+        ld      r20,-96(r1)
+.globl  _restgpr0_21
+_restgpr0_21:
+        ld      r21,-88(r1)
+.globl  _restgpr0_22
+_restgpr0_22:
+        ld      r22,-80(r1)
+.globl  _restgpr0_23
+_restgpr0_23:
+        ld      r23,-72(r1)
+.globl  _restgpr0_24
+_restgpr0_24:
+        ld      r24,-64(r1)
+.globl  _restgpr0_25
+_restgpr0_25:
+        ld      r25,-56(r1)
+.globl  _restgpr0_26
+_restgpr0_26:
+        ld      r26,-48(r1)
+.globl  _restgpr0_27
+_restgpr0_27:
+        ld      r27,-40(r1)
+.globl  _restgpr0_28
+_restgpr0_28:
+        ld      r28,-32(r1)
+.globl  _restgpr0_29
+_restgpr0_29:
+        ld      r0,16(r1)
+        ld      r29,-24(r1)
+        mtlr    r0
+        ld      r30,-16(r1)
+        ld      r31,-8(r1)
+        blr
+
+.globl  _restgpr0_30
+_restgpr0_30:
+        ld      r30,-16(r1)
+.globl  _restgpr0_31
+_restgpr0_31:
+        ld      r0,16(r1)
+        ld      r31,-8(r1)
+        mtlr    r0
+        blr
+
+#endif /* CONFIG_PPC64 */
+
 #endif
diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c
index e640175b65ae..0d08d0171392 100644
--- a/arch/powerpc/lib/feature-fixups.c
+++ b/arch/powerpc/lib/feature-fixups.c
@@ -12,6 +12,7 @@
  *  2 of the License, or (at your option) any later version.
  */
 
+#include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/init.h>
@@ -288,8 +289,8 @@ static void test_alternative_case_with_external_branch(void)
 
 static void test_cpu_macros(void)
 {
-        extern void ftr_fixup_test_FTR_macros;
-        extern void ftr_fixup_test_FTR_macros_expected;
+        extern u8 ftr_fixup_test_FTR_macros;
+        extern u8 ftr_fixup_test_FTR_macros_expected;
         unsigned long size = &ftr_fixup_test_FTR_macros_expected -
                              &ftr_fixup_test_FTR_macros;
 
@@ -301,8 +302,8 @@ static void test_cpu_macros(void)
 static void test_fw_macros(void)
 {
 #ifdef CONFIG_PPC64
-        extern void ftr_fixup_test_FW_FTR_macros;
-        extern void ftr_fixup_test_FW_FTR_macros_expected;
+        extern u8 ftr_fixup_test_FW_FTR_macros;
+        extern u8 ftr_fixup_test_FW_FTR_macros_expected;
         unsigned long size = &ftr_fixup_test_FW_FTR_macros_expected -
                              &ftr_fixup_test_FW_FTR_macros;
 
@@ -314,10 +315,10 @@ static void test_fw_macros(void)
 
 static void test_lwsync_macros(void)
 {
-        extern void lwsync_fixup_test;
-        extern void end_lwsync_fixup_test;
-        extern void lwsync_fixup_test_expected_LWSYNC;
-        extern void lwsync_fixup_test_expected_SYNC;
+        extern u8 lwsync_fixup_test;
+        extern u8 end_lwsync_fixup_test;
+        extern u8 lwsync_fixup_test_expected_LWSYNC;
+        extern u8 lwsync_fixup_test_expected_SYNC;
         unsigned long size = &end_lwsync_fixup_test -
                              &lwsync_fixup_test;
 
diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c
index 9fc02dc72ce9..34347b2e7e31 100644
--- a/arch/powerpc/mm/pgtable_32.c
+++ b/arch/powerpc/mm/pgtable_32.c
@@ -115,11 +115,7 @@ pgtable_t pte_alloc_one(struct mm_struct *mm, unsigned long address)
 {
         struct page *ptepage;
 
-#ifdef CONFIG_HIGHPTE
-        gfp_t flags = GFP_KERNEL | __GFP_HIGHMEM | __GFP_REPEAT | __GFP_ZERO;
-#else
         gfp_t flags = GFP_KERNEL | __GFP_REPEAT | __GFP_ZERO;
-#endif
 
         ptepage = alloc_pages(flags, 0);
         if (!ptepage)
diff --git a/arch/powerpc/oprofile/op_model_cell.c b/arch/powerpc/oprofile/op_model_cell.c
index 2c9e52267292..7fd90d02d8c6 100644
--- a/arch/powerpc/oprofile/op_model_cell.c
+++ b/arch/powerpc/oprofile/op_model_cell.c
@@ -1077,7 +1077,7 @@ static int calculate_lfsr(int n)
                 index = ENTRIES-1;
 
         /* make sure index is valid */
-        if ((index > ENTRIES) || (index < 0))
+        if ((index >= ENTRIES) || (index < 0))
                 index = ENTRIES-1;
 
         return initial_lfsr[index];
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_pm.c b/arch/powerpc/platforms/52xx/mpc52xx_pm.c
index a55b0b6813ed..76722532bd95 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_pm.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_pm.c
@@ -64,10 +64,19 @@ int mpc52xx_pm_prepare(void)
                 { .type = "builtin", .compatible = "mpc5200", }, /* efika */
                 {}
         };
+        struct resource res;
 
         /* map the whole register space */
         np = of_find_matching_node(NULL, immr_ids);
-        mbar = of_iomap(np, 0);
+
+        if (of_address_to_resource(np, 0, &res)) {
+                pr_err("mpc52xx_pm_prepare(): could not get IMMR address\n");
+                of_node_put(np);
+                return -ENOSYS;
+        }
+
+        mbar = ioremap(res.start, 0xc000); /* we should map whole region including SRAM */
+
         of_node_put(np);
         if (!mbar) {
                 pr_err("mpc52xx_pm_prepare(): could not map registers\n");
diff --git a/arch/powerpc/platforms/iseries/pci.c b/arch/powerpc/platforms/iseries/pci.c
index 3fc2e6494b8b..ab3962b0d246 100644
--- a/arch/powerpc/platforms/iseries/pci.c
+++ b/arch/powerpc/platforms/iseries/pci.c
@@ -445,7 +445,11 @@ void __init iSeries_pcibios_fixup_resources(struct pci_dev *pdev)
         }
 
         allocate_device_bars(pdev);
-        iseries_device_information(pdev, bus, *sub_bus);
+        if (likely(sub_bus))
+                iseries_device_information(pdev, bus, *sub_bus);
+        else
+                printk(KERN_ERR "PCI: Device node %s has missing or invalid "
+                                "linux,subbus property\n", node->full_name);
 }
 
 /*
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 2102487612a4..20b73c025a45 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -1666,7 +1666,7 @@ static int mpic_resume(struct sys_device *dev)
                                mpic->save_data[i].dest);
 
 #ifdef CONFIG_MPIC_U3_HT_IRQS
-        {
+        if (mpic->fixups) {
                 struct mpic_irq_fixup *fixup = &mpic->fixups[i];
 
                 if (fixup->base) {
diff --git a/arch/s390/appldata/appldata_os.c b/arch/s390/appldata/appldata_os.c
index 55c80ffd42b9..92f1cb745d69 100644
--- a/arch/s390/appldata/appldata_os.c
+++ b/arch/s390/appldata/appldata_os.c
@@ -181,7 +181,7 @@ static int __init appldata_os_init(void)
                 goto out;
         }
 
-        appldata_os_data = kzalloc(max_size, GFP_DMA);
+        appldata_os_data = kzalloc(max_size, GFP_KERNEL | GFP_DMA);
         if (appldata_os_data == NULL) {
                 rc = -ENOMEM;
                 goto out;
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index bcd6884985ad..253f158db668 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.34-rc3
-# Fri Apr  9 09:57:10 2010
+# Linux kernel version: 2.6.35-rc1
+# Fri Jun  4 11:32:40 2010
 #
 CONFIG_SCHED_MC=y
 CONFIG_MMU=y
@@ -35,11 +35,13 @@ CONFIG_CONSTRUCTORS=y
 CONFIG_EXPERIMENTAL=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
+CONFIG_CROSS_COMPILE=""
 CONFIG_LOCALVERSION=""
 CONFIG_LOCALVERSION_AUTO=y
 CONFIG_HAVE_KERNEL_GZIP=y
 CONFIG_HAVE_KERNEL_BZIP2=y
 CONFIG_HAVE_KERNEL_LZMA=y
+CONFIG_HAVE_KERNEL_LZO=y
 CONFIG_KERNEL_GZIP=y
 # CONFIG_KERNEL_BZIP2 is not set
 # CONFIG_KERNEL_LZMA is not set
@@ -77,6 +79,7 @@ CONFIG_CGROUP_NS=y
 # CONFIG_CGROUP_CPUACCT is not set
 # CONFIG_RESOURCE_COUNTERS is not set
 # CONFIG_CGROUP_SCHED is not set
+# CONFIG_BLK_CGROUP is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -157,7 +160,6 @@ CONFIG_STOP_MACHINE=y
 CONFIG_BLOCK=y
 CONFIG_BLK_DEV_BSG=y
 # CONFIG_BLK_DEV_INTEGRITY is not set
-# CONFIG_BLK_CGROUP is not set
 CONFIG_BLOCK_COMPAT=y
 
 #
@@ -166,7 +168,6 @@ CONFIG_BLOCK_COMPAT=y
 CONFIG_IOSCHED_NOOP=y
 CONFIG_IOSCHED_DEADLINE=y
 CONFIG_IOSCHED_CFQ=y
-# CONFIG_CFQ_GROUP_IOSCHED is not set
 CONFIG_DEFAULT_DEADLINE=y
 # CONFIG_DEFAULT_CFQ is not set
 # CONFIG_DEFAULT_NOOP is not set
@@ -247,7 +248,6 @@ CONFIG_64BIT=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=32
 CONFIG_HOTPLUG_CPU=y
-# CONFIG_SCHED_BOOK is not set
 CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_AUDIT_ARCH=y
@@ -320,7 +320,6 @@ CONFIG_COMPAT_BINFMT_ELF=y
 # CONFIG_HAVE_AOUT is not set
 CONFIG_BINFMT_MISC=m
 CONFIG_FORCE_MAX_ZONEORDER=9
-# CONFIG_PROCESS_DEBUG is not set
 CONFIG_PFAULT=y
 # CONFIG_SHARED_KERNEL is not set
 # CONFIG_CMM is not set
@@ -457,6 +456,7 @@ CONFIG_NF_CONNTRACK=m
 # CONFIG_IP6_NF_IPTABLES is not set
 # CONFIG_IP_DCCP is not set
 CONFIG_IP_SCTP=m
+# CONFIG_NET_SCTPPROBE is not set
 # CONFIG_SCTP_DBG_MSG is not set
 # CONFIG_SCTP_DBG_OBJCNT is not set
 # CONFIG_SCTP_HMAC_NONE is not set
@@ -465,6 +465,7 @@ CONFIG_SCTP_HMAC_MD5=y
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
+# CONFIG_L2TP is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
 # CONFIG_DECNET is not set
@@ -525,6 +526,7 @@ CONFIG_NET_ACT_NAT=m
 # CONFIG_NET_CLS_IND is not set
 CONFIG_NET_SCH_FIFO=y
 # CONFIG_DCB is not set
+CONFIG_RPS=y
 
 #
 # Network testing
@@ -546,6 +548,7 @@ CONFIG_CAN_VCAN=m
 # CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
+# CONFIG_CAIF is not set
 # CONFIG_PCMCIA is not set
 CONFIG_CCW=y
 
@@ -728,6 +731,7 @@ CONFIG_VIRTIO_NET=m
 # Character devices
 #
 CONFIG_DEVKMEM=y
+# CONFIG_N_GSM is not set
 CONFIG_UNIX98_PTYS=y
 # CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
@@ -775,6 +779,7 @@ CONFIG_S390_TAPE_34XX=m
 # CONFIG_MONREADER is not set
 CONFIG_MONWRITER=m
 CONFIG_S390_VMUR=m
+# CONFIG_RAMOOPS is not set
 
 #
 # PPS support
@@ -788,10 +793,6 @@ CONFIG_S390_VMUR=m
 # CONFIG_NEW_LEDS is not set
 CONFIG_ACCESSIBILITY=y
 # CONFIG_AUXDISPLAY is not set
-
-#
-# TI VLYNQ
-#
 # CONFIG_STAGING is not set
 
 #
@@ -976,6 +977,7 @@ CONFIG_DEBUG_MEMORY_INIT=y
 # CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
 CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
 # CONFIG_LKDTM is not set
+# CONFIG_CPU_NOTIFIER_ERROR_INJECT is not set
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_SYSCTL_SYSCALL_CHECK=y
@@ -1010,6 +1012,7 @@ CONFIG_BRANCH_PROFILE_NONE=y
 CONFIG_KPROBE_EVENT=y
 # CONFIG_RING_BUFFER_BENCHMARK is not set
 # CONFIG_DYNAMIC_DEBUG is not set
+# CONFIG_ATOMIC64_SELFTEST is not set
 CONFIG_SAMPLES=y
 # CONFIG_SAMPLE_TRACEPOINTS is not set
 # CONFIG_SAMPLE_TRACE_EVENTS is not set
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 639380a0c45c..22cfd634c355 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -55,8 +55,10 @@ void *module_alloc(unsigned long size)
 /* Free memory returned from module_alloc */
 void module_free(struct module *mod, void *module_region)
 {
-        vfree(mod->arch.syminfo);
-        mod->arch.syminfo = NULL;
+        if (mod) {
+                vfree(mod->arch.syminfo);
+                mod->arch.syminfo = NULL;
+        }
         vfree(module_region);
 }
 
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 8093e6f47f49..ae3705816878 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -761,7 +761,7 @@ static int __init kvm_s390_init(void)
          * to hold the maximum amount of facilites. On the other hand, we
          * only set facilities that are known to work in KVM.
          */
-        facilities = (unsigned long long *) get_zeroed_page(GFP_DMA);
+        facilities = (unsigned long long *) get_zeroed_page(GFP_KERNEL|GFP_DMA);
         if (!facilities) {
                 kvm_exit();
                 return -ENOMEM;
diff --git a/arch/s390/kvm/sigp.c b/arch/s390/kvm/sigp.c
index eff3c5989b46..702276f5e2fa 100644
--- a/arch/s390/kvm/sigp.c
+++ b/arch/s390/kvm/sigp.c
@@ -113,7 +113,7 @@ static int __inject_sigp_stop(struct kvm_s390_local_interrupt *li, int action)
 {
         struct kvm_s390_interrupt_info *inti;
 
-        inti = kzalloc(sizeof(*inti), GFP_KERNEL);
+        inti = kzalloc(sizeof(*inti), GFP_ATOMIC);
         if (!inti)
                 return -ENOMEM;
         inti->type = KVM_S390_SIGP_STOP;
diff --git a/arch/s390/mm/extmem.c b/arch/s390/mm/extmem.c
index 6409fd57eb04..3cc95dd0a3a6 100644
--- a/arch/s390/mm/extmem.c
+++ b/arch/s390/mm/extmem.c
@@ -105,7 +105,7 @@ static int
 dcss_set_subcodes(void)
 {
 #ifdef CONFIG_64BIT
-        char *name = kmalloc(8 * sizeof(char), GFP_DMA);
+        char *name = kmalloc(8 * sizeof(char), GFP_KERNEL | GFP_DMA);
         unsigned long rx, ry;
         int rc;
 
@@ -252,12 +252,13 @@ dcss_diag_translate_rc (int vm_rc) {
 static int
 query_segment_type (struct dcss_segment *seg)
 {
-        struct qin64  *qin = kmalloc (sizeof(struct qin64), GFP_DMA);
-        struct qout64 *qout = kmalloc (sizeof(struct qout64), GFP_DMA);
-
-        int diag_cc, rc, i;
         unsigned long dummy, vmrc;
+        int diag_cc, rc, i;
+        struct qout64 *qout;
+        struct qin64 *qin;
 
+        qin = kmalloc(sizeof(*qin), GFP_KERNEL | GFP_DMA);
+        qout = kmalloc(sizeof(*qout), GFP_KERNEL | GFP_DMA);
         if ((qin == NULL) || (qout == NULL)) {
                 rc = -ENOMEM;
                 goto out_free;
@@ -286,7 +287,7 @@ query_segment_type (struct dcss_segment *seg)
            copy data for the new format. */
         if (segext_scode == DCSS_SEGEXT) {
                 struct qout64_old *qout_old;
-                qout_old = kzalloc(sizeof(struct qout64_old), GFP_DMA);
+                qout_old = kzalloc(sizeof(*qout_old), GFP_KERNEL | GFP_DMA);
                 if (qout_old == NULL) {
                         rc = -ENOMEM;
                         goto out_free;
@@ -407,11 +408,11 @@ segment_overlaps_others (struct dcss_segment *seg)
 static int
 __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long *end)
 {
-        struct dcss_segment *seg = kmalloc(sizeof(struct dcss_segment),
-                        GFP_DMA);
-        int rc, diag_cc;
         unsigned long start_addr, end_addr, dummy;
+        struct dcss_segment *seg;
+        int rc, diag_cc;
 
+        seg = kmalloc(sizeof(*seg), GFP_KERNEL | GFP_DMA);
         if (seg == NULL) {
                 rc = -ENOMEM;
                 goto out;
diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
index be1d114d3a43..1d7b495a7db4 100644
--- a/arch/sh/boards/mach-ecovec24/setup.c
+++ b/arch/sh/boards/mach-ecovec24/setup.c
@@ -25,7 +25,6 @@
 #include <linux/spi/spi.h>
 #include <linux/spi/sh_msiof.h>
 #include <linux/spi/mmc_spi.h>
-#include <linux/mmc/host.h>
 #include <linux/input.h>
 #include <linux/input/sh_keysc.h>
 #include <video/sh_mobile_lcdc.h>
diff --git a/arch/sh/drivers/pci/pci.c b/arch/sh/drivers/pci/pci.c
index 953af139e230..1e9598d2bbf4 100644
--- a/arch/sh/drivers/pci/pci.c
+++ b/arch/sh/drivers/pci/pci.c
@@ -139,8 +139,6 @@ static void pcibios_fixup_device_resources(struct pci_dev *dev,
         for (i = 0; i < PCI_NUM_RESOURCES; i++) {
                 if (!dev->resource[i].start)
                         continue;
-                if (dev->resource[i].flags & IORESOURCE_PCI_FIXED)
-                        continue;
                 if (dev->resource[i].flags & IORESOURCE_IO)
                         offset = hose->io_offset;
                 else if (dev->resource[i].flags & IORESOURCE_MEM)
diff --git a/arch/sh/mm/pmb.c b/arch/sh/mm/pmb.c
index 18623ba751b3..6379091a1647 100644
--- a/arch/sh/mm/pmb.c
+++ b/arch/sh/mm/pmb.c
@@ -770,7 +770,7 @@ static void __init pmb_resize(void)
                 spin_unlock_irqrestore(&pmbe->lock, flags);
         }
 
-        read_lock(&pmb_rwlock);
+        read_unlock(&pmb_rwlock);
 }
 #endif
 
diff --git a/arch/um/include/asm/arch_hweight.h b/arch/um/include/asm/arch_hweight.h
new file mode 100644
index 000000000000..c656cf443f4a
--- /dev/null
+++ b/arch/um/include/asm/arch_hweight.h
@@ -0,0 +1,6 @@
+#ifndef _ASM_UM_HWEIGHT_H
+#define _ASM_UM_HWEIGHT_H
+
+#include <asm-generic/bitops/arch_hweight.h>
+
+#endif
diff --git a/arch/um/os-Linux/mem.c b/arch/um/os-Linux/mem.c
index 93a11d7edfa0..e696144d2be3 100644
--- a/arch/um/os-Linux/mem.c
+++ b/arch/um/os-Linux/mem.c
@@ -10,6 +10,7 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <string.h>
+#include <sys/stat.h>
 #include <sys/mman.h>
 #include <sys/param.h>
 #include "init.h"
diff --git a/arch/x86/boot/video-vga.c b/arch/x86/boot/video-vga.c
index ed7aeff786b2..45bc9402aa49 100644
--- a/arch/x86/boot/video-vga.c
+++ b/arch/x86/boot/video-vga.c
@@ -41,13 +41,12 @@ static __videocard video_vga;
 static u8 vga_set_basic_mode(void)
 {
         struct biosregs ireg, oreg;
-        u16 ax;
         u8 mode;
 
         initregs(&ireg);
 
         /* Query current mode */
-        ax = 0x0f00;
+        ireg.ax = 0x0f00;
         intcall(0x10, &ireg, &oreg);
         mode = oreg.al;
 
diff --git a/arch/x86/include/asm/io_apic.h b/arch/x86/include/asm/io_apic.h
index 63cb4096c3dc..9cb2edb87c2f 100644
--- a/arch/x86/include/asm/io_apic.h
+++ b/arch/x86/include/asm/io_apic.h
@@ -183,7 +183,7 @@ struct mp_ioapic_gsi{
         u32 gsi_end;
 };
 extern struct mp_ioapic_gsi  mp_gsi_routing[];
-extern u32 gsi_end;
+extern u32 gsi_top;
 int mp_find_ioapic(u32 gsi);
 int mp_find_ioapic_pin(int ioapic, u32 gsi);
 void __init mp_register_ioapic(int id, u32 address, u32 gsi_base);
@@ -197,7 +197,7 @@ static const int timer_through_8259 = 0;
 static inline void ioapic_init_mappings(void)   { }
 static inline void ioapic_insert_resources(void) { }
 static inline void probe_nr_irqs_gsi(void)      { }
-#define gsi_end (NR_IRQS_LEGACY - 1)
+#define gsi_top (NR_IRQS_LEGACY)
 static inline int mp_find_ioapic(u32 gsi) { return 0; }
 
 struct io_apic_irq_attr;
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index b49d8ca228f6..8c7ae4318629 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -110,6 +110,7 @@
 #define MSR_AMD64_PATCH_LOADER          0xc0010020
 #define MSR_AMD64_OSVW_ID_LENGTH        0xc0010140
 #define MSR_AMD64_OSVW_STATUS           0xc0010141
+#define MSR_AMD64_DC_CFG                0xc0011022
 #define MSR_AMD64_IBSFETCHCTL           0xc0011030
 #define MSR_AMD64_IBSFETCHLINAD         0xc0011031
 #define MSR_AMD64_IBSFETCHPHYSAD        0xc0011032
diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index 0797e748d280..cd28f9ad910d 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -77,6 +77,7 @@ do {							\
         if (0) {                                        \
                 pto_T__ pto_tmp__;                      \
                 pto_tmp__ = (val);                      \
+                (void)pto_tmp__;                        \
         }                                               \
         switch (sizeof(var)) {                          \
         case 1:                                         \
@@ -115,6 +116,7 @@ do {									\
         if (0) {                                                        \
                 pao_T__ pao_tmp__;                                      \
                 pao_tmp__ = (val);                                      \
+                (void)pao_tmp__;                                        \
         }                                                               \
         switch (sizeof(var)) {                                          \
         case 1:                                                         \
diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
index 5e67c1532314..ed5903be26fe 100644
--- a/arch/x86/include/asm/pgtable_32_types.h
+++ b/arch/x86/include/asm/pgtable_32_types.h
@@ -26,7 +26,7 @@
  */
 #define VMALLOC_OFFSET  (8 * 1024 * 1024)
 
-#ifndef __ASSEMBLER__
+#ifndef __ASSEMBLY__
 extern bool __vmalloc_start_set; /* set once high_memory is set */
 #endif
 
diff --git a/arch/x86/include/asm/suspend_32.h b/arch/x86/include/asm/suspend_32.h
index 48dcfa62ea07..fd921c3a6841 100644
--- a/arch/x86/include/asm/suspend_32.h
+++ b/arch/x86/include/asm/suspend_32.h
@@ -15,6 +15,8 @@ static inline int arch_prepare_suspend(void) { return 0; }
 struct saved_context {
         u16 es, fs, gs, ss;
         unsigned long cr0, cr2, cr3, cr4;
+        u64 misc_enable;
+        bool misc_enable_saved;
         struct desc_ptr gdt;
         struct desc_ptr idt;
         u16 ldt;
diff --git a/arch/x86/include/asm/suspend_64.h b/arch/x86/include/asm/suspend_64.h
index 06284f42b759..8d942afae681 100644
--- a/arch/x86/include/asm/suspend_64.h
+++ b/arch/x86/include/asm/suspend_64.h
@@ -27,6 +27,8 @@ struct saved_context {
         u16 ds, es, fs, gs, ss;
         unsigned long gs_base, gs_kernel_base, fs_base;
         unsigned long cr0, cr2, cr3, cr4, cr8;
+        u64 misc_enable;
+        bool misc_enable_saved;
         unsigned long efer;
         u16 gdt_pad;
         u16 gdt_limit;
diff --git a/arch/x86/include/asm/system.h b/arch/x86/include/asm/system.h
index b8fe48ee2ed9..e7f4d33c55ed 100644
--- a/arch/x86/include/asm/system.h
+++ b/arch/x86/include/asm/system.h
@@ -451,7 +451,7 @@ void stop_this_cpu(void *dummy);
  *
  * (Could use an alternative three way for this if there was one.)
  */
-static inline void rdtsc_barrier(void)
+static __always_inline void rdtsc_barrier(void)
 {
         alternative(ASM_NOP3, "mfence", X86_FEATURE_MFENCE_RDTSC);
         alternative(ASM_NOP3, "lfence", X86_FEATURE_LFENCE_RDTSC);
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 60cc4058ed5f..c05872aa3ce0 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -118,7 +118,7 @@ static unsigned int gsi_to_irq(unsigned int gsi)
         if (gsi >= NR_IRQS_LEGACY)
                 irq = gsi;
         else
-                irq = gsi_end + 1 + gsi;
+                irq = gsi_top + gsi;
 
         return irq;
 }
@@ -129,10 +129,10 @@ static u32 irq_to_gsi(int irq)
 
         if (irq < NR_IRQS_LEGACY)
                 gsi = isa_irq_to_gsi[irq];
-        else if (irq <= gsi_end)
+        else if (irq < gsi_top)
                 gsi = irq;
-        else if (irq <= (gsi_end + NR_IRQS_LEGACY))
-                gsi = irq - gsi_end;
+        else if (irq < (gsi_top + NR_IRQS_LEGACY))
+                gsi = irq - gsi_top;
         else
                 gsi = 0xffffffff;
 
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 33f3563a2a52..e41ed24ab26d 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -89,8 +89,8 @@ int nr_ioapics;
 /* IO APIC gsi routing info */
 struct mp_ioapic_gsi  mp_gsi_routing[MAX_IO_APICS];
 
-/* The last gsi number used */
-u32 gsi_end;
+/* The one past the highest gsi number used */
+u32 gsi_top;
 
 /* MP IRQ source entries */
 struct mpc_intsrc mp_irqs[MAX_IRQ_SOURCES];
@@ -1035,7 +1035,7 @@ static int pin_2_irq(int idx, int apic, int pin)
                 if (gsi >= NR_IRQS_LEGACY)
                         irq = gsi;
                 else
-                        irq = gsi_end + 1 + gsi;
+                        irq = gsi_top + gsi;
         }
 
 #ifdef CONFIG_X86_32
@@ -3853,7 +3853,7 @@ void __init probe_nr_irqs_gsi(void)
 {
         int nr;
 
-        nr = gsi_end + 1 + NR_IRQS_LEGACY;
+        nr = gsi_top + NR_IRQS_LEGACY;
         if (nr > nr_irqs_gsi)
                 nr_irqs_gsi = nr;
 
@@ -4294,8 +4294,8 @@ void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
          */
         nr_ioapic_registers[idx] = entries;
 
-        if (mp_gsi_routing[idx].gsi_end > gsi_end)
-                gsi_end = mp_gsi_routing[idx].gsi_end;
+        if (mp_gsi_routing[idx].gsi_end >= gsi_top)
+                gsi_top = mp_gsi_routing[idx].gsi_end + 1;
 
         printk(KERN_INFO "IOAPIC[%d]: apic_id %d, version %d, address 0x%x, "
                "GSI %d-%d\n", idx, mp_ioapics[idx].apicid,
diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
index 611df11ba15e..c2897b7b4a3b 100644
--- a/arch/x86/kernel/cpu/perf_event_amd.c
+++ b/arch/x86/kernel/cpu/perf_event_amd.c
@@ -102,8 +102,8 @@ static const u64 amd_perfmon_event_map[] =
   [PERF_COUNT_HW_INSTRUCTIONS]          = 0x00c0,
   [PERF_COUNT_HW_CACHE_REFERENCES]      = 0x0080,
   [PERF_COUNT_HW_CACHE_MISSES]          = 0x0081,
-  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]   = 0x00c4,
-  [PERF_COUNT_HW_BRANCH_MISSES]         = 0x00c5,
+  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]   = 0x00c2,
+  [PERF_COUNT_HW_BRANCH_MISSES]         = 0x00c3,
 };
 
 static u64 amd_pmu_event_map(int hw_event)
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index fdbc652d3feb..214ac860ebe0 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -72,6 +72,7 @@ static struct event_constraint intel_westmere_event_constraints[] =
         INTEL_EVENT_CONSTRAINT(0x51, 0x3), /* L1D */
         INTEL_EVENT_CONSTRAINT(0x60, 0x1), /* OFFCORE_REQUESTS_OUTSTANDING */
         INTEL_EVENT_CONSTRAINT(0x63, 0x3), /* CACHE_LOCK_CYCLES */
+        INTEL_EVENT_CONSTRAINT(0xb3, 0x1), /* SNOOPQ_REQUEST_OUTSTANDING */
         EVENT_CONSTRAINT_END
 };
 
diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
index 7bca3c6a02fb..0d6fc71bedb1 100644
--- a/arch/x86/kernel/e820.c
+++ b/arch/x86/kernel/e820.c
@@ -729,7 +729,7 @@ static int __init e820_mark_nvs_memory(void)
                 struct e820entry *ei = &e820.map[i];
 
                 if (ei->type == E820_NVS)
-                        hibernate_nvs_register(ei->addr, ei->size);
+                        suspend_nvs_register(ei->addr, ei->size);
         }
 
         return 0;
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index 5ae5d2426edf..d86dbf7e54be 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -123,7 +123,7 @@ static void __init MP_ioapic_info(struct mpc_ioapic *m)
         printk(KERN_INFO "I/O APIC #%d Version %d at 0x%X.\n",
                m->apicid, m->apicver, m->apicaddr);
 
-        mp_register_ioapic(m->apicid, m->apicaddr, gsi_end + 1);
+        mp_register_ioapic(m->apicid, m->apicaddr, gsi_top);
 }
 
 static void print_MP_intsrc_info(struct mpc_intsrc *m)
diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
index fb99f7edb341..078d4ec1a9d9 100644
--- a/arch/x86/kernel/pci-calgary_64.c
+++ b/arch/x86/kernel/pci-calgary_64.c
@@ -103,11 +103,16 @@ int use_calgary __read_mostly = 0;
 #define PMR_SOFTSTOPFAULT       0x40000000
 #define PMR_HARDSTOP            0x20000000
 
-#define MAX_NUM_OF_PHBS         8 /* how many PHBs in total? */
-#define MAX_NUM_CHASSIS         8 /* max number of chassis */
-/* MAX_PHB_BUS_NUM is the maximal possible dev->bus->number */
-#define MAX_PHB_BUS_NUM         (MAX_NUM_OF_PHBS * MAX_NUM_CHASSIS * 2)
-#define PHBS_PER_CALGARY        4
+/*
+ * The maximum PHB bus number.
+ * x3950M2 (rare): 8 chassis, 48 PHBs per chassis = 384
+ * x3950M2: 4 chassis, 48 PHBs per chassis        = 192
+ * x3950 (PCIE): 8 chassis, 32 PHBs per chassis   = 256
+ * x3950 (PCIX): 8 chassis, 16 PHBs per chassis   = 128
+ */
+#define MAX_PHB_BUS_NUM         256
+
+#define PHBS_PER_CALGARY          4
 
 /* register offsets in Calgary's internal register space */
 static const unsigned long tar_offsets[] = {
@@ -1051,8 +1056,6 @@ static int __init calgary_init_one(struct pci_dev *dev)
         struct iommu_table *tbl;
         int ret;
 
-        BUG_ON(dev->bus->number >= MAX_PHB_BUS_NUM);
-
         bbar = busno_to_bbar(dev->bus->number);
         ret = calgary_setup_tar(dev, bbar);
         if (ret)
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 8e1aac86b50c..e3af342fe83a 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -228,6 +228,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Precision WorkStation T5400"),
                 },
         },
+        {       /* Handle problems with rebooting on Dell T7400's */
+                .callback = set_bios_reboot,
+                .ident = "Dell Precision T7400",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Precision WorkStation T7400"),
+                },
+        },
         {       /* Handle problems with rebooting on HP laptops */
                 .callback = set_bios_reboot,
                 .ident = "HP Compaq Laptop",
diff --git a/arch/x86/kernel/sfi.c b/arch/x86/kernel/sfi.c
index 7ded57896c0a..cb22acf3ed09 100644
--- a/arch/x86/kernel/sfi.c
+++ b/arch/x86/kernel/sfi.c
@@ -93,7 +93,7 @@ static int __init sfi_parse_ioapic(struct sfi_table_header *table)
         pentry = (struct sfi_apic_table_entry *)sb->pentry;
 
         for (i = 0; i < num; i++) {
-                mp_register_ioapic(i, pentry->phys_addr, gsi_end + 1);
+                mp_register_ioapic(i, pentry->phys_addr, gsi_top);
                 pentry++;
         }
 
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 142d70c74b02..725ef4d17cd5 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -526,6 +526,7 @@ asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
 dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
 {
         struct task_struct *tsk = current;
+        int user_icebp = 0;
         unsigned long dr6;
         int si_code;
 
@@ -534,6 +535,14 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
         /* Filter out all the reserved bits which are preset to 1 */
         dr6 &= ~DR6_RESERVED;
 
+        /*
+         * If dr6 has no reason to give us about the origin of this trap,
+         * then it's very likely the result of an icebp/int01 trap.
+         * User wants a sigtrap for that.
+         */
+        if (!dr6 && user_mode(regs))
+                user_icebp = 1;
+
         /* Catch kmemcheck conditions first of all! */
         if ((dr6 & DR_STEP) && kmemcheck_trap(regs))
                 return;
@@ -575,7 +584,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
                 regs->flags &= ~X86_EFLAGS_TF;
         }
         si_code = get_si_code(tsk->thread.debugreg6);
-        if (tsk->thread.debugreg6 & (DR_STEP | DR_TRAP_BITS))
+        if (tsk->thread.debugreg6 & (DR_STEP | DR_TRAP_BITS) || user_icebp)
                 send_sigtrap(tsk, regs, error_code, si_code);
         preempt_conditional_cli(regs);
 
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 81563e76e28f..a6f695d76928 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -1815,6 +1815,9 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
 
                 spte |= PT_WRITABLE_MASK;
 
+                if (!tdp_enabled && !(pte_access & ACC_WRITE_MASK))
+                        spte &= ~PT_USER_MASK;
+
                 /*
                  * Optimization: for pte sync, if spte was writable the hash
                  * lookup is unnecessary (and expensive). Write protection
@@ -1870,6 +1873,8 @@ static void mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep,
 
                         child = page_header(pte & PT64_BASE_ADDR_MASK);
                         mmu_page_remove_parent_pte(child, sptep);
+                        __set_spte(sptep, shadow_trap_nonpresent_pte);
+                        kvm_flush_remote_tlbs(vcpu->kvm);
                 } else if (pfn != spte_to_pfn(*sptep)) {
                         pgprintk("hfn old %lx new %lx\n",
                                  spte_to_pfn(*sptep), pfn);
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 96dc232bfc56..ce438e0fdd26 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -28,6 +28,7 @@
 #include <linux/ftrace_event.h>
 #include <linux/slab.h>
 
+#include <asm/tlbflush.h>
 #include <asm/desc.h>
 
 #include <asm/virtext.h>
@@ -56,6 +57,8 @@ MODULE_LICENSE("GPL");
 
 #define DEBUGCTL_RESERVED_BITS (~(0x3fULL))
 
+static bool erratum_383_found __read_mostly;
+
 static const u32 host_save_user_msrs[] = {
 #ifdef CONFIG_X86_64
         MSR_STAR, MSR_LSTAR, MSR_CSTAR, MSR_SYSCALL_MASK, MSR_KERNEL_GS_BASE,
@@ -374,6 +377,31 @@ static void svm_queue_exception(struct kvm_vcpu *vcpu, unsigned nr,
         svm->vmcb->control.event_inj_err = error_code;
 }
 
+static void svm_init_erratum_383(void)
+{
+        u32 low, high;
+        int err;
+        u64 val;
+
+        /* Only Fam10h is affected */
+        if (boot_cpu_data.x86 != 0x10)
+                return;
+
+        /* Use _safe variants to not break nested virtualization */
+        val = native_read_msr_safe(MSR_AMD64_DC_CFG, &err);
+        if (err)
+                return;
+
+        val |= (1ULL << 47);
+
+        low  = lower_32_bits(val);
+        high = upper_32_bits(val);
+
+        native_write_msr_safe(MSR_AMD64_DC_CFG, low, high);
+
+        erratum_383_found = true;
+}
+
 static int has_svm(void)
 {
         const char *msg;
@@ -429,6 +457,8 @@ static int svm_hardware_enable(void *garbage)
 
         wrmsrl(MSR_VM_HSAVE_PA, page_to_pfn(sd->save_area) << PAGE_SHIFT);
 
+        svm_init_erratum_383();
+
         return 0;
 }
 
@@ -1410,8 +1440,59 @@ static int nm_interception(struct vcpu_svm *svm)
         return 1;
 }
 
-static int mc_interception(struct vcpu_svm *svm)
+static bool is_erratum_383(void)
 {
+        int err, i;
+        u64 value;
+
+        if (!erratum_383_found)
+                return false;
+
+        value = native_read_msr_safe(MSR_IA32_MC0_STATUS, &err);
+        if (err)
+                return false;
+
+        /* Bit 62 may or may not be set for this mce */
+        value &= ~(1ULL << 62);
+
+        if (value != 0xb600000000010015ULL)
+                return false;
+
+        /* Clear MCi_STATUS registers */
+        for (i = 0; i < 6; ++i)
+                native_write_msr_safe(MSR_IA32_MCx_STATUS(i), 0, 0);
+
+        value = native_read_msr_safe(MSR_IA32_MCG_STATUS, &err);
+        if (!err) {
+                u32 low, high;
+
+                value &= ~(1ULL << 2);
+                low    = lower_32_bits(value);
+                high   = upper_32_bits(value);
+
+                native_write_msr_safe(MSR_IA32_MCG_STATUS, low, high);
+        }
+
+        /* Flush tlb to evict multi-match entries */
+        __flush_tlb_all();
+
+        return true;
+}
+
+static void svm_handle_mce(struct vcpu_svm *svm)
+{
+        if (is_erratum_383()) {
+                /*
+                 * Erratum 383 triggered. Guest state is corrupt so kill the
+                 * guest.
+                 */
+                pr_err("KVM: Guest triggered AMD Erratum 383\n");
+
+                set_bit(KVM_REQ_TRIPLE_FAULT, &svm->vcpu.requests);
+
+                return;
+        }
+
         /*
          * On an #MC intercept the MCE handler is not called automatically in
          * the host. So do it by hand here.
@@ -1420,6 +1501,11 @@ static int mc_interception(struct vcpu_svm *svm)
                 "int $0x12\n");
         /* not sure if we ever come back to this point */
 
+        return;
+}
+
+static int mc_interception(struct vcpu_svm *svm)
+{
         return 1;
 }
 
@@ -3088,6 +3174,14 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
                 vcpu->arch.regs_avail &= ~(1 << VCPU_EXREG_PDPTR);
                 vcpu->arch.regs_dirty &= ~(1 << VCPU_EXREG_PDPTR);
         }
+
+        /*
+         * We need to handle MC intercepts here before the vcpu has a chance to
+         * change the physical cpu
+         */
+        if (unlikely(svm->vmcb->control.exit_code ==
+                     SVM_EXIT_EXCP_BASE + MC_VECTOR))
+                svm_handle_mce(svm);
 }
 
 #undef R
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index acc15b23b743..64121a18b8cb 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -302,7 +302,7 @@ int reserve_memtype(u64 start, u64 end, unsigned long req_type,
                 return -EINVAL;
         }
 
-        new  = kmalloc(sizeof(struct memtype), GFP_KERNEL);
+        new  = kzalloc(sizeof(struct memtype), GFP_KERNEL);
         if (!new)
                 return -ENOMEM;
 
diff --git a/arch/x86/mm/pat_rbtree.c b/arch/x86/mm/pat_rbtree.c
index f537087bb740..8acaddd0fb21 100644
--- a/arch/x86/mm/pat_rbtree.c
+++ b/arch/x86/mm/pat_rbtree.c
@@ -34,8 +34,7 @@
  * memtype_lock protects the rbtree.
  */
 
-static void memtype_rb_augment_cb(struct rb_node *node);
-static struct rb_root memtype_rbroot = RB_AUGMENT_ROOT(&memtype_rb_augment_cb);
+static struct rb_root memtype_rbroot = RB_ROOT;
 
 static int is_node_overlap(struct memtype *node, u64 start, u64 end)
 {
@@ -56,7 +55,7 @@ static u64 get_subtree_max_end(struct rb_node *node)
 }
 
 /* Update 'subtree_max_end' for a node, based on node and its children */
-static void update_node_max_end(struct rb_node *node)
+static void memtype_rb_augment_cb(struct rb_node *node, void *__unused)
 {
         struct memtype *data;
         u64 max_end, child_max_end;
@@ -78,25 +77,6 @@ static void update_node_max_end(struct rb_node *node)
         data->subtree_max_end = max_end;
 }
 
-/* Update 'subtree_max_end' for a node and all its ancestors */
-static void update_path_max_end(struct rb_node *node)
-{
-        u64 old_max_end, new_max_end;
-
-        while (node) {
-                struct memtype *data = container_of(node, struct memtype, rb);
-
-                old_max_end = data->subtree_max_end;
-                update_node_max_end(node);
-                new_max_end = data->subtree_max_end;
-
-                if (new_max_end == old_max_end)
-                        break;
-
-                node = rb_parent(node);
-        }
-}
-
 /* Find the first (lowest start addr) overlapping range from rb tree */
 static struct memtype *memtype_rb_lowest_match(struct rb_root *root,
                                 u64 start, u64 end)
@@ -190,12 +170,6 @@ failure:
         return -EBUSY;
 }
 
-static void memtype_rb_augment_cb(struct rb_node *node)
-{
-        if (node)
-                update_path_max_end(node);
-}
-
 static void memtype_rb_insert(struct rb_root *root, struct memtype *newdata)
 {
         struct rb_node **node = &(root->rb_node);
@@ -213,6 +187,7 @@ static void memtype_rb_insert(struct rb_root *root, struct memtype *newdata)
 
         rb_link_node(&newdata->rb, parent, node);
         rb_insert_color(&newdata->rb, root);
+        rb_augment_insert(&newdata->rb, memtype_rb_augment_cb, NULL);
 }
 
 int rbt_memtype_check_insert(struct memtype *new, unsigned long *ret_type)
@@ -226,6 +201,7 @@ int rbt_memtype_check_insert(struct memtype *new, unsigned long *ret_type)
                 if (ret_type)
                         new->type = *ret_type;
 
+                new->subtree_max_end = new->end;
                 memtype_rb_insert(&memtype_rbroot, new);
         }
         return err;
@@ -233,13 +209,16 @@ int rbt_memtype_check_insert(struct memtype *new, unsigned long *ret_type)
 
 struct memtype *rbt_memtype_erase(u64 start, u64 end)
 {
+        struct rb_node *deepest;
         struct memtype *data;
 
         data = memtype_rb_exact_match(&memtype_rbroot, start, end);
         if (!data)
                 goto out;
 
+        deepest = rb_augment_erase_begin(&data->rb);
         rb_erase(&data->rb, &memtype_rbroot);
+        rb_augment_erase_end(deepest, memtype_rb_augment_cb, NULL);
 out:
         return data;
 }
diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
index 97da2ba9344b..6fdb3ec30c31 100644
--- a/arch/x86/pci/i386.c
+++ b/arch/x86/pci/i386.c
@@ -96,6 +96,7 @@ EXPORT_SYMBOL(pcibios_align_resource);
  *        the fact the PCI specs explicitly allow address decoders to be
  *        shared between expansion ROMs and other resource regions, it's
  *        at least dangerous)
+ *      - bad resource sizes or overlaps with other regions
  *
  *  Our solution:
  *      (1) Allocate resources for all buses behind PCI-to-PCI bridges.
@@ -136,6 +137,7 @@ static void __init pcibios_allocate_bus_resources(struct list_head *bus_list)
                                          * child resource allocations in this
                                          * range.
                                          */
+                                        r->start = r->end = 0;
                                         r->flags = 0;
                                 }
                         }
diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
index 0a979f3e5b8a..1290ba54b350 100644
--- a/arch/x86/power/cpu.c
+++ b/arch/x86/power/cpu.c
@@ -105,6 +105,8 @@ static void __save_processor_state(struct saved_context *ctxt)
         ctxt->cr4 = read_cr4();
         ctxt->cr8 = read_cr8();
 #endif
+        ctxt->misc_enable_saved = !rdmsrl_safe(MSR_IA32_MISC_ENABLE,
+                                               &ctxt->misc_enable);
 }
 
 /* Needed by apm.c */
@@ -152,6 +154,8 @@ static void fix_processor_context(void)
  */
 static void __restore_processor_state(struct saved_context *ctxt)
 {
+        if (ctxt->misc_enable_saved)
+                wrmsrl(MSR_IA32_MISC_ENABLE, ctxt->misc_enable);
         /*
          * control registers
          */
diff --git a/block/blk-core.c b/block/blk-core.c
index f84cce42fc58..f0640d7f800f 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1149,13 +1149,10 @@ void init_request_from_bio(struct request *req, struct bio *bio)
         else
                 req->cmd_flags |= bio->bi_rw & REQ_FAILFAST_MASK;
 
-        if (unlikely(bio_rw_flagged(bio, BIO_RW_DISCARD))) {
+        if (bio_rw_flagged(bio, BIO_RW_DISCARD))
                 req->cmd_flags |= REQ_DISCARD;
-                if (bio_rw_flagged(bio, BIO_RW_BARRIER))
-                        req->cmd_flags |= REQ_SOFTBARRIER;
-        } else if (unlikely(bio_rw_flagged(bio, BIO_RW_BARRIER)))
+        if (bio_rw_flagged(bio, BIO_RW_BARRIER))
                 req->cmd_flags |= REQ_HARDBARRIER;
-
         if (bio_rw_flagged(bio, BIO_RW_SYNCIO))
                 req->cmd_flags |= REQ_RW_SYNC;
         if (bio_rw_flagged(bio, BIO_RW_META))
@@ -1586,7 +1583,7 @@ void submit_bio(int rw, struct bio *bio)
          * If it's a regular read/write or a barrier with data attached,
          * go through the normal accounting stuff before submission.
          */
-        if (bio_has_data(bio)) {
+        if (bio_has_data(bio) && !(rw & (1 << BIO_RW_DISCARD))) {
                 if (rw & WRITE) {
                         count_vm_events(PGPGOUT, count);
                 } else {
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 5ff4f4850e71..7982b830db58 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -14,7 +14,7 @@
 #include <linux/rbtree.h>
 #include <linux/ioprio.h>
 #include <linux/blktrace_api.h>
-#include "blk-cgroup.h"
+#include "cfq.h"
 
 /*
  * tunables
@@ -879,7 +879,7 @@ cfq_group_service_tree_del(struct cfq_data *cfqd, struct cfq_group *cfqg)
         if (!RB_EMPTY_NODE(&cfqg->rb_node))
                 cfq_rb_erase(&cfqg->rb_node, st);
         cfqg->saved_workload_slice = 0;
-        blkiocg_update_dequeue_stats(&cfqg->blkg, 1);
+        cfq_blkiocg_update_dequeue_stats(&cfqg->blkg, 1);
 }
 
 static inline unsigned int cfq_cfqq_slice_usage(struct cfq_queue *cfqq)
@@ -939,8 +939,8 @@ static void cfq_group_served(struct cfq_data *cfqd, struct cfq_group *cfqg,
 
         cfq_log_cfqg(cfqd, cfqg, "served: vt=%llu min_vt=%llu", cfqg->vdisktime,
                                         st->min_vdisktime);
-        blkiocg_update_timeslice_used(&cfqg->blkg, used_sl);
-        blkiocg_set_start_empty_time(&cfqg->blkg);
+        cfq_blkiocg_update_timeslice_used(&cfqg->blkg, used_sl);
+        cfq_blkiocg_set_start_empty_time(&cfqg->blkg);
 }
 
 #ifdef CONFIG_CFQ_GROUP_IOSCHED
@@ -995,7 +995,7 @@ cfq_find_alloc_cfqg(struct cfq_data *cfqd, struct cgroup *cgroup, int create)
 
         /* Add group onto cgroup list */
         sscanf(dev_name(bdi->dev), "%u:%u", &major, &minor);
-        blkiocg_add_blkio_group(blkcg, &cfqg->blkg, (void *)cfqd,
+        cfq_blkiocg_add_blkio_group(blkcg, &cfqg->blkg, (void *)cfqd,
                                         MKDEV(major, minor));
         cfqg->weight = blkcg_get_weight(blkcg, cfqg->blkg.dev);
 
@@ -1079,7 +1079,7 @@ static void cfq_release_cfq_groups(struct cfq_data *cfqd)
                  * it from cgroup list, then it will take care of destroying
                  * cfqg also.
                  */
-                if (!blkiocg_del_blkio_group(&cfqg->blkg))
+                if (!cfq_blkiocg_del_blkio_group(&cfqg->blkg))
                         cfq_destroy_cfqg(cfqd, cfqg);
         }
 }
@@ -1421,10 +1421,10 @@ static void cfq_reposition_rq_rb(struct cfq_queue *cfqq, struct request *rq)
 {
         elv_rb_del(&cfqq->sort_list, rq);
         cfqq->queued[rq_is_sync(rq)]--;
-        blkiocg_update_io_remove_stats(&(RQ_CFQG(rq))->blkg, rq_data_dir(rq),
-                                                rq_is_sync(rq));
+        cfq_blkiocg_update_io_remove_stats(&(RQ_CFQG(rq))->blkg,
+                                        rq_data_dir(rq), rq_is_sync(rq));
         cfq_add_rq_rb(rq);
-        blkiocg_update_io_add_stats(&(RQ_CFQG(rq))->blkg,
+        cfq_blkiocg_update_io_add_stats(&(RQ_CFQG(rq))->blkg,
                         &cfqq->cfqd->serving_group->blkg, rq_data_dir(rq),
                         rq_is_sync(rq));
 }
@@ -1482,8 +1482,8 @@ static void cfq_remove_request(struct request *rq)
         cfq_del_rq_rb(rq);
 
         cfqq->cfqd->rq_queued--;
-        blkiocg_update_io_remove_stats(&(RQ_CFQG(rq))->blkg, rq_data_dir(rq),
-                                                rq_is_sync(rq));
+        cfq_blkiocg_update_io_remove_stats(&(RQ_CFQG(rq))->blkg,
+                                        rq_data_dir(rq), rq_is_sync(rq));
         if (rq_is_meta(rq)) {
                 WARN_ON(!cfqq->meta_pending);
                 cfqq->meta_pending--;
@@ -1518,8 +1518,8 @@ static void cfq_merged_request(struct request_queue *q, struct request *req,
 static void cfq_bio_merged(struct request_queue *q, struct request *req,
                                 struct bio *bio)
 {
-        blkiocg_update_io_merged_stats(&(RQ_CFQG(req))->blkg, bio_data_dir(bio),
-                                        cfq_bio_sync(bio));
+        cfq_blkiocg_update_io_merged_stats(&(RQ_CFQG(req))->blkg,
+                                        bio_data_dir(bio), cfq_bio_sync(bio));
 }
 
 static void
@@ -1539,8 +1539,8 @@ cfq_merged_requests(struct request_queue *q, struct request *rq,
         if (cfqq->next_rq == next)
                 cfqq->next_rq = rq;
         cfq_remove_request(next);
-        blkiocg_update_io_merged_stats(&(RQ_CFQG(rq))->blkg, rq_data_dir(next),
-                                        rq_is_sync(next));
+        cfq_blkiocg_update_io_merged_stats(&(RQ_CFQG(rq))->blkg,
+                                        rq_data_dir(next), rq_is_sync(next));
 }
 
 static int cfq_allow_merge(struct request_queue *q, struct request *rq,
@@ -1571,7 +1571,7 @@ static int cfq_allow_merge(struct request_queue *q, struct request *rq,
 static inline void cfq_del_timer(struct cfq_data *cfqd, struct cfq_queue *cfqq)
 {
         del_timer(&cfqd->idle_slice_timer);
-        blkiocg_update_idle_time_stats(&cfqq->cfqg->blkg);
+        cfq_blkiocg_update_idle_time_stats(&cfqq->cfqg->blkg);
 }
 
 static void __cfq_set_active_queue(struct cfq_data *cfqd,
@@ -1580,7 +1580,7 @@ static void __cfq_set_active_queue(struct cfq_data *cfqd,
         if (cfqq) {
                 cfq_log_cfqq(cfqd, cfqq, "set_active wl_prio:%d wl_type:%d",
                                 cfqd->serving_prio, cfqd->serving_type);
-                blkiocg_update_avg_queue_size_stats(&cfqq->cfqg->blkg);
+                cfq_blkiocg_update_avg_queue_size_stats(&cfqq->cfqg->blkg);
                 cfqq->slice_start = 0;
                 cfqq->dispatch_start = jiffies;
                 cfqq->allocated_slice = 0;
@@ -1911,7 +1911,7 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd)
         sl = cfqd->cfq_slice_idle;
 
         mod_timer(&cfqd->idle_slice_timer, jiffies + sl);
-        blkiocg_update_set_idle_time_stats(&cfqq->cfqg->blkg);
+        cfq_blkiocg_update_set_idle_time_stats(&cfqq->cfqg->blkg);
         cfq_log_cfqq(cfqd, cfqq, "arm_idle: %lu", sl);
 }
 
@@ -1931,7 +1931,7 @@ static void cfq_dispatch_insert(struct request_queue *q, struct request *rq)
         elv_dispatch_sort(q, rq);
 
         cfqd->rq_in_flight[cfq_cfqq_sync(cfqq)]++;
-        blkiocg_update_dispatch_stats(&cfqq->cfqg->blkg, blk_rq_bytes(rq),
+        cfq_blkiocg_update_dispatch_stats(&cfqq->cfqg->blkg, blk_rq_bytes(rq),
                                         rq_data_dir(rq), rq_is_sync(rq));
 }
 
@@ -1986,6 +1986,15 @@ static void cfq_setup_merge(struct cfq_queue *cfqq, struct cfq_queue *new_cfqq)
         int process_refs, new_process_refs;
         struct cfq_queue *__cfqq;
 
+        /*
+         * If there are no process references on the new_cfqq, then it is
+         * unsafe to follow the ->new_cfqq chain as other cfqq's in the
+         * chain may have dropped their last reference (not just their
+         * last process reference).
+         */
+        if (!cfqq_process_refs(new_cfqq))
+                return;
+
         /* Avoid a circular list and skip interim queue merges */
         while ((__cfqq = new_cfqq->new_cfqq)) {
                 if (__cfqq == cfqq)
@@ -1994,17 +2003,17 @@ static void cfq_setup_merge(struct cfq_queue *cfqq, struct cfq_queue *new_cfqq)
         }
 
         process_refs = cfqq_process_refs(cfqq);
+        new_process_refs = cfqq_process_refs(new_cfqq);
         /*
          * If the process for the cfqq has gone away, there is no
          * sense in merging the queues.
          */
-        if (process_refs == 0)
+        if (process_refs == 0 || new_process_refs == 0)
                 return;
 
         /*
          * Merge in the direction of the lesser amount of work.
          */
-        new_process_refs = cfqq_process_refs(new_cfqq);
         if (new_process_refs >= process_refs) {
                 cfqq->new_cfqq = new_cfqq;
                 atomic_add(process_refs, &new_cfqq->ref);
@@ -3248,7 +3257,7 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
                                 cfq_clear_cfqq_wait_request(cfqq);
                                 __blk_run_queue(cfqd->queue);
                         } else {
-                                blkiocg_update_idle_time_stats(
+                                cfq_blkiocg_update_idle_time_stats(
                                                 &cfqq->cfqg->blkg);
                                 cfq_mark_cfqq_must_dispatch(cfqq);
                         }
@@ -3276,7 +3285,7 @@ static void cfq_insert_request(struct request_queue *q, struct request *rq)
         rq_set_fifo_time(rq, jiffies + cfqd->cfq_fifo_expire[rq_is_sync(rq)]);
         list_add_tail(&rq->queuelist, &cfqq->fifo);
         cfq_add_rq_rb(rq);
-        blkiocg_update_io_add_stats(&(RQ_CFQG(rq))->blkg,
+        cfq_blkiocg_update_io_add_stats(&(RQ_CFQG(rq))->blkg,
                         &cfqd->serving_group->blkg, rq_data_dir(rq),
                         rq_is_sync(rq));
         cfq_rq_enqueued(cfqd, cfqq, rq);
@@ -3364,9 +3373,9 @@ static void cfq_completed_request(struct request_queue *q, struct request *rq)
         WARN_ON(!cfqq->dispatched);
         cfqd->rq_in_driver--;
         cfqq->dispatched--;
-        blkiocg_update_completion_stats(&cfqq->cfqg->blkg, rq_start_time_ns(rq),
-                        rq_io_start_time_ns(rq), rq_data_dir(rq),
-                        rq_is_sync(rq));
+        cfq_blkiocg_update_completion_stats(&cfqq->cfqg->blkg,
+                        rq_start_time_ns(rq), rq_io_start_time_ns(rq),
+                        rq_data_dir(rq), rq_is_sync(rq));
 
         cfqd->rq_in_flight[cfq_cfqq_sync(cfqq)]--;
 
@@ -3730,7 +3739,7 @@ static void cfq_exit_queue(struct elevator_queue *e)
 
         cfq_put_async_queues(cfqd);
         cfq_release_cfq_groups(cfqd);
-        blkiocg_del_blkio_group(&cfqd->root_group.blkg);
+        cfq_blkiocg_del_blkio_group(&cfqd->root_group.blkg);
 
         spin_unlock_irq(q->queue_lock);
 
@@ -3798,8 +3807,8 @@ static void *cfq_init_queue(struct request_queue *q)
          */
         atomic_set(&cfqg->ref, 1);
         rcu_read_lock();
-        blkiocg_add_blkio_group(&blkio_root_cgroup, &cfqg->blkg, (void *)cfqd,
-                                        0);
+        cfq_blkiocg_add_blkio_group(&blkio_root_cgroup, &cfqg->blkg,
+                                        (void *)cfqd, 0);
         rcu_read_unlock();
 #endif
         /*
diff --git a/block/cfq.h b/block/cfq.h
new file mode 100644
index 000000000000..93448e5a2e41
--- /dev/null
+++ b/block/cfq.h
@@ -0,0 +1,115 @@
+#ifndef _CFQ_H
+#define _CFQ_H
+#include "blk-cgroup.h"
+
+#ifdef CONFIG_CFQ_GROUP_IOSCHED
+static inline void cfq_blkiocg_update_io_add_stats(struct blkio_group *blkg,
+        struct blkio_group *curr_blkg, bool direction, bool sync)
+{
+        blkiocg_update_io_add_stats(blkg, curr_blkg, direction, sync);
+}
+
+static inline void cfq_blkiocg_update_dequeue_stats(struct blkio_group *blkg,
+                        unsigned long dequeue)
+{
+        blkiocg_update_dequeue_stats(blkg, dequeue);
+}
+
+static inline void cfq_blkiocg_update_timeslice_used(struct blkio_group *blkg,
+                        unsigned long time)
+{
+        blkiocg_update_timeslice_used(blkg, time);
+}
+
+static inline void cfq_blkiocg_set_start_empty_time(struct blkio_group *blkg)
+{
+        blkiocg_set_start_empty_time(blkg);
+}
+
+static inline void cfq_blkiocg_update_io_remove_stats(struct blkio_group *blkg,
+                                bool direction, bool sync)
+{
+        blkiocg_update_io_remove_stats(blkg, direction, sync);
+}
+
+static inline void cfq_blkiocg_update_io_merged_stats(struct blkio_group *blkg,
+                bool direction, bool sync)
+{
+        blkiocg_update_io_merged_stats(blkg, direction, sync);
+}
+
+static inline void cfq_blkiocg_update_idle_time_stats(struct blkio_group *blkg)
+{
+        blkiocg_update_idle_time_stats(blkg);
+}
+
+static inline void
+cfq_blkiocg_update_avg_queue_size_stats(struct blkio_group *blkg)
+{
+        blkiocg_update_avg_queue_size_stats(blkg);
+}
+
+static inline void
+cfq_blkiocg_update_set_idle_time_stats(struct blkio_group *blkg)
+{
+        blkiocg_update_set_idle_time_stats(blkg);
+}
+
+static inline void cfq_blkiocg_update_dispatch_stats(struct blkio_group *blkg,
+                                uint64_t bytes, bool direction, bool sync)
+{
+        blkiocg_update_dispatch_stats(blkg, bytes, direction, sync);
+}
+
+static inline void cfq_blkiocg_update_completion_stats(struct blkio_group *blkg, uint64_t start_time, uint64_t io_start_time, bool direction, bool sync)
+{
+        blkiocg_update_completion_stats(blkg, start_time, io_start_time,
+                                direction, sync);
+}
+
+static inline void cfq_blkiocg_add_blkio_group(struct blkio_cgroup *blkcg,
+                        struct blkio_group *blkg, void *key, dev_t dev) {
+        blkiocg_add_blkio_group(blkcg, blkg, key, dev);
+}
+
+static inline int cfq_blkiocg_del_blkio_group(struct blkio_group *blkg)
+{
+        return blkiocg_del_blkio_group(blkg);
+}
+
+#else /* CFQ_GROUP_IOSCHED */
+static inline void cfq_blkiocg_update_io_add_stats(struct blkio_group *blkg,
+        struct blkio_group *curr_blkg, bool direction, bool sync) {}
+
+static inline void cfq_blkiocg_update_dequeue_stats(struct blkio_group *blkg,
+                        unsigned long dequeue) {}
+
+static inline void cfq_blkiocg_update_timeslice_used(struct blkio_group *blkg,
+                        unsigned long time) {}
+static inline void cfq_blkiocg_set_start_empty_time(struct blkio_group *blkg) {}
+static inline void cfq_blkiocg_update_io_remove_stats(struct blkio_group *blkg,
+                                bool direction, bool sync) {}
+static inline void cfq_blkiocg_update_io_merged_stats(struct blkio_group *blkg,
+                bool direction, bool sync) {}
+static inline void cfq_blkiocg_update_idle_time_stats(struct blkio_group *blkg)
+{
+}
+static inline void
+cfq_blkiocg_update_avg_queue_size_stats(struct blkio_group *blkg) {}
+
+static inline void
+cfq_blkiocg_update_set_idle_time_stats(struct blkio_group *blkg) {}
+
+static inline void cfq_blkiocg_update_dispatch_stats(struct blkio_group *blkg,
+                                uint64_t bytes, bool direction, bool sync) {}
+static inline void cfq_blkiocg_update_completion_stats(struct blkio_group *blkg, uint64_t start_time, uint64_t io_start_time, bool direction, bool sync) {}
+
+static inline void cfq_blkiocg_add_blkio_group(struct blkio_cgroup *blkcg,
+                        struct blkio_group *blkg, void *key, dev_t dev) {}
+static inline int cfq_blkiocg_del_blkio_group(struct blkio_group *blkg)
+{
+        return 0;
+}
+
+#endif /* CFQ_GROUP_IOSCHED */
+#endif
diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index d269a8f3329c..446aced33aff 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -46,6 +46,8 @@ static unsigned long power_saving_mwait_eax;
 
 static unsigned char tsc_detected_unstable;
 static unsigned char tsc_marked_unstable;
+static unsigned char lapic_detected_unstable;
+static unsigned char lapic_marked_unstable;
 
 static void power_saving_mwait_init(void)
 {
@@ -75,9 +77,6 @@ static void power_saving_mwait_init(void)
         power_saving_mwait_eax = (highest_cstate << MWAIT_SUBSTATE_SIZE) |
                 (highest_subcstate - 1);
 
-        for_each_online_cpu(i)
-                clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ON, &i);
-
 #if defined(CONFIG_GENERIC_TIME) && defined(CONFIG_X86)
         switch (boot_cpu_data.x86_vendor) {
         case X86_VENDOR_AMD:
@@ -86,13 +85,15 @@ static void power_saving_mwait_init(void)
                  * AMD Fam10h TSC will tick in all
                  * C/P/S0/S1 states when this bit is set.
                  */
-                if (boot_cpu_has(X86_FEATURE_NONSTOP_TSC))
-                        return;
-
-                /*FALL THROUGH*/
+                if (!boot_cpu_has(X86_FEATURE_NONSTOP_TSC))
+                        tsc_detected_unstable = 1;
+                if (!boot_cpu_has(X86_FEATURE_ARAT))
+                        lapic_detected_unstable = 1;
+                break;
         default:
-                /* TSC could halt in idle */
+                /* TSC & LAPIC could halt in idle */
                 tsc_detected_unstable = 1;
+                lapic_detected_unstable = 1;
         }
 #endif
 }
@@ -180,10 +181,20 @@ static int power_saving_thread(void *data)
                                 mark_tsc_unstable("TSC halts in idle");
                                 tsc_marked_unstable = 1;
                         }
+                        if (lapic_detected_unstable && !lapic_marked_unstable) {
+                                int i;
+                                /* LAPIC could halt in idle, so notify users */
+                                for_each_online_cpu(i)
+                                        clockevents_notify(
+                                                CLOCK_EVT_NOTIFY_BROADCAST_ON,
+                                                &i);
+                                lapic_marked_unstable = 1;
+                        }
                         local_irq_disable();
                         cpu = smp_processor_id();
-                        clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER,
-                                &cpu);
+                        if (lapic_marked_unstable)
+                                clockevents_notify(
+                                        CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu);
                         stop_critical_timings();
 
                         __monitor((void *)&current_thread_info()->flags, 0, 0);
@@ -192,8 +203,9 @@ static int power_saving_thread(void *data)
                                 __mwait(power_saving_mwait_eax, 1);
 
                         start_critical_timings();
-                        clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT,
-                                &cpu);
+                        if (lapic_marked_unstable)
+                                clockevents_notify(
+                                        CLOCK_EVT_NOTIFY_BROADCAST_EXIT, &cpu);
                         local_irq_enable();
 
                         if (jiffies > expire_time) {
diff --git a/drivers/acpi/acpica/acconfig.h b/drivers/acpi/acpica/acconfig.h
index 33181ad350d5..b17d8de9f6ff 100644
--- a/drivers/acpi/acpica/acconfig.h
+++ b/drivers/acpi/acpica/acconfig.h
@@ -119,6 +119,10 @@
 
 #define ACPI_MAX_LOOP_ITERATIONS        0xFFFF
 
+/* Maximum sleep allowed via Sleep() operator */
+
+#define ACPI_MAX_SLEEP                  20000   /* Two seconds */
+
 /******************************************************************************
  *
  * ACPI Specification constants (Do not change unless the specification changes)
diff --git a/drivers/acpi/acpica/acevents.h b/drivers/acpi/acpica/acevents.h
index 64d1e5c2d4ae..c3f43daa8be3 100644
--- a/drivers/acpi/acpica/acevents.h
+++ b/drivers/acpi/acpica/acevents.h
@@ -80,10 +80,6 @@ u32 acpi_ev_gpe_detect(struct acpi_gpe_xrupt_info *gpe_xrupt_list);
 acpi_status
 acpi_ev_update_gpe_enable_masks(struct acpi_gpe_event_info *gpe_event_info);
 
-acpi_status acpi_ev_enable_gpe(struct acpi_gpe_event_info *gpe_event_info);
-
-acpi_status acpi_ev_disable_gpe(struct acpi_gpe_event_info *gpe_event_info);
-
 struct acpi_gpe_event_info *acpi_ev_get_gpe_event_info(acpi_handle gpe_device,
                                                        u32 gpe_number);
 
diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h
index 9070f1fe8f17..899d68afc3c5 100644
--- a/drivers/acpi/acpica/acglobal.h
+++ b/drivers/acpi/acpica/acglobal.h
@@ -125,6 +125,14 @@ u8 ACPI_INIT_GLOBAL(acpi_gbl_enable_aml_debug_object, FALSE);
  */
 u8 ACPI_INIT_GLOBAL(acpi_gbl_copy_dsdt_locally, FALSE);
 
+/*
+ * Optionally truncate I/O addresses to 16 bits. Provides compatibility
+ * with other ACPI implementations. NOTE: During ACPICA initialization,
+ * this value is set to TRUE if any Windows OSI strings have been
+ * requested by the BIOS.
+ */
+u8 ACPI_INIT_GLOBAL(acpi_gbl_truncate_io_addresses, FALSE);
+
 /* acpi_gbl_FADT is a local copy of the FADT, converted to a common format. */
 
 struct acpi_table_fadt acpi_gbl_FADT;
diff --git a/drivers/acpi/acpica/achware.h b/drivers/acpi/acpica/achware.h
index 5900f135dc6d..32391588e163 100644
--- a/drivers/acpi/acpica/achware.h
+++ b/drivers/acpi/acpica/achware.h
@@ -90,7 +90,11 @@ acpi_status acpi_hw_write_port(acpi_io_address address, u32 value, u32 width);
 /*
  * hwgpe - GPE support
  */
-acpi_status acpi_hw_low_disable_gpe(struct acpi_gpe_event_info *gpe_event_info);
+u32 acpi_hw_gpe_register_bit(struct acpi_gpe_event_info *gpe_event_info,
+                             struct acpi_gpe_register_info *gpe_register_info);
+
+acpi_status
+acpi_hw_low_set_gpe(struct acpi_gpe_event_info *gpe_event_info, u8 action);
 
 acpi_status
 acpi_hw_write_gpe_enable_reg(struct acpi_gpe_event_info *gpe_event_info);
diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
index a221ad404167..7c2c336006a1 100644
--- a/drivers/acpi/acpica/evgpe.c
+++ b/drivers/acpi/acpica/evgpe.c
@@ -69,7 +69,7 @@ acpi_status
 acpi_ev_update_gpe_enable_masks(struct acpi_gpe_event_info *gpe_event_info)
 {
         struct acpi_gpe_register_info *gpe_register_info;
-        u8 register_bit;
+        u32 register_bit;
 
         ACPI_FUNCTION_TRACE(ev_update_gpe_enable_masks);
 
@@ -78,9 +78,8 @@ acpi_ev_update_gpe_enable_masks(struct acpi_gpe_event_info *gpe_event_info)
                 return_ACPI_STATUS(AE_NOT_EXIST);
         }
 
-        register_bit = (u8)
-            (1 <<
-             (gpe_event_info->gpe_number - gpe_register_info->base_gpe_number));
+        register_bit = acpi_hw_gpe_register_bit(gpe_event_info,
+                                                gpe_register_info);
 
         /* Clear the wake/run bits up front */
 
@@ -100,106 +99,6 @@ acpi_ev_update_gpe_enable_masks(struct acpi_gpe_event_info *gpe_event_info)
         return_ACPI_STATUS(AE_OK);
 }
 
-/*******************************************************************************
- *
- * FUNCTION:    acpi_ev_enable_gpe
- *
- * PARAMETERS:  gpe_event_info          - GPE to enable
- *
- * RETURN:      Status
- *
- * DESCRIPTION: Hardware-enable a GPE. Always enables the GPE, regardless
- *              of type or number of references.
- *
- * Note: The GPE lock should be already acquired when this function is called.
- *
- ******************************************************************************/
-
-acpi_status acpi_ev_enable_gpe(struct acpi_gpe_event_info *gpe_event_info)
-{
-        acpi_status status;
-
-
-        ACPI_FUNCTION_TRACE(ev_enable_gpe);
-
-
-        /*
-         * We will only allow a GPE to be enabled if it has either an
-         * associated method (_Lxx/_Exx) or a handler. Otherwise, the
-         * GPE will be immediately disabled by acpi_ev_gpe_dispatch the
-         * first time it fires.
-         */
-        if (!(gpe_event_info->flags & ACPI_GPE_DISPATCH_MASK)) {
-                return_ACPI_STATUS(AE_NO_HANDLER);
-        }
-
-        /* Ensure the HW enable masks are current */
-
-        status = acpi_ev_update_gpe_enable_masks(gpe_event_info);
-        if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
-        }
-
-        /* Clear the GPE (of stale events) */
-
-        status = acpi_hw_clear_gpe(gpe_event_info);
-        if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
-        }
-
-        /* Enable the requested GPE */
-
-        status = acpi_hw_write_gpe_enable_reg(gpe_event_info);
-        return_ACPI_STATUS(status);
-}
-
-/*******************************************************************************
- *
- * FUNCTION:    acpi_ev_disable_gpe
- *
- * PARAMETERS:  gpe_event_info          - GPE to disable
- *
- * RETURN:      Status
- *
- * DESCRIPTION: Hardware-disable a GPE. Always disables the requested GPE,
- *              regardless of the type or number of references.
- *
- * Note: The GPE lock should be already acquired when this function is called.
- *
- ******************************************************************************/
-
-acpi_status acpi_ev_disable_gpe(struct acpi_gpe_event_info *gpe_event_info)
-{
-        acpi_status status;
-
-        ACPI_FUNCTION_TRACE(ev_disable_gpe);
-
-
-        /*
-         * Note: Always disable the GPE, even if we think that that it is already
-         * disabled. It is possible that the AML or some other code has enabled
-         * the GPE behind our back.
-         */
-
-        /* Ensure the HW enable masks are current */
-
-        status = acpi_ev_update_gpe_enable_masks(gpe_event_info);
-        if (ACPI_FAILURE(status)) {
-                return_ACPI_STATUS(status);
-        }
-
-        /*
-         * Always H/W disable this GPE, even if we don't know the GPE type.
-         * Simply clear the enable bit for this particular GPE, but do not
-         * write out the current GPE enable mask since this may inadvertently
-         * enable GPEs too early. An example is a rogue GPE that has arrived
-         * during ACPICA initialization - possibly because AML or other code
-         * has enabled the GPE.
-         */
-        status = acpi_hw_low_disable_gpe(gpe_event_info);
-        return_ACPI_STATUS(status);
-}
-
 
 /*******************************************************************************
  *
@@ -451,10 +350,6 @@ static void ACPI_SYSTEM_XFACE acpi_ev_asynch_execute_gpe_method(void *context)
                 return_VOID;
         }
 
-        /* Update the GPE register masks for return to enabled state */
-
-        (void)acpi_ev_update_gpe_enable_masks(gpe_event_info);
-
         /*
          * Take a snapshot of the GPE info for this level - we copy the info to
          * prevent a race condition with remove_handler/remove_block.
@@ -607,7 +502,7 @@ acpi_ev_gpe_dispatch(struct acpi_gpe_event_info *gpe_event_info, u32 gpe_number)
                  * Disable the GPE, so it doesn't keep firing before the method has a
                  * chance to run (it runs asynchronously with interrupts enabled).
                  */
-                status = acpi_ev_disable_gpe(gpe_event_info);
+                status = acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_DISABLE);
                 if (ACPI_FAILURE(status)) {
                         ACPI_EXCEPTION((AE_INFO, status,
                                         "Unable to disable GPE[0x%2X]",
@@ -644,7 +539,7 @@ acpi_ev_gpe_dispatch(struct acpi_gpe_event_info *gpe_event_info, u32 gpe_number)
                  * Disable the GPE. The GPE will remain disabled a handler
                  * is installed or ACPICA is restarted.
                  */
-                status = acpi_ev_disable_gpe(gpe_event_info);
+                status = acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_DISABLE);
                 if (ACPI_FAILURE(status)) {
                         ACPI_EXCEPTION((AE_INFO, status,
                                         "Unable to disable GPE[0x%2X]",
diff --git a/drivers/acpi/acpica/evgpeblk.c b/drivers/acpi/acpica/evgpeblk.c
index 7c28f2d9fd35..341a38ce8aa6 100644
--- a/drivers/acpi/acpica/evgpeblk.c
+++ b/drivers/acpi/acpica/evgpeblk.c
@@ -500,6 +500,19 @@ acpi_ev_initialize_gpe_block(struct acpi_namespace_node *gpe_device,
 
                         gpe_index = (i * ACPI_GPE_REGISTER_WIDTH) + j;
                         gpe_event_info = &gpe_block->event_info[gpe_index];
+                        gpe_number = gpe_index + gpe_block->block_base_number;
+
+                        /*
+                         * If the GPE has already been enabled for runtime
+                         * signaling, make sure it remains enabled, but do not
+                         * increment its reference counter.
+                         */
+                        if (gpe_event_info->runtime_count) {
+                                acpi_set_gpe(gpe_device, gpe_number,
+                                                ACPI_GPE_ENABLE);
+                                gpe_enabled_count++;
+                                continue;
+                        }
 
                         if (gpe_event_info->flags & ACPI_GPE_CAN_WAKE) {
                                 wake_gpe_count++;
@@ -516,7 +529,6 @@ acpi_ev_initialize_gpe_block(struct acpi_namespace_node *gpe_device,
 
                         /* Enable this GPE */
 
-                        gpe_number = gpe_index + gpe_block->block_base_number;
                         status = acpi_enable_gpe(gpe_device, gpe_number,
                                                  ACPI_GPE_TYPE_RUNTIME);
                         if (ACPI_FAILURE(status)) {
diff --git a/drivers/acpi/acpica/evxface.c b/drivers/acpi/acpica/evxface.c
index cc825023012a..4a531cdf7942 100644
--- a/drivers/acpi/acpica/evxface.c
+++ b/drivers/acpi/acpica/evxface.c
@@ -719,13 +719,6 @@ acpi_install_gpe_handler(acpi_handle gpe_device,
         handler->context = context;
         handler->method_node = gpe_event_info->dispatch.method_node;
 
-        /* Disable the GPE before installing the handler */
-
-        status = acpi_ev_disable_gpe(gpe_event_info);
-        if (ACPI_FAILURE (status)) {
-                goto unlock_and_exit;
-        }
-
         /* Install the handler */
 
         flags = acpi_os_acquire_lock(acpi_gbl_gpe_lock);
diff --git a/drivers/acpi/acpica/evxfevnt.c b/drivers/acpi/acpica/evxfevnt.c
index d5a5efc043bf..d97b8dce1668 100644
--- a/drivers/acpi/acpica/evxfevnt.c
+++ b/drivers/acpi/acpica/evxfevnt.c
@@ -210,6 +210,44 @@ ACPI_EXPORT_SYMBOL(acpi_enable_event)
 
 /*******************************************************************************
  *
+ * FUNCTION:    acpi_clear_and_enable_gpe
+ *
+ * PARAMETERS:  gpe_event_info  - GPE to enable
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Clear the given GPE from stale events and enable it.
+ *
+ ******************************************************************************/
+static acpi_status
+acpi_clear_and_enable_gpe(struct acpi_gpe_event_info *gpe_event_info)
+{
+        acpi_status status;
+
+        /*
+         * We will only allow a GPE to be enabled if it has either an
+         * associated method (_Lxx/_Exx) or a handler. Otherwise, the
+         * GPE will be immediately disabled by acpi_ev_gpe_dispatch the
+         * first time it fires.
+         */
+        if (!(gpe_event_info->flags & ACPI_GPE_DISPATCH_MASK)) {
+                return_ACPI_STATUS(AE_NO_HANDLER);
+        }
+
+        /* Clear the GPE (of stale events) */
+        status = acpi_hw_clear_gpe(gpe_event_info);
+        if (ACPI_FAILURE(status)) {
+                return_ACPI_STATUS(status);
+        }
+
+        /* Enable the requested GPE */
+        status = acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_ENABLE);
+
+        return_ACPI_STATUS(status);
+}
+
+/*******************************************************************************
+ *
  * FUNCTION:    acpi_set_gpe
  *
  * PARAMETERS:  gpe_device      - Parent GPE Device. NULL for GPE0/GPE1
@@ -249,11 +287,11 @@ acpi_status acpi_set_gpe(acpi_handle gpe_device, u32 gpe_number, u8 action)
 
         switch (action) {
         case ACPI_GPE_ENABLE:
-                status = acpi_ev_enable_gpe(gpe_event_info);
+                status = acpi_clear_and_enable_gpe(gpe_event_info);
                 break;
 
         case ACPI_GPE_DISABLE:
-                status = acpi_ev_disable_gpe(gpe_event_info);
+                status = acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_DISABLE);
                 break;
 
         default:
@@ -316,7 +354,11 @@ acpi_status acpi_enable_gpe(acpi_handle gpe_device, u32 gpe_number, u8 gpe_type)
 
                 gpe_event_info->runtime_count++;
                 if (gpe_event_info->runtime_count == 1) {
-                        status = acpi_ev_enable_gpe(gpe_event_info);
+                        status = acpi_ev_update_gpe_enable_masks(gpe_event_info);
+                        if (ACPI_SUCCESS(status)) {
+                                status = acpi_clear_and_enable_gpe(gpe_event_info);
+                        }
+
                         if (ACPI_FAILURE(status)) {
                                 gpe_event_info->runtime_count--;
                                 goto unlock_and_exit;
@@ -343,7 +385,7 @@ acpi_status acpi_enable_gpe(acpi_handle gpe_device, u32 gpe_number, u8 gpe_type)
                  */
                 gpe_event_info->wakeup_count++;
                 if (gpe_event_info->wakeup_count == 1) {
-                        (void)acpi_ev_update_gpe_enable_masks(gpe_event_info);
+                        status = acpi_ev_update_gpe_enable_masks(gpe_event_info);
                 }
         }
 
@@ -403,7 +445,12 @@ acpi_status acpi_disable_gpe(acpi_handle gpe_device, u32 gpe_number, u8 gpe_type
 
                 gpe_event_info->runtime_count--;
                 if (!gpe_event_info->runtime_count) {
-                        status = acpi_ev_disable_gpe(gpe_event_info);
+                        status = acpi_ev_update_gpe_enable_masks(gpe_event_info);
+                        if (ACPI_SUCCESS(status)) {
+                                status = acpi_hw_low_set_gpe(gpe_event_info,
+                                                             ACPI_GPE_DISABLE);
+                        }
+
                         if (ACPI_FAILURE(status)) {
                                 gpe_event_info->runtime_count++;
                                 goto unlock_and_exit;
@@ -424,7 +471,7 @@ acpi_status acpi_disable_gpe(acpi_handle gpe_device, u32 gpe_number, u8 gpe_type
 
                 gpe_event_info->wakeup_count--;
                 if (!gpe_event_info->wakeup_count) {
-                        (void)acpi_ev_update_gpe_enable_masks(gpe_event_info);
+                        status = acpi_ev_update_gpe_enable_masks(gpe_event_info);
                 }
         }
 
diff --git a/drivers/acpi/acpica/exsystem.c b/drivers/acpi/acpica/exsystem.c
index 6d32e09327f1..675aaa91a770 100644
--- a/drivers/acpi/acpica/exsystem.c
+++ b/drivers/acpi/acpica/exsystem.c
@@ -201,6 +201,14 @@ acpi_status acpi_ex_system_do_sleep(u64 how_long)
 
         acpi_ex_relinquish_interpreter();
 
+        /*
+         * For compatibility with other ACPI implementations and to prevent
+         * accidental deep sleeps, limit the sleep time to something reasonable.
+         */
+        if (how_long > ACPI_MAX_SLEEP) {
+                how_long = ACPI_MAX_SLEEP;
+        }
+
         acpi_os_sleep(how_long);
 
         /* And now we must get the interpreter again */
diff --git a/drivers/acpi/acpica/hwgpe.c b/drivers/acpi/acpica/hwgpe.c
index bd72319a38f0..3450309c2786 100644
--- a/drivers/acpi/acpica/hwgpe.c
+++ b/drivers/acpi/acpica/hwgpe.c
@@ -57,21 +57,47 @@ acpi_hw_enable_wakeup_gpe_block(struct acpi_gpe_xrupt_info *gpe_xrupt_info,
 
 /******************************************************************************
  *
- * FUNCTION:    acpi_hw_low_disable_gpe
+ * FUNCTION:    acpi_hw_gpe_register_bit
+ *
+ * PARAMETERS:  gpe_event_info      - Info block for the GPE
+ *              gpe_register_info   - Info block for the GPE register
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: Compute GPE enable mask with one bit corresponding to the given
+ *              GPE set.
+ *
+ ******************************************************************************/
+
+u32 acpi_hw_gpe_register_bit(struct acpi_gpe_event_info *gpe_event_info,
+                             struct acpi_gpe_register_info *gpe_register_info)
+{
+        return (u32)1 << (gpe_event_info->gpe_number -
+                                gpe_register_info->base_gpe_number);
+}
+
+/******************************************************************************
+ *
+ * FUNCTION:    acpi_hw_low_set_gpe
  *
  * PARAMETERS:  gpe_event_info      - Info block for the GPE to be disabled
+ *              action              - Enable or disable
  *
  * RETURN:      Status
  *
- * DESCRIPTION: Disable a single GPE in the enable register.
+ * DESCRIPTION: Enable or disable a single GPE in its enable register.
  *
  ******************************************************************************/
 
-acpi_status acpi_hw_low_disable_gpe(struct acpi_gpe_event_info *gpe_event_info)
+acpi_status
+acpi_hw_low_set_gpe(struct acpi_gpe_event_info *gpe_event_info, u8 action)
 {
         struct acpi_gpe_register_info *gpe_register_info;
         acpi_status status;
         u32 enable_mask;
+        u32 register_bit;
+
+        ACPI_FUNCTION_ENTRY();
 
         /* Get the info block for the entire GPE register */
 
@@ -87,11 +113,27 @@ acpi_status acpi_hw_low_disable_gpe(struct acpi_gpe_event_info *gpe_event_info)
                 return (status);
         }
 
-        /* Clear just the bit that corresponds to this GPE */
+        /* Set ot clear just the bit that corresponds to this GPE */
 
-        ACPI_CLEAR_BIT(enable_mask, ((u32)1 <<
-                                     (gpe_event_info->gpe_number -
-                                      gpe_register_info->base_gpe_number)));
+        register_bit = acpi_hw_gpe_register_bit(gpe_event_info,
+                                                gpe_register_info);
+        switch (action) {
+        case ACPI_GPE_COND_ENABLE:
+                if (!(register_bit & gpe_register_info->enable_for_run))
+                        return (AE_BAD_PARAMETER);
+
+        case ACPI_GPE_ENABLE:
+                ACPI_SET_BIT(enable_mask, register_bit);
+                break;
+
+        case ACPI_GPE_DISABLE:
+                ACPI_CLEAR_BIT(enable_mask, register_bit);
+                break;
+
+        default:
+                ACPI_ERROR((AE_INFO, "Invalid action\n"));
+                return (AE_BAD_PARAMETER);
+        }
 
         /* Write the updated enable mask */
 
@@ -116,23 +158,11 @@ acpi_status acpi_hw_low_disable_gpe(struct acpi_gpe_event_info *gpe_event_info)
 acpi_status
 acpi_hw_write_gpe_enable_reg(struct acpi_gpe_event_info * gpe_event_info)
 {
-        struct acpi_gpe_register_info *gpe_register_info;
         acpi_status status;
 
         ACPI_FUNCTION_ENTRY();
 
-        /* Get the info block for the entire GPE register */
-
-        gpe_register_info = gpe_event_info->register_info;
-        if (!gpe_register_info) {
-                return (AE_NOT_EXIST);
-        }
-
-        /* Write the entire GPE (runtime) enable register */
-
-        status = acpi_hw_write(gpe_register_info->enable_for_run,
-                               &gpe_register_info->enable_address);
-
+        status = acpi_hw_low_set_gpe(gpe_event_info, ACPI_GPE_COND_ENABLE);
         return (status);
 }
 
@@ -150,21 +180,28 @@ acpi_hw_write_gpe_enable_reg(struct acpi_gpe_event_info * gpe_event_info)
 
 acpi_status acpi_hw_clear_gpe(struct acpi_gpe_event_info * gpe_event_info)
 {
+        struct acpi_gpe_register_info *gpe_register_info;
         acpi_status status;
-        u8 register_bit;
+        u32 register_bit;
 
         ACPI_FUNCTION_ENTRY();
 
-        register_bit = (u8)(1 <<
-                            (gpe_event_info->gpe_number -
-                             gpe_event_info->register_info->base_gpe_number));
+        /* Get the info block for the entire GPE register */
+
+        gpe_register_info = gpe_event_info->register_info;
+        if (!gpe_register_info) {
+                return (AE_NOT_EXIST);
+        }
+
+        register_bit = acpi_hw_gpe_register_bit(gpe_event_info,
+                                                gpe_register_info);
 
         /*
          * Write a one to the appropriate bit in the status register to
          * clear this GPE.
          */
         status = acpi_hw_write(register_bit,
-                               &gpe_event_info->register_info->status_address);
+                               &gpe_register_info->status_address);
 
         return (status);
 }
@@ -187,7 +224,7 @@ acpi_hw_get_gpe_status(struct acpi_gpe_event_info * gpe_event_info,
                        acpi_event_status * event_status)
 {
         u32 in_byte;
-        u8 register_bit;
+        u32 register_bit;
         struct acpi_gpe_register_info *gpe_register_info;
         acpi_status status;
         acpi_event_status local_event_status = 0;
@@ -204,9 +241,8 @@ acpi_hw_get_gpe_status(struct acpi_gpe_event_info * gpe_event_info,
 
         /* Get the register bitmask for this GPE */
 
-        register_bit = (u8)(1 <<
-                            (gpe_event_info->gpe_number -
-                             gpe_event_info->register_info->base_gpe_number));
+        register_bit = acpi_hw_gpe_register_bit(gpe_event_info,
+                                                gpe_register_info);
 
         /* GPE currently enabled? (enabled for runtime?) */
 
diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c
index c10d587c1641..e1d9c777b213 100644
--- a/drivers/acpi/acpica/hwvalid.c
+++ b/drivers/acpi/acpica/hwvalid.c
@@ -222,6 +222,12 @@ acpi_status acpi_hw_read_port(acpi_io_address address, u32 *value, u32 width)
         u32 one_byte;
         u32 i;
 
+        /* Truncate address to 16 bits if requested */
+
+        if (acpi_gbl_truncate_io_addresses) {
+                address &= ACPI_UINT16_MAX;
+        }
+
         /* Validate the entire request and perform the I/O */
 
         status = acpi_hw_validate_io_request(address, width);
@@ -279,6 +285,12 @@ acpi_status acpi_hw_write_port(acpi_io_address address, u32 value, u32 width)
         acpi_status status;
         u32 i;
 
+        /* Truncate address to 16 bits if requested */
+
+        if (acpi_gbl_truncate_io_addresses) {
+                address &= ACPI_UINT16_MAX;
+        }
+
         /* Validate the entire request and perform the I/O */
 
         status = acpi_hw_validate_io_request(address, width);
diff --git a/drivers/acpi/acpica/nsinit.c b/drivers/acpi/acpica/nsinit.c
index 9bd6f050f299..4e5272c313e0 100644
--- a/drivers/acpi/acpica/nsinit.c
+++ b/drivers/acpi/acpica/nsinit.c
@@ -193,6 +193,15 @@ acpi_status acpi_ns_initialize_devices(void)
                                         acpi_ns_init_one_device, NULL, &info,
                                         NULL);
 
+        /*
+         * Any _OSI requests should be completed by now. If the BIOS has
+         * requested any Windows OSI strings, we will always truncate
+         * I/O addresses to 16 bits -- for Windows compatibility.
+         */
+        if (acpi_gbl_osi_data >= ACPI_OSI_WIN_2000) {
+                acpi_gbl_truncate_io_addresses = TRUE;
+        }
+
         ACPI_FREE(info.evaluate_info);
         if (ACPI_FAILURE(status)) {
                 goto error_exit;
diff --git a/drivers/acpi/apei/apei-base.c b/drivers/acpi/apei/apei-base.c
index db3946e9c66b..216e1e948ff6 100644
--- a/drivers/acpi/apei/apei-base.c
+++ b/drivers/acpi/apei/apei-base.c
@@ -34,6 +34,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/acpi.h>
+#include <linux/slab.h>
 #include <linux/io.h>
 #include <linux/kref.h>
 #include <linux/rculist.h>
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 2ebc39115507..864dd46c346f 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -781,7 +781,7 @@ static int __init erst_init(void)
         status = acpi_get_table(ACPI_SIG_ERST, 0,
                                 (struct acpi_table_header **)&erst_tab);
         if (status == AE_NOT_FOUND) {
-                pr_err(ERST_PFX "Table is not found!\n");
+                pr_info(ERST_PFX "Table is not found!\n");
                 goto err;
         } else if (ACPI_FAILURE(status)) {
                 const char *msg = acpi_format_exception(status);
diff --git a/drivers/acpi/atomicio.c b/drivers/acpi/atomicio.c
index 814b19249616..8f8bd736d4ff 100644
--- a/drivers/acpi/atomicio.c
+++ b/drivers/acpi/atomicio.c
@@ -31,6 +31,7 @@
 #include <linux/kref.h>
 #include <linux/rculist.h>
 #include <linux/interrupt.h>
+#include <linux/slab.h>
 #include <acpi/atomicio.h>
 
 #define ACPI_PFX "ACPI: "
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index 2815df66f6f7..01381be05e96 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -218,6 +218,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                 },
         },
         {
+        .callback = dmi_disable_osi_vista,
+        .ident = "VGN-NS50B_L",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "VGN-NS50B_L"),
+                },
+        },
+        {
         .callback = dmi_disable_osi_win7,
         .ident = "ASUS K50IJ",
         .matches = {
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index fd51c4ab4829..7d857dabdde4 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -425,7 +425,7 @@ static int acpi_button_add(struct acpi_device *device)
                 /* Button's GPE is run-wake GPE */
                 acpi_enable_gpe(device->wakeup.gpe_device,
                                 device->wakeup.gpe_number,
-                                ACPI_GPE_TYPE_WAKE_RUN);
+                                ACPI_GPE_TYPE_RUNTIME);
                 device->wakeup.run_wake_count++;
                 device->wakeup.state.enabled = 1;
         }
@@ -449,7 +449,7 @@ static int acpi_button_remove(struct acpi_device *device, int type)
         if (device->wakeup.flags.valid) {
                 acpi_disable_gpe(device->wakeup.gpe_device,
                                 device->wakeup.gpe_number,
-                                ACPI_GPE_TYPE_WAKE_RUN);
+                                ACPI_GPE_TYPE_RUNTIME);
                 device->wakeup.run_wake_count--;
                 device->wakeup.state.enabled = 0;
         }
diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c
index acf2ab249842..8a3b840c0bb2 100644
--- a/drivers/acpi/fan.c
+++ b/drivers/acpi/fan.c
@@ -347,7 +347,6 @@ static int __init acpi_fan_init(void)
 {
         int result = 0;
 
-
 #ifdef CONFIG_ACPI_PROCFS
         acpi_fan_dir = proc_mkdir(ACPI_FAN_CLASS, acpi_root_dir);
         if (!acpi_fan_dir)
@@ -356,7 +355,9 @@ static int __init acpi_fan_init(void)
 
         result = acpi_bus_register_driver(&acpi_fan_driver);
         if (result < 0) {
+#ifdef CONFIG_ACPI_PROCFS
                 remove_proc_entry(ACPI_FAN_CLASS, acpi_root_dir);
+#endif
                 return -ENODEV;
         }
 
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index b1034a9ada4e..38ea0cc6dc49 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -581,6 +581,11 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device)
                 return 0;
         }
 
+#ifdef CONFIG_SMP
+        if (pr->id >= setup_max_cpus && pr->id != 0)
+                return 0;
+#endif
+
         BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
 
         /*
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 3fb4bdea7e06..5b7c52e4a00f 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -114,6 +114,8 @@ static int __acpi_pm_prepare(void)
 {
         int error = acpi_sleep_prepare(acpi_target_sleep_state);
 
+        suspend_nvs_save();
+
         if (error)
                 acpi_target_sleep_state = ACPI_STATE_S0;
         return error;
@@ -143,6 +145,9 @@ static void acpi_pm_finish(void)
 {
         u32 acpi_state = acpi_target_sleep_state;
 
+        suspend_nvs_free();
+        acpi_ec_unblock_transactions();
+
         if (acpi_state == ACPI_STATE_S0)
                 return;
 
@@ -192,6 +197,11 @@ static int acpi_suspend_begin(suspend_state_t pm_state)
         u32 acpi_state = acpi_suspend_states[pm_state];
         int error = 0;
 
+        error = suspend_nvs_alloc();
+
+        if (error)
+                return error;
+
         if (sleep_states[acpi_state]) {
                 acpi_target_sleep_state = acpi_state;
                 acpi_sleep_tts_switch(acpi_target_sleep_state);
@@ -269,12 +279,13 @@ static int acpi_suspend_enter(suspend_state_t pm_state)
         if (acpi_state == ACPI_STATE_S3)
                 acpi_restore_state_mem();
 
+        suspend_nvs_restore();
+
         return ACPI_SUCCESS(status) ? 0 : -EFAULT;
 }
 
 static void acpi_suspend_finish(void)
 {
-        acpi_ec_unblock_transactions();
         acpi_pm_finish();
 }
 
@@ -404,7 +415,7 @@ static int acpi_hibernation_begin(void)
 {
         int error;
 
-        error = s4_no_nvs ? 0 : hibernate_nvs_alloc();
+        error = s4_no_nvs ? 0 : suspend_nvs_alloc();
         if (!error) {
                 acpi_target_sleep_state = ACPI_STATE_S4;
                 acpi_sleep_tts_switch(acpi_target_sleep_state);
@@ -418,7 +429,7 @@ static int acpi_hibernation_pre_snapshot(void)
         int error = acpi_pm_prepare();
 
         if (!error)
-                hibernate_nvs_save();
+                suspend_nvs_save();
 
         return error;
 }
@@ -441,13 +452,6 @@ static int acpi_hibernation_enter(void)
         return ACPI_SUCCESS(status) ? 0 : -EFAULT;
 }
 
-static void acpi_hibernation_finish(void)
-{
-        hibernate_nvs_free();
-        acpi_ec_unblock_transactions();
-        acpi_pm_finish();
-}
-
 static void acpi_hibernation_leave(void)
 {
         /*
@@ -464,7 +468,7 @@ static void acpi_hibernation_leave(void)
                 panic("ACPI S4 hardware signature mismatch");
         }
         /* Restore the NVS memory area */
-        hibernate_nvs_restore();
+        suspend_nvs_restore();
         /* Allow EC transactions to happen. */
         acpi_ec_unblock_transactions_early();
 }
@@ -479,7 +483,7 @@ static struct platform_hibernation_ops acpi_hibernation_ops = {
         .begin = acpi_hibernation_begin,
         .end = acpi_pm_end,
         .pre_snapshot = acpi_hibernation_pre_snapshot,
-        .finish = acpi_hibernation_finish,
+        .finish = acpi_pm_finish,
         .prepare = acpi_pm_prepare,
         .enter = acpi_hibernation_enter,
         .leave = acpi_hibernation_leave,
@@ -507,7 +511,7 @@ static int acpi_hibernation_begin_old(void)
 
         if (!error) {
                 if (!s4_no_nvs)
-                        error = hibernate_nvs_alloc();
+                        error = suspend_nvs_alloc();
                 if (!error)
                         acpi_target_sleep_state = ACPI_STATE_S4;
         }
@@ -517,7 +521,7 @@ static int acpi_hibernation_begin_old(void)
 static int acpi_hibernation_pre_snapshot_old(void)
 {
         acpi_pm_freeze();
-        hibernate_nvs_save();
+        suspend_nvs_save();
         return 0;
 }
 
@@ -529,8 +533,8 @@ static struct platform_hibernation_ops acpi_hibernation_ops_old = {
         .begin = acpi_hibernation_begin_old,
         .end = acpi_pm_end,
         .pre_snapshot = acpi_hibernation_pre_snapshot_old,
-        .finish = acpi_hibernation_finish,
         .prepare = acpi_pm_freeze,
+        .finish = acpi_pm_finish,
         .enter = acpi_hibernation_enter,
         .leave = acpi_hibernation_leave,
         .pre_restore = acpi_pm_freeze,
diff --git a/drivers/acpi/system.c b/drivers/acpi/system.c
index c79e789ed03a..f8db50a0941c 100644
--- a/drivers/acpi/system.c
+++ b/drivers/acpi/system.c
@@ -388,10 +388,12 @@ static ssize_t counter_set(struct kobject *kobj,
         if (index < num_gpes) {
                 if (!strcmp(buf, "disable\n") &&
                                 (status & ACPI_EVENT_FLAG_ENABLED))
-                        result = acpi_set_gpe(handle, index, ACPI_GPE_DISABLE);
+                        result = acpi_disable_gpe(handle, index,
+                                                ACPI_GPE_TYPE_RUNTIME);
                 else if (!strcmp(buf, "enable\n") &&
                                 !(status & ACPI_EVENT_FLAG_ENABLED))
-                        result = acpi_set_gpe(handle, index, ACPI_GPE_ENABLE);
+                        result = acpi_enable_gpe(handle, index,
+                                                ACPI_GPE_TYPE_RUNTIME);
                 else if (!strcmp(buf, "clear\n") &&
                                 (status & ACPI_EVENT_FLAG_SET))
                         result = acpi_clear_gpe(handle, index);
diff --git a/drivers/acpi/wakeup.c b/drivers/acpi/wakeup.c
index 4b9d339a6e28..388747a7ef4f 100644
--- a/drivers/acpi/wakeup.c
+++ b/drivers/acpi/wakeup.c
@@ -64,16 +64,13 @@ void acpi_enable_wakeup_device(u8 sleep_state)
                 struct acpi_device *dev =
                         container_of(node, struct acpi_device, wakeup_list);
 
-                if (!dev->wakeup.flags.valid)
-                        continue;
-
-                if ((!dev->wakeup.state.enabled && !dev->wakeup.prepare_count)
+                if (!dev->wakeup.flags.valid || !dev->wakeup.state.enabled
                     || sleep_state > (u32) dev->wakeup.sleep_state)
                         continue;
 
                 /* The wake-up power should have been enabled already. */
-                acpi_set_gpe(dev->wakeup.gpe_device, dev->wakeup.gpe_number,
-                                ACPI_GPE_ENABLE);
+                acpi_enable_gpe(dev->wakeup.gpe_device, dev->wakeup.gpe_number,
+                                ACPI_GPE_TYPE_WAKE);
         }
 }
 
@@ -96,6 +93,8 @@ void acpi_disable_wakeup_device(u8 sleep_state)
                     || (sleep_state > (u32) dev->wakeup.sleep_state))
                         continue;
 
+                acpi_disable_gpe(dev->wakeup.gpe_device, dev->wakeup.gpe_number,
+                                ACPI_GPE_TYPE_WAKE);
                 acpi_disable_wakeup_device_power(dev);
         }
 }
@@ -109,13 +108,8 @@ int __init acpi_wakeup_device_init(void)
                 struct acpi_device *dev = container_of(node,
                                                        struct acpi_device,
                                                        wakeup_list);
-                /* In case user doesn't load button driver */
-                if (!dev->wakeup.flags.always_enabled ||
-                    dev->wakeup.state.enabled)
-                        continue;
-                acpi_enable_gpe(dev->wakeup.gpe_device, dev->wakeup.gpe_number,
-                                ACPI_GPE_TYPE_WAKE);
-                dev->wakeup.state.enabled = 1;
+                if (dev->wakeup.flags.always_enabled)
+                        dev->wakeup.state.enabled = 1;
         }
         mutex_unlock(&acpi_device_lock);
         return 0;
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 8ca16f54e1ed..f2522534ae63 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1053,6 +1053,16 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (pdev->vendor == PCI_VENDOR_ID_MARVELL && !marvell_enable)
                 return -ENODEV;
 
+        /*
+         * For some reason, MCP89 on MacBook 7,1 doesn't work with
+         * ahci, use ata_generic instead.
+         */
+        if (pdev->vendor == PCI_VENDOR_ID_NVIDIA &&
+            pdev->device == PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA &&
+            pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+            pdev->subsystem_device == 0xcb89)
+                return -ENODEV;
+
         /* Promise's PDC42819 is a SAS/SATA controller that has an AHCI mode.
          * At the moment, we can only use the AHCI mode. Let the users know
          * that for SAS drives they're out of luck.
diff --git a/drivers/ata/ata_generic.c b/drivers/ata/ata_generic.c
index 573158a9668d..7107a6929deb 100644
--- a/drivers/ata/ata_generic.c
+++ b/drivers/ata/ata_generic.c
@@ -32,6 +32,11 @@
  *      A generic parallel ATA driver using libata
  */
 
+enum {
+        ATA_GEN_CLASS_MATCH             = (1 << 0),
+        ATA_GEN_FORCE_DMA               = (1 << 1),
+};
+
 /**
  *      generic_set_mode        -       mode setting
  *      @link: link to set up
@@ -46,13 +51,17 @@
 static int generic_set_mode(struct ata_link *link, struct ata_device **unused)
 {
         struct ata_port *ap = link->ap;
+        const struct pci_device_id *id = ap->host->private_data;
         int dma_enabled = 0;
         struct ata_device *dev;
         struct pci_dev *pdev = to_pci_dev(ap->host->dev);
 
-        /* Bits 5 and 6 indicate if DMA is active on master/slave */
-        if (ap->ioaddr.bmdma_addr)
+        if (id->driver_data & ATA_GEN_FORCE_DMA) {
+                dma_enabled = 0xff;
+        } else if (ap->ioaddr.bmdma_addr) {
+                /* Bits 5 and 6 indicate if DMA is active on master/slave */
                 dma_enabled = ioread8(ap->ioaddr.bmdma_addr + ATA_DMA_STATUS);
+        }
 
         if (pdev->vendor == PCI_VENDOR_ID_CENATEK)
                 dma_enabled = 0xFF;
@@ -126,7 +135,7 @@ static int ata_generic_init_one(struct pci_dev *dev, const struct pci_device_id
         const struct ata_port_info *ppi[] = { &info, NULL };
 
         /* Don't use the generic entry unless instructed to do so */
-        if (id->driver_data == 1 && all_generic_ide == 0)
+        if ((id->driver_data & ATA_GEN_CLASS_MATCH) && all_generic_ide == 0)
                 return -ENODEV;
 
         /* Devices that need care */
@@ -155,7 +164,7 @@ static int ata_generic_init_one(struct pci_dev *dev, const struct pci_device_id
                         return rc;
                 pcim_pin_device(dev);
         }
-        return ata_pci_bmdma_init_one(dev, ppi, &generic_sht, NULL, 0);
+        return ata_pci_bmdma_init_one(dev, ppi, &generic_sht, (void *)id, 0);
 }
 
 static struct pci_device_id ata_generic[] = {
@@ -167,7 +176,15 @@ static struct pci_device_id ata_generic[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_HINT,   PCI_DEVICE_ID_HINT_VXPROII_IDE), },
         { PCI_DEVICE(PCI_VENDOR_ID_VIA,    PCI_DEVICE_ID_VIA_82C561), },
         { PCI_DEVICE(PCI_VENDOR_ID_OPTI,   PCI_DEVICE_ID_OPTI_82C558), },
-        { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE), },
+        { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE),
+          .driver_data = ATA_GEN_FORCE_DMA },
+        /*
+         * For some reason, MCP89 on MacBook 7,1 doesn't work with
+         * ahci, use ata_generic instead.
+         */
+        { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA,
+          PCI_VENDOR_ID_APPLE, 0xcb89,
+          .driver_data = ATA_GEN_FORCE_DMA },
 #if !defined(CONFIG_PATA_TOSHIBA) && !defined(CONFIG_PATA_TOSHIBA_MODULE)
         { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_1), },
         { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_2),  },
@@ -175,7 +192,8 @@ static struct pci_device_id ata_generic[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_5),  },
 #endif  
         /* Must come last. If you add entries adjust this table appropriately */
-        { PCI_ANY_ID,           PCI_ANY_ID,                        PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL, 1},
+        { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL),
+          .driver_data = ATA_GEN_CLASS_MATCH },
         { 0, },
 };
 
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 1984a6e89e84..81e772a94d59 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -324,6 +324,7 @@ static ssize_t ahci_store_em_buffer(struct device *dev,
         struct ahci_host_priv *hpriv = ap->host->private_data;
         void __iomem *mmio = hpriv->mmio;
         void __iomem *em_mmio = mmio + hpriv->em_loc;
+        const unsigned char *msg_buf = buf;
         u32 em_ctl, msg;
         unsigned long flags;
         int i;
@@ -343,8 +344,8 @@ static ssize_t ahci_store_em_buffer(struct device *dev,
         }
 
         for (i = 0; i < size; i += 4) {
-                msg = buf[i] | buf[i + 1] << 8 |
-                      buf[i + 2] << 16 | buf[i + 3] << 24;
+                msg = msg_buf[i] | msg_buf[i + 1] << 8 |
+                      msg_buf[i + 2] << 16 | msg_buf[i + 3] << 24;
                 writel(msg, em_mmio + i);
         }
 
@@ -541,29 +542,11 @@ static int ahci_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val)
         return -EINVAL;
 }
 
-static int ahci_is_device_present(void __iomem *port_mmio)
-{
-        u8 status = readl(port_mmio + PORT_TFDATA) & 0xff;
-
-        /* Make sure PxTFD.STS.BSY and PxTFD.STS.DRQ are 0 */
-        if (status & (ATA_BUSY | ATA_DRQ))
-                return 0;
-
-        /* Make sure PxSSTS.DET is 3h */
-        status = readl(port_mmio + PORT_SCR_STAT) & 0xf;
-        if (status != 3)
-                return 0;
-        return 1;
-}
-
 void ahci_start_engine(struct ata_port *ap)
 {
         void __iomem *port_mmio = ahci_port_base(ap);
         u32 tmp;
 
-        if (!ahci_is_device_present(port_mmio))
-                return;
-
         /* start DMA */
         tmp = readl(port_mmio + PORT_CMD);
         tmp |= PORT_CMD_START;
@@ -1892,6 +1875,9 @@ static void ahci_error_handler(struct ata_port *ap)
         }
 
         sata_pmp_error_handler(ap);
+
+        if (!ata_dev_enabled(ap->link.device))
+                ahci_stop_engine(ap);
 }
 
 static void ahci_post_internal_cmd(struct ata_queued_cmd *qc)
diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
index e9250514734b..be7726d7686d 100644
--- a/drivers/ata/sata_sil24.c
+++ b/drivers/ata/sata_sil24.c
@@ -539,12 +539,12 @@ static void sil24_config_port(struct ata_port *ap)
                 writel(PORT_CS_IRQ_WOC, port + PORT_CTRL_CLR);
 
         /* zero error counters. */
-        writel(0x8000, port + PORT_DECODE_ERR_THRESH);
-        writel(0x8000, port + PORT_CRC_ERR_THRESH);
-        writel(0x8000, port + PORT_HSHK_ERR_THRESH);
-        writel(0x0000, port + PORT_DECODE_ERR_CNT);
-        writel(0x0000, port + PORT_CRC_ERR_CNT);
-        writel(0x0000, port + PORT_HSHK_ERR_CNT);
+        writew(0x8000, port + PORT_DECODE_ERR_THRESH);
+        writew(0x8000, port + PORT_CRC_ERR_THRESH);
+        writew(0x8000, port + PORT_HSHK_ERR_THRESH);
+        writew(0x0000, port + PORT_DECODE_ERR_CNT);
+        writew(0x0000, port + PORT_CRC_ERR_CNT);
+        writew(0x0000, port + PORT_HSHK_ERR_CNT);
 
         /* always use 64bit activation */
         writel(PORT_CS_32BIT_ACTV, port + PORT_CTRL_CLR);
@@ -622,6 +622,11 @@ static int sil24_exec_polled_cmd(struct ata_port *ap, int pmp,
         irq_enabled = readl(port + PORT_IRQ_ENABLE_SET);
         writel(PORT_IRQ_COMPLETE | PORT_IRQ_ERROR, port + PORT_IRQ_ENABLE_CLR);
 
+        /*
+         * The barrier is required to ensure that writes to cmd_block reach
+         * the memory before the write to PORT_CMD_ACTIVATE.
+         */
+        wmb();
         writel((u32)paddr, port + PORT_CMD_ACTIVATE);
         writel((u64)paddr >> 32, port + PORT_CMD_ACTIVATE + 4);
 
@@ -865,7 +870,7 @@ static void sil24_qc_prep(struct ata_queued_cmd *qc)
         } else {
                 prb = &cb->atapi.prb;
                 sge = cb->atapi.sge;
-                memset(cb->atapi.cdb, 0, 32);
+                memset(cb->atapi.cdb, 0, sizeof(cb->atapi.cdb));
                 memcpy(cb->atapi.cdb, qc->cdb, qc->dev->cdb_len);
 
                 if (ata_is_data(qc->tf.protocol)) {
@@ -895,6 +900,11 @@ static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc)
         paddr = pp->cmd_block_dma + tag * sizeof(*pp->cmd_block);
         activate = port + PORT_CMD_ACTIVATE + tag * 8;
 
+        /*
+         * The barrier is required to ensure that writes to cmd_block reach
+         * the memory before the write to PORT_CMD_ACTIVATE.
+         */
+        wmb();
         writel((u32)paddr, activate);
         writel((u64)paddr >> 32, activate + 4);
 
diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index 0ecd0f6aa2c0..4730c42a5ee5 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -578,10 +578,24 @@ static void svia_configure(struct pci_dev *pdev)
 
         /*
          * vt6421 has problems talking to some drives.  The following
-         * is the magic fix from Joseph Chan <JosephChan@via.com.tw>.
-         * Please add proper documentation if possible.
+         * is the fix from Joseph Chan <JosephChan@via.com.tw>.
+         *
+         * When host issues HOLD, device may send up to 20DW of data
+         * before acknowledging it with HOLDA and the host should be
+         * able to buffer them in FIFO.  Unfortunately, some WD drives
+         * send upto 40DW before acknowledging HOLD and, in the
+         * default configuration, this ends up overflowing vt6421's
+         * FIFO, making the controller abort the transaction with
+         * R_ERR.
+         *
+         * Rx52[2] is the internal 128DW FIFO Flow control watermark
+         * adjusting mechanism enable bit and the default value 0
+         * means host will issue HOLD to device when the left FIFO
+         * size goes below 32DW.  Setting it to 1 makes the watermark
+         * 64DW.
          *
          * https://bugzilla.kernel.org/show_bug.cgi?id=15173
+         * http://article.gmane.org/gmane.linux.ide/46352
          */
         if (pdev->device == 0x3249) {
                 pci_read_config_byte(pdev, 0x52, &tmp8);
diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index 3381505c8a6c..72dae92f3cab 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -861,6 +861,7 @@ cciss_scsi_detect(int ctlr)
         sh->n_io_port = 0;      // I don't think we use these two...
         sh->this_id = SELF_SCSI_ID;  
         sh->sg_tablesize = hba[ctlr]->maxsgentries;
+        sh->max_cmd_len = MAX_COMMAND_SIZE;
 
         ((struct cciss_scsi_adapter_data_t *) 
                 hba[ctlr]->scsi_ctlr)->scsi_host = sh;
diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
index 91d11631cec9..abb4ec6690fc 100644
--- a/drivers/block/cpqarray.c
+++ b/drivers/block/cpqarray.c
@@ -386,7 +386,7 @@ static void __devexit cpqarray_remove_one_eisa (int i)
 }
 
 /* pdev is NULL for eisa */
-static int __init cpqarray_register_ctlr( int i, struct pci_dev *pdev)
+static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
 {
         struct request_queue *q;
         int j;
@@ -503,7 +503,7 @@ Enomem4:
         return -1;
 }
 
-static int __init cpqarray_init_one( struct pci_dev *pdev,
+static int __devinit cpqarray_init_one( struct pci_dev *pdev,
         const struct pci_device_id *ent)
 {
         int i;
@@ -740,7 +740,7 @@ __setup("smart2=", cpqarray_setup);
 /*
  * Find an EISA controller's signature.  Set up an hba if we find it.
  */
-static int __init cpqarray_eisa_detect(void)
+static int __devinit cpqarray_eisa_detect(void)
 {
         int i=0, j;
         __u32 board_id;
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 6b077f93acc6..7258c95e895e 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -1236,8 +1236,6 @@ static void after_state_ch(struct drbd_conf *mdev, union drbd_state os,
         /* Last part of the attaching process ... */
         if (ns.conn >= C_CONNECTED &&
             os.disk == D_ATTACHING && ns.disk == D_NEGOTIATING) {
-                kfree(mdev->p_uuid); /* We expect to receive up-to-date UUIDs soon. */
-                mdev->p_uuid = NULL; /* ...to not use the old ones in the mean time */
                 drbd_send_sizes(mdev, 0, 0);  /* to start sync... */
                 drbd_send_uuids(mdev);
                 drbd_send_state(mdev);
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index 632e3245d1bb..2151f18b21de 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -1114,6 +1114,12 @@ static int drbd_nl_disk_conf(struct drbd_conf *mdev, struct drbd_nl_cfg_req *nlp
                 mdev->new_state_tmp.i = ns.i;
                 ns.i = os.i;
                 ns.disk = D_NEGOTIATING;
+
+                /* We expect to receive up-to-date UUIDs soon.
+                   To avoid a race in receive_state, free p_uuid while
+                   holding req_lock. I.e. atomic with the state change */
+                kfree(mdev->p_uuid);
+                mdev->p_uuid = NULL;
         }
 
         rv = _drbd_set_state(mdev, ns, CS_VERBOSE, NULL);
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index 6f907ebed2d5..6d34f405a2f3 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -37,7 +37,7 @@
 #include <linux/wait.h>
 
 #include <linux/skbuff.h>
-#include <asm/io.h>
+#include <linux/io.h>
 
 #include <pcmcia/cs_types.h>
 #include <pcmcia/cs.h>
diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index 40aec0fb8596..42d69d4de05c 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -244,7 +244,7 @@ static struct sk_buff *bcsp_prepare_pkt(struct bcsp_struct *bcsp, u8 *data,
         if (rel) {
                 hdr[0] |= 0x80 + bcsp->msgq_txseq;
                 BT_DBG("Sending packet with seqno %u", bcsp->msgq_txseq);
-                bcsp->msgq_txseq = ++(bcsp->msgq_txseq) & 0x07;
+                bcsp->msgq_txseq = (bcsp->msgq_txseq + 1) & 0x07;
         }
 
         if (bcsp->use_crc)
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 4b51982fd23a..d2abf5143983 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -97,20 +97,18 @@ EXPORT_SYMBOL(agp_flush_chipset);
 void agp_alloc_page_array(size_t size, struct agp_memory *mem)
 {
         mem->pages = NULL;
-        mem->vmalloc_flag = false;
 
         if (size <= 2*PAGE_SIZE)
-                mem->pages = kmalloc(size, GFP_KERNEL | __GFP_NORETRY);
+                mem->pages = kmalloc(size, GFP_KERNEL | __GFP_NOWARN);
         if (mem->pages == NULL) {
                 mem->pages = vmalloc(size);
-                mem->vmalloc_flag = true;
         }
 }
 EXPORT_SYMBOL(agp_alloc_page_array);
 
 void agp_free_page_array(struct agp_memory *mem)
 {
-        if (mem->vmalloc_flag) {
+        if (is_vmalloc_addr(mem->pages)) {
                 vfree(mem->pages);
         } else {
                 kfree(mem->pages);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 35603dd4e6c5..094bdc355b1f 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -302,6 +302,12 @@ struct smi_info {
 
 static int force_kipmid[SI_MAX_PARMS];
 static int num_force_kipmid;
+#ifdef CONFIG_PCI
+static int pci_registered;
+#endif
+#ifdef CONFIG_PPC_OF
+static int of_registered;
+#endif
 
 static unsigned int kipmid_max_busy_us[SI_MAX_PARMS];
 static int num_max_busy_us;
@@ -1018,7 +1024,7 @@ static int ipmi_thread(void *data)
                 else if (smi_result == SI_SM_IDLE)
                         schedule_timeout_interruptible(100);
                 else
-                        schedule_timeout_interruptible(0);
+                        schedule_timeout_interruptible(1);
         }
         return 0;
 }
@@ -3314,6 +3320,8 @@ static __devinit int init_ipmi_si(void)
         rv = pci_register_driver(&ipmi_pci_driver);
         if (rv)
                 printk(KERN_ERR PFX "Unable to register PCI driver: %d\n", rv);
+        else
+                pci_registered = 1;
 #endif
 
 #ifdef CONFIG_ACPI
@@ -3330,6 +3338,7 @@ static __devinit int init_ipmi_si(void)
 
 #ifdef CONFIG_PPC_OF
         of_register_platform_driver(&ipmi_of_platform_driver);
+        of_registered = 1;
 #endif
 
         /* We prefer devices with interrupts, but in the case of a machine
@@ -3383,11 +3392,13 @@ static __devinit int init_ipmi_si(void)
         if (unload_when_empty && list_empty(&smi_infos)) {
                 mutex_unlock(&smi_infos_lock);
 #ifdef CONFIG_PCI
-                pci_unregister_driver(&ipmi_pci_driver);
+                if (pci_registered)
+                        pci_unregister_driver(&ipmi_pci_driver);
 #endif
 
 #ifdef CONFIG_PPC_OF
-                of_unregister_platform_driver(&ipmi_of_platform_driver);
+                if (of_registered)
+                        of_unregister_platform_driver(&ipmi_of_platform_driver);
 #endif
                 driver_unregister(&ipmi_driver.driver);
                 printk(KERN_WARNING PFX
@@ -3478,14 +3489,16 @@ static __exit void cleanup_ipmi_si(void)
                 return;
 
 #ifdef CONFIG_PCI
-        pci_unregister_driver(&ipmi_pci_driver);
+        if (pci_registered)
+                pci_unregister_driver(&ipmi_pci_driver);
 #endif
 #ifdef CONFIG_ACPI
         pnp_unregister_driver(&ipmi_pnp_driver);
 #endif
 
 #ifdef CONFIG_PPC_OF
-        of_unregister_platform_driver(&ipmi_of_platform_driver);
+        if (of_registered)
+                of_unregister_platform_driver(&ipmi_of_platform_driver);
 #endif
 
         mutex_lock(&smi_infos_lock);
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 5d15630a5830..5d64e3acb000 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -580,8 +580,12 @@ static bool sysrq_filter(struct input_handle *handle, unsigned int type,
         case KEY_RIGHTALT:
                 if (value)
                         sysrq_alt = code;
-                else if (sysrq_down && code == sysrq_alt_use)
-                        sysrq_down = false;
+                else {
+                        if (sysrq_down && code == sysrq_alt_use)
+                                sysrq_down = false;
+
+                        sysrq_alt = 0;
+                }
                 break;
 
         case KEY_SYSRQ:
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 8e00b4ddd083..792868d24f2a 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -224,6 +224,7 @@ struct	tpm_readpubek_params_out {
         u8      algorithm[4];
         u8      encscheme[2];
         u8      sigscheme[2];
+        __be32  paramsize;
         u8      parameters[12]; /*assuming RSA*/
         __be32  keysize;
         u8      modulus[256];
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 1296c42ed5c6..7cdb6ee569cd 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -304,7 +304,7 @@ static void scrup(struct vc_data *vc, unsigned int t, unsigned int b, int nr)
         d = (unsigned short *)(vc->vc_origin + vc->vc_size_row * t);
         s = (unsigned short *)(vc->vc_origin + vc->vc_size_row * (t + nr));
         scr_memmovew(d, s, (b - t - nr) * vc->vc_size_row);
-        scr_memsetw(d + (b - t - nr) * vc->vc_size_row, vc->vc_video_erase_char,
+        scr_memsetw(d + (b - t - nr) * vc->vc_cols, vc->vc_video_erase_char,
                     vc->vc_size_row * nr);
 }
 
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index f3d3898898ed..717305d30444 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -449,7 +449,7 @@ static int sh_cmt_register_clocksource(struct sh_cmt_priv *p,
         clk_disable(p->clk);
 
         /* TODO: calculate good shift from rate and counter bit width */
-        cs->shift = 10;
+        cs->shift = 0;
         cs->mult = clocksource_hz2mult(p->rate, cs->shift);
 
         dev_info(&p->pdev->dev, "used as clock source\n");
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index 52ff8aa63f84..1b128702d300 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -143,7 +143,7 @@ static inline int which_bucket(unsigned int duration)
          * This allows us to calculate
          * E(duration)|iowait
          */
-        if (nr_iowait_cpu())
+        if (nr_iowait_cpu(smp_processor_id()))
                 bucket = BUCKETS/2;
 
         if (duration < 10)
@@ -175,7 +175,7 @@ static inline int performance_multiplier(void)
         mult += 2 * get_loadavg();
 
         /* for IO wait tasks (per cpu!) we add 5x each */
-        mult += 10 * nr_iowait_cpu();
+        mult += 10 * nr_iowait_cpu(smp_processor_id());
 
         return mult;
 }
diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
index 5a22ca6927e5..7c3747902a37 100644
--- a/drivers/dma/ppc4xx/adma.c
+++ b/drivers/dma/ppc4xx/adma.c
@@ -4257,10 +4257,12 @@ static int ppc440spe_adma_setup_irqs(struct ppc440spe_adma_device *adev,
                                      struct ppc440spe_adma_chan *chan,
                                      int *initcode)
 {
+        struct of_device *ofdev;
         struct device_node *np;
         int ret;
 
-        np = container_of(adev->dev, struct of_device, dev)->node;
+        ofdev = container_of(adev->dev, struct of_device, dev);
+        np = ofdev->dev.of_node;
         if (adev->id != PPC440SPE_XOR_ID) {
                 adev->err_irq = irq_of_parse_and_map(np, 1);
                 if (adev->err_irq == NO_IRQ) {
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index cf17dbb8014f..ac9f7985096d 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -1958,20 +1958,20 @@ static int get_channel_from_ecc_syndrome(struct mem_ctl_info *mci, u16 syndrome)
         u32 value = 0;
         int err_sym = 0;
 
-        amd64_read_pci_cfg(pvt->misc_f3_ctl, 0x180, &value);
+        if (boot_cpu_data.x86 == 0x10) {
 
-        /* F3x180[EccSymbolSize]=1, x8 symbols */
-        if (boot_cpu_data.x86 == 0x10 &&
-            boot_cpu_data.x86_model > 7 &&
-            value & BIT(25)) {
-                err_sym = decode_syndrome(syndrome, x8_vectors,
-                                          ARRAY_SIZE(x8_vectors), 8);
-                return map_err_sym_to_channel(err_sym, 8);
-        } else {
-                err_sym = decode_syndrome(syndrome, x4_vectors,
-                                          ARRAY_SIZE(x4_vectors), 4);
-                return map_err_sym_to_channel(err_sym, 4);
+                amd64_read_pci_cfg(pvt->misc_f3_ctl, 0x180, &value);
+
+                /* F3x180[EccSymbolSize]=1 => x8 symbols */
+                if (boot_cpu_data.x86_model > 7 &&
+                    value & BIT(25)) {
+                        err_sym = decode_syndrome(syndrome, x8_vectors,
+                                                  ARRAY_SIZE(x8_vectors), 8);
+                        return map_err_sym_to_channel(err_sym, 8);
+                }
         }
+        err_sym = decode_syndrome(syndrome, x4_vectors, ARRAY_SIZE(x4_vectors), 4);
+        return map_err_sym_to_channel(err_sym, 4);
 }
 
 /*
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index 6b8b7b41ec5f..cc9357da0e34 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1233,10 +1233,28 @@ static void __init i7core_xeon_pci_fixup(struct pci_id_table *table)
                         for (i = 0; i < MAX_SOCKET_BUSES; i++)
                                 pcibios_scan_specific_bus(255-i);
                 }
+                pci_dev_put(pdev);
                 table++;
         }
 }
 
+static unsigned i7core_pci_lastbus(void)
+{
+        int last_bus = 0, bus;
+        struct pci_bus *b = NULL;
+
+        while ((b = pci_find_next_bus(b)) != NULL) {
+                bus = b->number;
+                debugf0("Found bus %d\n", bus);
+                if (bus > last_bus)
+                        last_bus = bus;
+        }
+
+        debugf0("Last bus %d\n", last_bus);
+
+        return last_bus;
+}
+
 /*
  *      i7core_get_devices      Find and perform 'get' operation on the MCH's
  *                      device/functions we want to reference for this driver
@@ -1244,7 +1262,8 @@ static void __init i7core_xeon_pci_fixup(struct pci_id_table *table)
  *                      Need to 'get' device 16 func 1 and func 2
  */
 int i7core_get_onedevice(struct pci_dev **prev, int devno,
-                         struct pci_id_descr *dev_descr, unsigned n_devs)
+                         struct pci_id_descr *dev_descr, unsigned n_devs,
+                         unsigned last_bus)
 {
         struct i7core_dev *i7core_dev;
 
@@ -1291,10 +1310,7 @@ int i7core_get_onedevice(struct pci_dev **prev, int devno,
         }
         bus = pdev->bus->number;
 
-        if (bus == 0x3f)
-                socket = 0;
-        else
-                socket = 255 - bus;
+        socket = last_bus - bus;
 
         i7core_dev = get_i7core_dev(socket);
         if (!i7core_dev) {
@@ -1358,17 +1374,21 @@ int i7core_get_onedevice(struct pci_dev **prev, int devno,
 
 static int i7core_get_devices(struct pci_id_table *table)
 {
-        int i, rc;
+        int i, rc, last_bus;
         struct pci_dev *pdev = NULL;
         struct pci_id_descr *dev_descr;
 
+        last_bus = i7core_pci_lastbus();
+
         while (table && table->descr) {
                 dev_descr = table->descr;
                 for (i = 0; i < table->n_devs; i++) {
                         pdev = NULL;
                         do {
-                                rc = i7core_get_onedevice(&pdev, i, &dev_descr[i],
-                                                          table->n_devs);
+                                rc = i7core_get_onedevice(&pdev, i,
+                                                          &dev_descr[i],
+                                                          table->n_devs,
+                                                          last_bus);
                                 if (rc < 0) {
                                         if (i == 0) {
                                                 i = table->n_devs;
@@ -1927,21 +1947,26 @@ fail:
  *              0 for FOUND a device
  *              < 0 for error code
  */
+
+static int probed = 0;
+
 static int __devinit i7core_probe(struct pci_dev *pdev,
                                   const struct pci_device_id *id)
 {
-        int dev_idx = id->driver_data;
         int rc;
         struct i7core_dev *i7core_dev;
 
+        /* get the pci devices we want to reserve for our use */
+        mutex_lock(&i7core_edac_lock);
+
         /*
          * All memory controllers are allocated at the first pass.
          */
-        if (unlikely(dev_idx >= 1))
+        if (unlikely(probed >= 1)) {
+                mutex_unlock(&i7core_edac_lock);
                 return -EINVAL;
-
-        /* get the pci devices we want to reserve for our use */
-        mutex_lock(&i7core_edac_lock);
+        }
+        probed++;
 
         rc = i7core_get_devices(pci_dev_table);
         if (unlikely(rc < 0))
@@ -2013,6 +2038,8 @@ static void __devexit i7core_remove(struct pci_dev *pdev)
                                       i7core_dev->socket);
                 }
         }
+        probed--;
+
         mutex_unlock(&i7core_edac_lock);
 }
 
diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
index 9dcb30466ec0..371713ff0266 100644
--- a/drivers/firewire/core-card.c
+++ b/drivers/firewire/core-card.c
@@ -231,7 +231,7 @@ void fw_schedule_bm_work(struct fw_card *card, unsigned long delay)
 static void fw_card_bm_work(struct work_struct *work)
 {
         struct fw_card *card = container_of(work, struct fw_card, work.work);
-        struct fw_device *root_device;
+        struct fw_device *root_device, *irm_device;
         struct fw_node *root_node;
         unsigned long flags;
         int root_id, new_root_id, irm_id, local_id;
@@ -239,6 +239,7 @@ static void fw_card_bm_work(struct work_struct *work)
         bool do_reset = false;
         bool root_device_is_running;
         bool root_device_is_cmc;
+        bool irm_is_1394_1995_only;
 
         spin_lock_irqsave(&card->lock, flags);
 
@@ -248,12 +249,18 @@ static void fw_card_bm_work(struct work_struct *work)
         }
 
         generation = card->generation;
+
         root_node = card->root_node;
         fw_node_get(root_node);
         root_device = root_node->data;
         root_device_is_running = root_device &&
                         atomic_read(&root_device->state) == FW_DEVICE_RUNNING;
         root_device_is_cmc = root_device && root_device->cmc;
+
+        irm_device = card->irm_node->data;
+        irm_is_1394_1995_only = irm_device && irm_device->config_rom &&
+                        (irm_device->config_rom[2] & 0x000000f0) == 0;
+
         root_id  = root_node->node_id;
         irm_id   = card->irm_node->node_id;
         local_id = card->local_node->node_id;
@@ -276,8 +283,15 @@ static void fw_card_bm_work(struct work_struct *work)
 
                 if (!card->irm_node->link_on) {
                         new_root_id = local_id;
-                        fw_notify("IRM has link off, making local node (%02x) root.\n",
-                                  new_root_id);
+                        fw_notify("%s, making local node (%02x) root.\n",
+                                  "IRM has link off", new_root_id);
+                        goto pick_me;
+                }
+
+                if (irm_is_1394_1995_only) {
+                        new_root_id = local_id;
+                        fw_notify("%s, making local node (%02x) root.\n",
+                                  "IRM is not 1394a compliant", new_root_id);
                         goto pick_me;
                 }
 
@@ -316,8 +330,8 @@ static void fw_card_bm_work(struct work_struct *work)
                          * root, and thus, IRM.
                          */
                         new_root_id = local_id;
-                        fw_notify("BM lock failed, making local node (%02x) root.\n",
-                                  new_root_id);
+                        fw_notify("%s, making local node (%02x) root.\n",
+                                  "BM lock failed", new_root_id);
                         goto pick_me;
                 }
         } else if (card->bm_generation != generation) {
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 724038dab4ca..7face915b963 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -1,5 +1,5 @@
 #
-# GPIO infrastructure and expanders
+# platform-neutral GPIO infrastructure and expanders
 #
 
 config ARCH_WANT_OPTIONAL_GPIOLIB
diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile
index 51c3cdd41b5a..e53dcff49b4f 100644
--- a/drivers/gpio/Makefile
+++ b/drivers/gpio/Makefile
@@ -1,4 +1,8 @@
-# gpio support: dedicated expander chips, etc
+# generic gpio support: dedicated expander chips, etc
+#
+# NOTE: platform-specific GPIO drivers don't belong in the
+# drivers/gpio directory; put them with other platform setup
+# code, IRQ controllers, board init, etc.
 
 ccflags-$(CONFIG_DEBUG_GPIO)    += -DDEBUG
 
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 994d23beeb1d..57cea01c4ffb 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1840,8 +1840,10 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
 
                 ret = copy_from_user(clips, clips_ptr,
                                      num_clips * sizeof(*clips));
-                if (ret)
+                if (ret) {
+                        ret = -EFAULT;
                         goto out_err2;
+                }
         }
 
         if (fb->funcs->dirty) {
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index b3779d243aef..719662034bbf 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -146,7 +146,7 @@ static bool drm_fb_helper_connector_parse_command_line(struct drm_fb_helper_conn
                                 cvt = 1;
                         break;
                 case 'R':
-                        if (!cvt)
+                        if (cvt)
                                 rb = 1;
                         break;
                 case 'm':
@@ -264,7 +264,7 @@ bool drm_fb_helper_force_kernel_mode(void)
 int drm_fb_helper_panic(struct notifier_block *n, unsigned long ununsed,
                         void *panic_str)
 {
-        DRM_ERROR("panic occurred, switching back to text console\n");
+        printk(KERN_ERR "panic occurred, switching back to text console\n");
         return drm_fb_helper_force_kernel_mode();
         return 0;
 }
@@ -315,8 +315,9 @@ static void drm_fb_helper_on(struct fb_info *info)
         struct drm_device *dev = fb_helper->dev;
         struct drm_crtc *crtc;
         struct drm_crtc_helper_funcs *crtc_funcs;
+        struct drm_connector *connector;
         struct drm_encoder *encoder;
-        int i;
+        int i, j;
 
