360 files changed, 2965 insertions, 1795 deletions

diff --git a/Documentation/networking/00-INDEX b/Documentation/networking/00-INDEX
index fe5c099b8fc8..4edd78dfb362 100644
--- a/Documentation/networking/00-INDEX
+++ b/Documentation/networking/00-INDEX
@@ -40,8 +40,6 @@ decnet.txt
         - info on using the DECnet networking layer in Linux.
 depca.txt
         - the Digital DEPCA/EtherWORKS DE1?? and DE2?? LANCE Ethernet driver
-dgrs.txt
-        - the Digi International RightSwitch SE-X Ethernet driver
 dmfe.txt
         - info on the Davicom DM9102(A)/DM9132/DM9801 fast ethernet driver.
 e100.txt
@@ -50,8 +48,6 @@ e1000.txt
         - info on Intel's E1000 line of gigabit ethernet boards
 eql.txt
         - serial IP load balancing
-ethertap.txt
-        - the Ethertap user space packet reception and transmission driver
 ewrk3.txt
         - the Digital EtherWORKS 3 DE203/4/5 Ethernet driver
 filter.txt
@@ -104,8 +100,6 @@ tuntap.txt
         - TUN/TAP device driver, allowing user space Rx/Tx of packets.
 vortex.txt
         - info on using 3Com Vortex (3c590, 3c592, 3c595, 3c597) Ethernet cards.
-wavelan.txt
-        - AT&T GIS (nee NCR) WaveLAN card: An Ethernet-like radio transceiver
 x25.txt
         - general info on X.25 development.
 x25-iface.txt
diff --git a/Documentation/networking/dns_resolver.txt b/Documentation/networking/dns_resolver.txt
index aefd1e681804..04ca06325b08 100644
--- a/Documentation/networking/dns_resolver.txt
+++ b/Documentation/networking/dns_resolver.txt
@@ -61,7 +61,6 @@ before the more general line given above as the first match is the one taken.
         create  dns_resolver    foo:*   *       /usr/sbin/dns.foo %k
 
 
-
 =====
 USAGE
 =====
@@ -104,6 +103,14 @@ implemented in the module can be called after doing:
      returned also.
 
 
+===============================
+READING DNS KEYS FROM USERSPACE
+===============================
+
+Keys of dns_resolver type can be read from userspace using keyctl_read() or
+"keyctl read/print/pipe".
+
+
 =========
 MECHANISM
 =========
diff --git a/MAINTAINERS b/MAINTAINERS
index 8afba6321e24..f1bc3dc6b369 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1010,6 +1010,15 @@ L:	linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-s5p*/
 
+ARM/SAMSUNG MOBILE MACHINE SUPPORT
+M:      Kyungmin Park <kyungmin.park@samsung.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-s5pv210/mach-aquila.c
+F:      arch/arm/mach-s5pv210/mach-goni.c
+F:      arch/arm/mach-exynos4/mach-universal_c210.c
+F:      arch/arm/mach-exynos4/mach-nuri.c
+
 ARM/SAMSUNG S5P SERIES FIMC SUPPORT
 M:      Kyungmin Park <kyungmin.park@samsung.com>
 M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
@@ -1467,6 +1476,7 @@ F:	include/net/bluetooth/
 
 BONDING DRIVER
 M:      Jay Vosburgh <fubar@us.ibm.com>
+M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/bonding/
 S:      Supported
@@ -2033,7 +2043,7 @@ F:	Documentation/scsi/dc395x.txt
 F:      drivers/scsi/dc395x.*
 
 DCCP PROTOCOL
-M:      Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
+M:      Gerrit Renker <gerrit@erg.abdn.ac.uk>
 L:      dccp@vger.kernel.org
 W:      http://www.linuxfoundation.org/collaborate/workgroups/networking/dccp
 S:      Maintained
@@ -3519,7 +3529,7 @@ F:	drivers/hwmon/jc42.c
 F:      Documentation/hwmon/jc42
 
 JFS FILESYSTEM
-M:      Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+M:      Dave Kleikamp <shaggy@kernel.org>
 L:      jfs-discussion@lists.sourceforge.net
 W:      http://jfs.sourceforge.net/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6.git
@@ -4282,10 +4292,7 @@ S:	Maintained
 F:      net/sched/sch_netem.c
 
 NETERION 10GbE DRIVERS (s2io/vxge)
-M:      Ramkrishna Vepa <ramkrishna.vepa@exar.com>
-M:      Sivakumar Subramani <sivakumar.subramani@exar.com>
-M:      Sreenivasa Honnur <sreenivasa.honnur@exar.com>
-M:      Jon Mason <jon.mason@exar.com>
+M:      Jon Mason <jdmason@kudzu.us>
 L:      netdev@vger.kernel.org
 W:      http://trac.neterion.com/cgi-bin/trac.cgi/wiki/Linux?Anonymous
 W:      http://trac.neterion.com/cgi-bin/trac.cgi/wiki/X3100Linux?Anonymous
@@ -5171,6 +5178,7 @@ F:	drivers/char/random.c
 
 RAPIDIO SUBSYSTEM
 M:      Matt Porter <mporter@kernel.crashing.org>
+M:      Alexandre Bounine <alexandre.bounine@idt.com>
 S:      Maintained
 F:      drivers/rapidio/
 
diff --git a/Makefile b/Makefile
index 2f7d92255b57..d6592b63c8cb 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 38
-EXTRAVERSION = -rc7
+EXTRAVERSION =
 NAME = Flesh-Eating Bats with Fangs
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 47f63d480141..cc31bec2e316 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -11,6 +11,7 @@ config ALPHA
         select HAVE_GENERIC_HARDIRQS
         select GENERIC_IRQ_PROBE
         select AUTO_IRQ_AFFINITY if SMP
+        select GENERIC_HARDIRQS_NO_DEPRECATED
         help
           The Alpha is a 64-bit general-purpose processor designed and
           marketed by the Digital Equipment Corporation of blessed memory,
diff --git a/arch/alpha/kernel/irq.c b/arch/alpha/kernel/irq.c
index 9ab234f48dd8..a19d60082299 100644
--- a/arch/alpha/kernel/irq.c
+++ b/arch/alpha/kernel/irq.c
@@ -44,11 +44,16 @@ static char irq_user_affinity[NR_IRQS];
 
 int irq_select_affinity(unsigned int irq)
 {
-        struct irq_desc *desc = irq_to_desc[irq];
+        struct irq_data *data = irq_get_irq_data(irq);
+        struct irq_chip *chip;
         static int last_cpu;
         int cpu = last_cpu + 1;
 
-        if (!desc || !get_irq_desc_chip(desc)->set_affinity || irq_user_affinity[irq])
+        if (!data)
+                return 1;
+        chip = irq_data_get_irq_chip(data);
+
+        if (!chip->irq_set_affinity || irq_user_affinity[irq])
                 return 1;
 
         while (!cpu_possible(cpu) ||
@@ -56,8 +61,8 @@ int irq_select_affinity(unsigned int irq)
                 cpu = (cpu < (NR_CPUS-1) ? cpu + 1 : 0);
         last_cpu = cpu;
 
-        cpumask_copy(desc->affinity, cpumask_of(cpu));
-        get_irq_desc_chip(desc)->set_affinity(irq, cpumask_of(cpu));
+        cpumask_copy(data->affinity, cpumask_of(cpu));
+        chip->irq_set_affinity(data, cpumask_of(cpu), false);
         return 0;
 }
 #endif /* CONFIG_SMP */
diff --git a/arch/alpha/kernel/irq_alpha.c b/arch/alpha/kernel/irq_alpha.c
index 2d0679b60939..411ca11d0a18 100644
--- a/arch/alpha/kernel/irq_alpha.c
+++ b/arch/alpha/kernel/irq_alpha.c
@@ -228,14 +228,9 @@ struct irqaction timer_irqaction = {
 void __init
 init_rtc_irq(void)
 {
-        struct irq_desc *desc = irq_to_desc(RTC_IRQ);
-
-        if (desc) {
-                desc->status |= IRQ_DISABLED;
-                set_irq_chip_and_handler_name(RTC_IRQ, &no_irq_chip,
-                        handle_simple_irq, "RTC");
-                setup_irq(RTC_IRQ, &timer_irqaction);
-        }
+        set_irq_chip_and_handler_name(RTC_IRQ, &no_irq_chip,
+                                      handle_simple_irq, "RTC");
+        setup_irq(RTC_IRQ, &timer_irqaction);
 }
 