         /*
          * For each CRTC in this fb, turn the crtc on then,
@@ -332,7 +333,14 @@ static void drm_fb_helper_on(struct fb_info *info)
 
                 crtc_funcs->dpms(crtc, DRM_MODE_DPMS_ON);
 
-
+                /* Walk the connectors & encoders on this fb turning them on */
+                for (j = 0; j < fb_helper->connector_count; j++) {
+                        connector = fb_helper->connector_info[j]->connector;
+                        connector->dpms = DRM_MODE_DPMS_ON;
+                        drm_connector_property_set_value(connector,
+                                                         dev->mode_config.dpms_property,
+                                                         DRM_MODE_DPMS_ON);
+                }
                 /* Found a CRTC on this fb, now find encoders */
                 list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
                         if (encoder->crtc == crtc) {
@@ -352,8 +360,9 @@ static void drm_fb_helper_off(struct fb_info *info, int dpms_mode)
         struct drm_device *dev = fb_helper->dev;
         struct drm_crtc *crtc;
         struct drm_crtc_helper_funcs *crtc_funcs;
+        struct drm_connector *connector;
         struct drm_encoder *encoder;
-        int i;
+        int i, j;
 
         /*
          * For each CRTC in this fb, find all associated encoders
@@ -367,6 +376,14 @@ static void drm_fb_helper_off(struct fb_info *info, int dpms_mode)
                 if (!crtc->enabled)
                         continue;
 
+                /* Walk the connectors on this fb and mark them off */
+                for (j = 0; j < fb_helper->connector_count; j++) {
+                        connector = fb_helper->connector_info[j]->connector;
+                        connector->dpms = dpms_mode;
+                        drm_connector_property_set_value(connector,
+                                                         dev->mode_config.dpms_property,
+                                                         dpms_mode);
+                }
                 /* Found a CRTC on this fb, now find encoders */
                 list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
                         if (encoder->crtc == crtc) {
@@ -1024,11 +1041,18 @@ static struct drm_display_mode *drm_pick_cmdline_mode(struct drm_fb_helper_conne
         }
 
 create_mode:
-        mode = drm_cvt_mode(fb_helper_conn->connector->dev, cmdline_mode->xres,
-                            cmdline_mode->yres,
-                            cmdline_mode->refresh_specified ? cmdline_mode->refresh : 60,
-                            cmdline_mode->rb, cmdline_mode->interlace,
-                            cmdline_mode->margins);
+        if (cmdline_mode->cvt)
+                mode = drm_cvt_mode(fb_helper_conn->connector->dev,
+                                    cmdline_mode->xres, cmdline_mode->yres,
+                                    cmdline_mode->refresh_specified ? cmdline_mode->refresh : 60,
+                                    cmdline_mode->rb, cmdline_mode->interlace,
+                                    cmdline_mode->margins);
+        else
+                mode = drm_gtf_mode(fb_helper_conn->connector->dev,
+                                    cmdline_mode->xres, cmdline_mode->yres,
+                                    cmdline_mode->refresh_specified ? cmdline_mode->refresh : 60,
+                                    cmdline_mode->interlace,
+                                    cmdline_mode->margins);
         drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
         list_add(&mode->head, &fb_helper_conn->connector->modes);
         return mode;
diff --git a/drivers/gpu/drm/i915/dvo_tfp410.c b/drivers/gpu/drm/i915/dvo_tfp410.c
index 66c697bc9b22..56f66426207f 100644
--- a/drivers/gpu/drm/i915/dvo_tfp410.c
+++ b/drivers/gpu/drm/i915/dvo_tfp410.c
@@ -208,7 +208,7 @@ static enum drm_connector_status tfp410_detect(struct intel_dvo_device *dvo)
         uint8_t ctl2;
 
         if (tfp410_readb(dvo, TFP410_CTL_2, &ctl2)) {
-                if (ctl2 & TFP410_CTL_2_HTPLG)
+                if (ctl2 & TFP410_CTL_2_RSEN)
                         ret = connector_status_connected;
                 else
                         ret = connector_status_disconnected;
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 52510ad8b25d..aee83fa178f6 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -620,7 +620,7 @@ static int i915_sr_status(struct seq_file *m, void *unused)
         drm_i915_private_t *dev_priv = dev->dev_private;
         bool sr_enabled = false;
 
-        if (IS_I965G(dev) || IS_I945G(dev) || IS_I945GM(dev))
+        if (IS_I965GM(dev) || IS_I945G(dev) || IS_I945GM(dev))
                 sr_enabled = I915_READ(FW_BLC_SELF) & FW_BLC_SELF_EN;
         else if (IS_I915GM(dev))
                 sr_enabled = I915_READ(INSTPM) & INSTPM_SELF_EN;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index b2ebf02e4f8a..f00c5ae9556c 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -128,9 +128,11 @@ static int i915_dma_cleanup(struct drm_device * dev)
         if (dev->irq_enabled)
                 drm_irq_uninstall(dev);
 
+        mutex_lock(&dev->struct_mutex);
         intel_cleanup_ring_buffer(dev, &dev_priv->render_ring);
         if (HAS_BSD(dev))
                 intel_cleanup_ring_buffer(dev, &dev_priv->bsd_ring);
+        mutex_unlock(&dev->struct_mutex);
 
         /* Clear the HWS virtual address at teardown */
         if (I915_NEED_GFX_HWS(dev))
@@ -1229,7 +1231,7 @@ static void i915_warn_stolen(struct drm_device *dev)
 static void i915_setup_compression(struct drm_device *dev, int size)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_mm_node *compressed_fb, *compressed_llb;
+        struct drm_mm_node *compressed_fb, *uninitialized_var(compressed_llb);
         unsigned long cfb_base;
         unsigned long ll_base = 0;
 
@@ -1402,19 +1404,23 @@ static int i915_load_modeset_init(struct drm_device *dev,
         /* if we have > 1 VGA cards, then disable the radeon VGA resources */
         ret = vga_client_register(dev->pdev, dev, NULL, i915_vga_set_decode);
         if (ret)
-                goto destroy_ringbuffer;
+                goto cleanup_ringbuffer;
 
         ret = vga_switcheroo_register_client(dev->pdev,
                                              i915_switcheroo_set_state,
                                              i915_switcheroo_can_switch);
         if (ret)
-                goto destroy_ringbuffer;
+                goto cleanup_vga_client;
+
+        /* IIR "flip pending" bit means done if this bit is set */
+        if (IS_GEN3(dev) && (I915_READ(ECOSKPD) & ECO_FLIP_DONE))
+                dev_priv->flip_pending_is_done = true;
 
         intel_modeset_init(dev);
 
         ret = drm_irq_install(dev);
         if (ret)
-                goto destroy_ringbuffer;
+                goto cleanup_vga_switcheroo;
 
         /* Always safe in the mode setting case. */
         /* FIXME: do pre/post-mode set stuff in core KMS code */
@@ -1426,11 +1432,20 @@ static int i915_load_modeset_init(struct drm_device *dev,
 
         I915_WRITE(INSTPM, (1 << 5) | (1 << 21));
 
-        intel_fbdev_init(dev);
+        ret = intel_fbdev_init(dev);
+        if (ret)
+                goto cleanup_irq;
+
         drm_kms_helper_poll_init(dev);
         return 0;
 
-destroy_ringbuffer:
+cleanup_irq:
+        drm_irq_uninstall(dev);
+cleanup_vga_switcheroo:
+        vga_switcheroo_unregister_client(dev->pdev);
+cleanup_vga_client:
+        vga_client_register(dev->pdev, NULL, NULL, NULL);
+cleanup_ringbuffer:
         mutex_lock(&dev->struct_mutex);
         i915_gem_cleanup_ringbuffer(dev);
         mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 9ed8ecd95801..d147ab2f5bfc 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -278,6 +278,7 @@ typedef struct drm_i915_private {
         struct mem_block *agp_heap;
         unsigned int sr01, adpa, ppcr, dvob, dvoc, lvds;
         int vblank_pipe;
+        int num_pipe;
 
         /* For hangcheck timer */
 #define DRM_I915_HANGCHECK_PERIOD 75 /* in jiffies */
@@ -595,6 +596,7 @@ typedef struct drm_i915_private {
         struct drm_crtc *plane_to_crtc_mapping[2];
         struct drm_crtc *pipe_to_crtc_mapping[2];
         wait_queue_head_t pending_flip_queue;
+        bool flip_pending_is_done;
 
         /* Reclocking support */
         bool render_reclock_avail;
@@ -1075,7 +1077,7 @@ extern int intel_trans_dp_port_sel (struct drm_crtc *crtc);
         drm_i915_private_t *dev_priv = dev->dev_private;                \
         if (I915_VERBOSE)                                               \
                 DRM_DEBUG("   BEGIN_LP_RING %x\n", (int)(n));           \
-        intel_ring_begin(dev, &dev_priv->render_ring, 4*(n));           \
+        intel_ring_begin(dev, &dev_priv->render_ring, (n));             \
 } while (0)
 
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 9ded3dae6c87..074385882ccf 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2239,7 +2239,7 @@ i915_gem_object_get_pages(struct drm_gem_object *obj,
         mapping = inode->i_mapping;
         for (i = 0; i < page_count; i++) {
                 page = read_cache_page_gfp(mapping, i,
-                                           mapping_gfp_mask (mapping) |
+                                           GFP_HIGHUSER |
                                            __GFP_COLD |
                                            gfpmask);
                 if (IS_ERR(page))
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 2479be001e40..dba53d4b9fb3 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -940,22 +940,30 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                 if (HAS_BSD(dev) && (iir & I915_BSD_USER_INTERRUPT))
                         DRM_WAKEUP(&dev_priv->bsd_ring.irq_queue);
 
-                if (iir & I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT)
+                if (iir & I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT) {
                         intel_prepare_page_flip(dev, 0);
+                        if (dev_priv->flip_pending_is_done)
+                                intel_finish_page_flip_plane(dev, 0);
+                }
 
-                if (iir & I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT)
+                if (iir & I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT) {
                         intel_prepare_page_flip(dev, 1);
+                        if (dev_priv->flip_pending_is_done)
+                                intel_finish_page_flip_plane(dev, 1);
+                }
 
                 if (pipea_stats & vblank_status) {
                         vblank++;
                         drm_handle_vblank(dev, 0);
-                        intel_finish_page_flip(dev, 0);
+                        if (!dev_priv->flip_pending_is_done)
+                                intel_finish_page_flip(dev, 0);
                 }
 
                 if (pipeb_stats & vblank_status) {
                         vblank++;
                         drm_handle_vblank(dev, 1);
-                        intel_finish_page_flip(dev, 1);
+                        if (!dev_priv->flip_pending_is_done)
+                                intel_finish_page_flip(dev, 1);
                 }
 
                 if ((pipea_stats & I915_LEGACY_BLC_EVENT_STATUS) ||
@@ -1387,29 +1395,10 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
         dev_priv->pipestat[1] = 0;
 
         if (I915_HAS_HOTPLUG(dev)) {
-                u32 hotplug_en = I915_READ(PORT_HOTPLUG_EN);
-
-                /* Note HDMI and DP share bits */
-                if (dev_priv->hotplug_supported_mask & HDMIB_HOTPLUG_INT_STATUS)
-                        hotplug_en |= HDMIB_HOTPLUG_INT_EN;
-                if (dev_priv->hotplug_supported_mask & HDMIC_HOTPLUG_INT_STATUS)
-                        hotplug_en |= HDMIC_HOTPLUG_INT_EN;
-                if (dev_priv->hotplug_supported_mask & HDMID_HOTPLUG_INT_STATUS)
-                        hotplug_en |= HDMID_HOTPLUG_INT_EN;
-                if (dev_priv->hotplug_supported_mask & SDVOC_HOTPLUG_INT_STATUS)
-                        hotplug_en |= SDVOC_HOTPLUG_INT_EN;
-                if (dev_priv->hotplug_supported_mask & SDVOB_HOTPLUG_INT_STATUS)
-                        hotplug_en |= SDVOB_HOTPLUG_INT_EN;
-                if (dev_priv->hotplug_supported_mask & CRT_HOTPLUG_INT_STATUS)
-                        hotplug_en |= CRT_HOTPLUG_INT_EN;
-                /* Ignore TV since it's buggy */
-
-                I915_WRITE(PORT_HOTPLUG_EN, hotplug_en);
-
                 /* Enable in IER... */
                 enable_mask |= I915_DISPLAY_PORT_INTERRUPT;
                 /* and unmask in IMR */
-                i915_enable_irq(dev_priv, I915_DISPLAY_PORT_INTERRUPT);
+                dev_priv->irq_mask_reg &= ~I915_DISPLAY_PORT_INTERRUPT;
         }
 
         /*
@@ -1427,16 +1416,41 @@ int i915_driver_irq_postinstall(struct drm_device *dev)
         }
         I915_WRITE(EMR, error_mask);
 
-        /* Disable pipe interrupt enables, clear pending pipe status */
-        I915_WRITE(PIPEASTAT, I915_READ(PIPEASTAT) & 0x8000ffff);
-        I915_WRITE(PIPEBSTAT, I915_READ(PIPEBSTAT) & 0x8000ffff);
-        /* Clear pending interrupt status */
-        I915_WRITE(IIR, I915_READ(IIR));
-
-        I915_WRITE(IER, enable_mask);
         I915_WRITE(IMR, dev_priv->irq_mask_reg);
+        I915_WRITE(IER, enable_mask);
         (void) I915_READ(IER);
 
+        if (I915_HAS_HOTPLUG(dev)) {
+                u32 hotplug_en = I915_READ(PORT_HOTPLUG_EN);
+
+                /* Note HDMI and DP share bits */
+                if (dev_priv->hotplug_supported_mask & HDMIB_HOTPLUG_INT_STATUS)
+                        hotplug_en |= HDMIB_HOTPLUG_INT_EN;
+                if (dev_priv->hotplug_supported_mask & HDMIC_HOTPLUG_INT_STATUS)
+                        hotplug_en |= HDMIC_HOTPLUG_INT_EN;
+                if (dev_priv->hotplug_supported_mask & HDMID_HOTPLUG_INT_STATUS)
+                        hotplug_en |= HDMID_HOTPLUG_INT_EN;
+                if (dev_priv->hotplug_supported_mask & SDVOC_HOTPLUG_INT_STATUS)
+                        hotplug_en |= SDVOC_HOTPLUG_INT_EN;
+                if (dev_priv->hotplug_supported_mask & SDVOB_HOTPLUG_INT_STATUS)
+                        hotplug_en |= SDVOB_HOTPLUG_INT_EN;
+                if (dev_priv->hotplug_supported_mask & CRT_HOTPLUG_INT_STATUS) {
+                        hotplug_en |= CRT_HOTPLUG_INT_EN;
+
+                        /* Programming the CRT detection parameters tends
+                           to generate a spurious hotplug event about three
+                           seconds later.  So just do it once.
+                        */
+                        if (IS_G4X(dev))
+                                hotplug_en |= CRT_HOTPLUG_ACTIVATION_PERIOD_64;
+                        hotplug_en |= CRT_HOTPLUG_VOLTAGE_COMPARE_50;
+                }
+
+                /* Ignore TV since it's buggy */
+
+                I915_WRITE(PORT_HOTPLUG_EN, hotplug_en);
+        }
+
         opregion_enable_asle(dev);
 
         return 0;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 64b0a3afd92b..150400f40534 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -178,6 +178,7 @@
 #define   MI_OVERLAY_OFF        (0x2<<21)
 #define MI_LOAD_SCAN_LINES_INCL MI_INSTR(0x12, 0)
 #define MI_DISPLAY_FLIP         MI_INSTR(0x14, 2)
+#define MI_DISPLAY_FLIP_I915    MI_INSTR(0x14, 1)
 #define   MI_DISPLAY_FLIP_PLANE(n) ((n) << 20)
 #define MI_STORE_DWORD_IMM      MI_INSTR(0x20, 1)
 #define   MI_MEM_VIRTUAL        (1 << 22) /* 965+ only */
@@ -368,6 +369,9 @@
 #define   CM0_RC_OP_FLUSH_DISABLE (1<<0)
 #define BB_ADDR         0x02140 /* 8 bytes */
 #define GFX_FLSH_CNTL   0x02170 /* 915+ only */
+#define ECOSKPD         0x021d0
+#define   ECO_GATING_CX_ONLY    (1<<3)
+#define   ECO_FLIP_DONE         (1<<0)
 
 /* GEN6 interrupt control */
 #define GEN6_RENDER_HWSTAM      0x2098
@@ -1130,7 +1134,6 @@
 #define CRT_HOTPLUG_DETECT_DELAY_2G             (1 << 4)
 #define CRT_HOTPLUG_DETECT_VOLTAGE_325MV        (0 << 2)
 #define CRT_HOTPLUG_DETECT_VOLTAGE_475MV        (1 << 2)
-#define CRT_HOTPLUG_MASK                        (0x3fc) /* Bits 9-2 */
 
 #define PORT_HOTPLUG_STAT       0x61114
 #define   HDMIB_HOTPLUG_INT_STATUS              (1 << 29)
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 22ff38455731..ee0732b222a1 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -234,14 +234,8 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
         else
                 tries = 1;
         hotplug_en = orig = I915_READ(PORT_HOTPLUG_EN);
-        hotplug_en &= CRT_HOTPLUG_MASK;
         hotplug_en |= CRT_HOTPLUG_FORCE_DETECT;
 
-        if (IS_G4X(dev))
-                hotplug_en |= CRT_HOTPLUG_ACTIVATION_PERIOD_64;
-
-        hotplug_en |= CRT_HOTPLUG_VOLTAGE_COMPARE_50;
-
         for (i = 0; i < tries ; i++) {
                 unsigned long timeout;
                 /* turn on the FORCE_DETECT */
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 04e1bb499ff8..68dcf36e2793 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2970,11 +2970,13 @@ static void i965_update_wm(struct drm_device *dev, int planea_clock,
                 if (srwm < 0)
                         srwm = 1;
                 srwm &= 0x3f;
-                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
+                if (IS_I965GM(dev))
+                        I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
         } else {
                 /* Turn off self refresh if both pipes are enabled */
-                I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
-                                        & ~FW_BLC_SELF_EN);
+                if (IS_I965GM(dev))
+                        I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
+                                   & ~FW_BLC_SELF_EN);
         }
 
         DRM_DEBUG_KMS("Setting FIFO watermarks - A: 8, B: 8, C: 8, SR %d\n",
@@ -3653,6 +3655,11 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                         pipeconf &= ~PIPEACONF_DOUBLE_WIDE;
         }
 
+        dspcntr |= DISPLAY_PLANE_ENABLE;
+        pipeconf |= PIPEACONF_ENABLE;
+        dpll |= DPLL_VCO_ENABLE;
+
+
         /* Disable the panel fitter if it was on our pipe */
         if (!HAS_PCH_SPLIT(dev) && intel_panel_fitter_pipe(dev) == pipe)
                 I915_WRITE(PFIT_CONTROL, 0);
@@ -4478,6 +4485,7 @@ static void intel_idle_update(struct work_struct *work)
         struct drm_device *dev = dev_priv->dev;
         struct drm_crtc *crtc;
         struct intel_crtc *intel_crtc;
+        int enabled = 0;
 
         if (!i915_powersave)
                 return;
@@ -4486,21 +4494,22 @@ static void intel_idle_update(struct work_struct *work)
 
         i915_update_gfx_val(dev_priv);
 
-        if (IS_I945G(dev) || IS_I945GM(dev)) {
-                DRM_DEBUG_DRIVER("enable memory self refresh on 945\n");
-                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN_MASK | FW_BLC_SELF_EN);
-        }
-
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                 /* Skip inactive CRTCs */
                 if (!crtc->fb)
                         continue;
 
+                enabled++;
                 intel_crtc = to_intel_crtc(crtc);
                 if (!intel_crtc->busy)
                         intel_decrease_pllclock(crtc);
         }
 
+        if ((enabled == 1) && (IS_I945G(dev) || IS_I945GM(dev))) {
+                DRM_DEBUG_DRIVER("enable memory self refresh on 945\n");
+                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN_MASK | FW_BLC_SELF_EN);
+        }
+
         mutex_unlock(&dev->struct_mutex);
 }
 
@@ -4596,10 +4605,10 @@ static void intel_unpin_work_fn(struct work_struct *__work)
         kfree(work);
 }
 
-void intel_finish_page_flip(struct drm_device *dev, int pipe)
+static void do_intel_finish_page_flip(struct drm_device *dev,
+                                      struct drm_crtc *crtc)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         struct intel_unpin_work *work;
         struct drm_i915_gem_object *obj_priv;
@@ -4643,6 +4652,22 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
         schedule_work(&work->work);
 }
 
+void intel_finish_page_flip(struct drm_device *dev, int pipe)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
+
+        do_intel_finish_page_flip(dev, crtc);
+}
+
+void intel_finish_page_flip_plane(struct drm_device *dev, int plane)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_crtc *crtc = dev_priv->plane_to_crtc_mapping[plane];
+
+        do_intel_finish_page_flip(dev, crtc);
+}
+
 void intel_prepare_page_flip(struct drm_device *dev, int plane)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
@@ -4673,6 +4698,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
         unsigned long flags;
         int pipesrc_reg = (intel_crtc->pipe == 0) ? PIPEASRC : PIPEBSRC;
         int ret, pipesrc;
+        u32 flip_mask;
 
         work = kzalloc(sizeof *work, GFP_KERNEL);
         if (work == NULL)
@@ -4726,15 +4752,28 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
         atomic_inc(&obj_priv->pending_flip);
         work->pending_flip_obj = obj;
 
+        if (intel_crtc->plane)
+                flip_mask = I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
+        else
+                flip_mask = I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT;
+
+        /* Wait for any previous flip to finish */
+        if (IS_GEN3(dev))
+                while (I915_READ(ISR) & flip_mask)
+                        ;
+
         BEGIN_LP_RING(4);
-        OUT_RING(MI_DISPLAY_FLIP |
-                 MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
-        OUT_RING(fb->pitch);
         if (IS_I965G(dev)) {
+                OUT_RING(MI_DISPLAY_FLIP |
+                         MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
+                OUT_RING(fb->pitch);
                 OUT_RING(obj_priv->gtt_offset | obj_priv->tiling_mode);
                 pipesrc = I915_READ(pipesrc_reg); 
                 OUT_RING(pipesrc & 0x0fff0fff);
         } else {
+                OUT_RING(MI_DISPLAY_FLIP_I915 |
+                         MI_DISPLAY_FLIP_PLANE(intel_crtc->plane));
+                OUT_RING(fb->pitch);
                 OUT_RING(obj_priv->gtt_offset);
                 OUT_RING(MI_NOOP);
         }
@@ -5470,7 +5509,6 @@ static void intel_init_display(struct drm_device *dev)
 void intel_modeset_init(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        int num_pipe;
         int i;
 
         drm_mode_config_init(dev);
@@ -5500,13 +5538,13 @@ void intel_modeset_init(struct drm_device *dev)
                 dev->mode_config.fb_base = pci_resource_start(dev->pdev, 0);
 
         if (IS_MOBILE(dev) || IS_I9XX(dev))
-                num_pipe = 2;
+                dev_priv->num_pipe = 2;
         else
-                num_pipe = 1;
+                dev_priv->num_pipe = 1;
         DRM_DEBUG_KMS("%d display pipe%s available.\n",
-                  num_pipe, num_pipe > 1 ? "s" : "");
+                      dev_priv->num_pipe, dev_priv->num_pipe > 1 ? "s" : "");
 
-        for (i = 0; i < num_pipe; i++) {
+        for (i = 0; i < dev_priv->num_pipe; i++) {
                 intel_crtc_init(dev, i);
         }
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 49b54f05d3cf..1aac59e83bff 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -136,6 +136,12 @@ intel_dp_link_required(struct drm_device *dev,
 }
 
 static int
+intel_dp_max_data_rate(int max_link_clock, int max_lanes)
+{
+        return (max_link_clock * max_lanes * 8) / 10;
+}
+
+static int
 intel_dp_mode_valid(struct drm_connector *connector,
                     struct drm_display_mode *mode)
 {
@@ -144,8 +150,11 @@ intel_dp_mode_valid(struct drm_connector *connector,
         int max_link_clock = intel_dp_link_clock(intel_dp_max_link_bw(intel_encoder));
         int max_lanes = intel_dp_max_lane_count(intel_encoder);
 
-        if (intel_dp_link_required(connector->dev, intel_encoder, mode->clock)
-                        > max_link_clock * max_lanes)
+        /* only refuse the mode on non eDP since we have seen some wierd eDP panels
+           which are outside spec tolerances but somehow work by magic */
+        if (!IS_eDP(intel_encoder) &&
+            (intel_dp_link_required(connector->dev, intel_encoder, mode->clock)
+             > intel_dp_max_data_rate(max_link_clock, max_lanes)))
                 return MODE_CLOCK_HIGH;
 
         if (mode->clock < 10000)
@@ -506,7 +515,7 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
 
         for (lane_count = 1; lane_count <= max_lane_count; lane_count <<= 1) {
                 for (clock = 0; clock <= max_clock; clock++) {
-                        int link_avail = intel_dp_link_clock(bws[clock]) * lane_count;
+                        int link_avail = intel_dp_max_data_rate(intel_dp_link_clock(bws[clock]), lane_count);
 
                         if (intel_dp_link_required(encoder->dev, intel_encoder, mode->clock)
                                         <= link_avail) {
@@ -521,6 +530,18 @@ intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
                         }
                 }
         }
+
+        if (IS_eDP(intel_encoder)) {
+                /* okay we failed just pick the highest */
+                dp_priv->lane_count = max_lane_count;
+                dp_priv->link_bw = bws[max_clock];
+                adjusted_mode->clock = intel_dp_link_clock(dp_priv->link_bw);
+                DRM_DEBUG_KMS("Force picking display port link bw %02x lane "
+                              "count %d clock %d\n",
+                              dp_priv->link_bw, dp_priv->lane_count,
+                              adjusted_mode->clock);
+                return true;
+        }
         return false;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index df931f787665..72206f37c4fb 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -224,6 +224,7 @@ extern void intel_fbdev_fini(struct drm_device *dev);
 
 extern void intel_prepare_page_flip(struct drm_device *dev, int plane);
 extern void intel_finish_page_flip(struct drm_device *dev, int pipe);
+extern void intel_finish_page_flip_plane(struct drm_device *dev, int plane);
 
 extern void intel_setup_overlay(struct drm_device *dev);
 extern void intel_cleanup_overlay(struct drm_device *dev);
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index f8c76e64bb77..c3c505244e07 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -245,6 +245,7 @@ int intel_fbdev_init(struct drm_device *dev)
 {
         struct intel_fbdev *ifbdev;
         drm_i915_private_t *dev_priv = dev->dev_private;
+        int ret;
 
         ifbdev = kzalloc(sizeof(struct intel_fbdev), GFP_KERNEL);
         if (!ifbdev)
@@ -253,8 +254,13 @@ int intel_fbdev_init(struct drm_device *dev)
         dev_priv->fbdev = ifbdev;
         ifbdev->helper.funcs = &intel_fb_helper_funcs;
 
-        drm_fb_helper_init(dev, &ifbdev->helper, 2,
-                           INTELFB_CONN_LIMIT);
+        ret = drm_fb_helper_init(dev, &ifbdev->helper,
+                                 dev_priv->num_pipe,
+                                 INTELFB_CONN_LIMIT);
+        if (ret) {
+                kfree(ifbdev);
+                return ret;
+        }
 
         drm_fb_helper_single_add_all_connectors(&ifbdev->helper);
         drm_fb_helper_initial_config(&ifbdev->helper, 32);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 6a1accd83aec..31df55f0a0a7 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -983,8 +983,8 @@ void intel_lvds_init(struct drm_device *dev)
 
         drm_connector_attach_property(&intel_connector->base,
                                       dev->mode_config.scaling_mode_property,
-                                      DRM_MODE_SCALE_FULLSCREEN);
-        lvds_priv->fitting_mode = DRM_MODE_SCALE_FULLSCREEN;
+                                      DRM_MODE_SCALE_ASPECT);
+        lvds_priv->fitting_mode = DRM_MODE_SCALE_ASPECT;
         /*
          * LVDS discovery:
          * 1) check for EDID on DDC
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index cea4f1a8709e..26362f8495a8 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -94,7 +94,7 @@ render_ring_flush(struct drm_device *dev,
 #if WATCH_EXEC
                 DRM_INFO("%s: queue flush %08x to ring\n", __func__, cmd);
 #endif
-                intel_ring_begin(dev, ring, 8);
+                intel_ring_begin(dev, ring, 2);
                 intel_ring_emit(dev, ring, cmd);
                 intel_ring_emit(dev, ring, MI_NOOP);
                 intel_ring_advance(dev, ring);
@@ -358,7 +358,7 @@ bsd_ring_flush(struct drm_device *dev,
                 u32     invalidate_domains,
                 u32     flush_domains)
 {
-        intel_ring_begin(dev, ring, 8);
+        intel_ring_begin(dev, ring, 2);
         intel_ring_emit(dev, ring, MI_FLUSH);
         intel_ring_emit(dev, ring, MI_NOOP);
         intel_ring_advance(dev, ring);
@@ -687,6 +687,7 @@ int intel_wrap_ring_buffer(struct drm_device *dev,
                 *virt++ = MI_NOOP;
 
         ring->tail = 0;
+        ring->space = ring->head - 8;
 
         return 0;
 }
@@ -721,8 +722,9 @@ int intel_wait_ring_buffer(struct drm_device *dev,
 }
 
 void intel_ring_begin(struct drm_device *dev,
-                struct intel_ring_buffer *ring, int n)
+                struct intel_ring_buffer *ring, int num_dwords)
 {
+        int n = 4*num_dwords;
         if (unlikely(ring->tail + n > ring->size))
                 intel_wrap_ring_buffer(dev, ring);
         if (unlikely(ring->space < n))
@@ -752,7 +754,7 @@ void intel_fill_struct(struct drm_device *dev,
 {
         unsigned int *virt = ring->virtual_start + ring->tail;
         BUG_ON((len&~(4-1)) != 0);
-        intel_ring_begin(dev, ring, len);
+        intel_ring_begin(dev, ring, len/4);
         memcpy(virt, data, len);
         ring->tail += len;
         ring->tail &= ring->size - 1;
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index 9ba2deaadcc7..fc924b649195 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -834,7 +834,7 @@ init_i2c_device_find(struct drm_device *dev, int i2c_index)
         if (i2c_index == 0x81)
                 i2c_index = (dcb->i2c_default_indices & 0xf0) >> 4;
 
-        if (i2c_index > DCB_MAX_NUM_I2C_ENTRIES) {
+        if (i2c_index >= DCB_MAX_NUM_I2C_ENTRIES) {
                 NV_ERROR(dev, "invalid i2c_index 0x%x\n", i2c_index);
                 return NULL;
         }
@@ -3920,7 +3920,8 @@ int nouveau_bios_parse_lvds_table(struct drm_device *dev, int pxclk, bool *dl, b
 
 static uint8_t *
 bios_output_config_match(struct drm_device *dev, struct dcb_entry *dcbent,
-                         uint16_t record, int record_len, int record_nr)
+                         uint16_t record, int record_len, int record_nr,
+                         bool match_link)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
         struct nvbios *bios = &dev_priv->vbios;
@@ -3928,12 +3929,28 @@ bios_output_config_match(struct drm_device *dev, struct dcb_entry *dcbent,
         uint16_t table;
         int i, v;
 
+        switch (dcbent->type) {
+        case OUTPUT_TMDS:
+        case OUTPUT_LVDS:
+        case OUTPUT_DP:
+                break;
+        default:
+                match_link = false;
+                break;
+        }
+
         for (i = 0; i < record_nr; i++, record += record_len) {
                 table = ROM16(bios->data[record]);
                 if (!table)
                         continue;
                 entry = ROM32(bios->data[table]);
 
+                if (match_link) {
+                        v = (entry & 0x00c00000) >> 22;
+                        if (!(v & dcbent->sorconf.link))
+                                continue;
+                }
+
                 v = (entry & 0x000f0000) >> 16;
                 if (!(v & dcbent->or))
                         continue;
@@ -3975,7 +3992,7 @@ nouveau_bios_dp_table(struct drm_device *dev, struct dcb_entry *dcbent,
         *length = table[4];
         return bios_output_config_match(dev, dcbent,
                                         bios->display.dp_table_ptr + table[1],
-                                        table[2], table[3]);
+                                        table[2], table[3], table[0] >= 0x21);
 }
 
 int
@@ -4064,7 +4081,7 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                         dcbent->type, dcbent->location, dcbent->or);
         otable = bios_output_config_match(dev, dcbent, table[1] +
                                           bios->display.script_table_ptr,
-                                          table[2], table[3]);
+                                          table[2], table[3], table[0] >= 0x21);
         if (!otable) {
                 NV_ERROR(dev, "Couldn't find matching output script table\n");
                 return 1;
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index fd4a2df715e9..c9a4a0d2a115 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -377,6 +377,7 @@ int nouveau_fbcon_init(struct drm_device *dev)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
         struct nouveau_fbdev *nfbdev;
+        int ret;
 
         nfbdev = kzalloc(sizeof(struct nouveau_fbdev), GFP_KERNEL);
         if (!nfbdev)
@@ -386,7 +387,12 @@ int nouveau_fbcon_init(struct drm_device *dev)
         dev_priv->nfbdev = nfbdev;
         nfbdev->helper.funcs = &nouveau_fbcon_helper_funcs;
 
-        drm_fb_helper_init(dev, &nfbdev->helper, 2, 4);
+        ret = drm_fb_helper_init(dev, &nfbdev->helper, 2, 4);
+        if (ret) {
+                kfree(nfbdev);
+                return ret;
+        }
+
         drm_fb_helper_single_add_all_connectors(&nfbdev->helper);
         drm_fb_helper_initial_config(&nfbdev->helper, 32);
         return 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
index 147e59c40151..b02a231d6937 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -779,29 +779,24 @@ int nouveau_load(struct drm_device *dev, unsigned long flags)
                         return ret;
         }
 
-        /* map larger RAMIN aperture on NV40 cards */
-        dev_priv->ramin  = NULL;
+        /* Map PRAMIN BAR, or on older cards, the aperture withing BAR0 */
         if (dev_priv->card_type >= NV_40) {
                 int ramin_bar = 2;
                 if (pci_resource_len(dev->pdev, ramin_bar) == 0)
                         ramin_bar = 3;
 
                 dev_priv->ramin_size = pci_resource_len(dev->pdev, ramin_bar);
-                dev_priv->ramin = ioremap(
-                                pci_resource_start(dev->pdev, ramin_bar),
+                dev_priv->ramin =
+                        ioremap(pci_resource_start(dev->pdev, ramin_bar),
                                 dev_priv->ramin_size);
                 if (!dev_priv->ramin) {
-                        NV_ERROR(dev, "Failed to init RAMIN mapping, "
-                                      "limited instance memory available\n");
+                        NV_ERROR(dev, "Failed to PRAMIN BAR");
+                        return -ENOMEM;
                 }
-        }
-
-        /* On older cards (or if the above failed), create a map covering
-         * the BAR0 PRAMIN aperture */
-        if (!dev_priv->ramin) {
+        } else {
                 dev_priv->ramin_size = 1 * 1024 * 1024;
                 dev_priv->ramin = ioremap(mmio_start_offs + NV_RAMIN,
-                                                        dev_priv->ramin_size);
+                                          dev_priv->ramin_size);
                 if (!dev_priv->ramin) {
                         NV_ERROR(dev, "Failed to map BAR0 PRAMIN.\n");
                         return -ENOMEM;
diff --git a/drivers/gpu/drm/nouveau/nv50_fb.c b/drivers/gpu/drm/nouveau/nv50_fb.c
index a95e6941ba88..32611bd30e6d 100644
--- a/drivers/gpu/drm/nouveau/nv50_fb.c
+++ b/drivers/gpu/drm/nouveau/nv50_fb.c
@@ -6,10 +6,16 @@
 int
 nv50_fb_init(struct drm_device *dev)
 {
-        /* This is needed to get meaningful information from 100c90
-         * on traps. No idea what these values mean exactly. */
         struct drm_nouveau_private *dev_priv = dev->dev_private;
 
+        /* Not a clue what this is exactly.  Without pointing it at a
+         * scratch page, VRAM->GART blits with M2MF (as in DDX DFS)
+         * cause IOMMU "read from address 0" errors (rh#561267)
+         */
+        nv_wr32(dev, 0x100c08, dev_priv->gart_info.sg_dummy_bus >> 8);
+
+        /* This is needed to get meaningful information from 100c90
+         * on traps. No idea what these values mean exactly. */
         switch (dev_priv->chipset) {
         case 0x50:
                 nv_wr32(dev, 0x100c90, 0x0707ff);
diff --git a/drivers/gpu/drm/nouveau/nv50_gpio.c b/drivers/gpu/drm/nouveau/nv50_gpio.c
index c61782b314e7..bb47ad737267 100644
--- a/drivers/gpu/drm/nouveau/nv50_gpio.c
+++ b/drivers/gpu/drm/nouveau/nv50_gpio.c
@@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t *reg, uint32_t *shift)
 {
         const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
 
-        if (gpio->line > 32)
+        if (gpio->line >= 32)
                 return -EINVAL;
 
         *reg = nv50_gpio_reg[gpio->line >> 3];
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index f3f2827017ef..8c2d6478a221 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -498,7 +498,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                 if ((rdev->family == CHIP_RS600) ||
                     (rdev->family == CHIP_RS690) ||
                     (rdev->family == CHIP_RS740))
-                        pll->flags |= (RADEON_PLL_USE_FRAC_FB_DIV |
+                        pll->flags |= (/*RADEON_PLL_USE_FRAC_FB_DIV |*/
                                        RADEON_PLL_PREFER_CLOSEST_LOWER);
 
                 if (ASIC_IS_DCE32(rdev) && mode->clock > 200000)        /* range limits??? */
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 0440c0939bdd..1caf625e472b 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -41,12 +41,18 @@ void evergreen_fini(struct radeon_device *rdev);
 
 void evergreen_pm_misc(struct radeon_device *rdev)
 {
-        int requested_index = rdev->pm.requested_power_state_index;
-        struct radeon_power_state *ps = &rdev->pm.power_state[requested_index];
-        struct radeon_voltage *voltage = &ps->clock_info[0].voltage;
-
-        if ((voltage->type == VOLTAGE_SW) && voltage->voltage)
-                radeon_atom_set_voltage(rdev, voltage->voltage);
+        int req_ps_idx = rdev->pm.requested_power_state_index;
+        int req_cm_idx = rdev->pm.requested_clock_mode_index;
+        struct radeon_power_state *ps = &rdev->pm.power_state[req_ps_idx];
+        struct radeon_voltage *voltage = &ps->clock_info[req_cm_idx].voltage;
+
+        if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
+                if (voltage->voltage != rdev->pm.current_vddc) {
+                        radeon_atom_set_voltage(rdev, voltage->voltage);
+                        rdev->pm.current_vddc = voltage->voltage;
+                        DRM_DEBUG("Setting: v: %d\n", voltage->voltage);
+                }
+        }
 }
 
 void evergreen_pm_prepare(struct radeon_device *rdev)
@@ -601,7 +607,7 @@ static void evergreen_mc_program(struct radeon_device *rdev)
         WREG32(MC_VM_FB_LOCATION, tmp);
         WREG32(HDP_NONSURFACE_BASE, (rdev->mc.vram_start >> 8));
         WREG32(HDP_NONSURFACE_INFO, (2 << 7));
-        WREG32(HDP_NONSURFACE_SIZE, (rdev->mc.mc_vram_size - 1) | 0x3FF);
+        WREG32(HDP_NONSURFACE_SIZE, 0x3FFFFFFF);
         if (rdev->flags & RADEON_IS_AGP) {
                 WREG32(MC_VM_AGP_TOP, rdev->mc.gtt_end >> 16);
                 WREG32(MC_VM_AGP_BOT, rdev->mc.gtt_start >> 16);
@@ -1216,11 +1222,11 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
                 ps_thread_count = 128;
 
         sq_thread_resource_mgmt = NUM_PS_THREADS(ps_thread_count);
-        sq_thread_resource_mgmt |= NUM_VS_THREADS(((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8;
-        sq_thread_resource_mgmt |= NUM_GS_THREADS(((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8;
-        sq_thread_resource_mgmt |= NUM_ES_THREADS(((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8;
-        sq_thread_resource_mgmt_2 = NUM_HS_THREADS(((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8;
-        sq_thread_resource_mgmt_2 |= NUM_LS_THREADS(((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8;
+        sq_thread_resource_mgmt |= NUM_VS_THREADS((((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8);
+        sq_thread_resource_mgmt |= NUM_GS_THREADS((((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8);
+        sq_thread_resource_mgmt |= NUM_ES_THREADS((((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8);
+        sq_thread_resource_mgmt_2 = NUM_HS_THREADS((((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8);
+        sq_thread_resource_mgmt_2 |= NUM_LS_THREADS((((rdev->config.evergreen.max_threads - ps_thread_count) / 6) / 8) * 8);
 
         sq_stack_resource_mgmt_1 = NUM_PS_STACK_ENTRIES((rdev->config.evergreen.max_stack_entries * 1) / 6);
         sq_stack_resource_mgmt_1 |= NUM_VS_STACK_ENTRIES((rdev->config.evergreen.max_stack_entries * 1) / 6);
@@ -1254,6 +1260,9 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         WREG32(VGT_GS_VERTEX_REUSE, 16);
         WREG32(PA_SC_LINE_STIPPLE_STATE, 0);
 
+        WREG32(VGT_VERTEX_REUSE_BLOCK_CNTL, 14);
+        WREG32(VGT_OUT_DEALLOC_CNTL, 16);
+
         WREG32(CB_PERF_CTR0_SEL_0, 0);
         WREG32(CB_PERF_CTR0_SEL_1, 0);
         WREG32(CB_PERF_CTR1_SEL_0, 0);
@@ -1263,6 +1272,26 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         WREG32(CB_PERF_CTR3_SEL_0, 0);
         WREG32(CB_PERF_CTR3_SEL_1, 0);
 
+        /* clear render buffer base addresses */
+        WREG32(CB_COLOR0_BASE, 0);
+        WREG32(CB_COLOR1_BASE, 0);
+        WREG32(CB_COLOR2_BASE, 0);
+        WREG32(CB_COLOR3_BASE, 0);
+        WREG32(CB_COLOR4_BASE, 0);
+        WREG32(CB_COLOR5_BASE, 0);
+        WREG32(CB_COLOR6_BASE, 0);
+        WREG32(CB_COLOR7_BASE, 0);
+        WREG32(CB_COLOR8_BASE, 0);
+        WREG32(CB_COLOR9_BASE, 0);
+        WREG32(CB_COLOR10_BASE, 0);
+        WREG32(CB_COLOR11_BASE, 0);
+
+        /* set the shader const cache sizes to 0 */
+        for (i = SQ_ALU_CONST_BUFFER_SIZE_PS_0; i < 0x28200; i += 4)
+                WREG32(i, 0);
+        for (i = SQ_ALU_CONST_BUFFER_SIZE_HS_0; i < 0x29000; i += 4)
+                WREG32(i, 0);
+
         hdp_host_path_cntl = RREG32(HDP_HOST_PATH_CNTL);
         WREG32(HDP_HOST_PATH_CNTL, hdp_host_path_cntl);
 
@@ -2153,7 +2182,7 @@ int evergreen_init(struct radeon_device *rdev)
         if (r)
                 return r;
 
-        rdev->accel_working = false;
+        rdev->accel_working = true;
         r = evergreen_startup(rdev);
         if (r) {
                 dev_err(rdev->dev, "disabling GPU acceleration\n");
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 64516b950891..010963d4570f 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -1197,7 +1197,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                         DRM_ERROR("bad SET_RESOURCE (tex)\n");
                                         return -EINVAL;
                                 }
-                                ib[idx+1+(i*8)+3] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                                ib[idx+1+(i*8)+2] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
                                 if (reloc->lobj.tiling_flags & RADEON_TILING_MACRO)
                                         ib[idx+1+(i*8)+1] |= TEX_ARRAY_MODE(ARRAY_2D_TILED_THIN1);
                                 else if (reloc->lobj.tiling_flags & RADEON_TILING_MICRO)
@@ -1209,7 +1209,7 @@ static int evergreen_packet3_check(struct radeon_cs_parser *p,
                                         DRM_ERROR("bad SET_RESOURCE (tex)\n");
                                         return -EINVAL;
                                 }
-                                ib[idx+1+(i*8)+4] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
+                                ib[idx+1+(i*8)+3] += (u32)((reloc->lobj.gpu_offset >> 8) & 0xffffffff);
                                 mipmap = reloc->robj;
                                 r = evergreen_check_texture_resource(p,  idx+1+(i*8),
                                                 texture, mipmap);
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index 79683f6b4452..a1cd621780e2 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -713,6 +713,9 @@
 #define SQ_GSVS_RING_OFFSET_2                           0x28930
 #define SQ_GSVS_RING_OFFSET_3                           0x28934
 
+#define SQ_ALU_CONST_BUFFER_SIZE_PS_0                   0x28140
+#define SQ_ALU_CONST_BUFFER_SIZE_HS_0                   0x28f80
+
 #define SQ_ALU_CONST_CACHE_PS_0                         0x28940
 #define SQ_ALU_CONST_CACHE_PS_1                         0x28944
 #define SQ_ALU_CONST_CACHE_PS_2                         0x28948
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index cc004b05d63e..3970e62eaab8 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -162,6 +162,11 @@ void r100_pm_init_profile(struct radeon_device *rdev)
         rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_ps_idx = 0;
         rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_off_cm_idx = 0;
         rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_cm_idx = 0;
+        /* mid sh */
+        rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_ps_idx = 0;
+        rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_ps_idx = 0;
+        rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_cm_idx = 0;
+        rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_cm_idx = 0;
         /* high sh */
         rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_off_ps_idx = 0;
         rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
@@ -172,6 +177,11 @@ void r100_pm_init_profile(struct radeon_device *rdev)
         rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
         rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_off_cm_idx = 0;
         rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_cm_idx = 0;
+        /* mid mh */
+        rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_ps_idx = 0;
+        rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
+        rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_cm_idx = 0;
+        rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_cm_idx = 0;
         /* high mh */
         rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_off_ps_idx = 0;
         rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
@@ -1618,6 +1628,7 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                 case RADEON_TXFORMAT_RGB332:
                 case RADEON_TXFORMAT_Y8:
                         track->textures[i].cpp = 1;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case RADEON_TXFORMAT_AI88:
                 case RADEON_TXFORMAT_ARGB1555:
@@ -1629,12 +1640,14 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                 case RADEON_TXFORMAT_LDUDV655:
                 case RADEON_TXFORMAT_DUDV88:
                         track->textures[i].cpp = 2;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case RADEON_TXFORMAT_ARGB8888:
                 case RADEON_TXFORMAT_RGBA8888:
                 case RADEON_TXFORMAT_SHADOW32:
                 case RADEON_TXFORMAT_LDUDUV8888:
                         track->textures[i].cpp = 4;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case RADEON_TXFORMAT_DXT1:
                         track->textures[i].cpp = 1;
@@ -2594,12 +2607,6 @@ int r100_set_surface_reg(struct radeon_device *rdev, int reg,
         int surf_index = reg * 16;
         int flags = 0;
 
-        /* r100/r200 divide by 16 */
-        if (rdev->family < CHIP_R300)
-                flags = pitch / 16;
-        else
-                flags = pitch / 8;
-
         if (rdev->family <= CHIP_RS200) {
                 if ((tiling_flags & (RADEON_TILING_MACRO|RADEON_TILING_MICRO))
                                  == (RADEON_TILING_MACRO|RADEON_TILING_MICRO))
@@ -2623,6 +2630,20 @@ int r100_set_surface_reg(struct radeon_device *rdev, int reg,
         if (tiling_flags & RADEON_TILING_SWAP_32BIT)
                 flags |= RADEON_SURF_AP0_SWP_32BPP | RADEON_SURF_AP1_SWP_32BPP;
 
+        /* when we aren't tiling the pitch seems to needs to be furtherdivided down. - tested on power5 + rn50 server */
+        if (tiling_flags & (RADEON_TILING_SWAP_16BIT | RADEON_TILING_SWAP_32BIT)) {
+                if (!(tiling_flags & (RADEON_TILING_MACRO | RADEON_TILING_MICRO)))
+                        if (ASIC_IS_RN50(rdev))
+                                pitch /= 16;
+        }
+
+        /* r100/r200 divide by 16 */
+        if (rdev->family < CHIP_R300)
+                flags |= pitch / 16;
+        else
+                flags |= pitch / 8;
+
+
         DRM_DEBUG("writing surface %d %d %x %x\n", reg, flags, offset, offset+obj_size-1);
         WREG32(RADEON_SURFACE0_INFO + surf_index, flags);
         WREG32(RADEON_SURFACE0_LOWER_BOUND + surf_index, offset);
@@ -3137,33 +3158,6 @@ static inline void r100_cs_track_texture_print(struct r100_cs_track_texture *t)
         DRM_ERROR("compress format            %d\n", t->compress_format);
 }
 
-static int r100_cs_track_cube(struct radeon_device *rdev,
-                              struct r100_cs_track *track, unsigned idx)
-{
-        unsigned face, w, h;
-        struct radeon_bo *cube_robj;
-        unsigned long size;
-
-        for (face = 0; face < 5; face++) {
-                cube_robj = track->textures[idx].cube_info[face].robj;
-                w = track->textures[idx].cube_info[face].width;
-                h = track->textures[idx].cube_info[face].height;
-
-                size = w * h;
-                size *= track->textures[idx].cpp;
-
-                size += track->textures[idx].cube_info[face].offset;
-
-                if (size > radeon_bo_size(cube_robj)) {
-                        DRM_ERROR("Cube texture offset greater than object size %lu %lu\n",
-                                  size, radeon_bo_size(cube_robj));
-                        r100_cs_track_texture_print(&track->textures[idx]);
-                        return -1;
-                }
-        }
-        return 0;
-}
-
 static int r100_track_compress_size(int compress_format, int w, int h)
 {
         int block_width, block_height, block_bytes;
@@ -3194,6 +3188,37 @@ static int r100_track_compress_size(int compress_format, int w, int h)
         return sz;
 }
 
+static int r100_cs_track_cube(struct radeon_device *rdev,
+                              struct r100_cs_track *track, unsigned idx)
+{
+        unsigned face, w, h;
+        struct radeon_bo *cube_robj;
+        unsigned long size;
+        unsigned compress_format = track->textures[idx].compress_format;
+
+        for (face = 0; face < 5; face++) {
+                cube_robj = track->textures[idx].cube_info[face].robj;
+                w = track->textures[idx].cube_info[face].width;
+                h = track->textures[idx].cube_info[face].height;
+
+                if (compress_format) {
+                        size = r100_track_compress_size(compress_format, w, h);
+                } else
+                        size = w * h;
+                size *= track->textures[idx].cpp;
+
+                size += track->textures[idx].cube_info[face].offset;
+
+                if (size > radeon_bo_size(cube_robj)) {
+                        DRM_ERROR("Cube texture offset greater than object size %lu %lu\n",
+                                  size, radeon_bo_size(cube_robj));
+                        r100_cs_track_texture_print(&track->textures[idx]);
+                        return -1;
+                }
+        }
+        return 0;
+}
+
 static int r100_cs_track_texture_check(struct radeon_device *rdev,
                                        struct r100_cs_track *track)
 {
diff --git a/drivers/gpu/drm/radeon/r200.c b/drivers/gpu/drm/radeon/r200.c
index 85617c311212..0266d72e0a4c 100644
--- a/drivers/gpu/drm/radeon/r200.c
+++ b/drivers/gpu/drm/radeon/r200.c
@@ -415,6 +415,8 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                 /* 2D, 3D, CUBE */
                 switch (tmp) {
                 case 0:
+                case 3:
+                case 4:
                 case 5:
                 case 6:
                 case 7:
@@ -450,6 +452,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                 case R200_TXFORMAT_RGB332:
                 case R200_TXFORMAT_Y8:
                         track->textures[i].cpp = 1;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R200_TXFORMAT_AI88:
                 case R200_TXFORMAT_ARGB1555:
@@ -461,6 +464,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                 case R200_TXFORMAT_DVDU88:
                 case R200_TXFORMAT_AVYU4444:
                         track->textures[i].cpp = 2;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R200_TXFORMAT_ARGB8888:
                 case R200_TXFORMAT_RGBA8888:
@@ -468,6 +472,7 @@ int r200_packet0_check(struct radeon_cs_parser *p,
                 case R200_TXFORMAT_BGR111110:
                 case R200_TXFORMAT_LDVDU8888:
                         track->textures[i].cpp = 4;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R200_TXFORMAT_DXT1:
                         track->textures[i].cpp = 1;
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index b2f9efe2897c..7e81db5eb804 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -881,6 +881,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 case R300_TX_FORMAT_Y4X4:
                 case R300_TX_FORMAT_Z3Y3X2:
                         track->textures[i].cpp = 1;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R300_TX_FORMAT_X16:
                 case R300_TX_FORMAT_Y8X8:
@@ -892,6 +893,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 case R300_TX_FORMAT_B8G8_B8G8:
                 case R300_TX_FORMAT_G8R8_G8B8:
                         track->textures[i].cpp = 2;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R300_TX_FORMAT_Y16X16:
                 case R300_TX_FORMAT_Z11Y11X10:
@@ -902,14 +904,17 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 case R300_TX_FORMAT_FL_I32:
                 case 0x1e:
                         track->textures[i].cpp = 4;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R300_TX_FORMAT_W16Z16Y16X16:
                 case R300_TX_FORMAT_FL_R16G16B16A16:
                 case R300_TX_FORMAT_FL_I32A32:
                         track->textures[i].cpp = 8;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R300_TX_FORMAT_FL_R32G32B32A32:
                         track->textures[i].cpp = 16;
+                        track->textures[i].compress_format = R100_TRACK_COMP_NONE;
                         break;
                 case R300_TX_FORMAT_DXT1:
                         track->textures[i].cpp = 1;
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 4415a5ee5871..e6c89142bb4d 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -45,9 +45,14 @@ void r420_pm_init_profile(struct radeon_device *rdev)
         rdev->pm.profiles[PM_PROFILE_DEFAULT_IDX].dpms_on_cm_idx = 0;
         /* low sh */
         rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_off_ps_idx = 0;
-        rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_ps_idx = 1;
+        rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_ps_idx = 0;
         rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_off_cm_idx = 0;
         rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_cm_idx = 0;
+        /* mid sh */
+        rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_ps_idx = 0;
+        rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_ps_idx = 1;
+        rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_cm_idx = 0;
+        rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_cm_idx = 0;
         /* high sh */
         rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_off_ps_idx = 0;
         rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
@@ -58,6 +63,11 @@ void r420_pm_init_profile(struct radeon_device *rdev)
         rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
         rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_off_cm_idx = 0;
         rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_cm_idx = 0;
+        /* mid mh */
+        rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_ps_idx = 0;
+        rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
+        rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_cm_idx = 0;
+        rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_cm_idx = 0;
         /* high mh */
         rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_off_ps_idx = 0;
         rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index e14f59748e65..3d6645ce2151 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -130,9 +130,14 @@ void r600_pm_get_dynpm_state(struct radeon_device *rdev)
                                                         break;
                                                 }
                                         }
-                                } else
-                                        rdev->pm.requested_power_state_index =
-                                                rdev->pm.current_power_state_index - 1;
+                                } else {
+                                        if (rdev->pm.current_power_state_index == 0)
+                                                rdev->pm.requested_power_state_index =
+                                                        rdev->pm.num_power_states - 1;
+                                        else
+                                                rdev->pm.requested_power_state_index =
+                                                        rdev->pm.current_power_state_index - 1;
+                                }
                         }
                         rdev->pm.requested_clock_mode_index = 0;
                         /* don't use the power state if crtcs are active and no display flag is set */
@@ -291,6 +296,11 @@ void rs780_pm_init_profile(struct radeon_device *rdev)
                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_ps_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_off_cm_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_cm_idx = 0;
+                /* mid sh */
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_ps_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_ps_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_cm_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_cm_idx = 0;
                 /* high sh */
                 rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_off_ps_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_on_ps_idx = 1;
@@ -301,6 +311,11 @@ void rs780_pm_init_profile(struct radeon_device *rdev)
                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_ps_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_off_cm_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_cm_idx = 0;
+                /* mid mh */
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_ps_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_ps_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_cm_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_cm_idx = 0;
                 /* high mh */
                 rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_off_ps_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_on_ps_idx = 1;
@@ -317,6 +332,11 @@ void rs780_pm_init_profile(struct radeon_device *rdev)
                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_ps_idx = 1;
                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_off_cm_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_cm_idx = 0;
+                /* mid sh */
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_ps_idx = 1;
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_ps_idx = 1;
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_cm_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_cm_idx = 0;
                 /* high sh */
                 rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_off_ps_idx = 1;
                 rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_on_ps_idx = 2;
@@ -327,6 +347,11 @@ void rs780_pm_init_profile(struct radeon_device *rdev)
                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_ps_idx = 1;
                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_off_cm_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_cm_idx = 0;
+                /* mid mh */
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_ps_idx = 1;
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_ps_idx = 1;
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_cm_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_cm_idx = 0;
                 /* high mh */
                 rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_off_ps_idx = 1;
                 rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_on_ps_idx = 2;
@@ -343,6 +368,11 @@ void rs780_pm_init_profile(struct radeon_device *rdev)
                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_ps_idx = 2;
                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_off_cm_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_cm_idx = 0;
+                /* mid sh */
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_ps_idx = 2;
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_ps_idx = 2;
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_cm_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_cm_idx = 0;
                 /* high sh */
                 rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_off_ps_idx = 2;
                 rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_on_ps_idx = 3;
@@ -353,6 +383,11 @@ void rs780_pm_init_profile(struct radeon_device *rdev)
                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_ps_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_off_cm_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_cm_idx = 0;
+                /* mid mh */
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_ps_idx = 2;
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_ps_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_cm_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_cm_idx = 0;
                 /* high mh */
                 rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_off_ps_idx = 2;
                 rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_on_ps_idx = 3;
@@ -375,6 +410,11 @@ void r600_pm_init_profile(struct radeon_device *rdev)
                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_off_cm_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_cm_idx = 0;
+                /* mid sh */
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_ps_idx = rdev->pm.default_power_state_index;
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_cm_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_cm_idx = 0;
                 /* high sh */
                 rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_off_ps_idx = rdev->pm.default_power_state_index;
                 rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
@@ -385,6 +425,11 @@ void r600_pm_init_profile(struct radeon_device *rdev)
                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_off_cm_idx = 0;
                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_cm_idx = 0;
+                /* mid mh */
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_ps_idx = rdev->pm.default_power_state_index;
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_cm_idx = 0;
+                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_cm_idx = 0;
                 /* high mh */
                 rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_off_ps_idx = rdev->pm.default_power_state_index;
                 rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_on_ps_idx = rdev->pm.default_power_state_index;
@@ -401,7 +446,12 @@ void r600_pm_init_profile(struct radeon_device *rdev)
                         rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_off_ps_idx = 1;
                         rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_ps_idx = 1;
                         rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_off_cm_idx = 0;
-                        rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_cm_idx = 1;
+                        rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_cm_idx = 0;
+                        /* mid sh */
+                        rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_ps_idx = 1;
+                        rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_ps_idx = 1;
+                        rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_cm_idx = 0;
+                        rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_cm_idx = 1;
                         /* high sh */
                         rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_off_ps_idx = 1;
                         rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_on_ps_idx = 1;
@@ -411,7 +461,12 @@ void r600_pm_init_profile(struct radeon_device *rdev)
                         rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_off_ps_idx = 2;
                         rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_ps_idx = 2;
                         rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_off_cm_idx = 0;
-                        rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_cm_idx = 1;
+                        rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_cm_idx = 0;
+                        /* low mh */
+                        rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_ps_idx = 2;
+                        rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_ps_idx = 2;
+                        rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_cm_idx = 0;
+                        rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_cm_idx = 1;
                         /* high mh */
                         rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_off_ps_idx = 2;
                         rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_on_ps_idx = 2;
@@ -430,14 +485,30 @@ void r600_pm_init_profile(struct radeon_device *rdev)
                                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_ps_idx =
                                         r600_pm_get_type_index(rdev, POWER_STATE_TYPE_BATTERY, 0);
                                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_off_cm_idx = 0;
-                                rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_cm_idx = 1;
+                                rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_cm_idx = 0;
                         } else {
                                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_off_ps_idx =
                                         r600_pm_get_type_index(rdev, POWER_STATE_TYPE_PERFORMANCE, 0);
                                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_ps_idx =
                                         r600_pm_get_type_index(rdev, POWER_STATE_TYPE_PERFORMANCE, 0);
                                 rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_off_cm_idx = 0;
-                                rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_cm_idx = 1;
+                                rdev->pm.profiles[PM_PROFILE_LOW_SH_IDX].dpms_on_cm_idx = 0;
+                        }
+                        /* mid sh */
+                        if (rdev->flags & RADEON_IS_MOBILITY) {
+                                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_ps_idx =
+                                        r600_pm_get_type_index(rdev, POWER_STATE_TYPE_BATTERY, 0);
+                                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_ps_idx =
+                                        r600_pm_get_type_index(rdev, POWER_STATE_TYPE_BATTERY, 0);
+                                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_cm_idx = 0;
+                                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_cm_idx = 1;
+                        } else {
+                                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_ps_idx =
+                                        r600_pm_get_type_index(rdev, POWER_STATE_TYPE_PERFORMANCE, 0);
+                                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_ps_idx =
+                                        r600_pm_get_type_index(rdev, POWER_STATE_TYPE_PERFORMANCE, 0);
+                                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_off_cm_idx = 0;
+                                rdev->pm.profiles[PM_PROFILE_MID_SH_IDX].dpms_on_cm_idx = 1;
                         }
                         /* high sh */
                         rdev->pm.profiles[PM_PROFILE_HIGH_SH_IDX].dpms_off_ps_idx =
@@ -453,14 +524,30 @@ void r600_pm_init_profile(struct radeon_device *rdev)
                                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_ps_idx =
                                         r600_pm_get_type_index(rdev, POWER_STATE_TYPE_BATTERY, 1);
                                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_off_cm_idx = 0;
-                                rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_cm_idx = 2;
+                                rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_cm_idx = 0;
                         } else {
                                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_off_ps_idx =
                                         r600_pm_get_type_index(rdev, POWER_STATE_TYPE_PERFORMANCE, 1);
                                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_ps_idx =
                                         r600_pm_get_type_index(rdev, POWER_STATE_TYPE_PERFORMANCE, 1);
                                 rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_off_cm_idx = 0;
-                                rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_cm_idx = 1;
+                                rdev->pm.profiles[PM_PROFILE_LOW_MH_IDX].dpms_on_cm_idx = 0;
+                        }
+                        /* mid mh */
+                        if (rdev->flags & RADEON_IS_MOBILITY) {
+                                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_ps_idx =
+                                        r600_pm_get_type_index(rdev, POWER_STATE_TYPE_BATTERY, 1);
+                                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_ps_idx =
+                                        r600_pm_get_type_index(rdev, POWER_STATE_TYPE_BATTERY, 1);
+                                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_cm_idx = 0;
+                                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_cm_idx = 1;
+                        } else {
+                                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_ps_idx =
+                                        r600_pm_get_type_index(rdev, POWER_STATE_TYPE_PERFORMANCE, 1);
+                                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_ps_idx =
+                                        r600_pm_get_type_index(rdev, POWER_STATE_TYPE_PERFORMANCE, 1);
+                                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_off_cm_idx = 0;
+                                rdev->pm.profiles[PM_PROFILE_MID_MH_IDX].dpms_on_cm_idx = 1;
                         }
                         /* high mh */
                         rdev->pm.profiles[PM_PROFILE_HIGH_MH_IDX].dpms_off_ps_idx =
@@ -475,13 +562,18 @@ void r600_pm_init_profile(struct radeon_device *rdev)
 
 void r600_pm_misc(struct radeon_device *rdev)
 {
-        int requested_index = rdev->pm.requested_power_state_index;
-        struct radeon_power_state *ps = &rdev->pm.power_state[requested_index];
-        struct radeon_voltage *voltage = &ps->clock_info[0].voltage;
-
-        if ((voltage->type == VOLTAGE_SW) && voltage->voltage)
-                radeon_atom_set_voltage(rdev, voltage->voltage);
+        int req_ps_idx = rdev->pm.requested_power_state_index;
+        int req_cm_idx = rdev->pm.requested_clock_mode_index;
+        struct radeon_power_state *ps = &rdev->pm.power_state[req_ps_idx];
+        struct radeon_voltage *voltage = &ps->clock_info[req_cm_idx].voltage;
 
+        if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
+                if (voltage->voltage != rdev->pm.current_vddc) {
+                        radeon_atom_set_voltage(rdev, voltage->voltage);
+                        rdev->pm.current_vddc = voltage->voltage;
+                        DRM_DEBUG("Setting: v: %d\n", voltage->voltage);
+                }
+        }
 }
 
 bool r600_gui_idle(struct radeon_device *rdev)
@@ -1010,7 +1102,7 @@ static void r600_mc_program(struct radeon_device *rdev)
         WREG32(MC_VM_FB_LOCATION, tmp);
         WREG32(HDP_NONSURFACE_BASE, (rdev->mc.vram_start >> 8));
         WREG32(HDP_NONSURFACE_INFO, (2 << 7));
-        WREG32(HDP_NONSURFACE_SIZE, rdev->mc.mc_vram_size | 0x3FF);
+        WREG32(HDP_NONSURFACE_SIZE, 0x3FFFFFFF);
         if (rdev->flags & RADEON_IS_AGP) {
                 WREG32(MC_VM_AGP_TOP, rdev->mc.gtt_end >> 22);
                 WREG32(MC_VM_AGP_BOT, rdev->mc.gtt_start >> 22);
@@ -1132,8 +1224,10 @@ int r600_mc_init(struct radeon_device *rdev)
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
         r600_vram_gtt_location(rdev, &rdev->mc);
 
-        if (rdev->flags & RADEON_IS_IGP)
+        if (rdev->flags & RADEON_IS_IGP) {
+                rs690_pm_info(rdev);
                 rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
+        }
         radeon_update_bandwidth_info(rdev);
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 5f96fe871b3f..ab61aaa887bb 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -177,6 +177,7 @@ void radeon_pm_resume(struct radeon_device *rdev);
 void radeon_combios_get_power_modes(struct radeon_device *rdev);
 void radeon_atombios_get_power_modes(struct radeon_device *rdev);
 void radeon_atom_set_voltage(struct radeon_device *rdev, u16 level);
+void rs690_pm_info(struct radeon_device *rdev);
 
 /*
  * Fences.
@@ -619,7 +620,8 @@ enum radeon_dynpm_state {
         DYNPM_STATE_DISABLED,
         DYNPM_STATE_MINIMUM,
         DYNPM_STATE_PAUSED,
-        DYNPM_STATE_ACTIVE
+        DYNPM_STATE_ACTIVE,
+        DYNPM_STATE_SUSPENDED,
 };
 enum radeon_dynpm_action {
         DYNPM_ACTION_NONE,
@@ -648,15 +650,18 @@ enum radeon_pm_profile_type {
         PM_PROFILE_DEFAULT,
         PM_PROFILE_AUTO,
         PM_PROFILE_LOW,
+        PM_PROFILE_MID,
         PM_PROFILE_HIGH,
 };
 
 #define PM_PROFILE_DEFAULT_IDX 0
 #define PM_PROFILE_LOW_SH_IDX  1
-#define PM_PROFILE_HIGH_SH_IDX 2
-#define PM_PROFILE_LOW_MH_IDX  3
-#define PM_PROFILE_HIGH_MH_IDX 4
-#define PM_PROFILE_MAX         5
+#define PM_PROFILE_MID_SH_IDX  2
+#define PM_PROFILE_HIGH_SH_IDX 3
+#define PM_PROFILE_LOW_MH_IDX  4
+#define PM_PROFILE_MID_MH_IDX  5
+#define PM_PROFILE_HIGH_MH_IDX 6
+#define PM_PROFILE_MAX         7
 
 struct radeon_pm_profile {
         int dpms_off_ps_idx;
@@ -745,6 +750,7 @@ struct radeon_pm {
         int                     default_power_state_index;
         u32                     current_sclk;
         u32                     current_mclk;
+        u32                     current_vddc;
         struct radeon_i2c_chan *i2c_bus;
         /* selected pm method */
         enum radeon_pm_method     pm_method;
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 87f7e2cc52d4..646f96f97c77 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -780,6 +780,13 @@ int radeon_asic_init(struct radeon_device *rdev)
         case CHIP_R423:
         case CHIP_RV410:
                 rdev->asic = &r420_asic;
+                /* handle macs */
+                if (rdev->bios == NULL) {
+                        rdev->asic->get_engine_clock = &radeon_legacy_get_engine_clock;
+                        rdev->asic->set_engine_clock = &radeon_legacy_set_engine_clock;
+                        rdev->asic->get_memory_clock = &radeon_legacy_get_memory_clock;
+                        rdev->asic->set_memory_clock = NULL;
+                }
                 break;
         case CHIP_RS400:
         case CHIP_RS480:
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 4305cd55d0ac..99bd8a9c56b3 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1833,10 +1833,7 @@ void radeon_atombios_get_power_modes(struct radeon_device *rdev)
                                                 /* skip invalid modes */
                                                 if (rdev->pm.power_state[state_index].clock_info[mode_index].sclk == 0)
                                                         continue;
-                                                rdev->pm.power_state[state_index].clock_info[mode_index].voltage.type =
-                                                        VOLTAGE_SW;
-                                                rdev->pm.power_state[state_index].clock_info[mode_index].voltage.voltage =
-                                                        clock_info->usVDDC;
+                                                /* voltage works differently on IGPs */
                                                 mode_index++;
                                         } else if (ASIC_IS_DCE4(rdev)) {
                                                 struct _ATOM_PPLIB_EVERGREEN_CLOCK_INFO *clock_info =
@@ -1969,6 +1966,7 @@ void radeon_atombios_get_power_modes(struct radeon_device *rdev)
 
         rdev->pm.current_power_state_index = rdev->pm.default_power_state_index;
         rdev->pm.current_clock_mode_index = 0;
+        rdev->pm.current_vddc = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.voltage;
 }
 
 void radeon_atom_set_clock_gating(struct radeon_device *rdev, int enable)
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index fbba938f8048..2c9213739999 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -48,6 +48,10 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev)
         resource_size_t vram_base;
         resource_size_t size = 256 * 1024; /* ??? */
 
+        if (!(rdev->flags & RADEON_IS_IGP))
+                if (!radeon_card_posted(rdev))
+                        return false;
+
         rdev->bios = NULL;
         vram_base = drm_get_resource_start(rdev->ddev, 0);
         bios = ioremap(vram_base, size);
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 102c744eaf5a..d1c1d8dd93ce 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -1411,6 +1411,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
                         rdev->mode_info.connector_table = CT_IMAC_G5_ISIGHT;
                 } else
 #endif /* CONFIG_PPC_PMAC */
+#ifdef CONFIG_PPC64
+                if (ASIC_IS_RN50(rdev))
+                        rdev->mode_info.connector_table = CT_RN50_POWER;
+                else
+#endif
                         rdev->mode_info.connector_table = CT_GENERIC;
         }
 
@@ -1853,6 +1858,33 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
                                             CONNECTOR_OBJECT_ID_SVIDEO,
                                             &hpd);
                 break;
+        case CT_RN50_POWER:
+                DRM_INFO("Connector Table: %d (rn50-power)\n",
+                         rdev->mode_info.connector_table);
+                /* VGA - primary dac */
+                ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_VGA_DDC);
+                hpd.hpd = RADEON_HPD_NONE;
+                radeon_add_legacy_encoder(dev,
+                                          radeon_get_encoder_id(dev,
+                                                                ATOM_DEVICE_CRT1_SUPPORT,
+                                                                1),
+                                          ATOM_DEVICE_CRT1_SUPPORT);
+                radeon_add_legacy_connector(dev, 0, ATOM_DEVICE_CRT1_SUPPORT,
+                                            DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
+                                            CONNECTOR_OBJECT_ID_VGA,
+                                            &hpd);
+                ddc_i2c = combios_setup_i2c_bus(rdev, RADEON_GPIO_CRT2_DDC);
+                hpd.hpd = RADEON_HPD_NONE;
+                radeon_add_legacy_encoder(dev,
+                                          radeon_get_encoder_id(dev,
+                                                                ATOM_DEVICE_CRT2_SUPPORT,
+                                                                2),
+                                          ATOM_DEVICE_CRT2_SUPPORT);
+                radeon_add_legacy_connector(dev, 1, ATOM_DEVICE_CRT2_SUPPORT,
+                                            DRM_MODE_CONNECTOR_VGA, &ddc_i2c,
+                                            CONNECTOR_OBJECT_ID_VGA,
+                                            &hpd);
+                break;
         default:
                 DRM_INFO("Connector table: %d (invalid)\n",
                          rdev->mode_info.connector_table);
@@ -1906,15 +1938,6 @@ static bool radeon_apply_legacy_quirks(struct drm_device *dev,
                         return false;
         }
 
-        /* Some RV100 cards with 2 VGA ports show up with DVI+VGA */
-        if (dev->pdev->device == 0x5159 &&
-            dev->pdev->subsystem_vendor == 0x1002 &&
-            dev->pdev->subsystem_device == 0x013a) {
-                if (*legacy_connector == CONNECTOR_DVI_I_LEGACY)
-                        *legacy_connector = CONNECTOR_CRT_LEGACY;
-
-        }
-
         /* X300 card with extra non-existent DVI port */
         if (dev->pdev->device == 0x5B60 &&
             dev->pdev->subsystem_vendor == 0x17af &&
@@ -2026,6 +2049,7 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
                                         combios_setup_i2c_bus(rdev, RADEON_GPIO_CRT2_DDC);
                                 break;
                         default:
+                                ddc_i2c.valid = false;
                                 break;
                         }
 
@@ -2339,6 +2363,7 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
                         if (RBIOS8(tv_info + 6) == 'T') {
                                 if (radeon_apply_legacy_tv_quirks(dev)) {
                                         hpd.hpd = RADEON_HPD_NONE;
+                                        ddc_i2c.valid = false;
                                         radeon_add_legacy_encoder(dev,
                                                                   radeon_get_encoder_id
                                                                   (dev,
@@ -2455,7 +2480,7 @@ default_mode:
         rdev->pm.power_state[state_index].clock_info[0].sclk = rdev->clock.default_sclk;
         rdev->pm.power_state[state_index].default_clock_mode = &rdev->pm.power_state[state_index].clock_info[0];
         if ((state_index > 0) &&
-            (rdev->pm.power_state[0].clock_info[0].voltage.type = VOLTAGE_GPIO))
+            (rdev->pm.power_state[0].clock_info[0].voltage.type == VOLTAGE_GPIO))
                 rdev->pm.power_state[state_index].clock_info[0].voltage =
                         rdev->pm.power_state[0].clock_info[0].voltage;
         else
@@ -3017,6 +3042,14 @@ void radeon_combios_asic_init(struct drm_device *dev)
                 combios_write_ram_size(dev);
         }
 
+        /* quirk for rs4xx HP nx6125 laptop to make it resume
+         * - it hangs on resume inside the dynclk 1 table.
+         */
+        if (rdev->family == CHIP_RS480 &&
+            rdev->pdev->subsystem_vendor == 0x103c &&
+            rdev->pdev->subsystem_device == 0x308b)
+                return;
+
         /* DYN CLK 1 */
         table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
         if (table)
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 0c7ccc6961a3..f58f8bd8f77b 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -785,7 +785,9 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
                                         if (connector == list_connector)
                                                 continue;
                                         list_radeon_connector = to_radeon_connector(list_connector);
-                                        if (radeon_connector->devices == list_radeon_connector->devices) {
+                                        if (list_radeon_connector->shared_ddc &&
+                                            (list_radeon_connector->ddc_bus->rec.i2c_id ==
+                                             radeon_connector->ddc_bus->rec.i2c_id)) {
                                                 if (drm_detect_hdmi_monitor(radeon_connector->edid)) {
                                                         if (connector->connector_type == DRM_MODE_CONNECTOR_DVID) {
                                                                 kfree(radeon_connector->edid);
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index b7023fff89eb..4eb67c0e0996 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -194,7 +194,7 @@ unpin:
 fail:
         drm_gem_object_unreference_unlocked(obj);
 
-        return 0;
+        return ret;
 }
 
 int radeon_crtc_cursor_move(struct drm_crtc *crtc,
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index f10faed21567..5f317317aba2 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -779,6 +779,7 @@ int radeon_suspend_kms(struct drm_device *dev, pm_message_t state)
 
 int radeon_resume_kms(struct drm_device *dev)
 {
+        struct drm_connector *connector;
         struct radeon_device *rdev = dev->dev_private;
 
         if (rdev->powered_down)
@@ -797,6 +798,12 @@ int radeon_resume_kms(struct drm_device *dev)
         radeon_resume(rdev);
         radeon_pm_resume(rdev);
         radeon_restore_bios_scratch_regs(rdev);
+
+        /* turn on display hw */
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+                drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
+        }
+
         radeon_fbdev_set_suspend(rdev, 0);
         release_console_sem();
 
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 1006549d1570..8154cdf796e4 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -284,8 +284,7 @@ static const char *connector_names[15] = {
         "eDP",
 };
 
-static const char *hpd_names[7] = {
-        "NONE",
+static const char *hpd_names[6] = {
         "HPD1",
         "HPD2",
         "HPD3",
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 902d1731a652..e166fe4d7c30 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -45,9 +45,10 @@
  * - 2.2.0 - add r6xx/r7xx const buffer support
  * - 2.3.0 - add MSPOS + 3D texture + r500 VAP regs
  * - 2.4.0 - add crtc id query
+ * - 2.5.0 - add get accel 2 to work around ddx breakage for evergreen
  */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        4
+#define KMS_DRIVER_MINOR        5
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 1ebb100015b7..e0b30b264c28 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -1072,6 +1072,8 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
         if (is_dig) {
                 switch (mode) {
                 case DRM_MODE_DPMS_ON:
+                        if (!ASIC_IS_DCE4(rdev))
+                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                         if (atombios_get_encoder_mode(encoder) == ATOM_ENCODER_MODE_DP) {
                                 struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
 
@@ -1079,8 +1081,6 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
                                 if (ASIC_IS_DCE4(rdev))
                                         atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_ON);
                         }
-                        if (!ASIC_IS_DCE4(rdev))
-                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                         break;
                 case DRM_MODE_DPMS_STANDBY:
                 case DRM_MODE_DPMS_SUSPEND:
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index e192acfbf0cd..dc1634bb0c11 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -363,6 +363,7 @@ int radeon_fbdev_init(struct radeon_device *rdev)
 {
         struct radeon_fbdev *rfbdev;
         int bpp_sel = 32;
+        int ret;
 
         /* select 8 bpp console on RN50 or 16MB cards */
         if (ASIC_IS_RN50(rdev) || rdev->mc.real_vram_size <= (32*1024*1024))
@@ -376,9 +377,14 @@ int radeon_fbdev_init(struct radeon_device *rdev)
         rdev->mode_info.rfbdev = rfbdev;
         rfbdev->helper.funcs = &radeon_fb_helper_funcs;
 
-        drm_fb_helper_init(rdev->ddev, &rfbdev->helper,
-                           rdev->num_crtc,
-                           RADEONFB_CONN_LIMIT);
+        ret = drm_fb_helper_init(rdev->ddev, &rfbdev->helper,
+                                 rdev->num_crtc,
+                                 RADEONFB_CONN_LIMIT);
+        if (ret) {
+                kfree(rfbdev);
+                return ret;
+        }
+
         drm_fb_helper_single_add_all_connectors(&rfbdev->helper);
         drm_fb_helper_initial_config(&rfbdev->helper, bpp_sel);
         return 0;
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 04068352ccd2..6a70c0dc7f92 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -118,7 +118,11 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                 value = rdev->num_z_pipes;
                 break;
         case RADEON_INFO_ACCEL_WORKING:
-                value = rdev->accel_working;
+                /* xf86-video-ati 6.13.0 relies on this being false for evergreen */
+                if ((rdev->family >= CHIP_CEDAR) && (rdev->family <= CHIP_HEMLOCK))
+                        value = false;
+                else
+                        value = rdev->accel_working;
                 break;
         case RADEON_INFO_CRTC_FROM_ID:
                 for (i = 0, found = 0; i < rdev->num_crtc; i++) {
@@ -134,6 +138,9 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                         return -EINVAL;
                 }
                 break;
+        case RADEON_INFO_ACCEL_WORKING2:
+                value = rdev->accel_working;
+                break;
         default:
                 DRM_DEBUG("Invalid request %d\n", info->request);
                 return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 5a13b3eeef19..bad77f40a9da 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -928,16 +928,14 @@ static void radeon_legacy_tv_dac_mode_set(struct drm_encoder *encoder,
         if (ASIC_IS_R300(rdev)) {
                 gpiopad_a = RREG32(RADEON_GPIOPAD_A) | 1;
                 disp_output_cntl = RREG32(RADEON_DISP_OUTPUT_CNTL);
-        }
-
-        if (rdev->family == CHIP_R200 || ASIC_IS_R300(rdev))
-                disp_tv_out_cntl = RREG32(RADEON_DISP_TV_OUT_CNTL);
-        else
+        } else if (rdev->family != CHIP_R200)
                 disp_hw_debug = RREG32(RADEON_DISP_HW_DEBUG);
-
-        if (rdev->family == CHIP_R200)
+        else if (rdev->family == CHIP_R200)
                 fp2_gen_cntl = RREG32(RADEON_FP2_GEN_CNTL);
 
+        if (rdev->family >= CHIP_R200)
+                disp_tv_out_cntl = RREG32(RADEON_DISP_TV_OUT_CNTL);
+
         if (is_tv) {
                 uint32_t dac_cntl;
 
@@ -1002,15 +1000,13 @@ static void radeon_legacy_tv_dac_mode_set(struct drm_encoder *encoder,
         if (ASIC_IS_R300(rdev)) {
                 WREG32_P(RADEON_GPIOPAD_A, gpiopad_a, ~1);
                 WREG32(RADEON_DISP_OUTPUT_CNTL, disp_output_cntl);
-        }
+        } else if (rdev->family != CHIP_R200)
+                WREG32(RADEON_DISP_HW_DEBUG, disp_hw_debug);
+        else if (rdev->family == CHIP_R200)
+                WREG32(RADEON_FP2_GEN_CNTL, fp2_gen_cntl);
 
         if (rdev->family >= CHIP_R200)
                 WREG32(RADEON_DISP_TV_OUT_CNTL, disp_tv_out_cntl);
-        else
-                WREG32(RADEON_DISP_HW_DEBUG, disp_hw_debug);
-
-        if (rdev->family == CHIP_R200)
-                WREG32(RADEON_FP2_GEN_CNTL, fp2_gen_cntl);
 
         if (is_tv)
                 radeon_legacy_tv_mode_set(encoder, mode, adjusted_mode);
@@ -1168,6 +1164,17 @@ static enum drm_connector_status radeon_legacy_tv_dac_detect(struct drm_encoder
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_tv_dac *tv_dac = radeon_encoder->enc_priv;
         bool color = true;
+        struct drm_crtc *crtc;
+
+        /* find out if crtc2 is in use or if this encoder is using it */
+        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+                struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+                if ((radeon_crtc->crtc_id == 1) && crtc->enabled) {
+                        if (encoder->crtc != crtc) {
+                                return connector_status_disconnected;
+                        }
+                }
+        }
 
         if (connector->connector_type == DRM_MODE_CONNECTOR_SVIDEO ||
             connector->connector_type == DRM_MODE_CONNECTOR_Composite ||
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 67358baf28b2..95696aa57ac8 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -206,6 +206,7 @@ enum radeon_connector_table {
         CT_MINI_INTERNAL,
         CT_IMAC_G5_ISIGHT,
         CT_EMAC,
+        CT_RN50_POWER,
 };
 
 enum radeon_dvo_chip {
diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
index 02281269a881..115d26b762cc 100644
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -33,6 +33,14 @@
 #define RADEON_WAIT_VBLANK_TIMEOUT 200
 #define RADEON_WAIT_IDLE_TIMEOUT 200
 
+static const char *radeon_pm_state_type_name[5] = {
+        "Default",
+        "Powersave",
+        "Battery",
+        "Balanced",
+        "Performance",
+};
+
 static void radeon_dynpm_idle_work_handler(struct work_struct *work);
 static int radeon_debugfs_pm_init(struct radeon_device *rdev);
 static bool radeon_pm_in_vbl(struct radeon_device *rdev);
@@ -84,9 +92,9 @@ static void radeon_pm_update_profile(struct radeon_device *rdev)
                                 rdev->pm.profile_index = PM_PROFILE_HIGH_SH_IDX;
                 } else {
                         if (rdev->pm.active_crtc_count > 1)
-                                rdev->pm.profile_index = PM_PROFILE_LOW_MH_IDX;
+                                rdev->pm.profile_index = PM_PROFILE_MID_MH_IDX;
                         else
-                                rdev->pm.profile_index = PM_PROFILE_LOW_SH_IDX;
+                                rdev->pm.profile_index = PM_PROFILE_MID_SH_IDX;
                 }
                 break;
         case PM_PROFILE_LOW:
@@ -95,6 +103,12 @@ static void radeon_pm_update_profile(struct radeon_device *rdev)
                 else
                         rdev->pm.profile_index = PM_PROFILE_LOW_SH_IDX;
                 break;
+        case PM_PROFILE_MID:
+                if (rdev->pm.active_crtc_count > 1)
+                        rdev->pm.profile_index = PM_PROFILE_MID_MH_IDX;
+                else
+                        rdev->pm.profile_index = PM_PROFILE_MID_SH_IDX;
+                break;
         case PM_PROFILE_HIGH:
                 if (rdev->pm.active_crtc_count > 1)
                         rdev->pm.profile_index = PM_PROFILE_HIGH_MH_IDX;
@@ -127,15 +141,6 @@ static void radeon_unmap_vram_bos(struct radeon_device *rdev)
                 if (bo->tbo.mem.mem_type == TTM_PL_VRAM)
                         ttm_bo_unmap_virtual(&bo->tbo);
         }
-
-        if (rdev->gart.table.vram.robj)
-                ttm_bo_unmap_virtual(&rdev->gart.table.vram.robj->tbo);
-
-        if (rdev->stollen_vga_memory)
-                ttm_bo_unmap_virtual(&rdev->stollen_vga_memory->tbo);
-
-        if (rdev->r600_blit.shader_obj)
-                ttm_bo_unmap_virtual(&rdev->r600_blit.shader_obj->tbo);
 }
 
 static void radeon_sync_with_vblank(struct radeon_device *rdev)
@@ -281,6 +286,42 @@ static void radeon_pm_set_clocks(struct radeon_device *rdev)
         mutex_unlock(&rdev->ddev->struct_mutex);
 }
 
+static void radeon_pm_print_states(struct radeon_device *rdev)
+{
+        int i, j;
+        struct radeon_power_state *power_state;
+        struct radeon_pm_clock_info *clock_info;
+
+        DRM_DEBUG("%d Power State(s)\n", rdev->pm.num_power_states);
+        for (i = 0; i < rdev->pm.num_power_states; i++) {
+                power_state = &rdev->pm.power_state[i];
+                DRM_DEBUG("State %d: %s\n", i,
+                        radeon_pm_state_type_name[power_state->type]);
+                if (i == rdev->pm.default_power_state_index)
+                        DRM_DEBUG("\tDefault");
+                if ((rdev->flags & RADEON_IS_PCIE) && !(rdev->flags & RADEON_IS_IGP))
+                        DRM_DEBUG("\t%d PCIE Lanes\n", power_state->pcie_lanes);
+                if (power_state->flags & RADEON_PM_STATE_SINGLE_DISPLAY_ONLY)
+                        DRM_DEBUG("\tSingle display only\n");
+                DRM_DEBUG("\t%d Clock Mode(s)\n", power_state->num_clock_modes);
+                for (j = 0; j < power_state->num_clock_modes; j++) {
+                        clock_info = &(power_state->clock_info[j]);
+                        if (rdev->flags & RADEON_IS_IGP)
+                                DRM_DEBUG("\t\t%d e: %d%s\n",
+                                        j,
+                                        clock_info->sclk * 10,
+                                        clock_info->flags & RADEON_PM_MODE_NO_DISPLAY ? "\tNo display only" : "");
+                        else
+                                DRM_DEBUG("\t\t%d e: %d\tm: %d\tv: %d%s\n",
+                                        j,
+                                        clock_info->sclk * 10,
+                                        clock_info->mclk * 10,
+                                        clock_info->voltage.voltage,
+                                        clock_info->flags & RADEON_PM_MODE_NO_DISPLAY ? "\tNo display only" : "");
+                }
+        }
+}
+
 static ssize_t radeon_get_pm_profile(struct device *dev,
                                      struct device_attribute *attr,
                                      char *buf)
@@ -311,6 +352,8 @@ static ssize_t radeon_set_pm_profile(struct device *dev,
                         rdev->pm.profile = PM_PROFILE_AUTO;
                 else if (strncmp("low", buf, strlen("low")) == 0)
                         rdev->pm.profile = PM_PROFILE_LOW;
+                else if (strncmp("mid", buf, strlen("mid")) == 0)
+                        rdev->pm.profile = PM_PROFILE_MID;
                 else if (strncmp("high", buf, strlen("high")) == 0)
                         rdev->pm.profile = PM_PROFILE_HIGH;
                 else {
@@ -354,13 +397,20 @@ static ssize_t radeon_set_pm_method(struct device *dev,
                 rdev->pm.dynpm_planned_action = DYNPM_ACTION_DEFAULT;
                 mutex_unlock(&rdev->pm.mutex);
         } else if (strncmp("profile", buf, strlen("profile")) == 0) {
+                bool flush_wq = false;
+
                 mutex_lock(&rdev->pm.mutex);
-                rdev->pm.pm_method = PM_METHOD_PROFILE;
+                if (rdev->pm.pm_method == PM_METHOD_DYNPM) {
+                        cancel_delayed_work(&rdev->pm.dynpm_idle_work);
+                        flush_wq = true;
+                }
                 /* disable dynpm */
                 rdev->pm.dynpm_state = DYNPM_STATE_DISABLED;
                 rdev->pm.dynpm_planned_action = DYNPM_ACTION_NONE;
-                cancel_delayed_work(&rdev->pm.dynpm_idle_work);
+                rdev->pm.pm_method = PM_METHOD_PROFILE;
                 mutex_unlock(&rdev->pm.mutex);
+                if (flush_wq)
+                        flush_workqueue(rdev->wq);
         } else {
                 DRM_ERROR("invalid power method!\n");
                 goto fail;
@@ -375,17 +425,36 @@ static DEVICE_ATTR(power_method, S_IRUGO | S_IWUSR, radeon_get_pm_method, radeon
 
 void radeon_pm_suspend(struct radeon_device *rdev)
 {
+        bool flush_wq = false;
+
         mutex_lock(&rdev->pm.mutex);
-        cancel_delayed_work(&rdev->pm.dynpm_idle_work);
-        rdev->pm.current_power_state_index = -1;
-        rdev->pm.current_clock_mode_index = -1;
-        rdev->pm.current_sclk = 0;
-        rdev->pm.current_mclk = 0;
+        if (rdev->pm.pm_method == PM_METHOD_DYNPM) {
+                cancel_delayed_work(&rdev->pm.dynpm_idle_work);
+                if (rdev->pm.dynpm_state == DYNPM_STATE_ACTIVE)
+                        rdev->pm.dynpm_state = DYNPM_STATE_SUSPENDED;
+                flush_wq = true;
+        }
         mutex_unlock(&rdev->pm.mutex);
+        if (flush_wq)
+                flush_workqueue(rdev->wq);
 }
 
 void radeon_pm_resume(struct radeon_device *rdev)
 {
+        /* asic init will reset the default power state */
+        mutex_lock(&rdev->pm.mutex);
+        rdev->pm.current_power_state_index = rdev->pm.default_power_state_index;
+        rdev->pm.current_clock_mode_index = 0;
+        rdev->pm.current_sclk = rdev->clock.default_sclk;
+        rdev->pm.current_mclk = rdev->clock.default_mclk;
+        rdev->pm.current_vddc = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.voltage;
+        if (rdev->pm.pm_method == PM_METHOD_DYNPM
+            && rdev->pm.dynpm_state == DYNPM_STATE_SUSPENDED) {
+                rdev->pm.dynpm_state = DYNPM_STATE_ACTIVE;
+                queue_delayed_work(rdev->wq, &rdev->pm.dynpm_idle_work,
+                                        msecs_to_jiffies(RADEON_IDLE_LOOP_MS));
+        }
+        mutex_unlock(&rdev->pm.mutex);
         radeon_pm_compute_clocks(rdev);
 }
 
@@ -394,32 +463,24 @@ int radeon_pm_init(struct radeon_device *rdev)
         int ret;
         /* default to profile method */
         rdev->pm.pm_method = PM_METHOD_PROFILE;
+        rdev->pm.profile = PM_PROFILE_DEFAULT;
         rdev->pm.dynpm_state = DYNPM_STATE_DISABLED;
         rdev->pm.dynpm_planned_action = DYNPM_ACTION_NONE;
         rdev->pm.dynpm_can_upclock = true;
         rdev->pm.dynpm_can_downclock = true;
-        rdev->pm.current_sclk = 0;
-        rdev->pm.current_mclk = 0;
+        rdev->pm.current_sclk = rdev->clock.default_sclk;
+        rdev->pm.current_mclk = rdev->clock.default_mclk;
 
         if (rdev->bios) {
                 if (rdev->is_atom_bios)
                         radeon_atombios_get_power_modes(rdev);
                 else
                         radeon_combios_get_power_modes(rdev);
+                radeon_pm_print_states(rdev);
                 radeon_pm_init_profile(rdev);
-                rdev->pm.current_power_state_index = -1;
-                rdev->pm.current_clock_mode_index = -1;
         }
 
         if (rdev->pm.num_power_states > 1) {
-                if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
-                        mutex_lock(&rdev->pm.mutex);
-                        rdev->pm.profile = PM_PROFILE_DEFAULT;
-                        radeon_pm_update_profile(rdev);
-                        radeon_pm_set_clocks(rdev);
-                        mutex_unlock(&rdev->pm.mutex);
-                }
-
                 /* where's the best place to put these? */
                 ret = device_create_file(rdev->dev, &dev_attr_power_profile);
                 if (ret)
@@ -447,6 +508,8 @@ int radeon_pm_init(struct radeon_device *rdev)
 void radeon_pm_fini(struct radeon_device *rdev)
 {
         if (rdev->pm.num_power_states > 1) {
+                bool flush_wq = false;
+
                 mutex_lock(&rdev->pm.mutex);
                 if (rdev->pm.pm_method == PM_METHOD_PROFILE) {
                         rdev->pm.profile = PM_PROFILE_DEFAULT;
@@ -454,13 +517,16 @@ void radeon_pm_fini(struct radeon_device *rdev)
                         radeon_pm_set_clocks(rdev);
                 } else if (rdev->pm.pm_method == PM_METHOD_DYNPM) {
                         /* cancel work */
-                        cancel_delayed_work_sync(&rdev->pm.dynpm_idle_work);
+                        cancel_delayed_work(&rdev->pm.dynpm_idle_work);
+                        flush_wq = true;
                         /* reset default clocks */
                         rdev->pm.dynpm_state = DYNPM_STATE_DISABLED;
                         rdev->pm.dynpm_planned_action = DYNPM_ACTION_DEFAULT;
                         radeon_pm_set_clocks(rdev);
                 }
                 mutex_unlock(&rdev->pm.mutex);
+                if (flush_wq)
+                        flush_workqueue(rdev->wq);
 
                 device_remove_file(rdev->dev, &dev_attr_power_profile);
                 device_remove_file(rdev->dev, &dev_attr_power_method);
@@ -681,12 +747,12 @@ static void radeon_dynpm_idle_work_handler(struct work_struct *work)
                         radeon_pm_get_dynpm_state(rdev);
                         radeon_pm_set_clocks(rdev);
                 }
+
+                queue_delayed_work(rdev->wq, &rdev->pm.dynpm_idle_work,
+                                        msecs_to_jiffies(RADEON_IDLE_LOOP_MS));
         }
         mutex_unlock(&rdev->pm.mutex);
         ttm_bo_unlock_delayed_workqueue(&rdev->mman.bdev, resched);
-
-        queue_delayed_work(rdev->wq, &rdev->pm.dynpm_idle_work,
-                                        msecs_to_jiffies(RADEON_IDLE_LOOP_MS));
 }
 
 /*
@@ -705,6 +771,8 @@ static int radeon_debugfs_pm_info(struct seq_file *m, void *data)
         seq_printf(m, "default memory clock: %u0 kHz\n", rdev->clock.default_mclk);
         if (rdev->asic->get_memory_clock)
                 seq_printf(m, "current memory clock: %u0 kHz\n", radeon_get_memory_clock(rdev));
+        if (rdev->pm.current_vddc)
+                seq_printf(m, "voltage: %u mV\n", rdev->pm.current_vddc);
         if (rdev->asic->get_pcie_lanes)
                 seq_printf(m, "PCIE lanes: %d\n", radeon_get_pcie_lanes(rdev));
 
diff --git a/drivers/gpu/drm/radeon/reg_srcs/evergreen b/drivers/gpu/drm/radeon/reg_srcs/evergreen
index b5c757f68d3c..f78fd592544d 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/evergreen
+++ b/drivers/gpu/drm/radeon/reg_srcs/evergreen
@@ -80,8 +80,8 @@ evergreen 0x9400
 0x00028010 DB_RENDER_OVERRIDE2
 0x00028028 DB_STENCIL_CLEAR
 0x0002802C DB_DEPTH_CLEAR
-0x00028034 PA_SC_SCREEN_SCISSOR_BR
 0x00028030 PA_SC_SCREEN_SCISSOR_TL
+0x00028034 PA_SC_SCREEN_SCISSOR_BR
 0x0002805C DB_DEPTH_SLICE
 0x00028140 SQ_ALU_CONST_BUFFER_SIZE_PS_0
 0x00028144 SQ_ALU_CONST_BUFFER_SIZE_PS_1
@@ -460,8 +460,8 @@ evergreen 0x9400
 0x00028844 SQ_PGM_RESOURCES_PS
 0x00028848 SQ_PGM_RESOURCES_2_PS
 0x0002884C SQ_PGM_EXPORTS_PS
-0x0002885C SQ_PGM_RESOURCES_VS
-0x00028860 SQ_PGM_RESOURCES_2_VS
+0x00028860 SQ_PGM_RESOURCES_VS
+0x00028864 SQ_PGM_RESOURCES_2_VS
 0x00028878 SQ_PGM_RESOURCES_GS
 0x0002887C SQ_PGM_RESOURCES_2_GS
 0x00028890 SQ_PGM_RESOURCES_ES
@@ -469,8 +469,8 @@ evergreen 0x9400
 0x000288A8 SQ_PGM_RESOURCES_FS
 0x000288BC SQ_PGM_RESOURCES_HS
 0x000288C0 SQ_PGM_RESOURCES_2_HS
-0x000288D0 SQ_PGM_RESOURCES_LS
-0x000288D4 SQ_PGM_RESOURCES_2_LS
+0x000288D4 SQ_PGM_RESOURCES_LS
+0x000288D8 SQ_PGM_RESOURCES_2_LS
 0x000288E8 SQ_LDS_ALLOC
 0x000288EC SQ_LDS_ALLOC_PS
 0x000288F0 SQ_VTX_SEMANTIC_CLEAR
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index bcc33195ebc2..f4f0a61bcdce 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -79,7 +79,13 @@ void rs690_pm_info(struct radeon_device *rdev)
                         tmp.full = dfixed_const(100);
                         rdev->pm.igp_sideport_mclk.full = dfixed_const(info->info.ulBootUpMemoryClock);
                         rdev->pm.igp_sideport_mclk.full = dfixed_div(rdev->pm.igp_sideport_mclk, tmp);
-                        rdev->pm.igp_system_mclk.full = dfixed_const(le16_to_cpu(info->info.usK8MemoryClock));
+                        if (info->info.usK8MemoryClock)
+                                rdev->pm.igp_system_mclk.full = dfixed_const(le16_to_cpu(info->info.usK8MemoryClock));
+                        else if (rdev->clock.default_mclk) {
+                                rdev->pm.igp_system_mclk.full = dfixed_const(rdev->clock.default_mclk);
+                                rdev->pm.igp_system_mclk.full = dfixed_div(rdev->pm.igp_system_mclk, tmp);
+                        } else
+                                rdev->pm.igp_system_mclk.full = dfixed_const(400);
                         rdev->pm.igp_ht_link_clk.full = dfixed_const(le16_to_cpu(info->info.usFSBClock));
                         rdev->pm.igp_ht_link_width.full = dfixed_const(info->info.ucHTLinkWidth);
                         break;
@@ -87,34 +93,31 @@ void rs690_pm_info(struct radeon_device *rdev)
                         tmp.full = dfixed_const(100);
                         rdev->pm.igp_sideport_mclk.full = dfixed_const(info->info_v2.ulBootUpSidePortClock);
                         rdev->pm.igp_sideport_mclk.full = dfixed_div(rdev->pm.igp_sideport_mclk, tmp);
-                        rdev->pm.igp_system_mclk.full = dfixed_const(info->info_v2.ulBootUpUMAClock);
+                        if (info->info_v2.ulBootUpUMAClock)
+                                rdev->pm.igp_system_mclk.full = dfixed_const(info->info_v2.ulBootUpUMAClock);
+                        else if (rdev->clock.default_mclk)
+                                rdev->pm.igp_system_mclk.full = dfixed_const(rdev->clock.default_mclk);
+                        else
+                                rdev->pm.igp_system_mclk.full = dfixed_const(66700);
                         rdev->pm.igp_system_mclk.full = dfixed_div(rdev->pm.igp_system_mclk, tmp);
                         rdev->pm.igp_ht_link_clk.full = dfixed_const(info->info_v2.ulHTLinkFreq);
                         rdev->pm.igp_ht_link_clk.full = dfixed_div(rdev->pm.igp_ht_link_clk, tmp);
                         rdev->pm.igp_ht_link_width.full = dfixed_const(le16_to_cpu(info->info_v2.usMinHTLinkWidth));
                         break;
                 default:
-                        tmp.full = dfixed_const(100);
                         /* We assume the slower possible clock ie worst case */
-                        /* DDR 333Mhz */
-                        rdev->pm.igp_sideport_mclk.full = dfixed_const(333);
-                        /* FIXME: system clock ? */
-                        rdev->pm.igp_system_mclk.full = dfixed_const(100);
-                        rdev->pm.igp_system_mclk.full = dfixed_div(rdev->pm.igp_system_mclk, tmp);
-                        rdev->pm.igp_ht_link_clk.full = dfixed_const(200);
+                        rdev->pm.igp_sideport_mclk.full = dfixed_const(200);
+                        rdev->pm.igp_system_mclk.full = dfixed_const(200);
+                        rdev->pm.igp_ht_link_clk.full = dfixed_const(1000);
                         rdev->pm.igp_ht_link_width.full = dfixed_const(8);
                         DRM_ERROR("No integrated system info for your GPU, using safe default\n");
                         break;
                 }
         } else {
-                tmp.full = dfixed_const(100);
                 /* We assume the slower possible clock ie worst case */
-                /* DDR 333Mhz */
-                rdev->pm.igp_sideport_mclk.full = dfixed_const(333);
-                /* FIXME: system clock ? */
-                rdev->pm.igp_system_mclk.full = dfixed_const(100);
-                rdev->pm.igp_system_mclk.full = dfixed_div(rdev->pm.igp_system_mclk, tmp);
-                rdev->pm.igp_ht_link_clk.full = dfixed_const(200);
+                rdev->pm.igp_sideport_mclk.full = dfixed_const(200);
+                rdev->pm.igp_system_mclk.full = dfixed_const(200);
+                rdev->pm.igp_ht_link_clk.full = dfixed_const(1000);
                 rdev->pm.igp_ht_link_width.full = dfixed_const(8);
                 DRM_ERROR("No integrated system info for your GPU, using safe default\n");
         }
@@ -228,10 +231,6 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
         fixed20_12 a, b, c;
         fixed20_12 pclk, request_fifo_depth, tolerable_latency, estimated_width;
         fixed20_12 consumption_time, line_time, chunk_time, read_delay_latency;
-        /* FIXME: detect IGP with sideport memory, i don't think there is any
-         * such product available
-         */
-        bool sideport = false;
 
         if (!crtc->base.enabled) {
                 /* FIXME: wouldn't it better to set priority mark to maximum */
@@ -300,7 +299,7 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
 
         /* Maximun bandwidth is the minimun bandwidth of all component */
         rdev->pm.max_bandwidth = rdev->pm.core_bandwidth;
-        if (sideport) {
+        if (rdev->mc.igp_sideport_enabled) {
                 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
                         rdev->pm.sideport_bandwidth.full)
                         rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 33952da65340..b7fd82064922 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -44,12 +44,18 @@ void rv770_fini(struct radeon_device *rdev);
 
 void rv770_pm_misc(struct radeon_device *rdev)
 {
-        int requested_index = rdev->pm.requested_power_state_index;
-        struct radeon_power_state *ps = &rdev->pm.power_state[requested_index];
-        struct radeon_voltage *voltage = &ps->clock_info[0].voltage;
-
-        if ((voltage->type == VOLTAGE_SW) && voltage->voltage)
-                radeon_atom_set_voltage(rdev, voltage->voltage);
+        int req_ps_idx = rdev->pm.requested_power_state_index;
+        int req_cm_idx = rdev->pm.requested_clock_mode_index;
+        struct radeon_power_state *ps = &rdev->pm.power_state[req_ps_idx];
+        struct radeon_voltage *voltage = &ps->clock_info[req_cm_idx].voltage;
+
+        if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
+                if (voltage->voltage != rdev->pm.current_vddc) {
+                        radeon_atom_set_voltage(rdev, voltage->voltage);
+                        rdev->pm.current_vddc = voltage->voltage;
+                        DRM_DEBUG("Setting: v: %d\n", voltage->voltage);
+                }
+        }
 }
 
 /*
@@ -218,7 +224,7 @@ static void rv770_mc_program(struct radeon_device *rdev)
         WREG32(MC_VM_FB_LOCATION, tmp);
         WREG32(HDP_NONSURFACE_BASE, (rdev->mc.vram_start >> 8));
         WREG32(HDP_NONSURFACE_INFO, (2 << 7));
-        WREG32(HDP_NONSURFACE_SIZE, (rdev->mc.mc_vram_size - 1) | 0x3FF);
+        WREG32(HDP_NONSURFACE_SIZE, 0x3FFFFFFF);
         if (rdev->flags & RADEON_IS_AGP) {
                 WREG32(MC_VM_AGP_TOP, rdev->mc.gtt_end >> 16);
                 WREG32(MC_VM_AGP_BOT, rdev->mc.gtt_start >> 16);
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index ef910694bd63..b1d67dc973dc 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -104,7 +104,6 @@ struct ttm_pool_opts {
 struct ttm_pool_manager {
         struct kobject          kobj;
         struct shrinker         mm_shrink;
-        atomic_t                page_alloc_inited;
         struct ttm_pool_opts    options;
 
         union {
@@ -142,7 +141,7 @@ static void ttm_pool_kobj_release(struct kobject *kobj)
 {
         struct ttm_pool_manager *m =
                 container_of(kobj, struct ttm_pool_manager, kobj);
-        (void)m;
+        kfree(m);
 }
 
 static ssize_t ttm_pool_store(struct kobject *kobj,
@@ -214,9 +213,7 @@ static struct kobj_type ttm_pool_kobj_type = {
         .default_attrs = ttm_pool_attrs,
 };
 
-static struct ttm_pool_manager _manager = {
-        .page_alloc_inited      = ATOMIC_INIT(0)
-};
+static struct ttm_pool_manager *_manager;
 
 #ifndef CONFIG_X86
 static int set_pages_array_wb(struct page **pages, int addrinarray)
@@ -271,7 +268,7 @@ static struct ttm_page_pool *ttm_get_pool(int flags,
         if (flags & TTM_PAGE_FLAG_DMA32)
                 pool_index |= 0x2;
 
-        return &_manager.pools[pool_index];
+        return &_manager->pools[pool_index];
 }
 
 /* set memory back to wb and free the pages. */
@@ -387,7 +384,7 @@ static int ttm_pool_get_num_unused_pages(void)
         unsigned i;
         int total = 0;
         for (i = 0; i < NUM_POOLS; ++i)
-                total += _manager.pools[i].npages;
+                total += _manager->pools[i].npages;
 
         return total;
 }
@@ -408,7 +405,7 @@ static int ttm_pool_mm_shrink(int shrink_pages, gfp_t gfp_mask)
                 unsigned nr_free = shrink_pages;
                 if (shrink_pages == 0)
                         break;
-                pool = &_manager.pools[(i + pool_offset)%NUM_POOLS];
+                pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
                 shrink_pages = ttm_page_pool_free(pool, nr_free);
         }
         /* return estimated number of unused pages in pool */
@@ -576,10 +573,10 @@ static void ttm_page_pool_fill_locked(struct ttm_page_pool *pool,
 
         /* If allocation request is small and there is not enough
          * pages in pool we fill the pool first */
-        if (count < _manager.options.small
+        if (count < _manager->options.small
                 && count > pool->npages) {
                 struct list_head new_pages;
-                unsigned alloc_size = _manager.options.alloc_size;
+                unsigned alloc_size = _manager->options.alloc_size;
 
                 /**
                  * Can't change page caching if in irqsave context. We have to
@@ -667,7 +664,7 @@ int ttm_get_pages(struct list_head *pages, int flags,
 {
         struct ttm_page_pool *pool = ttm_get_pool(flags, cstate);
         struct page *p = NULL;
-        int gfp_flags = 0;
+        int gfp_flags = GFP_USER;
         int r;
 
         /* set zero flag for page allocation if required */
@@ -759,8 +756,8 @@ void ttm_put_pages(struct list_head *pages, unsigned page_count, int flags,
         pool->npages += page_count;
         /* Check that we don't go over the pool limit */
         page_count = 0;
-        if (pool->npages > _manager.options.max_size) {
-                page_count = pool->npages - _manager.options.max_size;
+        if (pool->npages > _manager->options.max_size) {
+                page_count = pool->npages - _manager->options.max_size;
                 /* free at least NUM_PAGES_TO_ALLOC number of pages
                  * to reduce calls to set_memory_wb */
                 if (page_count < NUM_PAGES_TO_ALLOC)
@@ -785,33 +782,36 @@ static void ttm_page_pool_init_locked(struct ttm_page_pool *pool, int flags,
 int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages)
 {
         int ret;
-        if (atomic_add_return(1, &_manager.page_alloc_inited) > 1)
-                return 0;
+
+        WARN_ON(_manager);
 
         printk(KERN_INFO TTM_PFX "Initializing pool allocator.\n");
 
-        ttm_page_pool_init_locked(&_manager.wc_pool, GFP_HIGHUSER, "wc");
+        _manager = kzalloc(sizeof(*_manager), GFP_KERNEL);
 
-        ttm_page_pool_init_locked(&_manager.uc_pool, GFP_HIGHUSER, "uc");
+        ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc");
 
-        ttm_page_pool_init_locked(&_manager.wc_pool_dma32, GFP_USER | GFP_DMA32,
-                        "wc dma");
+        ttm_page_pool_init_locked(&_manager->uc_pool, GFP_HIGHUSER, "uc");
 
-        ttm_page_pool_init_locked(&_manager.uc_pool_dma32, GFP_USER | GFP_DMA32,
-                        "uc dma");
+        ttm_page_pool_init_locked(&_manager->wc_pool_dma32,
+                                  GFP_USER | GFP_DMA32, "wc dma");
 
-        _manager.options.max_size = max_pages;
-        _manager.options.small = SMALL_ALLOCATION;
-        _manager.options.alloc_size = NUM_PAGES_TO_ALLOC;
+        ttm_page_pool_init_locked(&_manager->uc_pool_dma32,
+                                  GFP_USER | GFP_DMA32, "uc dma");
 
-        kobject_init(&_manager.kobj, &ttm_pool_kobj_type);
-        ret = kobject_add(&_manager.kobj, &glob->kobj, "pool");
+        _manager->options.max_size = max_pages;
+        _manager->options.small = SMALL_ALLOCATION;
+        _manager->options.alloc_size = NUM_PAGES_TO_ALLOC;
+
+        ret = kobject_init_and_add(&_manager->kobj, &ttm_pool_kobj_type,
+                                   &glob->kobj, "pool");
         if (unlikely(ret != 0)) {
-                kobject_put(&_manager.kobj);
+                kobject_put(&_manager->kobj);
+                _manager = NULL;
                 return ret;
         }
 
-        ttm_pool_mm_shrink_init(&_manager);
+        ttm_pool_mm_shrink_init(_manager);
 
         return 0;
 }
@@ -820,16 +820,14 @@ void ttm_page_alloc_fini()
 {
         int i;
 
-        if (atomic_sub_return(1, &_manager.page_alloc_inited) > 0)
-                return;
-
         printk(KERN_INFO TTM_PFX "Finalizing pool allocator.\n");
-        ttm_pool_mm_shrink_fini(&_manager);
+        ttm_pool_mm_shrink_fini(_manager);
 
         for (i = 0; i < NUM_POOLS; ++i)
-                ttm_page_pool_free(&_manager.pools[i], FREE_ALL_PAGES);
+                ttm_page_pool_free(&_manager->pools[i], FREE_ALL_PAGES);
 
-        kobject_put(&_manager.kobj);
+        kobject_put(&_manager->kobj);
+        _manager = NULL;
 }
 
 int ttm_page_alloc_debugfs(struct seq_file *m, void *data)
@@ -837,14 +835,14 @@ int ttm_page_alloc_debugfs(struct seq_file *m, void *data)
         struct ttm_page_pool *p;
         unsigned i;
         char *h[] = {"pool", "refills", "pages freed", "size"};
-        if (atomic_read(&_manager.page_alloc_inited) == 0) {
+        if (!_manager) {
                 seq_printf(m, "No pool allocator running.\n");
                 return 0;
         }
         seq_printf(m, "%6s %12s %13s %8s\n",
                         h[0], h[1], h[2], h[3]);
         for (i = 0; i < NUM_POOLS; ++i) {
-                p = &_manager.pools[i];
+                p = &_manager->pools[i];
 
                 seq_printf(m, "%6s %12ld %13ld %8d\n",
                                 p->name, p->nrefills,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index bdd67cf83315..8e396850513c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -644,6 +644,7 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
         ret = copy_from_user(cmd, user_cmd, arg->command_size);
 
         if (unlikely(ret != 0)) {
+                ret = -EFAULT;
                 DRM_ERROR("Failed copying commands.\n");
                 goto out_commit;
         }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index f8fbbc67a406..8612378b131e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -597,8 +597,10 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
 
         ret = copy_from_user(srf->sizes, user_sizes,
                              srf->num_sizes * sizeof(*srf->sizes));
-        if (unlikely(ret != 0))
+        if (unlikely(ret != 0)) {
+                ret = -EFAULT;
                 goto out_err1;
+        }
 
         if (srf->scanout &&
             srf->num_sizes == 1 &&
@@ -697,9 +699,11 @@ int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,
         if (user_sizes)
                 ret = copy_to_user(user_sizes, srf->sizes,
                                    srf->num_sizes * sizeof(*srf->sizes));
-        if (unlikely(ret != 0))
+        if (unlikely(ret != 0)) {
                 DRM_ERROR("copy_to_user failed %p %u\n",
                           user_sizes, srf->num_sizes);
+                ret = -EFAULT;
+        }
 out_bad_resource:
 out_no_reference:
         ttm_base_object_unref(&base);
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 132278fa6240..434099369058 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -358,6 +358,7 @@ config HID_ROCCAT
 config HID_ROCCAT_KONE
         tristate "Roccat Kone Mouse support"
         depends on USB_HID
+        select HID_ROCCAT
         ---help---
         Support for Roccat Kone mouse.
 
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index aa0f7dcabcd7..866e54ec5fb2 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1337,6 +1337,24 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) },
         { HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_4) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_5) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_6) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_7) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_8) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_9) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_10) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_11) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_12) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_13) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_14) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_15) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
         { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) },
         { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH) },
@@ -1760,7 +1778,8 @@ int hid_add_device(struct hid_device *hdev)
 
         /* we need to kill them here, otherwise they will stay allocated to
          * wait for coming driver */
-        if (!(hdev->quirks & HID_QUIRK_NO_IGNORE) && hid_ignore(hdev))
+        if (!(hdev->quirks & HID_QUIRK_NO_IGNORE)
+            && (hid_ignore(hdev) || (hdev->quirks & HID_QUIRK_IGNORE)))
                 return -ENODEV;
 
         /* XXX hack, any other cleaner solution after the driver core
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index c94026768570..850d02a7a925 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -949,8 +949,8 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer,
         int ret = 0, len;
         DECLARE_WAITQUEUE(wait, current);
 
+        mutex_lock(&list->read_mutex);
         while (ret == 0) {
-                mutex_lock(&list->read_mutex);
                 if (list->head == list->tail) {
                         add_wait_queue(&list->hdev->debug_wait, &wait);
                         set_current_state(TASK_INTERRUPTIBLE);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 6af77ed0b555..31601eef25dd 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -134,6 +134,7 @@
 #define USB_VENDOR_ID_CH                0x068e
 #define USB_DEVICE_ID_CH_PRO_PEDALS     0x00f2
 #define USB_DEVICE_ID_CH_COMBATSTICK    0x00f4
+#define USB_DEVICE_ID_CH_FLIGHT_SIM_ECLIPSE_YOKE       0x0051
 #define USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE        0x00ff
 #define USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK    0x00d3
 
@@ -369,6 +370,8 @@
 #define USB_DEVICE_ID_MS_PRESENTER_8K_BT        0x0701
 #define USB_DEVICE_ID_MS_PRESENTER_8K_USB       0x0713
 
+#define USB_VENDOR_ID_MOJO              0x8282
+#define USB_DEVICE_ID_RETRO_ADAPTER     0x3201
 
 #define USB_VENDOR_ID_MONTEREY          0x0566
 #define USB_DEVICE_ID_GENIUS_KB29E      0x3004
@@ -391,6 +394,24 @@
 
 #define USB_VENDOR_ID_NTRIG                0x1b96
 #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN   0x0001
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1   0x0003
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_2   0x0004
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_3   0x0005
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_4   0x0006
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_5   0x0007
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_6   0x0008
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_7   0x0009
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_8   0x000A
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_9   0x000B
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_10   0x000C
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_11   0x000D
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_12   0x000E
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_13   0x000F
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_14   0x0010
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_15   0x0011
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16   0x0012
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17   0x0013
+#define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18   0x0014
 
 #define USB_VENDOR_ID_ONTRAK            0x0a07
 #define USB_DEVICE_ID_ONTRAK_ADU100     0x0064
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
index b6b0caeeac58..fb69b8c4953f 100644
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@@ -868,6 +868,42 @@ static void ntrig_remove(struct hid_device *hdev)
 static const struct hid_device_id ntrig_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN),
                 .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_2),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_3),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_4),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_5),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_6),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_7),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_8),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_9),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_10),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_11),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_12),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_13),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_14),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_15),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
+        { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18),
+                .driver_data = NTRIG_DUPLICATE_USAGES },
         { }
 };
 MODULE_DEVICE_TABLE(hid, ntrig_devices);
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 1ebd3244eb85..b729c0286679 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -827,14 +827,21 @@ static int usbhid_output_raw_report(struct hid_device *hid, __u8 *buf, size_t co
                                 ret++;
                 }
         } else {
+                int skipped_report_id = 0;
+                if (buf[0] == 0x0) {
+                        /* Don't send the Report ID */
+                        buf++;
+                        count--;
+                        skipped_report_id = 1;
+                }
                 ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
                         HID_REQ_SET_REPORT,
                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
                         ((report_type + 1) << 8) | *buf,
-                        interface->desc.bInterfaceNumber, buf + 1, count - 1,
+                        interface->desc.bInterfaceNumber, buf, count,
                         USB_CTRL_SET_TIMEOUT);
-                /* count also the report id */
-                if (ret > 0)
+                /* count also the report id, if this was a numbered report. */
+                if (ret > 0 && skipped_report_id)
                         ret++;
         }
 
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 5ff8d327f33a..5f5aa39b3988 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -34,6 +34,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ALPS, USB_DEVICE_ID_IBM_GAMEPAD, HID_QUIRK_BADPAD },
         { USB_VENDOR_ID_CHIC, USB_DEVICE_ID_CHIC_GAMEPAD, HID_QUIRK_BADPAD },
         { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_MOJO, USB_DEVICE_ID_RETRO_ADAPTER, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
@@ -56,6 +57,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_ECLIPSE_YOKE, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 2988da150ed6..05344af50734 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -53,6 +53,7 @@ struct coretemp_data {
         struct mutex update_lock;
         const char *name;
         u32 id;
+        u16 core_id;
         char valid;             /* zero until following fields are valid */
         unsigned long last_updated;     /* in jiffies */
         int temp;
@@ -75,7 +76,7 @@ static ssize_t show_name(struct device *dev, struct device_attribute
         if (attr->index == SHOW_NAME)
                 ret = sprintf(buf, "%s\n", data->name);
         else    /* show label */
-                ret = sprintf(buf, "Core %d\n", data->id);
+                ret = sprintf(buf, "Core %d\n", data->core_id);
         return ret;
 }
 
@@ -304,6 +305,9 @@ static int __devinit coretemp_probe(struct platform_device *pdev)
         }
 
         data->id = pdev->id;
+#ifdef CONFIG_SMP
+        data->core_id = c->cpu_core_id;
+#endif
         data->name = "coretemp";
         mutex_init(&data->update_lock);
 
@@ -405,6 +409,10 @@ struct pdev_entry {
         struct list_head list;
         struct platform_device *pdev;
         unsigned int cpu;
+#ifdef CONFIG_SMP
+        u16 phys_proc_id;
+        u16 cpu_core_id;
+#endif
 };
 
 static LIST_HEAD(pdev_list);
@@ -415,6 +423,22 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
         int err;
         struct platform_device *pdev;
         struct pdev_entry *pdev_entry;
+#ifdef CONFIG_SMP
+        struct cpuinfo_x86 *c = &cpu_data(cpu);
+#endif
+
+        mutex_lock(&pdev_list_mutex);
+
+#ifdef CONFIG_SMP
+        /* Skip second HT entry of each core */
+        list_for_each_entry(pdev_entry, &pdev_list, list) {
+                if (c->phys_proc_id == pdev_entry->phys_proc_id &&
+                    c->cpu_core_id == pdev_entry->cpu_core_id) {
+                        err = 0;        /* Not an error */
+                        goto exit;
+                }
+        }
+#endif
 
         pdev = platform_device_alloc(DRVNAME, cpu);
         if (!pdev) {
@@ -438,7 +462,10 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
 
         pdev_entry->pdev = pdev;
         pdev_entry->cpu = cpu;
-        mutex_lock(&pdev_list_mutex);
+#ifdef CONFIG_SMP
+        pdev_entry->phys_proc_id = c->phys_proc_id;
+        pdev_entry->cpu_core_id = c->cpu_core_id;
+#endif
         list_add_tail(&pdev_entry->list, &pdev_list);
         mutex_unlock(&pdev_list_mutex);
 
@@ -449,6 +476,7 @@ exit_device_free:
 exit_device_put:
         platform_device_put(pdev);
 exit:
+        mutex_unlock(&pdev_list_mutex);
         return err;
 }
 
diff --git a/drivers/hwmon/i5k_amb.c b/drivers/hwmon/i5k_amb.c
index e880e2c3871d..937983407e2a 100644
--- a/drivers/hwmon/i5k_amb.c
+++ b/drivers/hwmon/i5k_amb.c
@@ -289,6 +289,7 @@ static int __devinit i5k_amb_hwmon_init(struct platform_device *pdev)
                         iattr->s_attr.dev_attr.attr.mode = S_IRUGO;
                         iattr->s_attr.dev_attr.show = show_label;
                         iattr->s_attr.index = k;
+                        sysfs_attr_init(&iattr->s_attr.dev_attr.attr);
                         res = device_create_file(&pdev->dev,
                                                  &iattr->s_attr.dev_attr);
                         if (res)
@@ -303,6 +304,7 @@ static int __devinit i5k_amb_hwmon_init(struct platform_device *pdev)
                         iattr->s_attr.dev_attr.attr.mode = S_IRUGO;
                         iattr->s_attr.dev_attr.show = show_amb_temp;
                         iattr->s_attr.index = k;
+                        sysfs_attr_init(&iattr->s_attr.dev_attr.attr);
                         res = device_create_file(&pdev->dev,
                                                  &iattr->s_attr.dev_attr);
                         if (res)
@@ -318,6 +320,7 @@ static int __devinit i5k_amb_hwmon_init(struct platform_device *pdev)
                         iattr->s_attr.dev_attr.show = show_amb_min;
                         iattr->s_attr.dev_attr.store = store_amb_min;
                         iattr->s_attr.index = k;
+                        sysfs_attr_init(&iattr->s_attr.dev_attr.attr);
                         res = device_create_file(&pdev->dev,
                                                  &iattr->s_attr.dev_attr);
                         if (res)
@@ -333,6 +336,7 @@ static int __devinit i5k_amb_hwmon_init(struct platform_device *pdev)
                         iattr->s_attr.dev_attr.show = show_amb_mid;
                         iattr->s_attr.dev_attr.store = store_amb_mid;
                         iattr->s_attr.index = k;
+                        sysfs_attr_init(&iattr->s_attr.dev_attr.attr);
                         res = device_create_file(&pdev->dev,
                                                  &iattr->s_attr.dev_attr);
                         if (res)
@@ -348,6 +352,7 @@ static int __devinit i5k_amb_hwmon_init(struct platform_device *pdev)
                         iattr->s_attr.dev_attr.show = show_amb_max;
                         iattr->s_attr.dev_attr.store = store_amb_max;
                         iattr->s_attr.index = k;
+                        sysfs_attr_init(&iattr->s_attr.dev_attr.attr);
                         res = device_create_file(&pdev->dev,
                                                  &iattr->s_attr.dev_attr);
                         if (res)
@@ -362,6 +367,7 @@ static int __devinit i5k_amb_hwmon_init(struct platform_device *pdev)
                         iattr->s_attr.dev_attr.attr.mode = S_IRUGO;
                         iattr->s_attr.dev_attr.show = show_amb_alarm;
                         iattr->s_attr.index = k;
+                        sysfs_attr_init(&iattr->s_attr.dev_attr.attr);
                         res = device_create_file(&pdev->dev,
                                                  &iattr->s_attr.dev_attr);
                         if (res)
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index 5be09c048c5f..25763d2223b6 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -80,6 +80,13 @@ superio_inb(int reg)
         return inb(VAL);
 }
 
+static inline void
+superio_outb(int reg, int val)
+{
+        outb(reg, REG);
+        outb(val, VAL);
+}
+
 static int superio_inw(int reg)
 {
         int val;
@@ -1517,6 +1524,21 @@ static int __init it87_find(unsigned short *address,
                         sio_data->vid_value = superio_inb(IT87_SIO_VID_REG);
 
                 reg = superio_inb(IT87_SIO_PINX2_REG);
+                /*
+                 * The IT8720F has no VIN7 pin, so VCCH should always be
+                 * routed internally to VIN7 with an internal divider.
+                 * Curiously, there still is a configuration bit to control
+                 * this, which means it can be set incorrectly. And even
+                 * more curiously, many boards out there are improperly
+                 * configured, even though the IT8720F datasheet claims
+                 * that the internal routing of VCCH to VIN7 is the default
+                 * setting. So we force the internal routing in this case.
+                 */
+                if (sio_data->type == it8720 && !(reg & (1 << 1))) {
+                        reg |= (1 << 1);
+                        superio_outb(IT87_SIO_PINX2_REG, reg);
+                        pr_notice("it87: Routing internal VCCH to in7\n");
+                }
                 if (reg & (1 << 0))
                         pr_info("it87: in3 is VCC (+5V)\n");
                 if (reg & (1 << 1))
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index 099a2138cdf6..da5a2404cd3e 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -112,11 +112,21 @@ static bool __devinit has_erratum_319(struct pci_dev *pdev)
         if (pkg_type != CPUID_PKGTYPE_AM2R2_AM3)
                 return false;
 
-        /* Differentiate between AM2+ (bad) and AM3 (good) */
+        /* DDR3 memory implies socket AM3, which is good */
         pci_bus_read_config_dword(pdev->bus,
                                   PCI_DEVFN(PCI_SLOT(pdev->devfn), 2),
                                   REG_DCT0_CONFIG_HIGH, &reg_dram_cfg);
-        return !(reg_dram_cfg & DDR3_MODE);
+        if (reg_dram_cfg & DDR3_MODE)
+                return false;
+
+        /*
+         * Unfortunately it is possible to run a socket AM3 CPU with DDR2
+         * memory. We blacklist all the cores which do exist in socket AM2+
+         * format. It still isn't perfect, as RB-C2 cores exist in both AM2+
+         * and AM3 formats, but that's the best we can do.
+         */
+        return boot_cpu_data.x86_model < 4 ||
+               (boot_cpu_data.x86_model == 4 && boot_cpu_data.x86_mask <= 2);
 }
 
 static int __devinit k10temp_probe(struct pci_dev *pdev,
diff --git a/drivers/hwmon/k8temp.c b/drivers/hwmon/k8temp.c
index 0ceb6d6200a3..8bdf80d91598 100644
--- a/drivers/hwmon/k8temp.c
+++ b/drivers/hwmon/k8temp.c
@@ -120,7 +120,7 @@ static ssize_t show_temp(struct device *dev,
         int temp;
         struct k8temp_data *data = k8temp_update_device(dev);
 
-        if (data->swap_core_select)
+        if (data->swap_core_select && (data->sensorsp & SEL_CORE))
                 core = core ? 0 : 1;
 
         temp = TEMP_FROM_REG(data->temp[core][place]) + data->temp_offset;
@@ -180,11 +180,13 @@ static int __devinit k8temp_probe(struct pci_dev *pdev,
                 }
 
                 if ((model >= 0x69) &&
-                    !(model == 0xc1 || model == 0x6c || model == 0x7c)) {
+                    !(model == 0xc1 || model == 0x6c || model == 0x7c ||
+                      model == 0x6b || model == 0x6f || model == 0x7f)) {
                         /*
-                         * RevG desktop CPUs (i.e. no socket S1G1 parts)
-                         * need additional offset, otherwise reported
-                         * temperature is below ambient temperature
+                         * RevG desktop CPUs (i.e. no socket S1G1 or
+                         * ASB1 parts) need additional offset,
+                         * otherwise reported temperature is below
+                         * ambient temperature
                          */
                         data->temp_offset = 21000;
                 }
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index f4b21f2bb8ed..c60081169cc3 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -655,7 +655,7 @@ static void __devinit dmi_check_onboard_device(u8 type, const char *name,
                 /* & ~0x80, ignore enabled/disabled bit */
                 if ((type & ~0x80) != dmi_devices[i].type)
                         continue;
-                if (strcmp(name, dmi_devices[i].name))
+                if (strcasecmp(name, dmi_devices[i].name))
                         continue;
 
                 memset(&info, 0, sizeof(struct i2c_board_info));
@@ -704,9 +704,6 @@ static int __devinit i801_probe(struct pci_dev *dev,
 {
         unsigned char temp;
         int err, i;
-#if defined CONFIG_SENSORS_FSCHMD || defined CONFIG_SENSORS_FSCHMD_MODULE
-        const char *vendor;
-#endif
 
         I801_dev = dev;
         i801_features = 0;
@@ -808,8 +805,7 @@ static int __devinit i801_probe(struct pci_dev *dev,
         }
 #endif
 #if defined CONFIG_SENSORS_FSCHMD || defined CONFIG_SENSORS_FSCHMD_MODULE
-        vendor = dmi_get_system_info(DMI_BOARD_VENDOR);
-        if (vendor && !strcmp(vendor, "FUJITSU SIEMENS"))
+        if (dmi_name_in_vendors("FUJITSU"))
                 dmi_walk(dmi_check_onboard_devices, &i801_adapter);
 #endif
 
diff --git a/drivers/i2c/busses/i2c-sibyte.c b/drivers/i2c/busses/i2c-sibyte.c
index 3d76a188e42f..0fe505d7abe9 100644
--- a/drivers/i2c/busses/i2c-sibyte.c
+++ b/drivers/i2c/busses/i2c-sibyte.c
@@ -94,7 +94,7 @@ static int smbus_xfer(struct i2c_adapter *i2c_adap, u16 addr,
                 }
                 break;
         default:
-                return -1;      /* XXXKW better error code? */
+                return -EOPNOTSUPP;
         }
 
         while (csr_in32(SMB_CSR(adap, R_SMB_STATUS)) & M_SMB_BUSY)
@@ -104,7 +104,7 @@ static int smbus_xfer(struct i2c_adapter *i2c_adap, u16 addr,
         if (error & M_SMB_ERROR) {
                 /* Clear error bit by writing a 1 */
                 csr_out32(M_SMB_ERROR, SMB_CSR(adap, R_SMB_STATUS));
-                return -1;      /* XXXKW better error code? */
+                return (error & M_SMB_ERROR_TYPE) ? -EIO : -ENXIO;
         }
 
         if (data_bytes == 1)
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 1cca2631e5b3..0815e10da7c6 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -1428,13 +1428,12 @@ static int i2c_detect(struct i2c_adapter *adapter, struct i2c_driver *driver)
         if (!(adapter->class & driver->class))
                 goto exit_free;
 
-        /* Stop here if we can't use SMBUS_QUICK */
-        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_QUICK)) {
+        /* Stop here if the bus doesn't support probing */
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_READ_BYTE)) {
                 if (address_list[0] == I2C_CLIENT_END)
                         goto exit_free;
 
-                dev_warn(&adapter->dev, "SMBus Quick command not supported, "
-                         "can't probe for chips\n");
+                dev_warn(&adapter->dev, "Probing not supported\n");
                 err = -EOPNOTSUPP;
                 goto exit_free;
         }
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 30ce0a8eca09..855ee44fdb52 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -969,7 +969,8 @@ static void process_mpa_reply(struct c4iw_ep *ep, struct sk_buff *skb)
                 goto err;
         goto out;
 err:
-        abort_connection(ep, skb, GFP_KERNEL);
+        state_set(&ep->com, ABORTING);
+        send_abort(ep, skb, GFP_KERNEL);
 out:
         connect_reply_upcall(ep, err);
         return;
@@ -1372,7 +1373,7 @@ static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb)
                                     pdev, 0);
                 mtu = pdev->mtu;
                 tx_chan = cxgb4_port_chan(pdev);
-                smac_idx = tx_chan << 1;
+                smac_idx = (cxgb4_port_viid(pdev) & 0x7F) << 1;
                 step = dev->rdev.lldi.ntxq / dev->rdev.lldi.nchan;
                 txq_idx = cxgb4_port_idx(pdev) * step;
                 step = dev->rdev.lldi.nrxq / dev->rdev.lldi.nchan;
@@ -1383,7 +1384,7 @@ static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb)
                                         dst->neighbour->dev, 0);
                 mtu = dst_mtu(dst);
                 tx_chan = cxgb4_port_chan(dst->neighbour->dev);
-                smac_idx = tx_chan << 1;
+                smac_idx = (cxgb4_port_viid(dst->neighbour->dev) & 0x7F) << 1;
                 step = dev->rdev.lldi.ntxq / dev->rdev.lldi.nchan;
                 txq_idx = cxgb4_port_idx(dst->neighbour->dev) * step;
                 step = dev->rdev.lldi.nrxq / dev->rdev.lldi.nchan;
@@ -1950,7 +1951,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                                         pdev, 0);
                 ep->mtu = pdev->mtu;
                 ep->tx_chan = cxgb4_port_chan(pdev);
-                ep->smac_idx = ep->tx_chan << 1;
+                ep->smac_idx = (cxgb4_port_viid(pdev) & 0x7F) << 1;
                 step = ep->com.dev->rdev.lldi.ntxq /
                        ep->com.dev->rdev.lldi.nchan;
                 ep->txq_idx = cxgb4_port_idx(pdev) * step;
@@ -1965,7 +1966,8 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                                         ep->dst->neighbour->dev, 0);
                 ep->mtu = dst_mtu(ep->dst);
                 ep->tx_chan = cxgb4_port_chan(ep->dst->neighbour->dev);
-                ep->smac_idx = ep->tx_chan << 1;
+                ep->smac_idx = (cxgb4_port_viid(ep->dst->neighbour->dev) &
+                                0x7F) << 1;
                 step = ep->com.dev->rdev.lldi.ntxq /
                        ep->com.dev->rdev.lldi.nchan;
                 ep->txq_idx = cxgb4_port_idx(ep->dst->neighbour->dev) * step;
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 2447f5295482..fac5c6e68011 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -77,7 +77,7 @@ static int destroy_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
         kfree(cq->sw_queue);
         dma_free_coherent(&(rdev->lldi.pdev->dev),
                           cq->memsize, cq->queue,
-                          pci_unmap_addr(cq, mapping));
+                          dma_unmap_addr(cq, mapping));
         c4iw_put_cqid(rdev, cq->cqid, uctx);
         return ret;
 }
@@ -112,7 +112,7 @@ static int create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
                 ret = -ENOMEM;
                 goto err3;
         }
-        pci_unmap_addr_set(cq, mapping, cq->dma_addr);
+        dma_unmap_addr_set(cq, mapping, cq->dma_addr);
         memset(cq->queue, 0, cq->memsize);
 
         /* build fw_ri_res_wr */
@@ -179,7 +179,7 @@ static int create_cq(struct c4iw_rdev *rdev, struct t4_cq *cq,
         return 0;
 err4:
         dma_free_coherent(&rdev->lldi.pdev->dev, cq->memsize, cq->queue,
-                          pci_unmap_addr(cq, mapping));
+                          dma_unmap_addr(cq, mapping));
 err3:
         kfree(cq->sw_queue);
 err2:
@@ -764,7 +764,7 @@ struct ib_cq *c4iw_create_cq(struct ib_device *ibdev, int entries,
         struct c4iw_create_cq_resp uresp;
         struct c4iw_ucontext *ucontext = NULL;
         int ret;
-        size_t memsize;
+        size_t memsize, hwentries;
         struct c4iw_mm_entry *mm, *mm2;
 
         PDBG("%s ib_dev %p entries %d\n", __func__, ibdev, entries);
@@ -788,14 +788,29 @@ struct ib_cq *c4iw_create_cq(struct ib_device *ibdev, int entries,
          * entries must be multiple of 16 for HW.
          */
         entries = roundup(entries, 16);
-        memsize = entries * sizeof *chp->cq.queue;
+
+        /*
+         * Make actual HW queue 2x to avoid cdix_inc overflows.
+         */
+        hwentries = entries * 2;
+
+        /*
+         * Make HW queue at least 64 entries so GTS updates aren't too
+         * frequent.
+         */
+        if (hwentries < 64)
+                hwentries = 64;
+
+        memsize = hwentries * sizeof *chp->cq.queue;
 
         /*
          * memsize must be a multiple of the page size if its a user cq.
          */
-        if (ucontext)
+        if (ucontext) {
                 memsize = roundup(memsize, PAGE_SIZE);
-        chp->cq.size = entries;
+                hwentries = memsize / sizeof *chp->cq.queue;
+        }
+        chp->cq.size = hwentries;
         chp->cq.memsize = memsize;
 
         ret = create_cq(&rhp->rdev, &chp->cq,
@@ -805,7 +820,7 @@ struct ib_cq *c4iw_create_cq(struct ib_device *ibdev, int entries,
 
         chp->rhp = rhp;
         chp->cq.size--;                         /* status page */
-        chp->ibcq.cqe = chp->cq.size - 1;
+        chp->ibcq.cqe = entries - 2;
         spin_lock_init(&chp->lock);
         atomic_set(&chp->refcnt, 1);
         init_waitqueue_head(&chp->wait);
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index 277ab589b44d..d33e1a668811 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -261,7 +261,7 @@ static inline struct c4iw_mw *to_c4iw_mw(struct ib_mw *ibmw)
 
 struct c4iw_fr_page_list {
         struct ib_fast_reg_page_list ibpl;
-        DECLARE_PCI_UNMAP_ADDR(mapping);
+        DEFINE_DMA_UNMAP_ADDR(mapping);
         dma_addr_t dma_addr;
         struct c4iw_dev *dev;
         int size;
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 7f94da1a2437..82b5703b8947 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -764,7 +764,7 @@ struct ib_fast_reg_page_list *c4iw_alloc_fastreg_pbl(struct ib_device *device,
         if (!c4pl)
                 return ERR_PTR(-ENOMEM);
 
-        pci_unmap_addr_set(c4pl, mapping, dma_addr);
+        dma_unmap_addr_set(c4pl, mapping, dma_addr);
         c4pl->dma_addr = dma_addr;
         c4pl->dev = dev;
         c4pl->size = size;
@@ -779,7 +779,7 @@ void c4iw_free_fastreg_pbl(struct ib_fast_reg_page_list *ibpl)
         struct c4iw_fr_page_list *c4pl = to_c4iw_fr_page_list(ibpl);
 
         dma_free_coherent(&c4pl->dev->rdev.lldi.pdev->dev, c4pl->size,
-                          c4pl, pci_unmap_addr(c4pl, mapping));
+                          c4pl, dma_unmap_addr(c4pl, mapping));
 }
 
 int c4iw_dereg_mr(struct ib_mr *ib_mr)
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index 0c28ed1eafa6..7065cb310553 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -40,10 +40,10 @@ static int destroy_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
          */
         dma_free_coherent(&(rdev->lldi.pdev->dev),
                           wq->rq.memsize, wq->rq.queue,
-                          pci_unmap_addr(&wq->rq, mapping));
+                          dma_unmap_addr(&wq->rq, mapping));
         dma_free_coherent(&(rdev->lldi.pdev->dev),
                           wq->sq.memsize, wq->sq.queue,
-                          pci_unmap_addr(&wq->sq, mapping));
+                          dma_unmap_addr(&wq->sq, mapping));
         c4iw_rqtpool_free(rdev, wq->rq.rqt_hwaddr, wq->rq.rqt_size);
         kfree(wq->rq.sw_rq);
         kfree(wq->sq.sw_sq);
@@ -99,7 +99,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
         if (!wq->sq.queue)
                 goto err5;
         memset(wq->sq.queue, 0, wq->sq.memsize);
-        pci_unmap_addr_set(&wq->sq, mapping, wq->sq.dma_addr);
+        dma_unmap_addr_set(&wq->sq, mapping, wq->sq.dma_addr);
 
         wq->rq.queue = dma_alloc_coherent(&(rdev->lldi.pdev->dev),
                                           wq->rq.memsize, &(wq->rq.dma_addr),
@@ -112,7 +112,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
                 wq->rq.queue,
                 (unsigned long long)virt_to_phys(wq->rq.queue));
         memset(wq->rq.queue, 0, wq->rq.memsize);
-        pci_unmap_addr_set(&wq->rq, mapping, wq->rq.dma_addr);
+        dma_unmap_addr_set(&wq->rq, mapping, wq->rq.dma_addr);
 
         wq->db = rdev->lldi.db_reg;
         wq->gts = rdev->lldi.gts_reg;
@@ -217,11 +217,11 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
 err7:
         dma_free_coherent(&(rdev->lldi.pdev->dev),
                           wq->rq.memsize, wq->rq.queue,
-                          pci_unmap_addr(&wq->rq, mapping));
+                          dma_unmap_addr(&wq->rq, mapping));
 err6:
         dma_free_coherent(&(rdev->lldi.pdev->dev),
                           wq->sq.memsize, wq->sq.queue,
-                          pci_unmap_addr(&wq->sq, mapping));
+                          dma_unmap_addr(&wq->sq, mapping));
 err5:
         c4iw_rqtpool_free(rdev, wq->rq.rqt_hwaddr, wq->rq.rqt_size);
 err4:
diff --git a/drivers/infiniband/hw/cxgb4/t4.h b/drivers/infiniband/hw/cxgb4/t4.h
index 1057cb96302e..9cf8d85bfcff 100644
--- a/drivers/infiniband/hw/cxgb4/t4.h
+++ b/drivers/infiniband/hw/cxgb4/t4.h
@@ -279,7 +279,7 @@ struct t4_swsqe {
 struct t4_sq {
         union t4_wr *queue;
         dma_addr_t dma_addr;
-        DECLARE_PCI_UNMAP_ADDR(mapping);
+        DEFINE_DMA_UNMAP_ADDR(mapping);
         struct t4_swsqe *sw_sq;
         struct t4_swsqe *oldest_read;
         u64 udb;
@@ -298,7 +298,7 @@ struct t4_swrqe {
 struct t4_rq {
         union  t4_recv_wr *queue;
         dma_addr_t dma_addr;
-        DECLARE_PCI_UNMAP_ADDR(mapping);
+        DEFINE_DMA_UNMAP_ADDR(mapping);
         struct t4_swrqe *sw_rq;
         u64 udb;
         size_t memsize;
@@ -429,7 +429,7 @@ static inline int t4_wq_db_enabled(struct t4_wq *wq)
 struct t4_cq {
         struct t4_cqe *queue;
         dma_addr_t dma_addr;
-        DECLARE_PCI_UNMAP_ADDR(mapping);
+        DEFINE_DMA_UNMAP_ADDR(mapping);
         struct t4_cqe *sw_queue;
         void __iomem *gts;
         struct c4iw_rdev *rdev;
diff --git a/drivers/infiniband/hw/qib/Makefile b/drivers/infiniband/hw/qib/Makefile
index c6515a1b9a6a..f12d7bb8b39f 100644
--- a/drivers/infiniband/hw/qib/Makefile
+++ b/drivers/infiniband/hw/qib/Makefile
@@ -6,7 +6,7 @@ ib_qib-y := qib_cq.o qib_diag.o qib_dma.o qib_driver.o qib_eeprom.o \
         qib_qp.o qib_qsfp.o qib_rc.o qib_ruc.o qib_sdma.o qib_srq.o \
         qib_sysfs.o qib_twsi.o qib_tx.o qib_uc.o qib_ud.o \
         qib_user_pages.o qib_user_sdma.o qib_verbs_mcast.o qib_iba7220.o \
-        qib_sd7220.o qib_sd7220_img.o qib_iba7322.o qib_verbs.o
+        qib_sd7220.o qib_iba7322.o qib_verbs.o
 
 # 6120 has no fallback if no MSI interrupts, others can do INTx
 ib_qib-$(CONFIG_PCI_MSI) += qib_iba6120.o
diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
index 32d9208efcff..3593983df7ba 100644
--- a/drivers/infiniband/hw/qib/qib.h
+++ b/drivers/infiniband/hw/qib/qib.h
@@ -686,6 +686,7 @@ struct qib_devdata {
         void __iomem *piobase;
         /* mem-mapped pointer to base of user chip regs (if using WC PAT) */
         u64 __iomem *userbase;
+        void __iomem *piovl15base; /* base of VL15 buffers, if not WC */
         /*
          * points to area where PIOavail registers will be DMA'ed.
          * Has to be on a page of it's own, because the page will be
diff --git a/drivers/infiniband/hw/qib/qib_7220.h b/drivers/infiniband/hw/qib/qib_7220.h
index ea0bfd896f92..21f374aa0631 100644
--- a/drivers/infiniband/hw/qib/qib_7220.h
+++ b/drivers/infiniband/hw/qib/qib_7220.h
@@ -109,10 +109,6 @@ struct qib_chippport_specific {
  */
 int qib_sd7220_presets(struct qib_devdata *dd);
 int qib_sd7220_init(struct qib_devdata *dd);
-int qib_sd7220_prog_ld(struct qib_devdata *dd, int sdnum, u8 *img,
-                       int len, int offset);
-int qib_sd7220_prog_vfy(struct qib_devdata *dd, int sdnum, const u8 *img,
-                        int len, int offset);
 void qib_sd7220_clr_ibpar(struct qib_devdata *);
 /*
  * Below used for sdnum parameter, selecting one of the two sections
@@ -121,9 +117,6 @@ void qib_sd7220_clr_ibpar(struct qib_devdata *);
  */
 #define IB_7220_SERDES 2
 
-int qib_sd7220_ib_load(struct qib_devdata *dd);
-int qib_sd7220_ib_vfy(struct qib_devdata *dd);
-
 static inline u32 qib_read_kreg32(const struct qib_devdata *dd,
                                   const u16 regno)
 {
diff --git a/drivers/infiniband/hw/qib/qib_7322_regs.h b/drivers/infiniband/hw/qib/qib_7322_regs.h
index a97440ba924c..32dc81ff8d4a 100644
--- a/drivers/infiniband/hw/qib/qib_7322_regs.h
+++ b/drivers/infiniband/hw/qib/qib_7322_regs.h
@@ -742,15 +742,15 @@
 #define QIB_7322_HwErrMask_IBCBusFromSPCParityErrMask_1_LSB 0xF
 #define QIB_7322_HwErrMask_IBCBusFromSPCParityErrMask_1_MSB 0xF
 #define QIB_7322_HwErrMask_IBCBusFromSPCParityErrMask_1_RMASK 0x1
-#define QIB_7322_HwErrMask_statusValidNoEopMask_1_LSB 0xE
-#define QIB_7322_HwErrMask_statusValidNoEopMask_1_MSB 0xE
-#define QIB_7322_HwErrMask_statusValidNoEopMask_1_RMASK 0x1
+#define QIB_7322_HwErrMask_IBCBusToSPCParityErrMask_1_LSB 0xE
+#define QIB_7322_HwErrMask_IBCBusToSPCParityErrMask_1_MSB 0xE
+#define QIB_7322_HwErrMask_IBCBusToSPCParityErrMask_1_RMASK 0x1
 #define QIB_7322_HwErrMask_IBCBusFromSPCParityErrMask_0_LSB 0xD
 #define QIB_7322_HwErrMask_IBCBusFromSPCParityErrMask_0_MSB 0xD
 #define QIB_7322_HwErrMask_IBCBusFromSPCParityErrMask_0_RMASK 0x1
-#define QIB_7322_HwErrMask_statusValidNoEopMask_0_LSB 0xC
-#define QIB_7322_HwErrMask_statusValidNoEopMask_0_MSB 0xC
-#define QIB_7322_HwErrMask_statusValidNoEopMask_0_RMASK 0x1
+#define QIB_7322_HwErrMask_statusValidNoEopMask_LSB 0xC
+#define QIB_7322_HwErrMask_statusValidNoEopMask_MSB 0xC
+#define QIB_7322_HwErrMask_statusValidNoEopMask_RMASK 0x1
 #define QIB_7322_HwErrMask_LATriggeredMask_LSB 0xB
 #define QIB_7322_HwErrMask_LATriggeredMask_MSB 0xB
 #define QIB_7322_HwErrMask_LATriggeredMask_RMASK 0x1
@@ -796,15 +796,15 @@
 #define QIB_7322_HwErrStatus_IBCBusFromSPCParityErr_1_LSB 0xF
 #define QIB_7322_HwErrStatus_IBCBusFromSPCParityErr_1_MSB 0xF
 #define QIB_7322_HwErrStatus_IBCBusFromSPCParityErr_1_RMASK 0x1
-#define QIB_7322_HwErrStatus_statusValidNoEop_1_LSB 0xE
-#define QIB_7322_HwErrStatus_statusValidNoEop_1_MSB 0xE
-#define QIB_7322_HwErrStatus_statusValidNoEop_1_RMASK 0x1
+#define QIB_7322_HwErrStatus_IBCBusToSPCParityErr_1_LSB 0xE
+#define QIB_7322_HwErrStatus_IBCBusToSPCParityErr_1_MSB 0xE
+#define QIB_7322_HwErrStatus_IBCBusToSPCParityErr_1_RMASK 0x1
 #define QIB_7322_HwErrStatus_IBCBusFromSPCParityErr_0_LSB 0xD
 #define QIB_7322_HwErrStatus_IBCBusFromSPCParityErr_0_MSB 0xD
 #define QIB_7322_HwErrStatus_IBCBusFromSPCParityErr_0_RMASK 0x1
-#define QIB_7322_HwErrStatus_statusValidNoEop_0_LSB 0xC
-#define QIB_7322_HwErrStatus_statusValidNoEop_0_MSB 0xC
-#define QIB_7322_HwErrStatus_statusValidNoEop_0_RMASK 0x1
+#define QIB_7322_HwErrStatus_statusValidNoEop_LSB 0xC
+#define QIB_7322_HwErrStatus_statusValidNoEop_MSB 0xC
+#define QIB_7322_HwErrStatus_statusValidNoEop_RMASK 0x1
 #define QIB_7322_HwErrStatus_LATriggered_LSB 0xB
 #define QIB_7322_HwErrStatus_LATriggered_MSB 0xB
 #define QIB_7322_HwErrStatus_LATriggered_RMASK 0x1
@@ -850,15 +850,15 @@
 #define QIB_7322_HwErrClear_IBCBusFromSPCParityErrClear_1_LSB 0xF
 #define QIB_7322_HwErrClear_IBCBusFromSPCParityErrClear_1_MSB 0xF
 #define QIB_7322_HwErrClear_IBCBusFromSPCParityErrClear_1_RMASK 0x1
-#define QIB_7322_HwErrClear_IBCBusToSPCparityErrClear_1_LSB 0xE
-#define QIB_7322_HwErrClear_IBCBusToSPCparityErrClear_1_MSB 0xE
-#define QIB_7322_HwErrClear_IBCBusToSPCparityErrClear_1_RMASK 0x1
+#define QIB_7322_HwErrClear_IBCBusToSPCParityErrClear_1_LSB 0xE
+#define QIB_7322_HwErrClear_IBCBusToSPCParityErrClear_1_MSB 0xE
+#define QIB_7322_HwErrClear_IBCBusToSPCParityErrClear_1_RMASK 0x1
 #define QIB_7322_HwErrClear_IBCBusFromSPCParityErrClear_0_LSB 0xD
 #define QIB_7322_HwErrClear_IBCBusFromSPCParityErrClear_0_MSB 0xD
 #define QIB_7322_HwErrClear_IBCBusFromSPCParityErrClear_0_RMASK 0x1
-#define QIB_7322_HwErrClear_IBCBusToSPCparityErrClear_0_LSB 0xC
-#define QIB_7322_HwErrClear_IBCBusToSPCparityErrClear_0_MSB 0xC
-#define QIB_7322_HwErrClear_IBCBusToSPCparityErrClear_0_RMASK 0x1
+#define QIB_7322_HwErrClear_statusValidNoEopClear_LSB 0xC
+#define QIB_7322_HwErrClear_statusValidNoEopClear_MSB 0xC
+#define QIB_7322_HwErrClear_statusValidNoEopClear_RMASK 0x1
 #define QIB_7322_HwErrClear_LATriggeredClear_LSB 0xB
 #define QIB_7322_HwErrClear_LATriggeredClear_MSB 0xB
 #define QIB_7322_HwErrClear_LATriggeredClear_RMASK 0x1
@@ -880,15 +880,15 @@
 #define QIB_7322_HwDiagCtrl_ForceIBCBusFromSPCParityErr_1_LSB 0xF
 #define QIB_7322_HwDiagCtrl_ForceIBCBusFromSPCParityErr_1_MSB 0xF
 #define QIB_7322_HwDiagCtrl_ForceIBCBusFromSPCParityErr_1_RMASK 0x1
-#define QIB_7322_HwDiagCtrl_ForcestatusValidNoEop_1_LSB 0xE
-#define QIB_7322_HwDiagCtrl_ForcestatusValidNoEop_1_MSB 0xE
-#define QIB_7322_HwDiagCtrl_ForcestatusValidNoEop_1_RMASK 0x1
+#define QIB_7322_HwDiagCtrl_ForceIBCBusToSPCParityErr_1_LSB 0xE
+#define QIB_7322_HwDiagCtrl_ForceIBCBusToSPCParityErr_1_MSB 0xE
+#define QIB_7322_HwDiagCtrl_ForceIBCBusToSPCParityErr_1_RMASK 0x1
 #define QIB_7322_HwDiagCtrl_ForceIBCBusFromSPCParityErr_0_LSB 0xD
 #define QIB_7322_HwDiagCtrl_ForceIBCBusFromSPCParityErr_0_MSB 0xD
 #define QIB_7322_HwDiagCtrl_ForceIBCBusFromSPCParityErr_0_RMASK 0x1
-#define QIB_7322_HwDiagCtrl_ForcestatusValidNoEop_0_LSB 0xC
-#define QIB_7322_HwDiagCtrl_ForcestatusValidNoEop_0_MSB 0xC
-#define QIB_7322_HwDiagCtrl_ForcestatusValidNoEop_0_RMASK 0x1
+#define QIB_7322_HwDiagCtrl_ForceIBCBusToSPCParityErr_0_LSB 0xC
+#define QIB_7322_HwDiagCtrl_ForceIBCBusToSPCParityErr_0_MSB 0xC
+#define QIB_7322_HwDiagCtrl_ForceIBCBusToSPCParityErr_0_RMASK 0x1
 
 #define QIB_7322_EXTStatus_OFFS 0xC0
 #define QIB_7322_EXTStatus_DEF 0x000000000000X000
diff --git a/drivers/infiniband/hw/qib/qib_diag.c b/drivers/infiniband/hw/qib/qib_diag.c
index ca98dd523752..05dcf0d9a7d3 100644
--- a/drivers/infiniband/hw/qib/qib_diag.c
+++ b/drivers/infiniband/hw/qib/qib_diag.c
@@ -233,6 +233,7 @@ static u32 __iomem *qib_remap_ioaddr32(struct qib_devdata *dd, u32 offset,
         u32 __iomem *krb32 = (u32 __iomem *)dd->kregbase;
         u32 __iomem *map = NULL;
         u32 cnt = 0;
+        u32 tot4k, offs4k;
 
         /* First, simplest case, offset is within the first map. */
         kreglen = (dd->kregend - dd->kregbase) * sizeof(u64);
@@ -250,7 +251,8 @@ static u32 __iomem *qib_remap_ioaddr32(struct qib_devdata *dd, u32 offset,
         if (dd->userbase) {
                 /* If user regs mapped, they are after send, so set limit. */
                 u32 ulim = (dd->cfgctxts * dd->ureg_align) + dd->uregbase;
-                snd_lim = dd->uregbase;
+                if (!dd->piovl15base)
+                        snd_lim = dd->uregbase;
                 krb32 = (u32 __iomem *)dd->userbase;
                 if (offset >= dd->uregbase && offset < ulim) {
                         map = krb32 + (offset - dd->uregbase) / sizeof(u32);
@@ -277,14 +279,14 @@ static u32 __iomem *qib_remap_ioaddr32(struct qib_devdata *dd, u32 offset,
         /* If 4k buffers exist, account for them by bumping
          * appropriate limit.
          */
+        tot4k = dd->piobcnt4k * dd->align4k;
+        offs4k = dd->piobufbase >> 32;
         if (dd->piobcnt4k) {
-                u32 tot4k = dd->piobcnt4k * dd->align4k;
-                u32 offs4k = dd->piobufbase >> 32;
                 if (snd_bottom > offs4k)
                         snd_bottom = offs4k;
                 else {
                         /* 4k above 2k. Bump snd_lim, if needed*/
-                        if (!dd->userbase)
+                        if (!dd->userbase || dd->piovl15base)
                                 snd_lim = offs4k + tot4k;
                 }
         }
@@ -298,6 +300,15 @@ static u32 __iomem *qib_remap_ioaddr32(struct qib_devdata *dd, u32 offset,
                 cnt = snd_lim - offset;
         }
 
+        if (!map && offs4k && dd->piovl15base) {
+                snd_lim = offs4k + tot4k + 2 * dd->align4k;
+                if (offset >= (offs4k + tot4k) && offset < snd_lim) {
+                        map = (u32 __iomem *)dd->piovl15base +
+                                ((offset - (offs4k + tot4k)) / sizeof(u32));
+                        cnt = snd_lim - offset;
+                }
+        }
+
 mapped:
         if (cntp)
                 *cntp = cnt;
diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
index 1eadadc13da8..a5e29dbb9537 100644
--- a/drivers/infiniband/hw/qib/qib_iba6120.c
+++ b/drivers/infiniband/hw/qib/qib_iba6120.c
@@ -1355,8 +1355,7 @@ static int qib_6120_bringup_serdes(struct qib_pportdata *ppd)
         hwstat = qib_read_kreg64(dd, kr_hwerrstatus);
         if (hwstat) {
                 /* should just have PLL, clear all set, in an case */
-                if (hwstat & ~QLOGIC_IB_HWE_SERDESPLLFAILED)
-                        qib_write_kreg(dd, kr_hwerrclear, hwstat);
+                qib_write_kreg(dd, kr_hwerrclear, hwstat);
                 qib_write_kreg(dd, kr_errclear, ERR_MASK(HardwareErr));
         }
 
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 503992d9c5ce..5eedf83e2c3b 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -543,7 +543,7 @@ struct vendor_txdds_ent {
 static void write_tx_serdes_param(struct qib_pportdata *, struct txdds_ent *);
 
 #define TXDDS_TABLE_SZ 16 /* number of entries per speed in onchip table */
-#define TXDDS_EXTRA_SZ 11 /* number of extra tx settings entries */
+#define TXDDS_EXTRA_SZ 13 /* number of extra tx settings entries */
 #define SERDES_CHANS 4 /* yes, it's obvious, but one less magic number */
 
 #define H1_FORCE_VAL 8
@@ -1100,9 +1100,9 @@ static const struct qib_hwerror_msgs qib_7322_hwerror_msgs[] = {
         HWE_AUTO_P(SDmaMemReadErr, 1),
         HWE_AUTO_P(SDmaMemReadErr, 0),
         HWE_AUTO_P(IBCBusFromSPCParityErr, 1),
+        HWE_AUTO_P(IBCBusToSPCParityErr, 1),
         HWE_AUTO_P(IBCBusFromSPCParityErr, 0),
-        HWE_AUTO_P(statusValidNoEop, 1),
-        HWE_AUTO_P(statusValidNoEop, 0),
+        HWE_AUTO(statusValidNoEop),
         HWE_AUTO(LATriggered),
         { .mask = 0 }
 };
@@ -4763,6 +4763,8 @@ static void qib_7322_mini_pcs_reset(struct qib_pportdata *ppd)
                 SYM_MASK(IBPCSConfig_0, tx_rx_reset);
 
         val = qib_read_kreg_port(ppd, krp_ib_pcsconfig);
+        qib_write_kreg(dd, kr_hwerrmask,
+                       dd->cspec->hwerrmask & ~HWE_MASK(statusValidNoEop));
         qib_write_kreg_port(ppd, krp_ibcctrl_a,
                             ppd->cpspec->ibcctrl_a &
                             ~SYM_MASK(IBCCtrlA_0, IBLinkEn));
@@ -4772,6 +4774,9 @@ static void qib_7322_mini_pcs_reset(struct qib_pportdata *ppd)
         qib_write_kreg_port(ppd, krp_ib_pcsconfig, val & ~reset_bits);
         qib_write_kreg_port(ppd, krp_ibcctrl_a, ppd->cpspec->ibcctrl_a);
         qib_write_kreg(dd, kr_scratch, 0ULL);
+        qib_write_kreg(dd, kr_hwerrclear,
+                       SYM_MASK(HwErrClear, statusValidNoEopClear));
+        qib_write_kreg(dd, kr_hwerrmask, dd->cspec->hwerrmask);
 }
 
 /*
@@ -5624,6 +5629,8 @@ static void set_no_qsfp_atten(struct qib_devdata *dd, int change)
                         if (ppd->port != port || !ppd->link_speed_supported)
                                 continue;
                         ppd->cpspec->no_eep = val;
+                        if (seth1)
+                                ppd->cpspec->h1_val = h1;
                         /* now change the IBC and serdes, overriding generic */
                         init_txdds_table(ppd, 1);
                         any++;
@@ -6064,9 +6071,9 @@ static int qib_init_7322_variables(struct qib_devdata *dd)
                  * the "cable info" setup here.  Can be overridden
                  * in adapter-specific routines.
                  */
-                if (!(ppd->dd->flags & QIB_HAS_QSFP)) {
-                        if (!IS_QMH(ppd->dd) && !IS_QME(ppd->dd))
-                                qib_devinfo(ppd->dd->pcidev, "IB%u:%u: "
+                if (!(dd->flags & QIB_HAS_QSFP)) {
+                        if (!IS_QMH(dd) && !IS_QME(dd))
+                                qib_devinfo(dd->pcidev, "IB%u:%u: "
                                             "Unknown mezzanine card type\n",
                                             dd->unit, ppd->port);
                         cp->h1_val = IS_QMH(dd) ? H1_FORCE_QMH : H1_FORCE_QME;
@@ -6119,9 +6126,25 @@ static int qib_init_7322_variables(struct qib_devdata *dd)
         qib_set_ctxtcnt(dd);
 
         if (qib_wc_pat) {
-                ret = init_chip_wc_pat(dd, NUM_VL15_BUFS * dd->align4k);
+                resource_size_t vl15off;
+                /*
+                 * We do not set WC on the VL15 buffers to avoid
+                 * a rare problem with unaligned writes from
+                 * interrupt-flushed store buffers, so we need
+                 * to map those separately here.  We can't solve
+                 * this for the rarely used mtrr case.
+                 */
+                ret = init_chip_wc_pat(dd, 0);
                 if (ret)
                         goto bail;
+
+                /* vl15 buffers start just after the 4k buffers */
+                vl15off = dd->physaddr + (dd->piobufbase >> 32) +
+                        dd->piobcnt4k * dd->align4k;
+                dd->piovl15base = ioremap_nocache(vl15off,
+                                                  NUM_VL15_BUFS * dd->align4k);
+                if (!dd->piovl15base)
+                        goto bail;
         }
         qib_7322_set_baseaddrs(dd); /* set chip access pointers now */
 
@@ -6932,6 +6955,8 @@ static const struct txdds_ent txdds_extra_sdr[TXDDS_EXTRA_SZ] = {
         {  0, 0, 0, 11 },       /* QME7342 backplane settings */
         {  0, 0, 0, 11 },       /* QME7342 backplane settings */
         {  0, 0, 0, 11 },       /* QME7342 backplane settings */
+        {  0, 0, 0,  3 },       /* QMH7342 backplane settings */
+        {  0, 0, 0,  4 },       /* QMH7342 backplane settings */
 };
 
 static const struct txdds_ent txdds_extra_ddr[TXDDS_EXTRA_SZ] = {
@@ -6947,6 +6972,8 @@ static const struct txdds_ent txdds_extra_ddr[TXDDS_EXTRA_SZ] = {
         {  0, 0, 0, 13 },       /* QME7342 backplane settings */
         {  0, 0, 0, 13 },       /* QME7342 backplane settings */
         {  0, 0, 0, 13 },       /* QME7342 backplane settings */
+        {  0, 0, 0,  9 },       /* QMH7342 backplane settings */
+        {  0, 0, 0, 10 },       /* QMH7342 backplane settings */
 };
 
 static const struct txdds_ent txdds_extra_qdr[TXDDS_EXTRA_SZ] = {
@@ -6962,6 +6989,8 @@ static const struct txdds_ent txdds_extra_qdr[TXDDS_EXTRA_SZ] = {
         {  0, 1, 12,  6 },      /* QME7342 backplane setting */
         {  0, 1, 12,  7 },      /* QME7342 backplane setting */
         {  0, 1, 12,  8 },      /* QME7342 backplane setting */
+        {  0, 1,  0, 10 },      /* QMH7342 backplane settings */
+        {  0, 1,  0, 12 },      /* QMH7342 backplane settings */
 };
 
 static const struct txdds_ent *get_atten_table(const struct txdds_ent *txdds,
diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c
index 9b40f345ac3f..a873dd596e81 100644
--- a/drivers/infiniband/hw/qib/qib_init.c
+++ b/drivers/infiniband/hw/qib/qib_init.c
@@ -1059,7 +1059,7 @@ static int __init qlogic_ib_init(void)
                 goto bail_dev;
         }
 
-        qib_cq_wq = create_workqueue("qib_cq");
+        qib_cq_wq = create_singlethread_workqueue("qib_cq");
         if (!qib_cq_wq) {
                 ret = -ENOMEM;
                 goto bail_wq;
@@ -1289,8 +1289,18 @@ static int __devinit qib_init_one(struct pci_dev *pdev,
 
         if (qib_mini_init || initfail || ret) {
                 qib_stop_timers(dd);
+                flush_scheduled_work();
                 for (pidx = 0; pidx < dd->num_pports; ++pidx)
                         dd->f_quiet_serdes(dd->pport + pidx);
+                if (qib_mini_init)
+                        goto bail;
+                if (!j) {
+                        (void) qibfs_remove(dd);
+                        qib_device_remove(dd);
+                }
+                if (!ret)
+                        qib_unregister_ib_device(dd);
+                qib_postinit_cleanup(dd);
                 if (initfail)
                         ret = initfail;
                 goto bail;
@@ -1472,6 +1482,9 @@ int qib_setup_eagerbufs(struct qib_ctxtdata *rcd)
                 dma_addr_t pa = rcd->rcvegrbuf_phys[chunk];
                 unsigned i;
 
+                /* clear for security and sanity on each use */
+                memset(rcd->rcvegrbuf[chunk], 0, size);
+
                 for (i = 0; e < egrcnt && i < egrperchunk; e++, i++) {
                         dd->f_put_tid(dd, e + egroff +
                                           (u64 __iomem *)
@@ -1499,6 +1512,12 @@ bail:
         return -ENOMEM;
 }
 
+/*
+ * Note: Changes to this routine should be mirrored
+ * for the diagnostics routine qib_remap_ioaddr32().
+ * There is also related code for VL15 buffers in qib_init_7322_variables().
+ * The teardown code that unmaps is in qib_pcie_ddcleanup()
+ */
 int init_chip_wc_pat(struct qib_devdata *dd, u32 vl15buflen)
 {
         u64 __iomem *qib_kregbase = NULL;
diff --git a/drivers/infiniband/hw/qib/qib_pcie.c b/drivers/infiniband/hw/qib/qib_pcie.c
index c926bf4541df..7fa6e5592630 100644
--- a/drivers/infiniband/hw/qib/qib_pcie.c
+++ b/drivers/infiniband/hw/qib/qib_pcie.c
@@ -179,6 +179,8 @@ void qib_pcie_ddcleanup(struct qib_devdata *dd)
                 iounmap(dd->piobase);
         if (dd->userbase)
                 iounmap(dd->userbase);
+        if (dd->piovl15base)
+                iounmap(dd->piovl15base);
 
         pci_disable_device(dd->pcidev);
         pci_release_regions(dd->pcidev);
diff --git a/drivers/infiniband/hw/qib/qib_sd7220.c b/drivers/infiniband/hw/qib/qib_sd7220.c
index 0aeed0e74cb6..e9f9f8bc3204 100644
--- a/drivers/infiniband/hw/qib/qib_sd7220.c
+++ b/drivers/infiniband/hw/qib/qib_sd7220.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (c) 2006, 2007, 2008, 2009 QLogic Corporation. All rights reserved.
+ * Copyright (c) 2006, 2007, 2008, 2009, 2010 QLogic Corporation.
+ * All rights reserved.
  * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
@@ -37,10 +38,14 @@
 
 #include <linux/pci.h>
 #include <linux/delay.h>
+#include <linux/firmware.h>
 
 #include "qib.h"
 #include "qib_7220.h"
 
+#define SD7220_FW_NAME "qlogic/sd7220.fw"
+MODULE_FIRMWARE(SD7220_FW_NAME);
+
 /*
  * Same as in qib_iba7220.c, but just the registers needed here.
  * Could move whole set to qib_7220.h, but decided better to keep
@@ -102,6 +107,10 @@ static int qib_internal_presets(struct qib_devdata *dd);
 /* Tweak the register (CMUCTRL5) that contains the TRIMSELF controls */
 static int qib_sd_trimself(struct qib_devdata *dd, int val);
 static int epb_access(struct qib_devdata *dd, int sdnum, int claim);
+static int qib_sd7220_ib_load(struct qib_devdata *dd,
+                              const struct firmware *fw);
+static int qib_sd7220_ib_vfy(struct qib_devdata *dd,
+                             const struct firmware *fw);
 
 /*
  * Below keeps track of whether the "once per power-on" initialization has
@@ -110,10 +119,13 @@ static int epb_access(struct qib_devdata *dd, int sdnum, int claim);
  * state of the reset "pin", is no longer valid. Instead, we check for the
  * actual uC code having been loaded.
  */
-static int qib_ibsd_ucode_loaded(struct qib_pportdata *ppd)
+static int qib_ibsd_ucode_loaded(struct qib_pportdata *ppd,
+                                 const struct firmware *fw)
 {
         struct qib_devdata *dd = ppd->dd;
-        if (!dd->cspec->serdes_first_init_done && (qib_sd7220_ib_vfy(dd) > 0))
+
+        if (!dd->cspec->serdes_first_init_done &&
+            qib_sd7220_ib_vfy(dd, fw) > 0)
                 dd->cspec->serdes_first_init_done = 1;
         return dd->cspec->serdes_first_init_done;
 }
@@ -377,6 +389,7 @@ static void qib_sd_trimdone_monitor(struct qib_devdata *dd,
  */
 int qib_sd7220_init(struct qib_devdata *dd)
 {
+        const struct firmware *fw;
         int ret = 1; /* default to failure */
         int first_reset, was_reset;
 
@@ -387,8 +400,15 @@ int qib_sd7220_init(struct qib_devdata *dd)
                 qib_ibsd_reset(dd, 1);
                 qib_sd_trimdone_monitor(dd, "Driver-reload");
         }
+
+        ret = request_firmware(&fw, SD7220_FW_NAME, &dd->pcidev->dev);
+        if (ret) {
+                qib_dev_err(dd, "Failed to load IB SERDES image\n");
+                goto done;
+        }
+
         /* Substitute our deduced value for was_reset */
-        ret = qib_ibsd_ucode_loaded(dd->pport);
+        ret = qib_ibsd_ucode_loaded(dd->pport, fw);
         if (ret < 0)
                 goto bail;
 
@@ -437,13 +457,13 @@ int qib_sd7220_init(struct qib_devdata *dd)
                 int vfy;
                 int trim_done;
 
-                ret = qib_sd7220_ib_load(dd);
+                ret = qib_sd7220_ib_load(dd, fw);
                 if (ret < 0) {
                         qib_dev_err(dd, "Failed to load IB SERDES image\n");
                         goto bail;
                 } else {
                         /* Loaded image, try to verify */
-                        vfy = qib_sd7220_ib_vfy(dd);
+                        vfy = qib_sd7220_ib_vfy(dd, fw);
                         if (vfy != ret) {
                                 qib_dev_err(dd, "SERDES PRAM VFY failed\n");
                                 goto bail;
@@ -506,6 +526,8 @@ bail:
 done:
         /* start relock timer regardless, but start at 1 second */
         set_7220_relock_poll(dd, -1);
+
+        release_firmware(fw);
         return ret;
 }
 
@@ -829,8 +851,8 @@ static int qib_sd7220_ram_xfer(struct qib_devdata *dd, int sdnum, u32 loc,
 
 #define PROG_CHUNK 64
 
-int qib_sd7220_prog_ld(struct qib_devdata *dd, int sdnum,
-                       u8 *img, int len, int offset)
+static int qib_sd7220_prog_ld(struct qib_devdata *dd, int sdnum,
+                              const u8 *img, int len, int offset)
 {
         int cnt, sofar, req;
 
@@ -840,7 +862,7 @@ int qib_sd7220_prog_ld(struct qib_devdata *dd, int sdnum,
                 if (req > PROG_CHUNK)
                         req = PROG_CHUNK;
                 cnt = qib_sd7220_ram_xfer(dd, sdnum, offset + sofar,
-                                          img + sofar, req, 0);
+                                          (u8 *)img + sofar, req, 0);
                 if (cnt < req) {
                         sofar = -1;
                         break;
@@ -853,8 +875,8 @@ int qib_sd7220_prog_ld(struct qib_devdata *dd, int sdnum,
 #define VFY_CHUNK 64
 #define SD_PRAM_ERROR_LIMIT 42
 
-int qib_sd7220_prog_vfy(struct qib_devdata *dd, int sdnum,
-                        const u8 *img, int len, int offset)
+static int qib_sd7220_prog_vfy(struct qib_devdata *dd, int sdnum,
+                               const u8 *img, int len, int offset)
 {
         int cnt, sofar, req, idx, errors;
         unsigned char readback[VFY_CHUNK];
@@ -881,6 +903,18 @@ int qib_sd7220_prog_vfy(struct qib_devdata *dd, int sdnum,
         return errors ? -errors : sofar;
 }
 
+static int
+qib_sd7220_ib_load(struct qib_devdata *dd, const struct firmware *fw)
+{
+        return qib_sd7220_prog_ld(dd, IB_7220_SERDES, fw->data, fw->size, 0);
+}
+
+static int
+qib_sd7220_ib_vfy(struct qib_devdata *dd, const struct firmware *fw)
+{
+        return qib_sd7220_prog_vfy(dd, IB_7220_SERDES, fw->data, fw->size, 0);
+}
+
 /*
  * IRQ not set up at this point in init, so we poll.
  */
diff --git a/drivers/infiniband/hw/qib/qib_sd7220_img.c b/drivers/infiniband/hw/qib/qib_sd7220_img.c
deleted file mode 100644
index a1118fbd2370..000000000000
--- a/drivers/infiniband/hw/qib/qib_sd7220_img.c
+++ /dev/null
@@ -1,1081 +0,0 @@
-/*
- * Copyright (c) 2007, 2008 QLogic Corporation. All rights reserved.
- *
- * This software is available to you under a choice of one of two
- * licenses.  You may choose to be licensed under the terms of the GNU
- * General Public License (GPL) Version 2, available from the file
- * COPYING in the main directory of this source tree, or the
- * OpenIB.org BSD license below:
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- * SOFTWARE.
- */
-
-/*
- * This file contains the memory image from the vendor, to be copied into
- * the IB SERDES of the IBA7220 during initialization.
- * The file also includes the two functions which use this image.
- */
-#include <linux/pci.h>
-#include <linux/delay.h>
-
-#include "qib.h"
-#include "qib_7220.h"
-
-static unsigned char qib_sd7220_ib_img[] = {
-/*0000*/0x02, 0x0A, 0x29, 0x02, 0x0A, 0x87, 0xE5, 0xE6,
-        0x30, 0xE6, 0x04, 0x7F, 0x01, 0x80, 0x02, 0x7F,
-/*0010*/0x00, 0xE5, 0xE2, 0x30, 0xE4, 0x04, 0x7E, 0x01,
-        0x80, 0x02, 0x7E, 0x00, 0xEE, 0x5F, 0x60, 0x08,
-/*0020*/0x53, 0xF9, 0xF7, 0xE4, 0xF5, 0xFE, 0x80, 0x08,
-        0x7F, 0x0A, 0x12, 0x17, 0x31, 0x12, 0x0E, 0xA2,
-/*0030*/0x75, 0xFC, 0x08, 0xE4, 0xF5, 0xFD, 0xE5, 0xE7,
-        0x20, 0xE7, 0x03, 0x43, 0xF9, 0x08, 0x22, 0x00,
-/*0040*/0x01, 0x20, 0x11, 0x00, 0x04, 0x20, 0x00, 0x75,
-        0x51, 0x01, 0xE4, 0xF5, 0x52, 0xF5, 0x53, 0xF5,
-/*0050*/0x52, 0xF5, 0x7E, 0x7F, 0x04, 0x02, 0x04, 0x38,
-        0xC2, 0x36, 0x05, 0x52, 0xE5, 0x52, 0xD3, 0x94,
-/*0060*/0x0C, 0x40, 0x05, 0x75, 0x52, 0x01, 0xD2, 0x36,
-        0x90, 0x07, 0x0C, 0x74, 0x07, 0xF0, 0xA3, 0x74,
-/*0070*/0xFF, 0xF0, 0xE4, 0xF5, 0x0C, 0xA3, 0xF0, 0x90,
-        0x07, 0x14, 0xF0, 0xA3, 0xF0, 0x75, 0x0B, 0x20,
-/*0080*/0xF5, 0x09, 0xE4, 0xF5, 0x08, 0xE5, 0x08, 0xD3,
-        0x94, 0x30, 0x40, 0x03, 0x02, 0x04, 0x04, 0x12,
-/*0090*/0x00, 0x06, 0x15, 0x0B, 0xE5, 0x08, 0x70, 0x04,
-        0x7F, 0x01, 0x80, 0x02, 0x7F, 0x00, 0xE5, 0x09,
-/*00A0*/0x70, 0x04, 0x7E, 0x01, 0x80, 0x02, 0x7E, 0x00,
-        0xEE, 0x5F, 0x60, 0x05, 0x12, 0x18, 0x71, 0xD2,
-/*00B0*/0x35, 0x53, 0xE1, 0xF7, 0xE5, 0x08, 0x45, 0x09,
-        0xFF, 0xE5, 0x0B, 0x25, 0xE0, 0x25, 0xE0, 0x24,
-/*00C0*/0x83, 0xF5, 0x82, 0xE4, 0x34, 0x07, 0xF5, 0x83,
-        0xEF, 0xF0, 0x85, 0xE2, 0x20, 0xE5, 0x52, 0xD3,
-/*00D0*/0x94, 0x01, 0x40, 0x0D, 0x12, 0x19, 0xF3, 0xE0,
-        0x54, 0xA0, 0x64, 0x40, 0x70, 0x03, 0x02, 0x03,
-/*00E0*/0xFB, 0x53, 0xF9, 0xF8, 0x90, 0x94, 0x70, 0xE4,
-        0xF0, 0xE0, 0xF5, 0x10, 0xAF, 0x09, 0x12, 0x1E,
-/*00F0*/0xB3, 0xAF, 0x08, 0xEF, 0x44, 0x08, 0xF5, 0x82,
-        0x75, 0x83, 0x80, 0xE0, 0xF5, 0x29, 0xEF, 0x44,
-/*0100*/0x07, 0x12, 0x1A, 0x3C, 0xF5, 0x22, 0x54, 0x40,
-        0xD3, 0x94, 0x00, 0x40, 0x1E, 0xE5, 0x29, 0x54,
-/*0110*/0xF0, 0x70, 0x21, 0x12, 0x19, 0xF3, 0xE0, 0x44,
-        0x80, 0xF0, 0xE5, 0x22, 0x54, 0x30, 0x65, 0x08,
-/*0120*/0x70, 0x09, 0x12, 0x19, 0xF3, 0xE0, 0x54, 0xBF,
-        0xF0, 0x80, 0x09, 0x12, 0x19, 0xF3, 0x74, 0x40,
-/*0130*/0xF0, 0x02, 0x03, 0xFB, 0x12, 0x1A, 0x12, 0x75,
-        0x83, 0xAE, 0x74, 0xFF, 0xF0, 0xAF, 0x08, 0x7E,
-/*0140*/0x00, 0xEF, 0x44, 0x07, 0xF5, 0x82, 0xE0, 0xFD,
-        0xE5, 0x0B, 0x25, 0xE0, 0x25, 0xE0, 0x24, 0x81,
-/*0150*/0xF5, 0x82, 0xE4, 0x34, 0x07, 0xF5, 0x83, 0xED,
-        0xF0, 0x90, 0x07, 0x0E, 0xE0, 0x04, 0xF0, 0xEF,
-/*0160*/0x44, 0x07, 0xF5, 0x82, 0x75, 0x83, 0x98, 0xE0,
-        0xF5, 0x28, 0x12, 0x1A, 0x23, 0x40, 0x0C, 0x12,
-/*0170*/0x19, 0xF3, 0xE0, 0x44, 0x01, 0x12, 0x1A, 0x32,
-        0x02, 0x03, 0xF6, 0xAF, 0x08, 0x7E, 0x00, 0x74,
-/*0180*/0x80, 0xCD, 0xEF, 0xCD, 0x8D, 0x82, 0xF5, 0x83,
-        0xE0, 0x30, 0xE0, 0x0A, 0x12, 0x19, 0xF3, 0xE0,
-/*0190*/0x44, 0x20, 0xF0, 0x02, 0x03, 0xFB, 0x12, 0x19,
-        0xF3, 0xE0, 0x54, 0xDF, 0xF0, 0xEE, 0x44, 0xAE,
-/*01A0*/0x12, 0x1A, 0x43, 0x30, 0xE4, 0x03, 0x02, 0x03,
-        0xFB, 0x74, 0x9E, 0x12, 0x1A, 0x05, 0x20, 0xE0,
-/*01B0*/0x03, 0x02, 0x03, 0xFB, 0x8F, 0x82, 0x8E, 0x83,
-        0xE0, 0x20, 0xE0, 0x03, 0x02, 0x03, 0xFB, 0x12,
-/*01C0*/0x19, 0xF3, 0xE0, 0x44, 0x10, 0xF0, 0xE5, 0xE3,
-        0x20, 0xE7, 0x08, 0xE5, 0x08, 0x12, 0x1A, 0x3A,
-/*01D0*/0x44, 0x04, 0xF0, 0xAF, 0x08, 0x7E, 0x00, 0xEF,
-        0x12, 0x1A, 0x3A, 0x20, 0xE2, 0x34, 0x12, 0x19,
-/*01E0*/0xF3, 0xE0, 0x44, 0x08, 0xF0, 0xE5, 0xE4, 0x30,
-        0xE6, 0x04, 0x7D, 0x01, 0x80, 0x02, 0x7D, 0x00,
-/*01F0*/0xE5, 0x7E, 0xC3, 0x94, 0x04, 0x50, 0x04, 0x7C,
-        0x01, 0x80, 0x02, 0x7C, 0x00, 0xEC, 0x4D, 0x60,
-/*0200*/0x05, 0xC2, 0x35, 0x02, 0x03, 0xFB, 0xEE, 0x44,
-        0xD2, 0x12, 0x1A, 0x43, 0x44, 0x40, 0xF0, 0x02,
-/*0210*/0x03, 0xFB, 0x12, 0x19, 0xF3, 0xE0, 0x54, 0xF7,
-        0xF0, 0x12, 0x1A, 0x12, 0x75, 0x83, 0xD2, 0xE0,
-/*0220*/0x54, 0xBF, 0xF0, 0x90, 0x07, 0x14, 0xE0, 0x04,
-        0xF0, 0xE5, 0x7E, 0x70, 0x03, 0x75, 0x7E, 0x01,
-/*0230*/0xAF, 0x08, 0x7E, 0x00, 0x12, 0x1A, 0x23, 0x40,
-        0x12, 0x12, 0x19, 0xF3, 0xE0, 0x44, 0x01, 0x12,
-/*0240*/0x19, 0xF2, 0xE0, 0x54, 0x02, 0x12, 0x1A, 0x32,
-        0x02, 0x03, 0xFB, 0x12, 0x19, 0xF3, 0xE0, 0x44,
-/*0250*/0x02, 0x12, 0x19, 0xF2, 0xE0, 0x54, 0xFE, 0xF0,
-        0xC2, 0x35, 0xEE, 0x44, 0x8A, 0x8F, 0x82, 0xF5,
-/*0260*/0x83, 0xE0, 0xF5, 0x17, 0x54, 0x8F, 0x44, 0x40,
-        0xF0, 0x74, 0x90, 0xFC, 0xE5, 0x08, 0x44, 0x07,
-/*0270*/0xFD, 0xF5, 0x82, 0x8C, 0x83, 0xE0, 0x54, 0x3F,
-        0x90, 0x07, 0x02, 0xF0, 0xE0, 0x54, 0xC0, 0x8D,
-/*0280*/0x82, 0x8C, 0x83, 0xF0, 0x74, 0x92, 0x12, 0x1A,
-        0x05, 0x90, 0x07, 0x03, 0x12, 0x1A, 0x19, 0x74,
-/*0290*/0x82, 0x12, 0x1A, 0x05, 0x90, 0x07, 0x04, 0x12,
-        0x1A, 0x19, 0x74, 0xB4, 0x12, 0x1A, 0x05, 0x90,
-/*02A0*/0x07, 0x05, 0x12, 0x1A, 0x19, 0x74, 0x94, 0xFE,
-        0xE5, 0x08, 0x44, 0x06, 0x12, 0x1A, 0x0A, 0xF5,
-/*02B0*/0x10, 0x30, 0xE0, 0x04, 0xD2, 0x37, 0x80, 0x02,
-        0xC2, 0x37, 0xE5, 0x10, 0x54, 0x7F, 0x8F, 0x82,
-/*02C0*/0x8E, 0x83, 0xF0, 0x30, 0x44, 0x30, 0x12, 0x1A,
-        0x03, 0x54, 0x80, 0xD3, 0x94, 0x00, 0x40, 0x04,
-/*02D0*/0xD2, 0x39, 0x80, 0x02, 0xC2, 0x39, 0x8F, 0x82,
-        0x8E, 0x83, 0xE0, 0x44, 0x80, 0xF0, 0x12, 0x1A,
-/*02E0*/0x03, 0x54, 0x40, 0xD3, 0x94, 0x00, 0x40, 0x04,
-        0xD2, 0x3A, 0x80, 0x02, 0xC2, 0x3A, 0x8F, 0x82,
-/*02F0*/0x8E, 0x83, 0xE0, 0x44, 0x40, 0xF0, 0x74, 0x92,
-        0xFE, 0xE5, 0x08, 0x44, 0x06, 0x12, 0x1A, 0x0A,
-/*0300*/0x30, 0xE7, 0x04, 0xD2, 0x38, 0x80, 0x02, 0xC2,
-        0x38, 0x8F, 0x82, 0x8E, 0x83, 0xE0, 0x54, 0x7F,
-/*0310*/0xF0, 0x12, 0x1E, 0x46, 0xE4, 0xF5, 0x0A, 0x20,
-        0x03, 0x02, 0x80, 0x03, 0x30, 0x43, 0x03, 0x12,
-/*0320*/0x19, 0x95, 0x20, 0x02, 0x02, 0x80, 0x03, 0x30,
-        0x42, 0x03, 0x12, 0x0C, 0x8F, 0x30, 0x30, 0x06,
-/*0330*/0x12, 0x19, 0x95, 0x12, 0x0C, 0x8F, 0x12, 0x0D,
-        0x47, 0x12, 0x19, 0xF3, 0xE0, 0x54, 0xFB, 0xF0,
-/*0340*/0xE5, 0x0A, 0xC3, 0x94, 0x01, 0x40, 0x46, 0x43,
-        0xE1, 0x08, 0x12, 0x19, 0xF3, 0xE0, 0x44, 0x04,
-/*0350*/0xF0, 0xE5, 0xE4, 0x20, 0xE7, 0x2A, 0x12, 0x1A,
-        0x12, 0x75, 0x83, 0xD2, 0xE0, 0x54, 0x08, 0xD3,
-/*0360*/0x94, 0x00, 0x40, 0x04, 0x7F, 0x01, 0x80, 0x02,
-        0x7F, 0x00, 0xE5, 0x0A, 0xC3, 0x94, 0x01, 0x40,
-/*0370*/0x04, 0x7E, 0x01, 0x80, 0x02, 0x7E, 0x00, 0xEF,
-        0x5E, 0x60, 0x05, 0x12, 0x1D, 0xD7, 0x80, 0x17,
-/*0380*/0x12, 0x1A, 0x12, 0x75, 0x83, 0xD2, 0xE0, 0x44,
-        0x08, 0xF0, 0x02, 0x03, 0xFB, 0x12, 0x1A, 0x12,
-/*0390*/0x75, 0x83, 0xD2, 0xE0, 0x54, 0xF7, 0xF0, 0x12,
-        0x1E, 0x46, 0x7F, 0x08, 0x12, 0x17, 0x31, 0x74,
-/*03A0*/0x8E, 0xFE, 0x12, 0x1A, 0x12, 0x8E, 0x83, 0xE0,
-        0xF5, 0x10, 0x54, 0xFE, 0xF0, 0xE5, 0x10, 0x44,
-/*03B0*/0x01, 0xFF, 0xE5, 0x08, 0xFD, 0xED, 0x44, 0x07,
-        0xF5, 0x82, 0xEF, 0xF0, 0xE5, 0x10, 0x54, 0xFE,
-/*03C0*/0xFF, 0xED, 0x44, 0x07, 0xF5, 0x82, 0xEF, 0x12,
-        0x1A, 0x11, 0x75, 0x83, 0x86, 0xE0, 0x44, 0x10,
-/*03D0*/0x12, 0x1A, 0x11, 0xE0, 0x44, 0x10, 0xF0, 0x12,
-        0x19, 0xF3, 0xE0, 0x54, 0xFD, 0x44, 0x01, 0xFF,
-/*03E0*/0x12, 0x19, 0xF3, 0xEF, 0x12, 0x1A, 0x32, 0x30,
-        0x32, 0x0C, 0xE5, 0x08, 0x44, 0x08, 0xF5, 0x82,
-/*03F0*/0x75, 0x83, 0x82, 0x74, 0x05, 0xF0, 0xAF, 0x0B,
-        0x12, 0x18, 0xD7, 0x74, 0x10, 0x25, 0x08, 0xF5,
-/*0400*/0x08, 0x02, 0x00, 0x85, 0x05, 0x09, 0xE5, 0x09,
-        0xD3, 0x94, 0x07, 0x50, 0x03, 0x02, 0x00, 0x82,
-/*0410*/0xE5, 0x7E, 0xD3, 0x94, 0x00, 0x40, 0x04, 0x7F,
-        0x01, 0x80, 0x02, 0x7F, 0x00, 0xE5, 0x7E, 0xC3,
-/*0420*/0x94, 0xFA, 0x50, 0x04, 0x7E, 0x01, 0x80, 0x02,
-        0x7E, 0x00, 0xEE, 0x5F, 0x60, 0x02, 0x05, 0x7E,
-/*0430*/0x30, 0x35, 0x0B, 0x43, 0xE1, 0x01, 0x7F, 0x09,
-        0x12, 0x17, 0x31, 0x02, 0x00, 0x58, 0x53, 0xE1,
-/*0440*/0xFE, 0x02, 0x00, 0x58, 0x8E, 0x6A, 0x8F, 0x6B,
-        0x8C, 0x6C, 0x8D, 0x6D, 0x75, 0x6E, 0x01, 0x75,
-/*0450*/0x6F, 0x01, 0x75, 0x70, 0x01, 0xE4, 0xF5, 0x73,
-        0xF5, 0x74, 0xF5, 0x75, 0x90, 0x07, 0x2F, 0xF0,
-/*0460*/0xF5, 0x3C, 0xF5, 0x3E, 0xF5, 0x46, 0xF5, 0x47,
-        0xF5, 0x3D, 0xF5, 0x3F, 0xF5, 0x6F, 0xE5, 0x6F,
-/*0470*/0x70, 0x0F, 0xE5, 0x6B, 0x45, 0x6A, 0x12, 0x07,
-        0x2A, 0x75, 0x83, 0x80, 0x74, 0x3A, 0xF0, 0x80,
-/*0480*/0x09, 0x12, 0x07, 0x2A, 0x75, 0x83, 0x80, 0x74,
-        0x1A, 0xF0, 0xE4, 0xF5, 0x6E, 0xC3, 0x74, 0x3F,
-/*0490*/0x95, 0x6E, 0xFF, 0x12, 0x08, 0x65, 0x75, 0x83,
-        0x82, 0xEF, 0xF0, 0x12, 0x1A, 0x4D, 0x12, 0x08,
-/*04A0*/0xC6, 0xE5, 0x33, 0xF0, 0x12, 0x08, 0xFA, 0x12,
-        0x08, 0xB1, 0x40, 0xE1, 0xE5, 0x6F, 0x70, 0x0B,
-/*04B0*/0x12, 0x07, 0x2A, 0x75, 0x83, 0x80, 0x74, 0x36,
-        0xF0, 0x80, 0x09, 0x12, 0x07, 0x2A, 0x75, 0x83,
-/*04C0*/0x80, 0x74, 0x16, 0xF0, 0x75, 0x6E, 0x01, 0x12,
-        0x07, 0x2A, 0x75, 0x83, 0xB4, 0xE5, 0x6E, 0xF0,
-/*04D0*/0x12, 0x1A, 0x4D, 0x74, 0x3F, 0x25, 0x6E, 0xF5,
-        0x82, 0xE4, 0x34, 0x00, 0xF5, 0x83, 0xE5, 0x33,
-/*04E0*/0xF0, 0x74, 0xBF, 0x25, 0x6E, 0xF5, 0x82, 0xE4,
-        0x34, 0x00, 0x12, 0x08, 0xB1, 0x40, 0xD8, 0xE4,
-/*04F0*/0xF5, 0x70, 0xF5, 0x46, 0xF5, 0x47, 0xF5, 0x6E,
-        0x12, 0x08, 0xFA, 0xF5, 0x83, 0xE0, 0xFE, 0x12,
-/*0500*/0x08, 0xC6, 0xE0, 0x7C, 0x00, 0x24, 0x00, 0xFF,
-        0xEC, 0x3E, 0xFE, 0xAD, 0x3B, 0xD3, 0xEF, 0x9D,
-/*0510*/0xEE, 0x9C, 0x50, 0x04, 0x7B, 0x01, 0x80, 0x02,
-        0x7B, 0x00, 0xE5, 0x70, 0x70, 0x04, 0x7A, 0x01,
-/*0520*/0x80, 0x02, 0x7A, 0x00, 0xEB, 0x5A, 0x60, 0x06,
-        0x85, 0x6E, 0x46, 0x75, 0x70, 0x01, 0xD3, 0xEF,
-/*0530*/0x9D, 0xEE, 0x9C, 0x50, 0x04, 0x7F, 0x01, 0x80,
-        0x02, 0x7F, 0x00, 0xE5, 0x70, 0xB4, 0x01, 0x04,
-/*0540*/0x7E, 0x01, 0x80, 0x02, 0x7E, 0x00, 0xEF, 0x5E,
-        0x60, 0x03, 0x85, 0x6E, 0x47, 0x05, 0x6E, 0xE5,
-/*0550*/0x6E, 0x64, 0x7F, 0x70, 0xA3, 0xE5, 0x46, 0x60,
-        0x05, 0xE5, 0x47, 0xB4, 0x7E, 0x03, 0x85, 0x46,
-/*0560*/0x47, 0xE5, 0x6F, 0x70, 0x08, 0x85, 0x46, 0x76,
-        0x85, 0x47, 0x77, 0x80, 0x0E, 0xC3, 0x74, 0x7F,
-/*0570*/0x95, 0x46, 0xF5, 0x78, 0xC3, 0x74, 0x7F, 0x95,
-        0x47, 0xF5, 0x79, 0xE5, 0x6F, 0x70, 0x37, 0xE5,
-/*0580*/0x46, 0x65, 0x47, 0x70, 0x0C, 0x75, 0x73, 0x01,
-        0x75, 0x74, 0x01, 0xF5, 0x3C, 0xF5, 0x3D, 0x80,
-/*0590*/0x35, 0xE4, 0xF5, 0x4E, 0xC3, 0xE5, 0x47, 0x95,
-        0x46, 0xF5, 0x3C, 0xC3, 0x13, 0xF5, 0x71, 0x25,
-/*05A0*/0x46, 0xF5, 0x72, 0xC3, 0x94, 0x3F, 0x40, 0x05,
-        0xE4, 0xF5, 0x3D, 0x80, 0x40, 0xC3, 0x74, 0x3F,
-/*05B0*/0x95, 0x72, 0xF5, 0x3D, 0x80, 0x37, 0xE5, 0x46,
-        0x65, 0x47, 0x70, 0x0F, 0x75, 0x73, 0x01, 0x75,
-/*05C0*/0x75, 0x01, 0xF5, 0x3E, 0xF5, 0x3F, 0x75, 0x4E,
-        0x01, 0x80, 0x22, 0xE4, 0xF5, 0x4E, 0xC3, 0xE5,
-/*05D0*/0x47, 0x95, 0x46, 0xF5, 0x3E, 0xC3, 0x13, 0xF5,
-        0x71, 0x25, 0x46, 0xF5, 0x72, 0xD3, 0x94, 0x3F,
-/*05E0*/0x50, 0x05, 0xE4, 0xF5, 0x3F, 0x80, 0x06, 0xE5,
-        0x72, 0x24, 0xC1, 0xF5, 0x3F, 0x05, 0x6F, 0xE5,
-/*05F0*/0x6F, 0xC3, 0x94, 0x02, 0x50, 0x03, 0x02, 0x04,
-        0x6E, 0xE5, 0x6D, 0x45, 0x6C, 0x70, 0x02, 0x80,
-/*0600*/0x04, 0xE5, 0x74, 0x45, 0x75, 0x90, 0x07, 0x2F,
-        0xF0, 0x7F, 0x01, 0xE5, 0x3E, 0x60, 0x04, 0xE5,
-/*0610*/0x3C, 0x70, 0x14, 0xE4, 0xF5, 0x3C, 0xF5, 0x3D,
-        0xF5, 0x3E, 0xF5, 0x3F, 0x12, 0x08, 0xD2, 0x70,
-/*0620*/0x04, 0xF0, 0x02, 0x06, 0xA4, 0x80, 0x7A, 0xE5,
-        0x3C, 0xC3, 0x95, 0x3E, 0x40, 0x07, 0xE5, 0x3C,
-/*0630*/0x95, 0x3E, 0xFF, 0x80, 0x06, 0xC3, 0xE5, 0x3E,
-        0x95, 0x3C, 0xFF, 0xE5, 0x76, 0xD3, 0x95, 0x79,
-/*0640*/0x40, 0x05, 0x85, 0x76, 0x7A, 0x80, 0x03, 0x85,
-        0x79, 0x7A, 0xE5, 0x77, 0xC3, 0x95, 0x78, 0x50,
-/*0650*/0x05, 0x85, 0x77, 0x7B, 0x80, 0x03, 0x85, 0x78,
-        0x7B, 0xE5, 0x7B, 0xD3, 0x95, 0x7A, 0x40, 0x30,
-/*0660*/0xE5, 0x7B, 0x95, 0x7A, 0xF5, 0x3C, 0xF5, 0x3E,
-        0xC3, 0xE5, 0x7B, 0x95, 0x7A, 0x90, 0x07, 0x19,
-/*0670*/0xF0, 0xE5, 0x3C, 0xC3, 0x13, 0xF5, 0x71, 0x25,
-        0x7A, 0xF5, 0x72, 0xC3, 0x94, 0x3F, 0x40, 0x05,
-/*0680*/0xE4, 0xF5, 0x3D, 0x80, 0x1F, 0xC3, 0x74, 0x3F,
-        0x95, 0x72, 0xF5, 0x3D, 0xF5, 0x3F, 0x80, 0x14,
-/*0690*/0xE4, 0xF5, 0x3C, 0xF5, 0x3E, 0x90, 0x07, 0x19,
-        0xF0, 0x12, 0x08, 0xD2, 0x70, 0x03, 0xF0, 0x80,
-/*06A0*/0x03, 0x74, 0x01, 0xF0, 0x12, 0x08, 0x65, 0x75,
-        0x83, 0xD0, 0xE0, 0x54, 0x0F, 0xFE, 0xAD, 0x3C,
-/*06B0*/0x70, 0x02, 0x7E, 0x07, 0xBE, 0x0F, 0x02, 0x7E,
-        0x80, 0xEE, 0xFB, 0xEF, 0xD3, 0x9B, 0x74, 0x80,
-/*06C0*/0xF8, 0x98, 0x40, 0x1F, 0xE4, 0xF5, 0x3C, 0xF5,
-        0x3E, 0x12, 0x08, 0xD2, 0x70, 0x03, 0xF0, 0x80,
-/*06D0*/0x12, 0x74, 0x01, 0xF0, 0xE5, 0x08, 0xFB, 0xEB,
-        0x44, 0x07, 0xF5, 0x82, 0x75, 0x83, 0xD2, 0xE0,
-/*06E0*/0x44, 0x10, 0xF0, 0xE5, 0x08, 0xFB, 0xEB, 0x44,
-        0x09, 0xF5, 0x82, 0x75, 0x83, 0x9E, 0xED, 0xF0,
-/*06F0*/0xEB, 0x44, 0x07, 0xF5, 0x82, 0x75, 0x83, 0xCA,
-        0xED, 0xF0, 0x12, 0x08, 0x65, 0x75, 0x83, 0xCC,
-/*0700*/0xEF, 0xF0, 0x22, 0xE5, 0x08, 0x44, 0x07, 0xF5,
-        0x82, 0x75, 0x83, 0xBC, 0xE0, 0x54, 0xF0, 0xF0,
-/*0710*/0xE5, 0x08, 0x44, 0x07, 0xF5, 0x82, 0x75, 0x83,
-        0xBE, 0xE0, 0x54, 0xF0, 0xF0, 0xE5, 0x08, 0x44,
-/*0720*/0x07, 0xF5, 0x82, 0x75, 0x83, 0xC0, 0xE0, 0x54,
-        0xF0, 0xF0, 0xE5, 0x08, 0x44, 0x07, 0xF5, 0x82,
-/*0730*/0x22, 0xF0, 0x90, 0x07, 0x28, 0xE0, 0xFE, 0xA3,
-        0xE0, 0xF5, 0x82, 0x8E, 0x83, 0x22, 0x85, 0x42,
-/*0740*/0x42, 0x85, 0x41, 0x41, 0x85, 0x40, 0x40, 0x74,
-        0xC0, 0x2F, 0xF5, 0x82, 0x74, 0x02, 0x3E, 0xF5,
-/*0750*/0x83, 0xE5, 0x42, 0xF0, 0x74, 0xE0, 0x2F, 0xF5,
-        0x82, 0x74, 0x02, 0x3E, 0xF5, 0x83, 0x22, 0xE5,
-/*0760*/0x42, 0x29, 0xFD, 0xE4, 0x33, 0xFC, 0xE5, 0x3C,
-        0xC3, 0x9D, 0xEC, 0x64, 0x80, 0xF8, 0x74, 0x80,
-/*0770*/0x98, 0x22, 0xF5, 0x83, 0xE0, 0x90, 0x07, 0x22,
-        0x54, 0x1F, 0xFD, 0xE0, 0xFA, 0xA3, 0xE0, 0xF5,
-/*0780*/0x82, 0x8A, 0x83, 0xED, 0xF0, 0x22, 0x90, 0x07,
-        0x22, 0xE0, 0xFC, 0xA3, 0xE0, 0xF5, 0x82, 0x8C,
-/*0790*/0x83, 0x22, 0x90, 0x07, 0x24, 0xFF, 0xED, 0x44,
-        0x07, 0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0x22, 0x85,
-/*07A0*/0x38, 0x38, 0x85, 0x39, 0x39, 0x85, 0x3A, 0x3A,
-        0x74, 0xC0, 0x2F, 0xF5, 0x82, 0x74, 0x02, 0x3E,
-/*07B0*/0xF5, 0x83, 0x22, 0x90, 0x07, 0x26, 0xFF, 0xED,
-        0x44, 0x07, 0xCF, 0xF0, 0xA3, 0xEF, 0xF0, 0x22,
-/*07C0*/0xF0, 0x74, 0xA0, 0x2F, 0xF5, 0x82, 0x74, 0x02,
-        0x3E, 0xF5, 0x83, 0x22, 0x74, 0xC0, 0x25, 0x11,
-/*07D0*/0xF5, 0x82, 0xE4, 0x34, 0x01, 0xF5, 0x83, 0x22,
-        0x74, 0x00, 0x25, 0x11, 0xF5, 0x82, 0xE4, 0x34,
-/*07E0*/0x02, 0xF5, 0x83, 0x22, 0x74, 0x60, 0x25, 0x11,
-        0xF5, 0x82, 0xE4, 0x34, 0x03, 0xF5, 0x83, 0x22,
-/*07F0*/0x74, 0x80, 0x25, 0x11, 0xF5, 0x82, 0xE4, 0x34,
-        0x03, 0xF5, 0x83, 0x22, 0x74, 0xE0, 0x25, 0x11,
-/*0800*/0xF5, 0x82, 0xE4, 0x34, 0x03, 0xF5, 0x83, 0x22,
-        0x74, 0x40, 0x25, 0x11, 0xF5, 0x82, 0xE4, 0x34,
-/*0810*/0x06, 0xF5, 0x83, 0x22, 0x74, 0x80, 0x2F, 0xF5,
-        0x82, 0x74, 0x02, 0x3E, 0xF5, 0x83, 0x22, 0xAF,
-/*0820*/0x08, 0x7E, 0x00, 0xEF, 0x44, 0x07, 0xF5, 0x82,
-        0x22, 0xF5, 0x83, 0xE5, 0x82, 0x44, 0x07, 0xF5,
-/*0830*/0x82, 0xE5, 0x40, 0xF0, 0x22, 0x74, 0x40, 0x25,
-        0x11, 0xF5, 0x82, 0xE4, 0x34, 0x02, 0xF5, 0x83,
-/*0840*/0x22, 0x74, 0xC0, 0x25, 0x11, 0xF5, 0x82, 0xE4,
-        0x34, 0x03, 0xF5, 0x83, 0x22, 0x74, 0x00, 0x25,
-/*0850*/0x11, 0xF5, 0x82, 0xE4, 0x34, 0x06, 0xF5, 0x83,
-        0x22, 0x74, 0x20, 0x25, 0x11, 0xF5, 0x82, 0xE4,
-/*0860*/0x34, 0x06, 0xF5, 0x83, 0x22, 0xE5, 0x08, 0xFD,
-        0xED, 0x44, 0x07, 0xF5, 0x82, 0x22, 0xE5, 0x41,
-/*0870*/0xF0, 0xE5, 0x65, 0x64, 0x01, 0x45, 0x64, 0x22,
-        0x7E, 0x00, 0xFB, 0x7A, 0x00, 0xFD, 0x7C, 0x00,
-/*0880*/0x22, 0x74, 0x20, 0x25, 0x11, 0xF5, 0x82, 0xE4,
-        0x34, 0x02, 0x22, 0x74, 0xA0, 0x25, 0x11, 0xF5,
-/*0890*/0x82, 0xE4, 0x34, 0x03, 0x22, 0x85, 0x3E, 0x42,
-        0x85, 0x3F, 0x41, 0x8F, 0x40, 0x22, 0x85, 0x3C,
-/*08A0*/0x42, 0x85, 0x3D, 0x41, 0x8F, 0x40, 0x22, 0x75,
-        0x45, 0x3F, 0x90, 0x07, 0x20, 0xE4, 0xF0, 0xA3,
-/*08B0*/0x22, 0xF5, 0x83, 0xE5, 0x32, 0xF0, 0x05, 0x6E,
-        0xE5, 0x6E, 0xC3, 0x94, 0x40, 0x22, 0xF0, 0xE5,
-/*08C0*/0x08, 0x44, 0x06, 0xF5, 0x82, 0x22, 0x74, 0x00,
-        0x25, 0x6E, 0xF5, 0x82, 0xE4, 0x34, 0x00, 0xF5,
-/*08D0*/0x83, 0x22, 0xE5, 0x6D, 0x45, 0x6C, 0x90, 0x07,
-        0x2F, 0x22, 0xE4, 0xF9, 0xE5, 0x3C, 0xD3, 0x95,
-/*08E0*/0x3E, 0x22, 0x74, 0x80, 0x2E, 0xF5, 0x82, 0xE4,
-        0x34, 0x02, 0xF5, 0x83, 0xE0, 0x22, 0x74, 0xA0,
-/*08F0*/0x2E, 0xF5, 0x82, 0xE4, 0x34, 0x02, 0xF5, 0x83,
-        0xE0, 0x22, 0x74, 0x80, 0x25, 0x6E, 0xF5, 0x82,
-/*0900*/0xE4, 0x34, 0x00, 0x22, 0x25, 0x42, 0xFD, 0xE4,
-        0x33, 0xFC, 0x22, 0x85, 0x42, 0x42, 0x85, 0x41,
-/*0910*/0x41, 0x85, 0x40, 0x40, 0x22, 0xED, 0x4C, 0x60,
-        0x03, 0x02, 0x09, 0xE5, 0xEF, 0x4E, 0x70, 0x37,
-/*0920*/0x90, 0x07, 0x26, 0x12, 0x07, 0x89, 0xE0, 0xFD,
-        0x12, 0x07, 0xCC, 0xED, 0xF0, 0x90, 0x07, 0x28,
-/*0930*/0x12, 0x07, 0x89, 0xE0, 0xFD, 0x12, 0x07, 0xD8,
-        0xED, 0xF0, 0x12, 0x07, 0x86, 0xE0, 0x54, 0x1F,
-/*0940*/0xFD, 0x12, 0x08, 0x81, 0xF5, 0x83, 0xED, 0xF0,
-        0x90, 0x07, 0x24, 0x12, 0x07, 0x89, 0xE0, 0x54,
-/*0950*/0x1F, 0xFD, 0x12, 0x08, 0x35, 0xED, 0xF0, 0xEF,
-        0x64, 0x04, 0x4E, 0x70, 0x37, 0x90, 0x07, 0x26,
-/*0960*/0x12, 0x07, 0x89, 0xE0, 0xFD, 0x12, 0x07, 0xE4,
-        0xED, 0xF0, 0x90, 0x07, 0x28, 0x12, 0x07, 0x89,
-/*0970*/0xE0, 0xFD, 0x12, 0x07, 0xF0, 0xED, 0xF0, 0x12,
-        0x07, 0x86, 0xE0, 0x54, 0x1F, 0xFD, 0x12, 0x08,
-/*0980*/0x8B, 0xF5, 0x83, 0xED, 0xF0, 0x90, 0x07, 0x24,
-        0x12, 0x07, 0x89, 0xE0, 0x54, 0x1F, 0xFD, 0x12,
-/*0990*/0x08, 0x41, 0xED, 0xF0, 0xEF, 0x64, 0x01, 0x4E,
-        0x70, 0x04, 0x7D, 0x01, 0x80, 0x02, 0x7D, 0x00,
-/*09A0*/0xEF, 0x64, 0x02, 0x4E, 0x70, 0x04, 0x7F, 0x01,
-        0x80, 0x02, 0x7F, 0x00, 0xEF, 0x4D, 0x60, 0x78,
-/*09B0*/0x90, 0x07, 0x26, 0x12, 0x07, 0x35, 0xE0, 0xFF,
-        0x12, 0x07, 0xFC, 0xEF, 0x12, 0x07, 0x31, 0xE0,
-/*09C0*/0xFF, 0x12, 0x08, 0x08, 0xEF, 0xF0, 0x90, 0x07,
-        0x22, 0x12, 0x07, 0x35, 0xE0, 0x54, 0x1F, 0xFF,
-/*09D0*/0x12, 0x08, 0x4D, 0xEF, 0xF0, 0x90, 0x07, 0x24,
-        0x12, 0x07, 0x35, 0xE0, 0x54, 0x1F, 0xFF, 0x12,
-/*09E0*/0x08, 0x59, 0xEF, 0xF0, 0x22, 0x12, 0x07, 0xCC,
-        0xE4, 0xF0, 0x12, 0x07, 0xD8, 0xE4, 0xF0, 0x12,
-/*09F0*/0x08, 0x81, 0xF5, 0x83, 0xE4, 0xF0, 0x12, 0x08,
-        0x35, 0x74, 0x14, 0xF0, 0x12, 0x07, 0xE4, 0xE4,
-/*0A00*/0xF0, 0x12, 0x07, 0xF0, 0xE4, 0xF0, 0x12, 0x08,
-        0x8B, 0xF5, 0x83, 0xE4, 0xF0, 0x12, 0x08, 0x41,
-/*0A10*/0x74, 0x14, 0xF0, 0x12, 0x07, 0xFC, 0xE4, 0xF0,
-        0x12, 0x08, 0x08, 0xE4, 0xF0, 0x12, 0x08, 0x4D,
-/*0A20*/0xE4, 0xF0, 0x12, 0x08, 0x59, 0x74, 0x14, 0xF0,
-        0x22, 0x53, 0xF9, 0xF7, 0x75, 0xFC, 0x10, 0xE4,
-/*0A30*/0xF5, 0xFD, 0x75, 0xFE, 0x30, 0xF5, 0xFF, 0xE5,
-        0xE7, 0x20, 0xE7, 0x03, 0x43, 0xF9, 0x08, 0xE5,
-/*0A40*/0xE6, 0x20, 0xE7, 0x0B, 0x78, 0xFF, 0xE4, 0xF6,
-        0xD8, 0xFD, 0x53, 0xE6, 0xFE, 0x80, 0x09, 0x78,
-/*0A50*/0x08, 0xE4, 0xF6, 0xD8, 0xFD, 0x53, 0xE6, 0xFE,
-        0x75, 0x81, 0x80, 0xE4, 0xF5, 0xA8, 0xD2, 0xA8,
-/*0A60*/0xC2, 0xA9, 0xD2, 0xAF, 0xE5, 0xE2, 0x20, 0xE5,
-        0x05, 0x20, 0xE6, 0x02, 0x80, 0x03, 0x43, 0xE1,
-/*0A70*/0x02, 0xE5, 0xE2, 0x20, 0xE0, 0x0E, 0x90, 0x00,
-        0x00, 0x7F, 0x00, 0x7E, 0x08, 0xE4, 0xF0, 0xA3,
-/*0A80*/0xDF, 0xFC, 0xDE, 0xFA, 0x02, 0x0A, 0xDB, 0x43,
-        0xFA, 0x01, 0xC0, 0xE0, 0xC0, 0xF0, 0xC0, 0x83,
-/*0A90*/0xC0, 0x82, 0xC0, 0xD0, 0x12, 0x1C, 0xE7, 0xD0,
-        0xD0, 0xD0, 0x82, 0xD0, 0x83, 0xD0, 0xF0, 0xD0,
-/*0AA0*/0xE0, 0x53, 0xFA, 0xFE, 0x32, 0x02, 0x1B, 0x55,
-        0xE4, 0x93, 0xA3, 0xF8, 0xE4, 0x93, 0xA3, 0xF6,
-/*0AB0*/0x08, 0xDF, 0xF9, 0x80, 0x29, 0xE4, 0x93, 0xA3,
-        0xF8, 0x54, 0x07, 0x24, 0x0C, 0xC8, 0xC3, 0x33,
-/*0AC0*/0xC4, 0x54, 0x0F, 0x44, 0x20, 0xC8, 0x83, 0x40,
-        0x04, 0xF4, 0x56, 0x80, 0x01, 0x46, 0xF6, 0xDF,
-/*0AD0*/0xE4, 0x80, 0x0B, 0x01, 0x02, 0x04, 0x08, 0x10,
-        0x20, 0x40, 0x80, 0x90, 0x00, 0x3F, 0xE4, 0x7E,
-/*0AE0*/0x01, 0x93, 0x60, 0xC1, 0xA3, 0xFF, 0x54, 0x3F,
-        0x30, 0xE5, 0x09, 0x54, 0x1F, 0xFE, 0xE4, 0x93,
-/*0AF0*/0xA3, 0x60, 0x01, 0x0E, 0xCF, 0x54, 0xC0, 0x25,
-        0xE0, 0x60, 0xAD, 0x40, 0xB8, 0x80, 0xFE, 0x8C,
-/*0B00*/0x64, 0x8D, 0x65, 0x8A, 0x66, 0x8B, 0x67, 0xE4,
-        0xF5, 0x69, 0xEF, 0x4E, 0x70, 0x03, 0x02, 0x1D,
-/*0B10*/0x55, 0xE4, 0xF5, 0x68, 0xE5, 0x67, 0x45, 0x66,
-        0x70, 0x32, 0x12, 0x07, 0x2A, 0x75, 0x83, 0x90,
-/*0B20*/0xE4, 0x12, 0x07, 0x29, 0x75, 0x83, 0xC2, 0xE4,
-        0x12, 0x07, 0x29, 0x75, 0x83, 0xC4, 0xE4, 0x12,
-/*0B30*/0x08, 0x70, 0x70, 0x29, 0x12, 0x07, 0x2A, 0x75,
-        0x83, 0x92, 0xE4, 0x12, 0x07, 0x29, 0x75, 0x83,
-/*0B40*/0xC6, 0xE4, 0x12, 0x07, 0x29, 0x75, 0x83, 0xC8,
-        0xE4, 0xF0, 0x80, 0x11, 0x90, 0x07, 0x26, 0x12,
-/*0B50*/0x07, 0x35, 0xE4, 0x12, 0x08, 0x70, 0x70, 0x05,
-        0x12, 0x07, 0x32, 0xE4, 0xF0, 0x12, 0x1D, 0x55,
-/*0B60*/0x12, 0x1E, 0xBF, 0xE5, 0x67, 0x45, 0x66, 0x70,
-        0x33, 0x12, 0x07, 0x2A, 0x75, 0x83, 0x90, 0xE5,
-/*0B70*/0x41, 0x12, 0x07, 0x29, 0x75, 0x83, 0xC2, 0xE5,
-        0x41, 0x12, 0x07, 0x29, 0x75, 0x83, 0xC4, 0x12,
-/*0B80*/0x08, 0x6E, 0x70, 0x29, 0x12, 0x07, 0x2A, 0x75,
-        0x83, 0x92, 0xE5, 0x40, 0x12, 0x07, 0x29, 0x75,
-/*0B90*/0x83, 0xC6, 0xE5, 0x40, 0x12, 0x07, 0x29, 0x75,
-        0x83, 0xC8, 0x80, 0x0E, 0x90, 0x07, 0x26, 0x12,
-/*0BA0*/0x07, 0x35, 0x12, 0x08, 0x6E, 0x70, 0x06, 0x12,
-        0x07, 0x32, 0xE5, 0x40, 0xF0, 0xAF, 0x69, 0x7E,
-/*0BB0*/0x00, 0xAD, 0x67, 0xAC, 0x66, 0x12, 0x04, 0x44,
-        0x12, 0x07, 0x2A, 0x75, 0x83, 0xCA, 0xE0, 0xD3,
-/*0BC0*/0x94, 0x00, 0x50, 0x0C, 0x05, 0x68, 0xE5, 0x68,
-        0xC3, 0x94, 0x05, 0x50, 0x03, 0x02, 0x0B, 0x14,
-/*0BD0*/0x22, 0x8C, 0x60, 0x8D, 0x61, 0x12, 0x08, 0xDA,
-        0x74, 0x20, 0x40, 0x0D, 0x2F, 0xF5, 0x82, 0x74,
-/*0BE0*/0x03, 0x3E, 0xF5, 0x83, 0xE5, 0x3E, 0xF0, 0x80,
-        0x0B, 0x2F, 0xF5, 0x82, 0x74, 0x03, 0x3E, 0xF5,
-/*0BF0*/0x83, 0xE5, 0x3C, 0xF0, 0xE5, 0x3C, 0xD3, 0x95,
-        0x3E, 0x40, 0x3C, 0xE5, 0x61, 0x45, 0x60, 0x70,
-/*0C00*/0x10, 0xE9, 0x12, 0x09, 0x04, 0xE5, 0x3E, 0x12,
-        0x07, 0x68, 0x40, 0x3B, 0x12, 0x08, 0x95, 0x80,
-/*0C10*/0x18, 0xE5, 0x3E, 0xC3, 0x95, 0x38, 0x40, 0x1D,
-        0x85, 0x3E, 0x38, 0xE5, 0x3E, 0x60, 0x05, 0x85,
-/*0C20*/0x3F, 0x39, 0x80, 0x03, 0x85, 0x39, 0x39, 0x8F,
-        0x3A, 0x12, 0x08, 0x14, 0xE5, 0x3E, 0x12, 0x07,
-/*0C30*/0xC0, 0xE5, 0x3F, 0xF0, 0x22, 0x80, 0x43, 0xE5,
-        0x61, 0x45, 0x60, 0x70, 0x19, 0x12, 0x07, 0x5F,
-/*0C40*/0x40, 0x05, 0x12, 0x08, 0x9E, 0x80, 0x27, 0x12,
-        0x09, 0x0B, 0x12, 0x08, 0x14, 0xE5, 0x42, 0x12,
-/*0C50*/0x07, 0xC0, 0xE5, 0x41, 0xF0, 0x22, 0xE5, 0x3C,
-        0xC3, 0x95, 0x38, 0x40, 0x1D, 0x85, 0x3C, 0x38,
-/*0C60*/0xE5, 0x3C, 0x60, 0x05, 0x85, 0x3D, 0x39, 0x80,
-        0x03, 0x85, 0x39, 0x39, 0x8F, 0x3A, 0x12, 0x08,
-/*0C70*/0x14, 0xE5, 0x3C, 0x12, 0x07, 0xC0, 0xE5, 0x3D,
-        0xF0, 0x22, 0x85, 0x38, 0x38, 0x85, 0x39, 0x39,
-/*0C80*/0x85, 0x3A, 0x3A, 0x12, 0x08, 0x14, 0xE5, 0x38,
-        0x12, 0x07, 0xC0, 0xE5, 0x39, 0xF0, 0x22, 0x7F,
-/*0C90*/0x06, 0x12, 0x17, 0x31, 0x12, 0x1D, 0x23, 0x12,
-        0x0E, 0x04, 0x12, 0x0E, 0x33, 0xE0, 0x44, 0x0A,
-/*0CA0*/0xF0, 0x74, 0x8E, 0xFE, 0x12, 0x0E, 0x04, 0x12,
-        0x0E, 0x0B, 0xEF, 0xF0, 0xE5, 0x28, 0x30, 0xE5,
-/*0CB0*/0x03, 0xD3, 0x80, 0x01, 0xC3, 0x40, 0x05, 0x75,
-        0x14, 0x20, 0x80, 0x03, 0x75, 0x14, 0x08, 0x12,
-/*0CC0*/0x0E, 0x04, 0x75, 0x83, 0x8A, 0xE5, 0x14, 0xF0,
-        0xB4, 0xFF, 0x05, 0x75, 0x12, 0x80, 0x80, 0x06,
-/*0CD0*/0xE5, 0x14, 0xC3, 0x13, 0xF5, 0x12, 0xE4, 0xF5,
-        0x16, 0xF5, 0x7F, 0x12, 0x19, 0x36, 0x12, 0x13,
-/*0CE0*/0xA3, 0xE5, 0x0A, 0xC3, 0x94, 0x01, 0x50, 0x09,
-        0x05, 0x16, 0xE5, 0x16, 0xC3, 0x94, 0x14, 0x40,
-/*0CF0*/0xEA, 0xE5, 0xE4, 0x20, 0xE7, 0x28, 0x12, 0x0E,
-        0x04, 0x75, 0x83, 0xD2, 0xE0, 0x54, 0x08, 0xD3,
-/*0D00*/0x94, 0x00, 0x40, 0x04, 0x7F, 0x01, 0x80, 0x02,
-        0x7F, 0x00, 0xE5, 0x0A, 0xC3, 0x94, 0x01, 0x40,
-/*0D10*/0x04, 0x7E, 0x01, 0x80, 0x02, 0x7E, 0x00, 0xEF,
-        0x5E, 0x60, 0x03, 0x12, 0x1D, 0xD7, 0xE5, 0x7F,
-/*0D20*/0xC3, 0x94, 0x11, 0x40, 0x14, 0x12, 0x0E, 0x04,
-        0x75, 0x83, 0xD2, 0xE0, 0x44, 0x80, 0xF0, 0xE5,
-/*0D30*/0xE4, 0x20, 0xE7, 0x0F, 0x12, 0x1D, 0xD7, 0x80,
-        0x0A, 0x12, 0x0E, 0x04, 0x75, 0x83, 0xD2, 0xE0,
-/*0D40*/0x54, 0x7F, 0xF0, 0x12, 0x1D, 0x23, 0x22, 0x74,
-        0x8A, 0x85, 0x08, 0x82, 0xF5, 0x83, 0xE5, 0x17,
-/*0D50*/0xF0, 0x12, 0x0E, 0x3A, 0xE4, 0xF0, 0x90, 0x07,
-        0x02, 0xE0, 0x12, 0x0E, 0x17, 0x75, 0x83, 0x90,
-/*0D60*/0xEF, 0xF0, 0x74, 0x92, 0xFE, 0xE5, 0x08, 0x44,
-        0x07, 0xFF, 0xF5, 0x82, 0x8E, 0x83, 0xE0, 0x54,
-/*0D70*/0xC0, 0xFD, 0x90, 0x07, 0x03, 0xE0, 0x54, 0x3F,
-        0x4D, 0x8F, 0x82, 0x8E, 0x83, 0xF0, 0x90, 0x07,
-/*0D80*/0x04, 0xE0, 0x12, 0x0E, 0x17, 0x75, 0x83, 0x82,
-        0xEF, 0xF0, 0x90, 0x07, 0x05, 0xE0, 0xFF, 0xED,
-/*0D90*/0x44, 0x07, 0xF5, 0x82, 0x75, 0x83, 0xB4, 0xEF,
-        0x12, 0x0E, 0x03, 0x75, 0x83, 0x80, 0xE0, 0x54,
-/*0DA0*/0xBF, 0xF0, 0x30, 0x37, 0x0A, 0x12, 0x0E, 0x91,
-        0x75, 0x83, 0x94, 0xE0, 0x44, 0x80, 0xF0, 0x30,
-/*0DB0*/0x38, 0x0A, 0x12, 0x0E, 0x91, 0x75, 0x83, 0x92,
-        0xE0, 0x44, 0x80, 0xF0, 0xE5, 0x28, 0x30, 0xE4,
-/*0DC0*/0x1A, 0x20, 0x39, 0x0A, 0x12, 0x0E, 0x04, 0x75,
-        0x83, 0x88, 0xE0, 0x54, 0x7F, 0xF0, 0x20, 0x3A,
-/*0DD0*/0x0A, 0x12, 0x0E, 0x04, 0x75, 0x83, 0x88, 0xE0,
-        0x54, 0xBF, 0xF0, 0x74, 0x8C, 0xFE, 0x12, 0x0E,
-/*0DE0*/0x04, 0x8E, 0x83, 0xE0, 0x54, 0x0F, 0x12, 0x0E,
-        0x03, 0x75, 0x83, 0x86, 0xE0, 0x54, 0xBF, 0xF0,
-/*0DF0*/0xE5, 0x08, 0x44, 0x06, 0x12, 0x0D, 0xFD, 0x75,
-        0x83, 0x8A, 0xE4, 0xF0, 0x22, 0xF5, 0x82, 0x75,
-/*0E00*/0x83, 0x82, 0xE4, 0xF0, 0xE5, 0x08, 0x44, 0x07,
-        0xF5, 0x82, 0x22, 0x8E, 0x83, 0xE0, 0xF5, 0x10,
-/*0E10*/0x54, 0xFE, 0xF0, 0xE5, 0x10, 0x44, 0x01, 0xFF,
-        0xE5, 0x08, 0xFD, 0xED, 0x44, 0x07, 0xF5, 0x82,
-/*0E20*/0x22, 0xE5, 0x15, 0xC4, 0x54, 0x07, 0xFF, 0xE5,
-        0x08, 0xFD, 0xED, 0x44, 0x08, 0xF5, 0x82, 0x75,
-/*0E30*/0x83, 0x82, 0x22, 0x75, 0x83, 0x80, 0xE0, 0x44,
-        0x40, 0xF0, 0xE5, 0x08, 0x44, 0x08, 0xF5, 0x82,
-/*0E40*/0x75, 0x83, 0x8A, 0x22, 0xE5, 0x16, 0x25, 0xE0,
-        0x25, 0xE0, 0x24, 0xAF, 0xF5, 0x82, 0xE4, 0x34,
-/*0E50*/0x1A, 0xF5, 0x83, 0xE4, 0x93, 0xF5, 0x0D, 0x22,
-        0x43, 0xE1, 0x10, 0x43, 0xE1, 0x80, 0x53, 0xE1,
-/*0E60*/0xFD, 0x85, 0xE1, 0x10, 0x22, 0xE5, 0x16, 0x25,
-        0xE0, 0x25, 0xE0, 0x24, 0xB2, 0xF5, 0x82, 0xE4,
-/*0E70*/0x34, 0x1A, 0xF5, 0x83, 0xE4, 0x93, 0x22, 0x85,
-        0x55, 0x82, 0x85, 0x54, 0x83, 0xE5, 0x15, 0xF0,
-/*0E80*/0x22, 0xE5, 0xE2, 0x54, 0x20, 0xD3, 0x94, 0x00,
-        0x22, 0xE5, 0xE2, 0x54, 0x40, 0xD3, 0x94, 0x00,
-/*0E90*/0x22, 0xE5, 0x08, 0x44, 0x06, 0xF5, 0x82, 0x22,
-        0xFD, 0xE5, 0x08, 0xFB, 0xEB, 0x44, 0x07, 0xF5,
-/*0EA0*/0x82, 0x22, 0x53, 0xF9, 0xF7, 0x75, 0xFE, 0x30,
-        0x22, 0xEF, 0x4E, 0x70, 0x26, 0x12, 0x07, 0xCC,
-/*0EB0*/0xE0, 0xFD, 0x90, 0x07, 0x26, 0x12, 0x07, 0x7B,
-        0x12, 0x07, 0xD8, 0xE0, 0xFD, 0x90, 0x07, 0x28,
-/*0EC0*/0x12, 0x07, 0x7B, 0x12, 0x08, 0x81, 0x12, 0x07,
-        0x72, 0x12, 0x08, 0x35, 0xE0, 0x90, 0x07, 0x24,
-/*0ED0*/0x12, 0x07, 0x78, 0xEF, 0x64, 0x04, 0x4E, 0x70,
-        0x29, 0x12, 0x07, 0xE4, 0xE0, 0xFD, 0x90, 0x07,
-/*0EE0*/0x26, 0x12, 0x07, 0x7B, 0x12, 0x07, 0xF0, 0xE0,
-        0xFD, 0x90, 0x07, 0x28, 0x12, 0x07, 0x7B, 0x12,
-/*0EF0*/0x08, 0x8B, 0x12, 0x07, 0x72, 0x12, 0x08, 0x41,
-        0xE0, 0x54, 0x1F, 0xFD, 0x90, 0x07, 0x24, 0x12,
-/*0F00*/0x07, 0x7B, 0xEF, 0x64, 0x01, 0x4E, 0x70, 0x04,
-        0x7D, 0x01, 0x80, 0x02, 0x7D, 0x00, 0xEF, 0x64,
-/*0F10*/0x02, 0x4E, 0x70, 0x04, 0x7F, 0x01, 0x80, 0x02,
-        0x7F, 0x00, 0xEF, 0x4D, 0x60, 0x35, 0x12, 0x07,
-/*0F20*/0xFC, 0xE0, 0xFF, 0x90, 0x07, 0x26, 0x12, 0x07,
-        0x89, 0xEF, 0xF0, 0x12, 0x08, 0x08, 0xE0, 0xFF,
-/*0F30*/0x90, 0x07, 0x28, 0x12, 0x07, 0x89, 0xEF, 0xF0,
-        0x12, 0x08, 0x4D, 0xE0, 0x54, 0x1F, 0xFF, 0x12,
-/*0F40*/0x07, 0x86, 0xEF, 0xF0, 0x12, 0x08, 0x59, 0xE0,
-        0x54, 0x1F, 0xFF, 0x90, 0x07, 0x24, 0x12, 0x07,
-/*0F50*/0x89, 0xEF, 0xF0, 0x22, 0xE4, 0xF5, 0x53, 0x12,
-        0x0E, 0x81, 0x40, 0x04, 0x7F, 0x01, 0x80, 0x02,
-/*0F60*/0x7F, 0x00, 0x12, 0x0E, 0x89, 0x40, 0x04, 0x7E,
-        0x01, 0x80, 0x02, 0x7E, 0x00, 0xEE, 0x4F, 0x70,
-/*0F70*/0x03, 0x02, 0x0F, 0xF6, 0x85, 0xE1, 0x10, 0x43,
-        0xE1, 0x02, 0x53, 0xE1, 0x0F, 0x85, 0xE1, 0x10,
-/*0F80*/0xE4, 0xF5, 0x51, 0xE5, 0xE3, 0x54, 0x3F, 0xF5,
-        0x52, 0x12, 0x0E, 0x89, 0x40, 0x1D, 0xAD, 0x52,
-/*0F90*/0xAF, 0x51, 0x12, 0x11, 0x18, 0xEF, 0x60, 0x08,
-        0x85, 0xE1, 0x10, 0x43, 0xE1, 0x40, 0x80, 0x0B,
-/*0FA0*/0x53, 0xE1, 0xBF, 0x12, 0x0E, 0x58, 0x12, 0x00,
-        0x06, 0x80, 0xFB, 0xE5, 0xE3, 0x54, 0x3F, 0xF5,
-/*0FB0*/0x51, 0xE5, 0xE4, 0x54, 0x3F, 0xF5, 0x52, 0x12,
-        0x0E, 0x81, 0x40, 0x1D, 0xAD, 0x52, 0xAF, 0x51,
-/*0FC0*/0x12, 0x11, 0x18, 0xEF, 0x60, 0x08, 0x85, 0xE1,
-        0x10, 0x43, 0xE1, 0x20, 0x80, 0x0B, 0x53, 0xE1,
-/*0FD0*/0xDF, 0x12, 0x0E, 0x58, 0x12, 0x00, 0x06, 0x80,
-        0xFB, 0x12, 0x0E, 0x81, 0x40, 0x04, 0x7F, 0x01,
-/*0FE0*/0x80, 0x02, 0x7F, 0x00, 0x12, 0x0E, 0x89, 0x40,
-        0x04, 0x7E, 0x01, 0x80, 0x02, 0x7E, 0x00, 0xEE,
-/*0FF0*/0x4F, 0x60, 0x03, 0x12, 0x0E, 0x5B, 0x22, 0x12,
-        0x0E, 0x21, 0xEF, 0xF0, 0x12, 0x10, 0x91, 0x22,
-/*1000*/0x02, 0x11, 0x00, 0x02, 0x10, 0x40, 0x02, 0x10,
-        0x90, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1010*/0x01, 0x20, 0x01, 0x20, 0xE4, 0xF5, 0x57, 0x12,
-        0x16, 0xBD, 0x12, 0x16, 0x44, 0xE4, 0x12, 0x10,
-/*1020*/0x56, 0x12, 0x14, 0xB7, 0x90, 0x07, 0x26, 0x12,
-        0x07, 0x35, 0xE4, 0x12, 0x07, 0x31, 0xE4, 0xF0,
-/*1030*/0x12, 0x10, 0x56, 0x12, 0x14, 0xB7, 0x90, 0x07,
-        0x26, 0x12, 0x07, 0x35, 0xE5, 0x41, 0x12, 0x07,
-/*1040*/0x31, 0xE5, 0x40, 0xF0, 0xAF, 0x57, 0x7E, 0x00,
-        0xAD, 0x56, 0x7C, 0x00, 0x12, 0x04, 0x44, 0xAF,
-/*1050*/0x56, 0x7E, 0x00, 0x02, 0x11, 0xEE, 0xFF, 0x90,
-        0x07, 0x20, 0xA3, 0xE0, 0xFD, 0xE4, 0xF5, 0x56,
-/*1060*/0xF5, 0x40, 0xFE, 0xFC, 0xAB, 0x56, 0xFA, 0x12,
-        0x11, 0x51, 0x7F, 0x0F, 0x7D, 0x18, 0xE4, 0xF5,
-/*1070*/0x56, 0xF5, 0x40, 0xFE, 0xFC, 0xAB, 0x56, 0xFA,
-        0x12, 0x15, 0x41, 0xAF, 0x56, 0x7E, 0x00, 0x12,
-/*1080*/0x1A, 0xFF, 0xE4, 0xFF, 0xF5, 0x56, 0x7D, 0x1F,
-        0xF5, 0x40, 0xFE, 0xFC, 0xAB, 0x56, 0xFA, 0x22,
-/*1090*/0x22, 0xE4, 0xF5, 0x55, 0xE5, 0x08, 0xFD, 0x74,
-        0xA0, 0xF5, 0x56, 0xED, 0x44, 0x07, 0xF5, 0x57,
-/*10A0*/0xE5, 0x28, 0x30, 0xE5, 0x03, 0xD3, 0x80, 0x01,
-        0xC3, 0x40, 0x05, 0x7F, 0x28, 0xEF, 0x80, 0x04,
-/*10B0*/0x7F, 0x14, 0xEF, 0xC3, 0x13, 0xF5, 0x54, 0xE4,
-        0xF9, 0x12, 0x0E, 0x18, 0x75, 0x83, 0x8E, 0xE0,
-/*10C0*/0xF5, 0x10, 0xCE, 0xEF, 0xCE, 0xEE, 0xD3, 0x94,
-        0x00, 0x40, 0x26, 0xE5, 0x10, 0x54, 0xFE, 0x12,
-/*10D0*/0x0E, 0x98, 0x75, 0x83, 0x8E, 0xED, 0xF0, 0xE5,
-        0x10, 0x44, 0x01, 0xFD, 0xEB, 0x44, 0x07, 0xF5,
-/*10E0*/0x82, 0xED, 0xF0, 0x85, 0x57, 0x82, 0x85, 0x56,
-        0x83, 0xE0, 0x30, 0xE3, 0x01, 0x09, 0x1E, 0x80,
-/*10F0*/0xD4, 0xC2, 0x34, 0xE9, 0xC3, 0x95, 0x54, 0x40,
-        0x02, 0xD2, 0x34, 0x22, 0x02, 0x00, 0x06, 0x22,
-/*1100*/0x30, 0x30, 0x11, 0x90, 0x10, 0x00, 0xE4, 0x93,
-        0xF5, 0x10, 0x90, 0x10, 0x10, 0xE4, 0x93, 0xF5,
-/*1110*/0x10, 0x12, 0x10, 0x90, 0x12, 0x11, 0x50, 0x22,
-        0xE4, 0xFC, 0xC3, 0xED, 0x9F, 0xFA, 0xEF, 0xF5,
-/*1120*/0x83, 0x75, 0x82, 0x00, 0x79, 0xFF, 0xE4, 0x93,
-        0xCC, 0x6C, 0xCC, 0xA3, 0xD9, 0xF8, 0xDA, 0xF6,
-/*1130*/0xE5, 0xE2, 0x30, 0xE4, 0x02, 0x8C, 0xE5, 0xED,
-        0x24, 0xFF, 0xFF, 0xEF, 0x75, 0x82, 0xFF, 0xF5,
-/*1140*/0x83, 0xE4, 0x93, 0x6C, 0x70, 0x03, 0x7F, 0x01,
-        0x22, 0x7F, 0x00, 0x22, 0x22, 0x11, 0x00, 0x00,
-/*1150*/0x22, 0x8E, 0x58, 0x8F, 0x59, 0x8C, 0x5A, 0x8D,
-        0x5B, 0x8A, 0x5C, 0x8B, 0x5D, 0x75, 0x5E, 0x01,
-/*1160*/0xE4, 0xF5, 0x5F, 0xF5, 0x60, 0xF5, 0x62, 0x12,
-        0x07, 0x2A, 0x75, 0x83, 0xD0, 0xE0, 0xFF, 0xC4,
-/*1170*/0x54, 0x0F, 0xF5, 0x61, 0x12, 0x1E, 0xA5, 0x85,
-        0x59, 0x5E, 0xD3, 0xE5, 0x5E, 0x95, 0x5B, 0xE5,
-/*1180*/0x5A, 0x12, 0x07, 0x6B, 0x50, 0x4B, 0x12, 0x07,
-        0x03, 0x75, 0x83, 0xBC, 0xE0, 0x45, 0x5E, 0x12,
-/*1190*/0x07, 0x29, 0x75, 0x83, 0xBE, 0xE0, 0x45, 0x5E,
-        0x12, 0x07, 0x29, 0x75, 0x83, 0xC0, 0xE0, 0x45,
-/*11A0*/0x5E, 0xF0, 0xAF, 0x5F, 0xE5, 0x60, 0x12, 0x08,
-        0x78, 0x12, 0x0A, 0xFF, 0xAF, 0x62, 0x7E, 0x00,
-/*11B0*/0xAD, 0x5D, 0xAC, 0x5C, 0x12, 0x04, 0x44, 0xE5,
-        0x61, 0xAF, 0x5E, 0x7E, 0x00, 0xB4, 0x03, 0x05,
-/*11C0*/0x12, 0x1E, 0x21, 0x80, 0x07, 0xAD, 0x5D, 0xAC,
-        0x5C, 0x12, 0x13, 0x17, 0x05, 0x5E, 0x02, 0x11,
-/*11D0*/0x7A, 0x12, 0x07, 0x03, 0x75, 0x83, 0xBC, 0xE0,
-        0x45, 0x40, 0x12, 0x07, 0x29, 0x75, 0x83, 0xBE,
-/*11E0*/0xE0, 0x45, 0x40, 0x12, 0x07, 0x29, 0x75, 0x83,
-        0xC0, 0xE0, 0x45, 0x40, 0xF0, 0x22, 0x8E, 0x58,
-/*11F0*/0x8F, 0x59, 0x75, 0x5A, 0x01, 0x79, 0x01, 0x75,
-        0x5B, 0x01, 0xE4, 0xFB, 0x12, 0x07, 0x2A, 0x75,
-/*1200*/0x83, 0xAE, 0xE0, 0x54, 0x1A, 0xFF, 0x12, 0x08,
-        0x65, 0xE0, 0xC4, 0x13, 0x54, 0x07, 0xFE, 0xEF,
-/*1210*/0x70, 0x0C, 0xEE, 0x65, 0x35, 0x70, 0x07, 0x90,
-        0x07, 0x2F, 0xE0, 0xB4, 0x01, 0x0D, 0xAF, 0x35,
-/*1220*/0x7E, 0x00, 0x12, 0x0E, 0xA9, 0xCF, 0xEB, 0xCF,
-        0x02, 0x1E, 0x60, 0xE5, 0x59, 0x64, 0x02, 0x45,
-/*1230*/0x58, 0x70, 0x04, 0x7F, 0x01, 0x80, 0x02, 0x7F,
-        0x00, 0xE5, 0x59, 0x45, 0x58, 0x70, 0x04, 0x7E,
-/*1240*/0x01, 0x80, 0x02, 0x7E, 0x00, 0xEE, 0x4F, 0x60,
-        0x23, 0x85, 0x41, 0x49, 0x85, 0x40, 0x4B, 0xE5,
-/*1250*/0x59, 0x45, 0x58, 0x70, 0x2C, 0xAF, 0x5A, 0xFE,
-        0xCD, 0xE9, 0xCD, 0xFC, 0xAB, 0x59, 0xAA, 0x58,
-/*1260*/0x12, 0x0A, 0xFF, 0xAF, 0x5B, 0x7E, 0x00, 0x12,
-        0x1E, 0x60, 0x80, 0x15, 0xAF, 0x5B, 0x7E, 0x00,
-/*1270*/0x12, 0x1E, 0x60, 0x90, 0x07, 0x26, 0x12, 0x07,
-        0x35, 0xE5, 0x49, 0x12, 0x07, 0x31, 0xE5, 0x4B,
-/*1280*/0xF0, 0xE4, 0xFD, 0xAF, 0x35, 0xFE, 0xFC, 0x12,
-        0x09, 0x15, 0x22, 0x8C, 0x64, 0x8D, 0x65, 0x12,
-/*1290*/0x08, 0xDA, 0x40, 0x3C, 0xE5, 0x65, 0x45, 0x64,
-        0x70, 0x10, 0x12, 0x09, 0x04, 0xC3, 0xE5, 0x3E,
-/*12A0*/0x12, 0x07, 0x69, 0x40, 0x3B, 0x12, 0x08, 0x95,
-        0x80, 0x18, 0xE5, 0x3E, 0xC3, 0x95, 0x38, 0x40,
-/*12B0*/0x1D, 0x85, 0x3E, 0x38, 0xE5, 0x3E, 0x60, 0x05,
-        0x85, 0x3F, 0x39, 0x80, 0x03, 0x85, 0x39, 0x39,
-/*12C0*/0x8F, 0x3A, 0x12, 0x07, 0xA8, 0xE5, 0x3E, 0x12,
-        0x07, 0x53, 0xE5, 0x3F, 0xF0, 0x22, 0x80, 0x3B,
-/*12D0*/0xE5, 0x65, 0x45, 0x64, 0x70, 0x11, 0x12, 0x07,
-        0x5F, 0x40, 0x05, 0x12, 0x08, 0x9E, 0x80, 0x1F,
-/*12E0*/0x12, 0x07, 0x3E, 0xE5, 0x41, 0xF0, 0x22, 0xE5,
-        0x3C, 0xC3, 0x95, 0x38, 0x40, 0x1D, 0x85, 0x3C,
-/*12F0*/0x38, 0xE5, 0x3C, 0x60, 0x05, 0x85, 0x3D, 0x39,
-        0x80, 0x03, 0x85, 0x39, 0x39, 0x8F, 0x3A, 0x12,
-/*1300*/0x07, 0xA8, 0xE5, 0x3C, 0x12, 0x07, 0x53, 0xE5,
-        0x3D, 0xF0, 0x22, 0x12, 0x07, 0x9F, 0xE5, 0x38,
-/*1310*/0x12, 0x07, 0x53, 0xE5, 0x39, 0xF0, 0x22, 0x8C,
-        0x63, 0x8D, 0x64, 0x12, 0x08, 0xDA, 0x40, 0x3C,
-/*1320*/0xE5, 0x64, 0x45, 0x63, 0x70, 0x10, 0x12, 0x09,
-        0x04, 0xC3, 0xE5, 0x3E, 0x12, 0x07, 0x69, 0x40,
-/*1330*/0x3B, 0x12, 0x08, 0x95, 0x80, 0x18, 0xE5, 0x3E,
-        0xC3, 0x95, 0x38, 0x40, 0x1D, 0x85, 0x3E, 0x38,
-/*1340*/0xE5, 0x3E, 0x60, 0x05, 0x85, 0x3F, 0x39, 0x80,
-        0x03, 0x85, 0x39, 0x39, 0x8F, 0x3A, 0x12, 0x07,
-/*1350*/0xA8, 0xE5, 0x3E, 0x12, 0x07, 0x53, 0xE5, 0x3F,
-        0xF0, 0x22, 0x80, 0x3B, 0xE5, 0x64, 0x45, 0x63,
-/*1360*/0x70, 0x11, 0x12, 0x07, 0x5F, 0x40, 0x05, 0x12,
-        0x08, 0x9E, 0x80, 0x1F, 0x12, 0x07, 0x3E, 0xE5,
-/*1370*/0x41, 0xF0, 0x22, 0xE5, 0x3C, 0xC3, 0x95, 0x38,
-        0x40, 0x1D, 0x85, 0x3C, 0x38, 0xE5, 0x3C, 0x60,
-/*1380*/0x05, 0x85, 0x3D, 0x39, 0x80, 0x03, 0x85, 0x39,
-        0x39, 0x8F, 0x3A, 0x12, 0x07, 0xA8, 0xE5, 0x3C,
-/*1390*/0x12, 0x07, 0x53, 0xE5, 0x3D, 0xF0, 0x22, 0x12,
-        0x07, 0x9F, 0xE5, 0x38, 0x12, 0x07, 0x53, 0xE5,
-/*13A0*/0x39, 0xF0, 0x22, 0xE5, 0x0D, 0xFE, 0xE5, 0x08,
-        0x8E, 0x54, 0x44, 0x05, 0xF5, 0x55, 0x75, 0x15,
-/*13B0*/0x0F, 0xF5, 0x82, 0x12, 0x0E, 0x7A, 0x12, 0x17,
-        0xA3, 0x20, 0x31, 0x05, 0x75, 0x15, 0x03, 0x80,
-/*13C0*/0x03, 0x75, 0x15, 0x0B, 0xE5, 0x0A, 0xC3, 0x94,
-        0x01, 0x50, 0x38, 0x12, 0x14, 0x20, 0x20, 0x31,
-/*13D0*/0x06, 0x05, 0x15, 0x05, 0x15, 0x80, 0x04, 0x15,
-        0x15, 0x15, 0x15, 0xE5, 0x0A, 0xC3, 0x94, 0x01,
-/*13E0*/0x50, 0x21, 0x12, 0x14, 0x20, 0x20, 0x31, 0x04,
-        0x05, 0x15, 0x80, 0x02, 0x15, 0x15, 0xE5, 0x0A,
-/*13F0*/0xC3, 0x94, 0x01, 0x50, 0x0E, 0x12, 0x0E, 0x77,
-        0x12, 0x17, 0xA3, 0x20, 0x31, 0x05, 0x05, 0x15,
-/*1400*/0x12, 0x0E, 0x77, 0xE5, 0x15, 0xB4, 0x08, 0x04,
-        0x7F, 0x01, 0x80, 0x02, 0x7F, 0x00, 0xE5, 0x15,
-/*1410*/0xB4, 0x07, 0x04, 0x7E, 0x01, 0x80, 0x02, 0x7E,
-        0x00, 0xEE, 0x4F, 0x60, 0x02, 0x05, 0x7F, 0x22,
-/*1420*/0x85, 0x55, 0x82, 0x85, 0x54, 0x83, 0xE5, 0x15,
-        0xF0, 0x12, 0x17, 0xA3, 0x22, 0x12, 0x07, 0x2A,
-/*1430*/0x75, 0x83, 0xAE, 0x74, 0xFF, 0x12, 0x07, 0x29,
-        0xE0, 0x54, 0x1A, 0xF5, 0x34, 0xE0, 0xC4, 0x13,
-/*1440*/0x54, 0x07, 0xF5, 0x35, 0x24, 0xFE, 0x60, 0x24,
-        0x24, 0xFE, 0x60, 0x3C, 0x24, 0x04, 0x70, 0x63,
-/*1450*/0x75, 0x31, 0x2D, 0xE5, 0x08, 0xFD, 0x74, 0xB6,
-        0x12, 0x07, 0x92, 0x74, 0xBC, 0x90, 0x07, 0x22,
-/*1460*/0x12, 0x07, 0x95, 0x74, 0x90, 0x12, 0x07, 0xB3,
-        0x74, 0x92, 0x80, 0x3C, 0x75, 0x31, 0x3A, 0xE5,
-/*1470*/0x08, 0xFD, 0x74, 0xBA, 0x12, 0x07, 0x92, 0x74,
-        0xC0, 0x90, 0x07, 0x22, 0x12, 0x07, 0xB6, 0x74,
-/*1480*/0xC4, 0x12, 0x07, 0xB3, 0x74, 0xC8, 0x80, 0x20,
-        0x75, 0x31, 0x35, 0xE5, 0x08, 0xFD, 0x74, 0xB8,
-/*1490*/0x12, 0x07, 0x92, 0x74, 0xBE, 0xFF, 0xED, 0x44,
-        0x07, 0x90, 0x07, 0x22, 0xCF, 0xF0, 0xA3, 0xEF,
-/*14A0*/0xF0, 0x74, 0xC2, 0x12, 0x07, 0xB3, 0x74, 0xC6,
-        0xFF, 0xED, 0x44, 0x07, 0xA3, 0xCF, 0xF0, 0xA3,
-/*14B0*/0xEF, 0xF0, 0x22, 0x75, 0x34, 0x01, 0x22, 0x8E,
-        0x58, 0x8F, 0x59, 0x8C, 0x5A, 0x8D, 0x5B, 0x8A,
-/*14C0*/0x5C, 0x8B, 0x5D, 0x75, 0x5E, 0x01, 0xE4, 0xF5,
-        0x5F, 0x12, 0x1E, 0xA5, 0x85, 0x59, 0x5E, 0xD3,
-/*14D0*/0xE5, 0x5E, 0x95, 0x5B, 0xE5, 0x5A, 0x12, 0x07,
-        0x6B, 0x50, 0x57, 0xE5, 0x5D, 0x45, 0x5C, 0x70,
-/*14E0*/0x30, 0x12, 0x07, 0x2A, 0x75, 0x83, 0x92, 0xE5,
-        0x5E, 0x12, 0x07, 0x29, 0x75, 0x83, 0xC6, 0xE5,
-/*14F0*/0x5E, 0x12, 0x07, 0x29, 0x75, 0x83, 0xC8, 0xE5,
-        0x5E, 0x12, 0x07, 0x29, 0x75, 0x83, 0x90, 0xE5,
-/*1500*/0x5E, 0x12, 0x07, 0x29, 0x75, 0x83, 0xC2, 0xE5,
-        0x5E, 0x12, 0x07, 0x29, 0x75, 0x83, 0xC4, 0x80,
-/*1510*/0x03, 0x12, 0x07, 0x32, 0xE5, 0x5E, 0xF0, 0xAF,
-        0x5F, 0x7E, 0x00, 0xAD, 0x5D, 0xAC, 0x5C, 0x12,
-/*1520*/0x04, 0x44, 0xAF, 0x5E, 0x7E, 0x00, 0xAD, 0x5D,
-        0xAC, 0x5C, 0x12, 0x0B, 0xD1, 0x05, 0x5E, 0x02,
-/*1530*/0x14, 0xCF, 0xAB, 0x5D, 0xAA, 0x5C, 0xAD, 0x5B,
-        0xAC, 0x5A, 0xAF, 0x59, 0xAE, 0x58, 0x02, 0x1B,
-/*1540*/0xFB, 0x8C, 0x5C, 0x8D, 0x5D, 0x8A, 0x5E, 0x8B,
-        0x5F, 0x75, 0x60, 0x01, 0xE4, 0xF5, 0x61, 0xF5,
-/*1550*/0x62, 0xF5, 0x63, 0x12, 0x1E, 0xA5, 0x8F, 0x60,
-        0xD3, 0xE5, 0x60, 0x95, 0x5D, 0xE5, 0x5C, 0x12,
-/*1560*/0x07, 0x6B, 0x50, 0x61, 0xE5, 0x5F, 0x45, 0x5E,
-        0x70, 0x27, 0x12, 0x07, 0x2A, 0x75, 0x83, 0xB6,
-/*1570*/0xE5, 0x60, 0x12, 0x07, 0x29, 0x75, 0x83, 0xB8,
-        0xE5, 0x60, 0x12, 0x07, 0x29, 0x75, 0x83, 0xBA,
-/*1580*/0xE5, 0x60, 0xF0, 0xAF, 0x61, 0x7E, 0x00, 0xE5,
-        0x62, 0x12, 0x08, 0x7A, 0x12, 0x0A, 0xFF, 0x80,
-/*1590*/0x19, 0x90, 0x07, 0x24, 0x12, 0x07, 0x35, 0xE5,
-        0x60, 0x12, 0x07, 0x29, 0x75, 0x83, 0x8E, 0xE4,
-/*15A0*/0x12, 0x07, 0x29, 0x74, 0x01, 0x12, 0x07, 0x29,
-        0xE4, 0xF0, 0xAF, 0x63, 0x7E, 0x00, 0xAD, 0x5F,
-/*15B0*/0xAC, 0x5E, 0x12, 0x04, 0x44, 0xAF, 0x60, 0x7E,
-        0x00, 0xAD, 0x5F, 0xAC, 0x5E, 0x12, 0x12, 0x8B,
-/*15C0*/0x05, 0x60, 0x02, 0x15, 0x58, 0x22, 0x90, 0x11,
-        0x4D, 0xE4, 0x93, 0x90, 0x07, 0x2E, 0xF0, 0x12,
-/*15D0*/0x08, 0x1F, 0x75, 0x83, 0xAE, 0xE0, 0x54, 0x1A,
-        0xF5, 0x34, 0x70, 0x67, 0xEF, 0x44, 0x07, 0xF5,
-/*15E0*/0x82, 0x75, 0x83, 0xCE, 0xE0, 0xFF, 0x13, 0x13,
-        0x13, 0x54, 0x07, 0xF5, 0x36, 0x54, 0x0F, 0xD3,
-/*15F0*/0x94, 0x00, 0x40, 0x06, 0x12, 0x14, 0x2D, 0x12,
-        0x1B, 0xA9, 0xE5, 0x36, 0x54, 0x0F, 0x24, 0xFE,
-/*1600*/0x60, 0x0C, 0x14, 0x60, 0x0C, 0x14, 0x60, 0x19,
-        0x24, 0x03, 0x70, 0x37, 0x80, 0x10, 0x02, 0x1E,
-/*1610*/0x91, 0x12, 0x1E, 0x91, 0x12, 0x07, 0x2A, 0x75,
-        0x83, 0xCE, 0xE0, 0x54, 0xEF, 0xF0, 0x02, 0x1D,
-/*1620*/0xAE, 0x12, 0x10, 0x14, 0xE4, 0xF5, 0x55, 0x12,
-        0x1D, 0x85, 0x05, 0x55, 0xE5, 0x55, 0xC3, 0x94,
-/*1630*/0x05, 0x40, 0xF4, 0x12, 0x07, 0x2A, 0x75, 0x83,
-        0xCE, 0xE0, 0x54, 0xC7, 0x12, 0x07, 0x29, 0xE0,
-/*1640*/0x44, 0x08, 0xF0, 0x22, 0xE4, 0xF5, 0x58, 0xF5,
-        0x59, 0xAF, 0x08, 0xEF, 0x44, 0x07, 0xF5, 0x82,
-/*1650*/0x75, 0x83, 0xD0, 0xE0, 0xFD, 0xC4, 0x54, 0x0F,
-        0xF5, 0x5A, 0xEF, 0x44, 0x07, 0xF5, 0x82, 0x75,
-/*1660*/0x83, 0x80, 0x74, 0x01, 0xF0, 0x12, 0x08, 0x21,
-        0x75, 0x83, 0x82, 0xE5, 0x45, 0xF0, 0xEF, 0x44,
-/*1670*/0x07, 0xF5, 0x82, 0x75, 0x83, 0x8A, 0x74, 0xFF,
-        0xF0, 0x12, 0x1A, 0x4D, 0x12, 0x07, 0x2A, 0x75,
-/*1680*/0x83, 0xBC, 0xE0, 0x54, 0xEF, 0x12, 0x07, 0x29,
-        0x75, 0x83, 0xBE, 0xE0, 0x54, 0xEF, 0x12, 0x07,
-/*1690*/0x29, 0x75, 0x83, 0xC0, 0xE0, 0x54, 0xEF, 0x12,
-        0x07, 0x29, 0x75, 0x83, 0xBC, 0xE0, 0x44, 0x10,
-/*16A0*/0x12, 0x07, 0x29, 0x75, 0x83, 0xBE, 0xE0, 0x44,
-        0x10, 0x12, 0x07, 0x29, 0x75, 0x83, 0xC0, 0xE0,
-/*16B0*/0x44, 0x10, 0xF0, 0xAF, 0x58, 0xE5, 0x59, 0x12,
-        0x08, 0x78, 0x02, 0x0A, 0xFF, 0xE4, 0xF5, 0x58,
-/*16C0*/0x7D, 0x01, 0xF5, 0x59, 0xAF, 0x35, 0xFE, 0xFC,
-        0x12, 0x09, 0x15, 0x12, 0x07, 0x2A, 0x75, 0x83,
-/*16D0*/0xB6, 0x74, 0x10, 0x12, 0x07, 0x29, 0x75, 0x83,
-        0xB8, 0x74, 0x10, 0x12, 0x07, 0x29, 0x75, 0x83,
-/*16E0*/0xBA, 0x74, 0x10, 0x12, 0x07, 0x29, 0x75, 0x83,
-        0xBC, 0x74, 0x10, 0x12, 0x07, 0x29, 0x75, 0x83,
-/*16F0*/0xBE, 0x74, 0x10, 0x12, 0x07, 0x29, 0x75, 0x83,
-        0xC0, 0x74, 0x10, 0x12, 0x07, 0x29, 0x75, 0x83,
-/*1700*/0x90, 0xE4, 0x12, 0x07, 0x29, 0x75, 0x83, 0xC2,
-        0xE4, 0x12, 0x07, 0x29, 0x75, 0x83, 0xC4, 0xE4,
-/*1710*/0x12, 0x07, 0x29, 0x75, 0x83, 0x92, 0xE4, 0x12,
-        0x07, 0x29, 0x75, 0x83, 0xC6, 0xE4, 0x12, 0x07,
-/*1720*/0x29, 0x75, 0x83, 0xC8, 0xE4, 0xF0, 0xAF, 0x58,
-        0xFE, 0xE5, 0x59, 0x12, 0x08, 0x7A, 0x02, 0x0A,
-/*1730*/0xFF, 0xE5, 0xE2, 0x30, 0xE4, 0x6C, 0xE5, 0xE7,
-        0x54, 0xC0, 0x64, 0x40, 0x70, 0x64, 0xE5, 0x09,
-/*1740*/0xC4, 0x54, 0x30, 0xFE, 0xE5, 0x08, 0x25, 0xE0,
-        0x25, 0xE0, 0x54, 0xC0, 0x4E, 0xFE, 0xEF, 0x54,
-/*1750*/0x3F, 0x4E, 0xFD, 0xE5, 0x2B, 0xAE, 0x2A, 0x78,
-        0x02, 0xC3, 0x33, 0xCE, 0x33, 0xCE, 0xD8, 0xF9,
-/*1760*/0xF5, 0x82, 0x8E, 0x83, 0xED, 0xF0, 0xE5, 0x2B,
-        0xAE, 0x2A, 0x78, 0x02, 0xC3, 0x33, 0xCE, 0x33,
-/*1770*/0xCE, 0xD8, 0xF9, 0xFF, 0xF5, 0x82, 0x8E, 0x83,
-        0xA3, 0xE5, 0xFE, 0xF0, 0x8F, 0x82, 0x8E, 0x83,
-/*1780*/0xA3, 0xA3, 0xE5, 0xFD, 0xF0, 0x8F, 0x82, 0x8E,
-        0x83, 0xA3, 0xA3, 0xA3, 0xE5, 0xFC, 0xF0, 0xC3,
-/*1790*/0xE5, 0x2B, 0x94, 0xFA, 0xE5, 0x2A, 0x94, 0x00,
-        0x50, 0x08, 0x05, 0x2B, 0xE5, 0x2B, 0x70, 0x02,
-/*17A0*/0x05, 0x2A, 0x22, 0xE4, 0xFF, 0xE4, 0xF5, 0x58,
-        0xF5, 0x56, 0xF5, 0x57, 0x74, 0x82, 0xFC, 0x12,
-/*17B0*/0x0E, 0x04, 0x8C, 0x83, 0xE0, 0xF5, 0x10, 0x54,
-        0x7F, 0xF0, 0xE5, 0x10, 0x44, 0x80, 0x12, 0x0E,
-/*17C0*/0x98, 0xED, 0xF0, 0x7E, 0x0A, 0x12, 0x0E, 0x04,
-        0x75, 0x83, 0xA0, 0xE0, 0x20, 0xE0, 0x26, 0xDE,
-/*17D0*/0xF4, 0x05, 0x57, 0xE5, 0x57, 0x70, 0x02, 0x05,
-        0x56, 0xE5, 0x14, 0x24, 0x01, 0xFD, 0xE4, 0x33,
-/*17E0*/0xFC, 0xD3, 0xE5, 0x57, 0x9D, 0xE5, 0x56, 0x9C,
-        0x40, 0xD9, 0xE5, 0x0A, 0x94, 0x20, 0x50, 0x02,
-/*17F0*/0x05, 0x0A, 0x43, 0xE1, 0x08, 0xC2, 0x31, 0x12,
-        0x0E, 0x04, 0x75, 0x83, 0xA6, 0xE0, 0x55, 0x12,
-/*1800*/0x65, 0x12, 0x70, 0x03, 0xD2, 0x31, 0x22, 0xC2,
-        0x31, 0x22, 0x90, 0x07, 0x26, 0xE0, 0xFA, 0xA3,
-/*1810*/0xE0, 0xF5, 0x82, 0x8A, 0x83, 0xE0, 0xF5, 0x41,
-        0xE5, 0x39, 0xC3, 0x95, 0x41, 0x40, 0x26, 0xE5,
-/*1820*/0x39, 0x95, 0x41, 0xC3, 0x9F, 0xEE, 0x12, 0x07,
-        0x6B, 0x40, 0x04, 0x7C, 0x01, 0x80, 0x02, 0x7C,
-/*1830*/0x00, 0xE5, 0x41, 0x64, 0x3F, 0x60, 0x04, 0x7B,
-        0x01, 0x80, 0x02, 0x7B, 0x00, 0xEC, 0x5B, 0x60,
-/*1840*/0x29, 0x05, 0x41, 0x80, 0x28, 0xC3, 0xE5, 0x41,
-        0x95, 0x39, 0xC3, 0x9F, 0xEE, 0x12, 0x07, 0x6B,
-/*1850*/0x40, 0x04, 0x7F, 0x01, 0x80, 0x02, 0x7F, 0x00,
-        0xE5, 0x41, 0x60, 0x04, 0x7E, 0x01, 0x80, 0x02,
-/*1860*/0x7E, 0x00, 0xEF, 0x5E, 0x60, 0x04, 0x15, 0x41,
-        0x80, 0x03, 0x85, 0x39, 0x41, 0x85, 0x3A, 0x40,
-/*1870*/0x22, 0xE5, 0xE2, 0x30, 0xE4, 0x60, 0xE5, 0xE1,
-        0x30, 0xE2, 0x5B, 0xE5, 0x09, 0x70, 0x04, 0x7F,
-/*1880*/0x01, 0x80, 0x02, 0x7F, 0x00, 0xE5, 0x08, 0x70,
-        0x04, 0x7E, 0x01, 0x80, 0x02, 0x7E, 0x00, 0xEE,
-/*1890*/0x5F, 0x60, 0x43, 0x53, 0xF9, 0xF8, 0xE5, 0xE2,
-        0x30, 0xE4, 0x3B, 0xE5, 0xE1, 0x30, 0xE2, 0x2E,
-/*18A0*/0x43, 0xFA, 0x02, 0x53, 0xFA, 0xFB, 0xE4, 0xF5,
-        0x10, 0x90, 0x94, 0x70, 0xE5, 0x10, 0xF0, 0xE5,
-/*18B0*/0xE1, 0x30, 0xE2, 0xE7, 0x90, 0x94, 0x70, 0xE0,
-        0x65, 0x10, 0x60, 0x03, 0x43, 0xFA, 0x04, 0x05,
-/*18C0*/0x10, 0x90, 0x94, 0x70, 0xE5, 0x10, 0xF0, 0x70,
-        0xE6, 0x12, 0x00, 0x06, 0x80, 0xE1, 0x53, 0xFA,
-/*18D0*/0xFD, 0x53, 0xFA, 0xFB, 0x80, 0xC0, 0x22, 0x8F,
-        0x54, 0x12, 0x00, 0x06, 0xE5, 0xE1, 0x30, 0xE0,
-/*18E0*/0x04, 0x7F, 0x01, 0x80, 0x02, 0x7F, 0x00, 0xE5,
-        0x7E, 0xD3, 0x94, 0x05, 0x40, 0x04, 0x7E, 0x01,
-/*18F0*/0x80, 0x02, 0x7E, 0x00, 0xEE, 0x4F, 0x60, 0x3D,
-        0x85, 0x54, 0x11, 0xE5, 0xE2, 0x20, 0xE1, 0x32,
-/*1900*/0x74, 0xCE, 0x12, 0x1A, 0x05, 0x30, 0xE7, 0x04,
-        0x7D, 0x01, 0x80, 0x02, 0x7D, 0x00, 0x8F, 0x82,
-/*1910*/0x8E, 0x83, 0xE0, 0x30, 0xE6, 0x04, 0x7F, 0x01,
-        0x80, 0x02, 0x7F, 0x00, 0xEF, 0x5D, 0x70, 0x15,
-/*1920*/0x12, 0x15, 0xC6, 0x74, 0xCE, 0x12, 0x1A, 0x05,
-        0x30, 0xE6, 0x07, 0xE0, 0x44, 0x80, 0xF0, 0x43,
-/*1930*/0xF9, 0x80, 0x12, 0x18, 0x71, 0x22, 0x12, 0x0E,
-        0x44, 0xE5, 0x16, 0x25, 0xE0, 0x25, 0xE0, 0x24,
-/*1940*/0xB0, 0xF5, 0x82, 0xE4, 0x34, 0x1A, 0xF5, 0x83,
-        0xE4, 0x93, 0xF5, 0x0F, 0xE5, 0x16, 0x25, 0xE0,
-/*1950*/0x25, 0xE0, 0x24, 0xB1, 0xF5, 0x82, 0xE4, 0x34,
-        0x1A, 0xF5, 0x83, 0xE4, 0x93, 0xF5, 0x0E, 0x12,
-/*1960*/0x0E, 0x65, 0xF5, 0x10, 0xE5, 0x0F, 0x54, 0xF0,
-        0x12, 0x0E, 0x17, 0x75, 0x83, 0x8C, 0xEF, 0xF0,
-/*1970*/0xE5, 0x0F, 0x30, 0xE0, 0x0C, 0x12, 0x0E, 0x04,
-        0x75, 0x83, 0x86, 0xE0, 0x44, 0x40, 0xF0, 0x80,
-/*1980*/0x0A, 0x12, 0x0E, 0x04, 0x75, 0x83, 0x86, 0xE0,
-        0x54, 0xBF, 0xF0, 0x12, 0x0E, 0x91, 0x75, 0x83,
-/*1990*/0x82, 0xE5, 0x0E, 0xF0, 0x22, 0x7F, 0x05, 0x12,
-        0x17, 0x31, 0x12, 0x0E, 0x04, 0x12, 0x0E, 0x33,
-/*19A0*/0x74, 0x02, 0xF0, 0x74, 0x8E, 0xFE, 0x12, 0x0E,
-        0x04, 0x12, 0x0E, 0x0B, 0xEF, 0xF0, 0x75, 0x15,
-/*19B0*/0x70, 0x12, 0x0F, 0xF7, 0x20, 0x34, 0x05, 0x75,
-        0x15, 0x10, 0x80, 0x03, 0x75, 0x15, 0x50, 0x12,
-/*19C0*/0x0F, 0xF7, 0x20, 0x34, 0x04, 0x74, 0x10, 0x80,
-        0x02, 0x74, 0xF0, 0x25, 0x15, 0xF5, 0x15, 0x12,
-/*19D0*/0x0E, 0x21, 0xEF, 0xF0, 0x12, 0x10, 0x91, 0x20,
-        0x34, 0x17, 0xE5, 0x15, 0x64, 0x30, 0x60, 0x0C,
-/*19E0*/0x74, 0x10, 0x25, 0x15, 0xF5, 0x15, 0xB4, 0x80,
-        0x03, 0xE4, 0xF5, 0x15, 0x12, 0x0E, 0x21, 0xEF,
-/*19F0*/0xF0, 0x22, 0xF0, 0xE5, 0x0B, 0x25, 0xE0, 0x25,
-        0xE0, 0x24, 0x82, 0xF5, 0x82, 0xE4, 0x34, 0x07,
-/*1A00*/0xF5, 0x83, 0x22, 0x74, 0x88, 0xFE, 0xE5, 0x08,
-        0x44, 0x07, 0xFF, 0xF5, 0x82, 0x8E, 0x83, 0xE0,
-/*1A10*/0x22, 0xF0, 0xE5, 0x08, 0x44, 0x07, 0xF5, 0x82,
-        0x22, 0xF0, 0xE0, 0x54, 0xC0, 0x8F, 0x82, 0x8E,
-/*1A20*/0x83, 0xF0, 0x22, 0xEF, 0x44, 0x07, 0xF5, 0x82,
-        0x75, 0x83, 0x86, 0xE0, 0x54, 0x10, 0xD3, 0x94,
-/*1A30*/0x00, 0x22, 0xF0, 0x90, 0x07, 0x15, 0xE0, 0x04,
-        0xF0, 0x22, 0x44, 0x06, 0xF5, 0x82, 0x75, 0x83,
-/*1A40*/0x9E, 0xE0, 0x22, 0xFE, 0xEF, 0x44, 0x07, 0xF5,
-        0x82, 0x8E, 0x83, 0xE0, 0x22, 0xE4, 0x90, 0x07,
-/*1A50*/0x2A, 0xF0, 0xA3, 0xF0, 0x12, 0x07, 0x2A, 0x75,
-        0x83, 0x82, 0xE0, 0x54, 0x7F, 0x12, 0x07, 0x29,
-/*1A60*/0xE0, 0x44, 0x80, 0xF0, 0x12, 0x10, 0xFC, 0x12,
-        0x08, 0x1F, 0x75, 0x83, 0xA0, 0xE0, 0x20, 0xE0,
-/*1A70*/0x1A, 0x90, 0x07, 0x2B, 0xE0, 0x04, 0xF0, 0x70,
-        0x06, 0x90, 0x07, 0x2A, 0xE0, 0x04, 0xF0, 0x90,
-/*1A80*/0x07, 0x2A, 0xE0, 0xB4, 0x10, 0xE1, 0xA3, 0xE0,
-        0xB4, 0x00, 0xDC, 0xEE, 0x44, 0xA6, 0xFC, 0xEF,
-/*1A90*/0x44, 0x07, 0xF5, 0x82, 0x8C, 0x83, 0xE0, 0xF5,
-        0x32, 0xEE, 0x44, 0xA8, 0xFE, 0xEF, 0x44, 0x07,
-/*1AA0*/0xF5, 0x82, 0x8E, 0x83, 0xE0, 0xF5, 0x33, 0x22,
-        0x01, 0x20, 0x11, 0x00, 0x04, 0x20, 0x00, 0x90,
-/*1AB0*/0x00, 0x20, 0x0F, 0x92, 0x00, 0x21, 0x0F, 0x94,
-        0x00, 0x22, 0x0F, 0x96, 0x00, 0x23, 0x0F, 0x98,
-/*1AC0*/0x00, 0x24, 0x0F, 0x9A, 0x00, 0x25, 0x0F, 0x9C,
-        0x00, 0x26, 0x0F, 0x9E, 0x00, 0x27, 0x0F, 0xA0,
-/*1AD0*/0x01, 0x20, 0x01, 0xA2, 0x01, 0x21, 0x01, 0xA4,
-        0x01, 0x22, 0x01, 0xA6, 0x01, 0x23, 0x01, 0xA8,
-/*1AE0*/0x01, 0x24, 0x01, 0xAA, 0x01, 0x25, 0x01, 0xAC,
-        0x01, 0x26, 0x01, 0xAE, 0x01, 0x27, 0x01, 0xB0,
-/*1AF0*/0x01, 0x28, 0x01, 0xB4, 0x00, 0x28, 0x0F, 0xB6,
-        0x40, 0x28, 0x0F, 0xB8, 0x61, 0x28, 0x01, 0xCB,
-/*1B00*/0xEF, 0xCB, 0xCA, 0xEE, 0xCA, 0x7F, 0x01, 0xE4,
-        0xFD, 0xEB, 0x4A, 0x70, 0x24, 0xE5, 0x08, 0xF5,
-/*1B10*/0x82, 0x74, 0xB6, 0x12, 0x08, 0x29, 0xE5, 0x08,
-        0xF5, 0x82, 0x74, 0xB8, 0x12, 0x08, 0x29, 0xE5,
-/*1B20*/0x08, 0xF5, 0x82, 0x74, 0xBA, 0x12, 0x08, 0x29,
-        0x7E, 0x00, 0x7C, 0x00, 0x12, 0x0A, 0xFF, 0x80,
-/*1B30*/0x12, 0x90, 0x07, 0x26, 0x12, 0x07, 0x35, 0xE5,
-        0x41, 0xF0, 0x90, 0x07, 0x24, 0x12, 0x07, 0x35,
-/*1B40*/0xE5, 0x40, 0xF0, 0x12, 0x07, 0x2A, 0x75, 0x83,
-        0x8E, 0xE4, 0x12, 0x07, 0x29, 0x74, 0x01, 0x12,
-/*1B50*/0x07, 0x29, 0xE4, 0xF0, 0x22, 0xE4, 0xF5, 0x26,
-        0xF5, 0x27, 0x53, 0xE1, 0xFE, 0xF5, 0x2A, 0x75,
-/*1B60*/0x2B, 0x01, 0xF5, 0x08, 0x7F, 0x01, 0x12, 0x17,
-        0x31, 0x30, 0x30, 0x1C, 0x90, 0x1A, 0xA9, 0xE4,
-/*1B70*/0x93, 0xF5, 0x10, 0x90, 0x1F, 0xF9, 0xE4, 0x93,
-        0xF5, 0x10, 0x90, 0x00, 0x41, 0xE4, 0x93, 0xF5,
-/*1B80*/0x10, 0x90, 0x1E, 0xCA, 0xE4, 0x93, 0xF5, 0x10,
-        0x7F, 0x02, 0x12, 0x17, 0x31, 0x12, 0x0F, 0x54,
-/*1B90*/0x7F, 0x03, 0x12, 0x17, 0x31, 0x12, 0x00, 0x06,
-        0xE5, 0xE2, 0x30, 0xE7, 0x09, 0x12, 0x10, 0x00,
-/*1BA0*/0x30, 0x30, 0x03, 0x12, 0x11, 0x00, 0x02, 0x00,
-        0x47, 0x12, 0x08, 0x1F, 0x75, 0x83, 0xD0, 0xE0,
-/*1BB0*/0xC4, 0x54, 0x0F, 0xFD, 0x75, 0x43, 0x01, 0x75,
-        0x44, 0xFF, 0x12, 0x08, 0xAA, 0x74, 0x04, 0xF0,
-/*1BC0*/0x75, 0x3B, 0x01, 0xED, 0x14, 0x60, 0x0C, 0x14,
-        0x60, 0x0B, 0x14, 0x60, 0x0F, 0x24, 0x03, 0x70,
-/*1BD0*/0x0B, 0x80, 0x09, 0x80, 0x00, 0x12, 0x08, 0xA7,
-        0x04, 0xF0, 0x80, 0x06, 0x12, 0x08, 0xA7, 0x74,
-/*1BE0*/0x04, 0xF0, 0xEE, 0x44, 0x82, 0xFE, 0xEF, 0x44,
-        0x07, 0xF5, 0x82, 0x8E, 0x83, 0xE5, 0x45, 0x12,
-/*1BF0*/0x08, 0xBE, 0x75, 0x83, 0x82, 0xE5, 0x31, 0xF0,
-        0x02, 0x11, 0x4C, 0x8E, 0x60, 0x8F, 0x61, 0x12,
-/*1C00*/0x1E, 0xA5, 0xE4, 0xFF, 0xCE, 0xED, 0xCE, 0xEE,
-        0xD3, 0x95, 0x61, 0xE5, 0x60, 0x12, 0x07, 0x6B,
-/*1C10*/0x40, 0x39, 0x74, 0x20, 0x2E, 0xF5, 0x82, 0xE4,
-        0x34, 0x03, 0xF5, 0x83, 0xE0, 0x70, 0x03, 0xFF,
-/*1C20*/0x80, 0x26, 0x12, 0x08, 0xE2, 0xFD, 0xC3, 0x9F,
-        0x40, 0x1E, 0xCF, 0xED, 0xCF, 0xEB, 0x4A, 0x70,
-/*1C30*/0x0B, 0x8D, 0x42, 0x12, 0x08, 0xEE, 0xF5, 0x41,
-        0x8E, 0x40, 0x80, 0x0C, 0x12, 0x08, 0xE2, 0xF5,
-/*1C40*/0x38, 0x12, 0x08, 0xEE, 0xF5, 0x39, 0x8E, 0x3A,
-        0x1E, 0x80, 0xBC, 0x22, 0x75, 0x58, 0x01, 0xE5,
-/*1C50*/0x35, 0x70, 0x0C, 0x12, 0x07, 0xCC, 0xE0, 0xF5,
-        0x4A, 0x12, 0x07, 0xD8, 0xE0, 0xF5, 0x4C, 0xE5,
-/*1C60*/0x35, 0xB4, 0x04, 0x0C, 0x12, 0x07, 0xE4, 0xE0,
-        0xF5, 0x4A, 0x12, 0x07, 0xF0, 0xE0, 0xF5, 0x4C,
-/*1C70*/0xE5, 0x35, 0xB4, 0x01, 0x04, 0x7F, 0x01, 0x80,
-        0x02, 0x7F, 0x00, 0xE5, 0x35, 0xB4, 0x02, 0x04,
-/*1C80*/0x7E, 0x01, 0x80, 0x02, 0x7E, 0x00, 0xEE, 0x4F,
-        0x60, 0x0C, 0x12, 0x07, 0xFC, 0xE0, 0xF5, 0x4A,
-/*1C90*/0x12, 0x08, 0x08, 0xE0, 0xF5, 0x4C, 0x85, 0x41,
-        0x49, 0x85, 0x40, 0x4B, 0x22, 0x75, 0x5B, 0x01,
-/*1CA0*/0x90, 0x07, 0x24, 0x12, 0x07, 0x35, 0xE0, 0x54,
-        0x1F, 0xFF, 0xD3, 0x94, 0x02, 0x50, 0x04, 0x8F,
-/*1CB0*/0x58, 0x80, 0x05, 0xEF, 0x24, 0xFE, 0xF5, 0x58,
-        0xEF, 0xC3, 0x94, 0x18, 0x40, 0x05, 0x75, 0x59,
-/*1CC0*/0x18, 0x80, 0x04, 0xEF, 0x04, 0xF5, 0x59, 0x85,
-        0x43, 0x5A, 0xAF, 0x58, 0x7E, 0x00, 0xAD, 0x59,
-/*1CD0*/0x7C, 0x00, 0xAB, 0x5B, 0x7A, 0x00, 0x12, 0x15,
-        0x41, 0xAF, 0x5A, 0x7E, 0x00, 0x12, 0x18, 0x0A,
-/*1CE0*/0xAF, 0x5B, 0x7E, 0x00, 0x02, 0x1A, 0xFF, 0xE5,
-        0xE2, 0x30, 0xE7, 0x0E, 0x12, 0x10, 0x03, 0xC2,
-/*1CF0*/0x30, 0x30, 0x30, 0x03, 0x12, 0x10, 0xFF, 0x20,
-        0x33, 0x28, 0xE5, 0xE7, 0x30, 0xE7, 0x05, 0x12,
-/*1D00*/0x0E, 0xA2, 0x80, 0x0D, 0xE5, 0xFE, 0xC3, 0x94,
-        0x20, 0x50, 0x06, 0x12, 0x0E, 0xA2, 0x43, 0xF9,
-/*1D10*/0x08, 0xE5, 0xF2, 0x30, 0xE7, 0x03, 0x53, 0xF9,
-        0x7F, 0xE5, 0xF1, 0x54, 0x70, 0xD3, 0x94, 0x00,
-/*1D20*/0x50, 0xD8, 0x22, 0x12, 0x0E, 0x04, 0x75, 0x83,
-        0x80, 0xE4, 0xF0, 0xE5, 0x08, 0x44, 0x07, 0x12,
-/*1D30*/0x0D, 0xFD, 0x75, 0x83, 0x84, 0x12, 0x0E, 0x02,
-        0x75, 0x83, 0x86, 0x12, 0x0E, 0x02, 0x75, 0x83,
-/*1D40*/0x8C, 0xE0, 0x54, 0xF3, 0x12, 0x0E, 0x03, 0x75,
-        0x83, 0x8E, 0x12, 0x0E, 0x02, 0x75, 0x83, 0x94,
-/*1D50*/0xE0, 0x54, 0xFB, 0xF0, 0x22, 0x12, 0x07, 0x2A,
-        0x75, 0x83, 0x8E, 0xE4, 0x12, 0x07, 0x29, 0x74,
-/*1D60*/0x01, 0x12, 0x07, 0x29, 0xE4, 0x12, 0x08, 0xBE,
-        0x75, 0x83, 0x8C, 0xE0, 0x44, 0x20, 0x12, 0x08,
-/*1D70*/0xBE, 0xE0, 0x54, 0xDF, 0xF0, 0x74, 0x84, 0x85,
-        0x08, 0x82, 0xF5, 0x83, 0xE0, 0x54, 0x7F, 0xF0,
-/*1D80*/0xE0, 0x44, 0x80, 0xF0, 0x22, 0x75, 0x56, 0x01,
-        0xE4, 0xFD, 0xF5, 0x57, 0xAF, 0x35, 0xFE, 0xFC,
-/*1D90*/0x12, 0x09, 0x15, 0x12, 0x1C, 0x9D, 0x12, 0x1E,
-        0x7A, 0x12, 0x1C, 0x4C, 0xAF, 0x57, 0x7E, 0x00,
-/*1DA0*/0xAD, 0x56, 0x7C, 0x00, 0x12, 0x04, 0x44, 0xAF,
-        0x56, 0x7E, 0x00, 0x02, 0x11, 0xEE, 0x75, 0x56,
-/*1DB0*/0x01, 0xE4, 0xFD, 0xF5, 0x57, 0xAF, 0x35, 0xFE,
-        0xFC, 0x12, 0x09, 0x15, 0x12, 0x1C, 0x9D, 0x12,
-/*1DC0*/0x1E, 0x7A, 0x12, 0x1C, 0x4C, 0xAF, 0x57, 0x7E,
-        0x00, 0xAD, 0x56, 0x7C, 0x00, 0x12, 0x04, 0x44,
-/*1DD0*/0xAF, 0x56, 0x7E, 0x00, 0x02, 0x11, 0xEE, 0xE4,
-        0xF5, 0x16, 0x12, 0x0E, 0x44, 0xFE, 0xE5, 0x08,
-/*1DE0*/0x44, 0x05, 0xFF, 0x12, 0x0E, 0x65, 0x8F, 0x82,
-        0x8E, 0x83, 0xF0, 0x05, 0x16, 0xE5, 0x16, 0xC3,
-/*1DF0*/0x94, 0x14, 0x40, 0xE6, 0xE5, 0x08, 0x12, 0x0E,
-        0x2B, 0xE4, 0xF0, 0x22, 0xE4, 0xF5, 0x58, 0xF5,
-/*1E00*/0x59, 0xF5, 0x5A, 0xFF, 0xFE, 0xAD, 0x58, 0xFC,
-        0x12, 0x09, 0x15, 0x7F, 0x04, 0x7E, 0x00, 0xAD,
-/*1E10*/0x58, 0x7C, 0x00, 0x12, 0x09, 0x15, 0x7F, 0x02,
-        0x7E, 0x00, 0xAD, 0x58, 0x7C, 0x00, 0x02, 0x09,
-/*1E20*/0x15, 0xE5, 0x3C, 0x25, 0x3E, 0xFC, 0xE5, 0x42,
-        0x24, 0x00, 0xFB, 0xE4, 0x33, 0xFA, 0xEC, 0xC3,
-/*1E30*/0x9B, 0xEA, 0x12, 0x07, 0x6B, 0x40, 0x0B, 0x8C,
-        0x42, 0xE5, 0x3D, 0x25, 0x3F, 0xF5, 0x41, 0x8F,
-/*1E40*/0x40, 0x22, 0x12, 0x09, 0x0B, 0x22, 0x74, 0x84,
-        0xF5, 0x18, 0x85, 0x08, 0x19, 0x85, 0x19, 0x82,
-/*1E50*/0x85, 0x18, 0x83, 0xE0, 0x54, 0x7F, 0xF0, 0xE0,
-        0x44, 0x80, 0xF0, 0xE0, 0x44, 0x80, 0xF0, 0x22,
-/*1E60*/0xEF, 0x4E, 0x70, 0x0B, 0x12, 0x07, 0x2A, 0x75,
-        0x83, 0xD2, 0xE0, 0x54, 0xDF, 0xF0, 0x22, 0x12,
-/*1E70*/0x07, 0x2A, 0x75, 0x83, 0xD2, 0xE0, 0x44, 0x20,
-        0xF0, 0x22, 0x75, 0x58, 0x01, 0x90, 0x07, 0x26,
-/*1E80*/0x12, 0x07, 0x35, 0xE0, 0x54, 0x3F, 0xF5, 0x41,
-        0x12, 0x07, 0x32, 0xE0, 0x54, 0x3F, 0xF5, 0x40,
-/*1E90*/0x22, 0x75, 0x56, 0x02, 0xE4, 0xF5, 0x57, 0x12,
-        0x1D, 0xFC, 0xAF, 0x57, 0x7E, 0x00, 0xAD, 0x56,
-/*1EA0*/0x7C, 0x00, 0x02, 0x04, 0x44, 0xE4, 0xF5, 0x42,
-        0xF5, 0x41, 0xF5, 0x40, 0xF5, 0x38, 0xF5, 0x39,
-/*1EB0*/0xF5, 0x3A, 0x22, 0xEF, 0x54, 0x07, 0xFF, 0xE5,
-        0xF9, 0x54, 0xF8, 0x4F, 0xF5, 0xF9, 0x22, 0x7F,
-/*1EC0*/0x01, 0xE4, 0xFE, 0x0F, 0x0E, 0xBE, 0xFF, 0xFB,
-        0x22, 0x01, 0x20, 0x00, 0x01, 0x04, 0x20, 0x00,
-/*1ED0*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1EE0*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1EF0*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1F00*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1F10*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1F20*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1F30*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1F40*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1F50*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1F60*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1F70*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1F80*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1F90*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1FA0*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1FB0*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1FC0*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1FD0*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1FE0*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-/*1FF0*/0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x01, 0x20, 0x11, 0x00, 0x04, 0x20, 0x00, 0x81
-};
-
-int qib_sd7220_ib_load(struct qib_devdata *dd)
-{
-        return qib_sd7220_prog_ld(dd, IB_7220_SERDES, qib_sd7220_ib_img,
-                sizeof(qib_sd7220_ib_img), 0);
-}
-
-int qib_sd7220_ib_vfy(struct qib_devdata *dd)
-{
-        return qib_sd7220_prog_vfy(dd, IB_7220_SERDES, qib_sd7220_ib_img,
-                sizeof(qib_sd7220_ib_img), 0);
-}
diff --git a/drivers/infiniband/hw/qib/qib_tx.c b/drivers/infiniband/hw/qib/qib_tx.c
index f7eb1ddff5f3..af30232b6831 100644
--- a/drivers/infiniband/hw/qib/qib_tx.c
+++ b/drivers/infiniband/hw/qib/qib_tx.c
@@ -340,9 +340,13 @@ rescan:
                 if (i < dd->piobcnt2k)
                         buf = (u32 __iomem *)(dd->pio2kbase +
                                 i * dd->palign);
-                else
+                else if (i < dd->piobcnt2k + dd->piobcnt4k || !dd->piovl15base)
                         buf = (u32 __iomem *)(dd->pio4kbase +
                                 (i - dd->piobcnt2k) * dd->align4k);
+                else
+                        buf = (u32 __iomem *)(dd->piovl15base +
+                                (i - (dd->piobcnt2k + dd->piobcnt4k)) *
+                                dd->align4k);
                 if (pbufnum)
                         *pbufnum = i;
                 dd->upd_pio_shadow = 0;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index df3eb8c9fd96..b4b22576f12a 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1163,7 +1163,7 @@ static ssize_t create_child(struct device *dev,
 