 /* Dummy irqactions.  */
diff --git a/arch/alpha/kernel/irq_i8259.c b/arch/alpha/kernel/irq_i8259.c
index 956ea0ed1694..c7cc9813e45f 100644
--- a/arch/alpha/kernel/irq_i8259.c
+++ b/arch/alpha/kernel/irq_i8259.c
@@ -33,10 +33,10 @@ i8259_update_irq_hw(unsigned int irq, unsigned long mask)
 }
 
 inline void
-i8259a_enable_irq(unsigned int irq)
+i8259a_enable_irq(struct irq_data *d)
 {
         spin_lock(&i8259_irq_lock);
-        i8259_update_irq_hw(irq, cached_irq_mask &= ~(1 << irq));
+        i8259_update_irq_hw(d->irq, cached_irq_mask &= ~(1 << d->irq));
         spin_unlock(&i8259_irq_lock);
 }
 
@@ -47,16 +47,18 @@ __i8259a_disable_irq(unsigned int irq)
 }
 
 void
-i8259a_disable_irq(unsigned int irq)
+i8259a_disable_irq(struct irq_data *d)
 {
         spin_lock(&i8259_irq_lock);
-        __i8259a_disable_irq(irq);
+        __i8259a_disable_irq(d->irq);
         spin_unlock(&i8259_irq_lock);
 }
 
 void
-i8259a_mask_and_ack_irq(unsigned int irq)
+i8259a_mask_and_ack_irq(struct irq_data *d)
 {
+        unsigned int irq = d->irq;
+
         spin_lock(&i8259_irq_lock);
         __i8259a_disable_irq(irq);
 
@@ -71,9 +73,9 @@ i8259a_mask_and_ack_irq(unsigned int irq)
 
 struct irq_chip i8259a_irq_type = {
         .name           = "XT-PIC",
-        .unmask         = i8259a_enable_irq,
-        .mask           = i8259a_disable_irq,
-        .mask_ack       = i8259a_mask_and_ack_irq,
+        .irq_unmask     = i8259a_enable_irq,
+        .irq_mask       = i8259a_disable_irq,
+        .irq_mask_ack   = i8259a_mask_and_ack_irq,
 };
 
 void __init
diff --git a/arch/alpha/kernel/irq_impl.h b/arch/alpha/kernel/irq_impl.h
index b63ccd7386f1..d507a234b05d 100644
--- a/arch/alpha/kernel/irq_impl.h
+++ b/arch/alpha/kernel/irq_impl.h
@@ -31,11 +31,9 @@ extern void init_rtc_irq(void);
 
 extern void common_init_isa_dma(void);
 
-extern void i8259a_enable_irq(unsigned int);
-extern void i8259a_disable_irq(unsigned int);
-extern void i8259a_mask_and_ack_irq(unsigned int);
-extern unsigned int i8259a_startup_irq(unsigned int);
-extern void i8259a_end_irq(unsigned int);
+extern void i8259a_enable_irq(struct irq_data *d);
+extern void i8259a_disable_irq(struct irq_data *d);
+extern void i8259a_mask_and_ack_irq(struct irq_data *d);
 extern struct irq_chip i8259a_irq_type;
 extern void init_i8259a_irqs(void);
 
diff --git a/arch/alpha/kernel/irq_pyxis.c b/arch/alpha/kernel/irq_pyxis.c
index 2863458c853e..b30227fa7f5f 100644
--- a/arch/alpha/kernel/irq_pyxis.c
+++ b/arch/alpha/kernel/irq_pyxis.c
@@ -29,21 +29,21 @@ pyxis_update_irq_hw(unsigned long mask)
 }
 
 static inline void
-pyxis_enable_irq(unsigned int irq)
+pyxis_enable_irq(struct irq_data *d)
 {
-        pyxis_update_irq_hw(cached_irq_mask |= 1UL << (irq - 16));
+        pyxis_update_irq_hw(cached_irq_mask |= 1UL << (d->irq - 16));
 }
 
 static void
-pyxis_disable_irq(unsigned int irq)
+pyxis_disable_irq(struct irq_data *d)
 {
-        pyxis_update_irq_hw(cached_irq_mask &= ~(1UL << (irq - 16)));
+        pyxis_update_irq_hw(cached_irq_mask &= ~(1UL << (d->irq - 16)));
 }
 
 static void
-pyxis_mask_and_ack_irq(unsigned int irq)
+pyxis_mask_and_ack_irq(struct irq_data *d)
 {
-        unsigned long bit = 1UL << (irq - 16);
+        unsigned long bit = 1UL << (d->irq - 16);
         unsigned long mask = cached_irq_mask &= ~bit;
 
         /* Disable the interrupt.  */
@@ -58,9 +58,9 @@ pyxis_mask_and_ack_irq(unsigned int irq)
 
 static struct irq_chip pyxis_irq_type = {
         .name           = "PYXIS",
-        .mask_ack       = pyxis_mask_and_ack_irq,
-        .mask           = pyxis_disable_irq,
-        .unmask         = pyxis_enable_irq,
+        .irq_mask_ack   = pyxis_mask_and_ack_irq,
+        .irq_mask       = pyxis_disable_irq,
+        .irq_unmask     = pyxis_enable_irq,
 };
 
 void 
@@ -103,7 +103,7 @@ init_pyxis_irqs(unsigned long ignore_mask)
                 if ((ignore_mask >> i) & 1)
                         continue;
                 set_irq_chip_and_handler(i, &pyxis_irq_type, handle_level_irq);
-                irq_to_desc(i)->status |= IRQ_LEVEL;
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 
         setup_irq(16+7, &isa_cascade_irqaction);
diff --git a/arch/alpha/kernel/irq_srm.c b/arch/alpha/kernel/irq_srm.c
index 0e57e828b413..82a47bba41c4 100644
--- a/arch/alpha/kernel/irq_srm.c
+++ b/arch/alpha/kernel/irq_srm.c
@@ -18,27 +18,27 @@
 DEFINE_SPINLOCK(srm_irq_lock);
 
 static inline void
-srm_enable_irq(unsigned int irq)
+srm_enable_irq(struct irq_data *d)
 {
         spin_lock(&srm_irq_lock);
-        cserve_ena(irq - 16);
+        cserve_ena(d->irq - 16);
         spin_unlock(&srm_irq_lock);
 }
 
 static void
-srm_disable_irq(unsigned int irq)
+srm_disable_irq(struct irq_data *d)
 {
         spin_lock(&srm_irq_lock);
-        cserve_dis(irq - 16);
+        cserve_dis(d->irq - 16);
         spin_unlock(&srm_irq_lock);
 }
 
 /* Handle interrupts from the SRM, assuming no additional weirdness.  */
 static struct irq_chip srm_irq_type = {
         .name           = "SRM",
-        .unmask         = srm_enable_irq,
-        .mask           = srm_disable_irq,
-        .mask_ack       = srm_disable_irq,
+        .irq_unmask     = srm_enable_irq,
+        .irq_mask       = srm_disable_irq,
+        .irq_mask_ack   = srm_disable_irq,
 };
 
 void __init
@@ -52,7 +52,7 @@ init_srm_irqs(long max, unsigned long ignore_mask)
                 if (i < 64 && ((ignore_mask >> i) & 1))
                         continue;
                 set_irq_chip_and_handler(i, &srm_irq_type, handle_level_irq);
-                irq_to_desc(i)->status |= IRQ_LEVEL;
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 }
 
diff --git a/arch/alpha/kernel/sys_alcor.c b/arch/alpha/kernel/sys_alcor.c
index 7bef61768236..88d95e872f55 100644
--- a/arch/alpha/kernel/sys_alcor.c
+++ b/arch/alpha/kernel/sys_alcor.c
@@ -44,31 +44,31 @@ alcor_update_irq_hw(unsigned long mask)
 }
 
 static inline void
-alcor_enable_irq(unsigned int irq)
+alcor_enable_irq(struct irq_data *d)
 {
-        alcor_update_irq_hw(cached_irq_mask |= 1UL << (irq - 16));
+        alcor_update_irq_hw(cached_irq_mask |= 1UL << (d->irq - 16));
 }
 
 static void
-alcor_disable_irq(unsigned int irq)
+alcor_disable_irq(struct irq_data *d)
 {
-        alcor_update_irq_hw(cached_irq_mask &= ~(1UL << (irq - 16)));
+        alcor_update_irq_hw(cached_irq_mask &= ~(1UL << (d->irq - 16)));
 }
 
 static void
-alcor_mask_and_ack_irq(unsigned int irq)
+alcor_mask_and_ack_irq(struct irq_data *d)
 {
-        alcor_disable_irq(irq);
+        alcor_disable_irq(d);
 