         return ret ? ret : count;
 }
-static DEVICE_ATTR(create_child, S_IWUGO, NULL, create_child);
+static DEVICE_ATTR(create_child, S_IWUSR, NULL, create_child);
 
 static ssize_t delete_child(struct device *dev,
                             struct device_attribute *attr,
@@ -1183,7 +1183,7 @@ static ssize_t delete_child(struct device *dev,
         return ret ? ret : count;
 
 }
-static DEVICE_ATTR(delete_child, S_IWUGO, NULL, delete_child);
+static DEVICE_ATTR(delete_child, S_IWUSR, NULL, delete_child);
 
 int ipoib_add_pkey_attr(struct net_device *dev)
 {
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index d8fa5d724c57..0f9a4785d798 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -69,7 +69,7 @@ config KEYBOARD_ATARI
           module will be called atakbd.
 
 config KEYBOARD_ATKBD
-        tristate "AT keyboard" if EMBEDDED || !X86
+        tristate "AT keyboard" if EMBEDDED || !X86 || X86_MRST
         default y
         select SERIO
         select SERIO_LIBPS2
diff --git a/drivers/input/misc/hp_sdc_rtc.c b/drivers/input/misc/hp_sdc_rtc.c
index e00a1cc79c0a..c19066479057 100644
--- a/drivers/input/misc/hp_sdc_rtc.c
+++ b/drivers/input/misc/hp_sdc_rtc.c
@@ -678,7 +678,7 @@ static const struct file_operations hp_sdc_rtc_fops = {
         .llseek =               no_llseek,
         .read =                 hp_sdc_rtc_read,
         .poll =                 hp_sdc_rtc_poll,
-        .unlocked_ioctl =       hp_sdc_rtc_ioctl,
+        .unlocked_ioctl =       hp_sdc_rtc_unlocked_ioctl,
         .open =                 hp_sdc_rtc_open,
         .fasync =               hp_sdc_rtc_fasync,
 };
diff --git a/drivers/input/misc/pcf8574_keypad.c b/drivers/input/misc/pcf8574_keypad.c
index 0ac47d2898ec..4b42ffc0532a 100644
--- a/drivers/input/misc/pcf8574_keypad.c
+++ b/drivers/input/misc/pcf8574_keypad.c
@@ -69,7 +69,7 @@ static irqreturn_t pcf8574_kp_irq_handler(int irq, void *dev_id)
         unsigned char nextstate = read_state(lp);
 
         if (lp->laststate != nextstate) {
-                int key_down = nextstate <= ARRAY_SIZE(lp->btncode);
+                int key_down = nextstate < ARRAY_SIZE(lp->btncode);
                 unsigned short keycode = key_down ?
                         lp->btncode[nextstate] : lp->btncode[lp->laststate];
 
diff --git a/drivers/input/serio/Kconfig b/drivers/input/serio/Kconfig
index 3bfe8fafc6ad..256b9e9394dc 100644
--- a/drivers/input/serio/Kconfig
+++ b/drivers/input/serio/Kconfig
@@ -22,7 +22,7 @@ config SERIO_I8042
         tristate "i8042 PC Keyboard controller" if EMBEDDED || !X86
         default y
         depends on !PARISC && (!ARM || ARCH_SHARK || FOOTBRIDGE_HOST) && \
-                   (!SUPERH || SH_CAYMAN) && !M68K && !BLACKFIN
+                   (!SUPERH || SH_CAYMAN) && !M68K && !BLACKFIN && !X86_MRST
         help
           i8042 is the chip over which the standard AT keyboard and PS/2
           mouse are connected to the computer. If you use these devices,
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index d564af58175c..415f6306105d 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -284,12 +284,13 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
                         (data[4] << 20) + (data[5] << 12) +
                         (data[6] << 4) + (data[7] >> 4);
 
-                wacom->id[idx] = (data[2] << 4) | (data[3] >> 4);
+                wacom->id[idx] = (data[2] << 4) | (data[3] >> 4) |
+                        ((data[7] & 0x0f) << 20) | ((data[8] & 0xf0) << 12);
 
-                switch (wacom->id[idx]) {
+                switch (wacom->id[idx] & 0xfffff) {
                 case 0x812: /* Inking pen */
                 case 0x801: /* Intuos3 Inking pen */
-                case 0x20802: /* Intuos4 Classic Pen */
+                case 0x20802: /* Intuos4 Inking Pen */
                 case 0x012:
                         wacom->tool[idx] = BTN_TOOL_PENCIL;
                         break;
@@ -513,7 +514,7 @@ static int wacom_intuos_irq(struct wacom_wac *wacom)
                         input_report_abs(input, ABS_RX, ((data[1] & 0x1f) << 8) | data[2]);
                         input_report_abs(input, ABS_RY, ((data[3] & 0x1f) << 8) | data[4]);
 
-                        if ((data[5] & 0x1f) | (data[6] & 0x1f) | (data[1] & 0x1f) |
+                        if ((data[5] & 0x1f) | data[6] | (data[1] & 0x1f) |
                                 data[2] | (data[3] & 0x1f) | data[4] | data[8] |
                                 (data[7] & 0x01)) {
                                 input_report_key(input, wacom->tool[1], 1);
diff --git a/drivers/input/touchscreen/ad7877.c b/drivers/input/touchscreen/ad7877.c
index 0d2d7e54b465..5f0221cffef9 100644
--- a/drivers/input/touchscreen/ad7877.c
+++ b/drivers/input/touchscreen/ad7877.c
@@ -679,6 +679,13 @@ static int __devinit ad7877_probe(struct spi_device *spi)
                 return -EINVAL;
         }
 
+        spi->bits_per_word = 16;
+        err = spi_setup(spi);
+        if (err) {
+                dev_dbg(&spi->dev, "spi master doesn't support 16 bits/word\n");
+                return err;
+        }
+
         ts = kzalloc(sizeof(struct ad7877), GFP_KERNEL);
         input_dev = input_allocate_device();
         if (!ts || !input_dev) {
diff --git a/drivers/isdn/gigaset/asyncdata.c b/drivers/isdn/gigaset/asyncdata.c
index c5016bd2d94f..c3b1dc3a13a0 100644
--- a/drivers/isdn/gigaset/asyncdata.c
+++ b/drivers/isdn/gigaset/asyncdata.c
@@ -126,26 +126,6 @@ static unsigned lock_loop(unsigned numbytes, struct inbuf_t *inbuf)
         return numbytes;
 }
 
-/* set up next receive skb for data mode
- */
-static void new_rcv_skb(struct bc_state *bcs)
-{
-        struct cardstate *cs = bcs->cs;
-        unsigned short hw_hdr_len = cs->hw_hdr_len;
-
-        if (bcs->ignore) {
-                bcs->skb = NULL;
-                return;
-        }
-
-        bcs->skb = dev_alloc_skb(SBUFSIZE + hw_hdr_len);
-        if (bcs->skb == NULL) {
-                dev_warn(cs->dev, "could not allocate new skb\n");
-                return;
-        }
-        skb_reserve(bcs->skb, hw_hdr_len);
-}
-
 /* process a block of received bytes in HDLC data mode
  * (mstate != MS_LOCKED && !(inputstate & INS_command) && proto2 == L2_HDLC)
  * Collect HDLC frames, undoing byte stuffing and watching for DLE escapes.
@@ -159,8 +139,8 @@ static unsigned hdlc_loop(unsigned numbytes, struct inbuf_t *inbuf)
         struct cardstate *cs = inbuf->cs;
         struct bc_state *bcs = cs->bcs;
         int inputstate = bcs->inputstate;
-        __u16 fcs = bcs->fcs;
-        struct sk_buff *skb = bcs->skb;
+        __u16 fcs = bcs->rx_fcs;
+        struct sk_buff *skb = bcs->rx_skb;
         unsigned char *src = inbuf->data + inbuf->head;
         unsigned procbytes = 0;
         unsigned char c;
@@ -245,8 +225,7 @@ byte_stuff:
 
                                 /* prepare reception of next frame */
                                 inputstate &= ~INS_have_data;
-                                new_rcv_skb(bcs);
-                                skb = bcs->skb;
+                                skb = gigaset_new_rx_skb(bcs);
                         } else {
                                 /* empty frame (7E 7E) */
 #ifdef CONFIG_GIGASET_DEBUG
@@ -255,8 +234,7 @@ byte_stuff:
                                 if (!skb) {
                                         /* skipped (?) */
                                         gigaset_isdn_rcv_err(bcs);
-                                        new_rcv_skb(bcs);
-                                        skb = bcs->skb;
+                                        skb = gigaset_new_rx_skb(bcs);
                                 }
                         }
 
@@ -279,11 +257,11 @@ byte_stuff:
 #endif
                 inputstate |= INS_have_data;
                 if (skb) {
-                        if (skb->len == SBUFSIZE) {
+                        if (skb->len >= bcs->rx_bufsize) {
                                 dev_warn(cs->dev, "received packet too long\n");
                                 dev_kfree_skb_any(skb);
                                 /* skip remainder of packet */
-                                bcs->skb = skb = NULL;
+                                bcs->rx_skb = skb = NULL;
                         } else {
                                 *__skb_put(skb, 1) = c;
                                 fcs = crc_ccitt_byte(fcs, c);
@@ -292,7 +270,7 @@ byte_stuff:
         }
 
         bcs->inputstate = inputstate;
-        bcs->fcs = fcs;
+        bcs->rx_fcs = fcs;
         return procbytes;
 }
 
@@ -308,18 +286,18 @@ static unsigned iraw_loop(unsigned numbytes, struct inbuf_t *inbuf)
         struct cardstate *cs = inbuf->cs;
         struct bc_state *bcs = cs->bcs;
         int inputstate = bcs->inputstate;
-        struct sk_buff *skb = bcs->skb;
+        struct sk_buff *skb = bcs->rx_skb;
         unsigned char *src = inbuf->data + inbuf->head;
         unsigned procbytes = 0;
         unsigned char c;
 
         if (!skb) {
                 /* skip this block */
-                new_rcv_skb(bcs);
+                gigaset_new_rx_skb(bcs);
                 return numbytes;
         }
 
-        while (procbytes < numbytes && skb->len < SBUFSIZE) {
+        while (procbytes < numbytes && skb->len < bcs->rx_bufsize) {
                 c = *src++;
                 procbytes++;
 
@@ -343,7 +321,7 @@ static unsigned iraw_loop(unsigned numbytes, struct inbuf_t *inbuf)
         if (inputstate & INS_have_data) {
                 gigaset_skb_rcvd(bcs, skb);
                 inputstate &= ~INS_have_data;
-                new_rcv_skb(bcs);
+                gigaset_new_rx_skb(bcs);
         }
 
         bcs->inputstate = inputstate;
diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
index 8f78f15c8ef7..6fbe8999c419 100644
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -70,7 +70,7 @@
 #define MAX_NUMBER_DIGITS 20
 #define MAX_FMT_IE_LEN 20
 
-/* values for gigaset_capi_appl.connected */
+/* values for bcs->apconnstate */
 #define APCONN_NONE     0       /* inactive/listening */
 #define APCONN_SETUP    1       /* connecting */
 #define APCONN_ACTIVE   2       /* B channel up */
@@ -80,10 +80,10 @@ struct gigaset_capi_appl {
         struct list_head ctrlist;
         struct gigaset_capi_appl *bcnext;
         u16 id;
+        struct capi_register_params rp;
         u16 nextMessageNumber;
         u32 listenInfoMask;
         u32 listenCIPmask;
-        int connected;
 };
 
 /* CAPI specific controller data structure */
@@ -319,6 +319,39 @@ static const char *format_ie(const char *ie)
         return result;
 }
 
+/*
+ * emit DATA_B3_CONF message
+ */
+static void send_data_b3_conf(struct cardstate *cs, struct capi_ctr *ctr,
+                              u16 appl, u16 msgid, int channel,
+                              u16 handle, u16 info)
+{
+        struct sk_buff *cskb;
+        u8 *msg;
+
+        cskb = alloc_skb(CAPI_DATA_B3_CONF_LEN, GFP_ATOMIC);
+        if (!cskb) {
+                dev_err(cs->dev, "%s: out of memory\n", __func__);
+                return;
+        }
+        /* frequent message, avoid _cmsg overhead */
+        msg = __skb_put(cskb, CAPI_DATA_B3_CONF_LEN);
+        CAPIMSG_SETLEN(msg, CAPI_DATA_B3_CONF_LEN);
+        CAPIMSG_SETAPPID(msg, appl);
+        CAPIMSG_SETCOMMAND(msg, CAPI_DATA_B3);
+        CAPIMSG_SETSUBCOMMAND(msg,  CAPI_CONF);
+        CAPIMSG_SETMSGID(msg, msgid);
+        CAPIMSG_SETCONTROLLER(msg, ctr->cnr);
+        CAPIMSG_SETPLCI_PART(msg, channel);
+        CAPIMSG_SETNCCI_PART(msg, 1);
+        CAPIMSG_SETHANDLE_CONF(msg, handle);
+        CAPIMSG_SETINFO_CONF(msg, info);
+
+        /* emit message */
+        dump_rawmsg(DEBUG_MCMD, __func__, msg);
+        capi_ctr_handle_message(ctr, appl, cskb);
+}
+
 
 /*
  * driver interface functions
@@ -339,7 +372,6 @@ void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *dskb)
         struct gigaset_capi_ctr *iif = cs->iif;
         struct gigaset_capi_appl *ap = bcs->ap;
         unsigned char *req = skb_mac_header(dskb);
-        struct sk_buff *cskb;
         u16 flags;
 
         /* update statistics */
@@ -351,39 +383,22 @@ void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *dskb)
         }
 
         /* don't send further B3 messages if disconnected */
-        if (ap->connected < APCONN_ACTIVE) {
+        if (bcs->apconnstate < APCONN_ACTIVE) {
                 gig_dbg(DEBUG_LLDATA, "disconnected, discarding ack");
                 return;
         }
 
-        /* ToDo: honor unset "delivery confirmation" bit */
+        /*
+         * send DATA_B3_CONF if "delivery confirmation" bit was set in request;
+         * otherwise it has already been sent by do_data_b3_req()
+         */
         flags = CAPIMSG_FLAGS(req);
-
-        /* build DATA_B3_CONF message */
-        cskb = alloc_skb(CAPI_DATA_B3_CONF_LEN, GFP_ATOMIC);
-        if (!cskb) {
-                dev_err(cs->dev, "%s: out of memory\n", __func__);
-                return;
-        }
-        /* frequent message, avoid _cmsg overhead */
-        CAPIMSG_SETLEN(cskb->data, CAPI_DATA_B3_CONF_LEN);
-        CAPIMSG_SETAPPID(cskb->data, ap->id);
-        CAPIMSG_SETCOMMAND(cskb->data, CAPI_DATA_B3);
-        CAPIMSG_SETSUBCOMMAND(cskb->data,  CAPI_CONF);
-        CAPIMSG_SETMSGID(cskb->data, CAPIMSG_MSGID(req));
-        CAPIMSG_SETCONTROLLER(cskb->data, iif->ctr.cnr);
-        CAPIMSG_SETPLCI_PART(cskb->data, bcs->channel + 1);
-        CAPIMSG_SETNCCI_PART(cskb->data, 1);
-        CAPIMSG_SETHANDLE_CONF(cskb->data, CAPIMSG_HANDLE_REQ(req));
-        if (flags & ~CAPI_FLAGS_DELIVERY_CONFIRMATION)
-                CAPIMSG_SETINFO_CONF(cskb->data,
-                                     CapiFlagsNotSupportedByProtocol);
-        else
-                CAPIMSG_SETINFO_CONF(cskb->data, CAPI_NOERROR);
-
-        /* emit message */
-        dump_rawmsg(DEBUG_LLDATA, "DATA_B3_CONF", cskb->data);
-        capi_ctr_handle_message(&iif->ctr, ap->id, cskb);
+        if (flags & CAPI_FLAGS_DELIVERY_CONFIRMATION)
+                send_data_b3_conf(cs, &iif->ctr, ap->id, CAPIMSG_MSGID(req),
+                                  bcs->channel + 1, CAPIMSG_HANDLE_REQ(req),
+                                  (flags & ~CAPI_FLAGS_DELIVERY_CONFIRMATION) ?
+                                        CapiFlagsNotSupportedByProtocol :
+                                        CAPI_NOERROR);
 }
 EXPORT_SYMBOL_GPL(gigaset_skb_sent);
 
@@ -412,7 +427,7 @@ void gigaset_skb_rcvd(struct bc_state *bcs, struct sk_buff *skb)
         }
 
         /* don't send further B3 messages if disconnected */
-        if (ap->connected < APCONN_ACTIVE) {
+        if (bcs->apconnstate < APCONN_ACTIVE) {
                 gig_dbg(DEBUG_LLDATA, "disconnected, discarding data");
                 dev_kfree_skb_any(skb);
                 return;
@@ -484,6 +499,7 @@ int gigaset_isdn_icall(struct at_state_t *at_state)
         u32 actCIPmask;
         struct sk_buff *skb;
         unsigned int msgsize;
+        unsigned long flags;
         int i;
 
         /*
@@ -608,7 +624,14 @@ int gigaset_isdn_icall(struct at_state_t *at_state)
                 format_ie(iif->hcmsg.CalledPartyNumber));
 
         /* scan application list for matching listeners */
-        bcs->ap = NULL;
+        spin_lock_irqsave(&bcs->aplock, flags);
+        if (bcs->ap != NULL || bcs->apconnstate != APCONN_NONE) {
+                dev_warn(cs->dev, "%s: channel not properly cleared (%p/%d)\n",
+                         __func__, bcs->ap, bcs->apconnstate);
+                bcs->ap = NULL;
+                bcs->apconnstate = APCONN_NONE;
+        }
+        spin_unlock_irqrestore(&bcs->aplock, flags);
         actCIPmask = 1 | (1 << iif->hcmsg.CIPValue);
         list_for_each_entry(ap, &iif->appls, ctrlist)
                 if (actCIPmask & ap->listenCIPmask) {
@@ -626,10 +649,12 @@ int gigaset_isdn_icall(struct at_state_t *at_state)
                         dump_cmsg(DEBUG_CMD, __func__, &iif->hcmsg);
 
                         /* add to listeners on this B channel, update state */
+                        spin_lock_irqsave(&bcs->aplock, flags);
                         ap->bcnext = bcs->ap;
                         bcs->ap = ap;
                         bcs->chstate |= CHS_NOTIFY_LL;
-                        ap->connected = APCONN_SETUP;
+                        bcs->apconnstate = APCONN_SETUP;
+                        spin_unlock_irqrestore(&bcs->aplock, flags);
 
                         /* emit message */
                         capi_ctr_handle_message(&iif->ctr, ap->id, skb);
@@ -654,7 +679,7 @@ static void send_disconnect_ind(struct bc_state *bcs,
         struct gigaset_capi_ctr *iif = cs->iif;
         struct sk_buff *skb;
 
-        if (ap->connected == APCONN_NONE)
+        if (bcs->apconnstate == APCONN_NONE)
                 return;
 
         capi_cmsg_header(&iif->hcmsg, ap->id, CAPI_DISCONNECT, CAPI_IND,
@@ -668,7 +693,6 @@ static void send_disconnect_ind(struct bc_state *bcs,
         }
         capi_cmsg2message(&iif->hcmsg, __skb_put(skb, CAPI_DISCONNECT_IND_LEN));
         dump_cmsg(DEBUG_CMD, __func__, &iif->hcmsg);
-        ap->connected = APCONN_NONE;
         capi_ctr_handle_message(&iif->ctr, ap->id, skb);
 }
 
@@ -685,9 +709,9 @@ static void send_disconnect_b3_ind(struct bc_state *bcs,
         struct sk_buff *skb;
 
         /* nothing to do if no logical connection active */
-        if (ap->connected < APCONN_ACTIVE)
+        if (bcs->apconnstate < APCONN_ACTIVE)
                 return;
-        ap->connected = APCONN_SETUP;
+        bcs->apconnstate = APCONN_SETUP;
 
         capi_cmsg_header(&iif->hcmsg, ap->id, CAPI_DISCONNECT_B3, CAPI_IND,
                          ap->nextMessageNumber++,
@@ -714,14 +738,25 @@ void gigaset_isdn_connD(struct bc_state *bcs)
 {
         struct cardstate *cs = bcs->cs;
         struct gigaset_capi_ctr *iif = cs->iif;
-        struct gigaset_capi_appl *ap = bcs->ap;
+        struct gigaset_capi_appl *ap;
         struct sk_buff *skb;
         unsigned int msgsize;
+        unsigned long flags;
 
+        spin_lock_irqsave(&bcs->aplock, flags);
+        ap = bcs->ap;
         if (!ap) {
+                spin_unlock_irqrestore(&bcs->aplock, flags);
                 dev_err(cs->dev, "%s: no application\n", __func__);
                 return;
         }
+        if (bcs->apconnstate == APCONN_NONE) {
+                spin_unlock_irqrestore(&bcs->aplock, flags);
+                dev_warn(cs->dev, "%s: application %u not connected\n",
+                         __func__, ap->id);
+                return;
+        }
+        spin_unlock_irqrestore(&bcs->aplock, flags);
         while (ap->bcnext) {
                 /* this should never happen */
                 dev_warn(cs->dev, "%s: dropping extra application %u\n",
@@ -730,11 +765,6 @@ void gigaset_isdn_connD(struct bc_state *bcs)
                                     CapiCallGivenToOtherApplication);
                 ap->bcnext = ap->bcnext->bcnext;
         }
-        if (ap->connected == APCONN_NONE) {
-                dev_warn(cs->dev, "%s: application %u not connected\n",
-                         __func__, ap->id);
-                return;
-        }
 
         /* prepare CONNECT_ACTIVE_IND message
          * Note: LLC not supported by device
@@ -772,17 +802,24 @@ void gigaset_isdn_connD(struct bc_state *bcs)
 void gigaset_isdn_hupD(struct bc_state *bcs)
 {
         struct gigaset_capi_appl *ap;
+        unsigned long flags;
 
         /*
          * ToDo: pass on reason code reported by device
          * (requires ev-layer state machine extension to collect
          * ZCAU device reply)
          */
-        for (ap = bcs->ap; ap != NULL; ap = ap->bcnext) {
+        spin_lock_irqsave(&bcs->aplock, flags);
+        while (bcs->ap != NULL) {
+                ap = bcs->ap;
+                bcs->ap = ap->bcnext;
+                spin_unlock_irqrestore(&bcs->aplock, flags);
                 send_disconnect_b3_ind(bcs, ap);
                 send_disconnect_ind(bcs, ap, 0);
+                spin_lock_irqsave(&bcs->aplock, flags);
         }
-        bcs->ap = NULL;
+        bcs->apconnstate = APCONN_NONE;
+        spin_unlock_irqrestore(&bcs->aplock, flags);
 }
 
 /**
@@ -796,24 +833,21 @@ void gigaset_isdn_connB(struct bc_state *bcs)
 {
         struct cardstate *cs = bcs->cs;
         struct gigaset_capi_ctr *iif = cs->iif;
-        struct gigaset_capi_appl *ap = bcs->ap;
+        struct gigaset_capi_appl *ap;
         struct sk_buff *skb;
+        unsigned long flags;
         unsigned int msgsize;
         u8 command;
 
+        spin_lock_irqsave(&bcs->aplock, flags);
+        ap = bcs->ap;
         if (!ap) {
+                spin_unlock_irqrestore(&bcs->aplock, flags);
                 dev_err(cs->dev, "%s: no application\n", __func__);
                 return;
         }
-        while (ap->bcnext) {
-                /* this should never happen */
-                dev_warn(cs->dev, "%s: dropping extra application %u\n",
-                         __func__, ap->bcnext->id);
-                send_disconnect_ind(bcs, ap->bcnext,
-                                    CapiCallGivenToOtherApplication);
-                ap->bcnext = ap->bcnext->bcnext;
-        }
-        if (!ap->connected) {
+        if (!bcs->apconnstate) {
+                spin_unlock_irqrestore(&bcs->aplock, flags);
                 dev_warn(cs->dev, "%s: application %u not connected\n",
                          __func__, ap->id);
                 return;
@@ -825,13 +859,26 @@ void gigaset_isdn_connB(struct bc_state *bcs)
          * CONNECT_B3_ACTIVE_IND in reply to CONNECT_B3_RESP
          * Parameters in both cases always: NCCI = 1, NCPI empty
          */
-        if (ap->connected >= APCONN_ACTIVE) {
+        if (bcs->apconnstate >= APCONN_ACTIVE) {
                 command = CAPI_CONNECT_B3_ACTIVE;
                 msgsize = CAPI_CONNECT_B3_ACTIVE_IND_BASELEN;
         } else {
                 command = CAPI_CONNECT_B3;
                 msgsize = CAPI_CONNECT_B3_IND_BASELEN;
         }
+        bcs->apconnstate = APCONN_ACTIVE;
+
+        spin_unlock_irqrestore(&bcs->aplock, flags);
+
+        while (ap->bcnext) {
+                /* this should never happen */
+                dev_warn(cs->dev, "%s: dropping extra application %u\n",
+                         __func__, ap->bcnext->id);
+                send_disconnect_ind(bcs, ap->bcnext,
+                                    CapiCallGivenToOtherApplication);
+                ap->bcnext = ap->bcnext->bcnext;
+        }
+
         capi_cmsg_header(&iif->hcmsg, ap->id, command, CAPI_IND,
                          ap->nextMessageNumber++,
                          iif->ctr.cnr | ((bcs->channel + 1) << 8) | (1 << 16));
@@ -842,7 +889,6 @@ void gigaset_isdn_connB(struct bc_state *bcs)
         }
         capi_cmsg2message(&iif->hcmsg, __skb_put(skb, msgsize));
         dump_cmsg(DEBUG_CMD, __func__, &iif->hcmsg);
-        ap->connected = APCONN_ACTIVE;
         capi_ctr_handle_message(&iif->ctr, ap->id, skb);
 }
 
@@ -945,8 +991,64 @@ static void gigaset_register_appl(struct capi_ctr *ctr, u16 appl,
                 return;
         }
         ap->id = appl;
+        ap->rp = *rp;
 
         list_add(&ap->ctrlist, &iif->appls);
+        dev_info(cs->dev, "application %u registered\n", ap->id);
+}
+
+/*
+ * remove CAPI application from channel
+ * helper function to keep indentation levels down and stay in 80 columns
+ */
+
+static inline void remove_appl_from_channel(struct bc_state *bcs,
+                                            struct gigaset_capi_appl *ap)
+{
+        struct cardstate *cs = bcs->cs;
+        struct gigaset_capi_appl *bcap;
+        unsigned long flags;
+        int prevconnstate;
+
+        spin_lock_irqsave(&bcs->aplock, flags);
+        bcap = bcs->ap;
+        if (bcap == NULL) {
+                spin_unlock_irqrestore(&bcs->aplock, flags);
+                return;
+        }
+
+        /* check first application on channel */
+        if (bcap == ap) {
+                bcs->ap = ap->bcnext;
+                if (bcs->ap != NULL) {
+                        spin_unlock_irqrestore(&bcs->aplock, flags);
+                        return;
+                }
+
+                /* none left, clear channel state */
+                prevconnstate = bcs->apconnstate;
+                bcs->apconnstate = APCONN_NONE;
+                spin_unlock_irqrestore(&bcs->aplock, flags);
+
+                if (prevconnstate == APCONN_ACTIVE) {
+                        dev_notice(cs->dev, "%s: hanging up channel %u\n",
+                                   __func__, bcs->channel);
+                        gigaset_add_event(cs, &bcs->at_state,
+                                          EV_HUP, NULL, 0, NULL);
+                        gigaset_schedule_event(cs);
+                }
+                return;
+        }
+
+        /* check remaining list */
+        do {
+                if (bcap->bcnext == ap) {
+                        bcap->bcnext = bcap->bcnext->bcnext;
+                        return;
+                }
+                bcap = bcap->bcnext;
+        } while (bcap != NULL);
+        spin_unlock_irqrestore(&bcs->aplock, flags);
 }
 
 /*
@@ -958,19 +1060,19 @@ static void gigaset_release_appl(struct capi_ctr *ctr, u16 appl)
                 = container_of(ctr, struct gigaset_capi_ctr, ctr);
         struct cardstate *cs = iif->ctr.driverdata;
         struct gigaset_capi_appl *ap, *tmp;
+        unsigned ch;
 
         list_for_each_entry_safe(ap, tmp, &iif->appls, ctrlist)
                 if (ap->id == appl) {
-                        if (ap->connected != APCONN_NONE) {
-                                dev_err(cs->dev,
-                                        "%s: application %u still connected\n",
-                                        __func__, ap->id);
-                                /* ToDo: clear active connection */
-                        }
+                        /* remove from any channels */
+                        for (ch = 0; ch < cs->channels; ch++)
+                                remove_appl_from_channel(&cs->bcs[ch], ap);
+
+                        /* remove from registration list */
                         list_del(&ap->ctrlist);
                         kfree(ap);
+                        dev_info(cs->dev, "application %u released\n", appl);
                 }
-
 }
 
 /*
@@ -1149,7 +1251,8 @@ static void do_connect_req(struct gigaset_capi_ctr *iif,
         char **commands;
         char *s;
         u8 *pp;
-        int i, l;
+        unsigned long flags;
+        int i, l, lbc, lhlc;
         u16 info;
 
         /* decode message */
@@ -1164,8 +1267,18 @@ static void do_connect_req(struct gigaset_capi_ctr *iif,
                 send_conf(iif, ap, skb, CapiNoPlciAvailable);
                 return;
         }
+        spin_lock_irqsave(&bcs->aplock, flags);
+        if (bcs->ap != NULL || bcs->apconnstate != APCONN_NONE)
+                dev_warn(cs->dev, "%s: channel not properly cleared (%p/%d)\n",
+                         __func__, bcs->ap, bcs->apconnstate);
         ap->bcnext = NULL;
         bcs->ap = ap;
+        bcs->apconnstate = APCONN_SETUP;
+        spin_unlock_irqrestore(&bcs->aplock, flags);
+
+        bcs->rx_bufsize = ap->rp.datablklen;
+        dev_kfree_skb(bcs->rx_skb);
+        gigaset_new_rx_skb(bcs);
         cmsg->adr.adrPLCI |= (bcs->channel + 1) << 8;
 
         /* build command table */
@@ -1273,42 +1386,59 @@ static void do_connect_req(struct gigaset_capi_ctr *iif,
                 goto error;
         }
 
-        /* check/encode parameter: BC */
-        if (cmsg->BC && cmsg->BC[0]) {
-                /* explicit BC overrides CIP */
-                l = 2*cmsg->BC[0] + 7;
+        /*
+         * check/encode parameters: BC & HLC
+         * must be encoded together as device doesn't accept HLC separately
+         * explicit parameters override values derived from CIP
+         */
+
+        /* determine lengths */
+        if (cmsg->BC && cmsg->BC[0])            /* BC specified explicitly */
+                lbc = 2*cmsg->BC[0];
+        else if (cip2bchlc[cmsg->CIPValue].bc)  /* BC derived from CIP */
+                lbc = strlen(cip2bchlc[cmsg->CIPValue].bc);
+        else                                    /* no BC */
+                lbc = 0;
+        if (cmsg->HLC && cmsg->HLC[0])          /* HLC specified explicitly */
+                lhlc = 2*cmsg->HLC[0];
+        else if (cip2bchlc[cmsg->CIPValue].hlc) /* HLC derived from CIP */
+                lhlc = strlen(cip2bchlc[cmsg->CIPValue].hlc);
+        else                                    /* no HLC */
+                lhlc = 0;
+
+        if (lbc) {
+                /* have BC: allocate and assemble command string */
+                l = lbc + 7;            /* "^SBC=" + value + "\r" + null byte */
+                if (lhlc)
+                        l += lhlc + 7;  /* ";^SHLC=" + value */
                 commands[AT_BC] = kmalloc(l, GFP_KERNEL);
                 if (!commands[AT_BC])
                         goto oom;
                 strcpy(commands[AT_BC], "^SBC=");
-                decode_ie(cmsg->BC, commands[AT_BC]+5);
+                if (cmsg->BC && cmsg->BC[0])    /* BC specified explicitly */
+                        decode_ie(cmsg->BC, commands[AT_BC] + 5);
+                else                            /* BC derived from CIP */
+                        strcpy(commands[AT_BC] + 5,
+                               cip2bchlc[cmsg->CIPValue].bc);
+                if (lhlc) {
+                        strcpy(commands[AT_BC] + lbc + 5, ";^SHLC=");
+                        if (cmsg->HLC && cmsg->HLC[0])
+                                /* HLC specified explicitly */
+                                decode_ie(cmsg->HLC,
+                                          commands[AT_BC] + lbc + 12);
+                        else    /* HLC derived from CIP */
+                                strcpy(commands[AT_BC] + lbc + 12,
+                                       cip2bchlc[cmsg->CIPValue].hlc);
+                }
                 strcpy(commands[AT_BC] + l - 2, "\r");
-        } else if (cip2bchlc[cmsg->CIPValue].bc) {
-                l = strlen(cip2bchlc[cmsg->CIPValue].bc) + 7;
-                commands[AT_BC] = kmalloc(l, GFP_KERNEL);
-                if (!commands[AT_BC])
-                        goto oom;
-                snprintf(commands[AT_BC], l, "^SBC=%s\r",
-                         cip2bchlc[cmsg->CIPValue].bc);
-        }
-
-        /* check/encode parameter: HLC */
-        if (cmsg->HLC && cmsg->HLC[0]) {
-                /* explicit HLC overrides CIP */
-                l = 2*cmsg->HLC[0] + 7;
-                commands[AT_HLC] = kmalloc(l, GFP_KERNEL);
-                if (!commands[AT_HLC])
-                        goto oom;
-                strcpy(commands[AT_HLC], "^SHLC=");
-                decode_ie(cmsg->HLC, commands[AT_HLC]+5);
-                strcpy(commands[AT_HLC] + l - 2, "\r");
-        } else if (cip2bchlc[cmsg->CIPValue].hlc) {
-                l = strlen(cip2bchlc[cmsg->CIPValue].hlc) + 7;
-                commands[AT_HLC] = kmalloc(l, GFP_KERNEL);
-                if (!commands[AT_HLC])
-                        goto oom;
-                snprintf(commands[AT_HLC], l, "^SHLC=%s\r",
-                         cip2bchlc[cmsg->CIPValue].hlc);
+        } else {
+                /* no BC */
+                if (lhlc) {
+                        dev_notice(cs->dev, "%s: cannot set HLC without BC\n",
+                                   "CONNECT_REQ");
+                        info = CapiIllMessageParmCoding; /* ? */
+                        goto error;
+                }
         }
 
         /* check/encode parameter: B Protocol */
@@ -1322,13 +1452,13 @@ static void do_connect_req(struct gigaset_capi_ctr *iif,
                         bcs->proto2 = L2_HDLC;
                         break;
                 case 1:
-                        bcs->proto2 = L2_BITSYNC;
+                        bcs->proto2 = L2_VOICE;
                         break;
                 default:
                         dev_warn(cs->dev,
                             "B1 Protocol %u unsupported, using Transparent\n",
                                  cmsg->B1protocol);
-                        bcs->proto2 = L2_BITSYNC;
+                        bcs->proto2 = L2_VOICE;
                 }
                 if (cmsg->B2protocol != 1)
                         dev_warn(cs->dev,
@@ -1382,7 +1512,6 @@ static void do_connect_req(struct gigaset_capi_ctr *iif,
                 goto error;
         }
         gigaset_schedule_event(cs);
-        ap->connected = APCONN_SETUP;
         send_conf(iif, ap, skb, CapiSuccess);
         return;
 
@@ -1410,6 +1539,7 @@ static void do_connect_resp(struct gigaset_capi_ctr *iif,
         _cmsg *cmsg = &iif->acmsg;
         struct bc_state *bcs;
         struct gigaset_capi_appl *oap;
+        unsigned long flags;
         int channel;
 
         /* decode message */
@@ -1429,12 +1559,24 @@ static void do_connect_resp(struct gigaset_capi_ctr *iif,
         switch (cmsg->Reject) {
         case 0:         /* Accept */
                 /* drop all competing applications, keep only this one */
-                for (oap = bcs->ap; oap != NULL; oap = oap->bcnext)
-                        if (oap != ap)
+                spin_lock_irqsave(&bcs->aplock, flags);
+                while (bcs->ap != NULL) {
+                        oap = bcs->ap;
+                        bcs->ap = oap->bcnext;
+                        if (oap != ap) {
+                                spin_unlock_irqrestore(&bcs->aplock, flags);
                                 send_disconnect_ind(bcs, oap,
                                         CapiCallGivenToOtherApplication);
+                                spin_lock_irqsave(&bcs->aplock, flags);
+                        }
+                }
                 ap->bcnext = NULL;
                 bcs->ap = ap;
+                spin_unlock_irqrestore(&bcs->aplock, flags);
+
+                bcs->rx_bufsize = ap->rp.datablklen;
+                dev_kfree_skb(bcs->rx_skb);
+                gigaset_new_rx_skb(bcs);
                 bcs->chstate |= CHS_NOTIFY_LL;
 
                 /* check/encode B channel protocol */
@@ -1448,13 +1590,13 @@ static void do_connect_resp(struct gigaset_capi_ctr *iif,
                                 bcs->proto2 = L2_HDLC;
                                 break;
                         case 1:
-                                bcs->proto2 = L2_BITSYNC;
+                                bcs->proto2 = L2_VOICE;
                                 break;
                         default:
                                 dev_warn(cs->dev,
                         "B1 Protocol %u unsupported, using Transparent\n",
                                          cmsg->B1protocol);
-                                bcs->proto2 = L2_BITSYNC;
+                                bcs->proto2 = L2_VOICE;
                         }
                         if (cmsg->B2protocol != 1)
                                 dev_warn(cs->dev,
@@ -1502,31 +1644,45 @@ static void do_connect_resp(struct gigaset_capi_ctr *iif,
                 send_disconnect_ind(bcs, ap, 0);
 
                 /* remove it from the list of listening apps */
+                spin_lock_irqsave(&bcs->aplock, flags);
                 if (bcs->ap == ap) {
                         bcs->ap = ap->bcnext;
-                        if (bcs->ap == NULL)
+                        if (bcs->ap == NULL) {
                                 /* last one: stop ev-layer hupD notifications */
+                                bcs->apconnstate = APCONN_NONE;
                                 bcs->chstate &= ~CHS_NOTIFY_LL;
+                        }
+                        spin_unlock_irqrestore(&bcs->aplock, flags);
                         return;
                 }
                 for (oap = bcs->ap; oap != NULL; oap = oap->bcnext) {
                         if (oap->bcnext == ap) {
                                 oap->bcnext = oap->bcnext->bcnext;
+                                spin_unlock_irqrestore(&bcs->aplock, flags);
                                 return;
                         }
                 }
+                spin_unlock_irqrestore(&bcs->aplock, flags);
                 dev_err(cs->dev, "%s: application %u not found\n",
                         __func__, ap->id);
                 return;
 
         default:                /* Reject */
                 /* drop all competing applications, keep only this one */
-                for (oap = bcs->ap; oap != NULL; oap = oap->bcnext)
-                        if (oap != ap)
+                spin_lock_irqsave(&bcs->aplock, flags);
+                while (bcs->ap != NULL) {
+                        oap = bcs->ap;
+                        bcs->ap = oap->bcnext;
+                        if (oap != ap) {
+                                spin_unlock_irqrestore(&bcs->aplock, flags);
                                 send_disconnect_ind(bcs, oap,
                                         CapiCallGivenToOtherApplication);
+                                spin_lock_irqsave(&bcs->aplock, flags);
+                        }
+                }
                 ap->bcnext = NULL;
                 bcs->ap = ap;
+                spin_unlock_irqrestore(&bcs->aplock, flags);
 
                 /* reject call - will trigger DISCONNECT_IND for this app */
                 dev_info(cs->dev, "%s: Reject=%x\n",
@@ -1549,6 +1705,7 @@ static void do_connect_b3_req(struct gigaset_capi_ctr *iif,
 {
         struct cardstate *cs = iif->ctr.driverdata;
         _cmsg *cmsg = &iif->acmsg;
+        struct bc_state *bcs;
         int channel;
 
         /* decode message */
@@ -1563,9 +1720,10 @@ static void do_connect_b3_req(struct gigaset_capi_ctr *iif,
                 send_conf(iif, ap, skb, CapiIllContrPlciNcci);
                 return;
         }
+        bcs = &cs->bcs[channel-1];
 
         /* mark logical connection active */
-        ap->connected = APCONN_ACTIVE;
+        bcs->apconnstate = APCONN_ACTIVE;
 
         /* build NCCI: always 1 (one B3 connection only) */
         cmsg->adr.adrNCCI |= 1 << 16;
@@ -1611,7 +1769,7 @@ static void do_connect_b3_resp(struct gigaset_capi_ctr *iif,
 
         if (cmsg->Reject) {
                 /* Reject: clear B3 connect received flag */
-                ap->connected = APCONN_SETUP;
+                bcs->apconnstate = APCONN_SETUP;
 
                 /* trigger hangup, causing eventual DISCONNECT_IND */
                 if (!gigaset_add_event(cs, &bcs->at_state,
@@ -1683,11 +1841,11 @@ static void do_disconnect_req(struct gigaset_capi_ctr *iif,
         }
 
         /* skip if DISCONNECT_IND already sent */
-        if (!ap->connected)
+        if (!bcs->apconnstate)
                 return;
 
         /* check for active logical connection */
-        if (ap->connected >= APCONN_ACTIVE) {
+        if (bcs->apconnstate >= APCONN_ACTIVE) {
                 /*
                  * emit DISCONNECT_B3_IND with cause 0x3301
                  * use separate cmsg structure, as the content of iif->acmsg
@@ -1736,6 +1894,7 @@ static void do_disconnect_b3_req(struct gigaset_capi_ctr *iif,
 {
         struct cardstate *cs = iif->ctr.driverdata;
         _cmsg *cmsg = &iif->acmsg;
+        struct bc_state *bcs;
         int channel;
 
         /* decode message */
@@ -1751,17 +1910,17 @@ static void do_disconnect_b3_req(struct gigaset_capi_ctr *iif,
                 send_conf(iif, ap, skb, CapiIllContrPlciNcci);
                 return;
         }
+        bcs = &cs->bcs[channel-1];
 
         /* reject if logical connection not active */
-        if (ap->connected < APCONN_ACTIVE) {
+        if (bcs->apconnstate < APCONN_ACTIVE) {
                 send_conf(iif, ap, skb,
                           CapiMessageNotSupportedInCurrentState);
                 return;
         }
 
         /* trigger hangup, causing eventual DISCONNECT_B3_IND */
-        if (!gigaset_add_event(cs, &cs->bcs[channel-1].at_state,
-                               EV_HUP, NULL, 0, NULL)) {
+        if (!gigaset_add_event(cs, &bcs->at_state, EV_HUP, NULL, 0, NULL)) {
                 send_conf(iif, ap, skb, CAPI_MSGOSRESOURCEERR);
                 return;
         }
@@ -1782,11 +1941,14 @@ static void do_data_b3_req(struct gigaset_capi_ctr *iif,
                            struct sk_buff *skb)
 {
         struct cardstate *cs = iif->ctr.driverdata;
+        struct bc_state *bcs;
         int channel = CAPIMSG_PLCI_PART(skb->data);
         u16 ncci = CAPIMSG_NCCI_PART(skb->data);
         u16 msglen = CAPIMSG_LEN(skb->data);
         u16 datalen = CAPIMSG_DATALEN(skb->data);
         u16 flags = CAPIMSG_FLAGS(skb->data);
+        u16 msgid = CAPIMSG_MSGID(skb->data);
+        u16 handle = CAPIMSG_HANDLE_REQ(skb->data);
 
         /* frequent message, avoid _cmsg overhead */
         dump_rawmsg(DEBUG_LLDATA, "DATA_B3_REQ", skb->data);
@@ -1802,6 +1964,7 @@ static void do_data_b3_req(struct gigaset_capi_ctr *iif,
                 send_conf(iif, ap, skb, CapiIllContrPlciNcci);
                 return;
         }
+        bcs = &cs->bcs[channel-1];
         if (msglen != CAPI_DATA_B3_REQ_LEN && msglen != CAPI_DATA_B3_REQ_LEN64)
                 dev_notice(cs->dev, "%s: unexpected length %d\n",
                            "DATA_B3_REQ", msglen);
@@ -1821,7 +1984,7 @@ static void do_data_b3_req(struct gigaset_capi_ctr *iif,
         }
 
         /* reject if logical connection not active */
-        if (ap->connected < APCONN_ACTIVE) {
+        if (bcs->apconnstate < APCONN_ACTIVE) {
                 send_conf(iif, ap, skb, CapiMessageNotSupportedInCurrentState);
                 return;
         }
@@ -1832,17 +1995,19 @@ static void do_data_b3_req(struct gigaset_capi_ctr *iif,
         skb_pull(skb, msglen);
 
         /* pass to device-specific module */
-        if (cs->ops->send_skb(&cs->bcs[channel-1], skb) < 0) {
+        if (cs->ops->send_skb(bcs, skb) < 0) {
                 send_conf(iif, ap, skb, CAPI_MSGOSRESOURCEERR);
                 return;
         }
 
-        /* DATA_B3_CONF reply will be sent by gigaset_skb_sent() */
-
         /*
-         * ToDo: honor unset "delivery confirmation" bit
-         * (send DATA_B3_CONF immediately?)
+         * DATA_B3_CONF will be sent by gigaset_skb_sent() only if "delivery
+         * confirmation" bit is set; otherwise we have to send it now
          */
+        if (!(flags & CAPI_FLAGS_DELIVERY_CONFIRMATION))
+                send_data_b3_conf(cs, &iif->ctr, ap->id, msgid, channel, handle,
+                                  flags ? CapiFlagsNotSupportedByProtocol
+                                        : CAPI_NOERROR);
 }
 
 /*
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index f6f45f221920..5d4befb81057 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -399,8 +399,8 @@ static void gigaset_freebcs(struct bc_state *bcs)
         gig_dbg(DEBUG_INIT, "clearing bcs[%d]->at_state", bcs->channel);
         clear_at_state(&bcs->at_state);
         gig_dbg(DEBUG_INIT, "freeing bcs[%d]->skb", bcs->channel);
-        dev_kfree_skb(bcs->skb);
-        bcs->skb = NULL;
+        dev_kfree_skb(bcs->rx_skb);
+        bcs->rx_skb = NULL;
 
         for (i = 0; i < AT_NUM; ++i) {
                 kfree(bcs->commands[i]);
@@ -634,19 +634,10 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
         bcs->emptycount = 0;
 #endif
 
-        gig_dbg(DEBUG_INIT, "allocating bcs[%d]->skb", channel);
-        bcs->fcs = PPP_INITFCS;
+        bcs->rx_bufsize = 0;
+        bcs->rx_skb = NULL;
+        bcs->rx_fcs = PPP_INITFCS;
         bcs->inputstate = 0;
-        if (cs->ignoreframes) {
-                bcs->skb = NULL;
-        } else {
-                bcs->skb = dev_alloc_skb(SBUFSIZE + cs->hw_hdr_len);
-                if (bcs->skb != NULL)
-                        skb_reserve(bcs->skb, cs->hw_hdr_len);
-                else
-                        pr_err("out of memory\n");
-        }
-
         bcs->channel = channel;
         bcs->cs = cs;
 
@@ -658,16 +649,15 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
         for (i = 0; i < AT_NUM; ++i)
                 bcs->commands[i] = NULL;
 
+        spin_lock_init(&bcs->aplock);
+        bcs->ap = NULL;
+        bcs->apconnstate = 0;
+
         gig_dbg(DEBUG_INIT, "  setting up bcs[%d]->hw", channel);
         if (cs->ops->initbcshw(bcs))
                 return bcs;
 
         gig_dbg(DEBUG_INIT, "  failed");
-
-        gig_dbg(DEBUG_INIT, "  freeing bcs[%d]->skb", channel);
-        dev_kfree_skb(bcs->skb);
-        bcs->skb = NULL;
-
         return NULL;
 }
 
@@ -839,14 +829,12 @@ void gigaset_bcs_reinit(struct bc_state *bcs)
         bcs->emptycount = 0;
 #endif
 
-        bcs->fcs = PPP_INITFCS;
+        bcs->rx_fcs = PPP_INITFCS;
         bcs->chstate = 0;
 
         bcs->ignore = cs->ignoreframes;
-        if (bcs->ignore) {
-                dev_kfree_skb(bcs->skb);
-                bcs->skb = NULL;
-        }
+        dev_kfree_skb(bcs->rx_skb);
+        bcs->rx_skb = NULL;
 
         cs->ops->reinitbcshw(bcs);
 }
diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
index 206c380c5235..ceaef9a04a42 100644
--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
@@ -282,9 +282,7 @@ struct reply_t gigaset_tab_cid[] =
 /* dial */
 {EV_DIAL,        -1,  -1, -1,                    -1, -1, {ACT_DIAL} },
 {RSP_INIT,        0,   0, SEQ_DIAL,             601,  5, {ACT_CMD+AT_BC} },
-{RSP_OK,        601, 601, -1,                   602,  5, {ACT_CMD+AT_HLC} },
-{RSP_NULL,      602, 602, -1,                   603,  5, {ACT_CMD+AT_PROTO} },
-{RSP_OK,        602, 602, -1,                   603,  5, {ACT_CMD+AT_PROTO} },
+{RSP_OK,        601, 601, -1,                   603,  5, {ACT_CMD+AT_PROTO} },
 {RSP_OK,        603, 603, -1,                   604,  5, {ACT_CMD+AT_TYPE} },
 {RSP_OK,        604, 604, -1,                   605,  5, {ACT_CMD+AT_MSN} },
 {RSP_NULL,      605, 605, -1,                   606,  5, {ACT_CMD+AT_CLIP} },
diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
index 05947f9c1849..8738b0821fc9 100644
--- a/drivers/isdn/gigaset/gigaset.h
+++ b/drivers/isdn/gigaset/gigaset.h
@@ -45,10 +45,6 @@
 #define MAX_EVENTS 64           /* size of event queue */
 
 #define RBUFSIZE 8192
-#define SBUFSIZE 4096           /* sk_buff payload size */
-
-#define TRANSBUFSIZE 768        /* bytes per skb for transparent receive */
-#define MAX_BUF_SIZE (SBUFSIZE - 2)     /* Max. size of a data packet from LL */
 
 /* compile time options */
 #define GIG_MAJOR 0
@@ -190,10 +186,9 @@ void gigaset_dbg_buffer(enum debuglevel level, const unsigned char *msg,
 #define AT_BC           3
 #define AT_PROTO        4
 #define AT_TYPE         5
-#define AT_HLC          6
-#define AT_CLIP         7
+#define AT_CLIP         6
 /* total number */
-#define AT_NUM          8
+#define AT_NUM          7
 
 /* variables in struct at_state_t */
 #define VAR_ZSAU        0
@@ -380,8 +375,10 @@ struct bc_state {
 
         struct at_state_t at_state;
 
-        __u16 fcs;
-        struct sk_buff *skb;
+        /* receive buffer */
+        unsigned rx_bufsize;            /* max size accepted by application */
+        struct sk_buff *rx_skb;
+        __u16 rx_fcs;
         int inputstate;                 /* see INS_XXXX */
 
         int channel;
@@ -406,7 +403,9 @@ struct bc_state {
                 struct bas_bc_state *bas;       /* usb hardware driver (base) */
         } hw;
 
-        void *ap;                       /* LL application structure */
+        void *ap;                       /* associated LL application */
+        int apconnstate;                /* LL application connection state */
+        spinlock_t aplock;
 };
 
 struct cardstate {
@@ -801,8 +800,23 @@ static inline void gigaset_bchannel_up(struct bc_state *bcs)
         gigaset_schedule_event(bcs->cs);
 }
 
-/* handling routines for sk_buff */
-/* ============================= */
+/* set up next receive skb for data mode */
+static inline struct sk_buff *gigaset_new_rx_skb(struct bc_state *bcs)
+{
+        struct cardstate *cs = bcs->cs;
+        unsigned short hw_hdr_len = cs->hw_hdr_len;
+
+        if (bcs->ignore) {
+                bcs->rx_skb = NULL;
+        } else {
+                bcs->rx_skb = dev_alloc_skb(bcs->rx_bufsize + hw_hdr_len);
+                if (bcs->rx_skb == NULL)
+                        dev_warn(cs->dev, "could not allocate skb\n");
+                else
+                        skb_reserve(bcs->rx_skb, hw_hdr_len);
+        }
+        return bcs->rx_skb;
+}
 
 /* append received bytes to inbuf */
 int gigaset_fill_inbuf(struct inbuf_t *inbuf, const unsigned char *src,
diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
index c22e5ace8276..f01c3c2e2e46 100644
--- a/drivers/isdn/gigaset/i4l.c
+++ b/drivers/isdn/gigaset/i4l.c
@@ -16,7 +16,10 @@
 #include "gigaset.h"
 #include <linux/isdnif.h>
 
+#define SBUFSIZE        4096    /* sk_buff payload size */
+#define TRANSBUFSIZE    768     /* bytes per skb for transparent receive */
 #define HW_HDR_LEN      2       /* Header size used to store ack info */
+#define MAX_BUF_SIZE    (SBUFSIZE - HW_HDR_LEN) /* max data packet from LL */
 
 /* == Handling of I4L IO =====================================================*/
 
@@ -231,6 +234,15 @@ static int command_from_LL(isdn_ctrl *cntrl)
                         dev_err(cs->dev, "ISDN_CMD_DIAL: channel not free\n");
                         return -EBUSY;
                 }
+                switch (bcs->proto2) {
+                case L2_HDLC:
+                        bcs->rx_bufsize = SBUFSIZE;
+                        break;
+                default:                        /* assume transparent */
+                        bcs->rx_bufsize = TRANSBUFSIZE;
+                }
+                dev_kfree_skb(bcs->rx_skb);
+                gigaset_new_rx_skb(bcs);
 
                 commands = kzalloc(AT_NUM*(sizeof *commands), GFP_ATOMIC);
                 if (!commands) {
@@ -314,6 +326,15 @@ static int command_from_LL(isdn_ctrl *cntrl)
                         return -EINVAL;
                 }
                 bcs = cs->bcs + ch;
+                switch (bcs->proto2) {
+                case L2_HDLC:
+                        bcs->rx_bufsize = SBUFSIZE;
+                        break;
+                default:                        /* assume transparent */
+                        bcs->rx_bufsize = TRANSBUFSIZE;
+                }
+                dev_kfree_skb(bcs->rx_skb);
+                gigaset_new_rx_skb(bcs);
                 if (!gigaset_add_event(cs, &bcs->at_state,
                                        EV_ACCEPT, NULL, 0, NULL))
                         return -ENOMEM;
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index 16fd3bd48883..2dfd346fc889 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -500,19 +500,18 @@ int gigaset_isoc_buildframe(struct bc_state *bcs, unsigned char *in, int len)
  */
 static inline void hdlc_putbyte(unsigned char c, struct bc_state *bcs)
 {
-        bcs->fcs = crc_ccitt_byte(bcs->fcs, c);
-        if (unlikely(bcs->skb == NULL)) {
+        bcs->rx_fcs = crc_ccitt_byte(bcs->rx_fcs, c);
+        if (bcs->rx_skb == NULL)
                 /* skipping */
                 return;
-        }
-        if (unlikely(bcs->skb->len == SBUFSIZE)) {
+        if (bcs->rx_skb->len >= bcs->rx_bufsize) {
                 dev_warn(bcs->cs->dev, "received oversized packet discarded\n");
                 bcs->hw.bas->giants++;
-                dev_kfree_skb_any(bcs->skb);
-                bcs->skb = NULL;
+                dev_kfree_skb_any(bcs->rx_skb);
+                bcs->rx_skb = NULL;
                 return;
         }
-        *__skb_put(bcs->skb, 1) = c;
+        *__skb_put(bcs->rx_skb, 1) = c;
 }
 
 /* hdlc_flush
@@ -521,18 +520,13 @@ static inline void hdlc_putbyte(unsigned char c, struct bc_state *bcs)
 static inline void hdlc_flush(struct bc_state *bcs)
 {
         /* clear skb or allocate new if not skipping */
-        if (likely(bcs->skb != NULL))
-                skb_trim(bcs->skb, 0);
-        else if (!bcs->ignore) {
-                bcs->skb = dev_alloc_skb(SBUFSIZE + bcs->cs->hw_hdr_len);
-                if (bcs->skb)
-                        skb_reserve(bcs->skb, bcs->cs->hw_hdr_len);
-                else
-                        dev_err(bcs->cs->dev, "could not allocate skb\n");
-        }
+        if (bcs->rx_skb != NULL)
+                skb_trim(bcs->rx_skb, 0);
+        else
+                gigaset_new_rx_skb(bcs);
 
         /* reset packet state */
-        bcs->fcs = PPP_INITFCS;
+        bcs->rx_fcs = PPP_INITFCS;
 }
 
 /* hdlc_done
@@ -549,7 +543,7 @@ static inline void hdlc_done(struct bc_state *bcs)
                 hdlc_flush(bcs);
                 return;
         }
-        procskb = bcs->skb;
+        procskb = bcs->rx_skb;
         if (procskb == NULL) {
                 /* previous error */
                 gig_dbg(DEBUG_ISO, "%s: skb=NULL", __func__);
@@ -560,8 +554,8 @@ static inline void hdlc_done(struct bc_state *bcs)
                 bcs->hw.bas->runts++;
                 dev_kfree_skb_any(procskb);
                 gigaset_isdn_rcv_err(bcs);
-        } else if (bcs->fcs != PPP_GOODFCS) {
-                dev_notice(cs->dev, "frame check error (0x%04x)\n", bcs->fcs);
+        } else if (bcs->rx_fcs != PPP_GOODFCS) {
+                dev_notice(cs->dev, "frame check error\n");
                 bcs->hw.bas->fcserrs++;
                 dev_kfree_skb_any(procskb);
                 gigaset_isdn_rcv_err(bcs);
@@ -574,13 +568,8 @@ static inline void hdlc_done(struct bc_state *bcs)
                 bcs->hw.bas->goodbytes += len;
                 gigaset_skb_rcvd(bcs, procskb);
         }
-
-        bcs->skb = dev_alloc_skb(SBUFSIZE + cs->hw_hdr_len);
-        if (bcs->skb)
-                skb_reserve(bcs->skb, cs->hw_hdr_len);
-        else
-                dev_err(cs->dev, "could not allocate skb\n");
-        bcs->fcs = PPP_INITFCS;
+        gigaset_new_rx_skb(bcs);
+        bcs->rx_fcs = PPP_INITFCS;
 }
 
 /* hdlc_frag
@@ -597,8 +586,8 @@ static inline void hdlc_frag(struct bc_state *bcs, unsigned inbits)
         dev_notice(bcs->cs->dev, "received partial byte (%d bits)\n", inbits);
         bcs->hw.bas->alignerrs++;
         gigaset_isdn_rcv_err(bcs);
-        __skb_trim(bcs->skb, 0);
-        bcs->fcs = PPP_INITFCS;
+        __skb_trim(bcs->rx_skb, 0);
+        bcs->rx_fcs = PPP_INITFCS;
 }
 
 /* bit counts lookup table for HDLC bit unstuffing
@@ -847,7 +836,6 @@ static inline void hdlc_unpack(unsigned char *src, unsigned count,
 static inline void trans_receive(unsigned char *src, unsigned count,
                                  struct bc_state *bcs)
 {
-        struct cardstate *cs = bcs->cs;
         struct sk_buff *skb;
         int dobytes;
         unsigned char *dst;
@@ -857,17 +845,11 @@ static inline void trans_receive(unsigned char *src, unsigned count,
                 hdlc_flush(bcs);
                 return;
         }
-        skb = bcs->skb;
-        if (unlikely(skb == NULL)) {
-                bcs->skb = skb = dev_alloc_skb(SBUFSIZE + cs->hw_hdr_len);
-                if (!skb) {
-                        dev_err(cs->dev, "could not allocate skb\n");
-                        return;
-                }
-                skb_reserve(skb, cs->hw_hdr_len);
-        }
+        skb = bcs->rx_skb;
+        if (skb == NULL)
+                skb = gigaset_new_rx_skb(bcs);
         bcs->hw.bas->goodbytes += skb->len;
-        dobytes = TRANSBUFSIZE - skb->len;
+        dobytes = bcs->rx_bufsize - skb->len;
         while (count > 0) {
                 dst = skb_put(skb, count < dobytes ? count : dobytes);
                 while (count > 0 && dobytes > 0) {
@@ -879,14 +861,10 @@ static inline void trans_receive(unsigned char *src, unsigned count,
                         dump_bytes(DEBUG_STREAM_DUMP,
                                    "rcv data", skb->data, skb->len);
                         gigaset_skb_rcvd(bcs, skb);
-                        bcs->skb = skb =
-                                dev_alloc_skb(SBUFSIZE + cs->hw_hdr_len);
-                        if (!skb) {
-                                dev_err(cs->dev, "could not allocate skb\n");
+                        skb = gigaset_new_rx_skb(bcs);
+                        if (skb == NULL)
                                 return;
-                        }
-                        skb_reserve(skb, cs->hw_hdr_len);
-                        dobytes = TRANSBUFSIZE;
+                        dobytes = bcs->rx_bufsize;
                 }
         }
 }
diff --git a/drivers/isdn/hysdn/hysdn_net.c b/drivers/isdn/hysdn/hysdn_net.c
index 72eb92647c1b..feec8d89d719 100644
--- a/drivers/isdn/hysdn/hysdn_net.c
+++ b/drivers/isdn/hysdn/hysdn_net.c
@@ -187,12 +187,13 @@ void
 hysdn_rx_netpkt(hysdn_card * card, unsigned char *buf, unsigned short len)
 {
         struct net_local *lp = card->netif;
-        struct net_device *dev = lp->dev;
+        struct net_device *dev;
         struct sk_buff *skb;
 
         if (!lp)
                 return;         /* non existing device */
 
+        dev = lp->dev;
         dev->stats.rx_bytes += len;
 
         skb = dev_alloc_skb(len);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 46b3a044eadf..cb20d0b0555a 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2087,6 +2087,7 @@ static void sync_sbs(mddev_t * mddev, int nospares)
         /* First make sure individual recovery_offsets are correct */
         list_for_each_entry(rdev, &mddev->disks, same_set) {
                 if (rdev->raid_disk >= 0 &&
+                    mddev->delta_disks >= 0 &&
                     !test_bit(In_sync, &rdev->flags) &&
                     mddev->curr_resync_completed > rdev->recovery_offset)
                                 rdev->recovery_offset = mddev->curr_resync_completed;
@@ -3001,6 +3002,9 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
                 return -EINVAL;
         }
 
+        list_for_each_entry(rdev, &mddev->disks, same_set)
+                rdev->new_raid_disk = rdev->raid_disk;
+
         /* ->takeover must set new_* and/or delta_disks
          * if it succeeds, and may set them when it fails.
          */
@@ -3051,13 +3055,35 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
                 mddev->safemode = 0;
         }
 
-        module_put(mddev->pers->owner);
-        /* Invalidate devices that are now superfluous */
-        list_for_each_entry(rdev, &mddev->disks, same_set)
-                if (rdev->raid_disk >= mddev->raid_disks) {
-                        rdev->raid_disk = -1;
+        list_for_each_entry(rdev, &mddev->disks, same_set) {
+                char nm[20];
+                if (rdev->raid_disk < 0)
+                        continue;
+                if (rdev->new_raid_disk > mddev->raid_disks)
+                        rdev->new_raid_disk = -1;
+                if (rdev->new_raid_disk == rdev->raid_disk)
+                        continue;
+                sprintf(nm, "rd%d", rdev->raid_disk);
+                sysfs_remove_link(&mddev->kobj, nm);
+        }
+        list_for_each_entry(rdev, &mddev->disks, same_set) {
+                if (rdev->raid_disk < 0)
+                        continue;
+                if (rdev->new_raid_disk == rdev->raid_disk)
+                        continue;
+                rdev->raid_disk = rdev->new_raid_disk;
+                if (rdev->raid_disk < 0)
                         clear_bit(In_sync, &rdev->flags);
+                else {
+                        char nm[20];
+                        sprintf(nm, "rd%d", rdev->raid_disk);
+                        if(sysfs_create_link(&mddev->kobj, &rdev->kobj, nm))
+                                printk("md: cannot register %s for %s after level change\n",
+                                       nm, mdname(mddev));
                 }
+        }
+
+        module_put(mddev->pers->owner);
         mddev->pers = pers;
         mddev->private = priv;
         strlcpy(mddev->clevel, pers->name, sizeof(mddev->clevel));
@@ -5895,6 +5921,7 @@ static int md_open(struct block_device *bdev, fmode_t mode)
         atomic_inc(&mddev->openers);
         mutex_unlock(&mddev->open_mutex);
 
+        check_disk_size_change(mddev->gendisk, bdev);
  out:
         return err;
 }
@@ -6846,6 +6873,7 @@ void md_do_sync(mddev_t *mddev)
                         rcu_read_lock();
                         list_for_each_entry_rcu(rdev, &mddev->disks, same_set)
                                 if (rdev->raid_disk >= 0 &&
+                                    mddev->delta_disks >= 0 &&
                                     !test_bit(Faulty, &rdev->flags) &&
                                     !test_bit(In_sync, &rdev->flags) &&
                                     rdev->recovery_offset < mddev->curr_resync)
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 7ab5ea155452..10597bfec000 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -78,6 +78,9 @@ struct mdk_rdev_s
 
         int desc_nr;                    /* descriptor index in the superblock */
         int raid_disk;                  /* role of device in array */
+        int new_raid_disk;              /* role that the device will have in
+                                         * the array after a level-change completes.
+                                         */
         int saved_raid_disk;            /* role that device used to have in the
                                          * array and could again if we did a partial
                                          * resync from the bitmap
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index e70f004c99e8..563abed5a2cb 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -173,9 +173,11 @@ static int create_strip_zones(mddev_t *mddev, raid0_conf_t **private_conf)
         list_for_each_entry(rdev1, &mddev->disks, same_set) {
                 int j = rdev1->raid_disk;
 
-                if (mddev->level == 10)
+                if (mddev->level == 10) {
                         /* taking over a raid10-n2 array */
                         j /= 2;
+                        rdev1->new_raid_disk = j;
+                }
 
                 if (j < 0 || j >= mddev->raid_disks) {
                         printk(KERN_ERR "md/raid0:%s: bad disk number %d - "
@@ -361,12 +363,6 @@ static int raid0_run(mddev_t *mddev)
                 mddev->private = conf;
         }
         conf = mddev->private;
-        if (conf->scale_raid_disks) {
-                int i;
-                for (i=0; i < conf->strip_zone[0].nb_dev; i++)
-                        conf->devlist[i]->raid_disk /= conf->scale_raid_disks;
-                /* FIXME update sysfs rd links */
-        }
 
         /* calculate array device size */
         md_set_array_sectors(mddev, raid0_size(mddev, 0, 0));
@@ -573,7 +569,7 @@ static void raid0_status(struct seq_file *seq, mddev_t *mddev)
         return;
 }
 
-static void *raid0_takeover_raid5(mddev_t *mddev)
+static void *raid0_takeover_raid45(mddev_t *mddev)
 {
         mdk_rdev_t *rdev;
         raid0_conf_t *priv_conf;
@@ -596,6 +592,7 @@ static void *raid0_takeover_raid5(mddev_t *mddev)
 
         /* Set new parameters */
         mddev->new_level = 0;
+        mddev->new_layout = 0;
         mddev->new_chunk_sectors = mddev->chunk_sectors;
         mddev->raid_disks--;
         mddev->delta_disks = -1;
@@ -635,6 +632,7 @@ static void *raid0_takeover_raid10(mddev_t *mddev)
 
         /* Set new parameters */
         mddev->new_level = 0;
+        mddev->new_layout = 0;
         mddev->new_chunk_sectors = mddev->chunk_sectors;
         mddev->delta_disks = - mddev->raid_disks / 2;
         mddev->raid_disks += mddev->delta_disks;
@@ -643,19 +641,22 @@ static void *raid0_takeover_raid10(mddev_t *mddev)
         mddev->recovery_cp = MaxSector;
 
         create_strip_zones(mddev, &priv_conf);
-        priv_conf->scale_raid_disks = 2;
         return priv_conf;
 }
 
 static void *raid0_takeover(mddev_t *mddev)
 {
         /* raid0 can take over:
+         *  raid4 - if all data disks are active.
          *  raid5 - providing it is Raid4 layout and one disk is faulty
          *  raid10 - assuming we have all necessary active disks
          */
+        if (mddev->level == 4)
+                return raid0_takeover_raid45(mddev);
+
         if (mddev->level == 5) {
                 if (mddev->layout == ALGORITHM_PARITY_N)
-                        return raid0_takeover_raid5(mddev);
+                        return raid0_takeover_raid45(mddev);
 
                 printk(KERN_ERR "md/raid0:%s: Raid can only takeover Raid5 with layout: %d\n",
                        mdname(mddev), ALGORITHM_PARITY_N);
diff --git a/drivers/md/raid0.h b/drivers/md/raid0.h
index d724e664ca4d..91f8e876ee64 100644
--- a/drivers/md/raid0.h
+++ b/drivers/md/raid0.h
@@ -13,9 +13,6 @@ struct raid0_private_data
         struct strip_zone *strip_zone;
         mdk_rdev_t **devlist; /* lists of rdevs, pointed to by strip_zone->dev */
         int nr_strip_zones;
-        int scale_raid_disks; /* divide rdev->raid_disks by this in run()
-                               * to handle conversion from raid10
-                               */
 };
 
 typedef struct raid0_private_data raid0_conf_t;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 03724992cdf2..42e64e4e5e25 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1482,14 +1482,14 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
         int sectors = r10_bio->sectors;
         mdk_rdev_t*rdev;
         int max_read_errors = atomic_read(&mddev->max_corr_read_errors);
+        int d = r10_bio->devs[r10_bio->read_slot].devnum;
 
         rcu_read_lock();
-        {
-                int d = r10_bio->devs[r10_bio->read_slot].devnum;
+        rdev = rcu_dereference(conf->mirrors[d].rdev);
+        if (rdev) { /* If rdev is not NULL */
                 char b[BDEVNAME_SIZE];
                 int cur_read_error_count = 0;
 
-                rdev = rcu_dereference(conf->mirrors[d].rdev);
                 bdevname(rdev->bdev, b);
 
                 if (test_bit(Faulty, &rdev->flags)) {
@@ -1530,7 +1530,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
 
                 rcu_read_lock();
                 do {
-                        int d = r10_bio->devs[sl].devnum;
+                        d = r10_bio->devs[sl].devnum;
                         rdev = rcu_dereference(conf->mirrors[d].rdev);
                         if (rdev &&
                             test_bit(In_sync, &rdev->flags)) {
@@ -1564,7 +1564,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
                 rcu_read_lock();
                 while (sl != r10_bio->read_slot) {
                         char b[BDEVNAME_SIZE];
-                        int d;
+
                         if (sl==0)
                                 sl = conf->copies;
                         sl--;
@@ -1601,7 +1601,7 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
                 }
                 sl = start;
                 while (sl != r10_bio->read_slot) {
-                        int d;
+
                         if (sl==0)
                                 sl = conf->copies;
                         sl--;
@@ -2161,22 +2161,22 @@ static conf_t *setup_conf(mddev_t *mddev)
         sector_t stride, size;
         int err = -EINVAL;
 
-        if (mddev->chunk_sectors < (PAGE_SIZE >> 9) ||
-            !is_power_of_2(mddev->chunk_sectors)) {
+        if (mddev->new_chunk_sectors < (PAGE_SIZE >> 9) ||
+            !is_power_of_2(mddev->new_chunk_sectors)) {
                 printk(KERN_ERR "md/raid10:%s: chunk size must be "
                        "at least PAGE_SIZE(%ld) and be a power of 2.\n",
                        mdname(mddev), PAGE_SIZE);
                 goto out;
         }
 
-        nc = mddev->layout & 255;
-        fc = (mddev->layout >> 8) & 255;
-        fo = mddev->layout & (1<<16);
+        nc = mddev->new_layout & 255;
+        fc = (mddev->new_layout >> 8) & 255;
+        fo = mddev->new_layout & (1<<16);
 
         if ((nc*fc) <2 || (nc*fc) > mddev->raid_disks ||
-            (mddev->layout >> 17)) {
+            (mddev->new_layout >> 17)) {
                 printk(KERN_ERR "md/raid10:%s: unsupported raid10 layout: 0x%8x\n",
-                       mdname(mddev), mddev->layout);
+                       mdname(mddev), mddev->new_layout);
                 goto out;
         }
 
@@ -2241,7 +2241,6 @@ static conf_t *setup_conf(mddev_t *mddev)
         if (!conf->thread)
                 goto out;
 
-        conf->scale_disks = 0;
         conf->mddev = mddev;
         return conf;
 
@@ -2300,11 +2299,6 @@ static int run(mddev_t *mddev)
                 if (disk_idx >= conf->raid_disks
                     || disk_idx < 0)
                         continue;
-                if (conf->scale_disks) {
-                        disk_idx *= conf->scale_disks;
-                        rdev->raid_disk = disk_idx;
-                        /* MOVE 'rd%d' link !! */
-                }
                 disk = conf->mirrors + disk_idx;
 
                 disk->rdev = rdev;
@@ -2435,26 +2429,22 @@ static void *raid10_takeover_raid0(mddev_t *mddev)
                 return ERR_PTR(-EINVAL);
         }
 
-        /* Update slot numbers to obtain
-         * degraded raid10 with missing mirrors
-         */
-        list_for_each_entry(rdev, &mddev->disks, same_set) {
-                rdev->raid_disk *= 2;
-        }
-
         /* Set new parameters */
         mddev->new_level = 10;
         /* new layout: far_copies = 1, near_copies = 2 */
         mddev->new_layout = (1<<8) + 2;
         mddev->new_chunk_sectors = mddev->chunk_sectors;
         mddev->delta_disks = mddev->raid_disks;
-        mddev->degraded = mddev->raid_disks;
         mddev->raid_disks *= 2;
         /* make sure it will be not marked as dirty */
         mddev->recovery_cp = MaxSector;
 
         conf = setup_conf(mddev);
-        conf->scale_disks = 2;
+        if (!IS_ERR(conf))
+                list_for_each_entry(rdev, &mddev->disks, same_set)
+                        if (rdev->raid_disk >= 0)
+                                rdev->new_raid_disk = rdev->raid_disk * 2;
+                
         return conf;
 }
 
diff --git a/drivers/md/raid10.h b/drivers/md/raid10.h
index 3824a087e17c..2316ac2e8e21 100644
--- a/drivers/md/raid10.h
+++ b/drivers/md/raid10.h
@@ -38,11 +38,6 @@ struct r10_private_data_s {
         int chunk_shift; /* shift from chunks to sectors */
         sector_t chunk_mask;
 
-        int                     scale_disks;  /* When starting array, multiply
-                                               * each ->raid_disk by this.
-                                               * Need for raid0->raid10 migration
-                                               */
-
         struct list_head        retry_list;
         /* queue pending writes and submit them on unplug */
         struct bio_list         pending_bio_list;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index d2c0f94fa37d..96c690279fc6 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -277,12 +277,13 @@ out:
         return sh;
 }
 
-static void shrink_buffers(struct stripe_head *sh, int num)
+static void shrink_buffers(struct stripe_head *sh)
 {
         struct page *p;
         int i;
+        int num = sh->raid_conf->pool_size;
 
-        for (i=0; i<num ; i++) {
+        for (i = 0; i < num ; i++) {
                 p = sh->dev[i].page;
                 if (!p)
                         continue;
@@ -291,11 +292,12 @@ static void shrink_buffers(struct stripe_head *sh, int num)
         }
 }
 
-static int grow_buffers(struct stripe_head *sh, int num)
+static int grow_buffers(struct stripe_head *sh)
 {
         int i;
+        int num = sh->raid_conf->pool_size;
 
-        for (i=0; i<num; i++) {
+        for (i = 0; i < num; i++) {
                 struct page *page;
 
                 if (!(page = alloc_page(GFP_KERNEL))) {
@@ -364,6 +366,73 @@ static struct stripe_head *__find_stripe(raid5_conf_t *conf, sector_t sector,
         return NULL;
 }
 
+/*
+ * Need to check if array has failed when deciding whether to:
+ *  - start an array
+ *  - remove non-faulty devices
+ *  - add a spare
+ *  - allow a reshape
+ * This determination is simple when no reshape is happening.
+ * However if there is a reshape, we need to carefully check
+ * both the before and after sections.
+ * This is because some failed devices may only affect one
+ * of the two sections, and some non-in_sync devices may
+ * be insync in the section most affected by failed devices.
+ */
+static int has_failed(raid5_conf_t *conf)
+{
+        int degraded;
+        int i;
+        if (conf->mddev->reshape_position == MaxSector)
+                return conf->mddev->degraded > conf->max_degraded;
+
+        rcu_read_lock();
+        degraded = 0;
+        for (i = 0; i < conf->previous_raid_disks; i++) {
+                mdk_rdev_t *rdev = rcu_dereference(conf->disks[i].rdev);
+                if (!rdev || test_bit(Faulty, &rdev->flags))
+                        degraded++;
+                else if (test_bit(In_sync, &rdev->flags))
+                        ;
+                else
+                        /* not in-sync or faulty.
+                         * If the reshape increases the number of devices,
+                         * this is being recovered by the reshape, so
+                         * this 'previous' section is not in_sync.
+                         * If the number of devices is being reduced however,
+                         * the device can only be part of the array if
+                         * we are reverting a reshape, so this section will
+                         * be in-sync.
+                         */
+                        if (conf->raid_disks >= conf->previous_raid_disks)
+                                degraded++;
+        }
+        rcu_read_unlock();
+        if (degraded > conf->max_degraded)
+                return 1;
+        rcu_read_lock();
+        degraded = 0;
+        for (i = 0; i < conf->raid_disks; i++) {
+                mdk_rdev_t *rdev = rcu_dereference(conf->disks[i].rdev);
+                if (!rdev || test_bit(Faulty, &rdev->flags))
+                        degraded++;
+                else if (test_bit(In_sync, &rdev->flags))
+                        ;
+                else
+                        /* not in-sync or faulty.
+                         * If reshape increases the number of devices, this
+                         * section has already been recovered, else it
+                         * almost certainly hasn't.
+                         */
+                        if (conf->raid_disks <= conf->previous_raid_disks)
+                                degraded++;
+        }
+        rcu_read_unlock();
+        if (degraded > conf->max_degraded)
+                return 1;
+        return 0;
+}
+
 static void unplug_slaves(mddev_t *mddev);
 static void raid5_unplug_device(struct request_queue *q);
 
@@ -1240,19 +1309,18 @@ static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
 static int grow_one_stripe(raid5_conf_t *conf)
 {
         struct stripe_head *sh;
-        int disks = max(conf->raid_disks, conf->previous_raid_disks);
         sh = kmem_cache_alloc(conf->slab_cache, GFP_KERNEL);
         if (!sh)
                 return 0;
-        memset(sh, 0, sizeof(*sh) + (disks-1)*sizeof(struct r5dev));
+        memset(sh, 0, sizeof(*sh) + (conf->pool_size-1)*sizeof(struct r5dev));
         sh->raid_conf = conf;
         spin_lock_init(&sh->lock);
         #ifdef CONFIG_MULTICORE_RAID456
         init_waitqueue_head(&sh->ops.wait_for_ops);
         #endif
 
-        if (grow_buffers(sh, disks)) {
-                shrink_buffers(sh, disks);
+        if (grow_buffers(sh)) {
+                shrink_buffers(sh);
                 kmem_cache_free(conf->slab_cache, sh);
                 return 0;
         }
@@ -1468,7 +1536,7 @@ static int drop_one_stripe(raid5_conf_t *conf)
         if (!sh)
                 return 0;
         BUG_ON(atomic_read(&sh->count));
-        shrink_buffers(sh, conf->pool_size);
+        shrink_buffers(sh);
         kmem_cache_free(conf->slab_cache, sh);
         atomic_dec(&conf->active_stripes);
         return 1;
@@ -2963,7 +3031,6 @@ static void handle_stripe5(struct stripe_head *sh)
                 mdk_rdev_t *rdev;
 
                 dev = &sh->dev[i];
-                clear_bit(R5_Insync, &dev->flags);
 
                 pr_debug("check %d: state 0x%lx toread %p read %p write %p "
                         "written %p\n", i, dev->flags, dev->toread, dev->read,
@@ -3000,17 +3067,27 @@ static void handle_stripe5(struct stripe_head *sh)
                         blocked_rdev = rdev;
                         atomic_inc(&rdev->nr_pending);
                 }
-                if (!rdev || !test_bit(In_sync, &rdev->flags)) {
+                clear_bit(R5_Insync, &dev->flags);
+                if (!rdev)
+                        /* Not in-sync */;
+                else if (test_bit(In_sync, &rdev->flags))
+                        set_bit(R5_Insync, &dev->flags);
+                else {
+                        /* could be in-sync depending on recovery/reshape status */
+                        if (sh->sector + STRIPE_SECTORS <= rdev->recovery_offset)
+                                set_bit(R5_Insync, &dev->flags);
+                }
+                if (!test_bit(R5_Insync, &dev->flags)) {
                         /* The ReadError flag will just be confusing now */
                         clear_bit(R5_ReadError, &dev->flags);
                         clear_bit(R5_ReWrite, &dev->flags);
                 }
-                if (!rdev || !test_bit(In_sync, &rdev->flags)
-                    || test_bit(R5_ReadError, &dev->flags)) {
+                if (test_bit(R5_ReadError, &dev->flags))
+                        clear_bit(R5_Insync, &dev->flags);
+                if (!test_bit(R5_Insync, &dev->flags)) {
                         s.failed++;
                         s.failed_num = i;
-                } else
-                        set_bit(R5_Insync, &dev->flags);
+                }
         }
         rcu_read_unlock();
 
@@ -3244,7 +3321,6 @@ static void handle_stripe6(struct stripe_head *sh)
         for (i=disks; i--; ) {
                 mdk_rdev_t *rdev;
                 dev = &sh->dev[i];
-                clear_bit(R5_Insync, &dev->flags);
 
                 pr_debug("check %d: state 0x%lx read %p write %p written %p\n",
                         i, dev->flags, dev->toread, dev->towrite, dev->written);
@@ -3282,18 +3358,28 @@ static void handle_stripe6(struct stripe_head *sh)
                         blocked_rdev = rdev;
                         atomic_inc(&rdev->nr_pending);
                 }
-                if (!rdev || !test_bit(In_sync, &rdev->flags)) {
+                clear_bit(R5_Insync, &dev->flags);
+                if (!rdev)
+                        /* Not in-sync */;
+                else if (test_bit(In_sync, &rdev->flags))
+                        set_bit(R5_Insync, &dev->flags);
+                else {
+                        /* in sync if before recovery_offset */
+                        if (sh->sector + STRIPE_SECTORS <= rdev->recovery_offset)
+                                set_bit(R5_Insync, &dev->flags);
+                }
+                if (!test_bit(R5_Insync, &dev->flags)) {
                         /* The ReadError flag will just be confusing now */
                         clear_bit(R5_ReadError, &dev->flags);
                         clear_bit(R5_ReWrite, &dev->flags);
                 }
-                if (!rdev || !test_bit(In_sync, &rdev->flags)
-                    || test_bit(R5_ReadError, &dev->flags)) {
+                if (test_bit(R5_ReadError, &dev->flags))
+                        clear_bit(R5_Insync, &dev->flags);
+                if (!test_bit(R5_Insync, &dev->flags)) {
                         if (s.failed < 2)
                                 r6s.failed_num[s.failed] = i;
                         s.failed++;
-                } else
-                        set_bit(R5_Insync, &dev->flags);
+                }
         }
         rcu_read_unlock();
 
@@ -4971,8 +5057,10 @@ static int run(mddev_t *mddev)
         list_for_each_entry(rdev, &mddev->disks, same_set) {
                 if (rdev->raid_disk < 0)
                         continue;
-                if (test_bit(In_sync, &rdev->flags))
+                if (test_bit(In_sync, &rdev->flags)) {
                         working_disks++;
+                        continue;
+                }
                 /* This disc is not fully in-sync.  However if it
                  * just stored parity (beyond the recovery_offset),
                  * when we don't need to be concerned about the
@@ -5005,7 +5093,7 @@ static int run(mddev_t *mddev)
         mddev->degraded = (max(conf->raid_disks, conf->previous_raid_disks)
                            - working_disks);
 
-        if (mddev->degraded > conf->max_degraded) {
+        if (has_failed(conf)) {
                 printk(KERN_ERR "md/raid:%s: not enough operational devices"
                         " (%d/%d failed)\n",
                         mdname(mddev), mddev->degraded, conf->raid_disks);
@@ -5207,6 +5295,7 @@ static int raid5_spare_active(mddev_t *mddev)
         for (i = 0; i < conf->raid_disks; i++) {
                 tmp = conf->disks + i;
                 if (tmp->rdev
+                    && tmp->rdev->recovery_offset == MaxSector
                     && !test_bit(Faulty, &tmp->rdev->flags)
                     && !test_and_set_bit(In_sync, &tmp->rdev->flags)) {
                         unsigned long flags;
@@ -5242,7 +5331,7 @@ static int raid5_remove_disk(mddev_t *mddev, int number)
                  * isn't possible.
                  */
                 if (!test_bit(Faulty, &rdev->flags) &&
-                    mddev->degraded <= conf->max_degraded &&
+                    !has_failed(conf) &&
                     number < conf->raid_disks) {
                         err = -EBUSY;
                         goto abort;
@@ -5270,7 +5359,7 @@ static int raid5_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
         int first = 0;
         int last = conf->raid_disks - 1;
 
-        if (mddev->degraded > conf->max_degraded)
+        if (has_failed(conf))
                 /* no point adding a device */
                 return -EINVAL;
 
@@ -5362,7 +5451,7 @@ static int check_reshape(mddev_t *mddev)
         if (mddev->bitmap)
                 /* Cannot grow a bitmap yet */
                 return -EBUSY;
-        if (mddev->degraded > conf->max_degraded)
+        if (has_failed(conf))
                 return -EINVAL;
         if (mddev->delta_disks < 0) {
                 /* We might be able to shrink, but the devices must
@@ -5437,8 +5526,13 @@ static int raid5_start_reshape(mddev_t *mddev)
 
         /* Add some new drives, as many as will fit.
          * We know there are enough to make the newly sized array work.
+         * Don't add devices if we are reducing the number of
+         * devices in the array.  This is because it is not possible
+         * to correctly record the "partially reconstructed" state of
+         * such devices during the reshape and confusion could result.
          */
-        list_for_each_entry(rdev, &mddev->disks, same_set)
+        if (mddev->delta_disks >= 0)
+            list_for_each_entry(rdev, &mddev->disks, same_set)
                 if (rdev->raid_disk < 0 &&
                     !test_bit(Faulty, &rdev->flags)) {
                         if (raid5_add_disk(mddev, rdev) == 0) {
@@ -5460,7 +5554,7 @@ static int raid5_start_reshape(mddev_t *mddev)
                 }
 
         /* When a reshape changes the number of devices, ->degraded
-         * is measured against the large of the pre and post number of
+         * is measured against the larger of the pre and post number of
          * devices.*/
         if (mddev->delta_disks > 0) {
                 spin_lock_irqsave(&conf->device_lock, flags);
diff --git a/drivers/media/common/tuners/tuner-simple.c b/drivers/media/common/tuners/tuner-simple.c
index 8abbcc5fcf95..8cf2ab609d5e 100644
--- a/drivers/media/common/tuners/tuner-simple.c
+++ b/drivers/media/common/tuners/tuner-simple.c
@@ -524,6 +524,7 @@ static int simple_radio_bandswitch(struct dvb_frontend *fe, u8 *buffer)
                 buffer[3] = 0x39;
                 break;
         case TUNER_PHILIPS_FQ1216LME_MK3:
+        case TUNER_PHILIPS_FQ1236_MK5:
                 tuner_err("This tuner doesn't have FM\n");
                 /* Set the low band for sanity, since it covers 88-108 MHz */
                 buffer[3] = 0x01;
diff --git a/drivers/media/common/tuners/tuner-types.c b/drivers/media/common/tuners/tuner-types.c
index d9aaaca620c9..58a513bcd747 100644
--- a/drivers/media/common/tuners/tuner-types.c
+++ b/drivers/media/common/tuners/tuner-types.c
@@ -1353,6 +1353,17 @@ static struct tuner_params tuner_sony_btf_pxn01z_params[] = {
         },
 };
 
+/* ------------ TUNER_PHILIPS_FQ1236_MK5 - Philips NTSC ------------ */
+
+static struct tuner_params tuner_philips_fq1236_mk5_params[] = {
+        {
+                .type   = TUNER_PARAM_TYPE_NTSC,
+                .ranges = tuner_fm1236_mk3_ntsc_ranges,
+                .count  = ARRAY_SIZE(tuner_fm1236_mk3_ntsc_ranges),
+                .has_tda9887 = 1, /* TDA9885, no FM radio */
+        },
+};
+
 /* --------------------------------------------------------------------- */
 
 struct tunertype tuners[] = {
@@ -1826,6 +1837,11 @@ struct tunertype tuners[] = {
                 .params = tuner_sony_btf_pxn01z_params,
                 .count  = ARRAY_SIZE(tuner_sony_btf_pxn01z_params),
         },
+        [TUNER_PHILIPS_FQ1236_MK5] = { /* NTSC, TDA9885, no FM radio */
+                .name   = "Philips FQ1236 MK5",
+                .params = tuner_philips_fq1236_mk5_params,
+                .count  = ARRAY_SIZE(tuner_philips_fq1236_mk5_params),
+        },
 };
 EXPORT_SYMBOL(tuners);
 
diff --git a/drivers/media/video/ivtv/ivtv-streams.c b/drivers/media/video/ivtv/ivtv-streams.c
index 9ecacab4b89b..a937e2ff9b6e 100644
--- a/drivers/media/video/ivtv/ivtv-streams.c
+++ b/drivers/media/video/ivtv/ivtv-streams.c
@@ -912,6 +912,9 @@ int ivtv_stop_v4l2_decode_stream(struct ivtv_stream *s, int flags, u64 pts)
         clear_bit(IVTV_F_S_STREAMING, &s->s_flags);
         ivtv_flush_queues(s);
 
+        /* decoder needs time to settle */
+        ivtv_msleep_timeout(40, 0);
+
         /* decrement decoding */
         atomic_dec(&itv->decoding);
 
diff --git a/drivers/media/video/mem2mem_testdev.c b/drivers/media/video/mem2mem_testdev.c
index 554eaf140128..10ddeccc70eb 100644
--- a/drivers/media/video/mem2mem_testdev.c
+++ b/drivers/media/video/mem2mem_testdev.c
@@ -988,6 +988,9 @@ static int m2mtest_probe(struct platform_device *pdev)
                 goto err_m2m;
         }
 
+        q_data[V4L2_M2M_SRC].fmt = &formats[0];
+        q_data[V4L2_M2M_DST].fmt = &formats[0];
+
         return 0;
 
 err_m2m:
diff --git a/drivers/media/video/omap/Kconfig b/drivers/media/video/omap/Kconfig
index 97c53949ca89..e63233fd2aaa 100644
--- a/drivers/media/video/omap/Kconfig
+++ b/drivers/media/video/omap/Kconfig
@@ -1,8 +1,8 @@
 config VIDEO_OMAP2_VOUT
         tristate "OMAP2/OMAP3 V4L2-Display driver"
-        depends on ARCH_OMAP24XX || ARCH_OMAP34XX
+        depends on ARCH_OMAP2 || ARCH_OMAP3
         select VIDEOBUF_GEN
-        select VIDEOBUF_DMA_SG
+        select VIDEOBUF_DMA_CONTIG
         select OMAP2_DSS
         select OMAP2_VRAM
         select OMAP2_VRFB
diff --git a/drivers/media/video/omap/Makefile b/drivers/media/video/omap/Makefile
index b8bab00ad010..b28788070ae1 100644
--- a/drivers/media/video/omap/Makefile
+++ b/drivers/media/video/omap/Makefile
@@ -3,5 +3,5 @@
 #
 
 # OMAP2/3 Display driver
-omap-vout-mod-objs := omap_vout.o omap_voutlib.o
-obj-$(CONFIG_VIDEO_OMAP2_VOUT) += omap-vout-mod.o
+omap-vout-y := omap_vout.o omap_voutlib.o
+obj-$(CONFIG_VIDEO_OMAP2_VOUT) += omap-vout.o
diff --git a/drivers/media/video/omap/omap_vout.c b/drivers/media/video/omap/omap_vout.c
index e7db0554949a..929073e792c9 100644
--- a/drivers/media/video/omap/omap_vout.c
+++ b/drivers/media/video/omap/omap_vout.c
@@ -38,8 +38,9 @@
 #include <linux/dma-mapping.h>
 #include <linux/irq.h>
 #include <linux/videodev2.h>
+#include <linux/slab.h>
 
-#include <media/videobuf-dma-sg.h>
+#include <media/videobuf-dma-contig.h>
 #include <media/v4l2-device.h>
 #include <media/v4l2-ioctl.h>
 
@@ -1053,9 +1054,9 @@ static int omap_vout_buffer_prepare(struct videobuf_queue *q,
                             struct videobuf_buffer *vb,
                             enum v4l2_field field)
 {
+        dma_addr_t dmabuf;
         struct vid_vrfb_dma *tx;
         enum dss_rotation rotation;
-        struct videobuf_dmabuf *dmabuf = NULL;
         struct omap_vout_device *vout = q->priv_data;
         u32 dest_frame_index = 0, src_element_index = 0;
         u32 dest_element_index = 0, src_frame_index = 0;
@@ -1074,24 +1075,17 @@ static int omap_vout_buffer_prepare(struct videobuf_queue *q,
         if (V4L2_MEMORY_USERPTR == vb->memory) {
                 if (0 == vb->baddr)
                         return -EINVAL;
-                /* Virtual address */
-                /* priv points to struct videobuf_pci_sg_memory. But we went
-                 * pointer to videobuf_dmabuf, which is member of
-                 * videobuf_pci_sg_memory */
-                dmabuf = videobuf_to_dma(q->bufs[vb->i]);
-                dmabuf->vmalloc = (void *) vb->baddr;
-
                 /* Physical address */
-                dmabuf->bus_addr =
-                        (dma_addr_t) omap_vout_uservirt_to_phys(vb->baddr);
+                vout->queued_buf_addr[vb->i] = (u8 *)
+                        omap_vout_uservirt_to_phys(vb->baddr);
+        } else {
+                vout->queued_buf_addr[vb->i] = (u8 *)vout->buf_phy_addr[vb->i];
         }
 
-        if (!rotation_enabled(vout)) {
-                dmabuf = videobuf_to_dma(q->bufs[vb->i]);
-                vout->queued_buf_addr[vb->i] = (u8 *) dmabuf->bus_addr;
+        if (!rotation_enabled(vout))
                 return 0;
-        }
-        dmabuf = videobuf_to_dma(q->bufs[vb->i]);
+
+        dmabuf = vout->buf_phy_addr[vb->i];
         /* If rotation is enabled, copy input buffer into VRFB
          * memory space using DMA. We are copying input buffer
          * into VRFB memory space of desired angle and DSS will
@@ -1120,7 +1114,7 @@ static int omap_vout_buffer_prepare(struct videobuf_queue *q,
                         tx->dev_id, 0x0);
         /* src_port required only for OMAP1 */
         omap_set_dma_src_params(tx->dma_ch, 0, OMAP_DMA_AMODE_POST_INC,
-                        dmabuf->bus_addr, src_element_index, src_frame_index);
+                        dmabuf, src_element_index, src_frame_index);
         /*set dma source burst mode for VRFB */
         omap_set_dma_src_burst_mode(tx->dma_ch, OMAP_DMA_DATA_BURST_16);
         rotation = calc_rotation(vout);
@@ -1211,7 +1205,6 @@ static int omap_vout_mmap(struct file *file, struct vm_area_struct *vma)
         void *pos;
         unsigned long start = vma->vm_start;
         unsigned long size = (vma->vm_end - vma->vm_start);
-        struct videobuf_dmabuf *dmabuf = NULL;
         struct omap_vout_device *vout = file->private_data;
         struct videobuf_queue *q = &vout->vbq;
 
@@ -1241,8 +1234,7 @@ static int omap_vout_mmap(struct file *file, struct vm_area_struct *vma)
         vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
         vma->vm_ops = &omap_vout_vm_ops;
         vma->vm_private_data = (void *) vout;
-        dmabuf = videobuf_to_dma(q->bufs[i]);
-        pos = dmabuf->vmalloc;
+        pos = (void *)vout->buf_virt_addr[i];
         vma->vm_pgoff = virt_to_phys((void *)pos) >> PAGE_SHIFT;
         while (size > 0) {
                 unsigned long pfn;
@@ -1347,8 +1339,8 @@ static int omap_vout_open(struct file *file)
         video_vbq_ops.buf_queue = omap_vout_buffer_queue;
         spin_lock_init(&vout->vbq_lock);
 
-        videobuf_queue_sg_init(q, &video_vbq_ops, NULL, &vout->vbq_lock,
-                        vout->type, V4L2_FIELD_NONE,
+        videobuf_queue_dma_contig_init(q, &video_vbq_ops, q->dev,
+                        &vout->vbq_lock, vout->type, V4L2_FIELD_NONE,
                         sizeof(struct videobuf_buffer), vout);
 
         v4l2_dbg(1, debug, &vout->vid_dev->v4l2_dev, "Exiting %s\n", __func__);
@@ -1799,7 +1791,6 @@ static int vidioc_reqbufs(struct file *file, void *fh,
         unsigned int i, num_buffers = 0;
         struct omap_vout_device *vout = fh;
         struct videobuf_queue *q = &vout->vbq;
-        struct videobuf_dmabuf *dmabuf = NULL;
 
         if ((req->type != V4L2_BUF_TYPE_VIDEO_OUTPUT) || (req->count < 0))
                 return -EINVAL;
@@ -1825,8 +1816,7 @@ static int vidioc_reqbufs(struct file *file, void *fh,
                 num_buffers = (vout->vid == OMAP_VIDEO1) ?
                         video1_numbuffers : video2_numbuffers;
                 for (i = num_buffers; i < vout->buffer_allocated; i++) {
-                        dmabuf = videobuf_to_dma(q->bufs[i]);
-                        omap_vout_free_buffer((u32)dmabuf->vmalloc,
+                        omap_vout_free_buffer(vout->buf_virt_addr[i],
                                         vout->buffer_size);
                         vout->buf_virt_addr[i] = 0;
                         vout->buf_phy_addr[i] = 0;
@@ -1855,12 +1845,7 @@ static int vidioc_reqbufs(struct file *file, void *fh,
                 goto reqbuf_err;
 
         vout->buffer_allocated = req->count;
-        for (i = 0; i < req->count; i++) {
-                dmabuf = videobuf_to_dma(q->bufs[i]);
-                dmabuf->vmalloc = (void *) vout->buf_virt_addr[i];
-                dmabuf->bus_addr = (dma_addr_t) vout->buf_phy_addr[i];
-                dmabuf->sglen = 1;
-        }
+
 reqbuf_err:
         mutex_unlock(&vout->lock);
         return ret;
@@ -2488,7 +2473,7 @@ static int omap_vout_remove(struct platform_device *pdev)
 
         for (k = 0; k < vid_dev->num_displays; k++) {
                 if (vid_dev->displays[k]->state != OMAP_DSS_DISPLAY_DISABLED)
-                        vid_dev->displays[k]->disable(vid_dev->displays[k]);
+                        vid_dev->displays[k]->driver->disable(vid_dev->displays[k]);
 
                 omap_dss_put_device(vid_dev->displays[k]);
         }
@@ -2545,7 +2530,9 @@ static int __init omap_vout_probe(struct platform_device *pdev)
                         def_display = NULL;
                 }
                 if (def_display) {
-                        ret = def_display->enable(def_display);
+                        struct omap_dss_driver *dssdrv = def_display->driver;
+
+                        ret = dssdrv->enable(def_display);
                         if (ret) {
                                 /* Here we are not considering a error
                                  *  as display may be enabled by frame
@@ -2559,21 +2546,21 @@ static int __init omap_vout_probe(struct platform_device *pdev)
                         if (def_display->caps &
                                         OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE) {
 #ifdef CONFIG_FB_OMAP2_FORCE_AUTO_UPDATE
-                                if (def_display->enable_te)
-                                        def_display->enable_te(def_display, 1);
-                                if (def_display->set_update_mode)
-                                        def_display->set_update_mode(def_display,
+                                if (dssdrv->enable_te)
+                                        dssdrv->enable_te(def_display, 1);
+                                if (dssdrv->set_update_mode)
+                                        dssdrv->set_update_mode(def_display,
                                                         OMAP_DSS_UPDATE_AUTO);
 #else   /* MANUAL_UPDATE */
-                                if (def_display->enable_te)
-                                        def_display->enable_te(def_display, 0);
-                                if (def_display->set_update_mode)
-                                        def_display->set_update_mode(def_display,
+                                if (dssdrv->enable_te)
+                                        dssdrv->enable_te(def_display, 0);
+                                if (dssdrv->set_update_mode)
+                                        dssdrv->set_update_mode(def_display,
                                                         OMAP_DSS_UPDATE_MANUAL);
 #endif
                         } else {
-                                if (def_display->set_update_mode)
-                                        def_display->set_update_mode(def_display,
+                                if (dssdrv->set_update_mode)
+                                        dssdrv->set_update_mode(def_display,
                                                         OMAP_DSS_UPDATE_AUTO);
                         }
                 }
@@ -2592,8 +2579,8 @@ static int __init omap_vout_probe(struct platform_device *pdev)
         for (i = 0; i < vid_dev->num_displays; i++) {
                 struct omap_dss_device *display = vid_dev->displays[i];
 
-                if (display->update)
-                        display->update(display, 0, 0,
+                if (display->driver->update)
+                        display->driver->update(display, 0, 0,
                                         display->panel.timings.x_res,
                                         display->panel.timings.y_res);
         }
@@ -2608,8 +2595,8 @@ probe_err1:
                 if (ovl->manager && ovl->manager->device)
                         def_display = ovl->manager->device;
 
-                if (def_display)
-                        def_display->disable(def_display);
+                if (def_display && def_display->driver)
+                        def_display->driver->disable(def_display);
         }
 probe_err0:
         kfree(vid_dev);
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index 0a877497b93f..07fabdd9b465 100644
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -267,6 +267,21 @@ hauppauge_tuner[] =
         { TUNER_ABSENT,                 "Xceive XC4000"},
         { TUNER_ABSENT,                 "Dibcom 7070"},
         { TUNER_PHILIPS_TDA8290,        "NXP 18271C2"},
+        { TUNER_ABSENT,                 "unknown"},
+        { TUNER_ABSENT,                 "unknown"},
+        { TUNER_ABSENT,                 "unknown"},
+        { TUNER_ABSENT,                 "unknown"},
+        /* 160-169 */
+        { TUNER_ABSENT,                 "unknown"},
+        { TUNER_ABSENT,                 "unknown"},
+        { TUNER_ABSENT,                 "unknown"},
+        { TUNER_ABSENT,                 "unknown"},
+        { TUNER_ABSENT,                 "unknown"},
+        { TUNER_ABSENT,                 "unknown"},
+        { TUNER_ABSENT,                 "unknown"},
+        { TUNER_ABSENT,                 "unknown"},
+        { TUNER_PHILIPS_FQ1236_MK5,     "TCL M30WTP-4N-E"},
+        { TUNER_ABSENT,                 "unknown"},
 };
 
 /* Use V4L2_IDENT_AMBIGUOUS for those audio 'chips' that are
diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index aa0720af07a0..27a79f087b15 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -122,8 +122,8 @@ static struct uvc_control_info uvc_ctrls[] = {
                 .selector       = UVC_PU_POWER_LINE_FREQUENCY_CONTROL,
                 .index          = 10,
                 .size           = 1,
-                .flags          = UVC_CONTROL_SET_CUR | UVC_CONTROL_GET_RANGE
-                                | UVC_CONTROL_RESTORE,
+                .flags          = UVC_CONTROL_SET_CUR | UVC_CONTROL_GET_CUR
+                                | UVC_CONTROL_GET_DEF | UVC_CONTROL_RESTORE,
         },
         {
                 .entity         = UVC_GUID_UVC_PROCESSING,
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index e171e77f6129..f06d06e7fdfa 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -249,7 +249,7 @@ config MMC_IMX
 
 config MMC_MSM7X00A
         tristate "Qualcomm MSM 7X00A SDCC Controller Support"
-        depends on MMC && ARCH_MSM
+        depends on MMC && ARCH_MSM && !ARCH_MSM7X30
         help
           This provides support for the SD/MMC cell found in the
           MSM 7X00A controllers from Qualcomm.
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 000d65ea55a4..91c8013cf0d9 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -404,14 +404,9 @@ static int mtd_do_writeoob(struct file *file, struct mtd_info *mtd,
         if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
                 return -EINVAL;
 
-        ops.oobbuf = kmalloc(length, GFP_KERNEL);
-        if (!ops.oobbuf)
-                return -ENOMEM;
-
-        if (copy_from_user(ops.oobbuf, ptr, length)) {
-                kfree(ops.oobbuf);
-                return -EFAULT;
-        }
+        ops.oobbuf = memdup_user(ptr, length);
+        if (IS_ERR(ops.oobbuf))
+                return PTR_ERR(ops.oobbuf);
 
         start &= ~((uint64_t)mtd->oobsize - 1);
         ret = mtd->write_oob(mtd, start, &ops);
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 98a04b3c9526..ffc3720929f1 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -1,13 +1,3 @@
-menuconfig MTD_NAND
-        tristate "NAND Device Support"
-        depends on MTD
-        select MTD_NAND_IDS
-        select MTD_NAND_ECC
-        help
-          This enables support for accessing all type of NAND flash
-          devices. For further information see
-          <http://www.linux-mtd.infradead.org/doc/nand.html>.
-
 config MTD_NAND_ECC
         tristate
 
@@ -19,6 +9,17 @@ config MTD_NAND_ECC_SMC
           Software ECC according to the Smart Media Specification.
           The original Linux implementation had byte 0 and 1 swapped.
 
+
+menuconfig MTD_NAND
+        tristate "NAND Device Support"
+        depends on MTD
+        select MTD_NAND_IDS
+        select MTD_NAND_ECC
+        help
+          This enables support for accessing all type of NAND flash
+          devices. For further information see
+          <http://www.linux-mtd.infradead.org/doc/nand.html>.
+
 if MTD_NAND
 
 config MTD_NAND_VERIFY_WRITE
diff --git a/drivers/mtd/nand/r852.c b/drivers/mtd/nand/r852.c
index 78a423295474..bcfc851fe550 100644
--- a/drivers/mtd/nand/r852.c
+++ b/drivers/mtd/nand/r852.c
@@ -150,7 +150,6 @@ static void r852_dma_done(struct r852_device *dev, int error)
         if (dev->phys_dma_addr && dev->phys_dma_addr != dev->phys_bounce_buffer)
                 pci_unmap_single(dev->pci_dev, dev->phys_dma_addr, R852_DMA_LEN,
                         dev->dma_dir ? PCI_DMA_FROMDEVICE : PCI_DMA_TODEVICE);
-        complete(&dev->dma_done);
 }
 
 /*
@@ -182,6 +181,7 @@ static void r852_do_dma(struct r852_device *dev, uint8_t *buf, int do_read)
         /* Set dma direction */
         dev->dma_dir = do_read;
         dev->dma_stage = 1;
+        INIT_COMPLETION(dev->dma_done);
 
         dbg_verbose("doing dma %s ", do_read ? "read" : "write");
 
@@ -494,6 +494,11 @@ int r852_ecc_correct(struct mtd_info *mtd, uint8_t *dat,
         if (dev->card_unstable)
                 return 0;
 
+        if (dev->dma_error) {
+                dev->dma_error = 0;
+                return -1;
+        }
+
         r852_write_reg(dev, R852_CTL, dev->ctlreg | R852_CTL_ECC_ACCESS);
         ecc_reg = r852_read_reg_dword(dev, R852_DATALINE);
         r852_write_reg(dev, R852_CTL, dev->ctlreg);
@@ -707,6 +712,7 @@ void r852_card_detect_work(struct work_struct *work)
                 container_of(work, struct r852_device, card_detect_work.work);
 
         r852_card_update_present(dev);
+        r852_update_card_detect(dev);
         dev->card_unstable = 0;
 
         /* False alarm */
@@ -722,7 +728,6 @@ void r852_card_detect_work(struct work_struct *work)
         else
                 r852_unregister_nand_device(dev);
 exit:
-        /* Update detection logic */
         r852_update_card_detect(dev);
 }
 
@@ -796,6 +801,7 @@ static irqreturn_t r852_irq(int irq, void *data)
                 if (dma_status & R852_DMA_IRQ_ERROR) {
                         dbg("recieved dma error IRQ");
                         r852_dma_done(dev, -EIO);
+                        complete(&dev->dma_done);
                         goto out;
                 }
 
@@ -825,8 +831,10 @@ static irqreturn_t r852_irq(int irq, void *data)
                         r852_dma_enable(dev);
 
                 /* Operation done */
-                if (dev->dma_stage == 3)
+                if (dev->dma_stage == 3) {
                         r852_dma_done(dev, 0);
+                        complete(&dev->dma_done);
+                }
                 goto out;
         }
 
@@ -940,18 +948,19 @@ int  r852_probe(struct pci_dev *pci_dev, const struct pci_device_id *id)
 
         r852_dma_test(dev);
 
+        dev->irq = pci_dev->irq;
+        spin_lock_init(&dev->irqlock);
+
+        dev->card_detected = 0;
+        r852_card_update_present(dev);
+
         /*register irq handler*/
         error = -ENODEV;
         if (request_irq(pci_dev->irq, &r852_irq, IRQF_SHARED,
                           DRV_NAME, dev))
                 goto error10;
 
-        dev->irq = pci_dev->irq;
-        spin_lock_init(&dev->irqlock);
-
         /* kick initial present test */
-        dev->card_detected = 0;
-        r852_card_update_present(dev);
         queue_delayed_work(dev->card_workqueue,
                 &dev->card_detect_work, 0);
 
@@ -1081,7 +1090,7 @@ int r852_resume(struct device *device)
                         dev->card_detected ? "added" : "removed");
 
                 queue_delayed_work(dev->card_workqueue,
-                &dev->card_detect_work, 1000);
+                &dev->card_detect_work, msecs_to_jiffies(1000));
                 return 0;
         }
 
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 9c149750e2bf..284a5f4a63ac 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -598,8 +598,8 @@ rx_next:
                         goto rx_status_loop;
 
                 spin_lock_irqsave(&cp->lock, flags);
-                cpw16_f(IntrMask, cp_intr_mask);
                 __napi_complete(napi);
+                cpw16_f(IntrMask, cp_intr_mask);
                 spin_unlock_irqrestore(&cp->lock, flags);
         }
 
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index 4ba72933f0da..97d8068b372b 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -860,6 +860,7 @@ retry:
                 }
 
         /* if unknown chip, assume array element #0, original RTL-8139 in this case */
+        i = 0;
         dev_dbg(&pdev->dev, "unknown chip version, assuming RTL-8139\n");
         dev_dbg(&pdev->dev, "TxConfig = 0x%lx\n", RTL_R32 (TxConfig));
         tp->chipset = 0;
@@ -2088,8 +2089,8 @@ static int rtl8139_poll(struct napi_struct *napi, int budget)
                  * again when we think we are done.
                  */
                 spin_lock_irqsave(&tp->lock, flags);
-                RTL_W16_F(IntrMask, rtl8139_intr_mask);
                 __napi_complete(napi);
+                RTL_W16_F(IntrMask, rtl8139_intr_mask);
                 spin_unlock_irqrestore(&tp->lock, flags);
         }
         spin_unlock(&tp->rx_lock);
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 2decc597bda7..ce2fcdd4ab90 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2754,6 +2754,7 @@ config MYRI10GE_DCA
 config NETXEN_NIC
         tristate "NetXen Multi port (1/10) Gigabit Ethernet NIC"
         depends on PCI
+        select FW_LOADER
         help
           This enables the support for NetXen's Gigabit Ethernet card.
 
@@ -2819,6 +2820,7 @@ config BNX2X
 config QLCNIC
         tristate "QLOGIC QLCNIC 1/10Gb Converged Ethernet NIC Support"
         depends on PCI
+        select FW_LOADER
         help
           This driver supports QLogic QLE8240 and QLE8242 Converged Ethernet
           devices.
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 949d7a9dcf92..117432222a09 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -3073,7 +3073,6 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
         u16 hw_cons, sw_cons, sw_ring_cons, sw_prod, sw_ring_prod;
         struct l2_fhdr *rx_hdr;
         int rx_pkt = 0, pg_ring_used = 0;
-        struct pci_dev *pdev = bp->pdev;
 
         hw_cons = bnx2_get_hw_rx_cons(bnapi);
         sw_cons = rxr->rx_cons;
@@ -3099,12 +3098,10 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
                 skb = rx_buf->skb;
                 prefetchw(skb);
 
-                if (!get_dma_ops(&pdev->dev)->sync_single_for_cpu) {
-                        next_rx_buf =
-                                &rxr->rx_buf_ring[
-                                        RX_RING_IDX(NEXT_RX_BD(sw_cons))];
-                        prefetch(next_rx_buf->desc);
-                }
+                next_rx_buf =
+                        &rxr->rx_buf_ring[RX_RING_IDX(NEXT_RX_BD(sw_cons))];
+                prefetch(next_rx_buf->desc);
+
                 rx_buf->skb = NULL;
 
                 dma_addr = dma_unmap_addr(rx_buf, mapping);
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 40fdc41446cc..df483076eda6 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -340,7 +340,8 @@ static void rlb_update_entry_from_arp(struct bonding *bond, struct arp_pkt *arp)
 
         if ((client_info->assigned) &&
             (client_info->ip_src == arp->ip_dst) &&
-            (client_info->ip_dst == arp->ip_src)) {
+            (client_info->ip_dst == arp->ip_src) &&
+            (compare_ether_addr_64bits(client_info->mac_dst, arp->mac_src))) {
                 /* update the clients MAC address */
                 memcpy(client_info->mac_dst, arp->mac_src, ETH_ALEN);
                 client_info->ntt = 1;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 5e12462a9d5e..c3d98dde2f86 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -168,7 +168,7 @@ static int arp_ip_count;
 static int bond_mode    = BOND_MODE_ROUNDROBIN;
 static int xmit_hashtype = BOND_XMIT_POLICY_LAYER2;
 static int lacp_fast;
-
+static int disable_netpoll = 1;
 
 const struct bond_parm_tbl bond_lacp_tbl[] = {
 {       "slow",         AD_LACP_SLOW},
@@ -1742,15 +1742,23 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
         bond_set_carrier(bond);
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        if (slaves_support_netpoll(bond_dev)) {
-                bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
-                if (bond_dev->npinfo)
-                        slave_dev->npinfo = bond_dev->npinfo;
-        } else if (!(bond_dev->priv_flags & IFF_DISABLE_NETPOLL)) {
+        /*
+         * Netpoll and bonding is broken, make sure it is not initialized
+         * until it is fixed.
+         */
+        if (disable_netpoll) {
                 bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
-                pr_info("New slave device %s does not support netpoll\n",
-                        slave_dev->name);
-                pr_info("Disabling netpoll support for %s\n", bond_dev->name);
+        } else {
+                if (slaves_support_netpoll(bond_dev)) {
+                        bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
+                        if (bond_dev->npinfo)
+                                slave_dev->npinfo = bond_dev->npinfo;
+                } else if (!(bond_dev->priv_flags & IFF_DISABLE_NETPOLL)) {
+                        bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
+                        pr_info("New slave device %s does not support netpoll\n",
+                                slave_dev->name);
+                        pr_info("Disabling netpoll support for %s\n", bond_dev->name);
+                }
         }
 #endif
         read_unlock(&bond->lock);
@@ -1950,8 +1958,11 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
         read_lock_bh(&bond->lock);
-        if (slaves_support_netpoll(bond_dev))
-                bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
+
+         /* Make sure netpoll over stays disabled until fixed. */
+        if (!disable_netpoll)
+                if (slaves_support_netpoll(bond_dev))
+                                bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
         read_unlock_bh(&bond->lock);
         if (slave_dev->netdev_ops->ndo_netpoll_cleanup)
                 slave_dev->netdev_ops->ndo_netpoll_cleanup(slave_dev);
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index fe925663d39a..80471269977a 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -3919,8 +3919,9 @@ static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev)
                 HC_INDEX_DEF_C_ETH_ISCSI_CQ_CONS;
         context->cstorm_st_context.status_block_id = BNX2X_DEF_SB_ID;
 
-        context->xstorm_st_context.statistics_data = (cli |
-                                XSTORM_ETH_ST_CONTEXT_STATISTICS_ENABLE);
+        if (cli < MAX_X_STAT_COUNTER_ID)
+                context->xstorm_st_context.statistics_data = cli |
+                                XSTORM_ETH_ST_CONTEXT_STATISTICS_ENABLE;
 
         context->xstorm_ag_context.cdu_reserved =
                 CDU_RSRVD_VALUE_TYPE_A(BNX2X_HW_CID(BNX2X_ISCSI_L2_CID, func),
@@ -3928,10 +3929,12 @@ static void cnic_init_bnx2x_tx_ring(struct cnic_dev *dev)
                                         ETH_CONNECTION_TYPE);
 
         /* reset xstorm per client statistics */
-        val = BAR_XSTRORM_INTMEM +
-              XSTORM_PER_COUNTER_ID_STATS_OFFSET(port, cli);
-        for (i = 0; i < sizeof(struct xstorm_per_client_stats) / 4; i++)
-                CNIC_WR(dev, val + i * 4, 0);
+        if (cli < MAX_X_STAT_COUNTER_ID) {
+                val = BAR_XSTRORM_INTMEM +
+                      XSTORM_PER_COUNTER_ID_STATS_OFFSET(port, cli);
+                for (i = 0; i < sizeof(struct xstorm_per_client_stats) / 4; i++)
+                        CNIC_WR(dev, val + i * 4, 0);
+        }
 
         cp->tx_cons_ptr =
                 &cp->bnx2x_def_status_blk->c_def_status_block.index_values[
@@ -3978,9 +3981,11 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev)
                                                 BNX2X_ISCSI_RX_SB_INDEX_NUM;
         context->ustorm_st_context.common.clientId = cli;
         context->ustorm_st_context.common.status_block_id = BNX2X_DEF_SB_ID;
-        context->ustorm_st_context.common.flags =
-                USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_STATISTICS;
-        context->ustorm_st_context.common.statistics_counter_id = cli;
+        if (cli < MAX_U_STAT_COUNTER_ID) {
+                context->ustorm_st_context.common.flags =
+                        USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_STATISTICS;
+                context->ustorm_st_context.common.statistics_counter_id = cli;
+        }
         context->ustorm_st_context.common.mc_alignment_log_size = 0;
         context->ustorm_st_context.common.bd_buff_size =
                                                 cp->l2_single_buf_size;
@@ -4011,10 +4016,13 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev)
 
         /* client tstorm info */
         tstorm_client.mtu = cp->l2_single_buf_size - 14;
-        tstorm_client.config_flags =
-                        (TSTORM_ETH_CLIENT_CONFIG_E1HOV_REM_ENABLE |
-                        TSTORM_ETH_CLIENT_CONFIG_STATSITICS_ENABLE);
-        tstorm_client.statistics_counter_id = cli;
+        tstorm_client.config_flags = TSTORM_ETH_CLIENT_CONFIG_E1HOV_REM_ENABLE;
+
+        if (cli < MAX_T_STAT_COUNTER_ID) {
+                tstorm_client.config_flags |=
+                                TSTORM_ETH_CLIENT_CONFIG_STATSITICS_ENABLE;
+                tstorm_client.statistics_counter_id = cli;
+        }
 
         CNIC_WR(dev, BAR_TSTRORM_INTMEM +
                    TSTORM_CLIENT_CONFIG_OFFSET(port, cli),
@@ -4024,16 +4032,21 @@ static void cnic_init_bnx2x_rx_ring(struct cnic_dev *dev)
                    ((u32 *)&tstorm_client)[1]);
 
         /* reset tstorm per client statistics */
-        val = BAR_TSTRORM_INTMEM +
-              TSTORM_PER_COUNTER_ID_STATS_OFFSET(port, cli);
-        for (i = 0; i < sizeof(struct tstorm_per_client_stats) / 4; i++)
-                CNIC_WR(dev, val + i * 4, 0);
+        if (cli < MAX_T_STAT_COUNTER_ID) {
+
+                val = BAR_TSTRORM_INTMEM +
+                      TSTORM_PER_COUNTER_ID_STATS_OFFSET(port, cli);
+                for (i = 0; i < sizeof(struct tstorm_per_client_stats) / 4; i++)
+                        CNIC_WR(dev, val + i * 4, 0);
+        }
 
         /* reset ustorm per client statistics */
-        val = BAR_USTRORM_INTMEM +
-              USTORM_PER_COUNTER_ID_STATS_OFFSET(port, cli);
-        for (i = 0; i < sizeof(struct ustorm_per_client_stats) / 4; i++)
-                CNIC_WR(dev, val + i * 4, 0);
+        if (cli < MAX_U_STAT_COUNTER_ID) {
+                val = BAR_USTRORM_INTMEM +
+                      USTORM_PER_COUNTER_ID_STATS_OFFSET(port, cli);
+                for (i = 0; i < sizeof(struct ustorm_per_client_stats) / 4; i++)
+                        CNIC_WR(dev, val + i * 4, 0);
+        }
 
         cp->rx_cons_ptr =
                 &cp->bnx2x_def_status_blk->u_def_status_block.index_values[
diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
index 3c58db595285..23786ee34bed 100644
--- a/drivers/net/cpmac.c
+++ b/drivers/net/cpmac.c
@@ -1181,7 +1181,8 @@ static int __devinit cpmac_probe(struct platform_device *pdev)
                 if (netif_msg_drv(priv))
                         printk(KERN_ERR "%s: Could not attach to PHY\n",
                                dev->name);
-                return PTR_ERR(priv->phy);
+                rc = PTR_ERR(priv->phy);
+                goto fail;
         }
 
         if ((rc = register_netdev(dev))) {
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index ebdea0891665..68a80893dce1 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -1047,15 +1047,14 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
                 goto err_register;
 
         /* print bus type/speed/width info */
-        e_info("(PCI%s:%s:%s) ",
-                ((hw->bus_type == e1000_bus_type_pcix) ? "-X" : ""),
-                ((hw->bus_speed == e1000_bus_speed_133) ? "133MHz" :
-                 (hw->bus_speed == e1000_bus_speed_120) ? "120MHz" :
-                 (hw->bus_speed == e1000_bus_speed_100) ? "100MHz" :
-                 (hw->bus_speed == e1000_bus_speed_66) ? "66MHz" : "33MHz"),
-                ((hw->bus_width == e1000_bus_width_64) ? "64-bit" : "32-bit"));
-
-        e_info("%pM\n", netdev->dev_addr);
+        e_info("(PCI%s:%dMHz:%d-bit) %pM\n",
+               ((hw->bus_type == e1000_bus_type_pcix) ? "-X" : ""),
+               ((hw->bus_speed == e1000_bus_speed_133) ? 133 :
+                (hw->bus_speed == e1000_bus_speed_120) ? 120 :
+                (hw->bus_speed == e1000_bus_speed_100) ? 100 :
+                (hw->bus_speed == e1000_bus_speed_66) ? 66 : 33),
+               ((hw->bus_width == e1000_bus_width_64) ? 64 : 32),
+               netdev->dev_addr);
 
         /* carrier off reporting is important to ethtool even BEFORE open */
         netif_carrier_off(netdev);
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 0630980a2722..0060e422f171 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0103"
+#define DRV_VERSION     "EHEA_0105"
 
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index f547894ff48f..8b92acb448c2 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -867,6 +867,7 @@ static int ehea_poll(struct napi_struct *napi, int budget)
                 ehea_reset_cq_ep(pr->send_cq);
                 ehea_reset_cq_n1(pr->recv_cq);
                 ehea_reset_cq_n1(pr->send_cq);
+                rmb();
                 cqe = ehea_poll_rq1(pr->qp, &wqe_index);
                 cqe_skb = ehea_poll_cq(pr->send_cq);
 
@@ -2859,6 +2860,7 @@ static void ehea_reset_port(struct work_struct *work)
                 container_of(work, struct ehea_port, reset_task);
         struct net_device *dev = port->netdev;
 
+        mutex_lock(&dlpar_mem_lock);
         port->resets++;
         mutex_lock(&port->port_lock);
         netif_stop_queue(dev);
@@ -2881,6 +2883,7 @@ static void ehea_reset_port(struct work_struct *work)
         netif_wake_queue(dev);
 out:
         mutex_unlock(&port->port_lock);
+        mutex_unlock(&dlpar_mem_lock);
 }
 
 static void ehea_rereg_mrs(struct work_struct *work)
@@ -3542,10 +3545,7 @@ static int ehea_mem_notifier(struct notifier_block *nb,
         int ret = NOTIFY_BAD;
         struct memory_notify *arg = data;
 
-        if (!mutex_trylock(&dlpar_mem_lock)) {
-                ehea_info("ehea_mem_notifier must not be called parallelized");
-                goto out;
-        }
+        mutex_lock(&dlpar_mem_lock);
 
         switch (action) {
         case MEM_CANCEL_OFFLINE:
@@ -3574,7 +3574,6 @@ static int ehea_mem_notifier(struct notifier_block *nb,
 
 out_unlock:
         mutex_unlock(&dlpar_mem_lock);
-out:
         return ret;
 }
 
diff --git a/drivers/net/enic/vnic_dev.c b/drivers/net/enic/vnic_dev.c
index 2b3e16db5c82..e0d33281ec98 100644
--- a/drivers/net/enic/vnic_dev.c
+++ b/drivers/net/enic/vnic_dev.c
@@ -709,7 +709,7 @@ int vnic_dev_init_prov(struct vnic_dev *vdev, u8 *buf, u32 len)
 {
         u64 a0, a1 = len;
         int wait = 1000;
-        u64 prov_pa;
+        dma_addr_t prov_pa;
         void *prov_buf;
         int ret;
 
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 1830f3199cb5..28b53d1cd4f1 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -381,10 +381,14 @@ static void gfar_init_mac(struct net_device *ndev)
         /* Insert receive time stamps into padding alignment bytes */
         if (priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER) {
                 rctrl &= ~RCTRL_PAL_MASK;
-                rctrl |= RCTRL_PRSDEP_INIT | RCTRL_TS_ENABLE | RCTRL_PADDING(8);
+                rctrl |= RCTRL_PADDING(8);
                 priv->padding = 8;
         }
 
+        /* Enable HW time stamping if requested from user space */
+        if (priv->hwts_rx_en)
+                rctrl |= RCTRL_PRSDEP_INIT | RCTRL_TS_ENABLE;
+
         /* keep vlan related bits if it's enabled */
         if (priv->vlgrp) {
                 rctrl |= RCTRL_VLEX | RCTRL_PRSDEP_INIT;
@@ -806,12 +810,20 @@ static int gfar_hwtstamp_ioctl(struct net_device *netdev,
 
         switch (config.rx_filter) {
         case HWTSTAMP_FILTER_NONE:
-                priv->hwts_rx_en = 0;
+                if (priv->hwts_rx_en) {
+                        stop_gfar(netdev);
+                        priv->hwts_rx_en = 0;
+                        startup_gfar(netdev);
+                }
                 break;
         default:
                 if (!(priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER))
                         return -ERANGE;
-                priv->hwts_rx_en = 1;
+                if (!priv->hwts_rx_en) {
+                        stop_gfar(netdev);
+                        priv->hwts_rx_en = 1;
+                        startup_gfar(netdev);
+                }
                 config.rx_filter = HWTSTAMP_FILTER_ALL;
                 break;
         }
@@ -2643,6 +2655,10 @@ int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, int rx_work_limit)
                 dma_unmap_single(&priv->ofdev->dev, bdp->bufPtr,
                                 priv->rx_buffer_size, DMA_FROM_DEVICE);
 
+                if (unlikely(!(bdp->status & RXBD_ERR) &&
+                                bdp->length > priv->rx_buffer_size))
+                        bdp->status = RXBD_LARGE;
+
                 /* We drop the frame if we failed to allocate a new buffer */
                 if (unlikely(!newskb || !(bdp->status & RXBD_LAST) ||
                                  bdp->status & RXBD_ERR)) {
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index c50a7541ffec..3a93a81872b8 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -2077,25 +2077,6 @@ static int ixgbe_get_coalesce(struct net_device *netdev,
         return 0;
 }
 
-/*
- * this function must be called before setting the new value of
- * rx_itr_setting
- */
-static bool ixgbe_reenable_rsc(struct ixgbe_adapter *adapter,
-                               struct ethtool_coalesce *ec)
-{
-        /* check the old value and enable RSC if necessary */
-        if ((adapter->rx_itr_setting == 0) &&
-            (adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE)) {
-                adapter->flags2 |= IXGBE_FLAG2_RSC_ENABLED;
-                adapter->netdev->features |= NETIF_F_LRO;
-                DPRINTK(PROBE, INFO, "rx-usecs set to %d, re-enabling RSC\n",
-                        ec->rx_coalesce_usecs);
-                return true;
-        }
-        return false;
-}
-
 static int ixgbe_set_coalesce(struct net_device *netdev,
                               struct ethtool_coalesce *ec)
 {
@@ -2124,9 +2105,6 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                     (1000000/ec->rx_coalesce_usecs < IXGBE_MIN_INT_RATE))
                         return -EINVAL;
 
-                /* check the old value and enable RSC if necessary */
-                need_reset = ixgbe_reenable_rsc(adapter, ec);
-
                 /* store the value in ints/second */
                 adapter->rx_eitr_param = 1000000/ec->rx_coalesce_usecs;
 
@@ -2135,9 +2113,6 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                 /* clear the lower bit as its used for dynamic state */
                 adapter->rx_itr_setting &= ~1;
         } else if (ec->rx_coalesce_usecs == 1) {
-                /* check the old value and enable RSC if necessary */
-                need_reset = ixgbe_reenable_rsc(adapter, ec);
-
                 /* 1 means dynamic mode */
                 adapter->rx_eitr_param = 20000;
                 adapter->rx_itr_setting = 1;
@@ -2157,10 +2132,11 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                  */
                 if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                         adapter->flags2 &= ~IXGBE_FLAG2_RSC_ENABLED;
-                        netdev->features &= ~NETIF_F_LRO;
-                        DPRINTK(PROBE, INFO,
-                                "rx-usecs set to 0, disabling RSC\n");
-
+                        if (netdev->features & NETIF_F_LRO) {
+                                netdev->features &= ~NETIF_F_LRO;
+                                DPRINTK(PROBE, INFO, "rx-usecs set to 0, "
+                                        "disabling LRO/RSC\n");
+                        }
                         need_reset = true;
                 }
         }
@@ -2255,6 +2231,9 @@ static int ixgbe_set_flags(struct net_device *netdev, u32 data)
                         }
                 } else if (!adapter->rx_itr_setting) {
                         netdev->features &= ~ETH_FLAG_LRO;
+                        if (data & ETH_FLAG_LRO)
+                                DPRINTK(PROBE, INFO, "rx-usecs set to 0, "
+                                        "LRO/RSC cannot be enabled.\n");
                 }
         }
 
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index b2af2f67f604..7b5d9764f317 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -3684,10 +3684,6 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
         /* signal that we are down to the interrupt handler */
         set_bit(__IXGBE_DOWN, &adapter->state);
 
-        /* power down the optics */
-        if (hw->phy.multispeed_fiber)
-                hw->mac.ops.disable_tx_laser(hw);
-
         /* disable receive for all VFs and wait one second */
         if (adapter->num_vfs) {
                 /* ping all the active vfs to let them know we are going down */
@@ -3742,6 +3738,10 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
                                 (IXGBE_READ_REG(hw, IXGBE_DMATXCTL) &
                                  ~IXGBE_DMATXCTL_TE));
 
+        /* power down the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.disable_tx_laser(hw);
+
         /* clear n-tuple filters that are cached */
         ethtool_ntuple_flush(netdev);
 
@@ -4001,7 +4001,7 @@ static void ixgbe_set_num_queues(struct ixgbe_adapter *adapter)
 
 done:
         /* Notify the stack of the (possibly) reduced Tx Queue count. */
-        adapter->netdev->real_num_tx_queues = adapter->num_tx_queues;
+        netif_set_real_num_tx_queues(adapter->netdev, adapter->num_tx_queues);
 }
 
 static void ixgbe_acquire_msix_vectors(struct ixgbe_adapter *adapter,
@@ -5195,7 +5195,6 @@ static int __ixgbe_shutdown(struct pci_dev *pdev, bool *enable_wake)
                 ixgbe_free_all_tx_resources(adapter);
                 ixgbe_free_all_rx_resources(adapter);
         }
-        ixgbe_clear_interrupt_scheme(adapter);
 
 #ifdef CONFIG_PM
         retval = pci_save_state(pdev);
@@ -5230,6 +5229,8 @@ static int __ixgbe_shutdown(struct pci_dev *pdev, bool *enable_wake)
 
         *enable_wake = !!wufc;
 
+        ixgbe_clear_interrupt_scheme(adapter);
+
         ixgbe_release_hw_control(adapter);
 
         pci_disable_device(pdev);
@@ -5282,6 +5283,10 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
         u32 i, missed_rx = 0, mpc, bprc, lxon, lxoff, xon_off_tot;
         u64 non_eop_descs = 0, restart_queue = 0;
 
+        if (test_bit(__IXGBE_DOWN, &adapter->state) ||
+            test_bit(__IXGBE_RESETTING, &adapter->state))
+                return;
+
         if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                 u64 rsc_count = 0;
                 u64 rsc_flush = 0;
@@ -6019,7 +6024,6 @@ static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
 static void ixgbe_atr(struct ixgbe_adapter *adapter, struct sk_buff *skb,
                       int queue, u32 tx_flags)
 {
-        /* Right now, we support IPv4 only */
         struct ixgbe_atr_input atr_input;
         struct tcphdr *th;
         struct iphdr *iph = ip_hdr(skb);
@@ -6028,6 +6032,9 @@ static void ixgbe_atr(struct ixgbe_adapter *adapter, struct sk_buff *skb,
         u32 src_ipv4_addr, dst_ipv4_addr;
         u8 l4type = 0;
 
+        /* Right now, we support IPv4 only */
+        if (skb->protocol != htons(ETH_P_IP))
+                return;
         /* check if we're UDP or TCP */
         if (iph->protocol == IPPROTO_TCP) {
                 th = tcp_hdr(skb);
diff --git a/drivers/net/ixgbe/ixgbe_phy.c b/drivers/net/ixgbe/ixgbe_phy.c
index 09e1911ff510..48325a5beff2 100644
--- a/drivers/net/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ixgbe/ixgbe_phy.c
@@ -575,6 +575,8 @@ s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw)
                  * 4    SFP_DA_CORE1 - 82599-specific
                  * 5    SFP_SR/LR_CORE0 - 82599-specific
                  * 6    SFP_SR/LR_CORE1 - 82599-specific
+                 * 7    SFP_act_lmt_DA_CORE0 - 82599-specific
+                 * 8    SFP_act_lmt_DA_CORE1 - 82599-specific
                  */
                 if (hw->mac.type == ixgbe_mac_82598EB) {
                         if (cable_tech & IXGBE_SFF_DA_PASSIVE_CABLE)
diff --git a/drivers/net/lib82596.c b/drivers/net/lib82596.c
index ce5d6e909218..c27f4291b350 100644
--- a/drivers/net/lib82596.c
+++ b/drivers/net/lib82596.c
@@ -1343,7 +1343,7 @@ static void set_multicast_list(struct net_device *dev)
         DEB(DEB_MULTI,
             printk(KERN_DEBUG
                    "%s: set multicast list, %d entries, promisc %s, allmulti %s\n",
-                   dev->name, dev->mc_count,
+                   dev->name, netdev_mc_count(dev),
                    dev->flags & IFF_PROMISC ? "ON" : "OFF",
                    dev->flags & IFF_ALLMULTI ? "ON" : "OFF"));
 
diff --git a/drivers/net/ll_temac_main.c b/drivers/net/ll_temac_main.c
index 52dcc8495647..6474c4973d3a 100644
--- a/drivers/net/ll_temac_main.c
+++ b/drivers/net/ll_temac_main.c
@@ -964,7 +964,7 @@ temac_of_probe(struct of_device *op, const struct of_device_id *match)
         np = of_parse_phandle(op->dev.of_node, "llink-connected", 0);
         if (!np) {
                 dev_err(&op->dev, "could not find DMA node\n");
-                goto nodev;
+                goto err_iounmap;
         }
 
         /* Setup the DMA register accesses, could be DCR or memory mapped */
@@ -978,7 +978,7 @@ temac_of_probe(struct of_device *op, const struct of_device_id *match)
                         dev_dbg(&op->dev, "MEM base: %p\n", lp->sdma_regs);
                 } else {
                         dev_err(&op->dev, "unable to map DMA registers\n");
-                        goto nodev;
+                        goto err_iounmap;
                 }
         }
 
@@ -987,7 +987,7 @@ temac_of_probe(struct of_device *op, const struct of_device_id *match)
         if ((lp->rx_irq == NO_IRQ) || (lp->tx_irq == NO_IRQ)) {
                 dev_err(&op->dev, "could not determine irqs\n");
                 rc = -ENOMEM;
-                goto nodev;
+                goto err_iounmap_2;
         }
 
         of_node_put(np); /* Finished with the DMA node; drop the reference */
@@ -997,7 +997,7 @@ temac_of_probe(struct of_device *op, const struct of_device_id *match)
         if ((!addr) || (size != 6)) {
                 dev_err(&op->dev, "could not find MAC address\n");
                 rc = -ENODEV;
-                goto nodev;
+                goto err_iounmap_2;
         }
         temac_set_mac_address(ndev, (void *)addr);
 
@@ -1013,7 +1013,7 @@ temac_of_probe(struct of_device *op, const struct of_device_id *match)
         rc = sysfs_create_group(&lp->dev->kobj, &temac_attr_group);
         if (rc) {
                 dev_err(lp->dev, "Error creating sysfs files\n");
-                goto nodev;
+                goto err_iounmap_2;
         }
 
         rc = register_netdev(lp->ndev);
@@ -1026,6 +1026,11 @@ temac_of_probe(struct of_device *op, const struct of_device_id *match)
 
  err_register_ndev:
         sysfs_remove_group(&lp->dev->kobj, &temac_attr_group);
+ err_iounmap_2:
+        if (lp->sdma_regs)
+                iounmap(lp->sdma_regs);
+ err_iounmap:
+        iounmap(lp->regs);
  nodev:
         free_netdev(ndev);
         ndev = NULL;
@@ -1044,6 +1049,9 @@ static int __devexit temac_of_remove(struct of_device *op)
                 of_node_put(lp->phy_node);
         lp->phy_node = NULL;
         dev_set_drvdata(&op->dev, NULL);
+        iounmap(lp->regs);
+        if (lp->sdma_regs)
+                iounmap(lp->sdma_regs);
         free_netdev(ndev);
         return 0;
 }
diff --git a/drivers/net/mipsnet.c b/drivers/net/mipsnet.c
index 8e9704f5c122..869f0ea43a5b 100644
--- a/drivers/net/mipsnet.c
+++ b/drivers/net/mipsnet.c
@@ -247,7 +247,7 @@ static const struct net_device_ops mipsnet_netdev_ops = {
         .ndo_set_mac_address    = eth_mac_addr,
 };
 
-static int __init mipsnet_probe(struct platform_device *dev)
+static int __devinit mipsnet_probe(struct platform_device *dev)
 {
         struct net_device *netdev;
         int err;
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index e345ec8cb473..73bb8ea6f54a 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -289,6 +289,7 @@ struct mv643xx_eth_shared_private {
         unsigned int t_clk;
         int extended_rx_coal_limit;
         int tx_bw_control;
+        int tx_csum_limit;
 };
 
 #define TX_BW_CONTROL_ABSENT            0
@@ -776,13 +777,16 @@ static int txq_submit_skb(struct tx_queue *txq, struct sk_buff *skb)
         l4i_chk = 0;
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                int hdr_len;
                 int tag_bytes;
 
                 BUG_ON(skb->protocol != htons(ETH_P_IP) &&
                        skb->protocol != htons(ETH_P_8021Q));
 
-                tag_bytes = (void *)ip_hdr(skb) - (void *)skb->data - ETH_HLEN;
-                if (unlikely(tag_bytes & ~12)) {
+                hdr_len = (void *)ip_hdr(skb) - (void *)skb->data;
+                tag_bytes = hdr_len - ETH_HLEN;
+                if (skb->len - hdr_len > mp->shared->tx_csum_limit ||
+                    unlikely(tag_bytes & ~12)) {
                         if (skb_checksum_help(skb) == 0)
                                 goto no_csum;
                         kfree_skb(skb);
@@ -2666,6 +2670,7 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev)
          * Detect hardware parameters.
          */
         msp->t_clk = (pd != NULL && pd->t_clk != 0) ? pd->t_clk : 133000000;
+        msp->tx_csum_limit = pd->tx_csum_limit ? pd->tx_csum_limit : 9 * 1024;
         infer_hw_params(msp);
 
         platform_set_drvdata(pdev, msp);
diff --git a/drivers/net/ne.c b/drivers/net/ne.c
index b8e2923a1d69..1063093b3afc 100644
--- a/drivers/net/ne.c
+++ b/drivers/net/ne.c
@@ -806,8 +806,10 @@ static int __init ne_drv_probe(struct platform_device *pdev)
                 dev->base_addr = res->start;
                 dev->irq = platform_get_irq(pdev, 0);
         } else {
-                if (this_dev < 0 || this_dev >= MAX_NE_CARDS)
+                if (this_dev < 0 || this_dev >= MAX_NE_CARDS) {
+                        free_netdev(dev);
                         return -EINVAL;
+                }
                 dev->base_addr = io[this_dev];
                 dev->irq = irq[this_dev];
                 dev->mem_end = bad[this_dev];
diff --git a/drivers/net/netxen/netxen_nic_ctx.c b/drivers/net/netxen/netxen_nic_ctx.c
index f26e54716c88..3a41b6a84a68 100644
--- a/drivers/net/netxen/netxen_nic_ctx.c
+++ b/drivers/net/netxen/netxen_nic_ctx.c
@@ -629,7 +629,8 @@ int netxen_alloc_hw_resources(struct netxen_adapter *adapter)
         if (addr == NULL) {
                 dev_err(&pdev->dev, "%s: failed to allocate tx desc ring\n",
                                 netdev->name);
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto err_out_free;
         }
 
         tx_ring->desc_head = (struct cmd_desc_type0 *)addr;
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index 5c496f8d7c49..29d7b93d0493 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -1159,9 +1159,6 @@ netxen_nic_pci_set_crbwindow_2M(struct netxen_adapter *adapter, ulong off)
 
         window = CRB_HI(off);
 
-        if (adapter->ahw.crb_win == window)
-                return;
-
         writel(window, addr);
         if (readl(addr) != window) {
                 if (printk_ratelimit())
@@ -1169,7 +1166,6 @@ netxen_nic_pci_set_crbwindow_2M(struct netxen_adapter *adapter, ulong off)
                                 "failed to set CRB window to %d off 0x%lx\n",
                                 window, off);
         }
-        adapter->ahw.crb_win = window;
 }
 
 static void __iomem *
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 045a7c8f5bdf..c865dda2adf1 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -218,7 +218,7 @@ int netxen_alloc_sw_resources(struct netxen_adapter *adapter)
         if (cmd_buf_arr == NULL) {
                 dev_err(&pdev->dev, "%s: failed to allocate cmd buffer ring\n",
                        netdev->name);
-                return -ENOMEM;
+                goto err_out;
         }
         memset(cmd_buf_arr, 0, TX_BUFF_RINGSIZE(tx_ring));
         tx_ring->cmd_buf_arr = cmd_buf_arr;
@@ -230,7 +230,7 @@ int netxen_alloc_sw_resources(struct netxen_adapter *adapter)
         if (rds_ring == NULL) {
                 dev_err(&pdev->dev, "%s: failed to allocate rds ring struct\n",
                        netdev->name);
-                return -ENOMEM;
+                goto err_out;
         }
         recv_ctx->rds_rings = rds_ring;
 
@@ -1805,9 +1805,10 @@ netxen_post_rx_buffers(struct netxen_adapter *adapter, u32 ringid,
         netxen_ctx_msg msg = 0;
         struct list_head *head;
 
+        spin_lock(&rds_ring->lock);
+
         producer = rds_ring->producer;
 
-        spin_lock(&rds_ring->lock);
         head = &rds_ring->free_list;
         while (!list_empty(head)) {
 
@@ -1829,7 +1830,6 @@ netxen_post_rx_buffers(struct netxen_adapter *adapter, u32 ringid,
 
                 producer = get_next_index(producer, rds_ring->num_desc);
         }
-        spin_unlock(&rds_ring->lock);
 
         if (count) {
                 rds_ring->producer = producer;
@@ -1853,6 +1853,8 @@ netxen_post_rx_buffers(struct netxen_adapter *adapter, u32 ringid,
                                         NETXEN_RCV_PRODUCER_OFFSET), msg);
                 }
         }
+
+        spin_unlock(&rds_ring->lock);
 }
 
 static void
@@ -1864,10 +1866,11 @@ netxen_post_rx_buffers_nodb(struct netxen_adapter *adapter,
         int producer, count = 0;
         struct list_head *head;
 
-        producer = rds_ring->producer;
         if (!spin_trylock(&rds_ring->lock))
                 return;
 
+        producer = rds_ring->producer;
+
         head = &rds_ring->free_list;
         while (!list_empty(head)) {
 
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 6f77a768ba88..bfdef72c5d5e 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1727,6 +1727,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(0, "Psion Dacom", "Gold Card V34 Ethernet", 0xf5f025c2, 0x338e8155, "cis/PCMLM28.cis"),
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(0, "Psion Dacom", "Gold Card V34 Ethernet GSM", 0xf5f025c2, 0x4ae85d35, "cis/PCMLM28.cis"),
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(0, "LINKSYS", "PCMLM28", 0xf7cb0b07, 0x66881874, "cis/PCMLM28.cis"),
+        PCMCIA_PFC_DEVICE_CIS_PROD_ID12(0, "TOSHIBA", "Modem/LAN Card", 0xb4585a1a, 0x53f922f8, "cis/PCMLM28.cis"),
         PCMCIA_MFC_DEVICE_CIS_PROD_ID12(0, "DAYNA COMMUNICATIONS", "LAN AND MODEM MULTIFUNCTION", 0x8fdf8f89, 0xdd5ed9e8, "cis/DP83903.cis"),
         PCMCIA_MFC_DEVICE_CIS_PROD_ID4(0, "NSC MF LAN/Modem", 0x58fc6056, "cis/DP83903.cis"),
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(0, 0x0175, 0x0000, "cis/DP83903.cis"),
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index 7b6fe89f9db0..307cd1721e91 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -322,6 +322,7 @@ static int smc91c92_probe(struct pcmcia_device *link)
         return -ENOMEM;
     smc = netdev_priv(dev);
     smc->p_dev = link;
+    link->priv = dev;
 
     spin_lock_init(&smc->lock);
     link->io.NumPorts1 = 16;
@@ -1504,12 +1505,20 @@ irq_done:
         writeb(cor & ~COR_IREQ_ENA, smc->base + MOT_LAN + CISREG_COR);
         writeb(cor, smc->base + MOT_LAN + CISREG_COR);
     }
-#ifdef DOES_NOT_WORK
-    if (smc->base != NULL) { /* Megahertz MFC's */
-        readb(smc->base+MEGAHERTZ_ISR);
-        readb(smc->base+MEGAHERTZ_ISR);
+
+    if ((smc->base != NULL) &&  /* Megahertz MFC's */
+        (smc->manfid == MANFID_MEGAHERTZ) &&
+        (smc->cardid == PRODID_MEGAHERTZ_EM3288)) {
+
+        u_char tmp;
+        tmp = readb(smc->base+MEGAHERTZ_ISR);
+        tmp = readb(smc->base+MEGAHERTZ_ISR);
+
+        /* Retrigger interrupt if needed */
+        writeb(tmp, smc->base + MEGAHERTZ_ISR);
+        writeb(tmp, smc->base + MEGAHERTZ_ISR);
     }
-#endif
+
     spin_unlock(&smc->lock);
     return IRQ_RETVAL(handled);
 }
diff --git a/drivers/net/phy/lxt.c b/drivers/net/phy/lxt.c
index 8ee929b796d8..29c39ff85de5 100644
--- a/drivers/net/phy/lxt.c
+++ b/drivers/net/phy/lxt.c
@@ -53,6 +53,9 @@
 
 #define MII_LXT971_ISR          19  /* Interrupt Status Register */
 
+/* register definitions for the 973 */
+#define MII_LXT973_PCR 16 /* Port Configuration Register */
+#define PCR_FIBER_SELECT 1
 
 MODULE_DESCRIPTION("Intel LXT PHY driver");
 MODULE_AUTHOR("Andy Fleming");
@@ -119,6 +122,33 @@ static int lxt971_config_intr(struct phy_device *phydev)
         return err;
 }
 
+static int lxt973_probe(struct phy_device *phydev)
+{
+        int val = phy_read(phydev, MII_LXT973_PCR);
+
+        if (val & PCR_FIBER_SELECT) {
+                /*
+                 * If fiber is selected, then the only correct setting
+                 * is 100Mbps, full duplex, and auto negotiation off.
+                 */
+                val = phy_read(phydev, MII_BMCR);
+                val |= (BMCR_SPEED100 | BMCR_FULLDPLX);
+                val &= ~BMCR_ANENABLE;
+                phy_write(phydev, MII_BMCR, val);
+                /* Remember that the port is in fiber mode. */
+                phydev->priv = lxt973_probe;
+        } else {
+                phydev->priv = NULL;
+        }
+        return 0;
+}
+
+static int lxt973_config_aneg(struct phy_device *phydev)
+{
+        /* Do nothing if port is in fiber mode. */
+        return phydev->priv ? 0 : genphy_config_aneg(phydev);
+}
+
 static struct phy_driver lxt970_driver = {
         .phy_id         = 0x78100000,
         .name           = "LXT970",
@@ -146,6 +176,18 @@ static struct phy_driver lxt971_driver = {
         .driver         = { .owner = THIS_MODULE,},
 };
 
+static struct phy_driver lxt973_driver = {
+        .phy_id         = 0x00137a10,
+        .name           = "LXT973",
+        .phy_id_mask    = 0xfffffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = 0,
+        .probe          = lxt973_probe,
+        .config_aneg    = lxt973_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
 static int __init lxt_init(void)
 {
         int ret;
@@ -157,9 +199,15 @@ static int __init lxt_init(void)
         ret = phy_driver_register(&lxt971_driver);
         if (ret)
                 goto err2;
+
+        ret = phy_driver_register(&lxt973_driver);
+        if (ret)
+                goto err3;
         return 0;
 
- err2:  
+ err3:
+        phy_driver_unregister(&lxt971_driver);
+ err2:
         phy_driver_unregister(&lxt970_driver);
  err1:
         return ret;
@@ -169,6 +217,7 @@ static void __exit lxt_exit(void)
 {
         phy_driver_unregister(&lxt970_driver);
         phy_driver_unregister(&lxt971_driver);
+        phy_driver_unregister(&lxt973_driver);
 }
 
 module_init(lxt_init);
@@ -177,6 +226,7 @@ module_exit(lxt_exit);
 static struct mdio_device_id lxt_tbl[] = {
         { 0x78100000, 0xfffffff0 },
         { 0x001378e0, 0xfffffff0 },
+        { 0x00137a10, 0xfffffff0 },
         { }
 };
 
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index fa4b24c49f42..d10bcefc0e45 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -4611,8 +4611,7 @@ static void ql_timer(unsigned long data)
                 return;
         }
 
-        qdev->timer.expires = jiffies + (5*HZ);
-        add_timer(&qdev->timer);
+        mod_timer(&qdev->timer, jiffies + (5*HZ));
 }
 
 static int __devinit qlge_probe(struct pci_dev *pdev,
@@ -4713,6 +4712,8 @@ static void ql_eeh_close(struct net_device *ndev)
                 netif_stop_queue(ndev);
         }
 
+        /* Disabling the timer */
+        del_timer_sync(&qdev->timer);
         if (test_bit(QL_ADAPTER_UP, &qdev->flags))
                 cancel_delayed_work_sync(&qdev->asic_reset_work);
         cancel_delayed_work_sync(&qdev->mpi_reset_work);
@@ -4808,8 +4809,7 @@ static void qlge_io_resume(struct pci_dev *pdev)
                 netif_err(qdev, ifup, qdev->ndev,
                           "Device was not running prior to EEH.\n");
         }
-        qdev->timer.expires = jiffies + (5*HZ);
-        add_timer(&qdev->timer);
+        mod_timer(&qdev->timer, jiffies + (5*HZ));
         netif_device_attach(ndev);
 }
 
@@ -4871,8 +4871,7 @@ static int qlge_resume(struct pci_dev *pdev)
                         return err;
         }
 
-        qdev->timer.expires = jiffies + (5*HZ);
-        add_timer(&qdev->timer);
+        mod_timer(&qdev->timer, jiffies + (5*HZ));
         netif_device_attach(ndev);
 
         return 0;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 217e709bda3e..96b6cfbf0a3a 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -559,6 +559,11 @@ static void mdio_write(void __iomem *ioaddr, int reg_addr, int value)
                         break;
                 udelay(25);
         }
+        /*
+         * According to hardware specs a 20us delay is required after write
+         * complete indication, but before sending next command.
+         */
+        udelay(20);
 }
 
 static int mdio_read(void __iomem *ioaddr, int reg_addr)
@@ -578,6 +583,12 @@ static int mdio_read(void __iomem *ioaddr, int reg_addr)
                 }
                 udelay(25);
         }
+        /*
+         * According to hardware specs a 20us delay is required after read
+         * complete indication, but before sending next command.
+         */
+        udelay(20);
+
         return value;
 }
 
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 668327ccd8d0..1d37f0c310ca 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -3130,7 +3130,6 @@ static void tx_intr_handler(struct fifo_info *fifo_data)
                 pkt_cnt++;
 
                 /* Updating the statistics block */
-                nic->dev->stats.tx_bytes += skb->len;
                 swstats->mem_freed += skb->truesize;
                 dev_kfree_skb_irq(skb);
 
@@ -4901,48 +4900,81 @@ static void s2io_updt_stats(struct s2io_nic *sp)
  *  Return value:
  *  pointer to the updated net_device_stats structure.
  */
-
 static struct net_device_stats *s2io_get_stats(struct net_device *dev)
 {
         struct s2io_nic *sp = netdev_priv(dev);
-        struct config_param *config = &sp->config;
         struct mac_info *mac_control = &sp->mac_control;
         struct stat_block *stats = mac_control->stats_info;
-        int i;
+        u64 delta;
 
         /* Configure Stats for immediate updt */
         s2io_updt_stats(sp);
 
-        /* Using sp->stats as a staging area, because reset (due to mtu
-           change, for example) will clear some hardware counters */
-        dev->stats.tx_packets += le32_to_cpu(stats->tmac_frms) -
-                sp->stats.tx_packets;
-        sp->stats.tx_packets = le32_to_cpu(stats->tmac_frms);
-
-        dev->stats.tx_errors += le32_to_cpu(stats->tmac_any_err_frms) -
-                sp->stats.tx_errors;
-        sp->stats.tx_errors = le32_to_cpu(stats->tmac_any_err_frms);
-
-        dev->stats.rx_errors += le64_to_cpu(stats->rmac_drop_frms) -
-                sp->stats.rx_errors;
-        sp->stats.rx_errors = le64_to_cpu(stats->rmac_drop_frms);
-
-        dev->stats.multicast = le32_to_cpu(stats->rmac_vld_mcst_frms) -
-                sp->stats.multicast;
-        sp->stats.multicast = le32_to_cpu(stats->rmac_vld_mcst_frms);
-
-        dev->stats.rx_length_errors = le64_to_cpu(stats->rmac_long_frms) -
-                sp->stats.rx_length_errors;
-        sp->stats.rx_length_errors = le64_to_cpu(stats->rmac_long_frms);
+        /* A device reset will cause the on-adapter statistics to be zero'ed.
+         * This can be done while running by changing the MTU.  To prevent the
+         * system from having the stats zero'ed, the driver keeps a copy of the
+         * last update to the system (which is also zero'ed on reset).  This
+         * enables the driver to accurately know the delta between the last
+         * update and the current update.
+         */
+        delta = ((u64) le32_to_cpu(stats->rmac_vld_frms_oflow) << 32 |
+                le32_to_cpu(stats->rmac_vld_frms)) - sp->stats.rx_packets;
+        sp->stats.rx_packets += delta;
+        dev->stats.rx_packets += delta;
+
+        delta = ((u64) le32_to_cpu(stats->tmac_frms_oflow) << 32 |
+                le32_to_cpu(stats->tmac_frms)) - sp->stats.tx_packets;
+        sp->stats.tx_packets += delta;
+        dev->stats.tx_packets += delta;
+
+        delta = ((u64) le32_to_cpu(stats->rmac_data_octets_oflow) << 32 |
+                le32_to_cpu(stats->rmac_data_octets)) - sp->stats.rx_bytes;
+        sp->stats.rx_bytes += delta;
+        dev->stats.rx_bytes += delta;
+
+        delta = ((u64) le32_to_cpu(stats->tmac_data_octets_oflow) << 32 |
+                le32_to_cpu(stats->tmac_data_octets)) - sp->stats.tx_bytes;
+        sp->stats.tx_bytes += delta;
+        dev->stats.tx_bytes += delta;
+
+        delta = le64_to_cpu(stats->rmac_drop_frms) - sp->stats.rx_errors;
+        sp->stats.rx_errors += delta;
+        dev->stats.rx_errors += delta;
+
+        delta = ((u64) le32_to_cpu(stats->tmac_any_err_frms_oflow) << 32 |
+                le32_to_cpu(stats->tmac_any_err_frms)) - sp->stats.tx_errors;
+        sp->stats.tx_errors += delta;
+        dev->stats.tx_errors += delta;
+
+        delta = le64_to_cpu(stats->rmac_drop_frms) - sp->stats.rx_dropped;
+        sp->stats.rx_dropped += delta;
+        dev->stats.rx_dropped += delta;
+
+        delta = le64_to_cpu(stats->tmac_drop_frms) - sp->stats.tx_dropped;
+        sp->stats.tx_dropped += delta;
+        dev->stats.tx_dropped += delta;
+
+        /* The adapter MAC interprets pause frames as multicast packets, but
+         * does not pass them up.  This erroneously increases the multicast
+         * packet count and needs to be deducted when the multicast frame count
+         * is queried.
+         */
+        delta = (u64) le32_to_cpu(stats->rmac_vld_mcst_frms_oflow) << 32 |
+                le32_to_cpu(stats->rmac_vld_mcst_frms);
+        delta -= le64_to_cpu(stats->rmac_pause_ctrl_frms);
+        delta -= sp->stats.multicast;
+        sp->stats.multicast += delta;
+        dev->stats.multicast += delta;
 
-        /* collect per-ring rx_packets and rx_bytes */
-        dev->stats.rx_packets = dev->stats.rx_bytes = 0;
-        for (i = 0; i < config->rx_ring_num; i++) {
-                struct ring_info *ring = &mac_control->rings[i];
+        delta = ((u64) le32_to_cpu(stats->rmac_usized_frms_oflow) << 32 |
+                le32_to_cpu(stats->rmac_usized_frms)) +
+                le64_to_cpu(stats->rmac_long_frms) - sp->stats.rx_length_errors;
+        sp->stats.rx_length_errors += delta;
+        dev->stats.rx_length_errors += delta;
 
-                dev->stats.rx_packets += ring->rx_packets;
-                dev->stats.rx_bytes += ring->rx_bytes;
-        }
+        delta = le64_to_cpu(stats->rmac_fcs_err_frms) - sp->stats.rx_crc_errors;
+        sp->stats.rx_crc_errors += delta;
+        dev->stats.rx_crc_errors += delta;
 
         return &dev->stats;
 }
@@ -7455,15 +7487,11 @@ static int rx_osm_handler(struct ring_info *ring_data, struct RxD_t * rxdp)
                 }
         }
 
-        /* Updating statistics */
-        ring_data->rx_packets++;
         rxdp->Host_Control = 0;
         if (sp->rxd_mode == RXD_MODE_1) {
                 int len = RXD_GET_BUFFER0_SIZE_1(rxdp->Control_2);
 
-                ring_data->rx_bytes += len;
                 skb_put(skb, len);
-
         } else if (sp->rxd_mode == RXD_MODE_3B) {
                 int get_block = ring_data->rx_curr_get_info.block_index;
                 int get_off = ring_data->rx_curr_get_info.offset;
@@ -7472,7 +7500,6 @@ static int rx_osm_handler(struct ring_info *ring_data, struct RxD_t * rxdp)
                 unsigned char *buff = skb_push(skb, buf0_len);
 
                 struct buffAdd *ba = &ring_data->ba[get_block][get_off];
-                ring_data->rx_bytes += buf0_len + buf2_len;
                 memcpy(buff, ba->ba_0, buf0_len);
                 skb_put(skb, buf2_len);
         }
diff --git a/drivers/net/s2io.h b/drivers/net/s2io.h
index 47c36e0994f5..5e52c75892df 100644
--- a/drivers/net/s2io.h
+++ b/drivers/net/s2io.h
@@ -745,10 +745,6 @@ struct ring_info {
 
         /* Buffer Address store. */
         struct buffAdd **ba;
-
-        /* per-Ring statistics */
-        unsigned long rx_packets;
-        unsigned long rx_bytes;
 } ____cacheline_aligned;
 
 /* Fifo specific structure */
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index 1f3acc3a5dfd..79eee3062083 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -2671,6 +2671,7 @@ static struct platform_driver sbmac_driver = {
         .remove = __exit_p(sbmac_remove),
         .driver = {
                 .name = sbmac_string,
+                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 2111c7bbf578..7985165e84fc 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -717,11 +717,24 @@ static void sky2_phy_power_down(struct sky2_hw *hw, unsigned port)
         sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
 }
 
+/* Enable Rx/Tx */
+static void sky2_enable_rx_tx(struct sky2_port *sky2)
+{
+        struct sky2_hw *hw = sky2->hw;
+        unsigned port = sky2->port;
+        u16 reg;
+
+        reg = gma_read16(hw, port, GM_GP_CTRL);
+        reg |= GM_GPCR_RX_ENA | GM_GPCR_TX_ENA;
+        gma_write16(hw, port, GM_GP_CTRL, reg);
+}
+
 /* Force a renegotiation */
 static void sky2_phy_reinit(struct sky2_port *sky2)
 {
         spin_lock_bh(&sky2->phy_lock);
         sky2_phy_init(sky2->hw, sky2->port);
+        sky2_enable_rx_tx(sky2);
         spin_unlock_bh(&sky2->phy_lock);
 }
 
@@ -2040,7 +2053,6 @@ static void sky2_link_up(struct sky2_port *sky2)
 {
         struct sky2_hw *hw = sky2->hw;
         unsigned port = sky2->port;
-        u16 reg;
         static const char *fc_name[] = {
                 [FC_NONE]       = "none",
                 [FC_TX]         = "tx",
@@ -2048,10 +2060,7 @@ static void sky2_link_up(struct sky2_port *sky2)
                 [FC_BOTH]       = "both",
         };
 
-        /* enable Rx/Tx */
-        reg = gma_read16(hw, port, GM_GP_CTRL);
-        reg |= GM_GPCR_RX_ENA | GM_GPCR_TX_ENA;
-        gma_write16(hw, port, GM_GP_CTRL, reg);
+        sky2_enable_rx_tx(sky2);
 
         gm_phy_write(hw, port, PHY_MARV_INT_MASK, PHY_M_DEF_MSK);
 
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index c0e70006374e..06b552fca63d 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -367,8 +367,8 @@ static u16 t21041_csr14[] = { 0xFFFF, 0xF7FD, 0xF7FD, 0x6F3F, 0x6F3D, };
 static u16 t21041_csr15[] = { 0x0008, 0x0006, 0x000E, 0x0008, 0x0008, };
 
 
-#define dr32(reg)               readl(de->regs + (reg))
-#define dw32(reg,val)           writel((val), de->regs + (reg))
+#define dr32(reg)       ioread32(de->regs + (reg))
+#define dw32(reg, val)  iowrite32((val), de->regs + (reg))
 
 
 static void de_rx_err_acct (struct de_private *de, unsigned rx_tail,
@@ -1706,6 +1706,7 @@ static void __devinit de21040_get_mac_address (struct de_private *de)
                 int value, boguscnt = 100000;
                 do {
                         value = dr32(ROMCmd);
+                        rmb();
                 } while (value < 0 && --boguscnt > 0);
                 de->dev->dev_addr[i] = value;
                 udelay(1);
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 4a34833b85dd..807470e156af 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -3215,6 +3215,8 @@ static int ucc_geth_rx(struct ucc_geth_private *ugeth, u8 rxQ, int rx_work_limit
                                            __func__, __LINE__, (u32) skb);
                         if (skb) {
                                 skb->data = skb->head + NET_SKB_PAD;
+                                skb->len = 0;
+                                skb_reset_tail_pointer(skb);
                                 __skb_queue_head(&ugeth->rx_recycle, skb);
                         }
 
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 1f802e90474c..9516f382a6ba 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -344,7 +344,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                         return 2;
                 }
 
-                if (size > ETH_FRAME_LEN) {
+                if (size > dev->net->mtu + ETH_HLEN) {
                         netdev_err(dev->net, "asix_rx_fixup() Bad RX Length %d\n",
                                    size);
                         return 0;
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 0a3c41faea9c..4dd23513c5af 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1334,7 +1334,6 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
         /* check for port already opened, if not set the termios */
         serial->open_count++;
         if (serial->open_count == 1) {
-                tty->low_latency = 1;
                 serial->rx_state = RX_IDLE;
                 /* Force default termio settings */
                 _hso_serial_set_termios(tty, NULL);
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index 28d3ee175e7b..dd8a4adf48ca 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -104,10 +104,8 @@ static void rndis_msg_indicate(struct usbnet *dev, struct rndis_indicate *msg,
 int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen)
 {
         struct cdc_state        *info = (void *) &dev->data;
-        struct usb_cdc_notification notification;
         int                     master_ifnum;
         int                     retval;
-        int                     partial;
         unsigned                count;
         __le32                  rsp;
         u32                     xid = 0, msg_len, request_id;
@@ -135,17 +133,13 @@ int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen)
         if (unlikely(retval < 0 || xid == 0))
                 return retval;
 
-        /* Some devices don't respond on the control channel until
-         * polled on the status channel, so do that first. */
-        retval = usb_interrupt_msg(
-                dev->udev,
-                usb_rcvintpipe(dev->udev, dev->status->desc.bEndpointAddress),
-                &notification, sizeof(notification), &partial,
-                RNDIS_CONTROL_TIMEOUT_MS);
-        if (unlikely(retval < 0))
-                return retval;
+        // FIXME Seems like some devices discard responses when
+        // we time out and cancel our "get response" requests...
+        // so, this is fragile.  Probably need to poll for status.
 
-        /* Poll the control channel; the request probably completed immediately */
+        /* ignore status endpoint, just poll the control channel;
+         * the request probably completed immediately
+         */
         rsp = buf->msg_type | RNDIS_MSG_COMPLETION;
         for (count = 0; count < 10; count++) {
                 memset(buf, 0, CONTROL_BUFFER_SIZE);
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index a95c73de5824..81c76ada8e56 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1293,6 +1293,9 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
                 goto out;
         }
 
+        /* netdev_printk() needs this so do it as early as possible */
+        SET_NETDEV_DEV(net, &udev->dev);
+
         dev = netdev_priv(net);
         dev->udev = xdev;
         dev->intf = udev;
@@ -1377,8 +1380,6 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
                 dev->rx_urb_size = dev->hard_mtu;
         dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
 
-        SET_NETDEV_DEV(net, &udev->dev);
-
         if ((dev->driver_info->flags & FLAG_WLAN) != 0)
                 SET_NETDEV_DEVTYPE(net, &wlan_type);
         if ((dev->driver_info->flags & FLAG_WWAN) != 0)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 1edb7a61983c..bb6b67f6b0cc 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -415,7 +415,7 @@ static int add_recvbuf_mergeable(struct virtnet_info *vi, gfp_t gfp)
 static bool try_fill_recv(struct virtnet_info *vi, gfp_t gfp)
 {
         int err;
-        bool oom = false;
+        bool oom;
 
         do {
                 if (vi->mergeable_rx_bufs)
@@ -425,10 +425,9 @@ static bool try_fill_recv(struct virtnet_info *vi, gfp_t gfp)
                 else
                         err = add_recvbuf_small(vi, gfp);
 
-                if (err < 0) {
-                        oom = true;
+                oom = err == -ENOMEM;
+                if (err < 0)
                         break;
-                }
                 ++vi->num;
         } while (err > 0);
         if (unlikely(vi->num > vi->max))
@@ -563,7 +562,6 @@ static netdev_tx_t start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct virtnet_info *vi = netdev_priv(dev);
         int capacity;
 
-again:
         /* Free up any pending old buffers before queueing new ones. */
         free_old_xmit_skbs(vi);
 
@@ -572,14 +570,20 @@ again:
 
         /* This can happen with OOM and indirect buffers. */
         if (unlikely(capacity < 0)) {
-                netif_stop_queue(dev);
-                dev_warn(&dev->dev, "Unexpected full queue\n");
-                if (unlikely(!virtqueue_enable_cb(vi->svq))) {
-                        virtqueue_disable_cb(vi->svq);
-                        netif_start_queue(dev);
-                        goto again;
+                if (net_ratelimit()) {
+                        if (likely(capacity == -ENOMEM)) {
+                                dev_warn(&dev->dev,
+                                         "TX queue failure: out of memory\n");
+                        } else {
+                                dev->stats.tx_fifo_errors++;
+                                dev_warn(&dev->dev,
+                                         "Unexpected TX queue failure: %d\n",
+                                         capacity);
+                        }
                 }
-                return NETDEV_TX_BUSY;
+                dev->stats.tx_dropped++;
+                kfree_skb(skb);
+                return NETDEV_TX_OK;
         }
         virtqueue_kick(vi->svq);
 
diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
index b504bd561362..fc8b2d7a0919 100644
--- a/drivers/net/vxge/vxge-main.c
+++ b/drivers/net/vxge/vxge-main.c
@@ -2262,7 +2262,8 @@ start:
                 vxge_debug_init(VXGE_ERR,
                         "%s: memory allocation failed",
                         VXGE_DRIVER_NAME);
-                return  -ENOMEM;
+                ret = -ENOMEM;
+                goto alloc_entries_failed;
         }
 
         vdev->vxge_entries =
@@ -2271,8 +2272,8 @@ start:
         if (!vdev->vxge_entries) {
                 vxge_debug_init(VXGE_ERR, "%s: memory allocation failed",
                         VXGE_DRIVER_NAME);
-                kfree(vdev->entries);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto alloc_vxge_entries_failed;
         }
 
         for (i = 0, j = 0; i < vdev->no_of_vpath; i++) {
@@ -2303,22 +2304,32 @@ start:
                 vxge_debug_init(VXGE_ERR,
                         "%s: MSI-X enable failed for %d vectors, ret: %d",
                         VXGE_DRIVER_NAME, vdev->intr_cnt, ret);
+                if ((max_config_vpath != VXGE_USE_DEFAULT) || (ret < 3)) {
+                        ret = -ENODEV;
+                        goto enable_msix_failed;
+                }
+
                 kfree(vdev->entries);
                 kfree(vdev->vxge_entries);
                 vdev->entries = NULL;
                 vdev->vxge_entries = NULL;
-
-                if ((max_config_vpath != VXGE_USE_DEFAULT) || (ret < 3))
-                        return -ENODEV;
                 /* Try with less no of vector by reducing no of vpaths count */
                 temp = (ret - 1)/2;
                 vxge_close_vpaths(vdev, temp);
                 vdev->no_of_vpath = temp;
                 goto start;
-        } else if (ret < 0)
-                return -ENODEV;
-
+        } else if (ret < 0) {
+                ret = -ENODEV;
+                goto enable_msix_failed;
+        }
         return 0;
+
+enable_msix_failed:
+        kfree(vdev->vxge_entries);
+alloc_vxge_entries_failed:
+        kfree(vdev->entries);
+alloc_entries_failed:
+        return ret;
 }
 
 static int vxge_enable_msix(struct vxgedev *vdev)
@@ -4506,9 +4517,9 @@ vxge_starter(void)
         char version[32];
         snprintf(version, 32, "%s", DRV_VERSION);
 
-        printk(KERN_CRIT "%s: Copyright(c) 2002-2009 Neterion Inc\n",
+        printk(KERN_INFO "%s: Copyright(c) 2002-2009 Neterion Inc\n",
                 VXGE_DRIVER_NAME);
-        printk(KERN_CRIT "%s: Driver version: %s\n",
+        printk(KERN_INFO "%s: Driver version: %s\n",
                         VXGE_DRIVER_NAME, version);
 
         verify_bandwidth();
diff --git a/drivers/net/wimax/i2400m/fw.c b/drivers/net/wimax/i2400m/fw.c
index 3f283bff0ff7..11491354e5b5 100644
--- a/drivers/net/wimax/i2400m/fw.c
+++ b/drivers/net/wimax/i2400m/fw.c
@@ -1192,7 +1192,7 @@ int i2400m_fw_hdr_check(struct i2400m *i2400m,
         unsigned module_type, header_len, major_version, minor_version,
                 module_id, module_vendor, date, size;
 
-        module_type = bcf_hdr->module_type;
+        module_type = le32_to_cpu(bcf_hdr->module_type);
         header_len = sizeof(u32) * le32_to_cpu(bcf_hdr->header_len);
         major_version = (le32_to_cpu(bcf_hdr->header_version) & 0xffff0000)
                 >> 16;
diff --git a/drivers/net/wireless/ath/ath5k/attach.c b/drivers/net/wireless/ath/ath5k/attach.c
index e0c244b02f05..31c008042bfe 100644
--- a/drivers/net/wireless/ath/ath5k/attach.c
+++ b/drivers/net/wireless/ath/ath5k/attach.c
@@ -126,6 +126,7 @@ int ath5k_hw_attach(struct ath5k_softc *sc)
         ah->ah_ant_mode = AR5K_ANTMODE_DEFAULT;
         ah->ah_noise_floor = -95;       /* until first NF calibration is run */
         sc->ani_state.ani_mode = ATH5K_ANI_MODE_AUTO;
+        ah->ah_current_channel = &sc->channels[0];
 
         /*
          * Find the mac version
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 2978359c4366..648972df369d 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -195,7 +195,7 @@ static const struct ieee80211_rate ath5k_rates[] = {
 static int __devinit    ath5k_pci_probe(struct pci_dev *pdev,
                                 const struct pci_device_id *id);
 static void __devexit   ath5k_pci_remove(struct pci_dev *pdev);
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int              ath5k_pci_suspend(struct device *dev);
 static int              ath5k_pci_resume(struct device *dev);
 
@@ -203,7 +203,7 @@ static SIMPLE_DEV_PM_OPS(ath5k_pm_ops, ath5k_pci_suspend, ath5k_pci_resume);
 #define ATH5K_PM_OPS    (&ath5k_pm_ops)
 #else
 #define ATH5K_PM_OPS    NULL
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 
 static struct pci_driver ath5k_pci_driver = {
         .name           = KBUILD_MODNAME,
@@ -708,7 +708,7 @@ ath5k_pci_remove(struct pci_dev *pdev)
         ieee80211_free_hw(hw);
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int ath5k_pci_suspend(struct device *dev)
 {
         struct ieee80211_hw *hw = pci_get_drvdata(to_pci_dev(dev));
@@ -734,7 +734,7 @@ static int ath5k_pci_resume(struct device *dev)
         ath5k_led_enable(sc);
         return 0;
 }
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 
 
 /***********************\
@@ -3140,13 +3140,15 @@ static void ath5k_configure_filter(struct ieee80211_hw *hw,
 
         if (changed_flags & (FIF_PROMISC_IN_BSS | FIF_OTHER_BSS)) {
                 if (*new_flags & FIF_PROMISC_IN_BSS) {
-                        rfilt |= AR5K_RX_FILTER_PROM;
                         __set_bit(ATH_STAT_PROMISC, sc->status);
                 } else {
                         __clear_bit(ATH_STAT_PROMISC, sc->status);
                 }
         }
 
+        if (test_bit(ATH_STAT_PROMISC, sc->status))
+                rfilt |= AR5K_RX_FILTER_PROM;
+
         /* Note, AR5K_RX_FILTER_MCAST is already enabled */
         if (*new_flags & FIF_ALLMULTI) {
                 mfilt[0] =  ~0;
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 1b81c4778800..492cbb15720d 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -1814,6 +1814,13 @@ ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
         u8 def_ant, tx_ant, ee_mode;
         u32 sta_id1 = 0;
 
+        /* if channel is not initialized yet we can't set the antennas
+         * so just store the mode. it will be set on the next reset */
+        if (channel == NULL) {
+                ah->ah_ant_mode = ant_mode;
+                return;
+        }
+
         def_ant = ah->ah_def_ant;
 
         ATH5K_TRACE(ah->ah_sc);
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index fbb7dec6ddeb..5ea87736a6ae 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -445,6 +445,7 @@ void ath_deinit_leds(struct ath_softc *sc);
 #define SC_OP_TSF_RESET              BIT(11)
 #define SC_OP_BT_PRIORITY_DETECTED   BIT(12)
 #define SC_OP_BT_SCAN                BIT(13)
+#define SC_OP_ANI_RUN                BIT(14)
 
 /* Powersave flags */
 #define PS_WAIT_FOR_BEACON        BIT(0)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index abfa0493236f..1e2a68ea9355 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -336,6 +336,10 @@ set_timer:
 static void ath_start_ani(struct ath_common *common)
 {
         unsigned long timestamp = jiffies_to_msecs(jiffies);
+        struct ath_softc *sc = (struct ath_softc *) common->priv;
+
+        if (!(sc->sc_flags & SC_OP_ANI_RUN))
+                return;
 
         common->ani.longcal_timer = timestamp;
         common->ani.shortcal_timer = timestamp;
@@ -872,11 +876,13 @@ static void ath9k_bss_assoc_info(struct ath_softc *sc,
                 /* Reset rssi stats */
                 sc->sc_ah->stats.avgbrssi = ATH_RSSI_DUMMY_MARKER;
 
+                sc->sc_flags |= SC_OP_ANI_RUN;
                 ath_start_ani(common);
         } else {
                 ath_print(common, ATH_DBG_CONFIG, "Bss Info DISASSOC\n");
                 common->curaid = 0;
                 /* Stop ANI */
+                sc->sc_flags &= ~SC_OP_ANI_RUN;
                 del_timer_sync(&common->ani.timer);
         }
 }
@@ -1478,8 +1484,10 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
 
         if (vif->type == NL80211_IFTYPE_AP    ||
             vif->type == NL80211_IFTYPE_ADHOC ||
-            vif->type == NL80211_IFTYPE_MONITOR)
+            vif->type == NL80211_IFTYPE_MONITOR) {
+                sc->sc_flags |= SC_OP_ANI_RUN;
                 ath_start_ani(common);
+        }
 
 out:
         mutex_unlock(&sc->mutex);
@@ -1500,6 +1508,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
         mutex_lock(&sc->mutex);
 
         /* Stop ANI */
+        sc->sc_flags &= ~SC_OP_ANI_RUN;
         del_timer_sync(&common->ani.timer);
 
         /* Reclaim beacon resources */
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index db72461c486b..29b31a694b59 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -594,6 +594,7 @@ static int prism2_config(struct pcmcia_device *link)
         local_info_t *local;
         int ret = 1;
         struct hostap_cs_priv *hw_priv;
+        unsigned long flags;
 
         PDEBUG(DEBUG_FLOW, "prism2_config()\n");
 
@@ -625,9 +626,15 @@ static int prism2_config(struct pcmcia_device *link)
         local->hw_priv = hw_priv;
         hw_priv->link = link;
 
+        /*
+         * Make sure the IRQ handler cannot proceed until at least
+         * dev->base_addr is initialized.
+         */
+        spin_lock_irqsave(&local->irq_init_lock, flags);
+
         ret = pcmcia_request_irq(link, prism2_interrupt);
         if (ret)
-                goto failed;
+                goto failed_unlock;
 
         /*
          * This actually configures the PCMCIA socket -- setting up
@@ -636,11 +643,13 @@ static int prism2_config(struct pcmcia_device *link)
          */
         ret = pcmcia_request_configuration(link, &link->conf);
         if (ret)
-                goto failed;
+                goto failed_unlock;
 
         dev->irq = link->irq;
         dev->base_addr = link->io.BasePort1;
 
+        spin_unlock_irqrestore(&local->irq_init_lock, flags);
+
         /* Finally, report what we've done */
         printk(KERN_INFO "%s: index 0x%02x: ",
                dev_info, link->conf.ConfigIndex);
@@ -667,6 +676,8 @@ static int prism2_config(struct pcmcia_device *link)
 
         return ret;
 
+ failed_unlock:
+         spin_unlock_irqrestore(&local->irq_init_lock, flags);
  failed:
         kfree(hw_priv);
         prism2_release((u_long)link);
diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
index d70732819423..2f999fc94f60 100644
--- a/drivers/net/wireless/hostap/hostap_hw.c
+++ b/drivers/net/wireless/hostap/hostap_hw.c
@@ -2618,17 +2618,20 @@ static irqreturn_t prism2_interrupt(int irq, void *dev_id)
         int events = 0;
         u16 ev;
 
+        iface = netdev_priv(dev);
+        local = iface->local;
+
         /* Detect early interrupt before driver is fully configued */
+        spin_lock(&local->irq_init_lock);
         if (!dev->base_addr) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: Interrupt, but dev not configured\n",
                                dev->name);
                 }
+                spin_unlock(&local->irq_init_lock);
                 return IRQ_HANDLED;
         }
-
-        iface = netdev_priv(dev);
-        local = iface->local;
+        spin_unlock(&local->irq_init_lock);
 
         prism2_io_debug_add(dev, PRISM2_IO_DEBUG_CMD_INTERRUPT, 0, 0);
 
@@ -3147,6 +3150,7 @@ prism2_init_local_data(struct prism2_helper_functions *funcs, int card_idx,
         spin_lock_init(&local->cmdlock);
         spin_lock_init(&local->baplock);
         spin_lock_init(&local->lock);
+        spin_lock_init(&local->irq_init_lock);
         mutex_init(&local->rid_bap_mtx);
 
         if (card_idx < 0 || card_idx >= MAX_PARM_DEVICES)
diff --git a/drivers/net/wireless/hostap/hostap_wlan.h b/drivers/net/wireless/hostap/hostap_wlan.h
index 3d238917af07..1ba33be98b25 100644
--- a/drivers/net/wireless/hostap/hostap_wlan.h
+++ b/drivers/net/wireless/hostap/hostap_wlan.h
@@ -654,7 +654,7 @@ struct local_info {
         rwlock_t iface_lock; /* hostap_interfaces read lock; use write lock
                               * when removing entries from the list.
                               * TX and RX paths can use read lock. */
-        spinlock_t cmdlock, baplock, lock;
+        spinlock_t cmdlock, baplock, lock, irq_init_lock;
         struct mutex rid_bap_mtx;
         u16 infofid; /* MAC buffer id for info frame */
         /* txfid, intransmitfid, next_txtid, and next_alloc are protected by
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 068f7f8435c5..c44a303e62ed 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -2852,6 +2852,7 @@ static struct iwl_lib_ops iwl3945_lib = {
         .isr = iwl_isr_legacy,
         .config_ap = iwl3945_config_ap,
         .manage_ibss_station = iwl3945_manage_ibss_station,
+        .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl3945_good_plcp_health,
 
         .debugfs_ops = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
index 44ef5d93befc..01658cf82d39 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
@@ -212,11 +212,7 @@ static void iwlagn_chain_noise_reset(struct iwl_priv *priv)
 static void iwlagn_rts_tx_cmd_flag(struct ieee80211_tx_info *info,
                         __le32 *tx_flags)
 {
-        if ((info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
-            (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
-                *tx_flags |= TX_CMD_FLG_RTS_CTS_MSK;
-        else
-                *tx_flags &= ~TX_CMD_FLG_RTS_CTS_MSK;
+        *tx_flags |= TX_CMD_FLG_RTS_CTS_MSK;
 }
 
 /* Calc max signal level (dBm) among 3 possible receivers */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 1004cfc403b1..0f292a210ed9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1119,10 +1119,9 @@ static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
                                            struct iwl_scan_channel *scan_ch)
 {
         const struct ieee80211_supported_band *sband;
-        const struct iwl_channel_info *ch_info;
         u16 passive_dwell = 0;
         u16 active_dwell = 0;
-        int i, added = 0;
+        int added = 0;
         u16 channel = 0;
 
         sband = iwl_get_hw_mode(priv, band);
@@ -1137,32 +1136,7 @@ static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
         if (passive_dwell <= active_dwell)
                 passive_dwell = active_dwell + 1;
 
-        /* only scan single channel, good enough to reset the RF */
-        /* pick the first valid not in-use channel */
-        if (band == IEEE80211_BAND_5GHZ) {
-                for (i = 14; i < priv->channel_count; i++) {
-                        if (priv->channel_info[i].channel !=
-                            le16_to_cpu(priv->staging_rxon.channel)) {
-                                channel = priv->channel_info[i].channel;
-                                ch_info = iwl_get_channel_info(priv,
-                                        band, channel);
-                                if (is_channel_valid(ch_info))
-                                        break;
-                        }
-                }
-        } else {
-                for (i = 0; i < 14; i++) {
-                        if (priv->channel_info[i].channel !=
-                            le16_to_cpu(priv->staging_rxon.channel)) {
-                                        channel =
-                                                priv->channel_info[i].channel;
-                                        ch_info = iwl_get_channel_info(priv,
-                                                band, channel);
-                                        if (is_channel_valid(ch_info))
-                                                break;
-                        }
-                }
-        }
+        channel = iwl_get_single_channel_number(priv, band);
         if (channel) {
                 scan_ch->channel = cpu_to_le16(channel);
                 scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index c402bfc83f36..7d614c4d3c62 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -1125,6 +1125,7 @@ static void iwlagn_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
         struct ieee80211_sta *sta;
         struct iwl_station_priv *sta_priv;
 
+        rcu_read_lock();
         sta = ieee80211_find_sta(priv->vif, hdr->addr1);
         if (sta) {
                 sta_priv = (void *)sta->drv_priv;
@@ -1133,6 +1134,7 @@ static void iwlagn_tx_status(struct iwl_priv *priv, struct sk_buff *skb)
                     atomic_dec_return(&sta_priv->pending_frames) == 0)
                         ieee80211_sta_block_awake(priv->hw, sta, false);
         }
+        rcu_read_unlock();
 
         ieee80211_tx_status_irqsafe(priv->hw, skb);
 }
@@ -1297,6 +1299,11 @@ void iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
         sta_id = ba_resp->sta_id;
         tid = ba_resp->tid;
         agg = &priv->stations[sta_id].tid[tid].agg;
+        if (unlikely(agg->txq_id != scd_flow)) {
+                IWL_ERR(priv, "BA scd_flow %d does not match txq_id %d\n",
+                        scd_flow, agg->txq_id);
+                return;
+        }
 
         /* Find index just before block-ack window */
         index = iwl_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index aef4f71f1981..24aff654fa9c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1484,6 +1484,156 @@ bool iwl_good_ack_health(struct iwl_priv *priv,
 }
 
 
+/*****************************************************************************
+ *
+ * sysfs attributes
+ *
+ *****************************************************************************/
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+
+/*
+ * The following adds a new attribute to the sysfs representation
+ * of this device driver (i.e. a new file in /sys/class/net/wlan0/device/)
+ * used for controlling the debug level.
+ *
+ * See the level definitions in iwl for details.
+ *
+ * The debug_level being managed using sysfs below is a per device debug
+ * level that is used instead of the global debug level if it (the per
+ * device debug level) is set.
+ */
+static ssize_t show_debug_level(struct device *d,
+                                struct device_attribute *attr, char *buf)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        return sprintf(buf, "0x%08X\n", iwl_get_debug_level(priv));
+}
+static ssize_t store_debug_level(struct device *d,
+                                struct device_attribute *attr,
+                                 const char *buf, size_t count)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        unsigned long val;
+        int ret;
+
+        ret = strict_strtoul(buf, 0, &val);
+        if (ret)
+                IWL_ERR(priv, "%s is not in hex or decimal form.\n", buf);
+        else {
+                priv->debug_level = val;
+                if (iwl_alloc_traffic_mem(priv))
+                        IWL_ERR(priv,
+                                "Not enough memory to generate traffic log\n");
+        }
+        return strnlen(buf, count);
+}
+
+static DEVICE_ATTR(debug_level, S_IWUSR | S_IRUGO,
+                        show_debug_level, store_debug_level);
+
+
+#endif /* CONFIG_IWLWIFI_DEBUG */
+
+
+static ssize_t show_temperature(struct device *d,
+                                struct device_attribute *attr, char *buf)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        return sprintf(buf, "%d\n", priv->temperature);
+}
+
+static DEVICE_ATTR(temperature, S_IRUGO, show_temperature, NULL);
+
+static ssize_t show_tx_power(struct device *d,
+                             struct device_attribute *attr, char *buf)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+
+        if (!iwl_is_ready_rf(priv))
+                return sprintf(buf, "off\n");
+        else
+                return sprintf(buf, "%d\n", priv->tx_power_user_lmt);
+}
+
+static ssize_t store_tx_power(struct device *d,
+                              struct device_attribute *attr,
+                              const char *buf, size_t count)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        unsigned long val;
+        int ret;
+
+        ret = strict_strtoul(buf, 10, &val);
+        if (ret)
+                IWL_INFO(priv, "%s is not in decimal form.\n", buf);
+        else {
+                ret = iwl_set_tx_power(priv, val, false);
+                if (ret)
+                        IWL_ERR(priv, "failed setting tx power (0x%d).\n",
+                                ret);
+                else
+                        ret = count;
+        }
+        return ret;
+}
+
+static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
+
+static ssize_t show_rts_ht_protection(struct device *d,
+                             struct device_attribute *attr, char *buf)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+
+        return sprintf(buf, "%s\n",
+                priv->cfg->use_rts_for_ht ? "RTS/CTS" : "CTS-to-self");
+}
+
+static ssize_t store_rts_ht_protection(struct device *d,
+                              struct device_attribute *attr,
+                              const char *buf, size_t count)
+{
+        struct iwl_priv *priv = dev_get_drvdata(d);
+        unsigned long val;
+        int ret;
+
+        ret = strict_strtoul(buf, 10, &val);
+        if (ret)
+                IWL_INFO(priv, "Input is not in decimal form.\n");
+        else {
+                if (!iwl_is_associated(priv))
+                        priv->cfg->use_rts_for_ht = val ? true : false;
+                else
+                        IWL_ERR(priv, "Sta associated with AP - "
+                                "Change protection mechanism is not allowed\n");
+                ret = count;
+        }
+        return ret;
+}
+
+static DEVICE_ATTR(rts_ht_protection, S_IWUSR | S_IRUGO,
+                        show_rts_ht_protection, store_rts_ht_protection);
+
+
+static struct attribute *iwl_sysfs_entries[] = {
+        &dev_attr_temperature.attr,
+        &dev_attr_tx_power.attr,
+        &dev_attr_rts_ht_protection.attr,
+#ifdef CONFIG_IWLWIFI_DEBUG
+        &dev_attr_debug_level.attr,
+#endif
+        NULL
+};
+
+static struct attribute_group iwl_attribute_group = {
+        .name = NULL,           /* put in device directory */
+        .attrs = iwl_sysfs_entries,
+};
+
 /******************************************************************************
  *
  * uCode download functions
@@ -1965,6 +2115,13 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
         if (err)
                 IWL_ERR(priv, "failed to create debugfs files. Ignoring error: %d\n", err);
 
+        err = sysfs_create_group(&priv->pci_dev->dev.kobj,
+                                        &iwl_attribute_group);
+        if (err) {
+                IWL_ERR(priv, "failed to create sysfs device attributes\n");
+                goto out_unbind;
+        }
+
         /* We have our copies now, allow OS release its copies */
         release_firmware(ucode_raw);
         complete(&priv->_agn.firmware_loading_complete);
@@ -3234,10 +3391,12 @@ static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
         int ret;
         u8 sta_id;
 
-        sta_priv->common.sta_id = IWL_INVALID_STATION;
-
         IWL_DEBUG_INFO(priv, "received request to add station %pM\n",
                         sta->addr);
+        mutex_lock(&priv->mutex);
+        IWL_DEBUG_INFO(priv, "proceeding to add station %pM\n",
+                        sta->addr);
+        sta_priv->common.sta_id = IWL_INVALID_STATION;
 
         atomic_set(&sta_priv->pending_frames, 0);
         if (vif->type == NL80211_IFTYPE_AP)
@@ -3249,6 +3408,7 @@ static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
                 IWL_ERR(priv, "Unable to add station %pM (%d)\n",
                         sta->addr, ret);
                 /* Should we return success if return code is EEXIST ? */
+                mutex_unlock(&priv->mutex);
                 return ret;
         }
 
@@ -3258,147 +3418,13 @@ static int iwlagn_mac_sta_add(struct ieee80211_hw *hw,
         IWL_DEBUG_INFO(priv, "Initializing rate scaling for station %pM\n",
                        sta->addr);
         iwl_rs_rate_init(priv, sta, sta_id);
+        mutex_unlock(&priv->mutex);
 
         return 0;
 }
 
 /*****************************************************************************
  *
- * sysfs attributes
- *
- *****************************************************************************/
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-
-/*
- * The following adds a new attribute to the sysfs representation
- * of this device driver (i.e. a new file in /sys/class/net/wlan0/device/)
- * used for controlling the debug level.
- *
- * See the level definitions in iwl for details.
- *
- * The debug_level being managed using sysfs below is a per device debug
- * level that is used instead of the global debug level if it (the per
- * device debug level) is set.
- */
-static ssize_t show_debug_level(struct device *d,
-                                struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        return sprintf(buf, "0x%08X\n", iwl_get_debug_level(priv));
-}
-static ssize_t store_debug_level(struct device *d,
-                                struct device_attribute *attr,
-                                 const char *buf, size_t count)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        unsigned long val;
-        int ret;
-
-        ret = strict_strtoul(buf, 0, &val);
-        if (ret)
-                IWL_ERR(priv, "%s is not in hex or decimal form.\n", buf);
-        else {
-                priv->debug_level = val;
-                if (iwl_alloc_traffic_mem(priv))
-                        IWL_ERR(priv,
-                                "Not enough memory to generate traffic log\n");
-        }
-        return strnlen(buf, count);
-}
-
-static DEVICE_ATTR(debug_level, S_IWUSR | S_IRUGO,
-                        show_debug_level, store_debug_level);
-
-
-#endif /* CONFIG_IWLWIFI_DEBUG */
-
-
-static ssize_t show_temperature(struct device *d,
-                                struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        return sprintf(buf, "%d\n", priv->temperature);
-}
-
-static DEVICE_ATTR(temperature, S_IRUGO, show_temperature, NULL);
-
-static ssize_t show_tx_power(struct device *d,
-                             struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-
-        if (!iwl_is_ready_rf(priv))
-                return sprintf(buf, "off\n");
-        else
-                return sprintf(buf, "%d\n", priv->tx_power_user_lmt);
-}
-
-static ssize_t store_tx_power(struct device *d,
-                              struct device_attribute *attr,
-                              const char *buf, size_t count)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        unsigned long val;
-        int ret;
-
-        ret = strict_strtoul(buf, 10, &val);
-        if (ret)
-                IWL_INFO(priv, "%s is not in decimal form.\n", buf);
-        else {
-                ret = iwl_set_tx_power(priv, val, false);
-                if (ret)
-                        IWL_ERR(priv, "failed setting tx power (0x%d).\n",
-                                ret);
-                else
-                        ret = count;
-        }
-        return ret;
-}
-
-static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
-
-static ssize_t show_rts_ht_protection(struct device *d,
-                             struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-
-        return sprintf(buf, "%s\n",
-                priv->cfg->use_rts_for_ht ? "RTS/CTS" : "CTS-to-self");
-}
-
-static ssize_t store_rts_ht_protection(struct device *d,
-                              struct device_attribute *attr,
-                              const char *buf, size_t count)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        unsigned long val;
-        int ret;
-
-        ret = strict_strtoul(buf, 10, &val);
-        if (ret)
-                IWL_INFO(priv, "Input is not in decimal form.\n");
-        else {
-                if (!iwl_is_associated(priv))
-                        priv->cfg->use_rts_for_ht = val ? true : false;
-                else
-                        IWL_ERR(priv, "Sta associated with AP - "
-                                "Change protection mechanism is not allowed\n");
-                ret = count;
-        }
-        return ret;
-}
-
-static DEVICE_ATTR(rts_ht_protection, S_IWUSR | S_IRUGO,
-                        show_rts_ht_protection, store_rts_ht_protection);
-
-
-/*****************************************************************************
- *
  * driver setup and teardown
  *
  *****************************************************************************/
@@ -3550,21 +3576,6 @@ static void iwl_uninit_drv(struct iwl_priv *priv)
         kfree(priv->scan_cmd);
 }
 
-static struct attribute *iwl_sysfs_entries[] = {
-        &dev_attr_temperature.attr,
-        &dev_attr_tx_power.attr,
-        &dev_attr_rts_ht_protection.attr,
-#ifdef CONFIG_IWLWIFI_DEBUG
-        &dev_attr_debug_level.attr,
-#endif
-        NULL
-};
-
-static struct attribute_group iwl_attribute_group = {
-        .name = NULL,           /* put in device directory */
-        .attrs = iwl_sysfs_entries,
-};
-
 static struct ieee80211_ops iwl_hw_ops = {
         .tx = iwl_mac_tx,
         .start = iwl_mac_start,
@@ -3750,11 +3761,6 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 IWL_ERR(priv, "Error allocating IRQ %d\n", priv->pci_dev->irq);
                 goto out_disable_msi;
         }
-        err = sysfs_create_group(&pdev->dev.kobj, &iwl_attribute_group);
-        if (err) {
-                IWL_ERR(priv, "failed to create sysfs device attributes\n");
-                goto out_free_irq;
-        }
 
         iwl_setup_deferred_work(priv);
         iwl_setup_rx_handlers(priv);
@@ -3788,15 +3794,13 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         err = iwl_request_firmware(priv, true);
         if (err)
-                goto out_remove_sysfs;
+                goto out_destroy_workqueue;
 
         return 0;
 
- out_remove_sysfs:
+ out_destroy_workqueue:
         destroy_workqueue(priv->workqueue);
         priv->workqueue = NULL;
-        sysfs_remove_group(&pdev->dev.kobj, &iwl_attribute_group);
- out_free_irq:
         free_irq(priv->pci_dev->irq, priv);
         iwl_free_isr_ict(priv);
  out_disable_msi:
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 5a7eca8fb789..5bbc5298ef96 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -854,6 +854,45 @@ void iwl_set_rxon_chain(struct iwl_priv *priv)
 }
 EXPORT_SYMBOL(iwl_set_rxon_chain);
 
+/* Return valid channel */
+u8 iwl_get_single_channel_number(struct iwl_priv *priv,
+                                  enum ieee80211_band band)
+{
+        const struct iwl_channel_info *ch_info;
+        int i;
+        u8 channel = 0;
+
+        /* only scan single channel, good enough to reset the RF */
+        /* pick the first valid not in-use channel */
+        if (band == IEEE80211_BAND_5GHZ) {
+                for (i = 14; i < priv->channel_count; i++) {
+                        if (priv->channel_info[i].channel !=
+                            le16_to_cpu(priv->staging_rxon.channel)) {
+                                channel = priv->channel_info[i].channel;
+                                ch_info = iwl_get_channel_info(priv,
+                                        band, channel);
+                                if (is_channel_valid(ch_info))
+                                        break;
+                        }
+                }
+        } else {
+                for (i = 0; i < 14; i++) {
+                        if (priv->channel_info[i].channel !=
+                            le16_to_cpu(priv->staging_rxon.channel)) {
+                                        channel =
+                                                priv->channel_info[i].channel;
+                                        ch_info = iwl_get_channel_info(priv,
+                                                band, channel);
+                                        if (is_channel_valid(ch_info))
+                                                break;
+                        }
+                }
+        }
+
+        return channel;
+}
+EXPORT_SYMBOL(iwl_get_single_channel_number);
+
 /**
  * iwl_set_rxon_channel - Set the phymode and channel values in staging RXON
  * @phymode: MODE_IEEE80211A sets to 5.2GHz; all else set to 2.4GHz
@@ -1275,7 +1314,6 @@ void iwl_configure_filter(struct ieee80211_hw *hw,
                         changed_flags, *total_flags);
 
         CHK(FIF_OTHER_BSS | FIF_PROMISC_IN_BSS, RXON_FILTER_PROMISC_MSK);
-        CHK(FIF_ALLMULTI, RXON_FILTER_ACCEPT_GRP_MSK);
         CHK(FIF_CONTROL, RXON_FILTER_CTL2HOST_MSK);
         CHK(FIF_BCN_PRBRESP_PROMISC, RXON_FILTER_BCON_AWARE_MSK);
 
@@ -1290,6 +1328,12 @@ void iwl_configure_filter(struct ieee80211_hw *hw,
 
         mutex_unlock(&priv->mutex);
 
+        /*
+         * Receiving all multicast frames is always enabled by the
+         * default flags setup in iwl_connection_init_rx_config()
+         * since we currently do not support programming multicast
+         * filters into the device.
+         */
         *total_flags &= FIF_OTHER_BSS | FIF_ALLMULTI | FIF_PROMISC_IN_BSS |
                         FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 7e5a5ba41fd2..31775bd9c361 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -343,6 +343,8 @@ int iwl_check_rxon_cmd(struct iwl_priv *priv);
 int iwl_full_rxon_required(struct iwl_priv *priv);
 void iwl_set_rxon_chain(struct iwl_priv *priv);
 int iwl_set_rxon_channel(struct iwl_priv *priv, struct ieee80211_channel *ch);
+u8 iwl_get_single_channel_number(struct iwl_priv *priv,
+                                  enum ieee80211_band band);
 void iwl_set_rxon_ht(struct iwl_priv *priv, struct iwl_ht_config *ht_conf);
 u8 iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                          struct ieee80211_sta_ht_cap *sta_ht_inf);
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 5d3f51ff2f0d..386c5f96eff8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -491,6 +491,7 @@ void iwl_bg_abort_scan(struct work_struct *work)
 
         mutex_lock(&priv->mutex);
 
+        cancel_delayed_work_sync(&priv->scan_check);
         set_bit(STATUS_SCAN_ABORTING, &priv->status);
         iwl_send_scan_abort(priv);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 83a26361a9b5..c27c13fbb1ae 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -1373,10 +1373,14 @@ int iwl_mac_sta_remove(struct ieee80211_hw *hw,
 
         IWL_DEBUG_INFO(priv, "received request to remove station %pM\n",
                         sta->addr);
+        mutex_lock(&priv->mutex);
+        IWL_DEBUG_INFO(priv, "proceeding to remove station %pM\n",
+                        sta->addr);
         ret = iwl_remove_station(priv, sta_common->sta_id, sta->addr);
         if (ret)
                 IWL_ERR(priv, "Error removing station %pM\n",
                         sta->addr);
+        mutex_unlock(&priv->mutex);
         return ret;
 }
 EXPORT_SYMBOL(iwl_mac_sta_remove);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 3e5bffb6034f..a27872de4106 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -1844,6 +1844,49 @@ static void iwl3945_irq_tasklet(struct iwl_priv *priv)
 #endif
 }
 
+static int iwl3945_get_single_channel_for_scan(struct iwl_priv *priv,
+                                               struct ieee80211_vif *vif,
+                                               enum ieee80211_band band,
+                                               struct iwl3945_scan_channel *scan_ch)
+{
+        const struct ieee80211_supported_band *sband;
+        u16 passive_dwell = 0;
+        u16 active_dwell = 0;
+        int added = 0;
+        u8 channel = 0;
+
+        sband = iwl_get_hw_mode(priv, band);
+        if (!sband) {
+                IWL_ERR(priv, "invalid band\n");
+                return added;
+        }
+
+        active_dwell = iwl_get_active_dwell_time(priv, band, 0);
+        passive_dwell = iwl_get_passive_dwell_time(priv, band, vif);
+
+        if (passive_dwell <= active_dwell)
+                passive_dwell = active_dwell + 1;
+
+
+        channel = iwl_get_single_channel_number(priv, band);
+
+        if (channel) {
+                scan_ch->channel = channel;
+                scan_ch->type = 0;      /* passive */
+                scan_ch->active_dwell = cpu_to_le16(active_dwell);
+                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
+                /* Set txpower levels to defaults */
+                scan_ch->tpc.dsp_atten = 110;
+                if (band == IEEE80211_BAND_5GHZ)
+                        scan_ch->tpc.tx_gain = ((1 << 5) | (3 << 3)) | 3;
+                else
+                        scan_ch->tpc.tx_gain = ((1 << 5) | (5 << 3));
+                added++;
+        } else
+                IWL_ERR(priv, "no valid channel found\n");
+        return added;
+}
+
 static int iwl3945_get_channels_for_scan(struct iwl_priv *priv,
                                          enum ieee80211_band band,
                                      u8 is_active, u8 n_probes,
@@ -2992,9 +3035,16 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         /* select Rx antennas */
         scan->flags |= iwl3945_get_antenna_flags(priv);
 
-        scan->channel_count =
-                iwl3945_get_channels_for_scan(priv, band, is_active, n_probes,
-                        (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)], vif);
+        if (priv->is_internal_short_scan) {
+                scan->channel_count =
+                        iwl3945_get_single_channel_for_scan(priv, vif, band,
+                                (void *)&scan->data[le16_to_cpu(
+                                scan->tx_cmd.len)]);
+        } else {
+                scan->channel_count =
+                        iwl3945_get_channels_for_scan(priv, band, is_active, n_probes,
+                                (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)], vif);
+        }
 
         if (scan->channel_count == 0) {
                 IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
@@ -3387,10 +3437,13 @@ static int iwl3945_mac_sta_add(struct ieee80211_hw *hw,
         bool is_ap = vif->type == NL80211_IFTYPE_STATION;
         u8 sta_id;
 
-        sta_priv->common.sta_id = IWL_INVALID_STATION;
-
         IWL_DEBUG_INFO(priv, "received request to add station %pM\n",
                         sta->addr);
+        mutex_lock(&priv->mutex);
+        IWL_DEBUG_INFO(priv, "proceeding to add station %pM\n",
+                        sta->addr);
+        sta_priv->common.sta_id = IWL_INVALID_STATION;
+
 
         ret = iwl_add_station_common(priv, sta->addr, is_ap, &sta->ht_cap,
                                      &sta_id);
@@ -3398,6 +3451,7 @@ static int iwl3945_mac_sta_add(struct ieee80211_hw *hw,
                 IWL_ERR(priv, "Unable to add station %pM (%d)\n",
                         sta->addr, ret);
                 /* Should we return success if return code is EEXIST ? */
+                mutex_unlock(&priv->mutex);
                 return ret;
         }
 
@@ -3407,6 +3461,7 @@ static int iwl3945_mac_sta_add(struct ieee80211_hw *hw,
         IWL_DEBUG_INFO(priv, "Initializing rate scaling for station %pM\n",
                        sta->addr);
         iwl3945_rs_rate_init(priv, sta, sta_id);
+        mutex_unlock(&priv->mutex);
 
         return 0;
 }
diff --git a/drivers/net/wireless/libertas_tf/main.c b/drivers/net/wireless/libertas_tf/main.c
index 6a04c2157f73..817fffc0de4b 100644
--- a/drivers/net/wireless/libertas_tf/main.c
+++ b/drivers/net/wireless/libertas_tf/main.c
@@ -549,7 +549,7 @@ int lbtf_rx(struct lbtf_private *priv, struct sk_buff *skb)
 
         prxpd = (struct rxpd *) skb->data;
 
-        stats.flag = 0;
+        memset(&stats, 0, sizeof(stats));
         if (!(prxpd->status & cpu_to_le16(MRVDRV_RXPD_STATUS_OK)))
                 stats.flag |= RX_FLAG_FAILED_FCS_CRC;
         stats.freq = priv->cur_freq;
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 07c4528f6e6b..a5ea89cde8c4 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -41,6 +41,8 @@ static DEFINE_PCI_DEVICE_TABLE(p54p_table) = {
         { PCI_DEVICE(0x1260, 0x3877) },
         /* Intersil PRISM Javelin/Xbow Wireless LAN adapter */
         { PCI_DEVICE(0x1260, 0x3886) },
+        /* Intersil PRISM Xbow Wireless LAN adapter (Symbol AP-300) */
+        { PCI_DEVICE(0x1260, 0xffff) },
         { },
 };
 
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index d5b197b4d5bb..73073259f508 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -80,6 +80,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
         {USB_DEVICE(0x1435, 0x0427)},   /* Inventel UR054G */
         {USB_DEVICE(0x2001, 0x3704)},   /* DLink DWL-G122 rev A2 */
+        {USB_DEVICE(0x413c, 0x5513)},   /* Dell WLA3310 USB Wireless Adapter */
         {USB_DEVICE(0x413c, 0x8102)},   /* Spinnaker DUT */
         {USB_DEVICE(0x413c, 0x8104)},   /* Cohiba Proto board */
         {}
diff --git a/drivers/net/wireless/wl12xx/wl1251_sdio.c b/drivers/net/wireless/wl12xx/wl1251_sdio.c
index d234285c2c81..c561332e7009 100644
--- a/drivers/net/wireless/wl12xx/wl1251_sdio.c
+++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c
@@ -259,6 +259,7 @@ disable:
         sdio_disable_func(func);
 release:
         sdio_release_host(func);
+        wl1251_free_hw(wl);
         return ret;
 }
 
diff --git a/drivers/pci/hotplug/cpqphp_core.c b/drivers/pci/hotplug/cpqphp_core.c
index b3e5580c837b..4952c3b9379d 100644
--- a/drivers/pci/hotplug/cpqphp_core.c
+++ b/drivers/pci/hotplug/cpqphp_core.c
@@ -828,7 +828,14 @@ static int cpqhpc_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                         pci_name(pdev), err);
                 return err;
         }
+
         bus = pdev->subordinate;
+        if (!bus) {
+                dev_notice(&pdev->dev, "the device is not a bridge, "
+                                "skipping\n");
+                rc = -ENODEV;
+                goto err_disable_device;
+        }
 
         /* Need to read VID early b/c it's used to differentiate CPQ and INTC
          * discovery
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 796828fce34c..c9171be74564 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -340,7 +340,7 @@ int dmar_disabled = 0;
 int dmar_disabled = 1;
 #endif /*CONFIG_DMAR_DEFAULT_ON*/
 
-static int __initdata dmar_map_gfx = 1;
+static int dmar_map_gfx = 1;
 static int dmar_forcedac;
 static int intel_iommu_strict;
 
@@ -1874,14 +1874,15 @@ static struct dmar_domain *get_domain_for_dev(struct pci_dev *pdev, int gaw)
                         }
                 }
                 if (found) {
+                        spin_unlock_irqrestore(&device_domain_lock, flags);
                         free_devinfo_mem(info);
                         domain_exit(domain);
                         domain = found;
                 } else {
                         list_add(&info->link, &domain->devices);
                         list_add(&info->global, &device_domain_list);
+                        spin_unlock_irqrestore(&device_domain_lock, flags);
                 }
-                spin_unlock_irqrestore(&device_domain_lock, flags);
         }
 
 found_domain:
@@ -3603,7 +3604,8 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
                 pte = dmar_domain->pgd;
                 if (dma_pte_present(pte)) {
                         free_pgtable_page(dmar_domain->pgd);
-                        dmar_domain->pgd = (struct dma_pte *)dma_pte_addr(pte);
+                        dmar_domain->pgd = (struct dma_pte *)
+                                phys_to_virt(dma_pte_addr(pte));
                 }
                 dmar_domain->agaw--;
         }
@@ -3719,6 +3721,12 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
          */
         printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n");
         rwbf_quirk = 1;
+
+        /* https://bugzilla.redhat.com/show_bug.cgi?id=538163 */
+        if (dev->revision == 0x07) {
+                printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
+                dmar_map_gfx = 0;
+        }
 }
 
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index afd2fbf7d797..c9957f68ac9b 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -1035,39 +1035,6 @@ error:
         return retval;
 }
 
-static void pci_remove_slot_links(struct pci_dev *dev)
-{
-        char func[10];
-        struct pci_slot *slot;
-
-        sysfs_remove_link(&dev->dev.kobj, "slot");
-        list_for_each_entry(slot, &dev->bus->slots, list) {
-                if (slot->number != PCI_SLOT(dev->devfn))
-                        continue;
-                snprintf(func, 10, "function%d", PCI_FUNC(dev->devfn));
-                sysfs_remove_link(&slot->kobj, func);
-        }
-}
-
-static int pci_create_slot_links(struct pci_dev *dev)
-{
-        int result = 0;
-        char func[10];
-        struct pci_slot *slot;
-
-        list_for_each_entry(slot, &dev->bus->slots, list) {
-                if (slot->number != PCI_SLOT(dev->devfn))
-                        continue;
-                result = sysfs_create_link(&dev->dev.kobj, &slot->kobj, "slot");
-                if (result)
-                        goto out;
-                snprintf(func, 10, "function%d", PCI_FUNC(dev->devfn));
-                result = sysfs_create_link(&slot->kobj, &dev->dev.kobj, func);
-        }
-out:
-        return result;
-}
-
 int __must_check pci_create_sysfs_dev_files (struct pci_dev *pdev)
 {
         int retval;
@@ -1130,8 +1097,6 @@ int __must_check pci_create_sysfs_dev_files (struct pci_dev *pdev)
         if (retval)
                 goto err_vga_file;
 
-        pci_create_slot_links(pdev);
-
         return 0;
 
 err_vga_file:
@@ -1181,8 +1146,6 @@ void pci_remove_sysfs_dev_files(struct pci_dev *pdev)
         if (!sysfs_initialized)
                 return;
 
-        pci_remove_slot_links(pdev);
-
         pci_remove_capabilities_sysfs(pdev);
 
         if (pdev->cfg_size < PCI_CFG_SPACE_EXP_SIZE)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 60f30e7f1c8c..740fb4ea9669 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2292,6 +2292,7 @@ void pci_msi_off(struct pci_dev *dev)
                 pci_write_config_word(dev, pos + PCI_MSIX_FLAGS, control);
         }
 }
+EXPORT_SYMBOL_GPL(pci_msi_off);
 
 #ifndef HAVE_ARCH_PCI_SET_DMA_MAX_SEGMENT_SIZE
 int pci_set_dma_max_seg_size(struct pci_dev *dev, unsigned int size)
diff --git a/drivers/pci/pcie/pme/pcie_pme.c b/drivers/pci/pcie/pme/pcie_pme.c
index aac285a16b62..d672a0a63816 100644
--- a/drivers/pci/pcie/pme/pcie_pme.c
+++ b/drivers/pci/pcie/pme/pcie_pme.c
@@ -34,7 +34,7 @@
  * being registered.  Consequently, the interrupt-based PCIe PME signaling will
  * not be used by any PCIe root ports in that case.
  */
-static bool pcie_pme_disabled;
+static bool pcie_pme_disabled = true;
 
 /*
  * The PCI Express Base Specification 2.0, Section 6.1.8, states the following:
@@ -64,12 +64,19 @@ bool pcie_pme_msi_disabled;
 
 static int __init pcie_pme_setup(char *str)
 {
-        if (!strcmp(str, "off"))
-                pcie_pme_disabled = true;
-        else if (!strcmp(str, "force"))
+        if (!strncmp(str, "auto", 4))
+                pcie_pme_disabled = false;
+        else if (!strncmp(str, "force", 5))
                 pcie_pme_force_enable = true;
-        else if (!strcmp(str, "nomsi"))
-                pcie_pme_msi_disabled = true;
+
+        str = strchr(str, ',');
+        if (str) {
+                str++;
+                str += strspn(str, " \t");
+                if (*str && !strcmp(str, "nomsi"))
+                        pcie_pme_msi_disabled = true;
+        }
+
         return 1;
 }
 __setup("pcie_pme=", pcie_pme_setup);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index b7512cf08c58..477345d41641 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1457,7 +1457,8 @@ static void quirk_jmicron_ata(struct pci_dev *pdev)
         conf5 &= ~(1 << 24);  /* Clear bit 24 */
 
         switch (pdev->device) {
-        case PCI_DEVICE_ID_JMICRON_JMB360:
+        case PCI_DEVICE_ID_JMICRON_JMB360: /* SATA single port */
+        case PCI_DEVICE_ID_JMICRON_JMB362: /* SATA dual ports */
                 /* The controller should be in single function ahci mode */
                 conf1 |= 0x0002A100; /* Set 8, 13, 15, 17 */
                 break;
@@ -1493,12 +1494,14 @@ static void quirk_jmicron_ata(struct pci_dev *pdev)
 }
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB368, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB360, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB361, quirk_jmicron_ata);
+DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB362, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB363, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB365, quirk_jmicron_ata);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB366, quirk_jmicron_ata);
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 17bed18d24ad..92379e2d37e7 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -97,16 +97,16 @@ int pci_claim_resource(struct pci_dev *dev, int resource)
 
         root = pci_find_parent_resource(dev, res);
         if (!root) {
-                dev_err(&dev->dev, "no compatible bridge window for %pR\n",
-                        res);
+                dev_info(&dev->dev, "no compatible bridge window for %pR\n",
+                         res);
                 return -EINVAL;
         }
 
         conflict = request_resource_conflict(root, res);
         if (conflict) {
-                dev_err(&dev->dev,
-                        "address space collision: %pR conflicts with %s %pR\n",
-                        res, conflict->name, conflict);
+                dev_info(&dev->dev,
+                         "address space collision: %pR conflicts with %s %pR\n",
+                         res, conflict->name, conflict);
                 return -EBUSY;
         }
 
diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
index e0189cf7c558..659eaa0fc48f 100644
--- a/drivers/pci/slot.c
+++ b/drivers/pci/slot.c
@@ -97,50 +97,6 @@ static ssize_t cur_speed_read_file(struct pci_slot *slot, char *buf)
         return bus_speed_read(slot->bus->cur_bus_speed, buf);
 }
 
-static void remove_sysfs_files(struct pci_slot *slot)
-{
-        char func[10];
-        struct list_head *tmp;
-
-        list_for_each(tmp, &slot->bus->devices) {
-                struct pci_dev *dev = pci_dev_b(tmp);
-                if (PCI_SLOT(dev->devfn) != slot->number)
-                        continue;
-                sysfs_remove_link(&dev->dev.kobj, "slot");
-
-                snprintf(func, 10, "function%d", PCI_FUNC(dev->devfn));
-                sysfs_remove_link(&slot->kobj, func);
-        }
-}
-
-static int create_sysfs_files(struct pci_slot *slot)
-{
-        int result;
-        char func[10];
-        struct list_head *tmp;
-
-        list_for_each(tmp, &slot->bus->devices) {
-                struct pci_dev *dev = pci_dev_b(tmp);
-                if (PCI_SLOT(dev->devfn) != slot->number)
-                        continue;
-
-                result = sysfs_create_link(&dev->dev.kobj, &slot->kobj, "slot");
-                if (result)
-                        goto fail;
-
-                snprintf(func, 10, "function%d", PCI_FUNC(dev->devfn));
-                result = sysfs_create_link(&slot->kobj, &dev->dev.kobj, func);
-                if (result)
-                        goto fail;
-        }
-
-        return 0;
-
-fail:
-        remove_sysfs_files(slot);
-        return result;
-}
-
 static void pci_slot_release(struct kobject *kobj)
 {
         struct pci_dev *dev;
@@ -153,8 +109,6 @@ static void pci_slot_release(struct kobject *kobj)
                 if (PCI_SLOT(dev->devfn) == slot->number)
                         dev->slot = NULL;
 
-        remove_sysfs_files(slot);
-
         list_del(&slot->list);
 
         kfree(slot);
@@ -346,8 +300,6 @@ placeholder:
         INIT_LIST_HEAD(&slot->list);
         list_add(&slot->list, &parent->slots);
 
-        create_sysfs_files(slot);
-
         list_for_each_entry(dev, &parent->devices, bus_list)
                 if (PCI_SLOT(dev->devfn) == slot_nr)
                         dev->slot = slot;
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 7ef7adee5e4f..eac961463be2 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -671,6 +671,7 @@ static void pcmcia_requery(struct pcmcia_socket *s)
                 if (old_funcs != new_funcs) {
                         /* we need to re-start */
                         pcmcia_card_remove(s, NULL);
+                        s->functions = 0;
                         pcmcia_card_add(s);
                 }
         }
@@ -1355,6 +1356,7 @@ static int __devinit pcmcia_bus_add_socket(struct device *dev,
         INIT_LIST_HEAD(&socket->devices_list);
         memset(&socket->pcmcia_state, 0, sizeof(u8));
         socket->device_count = 0;
+        atomic_set(&socket->present, 0);
 
         ret = pccard_register_pcmcia(socket, &pcmcia_bus_callback);
         if (ret) {
@@ -1363,8 +1365,6 @@ static int __devinit pcmcia_bus_add_socket(struct device *dev,
                 return ret;
         }
 
-        atomic_set(&socket->present, 0);
-
         return 0;
 }
 
diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
index 424e576f3acb..f1d41374eea7 100644
--- a/drivers/pcmcia/yenta_socket.c
+++ b/drivers/pcmcia/yenta_socket.c
@@ -880,6 +880,12 @@ static struct cardbus_type cardbus_type[] = {
                 .restore_state  = ti_restore_state,
                 .sock_init      = ti_init,
         },
+        [CARDBUS_TYPE_ENE]      = {
+                .override       = ene_override,
+                .save_state     = ti_save_state,
+                .restore_state  = ti_restore_state,
+                .sock_init      = ti_init,
+        },
 #endif
 #ifdef CONFIG_YENTA_RICOH
         [CARDBUS_TYPE_RICOH]    = {
@@ -902,14 +908,6 @@ static struct cardbus_type cardbus_type[] = {
                 .restore_state  = o2micro_restore_state,
         },
 #endif
-#ifdef CONFIG_YENTA_TI
-        [CARDBUS_TYPE_ENE]      = {
-                .override       = ene_override,
-                .save_state     = ti_save_state,
-                .restore_state  = ti_restore_state,
-                .sock_init      = ti_init,
-        },
-#endif
 };
 
 
@@ -975,7 +973,7 @@ static irqreturn_t yenta_probe_handler(int irq, void *dev_id)
 /* probes the PCI interrupt, use only on override functions */
 static int yenta_probe_cb_irq(struct yenta_socket *socket)
 {
-        u8 reg;
+        u8 reg = 0;
 
         if (!socket->cb_irq)
                 return -1;
@@ -989,7 +987,8 @@ static int yenta_probe_cb_irq(struct yenta_socket *socket)
         }
 
         /* generate interrupt, wait */
-        reg = exca_readb(socket, I365_CSCINT);
+        if (!socket->dev->irq)
+                reg = exca_readb(socket, I365_CSCINT);
         exca_writeb(socket, I365_CSCINT, reg | I365_CSC_STSCHG);
         cb_writel(socket, CB_SOCKET_EVENT, -1);
         cb_writel(socket, CB_SOCKET_MASK, CB_CSTSMASK);
diff --git a/drivers/power/z2_battery.c b/drivers/power/z2_battery.c
index 9cca465436e3..85064a9f649e 100644
--- a/drivers/power/z2_battery.c
+++ b/drivers/power/z2_battery.c
@@ -9,19 +9,13 @@
  *
  */
 
-#include <linux/init.h>
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/power_supply.h>
-#include <linux/i2c.h>
-#include <linux/spinlock.h>
-#include <linux/interrupt.h>
 #include <linux/gpio.h>
+#include <linux/i2c.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
-#include <asm/irq.h>
-#include <asm/mach/irq.h>
+#include <linux/power_supply.h>
+#include <linux/slab.h>
 #include <linux/z2_battery.h>
 
 #define Z2_DEFAULT_NAME "Z2"
diff --git a/drivers/rtc/rtc-davinci.c b/drivers/rtc/rtc-davinci.c
index 92a8f6cacda9..34647fc1ee98 100644
--- a/drivers/rtc/rtc-davinci.c
+++ b/drivers/rtc/rtc-davinci.c
@@ -29,6 +29,7 @@
 #include <linux/bcd.h>
 #include <linux/platform_device.h>
 #include <linux/io.h>
+#include <linux/slab.h>
 
 /*
  * The DaVinci RTC is a simple RTC with the following
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index de033b7ac21f..d827ce570a8c 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -777,7 +777,7 @@ static int __devinit ds1307_probe(struct i2c_client *client,
 
 read_rtc:
         /* read RTC registers */
-        tmp = ds1307->read_block_data(ds1307->client, 0, 8, buf);
+        tmp = ds1307->read_block_data(ds1307->client, ds1307->offset, 8, buf);
         if (tmp != 8) {
                 pr_debug("read error %d\n", tmp);
                 err = -EIO;
@@ -862,7 +862,7 @@ read_rtc:
                 if (ds1307->regs[DS1307_REG_HOUR] & DS1307_BIT_PM)
                         tmp += 12;
                 i2c_smbus_write_byte_data(client,
-                                DS1307_REG_HOUR,
+                                ds1307->offset + DS1307_REG_HOUR,
                                 bin2bcd(tmp));
         }
 
diff --git a/drivers/s390/cio/itcw.c b/drivers/s390/cio/itcw.c
index 17da9ab932ed..a0ae29564774 100644
--- a/drivers/s390/cio/itcw.c
+++ b/drivers/s390/cio/itcw.c
@@ -42,7 +42,7 @@
  * size_t size;
  *
  * size = itcw_calc_size(1, 2, 0);
- * buffer = kmalloc(size, GFP_DMA);
+ * buffer = kmalloc(size, GFP_KERNEL | GFP_DMA);
  * if (!buffer)
  *      return -ENOMEM;
  * itcw = itcw_init(buffer, size, ITCW_OP_READ, 1, 2, 0);
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index 9eb62a256e9a..cd6cf575902e 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -930,6 +930,83 @@ static void cpm_uart_config_port(struct uart_port *port, int flags)
         }
 }
 
+#if defined(CONFIG_CONSOLE_POLL) || defined(CONFIG_SERIAL_CPM_CONSOLE)
+/*
+ * Write a string to the serial port
+ * Note that this is called with interrupts already disabled
+ */
+static void cpm_uart_early_write(struct uart_cpm_port *pinfo,
+                const char *string, u_int count)
+{
+        unsigned int i;
+        cbd_t __iomem *bdp, *bdbase;
+        unsigned char *cpm_outp_addr;
+
+        /* Get the address of the host memory buffer.
+         */
+        bdp = pinfo->tx_cur;
+        bdbase = pinfo->tx_bd_base;
+
+        /*
+         * Now, do each character.  This is not as bad as it looks
+         * since this is a holding FIFO and not a transmitting FIFO.
+         * We could add the complexity of filling the entire transmit
+         * buffer, but we would just wait longer between accesses......
+         */
+        for (i = 0; i < count; i++, string++) {
+                /* Wait for transmitter fifo to empty.
+                 * Ready indicates output is ready, and xmt is doing
+                 * that, not that it is ready for us to send.
+                 */
+                while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+                        ;
+
+                /* Send the character out.
+                 * If the buffer address is in the CPM DPRAM, don't
+                 * convert it.
+                 */
+                cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr),
+                                        pinfo);
+                *cpm_outp_addr = *string;
+
+                out_be16(&bdp->cbd_datlen, 1);
+                setbits16(&bdp->cbd_sc, BD_SC_READY);
+
+                if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
+                        bdp = bdbase;
+                else
+                        bdp++;
+
+                /* if a LF, also do CR... */
+                if (*string == 10) {
+                        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+                                ;
+
+                        cpm_outp_addr = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr),
+                                                pinfo);
+                        *cpm_outp_addr = 13;
+
+                        out_be16(&bdp->cbd_datlen, 1);
+                        setbits16(&bdp->cbd_sc, BD_SC_READY);
+
+                        if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
+                                bdp = bdbase;
+                        else
+                                bdp++;
+                }
+        }
+
+        /*
+         * Finally, Wait for transmitter & holding register to empty
+         *  and restore the IER
+         */
+        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
+                ;
+
+        pinfo->tx_cur = bdp;
+}
+#endif
+
 #ifdef CONFIG_CONSOLE_POLL
 /* Serial polling routines for writing and reading from the uart while
  * in an interrupt or debug context.
@@ -999,7 +1076,7 @@ static void cpm_put_poll_char(struct uart_port *port,
         static char ch[2];
 
         ch[0] = (char)c;
-        cpm_uart_early_write(pinfo->port.line, ch, 1);
+        cpm_uart_early_write(pinfo, ch, 1);
 }
 #endif /* CONFIG_CONSOLE_POLL */
 
@@ -1130,9 +1207,6 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                                    u_int count)
 {
         struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index];
-        unsigned int i;
-        cbd_t __iomem *bdp, *bdbase;
-        unsigned char *cp;
         unsigned long flags;
         int nolock = oops_in_progress;
 
@@ -1142,66 +1216,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                 spin_lock_irqsave(&pinfo->port.lock, flags);
         }
 
-        /* Get the address of the host memory buffer.
-         */
-        bdp = pinfo->tx_cur;
-        bdbase = pinfo->tx_bd_base;
-
-        /*
-         * Now, do each character.  This is not as bad as it looks
-         * since this is a holding FIFO and not a transmitting FIFO.
-         * We could add the complexity of filling the entire transmit
-         * buffer, but we would just wait longer between accesses......
-         */
-        for (i = 0; i < count; i++, s++) {
-                /* Wait for transmitter fifo to empty.
-                 * Ready indicates output is ready, and xmt is doing
-                 * that, not that it is ready for us to send.
-                 */
-                while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
-                        ;
-
-                /* Send the character out.
-                 * If the buffer address is in the CPM DPRAM, don't
-                 * convert it.
-                 */
-                cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo);
-                *cp = *s;
-
-                out_be16(&bdp->cbd_datlen, 1);
-                setbits16(&bdp->cbd_sc, BD_SC_READY);
-
-                if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
-                        bdp = bdbase;
-                else
-                        bdp++;
-
-                /* if a LF, also do CR... */
-                if (*s == 10) {
-                        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
-                                ;
-
-                        cp = cpm2cpu_addr(in_be32(&bdp->cbd_bufaddr), pinfo);
-                        *cp = 13;
-
-                        out_be16(&bdp->cbd_datlen, 1);
-                        setbits16(&bdp->cbd_sc, BD_SC_READY);
-
-                        if (in_be16(&bdp->cbd_sc) & BD_SC_WRAP)
-                                bdp = bdbase;
-                        else
-                                bdp++;
-                }
-        }
-
-        /*
-         * Finally, Wait for transmitter & holding register to empty
-         *  and restore the IER
-         */
-        while ((in_be16(&bdp->cbd_sc) & BD_SC_READY) != 0)
-                ;
-
-        pinfo->tx_cur = bdp;
+        cpm_uart_early_write(pinfo, s, count);
 
         if (unlikely(nolock)) {
                 local_irq_restore(flags);
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index 526307368f8b..ab17c08ddc03 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -821,6 +821,7 @@ static struct pcmcia_device_id serial_ids[] = {
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(1, "Psion Dacom", "Gold Card V34 Ethernet", 0xf5f025c2, 0x338e8155, "cis/PCMLM28.cis"),
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(1, "Psion Dacom", "Gold Card V34 Ethernet GSM", 0xf5f025c2, 0x4ae85d35, "cis/PCMLM28.cis"),
         PCMCIA_PFC_DEVICE_CIS_PROD_ID12(1, "LINKSYS", "PCMLM28", 0xf7cb0b07, 0x66881874, "cis/PCMLM28.cis"),
+        PCMCIA_PFC_DEVICE_CIS_PROD_ID12(1, "TOSHIBA", "Modem/LAN Card", 0xb4585a1a, 0x53f922f8, "cis/PCMLM28.cis"),
         PCMCIA_MFC_DEVICE_CIS_PROD_ID12(1, "DAYNA COMMUNICATIONS", "LAN AND MODEM MULTIFUNCTION", 0x8fdf8f89, 0xdd5ed9e8, "cis/DP83903.cis"),
         PCMCIA_MFC_DEVICE_CIS_PROD_ID4(1, "NSC MF LAN/Modem", 0x58fc6056, "cis/DP83903.cis"),
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(1, 0x0101, 0x0556, "cis/3CCFEM556.cis"),
diff --git a/drivers/staging/batman-adv/bat_sysfs.c b/drivers/staging/batman-adv/bat_sysfs.c
index e2c000b80ca0..212bc21e6d68 100644
--- a/drivers/staging/batman-adv/bat_sysfs.c
+++ b/drivers/staging/batman-adv/bat_sysfs.c
@@ -225,9 +225,9 @@ static struct bat_attribute *mesh_attrs[] = {
         NULL,
 };
 
-static ssize_t transtable_local_read(struct kobject *kobj,
-                               struct bin_attribute *bin_attr,
-                               char *buff, loff_t off, size_t count)
+static ssize_t transtable_local_read(struct file *filp, struct kobject *kobj,
+                                  struct bin_attribute *bin_attr,
+                                  char *buff, loff_t off, size_t count)
 {
         struct device *dev = to_dev(kobj->parent);
         struct net_device *net_dev = to_net_dev(dev);
@@ -235,9 +235,9 @@ static ssize_t transtable_local_read(struct kobject *kobj,
         return hna_local_fill_buffer_text(net_dev, buff, count, off);
 }
 
-static ssize_t transtable_global_read(struct kobject *kobj,
-                               struct bin_attribute *bin_attr,
-                               char *buff, loff_t off, size_t count)
+static ssize_t transtable_global_read(struct file *filp, struct kobject *kobj,
+                                  struct bin_attribute *bin_attr,
+                                  char *buff, loff_t off, size_t count)
 {
         struct device *dev = to_dev(kobj->parent);
         struct net_device *net_dev = to_net_dev(dev);
@@ -245,9 +245,9 @@ static ssize_t transtable_global_read(struct kobject *kobj,
         return hna_global_fill_buffer_text(net_dev, buff, count, off);
 }
 
-static ssize_t originators_read(struct kobject *kobj,
-                               struct bin_attribute *bin_attr,
-                               char *buff, loff_t off, size_t count)
+static ssize_t originators_read(struct file *filp, struct kobject *kobj,
+                                  struct bin_attribute *bin_attr,
+                                  char *buff, loff_t off, size_t count)
 {
         struct device *dev = to_dev(kobj->parent);
         struct net_device *net_dev = to_net_dev(dev);
@@ -255,9 +255,9 @@ static ssize_t originators_read(struct kobject *kobj,
         return orig_fill_buffer_text(net_dev, buff, count, off);
 }
 
-static ssize_t vis_data_read(struct kobject *kobj,
-                             struct bin_attribute *bin_attr,
-                             char *buff, loff_t off, size_t count)
+static ssize_t vis_data_read(struct file *filp, struct kobject *kobj,
+                                  struct bin_attribute *bin_attr,
+                                  char *buff, loff_t off, size_t count)
 {
         struct device *dev = to_dev(kobj->parent);
         struct net_device *net_dev = to_net_dev(dev);
diff --git a/drivers/staging/batman-adv/device.c b/drivers/staging/batman-adv/device.c
index 7eb6559e0315..32204b5572d0 100644
--- a/drivers/staging/batman-adv/device.c
+++ b/drivers/staging/batman-adv/device.c
@@ -196,7 +196,7 @@ ssize_t bat_device_read(struct file *file, char __user *buf, size_t count,
         kfree(device_packet);
 
         if (error)
-                return error;
+                return -EFAULT;
 
         return sizeof(struct icmp_packet);
 }
diff --git a/drivers/staging/comedi/drivers/adl_pci9111.c b/drivers/staging/comedi/drivers/adl_pci9111.c
index 36a254cd4413..39d112b708e3 100644
--- a/drivers/staging/comedi/drivers/adl_pci9111.c
+++ b/drivers/staging/comedi/drivers/adl_pci9111.c
@@ -824,9 +824,12 @@ static int pci9111_ai_do_cmd(struct comedi_device *dev,
                 plx9050_interrupt_control(dev_private->lcr_io_base, true, true,
                                           false, true, true);
 
-                dev_private->scan_delay =
-                    (async_cmd->scan_begin_arg / (async_cmd->convert_arg *
-                                                  async_cmd->chanlist_len)) - 1;
+                if (async_cmd->scan_begin_src == TRIG_TIMER) {
+                        dev_private->scan_delay =
+                                (async_cmd->scan_begin_arg /
+                                 (async_cmd->convert_arg *
+                                  async_cmd->chanlist_len)) - 1;
+                }
 
                 break;
 
diff --git a/drivers/staging/comedi/drivers/cb_pcidda.c b/drivers/staging/comedi/drivers/cb_pcidda.c
index 81829d6fd287..c374bee25068 100644
--- a/drivers/staging/comedi/drivers/cb_pcidda.c
+++ b/drivers/staging/comedi/drivers/cb_pcidda.c
@@ -52,7 +52,6 @@ Please report success/failure with other different cards to
 #include "8255.h"
 
 #define PCI_VENDOR_ID_CB        0x1307  /*  PCI vendor number of ComputerBoards */
-#define N_BOARDS        10      /*  Number of boards in cb_pcidda_boards */
 #define EEPROM_SIZE     128     /*  number of entries in eeprom */
 #define MAX_AO_CHANNELS 8       /*  maximum number of ao channels for supported boards */
 
@@ -307,7 +306,7 @@ static int cb_pcidda_attach(struct comedi_device *dev,
                                         continue;
                                 }
                         }
-                        for (index = 0; index < N_BOARDS; index++) {
+                        for (index = 0; index < ARRAY_SIZE(cb_pcidda_boards); index++) {
                                 if (cb_pcidda_boards[index].device_id ==
                                     pcidev->device) {
                                         goto found;
diff --git a/drivers/staging/hv/channel_mgmt.c b/drivers/staging/hv/channel_mgmt.c
index 3f53b4d1e4cf..12db555a3a5d 100644
--- a/drivers/staging/hv/channel_mgmt.c
+++ b/drivers/staging/hv/channel_mgmt.c
@@ -23,6 +23,7 @@
 #include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/completion.h>
 #include "osd.h"
 #include "logging.h"
 #include "vmbus_private.h"
@@ -293,6 +294,25 @@ void FreeVmbusChannel(struct vmbus_channel *Channel)
                               Channel);
 }
 
+
+DECLARE_COMPLETION(hv_channel_ready);
+
+/*
+ * Count initialized channels, and ensure all channels are ready when hv_vmbus
+ * module loading completes.
+ */
+static void count_hv_channel(void)
+{
+        static int counter;
+        unsigned long flags;
+
+        spin_lock_irqsave(&gVmbusConnection.channel_lock, flags);
+        if (++counter == MAX_MSG_TYPES)
+                complete(&hv_channel_ready);
+        spin_unlock_irqrestore(&gVmbusConnection.channel_lock, flags);
+}
+
+
 /*
  * VmbusChannelProcessOffer - Process the offer by creating a channel/device
  * associated with this offer
@@ -373,22 +393,21 @@ static void VmbusChannelProcessOffer(void *context)
                  * can cleanup properly
                  */
                 newChannel->State = CHANNEL_OPEN_STATE;
-                cnt = 0;
 
-                while (cnt != MAX_MSG_TYPES) {
+                /* Open IC channels */
+                for (cnt = 0; cnt < MAX_MSG_TYPES; cnt++) {
                         if (memcmp(&newChannel->OfferMsg.Offer.InterfaceType,
                                    &hv_cb_utils[cnt].data,
-                                   sizeof(struct hv_guid)) == 0) {
+                                   sizeof(struct hv_guid)) == 0 &&
+                                VmbusChannelOpen(newChannel, 2 * PAGE_SIZE,
+                                                 2 * PAGE_SIZE, NULL, 0,
+                                                 hv_cb_utils[cnt].callback,
+                                                 newChannel) == 0) {
+                                hv_cb_utils[cnt].channel = newChannel;
                                 DPRINT_INFO(VMBUS, "%s",
-                                            hv_cb_utils[cnt].log_msg);
-
-                                if (VmbusChannelOpen(newChannel, 2 * PAGE_SIZE,
-                                                    2 * PAGE_SIZE, NULL, 0,
-                                                    hv_cb_utils[cnt].callback,
-                                                    newChannel) == 0)
-                                        hv_cb_utils[cnt].channel = newChannel;
+                                                hv_cb_utils[cnt].log_msg);
+                                count_hv_channel();
                         }
-                        cnt++;
                 }
         }
         DPRINT_EXIT(VMBUS);
diff --git a/drivers/staging/hv/hv_utils.c b/drivers/staging/hv/hv_utils.c
index 8a49aafea37a..2adc9b48ca9c 100644
--- a/drivers/staging/hv/hv_utils.c
+++ b/drivers/staging/hv/hv_utils.c
@@ -24,6 +24,8 @@
 #include <linux/slab.h>
 #include <linux/sysctl.h>
 #include <linux/reboot.h>
+#include <linux/dmi.h>
+#include <linux/pci.h>
 
 #include "logging.h"
 #include "osd.h"
@@ -251,10 +253,36 @@ static void heartbeat_onchannelcallback(void *context)
         DPRINT_EXIT(VMBUS);
 }
 
+static const struct pci_device_id __initconst
+hv_utils_pci_table[] __maybe_unused = {
+        { PCI_DEVICE(0x1414, 0x5353) }, /* Hyper-V emulated VGA controller */
+        { 0 }
+};
+MODULE_DEVICE_TABLE(pci, hv_utils_pci_table);
+
+
+static const struct dmi_system_id __initconst
+hv_utils_dmi_table[] __maybe_unused  = {
+        {
+                .ident = "Hyper-V",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Virtual Machine"),
+                        DMI_MATCH(DMI_BOARD_NAME, "Virtual Machine"),
+                },
+        },
+        { },
+};
+MODULE_DEVICE_TABLE(dmi, hv_utils_dmi_table);
+
+
 static int __init init_hyperv_utils(void)
 {
         printk(KERN_INFO "Registering HyperV Utility Driver\n");
 
+        if (!dmi_check_system(hv_utils_dmi_table))
+                return -ENODEV;
+
         hv_cb_utils[HV_SHUTDOWN_MSG].channel->OnChannelCallback =
                 &shutdown_onchannelcallback;
         hv_cb_utils[HV_SHUTDOWN_MSG].callback = &shutdown_onchannelcallback;
diff --git a/drivers/staging/hv/vmbus.h b/drivers/staging/hv/vmbus.h
index 0c6ee0f487f3..3c14b2926e00 100644
--- a/drivers/staging/hv/vmbus.h
+++ b/drivers/staging/hv/vmbus.h
@@ -74,4 +74,6 @@ int vmbus_child_driver_register(struct driver_context *driver_ctx);
 void vmbus_child_driver_unregister(struct driver_context *driver_ctx);
 void vmbus_get_interface(struct vmbus_channel_interface *interface);
 
+extern struct completion hv_channel_ready;
+
 #endif /* _VMBUS_H_ */
diff --git a/drivers/staging/hv/vmbus_drv.c b/drivers/staging/hv/vmbus_drv.c
index c21731a12ca7..22c80ece6388 100644
--- a/drivers/staging/hv/vmbus_drv.c
+++ b/drivers/staging/hv/vmbus_drv.c
@@ -27,6 +27,7 @@
 #include <linux/pci.h>
 #include <linux/dmi.h>
 #include <linux/slab.h>
+#include <linux/completion.h>
 #include "version_info.h"
 #include "osd.h"
 #include "logging.h"
@@ -356,6 +357,8 @@ static int vmbus_bus_init(int (*drv_init)(struct hv_driver *drv))
 
         vmbus_drv_obj->GetChannelOffers();
 
+        wait_for_completion(&hv_channel_ready);
+
 cleanup:
         DPRINT_EXIT(VMBUS_DRV);
 
diff --git a/drivers/staging/mrst-touchscreen/intel-mid-touch.c b/drivers/staging/mrst-touchscreen/intel-mid-touch.c
index 1db00975a594..abba22f921be 100644
--- a/drivers/staging/mrst-touchscreen/intel-mid-touch.c
+++ b/drivers/staging/mrst-touchscreen/intel-mid-touch.c
@@ -817,9 +817,9 @@ static int mrstouch_remove(struct spi_device *spi)
         free_irq(mrstouchdevp->irq, mrstouchdevp);
         input_unregister_device(mrstouchdevp->input);
         input_free_device(mrstouchdevp->input);
-        kfree(mrstouchdevp);
         if (mrstouchdevp->pendet_thrd)
                 kthread_stop(mrstouchdevp->pendet_thrd);
+        kfree(mrstouchdevp);
         return 0;
 }
 
diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
index b740662d095a..674769d2b59b 100644
--- a/drivers/staging/rt2860/usb_main_dev.c
+++ b/drivers/staging/rt2860/usb_main_dev.c
@@ -77,6 +77,7 @@ struct usb_device_id rtusb_usb_id[] = {
         {USB_DEVICE(0x083A, 0x7522)},   /* Arcadyan */
         {USB_DEVICE(0x0CDE, 0x0022)},   /* ZCOM */
         {USB_DEVICE(0x0586, 0x3416)},   /* Zyxel */
+        {USB_DEVICE(0x0586, 0x341a)},   /* Zyxel NWD-270N */
         {USB_DEVICE(0x0CDE, 0x0025)},   /* Zyxel */
         {USB_DEVICE(0x1740, 0x9701)},   /* EnGenius */
         {USB_DEVICE(0x1740, 0x9702)},   /* EnGenius */
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
index dacefea78113..49ab9fa9ffa7 100644
--- a/drivers/staging/rtl8187se/r8180_core.c
+++ b/drivers/staging/rtl8187se/r8180_core.c
@@ -66,8 +66,6 @@ static int hwseqnum = 0;
 static int hwwep = 0;
 static int channels = 0x3fff;
 
-#define eqMacAddr(a, b)         (((a)[0] == (b)[0] && (a)[1] == (b)[1] && (a)[2] == (b)[2] && (a)[3] == (b)[3] && (a)[4] == (b)[4] && (a)[5] == (b)[5]) ? 1 : 0)
-#define cpMacAddr(des, src)             ((des)[0] = (src)[0], (des)[1] = (src)[1], (des)[2] = (src)[2], (des)[3] = (src)[3], (des)[4] = (src)[4], (des)[5] = (src)[5])
 MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(pci, rtl8180_pci_id_tbl);
 MODULE_AUTHOR("Andrea Merello <andreamrl@tiscali.it>");
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index 447d6474a70c..1b6890611fb6 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -112,28 +112,29 @@ u32 rt_global_debug_component = \
 #define CAM_CONTENT_COUNT 8
 
 static const struct usb_device_id rtl8192_usb_id_tbl[] = {
-        /* Realtek */
-        {USB_DEVICE(0x0bda, 0x8171)},
-        {USB_DEVICE(0x0bda, 0x8192)},
-        {USB_DEVICE(0x0bda, 0x8709)},
-        /* Corega */
-        {USB_DEVICE(0x07aa, 0x0043)},
-        /* Belkin */
-        {USB_DEVICE(0x050d, 0x805E)},
-        {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */
-        /* Sitecom */
-        {USB_DEVICE(0x0df6, 0x0031)},
-        {USB_DEVICE(0x0df6, 0x004b)},   /* WL-349 */
-        /* EnGenius */
-        {USB_DEVICE(0x1740, 0x9201)},
-        /* Dlink */
-        {USB_DEVICE(0x2001, 0x3301)},
-        /* Zinwell */
-        {USB_DEVICE(0x5a57, 0x0290)},
-        /* Guillemot */
-        {USB_DEVICE(0x06f8, 0xe031)},
-        //92SU
+        {USB_DEVICE(0x0bda, 0x8171)}, /* Realtek */
         {USB_DEVICE(0x0bda, 0x8172)},
+        {USB_DEVICE(0x0bda, 0x8173)},
+        {USB_DEVICE(0x0bda, 0x8174)},
+        {USB_DEVICE(0x0bda, 0x8712)},
+        {USB_DEVICE(0x0bda, 0x8713)},
+        {USB_DEVICE(0x07aa, 0x0047)},
+        {USB_DEVICE(0x07d1, 0x3303)},
+        {USB_DEVICE(0x07d1, 0x3302)},
+        {USB_DEVICE(0x07d1, 0x3300)},
+        {USB_DEVICE(0x1740, 0x9603)},
+        {USB_DEVICE(0x1740, 0x9605)},
+        {USB_DEVICE(0x050d, 0x815F)},
+        {USB_DEVICE(0x06f8, 0xe031)},
+        {USB_DEVICE(0x7392, 0x7611)},
+        {USB_DEVICE(0x7392, 0x7612)},
+        {USB_DEVICE(0x7392, 0x7622)},
+        {USB_DEVICE(0x0DF6, 0x0045)},
+        {USB_DEVICE(0x0E66, 0x0015)},
+        {USB_DEVICE(0x0E66, 0x0016)},
+        {USB_DEVICE(0x0b05, 0x1786)},
+        /* these are not in the official list */
+        {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */
         {}
 };
 
diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index 2bede271a2f0..f38472c2e75c 100644
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -121,6 +121,8 @@ static const struct usb_device_id rtl8192_usb_id_tbl[] = {
         {USB_DEVICE(0x2001, 0x3301)},
         /* Zinwell */
         {USB_DEVICE(0x5a57, 0x0290)},
+        /* LG */
+        {USB_DEVICE(0x043e, 0x7a01)},
         {}
 };
 
diff --git a/drivers/staging/tm6000/tm6000-alsa.c b/drivers/staging/tm6000/tm6000-alsa.c
index ce081cd44ad4..273e26ede650 100644
--- a/drivers/staging/tm6000/tm6000-alsa.c
+++ b/drivers/staging/tm6000/tm6000-alsa.c
@@ -15,6 +15,7 @@
 #include <linux/device.h>
 #include <linux/interrupt.h>
 #include <linux/usb.h>
+#include <linux/slab.h>
 