         /* On ALCOR/XLT, need to dismiss interrupt via GRU. */
-        *(vuip)GRU_INT_CLEAR = 1 << (irq - 16); mb();
+        *(vuip)GRU_INT_CLEAR = 1 << (d->irq - 16); mb();
         *(vuip)GRU_INT_CLEAR = 0; mb();
 }
 
 static void
-alcor_isa_mask_and_ack_irq(unsigned int irq)
+alcor_isa_mask_and_ack_irq(struct irq_data *d)
 {
-        i8259a_mask_and_ack_irq(irq);
+        i8259a_mask_and_ack_irq(d);
 
         /* On ALCOR/XLT, need to dismiss interrupt via GRU. */
         *(vuip)GRU_INT_CLEAR = 0x80000000; mb();
@@ -77,9 +77,9 @@ alcor_isa_mask_and_ack_irq(unsigned int irq)
 
 static struct irq_chip alcor_irq_type = {
         .name           = "ALCOR",
-        .unmask         = alcor_enable_irq,
-        .mask           = alcor_disable_irq,
-        .mask_ack       = alcor_mask_and_ack_irq,
+        .irq_unmask     = alcor_enable_irq,
+        .irq_mask       = alcor_disable_irq,
+        .irq_mask_ack   = alcor_mask_and_ack_irq,
 };
 
 static void
@@ -126,9 +126,9 @@ alcor_init_irq(void)
                 if (i >= 16+20 && i <= 16+30)
                         continue;
                 set_irq_chip_and_handler(i, &alcor_irq_type, handle_level_irq);
-                irq_to_desc(i)->status |= IRQ_LEVEL;
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
-        i8259a_irq_type.ack = alcor_isa_mask_and_ack_irq;
+        i8259a_irq_type.irq_ack = alcor_isa_mask_and_ack_irq;
 
         init_i8259a_irqs();
         common_init_isa_dma();
diff --git a/arch/alpha/kernel/sys_cabriolet.c b/arch/alpha/kernel/sys_cabriolet.c
index b0c916493aea..57eb6307bc27 100644
--- a/arch/alpha/kernel/sys_cabriolet.c
+++ b/arch/alpha/kernel/sys_cabriolet.c
@@ -46,22 +46,22 @@ cabriolet_update_irq_hw(unsigned int irq, unsigned long mask)
 }
 
 static inline void
-cabriolet_enable_irq(unsigned int irq)
+cabriolet_enable_irq(struct irq_data *d)
 {
-        cabriolet_update_irq_hw(irq, cached_irq_mask &= ~(1UL << irq));
+        cabriolet_update_irq_hw(d->irq, cached_irq_mask &= ~(1UL << d->irq));
 }
 
 static void
-cabriolet_disable_irq(unsigned int irq)
+cabriolet_disable_irq(struct irq_data *d)
 {
-        cabriolet_update_irq_hw(irq, cached_irq_mask |= 1UL << irq);
+        cabriolet_update_irq_hw(d->irq, cached_irq_mask |= 1UL << d->irq);
 }
 
 static struct irq_chip cabriolet_irq_type = {
         .name           = "CABRIOLET",
-        .unmask         = cabriolet_enable_irq,
-        .mask           = cabriolet_disable_irq,
-        .mask_ack       = cabriolet_disable_irq,
+        .irq_unmask     = cabriolet_enable_irq,
+        .irq_mask       = cabriolet_disable_irq,
+        .irq_mask_ack   = cabriolet_disable_irq,
 };
 
 static void 
@@ -107,7 +107,7 @@ common_init_irq(void (*srm_dev_int)(unsigned long v))
                 for (i = 16; i < 35; ++i) {
                         set_irq_chip_and_handler(i, &cabriolet_irq_type,
                                 handle_level_irq);
-                        irq_to_desc(i)->status |= IRQ_LEVEL;
+                        irq_set_status_flags(i, IRQ_LEVEL);
                 }
         }
 
diff --git a/arch/alpha/kernel/sys_dp264.c b/arch/alpha/kernel/sys_dp264.c
index edad5f759ccd..481df4ecb651 100644
--- a/arch/alpha/kernel/sys_dp264.c
+++ b/arch/alpha/kernel/sys_dp264.c
@@ -98,37 +98,37 @@ tsunami_update_irq_hw(unsigned long mask)
 }
 
 static void
-dp264_enable_irq(unsigned int irq)
+dp264_enable_irq(struct irq_data *d)
 {
         spin_lock(&dp264_irq_lock);
-        cached_irq_mask |= 1UL << irq;
+        cached_irq_mask |= 1UL << d->irq;
         tsunami_update_irq_hw(cached_irq_mask);
         spin_unlock(&dp264_irq_lock);
 }
 
 static void
-dp264_disable_irq(unsigned int irq)
+dp264_disable_irq(struct irq_data *d)
 {
         spin_lock(&dp264_irq_lock);
-        cached_irq_mask &= ~(1UL << irq);
+        cached_irq_mask &= ~(1UL << d->irq);
         tsunami_update_irq_hw(cached_irq_mask);
         spin_unlock(&dp264_irq_lock);
 }
 
 static void
-clipper_enable_irq(unsigned int irq)
+clipper_enable_irq(struct irq_data *d)
 {
         spin_lock(&dp264_irq_lock);
-        cached_irq_mask |= 1UL << (irq - 16);
+        cached_irq_mask |= 1UL << (d->irq - 16);
         tsunami_update_irq_hw(cached_irq_mask);
         spin_unlock(&dp264_irq_lock);
 }
 
 static void
-clipper_disable_irq(unsigned int irq)
+clipper_disable_irq(struct irq_data *d)
 {
         spin_lock(&dp264_irq_lock);
-        cached_irq_mask &= ~(1UL << (irq - 16));
+        cached_irq_mask &= ~(1UL << (d->irq - 16));
         tsunami_update_irq_hw(cached_irq_mask);
         spin_unlock(&dp264_irq_lock);
 }
@@ -149,10 +149,11 @@ cpu_set_irq_affinity(unsigned int irq, cpumask_t affinity)
 }
 
 static int
-dp264_set_affinity(unsigned int irq, const struct cpumask *affinity)
-{ 
+dp264_set_affinity(struct irq_data *d, const struct cpumask *affinity,
+                   bool force)
+{
         spin_lock(&dp264_irq_lock);
-        cpu_set_irq_affinity(irq, *affinity);
+        cpu_set_irq_affinity(d->irq, *affinity);
         tsunami_update_irq_hw(cached_irq_mask);
         spin_unlock(&dp264_irq_lock);
 
@@ -160,10 +161,11 @@ dp264_set_affinity(unsigned int irq, const struct cpumask *affinity)
 }
 
 static int
-clipper_set_affinity(unsigned int irq, const struct cpumask *affinity)
-{ 
+clipper_set_affinity(struct irq_data *d, const struct cpumask *affinity,
+                     bool force)
+{
         spin_lock(&dp264_irq_lock);
-        cpu_set_irq_affinity(irq - 16, *affinity);
+        cpu_set_irq_affinity(d->irq - 16, *affinity);
         tsunami_update_irq_hw(cached_irq_mask);
         spin_unlock(&dp264_irq_lock);
 