 #include <asm/delay.h>
 #include <sound/core.h>
diff --git a/drivers/staging/tm6000/tm6000-cards.c b/drivers/staging/tm6000/tm6000-cards.c
index cedd9044022f..6a9ae40c7c6d 100644
--- a/drivers/staging/tm6000/tm6000-cards.c
+++ b/drivers/staging/tm6000/tm6000-cards.c
@@ -24,6 +24,7 @@
 #include <linux/i2c.h>
 #include <linux/usb.h>
 #include <linux/version.h>
+#include <linux/slab.h>
 #include <media/v4l2-common.h>
 #include <media/tuner.h>
 #include <media/tvaudio.h>
diff --git a/drivers/staging/tm6000/tm6000-core.c b/drivers/staging/tm6000/tm6000-core.c
index 27f3f551b545..c3690e3580da 100644
--- a/drivers/staging/tm6000/tm6000-core.c
+++ b/drivers/staging/tm6000/tm6000-core.c
@@ -22,6 +22,7 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 #include <linux/i2c.h>
 #include "tm6000.h"
diff --git a/drivers/staging/tm6000/tm6000-dvb.c b/drivers/staging/tm6000/tm6000-dvb.c
index 261e66acbe46..86c1c8b5f25a 100644
--- a/drivers/staging/tm6000/tm6000-dvb.c
+++ b/drivers/staging/tm6000/tm6000-dvb.c
@@ -18,6 +18,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/usb.h>
 
 #include "tm6000.h"
diff --git a/drivers/staging/usbip/usbip_common.c b/drivers/staging/usbip/usbip_common.c
index 52408164036f..6a499f0eb594 100644
--- a/drivers/staging/usbip/usbip_common.c
+++ b/drivers/staging/usbip/usbip_common.c
@@ -378,47 +378,67 @@ int usbip_thread(void *param)
         complete_and_exit(&ut->thread_done, 0);
 }
 
+static void stop_rx_thread(struct usbip_device *ud)
+{
+        if (ud->tcp_rx.thread != NULL) {
+                send_sig(SIGKILL, ud->tcp_rx.thread, 1);
+                wait_for_completion(&ud->tcp_rx.thread_done);
+                usbip_udbg("rx_thread for ud %p has finished\n", ud);
+        }
+}
+
+static void stop_tx_thread(struct usbip_device *ud)
+{
+        if (ud->tcp_tx.thread != NULL) {
+                send_sig(SIGKILL, ud->tcp_tx.thread, 1);
+                wait_for_completion(&ud->tcp_tx.thread_done);
+                usbip_udbg("tx_thread for ud %p has finished\n", ud);
+        }
+}
+
 int usbip_start_threads(struct usbip_device *ud)
 {
         /*
          * threads are invoked per one device (per one connection).
          */
         struct task_struct *th;
+        int err = 0;
 
         th = kthread_run(usbip_thread, (void *)&ud->tcp_rx, "usbip");
         if (IS_ERR(th)) {
                 printk(KERN_WARNING
                         "Unable to start control thread\n");
-                return PTR_ERR(th);
+                err = PTR_ERR(th);
+                goto ust_exit;
         }
+
         th = kthread_run(usbip_thread, (void *)&ud->tcp_tx, "usbip");
         if (IS_ERR(th)) {
                 printk(KERN_WARNING
                         "Unable to start control thread\n");
-                return PTR_ERR(th);
+                err = PTR_ERR(th);
+                goto tx_thread_err;
         }
 
         /* confirm threads are starting */
         wait_for_completion(&ud->tcp_rx.thread_done);
         wait_for_completion(&ud->tcp_tx.thread_done);
+
         return 0;
+
+tx_thread_err:
+        stop_rx_thread(ud);
+
+ust_exit:
+        return err;
 }
 EXPORT_SYMBOL_GPL(usbip_start_threads);
 
 void usbip_stop_threads(struct usbip_device *ud)
 {
         /* kill threads related to this sdev, if v.c. exists */
-        if (ud->tcp_rx.thread != NULL) {
-                send_sig(SIGKILL, ud->tcp_rx.thread, 1);
-                wait_for_completion(&ud->tcp_rx.thread_done);
-                usbip_udbg("rx_thread for ud %p has finished\n", ud);
-        }
-
-        if (ud->tcp_tx.thread != NULL) {
-                send_sig(SIGKILL, ud->tcp_tx.thread, 1);
-                wait_for_completion(&ud->tcp_tx.thread_done);
-                usbip_udbg("tx_thread for ud %p has finished\n", ud);
-        }
+        stop_rx_thread(ud);
+        stop_tx_thread(ud);
 }
 EXPORT_SYMBOL_GPL(usbip_stop_threads);
 
diff --git a/drivers/staging/wlags49_h2/wl_enc.c b/drivers/staging/wlags49_h2/wl_enc.c
index 48c44c8fdb28..26cf5486edd6 100644
--- a/drivers/staging/wlags49_h2/wl_enc.c
+++ b/drivers/staging/wlags49_h2/wl_enc.c
@@ -62,6 +62,7 @@
 /*******************************************************************************
  *  include files
  ******************************************************************************/
+#include <linux/string.h>
 #include <wl_version.h>
 
 #include <debug.h>
diff --git a/drivers/staging/wlags49_h2/wl_sysfs.h b/drivers/staging/wlags49_h2/wl_sysfs.h
index 6d96d03cf490..fa658c38001e 100644
--- a/drivers/staging/wlags49_h2/wl_sysfs.h
+++ b/drivers/staging/wlags49_h2/wl_sysfs.h
@@ -2,6 +2,6 @@
 extern void register_wlags_sysfs(struct net_device *);
 extern void unregister_wlags_sysfs(struct net_device *);
 #else
-static void register_wlags_sysfs(struct net_device *) { return; };
-static void unregister_wlags_sysfs(struct net_device *) { return; };
+static inline void register_wlags_sysfs(struct net_device *net) { }
+static inline void unregister_wlags_sysfs(struct net_device *net) { }
 #endif
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index de98a94d1853..a6bd53ace035 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -1272,8 +1272,7 @@ static int usb_resume_both(struct usb_device *udev, pm_message_t msg)
 
 static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
 {
-        int                     w, i;
-        struct usb_interface    *intf;
+        int     w;
 
         /* Remote wakeup is needed only when we actually go to sleep.
          * For things like FREEZE and QUIESCE, if the device is already
@@ -1285,16 +1284,10 @@ static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
                 return;
         }
 
-        /* If remote wakeup is permitted, see whether any interface drivers
+        /* Enable remote wakeup if it is allowed, even if no interface drivers
          * actually want it.
          */
-        w = 0;
-        if (device_may_wakeup(&udev->dev) && udev->actconfig) {
-                for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
-                        intf = udev->actconfig->interface[i];
-                        w |= intf->needs_remote_wakeup;
-                }
-        }
+        w = device_may_wakeup(&udev->dev);
 
         /* If the device is autosuspended with the wrong wakeup setting,
          * autoresume now so the setting can be changed.
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index a73e08fdab36..fd4c36ea5e46 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -416,8 +416,11 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
                         /* A length of zero means transfer the whole sg list */
                         len = length;
                         if (len == 0) {
-                                for_each_sg(sg, sg, nents, i)
-                                        len += sg->length;
+                                struct scatterlist      *sg2;
+                                int                     j;
+
+                                for_each_sg(sg, sg2, nents, j)
+                                        len += sg2->length;
                         }
                 } else {
                         /*
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index 38226e9a371d..95dd4662d6a8 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -469,8 +469,7 @@ static int eem_unwrap(struct gether *port,
                                 crc = get_unaligned_le32(skb->data + len
                                                         - ETH_FCS_LEN);
                                 crc2 = ~crc32_le(~0,
-                                                skb->data,
-                                                skb->len - ETH_FCS_LEN);
+                                                skb->data, len - ETH_FCS_LEN);
                         } else {
                                 crc = get_unaligned_be32(skb->data + len
                                                         - ETH_FCS_LEN);
diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
index 7d05a0be5c60..4ce899c9b165 100644
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -321,8 +321,8 @@ struct fsg_dev;
 /* Data shared by all the FSG instances. */
 struct fsg_common {
         struct usb_gadget       *gadget;
-        struct fsg_dev          *fsg;
-        struct fsg_dev          *prev_fsg;
+        struct fsg_dev          *fsg, *new_fsg;
+        wait_queue_head_t       fsg_wait;
 
         /* filesem protects: backing files in use */
         struct rw_semaphore     filesem;
@@ -351,7 +351,6 @@ struct fsg_common {
         enum fsg_state          state;          /* For exception handling */
         unsigned int            exception_req_tag;
 
-        u8                      config, new_config;
         enum data_direction     data_dir;
         u32                     data_size;
         u32                     data_size_from_cmnd;
@@ -595,7 +594,7 @@ static int fsg_setup(struct usb_function *f,
         u16                     w_value = le16_to_cpu(ctrl->wValue);
         u16                     w_length = le16_to_cpu(ctrl->wLength);
 
-        if (!fsg->common->config)
+        if (!fsg_is_set(fsg->common))
                 return -EOPNOTSUPP;
 
         switch (ctrl->bRequest) {
@@ -2303,24 +2302,20 @@ static int alloc_request(struct fsg_common *common, struct usb_ep *ep,
         return -ENOMEM;
 }
 
-/*
- * Reset interface setting and re-init endpoint state (toggle etc).
- * Call with altsetting < 0 to disable the interface.  The only other
- * available altsetting is 0, which enables the interface.
- */
-static int do_set_interface(struct fsg_common *common, int altsetting)
+/* Reset interface setting and re-init endpoint state (toggle etc). */
+static int do_set_interface(struct fsg_common *common, struct fsg_dev *new_fsg)
 {
-        int     rc = 0;
-        int     i;
-        const struct usb_endpoint_descriptor    *d;
+        const struct usb_endpoint_descriptor *d;
+        struct fsg_dev *fsg;
+        int i, rc = 0;
 
         if (common->running)
                 DBG(common, "reset interface\n");
 
 reset:
         /* Deallocate the requests */
-        if (common->prev_fsg) {
-                struct fsg_dev *fsg = common->prev_fsg;
+        if (common->fsg) {
+                fsg = common->fsg;
 
                 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
                         struct fsg_buffhd *bh = &common->buffhds[i];
@@ -2345,88 +2340,53 @@ reset:
                         fsg->bulk_out_enabled = 0;
                 }
 
-                common->prev_fsg = 0;
+                common->fsg = NULL;
+                wake_up(&common->fsg_wait);
         }
 
         common->running = 0;
-        if (altsetting < 0 || rc != 0)
+        if (!new_fsg || rc)
                 return rc;
 
-        DBG(common, "set interface %d\n", altsetting);
+        common->fsg = new_fsg;
+        fsg = common->fsg;
 
-        if (fsg_is_set(common)) {
-                struct fsg_dev *fsg = common->fsg;
-                common->prev_fsg = common->fsg;
+        /* Enable the endpoints */
+        d = fsg_ep_desc(common->gadget,
+                        &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
+        rc = enable_endpoint(common, fsg->bulk_in, d);
+        if (rc)
+                goto reset;
+        fsg->bulk_in_enabled = 1;
+
+        d = fsg_ep_desc(common->gadget,
+                        &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
+        rc = enable_endpoint(common, fsg->bulk_out, d);
+        if (rc)
+                goto reset;
+        fsg->bulk_out_enabled = 1;
+        common->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
+        clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
 
-                /* Enable the endpoints */
-                d = fsg_ep_desc(common->gadget,
-                                &fsg_fs_bulk_in_desc, &fsg_hs_bulk_in_desc);
-                rc = enable_endpoint(common, fsg->bulk_in, d);
+        /* Allocate the requests */
+        for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
+                struct fsg_buffhd       *bh = &common->buffhds[i];
+
+                rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
                 if (rc)
                         goto reset;
-                fsg->bulk_in_enabled = 1;
-
-                d = fsg_ep_desc(common->gadget,
-                                &fsg_fs_bulk_out_desc, &fsg_hs_bulk_out_desc);
-                rc = enable_endpoint(common, fsg->bulk_out, d);
+                rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
                 if (rc)
                         goto reset;
-                fsg->bulk_out_enabled = 1;
-                common->bulk_out_maxpacket = le16_to_cpu(d->wMaxPacketSize);
-                clear_bit(IGNORE_BULK_OUT, &fsg->atomic_bitflags);
-
-                /* Allocate the requests */
-                for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
-                        struct fsg_buffhd       *bh = &common->buffhds[i];
-
-                        rc = alloc_request(common, fsg->bulk_in, &bh->inreq);
-                        if (rc)
-                                goto reset;
-                        rc = alloc_request(common, fsg->bulk_out, &bh->outreq);
-                        if (rc)
-                                goto reset;
-                        bh->inreq->buf = bh->outreq->buf = bh->buf;
-                        bh->inreq->context = bh->outreq->context = bh;
-                        bh->inreq->complete = bulk_in_complete;
-                        bh->outreq->complete = bulk_out_complete;
-                }
-
-                common->running = 1;
-                for (i = 0; i < common->nluns; ++i)
-                        common->luns[i].unit_attention_data = SS_RESET_OCCURRED;
-                return rc;
-        } else {
-                return -EIO;
-        }
-}
-
-
-/*
- * Change our operational configuration.  This code must agree with the code
- * that returns config descriptors, and with interface altsetting code.
- *
- * It's also responsible for power management interactions.  Some
- * configurations might not work with our current power sources.
- * For now we just assume the gadget is always self-powered.
- */
-static int do_set_config(struct fsg_common *common, u8 new_config)
-{
-        int     rc = 0;
-
-        /* Disable the single interface */
-        if (common->config != 0) {
-                DBG(common, "reset config\n");
-                common->config = 0;
-                rc = do_set_interface(common, -1);
+                bh->inreq->buf = bh->outreq->buf = bh->buf;
+                bh->inreq->context = bh->outreq->context = bh;
+                bh->inreq->complete = bulk_in_complete;
+                bh->outreq->complete = bulk_out_complete;
         }
 
-        /* Enable the interface */
-        if (new_config != 0) {
-                common->config = new_config;
-                rc = do_set_interface(common, 0);
-                if (rc != 0)
-                        common->config = 0;     /* Reset on errors */
-        }
+        common->running = 1;
+        for (i = 0; i < common->nluns; ++i)
+                common->luns[i].unit_attention_data = SS_RESET_OCCURRED;
         return rc;
 }
 
@@ -2437,9 +2397,7 @@ static int do_set_config(struct fsg_common *common, u8 new_config)
 static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 {
         struct fsg_dev *fsg = fsg_from_func(f);
-        fsg->common->prev_fsg = fsg->common->fsg;
-        fsg->common->fsg = fsg;
-        fsg->common->new_config = 1;
+        fsg->common->new_fsg = fsg;
         raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
         return 0;
 }
@@ -2447,9 +2405,7 @@ static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
 static void fsg_disable(struct usb_function *f)
 {
         struct fsg_dev *fsg = fsg_from_func(f);
-        fsg->common->prev_fsg = fsg->common->fsg;
-        fsg->common->fsg = fsg;
-        fsg->common->new_config = 0;
+        fsg->common->new_fsg = NULL;
         raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
 }
 
@@ -2459,19 +2415,17 @@ static void fsg_disable(struct usb_function *f)
 static void handle_exception(struct fsg_common *common)
 {
         siginfo_t               info;
-        int                     sig;
         int                     i;
         struct fsg_buffhd       *bh;
         enum fsg_state          old_state;
-        u8                      new_config;
         struct fsg_lun          *curlun;
         unsigned int            exception_req_tag;
-        int                     rc;
 
         /* Clear the existing signals.  Anything but SIGUSR1 is converted
          * into a high-priority EXIT exception. */
         for (;;) {
-                sig = dequeue_signal_lock(current, &current->blocked, &info);
+                int sig =
+                        dequeue_signal_lock(current, &current->blocked, &info);
                 if (!sig)
                         break;
                 if (sig != SIGUSR1) {
@@ -2482,7 +2436,7 @@ static void handle_exception(struct fsg_common *common)
         }
 
         /* Cancel all the pending transfers */
-        if (fsg_is_set(common)) {
+        if (likely(common->fsg)) {
                 for (i = 0; i < FSG_NUM_BUFFERS; ++i) {
                         bh = &common->buffhds[i];
                         if (bh->inreq_busy)
@@ -2523,7 +2477,6 @@ static void handle_exception(struct fsg_common *common)
         common->next_buffhd_to_fill = &common->buffhds[0];
         common->next_buffhd_to_drain = &common->buffhds[0];
         exception_req_tag = common->exception_req_tag;
-        new_config = common->new_config;
         old_state = common->state;
 
         if (old_state == FSG_STATE_ABORT_BULK_OUT)
@@ -2573,12 +2526,12 @@ static void handle_exception(struct fsg_common *common)
                 break;
 
         case FSG_STATE_CONFIG_CHANGE:
-                rc = do_set_config(common, new_config);
+                do_set_interface(common, common->new_fsg);
                 break;
 
         case FSG_STATE_EXIT:
         case FSG_STATE_TERMINATED:
-                do_set_config(common, 0);               /* Free resources */
+                do_set_interface(common, NULL);         /* Free resources */
                 spin_lock_irq(&common->lock);
                 common->state = FSG_STATE_TERMINATED;   /* Stop the thread */
                 spin_unlock_irq(&common->lock);
@@ -2863,6 +2816,7 @@ buffhds_first_it:
                 goto error_release;
         }
         init_completion(&common->thread_notifier);
+        init_waitqueue_head(&common->fsg_wait);
 #undef OR
 
 
@@ -2957,9 +2911,17 @@ static void fsg_common_release(struct kref *ref)
 static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
 {
         struct fsg_dev          *fsg = fsg_from_func(f);
+        struct fsg_common       *common = fsg->common;
 
         DBG(fsg, "unbind\n");
-        fsg_common_put(fsg->common);
+        if (fsg->common->fsg == fsg) {
+                fsg->common->new_fsg = NULL;
+                raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
+                /* FIXME: make interruptible or killable somehow? */
+                wait_event(common->fsg_wait, common->fsg != fsg);
+        }
+
+        fsg_common_put(common);
         usb_free_descriptors(fsg->function.descriptors);
         usb_free_descriptors(fsg->function.hs_descriptors);
         kfree(fsg);
@@ -2970,7 +2932,6 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
 {
         struct fsg_dev          *fsg = fsg_from_func(f);
         struct usb_gadget       *gadget = c->cdev->gadget;
-        int                     rc;
         int                     i;
         struct usb_ep           *ep;
 
@@ -2996,6 +2957,11 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
         ep->driver_data = fsg->common;  /* claim the endpoint */
         fsg->bulk_out = ep;
 
+        /* Copy descriptors */
+        f->descriptors = usb_copy_descriptors(fsg_fs_function);
+        if (unlikely(!f->descriptors))
+                return -ENOMEM;
+
         if (gadget_is_dualspeed(gadget)) {
                 /* Assume endpoint addresses are the same for both speeds */
                 fsg_hs_bulk_in_desc.bEndpointAddress =
@@ -3003,16 +2969,17 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
                 fsg_hs_bulk_out_desc.bEndpointAddress =
                         fsg_fs_bulk_out_desc.bEndpointAddress;
                 f->hs_descriptors = usb_copy_descriptors(fsg_hs_function);
-                if (unlikely(!f->hs_descriptors))
+                if (unlikely(!f->hs_descriptors)) {
+                        usb_free_descriptors(f->descriptors);
                         return -ENOMEM;
+                }
         }
 
         return 0;
 
 autoconf_fail:
         ERROR(fsg, "unable to autoconfigure all endpoints\n");
-        rc = -ENOTSUPP;
-        return rc;
+        return -ENOTSUPP;
 }
 
 
@@ -3036,11 +3003,6 @@ static int fsg_add(struct usb_composite_dev *cdev,
 
         fsg->function.name        = FSG_DRIVER_DESC;
         fsg->function.strings     = fsg_strings_array;
-        fsg->function.descriptors = usb_copy_descriptors(fsg_fs_function);
-        if (unlikely(!fsg->function.descriptors)) {
-                rc = -ENOMEM;
-                goto error_free_fsg;
-        }
         fsg->function.bind        = fsg_bind;
         fsg->function.unbind      = fsg_unbind;
         fsg->function.setup       = fsg_setup;
@@ -3056,19 +3018,9 @@ static int fsg_add(struct usb_composite_dev *cdev,
 
         rc = usb_add_function(c, &fsg->function);
         if (unlikely(rc))
-                goto error_free_all;
-
-        fsg_common_get(fsg->common);
-        return 0;
-
-error_free_all:
-        usb_free_descriptors(fsg->function.descriptors);
-        /* fsg_bind() might have copied those; or maybe not? who cares
-         * -- free it just in case. */
-        usb_free_descriptors(fsg->function.hs_descriptors);
-error_free_fsg:
-        kfree(fsg);
-
+                kfree(fsg);
+        else
+                fsg_common_get(fsg->common);
         return rc;
 }
 
diff --git a/drivers/usb/gadget/f_uvc.c b/drivers/usb/gadget/f_uvc.c
index fc2611f8b326..dbe6db0184fd 100644
--- a/drivers/usb/gadget/f_uvc.c
+++ b/drivers/usb/gadget/f_uvc.c
@@ -28,7 +28,7 @@
 
 #include "uvc.h"
 
-unsigned int uvc_trace_param;
+unsigned int uvc_gadget_trace_param;
 
 /* --------------------------------------------------------------------------
  * Function descriptors
@@ -656,6 +656,6 @@ error:
         return ret;
 }
 
-module_param_named(trace, uvc_trace_param, uint, S_IRUGO|S_IWUSR);
+module_param_named(trace, uvc_gadget_trace_param, uint, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(trace, "Trace level bitmask");
 
diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
index 4b0e4a040d6f..d1af253a9105 100644
--- a/drivers/usb/gadget/g_ffs.c
+++ b/drivers/usb/gadget/g_ffs.c
@@ -392,6 +392,17 @@ static int __gfs_do_config(struct usb_configuration *c,
         if (unlikely(ret < 0))
                 return ret;
 
+        /* After previous do_configs there may be some invalid
+         * pointers in c->interface array.  This happens every time
+         * a user space function with fewer interfaces than a user
+         * space function that was run before the new one is run.  The
+         * compasit's set_config() assumes that if there is no more
+         * then MAX_CONFIG_INTERFACES interfaces in a configuration
+         * then there is a NULL pointer after the last interface in
+         * c->interface array.  We need to make sure this is true. */
+        if (c->next_interface_id < ARRAY_SIZE(c->interface))
+                c->interface[c->next_interface_id] = NULL;
+
         return 0;
 }
 
diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
index 43abf55d8c60..4c3ac5c42237 100644
--- a/drivers/usb/gadget/printer.c
+++ b/drivers/usb/gadget/printer.c
@@ -82,7 +82,7 @@ static struct class *usb_gadget_class;
 struct printer_dev {
         spinlock_t              lock;           /* lock this structure */
         /* lock buffer lists during read/write calls */
-        spinlock_t              lock_printer_io;
+        struct mutex            lock_printer_io;
         struct usb_gadget       *gadget;
         struct usb_request      *req;           /* for control responses */
         u8                      config;
@@ -567,7 +567,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
 
         DBG(dev, "printer_read trying to read %d bytes\n", (int)len);
 
-        spin_lock(&dev->lock_printer_io);
+        mutex_lock(&dev->lock_printer_io);
         spin_lock_irqsave(&dev->lock, flags);
 
         /* We will use this flag later to check if a printer reset happened
@@ -601,7 +601,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                  * call or not.
                  */
                 if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
@@ -648,7 +648,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
                 if (dev->reset_printer) {
                         list_add(&current_rx_req->list, &dev->rx_reqs);
                         spin_unlock_irqrestore(&dev->lock, flags);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
@@ -673,7 +673,7 @@ printer_read(struct file *fd, char __user *buf, size_t len, loff_t *ptr)
         dev->current_rx_buf = current_rx_buf;
 
         spin_unlock_irqrestore(&dev->lock, flags);
-        spin_unlock(&dev->lock_printer_io);
+        mutex_unlock(&dev->lock_printer_io);
 
         DBG(dev, "printer_read returned %d bytes\n", (int)bytes_copied);
 
@@ -697,7 +697,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         if (len == 0)
                 return -EINVAL;
 
-        spin_lock(&dev->lock_printer_io);
+        mutex_lock(&dev->lock_printer_io);
         spin_lock_irqsave(&dev->lock, flags);
 
         /* Check if a printer reset happens while we have interrupts on */
@@ -713,7 +713,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                  * a NON-Blocking call or not.
                  */
                 if (fd->f_flags & (O_NONBLOCK|O_NDELAY)) {
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
@@ -752,7 +752,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
                 if (copy_from_user(req->buf, buf, size)) {
                         list_add(&req->list, &dev->tx_reqs);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return bytes_copied;
                 }
 
@@ -766,14 +766,14 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
                 if (dev->reset_printer) {
                         list_add(&req->list, &dev->tx_reqs);
                         spin_unlock_irqrestore(&dev->lock, flags);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
                 if (usb_ep_queue(dev->in_ep, req, GFP_ATOMIC)) {
                         list_add(&req->list, &dev->tx_reqs);
                         spin_unlock_irqrestore(&dev->lock, flags);
-                        spin_unlock(&dev->lock_printer_io);
+                        mutex_unlock(&dev->lock_printer_io);
                         return -EAGAIN;
                 }
 
@@ -782,7 +782,7 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
         }
 
         spin_unlock_irqrestore(&dev->lock, flags);
-        spin_unlock(&dev->lock_printer_io);
+        mutex_unlock(&dev->lock_printer_io);
 
         DBG(dev, "printer_write sent %d bytes\n", (int)bytes_copied);
 
@@ -820,11 +820,11 @@ printer_poll(struct file *fd, poll_table *wait)
         unsigned long           flags;
         int                     status = 0;
 
-        spin_lock(&dev->lock_printer_io);
+        mutex_lock(&dev->lock_printer_io);
         spin_lock_irqsave(&dev->lock, flags);
         setup_rx_reqs(dev);
         spin_unlock_irqrestore(&dev->lock, flags);
-        spin_unlock(&dev->lock_printer_io);
+        mutex_unlock(&dev->lock_printer_io);
 
         poll_wait(fd, &dev->rx_wait, wait);
         poll_wait(fd, &dev->tx_wait, wait);
@@ -1461,7 +1461,7 @@ autoconf_fail:
         }
 
         spin_lock_init(&dev->lock);
-        spin_lock_init(&dev->lock_printer_io);
+        mutex_init(&dev->lock_printer_io);
         INIT_LIST_HEAD(&dev->tx_reqs);
         INIT_LIST_HEAD(&dev->tx_reqs_active);
         INIT_LIST_HEAD(&dev->rx_reqs);
@@ -1594,7 +1594,7 @@ cleanup(void)
 {
         int status;
 
-        spin_lock(&usb_printer_gadget.lock_printer_io);
+        mutex_lock(&usb_printer_gadget.lock_printer_io);
         class_destroy(usb_gadget_class);
         unregister_chrdev_region(g_printer_devno, 2);
 
@@ -1602,6 +1602,6 @@ cleanup(void)
         if (status)
                 ERROR(dev, "usb_gadget_unregister_driver %x\n", status);
 
-        spin_unlock(&usb_printer_gadget.lock_printer_io);
+        mutex_unlock(&usb_printer_gadget.lock_printer_io);
 }
 module_exit(cleanup);
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index d5f4c1d45c97..e724a051bfdd 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -1700,9 +1700,13 @@ int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
         if (!driver || driver != udc->driver || !driver->unbind)
                 return -EINVAL;
 
-        dprintk(DEBUG_NORMAL,"usb_gadget_register_driver() '%s'\n",
+        dprintk(DEBUG_NORMAL, "usb_gadget_unregister_driver() '%s'\n",
                 driver->driver.name);
 
+        /* report disconnect */
+        if (driver->disconnect)
+                driver->disconnect(&udc->gadget);
+
         driver->unbind(&udc->gadget);
 
         device_del(&udc->gadget.dev);
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index 16bdf77f582a..3e8dcb5455e3 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -536,17 +536,11 @@ recycle:
                 list_move(&req->list, &port->read_pool);
         }
 
-        /* Push from tty to ldisc; this is immediate with low_latency, and
-         * may trigger callbacks to this driver ... so drop the spinlock.
+        /* Push from tty to ldisc; without low_latency set this is handled by
+         * a workqueue, so we won't get callbacks and can hold port_lock
          */
         if (tty && do_push) {
-                spin_unlock_irq(&port->port_lock);
                 tty_flip_buffer_push(tty);
-                wake_up_interruptible(&tty->read_wait);
-                spin_lock_irq(&port->port_lock);
-
-                /* tty may have been closed */
-                tty = port->port_tty;
         }
 
 
@@ -784,11 +778,6 @@ static int gs_open(struct tty_struct *tty, struct file *file)
         port->open_count = 1;
         port->openclose = false;
 
-        /* low_latency means ldiscs work in tasklet context, without
-         * needing a workqueue schedule ... easier to keep up.
-         */
-        tty->low_latency = 1;
-
         /* if connected, start the I/O stream */
         if (port->port_usb) {
                 struct gserial  *gser = port->port_usb;
@@ -1195,6 +1184,7 @@ void gserial_cleanup(void)
         n_ports = 0;
 
         tty_unregister_driver(gs_tty_driver);
+        put_tty_driver(gs_tty_driver);
         gs_tty_driver = NULL;
 
         pr_debug("%s: cleaned up ttyGS* support\n", __func__);
diff --git a/drivers/usb/gadget/uvc.h b/drivers/usb/gadget/uvc.h
index 0a705e63c936..e92454cddd7d 100644
--- a/drivers/usb/gadget/uvc.h
+++ b/drivers/usb/gadget/uvc.h
@@ -107,11 +107,11 @@ struct uvc_streaming_control {
 #define UVC_WARN_MINMAX                         0
 #define UVC_WARN_PROBE_DEF                      1
 
-extern unsigned int uvc_trace_param;
+extern unsigned int uvc_gadget_trace_param;
 
 #define uvc_trace(flag, msg...) \
         do { \
-                if (uvc_trace_param & flag) \
+                if (uvc_gadget_trace_param & flag) \
                         printk(KERN_DEBUG "uvcvideo: " msg); \
         } while (0)
 
@@ -220,16 +220,10 @@ struct uvc_file_handle
 #define to_uvc_file_handle(handle) \
         container_of(handle, struct uvc_file_handle, vfh)
 
-extern struct v4l2_file_operations uvc_v4l2_fops;
-
 /* ------------------------------------------------------------------------
  * Functions
  */
 
-extern int uvc_video_enable(struct uvc_video *video, int enable);
-extern int uvc_video_init(struct uvc_video *video);
-extern int uvc_video_pump(struct uvc_video *video);
-
 extern void uvc_endpoint_stream(struct uvc_device *dev);
 
 extern void uvc_function_connect(struct uvc_device *uvc);
diff --git a/drivers/usb/gadget/uvc_queue.c b/drivers/usb/gadget/uvc_queue.c
index 43891991bf21..f7395ac5dc17 100644
--- a/drivers/usb/gadget/uvc_queue.c
+++ b/drivers/usb/gadget/uvc_queue.c
@@ -78,7 +78,8 @@
  *
  */
 
-void uvc_queue_init(struct uvc_video_queue *queue, enum v4l2_buf_type type)
+static void
+uvc_queue_init(struct uvc_video_queue *queue, enum v4l2_buf_type type)
 {
         mutex_init(&queue->mutex);
         spin_lock_init(&queue->irqlock);
@@ -88,6 +89,28 @@ void uvc_queue_init(struct uvc_video_queue *queue, enum v4l2_buf_type type)
 }
 
 /*
+ * Free the video buffers.
+ *
+ * This function must be called with the queue lock held.
+ */
+static int uvc_free_buffers(struct uvc_video_queue *queue)
+{
+        unsigned int i;
+
+        for (i = 0; i < queue->count; ++i) {
+                if (queue->buffer[i].vma_use_count != 0)
+                        return -EBUSY;
+        }
+
+        if (queue->count) {
+                vfree(queue->mem);
+                queue->count = 0;
+        }
+
+        return 0;
+}
+
+/*
  * Allocate the video buffers.
  *
  * Pages are reserved to make sure they will not be swapped, as they will be
@@ -95,8 +118,9 @@ void uvc_queue_init(struct uvc_video_queue *queue, enum v4l2_buf_type type)
  *
  * Buffers will be individually mapped, so they must all be page aligned.
  */
-int uvc_alloc_buffers(struct uvc_video_queue *queue, unsigned int nbuffers,
-                unsigned int buflength)
+static int
+uvc_alloc_buffers(struct uvc_video_queue *queue, unsigned int nbuffers,
+                  unsigned int buflength)
 {
         unsigned int bufsize = PAGE_ALIGN(buflength);
         unsigned int i;
@@ -150,28 +174,6 @@ done:
         return ret;
 }
 
-/*
- * Free the video buffers.
- *
- * This function must be called with the queue lock held.
- */
-int uvc_free_buffers(struct uvc_video_queue *queue)
-{
-        unsigned int i;
-
-        for (i = 0; i < queue->count; ++i) {
-                if (queue->buffer[i].vma_use_count != 0)
-                        return -EBUSY;
-        }
-
-        if (queue->count) {
-                vfree(queue->mem);
-                queue->count = 0;
-        }
-
-        return 0;
-}
-
 static void __uvc_query_buffer(struct uvc_buffer *buf,
                 struct v4l2_buffer *v4l2_buf)
 {
@@ -195,8 +197,8 @@ static void __uvc_query_buffer(struct uvc_buffer *buf,
         }
 }
 
-int uvc_query_buffer(struct uvc_video_queue *queue,
-                struct v4l2_buffer *v4l2_buf)
+static int
+uvc_query_buffer(struct uvc_video_queue *queue, struct v4l2_buffer *v4l2_buf)
 {
         int ret = 0;
 
@@ -217,8 +219,8 @@ done:
  * Queue a video buffer. Attempting to queue a buffer that has already been
  * queued will return -EINVAL.
  */
-int uvc_queue_buffer(struct uvc_video_queue *queue,
-        struct v4l2_buffer *v4l2_buf)
+static int
+uvc_queue_buffer(struct uvc_video_queue *queue, struct v4l2_buffer *v4l2_buf)
 {
         struct uvc_buffer *buf;
         unsigned long flags;
@@ -298,8 +300,9 @@ static int uvc_queue_waiton(struct uvc_buffer *buf, int nonblocking)
  * Dequeue a video buffer. If nonblocking is false, block until a buffer is
  * available.
  */
-int uvc_dequeue_buffer(struct uvc_video_queue *queue,
-                struct v4l2_buffer *v4l2_buf, int nonblocking)
+static int
+uvc_dequeue_buffer(struct uvc_video_queue *queue, struct v4l2_buffer *v4l2_buf,
+                   int nonblocking)
 {
         struct uvc_buffer *buf;
         int ret = 0;
@@ -359,8 +362,9 @@ done:
  * This function implements video queue polling and is intended to be used by
  * the device poll handler.
  */
-unsigned int uvc_queue_poll(struct uvc_video_queue *queue, struct file *file,
-                poll_table *wait)
+static unsigned int
+uvc_queue_poll(struct uvc_video_queue *queue, struct file *file,
+               poll_table *wait)
 {
         struct uvc_buffer *buf;
         unsigned int mask = 0;
@@ -407,7 +411,8 @@ static struct vm_operations_struct uvc_vm_ops = {
  * This function implements video buffer memory mapping and is intended to be
  * used by the device mmap handler.
  */
-int uvc_queue_mmap(struct uvc_video_queue *queue, struct vm_area_struct *vma)
+static int
+uvc_queue_mmap(struct uvc_video_queue *queue, struct vm_area_struct *vma)
 {
         struct uvc_buffer *uninitialized_var(buffer);
         struct page *page;
@@ -458,6 +463,42 @@ done:
 }
 
 /*
+ * Cancel the video buffers queue.
+ *
+ * Cancelling the queue marks all buffers on the irq queue as erroneous,
+ * wakes them up and removes them from the queue.
+ *
+ * If the disconnect parameter is set, further calls to uvc_queue_buffer will
+ * fail with -ENODEV.
+ *
+ * This function acquires the irq spinlock and can be called from interrupt
+ * context.
+ */
+static void uvc_queue_cancel(struct uvc_video_queue *queue, int disconnect)
+{
+        struct uvc_buffer *buf;
+        unsigned long flags;
+
+        spin_lock_irqsave(&queue->irqlock, flags);
+        while (!list_empty(&queue->irqqueue)) {
+                buf = list_first_entry(&queue->irqqueue, struct uvc_buffer,
+                                       queue);
+                list_del(&buf->queue);
+                buf->state = UVC_BUF_STATE_ERROR;
+                wake_up(&buf->wait);
+        }
+        /* This must be protected by the irqlock spinlock to avoid race
+         * conditions between uvc_queue_buffer and the disconnection event that
+         * could result in an interruptible wait in uvc_dequeue_buffer. Do not
+         * blindly replace this logic by checking for the UVC_DEV_DISCONNECTED
+         * state outside the queue code.
+         */
+        if (disconnect)
+                queue->flags |= UVC_QUEUE_DISCONNECTED;
+        spin_unlock_irqrestore(&queue->irqlock, flags);
+}
+
+/*
  * Enable or disable the video buffers queue.
  *
  * The queue must be enabled before starting video acquisition and must be
@@ -474,7 +515,7 @@ done:
  * This function can't be called from interrupt context. Use
  * uvc_queue_cancel() instead.
  */
-int uvc_queue_enable(struct uvc_video_queue *queue, int enable)
+static int uvc_queue_enable(struct uvc_video_queue *queue, int enable)
 {
         unsigned int i;
         int ret = 0;
@@ -503,44 +544,8 @@ done:
         return ret;
 }
 
-/*
- * Cancel the video buffers queue.
- *
- * Cancelling the queue marks all buffers on the irq queue as erroneous,
- * wakes them up and removes them from the queue.
- *
- * If the disconnect parameter is set, further calls to uvc_queue_buffer will
- * fail with -ENODEV.
- *
- * This function acquires the irq spinlock and can be called from interrupt
- * context.
- */
-void uvc_queue_cancel(struct uvc_video_queue *queue, int disconnect)
-{
-        struct uvc_buffer *buf;
-        unsigned long flags;
-
-        spin_lock_irqsave(&queue->irqlock, flags);
-        while (!list_empty(&queue->irqqueue)) {
-                buf = list_first_entry(&queue->irqqueue, struct uvc_buffer,
-                                       queue);
-                list_del(&buf->queue);
-                buf->state = UVC_BUF_STATE_ERROR;
-                wake_up(&buf->wait);
-        }
-        /* This must be protected by the irqlock spinlock to avoid race
-         * conditions between uvc_queue_buffer and the disconnection event that
-         * could result in an interruptible wait in uvc_dequeue_buffer. Do not
-         * blindly replace this logic by checking for the UVC_DEV_DISCONNECTED
-         * state outside the queue code.
-         */
-        if (disconnect)
-                queue->flags |= UVC_QUEUE_DISCONNECTED;
-        spin_unlock_irqrestore(&queue->irqlock, flags);
-}
-
-struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue,
-                struct uvc_buffer *buf)
+static struct uvc_buffer *
+uvc_queue_next_buffer(struct uvc_video_queue *queue, struct uvc_buffer *buf)
 {
         struct uvc_buffer *nextbuf;
         unsigned long flags;
@@ -568,7 +573,7 @@ struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue,
         return nextbuf;
 }
 
-struct uvc_buffer *uvc_queue_head(struct uvc_video_queue *queue)
+static struct uvc_buffer *uvc_queue_head(struct uvc_video_queue *queue)
 {
         struct uvc_buffer *buf = NULL;
 
diff --git a/drivers/usb/gadget/uvc_queue.h b/drivers/usb/gadget/uvc_queue.h
index 7f5a33fe7ae2..1812a8ecc5d0 100644
--- a/drivers/usb/gadget/uvc_queue.h
+++ b/drivers/usb/gadget/uvc_queue.h
@@ -58,30 +58,10 @@ struct uvc_video_queue {
         struct list_head irqqueue;
 };
 
-extern void uvc_queue_init(struct uvc_video_queue *queue,
-                enum v4l2_buf_type type);
-extern int uvc_alloc_buffers(struct uvc_video_queue *queue,
-                unsigned int nbuffers, unsigned int buflength);
-extern int uvc_free_buffers(struct uvc_video_queue *queue);
-extern int uvc_query_buffer(struct uvc_video_queue *queue,
-                struct v4l2_buffer *v4l2_buf);
-extern int uvc_queue_buffer(struct uvc_video_queue *queue,
-                struct v4l2_buffer *v4l2_buf);
-extern int uvc_dequeue_buffer(struct uvc_video_queue *queue,
-                struct v4l2_buffer *v4l2_buf, int nonblocking);
-extern int uvc_queue_enable(struct uvc_video_queue *queue, int enable);
-extern void uvc_queue_cancel(struct uvc_video_queue *queue, int disconnect);
-extern struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue,
-                struct uvc_buffer *buf);
-extern unsigned int uvc_queue_poll(struct uvc_video_queue *queue,
-                struct file *file, poll_table *wait);
-extern int uvc_queue_mmap(struct uvc_video_queue *queue,
-                struct vm_area_struct *vma);
 static inline int uvc_queue_streaming(struct uvc_video_queue *queue)
 {
         return queue->flags & UVC_QUEUE_STREAMING;
 }
-extern struct uvc_buffer *uvc_queue_head(struct uvc_video_queue *queue);
 
 #endif /* __KERNEL__ */
 
diff --git a/drivers/usb/gadget/uvc_v4l2.c b/drivers/usb/gadget/uvc_v4l2.c
index a7989f29837e..2dcffdac86d2 100644
--- a/drivers/usb/gadget/uvc_v4l2.c
+++ b/drivers/usb/gadget/uvc_v4l2.c
@@ -363,7 +363,7 @@ uvc_v4l2_poll(struct file *file, poll_table *wait)
         return mask;
 }
 
-struct v4l2_file_operations uvc_v4l2_fops = {
+static struct v4l2_file_operations uvc_v4l2_fops = {
         .owner          = THIS_MODULE,
         .open           = uvc_v4l2_open,
         .release        = uvc_v4l2_release,
diff --git a/drivers/usb/gadget/uvc_video.c b/drivers/usb/gadget/uvc_video.c
index de8cbc46518d..b08f35438d70 100644
--- a/drivers/usb/gadget/uvc_video.c
+++ b/drivers/usb/gadget/uvc_video.c
@@ -271,7 +271,7 @@ error:
  * This function fills the available USB requests (listed in req_free) with
  * video data from the queued buffers.
  */
-int
+static int
 uvc_video_pump(struct uvc_video *video)
 {
         struct usb_request *req;
@@ -328,7 +328,7 @@ uvc_video_pump(struct uvc_video *video)
 /*
  * Enable or disable the video stream.
  */
-int
+static int
 uvc_video_enable(struct uvc_video *video, int enable)
 {
         unsigned int i;
@@ -367,7 +367,7 @@ uvc_video_enable(struct uvc_video *video, int enable)
 /*
  * Initialize the UVC video stream.
  */
-int
+static int
 uvc_video_init(struct uvc_video *video)
 {
         INIT_LIST_HEAD(&video->req_free);
diff --git a/drivers/usb/gadget/webcam.c b/drivers/usb/gadget/webcam.c
index 417fd6887698..f5f3030cc416 100644
--- a/drivers/usb/gadget/webcam.c
+++ b/drivers/usb/gadget/webcam.c
@@ -28,10 +28,10 @@
 #include "config.c"
 #include "epautoconf.c"
 
-#include "f_uvc.c"
 #include "uvc_queue.c"
-#include "uvc_v4l2.c"
 #include "uvc_video.c"
+#include "uvc_v4l2.c"
+#include "f_uvc.c"
 
 /* --------------------------------------------------------------------------
  * Device descriptor
diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
index 544ccfd7056e..bd4027745aa7 100644
--- a/drivers/usb/host/ehci-mxc.c
+++ b/drivers/usb/host/ehci-mxc.c
@@ -207,10 +207,17 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
         /* Initialize the transceiver */
         if (pdata->otg) {
                 pdata->otg->io_priv = hcd->regs + ULPI_VIEWPORT_OFFSET;
-                if (otg_init(pdata->otg) != 0)
-                        dev_err(dev, "unable to init transceiver\n");
-                else if (otg_set_vbus(pdata->otg, 1) != 0)
+                ret = otg_init(pdata->otg);
+                if (ret) {
+                        dev_err(dev, "unable to init transceiver, probably missing\n");
+                        ret = -ENODEV;
+                        goto err_add;
+                }
+                ret = otg_set_vbus(pdata->otg, 1);
+                if (ret) {
                         dev_err(dev, "unable to enable vbus on transceiver\n");
+                        goto err_add;
+                }
         }
 
         priv->hcd = hcd;
diff --git a/drivers/usb/host/isp1362-hcd.c b/drivers/usb/host/isp1362-hcd.c
index 20a0dfe0fe36..0587ad4ce5c2 100644
--- a/drivers/usb/host/isp1362-hcd.c
+++ b/drivers/usb/host/isp1362-hcd.c
@@ -2224,12 +2224,9 @@ static void remove_debug_file(struct isp1362_hcd *isp1362_hcd)
 
 /*-------------------------------------------------------------------------*/
 
-static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
+static void __isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
 {
         int tmp = 20;
-        unsigned long flags;
-
-        spin_lock_irqsave(&isp1362_hcd->lock, flags);
 
         isp1362_write_reg16(isp1362_hcd, HCSWRES, HCSWRES_MAGIC);
         isp1362_write_reg32(isp1362_hcd, HCCMDSTAT, OHCI_HCR);
@@ -2240,6 +2237,14 @@ static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
         }
         if (!tmp)
                 pr_err("Software reset timeout\n");
+}
+
+static void isp1362_sw_reset(struct isp1362_hcd *isp1362_hcd)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&isp1362_hcd->lock, flags);
+        __isp1362_sw_reset(isp1362_hcd);
         spin_unlock_irqrestore(&isp1362_hcd->lock, flags);
 }
 
@@ -2418,7 +2423,7 @@ static void isp1362_hc_stop(struct usb_hcd *hcd)
         if (isp1362_hcd->board && isp1362_hcd->board->reset)
                 isp1362_hcd->board->reset(hcd->self.controller, 1);
         else
-                isp1362_sw_reset(isp1362_hcd);
+                __isp1362_sw_reset(isp1362_hcd);
 
         if (isp1362_hcd->board && isp1362_hcd->board->clock)
                 isp1362_hcd->board->clock(hcd->self.controller, 0);
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index 1a2bb4ce638f..77be3c24a427 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -1065,7 +1065,7 @@ static void r8a66597_usb_connect(struct r8a66597 *r8a66597, int port)
         else if (speed == LSMODE)
                 rh->port |= USB_PORT_STAT_LOW_SPEED;
 
-        rh->port &= USB_PORT_STAT_RESET;
+        rh->port &= ~USB_PORT_STAT_RESET;
         rh->port |= USB_PORT_STAT_ENABLE;
 }
 
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 9012098add6b..94e6934edb09 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -182,8 +182,12 @@ static void inc_deq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
  * set, but other sections talk about dealing with the chain bit set.  This was
  * fixed in the 0.96 specification errata, but we have to assume that all 0.95
  * xHCI hardware can't handle the chain bit being cleared on a link TRB.
+ *
+ * @more_trbs_coming:   Will you enqueue more TRBs before calling
+ *                      prepare_transfer()?
  */
-static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer)
+static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring,
+                bool consumer, bool more_trbs_coming)
 {
         u32 chain;
         union xhci_trb *next;
@@ -199,15 +203,28 @@ static void inc_enq(struct xhci_hcd *xhci, struct xhci_ring *ring, bool consumer
         while (last_trb(xhci, ring, ring->enq_seg, next)) {
                 if (!consumer) {
                         if (ring != xhci->event_ring) {
-                                if (chain) {
-                                        next->link.control |= TRB_CHAIN;
-
-                                        /* Give this link TRB to the hardware */
-                                        wmb();
-                                        next->link.control ^= TRB_CYCLE;
-                                } else {
+                                /*
+                                 * If the caller doesn't plan on enqueueing more
+                                 * TDs before ringing the doorbell, then we
+                                 * don't want to give the link TRB to the
+                                 * hardware just yet.  We'll give the link TRB
+                                 * back in prepare_ring() just before we enqueue
+                                 * the TD at the top of the ring.
+                                 */
+                                if (!chain && !more_trbs_coming)
                                         break;
+
+                                /* If we're not dealing with 0.95 hardware,
+                                 * carry over the chain bit of the previous TRB
+                                 * (which may mean the chain bit is cleared).
+                                 */
+                                if (!xhci_link_trb_quirk(xhci)) {
+                                        next->link.control &= ~TRB_CHAIN;
+                                        next->link.control |= chain;
                                 }
+                                /* Give this link TRB to the hardware */
+                                wmb();
+                                next->link.control ^= TRB_CYCLE;
                         }
                         /* Toggle the cycle bit after the last ring segment. */
                         if (last_trb_on_last_seg(xhci, ring, ring->enq_seg, next)) {
@@ -1707,9 +1724,12 @@ void xhci_handle_event(struct xhci_hcd *xhci)
 /*
  * Generic function for queueing a TRB on a ring.
  * The caller must have checked to make sure there's room on the ring.
+ *
+ * @more_trbs_coming:   Will you enqueue more TRBs before calling
+ *                      prepare_transfer()?
  */
 static void queue_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
-                bool consumer,
+                bool consumer, bool more_trbs_coming,
                 u32 field1, u32 field2, u32 field3, u32 field4)
 {
         struct xhci_generic_trb *trb;
@@ -1719,7 +1739,7 @@ static void queue_trb(struct xhci_hcd *xhci, struct xhci_ring *ring,
         trb->field[1] = field2;
         trb->field[2] = field3;
         trb->field[3] = field4;
-        inc_enq(xhci, ring, consumer);
+        inc_enq(xhci, ring, consumer, more_trbs_coming);
 }
 
 /*
@@ -1988,6 +2008,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         int trb_buff_len, this_sg_len, running_total;
         bool first_trb;
         u64 addr;
+        bool more_trbs_coming;
 
         struct xhci_generic_trb *start_trb;
         int start_cycle;
@@ -2073,7 +2094,11 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 length_field = TRB_LEN(trb_buff_len) |
                         remainder |
                         TRB_INTR_TARGET(0);
-                queue_trb(xhci, ep_ring, false,
+                if (num_trbs > 1)
+                        more_trbs_coming = true;
+                else
+                        more_trbs_coming = false;
+                queue_trb(xhci, ep_ring, false, more_trbs_coming,
                                 lower_32_bits(addr),
                                 upper_32_bits(addr),
                                 length_field,
@@ -2124,6 +2149,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         int num_trbs;
         struct xhci_generic_trb *start_trb;
         bool first_trb;
+        bool more_trbs_coming;
         int start_cycle;
         u32 field, length_field;
 
@@ -2212,7 +2238,11 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 length_field = TRB_LEN(trb_buff_len) |
                         remainder |
                         TRB_INTR_TARGET(0);
-                queue_trb(xhci, ep_ring, false,
+                if (num_trbs > 1)
+                        more_trbs_coming = true;
+                else
+                        more_trbs_coming = false;
+                queue_trb(xhci, ep_ring, false, more_trbs_coming,
                                 lower_32_bits(addr),
                                 upper_32_bits(addr),
                                 length_field,
@@ -2291,7 +2321,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         /* Queue setup TRB - see section 6.4.1.2.1 */
         /* FIXME better way to translate setup_packet into two u32 fields? */
         setup = (struct usb_ctrlrequest *) urb->setup_packet;
-        queue_trb(xhci, ep_ring, false,
+        queue_trb(xhci, ep_ring, false, true,
                         /* FIXME endianness is probably going to bite my ass here. */
                         setup->bRequestType | setup->bRequest << 8 | setup->wValue << 16,
                         setup->wIndex | setup->wLength << 16,
@@ -2307,7 +2337,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         if (urb->transfer_buffer_length > 0) {
                 if (setup->bRequestType & USB_DIR_IN)
                         field |= TRB_DIR_IN;
-                queue_trb(xhci, ep_ring, false,
+                queue_trb(xhci, ep_ring, false, true,
                                 lower_32_bits(urb->transfer_dma),
                                 upper_32_bits(urb->transfer_dma),
                                 length_field,
@@ -2324,7 +2354,7 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 field = 0;
         else
                 field = TRB_DIR_IN;
-        queue_trb(xhci, ep_ring, false,
+        queue_trb(xhci, ep_ring, false, false,
                         0,
                         0,
                         TRB_INTR_TARGET(0),
@@ -2361,7 +2391,7 @@ static int queue_command(struct xhci_hcd *xhci, u32 field1, u32 field2,
                                         "unfailable commands failed.\n");
                 return -ENOMEM;
         }
-        queue_trb(xhci, xhci->cmd_ring, false, field1, field2, field3,
+        queue_trb(xhci, xhci->cmd_ring, false, false, field1, field2, field3,
                         field4 | xhci->cmd_ring->cycle_state);
         return 0;
 }
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index fad70bc83555..3b795c56221f 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -219,8 +219,8 @@ static int musb_ulpi_write(struct otg_transceiver *otg,
         return 0;
 }
 #else
-#define musb_ulpi_read(a, b)            NULL
-#define musb_ulpi_write(a, b, c)        NULL
+#define musb_ulpi_read          NULL
+#define musb_ulpi_write         NULL
 #endif
 
 static struct otg_io_access_ops musb_ulpi_access = {
@@ -451,10 +451,6 @@ void musb_hnp_stop(struct musb *musb)
  * @param power
  */
 
-#define STAGE0_MASK (MUSB_INTR_RESUME | MUSB_INTR_SESSREQ \
-                | MUSB_INTR_VBUSERROR | MUSB_INTR_CONNECT \
-                | MUSB_INTR_RESET)
-
 static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                                 u8 devctl, u8 power)
 {
@@ -642,7 +638,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                 handled = IRQ_HANDLED;
         }
 
-
+#endif
         if (int_usb & MUSB_INTR_SUSPEND) {
                 DBG(1, "SUSPEND (%s) devctl %02x power %02x\n",
                                 otg_state_string(musb), devctl, power);
@@ -705,6 +701,7 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
                 }
         }
 
+#ifdef CONFIG_USB_MUSB_HDRC_HCD
         if (int_usb & MUSB_INTR_CONNECT) {
                 struct usb_hcd *hcd = musb_to_hcd(musb);
                 void __iomem *mbase = musb->mregs;
@@ -1597,7 +1594,7 @@ irqreturn_t musb_interrupt(struct musb *musb)
         /* the core can interrupt us for multiple reasons; docs have
          * a generic interrupt flowchart to follow
          */
-        if (musb->int_usb & STAGE0_MASK)
+        if (musb->int_usb)
                 retval |= musb_stage0_irq(musb, musb->int_usb,
                                 devctl, power);
 
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index b22d02dea7d3..91d67794e350 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -470,7 +470,8 @@ struct musb_csr_regs {
 
 struct musb_context_registers {
 
-#ifdef CONFIG_PM
+#if defined(CONFIG_ARCH_OMAP2430) || defined(CONFIG_ARCH_OMAP3) || \
+    defined(CONFIG_ARCH_OMAP4)
         u32 otg_sysconfig, otg_forcestandby;
 #endif
         u8 power;
@@ -484,7 +485,8 @@ struct musb_context_registers {
         struct musb_csr_regs index_regs[MUSB_C_NUM_EPS];
 };
 
-#ifdef CONFIG_PM
+#if defined(CONFIG_ARCH_OMAP2430) || defined(CONFIG_ARCH_OMAP3) || \
+    defined(CONFIG_ARCH_OMAP4)
 extern void musb_platform_save_context(struct musb *musb,
                 struct musb_context_registers *musb_context);
 extern void musb_platform_restore_context(struct musb *musb,
diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
index 1008044a3bbc..dc66e4376d49 100644
--- a/drivers/usb/musb/musbhsdma.c
+++ b/drivers/usb/musb/musbhsdma.c
@@ -132,18 +132,9 @@ static void configure_channel(struct dma_channel *channel,
         if (mode) {
                 csr |= 1 << MUSB_HSDMA_MODE1_SHIFT;
                 BUG_ON(len < packet_sz);
-
-                if (packet_sz >= 64) {
-                        csr |= MUSB_HSDMA_BURSTMODE_INCR16
-                                        << MUSB_HSDMA_BURSTMODE_SHIFT;
-                } else if (packet_sz >= 32) {
-                        csr |= MUSB_HSDMA_BURSTMODE_INCR8
-                                        << MUSB_HSDMA_BURSTMODE_SHIFT;
-                } else if (packet_sz >= 16) {
-                        csr |= MUSB_HSDMA_BURSTMODE_INCR4
-                                        << MUSB_HSDMA_BURSTMODE_SHIFT;
-                }
         }
+        csr |= MUSB_HSDMA_BURSTMODE_INCR16
+                                << MUSB_HSDMA_BURSTMODE_SHIFT;
 
         csr |= (musb_channel->epnum << MUSB_HSDMA_ENDPOINT_SHIFT)
                 | (1 << MUSB_HSDMA_ENABLE_SHIFT)
diff --git a/drivers/usb/otg/ulpi.c b/drivers/usb/otg/ulpi.c
index b1b346932946..d331b222ad21 100644
--- a/drivers/usb/otg/ulpi.c
+++ b/drivers/usb/otg/ulpi.c
@@ -59,12 +59,17 @@ static int ulpi_set_flags(struct otg_transceiver *otg)
 
 static int ulpi_init(struct otg_transceiver *otg)
 {
-        int i, vid, pid;
-
-        vid = (otg_io_read(otg, ULPI_VENDOR_ID_HIGH) << 8) |
-               otg_io_read(otg, ULPI_VENDOR_ID_LOW);
-        pid = (otg_io_read(otg, ULPI_PRODUCT_ID_HIGH) << 8) |
-               otg_io_read(otg, ULPI_PRODUCT_ID_LOW);
+        int i, vid, pid, ret;
+        u32 ulpi_id = 0;
+
+        for (i = 0; i < 4; i++) {
+                ret = otg_io_read(otg, ULPI_PRODUCT_ID_HIGH - i);
+                if (ret < 0)
+                        return ret;
+                ulpi_id = (ulpi_id << 8) | ret;
+        }
+        vid = ulpi_id & 0xffff;
+        pid = ulpi_id >> 16;
 
         pr_info("ULPI transceiver vendor/product ID 0x%04x/0x%04x\n", vid, pid);
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 79dd1ae195e5..da7e334b0407 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -653,7 +653,6 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(EVOLUTION_VID, EVOLUTION_ER1_PID) },
         { USB_DEVICE(EVOLUTION_VID, EVO_HYBRID_PID) },
         { USB_DEVICE(EVOLUTION_VID, EVO_RCM4_PID) },
-        { USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ARTEMIS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ATIK_ATK16C_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 94d86c3febcb..bbc159a1df45 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -501,13 +501,6 @@
 #define CONTEC_COM1USBH_PID     0x8311  /* COM-1(USB)H */
 
 /*
- * Contec products (http://www.contec.com)
- * Submitted by Daniel Sangorrin
- */
-#define CONTEC_VID              0x06CE  /* Vendor ID */
-#define CONTEC_COM1USBH_PID     0x8311  /* COM-1(USB)H */
-
-/*
  * Definitions for B&B Electronics products.
  */
 #define BANDB_VID               0x0856  /* B&B Electronics Vendor ID */
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 04bb759536bb..93d72eb8cafc 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -139,6 +139,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                                         "Could not set interface, error %d\n",
                                         retval);
                                 retval = -ENODEV;
+                                kfree(data);
                         }
                         return retval;
                 }
@@ -155,6 +156,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
                                         "Could not set interface, error %d\n",
                                         retval);
                                 retval = -ENODEV;
+                                kfree(data);
                         }
                         return retval;
                 }
@@ -163,6 +165,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
         default:
                 dev_err(&serial->dev->dev,
                         "unknown number of interfaces: %d\n", nintf);
+                kfree(data);
                 return -ENODEV;
         }
 
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 0f41c9195e9b..57a593c58cf4 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -98,7 +98,8 @@ static void tx_poll_start(struct vhost_net *net, struct socket *sock)
 static void handle_tx(struct vhost_net *net)
 {
         struct vhost_virtqueue *vq = &net->dev.vqs[VHOST_NET_VQ_TX];
-        unsigned head, out, in, s;
+        unsigned out, in, s;
+        int head;
         struct msghdr msg = {
                 .msg_name = NULL,
                 .msg_namelen = 0,
@@ -135,6 +136,9 @@ static void handle_tx(struct vhost_net *net)
                                          ARRAY_SIZE(vq->iov),
                                          &out, &in,
                                          NULL, NULL);
+                /* On error, stop handling until the next kick. */
+                if (unlikely(head < 0))
+                        break;
                 /* Nothing new?  Wait for eventfd to tell us they refilled. */
                 if (head == vq->num) {
                         wmem = atomic_read(&sock->sk->sk_wmem_alloc);
@@ -192,7 +196,8 @@ static void handle_tx(struct vhost_net *net)
 static void handle_rx(struct vhost_net *net)
 {
         struct vhost_virtqueue *vq = &net->dev.vqs[VHOST_NET_VQ_RX];
-        unsigned head, out, in, log, s;
+        unsigned out, in, log, s;
+        int head;
         struct vhost_log *vq_log;
         struct msghdr msg = {
                 .msg_name = NULL,
@@ -228,6 +233,9 @@ static void handle_rx(struct vhost_net *net)
                                          ARRAY_SIZE(vq->iov),
                                          &out, &in,
                                          vq_log, &log);
+                /* On error, stop handling until the next kick. */
+                if (unlikely(head < 0))
+                        break;
                 /* OK, now we need to know about added descriptors. */
                 if (head == vq->num) {
                         if (unlikely(vhost_enable_notify(vq))) {
@@ -637,7 +645,7 @@ const static struct file_operations vhost_net_fops = {
 };
 
 static struct miscdevice vhost_net_misc = {
-        VHOST_NET_MINOR,
+        MISC_DYNAMIC_MINOR,
         "vhost-net",
         &vhost_net_fops,
 };
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 3b83382e06eb..0b99783083f6 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -736,12 +736,12 @@ static int translate_desc(struct vhost_dev *dev, u64 addr, u32 len,
         mem = rcu_dereference(dev->memory);
         while ((u64)len > s) {
                 u64 size;
-                if (ret >= iov_size) {
+                if (unlikely(ret >= iov_size)) {
                         ret = -ENOBUFS;
                         break;
                 }
                 reg = find_region(mem, addr, len);
-                if (!reg) {
+                if (unlikely(!reg)) {
                         ret = -EFAULT;
                         break;
                 }
@@ -780,18 +780,18 @@ static unsigned next_desc(struct vring_desc *desc)
         return next;
 }
 
-static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
-                             struct iovec iov[], unsigned int iov_size,
-                             unsigned int *out_num, unsigned int *in_num,
-                             struct vhost_log *log, unsigned int *log_num,
-                             struct vring_desc *indirect)
+static int get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
+                        struct iovec iov[], unsigned int iov_size,
+                        unsigned int *out_num, unsigned int *in_num,
+                        struct vhost_log *log, unsigned int *log_num,
+                        struct vring_desc *indirect)
 {
         struct vring_desc desc;
         unsigned int i = 0, count, found = 0;
         int ret;
 
         /* Sanity check */
-        if (indirect->len % sizeof desc) {
+        if (unlikely(indirect->len % sizeof desc)) {
                 vq_err(vq, "Invalid length in indirect descriptor: "
                        "len 0x%llx not multiple of 0x%zx\n",
                        (unsigned long long)indirect->len,
@@ -801,7 +801,7 @@ static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
 
         ret = translate_desc(dev, indirect->addr, indirect->len, vq->indirect,
                              ARRAY_SIZE(vq->indirect));
-        if (ret < 0) {
+        if (unlikely(ret < 0)) {
                 vq_err(vq, "Translation failure %d in indirect.\n", ret);
                 return ret;
         }
@@ -813,7 +813,7 @@ static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
         count = indirect->len / sizeof desc;
         /* Buffers are chained via a 16 bit next field, so
          * we can have at most 2^16 of these. */
-        if (count > USHRT_MAX + 1) {
+        if (unlikely(count > USHRT_MAX + 1)) {
                 vq_err(vq, "Indirect buffer length too big: %d\n",
                        indirect->len);
                 return -E2BIG;
@@ -821,19 +821,19 @@ static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
 
         do {
                 unsigned iov_count = *in_num + *out_num;
-                if (++found > count) {
+                if (unlikely(++found > count)) {
                         vq_err(vq, "Loop detected: last one at %u "
                                "indirect size %u\n",
                                i, count);
                         return -EINVAL;
                 }
-                if (memcpy_fromiovec((unsigned char *)&desc, vq->indirect,
-                                     sizeof desc)) {
+                if (unlikely(memcpy_fromiovec((unsigned char *)&desc, vq->indirect,
+                                              sizeof desc))) {
                         vq_err(vq, "Failed indirect descriptor: idx %d, %zx\n",
                                i, (size_t)indirect->addr + i * sizeof desc);
                         return -EINVAL;
                 }
-                if (desc.flags & VRING_DESC_F_INDIRECT) {
+                if (unlikely(desc.flags & VRING_DESC_F_INDIRECT)) {
                         vq_err(vq, "Nested indirect descriptor: idx %d, %zx\n",
                                i, (size_t)indirect->addr + i * sizeof desc);
                         return -EINVAL;
@@ -841,7 +841,7 @@ static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
 
                 ret = translate_desc(dev, desc.addr, desc.len, iov + iov_count,
                                      iov_size - iov_count);
-                if (ret < 0) {
+                if (unlikely(ret < 0)) {
                         vq_err(vq, "Translation failure %d indirect idx %d\n",
                                ret, i);
                         return ret;
@@ -857,7 +857,7 @@ static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
                 } else {
                         /* If it's an output descriptor, they're all supposed
                          * to come before any input descriptors. */
-                        if (*in_num) {
+                        if (unlikely(*in_num)) {
                                 vq_err(vq, "Indirect descriptor "
                                        "has out after in: idx %d\n", i);
                                 return -EINVAL;
@@ -873,12 +873,13 @@ static unsigned get_indirect(struct vhost_dev *dev, struct vhost_virtqueue *vq,
  * number of output then some number of input descriptors, it's actually two
  * iovecs, but we pack them into one and note how many of each there were.
  *
- * This function returns the descriptor number found, or vq->num (which
- * is never a valid descriptor number) if none was found. */
-unsigned vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
-                           struct iovec iov[], unsigned int iov_size,
-                           unsigned int *out_num, unsigned int *in_num,
-                           struct vhost_log *log, unsigned int *log_num)
+ * This function returns the descriptor number found, or vq->num (which is
+ * never a valid descriptor number) if none was found.  A negative code is
+ * returned on error. */
+int vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
+                      struct iovec iov[], unsigned int iov_size,
+                      unsigned int *out_num, unsigned int *in_num,
+                      struct vhost_log *log, unsigned int *log_num)
 {
         struct vring_desc desc;
         unsigned int i, head, found = 0;
@@ -887,16 +888,16 @@ unsigned vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
 
         /* Check it isn't doing very strange things with descriptor numbers. */
         last_avail_idx = vq->last_avail_idx;
-        if (get_user(vq->avail_idx, &vq->avail->idx)) {
+        if (unlikely(get_user(vq->avail_idx, &vq->avail->idx))) {
                 vq_err(vq, "Failed to access avail idx at %p\n",
                        &vq->avail->idx);
-                return vq->num;
+                return -EFAULT;
         }
 
-        if ((u16)(vq->avail_idx - last_avail_idx) > vq->num) {
+        if (unlikely((u16)(vq->avail_idx - last_avail_idx) > vq->num)) {
                 vq_err(vq, "Guest moved used index from %u to %u",
                        last_avail_idx, vq->avail_idx);
-                return vq->num;
+                return -EFAULT;
         }
 
         /* If there's nothing new since last we looked, return invalid. */
@@ -908,18 +909,19 @@ unsigned vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
 
         /* Grab the next descriptor number they're advertising, and increment
          * the index we've seen. */
-        if (get_user(head, &vq->avail->ring[last_avail_idx % vq->num])) {
+        if (unlikely(get_user(head,
+                              &vq->avail->ring[last_avail_idx % vq->num]))) {
                 vq_err(vq, "Failed to read head: idx %d address %p\n",
                        last_avail_idx,
                        &vq->avail->ring[last_avail_idx % vq->num]);
-                return vq->num;
+                return -EFAULT;
         }
 
         /* If their number is silly, that's an error. */
-        if (head >= vq->num) {
+        if (unlikely(head >= vq->num)) {
                 vq_err(vq, "Guest says index %u > %u is available",
                        head, vq->num);
-                return vq->num;
+                return -EINVAL;
         }
 
         /* When we start there are none of either input nor output. */
@@ -930,41 +932,41 @@ unsigned vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
         i = head;
         do {
                 unsigned iov_count = *in_num + *out_num;
-                if (i >= vq->num) {
+                if (unlikely(i >= vq->num)) {
                         vq_err(vq, "Desc index is %u > %u, head = %u",
                                i, vq->num, head);
-                        return vq->num;
+                        return -EINVAL;
                 }
-                if (++found > vq->num) {
+                if (unlikely(++found > vq->num)) {
                         vq_err(vq, "Loop detected: last one at %u "
                                "vq size %u head %u\n",
                                i, vq->num, head);
-                        return vq->num;
+                        return -EINVAL;
                 }
                 ret = copy_from_user(&desc, vq->desc + i, sizeof desc);
-                if (ret) {
+                if (unlikely(ret)) {
                         vq_err(vq, "Failed to get descriptor: idx %d addr %p\n",
                                i, vq->desc + i);
-                        return vq->num;
+                        return -EFAULT;
                 }
                 if (desc.flags & VRING_DESC_F_INDIRECT) {
                         ret = get_indirect(dev, vq, iov, iov_size,
                                            out_num, in_num,
                                            log, log_num, &desc);
-                        if (ret < 0) {
+                        if (unlikely(ret < 0)) {
                                 vq_err(vq, "Failure detected "
                                        "in indirect descriptor at idx %d\n", i);
-                                return vq->num;
+                                return ret;
                         }
                         continue;
                 }
 
                 ret = translate_desc(dev, desc.addr, desc.len, iov + iov_count,
                                      iov_size - iov_count);
-                if (ret < 0) {
+                if (unlikely(ret < 0)) {
                         vq_err(vq, "Translation failure %d descriptor idx %d\n",
                                ret, i);
-                        return vq->num;
+                        return ret;
                 }
                 if (desc.flags & VRING_DESC_F_WRITE) {
                         /* If this is an input descriptor,
@@ -978,10 +980,10 @@ unsigned vhost_get_vq_desc(struct vhost_dev *dev, struct vhost_virtqueue *vq,
                 } else {
                         /* If it's an output descriptor, they're all supposed
                          * to come before any input descriptors. */
-                        if (*in_num) {
+                        if (unlikely(*in_num)) {
                                 vq_err(vq, "Descriptor has out after in: "
                                        "idx %d\n", i);
-                                return vq->num;
+                                return -EINVAL;
                         }
                         *out_num += ret;
                 }
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 44591ba9b07a..11ee13dba0f7 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -120,10 +120,10 @@ long vhost_dev_ioctl(struct vhost_dev *, unsigned int ioctl, unsigned long arg);
 int vhost_vq_access_ok(struct vhost_virtqueue *vq);
 int vhost_log_access_ok(struct vhost_dev *);
 
-unsigned vhost_get_vq_desc(struct vhost_dev *, struct vhost_virtqueue *,
-                           struct iovec iov[], unsigned int iov_count,
-                           unsigned int *out_num, unsigned int *in_num,
-                           struct vhost_log *log, unsigned int *log_num);
+int vhost_get_vq_desc(struct vhost_dev *, struct vhost_virtqueue *,
+                      struct iovec iov[], unsigned int iov_count,
+                      unsigned int *out_num, unsigned int *in_num,
+                      struct vhost_log *log, unsigned int *log_num);
 void vhost_discard_vq_desc(struct vhost_virtqueue *);
 
 int vhost_add_used(struct vhost_virtqueue *, unsigned int head, int len);
diff --git a/drivers/video/geode/gxfb_core.c b/drivers/video/geode/gxfb_core.c
index 76e7dac6f259..70b1d9d51c96 100644
--- a/drivers/video/geode/gxfb_core.c
+++ b/drivers/video/geode/gxfb_core.c
@@ -40,7 +40,7 @@ static int vram;
 static int vt_switch;
 
 /* Modes relevant to the GX (taken from modedb.c) */
-static struct fb_videomode gx_modedb[] __initdata = {
+static struct fb_videomode gx_modedb[] __devinitdata = {
         /* 640x480-60 VESA */
         { NULL, 60, 640, 480, 39682,  48, 16, 33, 10, 96, 2,
           0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
@@ -110,14 +110,15 @@ static struct fb_videomode gx_modedb[] __initdata = {
 #ifdef CONFIG_OLPC
 #include <asm/olpc.h>
 
-static struct fb_videomode gx_dcon_modedb[] __initdata = {
+static struct fb_videomode gx_dcon_modedb[] __devinitdata = {
         /* The only mode the DCON has is 1200x900 */
         { NULL, 50, 1200, 900, 17460, 24, 8, 4, 5, 8, 3,
           FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
           FB_VMODE_NONINTERLACED, 0 }
 };
 
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
         if (olpc_has_dcon()) {
                 *modedb = (struct fb_videomode *) gx_dcon_modedb;
@@ -129,7 +130,8 @@ static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
 }
 
 #else
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
         *modedb = (struct fb_videomode *) gx_modedb;
         *size = ARRAY_SIZE(gx_modedb);
@@ -226,7 +228,8 @@ static int gxfb_blank(int blank_mode, struct fb_info *info)
         return gx_blank_display(info, blank_mode);
 }
 
-static int __init gxfb_map_video_memory(struct fb_info *info, struct pci_dev *dev)
+static int __devinit gxfb_map_video_memory(struct fb_info *info,
+                struct pci_dev *dev)
 {
         struct gxfb_par *par = info->par;
         int ret;
@@ -290,7 +293,7 @@ static struct fb_ops gxfb_ops = {
         .fb_imageblit   = cfb_imageblit,
 };
 
-static struct fb_info * __init gxfb_init_fbinfo(struct device *dev)
+static struct fb_info *__devinit gxfb_init_fbinfo(struct device *dev)
 {
         struct gxfb_par *par;
         struct fb_info *info;
@@ -371,7 +374,8 @@ static int gxfb_resume(struct pci_dev *pdev)
 }
 #endif
 
-static int __init gxfb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+static int __devinit gxfb_probe(struct pci_dev *pdev,
+                const struct pci_device_id *id)
 {
         struct gxfb_par *par;
         struct fb_info *info;
@@ -451,7 +455,7 @@ static int __init gxfb_probe(struct pci_dev *pdev, const struct pci_device_id *i
         return ret;
 }
 
-static void gxfb_remove(struct pci_dev *pdev)
+static void __devexit gxfb_remove(struct pci_dev *pdev)
 {
         struct fb_info *info = pci_get_drvdata(pdev);
         struct gxfb_par *par = info->par;
diff --git a/drivers/video/geode/lxfb_core.c b/drivers/video/geode/lxfb_core.c
index 1a18da86d3fa..39bdbedf43b4 100644
--- a/drivers/video/geode/lxfb_core.c
+++ b/drivers/video/geode/lxfb_core.c
@@ -35,7 +35,7 @@ static int vt_switch;
  * we try to make it something sane - 640x480-60 is sane
  */
 
-static struct fb_videomode geode_modedb[] __initdata = {
+static struct fb_videomode geode_modedb[] __devinitdata = {
         /* 640x480-60 */
         { NULL, 60, 640, 480, 39682, 48, 8, 25, 2, 88, 2,
           FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
@@ -219,14 +219,15 @@ static struct fb_videomode geode_modedb[] __initdata = {
 #ifdef CONFIG_OLPC
 #include <asm/olpc.h>
 
-static struct fb_videomode olpc_dcon_modedb[] __initdata = {
+static struct fb_videomode olpc_dcon_modedb[] __devinitdata = {
         /* The only mode the DCON has is 1200x900 */
         { NULL, 50, 1200, 900, 17460, 24, 8, 4, 5, 8, 3,
           FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
           FB_VMODE_NONINTERLACED, 0 }
 };
 
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
         if (olpc_has_dcon()) {
                 *modedb = (struct fb_videomode *) olpc_dcon_modedb;
@@ -238,7 +239,8 @@ static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
 }
 
 #else
-static void __init get_modedb(struct fb_videomode **modedb, unsigned int *size)
+static void __devinit get_modedb(struct fb_videomode **modedb,
+                unsigned int *size)
 {
         *modedb = (struct fb_videomode *) geode_modedb;
         *size = ARRAY_SIZE(geode_modedb);
@@ -334,7 +336,7 @@ static int lxfb_blank(int blank_mode, struct fb_info *info)
 }
 
 
-static int __init lxfb_map_video_memory(struct fb_info *info,
+static int __devinit lxfb_map_video_memory(struct fb_info *info,
                                         struct pci_dev *dev)
 {
         struct lxfb_par *par = info->par;
@@ -412,7 +414,7 @@ static struct fb_ops lxfb_ops = {
         .fb_imageblit   = cfb_imageblit,
 };
 
-static struct fb_info * __init lxfb_init_fbinfo(struct device *dev)
+static struct fb_info * __devinit lxfb_init_fbinfo(struct device *dev)
 {
         struct lxfb_par *par;
         struct fb_info *info;
@@ -496,7 +498,7 @@ static int lxfb_resume(struct pci_dev *pdev)
 #define lxfb_resume NULL
 #endif
 
-static int __init lxfb_probe(struct pci_dev *pdev,
+static int __devinit lxfb_probe(struct pci_dev *pdev,
                              const struct pci_device_id *id)
 {
         struct lxfb_par *par;
@@ -588,7 +590,7 @@ err:
         return ret;
 }
 
-static void lxfb_remove(struct pci_dev *pdev)
+static void __devexit lxfb_remove(struct pci_dev *pdev)
 {
         struct fb_info *info = pci_get_drvdata(pdev);
         struct lxfb_par *par = info->par;
diff --git a/drivers/video/nuc900fb.c b/drivers/video/nuc900fb.c
index d4cde79ea15e..81687ed26ba9 100644
--- a/drivers/video/nuc900fb.c
+++ b/drivers/video/nuc900fb.c
@@ -596,8 +596,6 @@ static int __devinit nuc900fb_probe(struct platform_device *pdev)
                 goto release_regs;
         }
 
-        nuc900_driver_clksrc_div(&pdev->dev, "ext", 0x2);
-
         fbi->clk = clk_get(&pdev->dev, NULL);
         if (!fbi->clk || IS_ERR(fbi->clk)) {
                 printk(KERN_ERR "nuc900-lcd:failed to get lcd clock source\n");
diff --git a/drivers/video/omap/lcdc.c b/drivers/video/omap/lcdc.c
index 43ab7d8b66b2..7767338f8b14 100644
--- a/drivers/video/omap/lcdc.c
+++ b/drivers/video/omap/lcdc.c
@@ -572,22 +572,12 @@ static enum omapfb_update_mode omap_lcdc_get_update_mode(void)
 /* PM code called only in internal controller mode */
 static void omap_lcdc_suspend(void)
 {
-        if (lcdc.update_mode == OMAPFB_AUTO_UPDATE) {
-                disable_controller();
-                omap_stop_lcd_dma();
-        }
+        omap_lcdc_set_update_mode(OMAPFB_UPDATE_DISABLED);
 }
 
 static void omap_lcdc_resume(void)
 {
-        if (lcdc.update_mode == OMAPFB_AUTO_UPDATE) {
-                setup_regs();
-                load_palette();
-                setup_lcd_dma();
-                set_load_mode(OMAP_LCDC_LOAD_FRAME);
-                enable_irqs(OMAP_LCDC_IRQ_DONE);
-                enable_controller();
-        }
+        omap_lcdc_set_update_mode(OMAPFB_AUTO_UPDATE);
 }
 
 static void omap_lcdc_get_caps(int plane, struct omapfb_caps *caps)
diff --git a/drivers/video/omap/rfbi.c b/drivers/video/omap/rfbi.c
index 1162603c72e5..eada9f12efc7 100644
--- a/drivers/video/omap/rfbi.c
+++ b/drivers/video/omap/rfbi.c
@@ -26,6 +26,7 @@
 #include <linux/interrupt.h>
 #include <linux/clk.h>
 #include <linux/io.h>
+#include <linux/platform_device.h>
 
 #include "omapfb.h"
 #include "dispc.h"
@@ -83,13 +84,13 @@ static inline u32 rfbi_read_reg(int idx)
 
 static int rfbi_get_clocks(void)
 {
-        rfbi.dss_ick = clk_get(&dispc.fbdev->dssdev->dev, "ick");
+        rfbi.dss_ick = clk_get(&rfbi.fbdev->dssdev->dev, "ick");
         if (IS_ERR(rfbi.dss_ick)) {
                 dev_err(rfbi.fbdev->dev, "can't get ick\n");
                 return PTR_ERR(rfbi.dss_ick);
         }
 
-        rfbi.dss1_fck = clk_get(&dispc.fbdev->dssdev->dev, "dss1_fck");
+        rfbi.dss1_fck = clk_get(&rfbi.fbdev->dssdev->dev, "dss1_fck");
         if (IS_ERR(rfbi.dss1_fck)) {
                 dev_err(rfbi.fbdev->dev, "can't get dss1_fck\n");
                 clk_put(rfbi.dss_ick);
diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
index 95896f387927..ef8d9d558fc7 100644
--- a/drivers/virtio/virtio_pci.c
+++ b/drivers/virtio/virtio_pci.c
@@ -636,6 +636,9 @@ static int __devinit virtio_pci_probe(struct pci_dev *pci_dev,
         INIT_LIST_HEAD(&vp_dev->virtqueues);
         spin_lock_init(&vp_dev->lock);
 
+        /* Disable MSI/MSIX to bring device to a known good state. */
+        pci_msi_off(pci_dev);
+
         /* enable the device */
         err = pci_enable_device(pci_dev);
         if (err)
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 1ca88908723b..afe7e21dd0ae 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -119,7 +119,7 @@ static int vring_add_indirect(struct vring_virtqueue *vq,
 
         desc = kmalloc((out + in) * sizeof(struct vring_desc), gfp);
         if (!desc)
-                return vq->vring.num;
+                return -ENOMEM;
 
         /* Transfer entries from the sg list into the indirect page */
         for (i = 0; i < out; i++) {
diff --git a/drivers/watchdog/at32ap700x_wdt.c b/drivers/watchdog/at32ap700x_wdt.c
index 1cddf92cb9a6..750bc5281d79 100644
--- a/drivers/watchdog/at32ap700x_wdt.c
+++ b/drivers/watchdog/at32ap700x_wdt.c
@@ -346,9 +346,13 @@ static int __init at32_wdt_probe(struct platform_device *pdev)
         } else {
                 wdt->users = 0;
         }
-        wdt->miscdev.minor = WATCHDOG_MINOR;
-        wdt->miscdev.name = "watchdog";
-        wdt->miscdev.fops = &at32_wdt_fops;
+
+        wdt->miscdev.minor      = WATCHDOG_MINOR;
+        wdt->miscdev.name       = "watchdog";
+        wdt->miscdev.fops       = &at32_wdt_fops;
+        wdt->miscdev.parent     = &pdev->dev;
+
+        platform_set_drvdata(pdev, wdt);
 
         if (at32_wdt_settimeout(timeout)) {
                 at32_wdt_settimeout(TIMEOUT_DEFAULT);
@@ -360,17 +364,17 @@ static int __init at32_wdt_probe(struct platform_device *pdev)
         ret = misc_register(&wdt->miscdev);
         if (ret) {
                 dev_dbg(&pdev->dev, "failed to register wdt miscdev\n");
-                goto err_iounmap;
+                goto err_register;
         }
 
-        platform_set_drvdata(pdev, wdt);
-        wdt->miscdev.parent = &pdev->dev;
         dev_info(&pdev->dev,
                 "AT32AP700X WDT at 0x%p, timeout %d sec (nowayout=%d)\n",
                 wdt->regs, wdt->timeout, nowayout);
 
         return 0;
 
+err_register:
+        platform_set_drvdata(pdev, NULL);
 err_iounmap:
         iounmap(wdt->regs);
 err_free:
diff --git a/drivers/watchdog/imx2_wdt.c b/drivers/watchdog/imx2_wdt.c
index ea25885781bb..2ee7dac55a3c 100644
--- a/drivers/watchdog/imx2_wdt.c
+++ b/drivers/watchdog/imx2_wdt.c
@@ -330,7 +330,6 @@ static void imx2_wdt_shutdown(struct platform_device *pdev)
 }
 
 static struct platform_driver imx2_wdt_driver = {
-        .probe          = imx2_wdt_probe,
         .remove         = __exit_p(imx2_wdt_remove),
         .shutdown       = imx2_wdt_shutdown,
         .driver         = {
diff --git a/drivers/watchdog/wm8350_wdt.c b/drivers/watchdog/wm8350_wdt.c
index 89dd7b035295..b68d928c8f90 100644
--- a/drivers/watchdog/wm8350_wdt.c
+++ b/drivers/watchdog/wm8350_wdt.c
@@ -284,7 +284,7 @@ static int __devinit wm8350_wdt_probe(struct platform_device *pdev)
         struct wm8350 *wm8350 = platform_get_drvdata(pdev);
 
         if (!wm8350) {
-                dev_err(wm8350->dev, "No driver data supplied\n");
+                pr_err("No driver data supplied\n");
                 return -ENODEV;
         }
 
diff --git a/firmware/Makefile b/firmware/Makefile
index 243409f5240d..020e629a615c 100644
--- a/firmware/Makefile
+++ b/firmware/Makefile
@@ -83,6 +83,7 @@ fw-shipped-$(CONFIG_SCSI_ADVANSYS) += advansys/mcode.bin advansys/38C1600.bin \
 fw-shipped-$(CONFIG_SCSI_QLOGIC_1280) += qlogic/1040.bin qlogic/1280.bin \
                                          qlogic/12160.bin
 fw-shipped-$(CONFIG_SCSI_QLOGICPTI) += qlogic/isp1000.bin
+fw-shipped-$(CONFIG_INFINIBAND_QIB) += qlogic/sd7220.fw
 fw-shipped-$(CONFIG_SMCTR) += tr_smctr.bin
 fw-shipped-$(CONFIG_SND_KORG1212) += korg/k1212.dsp
 fw-shipped-$(CONFIG_SND_MAESTRO3) += ess/maestro3_assp_kernel.fw \
diff --git a/firmware/WHENCE b/firmware/WHENCE
index e8e550fa2423..ae5f8a47f292 100644
--- a/firmware/WHENCE
+++ b/firmware/WHENCE
@@ -858,3 +858,43 @@ Licence:
 Found in hex form in kernel source.
 
 --------------------------------------------------------------------------
+
+Driver: ib_qib - QLogic Infiniband
+
+File: qlogic/sd7220.fw
+
+Licence:
+
+ * Copyright (c) 2007, 2008 QLogic Corporation. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+
+Found in hex form in kernel source.
+
+--------------------------------------------------------------------------
diff --git a/firmware/qlogic/sd7220.fw.ihex b/firmware/qlogic/sd7220.fw.ihex
new file mode 100644
index 000000000000..a33636319112
--- /dev/null
+++ b/firmware/qlogic/sd7220.fw.ihex
@@ -0,0 +1,513 @@
+:10000000020A29020A87E5E630E6047F0180027FC2
+:1000100000E5E230E4047E0180027E00EE5F6008CD
+:1000200053F9F7E4F5FE80087F0A121731120EA289
+:1000300075FC08E4F5FDE5E720E70343F908220035
+:1000400001201100042000755101E4F552F553F52B
+:1000500052F57E7F04020438C2360552E552D3942D
+:100060000C4005755201D23690070C7407F0A3744A
+:10007000FFF0E4F50CA3F0900714F0A3F0750B204B
+:10008000F509E4F508E508D39430400302040412AE
+:100090000006150BE50870047F0180027F00E5096A
+:1000A00070047E0180027E00EE5F6005121871D23E
+:1000B0003553E1F7E5084509FFE50B25E025E02488
+:1000C00083F582E43407F583EFF085E220E552D32F
+:1000D0009401400D1219F3E054A064407003020330
+:1000E000FB53F9F8909470E4F0E0F510AF09121E9C
+:1000F000B3AF08EF4408F582758380E0F529EF443B
+:1001000007121A3CF5225440D39400401EE52954AE
+:10011000F070211219F3E04480F0E52254306508B4
+:1001200070091219F3E054BFF080091219F37440FA
+:10013000F00203FB121A127583AE74FFF0AF087E53
+:1001400000EF4407F582E0FDE50B25E025E0248182
+:10015000F582E43407F583EDF090070EE004F0EF4C
+:100160004407F582758398E0F528121A23400C1293
+:1001700019F3E04401121A320203F6AF087E00744C
+:1001800080CDEFCD8D82F583E030E00A1219F3E0E7
+:100190004420F00203FB1219F3E054DFF0EE44AE0A
+:1001A000121A4330E4030203FB749E121A0520E086
+:1001B000030203FB8F828E83E020E0030203FB1225
+:1001C00019F3E04410F0E5E320E708E508121A3AD5
+:1001D0004404F0AF087E00EF121A3A20E2341219FC
+:1001E000F3E04408F0E5E430E6047D0180027D00A0
+:1001F000E57EC3940450047C0180027C00EC4D60D9
+:1002000005C2350203FBEE44D2121A434440F00209
+:1002100003FB1219F3E054F7F0121A127583D2E0BF
+:1002200054BFF0900714E004F0E57E7003757E0182
+:10023000AF087E00121A2340121219F3E044011293
+:1002400019F2E05402121A320203FB1219F3E044CD
+:10025000021219F2E054FEF0C235EE448A8F82F5A4
+:1002600083E0F517548F4440F07490FCE508440790
+:10027000FDF5828C83E0543F900702F0E054C08D7E
+:10028000828C83F07492121A05900703121A197463
+:1002900082121A05900704121A1974B4121A0590E2
+:1002A0000705121A197494FEE5084406121A0AF595
+:1002B0001030E004D2378002C237E510547F8F82BD
+:1002C0008E83F0304430121A035480D394004004DB
+:1002D000D2398002C2398F828E83E04480F0121AB4
+:1002E000035440D394004004D23A8002C23A8F8231
+:1002F0008E83E04440F07492FEE5084406121A0A28
+:1003000030E704D2388002C2388F828E83E0547F77
+:10031000F0121E46E4F50A20030280033043031264
+:1003200019952002028003304203120C8F303006F0
+:10033000121995120C8F120D471219F3E054FBF0AD
+:10034000E50AC39401404643E1081219F3E044046E
+:10035000F0E5E420E72A121A127583D2E05408D39C
+:10036000940040047F0180027F00E50AC3940140AD
+:10037000047E0180027E00EF5E6005121DD78017AB
+:10038000121A127583D2E04408F00203FB121A120B
+:100390007583D2E054F7F0121E467F0812173174AD
+:1003A0008EFE121A128E83E0F51054FEF0E5104412
+:1003B00001FFE508FDED4407F582EFF0E51054FE7E
+:1003C000FFED4407F582EF121A11758386E04410A1
+:1003D000121A11E04410F01219F3E054FD4401FF29
+:1003E0001219F3EF121A3230320CE5084408F58284
+:1003F0007583827405F0AF0B1218D774102508F5B9
+:10040000080200850509E509D3940750030200821C
+:10041000E57ED3940040047F0180027F00E57EC327
+:1004200094FA50047E0180027E00EE5F6002057E39
+:1004300030350B43E1017F0912173102005853E1B7
+:10044000FE0200588E6A8F6B8C6C8D6D756E017517
+:100450006F01757001E4F573F574F57590072FF071
+:10046000F53CF53EF546F547F53DF53FF56FE56F93
+:10047000700FE56B456A12072A758380743AF08025
+:100480000912072A758380741AF0E4F56EC3743F6D
+:10049000956EFF120865758382EFF0121A4D1208EF
+:1004A000C6E533F01208FA1208B140E1E56F700BAF
+:1004B00012072A7583807436F0800912072A758323
+:1004C000807416F0756E0112072A7583B4E56EF01C
+:1004D000121A4D743F256EF582E43400F583E5333E
+:1004E000F074BF256EF582E434001208B140D8E400
+:1004F000F570F546F547F56E1208FAF583E0FE1241
+:1005000008C6E07C002400FFEC3EFEAD3BD3EF9D2F
+:10051000EE9C50047B0180027B00E57070047A0140
+:1005200080027A00EB5A6006856E46757001D3EF43
+:100530009DEE9C50047F0180027F00E570B40104B1
+:100540007E0180027E00EF5E6003856E47056EE5EA
+:100550006E647F70A3E5466005E547B47E0385467B
+:1005600047E56F7008854676854777800EC3747FB0
+:100570009546F578C3747F9547F579E56F7037E553
+:10058000466547700C757301757401F53CF53D8047
+:1005900035E4F54EC3E5479546F53CC313F57125A3
+:1005A00046F572C3943F4005E4F53D8040C3743F77
+:1005B0009572F53D8037E5466547700F7573017597
+:1005C0007501F53EF53F754E018022E4F54EC3E519
+:1005D000479546F53EC313F5712546F572D3943F12
+:1005E0005005E4F53F8006E57224C1F53F056FE54F
+:1005F0006FC39402500302046EE56D456C70028077
+:1006000004E574457590072FF07F01E53E6004E531
+:100610003C7014E4F53CF53DF53EF53F1208D27010
+:1006200004F00206A4807AE53CC3953E4007E53C11
+:10063000953EFF8006C3E53E953CFFE576D3957970
+:10064000400585767A800385797AE577C395785079
+:100650000585777B800385787BE57BD3957A403071
+:10066000E57B957AF53CF53EC3E57B957A900719D5
+:10067000F0E53CC313F571257AF572C3943F40054C
+:10068000E4F53D801FC3743F9572F53DF53F80143E
+:10069000E4F53CF53E900719F01208D27003F080A3
+:1006A000037401F01208657583D0E0540FFEAD3C71
+:1006B00070027E07BE0F027E80EEFBEFD39B74803C
+:1006C000F898401FE4F53CF53E1208D27003F08024
+:1006D000127401F0E508FBEB4407F5827583D2E064
+:1006E0004410F0E508FBEB4409F58275839EEDF0BC
+:1006F000EB4407F5827583CAEDF01208657583CC6B
+:10070000EFF022E5084407F5827583BCE054F0F071
+:10071000E5084407F5827583BEE054F0F0E508442F
+:1007200007F5827583C0E054F0F0E5084407F582D0
+:1007300022F0900728E0FEA3E0F5828E8322854216
+:100740004285414185404074C02FF58274023EF5D8
+:1007500083E542F074E02FF58274023EF58322E5D2
+:100760004229FDE433FCE53CC39DEC6480F87480D1
+:100770009822F583E0900722541FFDE0FAA3E0F5EC
+:10078000828A83EDF022900722E0FCA3E0F5828CC0
+:100790008322900724FFED4407CFF0A3EFF02285DA
+:1007A0003838853939853A3A74C02FF58274023E5B
+:1007B000F58322900726FFED4407CFF0A3EFF02248
+:1007C000F074A02FF58274023EF5832274C02511C7
+:1007D000F582E43401F5832274002511F582E434B6
+:1007E00002F5832274602511F582E43403F5832237
+:1007F00074802511F582E43403F5832274E0251119
+:10080000F582E43403F5832274402511F582E43443
+:1008100006F5832274802FF58274023EF58322AFA1
+:10082000087E00EF4407F58222F583E5824407F550
+:1008300082E540F02274402511F582E43402F5830C
+:100840002274C02511F582E43403F5832274002557
+:1008500011F582E43406F5832274202511F582E433
+:100860003406F58322E508FDED4407F58222E541D3
+:10087000F0E56564014564227E00FB7A00FD7C00A2
+:100880002274202511F582E434022274A02511F58A
+:1008900082E4340322853E42853F418F4022853CDD
+:1008A00042853D418F402275453F900720E4F0A3EB
+:1008B00022F583E532F0056EE56EC3944022F0E543
+:1008C000084406F582227400256EF582E43400F5B2
+:1008D0008322E56D456C90072F22E4F9E53CD39522
+:1008E0003E2274802EF582E43402F583E02274A067
+:1008F0002EF582E43402F583E0227480256EF582C1
+:10090000E43400222542FDE433FC22854242854145
+:100910004185404022ED4C60030209E5EF4E7037FF
+:10092000900726120789E0FD1207CCEDF09007280A
+:10093000120789E0FD1207D8EDF0120786E0541F78
+:10094000FD120881F583EDF0900724120789E05429
+:100950001FFD120835EDF0EF64044E703790072646
+:10096000120789E0FD1207E4EDF0900728120789CD
+:10097000E0FD1207F0EDF0120786E0541FFD1208AB
+:100980008BF583EDF0900724120789E0541FFD12C8
+:100990000841EDF0EF64014E70047D0180027D009E
+:1009A000EF64024E70047F0180027F00EF4D60789B
+:1009B000900726120735E0FF1207FCEF120731E01F
+:1009C000FF120808EFF0900722120735E0541FFFCE
+:1009D00012084DEFF0900724120735E0541FFF1264
+:1009E0000859EFF0221207CCE4F01207D8E4F01215
+:1009F0000881F583E4F01208357414F01207E4E47A
+:100A0000F01207F0E4F012088BF583E4F0120841CD
+:100A10007414F01207FCE4F0120808E4F012084D18
+:100A2000E4F01208597414F02253F9F775FC10E43D
+:100A3000F5FD75FE30F5FFE5E720E70343F908E52E
+:100A4000E620E70B78FFE4F6D8FD53E6FE80097850
+:100A500008E4F6D8FD53E6FE758180E4F5A8D2A837
+:100A6000C2A9D2AFE5E220E50520E602800343E11A
+:100A700002E5E220E00E9000007F007E08E4F0A393
+:100A8000DFFCDEFA020ADB43FA01C0E0C0F0C083FB
+:100A9000C082C0D0121CE7D0D0D082D083D0F0D09A
+:100AA000E053FAFE32021B55E493A3F8E493A3F655
+:100AB00008DFF98029E493A3F85407240CC8C33352
+:100AC000C4540F4420C8834004F456800146F6DF26
+:100AD000E4800B010204081020408090003FE47E77
+:100AE000019360C1A3FF543F30E509541FFEE49316
+:100AF000A360010ECF54C025E060AD40B880FE8CED
+:100B0000648D658A668B67E4F569EF4E7003021D9C
+:100B100055E4F568E5674566703212072A758390DB
+:100B2000E41207297583C2E41207297583C4E4120D
+:100B30000870702912072A758392E41207297583B9
+:100B4000C6E41207297583C8E4F0801190072612C5
+:100B50000735E41208707005120732E4F0121D55D3
+:100B6000121EBFE5674566703312072A758390E54C
+:100B7000411207297583C2E5411207297583C41202
+:100B8000086E702912072A758392E54012072975AD
+:100B900083C6E5401207297583C8800E9007261288
+:100BA000073512086E7006120732E540F0AF697E15
+:100BB00000AD67AC6612044412072A7583CAE0D3FD
+:100BC0009400500C0568E568C394055003020B14AB
+:100BD000228C608D611208DA7420400D2FF582742A
+:100BE000033EF583E53EF0800B2FF58274033EF55E
+:100BF00083E53CF0E53CD3953E403CE561456070C3
+:100C000010E9120904E53E120768403B120895807E
+:100C100018E53EC39538401D853E38E53E600585A4
+:100C20003F3980038539398F3A120814E53E12079F
+:100C3000C0E53FF0228043E5614560701912075F0F
+:100C4000400512089E802712090B120814E5421273
+:100C500007C0E541F022E53CC39538401D853C388E
+:100C6000E53C6005853D3980038539398F3A1208A6
+:100C700014E53C1207C0E53DF02285383885393946
+:100C8000853A3A120814E5381207C0E539F0227F98
+:100C900006121731121D23120E04120E33E0440AFD
+:100CA000F0748EFE120E04120E0BEFF0E52830E504
+:100CB00003D38001C3400575142080037514081206
+:100CC0000E0475838AE514F0B4FF05751280800662
+:100CD000E514C313F512E4F516F57F121936121355
+:100CE000A3E50AC3940150090516E516C394144000
+:100CF000EAE5E420E728120E047583D2E05408D315
+:100D0000940040047F0180027F00E50AC394014003
+:100D1000047E0180027E00EF5E6003121DD7E57F36
+:100D2000C394114014120E047583D2E04480F0E5A0
+:100D3000E420E70F121DD7800A120E047583D2E05B
+:100D4000547FF0121D2322748A850882F583E517EB
+:100D5000F0120E3AE4F0900702E0120E177583903D
+:100D6000EFF07492FEE5084407FFF5828E83E054AD
+:100D7000C0FD900703E0543F4D8F828E83F09007B3
+:100D800004E0120E17758382EFF0900705E0FFED87
+:100D90004407F5827583B4EF120E03758380E05427
+:100DA000BFF030370A120E91758394E04480F03022
+:100DB000380A120E91758392E04480F0E52830E401
+:100DC0001A20390A120E04758388E0547FF0203A05
+:100DD0000A120E04758388E054BFF0748CFE120E64
+:100DE000048E83E0540F120E03758386E054BFF027
+:100DF000E5084406120DFD75838AE4F022F582753C
+:100E00008382E4F0E5084407F582228E83E0F51042
+:100E100054FEF0E5104401FFE508FDED4407F582BE
+:100E200022E515C45407FFE508FDED4408F5827579
+:100E3000838222758380E04440F0E5084408F5820F
+:100E400075838A22E51625E025E024AFF582E43497
+:100E50001AF583E493F50D2243E11043E18053E159
+:100E6000FD85E11022E51625E025E024B2F582E4B7
+:100E7000341AF583E49322855582855483E515F071
+:100E800022E5E25420D3940022E5E25440D39400BA
+:100E900022E5084406F58222FDE508FBEB4407F550
+:100EA000822253F9F775FE3022EF4E70261207CCDE
+:100EB000E0FD90072612077B1207D8E0FD90072877
+:100EC00012077B120881120772120835E09007247E
+:100ED000120778EF64044E70291207E4E0FD9007D2
+:100EE0002612077B1207F0E0FD90072812077B12FD
+:100EF000088B120772120841E0541FFD900724125C
+:100F0000077BEF64014E70047D0180027D00EF6479
+:100F1000024E70047F0180027F00EF4D60351207A2
+:100F2000FCE0FF900726120789EFF0120808E0FFA7
+:100F3000900728120789EFF012084DE0541FFF12A6
+:100F40000786EFF0120859E0541FFF90072412079C
+:100F500089EFF022E4F553120E8140047F018002F4
+:100F60007F00120E8940047E0180027E00EE4F70E9
+:100F700003020FF685E11043E10253E10F85E11012
+:100F8000E4F551E5E3543FF552120E89401DAD5290
+:100F9000AF51121118EF600885E11043E140800B5A
+:100FA00053E1BF120E5812000680FBE5E3543FF5F3
+:100FB00051E5E4543FF552120E81401DAD52AF5140
+:100FC000121118EF600885E11043E120800B53E116
+:100FD000DF120E5812000680FB120E8140047F01C2
+:100FE00080027F00120E8940047E0180027E00EEA6
+:100FF0004F6003120E5B22120E21EFF012109122AD
+:1010000002110002104002109000000000000000D9
+:1010100001200120E4F5571216BD121644E4121007
+:10102000561214B7900726120735E4120731E4F080
+:101030001210561214B7900726120735E541120711
+:1010400031E540F0AF577E00AD567C00120444AF4E
+:10105000567E000211EEFF900720A3E0FDE4F55656
+:10106000F540FEFCAB56FA1211517F0F7D18E4F5E6
+:1010700056F540FEFCAB56FA121541AF567E0012F3
+:101080001AFFE4FFF5567D1FF540FEFCAB56FA2231
+:1010900022E4F555E508FD74A0F556ED4407F55733
+:1010A000E52830E503D38001C340057F28EF8004A5
+:1010B0007F14EFC313F554E4F9120E1875838EE014
+:1010C000F510CEEFCEEED394004026E51054FE127C
+:1010D0000E9875838EEDF0E5104401FDEB4407F5A5
+:1010E00082EDF0855782855683E030E301091E804A
+:1010F000D4C234E9C395544002D2342202000622FD
+:10110000303011901000E493F510901010E493F536
+:101110001012109012115022E4FCC3ED9FFAEFF56B
+:101120008375820079FFE493CC6CCCA3D9F8DAF60E
+:10113000E5E230E4028CE5ED24FFFFEF7582FFF578
+:1011400083E4936C70037F01227F00222211000050
+:10115000228E588F598C5A8D5B8A5C8B5D755E012F
+:10116000E4F55FF560F56212072A7583D0E0FFC4ED
+:10117000540FF561121EA585595ED3E55E955BE5BA
+:101180005A12076B504B1207037583BCE0455E1281
+:1011900007297583BEE0455E1207297583C0E045C7
+:1011A0005EF0AF5FE560120878120AFFAF627E0062
+:1011B000AD5DAC5C120444E561AF5E7E00B4030536
+:1011C000121E218007AD5DAC5C121317055E021183
+:1011D0007A1207037583BCE045401207297583BE68
+:1011E000E045401207297583C0E04540F0228E5843
+:1011F0008F59755A017901755B01E4FB12072A7555
+:1012000083AEE0541AFF120865E0C4135407FEEFE2
+:10121000700CEE6535700790072FE0B4010DAF3507
+:101220007E00120EA9CFEBCF021E60E55964024585
+:101230005870047F0180027F00E559455870047E94
+:101240000180027E00EE4F602385414985404BE5D9
+:10125000594558702CAF5AFECDE9CDFCAB59AA5870
+:10126000120AFFAF5B7E00121E608015AF5B7E002E
+:10127000121E60900726120735E549120731E54B2B
+:10128000F0E4FDAF35FEFC120915228C648D651269
+:1012900008DA403CE56545647010120904C3E53E78
+:1012A000120769403B1208958018E53EC395384007
+:1012B0001D853E38E53E6005853F39800385393917
+:1012C0008F3A1207A8E53E120753E53FF022803B14
+:1012D000E5654564701112075F400512089E801F86
+:1012E00012073EE541F022E53CC39538401D853CA0
+:1012F00038E53C6005853D3980038539398F3A12E0
+:1013000007A8E53C120753E53DF02212079FE53898
+:10131000120753E539F0228C638D641208DA403CE1
+:10132000E56445637010120904C3E53E1207694085
+:101330003B1208958018E53EC39538401D853E3820
+:10134000E53E6005853F3980038539398F3A1207BC
+:10135000A8E53E120753E53FF022803BE564456374
+:10136000701112075F400512089E801F12073EE5AC
+:1013700041F022E53CC39538401D853C38E53C6092
+:1013800005853D3980038539398F3A1207A8E53C38
+:10139000120753E53DF02212079FE538120753E587
+:1013A00039F022E50DFEE5088E544405F555751516
+:1013B0000FF582120E7A1217A320310575150380DE
+:1013C0000375150BE50AC39401503812142020311F
+:1013D0000605150515800415151515E50AC39401B4
+:1013E0005021121420203104051580021515E50A3C
+:1013F000C39401500E120E771217A3203105051564
+:10140000120E77E515B408047F0180027F00E51510
+:10141000B407047E0180027E00EE4F6002057F2249
+:10142000855582855483E515F01217A32212072AE9
+:101430007583AE74FF120729E0541AF534E0C41323
+:101440005407F53524FE602424FE603C24047063B8
+:1014500075312DE508FD74B612079274BC90072211
+:1014600012079574901207B37492803C75313AE577
+:1014700008FD74BA12079274C09007221207B6745E
+:10148000C41207B374C88020753135E508FD74B8FF
+:1014900012079274BEFFED4407900722CFF0A3EF2E
+:1014A000F074C21207B374C6FFED4407A3CFF0A3D4
+:1014B000EFF022753401228E588F598C5A8D5B8A39
+:1014C0005C8B5D755E01E4F55F121EA585595ED3E8
+:1014D000E55E955BE55A12076B5057E55D455C701C
+:1014E0003012072A758392E55E1207297583C6E5D7
+:1014F0005E1207297583C8E55E120729758390E59A
+:101500005E1207297583C2E55E1207297583C480C0
+:1015100003120732E55EF0AF5F7E00AD5DAC5C129A
+:101520000444AF5E7E00AD5DAC5C120BD1055E0283
+:1015300014CFAB5DAA5CAD5BAC5AAF59AE58021B81
+:10154000FB8C5C8D5D8A5E8B5F756001E4F561F5F7
+:1015500062F563121EA58F60D3E560955DE55C12B0
+:10156000076B5061E55F455E702712072A7583B6E9
+:10157000E5601207297583B8E5601207297583BAFB
+:10158000E560F0AF617E00E56212087A120AFF8022
+:1015900019900724120735E56012072975838EE438
+:1015A0001207297401120729E4F0AF637E00AD5FD2
+:1015B000AC5E120444AF607E00AD5FAC5E12128B75
+:1015C00005600215582290114DE49390072EF012F9
+:1015D000081F7583AEE0541AF5347067EF4407F5C1
+:1015E000827583CEE0FF1313135407F536540FD3DF
+:1015F0009400400612142D121BA9E536540F24FE48
+:10160000600C14600C146019240370378010021EE3
+:1016100091121E9112072A7583CEE054EFF0021D3D
+:10162000AE121014E4F555121D850555E555C39409
+:101630000540F412072A7583CEE054C7120729E04B
+:101640004408F022E4F558F559AF08EF4407F58255
+:101650007583D0E0FDC4540FF55AEF4407F5827549
+:1016600083807401F0120821758382E545F0EF4410
+:1016700007F58275838A74FFF0121A4D12072A75D6
+:1016800083BCE054EF1207297583BEE054EF1207C4
+:10169000297583C0E054EF1207297583BCE044101C
+:1016A0001207297583BEE044101207297583C0E034
+:1016B0004410F0AF58E559120878020AFFE4F558D3
+:1016C0007D01F559AF35FEFC12091512072A758305
+:1016D000B674101207297583B87410120729758320
+:1016E000BA74101207297583BC7410120729758308
+:1016F000BE74101207297583C074101207297583F0
+:1017000090E41207297583C2E41207297583C4E4A3
+:10171000120729758392E41207297583C6E412071C
+:10172000297583C8E4F0AF58FEE55912087A020A19
+:10173000FFE5E230E46CE5E754C064407064E5091D
+:10174000C45430FEE50825E025E054C04EFEEF54B9
+:101750003F4EFDE52BAE2A7802C333CE33CED8F907
+:10176000F5828E83EDF0E52BAE2A7802C333CE33BB
+:10177000CED8F9FFF5828E83A3E5FEF08F828E83AB
+:10178000A3A3E5FDF08F828E83A3A3A3E5FCF0C3A2
+:10179000E52B94FAE52A94005008052BE52B7002FE
+:1017A000052A22E4FFE4F558F556F5577482FC1239
+:1017B0000E048C83E0F510547FF0E5104480120E87
+:1017C00098EDF07E0A120E047583A0E020E026DE7C
+:1017D000F40557E55770020556E5142401FDE4337E
+:1017E000FCD3E5579DE5569C40D9E50A942050026C
+:1017F000050A43E108C231120E047583A6E05512B2
+:1018000065127003D23122C23122900726E0FAA37A
+:10181000E0F5828A83E0F541E539C395414026E54C
+:10182000399541C39FEE12076B40047C0180027C16
+:1018300000E541643F60047B0180027B00EC5B605B
+:101840002905418028C3E5419539C39FEE12076BF6
+:1018500040047F0180027F00E54160047E01800238
+:101860007E00EF5E600415418003853941853A4072
+:1018700022E5E230E460E5E130E25BE50970047FF7
+:101880000180027F00E50870047E0180027E00EE88
+:101890005F604353F9F8E5E230E43BE5E130E22EE6
+:1018A00043FA0253FAFBE4F510909470E510F0E56A
+:1018B000E130E2E7909470E06510600343FA0405BC
+:1018C00010909470E510F070E612000680E153FA73
+:1018D000FD53FAFB80C0228F54120006E5E130E090
+:1018E000047F0180027F00E57ED3940540047E01E1
+:1018F00080027E00EE4F603D855411E5E220E1322A
+:1019000074CE121A0530E7047D0180027D008F82BB
+:101910008E83E030E6047F0180027F00EF5D70156A
+:101920001215C674CE121A0530E607E04480F04363
+:10193000F98012187122120E44E51625E025E024E4
+:10194000B0F582E4341AF583E493F50FE51625E04B
+:1019500025E024B1F582E4341AF583E493F50E1200
+:101960000E65F510E50F54F0120E1775838CEFF02D
+:10197000E50F30E00C120E04758386E04440F080E1
+:101980000A120E04758386E054BFF0120E9175831F
+:1019900082E50EF0227F05121731120E04120E336B
+:1019A0007402F0748EFE120E04120E0BEFF0751519
+:1019B00070120FF72034057515108003751550123D
+:1019C0000FF72034047410800274F02515F51512F9
+:1019D0000E21EFF0121091203417E5156430600CE1
+:1019E00074102515F515B48003E4F515120E21EFDA
+:1019F000F022F0E50B25E025E02482F582E43407AF
+:101A0000F583227488FEE5084407FFF5828E83E0A3
+:101A100022F0E5084407F58222F0E054C08F828E60
+:101A200083F022EF4407F582758386E05410D39447
+:101A30000022F0900715E004F0224406F582758339
+:101A40009EE022FEEF4407F5828E83E022E49007B9
+:101A50002AF0A3F012072A758382E0547F12072927
+:101A6000E04480F01210FC12081F7583A0E020E013
+:101A70001A90072BE004F0700690072AE004F0901B
+:101A8000072AE0B410E1A3E0B400DCEE44A6FCEFCA
+:101A90004407F5828C83E0F532EE44A8FEEF44075C
+:101AA000F5828E83E0F5332201201100042000909E
+:101AB00000200F9200210F9400220F9600230F9810
+:101AC00000240F9A00250F9C00260F9E00270FA0D0
+:101AD000012001A2012101A4012201A6012301A8E4
+:101AE000012401AA012501AC012601AE012701B0A4
+:101AF000012801B400280FB640280FB8612801CB97
+:101B0000EFCBCAEECA7F01E4FDEB4A7024E508F58D
+:101B10008274B6120829E508F58274B8120829E51E
+:101B200008F58274BA1208297E007C00120AFF8030
+:101B300012900726120735E541F090072412073569
+:101B4000E540F012072A75838EE41207297401120A
+:101B50000729E4F022E4F526F52753E1FEF52A757E
+:101B60002B01F5087F0112173130301C901AA9E4BF
+:101B700093F510901FF9E493F510900041E493F56C
+:101B800010901ECAE493F5107F02121731120F5401
+:101B90007F03121731120006E5E230E70912100048
+:101BA00030300312110002004712081F7583D0E085
+:101BB000C4540FFD7543017544FF1208AA7404F064
+:101BC000753B01ED14600C14600B14600F2403705E
+:101BD0000B800980001208A704F080061208A77481
+:101BE00004F0EE4482FEEF4407F5828E83E5451251
+:101BF00008BE758382E531F002114C8E608F611250
+:101C00001EA5E4FFCEEDCEEED39561E56012076B25
+:101C1000403974202EF582E43403F583E07003FF2D
+:101C200080261208E2FDC39F401ECFEDCFEB4A7025
+:101C30000B8D421208EEF5418E40800C1208E2F541
+:101C4000381208EEF5398E3A1E80BC22755801E52F
+:101C500035700C1207CCE0F54A1207D8E0F54CE5D8
+:101C600035B4040C1207E4E0F54A1207F0E0F54C35
+:101C7000E535B401047F0180027F00E535B402043C
+:101C80007E0180027E00EE4F600C1207FCE0F54AF8
+:101C9000120808E0F54C85414985404B22755B01EF
+:101CA000900724120735E0541FFFD3940250048F8D
+:101CB000588005EF24FEF558EFC394184005755978
+:101CC000188004EF04F55985435AAF587E00AD598A
+:101CD0007C00AB5B7A00121541AF5A7E0012180AE5
+:101CE000AF5B7E00021AFFE5E230E70E121003C27E
+:101CF000303030031210FF203328E5E730E70512BB
+:101D00000EA2800DE5FEC394205006120EA243F9E8
+:101D100008E5F230E70353F97FE5F15470D39400FE
+:101D200050D822120E04758380E4F0E508440712AF
+:101D30000DFD758384120E02758386120E02758363
+:101D40008CE054F3120E0375838E120E0275839489
+:101D5000E054FBF02212072A75838EE412072974DF
+:101D600001120729E41208BE75838CE04420120892
+:101D7000BEE054DFF07484850882F583E0547FF080
+:101D8000E04480F022755601E4FDF557AF35FEFCC6
+:101D9000120915121C9D121E7A121C4CAF577E00A0
+:101DA000AD567C00120444AF567E000211EE75560B
+:101DB00001E4FDF557AF35FEFC120915121C9D120A
+:101DC0001E7A121C4CAF577E00AD567C00120444A4
+:101DD000AF567E000211EEE4F516120E44FEE50841
+:101DE0004405FF120E658F828E83F00516E516C33B
+:101DF000941440E6E508120E2BE4F022E4F558F5C1
+:101E000059F55AFFFEAD58FC1209157F047E00AD4E
+:101E1000587C001209157F027E00AD587C00020933
+:101E200015E53C253EFCE5422400FBE433FAECC317
+:101E30009BEA12076B400B8C42E53D253FF5418F35
+:101E4000402212090B227484F5188508198519821D
+:101E5000851883E0547FF0E04480F0E04480F02275
+:101E6000EF4E700B12072A7583D2E054DFF0221276
+:101E7000072A7583D2E04420F02275580190072686
+:101E8000120735E0543FF541120732E0543FF54068
+:101E900022755602E4F557121DFCAF577E00AD5671
+:101EA0007C00020444E4F542F541F540F538F5398B
+:101EB000F53A22EF5407FFE5F954F84FF5F9227F80
+:101EC00001E4FE0F0EBEFFFB2201200001042000F2
+:101ED0000000000000000000000000000000000002
+:101EE00000000000000000000000000000000000F2
+:101EF00000000000000000000000000000000000E2
+:101F000000000000000000000000000000000000D1
+:101F100000000000000000000000000000000000C1
+:101F200000000000000000000000000000000000B1
+:101F300000000000000000000000000000000000A1
+:101F40000000000000000000000000000000000091
+:101F50000000000000000000000000000000000081
+:101F60000000000000000000000000000000000071
+:101F70000000000000000000000000000000000061
+:101F80000000000000000000000000000000000051
+:101F90000000000000000000000000000000000041
+:101FA0000000000000000000000000000000000031
+:101FB0000000000000000000000000000000000021
+:101FC0000000000000000000000000000000000011
+:101FD0000000000000000000000000000000000001
+:101FE00000000000000000000000000000000000F1
+:101FF000000000000000000001201100042000810A
+:00000001FF
diff --git a/fs/afs/write.c b/fs/afs/write.c
index 3dab9e9948d0..722743b152d8 100644
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -680,7 +680,6 @@ int afs_writeback_all(struct afs_vnode *vnode)
 {
         struct address_space *mapping = vnode->vfs_inode.i_mapping;
         struct writeback_control wbc = {
-                .bdi            = mapping->backing_dev_info,
                 .sync_mode      = WB_SYNC_ALL,
                 .nr_to_write    = LONG_MAX,
                 .range_cyclic   = 1,
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index b6ab27ccf214..811384bec8de 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -68,11 +68,7 @@
  * Here we can be a bit looser than the data sections since this
  * needs to only meet arch ABI requirements.
  */
-#ifdef ARCH_SLAB_MINALIGN
-#define FLAT_STACK_ALIGN        (ARCH_SLAB_MINALIGN)
-#else
-#define FLAT_STACK_ALIGN        (sizeof(void *))
-#endif
+#define FLAT_STACK_ALIGN        max_t(unsigned long, sizeof(void *), ARCH_SLAB_MINALIGN)
 
 #define RELOC_FAILED 0xff00ff01         /* Relocation incorrect somewhere */
 #define UNLOADED_LIB 0x7ff000ff         /* Placeholder for unused library */
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 7346c96308a5..99d6af811747 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -706,8 +706,13 @@ retry:
  * @bdev is about to be opened exclusively.  Check @bdev can be opened
  * exclusively and mark that an exclusive open is in progress.  Each
  * successful call to this function must be matched with a call to
- * either bd_claim() or bd_abort_claiming().  If this function
- * succeeds, the matching bd_claim() is guaranteed to succeed.
+ * either bd_finish_claiming() or bd_abort_claiming() (which do not
+ * fail).
+ *
+ * This function is used to gain exclusive access to the block device
+ * without actually causing other exclusive open attempts to fail. It
+ * should be used when the open sequence itself requires exclusive
+ * access but may subsequently fail.
  *
  * CONTEXT:
  * Might sleep.
@@ -734,6 +739,7 @@ static struct block_device *bd_start_claiming(struct block_device *bdev,
                 return ERR_PTR(-ENXIO);
 
         whole = bdget_disk(disk, 0);
+        module_put(disk->fops->owner);
         put_disk(disk);
         if (!whole)
                 return ERR_PTR(-ENOMEM);
@@ -782,15 +788,46 @@ static void bd_abort_claiming(struct block_device *whole, void *holder)
         __bd_abort_claiming(whole, holder);             /* releases bdev_lock */
 }
 
+/* increment holders when we have a legitimate claim. requires bdev_lock */
+static void __bd_claim(struct block_device *bdev, struct block_device *whole,
+                                        void *holder)
+{
+        /* note that for a whole device bd_holders
+         * will be incremented twice, and bd_holder will
+         * be set to bd_claim before being set to holder
+         */
+        whole->bd_holders++;
+        whole->bd_holder = bd_claim;
+        bdev->bd_holders++;
+        bdev->bd_holder = holder;
+}
+
+/**
+ * bd_finish_claiming - finish claiming a block device
+ * @bdev: block device of interest (passed to bd_start_claiming())
+ * @whole: whole block device returned by bd_start_claiming()
+ * @holder: holder trying to claim @bdev
+ *
+ * Finish a claiming block started by bd_start_claiming().
+ *
+ * CONTEXT:
+ * Grabs and releases bdev_lock.
+ */
+static void bd_finish_claiming(struct block_device *bdev,
+                                struct block_device *whole, void *holder)
+{
+        spin_lock(&bdev_lock);
+        BUG_ON(!bd_may_claim(bdev, whole, holder));
+        __bd_claim(bdev, whole, holder);
+        __bd_abort_claiming(whole, holder); /* not actually an abort */
+}
+
 /**
  * bd_claim - claim a block device
  * @bdev: block device to claim
  * @holder: holder trying to claim @bdev
  *
- * Try to claim @bdev which must have been opened successfully.  This
- * function may be called with or without preceding
- * blk_start_claiming().  In the former case, this function is always
- * successful and terminates the claiming block.
+ * Try to claim @bdev which must have been opened successfully.
  *
  * CONTEXT:
  * Might sleep.
@@ -806,23 +843,10 @@ int bd_claim(struct block_device *bdev, void *holder)
         might_sleep();
 
         spin_lock(&bdev_lock);
-
         res = bd_prepare_to_claim(bdev, whole, holder);
-        if (res == 0) {
-                /* note that for a whole device bd_holders
-                 * will be incremented twice, and bd_holder will
-                 * be set to bd_claim before being set to holder
-                 */
-                whole->bd_holders++;
-                whole->bd_holder = bd_claim;
-                bdev->bd_holders++;
-                bdev->bd_holder = holder;
-        }
-
-        if (whole->bd_claiming)
-                __bd_abort_claiming(whole, holder);     /* releases bdev_lock */
-        else
-                spin_unlock(&bdev_lock);
+        if (res == 0)
+                __bd_claim(bdev, whole, holder);
+        spin_unlock(&bdev_lock);
 
         return res;
 }
@@ -1476,7 +1500,7 @@ static int blkdev_open(struct inode * inode, struct file * filp)
 
         if (whole) {
                 if (res == 0)
-                        BUG_ON(bd_claim(bdev, filp) != 0);
+                        bd_finish_claiming(bdev, whole, filp);
                 else
                         bd_abort_claiming(whole, filp);
         }
@@ -1712,7 +1736,7 @@ struct block_device *open_bdev_exclusive(const char *path, fmode_t mode, void *h
         if ((mode & FMODE_WRITE) && bdev_read_only(bdev))
                 goto out_blkdev_put;
 
-        BUG_ON(bd_claim(bdev, holder) != 0);
+        bd_finish_claiming(bdev, whole, holder);
         return bdev;
 
 out_blkdev_put:
diff --git a/fs/btrfs/acl.c b/fs/btrfs/acl.c
index 8d432cd9d580..2222d161c7b6 100644
--- a/fs/btrfs/acl.c
+++ b/fs/btrfs/acl.c
@@ -60,6 +60,8 @@ static struct posix_acl *btrfs_get_acl(struct inode *inode, int type)
                 size = __btrfs_getxattr(inode, name, value, size);
                 if (size > 0) {
                         acl = posix_acl_from_xattr(value, size);
+                        if (IS_ERR(acl))
+                                return acl;
                         set_cached_acl(inode, type, acl);
                 }
                 kfree(value);
@@ -160,6 +162,12 @@ static int btrfs_xattr_acl_set(struct dentry *dentry, const char *name,
         int ret;
         struct posix_acl *acl = NULL;
 
+        if (!is_owner_or_cap(dentry->d_inode))
+                return -EPERM;
+
+        if (!IS_POSIXACL(dentry->d_inode))
+                return -EOPNOTSUPP;
+
         if (value) {
                 acl = posix_acl_from_xattr(value, size);
                 if (acl == NULL) {
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index f3b287c22caf..34f7c375567e 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1941,8 +1941,11 @@ struct btrfs_root *open_ctree(struct super_block *sb,
                      btrfs_level_size(tree_root,
                                       btrfs_super_log_root_level(disk_super));
 
-                log_tree_root = kzalloc(sizeof(struct btrfs_root),
-                                                      GFP_NOFS);
+                log_tree_root = kzalloc(sizeof(struct btrfs_root), GFP_NOFS);
+                if (!log_tree_root) {
+                        err = -ENOMEM;
+                        goto fail_trans_kthread;
+                }
 
                 __setup_root(nodesize, leafsize, sectorsize, stripesize,
                              log_tree_root, fs_info, BTRFS_TREE_LOG_OBJECTID);
@@ -1982,6 +1985,10 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         fs_info->fs_root = btrfs_read_fs_root_no_name(fs_info, &location);
         if (!fs_info->fs_root)
                 goto fail_trans_kthread;
+        if (IS_ERR(fs_info->fs_root)) {
+                err = PTR_ERR(fs_info->fs_root);
+                goto fail_trans_kthread;
+        }
 
         if (!(sb->s_flags & MS_RDONLY)) {
                 down_read(&fs_info->cleanup_work_sem);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index b9080d71991a..32d094002a57 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4360,7 +4360,8 @@ void btrfs_free_tree_block(struct btrfs_trans_handle *trans,
 
         block_rsv = get_block_rsv(trans, root);
         cache = btrfs_lookup_block_group(root->fs_info, buf->start);
-        BUG_ON(block_rsv->space_info != cache->space_info);
+        if (block_rsv->space_info != cache->space_info)
+                goto out;
 
         if (btrfs_header_generation(buf) == trans->transid) {
                 if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID) {
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index a4080c21ec55..d74e6af9b53a 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2594,7 +2594,6 @@ int extent_write_full_page(struct extent_io_tree *tree, struct page *page,
                 .sync_io = wbc->sync_mode == WB_SYNC_ALL,
         };
         struct writeback_control wbc_writepages = {
-                .bdi            = wbc->bdi,
                 .sync_mode      = wbc->sync_mode,
                 .older_than_this = NULL,
                 .nr_to_write    = 64,
@@ -2628,7 +2627,6 @@ int extent_write_locked_range(struct extent_io_tree *tree, struct inode *inode,
                 .sync_io = mode == WB_SYNC_ALL,
         };
         struct writeback_control wbc_writepages = {
-                .bdi            = inode->i_mapping->backing_dev_info,
                 .sync_mode      = mode,
                 .older_than_this = NULL,
                 .nr_to_write    = nr_pages * 2,
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 787b50a16a14..e354c33df082 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1140,7 +1140,7 @@ int btrfs_sync_file(struct file *file, int datasync)
         /*
          * ok we haven't committed the transaction yet, lets do a commit
          */
-        if (file && file->private_data)
+        if (file->private_data)
                 btrfs_ioctl_trans_end(file);
 
         trans = btrfs_start_transaction(root, 0);
@@ -1190,14 +1190,22 @@ static const struct vm_operations_struct btrfs_file_vm_ops = {
 
 static int btrfs_file_mmap(struct file  *filp, struct vm_area_struct *vma)
 {
-        vma->vm_ops = &btrfs_file_vm_ops;
+        struct address_space *mapping = filp->f_mapping;
+
+        if (!mapping->a_ops->readpage)
+                return -ENOEXEC;
+
         file_accessed(filp);
+        vma->vm_ops = &btrfs_file_vm_ops;
+        vma->vm_flags |= VM_CAN_NONLINEAR;
+
         return 0;
 }
 
 const struct file_operations btrfs_file_operations = {
         .llseek         = generic_file_llseek,
         .read           = do_sync_read,
+        .write          = do_sync_write,
         .aio_read       = generic_file_aio_read,
         .splice_read    = generic_file_splice_read,
         .aio_write      = btrfs_file_aio_write,
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index fa6ccc1bfe2a..1bff92ad4744 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -2673,7 +2673,7 @@ static int check_path_shared(struct btrfs_root *root,
         struct extent_buffer *eb;
         int level;
         int ret;
-        u64 refs;
+        u64 refs = 1;
 
         for (level = 0; level < BTRFS_MAX_LEVEL; level++) {
                 if (!path->nodes[level])
@@ -6884,7 +6884,7 @@ static long btrfs_fallocate(struct inode *inode, int mode,
                 if (em->block_start == EXTENT_MAP_HOLE ||
                     (cur_offset >= inode->i_size &&
                      !test_bit(EXTENT_FLAG_PREALLOC, &em->flags))) {
-                        ret = btrfs_prealloc_file_range(inode, 0, cur_offset,
+                        ret = btrfs_prealloc_file_range(inode, mode, cur_offset,
                                                         last_byte - cur_offset,
                                                         1 << inode->i_blkbits,
                                                         offset + len,
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 4cdb98cf26de..4dbaf89b1337 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1280,7 +1280,7 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
         trans = btrfs_start_transaction(root, 0);
         if (IS_ERR(trans)) {
                 err = PTR_ERR(trans);
-                goto out;
+                goto out_up_write;
         }
         trans->block_rsv = &root->fs_info->global_block_rsv;
 
@@ -1845,7 +1845,7 @@ static long btrfs_ioctl_default_subvol(struct file *file, void __user *argp)
         dir_id = btrfs_super_root_dir(&root->fs_info->super_copy);
         di = btrfs_lookup_dir_item(trans, root->fs_info->tree_root, path,
                                    dir_id, "default", 7, 1);
-        if (!di) {
+        if (IS_ERR_OR_NULL(di)) {
                 btrfs_free_path(path);
                 btrfs_end_transaction(trans, root);
                 printk(KERN_ERR "Umm, you don't have the default dir item, "
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 05d41e569236..b37d723b9d4a 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -784,16 +784,17 @@ again:
                                 struct btrfs_extent_ref_v0 *ref0;
                                 ref0 = btrfs_item_ptr(eb, path1->slots[0],
                                                 struct btrfs_extent_ref_v0);
-                                root = find_tree_root(rc, eb, ref0);
-                                if (!root->ref_cows)
-                                        cur->cowonly = 1;
                                 if (key.objectid == key.offset) {
+                                        root = find_tree_root(rc, eb, ref0);
                                         if (root && !should_ignore_root(root))
                                                 cur->root = root;
                                         else
                                                 list_add(&cur->list, &useless);
                                         break;
                                 }
+                                if (is_cowonly_root(btrfs_ref_root_v0(eb,
+                                                                      ref0)))
+                                        cur->cowonly = 1;
                         }
 #else
                 BUG_ON(key.type == BTRFS_EXTENT_REF_V0_KEY);
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index b91ccd972644..2d958be761c8 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -330,7 +330,6 @@ int btrfs_del_root(struct btrfs_trans_handle *trans, struct btrfs_root *root,
 {
         struct btrfs_path *path;
         int ret;
-        u32 refs;
         struct btrfs_root_item *ri;
         struct extent_buffer *leaf;
 
@@ -344,8 +343,6 @@ int btrfs_del_root(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         leaf = path->nodes[0];
         ri = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_root_item);
 
-        refs = btrfs_disk_root_refs(leaf, ri);
-        BUG_ON(refs != 0);
         ret = btrfs_del_item(trans, root, path);
 out:
         btrfs_free_path(path);
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index d34b2dfc9628..f2393b390318 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -360,6 +360,8 @@ static struct dentry *get_default_root(struct super_block *sb,
          */
         dir_id = btrfs_super_root_dir(&root->fs_info->super_copy);
         di = btrfs_lookup_dir_item(NULL, root, path, dir_id, "default", 7, 0);
+        if (IS_ERR(di))
+                return ERR_CAST(di);
         if (!di) {
                 /*
                  * Ok the default dir item isn't there.  This is weird since
@@ -390,8 +392,8 @@ setup_root:
         location.offset = 0;
 
         inode = btrfs_iget(sb, &location, new_root, &new);
-        if (!inode)
-                return ERR_PTR(-ENOMEM);
+        if (IS_ERR(inode))
+                return ERR_CAST(inode);
 
         /*
          * If we're just mounting the root most subvol put the inode and return
diff --git a/fs/ceph/auth_x.c b/fs/ceph/auth_x.c
index 83d4d2785ffe..3fe49042d8ad 100644
--- a/fs/ceph/auth_x.c
+++ b/fs/ceph/auth_x.c
@@ -493,7 +493,7 @@ static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result,
                 return -EAGAIN;
         }
 
-        op = le32_to_cpu(head->op);
+        op = le16_to_cpu(head->op);
         result = le32_to_cpu(head->result);
         dout("handle_reply op %d result %d\n", op, result);
         switch (op) {
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index ae3e3a306445..74144d6389f0 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -244,8 +244,14 @@ static struct ceph_cap *get_cap(struct ceph_cap_reservation *ctx)
         struct ceph_cap *cap = NULL;
 
         /* temporary, until we do something about cap import/export */
-        if (!ctx)
-                return kmem_cache_alloc(ceph_cap_cachep, GFP_NOFS);
+        if (!ctx) {
+                cap = kmem_cache_alloc(ceph_cap_cachep, GFP_NOFS);
+                if (cap) {
+                        caps_use_count++;
+                        caps_total_count++;
+                }
+                return cap;
+        }
 
         spin_lock(&caps_list_lock);
         dout("get_cap ctx=%p (%d) %d = %d used + %d resv + %d avail\n",
@@ -981,6 +987,46 @@ static int send_cap_msg(struct ceph_mds_session *session,
         return 0;
 }
 