@@ -171,19 +173,19 @@ clipper_set_affinity(unsigned int irq, const struct cpumask *affinity)
 }
 
 static struct irq_chip dp264_irq_type = {
-        .name           = "DP264",
-        .unmask         = dp264_enable_irq,
-        .mask           = dp264_disable_irq,
-        .mask_ack       = dp264_disable_irq,
-        .set_affinity   = dp264_set_affinity,
+        .name                   = "DP264",
+        .irq_unmask             = dp264_enable_irq,
+        .irq_mask               = dp264_disable_irq,
+        .irq_mask_ack           = dp264_disable_irq,
+        .irq_set_affinity       = dp264_set_affinity,
 };
 
 static struct irq_chip clipper_irq_type = {
-        .name           = "CLIPPER",
-        .unmask         = clipper_enable_irq,
-        .mask           = clipper_disable_irq,
-        .mask_ack       = clipper_disable_irq,
-        .set_affinity   = clipper_set_affinity,
+        .name                   = "CLIPPER",
+        .irq_unmask             = clipper_enable_irq,
+        .irq_mask               = clipper_disable_irq,
+        .irq_mask_ack           = clipper_disable_irq,
+        .irq_set_affinity       = clipper_set_affinity,
 };
 
 static void
@@ -268,8 +270,8 @@ init_tsunami_irqs(struct irq_chip * ops, int imin, int imax)
 {
         long i;
         for (i = imin; i <= imax; ++i) {
-                irq_to_desc(i)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(i, ops, handle_level_irq);
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 }
 
diff --git a/arch/alpha/kernel/sys_eb64p.c b/arch/alpha/kernel/sys_eb64p.c
index ae5f29d127b0..402e908ffb3e 100644
--- a/arch/alpha/kernel/sys_eb64p.c
+++ b/arch/alpha/kernel/sys_eb64p.c
@@ -44,22 +44,22 @@ eb64p_update_irq_hw(unsigned int irq, unsigned long mask)
 }
 
 static inline void
-eb64p_enable_irq(unsigned int irq)
+eb64p_enable_irq(struct irq_data *d)
 {
-        eb64p_update_irq_hw(irq, cached_irq_mask &= ~(1 << irq));
+        eb64p_update_irq_hw(d->irq, cached_irq_mask &= ~(1 << d->irq));
 }
 
 static void
-eb64p_disable_irq(unsigned int irq)
+eb64p_disable_irq(struct irq_data *d)
 {
-        eb64p_update_irq_hw(irq, cached_irq_mask |= 1 << irq);
+        eb64p_update_irq_hw(d->irq, cached_irq_mask |= 1 << d->irq);
 }
 
 static struct irq_chip eb64p_irq_type = {
         .name           = "EB64P",
-        .unmask         = eb64p_enable_irq,
-        .mask           = eb64p_disable_irq,
-        .mask_ack       = eb64p_disable_irq,
+        .irq_unmask     = eb64p_enable_irq,
+        .irq_mask       = eb64p_disable_irq,
+        .irq_mask_ack   = eb64p_disable_irq,
 };
 
 static void 
@@ -118,9 +118,9 @@ eb64p_init_irq(void)
         init_i8259a_irqs();
 
         for (i = 16; i < 32; ++i) {
-                irq_to_desc(i)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(i, &eb64p_irq_type, handle_level_irq);
-        }               
+                irq_set_status_flags(i, IRQ_LEVEL);
+        }
 
         common_init_isa_dma();
         setup_irq(16+5, &isa_cascade_irqaction);
diff --git a/arch/alpha/kernel/sys_eiger.c b/arch/alpha/kernel/sys_eiger.c
index 1121bc5c6c6c..0b44a54c1522 100644
--- a/arch/alpha/kernel/sys_eiger.c
+++ b/arch/alpha/kernel/sys_eiger.c
@@ -51,16 +51,18 @@ eiger_update_irq_hw(unsigned long irq, unsigned long mask)
 }
 
 static inline void
-eiger_enable_irq(unsigned int irq)
+eiger_enable_irq(struct irq_data *d)
 {
+        unsigned int irq = d->irq;
         unsigned long mask;
         mask = (cached_irq_mask[irq >= 64] &= ~(1UL << (irq & 63)));
         eiger_update_irq_hw(irq, mask);
 }
 
 static void
-eiger_disable_irq(unsigned int irq)
+eiger_disable_irq(struct irq_data *d)
 {
+        unsigned int irq = d->irq;
         unsigned long mask;
         mask = (cached_irq_mask[irq >= 64] |= 1UL << (irq & 63));
         eiger_update_irq_hw(irq, mask);
@@ -68,9 +70,9 @@ eiger_disable_irq(unsigned int irq)
 
 static struct irq_chip eiger_irq_type = {
         .name           = "EIGER",
-        .unmask         = eiger_enable_irq,
-        .mask           = eiger_disable_irq,
-        .mask_ack       = eiger_disable_irq,
+        .irq_unmask     = eiger_enable_irq,
+        .irq_mask       = eiger_disable_irq,
+        .irq_mask_ack   = eiger_disable_irq,
 };
 
 static void
@@ -136,8 +138,8 @@ eiger_init_irq(void)
         init_i8259a_irqs();
 
         for (i = 16; i < 128; ++i) {
-                irq_to_desc(i)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(i, &eiger_irq_type, handle_level_irq);
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 }
 
diff --git a/arch/alpha/kernel/sys_jensen.c b/arch/alpha/kernel/sys_jensen.c
index 34f55e03d331..00341b75c8b2 100644
--- a/arch/alpha/kernel/sys_jensen.c
+++ b/arch/alpha/kernel/sys_jensen.c
@@ -63,34 +63,34 @@
  */
 
 static void
-jensen_local_enable(unsigned int irq)
+jensen_local_enable(struct irq_data *d)
 {
         /* the parport is really hw IRQ 1, silly Jensen.  */
-        if (irq == 7)
-                i8259a_enable_irq(1);
+        if (d->irq == 7)
+                i8259a_enable_irq(d);
 }
 
 static void
-jensen_local_disable(unsigned int irq)
+jensen_local_disable(struct irq_data *d)
 {
         /* the parport is really hw IRQ 1, silly Jensen.  */
-        if (irq == 7)
-                i8259a_disable_irq(1);
+        if (d->irq == 7)
+                i8259a_disable_irq(d);
 }
 
 static void
-jensen_local_mask_ack(unsigned int irq)
+jensen_local_mask_ack(struct irq_data *d)
 {
         /* the parport is really hw IRQ 1, silly Jensen.  */
-        if (irq == 7)
-                i8259a_mask_and_ack_irq(1);
+        if (d->irq == 7)
+                i8259a_mask_and_ack_irq(d);
 }
 
 static struct irq_chip jensen_local_irq_type = {
         .name           = "LOCAL",
-        .unmask         = jensen_local_enable,
-        .mask           = jensen_local_disable,
-        .mask_ack       = jensen_local_mask_ack,
+        .irq_unmask     = jensen_local_enable,
+        .irq_mask       = jensen_local_disable,
+        .irq_mask_ack   = jensen_local_mask_ack,
 };
 
 static void 
diff --git a/arch/alpha/kernel/sys_marvel.c b/arch/alpha/kernel/sys_marvel.c
index 2bfc9f1b1ddc..e61910734e41 100644
--- a/arch/alpha/kernel/sys_marvel.c
+++ b/arch/alpha/kernel/sys_marvel.c
@@ -104,9 +104,10 @@ io7_get_irq_ctl(unsigned int irq, struct io7 **pio7)
 }
 
 static void
-io7_enable_irq(unsigned int irq)
+io7_enable_irq(struct irq_data *d)
 {
         volatile unsigned long *ctl;
+        unsigned int irq = d->irq;
         struct io7 *io7;
 
         ctl = io7_get_irq_ctl(irq, &io7);
@@ -115,7 +116,7 @@ io7_enable_irq(unsigned int irq)
                        __func__, irq);
                 return;
         }
-                
+
         spin_lock(&io7->irq_lock);
         *ctl |= 1UL << 24;
         mb();
@@ -124,9 +125,10 @@ io7_enable_irq(unsigned int irq)
 }
 
 static void
-io7_disable_irq(unsigned int irq)
+io7_disable_irq(struct irq_data *d)
 {
         volatile unsigned long *ctl;
+        unsigned int irq = d->irq;
         struct io7 *io7;
 
         ctl = io7_get_irq_ctl(irq, &io7);
@@ -135,7 +137,7 @@ io7_disable_irq(unsigned int irq)
                        __func__, irq);
                 return;
         }
-                
+
         spin_lock(&io7->irq_lock);
         *ctl &= ~(1UL << 24);
         mb();
@@ -144,35 +146,29 @@ io7_disable_irq(unsigned int irq)
 }
 
 static void
-marvel_irq_noop(unsigned int irq) 
-{ 
-        return; 
-}
-
-static unsigned int
-marvel_irq_noop_return(unsigned int irq) 
-{ 
-        return 0; 
+marvel_irq_noop(struct irq_data *d)
+{
+        return;
 }
 
 static struct irq_chip marvel_legacy_irq_type = {
         .name           = "LEGACY",
-        .mask           = marvel_irq_noop,
-        .unmask         = marvel_irq_noop,
+        .irq_mask       = marvel_irq_noop,
+        .irq_unmask     = marvel_irq_noop,
 };
 
 static struct irq_chip io7_lsi_irq_type = {
         .name           = "LSI",
-        .unmask         = io7_enable_irq,
-        .mask           = io7_disable_irq,
-        .mask_ack       = io7_disable_irq,
+        .irq_unmask     = io7_enable_irq,
+        .irq_mask       = io7_disable_irq,
+        .irq_mask_ack   = io7_disable_irq,
 };
 
 static struct irq_chip io7_msi_irq_type = {
         .name           = "MSI",
-        .unmask         = io7_enable_irq,
-        .mask           = io7_disable_irq,
-        .ack            = marvel_irq_noop,
+        .irq_unmask     = io7_enable_irq,
+        .irq_mask       = io7_disable_irq,
+        .irq_ack        = marvel_irq_noop,
 };
 
 static void
@@ -280,8 +276,8 @@ init_io7_irqs(struct io7 *io7,
 
         /* Set up the lsi irqs.  */
         for (i = 0; i < 128; ++i) {
-                irq_to_desc(base + i)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(base + i, lsi_ops, handle_level_irq);
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 
         /* Disable the implemented irqs in hardware.  */
@@ -294,8 +290,8 @@ init_io7_irqs(struct io7 *io7,
 
         /* Set up the msi irqs.  */
         for (i = 128; i < (128 + 512); ++i) {
-                irq_to_desc(base + i)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(base + i, msi_ops, handle_level_irq);
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 
         for (i = 0; i < 16; ++i)
diff --git a/arch/alpha/kernel/sys_mikasa.c b/arch/alpha/kernel/sys_mikasa.c
index bcc1639e8efb..cf7f43dd3147 100644
--- a/arch/alpha/kernel/sys_mikasa.c
+++ b/arch/alpha/kernel/sys_mikasa.c
@@ -43,22 +43,22 @@ mikasa_update_irq_hw(int mask)
 }
 
 static inline void
-mikasa_enable_irq(unsigned int irq)
+mikasa_enable_irq(struct irq_data *d)
 {
-        mikasa_update_irq_hw(cached_irq_mask |= 1 << (irq - 16));
+        mikasa_update_irq_hw(cached_irq_mask |= 1 << (d->irq - 16));
 }
 
 static void
-mikasa_disable_irq(unsigned int irq)
+mikasa_disable_irq(struct irq_data *d)
 {
-        mikasa_update_irq_hw(cached_irq_mask &= ~(1 << (irq - 16)));
+        mikasa_update_irq_hw(cached_irq_mask &= ~(1 << (d->irq - 16)));
 }
 
 static struct irq_chip mikasa_irq_type = {
         .name           = "MIKASA",
-        .unmask         = mikasa_enable_irq,
-        .mask           = mikasa_disable_irq,
-        .mask_ack       = mikasa_disable_irq,
+        .irq_unmask     = mikasa_enable_irq,
+        .irq_mask       = mikasa_disable_irq,
+        .irq_mask_ack   = mikasa_disable_irq,
 };
 
 static void 
@@ -98,8 +98,8 @@ mikasa_init_irq(void)
         mikasa_update_irq_hw(0);
 
         for (i = 16; i < 32; ++i) {
-                irq_to_desc(i)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(i, &mikasa_irq_type, handle_level_irq);
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 
         init_i8259a_irqs();
diff --git a/arch/alpha/kernel/sys_noritake.c b/arch/alpha/kernel/sys_noritake.c
index e88f4ae1260e..92bc188e94a9 100644
--- a/arch/alpha/kernel/sys_noritake.c
+++ b/arch/alpha/kernel/sys_noritake.c
@@ -48,22 +48,22 @@ noritake_update_irq_hw(int irq, int mask)
 }
 
 static void
-noritake_enable_irq(unsigned int irq)
+noritake_enable_irq(struct irq_data *d)
 {
-        noritake_update_irq_hw(irq, cached_irq_mask |= 1 << (irq - 16));
+        noritake_update_irq_hw(d->irq, cached_irq_mask |= 1 << (d->irq - 16));
 }
 
 static void
-noritake_disable_irq(unsigned int irq)
+noritake_disable_irq(struct irq_data *d)
 {
-        noritake_update_irq_hw(irq, cached_irq_mask &= ~(1 << (irq - 16)));
+        noritake_update_irq_hw(d->irq, cached_irq_mask &= ~(1 << (d->irq - 16)));
 }
 
 static struct irq_chip noritake_irq_type = {
         .name           = "NORITAKE",
-        .unmask         = noritake_enable_irq,
-        .mask           = noritake_disable_irq,
-        .mask_ack       = noritake_disable_irq,
+        .irq_unmask     = noritake_enable_irq,
+        .irq_mask       = noritake_disable_irq,
+        .irq_mask_ack   = noritake_disable_irq,
 };
 
 static void 
@@ -127,8 +127,8 @@ noritake_init_irq(void)
         outw(0, 0x54c);
 
         for (i = 16; i < 48; ++i) {
-                irq_to_desc(i)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(i, &noritake_irq_type, handle_level_irq);
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 
         init_i8259a_irqs();
diff --git a/arch/alpha/kernel/sys_rawhide.c b/arch/alpha/kernel/sys_rawhide.c
index 6a51364dd1cc..936d4140ed5f 100644
--- a/arch/alpha/kernel/sys_rawhide.c
+++ b/arch/alpha/kernel/sys_rawhide.c
@@ -56,9 +56,10 @@ rawhide_update_irq_hw(int hose, int mask)
   (((h) < MCPCIA_MAX_HOSES) && (cached_irq_masks[(h)] != 0))
 
 static inline void 
-rawhide_enable_irq(unsigned int irq)
+rawhide_enable_irq(struct irq_data *d)
 {
         unsigned int mask, hose;
+        unsigned int irq = d->irq;
 
         irq -= 16;
         hose = irq / 24;
@@ -76,9 +77,10 @@ rawhide_enable_irq(unsigned int irq)
 }
 
 static void 
-rawhide_disable_irq(unsigned int irq)
+rawhide_disable_irq(struct irq_data *d)
 {
         unsigned int mask, hose;
+        unsigned int irq = d->irq;
 
         irq -= 16;
         hose = irq / 24;
@@ -96,9 +98,10 @@ rawhide_disable_irq(unsigned int irq)
 }
 
 static void
-rawhide_mask_and_ack_irq(unsigned int irq)
+rawhide_mask_and_ack_irq(struct irq_data *d)
 {
         unsigned int mask, mask1, hose;
+        unsigned int irq = d->irq;
 
         irq -= 16;
         hose = irq / 24;
@@ -123,9 +126,9 @@ rawhide_mask_and_ack_irq(unsigned int irq)
 
 static struct irq_chip rawhide_irq_type = {
         .name           = "RAWHIDE",
-        .unmask         = rawhide_enable_irq,
-        .mask           = rawhide_disable_irq,
-        .mask_ack       = rawhide_mask_and_ack_irq,
+        .irq_unmask     = rawhide_enable_irq,
+        .irq_mask       = rawhide_disable_irq,
+        .irq_mask_ack   = rawhide_mask_and_ack_irq,
 };
 