+static void __queue_cap_release(struct ceph_mds_session *session,
+                                u64 ino, u64 cap_id, u32 migrate_seq,
+                                u32 issue_seq)
+{
+        struct ceph_msg *msg;
+        struct ceph_mds_cap_release *head;
+        struct ceph_mds_cap_item *item;
+
+        spin_lock(&session->s_cap_lock);
+        BUG_ON(!session->s_num_cap_releases);
+        msg = list_first_entry(&session->s_cap_releases,
+                               struct ceph_msg, list_head);
+
+        dout(" adding %llx release to mds%d msg %p (%d left)\n",
+             ino, session->s_mds, msg, session->s_num_cap_releases);
+
+        BUG_ON(msg->front.iov_len + sizeof(*item) > PAGE_CACHE_SIZE);
+        head = msg->front.iov_base;
+        head->num = cpu_to_le32(le32_to_cpu(head->num) + 1);
+        item = msg->front.iov_base + msg->front.iov_len;
+        item->ino = cpu_to_le64(ino);
+        item->cap_id = cpu_to_le64(cap_id);
+        item->migrate_seq = cpu_to_le32(migrate_seq);
+        item->seq = cpu_to_le32(issue_seq);
+
+        session->s_num_cap_releases--;
+
+        msg->front.iov_len += sizeof(*item);
+        if (le32_to_cpu(head->num) == CEPH_CAPS_PER_RELEASE) {
+                dout(" release msg %p full\n", msg);
+                list_move_tail(&msg->list_head, &session->s_cap_releases_done);
+        } else {
+                dout(" release msg %p at %d/%d (%d)\n", msg,
+                     (int)le32_to_cpu(head->num),
+                     (int)CEPH_CAPS_PER_RELEASE,
+                     (int)msg->front.iov_len);
+        }
+        spin_unlock(&session->s_cap_lock);
+}
+
 /*
  * Queue cap releases when an inode is dropped from our cache.  Since
  * inode is about to be destroyed, there is no need for i_lock.
@@ -994,41 +1040,9 @@ void ceph_queue_caps_release(struct inode *inode)
         while (p) {
                 struct ceph_cap *cap = rb_entry(p, struct ceph_cap, ci_node);
                 struct ceph_mds_session *session = cap->session;
-                struct ceph_msg *msg;
-                struct ceph_mds_cap_release *head;
-                struct ceph_mds_cap_item *item;
 
-                spin_lock(&session->s_cap_lock);
-                BUG_ON(!session->s_num_cap_releases);
-                msg = list_first_entry(&session->s_cap_releases,
-                                       struct ceph_msg, list_head);
-
-                dout(" adding %p release to mds%d msg %p (%d left)\n",
-                     inode, session->s_mds, msg, session->s_num_cap_releases);
-
-                BUG_ON(msg->front.iov_len + sizeof(*item) > PAGE_CACHE_SIZE);
-                head = msg->front.iov_base;
-                head->num = cpu_to_le32(le32_to_cpu(head->num) + 1);
-                item = msg->front.iov_base + msg->front.iov_len;
-                item->ino = cpu_to_le64(ceph_ino(inode));
-                item->cap_id = cpu_to_le64(cap->cap_id);
-                item->migrate_seq = cpu_to_le32(cap->mseq);
-                item->seq = cpu_to_le32(cap->issue_seq);
-
-                session->s_num_cap_releases--;
-
-                msg->front.iov_len += sizeof(*item);
-                if (le32_to_cpu(head->num) == CEPH_CAPS_PER_RELEASE) {
-                        dout(" release msg %p full\n", msg);
-                        list_move_tail(&msg->list_head,
-                                       &session->s_cap_releases_done);
-                } else {
-                        dout(" release msg %p at %d/%d (%d)\n", msg,
-                             (int)le32_to_cpu(head->num),
-                             (int)CEPH_CAPS_PER_RELEASE,
-                             (int)msg->front.iov_len);
-                }
-                spin_unlock(&session->s_cap_lock);
+                __queue_cap_release(session, ceph_ino(inode), cap->cap_id,
+                                    cap->mseq, cap->issue_seq);
                 p = rb_next(p);
                 __ceph_remove_cap(cap);
         }
@@ -2655,7 +2669,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         struct ceph_mds_caps *h;
         int mds = session->s_mds;
         int op;
-        u32 seq;
+        u32 seq, mseq;
         struct ceph_vino vino;
         u64 cap_id;
         u64 size, max_size;
@@ -2675,6 +2689,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         vino.snap = CEPH_NOSNAP;
         cap_id = le64_to_cpu(h->cap_id);
         seq = le32_to_cpu(h->seq);
+        mseq = le32_to_cpu(h->migrate_seq);
         size = le64_to_cpu(h->size);
         max_size = le64_to_cpu(h->max_size);
 
@@ -2689,6 +2704,18 @@ void ceph_handle_caps(struct ceph_mds_session *session,
              vino.snap, inode);
         if (!inode) {
                 dout(" i don't have ino %llx\n", vino.ino);
+
+                if (op == CEPH_CAP_OP_IMPORT)
+                        __queue_cap_release(session, vino.ino, cap_id,
+                                            mseq, seq);
+
+                /*
+                 * send any full release message to try to move things
+                 * along for the mds (who clearly thinks we still have this
+                 * cap).
+                 */
+                ceph_add_cap_releases(mdsc, session, -1);
+                ceph_send_cap_releases(mdsc, session);
                 goto done;
         }
 
@@ -2714,7 +2741,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         spin_lock(&inode->i_lock);
         cap = __get_cap_for_mds(ceph_inode(inode), mds);
         if (!cap) {
-                dout("no cap on %p ino %llx.%llx from mds%d, releasing\n",
+                dout(" no cap on %p ino %llx.%llx from mds%d\n",
                      inode, ceph_ino(inode), ceph_snap(inode), mds);
                 spin_unlock(&inode->i_lock);
                 goto done;
@@ -2865,18 +2892,19 @@ int ceph_encode_inode_release(void **p, struct inode *inode,
         struct ceph_inode_info *ci = ceph_inode(inode);
         struct ceph_cap *cap;
         struct ceph_mds_request_release *rel = *p;
+        int used, dirty;
         int ret = 0;
-        int used = 0;
 
         spin_lock(&inode->i_lock);
         used = __ceph_caps_used(ci);
+        dirty = __ceph_caps_dirty(ci);
 
-        dout("encode_inode_release %p mds%d used %s drop %s unless %s\n", inode,
-             mds, ceph_cap_string(used), ceph_cap_string(drop),
+        dout("encode_inode_release %p mds%d used|dirty %s drop %s unless %s\n",
+             inode, mds, ceph_cap_string(used|dirty), ceph_cap_string(drop),
              ceph_cap_string(unless));
 
-        /* only drop unused caps */
-        drop &= ~used;
+        /* only drop unused, clean caps */
+        drop &= ~(used | dirty);
 
         cap = __get_cap_for_mds(ci, mds);
         if (cap && __cap_is_valid(cap)) {
diff --git a/fs/ceph/crush/mapper.c b/fs/ceph/crush/mapper.c
index 9ba54efb6543..a4eec133258e 100644
--- a/fs/ceph/crush/mapper.c
+++ b/fs/ceph/crush/mapper.c
@@ -238,7 +238,7 @@ static int bucket_straw_choose(struct crush_bucket_straw *bucket,
 
 static int crush_bucket_choose(struct crush_bucket *in, int x, int r)
 {
-        dprintk("choose %d x=%d r=%d\n", in->id, x, r);
+        dprintk(" crush_bucket_choose %d x=%d r=%d\n", in->id, x, r);
         switch (in->alg) {
         case CRUSH_BUCKET_UNIFORM:
                 return bucket_uniform_choose((struct crush_bucket_uniform *)in,
@@ -264,7 +264,7 @@ static int crush_bucket_choose(struct crush_bucket *in, int x, int r)
  */
 static int is_out(struct crush_map *map, __u32 *weight, int item, int x)
 {
-        if (weight[item] >= 0x1000)
+        if (weight[item] >= 0x10000)
                 return 0;
         if (weight[item] == 0)
                 return 1;
@@ -305,7 +305,9 @@ static int crush_choose(struct crush_map *map,
         int itemtype;
         int collide, reject;
         const int orig_tries = 5; /* attempts before we fall back to search */
-        dprintk("choose bucket %d x %d outpos %d\n", bucket->id, x, outpos);
+
+        dprintk("CHOOSE%s bucket %d x %d outpos %d numrep %d\n", recurse_to_leaf ? "_LEAF" : "",
+                bucket->id, x, outpos, numrep);
 
         for (rep = outpos; rep < numrep; rep++) {
                 /* keep trying until we get a non-out, non-colliding item */
@@ -366,6 +368,7 @@ static int crush_choose(struct crush_map *map,
                                         BUG_ON(item >= 0 ||
                                                (-1-item) >= map->max_buckets);
                                         in = map->buckets[-1-item];
+                                        retry_bucket = 1;
                                         continue;
                                 }
 
@@ -377,15 +380,25 @@ static int crush_choose(struct crush_map *map,
                                         }
                                 }
 
-                                if (recurse_to_leaf &&
-                                    item < 0 &&
-                                    crush_choose(map, map->buckets[-1-item],
-                                                 weight,
-                                                 x, outpos+1, 0,
-                                                 out2, outpos,
-                                                 firstn, 0, NULL) <= outpos) {
-                                        reject = 1;
-                                } else {
+                                reject = 0;
+                                if (recurse_to_leaf) {
+                                        if (item < 0) {
+                                                if (crush_choose(map,
+                                                         map->buckets[-1-item],
+                                                         weight,
+                                                         x, outpos+1, 0,
+                                                         out2, outpos,
+                                                         firstn, 0,
+                                                         NULL) <= outpos)
+                                                        /* didn't get leaf */
+                                                        reject = 1;
+                                        } else {
+                                                /* we already have a leaf! */
+                                                out2[outpos] = item;
+                                        }
+                                }
+
+                                if (!reject) {
                                         /* out? */
                                         if (itemtype == 0)
                                                 reject = is_out(map, weight,
@@ -424,12 +437,12 @@ reject:
                         continue;
                 }
 
-                dprintk("choose got %d\n", item);
+                dprintk("CHOOSE got %d\n", item);
                 out[outpos] = item;
                 outpos++;
         }
 
-        dprintk("choose returns %d\n", outpos);
+        dprintk("CHOOSE returns %d\n", outpos);
         return outpos;
 }
 
diff --git a/fs/ceph/debugfs.c b/fs/ceph/debugfs.c
index 3be33fb066cc..f2f5332ddbba 100644
--- a/fs/ceph/debugfs.c
+++ b/fs/ceph/debugfs.c
@@ -261,7 +261,7 @@ static int osdc_show(struct seq_file *s, void *pp)
 
 static int caps_show(struct seq_file *s, void *p)
 {
-        struct ceph_client *client = p;
+        struct ceph_client *client = s->private;
         int total, avail, used, reserved, min;
 
         ceph_reservation_status(client, &total, &avail, &used, &reserved, &min);
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 226f5a50d362..8f9b9fe8ef9f 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -827,7 +827,7 @@ static void ceph_set_dentry_offset(struct dentry *dn)
 
         spin_lock(&dcache_lock);
         spin_lock(&dn->d_lock);
-        list_move_tail(&dir->d_subdirs, &dn->d_u.d_child);
+        list_move(&dn->d_u.d_child, &dir->d_subdirs);
         dout("set_dentry_offset %p %lld (%p %p)\n", dn, di->offset,
              dn->d_u.d_child.prev, dn->d_u.d_child.next);
         spin_unlock(&dn->d_lock);
@@ -854,8 +854,8 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in,
                 d_drop(dn);
         realdn = d_materialise_unique(dn, in);
         if (IS_ERR(realdn)) {
-                pr_err("splice_dentry error %p inode %p ino %llx.%llx\n",
-                       dn, in, ceph_vinop(in));
+                pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n",
+                       PTR_ERR(realdn), dn, in, ceph_vinop(in));
                 if (prehash)
                         *prehash = false; /* don't rehash on error */
                 dn = realdn; /* note realdn contains the error */
@@ -1234,18 +1234,23 @@ retry_lookup:
                                 goto out;
                         }
                         dn = splice_dentry(dn, in, NULL);
+                        if (IS_ERR(dn))
+                                dn = NULL;
                 }
 
                 if (fill_inode(in, &rinfo->dir_in[i], NULL, session,
                                req->r_request_started, -1,
                                &req->r_caps_reservation) < 0) {
                         pr_err("fill_inode badness on %p\n", in);
-                        dput(dn);
-                        continue;
+                        goto next_item;
                 }
-                update_dentry_lease(dn, rinfo->dir_dlease[i],
-                                    req->r_session, req->r_request_started);
-                dput(dn);
+                if (dn)
+                        update_dentry_lease(dn, rinfo->dir_dlease[i],
+                                            req->r_session,
+                                            req->r_request_started);
+next_item:
+                if (dn)
+                        dput(dn);
         }
         req->r_did_prepopulate = true;
 
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index b49f12822cbc..3ab79f6c4ce8 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1066,9 +1066,9 @@ static int trim_caps(struct ceph_mds_client *mdsc,
  *
  * Called under s_mutex.
  */
-static int add_cap_releases(struct ceph_mds_client *mdsc,
-                            struct ceph_mds_session *session,
-                            int extra)
+int ceph_add_cap_releases(struct ceph_mds_client *mdsc,
+                          struct ceph_mds_session *session,
+                          int extra)
 {
         struct ceph_msg *msg;
         struct ceph_mds_cap_release *head;
@@ -1176,8 +1176,8 @@ static int check_cap_flush(struct ceph_mds_client *mdsc, u64 want_flush_seq)
 /*
  * called under s_mutex
  */
-static void send_cap_releases(struct ceph_mds_client *mdsc,
-                       struct ceph_mds_session *session)
+void ceph_send_cap_releases(struct ceph_mds_client *mdsc,
+                            struct ceph_mds_session *session)
 {
         struct ceph_msg *msg;
 
@@ -1980,7 +1980,7 @@ out_err:
         }
         mutex_unlock(&mdsc->mutex);
 
-        add_cap_releases(mdsc, req->r_session, -1);
+        ceph_add_cap_releases(mdsc, req->r_session, -1);
         mutex_unlock(&session->s_mutex);
 
         /* kick calling process */
@@ -2433,6 +2433,7 @@ static void handle_lease(struct ceph_mds_client *mdsc,
         struct ceph_dentry_info *di;
         int mds = session->s_mds;
         struct ceph_mds_lease *h = msg->front.iov_base;
+        u32 seq;
         struct ceph_vino vino;
         int mask;
         struct qstr dname;
@@ -2446,6 +2447,7 @@ static void handle_lease(struct ceph_mds_client *mdsc,
         vino.ino = le64_to_cpu(h->ino);
         vino.snap = CEPH_NOSNAP;
         mask = le16_to_cpu(h->mask);
+        seq = le32_to_cpu(h->seq);
         dname.name = (void *)h + sizeof(*h) + sizeof(u32);
         dname.len = msg->front.iov_len - sizeof(*h) - sizeof(u32);
         if (dname.len != get_unaligned_le32(h+1))
@@ -2456,8 +2458,9 @@ static void handle_lease(struct ceph_mds_client *mdsc,
 
         /* lookup inode */
         inode = ceph_find_inode(sb, vino);
-        dout("handle_lease '%s', mask %d, ino %llx %p\n",
-             ceph_lease_op_name(h->action), mask, vino.ino, inode);
+        dout("handle_lease %s, mask %d, ino %llx %p %.*s\n",
+             ceph_lease_op_name(h->action), mask, vino.ino, inode,
+             dname.len, dname.name);
         if (inode == NULL) {
                 dout("handle_lease no inode %llx\n", vino.ino);
                 goto release;
@@ -2482,7 +2485,8 @@ static void handle_lease(struct ceph_mds_client *mdsc,
         switch (h->action) {
         case CEPH_MDS_LEASE_REVOKE:
                 if (di && di->lease_session == session) {
-                        h->seq = cpu_to_le32(di->lease_seq);
+                        if (ceph_seq_cmp(di->lease_seq, seq) > 0)
+                                h->seq = cpu_to_le32(di->lease_seq);
                         __ceph_mdsc_drop_dentry_lease(dentry);
                 }
                 release = 1;
@@ -2496,7 +2500,7 @@ static void handle_lease(struct ceph_mds_client *mdsc,
                         unsigned long duration =
                                 le32_to_cpu(h->duration_ms) * HZ / 1000;
 
-                        di->lease_seq = le32_to_cpu(h->seq);
+                        di->lease_seq = seq;
                         dentry->d_time = di->lease_renew_from + duration;
                         di->lease_renew_after = di->lease_renew_from +
                                 (duration >> 1);
@@ -2686,10 +2690,10 @@ static void delayed_work(struct work_struct *work)
                         send_renew_caps(mdsc, s);
                 else
                         ceph_con_keepalive(&s->s_con);
-                add_cap_releases(mdsc, s, -1);
+                ceph_add_cap_releases(mdsc, s, -1);
                 if (s->s_state == CEPH_MDS_SESSION_OPEN ||
                     s->s_state == CEPH_MDS_SESSION_HUNG)
-                        send_cap_releases(mdsc, s);
+                        ceph_send_cap_releases(mdsc, s);
                 mutex_unlock(&s->s_mutex);
                 ceph_put_mds_session(s);
 
@@ -2779,6 +2783,12 @@ void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc)
         drop_leases(mdsc);
         ceph_flush_dirty_caps(mdsc);
         wait_requests(mdsc);
+
+        /*
+         * wait for reply handlers to drop their request refs and
+         * their inode/dcache refs
+         */
+        ceph_msgr_flush();
 }
 
 /*
diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h
index d9936c4f1212..b292fa42a66d 100644
--- a/fs/ceph/mds_client.h
+++ b/fs/ceph/mds_client.h
@@ -322,6 +322,12 @@ static inline void ceph_mdsc_put_request(struct ceph_mds_request *req)
         kref_put(&req->r_kref, ceph_mdsc_release_request);
 }
 
+extern int ceph_add_cap_releases(struct ceph_mds_client *mdsc,
+                                 struct ceph_mds_session *session,
+                                 int extra);
+extern void ceph_send_cap_releases(struct ceph_mds_client *mdsc,
+                                   struct ceph_mds_session *session);
+
 extern void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc);
 
 extern char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *base,
diff --git a/fs/ceph/messenger.c b/fs/ceph/messenger.c
index 64b8b1f7863d..9ad43a310a41 100644
--- a/fs/ceph/messenger.c
+++ b/fs/ceph/messenger.c
@@ -657,7 +657,7 @@ static void prepare_write_connect(struct ceph_messenger *msgr,
         dout("prepare_write_connect %p cseq=%d gseq=%d proto=%d\n", con,
              con->connect_seq, global_seq, proto);
 
-        con->out_connect.features = CEPH_FEATURE_SUPPORTED_CLIENT;
+        con->out_connect.features = cpu_to_le64(CEPH_FEATURE_SUPPORTED_CLIENT);
         con->out_connect.host_type = cpu_to_le32(CEPH_ENTITY_TYPE_CLIENT);
         con->out_connect.connect_seq = cpu_to_le32(con->connect_seq);
         con->out_connect.global_seq = cpu_to_le32(global_seq);
@@ -1396,10 +1396,12 @@ static int read_partial_message(struct ceph_connection *con)
         if (!con->in_msg) {
                 dout("got hdr type %d front %d data %d\n", con->in_hdr.type,
                      con->in_hdr.front_len, con->in_hdr.data_len);
+                skip = 0;
                 con->in_msg = ceph_alloc_msg(con, &con->in_hdr, &skip);
                 if (skip) {
                         /* skip this message */
                         dout("alloc_msg said skip message\n");
+                        BUG_ON(con->in_msg);
                         con->in_base_pos = -front_len - middle_len - data_len -
                                 sizeof(m->footer);
                         con->in_tag = CEPH_MSGR_TAG_READY;
diff --git a/fs/ceph/mon_client.c b/fs/ceph/mon_client.c
index 21c62e9b7d1d..cc115eafae11 100644
--- a/fs/ceph/mon_client.c
+++ b/fs/ceph/mon_client.c
@@ -400,6 +400,8 @@ static void release_generic_request(struct kref *kref)
                 ceph_msg_put(req->reply);
         if (req->request)
                 ceph_msg_put(req->request);
+
+        kfree(req);
 }
 
 static void put_generic_request(struct ceph_mon_generic_request *req)
@@ -723,7 +725,8 @@ static void handle_auth_reply(struct ceph_mon_client *monc,
                 dout("authenticated, starting session\n");
 
                 monc->client->msgr->inst.name.type = CEPH_ENTITY_TYPE_CLIENT;
-                monc->client->msgr->inst.name.num = monc->auth->global_id;
+                monc->client->msgr->inst.name.num =
+                                        cpu_to_le64(monc->auth->global_id);
 
                 __send_subscribe(monc);
                 __resend_generic_request(monc);
diff --git a/fs/ceph/osd_client.c b/fs/ceph/osd_client.c
index d25b4add85b4..92b7251a53f1 100644
--- a/fs/ceph/osd_client.c
+++ b/fs/ceph/osd_client.c
@@ -1344,7 +1344,7 @@ static void dispatch(struct ceph_connection *con, struct ceph_msg *msg)
         int type = le16_to_cpu(msg->hdr.type);
 
         if (!osd)
-                return;
+                goto out;
         osdc = osd->o_osdc;
 
         switch (type) {
@@ -1359,6 +1359,7 @@ static void dispatch(struct ceph_connection *con, struct ceph_msg *msg)
                 pr_err("received unknown message type %d %s\n", type,
                        ceph_msg_type_name(type));
         }
+out:
         ceph_msg_put(msg);
 }
 
diff --git a/fs/ceph/osdmap.c b/fs/ceph/osdmap.c
index ddc656fb5c05..50ce64ebd330 100644
--- a/fs/ceph/osdmap.c
+++ b/fs/ceph/osdmap.c
@@ -707,6 +707,7 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                 newcrush = crush_decode(*p, min(*p+len, end));
                 if (IS_ERR(newcrush))
                         return ERR_CAST(newcrush);
+                *p += len;
         }
 
         /* new flags? */
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 4e0bee240b9d..fa87f51e38e1 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -89,7 +89,7 @@ static int ceph_statfs(struct dentry *dentry, struct kstatfs *buf)
 
         buf->f_files = le64_to_cpu(st.num_objects);
         buf->f_ffree = -1;
-        buf->f_namelen = PATH_MAX;
+        buf->f_namelen = NAME_MAX;
         buf->f_frsize = PAGE_CACHE_SIZE;
 
         /* leave fsid little-endian, regardless of host endianness */
@@ -926,7 +926,7 @@ static int ceph_compare_super(struct super_block *sb, void *data)
 /*
  * construct our own bdi so we can control readahead, etc.
  */
-static atomic_long_t bdi_seq = ATOMIC_INIT(0);
+static atomic_long_t bdi_seq = ATOMIC_LONG_INIT(0);
 
 static int ceph_register_bdi(struct super_block *sb, struct ceph_client *client)
 {
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 78c02eb4cb1f..484e52bb40bb 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -473,14 +473,24 @@ static int cifs_remount(struct super_block *sb, int *flags, char *data)
         return 0;
 }
 
+void cifs_drop_inode(struct inode *inode)
+{
+        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)
+                return generic_drop_inode(inode);
+
+        return generic_delete_inode(inode);
+}
+
 static const struct super_operations cifs_super_ops = {
         .put_super = cifs_put_super,
         .statfs = cifs_statfs,
         .alloc_inode = cifs_alloc_inode,
         .destroy_inode = cifs_destroy_inode,
-/*      .drop_inode         = generic_delete_inode,
-        .delete_inode   = cifs_delete_inode,  */  /* Do not need above two
-        functions unless later we add lazy close of inodes or unless the
+        .drop_inode     = cifs_drop_inode,
+/*      .delete_inode   = cifs_delete_inode,  */  /* Do not need above
+        function unless later we add lazy close of inodes or unless the
         kernel forgets to call us with the same number of releases (closes)
         as opens */
         .show_options = cifs_show_options,
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index fb1657e0fdb8..fb6318b81509 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -106,7 +106,6 @@ extern struct cifsFileInfo *cifs_new_fileinfo(struct inode *newinode,
                                 __u16 fileHandle, struct file *file,
                                 struct vfsmount *mnt, unsigned int oflags);
 extern int cifs_posix_open(char *full_path, struct inode **pinode,
-                                struct vfsmount *mnt,
                                 struct super_block *sb,
                                 int mode, int oflags,
                                 __u32 *poplock, __u16 *pnetfid, int xid);
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 391816b461ca..e7ae78b66fa1 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/namei.h>
 #include <linux/mount.h>
+#include <linux/file.h>
 #include "cifsfs.h"
 #include "cifspdu.h"
 #include "cifsglob.h"
@@ -184,12 +185,13 @@ cifs_new_fileinfo(struct inode *newinode, __u16 fileHandle,
         }
         write_unlock(&GlobalSMBSeslock);
 
+        file->private_data = pCifsFile;
+
         return pCifsFile;
 }
 
 int cifs_posix_open(char *full_path, struct inode **pinode,
-                        struct vfsmount *mnt, struct super_block *sb,
-                        int mode, int oflags,
+                        struct super_block *sb, int mode, int oflags,
                         __u32 *poplock, __u16 *pnetfid, int xid)
 {
         int rc;
@@ -258,19 +260,6 @@ int cifs_posix_open(char *full_path, struct inode **pinode,
                 cifs_fattr_to_inode(*pinode, &fattr);
         }
 
-        /*
-         * cifs_fill_filedata() takes care of setting cifsFileInfo pointer to
-         * file->private_data.
-         */
-        if (mnt) {
-                struct cifsFileInfo *pfile_info;
-
-                pfile_info = cifs_new_fileinfo(*pinode, *pnetfid, NULL, mnt,
-                                               oflags);
-                if (pfile_info == NULL)
-                        rc = -ENOMEM;
-        }
-
 posix_open_ret:
         kfree(presp_data);
         return rc;
@@ -298,7 +287,6 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
         int create_options = CREATE_NOT_DIR;
         __u32 oplock = 0;
         int oflags;
-        bool posix_create = false;
         /*
          * BB below access is probably too much for mknod to request
          *    but we have to do query and setpathinfo so requesting
@@ -339,7 +327,6 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
             (CIFS_UNIX_POSIX_PATH_OPS_CAP &
                         le64_to_cpu(tcon->fsUnixInfo.Capability))) {
                 rc = cifs_posix_open(full_path, &newinode,
-                        nd ? nd->path.mnt : NULL,
                         inode->i_sb, mode, oflags, &oplock, &fileHandle, xid);
                 /* EIO could indicate that (posix open) operation is not
                    supported, despite what server claimed in capability
@@ -347,7 +334,6 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                    handled in posix open */
 
                 if (rc == 0) {
-                        posix_create = true;
                         if (newinode == NULL) /* query inode info */
                                 goto cifs_create_get_file_info;
                         else /* success, no need to query */
@@ -478,21 +464,28 @@ cifs_create_set_dentry:
         else
                 cFYI(1, "Create worked, get_inode_info failed rc = %d", rc);
 
-        /* nfsd case - nfs srv does not set nd */
-        if ((nd == NULL) || (!(nd->flags & LOOKUP_OPEN))) {
-                /* mknod case - do not leave file open */
-                CIFSSMBClose(xid, tcon, fileHandle);
-        } else if (!(posix_create) && (newinode)) {
+        if (newinode && nd && (nd->flags & LOOKUP_OPEN)) {
                 struct cifsFileInfo *pfile_info;
-                /*
-                 * cifs_fill_filedata() takes care of setting cifsFileInfo
-                 * pointer to file->private_data.
-                 */
-                pfile_info = cifs_new_fileinfo(newinode, fileHandle, NULL,
+                struct file *filp;
+
+                filp = lookup_instantiate_filp(nd, direntry, generic_file_open);
+                if (IS_ERR(filp)) {
+                        rc = PTR_ERR(filp);
+                        CIFSSMBClose(xid, tcon, fileHandle);
+                        goto cifs_create_out;
+                }
+
+                pfile_info = cifs_new_fileinfo(newinode, fileHandle, filp,
                                                nd->path.mnt, oflags);
-                if (pfile_info == NULL)
+                if (pfile_info == NULL) {
+                        fput(filp);
+                        CIFSSMBClose(xid, tcon, fileHandle);
                         rc = -ENOMEM;
+                }
+        } else {
+                CIFSSMBClose(xid, tcon, fileHandle);
         }
+
 cifs_create_out:
         kfree(buf);
         kfree(full_path);
@@ -636,6 +629,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
         bool posix_open = false;
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
+        struct cifsFileInfo *cfile;
         struct inode *newInode = NULL;
         char *full_path = NULL;
         struct file *filp;
@@ -703,7 +697,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
                 if (nd && !(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
                      (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open &&
                      (nd->intent.open.flags & O_CREAT)) {
-                        rc = cifs_posix_open(full_path, &newInode, nd->path.mnt,
+                        rc = cifs_posix_open(full_path, &newInode,
                                         parent_dir_inode->i_sb,
                                         nd->intent.open.create_mode,
                                         nd->intent.open.flags, &oplock,
@@ -733,8 +727,25 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
                 else
                         direntry->d_op = &cifs_dentry_ops;
                 d_add(direntry, newInode);
-                if (posix_open)
-                        filp = lookup_instantiate_filp(nd, direntry, NULL);
+                if (posix_open) {
+                        filp = lookup_instantiate_filp(nd, direntry,
+                                                       generic_file_open);
+                        if (IS_ERR(filp)) {
+                                rc = PTR_ERR(filp);
+                                CIFSSMBClose(xid, pTcon, fileHandle);
+                                goto lookup_out;
+                        }
+
+                        cfile = cifs_new_fileinfo(newInode, fileHandle, filp,
+                                                  nd->path.mnt,
+                                                  nd->intent.open.flags);
+                        if (cfile == NULL) {
+                                fput(filp);
+                                CIFSSMBClose(xid, pTcon, fileHandle);
+                                rc = -ENOMEM;
+                                goto lookup_out;
+                        }
+                }
                 /* since paths are not looked up by component - the parent
                    directories are presumed to be good here */
                 renew_parental_timestamps(direntry);
@@ -755,6 +766,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
                 is a common return code */
         }
 
+lookup_out:
         kfree(full_path);
         FreeXid(xid);
         return ERR_PTR(rc);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 75541af4b3db..409e4f523e61 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -162,44 +162,12 @@ psx_client_can_cache:
         return 0;
 }
 
-static struct cifsFileInfo *
-cifs_fill_filedata(struct file *file)
-{
-        struct list_head *tmp;
-        struct cifsFileInfo *pCifsFile = NULL;
-        struct cifsInodeInfo *pCifsInode = NULL;
-
-        /* search inode for this file and fill in file->private_data */
-        pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
-        read_lock(&GlobalSMBSeslock);
-        list_for_each(tmp, &pCifsInode->openFileList) {
-                pCifsFile = list_entry(tmp, struct cifsFileInfo, flist);
-                if ((pCifsFile->pfile == NULL) &&
-                    (pCifsFile->pid == current->tgid)) {
-                        /* mode set in cifs_create */
-
-                        /* needed for writepage */
-                        pCifsFile->pfile = file;
-                        file->private_data = pCifsFile;
-                        break;
-                }
-        }
-        read_unlock(&GlobalSMBSeslock);
-
-        if (file->private_data != NULL) {
-                return pCifsFile;
-        } else if ((file->f_flags & O_CREAT) && (file->f_flags & O_EXCL))
-                        cERROR(1, "could not find file instance for "
-                                   "new file %p", file);
-        return NULL;
-}
-
 /* all arguments to this function must be checked for validity in caller */
-static inline int cifs_open_inode_helper(struct inode *inode, struct file *file,
-        struct cifsInodeInfo *pCifsInode, struct cifsFileInfo *pCifsFile,
+static inline int cifs_open_inode_helper(struct inode *inode,
         struct cifsTconInfo *pTcon, int *oplock, FILE_ALL_INFO *buf,
         char *full_path, int xid)
 {
+        struct cifsInodeInfo *pCifsInode = CIFS_I(inode);
         struct timespec temp;
         int rc;
 
@@ -213,36 +181,35 @@ static inline int cifs_open_inode_helper(struct inode *inode, struct file *file,
         /* if not oplocked, invalidate inode pages if mtime or file
            size changed */
         temp = cifs_NTtimeToUnix(buf->LastWriteTime);
-        if (timespec_equal(&file->f_path.dentry->d_inode->i_mtime, &temp) &&
-                           (file->f_path.dentry->d_inode->i_size ==
+        if (timespec_equal(&inode->i_mtime, &temp) &&
+                           (inode->i_size ==
                             (loff_t)le64_to_cpu(buf->EndOfFile))) {
                 cFYI(1, "inode unchanged on server");
         } else {
-                if (file->f_path.dentry->d_inode->i_mapping) {
+                if (inode->i_mapping) {
                         /* BB no need to lock inode until after invalidate
                         since namei code should already have it locked? */
-                        rc = filemap_write_and_wait(file->f_path.dentry->d_inode->i_mapping);
+                        rc = filemap_write_and_wait(inode->i_mapping);
                         if (rc != 0)
-                                CIFS_I(file->f_path.dentry->d_inode)->write_behind_rc = rc;
+                                pCifsInode->write_behind_rc = rc;
                 }
                 cFYI(1, "invalidating remote inode since open detected it "
                          "changed");
-                invalidate_remote_inode(file->f_path.dentry->d_inode);
+                invalidate_remote_inode(inode);
         }
 
 client_can_cache:
         if (pTcon->unix_ext)
-                rc = cifs_get_inode_info_unix(&file->f_path.dentry->d_inode,
-                        full_path, inode->i_sb, xid);
+                rc = cifs_get_inode_info_unix(&inode, full_path, inode->i_sb,
+                                              xid);
         else
-                rc = cifs_get_inode_info(&file->f_path.dentry->d_inode,
-                        full_path, buf, inode->i_sb, xid, NULL);
+                rc = cifs_get_inode_info(&inode, full_path, buf, inode->i_sb,
+                                         xid, NULL);
 
         if ((*oplock & 0xF) == OPLOCK_EXCLUSIVE) {
                 pCifsInode->clientCanCacheAll = true;
                 pCifsInode->clientCanCacheRead = true;
-                cFYI(1, "Exclusive Oplock granted on inode %p",
-                         file->f_path.dentry->d_inode);
+                cFYI(1, "Exclusive Oplock granted on inode %p", inode);
         } else if ((*oplock & 0xF) == OPLOCK_READ)
                 pCifsInode->clientCanCacheRead = true;
 
@@ -256,7 +223,7 @@ int cifs_open(struct inode *inode, struct file *file)
         __u32 oplock;
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *tcon;
-        struct cifsFileInfo *pCifsFile;
+        struct cifsFileInfo *pCifsFile = NULL;
         struct cifsInodeInfo *pCifsInode;
         char *full_path = NULL;
         int desiredAccess;
@@ -270,12 +237,6 @@ int cifs_open(struct inode *inode, struct file *file)
         tcon = cifs_sb->tcon;
 
         pCifsInode = CIFS_I(file->f_path.dentry->d_inode);
-        pCifsFile = cifs_fill_filedata(file);
-        if (pCifsFile) {
-                rc = 0;
-                FreeXid(xid);
-                return rc;
-        }
 
         full_path = build_path_from_dentry(file->f_path.dentry);
         if (full_path == NULL) {
@@ -299,8 +260,7 @@ int cifs_open(struct inode *inode, struct file *file)
                 int oflags = (int) cifs_posix_convert_flags(file->f_flags);
                 oflags |= SMB_O_CREAT;
                 /* can not refresh inode info since size could be stale */
-                rc = cifs_posix_open(full_path, &inode, file->f_path.mnt,
-                                inode->i_sb,
+                rc = cifs_posix_open(full_path, &inode, inode->i_sb,
                                 cifs_sb->mnt_file_mode /* ignored */,
                                 oflags, &oplock, &netfid, xid);
                 if (rc == 0) {
@@ -308,9 +268,20 @@ int cifs_open(struct inode *inode, struct file *file)
                         /* no need for special case handling of setting mode
                            on read only files needed here */
 
-                        pCifsFile = cifs_fill_filedata(file);
-                        cifs_posix_open_inode_helper(inode, file, pCifsInode,
-                                                     oplock, netfid);
+                        rc = cifs_posix_open_inode_helper(inode, file,
+                                        pCifsInode, oplock, netfid);
+                        if (rc != 0) {
+                                CIFSSMBClose(xid, tcon, netfid);
+                                goto out;
+                        }
+
+                        pCifsFile = cifs_new_fileinfo(inode, netfid, file,
+                                                        file->f_path.mnt,
+                                                        oflags);
+                        if (pCifsFile == NULL) {
+                                CIFSSMBClose(xid, tcon, netfid);
+                                rc = -ENOMEM;
+                        }
                         goto out;
                 } else if ((rc == -EINVAL) || (rc == -EOPNOTSUPP)) {
                         if (tcon->ses->serverNOS)
@@ -391,17 +362,17 @@ int cifs_open(struct inode *inode, struct file *file)
                 goto out;
         }
 
+        rc = cifs_open_inode_helper(inode, tcon, &oplock, buf, full_path, xid);
+        if (rc != 0)
+                goto out;
+
         pCifsFile = cifs_new_fileinfo(inode, netfid, file, file->f_path.mnt,
                                         file->f_flags);
-        file->private_data = pCifsFile;
-        if (file->private_data == NULL) {
+        if (pCifsFile == NULL) {
                 rc = -ENOMEM;
                 goto out;
         }
 
-        rc = cifs_open_inode_helper(inode, file, pCifsInode, pCifsFile, tcon,
-                                    &oplock, buf, full_path, xid);
-
         if (oplock & CIFS_CREATE_ACTION) {
                 /* time to set mode which we can not set earlier due to
                    problems creating new read-only files */
@@ -513,8 +484,7 @@ reopen_error_exit:
                         le64_to_cpu(tcon->fsUnixInfo.Capability))) {
                 int oflags = (int) cifs_posix_convert_flags(file->f_flags);
                 /* can not refresh inode info since size could be stale */
-                rc = cifs_posix_open(full_path, NULL, file->f_path.mnt,
-                                inode->i_sb,
+                rc = cifs_posix_open(full_path, NULL, inode->i_sb,
                                 cifs_sb->mnt_file_mode /* ignored */,
                                 oflags, &oplock, &netfid, xid);
                 if (rc == 0) {
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 62b324f26a56..6f0683c68952 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1401,6 +1401,10 @@ cifs_do_rename(int xid, struct dentry *from_dentry, const char *fromPath,
         if (rc == 0 || rc != -ETXTBSY)
                 return rc;
 
+        /* open-file renames don't work across directories */
+        if (to_dentry->d_parent != from_dentry->d_parent)
+                return rc;
+
         /* open the file to be renamed -- we need DELETE perms */
         rc = CIFSSMBOpen(xid, pTcon, fromPath, FILE_OPEN, DELETE,
                          CREATE_NOT_DIR, &srcfid, &oplock, NULL,
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 7707389bdf2c..0a57cb7db5dd 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -730,15 +730,7 @@ ssetup_ntlmssp_authenticate:
 
                 /* calculate session key */
                 setup_ntlmv2_rsp(ses, v2_sess_key, nls_cp);
-                if (first_time) /* should this be moved into common code
-                                   with similar ntlmv2 path? */
-                /*   cifs_calculate_ntlmv2_mac_key(ses->server->mac_signing_key,
-                                response BB FIXME, v2_sess_key); */
-
-                /* copy session key */
-
-        /*      memcpy(bcc_ptr, (char *)ntlm_session_key,LM2_SESS_KEY_SIZE);
-                bcc_ptr += LM2_SESS_KEY_SIZE; */
+                /* FIXME: calculate MAC key */
                 memcpy(bcc_ptr, (char *)v2_sess_key,
                        sizeof(struct ntlmv2_resp));
                 bcc_ptr += sizeof(struct ntlmv2_resp);
diff --git a/fs/dcache.c b/fs/dcache.c
index d96047b4a633..c8c78ba07827 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -590,6 +590,8 @@ static void prune_dcache(int count)
                         up_read(&sb->s_umount);
                 }
                 spin_lock(&sb_lock);
+                /* lock was dropped, must reset next */
+                list_safe_reset_next(sb, n, s_list);
                 count -= pruned;
                 __put_super(sb);
                 /* more work left to do? */
diff --git a/fs/ext2/acl.c b/fs/ext2/acl.c
index ca7e2a0ed98a..2bcc0431bada 100644
--- a/fs/ext2/acl.c
+++ b/fs/ext2/acl.c
@@ -200,6 +200,7 @@ ext2_set_acl(struct inode *inode, int type, struct posix_acl *acl)
                                         return error;
                                 else {
                                         inode->i_mode = mode;
+                                        inode->i_ctime = CURRENT_TIME_SEC;
                                         mark_inode_dirty(inode);
                                         if (error == 0)
                                                 acl = NULL;
diff --git a/fs/ext3/acl.c b/fs/ext3/acl.c
index 01552abbca3c..8a11fe212183 100644
--- a/fs/ext3/acl.c
+++ b/fs/ext3/acl.c
@@ -205,6 +205,7 @@ ext3_set_acl(handle_t *handle, struct inode *inode, int type,
                                         return error;
                                 else {
                                         inode->i_mode = mode;
+                                        inode->i_ctime = CURRENT_TIME_SEC;
                                         ext3_mark_inode_dirty(handle, inode);
                                         if (error == 0)
                                                 acl = NULL;
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 51e11bf5708f..9d175d623aab 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -733,12 +733,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
 {
         while (fa) {
                 struct fown_struct *fown;
+                unsigned long flags;
+
                 if (fa->magic != FASYNC_MAGIC) {
                         printk(KERN_ERR "kill_fasync: bad magic number in "
                                "fasync_struct!\n");
                         return;
                 }
-                spin_lock(&fa->fa_lock);
+                spin_lock_irqsave(&fa->fa_lock, flags);
                 if (fa->fa_file) {
                         fown = &fa->fa_file->f_owner;
                         /* Don't send SIGURG to processes which have not set a
@@ -747,7 +749,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
                         if (!(sig == SIGURG && fown->signum == 0))
                                 send_sigio(fown, fa->fa_fd, band);
                 }
-                spin_unlock(&fa->fa_lock);
+                spin_unlock_irqrestore(&fa->fa_lock, flags);
                 fa = rcu_dereference(fa->fa_next);
         }
 }
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 1d1088f48bc2..d5be1693ac93 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -38,51 +38,18 @@ int nr_pdflush_threads;
 /*
  * Passed into wb_writeback(), essentially a subset of writeback_control
  */
-struct wb_writeback_args {
+struct wb_writeback_work {
         long nr_pages;
         struct super_block *sb;
         enum writeback_sync_modes sync_mode;
         unsigned int for_kupdate:1;
         unsigned int range_cyclic:1;
         unsigned int for_background:1;
-};
 
-/*
- * Work items for the bdi_writeback threads
- */
-struct bdi_work {
         struct list_head list;          /* pending work list */
-        struct rcu_head rcu_head;       /* for RCU free/clear of work */
-
-        unsigned long seen;             /* threads that have seen this work */
-        atomic_t pending;               /* number of threads still to do work */
-
-        struct wb_writeback_args args;  /* writeback arguments */
-
-        unsigned long state;            /* flag bits, see WS_* */
+        struct completion *done;        /* set if the caller waits */
 };
 
-enum {
-        WS_USED_B = 0,
-        WS_ONSTACK_B,
-};
-
-#define WS_USED (1 << WS_USED_B)
-#define WS_ONSTACK (1 << WS_ONSTACK_B)
-
-static inline bool bdi_work_on_stack(struct bdi_work *work)
-{
-        return test_bit(WS_ONSTACK_B, &work->state);
-}
-
-static inline void bdi_work_init(struct bdi_work *work,
-                                 struct wb_writeback_args *args)
-{
-        INIT_RCU_HEAD(&work->rcu_head);
-        work->args = *args;
-        work->state = WS_USED;
-}
-
 /**
  * writeback_in_progress - determine whether there is writeback in progress
  * @bdi: the device's backing_dev_info structure.
@@ -95,76 +62,11 @@ int writeback_in_progress(struct backing_dev_info *bdi)
         return !list_empty(&bdi->work_list);
 }
 
-static void bdi_work_clear(struct bdi_work *work)
-{
-        clear_bit(WS_USED_B, &work->state);
-        smp_mb__after_clear_bit();
-        /*
-         * work can have disappeared at this point. bit waitq functions
-         * should be able to tolerate this, provided bdi_sched_wait does
-         * not dereference it's pointer argument.
-        */
-        wake_up_bit(&work->state, WS_USED_B);
-}
-
-static void bdi_work_free(struct rcu_head *head)
-{
-        struct bdi_work *work = container_of(head, struct bdi_work, rcu_head);
-
-        if (!bdi_work_on_stack(work))
-                kfree(work);
-        else
-                bdi_work_clear(work);
-}
-
-static void wb_work_complete(struct bdi_work *work)
-{
-        const enum writeback_sync_modes sync_mode = work->args.sync_mode;
-        int onstack = bdi_work_on_stack(work);
-
-        /*
-         * For allocated work, we can clear the done/seen bit right here.
-         * For on-stack work, we need to postpone both the clear and free
-         * to after the RCU grace period, since the stack could be invalidated
-         * as soon as bdi_work_clear() has done the wakeup.
-         */
-        if (!onstack)
-                bdi_work_clear(work);
-        if (sync_mode == WB_SYNC_NONE || onstack)
-                call_rcu(&work->rcu_head, bdi_work_free);
-}
-
-static void wb_clear_pending(struct bdi_writeback *wb, struct bdi_work *work)
-{
-        /*
-         * The caller has retrieved the work arguments from this work,
-         * drop our reference. If this is the last ref, delete and free it
-         */
-        if (atomic_dec_and_test(&work->pending)) {
-                struct backing_dev_info *bdi = wb->bdi;
-
-                spin_lock(&bdi->wb_lock);
-                list_del_rcu(&work->list);
-                spin_unlock(&bdi->wb_lock);
-
-                wb_work_complete(work);
-        }
-}
-
-static void bdi_queue_work(struct backing_dev_info *bdi, struct bdi_work *work)
+static void bdi_queue_work(struct backing_dev_info *bdi,
+                struct wb_writeback_work *work)
 {
-        work->seen = bdi->wb_mask;
-        BUG_ON(!work->seen);
-        atomic_set(&work->pending, bdi->wb_cnt);
-        BUG_ON(!bdi->wb_cnt);
-
-        /*
-         * list_add_tail_rcu() contains the necessary barriers to
-         * make sure the above stores are seen before the item is
-         * noticed on the list
-         */
         spin_lock(&bdi->wb_lock);
-        list_add_tail_rcu(&work->list, &bdi->work_list);
+        list_add_tail(&work->list, &bdi->work_list);
         spin_unlock(&bdi->wb_lock);
 
         /*
@@ -181,97 +83,59 @@ static void bdi_queue_work(struct backing_dev_info *bdi, struct bdi_work *work)
         }
 }
 
-/*
- * Used for on-stack allocated work items. The caller needs to wait until
- * the wb threads have acked the work before it's safe to continue.
- */
-static void bdi_wait_on_work_clear(struct bdi_work *work)
-{
-        wait_on_bit(&work->state, WS_USED_B, bdi_sched_wait,
-                    TASK_UNINTERRUPTIBLE);
-}
-
-static void bdi_alloc_queue_work(struct backing_dev_info *bdi,
-                                 struct wb_writeback_args *args)
+static void
+__bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages,
+                bool range_cyclic, bool for_background)
 {
-        struct bdi_work *work;
+        struct wb_writeback_work *work;
 
         /*
          * This is WB_SYNC_NONE writeback, so if allocation fails just
          * wakeup the thread for old dirty data writeback
          */
-        work = kmalloc(sizeof(*work), GFP_ATOMIC);
-        if (work) {
-                bdi_work_init(work, args);
-                bdi_queue_work(bdi, work);
-        } else {
-                struct bdi_writeback *wb = &bdi->wb;
-
-                if (wb->task)
-                        wake_up_process(wb->task);
+        work = kzalloc(sizeof(*work), GFP_ATOMIC);
+        if (!work) {
+                if (bdi->wb.task)
+                        wake_up_process(bdi->wb.task);
+                return;
         }
+
+        work->sync_mode = WB_SYNC_NONE;
+        work->nr_pages  = nr_pages;
+        work->range_cyclic = range_cyclic;
+        work->for_background = for_background;
+
+        bdi_queue_work(bdi, work);
 }
 
 /**
- * bdi_sync_writeback - start and wait for writeback
+ * bdi_start_writeback - start writeback
  * @bdi: the backing device to write from
- * @sb: write inodes from this super_block
+ * @nr_pages: the number of pages to write
  *
  * Description:
- *   This does WB_SYNC_ALL data integrity writeback and waits for the
- *   IO to complete. Callers must hold the sb s_umount semaphore for
- *   reading, to avoid having the super disappear before we are done.
+ *   This does WB_SYNC_NONE opportunistic writeback. The IO is only
+ *   started when this function returns, we make no guarentees on
+ *   completion. Caller need not hold sb s_umount semaphore.
+ *
  */
-static void bdi_sync_writeback(struct backing_dev_info *bdi,
-                               struct super_block *sb)
+void bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages)
 {
-        struct wb_writeback_args args = {
-                .sb             = sb,
-                .sync_mode      = WB_SYNC_ALL,
-                .nr_pages       = LONG_MAX,
-                .range_cyclic   = 0,
-        };
-        struct bdi_work work;
-
-        bdi_work_init(&work, &args);
-        work.state |= WS_ONSTACK;
-
-        bdi_queue_work(bdi, &work);
-        bdi_wait_on_work_clear(&work);
+        __bdi_start_writeback(bdi, nr_pages, true, false);
 }
 
 /**
- * bdi_start_writeback - start writeback
+ * bdi_start_background_writeback - start background writeback
  * @bdi: the backing device to write from
- * @sb: write inodes from this super_block
- * @nr_pages: the number of pages to write
  *
  * Description:
- *   This does WB_SYNC_NONE opportunistic writeback. The IO is only
+ *   This does WB_SYNC_NONE background writeback. The IO is only
  *   started when this function returns, we make no guarentees on
  *   completion. Caller need not hold sb s_umount semaphore.
- *
  */
-void bdi_start_writeback(struct backing_dev_info *bdi, struct super_block *sb,
-                         long nr_pages)
+void bdi_start_background_writeback(struct backing_dev_info *bdi)
 {
-        struct wb_writeback_args args = {
-                .sb             = sb,
-                .sync_mode      = WB_SYNC_NONE,
-                .nr_pages       = nr_pages,
-                .range_cyclic   = 1,
-        };
-
-        /*
-         * We treat @nr_pages=0 as the special case to do background writeback,
-         * ie. to sync pages until the background dirty threshold is reached.
-         */
-        if (!nr_pages) {
-                args.nr_pages = LONG_MAX;
-                args.for_background = 1;
-        }
-
-        bdi_alloc_queue_work(bdi, &args);
+        __bdi_start_writeback(bdi, LONG_MAX, true, true);
 }
 
 /*
@@ -561,75 +425,69 @@ select_queue:
         return ret;
 }
 
-static void unpin_sb_for_writeback(struct super_block *sb)
-{
-        up_read(&sb->s_umount);
-        put_super(sb);
-}
-
-enum sb_pin_state {
-        SB_PINNED,
-        SB_NOT_PINNED,
-        SB_PIN_FAILED
-};
-
 /*
- * For WB_SYNC_NONE writeback, the caller does not have the sb pinned
+ * For background writeback the caller does not have the sb pinned
  * before calling writeback. So make sure that we do pin it, so it doesn't
  * go away while we are writing inodes from it.
  */
-static enum sb_pin_state pin_sb_for_writeback(struct writeback_control *wbc,
-                                              struct super_block *sb)
+static bool pin_sb_for_writeback(struct super_block *sb)
 {
-        /*
-         * Caller must already hold the ref for this
-         */
-        if (wbc->sync_mode == WB_SYNC_ALL) {
-                WARN_ON(!rwsem_is_locked(&sb->s_umount));
-                return SB_NOT_PINNED;
-        }
         spin_lock(&sb_lock);
+        if (list_empty(&sb->s_instances)) {
+                spin_unlock(&sb_lock);
+                return false;
+        }
+
         sb->s_count++;
+        spin_unlock(&sb_lock);
+
         if (down_read_trylock(&sb->s_umount)) {
-                if (sb->s_root) {
-                        spin_unlock(&sb_lock);
-                        return SB_PINNED;
-                }
-                /*
-                 * umounted, drop rwsem again and fall through to failure
-                 */
+                if (sb->s_root)
+                        return true;
                 up_read(&sb->s_umount);
         }
-        sb->s_count--;
-        spin_unlock(&sb_lock);
-        return SB_PIN_FAILED;
+
+        put_super(sb);
+        return false;
 }
 
 /*
  * Write a portion of b_io inodes which belong to @sb.
- * If @wbc->sb != NULL, then find and write all such
+ *
+ * If @only_this_sb is true, then find and write all such
  * inodes. Otherwise write only ones which go sequentially
  * in reverse order.
+ *
  * Return 1, if the caller writeback routine should be
  * interrupted. Otherwise return 0.
  */
-static int writeback_sb_inodes(struct super_block *sb,
-                               struct bdi_writeback *wb,
-                               struct writeback_control *wbc)
+static int writeback_sb_inodes(struct super_block *sb, struct bdi_writeback *wb,
+                struct writeback_control *wbc, bool only_this_sb)
 {
         while (!list_empty(&wb->b_io)) {
                 long pages_skipped;
                 struct inode *inode = list_entry(wb->b_io.prev,
                                                  struct inode, i_list);
-                if (wbc->sb && sb != inode->i_sb) {
-                        /* super block given and doesn't
-                           match, skip this inode */
-                        redirty_tail(inode);
-                        continue;
-                }
-                if (sb != inode->i_sb)
-                        /* finish with this superblock */
+
+                if (inode->i_sb != sb) {
+                        if (only_this_sb) {
+                                /*
+                                 * We only want to write back data for this
+                                 * superblock, move all inodes not belonging
+                                 * to it back onto the dirty list.
+                                 */
+                                redirty_tail(inode);
+                                continue;
+                        }
+
+                        /*
+                         * The inode belongs to a different superblock.
+                         * Bounce back to the caller to unpin this and
+                         * pin the next superblock.
+                         */
                         return 0;
+                }
+
                 if (inode->i_state & (I_NEW | I_WILL_FREE)) {
                         requeue_io(inode);
                         continue;
@@ -667,8 +525,8 @@ static int writeback_sb_inodes(struct super_block *sb,
         return 1;
 }
 
-static void writeback_inodes_wb(struct bdi_writeback *wb,
-                                struct writeback_control *wbc)
+void writeback_inodes_wb(struct bdi_writeback *wb,
+                struct writeback_control *wbc)
 {
         int ret = 0;
 
@@ -681,24 +539,14 @@ static void writeback_inodes_wb(struct bdi_writeback *wb,
                 struct inode *inode = list_entry(wb->b_io.prev,
                                                  struct inode, i_list);
                 struct super_block *sb = inode->i_sb;
-                enum sb_pin_state state;
 
-                if (wbc->sb && sb != wbc->sb) {
-                        /* super block given and doesn't
-                           match, skip this inode */
-                        redirty_tail(inode);
-                        continue;
-                }
-                state = pin_sb_for_writeback(wbc, sb);
-
-                if (state == SB_PIN_FAILED) {
+                if (!pin_sb_for_writeback(sb)) {
                         requeue_io(inode);
                         continue;
                 }
-                ret = writeback_sb_inodes(sb, wb, wbc);
+                ret = writeback_sb_inodes(sb, wb, wbc, false);
+                drop_super(sb);
 
-                if (state == SB_PINNED)
-                        unpin_sb_for_writeback(sb);
                 if (ret)
                         break;
         }
@@ -706,11 +554,17 @@ static void writeback_inodes_wb(struct bdi_writeback *wb,
         /* Leave any unwritten inodes on b_io */
 }
 
-void writeback_inodes_wbc(struct writeback_control *wbc)
+static void __writeback_inodes_sb(struct super_block *sb,
+                struct bdi_writeback *wb, struct writeback_control *wbc)
 {
-        struct backing_dev_info *bdi = wbc->bdi;
+        WARN_ON(!rwsem_is_locked(&sb->s_umount));
 
-        writeback_inodes_wb(&bdi->wb, wbc);
+        wbc->wb_start = jiffies; /* livelock avoidance */
+        spin_lock(&inode_lock);
+        if (!wbc->for_kupdate || list_empty(&wb->b_io))
+                queue_io(wb, wbc->older_than_this);
+        writeback_sb_inodes(sb, wb, wbc, true);
+        spin_unlock(&inode_lock);
 }
 
 /*
@@ -748,16 +602,14 @@ static inline bool over_bground_thresh(void)
  * all dirty pages if they are all attached to "old" mappings.
  */
 static long wb_writeback(struct bdi_writeback *wb,
-                         struct wb_writeback_args *args)
+                         struct wb_writeback_work *work)
 {
         struct writeback_control wbc = {
-                .bdi                    = wb->bdi,
-                .sb                     = args->sb,
-                .sync_mode              = args->sync_mode,
+                .sync_mode              = work->sync_mode,
                 .older_than_this        = NULL,
-                .for_kupdate            = args->for_kupdate,
-                .for_background         = args->for_background,
-                .range_cyclic           = args->range_cyclic,
+                .for_kupdate            = work->for_kupdate,
+                .for_background         = work->for_background,
+                .range_cyclic           = work->range_cyclic,
         };
         unsigned long oldest_jif;
         long wrote = 0;
@@ -777,21 +629,24 @@ static long wb_writeback(struct bdi_writeback *wb,
                 /*
                  * Stop writeback when nr_pages has been consumed
                  */
-                if (args->nr_pages <= 0)
+                if (work->nr_pages <= 0)
                         break;
 
                 /*
                  * For background writeout, stop when we are below the
                  * background dirty threshold
                  */
-                if (args->for_background && !over_bground_thresh())
+                if (work->for_background && !over_bground_thresh())
                         break;
 
                 wbc.more_io = 0;
                 wbc.nr_to_write = MAX_WRITEBACK_PAGES;
                 wbc.pages_skipped = 0;
-                writeback_inodes_wb(wb, &wbc);
-                args->nr_pages -= MAX_WRITEBACK_PAGES - wbc.nr_to_write;
+                if (work->sb)
+                        __writeback_inodes_sb(work->sb, wb, &wbc);
+                else
+                        writeback_inodes_wb(wb, &wbc);
+                work->nr_pages -= MAX_WRITEBACK_PAGES - wbc.nr_to_write;
                 wrote += MAX_WRITEBACK_PAGES - wbc.nr_to_write;
 
                 /*
@@ -827,31 +682,21 @@ static long wb_writeback(struct bdi_writeback *wb,
 }
 
 /*
- * Return the next bdi_work struct that hasn't been processed by this
- * wb thread yet. ->seen is initially set for each thread that exists
- * for this device, when a thread first notices a piece of work it
- * clears its bit. Depending on writeback type, the thread will notify
- * completion on either receiving the work (WB_SYNC_NONE) or after
- * it is done (WB_SYNC_ALL).
+ * Return the next wb_writeback_work struct that hasn't been processed yet.
  */
-static struct bdi_work *get_next_work_item(struct backing_dev_info *bdi,
-                                           struct bdi_writeback *wb)
+static struct wb_writeback_work *
+get_next_work_item(struct backing_dev_info *bdi, struct bdi_writeback *wb)
 {
-        struct bdi_work *work, *ret = NULL;
+        struct wb_writeback_work *work = NULL;
 
-        rcu_read_lock();
-
-        list_for_each_entry_rcu(work, &bdi->work_list, list) {
-                if (!test_bit(wb->nr, &work->seen))
-                        continue;
-                clear_bit(wb->nr, &work->seen);
-
-                ret = work;
-                break;
+        spin_lock(&bdi->wb_lock);
+        if (!list_empty(&bdi->work_list)) {
+                work = list_entry(bdi->work_list.next,
+                                  struct wb_writeback_work, list);
+                list_del_init(&work->list);
         }
-
-        rcu_read_unlock();
-        return ret;
+        spin_unlock(&bdi->wb_lock);
+        return work;
 }
 
 static long wb_check_old_data_flush(struct bdi_writeback *wb)
@@ -876,14 +721,14 @@ static long wb_check_old_data_flush(struct bdi_writeback *wb)
                         (inodes_stat.nr_inodes - inodes_stat.nr_unused);
 
         if (nr_pages) {
-                struct wb_writeback_args args = {
+                struct wb_writeback_work work = {
                         .nr_pages       = nr_pages,
                         .sync_mode      = WB_SYNC_NONE,
                         .for_kupdate    = 1,
                         .range_cyclic   = 1,
                 };
 
-                return wb_writeback(wb, &args);
+                return wb_writeback(wb, &work);
         }
 
         return 0;
@@ -895,33 +740,27 @@ static long wb_check_old_data_flush(struct bdi_writeback *wb)
 long wb_do_writeback(struct bdi_writeback *wb, int force_wait)
 {
         struct backing_dev_info *bdi = wb->bdi;
-        struct bdi_work *work;
+        struct wb_writeback_work *work;
         long wrote = 0;
 
         while ((work = get_next_work_item(bdi, wb)) != NULL) {
-                struct wb_writeback_args args = work->args;
-
                 /*
                  * Override sync mode, in case we must wait for completion
+                 * because this thread is exiting now.
                  */
                 if (force_wait)
-                        work->args.sync_mode = args.sync_mode = WB_SYNC_ALL;
-
-                /*
-                 * If this isn't a data integrity operation, just notify
-                 * that we have seen this work and we are now starting it.
-                 */
-                if (args.sync_mode == WB_SYNC_NONE)
-                        wb_clear_pending(wb, work);
+                        work->sync_mode = WB_SYNC_ALL;
 
-                wrote += wb_writeback(wb, &args);
+                wrote += wb_writeback(wb, work);
 
                 /*
-                 * This is a data integrity writeback, so only do the
-                 * notification when we have completed the work.
+                 * Notify the caller of completion if this is a synchronous
+                 * work item, otherwise just free it.
                  */
-                if (args.sync_mode == WB_SYNC_ALL)
-                        wb_clear_pending(wb, work);
+                if (work->done)
+                        complete(work->done);
+                else
+                        kfree(work);
         }
 
         /*
@@ -978,42 +817,27 @@ int bdi_writeback_task(struct bdi_writeback *wb)
 }
 
 /*
- * Schedule writeback for all backing devices. This does WB_SYNC_NONE
- * writeback, for integrity writeback see bdi_sync_writeback().
+ * Start writeback of `nr_pages' pages.  If `nr_pages' is zero, write back
+ * the whole world.
  */
-static void bdi_writeback_all(struct super_block *sb, long nr_pages)
+void wakeup_flusher_threads(long nr_pages)
 {
-        struct wb_writeback_args args = {
-                .sb             = sb,
-                .nr_pages       = nr_pages,
-                .sync_mode      = WB_SYNC_NONE,
-        };
         struct backing_dev_info *bdi;
 
-        rcu_read_lock();
+        if (!nr_pages) {
+                nr_pages = global_page_state(NR_FILE_DIRTY) +
+                                global_page_state(NR_UNSTABLE_NFS);
+        }
 
+        rcu_read_lock();
         list_for_each_entry_rcu(bdi, &bdi_list, bdi_list) {
                 if (!bdi_has_dirty_io(bdi))
                         continue;
-
-                bdi_alloc_queue_work(bdi, &args);
+                __bdi_start_writeback(bdi, nr_pages, false, false);
         }
-
         rcu_read_unlock();
 }
 
-/*
- * Start writeback of `nr_pages' pages.  If `nr_pages' is zero, write back
- * the whole world.
- */
-void wakeup_flusher_threads(long nr_pages)
-{
-        if (nr_pages == 0)
-                nr_pages = global_page_state(NR_FILE_DIRTY) +
-                                global_page_state(NR_UNSTABLE_NFS);
-        bdi_writeback_all(NULL, nr_pages);
-}
-
 static noinline void block_dump___mark_inode_dirty(struct inode *inode)
 {
         if (inode->i_ino || strcmp(inode->i_sb->s_id, "bdev")) {
@@ -1218,12 +1042,20 @@ void writeback_inodes_sb(struct super_block *sb)
 {
         unsigned long nr_dirty = global_page_state(NR_FILE_DIRTY);
         unsigned long nr_unstable = global_page_state(NR_UNSTABLE_NFS);
-        long nr_to_write;
+        DECLARE_COMPLETION_ONSTACK(done);
+        struct wb_writeback_work work = {
+                .sb             = sb,
+                .sync_mode      = WB_SYNC_NONE,
+                .done           = &done,
+        };
+
+        WARN_ON(!rwsem_is_locked(&sb->s_umount));
 
-        nr_to_write = nr_dirty + nr_unstable +
+        work.nr_pages = nr_dirty + nr_unstable +
                         (inodes_stat.nr_inodes - inodes_stat.nr_unused);
 
-        bdi_start_writeback(sb->s_bdi, sb, nr_to_write);
+        bdi_queue_work(sb->s_bdi, &work);
+        wait_for_completion(&done);
 }
 EXPORT_SYMBOL(writeback_inodes_sb);
 
@@ -1237,7 +1069,9 @@ EXPORT_SYMBOL(writeback_inodes_sb);
 int writeback_inodes_sb_if_idle(struct super_block *sb)
 {
         if (!writeback_in_progress(sb->s_bdi)) {
+                down_read(&sb->s_umount);
                 writeback_inodes_sb(sb);
+                up_read(&sb->s_umount);
                 return 1;
         } else
                 return 0;
@@ -1253,7 +1087,20 @@ EXPORT_SYMBOL(writeback_inodes_sb_if_idle);
  */
 void sync_inodes_sb(struct super_block *sb)
 {
-        bdi_sync_writeback(sb->s_bdi, sb);
+        DECLARE_COMPLETION_ONSTACK(done);
+        struct wb_writeback_work work = {
+                .sb             = sb,
+                .sync_mode      = WB_SYNC_ALL,
+                .nr_pages       = LONG_MAX,
+                .range_cyclic   = 0,
+                .done           = &done,
+        };
+
+        WARN_ON(!rwsem_is_locked(&sb->s_umount));
+
+        bdi_queue_work(sb->s_bdi, &work);
+        wait_for_completion(&done);
+
         wait_sb_inodes(sb);
 }
 EXPORT_SYMBOL(sync_inodes_sb);
diff --git a/fs/jffs2/acl.c b/fs/jffs2/acl.c
index a33aab6b5e68..54a92fd02bbd 100644
--- a/fs/jffs2/acl.c
+++ b/fs/jffs2/acl.c
@@ -234,8 +234,9 @@ static int jffs2_set_acl(struct inode *inode, int type, struct posix_acl *acl)
                         if (inode->i_mode != mode) {
                                 struct iattr attr;
 
-                                attr.ia_valid = ATTR_MODE;
+                                attr.ia_valid = ATTR_MODE | ATTR_CTIME;
                                 attr.ia_mode = mode;
+                                attr.ia_ctime = CURRENT_TIME_SEC;
                                 rc = jffs2_do_setattr(inode, &attr);
                                 if (rc < 0)
                                         return rc;
diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
index 7aa4417e085f..166062a68230 100644
--- a/fs/jffs2/dir.c
+++ b/fs/jffs2/dir.c
@@ -222,15 +222,18 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry, int mode,
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(ri->ctime));
 
         jffs2_free_raw_inode(ri);
-        d_instantiate(dentry, inode);
 
         D1(printk(KERN_DEBUG "jffs2_create: Created ino #%lu with mode %o, nlink %d(%d). nrpages %ld\n",
                   inode->i_ino, inode->i_mode, inode->i_nlink,
                   f->inocache->pino_nlink, inode->i_mapping->nrpages));
+
+        d_instantiate(dentry, inode);
+        unlock_new_inode(inode);
         return 0;
 
  fail:
         make_bad_inode(inode);
+        unlock_new_inode(inode);
         iput(inode);
         jffs2_free_raw_inode(ri);
         return ret;
@@ -360,8 +363,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                 /* Eeek. Wave bye bye */
                 mutex_unlock(&f->sem);
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fn);
+                ret = PTR_ERR(fn);
+                goto fail;
         }
 
         /* We use f->target field to store the target path. */
@@ -370,8 +373,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                 printk(KERN_WARNING "Can't allocate %d bytes of memory\n", targetlen + 1);
                 mutex_unlock(&f->sem);
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         memcpy(f->target, target, targetlen + 1);
@@ -386,30 +389,24 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
         jffs2_complete_reservation(c);
 
         ret = jffs2_init_security(inode, dir_i);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
+
         ret = jffs2_init_acl_post(inode);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                   ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
-        if (ret) {
-                /* Eep. */
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         rd = jffs2_alloc_raw_dirent();
         if (!rd) {
                 /* Argh. Now we treat it like a normal delete */
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         dir_f = JFFS2_INODE_INFO(dir_i);
@@ -437,8 +434,8 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
                 jffs2_complete_reservation(c);
                 jffs2_free_raw_dirent(rd);
                 mutex_unlock(&dir_f->sem);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fd);
+                ret = PTR_ERR(fd);
+                goto fail;
         }
 
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
@@ -453,7 +450,14 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
         jffs2_complete_reservation(c);
 
         d_instantiate(dentry, inode);
+        unlock_new_inode(inode);
         return 0;
+
+ fail:
+        make_bad_inode(inode);
+        unlock_new_inode(inode);
+        iput(inode);
+        return ret;
 }
 
 
@@ -519,8 +523,8 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
                 /* Eeek. Wave bye bye */
                 mutex_unlock(&f->sem);
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fn);
+                ret = PTR_ERR(fn);
+                goto fail;
         }
         /* No data here. Only a metadata node, which will be
            obsoleted by the first data write
@@ -531,30 +535,24 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
         jffs2_complete_reservation(c);
 
         ret = jffs2_init_security(inode, dir_i);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
+
         ret = jffs2_init_acl_post(inode);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                   ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
-        if (ret) {
-                /* Eep. */
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         rd = jffs2_alloc_raw_dirent();
         if (!rd) {
                 /* Argh. Now we treat it like a normal delete */
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         dir_f = JFFS2_INODE_INFO(dir_i);
@@ -582,8 +580,8 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
                 jffs2_complete_reservation(c);
                 jffs2_free_raw_dirent(rd);
                 mutex_unlock(&dir_f->sem);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fd);
+                ret = PTR_ERR(fd);
+                goto fail;
         }
 
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
@@ -599,7 +597,14 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, int mode)
         jffs2_complete_reservation(c);
 
         d_instantiate(dentry, inode);
+        unlock_new_inode(inode);
         return 0;
+
+ fail:
+        make_bad_inode(inode);
+        unlock_new_inode(inode);
+        iput(inode);
+        return ret;
 }
 
 static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry)
@@ -693,8 +698,8 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
                 /* Eeek. Wave bye bye */
                 mutex_unlock(&f->sem);
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fn);
+                ret = PTR_ERR(fn);
+                goto fail;
         }
         /* No data here. Only a metadata node, which will be
            obsoleted by the first data write
@@ -705,30 +710,24 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
         jffs2_complete_reservation(c);
 
         ret = jffs2_init_security(inode, dir_i);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
+
         ret = jffs2_init_acl_post(inode);
-        if (ret) {
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
                                   ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
-        if (ret) {
-                /* Eep. */
-                jffs2_clear_inode(inode);
-                return ret;
-        }
+        if (ret)
+                goto fail;
 
         rd = jffs2_alloc_raw_dirent();
         if (!rd) {
                 /* Argh. Now we treat it like a normal delete */
                 jffs2_complete_reservation(c);
-                jffs2_clear_inode(inode);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         dir_f = JFFS2_INODE_INFO(dir_i);
@@ -759,8 +758,8 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
                 jffs2_complete_reservation(c);
                 jffs2_free_raw_dirent(rd);
                 mutex_unlock(&dir_f->sem);
-                jffs2_clear_inode(inode);
-                return PTR_ERR(fd);
+                ret = PTR_ERR(fd);
+                goto fail;
         }
 
         dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
@@ -775,8 +774,14 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, int mode, de
         jffs2_complete_reservation(c);
 
         d_instantiate(dentry, inode);
-
+        unlock_new_inode(inode);
         return 0;
+
+ fail:
+        make_bad_inode(inode);
+        unlock_new_inode(inode);
+        iput(inode);
+        return ret;
 }
 
 static int jffs2_rename (struct inode *old_dir_i, struct dentry *old_dentry,
diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index 8bc2c80ab159..459d39d1ea0b 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -465,7 +465,12 @@ struct inode *jffs2_new_inode (struct inode *dir_i, int mode, struct jffs2_raw_i
         inode->i_blocks = 0;
         inode->i_size = 0;
 
-        insert_inode_hash(inode);
+        if (insert_inode_locked(inode) < 0) {
+                make_bad_inode(inode);
+                unlock_new_inode(inode);
+                iput(inode);
+                return ERR_PTR(-EINVAL);
+        }
 
         return inode;
 }
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 7ec9b34a59f8..d25b5257b7a1 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -1286,6 +1286,55 @@ static void nfs4_session_set_rwsize(struct nfs_server *server)
 #endif /* CONFIG_NFS_V4_1 */
 }
 
+static int nfs4_server_common_setup(struct nfs_server *server,
+                struct nfs_fh *mntfh)
+{
+        struct nfs_fattr *fattr;
+        int error;
+
+        BUG_ON(!server->nfs_client);
+        BUG_ON(!server->nfs_client->rpc_ops);
+        BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops);
+
+        fattr = nfs_alloc_fattr();
+        if (fattr == NULL)
+                return -ENOMEM;
+
+        /* We must ensure the session is initialised first */
+        error = nfs4_init_session(server);
+        if (error < 0)
+                goto out;
+
+        /* Probe the root fh to retrieve its FSID and filehandle */
+        error = nfs4_get_rootfh(server, mntfh);
+        if (error < 0)
+                goto out;
+
+        dprintk("Server FSID: %llx:%llx\n",
+                        (unsigned long long) server->fsid.major,
+                        (unsigned long long) server->fsid.minor);
+        dprintk("Mount FH: %d\n", mntfh->size);
+
+        nfs4_session_set_rwsize(server);
+
+        error = nfs_probe_fsinfo(server, mntfh, fattr);
+        if (error < 0)
+                goto out;
+
+        if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
+                server->namelen = NFS4_MAXNAMLEN;
+
+        spin_lock(&nfs_client_lock);
+        list_add_tail(&server->client_link, &server->nfs_client->cl_superblocks);
+        list_add_tail(&server->master_link, &nfs_volume_list);
+        spin_unlock(&nfs_client_lock);
+
+        server->mount_time = jiffies;
+out:
+        nfs_free_fattr(fattr);
+        return error;
+}
+
 /*
  * Create a version 4 volume record
  */
@@ -1346,7 +1395,6 @@ error:
 struct nfs_server *nfs4_create_server(const struct nfs_parsed_mount_data *data,
                                       struct nfs_fh *mntfh)
 {
-        struct nfs_fattr *fattr;
         struct nfs_server *server;
         int error;
 
@@ -1356,55 +1404,19 @@ struct nfs_server *nfs4_create_server(const struct nfs_parsed_mount_data *data,
         if (!server)
                 return ERR_PTR(-ENOMEM);
 
-        error = -ENOMEM;
-        fattr = nfs_alloc_fattr();
-        if (fattr == NULL)
-                goto error;
-
         /* set up the general RPC client */
         error = nfs4_init_server(server, data);
         if (error < 0)
                 goto error;
 
-        BUG_ON(!server->nfs_client);
-        BUG_ON(!server->nfs_client->rpc_ops);
-        BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops);
-
-        error = nfs4_init_session(server);
-        if (error < 0)
-                goto error;
-
-        /* Probe the root fh to retrieve its FSID */
-        error = nfs4_get_rootfh(server, mntfh);
+        error = nfs4_server_common_setup(server, mntfh);
         if (error < 0)
                 goto error;
 
-        dprintk("Server FSID: %llx:%llx\n",
-                (unsigned long long) server->fsid.major,
-                (unsigned long long) server->fsid.minor);
-        dprintk("Mount FH: %d\n", mntfh->size);
-
-        nfs4_session_set_rwsize(server);
-
-        error = nfs_probe_fsinfo(server, mntfh, fattr);
-        if (error < 0)
-                goto error;
-
-        if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
-                server->namelen = NFS4_MAXNAMLEN;
-
-        spin_lock(&nfs_client_lock);
-        list_add_tail(&server->client_link, &server->nfs_client->cl_superblocks);
-        list_add_tail(&server->master_link, &nfs_volume_list);
-        spin_unlock(&nfs_client_lock);
-
-        server->mount_time = jiffies;
         dprintk("<-- nfs4_create_server() = %p\n", server);
-        nfs_free_fattr(fattr);
         return server;
 
 error:
-        nfs_free_fattr(fattr);
         nfs_free_server(server);
         dprintk("<-- nfs4_create_server() = error %d\n", error);
         return ERR_PTR(error);
@@ -1418,7 +1430,6 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data,
 {
         struct nfs_client *parent_client;
         struct nfs_server *server, *parent_server;
-        struct nfs_fattr *fattr;
         int error;
 
         dprintk("--> nfs4_create_referral_server()\n");
@@ -1427,11 +1438,6 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data,
         if (!server)
                 return ERR_PTR(-ENOMEM);
 
-        error = -ENOMEM;
-        fattr = nfs_alloc_fattr();
-        if (fattr == NULL)
-                goto error;
-
         parent_server = NFS_SB(data->sb);
         parent_client = parent_server->nfs_client;
 
@@ -1456,40 +1462,14 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data,
         if (error < 0)
                 goto error;
 
-        BUG_ON(!server->nfs_client);
-        BUG_ON(!server->nfs_client->rpc_ops);
-        BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops);
-
-        /* Probe the root fh to retrieve its FSID and filehandle */
-        error = nfs4_get_rootfh(server, mntfh);
-        if (error < 0)
-                goto error;
-
-        /* probe the filesystem info for this server filesystem */
-        error = nfs_probe_fsinfo(server, mntfh, fattr);
+        error = nfs4_server_common_setup(server, mntfh);
         if (error < 0)
                 goto error;
 
-        if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
-                server->namelen = NFS4_MAXNAMLEN;
-
-        dprintk("Referral FSID: %llx:%llx\n",
-                (unsigned long long) server->fsid.major,
-                (unsigned long long) server->fsid.minor);
-
-        spin_lock(&nfs_client_lock);
-        list_add_tail(&server->client_link, &server->nfs_client->cl_superblocks);
-        list_add_tail(&server->master_link, &nfs_volume_list);
-        spin_unlock(&nfs_client_lock);
-
-        server->mount_time = jiffies;
-
-        nfs_free_fattr(fattr);
         dprintk("<-- nfs_create_referral_server() = %p\n", server);
         return server;
 
 error:
-        nfs_free_fattr(fattr);
         nfs_free_server(server);
         dprintk("<-- nfs4_create_referral_server() = error %d\n", error);
         return ERR_PTR(error);
diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
index 7428f7d6273b..a70e446e1605 100644
--- a/fs/nfs/getroot.c
+++ b/fs/nfs/getroot.c
@@ -146,7 +146,7 @@ int nfs4_get_rootfh(struct nfs_server *server, struct nfs_fh *mntfh)
                 goto out;
         }
 
-        if (!(fsinfo.fattr->valid & NFS_ATTR_FATTR_MODE)
+        if (!(fsinfo.fattr->valid & NFS_ATTR_FATTR_TYPE)
                         || !S_ISDIR(fsinfo.fattr->mode)) {
                 printk(KERN_ERR "nfs4_get_rootfh:"
                        " getroot encountered non-directory\n");
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 6bdef28efa33..65c8dae4b267 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -862,8 +862,8 @@ static void encode_attrs(struct xdr_stream *xdr, const struct iattr *iap, const
                 bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET;
                 *p++ = cpu_to_be32(NFS4_SET_TO_CLIENT_TIME);
                 *p++ = cpu_to_be32(0);
-                *p++ = cpu_to_be32(iap->ia_mtime.tv_sec);
-                *p++ = cpu_to_be32(iap->ia_mtime.tv_nsec);
+                *p++ = cpu_to_be32(iap->ia_atime.tv_sec);
+                *p++ = cpu_to_be32(iap->ia_atime.tv_nsec);
         }
         else if (iap->ia_valid & ATTR_ATIME) {
                 bmval1 |= FATTR4_WORD1_TIME_ACCESS_SET;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 04214fc5c304..f9df16de4a56 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -570,6 +570,22 @@ static void nfs_show_mountd_options(struct seq_file *m, struct nfs_server *nfss,
         nfs_show_mountd_netid(m, nfss, showdefaults);
 }
 
+#ifdef CONFIG_NFS_V4
+static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss,
+                                    int showdefaults)
+{
+        struct nfs_client *clp = nfss->nfs_client;
+
+        seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr);
+        seq_printf(m, ",minorversion=%u", clp->cl_minorversion);
+}
+#else
+static void nfs_show_nfsv4_options(struct seq_file *m, struct nfs_server *nfss,
+                                    int showdefaults)
+{
+}
+#endif
+
 /*
  * Describe the mount options in force on this server representation
  */
@@ -631,11 +647,9 @@ static void nfs_show_mount_options(struct seq_file *m, struct nfs_server *nfss,
 
         if (version != 4)
                 nfs_show_mountd_options(m, nfss, showdefaults);
+        else
+                nfs_show_nfsv4_options(m, nfss, showdefaults);
 
-#ifdef CONFIG_NFS_V4
-        if (clp->rpc_ops->version == 4)
-                seq_printf(m, ",clientaddr=%s", clp->cl_ipaddr);
-#endif
         if (nfss->options & NFS_OPTION_FSCACHE)
                 seq_printf(m, ",fsc");
 }
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 12f7109720c2..4a2734758778 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4122,8 +4122,8 @@ nfs4_state_shutdown(void)
         nfs4_lock_state();
         nfs4_release_reclaim();
         __nfs4_state_shutdown();
-        nfsd4_destroy_callback_queue();
         nfs4_unlock_state();
+        nfsd4_destroy_callback_queue();
 }
 
 /*
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index ebbf3b6b2457..3c111120b619 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -443,8 +443,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
         if (size_change)
                 put_write_access(inode);
         if (!err)
-                if (EX_ISSYNC(fhp->fh_export))
-                        write_inode_now(inode, 1);
+                commit_metadata(fhp);
 out:
         return err;
 
diff --git a/fs/ocfs2/reservations.c b/fs/ocfs2/reservations.c
index 40650021fc24..d8b6e4259b80 100644
--- a/fs/ocfs2/reservations.c
+++ b/fs/ocfs2/reservations.c
@@ -26,7 +26,6 @@
 
 #include <linux/fs.h>
 #include <linux/types.h>
-#include <linux/slab.h>
 #include <linux/highmem.h>
 #include <linux/bitops.h>
 #include <linux/list.h>
diff --git a/fs/pipe.c b/fs/pipe.c
index 69c4c7c13ea9..279eef96c51c 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -1145,13 +1145,20 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
          * and adjust the indexes.
          */
         if (pipe->nrbufs) {
-                const unsigned int tail = pipe->nrbufs & (pipe->buffers - 1);
-                const unsigned int head = pipe->nrbufs - tail;
+                unsigned int tail;
+                unsigned int head;
 
+                tail = pipe->curbuf + pipe->nrbufs;
+                if (tail < pipe->buffers)
+                        tail = 0;
+                else
+                        tail &= (pipe->buffers - 1);
+
+                head = pipe->nrbufs - tail;
                 if (head)
                         memcpy(bufs, pipe->bufs + pipe->curbuf, head * sizeof(struct pipe_buffer));
                 if (tail)
-                        memcpy(bufs + head, pipe->bufs + pipe->curbuf, tail * sizeof(struct pipe_buffer));
+                        memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer));
         }
 
         pipe->curbuf = 0;
@@ -1208,12 +1215,13 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
                 size = round_pipe_size(arg);
                 nr_pages = size >> PAGE_SHIFT;
 
+                ret = -EINVAL;
+                if (!nr_pages)
+                        goto out;
+
                 if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
                         ret = -EPERM;
                         goto out;
-                } else if (nr_pages < PAGE_SIZE) {
-                        ret = -EINVAL;
-                        goto out;
                 }
                 ret = pipe_set_size(pipe, nr_pages);
                 break;
diff --git a/fs/proc/proc_devtree.c b/fs/proc/proc_devtree.c
index ce94801f48ca..d9396a4fc7ff 100644
--- a/fs/proc/proc_devtree.c
+++ b/fs/proc/proc_devtree.c
@@ -209,6 +209,9 @@ void proc_device_tree_add_node(struct device_node *np,
         for (pp = np->properties; pp != NULL; pp = pp->next) {
                 p = pp->name;
 
+                if (strchr(p, '/'))
+                        continue;
+
                 if (duplicate_name(de, p))
                         p = fixup_name(np, de, p);
 
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index 46d4b5d72bd3..cb6306e63843 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -122,11 +122,20 @@ int task_statm(struct mm_struct *mm, int *shared, int *text,
         return size;
 }
 
+static void pad_len_spaces(struct seq_file *m, int len)
+{
+        len = 25 + sizeof(void*) * 6 - len;
+        if (len < 1)
+                len = 1;
+        seq_printf(m, "%*c", len, ' ');
+}
+
 /*
  * display a single VMA to a sequenced file
  */
 static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
 {
+        struct mm_struct *mm = vma->vm_mm;
         unsigned long ino = 0;
         struct file *file;
         dev_t dev = 0;
@@ -155,11 +164,14 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma)
                    MAJOR(dev), MINOR(dev), ino, &len);
 
         if (file) {
-                len = 25 + sizeof(void *) * 6 - len;
-                if (len < 1)
-                        len = 1;
-                seq_printf(m, "%*c", len, ' ');
+                pad_len_spaces(m, len);
                 seq_path(m, &file->f_path, "");
+        } else if (mm) {
+                if (vma->vm_start <= mm->start_stack &&
+                        vma->vm_end >= mm->start_stack) {
+                        pad_len_spaces(m, len);
+                        seq_puts(m, "[stack]");
+                }
         }
 
         seq_putc(m, '\n');
diff --git a/fs/splice.c b/fs/splice.c
index 740e6b9faf7a..efdbfece9932 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1282,7 +1282,8 @@ static int direct_splice_actor(struct pipe_inode_info *pipe,
 {
         struct file *file = sd->u.file;
 
-        return do_splice_from(pipe, file, &sd->pos, sd->total_len, sd->flags);
+        return do_splice_from(pipe, file, &file->f_pos, sd->total_len,
+                              sd->flags);
 }
 
 /**
@@ -1371,8 +1372,7 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                 if (off_in)
                         return -ESPIPE;
                 if (off_out) {
-                        if (!out->f_op || !out->f_op->llseek ||
-                            out->f_op->llseek == no_llseek)
+                        if (!(out->f_mode & FMODE_PWRITE))
                                 return -EINVAL;
                         if (copy_from_user(&offset, off_out, sizeof(loff_t)))
                                 return -EFAULT;
@@ -1392,8 +1392,7 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                 if (off_out)
                         return -ESPIPE;
                 if (off_in) {
-                        if (!in->f_op || !in->f_op->llseek ||
-                            in->f_op->llseek == no_llseek)
+                        if (!(in->f_mode & FMODE_PREAD))
                                 return -EINVAL;
                         if (copy_from_user(&offset, off_in, sizeof(loff_t)))
                                 return -EFAULT;
diff --git a/fs/super.c b/fs/super.c
index 5c35bc7a499e..938119ab8dcb 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -374,6 +374,8 @@ void sync_supers(void)
                         up_read(&sb->s_umount);
 
                         spin_lock(&sb_lock);
+                        /* lock was dropped, must reset next */
+                        list_safe_reset_next(sb, n, s_list);
                         __put_super(sb);
                 }
         }
@@ -405,6 +407,8 @@ void iterate_supers(void (*f)(struct super_block *, void *), void *arg)
                 up_read(&sb->s_umount);
 
                 spin_lock(&sb_lock);
+                /* lock was dropped, must reset next */
+                list_safe_reset_next(sb, n, s_list);
                 __put_super(sb);
         }
         spin_unlock(&sb_lock);
@@ -585,6 +589,8 @@ static void do_emergency_remount(struct work_struct *work)
                 }
                 up_write(&sb->s_umount);
                 spin_lock(&sb_lock);
+                /* lock was dropped, must reset next */
+                list_safe_reset_next(sb, n, s_list);
                 __put_super(sb);
         }
         spin_unlock(&sb_lock);
diff --git a/fs/sysv/ialloc.c b/fs/sysv/ialloc.c
index bbd69bdb0fa8..fcc498ec9b33 100644
--- a/fs/sysv/ialloc.c
+++ b/fs/sysv/ialloc.c
@@ -25,6 +25,7 @@
 #include <linux/stat.h>
 #include <linux/string.h>
 #include <linux/buffer_head.h>
+#include <linux/writeback.h>
 #include "sysv.h"
 
 /* We don't trust the value of
@@ -139,6 +140,9 @@ struct inode * sysv_new_inode(const struct inode * dir, mode_t mode)
         struct inode *inode;
         sysv_ino_t ino;
         unsigned count;
+        struct writeback_control wbc = {
+                .sync_mode = WB_SYNC_NONE
+        };
 
         inode = new_inode(sb);
         if (!inode)
@@ -168,7 +172,7 @@ struct inode * sysv_new_inode(const struct inode * dir, mode_t mode)
         insert_inode_hash(inode);
         mark_inode_dirty(inode);
 
-        sysv_write_inode(inode, 0);     /* ensure inode not allocated again */
+        sysv_write_inode(inode, &wbc);  /* ensure inode not allocated again */
         mark_inode_dirty(inode);        /* cleared by sysv_write_inode() */
         /* That's it. */
         unlock_super(sb);
diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c
index 076ca50e9933..c8ff0d1ae5d3 100644
--- a/fs/ubifs/budget.c
+++ b/fs/ubifs/budget.c
@@ -62,7 +62,9 @@
  */
 static void shrink_liability(struct ubifs_info *c, int nr_to_write)
 {
+        down_read(&c->vfs_sb->s_umount);
         writeback_inodes_sb(c->vfs_sb);
+        up_read(&c->vfs_sb->s_umount);
 }
 
 /**
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index a0fa3bf0d1bb..34640d6dbdcb 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -1381,14 +1381,6 @@ xfs_vm_writepage(
         if (!page_has_buffers(page))
                 create_empty_buffers(page, 1 << inode->i_blkbits, 0);
 
-
-        /*
-         *  VM calculation for nr_to_write seems off.  Bump it way
-         *  up, this gets simple streaming writes zippy again.
-         *  To be reviewed again after Jens' writeback changes.
-         */
-        wbc->nr_to_write *= 4;
-
         /*
          * Convert delayed allocate, unwritten or unmapped space
          * to real space and flush out to disk.
diff --git a/fs/xfs/linux-2.6/xfs_export.c b/fs/xfs/linux-2.6/xfs_export.c
index 846b75aeb2ab..e7839ee49e43 100644
--- a/fs/xfs/linux-2.6/xfs_export.c
+++ b/fs/xfs/linux-2.6/xfs_export.c
@@ -128,13 +128,12 @@ xfs_nfs_get_inode(
                 return ERR_PTR(-ESTALE);
 
         /*
-         * The XFS_IGET_BULKSTAT means that an invalid inode number is just
-         * fine and not an indication of a corrupted filesystem.  Because
-         * clients can send any kind of invalid file handle, e.g. after
-         * a restore on the server we have to deal with this case gracefully.
+         * The XFS_IGET_UNTRUSTED means that an invalid inode number is just
+         * fine and not an indication of a corrupted filesystem as clients can
+         * send invalid file handles and we have to handle it gracefully..
          */
-        error = xfs_iget(mp, NULL, ino, XFS_IGET_BULKSTAT,
-                         XFS_ILOCK_SHARED, &ip, 0);
+        error = xfs_iget(mp, NULL, ino, XFS_IGET_UNTRUSTED,
+                         XFS_ILOCK_SHARED, &ip);
         if (error) {
                 /*
                  * EINVAL means the inode cluster doesn't exist anymore.
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index 699b60cbab9c..e59a81062830 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -679,10 +679,9 @@ xfs_ioc_bulkstat(
                 error = xfs_bulkstat_single(mp, &inlast,
                                                 bulkreq.ubuffer, &done);
         else    /* XFS_IOC_FSBULKSTAT */
-                error = xfs_bulkstat(mp, &inlast, &count,
-                        (bulkstat_one_pf)xfs_bulkstat_one, NULL,
-                        sizeof(xfs_bstat_t), bulkreq.ubuffer,
-                        BULKSTAT_FG_QUICK, &done);
+                error = xfs_bulkstat(mp, &inlast, &count, xfs_bulkstat_one,
+                                     sizeof(xfs_bstat_t), bulkreq.ubuffer,
+                                     &done);
 
         if (error)
                 return -error;
diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/linux-2.6/xfs_ioctl32.c
index 9287135e9bfc..52ed49e6465c 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl32.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl32.c
@@ -237,15 +237,12 @@ xfs_bulkstat_one_compat(
         xfs_ino_t       ino,            /* inode number to get data for */
         void            __user *buffer, /* buffer to place output in */
         int             ubsize,         /* size of buffer */
-        void            *private_data,  /* my private data */
-        xfs_daddr_t     bno,            /* starting bno of inode cluster */
         int             *ubused,        /* bytes used by me */
-        void            *dibuff,        /* on-disk inode buffer */
         int             *stat)          /* BULKSTAT_RV_... */
 {
         return xfs_bulkstat_one_int(mp, ino, buffer, ubsize,
-                                    xfs_bulkstat_one_fmt_compat, bno,
-                                    ubused, dibuff, stat);
+                                    xfs_bulkstat_one_fmt_compat,
+                                    ubused, stat);
 }
 
 /* copied from xfs_ioctl.c */
@@ -298,13 +295,11 @@ xfs_compat_ioc_bulkstat(
                 int res;
 
                 error = xfs_bulkstat_one_compat(mp, inlast, bulkreq.ubuffer,
-                                sizeof(compat_xfs_bstat_t),
-                                NULL, 0, NULL, NULL, &res);
+                                sizeof(compat_xfs_bstat_t), 0, &res);
         } else if (cmd == XFS_IOC_FSBULKSTAT_32) {
                 error = xfs_bulkstat(mp, &inlast, &count,
-                        xfs_bulkstat_one_compat, NULL,
-                        sizeof(compat_xfs_bstat_t), bulkreq.ubuffer,
-                        BULKSTAT_FG_QUICK, &done);
+                        xfs_bulkstat_one_compat, sizeof(compat_xfs_bstat_t),
+                        bulkreq.ubuffer, &done);
         } else
                 error = XFS_ERROR(EINVAL);
         if (error)
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 2d8b7bc792c9..8c117ff2e3ab 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -1632,10 +1632,7 @@ xfs_qm_dqusage_adjust(
         xfs_ino_t       ino,            /* inode number to get data for */
         void            __user *buffer, /* not used */
         int             ubsize,         /* not used */
-        void            *private_data,  /* not used */
-        xfs_daddr_t     bno,            /* starting block of inode cluster */
         int             *ubused,        /* not used */
-        void            *dip,           /* on-disk inode pointer (not used) */
         int             *res)           /* result code value */
 {
         xfs_inode_t     *ip;
@@ -1660,7 +1657,7 @@ xfs_qm_dqusage_adjust(
          * the case in all other instances. It's OK that we do this because
          * quotacheck is done only at mount time.
          */
-        if ((error = xfs_iget(mp, NULL, ino, 0, XFS_ILOCK_EXCL, &ip, bno))) {
+        if ((error = xfs_iget(mp, NULL, ino, 0, XFS_ILOCK_EXCL, &ip))) {
                 *res = BULKSTAT_RV_NOTHING;
                 return error;
         }
@@ -1796,12 +1793,13 @@ xfs_qm_quotacheck(
                  * Iterate thru all the inodes in the file system,
                  * adjusting the corresponding dquot counters in core.
                  */
-                if ((error = xfs_bulkstat(mp, &lastino, &count,
-                                     xfs_qm_dqusage_adjust, NULL,
-                                     structsz, NULL, BULKSTAT_FG_IGET, &done)))
+                error = xfs_bulkstat(mp, &lastino, &count,
+                                     xfs_qm_dqusage_adjust,
+                                     structsz, NULL, &done);
+                if (error)
                         break;
 
-        } while (! done);
+        } while (!done);
 
         /*
          * We've made all the changes that we need to make incore.
@@ -1889,14 +1887,14 @@ xfs_qm_init_quotainos(
                     mp->m_sb.sb_uquotino != NULLFSINO) {
                         ASSERT(mp->m_sb.sb_uquotino > 0);
                         if ((error = xfs_iget(mp, NULL, mp->m_sb.sb_uquotino,
-                                             0, 0, &uip, 0)))
+                                             0, 0, &uip)))
                                 return XFS_ERROR(error);
                 }
                 if (XFS_IS_OQUOTA_ON(mp) &&
                     mp->m_sb.sb_gquotino != NULLFSINO) {
                         ASSERT(mp->m_sb.sb_gquotino > 0);
                         if ((error = xfs_iget(mp, NULL, mp->m_sb.sb_gquotino,
-                                             0, 0, &gip, 0))) {
+                                             0, 0, &gip))) {
                                 if (uip)
                                         IRELE(uip);
                                 return XFS_ERROR(error);
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c
index 92b002f1805f..b4487764e923 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/quota/xfs_qm_syscalls.c
@@ -262,7 +262,7 @@ xfs_qm_scall_trunc_qfiles(
         }
 
         if ((flags & XFS_DQ_USER) && mp->m_sb.sb_uquotino != NULLFSINO) {
-                error = xfs_iget(mp, NULL, mp->m_sb.sb_uquotino, 0, 0, &qip, 0);
+                error = xfs_iget(mp, NULL, mp->m_sb.sb_uquotino, 0, 0, &qip);
                 if (!error) {
                         error = xfs_truncate_file(mp, qip);
                         IRELE(qip);
@@ -271,7 +271,7 @@ xfs_qm_scall_trunc_qfiles(
 
         if ((flags & (XFS_DQ_GROUP|XFS_DQ_PROJ)) &&
             mp->m_sb.sb_gquotino != NULLFSINO) {
-                error2 = xfs_iget(mp, NULL, mp->m_sb.sb_gquotino, 0, 0, &qip, 0);
+                error2 = xfs_iget(mp, NULL, mp->m_sb.sb_gquotino, 0, 0, &qip);
                 if (!error2) {
                         error2 = xfs_truncate_file(mp, qip);
                         IRELE(qip);
@@ -417,12 +417,12 @@ xfs_qm_scall_getqstat(
         }
         if (!uip && mp->m_sb.sb_uquotino != NULLFSINO) {
                 if (xfs_iget(mp, NULL, mp->m_sb.sb_uquotino,
-                                        0, 0, &uip, 0) == 0)
+                                        0, 0, &uip) == 0)
                         tempuqip = B_TRUE;
         }
         if (!gip && mp->m_sb.sb_gquotino != NULLFSINO) {
                 if (xfs_iget(mp, NULL, mp->m_sb.sb_gquotino,
-                                        0, 0, &gip, 0) == 0)
+                                        0, 0, &gip) == 0)
                         tempgqip = B_TRUE;
         }
         if (uip) {
@@ -1109,10 +1109,7 @@ xfs_qm_internalqcheck_adjust(
         xfs_ino_t       ino,            /* inode number to get data for */
         void            __user *buffer, /* not used */
         int             ubsize,         /* not used */
-        void            *private_data,  /* not used */
-        xfs_daddr_t     bno,            /* starting block of inode cluster */
         int             *ubused,        /* not used */
-        void            *dip,           /* not used */
         int             *res)           /* bulkstat result code */
 {
         xfs_inode_t             *ip;
@@ -1134,7 +1131,7 @@ xfs_qm_internalqcheck_adjust(
         ipreleased = B_FALSE;
  again:
         lock_flags = XFS_ILOCK_SHARED;
-        if ((error = xfs_iget(mp, NULL, ino, 0, lock_flags, &ip, bno))) {
+        if ((error = xfs_iget(mp, NULL, ino, 0, lock_flags, &ip))) {
                 *res = BULKSTAT_RV_NOTHING;
                 return (error);
         }
@@ -1205,15 +1202,15 @@ xfs_qm_internalqcheck(
                  * Iterate thru all the inodes in the file system,
                  * adjusting the corresponding dquot counters
                  */
-                if ((error = xfs_bulkstat(mp, &lastino, &count,
-                                 xfs_qm_internalqcheck_adjust, NULL,
-                                 0, NULL, BULKSTAT_FG_IGET, &done))) {
+                error = xfs_bulkstat(mp, &lastino, &count,
+                                 xfs_qm_internalqcheck_adjust,
+                                 0, NULL, &done);
+                if (error) {
+                        cmn_err(CE_DEBUG, "Bulkstat returned error 0x%x", error);
                         break;
                 }
-        } while (! done);
-        if (error) {
-                cmn_err(CE_DEBUG, "Bulkstat returned error 0x%x", error);
-        }
+        } while (!done);
+
         cmn_err(CE_DEBUG, "Checking results against system dquots");
         for (i = 0; i < qmtest_hashmask; i++) {
                 xfs_dqtest_t    *d, *n;
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index 5bba29a07812..7f159d2a429a 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -69,7 +69,9 @@ xfs_swapext(
                 goto out;
         }
 
-        if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) {
+        if (!(file->f_mode & FMODE_WRITE) ||
+            !(file->f_mode & FMODE_READ) ||
+            (file->f_flags & O_APPEND)) {
                 error = XFS_ERROR(EBADF);
                 goto out_put_file;
         }
@@ -81,6 +83,7 @@ xfs_swapext(
         }
 
         if (!(tmp_file->f_mode & FMODE_WRITE) ||
+            !(tmp_file->f_mode & FMODE_READ) ||
             (tmp_file->f_flags & O_APPEND)) {
                 error = XFS_ERROR(EBADF);
                 goto out_put_tmp_file;
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index 9d884c127bb9..c7142a064c48 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -1203,6 +1203,63 @@ error0:
         return error;
 }
 
+STATIC int
+xfs_imap_lookup(
+        struct xfs_mount        *mp,
+        struct xfs_trans        *tp,
+        xfs_agnumber_t          agno,
+        xfs_agino_t             agino,
+        xfs_agblock_t           agbno,
+        xfs_agblock_t           *chunk_agbno,
+        xfs_agblock_t           *offset_agbno,
+        int                     flags)
+{
+        struct xfs_inobt_rec_incore rec;
+        struct xfs_btree_cur    *cur;
+        struct xfs_buf          *agbp;
+        xfs_agino_t             startino;
+        int                     error;
+        int                     i;
+
+        error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
+        if (error) {
+                xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
+                                "xfs_ialloc_read_agi() returned "
+                                "error %d, agno %d",
+                                error, agno);
+                return error;
+        }
+
+        /*
+         * derive and lookup the exact inode record for the given agino. If the
+         * record cannot be found, then it's an invalid inode number and we
+         * should abort.
+         */
+        cur = xfs_inobt_init_cursor(mp, tp, agbp, agno);
+        startino = agino & ~(XFS_IALLOC_INODES(mp) - 1);
+        error = xfs_inobt_lookup(cur, startino, XFS_LOOKUP_EQ, &i);
+        if (!error) {
+                if (i)
+                        error = xfs_inobt_get_rec(cur, &rec, &i);
+                if (!error && i == 0)
+                        error = EINVAL;
+        }
+
+        xfs_trans_brelse(tp, agbp);
+        xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
+        if (error)
+                return error;
+
+        /* for untrusted inodes check it is allocated first */
+        if ((flags & XFS_IGET_UNTRUSTED) &&
+            (rec.ir_free & XFS_INOBT_MASK(agino - rec.ir_startino)))
+                return EINVAL;
+
+        *chunk_agbno = XFS_AGINO_TO_AGBNO(mp, rec.ir_startino);
+        *offset_agbno = agbno - *chunk_agbno;
+        return 0;
+}
+
 /*
  * Return the location of the inode in imap, for mapping it into a buffer.
  */
@@ -1235,8 +1292,11 @@ xfs_imap(
         if (agno >= mp->m_sb.sb_agcount || agbno >= mp->m_sb.sb_agblocks ||
             ino != XFS_AGINO_TO_INO(mp, agno, agino)) {
 #ifdef DEBUG
-                /* no diagnostics for bulkstat, ino comes from userspace */
-                if (flags & XFS_IGET_BULKSTAT)
+                /*
+                 * Don't output diagnostic information for untrusted inodes
+                 * as they can be invalid without implying corruption.
+                 */
+                if (flags & XFS_IGET_UNTRUSTED)
                         return XFS_ERROR(EINVAL);
                 if (agno >= mp->m_sb.sb_agcount) {
                         xfs_fs_cmn_err(CE_ALERT, mp,
@@ -1263,6 +1323,23 @@ xfs_imap(
                 return XFS_ERROR(EINVAL);
         }
 
+        blks_per_cluster = XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_blocklog;
+
+        /*
+         * For bulkstat and handle lookups, we have an untrusted inode number
+         * that we have to verify is valid. We cannot do this just by reading
+         * the inode buffer as it may have been unlinked and removed leaving
+         * inodes in stale state on disk. Hence we have to do a btree lookup
+         * in all cases where an untrusted inode number is passed.
+         */
+        if (flags & XFS_IGET_UNTRUSTED) {
+                error = xfs_imap_lookup(mp, tp, agno, agino, agbno,
+                                        &chunk_agbno, &offset_agbno, flags);
+                if (error)
+                        return error;
+                goto out_map;
+        }
+
         /*
          * If the inode cluster size is the same as the blocksize or
          * smaller we get to the buffer by simple arithmetics.
@@ -1277,24 +1354,6 @@ xfs_imap(
                 return 0;
         }
 
-        blks_per_cluster = XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_blocklog;
-
-        /*
-         * If we get a block number passed from bulkstat we can use it to
-         * find the buffer easily.
-         */
-        if (imap->im_blkno) {
-                offset = XFS_INO_TO_OFFSET(mp, ino);
-                ASSERT(offset < mp->m_sb.sb_inopblock);
-
-                cluster_agbno = xfs_daddr_to_agbno(mp, imap->im_blkno);
-                offset += (agbno - cluster_agbno) * mp->m_sb.sb_inopblock;
-
-                imap->im_len = XFS_FSB_TO_BB(mp, blks_per_cluster);
-                imap->im_boffset = (ushort)(offset << mp->m_sb.sb_inodelog);
-                return 0;
-        }
-
         /*
          * If the inode chunks are aligned then use simple maths to
          * find the location. Otherwise we have to do a btree
@@ -1304,50 +1363,13 @@ xfs_imap(
                 offset_agbno = agbno & mp->m_inoalign_mask;
                 chunk_agbno = agbno - offset_agbno;
         } else {
-                xfs_btree_cur_t *cur;   /* inode btree cursor */
-                xfs_inobt_rec_incore_t chunk_rec;
-                xfs_buf_t       *agbp;  /* agi buffer */
-                int             i;      /* temp state */
-
-                error = xfs_ialloc_read_agi(mp, tp, agno, &agbp);
-                if (error) {
-                        xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
-                                        "xfs_ialloc_read_agi() returned "
-                                        "error %d, agno %d",
-                                        error, agno);
-                        return error;
-                }
-
-                cur = xfs_inobt_init_cursor(mp, tp, agbp, agno);
-                error = xfs_inobt_lookup(cur, agino, XFS_LOOKUP_LE, &i);
-                if (error) {
-                        xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
-                                        "xfs_inobt_lookup() failed");
-                        goto error0;
-                }
-
-                error = xfs_inobt_get_rec(cur, &chunk_rec, &i);
-                if (error) {
-                        xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
-                                        "xfs_inobt_get_rec() failed");
-                        goto error0;
-                }
-                if (i == 0) {
-#ifdef DEBUG
-                        xfs_fs_cmn_err(CE_ALERT, mp, "xfs_imap: "
-                                        "xfs_inobt_get_rec() failed");
-#endif /* DEBUG */
-                        error = XFS_ERROR(EINVAL);
-                }
- error0:
-                xfs_trans_brelse(tp, agbp);
-                xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
+                error = xfs_imap_lookup(mp, tp, agno, agino, agbno,
+                                        &chunk_agbno, &offset_agbno, flags);
                 if (error)
                         return error;
-                chunk_agbno = XFS_AGINO_TO_AGBNO(mp, chunk_rec.ir_startino);
-                offset_agbno = agbno - chunk_agbno;
         }
 
+out_map:
         ASSERT(agbno >= chunk_agbno);
         cluster_agbno = chunk_agbno +
                 ((offset_agbno / blks_per_cluster) * blks_per_cluster);
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index 75df75f43d48..8f8b91be2c99 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -259,7 +259,6 @@ xfs_iget_cache_miss(
         xfs_trans_t             *tp,
         xfs_ino_t               ino,
         struct xfs_inode        **ipp,
-        xfs_daddr_t             bno,
         int                     flags,
         int                     lock_flags)
 {
@@ -272,7 +271,7 @@ xfs_iget_cache_miss(
         if (!ip)
                 return ENOMEM;
 
-        error = xfs_iread(mp, tp, ip, bno, flags);
+        error = xfs_iread(mp, tp, ip, flags);
         if (error)
                 goto out_destroy;
 
@@ -358,8 +357,6 @@ out_destroy:
  *        within the file system for the inode being requested.
  * lock_flags -- flags indicating how to lock the inode.  See the comment
  *               for xfs_ilock() for a list of valid values.
- * bno -- the block number starting the buffer containing the inode,
- *        if known (as by bulkstat), else 0.
  */
 int
 xfs_iget(
@@ -368,8 +365,7 @@ xfs_iget(
         xfs_ino_t       ino,
         uint            flags,
         uint            lock_flags,
-        xfs_inode_t     **ipp,
-        xfs_daddr_t     bno)
+        xfs_inode_t     **ipp)
 {
         xfs_inode_t     *ip;
         int             error;
@@ -397,7 +393,7 @@ again:
                 read_unlock(&pag->pag_ici_lock);
                 XFS_STATS_INC(xs_ig_missed);
 
-                error = xfs_iget_cache_miss(mp, pag, tp, ino, &ip, bno,
+                error = xfs_iget_cache_miss(mp, pag, tp, ino, &ip,
                                                         flags, lock_flags);
                 if (error)
                         goto out_error_or_again;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index d53c39de7d05..b76a829d7e20 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -177,7 +177,7 @@ xfs_imap_to_bp(
                 if (unlikely(XFS_TEST_ERROR(!di_ok, mp,
                                                 XFS_ERRTAG_ITOBP_INOTOBP,
                                                 XFS_RANDOM_ITOBP_INOTOBP))) {
-                        if (iget_flags & XFS_IGET_BULKSTAT) {
+                        if (iget_flags & XFS_IGET_UNTRUSTED) {
                                 xfs_trans_brelse(tp, bp);
                                 return XFS_ERROR(EINVAL);
                         }
@@ -787,7 +787,6 @@ xfs_iread(
         xfs_mount_t     *mp,
         xfs_trans_t     *tp,
         xfs_inode_t     *ip,
-        xfs_daddr_t     bno,
         uint            iget_flags)
 {
         xfs_buf_t       *bp;
@@ -797,11 +796,9 @@ xfs_iread(
         /*
          * Fill in the location information in the in-core inode.
          */
-        ip->i_imap.im_blkno = bno;
         error = xfs_imap(mp, tp, ip->i_ino, &ip->i_imap, iget_flags);
         if (error)
                 return error;
-        ASSERT(bno == 0 || bno == ip->i_imap.im_blkno);
 
         /*
          * Get pointers to the on-disk inode and the buffer containing it.
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 9965e40a4615..78550df13cd6 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -442,7 +442,7 @@ static inline void xfs_ifunlock(xfs_inode_t *ip)
  * xfs_iget.c prototypes.
  */
 int             xfs_iget(struct xfs_mount *, struct xfs_trans *, xfs_ino_t,
-                         uint, uint, xfs_inode_t **, xfs_daddr_t);
+                         uint, uint, xfs_inode_t **);
 void            xfs_iput(xfs_inode_t *, uint);
 void            xfs_iput_new(xfs_inode_t *, uint);
 void            xfs_ilock(xfs_inode_t *, uint);
@@ -500,7 +500,7 @@ do { \
  * Flags for xfs_iget()
  */
 #define XFS_IGET_CREATE         0x1
-#define XFS_IGET_BULKSTAT       0x2
+#define XFS_IGET_UNTRUSTED      0x2
 
 int             xfs_inotobp(struct xfs_mount *, struct xfs_trans *,
                             xfs_ino_t, struct xfs_dinode **,
@@ -509,7 +509,7 @@ int		xfs_itobp(struct xfs_mount *, struct xfs_trans *,
                           struct xfs_inode *, struct xfs_dinode **,
                           struct xfs_buf **, uint);
 int             xfs_iread(struct xfs_mount *, struct xfs_trans *,
-                          struct xfs_inode *, xfs_daddr_t, uint);
+                          struct xfs_inode *, uint);
 void            xfs_dinode_to_disk(struct xfs_dinode *,
                                    struct xfs_icdinode *);
 void            xfs_idestroy_fork(struct xfs_inode *, int);
diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index b1b801e4a28e..2b86f8610512 100644
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -49,24 +49,40 @@ xfs_internal_inum(
                  (ino == mp->m_sb.sb_uquotino || ino == mp->m_sb.sb_gquotino)));
 }
 
-STATIC int
-xfs_bulkstat_one_iget(
-        xfs_mount_t     *mp,            /* mount point for filesystem */
-        xfs_ino_t       ino,            /* inode number to get data for */
-        xfs_daddr_t     bno,            /* starting bno of inode cluster */
-        xfs_bstat_t     *buf,           /* return buffer */
-        int             *stat)          /* BULKSTAT_RV_... */
+/*
+ * Return stat information for one inode.
+ * Return 0 if ok, else errno.
+ */
+int
+xfs_bulkstat_one_int(
+        struct xfs_mount        *mp,            /* mount point for filesystem */
+        xfs_ino_t               ino,            /* inode to get data for */
+        void __user             *buffer,        /* buffer to place output in */
+        int                     ubsize,         /* size of buffer */
+        bulkstat_one_fmt_pf     formatter,      /* formatter, copy to user */
+        int                     *ubused,        /* bytes used by me */
+        int                     *stat)          /* BULKSTAT_RV_... */
 {
-        xfs_icdinode_t  *dic;   /* dinode core info pointer */
-        xfs_inode_t     *ip;            /* incore inode pointer */
-        struct inode    *inode;
-        int             error;
+        struct xfs_icdinode     *dic;           /* dinode core info pointer */
+        struct xfs_inode        *ip;            /* incore inode pointer */
+        struct inode            *inode;
+        struct xfs_bstat        *buf;           /* return buffer */
+        int                     error = 0;      /* error value */
+
+        *stat = BULKSTAT_RV_NOTHING;
+
+        if (!buffer || xfs_internal_inum(mp, ino))
+                return XFS_ERROR(EINVAL);
+
+        buf = kmem_alloc(sizeof(*buf), KM_SLEEP | KM_MAYFAIL);
+        if (!buf)
+                return XFS_ERROR(ENOMEM);
 
         error = xfs_iget(mp, NULL, ino,
-                         XFS_IGET_BULKSTAT, XFS_ILOCK_SHARED, &ip, bno);
+                         XFS_IGET_UNTRUSTED, XFS_ILOCK_SHARED, &ip);
         if (error) {
                 *stat = BULKSTAT_RV_NOTHING;
-                return error;
+                goto out_free;
         }
 
         ASSERT(ip != NULL);
@@ -127,77 +143,16 @@ xfs_bulkstat_one_iget(
                 buf->bs_blocks = dic->di_nblocks + ip->i_delayed_blks;
                 break;
         }
-
         xfs_iput(ip, XFS_ILOCK_SHARED);
-        return error;
-}
 
-STATIC void
-xfs_bulkstat_one_dinode(
-        xfs_mount_t     *mp,            /* mount point for filesystem */
-        xfs_ino_t       ino,            /* inode number to get data for */
-        xfs_dinode_t    *dic,           /* dinode inode pointer */
-        xfs_bstat_t     *buf)           /* return buffer */
-{
-        /*
-         * The inode format changed when we moved the link count and
-         * made it 32 bits long.  If this is an old format inode,
-         * convert it in memory to look like a new one.  If it gets
-         * flushed to disk we will convert back before flushing or
-         * logging it.  We zero out the new projid field and the old link
-         * count field.  We'll handle clearing the pad field (the remains
-         * of the old uuid field) when we actually convert the inode to
-         * the new format. We don't change the version number so that we
-         * can distinguish this from a real new format inode.
-         */
-        if (dic->di_version == 1) {
-                buf->bs_nlink = be16_to_cpu(dic->di_onlink);
-                buf->bs_projid = 0;
-        } else {
-                buf->bs_nlink = be32_to_cpu(dic->di_nlink);
-                buf->bs_projid = be16_to_cpu(dic->di_projid);
-        }
+        error = formatter(buffer, ubsize, ubused, buf);
 
-        buf->bs_ino = ino;
-        buf->bs_mode = be16_to_cpu(dic->di_mode);
-        buf->bs_uid = be32_to_cpu(dic->di_uid);
-        buf->bs_gid = be32_to_cpu(dic->di_gid);
-        buf->bs_size = be64_to_cpu(dic->di_size);
-        buf->bs_atime.tv_sec = be32_to_cpu(dic->di_atime.t_sec);
-        buf->bs_atime.tv_nsec = be32_to_cpu(dic->di_atime.t_nsec);
-        buf->bs_mtime.tv_sec = be32_to_cpu(dic->di_mtime.t_sec);
-        buf->bs_mtime.tv_nsec = be32_to_cpu(dic->di_mtime.t_nsec);
-        buf->bs_ctime.tv_sec = be32_to_cpu(dic->di_ctime.t_sec);
-        buf->bs_ctime.tv_nsec = be32_to_cpu(dic->di_ctime.t_nsec);
-        buf->bs_xflags = xfs_dic2xflags(dic);
-        buf->bs_extsize = be32_to_cpu(dic->di_extsize) << mp->m_sb.sb_blocklog;
-        buf->bs_extents = be32_to_cpu(dic->di_nextents);
-        buf->bs_gen = be32_to_cpu(dic->di_gen);
-        memset(buf->bs_pad, 0, sizeof(buf->bs_pad));
-        buf->bs_dmevmask = be32_to_cpu(dic->di_dmevmask);
-        buf->bs_dmstate = be16_to_cpu(dic->di_dmstate);
-        buf->bs_aextents = be16_to_cpu(dic->di_anextents);
-        buf->bs_forkoff = XFS_DFORK_BOFF(dic);
+        if (!error)
+                *stat = BULKSTAT_RV_DIDONE;
 
-        switch (dic->di_format) {
-        case XFS_DINODE_FMT_DEV:
-                buf->bs_rdev = xfs_dinode_get_rdev(dic);
-                buf->bs_blksize = BLKDEV_IOSIZE;
-                buf->bs_blocks = 0;
-                break;
-        case XFS_DINODE_FMT_LOCAL:
-        case XFS_DINODE_FMT_UUID:
-                buf->bs_rdev = 0;
-                buf->bs_blksize = mp->m_sb.sb_blocksize;
-                buf->bs_blocks = 0;
-                break;
-        case XFS_DINODE_FMT_EXTENTS:
-        case XFS_DINODE_FMT_BTREE:
-                buf->bs_rdev = 0;
-                buf->bs_blksize = mp->m_sb.sb_blocksize;
-                buf->bs_blocks = be64_to_cpu(dic->di_nblocks);
-                break;
-        }
+ out_free:
+        kmem_free(buf);
+        return error;
 }
 
 /* Return 0 on success or positive error */
@@ -217,118 +172,17 @@ xfs_bulkstat_one_fmt(
         return 0;
 }
 
-/*
- * Return stat information for one inode.
- * Return 0 if ok, else errno.
- */
-int                                     /* error status */
-xfs_bulkstat_one_int(
-        xfs_mount_t     *mp,            /* mount point for filesystem */
-        xfs_ino_t       ino,            /* inode number to get data for */
-        void            __user *buffer, /* buffer to place output in */
-        int             ubsize,         /* size of buffer */
-        bulkstat_one_fmt_pf formatter,  /* formatter, copy to user */
-        xfs_daddr_t     bno,            /* starting bno of inode cluster */
-        int             *ubused,        /* bytes used by me */
-        void            *dibuff,        /* on-disk inode buffer */
-        int             *stat)          /* BULKSTAT_RV_... */
-{
-        xfs_bstat_t     *buf;           /* return buffer */
-        int             error = 0;      /* error value */
-        xfs_dinode_t    *dip;           /* dinode inode pointer */
-
-        dip = (xfs_dinode_t *)dibuff;
-        *stat = BULKSTAT_RV_NOTHING;
-
-        if (!buffer || xfs_internal_inum(mp, ino))
-                return XFS_ERROR(EINVAL);
-
-        buf = kmem_alloc(sizeof(*buf), KM_SLEEP);
-
-        if (dip == NULL) {
-                /* We're not being passed a pointer to a dinode.  This happens
-                 * if BULKSTAT_FG_IGET is selected.  Do the iget.
-                 */
-                error = xfs_bulkstat_one_iget(mp, ino, bno, buf, stat);
-                if (error)
-                        goto out_free;
-        } else {
-                xfs_bulkstat_one_dinode(mp, ino, dip, buf);
-        }
-
-        error = formatter(buffer, ubsize, ubused, buf);
-        if (error)
-                goto out_free;
-
-        *stat = BULKSTAT_RV_DIDONE;
-
- out_free:
-        kmem_free(buf);
-        return error;
-}
-
 int
 xfs_bulkstat_one(
         xfs_mount_t     *mp,            /* mount point for filesystem */
         xfs_ino_t       ino,            /* inode number to get data for */
         void            __user *buffer, /* buffer to place output in */
         int             ubsize,         /* size of buffer */
-        void            *private_data,  /* my private data */
-        xfs_daddr_t     bno,            /* starting bno of inode cluster */
         int             *ubused,        /* bytes used by me */
-        void            *dibuff,        /* on-disk inode buffer */
         int             *stat)          /* BULKSTAT_RV_... */
 {
         return xfs_bulkstat_one_int(mp, ino, buffer, ubsize,
-                                    xfs_bulkstat_one_fmt, bno,
-                                    ubused, dibuff, stat);
-}
-
-/*
- * Test to see whether we can use the ondisk inode directly, based
- * on the given bulkstat flags, filling in dipp accordingly.
- * Returns zero if the inode is dodgey.
- */
-STATIC int
-xfs_bulkstat_use_dinode(
-        xfs_mount_t     *mp,
-        int             flags,
-        xfs_buf_t       *bp,
-        int             clustidx,
-        xfs_dinode_t    **dipp)
-{
-        xfs_dinode_t    *dip;
-        unsigned int    aformat;
-
-        *dipp = NULL;
-        if (!bp || (flags & BULKSTAT_FG_IGET))
-                return 1;
-        dip = (xfs_dinode_t *)
-                        xfs_buf_offset(bp, clustidx << mp->m_sb.sb_inodelog);
-        /*
-         * Check the buffer containing the on-disk inode for di_mode == 0.
-         * This is to prevent xfs_bulkstat from picking up just reclaimed
-         * inodes that have their in-core state initialized but not flushed
-         * to disk yet. This is a temporary hack that would require a proper
-         * fix in the future.
-         */
-        if (be16_to_cpu(dip->di_magic) != XFS_DINODE_MAGIC ||
-            !XFS_DINODE_GOOD_VERSION(dip->di_version) ||
-            !dip->di_mode)
-                return 0;
-        if (flags & BULKSTAT_FG_QUICK) {
-                *dipp = dip;
-                return 1;
-        }
-        /* BULKSTAT_FG_INLINE: if attr fork is local, or not there, use it */
-        aformat = dip->di_aformat;
-        if ((XFS_DFORK_Q(dip) == 0) ||
-            (aformat == XFS_DINODE_FMT_LOCAL) ||
-            (aformat == XFS_DINODE_FMT_EXTENTS && !dip->di_anextents)) {
-                *dipp = dip;
-                return 1;
-        }
-        return 1;
+                                    xfs_bulkstat_one_fmt, ubused, stat);
 }
 
 #define XFS_BULKSTAT_UBLEFT(ubleft)     ((ubleft) >= statstruct_size)
@@ -342,10 +196,8 @@ xfs_bulkstat(
         xfs_ino_t               *lastinop, /* last inode returned */
         int                     *ubcountp, /* size of buffer/count returned */
         bulkstat_one_pf         formatter, /* func that'd fill a single buf */
-        void                    *private_data,/* private data for formatter */
         size_t                  statstruct_size, /* sizeof struct filling */
         char                    __user *ubuffer, /* buffer with inode stats */
-        int                     flags,  /* defined in xfs_itable.h */
         int                     *done)  /* 1 if there are more stats to get */
 {
         xfs_agblock_t           agbno=0;/* allocation group block number */
@@ -380,14 +232,12 @@ xfs_bulkstat(
         int                     ubelem; /* spaces used in user's buffer */
         int                     ubused; /* bytes used by formatter */
         xfs_buf_t               *bp;    /* ptr to on-disk inode cluster buf */
-        xfs_dinode_t            *dip;   /* ptr into bp for specific inode */
 
         /*
          * Get the last inode value, see if there's nothing to do.
          */
         ino = (xfs_ino_t)*lastinop;
         lastino = ino;
-        dip = NULL;
         agno = XFS_INO_TO_AGNO(mp, ino);
         agino = XFS_INO_TO_AGINO(mp, ino);
         if (agno >= mp->m_sb.sb_agcount ||
@@ -612,37 +462,6 @@ xfs_bulkstat(
                                                         irbp->ir_startino) +
                                                 ((chunkidx & nimask) >>
                                                  mp->m_sb.sb_inopblog);
-
-                                        if (flags & (BULKSTAT_FG_QUICK |
-                                                     BULKSTAT_FG_INLINE)) {
-                                                int offset;
-
-                                                ino = XFS_AGINO_TO_INO(mp, agno,
-                                                                       agino);
-                                                bno = XFS_AGB_TO_DADDR(mp, agno,
-                                                                       agbno);
-
-                                                /*
-                                                 * Get the inode cluster buffer
-                                                 */
-                                                if (bp)
-                                                        xfs_buf_relse(bp);
-
-                                                error = xfs_inotobp(mp, NULL, ino, &dip,
-                                                                    &bp, &offset,
-                                                                    XFS_IGET_BULKSTAT);
-
-                                                if (!error)
-                                                        clustidx = offset / mp->m_sb.sb_inodesize;
-                                                if (XFS_TEST_ERROR(error != 0,
-                                                                   mp, XFS_ERRTAG_BULKSTAT_READ_CHUNK,
-                                                                   XFS_RANDOM_BULKSTAT_READ_CHUNK)) {
-                                                        bp = NULL;
-                                                        ubleft = 0;
-                                                        rval = error;
-                                                        break;
-                                                }
-                                        }
                                 }
                                 ino = XFS_AGINO_TO_INO(mp, agno, agino);
                                 bno = XFS_AGB_TO_DADDR(mp, agno, agbno);
@@ -658,35 +477,13 @@ xfs_bulkstat(
                                  * when the chunk is used up.
                                  */
                                 irbp->ir_freecount++;
-                                if (!xfs_bulkstat_use_dinode(mp, flags, bp,
-                                                             clustidx, &dip)) {
-                                        lastino = ino;
-                                        continue;
-                                }
-                                /*
-                                 * If we need to do an iget, cannot hold bp.
-                                 * Drop it, until starting the next cluster.
-                                 */
-                                if ((flags & BULKSTAT_FG_INLINE) && !dip) {
-                                        if (bp)
-                                                xfs_buf_relse(bp);
-                                        bp = NULL;
-                                }
 
                                 /*
                                  * Get the inode and fill in a single buffer.
-                                 * BULKSTAT_FG_QUICK uses dip to fill it in.
-                                 * BULKSTAT_FG_IGET uses igets.
-                                 * BULKSTAT_FG_INLINE uses dip if we have an
-                                 * inline attr fork, else igets.
-                                 * See: xfs_bulkstat_one & xfs_dm_bulkstat_one.
-                                 * This is also used to count inodes/blks, etc
-                                 * in xfs_qm_quotacheck.
                                  */
                                 ubused = statstruct_size;
-                                error = formatter(mp, ino, ubufp,
-                                                ubleft, private_data,
-                                                bno, &ubused, dip, &fmterror);
+                                error = formatter(mp, ino, ubufp, ubleft,
+                                                  &ubused, &fmterror);
                                 if (fmterror == BULKSTAT_RV_NOTHING) {
                                         if (error && error != ENOENT &&
                                                 error != EINVAL) {
@@ -778,8 +575,7 @@ xfs_bulkstat_single(
          */
 
         ino = (xfs_ino_t)*lastinop;
-        error = xfs_bulkstat_one(mp, ino, buffer, sizeof(xfs_bstat_t),
-                                 NULL, 0, NULL, NULL, &res);
+        error = xfs_bulkstat_one(mp, ino, buffer, sizeof(xfs_bstat_t), 0, &res);
         if (error) {
                 /*
                  * Special case way failed, do it the "long" way
@@ -788,8 +584,7 @@ xfs_bulkstat_single(
                 (*lastinop)--;
                 count = 1;
                 if (xfs_bulkstat(mp, lastinop, &count, xfs_bulkstat_one,
-                                NULL, sizeof(xfs_bstat_t), buffer,
-                                BULKSTAT_FG_IGET, done))
+                                sizeof(xfs_bstat_t), buffer, done))
                         return error;
                 if (count == 0 || (xfs_ino_t)*lastinop != ino)
                         return error == EFSCORRUPTED ?
diff --git a/fs/xfs/xfs_itable.h b/fs/xfs/xfs_itable.h
index 20792bf45946..97295d91d170 100644
--- a/fs/xfs/xfs_itable.h
+++ b/fs/xfs/xfs_itable.h
@@ -27,10 +27,7 @@ typedef int (*bulkstat_one_pf)(struct xfs_mount	*mp,
                                xfs_ino_t        ino,
                                void             __user *buffer,
                                int              ubsize,
-                               void             *private_data,
-                               xfs_daddr_t      bno,
                                int              *ubused,
-                               void             *dip,
                                int              *stat);
 
 /*
@@ -41,13 +38,6 @@ typedef int (*bulkstat_one_pf)(struct xfs_mount	*mp,
 #define BULKSTAT_RV_GIVEUP      2
 
 /*
- * Values for bulkstat flag argument.
- */
-#define BULKSTAT_FG_IGET        0x1     /* Go through the buffer cache */
-#define BULKSTAT_FG_QUICK       0x2     /* No iget, walk the dinode cluster */
-#define BULKSTAT_FG_INLINE      0x4     /* No iget if inline attrs */
-
-/*
  * Return stat information in bulk (by-inode) for the filesystem.
  */
 int                                     /* error status */
@@ -56,10 +46,8 @@ xfs_bulkstat(
         xfs_ino_t       *lastino,       /* last inode returned */
         int             *count,         /* size of buffer/count returned */
         bulkstat_one_pf formatter,      /* func that'd fill a single buf */
-        void            *private_data,  /* private data for formatter */
         size_t          statstruct_size,/* sizeof struct that we're filling */
         char            __user *ubuffer,/* buffer with inode stats */
-        int             flags,          /* flag to control access method */
         int             *done);         /* 1 if there are more stats to get */
 
 int
@@ -82,9 +70,7 @@ xfs_bulkstat_one_int(
         void                    __user *buffer,
         int                     ubsize,
         bulkstat_one_fmt_pf     formatter,
-        xfs_daddr_t             bno,
         int                     *ubused,
-        void                    *dibuff,
         int                     *stat);
 
 int
@@ -93,10 +79,7 @@ xfs_bulkstat_one(
         xfs_ino_t               ino,
         void                    __user *buffer,
         int                     ubsize,
-        void                    *private_data,
-        xfs_daddr_t             bno,
         int                     *ubused,
-        void                    *dibuff,
         int                     *stat);
 
 typedef int (*inumbers_fmt_pf)(
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index ed0684cc50ee..9ac5cfab27b9 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -3198,7 +3198,7 @@ xlog_recover_process_one_iunlink(
         int                             error;
 
         ino = XFS_AGINO_TO_INO(mp, agno, agino);
-        error = xfs_iget(mp, NULL, ino, 0, 0, &ip, 0);
+        error = xfs_iget(mp, NULL, ino, 0, 0, &ip);
         if (error)
                 goto fail;
 
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index d59f4e8bedcf..69f62d8b2816 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -1300,7 +1300,7 @@ xfs_mountfs(
          * Get and sanity-check the root inode.
          * Save the pointer to it in the mount structure.
          */
-        error = xfs_iget(mp, NULL, sbp->sb_rootino, 0, XFS_ILOCK_EXCL, &rip, 0);
+        error = xfs_iget(mp, NULL, sbp->sb_rootino, 0, XFS_ILOCK_EXCL, &rip);
         if (error) {
                 cmn_err(CE_WARN, "XFS: failed to read root inode");
                 goto out_log_dealloc;
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 16445518506d..a2d32ce335aa 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -2277,12 +2277,12 @@ xfs_rtmount_inodes(
         sbp = &mp->m_sb;
         if (sbp->sb_rbmino == NULLFSINO)
                 return 0;
-        error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip, 0);
+        error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip);
         if (error)
                 return error;
         ASSERT(mp->m_rbmip != NULL);
         ASSERT(sbp->sb_rsumino != NULLFSINO);
-        error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip, 0);
+        error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip);
         if (error) {
                 IRELE(mp->m_rbmip);
                 return error;
diff --git a/fs/xfs/xfs_trans_inode.c b/fs/xfs/xfs_trans_inode.c
index 785ff101da0a..2559dfec946b 100644
--- a/fs/xfs/xfs_trans_inode.c
+++ b/fs/xfs/xfs_trans_inode.c
@@ -62,7 +62,7 @@ xfs_trans_iget(
 {
         int                     error;
 
-        error = xfs_iget(mp, tp, ino, flags, lock_flags, ipp, 0);
+        error = xfs_iget(mp, tp, ino, flags, lock_flags, ipp);
         if (!error && tp)
                 xfs_trans_ijoin(tp, *ipp, lock_flags);
         return error;
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index a06bd62504fc..c1646838898f 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -1269,7 +1269,7 @@ xfs_lookup(
         if (error)
                 goto out;
 
-        error = xfs_iget(dp->i_mount, NULL, inum, 0, 0, ipp, 0);
+        error = xfs_iget(dp->i_mount, NULL, inum, 0, 0, ipp);
         if (error)
                 goto out_free_name;
 
diff --git a/include/acpi/acexcep.h b/include/acpi/acexcep.h
index 5958d7845bd5..17714beb868e 100644
--- a/include/acpi/acexcep.h
+++ b/include/acpi/acexcep.h
@@ -212,7 +212,7 @@ char const *acpi_gbl_exception_names_env[] = {
         "AE_NO_GLOBAL_LOCK",
         "AE_ABORT_METHOD",
         "AE_SAME_HANDLER",
-        "AE_WAKE_ONLY_GPE",
+        "AE_NO_HANDLER",
         "AE_OWNER_ID_LIMIT"
 };
 
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index 0e4ab1fe5966..1371cc997393 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -69,6 +69,7 @@ extern acpi_name acpi_gbl_trace_method_name;
 extern u32 acpi_gbl_trace_flags;
 extern u8 acpi_gbl_enable_aml_debug_object;
 extern u8 acpi_gbl_copy_dsdt_locally;
+extern u8 acpi_gbl_truncate_io_addresses;
 
 extern u32 acpi_current_gpe_count;
 extern struct acpi_table_fadt acpi_gbl_FADT;
diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
index bade172cad47..d55f4a7b824d 100644
--- a/include/acpi/actypes.h
+++ b/include/acpi/actypes.h
@@ -663,10 +663,11 @@ typedef u32 acpi_event_status;
 #define ACPI_GPE_MAX                    0xFF
 #define ACPI_NUM_GPE                    256
 
-/* Actions for acpi_set_gpe */
+/* Actions for acpi_set_gpe and acpi_hw_low_set_gpe */
 
 #define ACPI_GPE_ENABLE                 0
 #define ACPI_GPE_DISABLE                1
+#define ACPI_GPE_COND_ENABLE            2
 