 static void 
@@ -177,8 +180,8 @@ rawhide_init_irq(void)
         }
 
         for (i = 16; i < 128; ++i) {
-                irq_to_desc(i)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(i, &rawhide_irq_type, handle_level_irq);
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 
         init_i8259a_irqs();
diff --git a/arch/alpha/kernel/sys_rx164.c b/arch/alpha/kernel/sys_rx164.c
index 89e7e37ec84c..cea22a62913b 100644
--- a/arch/alpha/kernel/sys_rx164.c
+++ b/arch/alpha/kernel/sys_rx164.c
@@ -47,22 +47,22 @@ rx164_update_irq_hw(unsigned long mask)
 }
 
 static inline void
-rx164_enable_irq(unsigned int irq)
+rx164_enable_irq(struct irq_data *d)
 {
-        rx164_update_irq_hw(cached_irq_mask |= 1UL << (irq - 16));
+        rx164_update_irq_hw(cached_irq_mask |= 1UL << (d->irq - 16));
 }
 
 static void
-rx164_disable_irq(unsigned int irq)
+rx164_disable_irq(struct irq_data *d)
 {
-        rx164_update_irq_hw(cached_irq_mask &= ~(1UL << (irq - 16)));
+        rx164_update_irq_hw(cached_irq_mask &= ~(1UL << (d->irq - 16)));
 }
 
 static struct irq_chip rx164_irq_type = {
         .name           = "RX164",
-        .unmask         = rx164_enable_irq,
-        .mask           = rx164_disable_irq,
-        .mask_ack       = rx164_disable_irq,
+        .irq_unmask     = rx164_enable_irq,
+        .irq_mask       = rx164_disable_irq,
+        .irq_mask_ack   = rx164_disable_irq,
 };
 
 static void 
@@ -99,8 +99,8 @@ rx164_init_irq(void)
 
         rx164_update_irq_hw(0);
         for (i = 16; i < 40; ++i) {
-                irq_to_desc(i)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(i, &rx164_irq_type, handle_level_irq);
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 
         init_i8259a_irqs();
diff --git a/arch/alpha/kernel/sys_sable.c b/arch/alpha/kernel/sys_sable.c
index 5c4423d1b06c..a349538aabc9 100644
--- a/arch/alpha/kernel/sys_sable.c
+++ b/arch/alpha/kernel/sys_sable.c
@@ -443,11 +443,11 @@ lynx_swizzle(struct pci_dev *dev, u8 *pinp)
 /* GENERIC irq routines */
 
 static inline void
-sable_lynx_enable_irq(unsigned int irq)
+sable_lynx_enable_irq(struct irq_data *d)
 {
         unsigned long bit, mask;
 
-        bit = sable_lynx_irq_swizzle->irq_to_mask[irq];
+        bit = sable_lynx_irq_swizzle->irq_to_mask[d->irq];
         spin_lock(&sable_lynx_irq_lock);
         mask = sable_lynx_irq_swizzle->shadow_mask &= ~(1UL << bit);
         sable_lynx_irq_swizzle->update_irq_hw(bit, mask);
@@ -459,11 +459,11 @@ sable_lynx_enable_irq(unsigned int irq)
 }
 
 static void
-sable_lynx_disable_irq(unsigned int irq)
+sable_lynx_disable_irq(struct irq_data *d)
 {
         unsigned long bit, mask;
 
-        bit = sable_lynx_irq_swizzle->irq_to_mask[irq];
+        bit = sable_lynx_irq_swizzle->irq_to_mask[d->irq];
         spin_lock(&sable_lynx_irq_lock);
         mask = sable_lynx_irq_swizzle->shadow_mask |= 1UL << bit;
         sable_lynx_irq_swizzle->update_irq_hw(bit, mask);
@@ -475,11 +475,11 @@ sable_lynx_disable_irq(unsigned int irq)
 }
 
 static void
-sable_lynx_mask_and_ack_irq(unsigned int irq)
+sable_lynx_mask_and_ack_irq(struct irq_data *d)
 {
         unsigned long bit, mask;
 
-        bit = sable_lynx_irq_swizzle->irq_to_mask[irq];
+        bit = sable_lynx_irq_swizzle->irq_to_mask[d->irq];
         spin_lock(&sable_lynx_irq_lock);
         mask = sable_lynx_irq_swizzle->shadow_mask |= 1UL << bit;
         sable_lynx_irq_swizzle->update_irq_hw(bit, mask);
@@ -489,9 +489,9 @@ sable_lynx_mask_and_ack_irq(unsigned int irq)
 
 static struct irq_chip sable_lynx_irq_type = {
         .name           = "SABLE/LYNX",
-        .unmask         = sable_lynx_enable_irq,
-        .mask           = sable_lynx_disable_irq,
-        .mask_ack       = sable_lynx_mask_and_ack_irq,
+        .irq_unmask     = sable_lynx_enable_irq,
+        .irq_mask       = sable_lynx_disable_irq,
+        .irq_mask_ack   = sable_lynx_mask_and_ack_irq,
 };
 
 static void 
@@ -518,9 +518,9 @@ sable_lynx_init_irq(int nr_of_irqs)
         long i;
 
         for (i = 0; i < nr_of_irqs; ++i) {
-                irq_to_desc(i)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(i, &sable_lynx_irq_type,
                         handle_level_irq);
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 
         common_init_isa_dma();
diff --git a/arch/alpha/kernel/sys_takara.c b/arch/alpha/kernel/sys_takara.c
index f8a1e8a862fb..42a5331f13c4 100644
--- a/arch/alpha/kernel/sys_takara.c
+++ b/arch/alpha/kernel/sys_takara.c
@@ -45,16 +45,18 @@ takara_update_irq_hw(unsigned long irq, unsigned long mask)
 }
 
 static inline void
-takara_enable_irq(unsigned int irq)
+takara_enable_irq(struct irq_data *d)
 {
+        unsigned int irq = d->irq;
         unsigned long mask;
         mask = (cached_irq_mask[irq >= 64] &= ~(1UL << (irq & 63)));
         takara_update_irq_hw(irq, mask);
 }
 
 static void
-takara_disable_irq(unsigned int irq)
+takara_disable_irq(struct irq_data *d)
 {
+        unsigned int irq = d->irq;
         unsigned long mask;
         mask = (cached_irq_mask[irq >= 64] |= 1UL << (irq & 63));
         takara_update_irq_hw(irq, mask);
@@ -62,9 +64,9 @@ takara_disable_irq(unsigned int irq)
 
 static struct irq_chip takara_irq_type = {
         .name           = "TAKARA",
-        .unmask         = takara_enable_irq,
-        .mask           = takara_disable_irq,
-        .mask_ack       = takara_disable_irq,
+        .irq_unmask     = takara_enable_irq,
+        .irq_mask       = takara_disable_irq,
+        .irq_mask_ack   = takara_disable_irq,
 };
 
 static void
@@ -136,8 +138,8 @@ takara_init_irq(void)
                 takara_update_irq_hw(i, -1);
 
         for (i = 16; i < 128; ++i) {
-                irq_to_desc(i)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(i, &takara_irq_type, handle_level_irq);
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 
         common_init_isa_dma();
diff --git a/arch/alpha/kernel/sys_titan.c b/arch/alpha/kernel/sys_titan.c
index e02494bf5ef3..8c13a0c77830 100644
--- a/arch/alpha/kernel/sys_titan.c
+++ b/arch/alpha/kernel/sys_titan.c
@@ -112,8 +112,9 @@ titan_update_irq_hw(unsigned long mask)
 }
 
 static inline void
-titan_enable_irq(unsigned int irq)
+titan_enable_irq(struct irq_data *d)
 {
+        unsigned int irq = d->irq;
         spin_lock(&titan_irq_lock);
         titan_cached_irq_mask |= 1UL << (irq - 16);
         titan_update_irq_hw(titan_cached_irq_mask);
@@ -121,8 +122,9 @@ titan_enable_irq(unsigned int irq)
 }
 
 static inline void
-titan_disable_irq(unsigned int irq)
+titan_disable_irq(struct irq_data *d)
 {
+        unsigned int irq = d->irq;
         spin_lock(&titan_irq_lock);
         titan_cached_irq_mask &= ~(1UL << (irq - 16));
         titan_update_irq_hw(titan_cached_irq_mask);
@@ -144,8 +146,10 @@ titan_cpu_set_irq_affinity(unsigned int irq, cpumask_t affinity)
 }
 
 static int
-titan_set_irq_affinity(unsigned int irq, const struct cpumask *affinity)
+titan_set_irq_affinity(struct irq_data *d, const struct cpumask *affinity,
+                       bool force)
 { 
+        unsigned int irq = d->irq;
         spin_lock(&titan_irq_lock);
         titan_cpu_set_irq_affinity(irq - 16, *affinity);
         titan_update_irq_hw(titan_cached_irq_mask);
@@ -175,17 +179,17 @@ init_titan_irqs(struct irq_chip * ops, int imin, int imax)
 {
         long i;
         for (i = imin; i <= imax; ++i) {
-                irq_to_desc(i)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(i, ops, handle_level_irq);
+                irq_set_status_flags(i, IRQ_LEVEL);
         }
 }
 
 static struct irq_chip titan_irq_type = {
-       .name            = "TITAN",
-       .unmask          = titan_enable_irq,
-       .mask            = titan_disable_irq,
-       .mask_ack        = titan_disable_irq,
-       .set_affinity    = titan_set_irq_affinity,
+       .name                    = "TITAN",
+       .irq_unmask              = titan_enable_irq,
+       .irq_mask                = titan_disable_irq,
+       .irq_mask_ack            = titan_disable_irq,
+       .irq_set_affinity        = titan_set_irq_affinity,
 };
 
 static irqreturn_t
diff --git a/arch/alpha/kernel/sys_wildfire.c b/arch/alpha/kernel/sys_wildfire.c
index eec52594d410..ca60a387ef0a 100644
--- a/arch/alpha/kernel/sys_wildfire.c
+++ b/arch/alpha/kernel/sys_wildfire.c
@@ -104,10 +104,12 @@ wildfire_init_irq_hw(void)
 }
 
 static void
-wildfire_enable_irq(unsigned int irq)
+wildfire_enable_irq(struct irq_data *d)
 {
+        unsigned int irq = d->irq;
+
         if (irq < 16)
-                i8259a_enable_irq(irq);
+                i8259a_enable_irq(d);
 
         spin_lock(&wildfire_irq_lock);
         set_bit(irq, &cached_irq_mask);
@@ -116,10 +118,12 @@ wildfire_enable_irq(unsigned int irq)
 }
 
 static void
-wildfire_disable_irq(unsigned int irq)
+wildfire_disable_irq(struct irq_data *d)
 {
+        unsigned int irq = d->irq;
+
         if (irq < 16)
-                i8259a_disable_irq(irq);
+                i8259a_disable_irq(d);
 
         spin_lock(&wildfire_irq_lock);
         clear_bit(irq, &cached_irq_mask);
@@ -128,10 +132,12 @@ wildfire_disable_irq(unsigned int irq)
 }
 
 static void
-wildfire_mask_and_ack_irq(unsigned int irq)
+wildfire_mask_and_ack_irq(struct irq_data *d)
 {
+        unsigned int irq = d->irq;
+
         if (irq < 16)
-                i8259a_mask_and_ack_irq(irq);
+                i8259a_mask_and_ack_irq(d);
 
         spin_lock(&wildfire_irq_lock);
         clear_bit(irq, &cached_irq_mask);
@@ -141,9 +147,9 @@ wildfire_mask_and_ack_irq(unsigned int irq)
 
 static struct irq_chip wildfire_irq_type = {
         .name           = "WILDFIRE",
-        .unmask         = wildfire_enable_irq,
-        .mask           = wildfire_disable_irq,
-        .mask_ack       = wildfire_mask_and_ack_irq,
+        .irq_unmask     = wildfire_enable_irq,
+        .irq_mask       = wildfire_disable_irq,
+        .irq_mask_ack   = wildfire_mask_and_ack_irq,
 };
 
 static void __init
@@ -177,21 +183,21 @@ wildfire_init_irq_per_pca(int qbbno, int pcano)
         for (i = 0; i < 16; ++i) {
                 if (i == 2)
                         continue;
-                irq_to_desc(i+irq_bias)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(i+irq_bias, &wildfire_irq_type,
                         handle_level_irq);
+                irq_set_status_flags(i + irq_bias, IRQ_LEVEL);
         }
 
-        irq_to_desc(36+irq_bias)->status |= IRQ_LEVEL;
         set_irq_chip_and_handler(36+irq_bias, &wildfire_irq_type,
                 handle_level_irq);
+        irq_set_status_flags(36 + irq_bias, IRQ_LEVEL);
         for (i = 40; i < 64; ++i) {
-                irq_to_desc(i+irq_bias)->status |= IRQ_LEVEL;
                 set_irq_chip_and_handler(i+irq_bias, &wildfire_irq_type,
                         handle_level_irq);
+                irq_set_status_flags(i + irq_bias, IRQ_LEVEL);
         }
 
-        setup_irq(32+irq_bias, &isa_enable);    
+        setup_irq(32+irq_bias, &isa_enable);
 }
 
 static void __init
diff --git a/arch/arm/common/Kconfig b/arch/arm/common/Kconfig
index 778655f0257a..ea5ee4d067f3 100644
--- a/arch/arm/common/Kconfig
+++ b/arch/arm/common/Kconfig
@@ -6,6 +6,8 @@ config ARM_VIC
 
 config ARM_VIC_NR
         int
+        default 4 if ARCH_S5PV210
+        default 3 if ARCH_S5P6442 || ARCH_S5PC100
         default 2
         depends on ARM_VIC
         help
diff --git a/arch/arm/include/asm/mach/arch.h b/arch/arm/include/asm/mach/arch.h
index 3a0893a76a3b..bf13b814c1b8 100644
--- a/arch/arm/include/asm/mach/arch.h
+++ b/arch/arm/include/asm/mach/arch.h
@@ -15,10 +15,6 @@ struct meminfo;
 struct sys_timer;
 
 struct machine_desc {
-        /*
-         * Note! The first two elements are used
-         * by assembler code in head.S, head-common.S
-         */
         unsigned int            nr;             /* architecture number  */
         const char              *name;          /* architecture name    */
         unsigned long           boot_params;    /* tagged list          */
diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
index 9763be04f77e..22de005f159c 100644
--- a/arch/arm/include/asm/pgalloc.h
+++ b/arch/arm/include/asm/pgalloc.h
@@ -10,6 +10,8 @@
 #ifndef _ASMARM_PGALLOC_H
 #define _ASMARM_PGALLOC_H
 
+#include <linux/pagemap.h>
+
 #include <asm/domain.h>
 #include <asm/pgtable-hwdef.h>
 #include <asm/processor.h>
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index d600bd350704..44b84fe6e1b0 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -836,9 +836,11 @@ static int hw_breakpoint_pending(unsigned long addr, unsigned int fsr,
 /*
  * One-time initialisation.
  */
-static void reset_ctrl_regs(void *unused)
+static void reset_ctrl_regs(void *info)
 {
-        int i;
+        int i, cpu = smp_processor_id();
+        u32 dbg_power;
+        cpumask_t *cpumask = info;
 
         /*
          * v7 debug contains save and restore registers so that debug state
@@ -850,6 +852,17 @@ static void reset_ctrl_regs(void *unused)
          */
         if (debug_arch >= ARM_DEBUG_ARCH_V7_ECP14) {
                 /*
+                 * Ensure sticky power-down is clear (i.e. debug logic is
+                 * powered up).
+                 */
+                asm volatile("mrc p14, 0, %0, c1, c5, 4" : "=r" (dbg_power));
+                if ((dbg_power & 0x1) == 0) {
+                        pr_warning("CPU %d debug is powered down!\n", cpu);
+                        cpumask_or(cpumask, cpumask, cpumask_of(cpu));
+                        return;
+                }
+
+                /*
                  * Unconditionally clear the lock by writing a value
                  * other than 0xC5ACCE55 to the access register.
                  */
@@ -887,6 +900,7 @@ static struct notifier_block __cpuinitdata dbg_reset_nb = {
 static int __init arch_hw_breakpoint_init(void)
 {
         u32 dscr;
+        cpumask_t cpumask = { CPU_BITS_NONE };
 
         debug_arch = get_debug_arch();
 