 /* gpe_types for acpi_enable_gpe and acpi_disable_gpe */
 
diff --git a/include/drm/radeon_drm.h b/include/drm/radeon_drm.h
index 3ff9fc071dfe..5347063e9d5a 100644
--- a/include/drm/radeon_drm.h
+++ b/include/drm/radeon_drm.h
@@ -903,6 +903,7 @@ struct drm_radeon_cs {
 #define RADEON_INFO_NUM_Z_PIPES         0x02
 #define RADEON_INFO_ACCEL_WORKING       0x03
 #define RADEON_INFO_CRTC_FROM_ID        0x04
+#define RADEON_INFO_ACCEL_WORKING2      0x05
 
 struct drm_radeon_info {
         uint32_t                request;
diff --git a/include/drm/ttm/ttm_page_alloc.h b/include/drm/ttm/ttm_page_alloc.h
index 8bb4de567b2c..116821448c38 100644
--- a/include/drm/ttm/ttm_page_alloc.h
+++ b/include/drm/ttm/ttm_page_alloc.h
@@ -56,10 +56,6 @@ void ttm_put_pages(struct list_head *pages,
                    enum ttm_caching_state cstate);
 /**
  * Initialize pool allocator.
- *
- * Pool allocator is internaly reference counted so it can be initialized
- * multiple times but ttm_page_alloc_fini has to be called same number of
- * times.
  */
 int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages);
 /**
diff --git a/include/linux/agp_backend.h b/include/linux/agp_backend.h
index 9101ed64f803..09ea4a1e9505 100644
--- a/include/linux/agp_backend.h
+++ b/include/linux/agp_backend.h
@@ -79,7 +79,6 @@ struct agp_memory {
         u32 physical;
         bool is_bound;
         bool is_flushed;
-        bool vmalloc_flag;
         /* list of agp_memory mapped to the aperture */
         struct list_head mapped_list;
         /* DMA-mapped addresses */
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index aee5f6ce166e..e9aec0d099df 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -82,8 +82,6 @@ struct backing_dev_info {
         struct bdi_writeback wb;  /* default writeback info for this bdi */
         spinlock_t wb_lock;       /* protects update side of wb_list */
         struct list_head wb_list; /* the flusher threads hanging off this bdi */
-        unsigned long wb_mask;    /* bitmask of registered tasks */
-        unsigned int wb_cnt;      /* number of registered tasks */
 
         struct list_head work_list;
 
@@ -105,8 +103,8 @@ int bdi_register(struct backing_dev_info *bdi, struct device *parent,
 int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev);
 void bdi_unregister(struct backing_dev_info *bdi);
 int bdi_setup_and_register(struct backing_dev_info *, char *, unsigned int);
-void bdi_start_writeback(struct backing_dev_info *bdi, struct super_block *sb,
-                                long nr_pages);
+void bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages);
+void bdi_start_background_writeback(struct backing_dev_info *bdi);
 int bdi_writeback_task(struct bdi_writeback *wb);
 int bdi_has_dirty_io(struct backing_dev_info *bdi);
 void bdi_arm_supers_timer(void);
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 0c621604baa1..e3d00fdb858d 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -525,13 +525,21 @@ static inline struct cgroup_subsys_state *cgroup_subsys_state(
         return cgrp->subsys[subsys_id];
 }
 
-static inline struct cgroup_subsys_state *task_subsys_state(
-        struct task_struct *task, int subsys_id)
+/*
+ * function to get the cgroup_subsys_state which allows for extra
+ * rcu_dereference_check() conditions, such as locks used during the
+ * cgroup_subsys::attach() methods.
+ */
+#define task_subsys_state_check(task, subsys_id, __c)                   \
+        rcu_dereference_check(task->cgroups->subsys[subsys_id],         \
+                              rcu_read_lock_held() ||                   \
+                              lockdep_is_held(&task->alloc_lock) ||     \
+                              cgroup_lock_is_held() || (__c))
+
+static inline struct cgroup_subsys_state *
+task_subsys_state(struct task_struct *task, int subsys_id)
 {
-        return rcu_dereference_check(task->cgroups->subsys[subsys_id],
-                                     rcu_read_lock_held() ||
-                                     lockdep_is_held(&task->alloc_lock) ||
-                                     cgroup_lock_is_held());
+        return task_subsys_state_check(task, subsys_id, false);
 }
 
 static inline struct cgroup* task_cgroup(struct task_struct *task,
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 73dcf804bc94..0da5b187f124 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -58,8 +58,12 @@
  * naked functions because then mcount is called without stack and frame pointer
  * being set up and there is no chance to restore the lr register to the value
  * before mcount was called.
+ *
+ * The asm() bodies of naked functions often depend on standard calling conventions,
+ * therefore they must be noinline and noclone.  GCC 4.[56] currently fail to enforce
+ * this, so we must do so ourselves.  See GCC PR44290.
  */
-#define __naked                         __attribute__((naked)) notrace
+#define __naked                         __attribute__((naked)) noinline __noclone notrace
 
 #define __noreturn                      __attribute__((noreturn))
 
@@ -85,3 +89,7 @@
 #define _gcc_header(x) __gcc_header(linux/compiler-gcc##x.h)
 #define gcc_header(x) _gcc_header(x)
 #include gcc_header(__GNUC__)
+
+#if !defined(__noclone)
+#define __noclone       /* not needed */
+#endif
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index 94dea3ffbfa1..fcfa5b9a4317 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -48,6 +48,10 @@
  * unreleased.  Really, we need to have autoconf for the kernel.
  */
 #define unreachable() __builtin_unreachable()
+
+/* Mark a function definition as prohibited from being cloned. */
+#define __noclone       __attribute__((__noclone__))
+
 #endif
 
 #endif
diff --git a/include/linux/drbd.h b/include/linux/drbd.h
index 30da4ae48972..b8d2516668aa 100644
--- a/include/linux/drbd.h
+++ b/include/linux/drbd.h
@@ -53,7 +53,7 @@
 
 
 extern const char *drbd_buildtag(void);
-#define REL_VERSION "8.3.8rc2"
+#define REL_VERSION "8.3.8"
 #define API_VERSION 88
 #define PRO_VERSION_MIN 86
 #define PRO_VERSION_MAX 94
diff --git a/include/linux/dynamic_debug.h b/include/linux/dynamic_debug.h
index b3cd4de9432b..52c0da4bdd18 100644
--- a/include/linux/dynamic_debug.h
+++ b/include/linux/dynamic_debug.h
@@ -40,7 +40,7 @@ int ddebug_add_module(struct _ddebug *tab, unsigned int n,
                                 const char *modname);
 
 #if defined(CONFIG_DYNAMIC_DEBUG)
-extern int ddebug_remove_module(char *mod_name);
+extern int ddebug_remove_module(const char *mod_name);
 
 #define __dynamic_dbg_enabled(dd)  ({        \
         int __ret = 0;                                                       \
@@ -73,7 +73,7 @@ extern int ddebug_remove_module(char *mod_name);
 
 #else
 
-static inline int ddebug_remove_module(char *mod)
+static inline int ddebug_remove_module(const char *mod)
 {
         return 0;
 }
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index 276b40a16835..b4207ca3ad52 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -379,6 +379,8 @@ struct ethtool_rxnfc {
         __u32                           flow_type;
         /* The rx flow hash value or the rule DB size */
         __u64                           data;
+        /* The following fields are not valid and must not be used for
+         * the ETHTOOL_{G,X}RXFH commands. */
         struct ethtool_rx_flow_spec     fs;
         __u32                           rule_cnt;
         __u32                           rule_locs[0];
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 907ace3a64c8..8e5a9dfb76bf 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -786,8 +786,6 @@ struct fb_tile_ops {
 #define FBINFO_MISC_USEREVENT          0x10000 /* event request
                                                   from userspace */
 #define FBINFO_MISC_TILEBLITTING       0x20000 /* use tile blitting */
-#define FBINFO_MISC_FIRMWARE           0x40000 /* a replaceable firmware
-                                                  inited framebuffer */
 
 /* A driver may set this flag to indicate that it does want a set_par to be
  * called every time when fbcon_switch is executed. The advantage is that with
@@ -801,6 +799,8 @@ struct fb_tile_ops {
  */
 #define FBINFO_MISC_ALWAYS_SETPAR   0x40000
 
+/* where the fb is a firmware driver, and can be replaced with a proper one */
+#define FBINFO_MISC_FIRMWARE        0x80000
 /*
  * Host and GPU endianness differ.
  */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 471e1ff5079a..68ca1b0491af 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1783,6 +1783,19 @@ extern int get_sb_pseudo(struct file_system_type *, char *,
         struct vfsmount *mnt);
 extern void simple_set_mnt(struct vfsmount *mnt, struct super_block *sb);
 
+static inline void sb_mark_dirty(struct super_block *sb)
+{
+        sb->s_dirt = 1;
+}
+static inline void sb_mark_clean(struct super_block *sb)
+{
+        sb->s_dirt = 0;
+}
+static inline int sb_is_dirty(struct super_block *sb)
+{
+        return sb->s_dirt;
+}
+
 /* Alas, no aliases. Too much hassle with bringing module.h everywhere */
 #define fops_get(fops) \
         (((fops) && try_module_get((fops)->owner) ? (fops) : NULL))
diff --git a/include/linux/list.h b/include/linux/list.h
index 8392884a2977..5d57a3a1fa1b 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -544,6 +544,21 @@ static inline void list_splice_tail_init(struct list_head *list,
              &pos->member != (head);                                    \
              pos = n, n = list_entry(n->member.prev, typeof(*n), member))
 
+/**
+ * list_safe_reset_next - reset a stale list_for_each_entry_safe loop
+ * @pos:        the loop cursor used in the list_for_each_entry_safe loop
+ * @n:          temporary storage used in list_for_each_entry_safe
+ * @member:     the name of the list_struct within the struct.
+ *
+ * list_safe_reset_next is not safe to use in general if the list may be
+ * modified concurrently (eg. the lock is dropped in the loop body). An
+ * exception to this is if the cursor element (pos) is pinned in the list,
+ * and list_safe_reset_next is called after re-taking the lock and before
+ * completing the current iteration of the loop body.
+ */
+#define list_safe_reset_next(pos, n, member)                            \
+        n = list_entry(pos->member.next, typeof(*pos), member)
+
 /*
  * Double linked lists with a single pointer list head.
  * Mostly useful for hash tables where the two pointer list head is
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index b631c46cffd9..f6c9b7dcb9fd 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -3,6 +3,12 @@
 #include <linux/module.h>
 #include <linux/major.h>
 
+/*
+ *      These allocations are managed by device@lanana.org. If you use an
+ *      entry that is not in assigned your entry may well be moved and
+ *      reassigned, or set dynamic if a fixed value is not justified.
+ */
+
 #define PSMOUSE_MINOR           1
 #define MS_BUSMOUSE_MINOR       2
 #define ATIXL_BUSMOUSE_MINOR    3
@@ -30,7 +36,6 @@
 #define HPET_MINOR              228
 #define FUSE_MINOR              229
 #define KVM_MINOR               232
-#define VHOST_NET_MINOR         233
 #define BTRFS_MINOR             234
 #define AUTOFS_MINOR            235
 #define MISC_DYNAMIC_MINOR      255
diff --git a/include/linux/mv643xx_eth.h b/include/linux/mv643xx_eth.h
index cbbbe9bfecad..30b0c4e78f91 100644
--- a/include/linux/mv643xx_eth.h
+++ b/include/linux/mv643xx_eth.h
@@ -19,6 +19,11 @@ struct mv643xx_eth_shared_platform_data {
         struct mbus_dram_target_info    *dram;
         struct platform_device  *shared_smi;
         unsigned int            t_clk;
+        /*
+         * Max packet size for Tx IP/Layer 4 checksum, when set to 0, default
+         * limit of 9KiB will be used.
+         */
+        int                     tx_csum_limit;
 };
 
 #define MV643XX_ETH_PHY_ADDR_DEFAULT    0
diff --git a/include/linux/net.h b/include/linux/net.h
index 2b4deeeb8646..dee0b11a8759 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -129,10 +129,9 @@ struct socket_wq {
  *  @type: socket type (%SOCK_STREAM, etc)
  *  @flags: socket flags (%SOCK_ASYNC_NOSPACE, etc)
  *  @ops: protocol specific socket operations
- *  @fasync_list: Asynchronous wake up list
  *  @file: File back pointer for gc
  *  @sk: internal networking protocol agnostic socket representation
- *  @wait: wait queue for several uses
+ *  @wq: wait queue for several uses
  */
 struct socket {
         socket_state            state;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 40291f375024..b21e4054c12c 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1656,6 +1656,9 @@ static inline int netif_is_multiqueue(const struct net_device *dev)
         return (dev->num_tx_queues > 1);
 }
 
+extern void netif_set_real_num_tx_queues(struct net_device *dev,
+                                         unsigned int txq);
+
 /* Use this variant when it is known for sure that it
  * is executing from hardware interrupt context or with hardware interrupts
  * disabled.
@@ -2329,7 +2332,7 @@ do {								\
 #endif
 
 #if defined(VERBOSE_DEBUG)
-#define netif_vdbg      netdev_dbg
+#define netif_vdbg      netif_dbg
 #else
 #define netif_vdbg(priv, type, dev, format, args...)            \
 ({                                                              \
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index f149dd10908b..3bedcc149c84 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1261,6 +1261,7 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE       0x0759
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_SMBUS     0x07D8
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP79_SMBUS     0x0AA2
+#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA      0x0D85
 
 #define PCI_VENDOR_ID_IMS               0x10e0
 #define PCI_DEVICE_ID_IMS_TT128         0x9128
@@ -2321,6 +2322,7 @@
 #define PCI_VENDOR_ID_JMICRON           0x197B
 #define PCI_DEVICE_ID_JMICRON_JMB360    0x2360
 #define PCI_DEVICE_ID_JMICRON_JMB361    0x2361
+#define PCI_DEVICE_ID_JMICRON_JMB362    0x2362
 #define PCI_DEVICE_ID_JMICRON_JMB363    0x2363
 #define PCI_DEVICE_ID_JMICRON_JMB365    0x2365
 #define PCI_DEVICE_ID_JMICRON_JMB366    0x2366
diff --git a/include/linux/rbtree.h b/include/linux/rbtree.h
index fe1872e5b37e..7066acb2c530 100644
--- a/include/linux/rbtree.h
+++ b/include/linux/rbtree.h
@@ -110,7 +110,6 @@ struct rb_node
 struct rb_root
 {
         struct rb_node *rb_node;
-        void (*augment_cb)(struct rb_node *node);
 };
 
 
@@ -130,9 +129,7 @@ static inline void rb_set_color(struct rb_node *rb, int color)
         rb->rb_parent_color = (rb->rb_parent_color & ~1) | color;
 }
 
-#define RB_ROOT (struct rb_root) { NULL, NULL, }
-#define RB_AUGMENT_ROOT(x)      (struct rb_root) { NULL, x}
-
+#define RB_ROOT (struct rb_root) { NULL, }
 #define rb_entry(ptr, type, member) container_of(ptr, type, member)
 
 #define RB_EMPTY_ROOT(root)     ((root)->rb_node == NULL)
@@ -142,6 +139,14 @@ static inline void rb_set_color(struct rb_node *rb, int color)
 extern void rb_insert_color(struct rb_node *, struct rb_root *);
 extern void rb_erase(struct rb_node *, struct rb_root *);
 
+typedef void (*rb_augment_f)(struct rb_node *node, void *data);
+
+extern void rb_augment_insert(struct rb_node *node,
+                              rb_augment_f func, void *data);
+extern struct rb_node *rb_augment_erase_begin(struct rb_node *node);
+extern void rb_augment_erase_end(struct rb_node *node,
+                                 rb_augment_f func, void *data);
+
 /* Find logical next and previous nodes in a tree */
 extern struct rb_node *rb_next(const struct rb_node *);
 extern struct rb_node *rb_prev(const struct rb_node *);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index f118809c953f..747fcaedddb7 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -139,7 +139,7 @@ extern int nr_processes(void);
 extern unsigned long nr_running(void);
 extern unsigned long nr_uninterruptible(void);
 extern unsigned long nr_iowait(void);
-extern unsigned long nr_iowait_cpu(void);
+extern unsigned long nr_iowait_cpu(int cpu);
 extern unsigned long this_cpu_load(void);
 
 
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index bf243fc54959..f89e7fd59a4c 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -380,7 +380,10 @@ struct sk_buff {
         kmemcheck_bitfield_begin(flags2);
         __u16                   queue_mapping:16;
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
-        __u8                    ndisc_nodetype:2;
+        __u8                    ndisc_nodetype:2,
+                                deliver_no_wcard:1;
+#else
+        __u8                    deliver_no_wcard:1;
 #endif
         kmemcheck_bitfield_end(flags2);
 
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 5e781d824e6d..bc7d6bb4cd8e 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -256,22 +256,22 @@ static inline int hibernate(void) { return -ENOSYS; }
 static inline bool system_entering_hibernation(void) { return false; }
 #endif /* CONFIG_HIBERNATION */
 
-#ifdef CONFIG_HIBERNATION_NVS
-extern int hibernate_nvs_register(unsigned long start, unsigned long size);
-extern int hibernate_nvs_alloc(void);
-extern void hibernate_nvs_free(void);
-extern void hibernate_nvs_save(void);
-extern void hibernate_nvs_restore(void);
-#else /* CONFIG_HIBERNATION_NVS */
-static inline int hibernate_nvs_register(unsigned long a, unsigned long b)
+#ifdef CONFIG_SUSPEND_NVS
+extern int suspend_nvs_register(unsigned long start, unsigned long size);
+extern int suspend_nvs_alloc(void);
+extern void suspend_nvs_free(void);
+extern void suspend_nvs_save(void);
+extern void suspend_nvs_restore(void);
+#else /* CONFIG_SUSPEND_NVS */
+static inline int suspend_nvs_register(unsigned long a, unsigned long b)
 {
         return 0;
 }
-static inline int hibernate_nvs_alloc(void) { return 0; }
-static inline void hibernate_nvs_free(void) {}
-static inline void hibernate_nvs_save(void) {}
-static inline void hibernate_nvs_restore(void) {}
-#endif /* CONFIG_HIBERNATION_NVS */
+static inline int suspend_nvs_alloc(void) { return 0; }
+static inline void suspend_nvs_free(void) {}
+static inline void suspend_nvs_save(void) {}
+static inline void suspend_nvs_restore(void) {}
+#endif /* CONFIG_SUSPEND_NVS */
 
 #ifdef CONFIG_PM_SLEEP
 void save_processor_state(void);
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index 9a59d1f98cd4..103d1b61aacb 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -14,6 +14,7 @@
  * See the file COPYING for more details.
  */
 
+#include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/rcupdate.h>
 
diff --git a/include/linux/writeback.h b/include/linux/writeback.h
index f64134653a8c..c24eca71e80c 100644
--- a/include/linux/writeback.h
+++ b/include/linux/writeback.h
@@ -27,10 +27,6 @@ enum writeback_sync_modes {
  * in a manner such that unspecified fields are set to zero.
  */
 struct writeback_control {
-        struct backing_dev_info *bdi;   /* If !NULL, only write back this
-                                           queue */
-        struct super_block *sb;         /* if !NULL, only write inodes from
-                                           this super_block */
         enum writeback_sync_modes sync_mode;
         unsigned long *older_than_this; /* If !NULL, only write back inodes
                                            older than this */
@@ -56,15 +52,6 @@ struct writeback_control {
         unsigned for_reclaim:1;         /* Invoked from the page allocator */
         unsigned range_cyclic:1;        /* range_start is cyclic */
         unsigned more_io:1;             /* more io to be dispatched */
-        /*
-         * write_cache_pages() won't update wbc->nr_to_write and
-         * mapping->writeback_index if no_nrwrite_index_update
-         * is set.  write_cache_pages() may write more than we
-         * requested and we want to make sure nr_to_write and
-         * writeback_index are updated in a consistent manner
-         * so we use a single control to update them
-         */
-        unsigned no_nrwrite_index_update:1;
 };
 
 /*
@@ -75,7 +62,8 @@ int inode_wait(void *);
 void writeback_inodes_sb(struct super_block *);
 int writeback_inodes_sb_if_idle(struct super_block *);
 void sync_inodes_sb(struct super_block *);
-void writeback_inodes_wbc(struct writeback_control *wbc);
+void writeback_inodes_wb(struct bdi_writeback *wb,
+                struct writeback_control *wbc);
 long wb_do_writeback(struct bdi_writeback *wb, int force_wait);
 void wakeup_flusher_threads(long nr_pages);
 
diff --git a/include/media/tuner.h b/include/media/tuner.h
index 5505c5360ca3..51811eac46f1 100644
--- a/include/media/tuner.h
+++ b/include/media/tuner.h
@@ -130,6 +130,7 @@
 #define TUNER_PHILIPS_CU1216L           82
 #define TUNER_NXP_TDA18271              83
 #define TUNER_SONY_BTF_PXN01Z           84
+#define TUNER_PHILIPS_FQ1236_MK5        85      /* NTSC, TDA9885, no FM radio */
 
 /* tv card specific */
 #define TDA9887_PRESENT                 (1<<0)
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 03ca5d826757..433604bb3fe8 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -313,12 +313,24 @@ extern void qdisc_calculate_pkt_len(struct sk_buff *skb,
 extern void tcf_destroy(struct tcf_proto *tp);
 extern void tcf_destroy_chain(struct tcf_proto **fl);
 
-/* Reset all TX qdiscs of a device.  */
+/* Reset all TX qdiscs greater then index of a device.  */
+static inline void qdisc_reset_all_tx_gt(struct net_device *dev, unsigned int i)
+{
+        struct Qdisc *qdisc;
+
+        for (; i < dev->num_tx_queues; i++) {
+                qdisc = netdev_get_tx_queue(dev, i)->qdisc;
+                if (qdisc) {
+                        spin_lock_bh(qdisc_lock(qdisc));
+                        qdisc_reset(qdisc);
+                        spin_unlock_bh(qdisc_lock(qdisc));
+                }
+        }
+}
+
 static inline void qdisc_reset_all_tx(struct net_device *dev)
 {
-        unsigned int i;
-        for (i = 0; i < dev->num_tx_queues; i++)
-                qdisc_reset(netdev_get_tx_queue(dev, i)->qdisc);
+        qdisc_reset_all_tx_gt(dev, 0);
 }
 
 /* Are all TX queues of the device empty?  */
diff --git a/include/net/snmp.h b/include/net/snmp.h
index 92456f1035f5..899003d18db9 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -134,7 +134,7 @@ struct linux_xfrm_mib {
 #define SNMP_ADD_STATS_USER(mib, field, addend) \
                         this_cpu_add(mib[1]->mibs[field], addend)
 #define SNMP_ADD_STATS(mib, field, addend)      \
-                        this_cpu_add(mib[0]->mibs[field], addend)
+                        this_cpu_add(mib[!in_softirq()]->mibs[field], addend)
 /*
  * Use "__typeof__(*mib[0]) *ptr" instead of "__typeof__(mib[0]) ptr"
  * to make @ptr a non-percpu pointer.
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 1913af67c43d..fc8f36dd0f5c 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1586,7 +1586,7 @@ static inline struct xfrm_state *xfrm_input_state(struct sk_buff *skb)
 static inline int xfrm_mark_get(struct nlattr **attrs, struct xfrm_mark *m)
 {
         if (attrs[XFRMA_MARK])
-                memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(m));
+                memcpy(m, nla_data(attrs[XFRMA_MARK]), sizeof(struct xfrm_mark));
         else
                 m->v = m->m = 0;
 
diff --git a/include/trace/events/ext4.h b/include/trace/events/ext4.h
index f5b1ba90e952..f3865c7b4166 100644
--- a/include/trace/events/ext4.h
+++ b/include/trace/events/ext4.h
@@ -306,7 +306,6 @@ TRACE_EVENT(ext4_da_writepages_result,
                 __field(        int,    pages_written           )
                 __field(        long,   pages_skipped           )
                 __field(        char,   more_io                 )       
-                __field(        char,   no_nrwrite_index_update )
                 __field(       pgoff_t, writeback_index         )
         ),
 
@@ -317,16 +316,14 @@ TRACE_EVENT(ext4_da_writepages_result,
                 __entry->pages_written  = pages_written;
                 __entry->pages_skipped  = wbc->pages_skipped;
                 __entry->more_io        = wbc->more_io;
-                __entry->no_nrwrite_index_update = wbc->no_nrwrite_index_update;
                 __entry->writeback_index = inode->i_mapping->writeback_index;
         ),
 
-        TP_printk("dev %s ino %lu ret %d pages_written %d pages_skipped %ld more_io %d no_nrwrite_index_update %d writeback_index %lu",
+        TP_printk("dev %s ino %lu ret %d pages_written %d pages_skipped %ld more_io %d writeback_index %lu",
                   jbd2_dev_to_name(__entry->dev),
                   (unsigned long) __entry->ino, __entry->ret,
                   __entry->pages_written, __entry->pages_skipped,
                   __entry->more_io,
-                  __entry->no_nrwrite_index_update,
                   (unsigned long) __entry->writeback_index)
 );
 
diff --git a/include/trace/events/signal.h b/include/trace/events/signal.h
index 814566c99d29..17df43464df0 100644
--- a/include/trace/events/signal.h
+++ b/include/trace/events/signal.h
@@ -10,7 +10,8 @@
 
 #define TP_STORE_SIGINFO(__entry, info)                         \
         do {                                                    \
-                if (info == SEND_SIG_NOINFO) {                  \
+                if (info == SEND_SIG_NOINFO ||                  \
+                    info == SEND_SIG_FORCED) {                  \
                         __entry->errno  = 0;                    \
                         __entry->code   = SI_USER;              \
                 } else if (info == SEND_SIG_PRIV) {             \
diff --git a/init/main.c b/init/main.c
index 3bdb152f412f..a42fdf4aeba9 100644
--- a/init/main.c
+++ b/init/main.c
@@ -125,7 +125,9 @@ static char *ramdisk_execute_command;
 
 #ifdef CONFIG_SMP
 /* Setup configured maximum number of CPUs to activate */
-unsigned int __initdata setup_max_cpus = NR_CPUS;
+unsigned int setup_max_cpus = NR_CPUS;
+EXPORT_SYMBOL(setup_max_cpus);
+
 
 /*
  * Setup routine for controlling SMP activation
@@ -422,18 +424,26 @@ static void __init setup_command_line(char *command_line)
  * gcc-3.4 accidentally inlines this function, so use noinline.
  */
 
+static __initdata DECLARE_COMPLETION(kthreadd_done);
+
 static noinline void __init_refok rest_init(void)
         __releases(kernel_lock)
 {
         int pid;
 
         rcu_scheduler_starting();
+        /*
+         * We need to spawn init first so that it obtains pid 1, however
+         * the init task will end up wanting to create kthreads, which, if
+         * we schedule it before we create kthreadd, will OOPS.
+         */
         kernel_thread(kernel_init, NULL, CLONE_FS | CLONE_SIGHAND);
         numa_default_policy();
         pid = kernel_thread(kthreadd, NULL, CLONE_FS | CLONE_FILES);
         rcu_read_lock();
         kthreadd_task = find_task_by_pid_ns(pid, &init_pid_ns);
         rcu_read_unlock();
+        complete(&kthreadd_done);
         unlock_kernel();
 
         /*
@@ -855,6 +865,10 @@ static noinline int init_post(void)
 
 static int __init kernel_init(void * unused)
 {
+        /*
+         * Wait until kthreadd is all set-up.
+         */
+        wait_for_completion(&kthreadd_done);
         lock_kernel();
 
         /*
diff --git a/kernel/futex.c b/kernel/futex.c
index e7a35f1039e7..6a3a5fa1526d 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -429,20 +429,11 @@ static void free_pi_state(struct futex_pi_state *pi_state)
 static struct task_struct * futex_find_get_task(pid_t pid)
 {
         struct task_struct *p;
-        const struct cred *cred = current_cred(), *pcred;
 
         rcu_read_lock();
         p = find_task_by_vpid(pid);
-        if (!p) {
-                p = ERR_PTR(-ESRCH);
-        } else {
-                pcred = __task_cred(p);
-                if (cred->euid != pcred->euid &&
-                    cred->euid != pcred->uid)
-                        p = ERR_PTR(-ESRCH);
-                else
-                        get_task_struct(p);
-        }
+        if (p)
+                get_task_struct(p);
 
         rcu_read_unlock();
 
@@ -564,8 +555,8 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
         if (!pid)
                 return -ESRCH;
         p = futex_find_get_task(pid);
-        if (IS_ERR(p))
-                return PTR_ERR(p);
+        if (!p)
+                return -ESRCH;
 
         /*
          * We need to look at the task state flags to figure out,
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 3164ba7ce151..e1497481fe8a 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -456,6 +456,9 @@ int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
                 /* note that IRQF_TRIGGER_MASK == IRQ_TYPE_SENSE_MASK */
                 desc->status &= ~(IRQ_LEVEL | IRQ_TYPE_SENSE_MASK);
                 desc->status |= flags;
+
+                if (chip != desc->chip)
+                        irq_chip_set_defaults(desc->chip);
         }
 
         return ret;
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 474a84715eac..131b1703936f 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1089,9 +1089,10 @@ void crash_kexec(struct pt_regs *regs)
 
 size_t crash_get_memory_size(void)
 {
-        size_t size;
+        size_t size = 0;
         mutex_lock(&kexec_mutex);
-        size = crashk_res.end - crashk_res.start + 1;
+        if (crashk_res.end != crashk_res.start)
+                size = crashk_res.end - crashk_res.start + 1;
         mutex_unlock(&kexec_mutex);
         return size;
 }
@@ -1134,7 +1135,7 @@ int crash_shrink_memory(unsigned long new_size)
 
         free_reserved_phys_range(end, crashk_res.end);
 
-        if (start == end)
+        if ((start == end) && (crashk_res.parent != NULL))
                 release_resource(&crashk_res);
         crashk_res.end = end - 1;
 
diff --git a/kernel/module.c b/kernel/module.c
index 8c6b42840dd1..5d2d28197c82 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2062,6 +2062,12 @@ static void dynamic_debug_setup(struct _ddebug *debug, unsigned int num)
 #endif
 }
 
+static void dynamic_debug_remove(struct _ddebug *debug)
+{
+        if (debug)
+                ddebug_remove_module(debug->modname);
+}
+
 static void *module_alloc_update_bounds(unsigned long size)
 {
         void *ret = module_alloc(size);
@@ -2124,6 +2130,8 @@ static noinline struct module *load_module(void __user *umod,
         void *ptr = NULL; /* Stops spurious gcc warning */
         unsigned long symoffs, stroffs, *strmap;
         void __percpu *percpu;
+        struct _ddebug *debug = NULL;
+        unsigned int num_debug = 0;
 
         mm_segment_t old_fs;
 
@@ -2476,15 +2484,9 @@ static noinline struct module *load_module(void __user *umod,
         kfree(strmap);
         strmap = NULL;
 
-        if (!mod->taints) {
-                struct _ddebug *debug;
-                unsigned int num_debug;
-
+        if (!mod->taints)
                 debug = section_objs(hdr, sechdrs, secstrings, "__verbose",
                                      sizeof(*debug), &num_debug);
-                if (debug)
-                        dynamic_debug_setup(debug, num_debug);
-        }
 
         err = module_finalize(hdr, sechdrs, mod);
         if (err < 0)
@@ -2526,10 +2528,13 @@ static noinline struct module *load_module(void __user *umod,
                 goto unlock;
         }
 
+        if (debug)
+                dynamic_debug_setup(debug, num_debug);
+
         /* Find duplicate symbols */
         err = verify_export_symbols(mod);
         if (err < 0)
-                goto unlock;
+                goto ddebug;
 
         list_add_rcu(&mod->list, &modules);
         mutex_unlock(&module_mutex);
@@ -2557,6 +2562,8 @@ static noinline struct module *load_module(void __user *umod,
         mutex_lock(&module_mutex);
         /* Unlink carefully: kallsyms could be walking list. */
         list_del_rcu(&mod->list);
+ ddebug:
+        dynamic_debug_remove(debug);
  unlock:
         mutex_unlock(&module_mutex);
         synchronize_sched();
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 31d6afe92594..ff86c558af4c 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -1507,6 +1507,9 @@ do {					\
                 divisor = nsec * frequency;
         }
 
+        if (!divisor)
+                return dividend;
+
         return div64_u64(dividend, divisor);
 }
 
@@ -1529,7 +1532,7 @@ static int perf_event_start(struct perf_event *event)
 static void perf_adjust_period(struct perf_event *event, u64 nsec, u64 count)
 {
         struct hw_perf_event *hwc = &event->hw;
-        u64 period, sample_period;
+        s64 period, sample_period;
         s64 delta;
 
         period = perf_calculate_period(event, nsec, count);
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index 5c36ea9d55d2..ca6066a6952e 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -99,9 +99,13 @@ config PM_SLEEP_ADVANCED_DEBUG
         depends on PM_ADVANCED_DEBUG
         default n
 
+config SUSPEND_NVS
+       bool
+
 config SUSPEND
         bool "Suspend to RAM and standby"
         depends on PM && ARCH_SUSPEND_POSSIBLE
+        select SUSPEND_NVS if HAS_IOMEM
         default y
         ---help---
           Allow the system to enter sleep states in which main memory is
@@ -130,13 +134,10 @@ config SUSPEND_FREEZER
 
           Turning OFF this setting is NOT recommended! If in doubt, say Y.
 
-config HIBERNATION_NVS
-        bool
-
 config HIBERNATION
         bool "Hibernation (aka 'suspend to disk')"
         depends on PM && SWAP && ARCH_HIBERNATION_POSSIBLE
-        select HIBERNATION_NVS if HAS_IOMEM
+        select SUSPEND_NVS if HAS_IOMEM
         ---help---
           Enable the suspend to disk (STD) functionality, which is usually
           called "hibernation" in user interfaces.  STD checkpoints the
diff --git a/kernel/power/Makefile b/kernel/power/Makefile
index 524e058dcf06..f9063c6b185d 100644
--- a/kernel/power/Makefile
+++ b/kernel/power/Makefile
@@ -10,6 +10,6 @@ obj-$(CONFIG_SUSPEND)		+= suspend.o
 obj-$(CONFIG_PM_TEST_SUSPEND)   += suspend_test.o
 obj-$(CONFIG_HIBERNATION)       += hibernate.o snapshot.o swap.o user.o \
                                    block_io.o
-obj-$(CONFIG_HIBERNATION_NVS)   += hibernate_nvs.o
+obj-$(CONFIG_SUSPEND_NVS)       += nvs.o
 
 obj-$(CONFIG_MAGIC_SYSRQ)       += poweroff.o
diff --git a/kernel/power/hibernate_nvs.c b/kernel/power/nvs.c
index fdcad9ed5a7b..1836db60bbb6 100644
--- a/kernel/power/hibernate_nvs.c
+++ b/kernel/power/nvs.c
@@ -15,7 +15,7 @@
 
 /*
  * Platforms, like ACPI, may want us to save some memory used by them during
- * hibernation and to restore the contents of this memory during the subsequent
+ * suspend and to restore the contents of this memory during the subsequent
  * resume.  The code below implements a mechanism allowing us to do that.
  */
 
@@ -30,7 +30,7 @@ struct nvs_page {
 static LIST_HEAD(nvs_list);
 
 /**
- *      hibernate_nvs_register - register platform NVS memory region to save
+ *      suspend_nvs_register - register platform NVS memory region to save
  *      @start - physical address of the region
  *      @size - size of the region
  *
@@ -38,7 +38,7 @@ static LIST_HEAD(nvs_list);
  *      things so that the data from page-aligned addresses in this region will
  *      be copied into separate RAM pages.
  */
-int hibernate_nvs_register(unsigned long start, unsigned long size)
+int suspend_nvs_register(unsigned long start, unsigned long size)
 {
         struct nvs_page *entry, *next;
 
@@ -68,9 +68,9 @@ int hibernate_nvs_register(unsigned long start, unsigned long size)
 }
 
 /**
- *      hibernate_nvs_free - free data pages allocated for saving NVS regions
+ *      suspend_nvs_free - free data pages allocated for saving NVS regions
  */
-void hibernate_nvs_free(void)
+void suspend_nvs_free(void)
 {
         struct nvs_page *entry;
 
@@ -86,16 +86,16 @@ void hibernate_nvs_free(void)
 }
 
 /**
- *      hibernate_nvs_alloc - allocate memory necessary for saving NVS regions
+ *      suspend_nvs_alloc - allocate memory necessary for saving NVS regions
  */
-int hibernate_nvs_alloc(void)
+int suspend_nvs_alloc(void)
 {
         struct nvs_page *entry;
 
         list_for_each_entry(entry, &nvs_list, node) {
                 entry->data = (void *)__get_free_page(GFP_KERNEL);
                 if (!entry->data) {
-                        hibernate_nvs_free();
+                        suspend_nvs_free();
                         return -ENOMEM;
                 }
         }
@@ -103,9 +103,9 @@ int hibernate_nvs_alloc(void)
 }
 
 /**
- *      hibernate_nvs_save - save NVS memory regions
+ *      suspend_nvs_save - save NVS memory regions
  */
-void hibernate_nvs_save(void)
+void suspend_nvs_save(void)
 {
         struct nvs_page *entry;
 
@@ -119,12 +119,12 @@ void hibernate_nvs_save(void)
 }
 
 /**
- *      hibernate_nvs_restore - restore NVS memory regions
+ *      suspend_nvs_restore - restore NVS memory regions
  *
  *      This function is going to be called with interrupts disabled, so it
  *      cannot iounmap the virtual addresses used to access the NVS region.
  */
-void hibernate_nvs_restore(void)
+void suspend_nvs_restore(void)
 {
         struct nvs_page *entry;
 
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 56e7dbb8b996..f37cb7dd4402 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -16,6 +16,12 @@
 #include <linux/cpu.h>
 #include <linux/syscalls.h>
 #include <linux/gfp.h>
+#include <linux/io.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/suspend.h>
 
 #include "power.h"
 
diff --git a/kernel/sched.c b/kernel/sched.c
index f8b8996228dd..f52a8801b7a2 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -306,52 +306,6 @@ static int init_task_group_load = INIT_TASK_GROUP_LOAD;
  */
 struct task_group init_task_group;
 
-/* return group to which a task belongs */
-static inline struct task_group *task_group(struct task_struct *p)
-{
-        struct task_group *tg;
-
-#ifdef CONFIG_CGROUP_SCHED
-        tg = container_of(task_subsys_state(p, cpu_cgroup_subsys_id),
-                                struct task_group, css);
-#else
-        tg = &init_task_group;
-#endif
-        return tg;
-}
-
-/* Change a task's cfs_rq and parent entity if it moves across CPUs/groups */
-static inline void set_task_rq(struct task_struct *p, unsigned int cpu)
-{
-        /*
-         * Strictly speaking this rcu_read_lock() is not needed since the
-         * task_group is tied to the cgroup, which in turn can never go away
-         * as long as there are tasks attached to it.
-         *
-         * However since task_group() uses task_subsys_state() which is an
-         * rcu_dereference() user, this quiets CONFIG_PROVE_RCU.
-         */
-        rcu_read_lock();
-#ifdef CONFIG_FAIR_GROUP_SCHED
-        p->se.cfs_rq = task_group(p)->cfs_rq[cpu];
-        p->se.parent = task_group(p)->se[cpu];
-#endif
-
-#ifdef CONFIG_RT_GROUP_SCHED
-        p->rt.rt_rq  = task_group(p)->rt_rq[cpu];
-        p->rt.parent = task_group(p)->rt_se[cpu];
-#endif
-        rcu_read_unlock();
-}
-
-#else
-
-static inline void set_task_rq(struct task_struct *p, unsigned int cpu) { }
-static inline struct task_group *task_group(struct task_struct *p)
-{
-        return NULL;
-}
-
 #endif  /* CONFIG_CGROUP_SCHED */
 
 /* CFS-related fields in a runqueue */
@@ -644,6 +598,49 @@ static inline int cpu_of(struct rq *rq)
 #define cpu_curr(cpu)           (cpu_rq(cpu)->curr)
 #define raw_rq()                (&__raw_get_cpu_var(runqueues))
 
+#ifdef CONFIG_CGROUP_SCHED
+
+/*
+ * Return the group to which this tasks belongs.
+ *
+ * We use task_subsys_state_check() and extend the RCU verification
+ * with lockdep_is_held(&task_rq(p)->lock) because cpu_cgroup_attach()
+ * holds that lock for each task it moves into the cgroup. Therefore
+ * by holding that lock, we pin the task to the current cgroup.
+ */
+static inline struct task_group *task_group(struct task_struct *p)
+{
+        struct cgroup_subsys_state *css;
+
+        css = task_subsys_state_check(p, cpu_cgroup_subsys_id,
+                        lockdep_is_held(&task_rq(p)->lock));
+        return container_of(css, struct task_group, css);
+}
+
+/* Change a task's cfs_rq and parent entity if it moves across CPUs/groups */
+static inline void set_task_rq(struct task_struct *p, unsigned int cpu)
+{
+#ifdef CONFIG_FAIR_GROUP_SCHED
+        p->se.cfs_rq = task_group(p)->cfs_rq[cpu];
+        p->se.parent = task_group(p)->se[cpu];
+#endif
+
+#ifdef CONFIG_RT_GROUP_SCHED
+        p->rt.rt_rq  = task_group(p)->rt_rq[cpu];
+        p->rt.parent = task_group(p)->rt_se[cpu];
+#endif
+}
+
+#else /* CONFIG_CGROUP_SCHED */
+
+static inline void set_task_rq(struct task_struct *p, unsigned int cpu) { }
+static inline struct task_group *task_group(struct task_struct *p)
+{
+        return NULL;
+}
+
+#endif /* CONFIG_CGROUP_SCHED */
+
 inline void update_rq_clock(struct rq *rq)
 {
         if (!rq->skip_clock_update)
@@ -1257,6 +1254,12 @@ static void sched_avg_update(struct rq *rq)
         s64 period = sched_avg_period();
 
         while ((s64)(rq->clock - rq->age_stamp) > period) {
+                /*
+                 * Inline assembly required to prevent the compiler
+                 * optimising this loop into a divmod call.
+                 * See __iter_div_u64_rem() for another example of this.
+                 */
+                asm("" : "+rm" (rq->age_stamp));
                 rq->age_stamp += period;
                 rq->rt_avg /= 2;
         }
@@ -1660,9 +1663,6 @@ static void update_shares(struct sched_domain *sd)
 
 static void update_h_load(long cpu)
 {
-        if (root_task_group_empty())
-                return;
-
         walk_tg_tree(tg_load_down, tg_nop, (void *)cpu);
 }
 
@@ -2494,7 +2494,16 @@ void sched_fork(struct task_struct *p, int clone_flags)
         if (p->sched_class->task_fork)
                 p->sched_class->task_fork(p);
 
+        /*
+         * The child is not yet in the pid-hash so no cgroup attach races,
+         * and the cgroup is pinned to this child due to cgroup_fork()
+         * is ran before sched_fork().
+         *
+         * Silence PROVE_RCU.
+         */
+        rcu_read_lock();
         set_task_cpu(p, cpu);
+        rcu_read_unlock();
 
 #if defined(CONFIG_SCHEDSTATS) || defined(CONFIG_TASK_DELAY_ACCT)
         if (likely(sched_info_on()))
@@ -2864,9 +2873,9 @@ unsigned long nr_iowait(void)
         return sum;
 }
 
-unsigned long nr_iowait_cpu(void)
+unsigned long nr_iowait_cpu(int cpu)
 {
-        struct rq *this = this_rq();
+        struct rq *this = cpu_rq(cpu);
         return atomic_read(&this->nr_iowait);
 }
 
@@ -4465,16 +4474,6 @@ recheck:
         }
 
         if (user) {
-#ifdef CONFIG_RT_GROUP_SCHED
-                /*
-                 * Do not allow realtime tasks into groups that have no runtime
-                 * assigned.
-                 */
-                if (rt_bandwidth_enabled() && rt_policy(policy) &&
-                                task_group(p)->rt_bandwidth.rt_runtime == 0)
-                        return -EPERM;
-#endif
-
                 retval = security_task_setscheduler(p, policy, param);
                 if (retval)
                         return retval;
@@ -4490,6 +4489,22 @@ recheck:
          * runqueue lock must be held.
          */
         rq = __task_rq_lock(p);
+
+#ifdef CONFIG_RT_GROUP_SCHED
+        if (user) {
+                /*
+                 * Do not allow realtime tasks into groups that have no runtime
+                 * assigned.
+                 */
+                if (rt_bandwidth_enabled() && rt_policy(policy) &&
+                                task_group(p)->rt_bandwidth.rt_runtime == 0) {
+                        __task_rq_unlock(rq);
+                        raw_spin_unlock_irqrestore(&p->pi_lock, flags);
+                        return -EPERM;
+                }
+        }
+#endif
+
         /* recheck policy now with rq lock held */
         if (unlikely(oldpolicy != -1 && oldpolicy != p->policy)) {
                 policy = oldpolicy = -1;
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index eed35eded602..a878b5332daa 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -1240,6 +1240,7 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
          * effect of the currently running task from the load
          * of the current CPU:
          */
+        rcu_read_lock();
         if (sync) {
                 tg = task_group(current);
                 weight = current->se.load.weight;
@@ -1275,6 +1276,7 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
                 balanced = this_eff_load <= prev_eff_load;
         } else
                 balanced = true;
+        rcu_read_unlock();
 
         /*
          * If the currently running task will sleep within
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 1d7b9bc1c034..813993b5fb61 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -154,14 +154,14 @@ static void tick_nohz_update_jiffies(ktime_t now)
  * Updates the per cpu time idle statistics counters
  */
 static void
-update_ts_time_stats(struct tick_sched *ts, ktime_t now, u64 *last_update_time)
+update_ts_time_stats(int cpu, struct tick_sched *ts, ktime_t now, u64 *last_update_time)
 {
         ktime_t delta;
 
         if (ts->idle_active) {
                 delta = ktime_sub(now, ts->idle_entrytime);
                 ts->idle_sleeptime = ktime_add(ts->idle_sleeptime, delta);
-                if (nr_iowait_cpu() > 0)
+                if (nr_iowait_cpu(cpu) > 0)
                         ts->iowait_sleeptime = ktime_add(ts->iowait_sleeptime, delta);
                 ts->idle_entrytime = now;
         }
@@ -175,19 +175,19 @@ static void tick_nohz_stop_idle(int cpu, ktime_t now)
 {
         struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
 
-        update_ts_time_stats(ts, now, NULL);
+        update_ts_time_stats(cpu, ts, now, NULL);
         ts->idle_active = 0;
 
         sched_clock_idle_wakeup_event(0);
 }
 
-static ktime_t tick_nohz_start_idle(struct tick_sched *ts)
+static ktime_t tick_nohz_start_idle(int cpu, struct tick_sched *ts)
 {
         ktime_t now;
 
         now = ktime_get();
 
-        update_ts_time_stats(ts, now, NULL);
+        update_ts_time_stats(cpu, ts, now, NULL);
 
         ts->idle_entrytime = now;
         ts->idle_active = 1;
@@ -216,7 +216,7 @@ u64 get_cpu_idle_time_us(int cpu, u64 *last_update_time)
         if (!tick_nohz_enabled)
                 return -1;
 
-        update_ts_time_stats(ts, ktime_get(), last_update_time);
+        update_ts_time_stats(cpu, ts, ktime_get(), last_update_time);
 
         return ktime_to_us(ts->idle_sleeptime);
 }
@@ -242,7 +242,7 @@ u64 get_cpu_iowait_time_us(int cpu, u64 *last_update_time)
         if (!tick_nohz_enabled)
                 return -1;
 
-        update_ts_time_stats(ts, ktime_get(), last_update_time);
+        update_ts_time_stats(cpu, ts, ktime_get(), last_update_time);
 
         return ktime_to_us(ts->iowait_sleeptime);
 }
@@ -284,7 +284,7 @@ void tick_nohz_stop_sched_tick(int inidle)
          */
         ts->inidle = 1;
 
-        now = tick_nohz_start_idle(ts);
+        now = tick_nohz_start_idle(cpu, ts);
 
         /*
          * If this cpu is offline and it is the one which updates
@@ -315,9 +315,6 @@ void tick_nohz_stop_sched_tick(int inidle)
                 goto end;
         }
 
-        if (nohz_ratelimit(cpu))
-                goto end;
-
         ts->idle_calls++;
         /* Read jiffies and the time when jiffies were updated last */
         do {
@@ -328,7 +325,7 @@ void tick_nohz_stop_sched_tick(int inidle)
         } while (read_seqretry(&xtime_lock, seq));
 
         if (rcu_needs_cpu(cpu) || printk_needs_cpu(cpu) ||
-            arch_needs_cpu(cpu)) {
+            arch_needs_cpu(cpu) || nohz_ratelimit(cpu)) {
                 next_jiffies = last_jiffies + 1;
                 delta_jiffies = 1;
         } else {
diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index e6f65887842c..8a2b73f7c068 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c
@@ -96,7 +96,9 @@ int perf_trace_init(struct perf_event *p_event)
         mutex_lock(&event_mutex);
         list_for_each_entry(tp_event, &ftrace_events, list) {
                 if (tp_event->event.type == event_id &&
-                    tp_event->class && tp_event->class->perf_probe &&
+                    tp_event->class &&
+                    (tp_event->class->perf_probe ||
+                     tp_event->class->reg) &&
                     try_module_get(tp_event->mod)) {
                         ret = perf_trace_event_init(tp_event, p_event);
                         break;
diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index 3df8eb17a607..02afc2533728 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -692,7 +692,7 @@ static void ddebug_table_free(struct ddebug_table *dt)
  * Called in response to a module being unloaded.  Removes
  * any ddebug_table's which point at the module.
  */
-int ddebug_remove_module(char *mod_name)
+int ddebug_remove_module(const char *mod_name)
 {
         struct ddebug_table *dt, *nextdt;
         int ret = -ENOENT;
diff --git a/lib/genalloc.c b/lib/genalloc.c
index 736c3b06398e..1923f1490e72 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -128,7 +128,6 @@ unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size)
                 chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk);
 
                 end_bit = (chunk->end_addr - chunk->start_addr) >> order;
-                end_bit -= nbits + 1;
 
                 spin_lock_irqsave(&chunk->lock, flags);
                 start_bit = bitmap_find_next_zero_area(chunk->bits, end_bit, 0,
diff --git a/lib/idr.c b/lib/idr.c
index c1a206901761..7f1a4f0acf50 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -602,7 +602,7 @@ void *idr_get_next(struct idr *idp, int *nextidp)
         /* find first ent */
         n = idp->layers * IDR_BITS;
         max = 1 << n;
-        p = rcu_dereference(idp->top);
+        p = rcu_dereference_raw(idp->top);
         if (!p)
                 return NULL;
 
@@ -610,7 +610,7 @@ void *idr_get_next(struct idr *idp, int *nextidp)
                 while (n > 0 && p) {
                         n -= IDR_BITS;
                         *paa++ = p;
-                        p = rcu_dereference(p->ary[(id >> n) & IDR_MASK]);
+                        p = rcu_dereference_raw(p->ary[(id >> n) & IDR_MASK]);
                 }
 
                 if (p) {
diff --git a/lib/rbtree.c b/lib/rbtree.c
index 15e10b1afdd2..4693f79195d3 100644
--- a/lib/rbtree.c
+++ b/lib/rbtree.c
@@ -44,11 +44,6 @@ static void __rb_rotate_left(struct rb_node *node, struct rb_root *root)
         else
                 root->rb_node = right;
         rb_set_parent(node, right);
-
-        if (root->augment_cb) {
-                root->augment_cb(node);
-                root->augment_cb(right);
-        }
 }
 
 static void __rb_rotate_right(struct rb_node *node, struct rb_root *root)
@@ -72,20 +67,12 @@ static void __rb_rotate_right(struct rb_node *node, struct rb_root *root)
         else
                 root->rb_node = left;
         rb_set_parent(node, left);
-
-        if (root->augment_cb) {
-                root->augment_cb(node);
-                root->augment_cb(left);
-        }
 }
 
 void rb_insert_color(struct rb_node *node, struct rb_root *root)
 {
         struct rb_node *parent, *gparent;
 
-        if (root->augment_cb)
-                root->augment_cb(node);
-
         while ((parent = rb_parent(node)) && rb_is_red(parent))
         {
                 gparent = rb_parent(parent);
@@ -240,15 +227,12 @@ void rb_erase(struct rb_node *node, struct rb_root *root)
         else
         {
                 struct rb_node *old = node, *left;
-                int old_parent_cb = 0;
-                int successor_parent_cb = 0;
 
                 node = node->rb_right;
                 while ((left = node->rb_left) != NULL)
                         node = left;
 
                 if (rb_parent(old)) {
-                        old_parent_cb = 1;
                         if (rb_parent(old)->rb_left == old)
                                 rb_parent(old)->rb_left = node;
                         else
@@ -263,10 +247,8 @@ void rb_erase(struct rb_node *node, struct rb_root *root)
                 if (parent == old) {
                         parent = node;
                 } else {
-                        successor_parent_cb = 1;
                         if (child)
                                 rb_set_parent(child, parent);
-
                         parent->rb_left = child;
 
                         node->rb_right = old->rb_right;
@@ -277,24 +259,6 @@ void rb_erase(struct rb_node *node, struct rb_root *root)
                 node->rb_left = old->rb_left;
                 rb_set_parent(old->rb_left, node);
 
-                if (root->augment_cb) {
-                        /*
-                         * Here, three different nodes can have new children.
-                         * The parent of the successor node that was selected
-                         * to replace the node to be erased.
-                         * The node that is getting erased and is now replaced
-                         * by its successor.
-                         * The parent of the node getting erased-replaced.
-                         */
-                        if (successor_parent_cb)
-                                root->augment_cb(parent);
-
-                        root->augment_cb(node);
-
-                        if (old_parent_cb)
-                                root->augment_cb(rb_parent(old));
-                }
-
                 goto color;
         }
 
@@ -303,19 +267,15 @@ void rb_erase(struct rb_node *node, struct rb_root *root)
 
         if (child)
                 rb_set_parent(child, parent);
-
-        if (parent) {
+        if (parent)
+        {
                 if (parent->rb_left == node)
                         parent->rb_left = child;
                 else
                         parent->rb_right = child;
-
-                if (root->augment_cb)
-                        root->augment_cb(parent);
-
-        } else {
-                root->rb_node = child;
         }
+        else
+                root->rb_node = child;
 
  color:
         if (color == RB_BLACK)
@@ -323,6 +283,74 @@ void rb_erase(struct rb_node *node, struct rb_root *root)
 }
 EXPORT_SYMBOL(rb_erase);
 
+static void rb_augment_path(struct rb_node *node, rb_augment_f func, void *data)
+{
+        struct rb_node *parent;
+
+up:
+        func(node, data);
+        parent = rb_parent(node);
+        if (!parent)
+                return;
+
+        if (node == parent->rb_left && parent->rb_right)
+                func(parent->rb_right, data);
+        else if (parent->rb_left)
+                func(parent->rb_left, data);
+
+        node = parent;
+        goto up;
+}
+
+/*
+ * after inserting @node into the tree, update the tree to account for
+ * both the new entry and any damage done by rebalance
+ */
+void rb_augment_insert(struct rb_node *node, rb_augment_f func, void *data)
+{
+        if (node->rb_left)
+                node = node->rb_left;
+        else if (node->rb_right)
+                node = node->rb_right;
+
+        rb_augment_path(node, func, data);
+}
+
+/*
+ * before removing the node, find the deepest node on the rebalance path
+ * that will still be there after @node gets removed
+ */
+struct rb_node *rb_augment_erase_begin(struct rb_node *node)
+{
+        struct rb_node *deepest;
+
+        if (!node->rb_right && !node->rb_left)
+                deepest = rb_parent(node);
+        else if (!node->rb_right)
+                deepest = node->rb_left;
+        else if (!node->rb_left)
+                deepest = node->rb_right;
+        else {
+                deepest = rb_next(node);
+                if (deepest->rb_right)
+                        deepest = deepest->rb_right;
+                else if (rb_parent(deepest) != node)
+                        deepest = rb_parent(deepest);
+        }
+
+        return deepest;
+}
+
+/*
+ * after removal, update the tree to account for the removed entry
+ * and any rebalance damage.
+ */
+void rb_augment_erase_end(struct rb_node *node, rb_augment_f func, void *data)
+{
+        if (node)
+                rb_augment_path(node, func, data);
+}
+
 /*
  * This function returns the first node (in sort order) of the tree.
  */
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 660a87a22511..123bcef13e51 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -104,15 +104,13 @@ static int bdi_debug_stats_show(struct seq_file *m, void *v)
                    "b_more_io:        %8lu\n"
                    "bdi_list:         %8u\n"
                    "state:            %8lx\n"
-                   "wb_mask:          %8lx\n"
-                   "wb_list:          %8u\n"
-                   "wb_cnt:           %8u\n",
+                   "wb_list:          %8u\n",
                    (unsigned long) K(bdi_stat(bdi, BDI_WRITEBACK)),
                    (unsigned long) K(bdi_stat(bdi, BDI_RECLAIMABLE)),
                    K(bdi_thresh), K(dirty_thresh),
                    K(background_thresh), nr_wb, nr_dirty, nr_io, nr_more_io,
-                   !list_empty(&bdi->bdi_list), bdi->state, bdi->wb_mask,
-                   !list_empty(&bdi->wb_list), bdi->wb_cnt);
+                   !list_empty(&bdi->bdi_list), bdi->state,
+                   !list_empty(&bdi->wb_list));
 #undef K
 
         return 0;
@@ -340,14 +338,13 @@ int bdi_has_dirty_io(struct backing_dev_info *bdi)
 static void bdi_flush_io(struct backing_dev_info *bdi)
 {
         struct writeback_control wbc = {
-                .bdi                    = bdi,
                 .sync_mode              = WB_SYNC_NONE,
                 .older_than_this        = NULL,
                 .range_cyclic           = 1,
                 .nr_to_write            = 1024,
         };
 
-        writeback_inodes_wbc(&wbc);
+        writeback_inodes_wb(&bdi->wb, &wbc);
 }
 
 /*
@@ -675,12 +672,6 @@ int bdi_init(struct backing_dev_info *bdi)
 
         bdi_wb_init(&bdi->wb, bdi);
 
-        /*
-         * Just one thread support for now, hard code mask and count
-         */
-        bdi->wb_mask = 1;
-        bdi->wb_cnt = 1;
-
         for (i = 0; i < NR_BDI_STAT_ITEMS; i++) {
                 err = percpu_counter_init(&bdi->bdi_stat[i], 0);
                 if (err)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index c6ece0a57595..20a8193a7af8 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1370,7 +1370,7 @@ static void memcg_wakeup_oom(struct mem_cgroup *mem)
 
 static void memcg_oom_recover(struct mem_cgroup *mem)
 {
-        if (mem->oom_kill_disable && atomic_read(&mem->oom_lock))
+        if (atomic_read(&mem->oom_lock))
                 memcg_wakeup_oom(mem);
 }
 
@@ -3781,6 +3781,8 @@ static int mem_cgroup_oom_control_write(struct cgroup *cgrp,
                 return -EINVAL;
         }
         mem->oom_kill_disable = val;
+        if (!val)
+                memcg_oom_recover(mem);
         cgroup_unlock();
         return 0;
 }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 5d6fb339de03..5bc0a96beb51 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2094,7 +2094,7 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
                 NODEMASK_SCRATCH(scratch);
 
                 if (!scratch)
-                        return;
+                        goto put_mpol;
                 /* contextualize the tmpfs mount point mempolicy */
                 new = mpol_new(mpol->mode, mpol->flags, &mpol->w.user_nodemask);
                 if (IS_ERR(new))
@@ -2103,19 +2103,20 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
                 task_lock(current);
                 ret = mpol_set_nodemask(new, &mpol->w.user_nodemask, scratch);
                 task_unlock(current);
-                mpol_put(mpol); /* drop our ref on sb mpol */
                 if (ret)
-                        goto put_free;
+                        goto put_new;
 
                 /* Create pseudo-vma that contains just the policy */
                 memset(&pvma, 0, sizeof(struct vm_area_struct));
                 pvma.vm_end = TASK_SIZE;        /* policy covers entire file */
                 mpol_set_shared_policy(sp, &pvma, new); /* adds ref */
 
-put_free:
+put_new:
                 mpol_put(new);                  /* drop initial ref */
 free_scratch:
                 NODEMASK_SCRATCH_FREE(scratch);
+put_mpol:
+                mpol_put(mpol); /* drop our incoming ref on sb mpol */
         }
 }
 
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 5fa63bdf52e4..37498ef61548 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -495,7 +495,6 @@ static void balance_dirty_pages(struct address_space *mapping,
 
         for (;;) {
                 struct writeback_control wbc = {
-                        .bdi            = bdi,
                         .sync_mode      = WB_SYNC_NONE,
                         .older_than_this = NULL,
                         .nr_to_write    = write_chunk,
@@ -537,7 +536,7 @@ static void balance_dirty_pages(struct address_space *mapping,
                  * up.
                  */
                 if (bdi_nr_reclaimable > bdi_thresh) {
-                        writeback_inodes_wbc(&wbc);
+                        writeback_inodes_wb(&bdi->wb, &wbc);
                         pages_written += write_chunk - wbc.nr_to_write;
                         get_dirty_limits(&background_thresh, &dirty_thresh,
                                        &bdi_thresh, bdi);
@@ -597,7 +596,7 @@ static void balance_dirty_pages(struct address_space *mapping,
             (!laptop_mode && ((global_page_state(NR_FILE_DIRTY)
                                + global_page_state(NR_UNSTABLE_NFS))
                                           > background_thresh)))
-                bdi_start_writeback(bdi, NULL, 0);
+                bdi_start_background_writeback(bdi);
 }
 
 void set_page_dirty_balance(struct page *page, int page_mkwrite)
@@ -705,9 +704,8 @@ void laptop_mode_timer_fn(unsigned long data)
          * We want to write everything out, not just down to the dirty
          * threshold
          */
-
         if (bdi_has_dirty_io(&q->backing_dev_info))
-                bdi_start_writeback(&q->backing_dev_info, NULL, nr_pages);
+                bdi_start_writeback(&q->backing_dev_info, nr_pages);
 }
 
 /*
@@ -835,7 +833,6 @@ int write_cache_pages(struct address_space *mapping,
         pgoff_t done_index;
         int cycled;
         int range_whole = 0;
-        long nr_to_write = wbc->nr_to_write;
 
         pagevec_init(&pvec, 0);
         if (wbc->range_cyclic) {
@@ -852,7 +849,22 @@ int write_cache_pages(struct address_space *mapping,
                 if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
                         range_whole = 1;
                 cycled = 1; /* ignore range_cyclic tests */
+
+                /*
+                 * If this is a data integrity sync, cap the writeback to the
+                 * current end of file. Any extension to the file that occurs
+                 * after this is a new write and we don't need to write those
+                 * pages out to fulfil our data integrity requirements. If we
+                 * try to write them out, we can get stuck in this scan until
+                 * the concurrent writer stops adding dirty pages and extending
+                 * EOF.
+                 */
+                if (wbc->sync_mode == WB_SYNC_ALL &&
+                    wbc->range_end == LLONG_MAX) {
+                        end = i_size_read(mapping->host) >> PAGE_CACHE_SHIFT;
+                }
         }
+
 retry:
         done_index = index;
         while (!done && (index <= end)) {
@@ -935,11 +947,10 @@ continue_unlock:
                                         done = 1;
                                         break;
                                 }
-                        }
+                        }
 
-                        if (nr_to_write > 0) {
-                                nr_to_write--;
-                                if (nr_to_write == 0 &&
+                        if (wbc->nr_to_write > 0) {
+                                if (--wbc->nr_to_write == 0 &&
                                     wbc->sync_mode == WB_SYNC_NONE) {
                                         /*
                                          * We stop writing back only if we are
@@ -970,11 +981,8 @@ continue_unlock:
                 end = writeback_index - 1;
                 goto retry;
         }
-        if (!wbc->no_nrwrite_index_update) {
-                if (wbc->range_cyclic || (range_whole && nr_to_write > 0))
-                        mapping->writeback_index = done_index;
-                wbc->nr_to_write = nr_to_write;
-        }
+        if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0))
+                mapping->writeback_index = done_index;
 
         return ret;
 }
diff --git a/mm/percpu.c b/mm/percpu.c
index 39f7dfd59585..6470e7710231 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -229,8 +229,8 @@ static int __maybe_unused pcpu_page_idx(unsigned int cpu, int page_idx)
         return pcpu_unit_map[cpu] * pcpu_unit_pages + page_idx;
 }
 
-static unsigned long __maybe_unused pcpu_chunk_addr(struct pcpu_chunk *chunk,
-                                                unsigned int cpu, int page_idx)
+static unsigned long pcpu_chunk_addr(struct pcpu_chunk *chunk,
+                                     unsigned int cpu, int page_idx)
 {
         return (unsigned long)chunk->base_addr + pcpu_unit_offsets[cpu] +
                 (page_idx << PAGE_SHIFT);
@@ -978,7 +978,32 @@ bool is_kernel_percpu_address(unsigned long addr)
  */
 phys_addr_t per_cpu_ptr_to_phys(void *addr)
 {
-        if (pcpu_addr_in_first_chunk(addr)) {
+        void __percpu *base = __addr_to_pcpu_ptr(pcpu_base_addr);
+        bool in_first_chunk = false;
+        unsigned long first_start, first_end;
+        unsigned int cpu;
+
+        /*
+         * The following test on first_start/end isn't strictly
+         * necessary but will speed up lookups of addresses which
+         * aren't in the first chunk.
+         */
+        first_start = pcpu_chunk_addr(pcpu_first_chunk, pcpu_first_unit_cpu, 0);
+        first_end = pcpu_chunk_addr(pcpu_first_chunk, pcpu_last_unit_cpu,
+                                    pcpu_unit_pages);
+        if ((unsigned long)addr >= first_start &&
+            (unsigned long)addr < first_end) {
+                for_each_possible_cpu(cpu) {
+                        void *start = per_cpu_ptr(base, cpu);
+
+                        if (addr >= start && addr < start + pcpu_unit_size) {
+                                in_first_chunk = true;
+                                break;
+                        }
+                }
+        }
+
+        if (in_first_chunk) {
                 if ((unsigned long)addr < VMALLOC_START ||
                     (unsigned long)addr >= VMALLOC_END)
                         return __pa(addr);
@@ -1086,7 +1111,7 @@ struct pcpu_alloc_info * __init pcpu_build_alloc_info(
         static int group_map[NR_CPUS] __initdata;
         static int group_cnt[NR_CPUS] __initdata;
         const size_t static_size = __per_cpu_end - __per_cpu_start;
-        int group_cnt_max = 0, nr_groups = 1, nr_units = 0;
+        int nr_groups = 1, nr_units = 0;
         size_t size_sum, min_unit_size, alloc_size;
         int upa, max_upa, uninitialized_var(best_upa);  /* units_per_alloc */
         int last_allocs, group, unit;
@@ -1096,7 +1121,7 @@ struct pcpu_alloc_info * __init pcpu_build_alloc_info(
 
         /* this function may be called multiple times */
         memset(group_map, 0, sizeof(group_map));
-        memset(group_cnt, 0, sizeof(group_map));
+        memset(group_cnt, 0, sizeof(group_cnt));
 
         /*
          * Determine min_unit_size, alloc_size and max_upa such that
@@ -1130,7 +1155,6 @@ struct pcpu_alloc_info * __init pcpu_build_alloc_info(
                 }
                 group_map[cpu] = group;
                 group_cnt[group]++;
-                group_cnt_max = max(group_cnt_max, group_cnt[group]);
         }
 
         /*
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index bd537fc10254..50f58f5f1c34 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -12,7 +12,7 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
                 return NET_RX_DROP;
 
         if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
-                goto drop;
+                skb->deliver_no_wcard = 1;
 
         skb->skb_iif = skb->dev->ifindex;
         __vlan_hwaccel_put_tag(skb, vlan_tci);
@@ -84,7 +84,7 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
         struct sk_buff *p;
 
         if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
-                goto drop;
+                skb->deliver_no_wcard = 1;
 
         skb->skb_iif = skb->dev->ifindex;
         __vlan_hwaccel_put_tag(skb, vlan_tci);
diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
index 0faad5ce6dc4..8c100c9dae28 100644
--- a/net/bluetooth/bnep/netdev.c
+++ b/net/bluetooth/bnep/netdev.c
@@ -104,6 +104,8 @@ static void bnep_net_set_mc_list(struct net_device *dev)
                                 break;
                         memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
                         memcpy(__skb_put(skb, ETH_ALEN), ha->addr, ETH_ALEN);
+
+                        i++;
                 }
                 r->len = htons(skb->len - len);
         }
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 26637439965b..b01dde35a69e 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -128,7 +128,7 @@ void br_fdb_cleanup(unsigned long _data)
 {
         struct net_bridge *br = (struct net_bridge *)_data;
         unsigned long delay = hold_time(br);
-        unsigned long next_timer = jiffies + br->forward_delay;
+        unsigned long next_timer = jiffies + br->ageing_time;
         int i;
 
         spin_lock_bh(&br->hash_lock);
@@ -149,9 +149,7 @@ void br_fdb_cleanup(unsigned long _data)
         }
         spin_unlock_bh(&br->hash_lock);
 
-        /* Add HZ/4 to ensure we round the jiffies upwards to be after the next
-         * timer, otherwise we might round down and will have no-op run. */
-        mod_timer(&br->gc_timer, round_jiffies(next_timer + HZ/4));
+        mod_timer(&br->gc_timer, round_jiffies_up(next_timer));
 }
 
 /* Completely flush all dynamic entries in forwarding database.*/
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index a98ef1393097..a4e72a89e4ff 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -140,10 +140,10 @@ static int deliver_clone(const struct net_bridge_port *prev,
                          void (*__packet_hook)(const struct net_bridge_port *p,
                                                struct sk_buff *skb))
 {
+        struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
+
         skb = skb_clone(skb, GFP_ATOMIC);
         if (!skb) {
-                struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
-
                 dev->stats.tx_dropped++;
                 return -ENOMEM;
         }
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 9d21d98ae5fa..27ae946363f1 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -99,6 +99,15 @@ static struct net_bridge_mdb_entry *__br_mdb_ip_get(
         return NULL;
 }
 
+static struct net_bridge_mdb_entry *br_mdb_ip_get(
+        struct net_bridge_mdb_htable *mdb, struct br_ip *dst)
+{
+        if (!mdb)
+                return NULL;
+
+        return __br_mdb_ip_get(mdb, dst, br_ip_hash(mdb, dst));
+}
+
 static struct net_bridge_mdb_entry *br_mdb_ip4_get(
         struct net_bridge_mdb_htable *mdb, __be32 dst)
 {
@@ -107,7 +116,7 @@ static struct net_bridge_mdb_entry *br_mdb_ip4_get(
         br_dst.u.ip4 = dst;
         br_dst.proto = htons(ETH_P_IP);
 
-        return __br_mdb_ip_get(mdb, &br_dst, __br_ip4_hash(mdb, dst));
+        return br_mdb_ip_get(mdb, &br_dst);
 }
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
@@ -119,23 +128,17 @@ static struct net_bridge_mdb_entry *br_mdb_ip6_get(
         ipv6_addr_copy(&br_dst.u.ip6, dst);
         br_dst.proto = htons(ETH_P_IPV6);
 
-        return __br_mdb_ip_get(mdb, &br_dst, __br_ip6_hash(mdb, dst));
+        return br_mdb_ip_get(mdb, &br_dst);
 }
 #endif
 
-static struct net_bridge_mdb_entry *br_mdb_ip_get(
-        struct net_bridge_mdb_htable *mdb, struct br_ip *dst)
-{
-        return __br_mdb_ip_get(mdb, dst, br_ip_hash(mdb, dst));
-}
-
 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
                                         struct sk_buff *skb)
 {
         struct net_bridge_mdb_htable *mdb = br->mdb;
         struct br_ip ip;
 
-        if (!mdb || br->multicast_disabled)
+        if (br->multicast_disabled)
                 return NULL;
 
         if (BR_INPUT_SKB_CB(skb)->igmp)
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 44420992f72f..8fb75f89c4aa 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -591,6 +591,9 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
 
         pskb_trim_rcsum(skb, len);
 
+        /* BUG: Should really parse the IP options here. */
+        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+
         nf_bridge_put(skb->nf_bridge);
         if (!nf_bridge_alloc(skb))
                 return NF_DROP;
diff --git a/net/caif/cfrfml.c b/net/caif/cfrfml.c
index cd2830fec935..fd27b172fb5d 100644
--- a/net/caif/cfrfml.c
+++ b/net/caif/cfrfml.c
@@ -83,7 +83,7 @@ static int cfrfml_transmit(struct cflayer *layr, struct cfpkt *pkt)
         if (!cfsrvl_ready(service, &ret))
                 return ret;
 
-        if (!cfpkt_getlen(pkt) > CAIF_MAX_PAYLOAD_SIZE) {
+        if (cfpkt_getlen(pkt) > CAIF_MAX_PAYLOAD_SIZE) {
                 pr_err("CAIF: %s():Packet too large - size=%d\n",
                         __func__, cfpkt_getlen(pkt));
                 return -EOVERFLOW;
diff --git a/net/caif/cfveil.c b/net/caif/cfveil.c
index 0fd827f49491..e04f7d964e83 100644
--- a/net/caif/cfveil.c
+++ b/net/caif/cfveil.c
@@ -84,7 +84,7 @@ static int cfvei_transmit(struct cflayer *layr, struct cfpkt *pkt)
                 return ret;
         caif_assert(layr->dn != NULL);
         caif_assert(layr->dn->transmit != NULL);
-        if (!cfpkt_getlen(pkt) > CAIF_MAX_PAYLOAD_SIZE) {
+        if (cfpkt_getlen(pkt) > CAIF_MAX_PAYLOAD_SIZE) {
                 pr_warning("CAIF: %s(): Packet too large - size=%d\n",
                            __func__, cfpkt_getlen(pkt));
                 return -EOVERFLOW;
diff --git a/net/core/dev.c b/net/core/dev.c
index d03470f5260a..723a34710ad4 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1553,6 +1553,24 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
         rcu_read_unlock();
 }
 
+/*
+ * Routine to help set real_num_tx_queues. To avoid skbs mapped to queues
+ * greater then real_num_tx_queues stale skbs on the qdisc must be flushed.
+ */
+void netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
+{
+        unsigned int real_num = dev->real_num_tx_queues;
+
+        if (unlikely(txq > dev->num_tx_queues))
+                ;
+        else if (txq > real_num)
+                dev->real_num_tx_queues = txq;
+        else if (txq < real_num) {
+                dev->real_num_tx_queues = txq;
+                qdisc_reset_all_tx_gt(dev, txq);
+        }
+}
+EXPORT_SYMBOL(netif_set_real_num_tx_queues);
 
 static inline void __netif_reschedule(struct Qdisc *q)
 {
@@ -2253,11 +2271,9 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
         if (skb_rx_queue_recorded(skb)) {
                 u16 index = skb_get_rx_queue(skb);
                 if (unlikely(index >= dev->num_rx_queues)) {
-                        if (net_ratelimit()) {
-                                pr_warning("%s received packet on queue "
-                                        "%u, but number of RX queues is %u\n",
-                                        dev->name, index, dev->num_rx_queues);
-                        }
+                        WARN_ONCE(dev->num_rx_queues > 1, "%s received packet "
+                                "on queue %u, but number of RX queues is %u\n",
+                                dev->name, index, dev->num_rx_queues);
                         goto done;
                 }
                 rxqueue = dev->_rx + index;
@@ -2812,13 +2828,24 @@ static int __netif_receive_skb(struct sk_buff *skb)
         if (!skb->skb_iif)
                 skb->skb_iif = skb->dev->ifindex;
 
+        /*
+         * bonding note: skbs received on inactive slaves should only
+         * be delivered to pkt handlers that are exact matches.  Also
+         * the deliver_no_wcard flag will be set.  If packet handlers
+         * are sensitive to duplicate packets these skbs will need to
+         * be dropped at the handler.  The vlan accel path may have
+         * already set the deliver_no_wcard flag.
+         */
         null_or_orig = NULL;
         orig_dev = skb->dev;
         master = ACCESS_ONCE(orig_dev->master);
-        if (master) {
-                if (skb_bond_should_drop(skb, master))
+        if (skb->deliver_no_wcard)
+                null_or_orig = orig_dev;
+        else if (master) {
+                if (skb_bond_should_drop(skb, master)) {
+                        skb->deliver_no_wcard = 1;
                         null_or_orig = orig_dev; /* deliver only exact match */
-                else
+                } else
                         skb->dev = master;
         }
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index a0f4964033d2..75e4ffeb8cc9 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -318,23 +318,33 @@ out:
 }
 
 static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
-                                                void __user *useraddr)
+                                                u32 cmd, void __user *useraddr)
 {
-        struct ethtool_rxnfc cmd;
+        struct ethtool_rxnfc info;
+        size_t info_size = sizeof(info);
 
         if (!dev->ethtool_ops->set_rxnfc)
                 return -EOPNOTSUPP;
 
-        if (copy_from_user(&cmd, useraddr, sizeof(cmd)))
+        /* struct ethtool_rxnfc was originally defined for
+         * ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data
+         * members.  User-space might still be using that
+         * definition. */
+        if (cmd == ETHTOOL_SRXFH)
+                info_size = (offsetof(struct ethtool_rxnfc, data) +
+                             sizeof(info.data));
+
+        if (copy_from_user(&info, useraddr, info_size))
                 return -EFAULT;
 
-        return dev->ethtool_ops->set_rxnfc(dev, &cmd);
+        return dev->ethtool_ops->set_rxnfc(dev, &info);
 }
 
 static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
-                                                void __user *useraddr)
+                                                u32 cmd, void __user *useraddr)
 {
         struct ethtool_rxnfc info;
+        size_t info_size = sizeof(info);
         const struct ethtool_ops *ops = dev->ethtool_ops;
         int ret;
         void *rule_buf = NULL;
@@ -342,13 +352,22 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
         if (!ops->get_rxnfc)
                 return -EOPNOTSUPP;
 
-        if (copy_from_user(&info, useraddr, sizeof(info)))
+        /* struct ethtool_rxnfc was originally defined for
+         * ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data
+         * members.  User-space might still be using that
+         * definition. */
+        if (cmd == ETHTOOL_GRXFH)
+                info_size = (offsetof(struct ethtool_rxnfc, data) +
+                             sizeof(info.data));
+
+        if (copy_from_user(&info, useraddr, info_size))
                 return -EFAULT;
 
         if (info.cmd == ETHTOOL_GRXCLSRLALL) {
                 if (info.rule_cnt > 0) {
-                        rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
-                                           GFP_USER);
+                        if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
+                                rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+                                                   GFP_USER);
                         if (!rule_buf)
                                 return -ENOMEM;
                 }
@@ -359,7 +378,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
                 goto err_out;
 
         ret = -EFAULT;
-        if (copy_to_user(useraddr, &info, sizeof(info)))
+        if (copy_to_user(useraddr, &info, info_size))
                 goto err_out;
 
         if (rule_buf) {
@@ -1516,12 +1535,12 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GRXCLSRLCNT:
         case ETHTOOL_GRXCLSRULE:
         case ETHTOOL_GRXCLSRLALL:
-                rc = ethtool_get_rxnfc(dev, useraddr);
+                rc = ethtool_get_rxnfc(dev, ethcmd, useraddr);
                 break;
         case ETHTOOL_SRXFH:
         case ETHTOOL_SRXCLSRLDEL:
         case ETHTOOL_SRXCLSRLINS:
-                rc = ethtool_set_rxnfc(dev, useraddr);
+                rc = ethtool_set_rxnfc(dev, ethcmd, useraddr);
                 break;
         case ETHTOOL_GGRO:
                 rc = ethtool_get_gro(dev, useraddr);
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index cf8e70392fe0..785e5276a300 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -107,6 +107,7 @@ static DEFINE_RWLOCK(est_lock);
 
 /* Protects against soft lockup during large deletion */
 static struct rb_root est_root = RB_ROOT;
+static DEFINE_SPINLOCK(est_tree_lock);
 
 static void est_timer(unsigned long arg)
 {
@@ -201,7 +202,6 @@ struct gen_estimator *gen_find_node(const struct gnet_stats_basic_packed *bstats
  *
  * Returns 0 on success or a negative error code.
  *
- * NOTE: Called under rtnl_mutex
  */
 int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
                       struct gnet_stats_rate_est *rate_est,
@@ -232,6 +232,7 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
         est->last_packets = bstats->packets;
         est->avpps = rate_est->pps<<10;
 
+        spin_lock(&est_tree_lock);
         if (!elist[idx].timer.function) {
                 INIT_LIST_HEAD(&elist[idx].list);
                 setup_timer(&elist[idx].timer, est_timer, idx);
@@ -242,6 +243,7 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
 
         list_add_rcu(&est->list, &elist[idx].list);
         gen_add_node(est);
+        spin_unlock(&est_tree_lock);
 
         return 0;
 }
@@ -261,13 +263,13 @@ static void __gen_kill_estimator(struct rcu_head *head)
  *
  * Removes the rate estimator specified by &bstats and &rate_est.
  *
- * NOTE: Called under rtnl_mutex
  */
 void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                         struct gnet_stats_rate_est *rate_est)
 {
         struct gen_estimator *e;
 
+        spin_lock(&est_tree_lock);
         while ((e = gen_find_node(bstats, rate_est))) {
                 rb_erase(&e->node, &est_root);
 
@@ -278,6 +280,7 @@ void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                 list_del_rcu(&e->list);
                 call_rcu(&e->e_rcu, __gen_kill_estimator);
         }
+        spin_unlock(&est_tree_lock);
 }
 EXPORT_SYMBOL(gen_kill_estimator);
 
@@ -312,8 +315,14 @@ EXPORT_SYMBOL(gen_replace_estimator);
 bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
                           const struct gnet_stats_rate_est *rate_est)
 {
+        bool res;
+
         ASSERT_RTNL();
 
-        return gen_find_node(bstats, rate_est) != NULL;
+        spin_lock(&est_tree_lock);
+        res = gen_find_node(bstats, rate_est) != NULL;
+        spin_unlock(&est_tree_lock);
+
+        return res;
 }
 EXPORT_SYMBOL(gen_estimator_active);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 2ad68da418df..1dacd7ba8dbb 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2170,7 +2170,7 @@ static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until)
         end_time = ktime_now();
 
         pkt_dev->idle_acc += ktime_to_ns(ktime_sub(end_time, start_time));
-        pkt_dev->next_tx = ktime_add_ns(end_time, pkt_dev->delay);
+        pkt_dev->next_tx = ktime_add_ns(spin_until, pkt_dev->delay);
 }
 
 static inline void set_pkt_overhead(struct pktgen_dev *pkt_dev)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9f07e749d7b1..34432b4e96bb 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -532,6 +532,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->ip_summed          = old->ip_summed;
         skb_copy_queue_mapping(new, old);
         new->priority           = old->priority;
+        new->deliver_no_wcard   = old->deliver_no_wcard;
 #if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
         new->ipvs_property      = old->ipvs_property;
 #endif
@@ -569,7 +570,6 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
         C(len);
         C(data_len);
         C(mac_len);
-        C(rxhash);
         n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len;
         n->cloned = 1;
         n->nohdr = 0;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 9a4a6c96cb0d..041d41df1224 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -873,8 +873,10 @@ int ip_append_data(struct sock *sk,
             !exthdrlen)
                 csummode = CHECKSUM_PARTIAL;
 
+        skb = skb_peek_tail(&sk->sk_write_queue);
+
         inet->cork.length += length;
-        if (((length> mtu) || !skb_queue_empty(&sk->sk_write_queue)) &&
+        if (((length > mtu) || (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->u.dst.dev->features & NETIF_F_UFO)) {
                 err = ip_ufo_append_data(sk, getfrag, from, length, hh_len,
@@ -892,7 +894,7 @@ int ip_append_data(struct sock *sk,
          * adding appropriate IP header.
          */
 
-        if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
+        if (!skb)
                 goto alloc_new_skb;
 
         while (length > 0) {
@@ -1121,7 +1123,8 @@ ssize_t	ip_append_page(struct sock *sk, struct page *page,
                 return -EINVAL;
 
         inet->cork.length += size;
-        if ((sk->sk_protocol == IPPROTO_UDP) &&
+        if ((size + skb->len > mtu) &&
+            (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->u.dst.dev->features & NETIF_F_UFO)) {
                 skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 856123fe32f9..757f25eb9b4b 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -267,8 +267,10 @@ static void __net_exit ipmr_rules_exit(struct net *net)
 {
         struct mr_table *mrt, *next;
 
-        list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list)
+        list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
+                list_del(&mrt->list);
                 kfree(mrt);
+        }
         fib_rules_unregister(net->ipv4.mr_rules_ops);
 }
 #else
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 1705476670ef..23883a48ebfb 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -108,6 +108,8 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
         u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
 
         memset(fl, 0, sizeof(struct flowi));
+        fl->mark = skb->mark;
+
         if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
                 switch (iph->protocol) {
                 case IPPROTO_UDP:
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index ce7992982557..03e62f94ff8e 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -483,7 +483,7 @@ route_done:
                               np->tclass, NULL, &fl, (struct rt6_info*)dst,
                               MSG_DONTWAIT, np->dontfrag);
         if (err) {
-                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
+                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
                 ip6_flush_pending_frames(sk);
                 goto out_put;
         }
@@ -565,7 +565,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
                                 np->dontfrag);
 
         if (err) {
-                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
+                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
                 ip6_flush_pending_frames(sk);
                 goto out_put;
         }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 073071f2b75b..66078dad7fe8 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -120,7 +120,7 @@ static void mroute_clean_tables(struct mr6_table *mrt);
 static void ipmr_expire_process(unsigned long arg);
 
 #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
-#define ip6mr_for_each_table(mrt, met) \
+#define ip6mr_for_each_table(mrt, net) \
         list_for_each_entry_rcu(mrt, &net->ipv6.mr6_tables, list)
 
 static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
@@ -254,8 +254,10 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
 {
         struct mr6_table *mrt, *next;
 
-        list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list)
+        list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
+                list_del(&mrt->list);
                 ip6mr_free_table(mrt);
+        }
         fib_rules_unregister(net->ipv6.mr6_rules_ops);
 }
 #else
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 59f1881968c7..ab1622d7d409 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1356,7 +1356,10 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
                      IPV6_TLV_PADN, 0 };
 
         /* we assume size > sizeof(ra) here */
-        skb = sock_alloc_send_skb(sk, size + LL_ALLOCATED_SPACE(dev), 1, &err);
+        size += LL_ALLOCATED_SPACE(dev);
+        /* limit our allocations to order-0 page */
+        size = min_t(int, size, SKB_MAX_ORDER(0, 0));
+        skb = sock_alloc_send_skb(sk, size, 1, &err);
 
         if (!skb)
                 return NULL;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 0abdc242ddb7..2efef52fb461 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -586,6 +586,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                 src_addr = solicited_addr;
                 if (ifp->flags & IFA_F_OPTIMISTIC)
                         override = 0;
+                inc_opt |= ifp->idev->cnf.force_tllao;
                 in6_ifa_put(ifp);
         } else {
                 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
@@ -599,7 +600,6 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
         icmp6h.icmp6_solicited = solicited;
         icmp6h.icmp6_override = override;
 
-        inc_opt |= ifp->idev->cnf.force_tllao;
         __ndisc_send(dev, neigh, daddr, src_addr,
                      &icmp6h, solicited_addr,
                      inc_opt ? ND_OPT_TARGET_LL_ADDR : 0);
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 47d227713758..2933396e0281 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -97,9 +97,11 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
         fl.fl_ip_dport = otcph.source;
         security_skb_classify_flow(oldskb, &fl);
         dst = ip6_route_output(net, NULL, &fl);
-        if (dst == NULL)
+        if (dst == NULL || dst->error) {
+                dst_release(dst);
                 return;
-        if (dst->error || xfrm_lookup(net, &dst, &fl, NULL, 0))
+        }
+        if (xfrm_lookup(net, &dst, &fl, NULL, 0))
                 return;
 
         hh_len = (dst->dev->hard_header_len + 15)&~15;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 4a0e77e14468..6baeabbbca82 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -124,6 +124,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
         u8 nexthdr = nh[IP6CB(skb)->nhoff];
 
         memset(fl, 0, sizeof(struct flowi));
+        fl->mark = skb->mark;
+
         ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr);
         ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr);
 
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 4f2271316650..9c1da0809160 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -349,7 +349,7 @@ static inline int drv_get_survey(struct ieee80211_local *local, int idx,
                                 struct survey_info *survey)
 {
         int ret = -EOPNOTSUPP;
-        if (local->ops->conf_tx)
+        if (local->ops->get_survey)
                 ret = local->ops->get_survey(&local->hw, idx, survey);
         /* trace_drv_get_survey(local, idx, survey, ret); */
         return ret;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0839c4e8fd2e..f803f8b72a93 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1692,14 +1692,52 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                         rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
                         break;
                 case IEEE80211_STYPE_ACTION:
-                        if (mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
+                        switch (mgmt->u.action.category) {
+                        case WLAN_CATEGORY_BACK: {
+                                struct ieee80211_local *local = sdata->local;
+                                int len = skb->len;
+                                struct sta_info *sta;
+
+                                rcu_read_lock();
+                                sta = sta_info_get(sdata, mgmt->sa);
+                                if (!sta) {
+                                        rcu_read_unlock();
+                                        break;
+                                }
+
+                                local_bh_disable();
+
+                                switch (mgmt->u.action.u.addba_req.action_code) {
+                                case WLAN_ACTION_ADDBA_REQ:
+                                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                                   sizeof(mgmt->u.action.u.addba_req)))
+                                                break;
+                                        ieee80211_process_addba_request(local, sta, mgmt, len);
+                                        break;
+                                case WLAN_ACTION_ADDBA_RESP:
+                                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                                   sizeof(mgmt->u.action.u.addba_resp)))
+                                                break;
+                                        ieee80211_process_addba_resp(local, sta, mgmt, len);
+                                        break;
+                                case WLAN_ACTION_DELBA:
+                                        if (len < (IEEE80211_MIN_ACTION_SIZE +
+                                                   sizeof(mgmt->u.action.u.delba)))
+                                                break;
+                                        ieee80211_process_delba(sdata, sta, mgmt, len);
+                                        break;
+                                }
+                                local_bh_enable();
+                                rcu_read_unlock();
                                 break;
-
-                        ieee80211_sta_process_chanswitch(sdata,
-                                        &mgmt->u.action.u.chan_switch.sw_elem,
-                                        (void *)ifmgd->associated->priv,
-                                        rx_status->mactime);
-                        break;
+                                }
+                        case WLAN_CATEGORY_SPECTRUM_MGMT:
+                                ieee80211_sta_process_chanswitch(sdata,
+                                                &mgmt->u.action.u.chan_switch.sw_elem,
+                                                (void *)ifmgd->associated->priv,
+                                                rx_status->mactime);
+                                break;
+                        }
                 }
                 mutex_unlock(&ifmgd->mtx);
 
@@ -1722,9 +1760,45 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         mutex_unlock(&ifmgd->mtx);
 
         if (skb->len >= 24 + 2 /* mgmt + deauth reason */ &&
-            (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH)
-                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
+            (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH) {
+                struct ieee80211_local *local = sdata->local;
+                struct ieee80211_work *wk;
+
+                mutex_lock(&local->work_mtx);
+                list_for_each_entry(wk, &local->work_list, list) {
+                        if (wk->sdata != sdata)
+                                continue;
+
+                        if (wk->type != IEEE80211_WORK_ASSOC)
+                                continue;
+
+                        if (memcmp(mgmt->bssid, wk->filter_ta, ETH_ALEN))
+                                continue;
+                        if (memcmp(mgmt->sa, wk->filter_ta, ETH_ALEN))
+                                continue;
 
+                        /*
+                         * Printing the message only here means we can't
+                         * spuriously print it, but it also means that it
+                         * won't be printed when the frame comes in before
+                         * we even tried to associate or in similar cases.
+                         *
+                         * Ultimately, I suspect cfg80211 should print the
+                         * messages instead.
+                         */
+                        printk(KERN_DEBUG
+                               "%s: deauthenticated from %pM (Reason: %u)\n",
+                               sdata->name, mgmt->bssid,
+                               le16_to_cpu(mgmt->u.deauth.reason_code));
+
+                        list_del_rcu(&wk->list);
+                        free_work(wk);
+                        break;
+                }
+                mutex_unlock(&local->work_mtx);
+
+                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
+        }
  out:
         kfree_skb(skb);
 }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 5e0b65406c44..be9abc2e6348 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1944,6 +1944,9 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                         break;
 
+                if (sdata->vif.type == NL80211_IFTYPE_STATION)
+                        return ieee80211_sta_rx_mgmt(sdata, rx->skb);
+
                 switch (mgmt->u.action.u.addba_req.action_code) {
                 case WLAN_ACTION_ADDBA_REQ:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index be3d4a698692..b025dc7bb0fd 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -715,7 +715,7 @@ static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
         struct ieee80211_rx_status *rx_status;
         struct ieee80211_mgmt *mgmt;
         struct ieee80211_work *wk;
-        enum work_action rma;
+        enum work_action rma = WORK_ACT_NONE;
         u16 fc;
 
         rx_status = (struct ieee80211_rx_status *) skb->cb;
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index d8f7e8ef67b4..ff04e9edbed6 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -162,6 +162,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
         hash = ip_vs_conn_hashkey(cp->af, cp->protocol, &cp->caddr, cp->cport);
 
         ct_write_lock(hash);
+        spin_lock(&cp->lock);
 
         if (!(cp->flags & IP_VS_CONN_F_HASHED)) {
                 list_add(&cp->c_list, &ip_vs_conn_tab[hash]);
@@ -174,6 +175,7 @@ static inline int ip_vs_conn_hash(struct ip_vs_conn *cp)
                 ret = 0;
         }
 
+        spin_unlock(&cp->lock);
         ct_write_unlock(hash);
 
         return ret;
@@ -193,6 +195,7 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
         hash = ip_vs_conn_hashkey(cp->af, cp->protocol, &cp->caddr, cp->cport);
 
         ct_write_lock(hash);
+        spin_lock(&cp->lock);
 
         if (cp->flags & IP_VS_CONN_F_HASHED) {
                 list_del(&cp->c_list);
@@ -202,6 +205,7 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
         } else
                 ret = 0;
 
+        spin_unlock(&cp->lock);
         ct_write_unlock(hash);
 
         return ret;
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 3415b6ce1c0a..807643bdcbac 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -449,6 +449,7 @@ static __init void teql_master_setup(struct net_device *dev)
         dev->tx_queue_len       = 100;
         dev->flags              = IFF_NOARP;
         dev->hard_header_len    = LL_MAX_HEADER;
+        dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
 }
 
 static LIST_HEAD(master_dev_list);
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 2a9675136c68..7ca65c7005ea 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -210,7 +210,8 @@ struct sock_xprt {
          * State of TCP reply receive
          */
         __be32                  tcp_fraghdr,
-                                tcp_xid;
+                                tcp_xid,
+                                tcp_calldir;
 
         u32                     tcp_offset,
                                 tcp_reclen;
@@ -927,7 +928,7 @@ static inline void xs_tcp_read_calldir(struct sock_xprt *transport,
 {
         size_t len, used;
         u32 offset;
-        __be32  calldir;
+        char *p;
 
         /*
          * We want transport->tcp_offset to be 8 at the end of this routine
@@ -936,26 +937,33 @@ static inline void xs_tcp_read_calldir(struct sock_xprt *transport,
          * transport->tcp_offset is 4 (after having already read the xid).
          */
         offset = transport->tcp_offset - sizeof(transport->tcp_xid);
-        len = sizeof(calldir) - offset;
+        len = sizeof(transport->tcp_calldir) - offset;
         dprintk("RPC:       reading CALL/REPLY flag (%Zu bytes)\n", len);
-        used = xdr_skb_read_bits(desc, &calldir, len);
+        p = ((char *) &transport->tcp_calldir) + offset;
+        used = xdr_skb_read_bits(desc, p, len);
         transport->tcp_offset += used;
         if (used != len)
                 return;
         transport->tcp_flags &= ~TCP_RCV_READ_CALLDIR;
-        transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
-        transport->tcp_flags |= TCP_RCV_COPY_DATA;
         /*
          * We don't yet have the XDR buffer, so we will write the calldir
          * out after we get the buffer from the 'struct rpc_rqst'
          */
-        if (ntohl(calldir) == RPC_REPLY)
+        switch (ntohl(transport->tcp_calldir)) {
+        case RPC_REPLY:
+                transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
+                transport->tcp_flags |= TCP_RCV_COPY_DATA;
                 transport->tcp_flags |= TCP_RPC_REPLY;
-        else
+                break;
+        case RPC_CALL:
+                transport->tcp_flags |= TCP_RCV_COPY_CALLDIR;
+                transport->tcp_flags |= TCP_RCV_COPY_DATA;
                 transport->tcp_flags &= ~TCP_RPC_REPLY;
-        dprintk("RPC:       reading %s CALL/REPLY flag %08x\n",
-                        (transport->tcp_flags & TCP_RPC_REPLY) ?
-                                "reply for" : "request with", calldir);
+                break;
+        default:
+                dprintk("RPC:       invalid request message type\n");
+                xprt_force_disconnect(&transport->xprt);
+        }
         xs_tcp_check_fraghdr(transport);
 }
 
@@ -975,12 +983,10 @@ static inline void xs_tcp_read_common(struct rpc_xprt *xprt,
                 /*
                  * Save the RPC direction in the XDR buffer
                  */
-                __be32  calldir = transport->tcp_flags & TCP_RPC_REPLY ?
-                                        htonl(RPC_REPLY) : 0;
-
                 memcpy(rcvbuf->head[0].iov_base + transport->tcp_copied,
-                        &calldir, sizeof(calldir));
-                transport->tcp_copied += sizeof(calldir);
+                        &transport->tcp_calldir,
+                        sizeof(transport->tcp_calldir));
+                transport->tcp_copied += sizeof(transport->tcp_calldir);
                 transport->tcp_flags &= ~TCP_RCV_COPY_CALLDIR;
         }
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 4bf27d901333..af1c173be4ad 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2300,7 +2300,8 @@ int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
                         return 0;
                 if (xdst->xfrm_genid != dst->xfrm->genid)
                         return 0;
-                if (xdst->policy_genid != atomic_read(&xdst->pols[0]->genid))
+                if (xdst->num_pols > 0 &&
+                    xdst->policy_genid != atomic_read(&xdst->pols[0]->genid))
                         return 0;
 
                 if (strict && fl &&
diff --git a/scripts/Makefile.modbuiltin b/scripts/Makefile.modbuiltin
index 102a276f6eea..1adb974e6950 100644
--- a/scripts/Makefile.modbuiltin
+++ b/scripts/Makefile.modbuiltin
@@ -14,6 +14,11 @@ __modbuiltin:
 
 include scripts/Kbuild.include
 
+ifneq ($(KBUILD_SRC),)
+# Create output directory if not already present
+_dummy := $(shell [ -d $(obj) ] || mkdir -p $(obj))
+endif
+
 # The filename Kbuild has precedence over Makefile
 kbuild-dir := $(if $(filter /%,$(src)),$(src),$(srctree)/$(src))
 kbuild-file := $(if $(wildcard $(kbuild-dir)/Kbuild),$(kbuild-dir)/Kbuild,$(kbuild-dir)/Makefile)
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 3318692e4e76..f6127b9f5aca 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -503,6 +503,11 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname)
                     strncmp(symname, "_rest32gpr_", sizeof("_rest32gpr_") - 1) == 0 ||
                     strncmp(symname, "_save32gpr_", sizeof("_save32gpr_") - 1) == 0)
                         return 1;
+        if (info->hdr->e_machine == EM_PPC64)
+                /* Special register function linked on all modules during final link of .ko */
+                if (strncmp(symname, "_restgpr0_", sizeof("_restgpr0_") - 1) == 0 ||
+                    strncmp(symname, "_savegpr0_", sizeof("_savegpr0_") - 1) == 0)
+                        return 1;
         /* Do not ignore this symbol */
         return 0;
 }
@@ -1342,7 +1347,7 @@ static unsigned int *reloc_location(struct elf_info *elf,
         int section = sechdr->sh_info;
 
         return (void *)elf->hdr + sechdrs[section].sh_offset +
-                (r->r_offset - sechdrs[section].sh_addr);
+                r->r_offset - sechdrs[section].sh_addr;
 }
 
 static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
diff --git a/scripts/package/Makefile b/scripts/package/Makefile
index 62fcc3a7f4d3..3a681ef25306 100644
--- a/scripts/package/Makefile
+++ b/scripts/package/Makefile
@@ -44,7 +44,7 @@ rpm-pkg rpm: $(objtree)/kernel.spec FORCE
         fi
         $(MAKE) clean
         $(PREV) ln -sf $(srctree) $(KERNELPATH)
-        $(CONFIG_SHELL) $(srctree)/scripts/setlocalversion > $(objtree)/.scmversion
+        $(CONFIG_SHELL) $(srctree)/scripts/setlocalversion --scm-only > $(objtree)/.scmversion
         $(PREV) tar -cz $(RCS_TAR_IGNORE) -f $(KERNELPATH).tar.gz $(KERNELPATH)/.
         $(PREV) rm $(KERNELPATH)
         rm -f $(objtree)/.scmversion
diff --git a/scripts/setlocalversion b/scripts/setlocalversion
index 46989b88d734..d6a866ed1835 100755
--- a/scripts/setlocalversion
+++ b/scripts/setlocalversion
@@ -10,73 +10,158 @@
 #
 
 usage() {
-        echo "Usage: $0 [srctree]" >&2
+        echo "Usage: $0 [--scm-only] [srctree]" >&2
         exit 1
 }
 
-cd "${1:-.}" || usage
+scm_only=false
+srctree=.
+if test "$1" = "--scm-only"; then
+        scm_only=true
+        shift
+fi
+if test $# -gt 0; then
+        srctree=$1
+        shift
+fi
+if test $# -gt 0 -o ! -d "$srctree"; then
+        usage
+fi
 
-# Check for git and a git repo.
-if head=`git rev-parse --verify --short HEAD 2>/dev/null`; then
+scm_version()
+{
+        local short=false
 
-        # If we are at a tagged commit (like "v2.6.30-rc6"), we ignore it,
-        # because this version is defined in the top level Makefile.
-        if [ -z "`git describe --exact-match 2>/dev/null`" ]; then
+        cd "$srctree"
+        if test -e .scmversion; then
+                cat "$_"
+                return
+        fi
+        if test "$1" = "--short"; then
+                short=true
+        fi
 
-                # If we are past a tagged commit (like "v2.6.30-rc5-302-g72357d5"),
-                # we pretty print it.
-                if atag="`git describe 2>/dev/null`"; then
-                        echo "$atag" | awk -F- '{printf("-%05d-%s", $(NF-1),$(NF))}'
+        # Check for git and a git repo.
+        if head=`git rev-parse --verify --short HEAD 2>/dev/null`; then
+
+                # If we are at a tagged commit (like "v2.6.30-rc6"), we ignore
+                # it, because this version is defined in the top level Makefile.
+                if [ -z "`git describe --exact-match 2>/dev/null`" ]; then
+
+                        # If only the short version is requested, don't bother
+                        # running further git commands
+                        if $short; then
+                                echo "+"
+                                return
+                        fi
+                        # If we are past a tagged commit (like
+                        # "v2.6.30-rc5-302-g72357d5"), we pretty print it.
+                        if atag="`git describe 2>/dev/null`"; then
+                                echo "$atag" | awk -F- '{printf("-%05d-%s", $(NF-1),$(NF))}'
+
+                        # If we don't have a tag at all we print -g{commitish}.
+                        else
+                                printf '%s%s' -g $head
+                        fi
+                fi
 
-                # If we don't have a tag at all we print -g{commitish}.
-                else
-                        printf '%s%s' -g $head
+                # Is this git on svn?
+                if git config --get svn-remote.svn.url >/dev/null; then
+                        printf -- '-svn%s' "`git svn find-rev $head`"
                 fi
-        fi
 
-        # Is this git on svn?
-        if git config --get svn-remote.svn.url >/dev/null; then
-                printf -- '-svn%s' "`git svn find-rev $head`"
-        fi
+                # Update index only on r/w media
+                [ -w . ] && git update-index --refresh --unmerged > /dev/null
 
-        # Update index only on r/w media
-        [ -w . ] && git update-index --refresh --unmerged > /dev/null
+                # Check for uncommitted changes
+                if git diff-index --name-only HEAD | grep -v "^scripts/package" \
+                    | read dummy; then
+                        printf '%s' -dirty
+                fi
 
-        # Check for uncommitted changes
-        if git diff-index --name-only HEAD | grep -v "^scripts/package" \
-            | read dummy; then
-                printf '%s' -dirty
+                # All done with git
+                return
         fi
 
-        # All done with git
-        exit
-fi
+        # Check for mercurial and a mercurial repo.
+        if hgid=`hg id 2>/dev/null`; then
+                tag=`printf '%s' "$hgid" | cut -d' ' -f2`
+
+                # Do we have an untagged version?
+                if [ -z "$tag" -o "$tag" = tip ]; then
+                        id=`printf '%s' "$hgid" | sed 's/[+ ].*//'`
+                        printf '%s%s' -hg "$id"
+                fi
 
-# Check for mercurial and a mercurial repo.
-if hgid=`hg id 2>/dev/null`; then
-        tag=`printf '%s' "$hgid" | cut -d' ' -f2`
+                # Are there uncommitted changes?
+                # These are represented by + after the changeset id.
+                case "$hgid" in
+                        *+|*+\ *) printf '%s' -dirty ;;
+                esac
 
-        # Do we have an untagged version?
-        if [ -z "$tag" -o "$tag" = tip ]; then
-                id=`printf '%s' "$hgid" | sed 's/[+ ].*//'`
-                printf '%s%s' -hg "$id"
+                # All done with mercurial
+                return
         fi
 
-        # Are there uncommitted changes?
-        # These are represented by + after the changeset id.
-        case "$hgid" in
-                *+|*+\ *) printf '%s' -dirty ;;
-        esac
+        # Check for svn and a svn repo.
+        if rev=`svn info 2>/dev/null | grep '^Last Changed Rev'`; then
+                rev=`echo $rev | awk '{print $NF}'`
+                printf -- '-svn%s' "$rev"
 
-        # All done with mercurial
+                # All done with svn
+                return
+        fi
+}
+
+collect_files()
+{
+        local file res
+
+        for file; do
+                case "$file" in
+                *\~*)
+                        continue
+                        ;;
+                esac
+                if test -e "$file"; then
+                        res="$res$(cat "$file")"
+                fi
+        done
+        echo "$res"
+}
+
+if $scm_only; then
+        scm_version
         exit
 fi
 
-# Check for svn and a svn repo.
-if rev=`svn info 2>/dev/null | grep '^Last Changed Rev'`; then
-        rev=`echo $rev | awk '{print $NF}'`
-        printf -- '-svn%s' "$rev"
+if test -e include/config/auto.conf; then
+        source "$_"
+else
+        echo "Error: kernelrelease not valid - run 'make prepare' to update it"
+        exit 1
+fi
 
-        # All done with svn
-        exit
+# localversion* files in the build and source directory
+res="$(collect_files localversion*)"
+if test ! "$srctree" -ef .; then
+        res="$res$(collect_files "$srctree"/localversion*)"
+fi
+
+# CONFIG_LOCALVERSION and LOCALVERSION (if set)
+res="${res}${CONFIG_LOCALVERSION}${LOCALVERSION}"
+
+# scm version string if not at a tagged commit
+if test "$CONFIG_LOCALVERSION_AUTO" = "y"; then
+        # full scm version string
+        res="$res$(scm_version)"
+else
+        # apped a plus sign if the repository is not in a clean tagged
+        # state and  LOCALVERSION= is not specified
+        if test "${LOCALVERSION+set}" != "set"; then
+                scm=$(scm_version --short)
+                res="$res${scm:++}"
+        fi
 fi
+
+echo "$res"
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 13074b454743..6261745e4459 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -33,7 +33,7 @@ static int key_get_type_from_user(char *type,
         ret = strncpy_from_user(type, _type, len);
 
         if (ret < 0)
-                return -EFAULT;
+                return ret;
 
         if (ret == 0 || ret >= len)
                 return -EINVAL;
@@ -1080,7 +1080,7 @@ set:
         return old_setting;
 error:
         abort_creds(new);
-        return -EINVAL;
+        return ret;
 
 } /* end keyctl_set_reqkey_keyring() */
 
diff --git a/sound/atmel/ac97c.c b/sound/atmel/ac97c.c
index 428121a7e705..10c3a871a12d 100644
--- a/sound/atmel/ac97c.c
+++ b/sound/atmel/ac97c.c
@@ -657,7 +657,7 @@ static irqreturn_t atmel_ac97c_interrupt(int irq, void *dev)
         if (sr & AC97C_SR_CAEVT) {
                 struct snd_pcm_runtime *runtime;
                 int offset, next_period, block_size;
-                dev_info(&chip->pdev->dev, "channel A event%s%s%s%s%s%s\n",
+                dev_dbg(&chip->pdev->dev, "channel A event%s%s%s%s%s%s\n",
                                 casr & AC97C_CSR_OVRUN   ? " OVRUN"   : "",
                                 casr & AC97C_CSR_RXRDY   ? " RXRDY"   : "",
                                 casr & AC97C_CSR_UNRUN   ? " UNRUN"   : "",
diff --git a/sound/pci/asihpi/hpi6205.c b/sound/pci/asihpi/hpi6205.c
index e89991ea3543..3b4413448226 100644
--- a/sound/pci/asihpi/hpi6205.c
+++ b/sound/pci/asihpi/hpi6205.c
@@ -941,11 +941,11 @@ static void outstream_host_buffer_free(struct hpi_adapter_obj *pao,
 
 }
 
-static long outstream_get_space_available(struct hpi_hostbuffer_status
+static u32 outstream_get_space_available(struct hpi_hostbuffer_status
         *status)
 {
-        return status->size_in_bytes - ((long)(status->host_index) -
-                (long)(status->dSP_index));
+        return status->size_in_bytes - (status->host_index -
+                status->dSP_index);
 }
 
 static void outstream_write(struct hpi_adapter_obj *pao,
@@ -954,7 +954,7 @@ static void outstream_write(struct hpi_adapter_obj *pao,
         struct hpi_hw_obj *phw = pao->priv;
         struct bus_master_interface *interface = phw->p_interface_buffer;
         struct hpi_hostbuffer_status *status;
-        long space_available;
+        u32 space_available;
 
         if (!phw->outstream_host_buffer_size[phm->obj_index]) {
                 /* there  is no BBM buffer, write via message */
@@ -1007,7 +1007,7 @@ static void outstream_write(struct hpi_adapter_obj *pao,
         }
 
         space_available = outstream_get_space_available(status);
-        if (space_available < (long)phm->u.d.u.data.data_size) {
+        if (space_available < phm->u.d.u.data.data_size) {
                 phr->error = HPI_ERROR_INVALID_DATASIZE;
                 return;
         }
@@ -1018,7 +1018,7 @@ static void outstream_write(struct hpi_adapter_obj *pao,
                 && hpios_locked_mem_valid(&phw->outstream_host_buffers[phm->
                                 obj_index])) {
                 u8 *p_bbm_data;
-                long l_first_write;
+                u32 l_first_write;
                 u8 *p_app_data = (u8 *)phm->u.d.u.data.pb_data;
 
                 if (hpios_locked_mem_get_virt_addr(&phw->
@@ -1248,9 +1248,9 @@ static void instream_start(struct hpi_adapter_obj *pao,
         hw_message(pao, phm, phr);
 }
 
-static long instream_get_bytes_available(struct hpi_hostbuffer_status *status)
+static u32 instream_get_bytes_available(struct hpi_hostbuffer_status *status)
 {
-        return (long)(status->dSP_index) - (long)(status->host_index);
+        return status->dSP_index - status->host_index;
 }
 
 static void instream_read(struct hpi_adapter_obj *pao,
@@ -1259,9 +1259,9 @@ static void instream_read(struct hpi_adapter_obj *pao,
         struct hpi_hw_obj *phw = pao->priv;
         struct bus_master_interface *interface = phw->p_interface_buffer;
         struct hpi_hostbuffer_status *status;
-        long data_available;
+        u32 data_available;
         u8 *p_bbm_data;
-        long l_first_read;
+        u32 l_first_read;
         u8 *p_app_data = (u8 *)phm->u.d.u.data.pb_data;
 
         if (!phw->instream_host_buffer_size[phm->obj_index]) {
@@ -1272,7 +1272,7 @@ static void instream_read(struct hpi_adapter_obj *pao,
 
         status = &interface->instream_host_buffer_status[phm->obj_index];
         data_available = instream_get_bytes_available(status);
-        if (data_available < (long)phm->u.d.u.data.data_size) {
+        if (data_available < phm->u.d.u.data.data_size) {
                 phr->error = HPI_ERROR_INVALID_DATASIZE;
                 return;
         }
diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index 79f0f4ad242c..d3955096d872 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -612,7 +612,6 @@ static void davinci_hw_common_param(struct davinci_audio_dev *dev, int stream)
                                                                 NUMDMA_MASK);
                 mcasp_mod_bits(dev->base + DAVINCI_MCASP_WFIFOCTL,
                                 ((dev->txnumevt * tx_ser) << 8), NUMEVT_MASK);
-                mcasp_set_bits(dev->base + DAVINCI_MCASP_WFIFOCTL, FIFO_ENABLE);
         }
 
         if (dev->rxnumevt && stream == SNDRV_PCM_STREAM_CAPTURE) {
@@ -623,7 +622,6 @@ static void davinci_hw_common_param(struct davinci_audio_dev *dev, int stream)
                                                                 NUMDMA_MASK);
                 mcasp_mod_bits(dev->base + DAVINCI_MCASP_RFIFOCTL,
                                 ((dev->rxnumevt * rx_ser) << 8), NUMEVT_MASK);
-                mcasp_set_bits(dev->base + DAVINCI_MCASP_RFIFOCTL, FIFO_ENABLE);
         }
 }
 
diff --git a/sound/soc/fsl/mpc5200_dma.h b/sound/soc/fsl/mpc5200_dma.h
index 22208b373fb9..e1ec6d91ea38 100644
--- a/sound/soc/fsl/mpc5200_dma.h
+++ b/sound/soc/fsl/mpc5200_dma.h
@@ -73,7 +73,7 @@ struct psc_dma {
 };
 
 /* Utility for retrieving psc_dma_stream structure from a substream */
-inline struct psc_dma_stream *
+static inline struct psc_dma_stream *
 to_psc_dma_stream(struct snd_pcm_substream *substream, struct psc_dma *psc_dma)
 {
         if (substream->pstr->stream == SNDRV_PCM_STREAM_CAPTURE)
diff --git a/sound/soc/pxa/spitz.c b/sound/soc/pxa/spitz.c
index 1941a357e8c4..d256f5f313b5 100644
--- a/sound/soc/pxa/spitz.c
+++ b/sound/soc/pxa/spitz.c
@@ -328,38 +328,6 @@ static struct snd_soc_device spitz_snd_devdata = {
         .codec_dev = &soc_codec_dev_wm8750,
 };
 
-/*
- * FIXME: This is a temporary bodge to avoid cross-tree merge issues.
- * New drivers should register the wm8750 I2C device in the machine
- * setup code (under arch/arm for ARM systems).
- */
-static int wm8750_i2c_register(void)
-{
-        struct i2c_board_info info;
-        struct i2c_adapter *adapter;
-        struct i2c_client *client;
-
-        memset(&info, 0, sizeof(struct i2c_board_info));
-        info.addr = 0x1b;
-        strlcpy(info.type, "wm8750", I2C_NAME_SIZE);
-
-        adapter = i2c_get_adapter(0);
-        if (!adapter) {
-                printk(KERN_ERR "can't get i2c adapter 0\n");
-                return -ENODEV;
-        }
-
-        client = i2c_new_device(adapter, &info);
-        i2c_put_adapter(adapter);
-        if (!client) {
-                printk(KERN_ERR "can't add i2c device at 0x%x\n",
-                (unsigned int)info.addr);
-                return -ENODEV;
-        }
-
-        return 0;
-}
-
 static struct platform_device *spitz_snd_device;
 
 static int __init spitz_init(void)
@@ -369,10 +337,6 @@ static int __init spitz_init(void)
         if (!(machine_is_spitz() || machine_is_borzoi() || machine_is_akita()))
                 return -ENODEV;
 
-        ret = wm8750_i2c_setup();
-        if (ret != 0)
-                return ret;
-
         spitz_snd_device = platform_device_alloc("soc-audio", -1);
         if (!spitz_snd_device)
                 return -ENOMEM;
diff --git a/sound/spi/at73c213.c b/sound/spi/at73c213.c
index 4c7b051f9d17..1bc56b2b94e2 100644
--- a/sound/spi/at73c213.c
+++ b/sound/spi/at73c213.c
@@ -69,7 +69,6 @@ struct snd_at73c213 {
         int                             irq;
         int                             period;
         unsigned long                   bitrate;
-        struct clk                      *bitclk;
         struct ssc_device               *ssc;
         struct spi_device               *spi;
         u8                              spi_wbuffer[2];
diff --git a/sound/usb/clock.c b/sound/usb/clock.c
index b7aadd614c70..b5855114667e 100644
--- a/sound/usb/clock.c
+++ b/sound/usb/clock.c
@@ -103,7 +103,8 @@ static int uac_clock_selector_get_val(struct snd_usb_audio *chip, int selector_i
         ret = snd_usb_ctl_msg(chip->dev, usb_rcvctrlpipe(chip->dev, 0),
                               UAC2_CS_CUR,
                               USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_IN,
-                              UAC2_CX_CLOCK_SELECTOR << 8, selector_id << 8,
+                              UAC2_CX_CLOCK_SELECTOR << 8,
+                              snd_usb_ctrl_intf(chip) | (selector_id << 8),
                               &buf, sizeof(buf), 1000);
 
         if (ret < 0)
@@ -120,7 +121,8 @@ static bool uac_clock_source_is_valid(struct snd_usb_audio *chip, int source_id)
 
         err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC2_CS_CUR,
                               USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN,
-                              UAC2_CS_CONTROL_CLOCK_VALID << 8, source_id << 8,
+                              UAC2_CS_CONTROL_CLOCK_VALID << 8,
+                              snd_usb_ctrl_intf(chip) | (source_id << 8),
                               &data, sizeof(data), 1000);
 
         if (err < 0) {
@@ -269,7 +271,8 @@ static int set_sample_rate_v2(struct snd_usb_audio *chip, int iface,
         data[3] = rate >> 24;
         if ((err = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0), UAC2_CS_CUR,
                                    USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_OUT,
-                                   UAC2_CS_CONTROL_SAM_FREQ << 8, clock << 8,
+                                   UAC2_CS_CONTROL_SAM_FREQ << 8,
+                                   snd_usb_ctrl_intf(chip) | (clock << 8),
                                    data, sizeof(data), 1000)) < 0) {
                 snd_printk(KERN_ERR "%d:%d:%d: cannot set freq %d (v2)\n",
                            dev->devnum, iface, fmt->altsetting, rate);
@@ -278,7 +281,8 @@ static int set_sample_rate_v2(struct snd_usb_audio *chip, int iface,
 
         if ((err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC2_CS_CUR,
                                    USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN,
-                                   UAC2_CS_CONTROL_SAM_FREQ << 8, clock << 8,
+                                   UAC2_CS_CONTROL_SAM_FREQ << 8,
+                                   snd_usb_ctrl_intf(chip) | (clock << 8),
                                    data, sizeof(data), 1000)) < 0) {
                 snd_printk(KERN_WARNING "%d:%d:%d: cannot get freq (v2)\n",
                            dev->devnum, iface, fmt->altsetting);
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 9593b91452b9..6f6596cf2b19 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -427,6 +427,7 @@ int snd_usb_parse_audio_endpoints(struct snd_usb_audio *chip, int iface_no)
                 if (snd_usb_parse_audio_format(chip, fp, format, fmt, stream, alts) < 0) {
                         kfree(fp->rate_table);
                         kfree(fp);
+                        fp = NULL;
                         continue;
                 }
 
diff --git a/sound/usb/format.c b/sound/usb/format.c
index 5367cd1e52d9..30364aba79cc 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -206,6 +206,60 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof
 }
 
 /*
+ * Helper function to walk the array of sample rate triplets reported by
+ * the device. The problem is that we need to parse whole array first to
+ * get to know how many sample rates we have to expect.
+ * Then fp->rate_table can be allocated and filled.
+ */
+static int parse_uac2_sample_rate_range(struct audioformat *fp, int nr_triplets,
+                                        const unsigned char *data)
+{
+        int i, nr_rates = 0;
+
+        fp->rates = fp->rate_min = fp->rate_max = 0;
+
+        for (i = 0; i < nr_triplets; i++) {
+                int min = combine_quad(&data[2 + 12 * i]);
+                int max = combine_quad(&data[6 + 12 * i]);
+                int res = combine_quad(&data[10 + 12 * i]);
+                int rate;
+
+                if ((max < 0) || (min < 0) || (res < 0) || (max < min))
+                        continue;
+
+                /*
+                 * for ranges with res == 1, we announce a continuous sample
+                 * rate range, and this function should return 0 for no further
+                 * parsing.
+                 */
+                if (res == 1) {
+                        fp->rate_min = min;
+                        fp->rate_max = max;
+                        fp->rates = SNDRV_PCM_RATE_CONTINUOUS;
+                        return 0;
+                }
+
+                for (rate = min; rate <= max; rate += res) {
+                        if (fp->rate_table)
+                                fp->rate_table[nr_rates] = rate;
+                        if (!fp->rate_min || rate < fp->rate_min)
+                                fp->rate_min = rate;
+                        if (!fp->rate_max || rate > fp->rate_max)
+                                fp->rate_max = rate;
+                        fp->rates |= snd_pcm_rate_to_rate_bit(rate);
+
+                        nr_rates++;
+
+                        /* avoid endless loop */
+                        if (res == 0)
+                                break;
+                }
+        }
+
+        return nr_rates;
+}
+
+/*
  * parse the format descriptor and stores the possible sample rates
  * on the audioformat table (audio class v2).
  */
@@ -215,13 +269,20 @@ static int parse_audio_format_rates_v2(struct snd_usb_audio *chip,
 {
         struct usb_device *dev = chip->dev;
         unsigned char tmp[2], *data;
-        int i, nr_rates, data_size, ret = 0;
+        int nr_triplets, data_size, ret = 0;
         int clock = snd_usb_clock_find_source(chip, chip->ctrl_intf, fp->clock);
 
+        if (clock < 0) {
+                snd_printk(KERN_ERR "%s(): unable to find clock source (clock %d)\n",
+                                __func__, clock);
+                goto err;
+        }
+
         /* get the number of sample rates first by only fetching 2 bytes */
         ret = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC2_CS_RANGE,
                               USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN,
-                              UAC2_CS_CONTROL_SAM_FREQ << 8, clock << 8,
+                              UAC2_CS_CONTROL_SAM_FREQ << 8,
+                              snd_usb_ctrl_intf(chip) | (clock << 8),
                               tmp, sizeof(tmp), 1000);
 
         if (ret < 0) {
@@ -230,8 +291,8 @@ static int parse_audio_format_rates_v2(struct snd_usb_audio *chip,
                 goto err;
         }
 
-        nr_rates = (tmp[1] << 8) | tmp[0];
-        data_size = 2 + 12 * nr_rates;
+        nr_triplets = (tmp[1] << 8) | tmp[0];
+        data_size = 2 + 12 * nr_triplets;
         data = kzalloc(data_size, GFP_KERNEL);
         if (!data) {
                 ret = -ENOMEM;
@@ -241,7 +302,8 @@ static int parse_audio_format_rates_v2(struct snd_usb_audio *chip,
         /* now get the full information */
         ret = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC2_CS_RANGE,
                               USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN,
-                              UAC2_CS_CONTROL_SAM_FREQ << 8, clock << 8,
+                              UAC2_CS_CONTROL_SAM_FREQ << 8,
+                              snd_usb_ctrl_intf(chip) | (clock << 8),
                               data, data_size, 1000);
 
         if (ret < 0) {
@@ -251,26 +313,28 @@ static int parse_audio_format_rates_v2(struct snd_usb_audio *chip,
                 goto err_free;
         }
 
-        fp->rate_table = kmalloc(sizeof(int) * nr_rates, GFP_KERNEL);
+        /* Call the triplet parser, and make sure fp->rate_table is NULL.
+         * We just use the return value to know how many sample rates we
+         * will have to deal with. */
+        kfree(fp->rate_table);
+        fp->rate_table = NULL;
+        fp->nr_rates = parse_uac2_sample_rate_range(fp, nr_triplets, data);
+
+        if (fp->nr_rates == 0) {
+                /* SNDRV_PCM_RATE_CONTINUOUS */
+                ret = 0;
+                goto err_free;
+        }
+
+        fp->rate_table = kmalloc(sizeof(int) * fp->nr_rates, GFP_KERNEL);
         if (!fp->rate_table) {
                 ret = -ENOMEM;
                 goto err_free;
         }
 
-        fp->nr_rates = 0;
-        fp->rate_min = fp->rate_max = 0;
-
-        for (i = 0; i < nr_rates; i++) {
-                int rate = combine_quad(&data[2 + 12 * i]);
-
-                fp->rate_table[fp->nr_rates] = rate;
-                if (!fp->rate_min || rate < fp->rate_min)
-                        fp->rate_min = rate;
-                if (!fp->rate_max || rate > fp->rate_max)
-                        fp->rate_max = rate;
-                fp->rates |= snd_pcm_rate_to_rate_bit(rate);
-                fp->nr_rates++;
-        }
+        /* Call the triplet parser again, but this time, fp->rate_table is
+         * allocated, so the rates will be stored */
+        parse_uac2_sample_rate_range(fp, nr_triplets, data);
 
 err_free:
         kfree(data);
diff --git a/sound/usb/helper.h b/sound/usb/helper.h
index a6b0e51b3a9a..09bd943c43bf 100644
--- a/sound/usb/helper.h
+++ b/sound/usb/helper.h
@@ -28,5 +28,9 @@ unsigned char snd_usb_parse_datainterval(struct snd_usb_audio *chip,
 #define snd_usb_get_speed(dev) ((dev)->speed)
 #endif
 
+static inline int snd_usb_ctrl_intf(struct snd_usb_audio *chip)
+{
+        return get_iface_desc(chip->ctrl_intf)->bInterfaceNumber;
+}
 
 #endif /* __USBAUDIO_HELPER_H */
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index a060d005e209..736d134cc03c 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -297,20 +297,27 @@ static int get_ctl_value_v1(struct usb_mixer_elem_info *cval, int request, int v
 
 static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request, int validx, int *value_ret)
 {
-        unsigned char buf[14]; /* enough space for one range of 4 bytes */
+        unsigned char buf[2 + 3*sizeof(__u16)]; /* enough space for one range */
         unsigned char *val;
-        int ret;
+        int ret, size;
         __u8 bRequest;
 
-        bRequest = (request == UAC_GET_CUR) ?
-                UAC2_CS_CUR : UAC2_CS_RANGE;
+        if (request == UAC_GET_CUR) {
+                bRequest = UAC2_CS_CUR;
+                size = sizeof(__u16);
+        } else {
+                bRequest = UAC2_CS_RANGE;
+                size = sizeof(buf);
+        }
+
+        memset(buf, 0, sizeof(buf));
 
         ret = snd_usb_ctl_msg(cval->mixer->chip->dev,
                               usb_rcvctrlpipe(cval->mixer->chip->dev, 0),
                               bRequest,
                               USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_IN,
                               validx, cval->mixer->ctrlif | (cval->id << 8),
-                              buf, sizeof(buf), 1000);
+                              buf, size, 1000);
 
         if (ret < 0) {
                 snd_printk(KERN_ERR "cannot get ctl value: req = %#x, wValue = %#x, wIndex = %#x, type = %d\n",
@@ -318,6 +325,8 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request, int v
                 return ret;
         }
 
+        /* FIXME: how should we handle multiple triplets here? */
+
         switch (request) {
         case UAC_GET_CUR:
                 val = buf;
@@ -1098,6 +1107,19 @@ static void build_feature_ctl(struct mixer_build *state, void *raw_desc,
                 }
                 break;
 
+        case USB_ID(0x046d, 0x0809):
+        case USB_ID(0x046d, 0x0991):
+        /* Most audio usb devices lie about volume resolution.
+         * Most Logitech webcams have res = 384.
+         * Proboly there is some logitech magic behind this number --fishor
+         */
+                if (!strcmp(kctl->id.name, "Mic Capture Volume")) {
+                        snd_printk(KERN_INFO
+                                "set resolution quirk: cval->res = 384\n");
+                        cval->res = 384;
+                }
+                break;
+
         }
 
         snd_printdd(KERN_INFO "[%d] FU [%s] ch = %d, val = %d/%d/%d\n",
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index dc3435e18bde..711745f56bba 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -193,7 +193,7 @@ static void sig_handler(int sig)
 
 static void sig_atexit(void)
 {
-        if (child_pid != -1)
+        if (child_pid > 0)
                 kill(child_pid, SIGTERM);
 
         if (signr == -1)
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 1f08f008d289..2fbf6a463c81 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -538,8 +538,10 @@ int event__process_task(event_t *self, struct perf_session *session)
         dump_printf("(%d:%d):(%d:%d)\n", self->fork.pid, self->fork.tid,
                     self->fork.ppid, self->fork.ptid);
 
-        if (self->header.type == PERF_RECORD_EXIT)
+        if (self->header.type == PERF_RECORD_EXIT) {
+                perf_session__remove_thread(session, thread);
                 return 0;
+        }
 
         if (thread == NULL || parent == NULL ||
             thread__fork(thread, parent) < 0) {
diff --git a/tools/perf/util/newt.c b/tools/perf/util/newt.c
index cf182ca132fe..7537ca15900b 100644
--- a/tools/perf/util/newt.c
+++ b/tools/perf/util/newt.c
@@ -43,6 +43,9 @@ struct ui_progress *ui_progress__new(const char *title, u64 total)
 
         if (self != NULL) {
                 int cols;
+
+                if (use_browser <= 0)   
+                        return self;
                 newtGetScreenSize(&cols, NULL);
                 cols -= 4;
                 newtCenteredWindow(cols, 1, title);
@@ -67,14 +70,22 @@ out_free_self:
 
 void ui_progress__update(struct ui_progress *self, u64 curr)
 {
+        /*
+         * FIXME: We should have a per UI backend way of showing progress,
+         * stdio will just show a percentage as NN%, etc.
+         */
+        if (use_browser <= 0)
+                return;
         newtScaleSet(self->scale, curr);
         newtRefresh();
 }
 
 void ui_progress__delete(struct ui_progress *self)
 {
-        newtFormDestroy(self->form);
-        newtPopWindow();
+        if (use_browser > 0) {
+                newtFormDestroy(self->form);
+                newtPopWindow();
+        }
         free(self);
 }
 
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 8f83a1835766..c422cd676313 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -90,6 +90,7 @@ struct perf_session *perf_session__new(const char *filename, int mode, bool forc
 
         memcpy(self->filename, filename, len);
         self->threads = RB_ROOT;
+        INIT_LIST_HEAD(&self->dead_threads);
         self->hists_tree = RB_ROOT;
         self->last_match = NULL;
         self->mmap_window = 32;
@@ -131,6 +132,16 @@ void perf_session__delete(struct perf_session *self)
         free(self);
 }
 
+void perf_session__remove_thread(struct perf_session *self, struct thread *th)
+{
+        rb_erase(&th->rb_node, &self->threads);
+        /*
+         * We may have references to this thread, for instance in some hist_entry
+         * instances, so just move them to a separate list.
+         */
+        list_add_tail(&th->node, &self->dead_threads);
+}
+
 static bool symbol__match_parent_regex(struct symbol *sym)
 {
         if (sym->name && !regexec(&parent_regex, sym->name, 0, NULL, 0))
diff --git a/tools/perf/util/session.h b/tools/perf/util/session.h
index 55c6881b218d..9fa0fc2a863f 100644
--- a/tools/perf/util/session.h
+++ b/tools/perf/util/session.h
@@ -26,6 +26,7 @@ struct perf_session {
         unsigned long           size;
         unsigned long           mmap_window;
         struct rb_root          threads;
+        struct list_head        dead_threads;
         struct thread           *last_match;
         struct machine          host_machine;
         struct rb_root          machines;
@@ -99,6 +100,7 @@ int perf_session__create_kernel_maps(struct perf_session *self);
 
 int do_read(int fd, void *buf, size_t size);
 void perf_session__update_sample_type(struct perf_session *self);
+void perf_session__remove_thread(struct perf_session *self, struct thread *th);
 
 static inline
 struct machine *perf_session__find_host_machine(struct perf_session *self)
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 7fd6b151feb5..b63e5713849f 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1745,7 +1745,12 @@ static int dso__load_kernel_sym(struct dso *self, struct map *map,
         if (symbol_conf.vmlinux_name != NULL) {
                 err = dso__load_vmlinux(self, map,
                                         symbol_conf.vmlinux_name, filter);
-                goto out_try_fixup;
+                if (err > 0) {
+                        dso__set_long_name(self,
+                                           strdup(symbol_conf.vmlinux_name));
+                        goto out_fixup;
+                }
+                return err;
         }
 
         if (vmlinux_path != NULL) {
@@ -1806,7 +1811,6 @@ do_kallsyms:
                 pr_debug("Using %s for symbols\n", kallsyms_filename);
         free(kallsyms_allocated_filename);
 
-out_try_fixup:
         if (err > 0) {
 out_fixup:
                 if (kallsyms_filename != NULL)
diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
index 1f7ecd47f499..9a448b47400c 100644
--- a/tools/perf/util/thread.c
+++ b/tools/perf/util/thread.c
@@ -7,6 +7,15 @@
 #include "util.h"
 #include "debug.h"
 
+/* Skip "." and ".." directories */
+static int filter(const struct dirent *dir)
+{
+        if (dir->d_name[0] == '.')
+                return 0;
+        else
+                return 1;
+}
+
 int find_all_tid(int pid, pid_t ** all_tid)
 {
         char name[256];
@@ -16,7 +25,7 @@ int find_all_tid(int pid, pid_t ** all_tid)
         int i;
 
         sprintf(name, "/proc/%d/task", pid);
-        items = scandir(name, &namelist, NULL, NULL);
+        items = scandir(name, &namelist, filter, NULL);
         if (items <= 0)
                 return -ENOENT;
         *all_tid = malloc(sizeof(pid_t) * items);
diff --git a/tools/perf/util/thread.h b/tools/perf/util/thread.h
index 1dfd9ff8bdcd..ee6bbcf277ca 100644
--- a/tools/perf/util/thread.h
+++ b/tools/perf/util/thread.h
@@ -6,7 +6,10 @@
 #include "symbol.h"
 
 struct thread {
-        struct rb_node          rb_node;
+        union {
+                struct rb_node   rb_node;
+                struct list_head node;
+        };
         struct map_groups       mg;
         pid_t                   pid;
         char                    shortname[3];
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
index 7c79c1d76d0c..3500dee9cf2b 100644
--- a/virt/kvm/ioapic.c
+++ b/virt/kvm/ioapic.c
@@ -192,12 +192,13 @@ static int ioapic_deliver(struct kvm_ioapic *ioapic, int irq)
 
 int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)
 {
-        u32 old_irr = ioapic->irr;
+        u32 old_irr;
         u32 mask = 1 << irq;
         union kvm_ioapic_redirect_entry entry;
         int ret = 1;
 
         spin_lock(&ioapic->lock);
+        old_irr = ioapic->irr;
         if (irq >= 0 && irq < IOAPIC_NUM_PINS) {
                 entry = ioapic->redirtbl[irq];
                 level ^= entry.fields.polarity;
diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
index d2f06be63354..96048ee9e39e 100644
--- a/virt/kvm/iommu.c
+++ b/virt/kvm/iommu.c
@@ -271,7 +271,7 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
                 pfn  = phys >> PAGE_SHIFT;
 
                 /* Unmap address from IO address space */
-                order       = iommu_unmap(domain, gfn_to_gpa(gfn), PAGE_SIZE);
+                order       = iommu_unmap(domain, gfn_to_gpa(gfn), 0);
                 unmap_pages = 1ULL << order;
 
                 /* Unpin all pages we just unmapped to not leak any memory */