@@ -911,7 +925,13 @@ static int __init arch_hw_breakpoint_init(void)
          * Reset the breakpoint resources. We assume that a halting
          * debugger will leave the world in a nice state for us.
          */
-        on_each_cpu(reset_ctrl_regs, NULL, 1);
+        on_each_cpu(reset_ctrl_regs, &cpumask, 1);
+        if (!cpumask_empty(&cpumask)) {
+                core_num_brps = 0;
+                core_num_reserved_brps = 0;
+                core_num_wrps = 0;
+                return 0;
+        }
 
         ARM_DBG_READ(c1, 0, dscr);
         if (dscr & ARM_DSCR_HDBGEN) {
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 19c6816db61e..b13e70f63d71 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -996,10 +996,10 @@ static int ptrace_gethbpregs(struct task_struct *tsk, long num,
                 while (!(arch_ctrl.len & 0x1))
                         arch_ctrl.len >>= 1;
 
-                if (idx & 0x1)
-                        reg = encode_ctrl_reg(arch_ctrl);
-                else
+                if (num & 0x1)
                         reg = bp->attr.bp_addr;
+                else
+                        reg = encode_ctrl_reg(arch_ctrl);
         }
 
 put:
diff --git a/arch/arm/mach-davinci/cpufreq.c b/arch/arm/mach-davinci/cpufreq.c
index 343de73161fa..4a68c2b1ec11 100644
--- a/arch/arm/mach-davinci/cpufreq.c
+++ b/arch/arm/mach-davinci/cpufreq.c
@@ -132,7 +132,7 @@ out:
         return ret;
 }
 
-static int __init davinci_cpu_init(struct cpufreq_policy *policy)
+static int davinci_cpu_init(struct cpufreq_policy *policy)
 {
         int result = 0;
         struct davinci_cpufreq_config *pdata = cpufreq.dev->platform_data;
diff --git a/arch/arm/mach-davinci/devices-da8xx.c b/arch/arm/mach-davinci/devices-da8xx.c
index 9eec63070e0c..beda8a4133a0 100644
--- a/arch/arm/mach-davinci/devices-da8xx.c
+++ b/arch/arm/mach-davinci/devices-da8xx.c
@@ -480,8 +480,15 @@ static struct platform_device da850_mcasp_device = {
         .resource       = da850_mcasp_resources,
 };
 
+struct platform_device davinci_pcm_device = {
+        .name   = "davinci-pcm-audio",
+        .id     = -1,
+};
+
 void __init da8xx_register_mcasp(int id, struct snd_platform_data *pdata)
 {
+        platform_device_register(&davinci_pcm_device);
+
         /* DA830/OMAP-L137 has 3 instances of McASP */
         if (cpu_is_davinci_da830() && id == 1) {
                 da830_mcasp1_device.dev.platform_data = pdata;
diff --git a/arch/arm/mach-davinci/gpio-tnetv107x.c b/arch/arm/mach-davinci/gpio-tnetv107x.c
index d10298620e2c..3fa3e2867e19 100644
--- a/arch/arm/mach-davinci/gpio-tnetv107x.c
+++ b/arch/arm/mach-davinci/gpio-tnetv107x.c
@@ -58,7 +58,7 @@ static int tnetv107x_gpio_request(struct gpio_chip *chip, unsigned offset)
 
         spin_lock_irqsave(&ctlr->lock, flags);
 
-        gpio_reg_set_bit(&regs->enable, gpio);
+        gpio_reg_set_bit(regs->enable, gpio);
 
         spin_unlock_irqrestore(&ctlr->lock, flags);
 
@@ -74,7 +74,7 @@ static void tnetv107x_gpio_free(struct gpio_chip *chip, unsigned offset)
 
         spin_lock_irqsave(&ctlr->lock, flags);
 
-        gpio_reg_clear_bit(&regs->enable, gpio);
+        gpio_reg_clear_bit(regs->enable, gpio);
 
         spin_unlock_irqrestore(&ctlr->lock, flags);
 }
@@ -88,7 +88,7 @@ static int tnetv107x_gpio_dir_in(struct gpio_chip *chip, unsigned offset)
 
         spin_lock_irqsave(&ctlr->lock, flags);
 
-        gpio_reg_set_bit(&regs->direction, gpio);
+        gpio_reg_set_bit(regs->direction, gpio);
 
         spin_unlock_irqrestore(&ctlr->lock, flags);
 
@@ -106,11 +106,11 @@ static int tnetv107x_gpio_dir_out(struct gpio_chip *chip,
         spin_lock_irqsave(&ctlr->lock, flags);
 
         if (value)
-                gpio_reg_set_bit(&regs->data_out, gpio);
+                gpio_reg_set_bit(regs->data_out, gpio);
         else
-                gpio_reg_clear_bit(&regs->data_out, gpio);
+                gpio_reg_clear_bit(regs->data_out, gpio);
 
-        gpio_reg_clear_bit(&regs->direction, gpio);
+        gpio_reg_clear_bit(regs->direction, gpio);
 
         spin_unlock_irqrestore(&ctlr->lock, flags);
 
@@ -124,7 +124,7 @@ static int tnetv107x_gpio_get(struct gpio_chip *chip, unsigned offset)
         unsigned gpio = chip->base + offset;
         int ret;
 
-        ret = gpio_reg_get_bit(&regs->data_in, gpio);
+        ret = gpio_reg_get_bit(regs->data_in, gpio);
 
         return ret ? 1 : 0;
 }
@@ -140,9 +140,9 @@ static void tnetv107x_gpio_set(struct gpio_chip *chip,
         spin_lock_irqsave(&ctlr->lock, flags);
 
         if (value)
-                gpio_reg_set_bit(&regs->data_out, gpio);
+                gpio_reg_set_bit(regs->data_out, gpio);
         else
-                gpio_reg_clear_bit(&regs->data_out, gpio);
+                gpio_reg_clear_bit(regs->data_out, gpio);
 
         spin_unlock_irqrestore(&ctlr->lock, flags);
 }
diff --git a/arch/arm/mach-davinci/include/mach/clkdev.h b/arch/arm/mach-davinci/include/mach/clkdev.h
index 730c49d1ebd8..14a504887189 100644
--- a/arch/arm/mach-davinci/include/mach/clkdev.h
+++ b/arch/arm/mach-davinci/include/mach/clkdev.h
@@ -1,6 +1,8 @@
 #ifndef __MACH_CLKDEV_H
 #define __MACH_CLKDEV_H
 
+struct clk;
+
 static inline int __clk_get(struct clk *clk)
 {
         return 1;
diff --git a/arch/arm/mach-omap2/mailbox.c b/arch/arm/mach-omap2/mailbox.c
index 0a585dfa9874..24b88504df0f 100644
--- a/arch/arm/mach-omap2/mailbox.c
+++ b/arch/arm/mach-omap2/mailbox.c
@@ -193,10 +193,12 @@ static void omap2_mbox_disable_irq(struct omap_mbox *mbox,
                 omap_mbox_type_t irq)
 {
         struct omap_mbox2_priv *p = mbox->priv;
-        u32 l, bit = (irq == IRQ_TX) ? p->notfull_bit : p->newmsg_bit;
-        l = mbox_read_reg(p->irqdisable);
-        l &= ~bit;
-        mbox_write_reg(l, p->irqdisable);
+        u32 bit = (irq == IRQ_TX) ? p->notfull_bit : p->newmsg_bit;
+
+        if (!cpu_is_omap44xx())
+                bit = mbox_read_reg(p->irqdisable) & ~bit;
+
+        mbox_write_reg(bit, p->irqdisable);
 }
 
 static void omap2_mbox_ack_irq(struct omap_mbox *mbox,
diff --git a/arch/arm/mach-omap2/smartreflex.c b/arch/arm/mach-omap2/smartreflex.c
index 95ac336fe3f7..1a777e34d0c2 100644
--- a/arch/arm/mach-omap2/smartreflex.c
+++ b/arch/arm/mach-omap2/smartreflex.c
@@ -282,6 +282,7 @@ error:
                 dev_err(&sr_info->pdev->dev, "%s: ERROR in registering"
                         "interrupt handler. Smartreflex will"
                         "not function as desired\n", __func__);
+                kfree(name);
                 kfree(sr_info);
                 return ret;
 }
@@ -879,7 +880,7 @@ static int __init omap_sr_probe(struct platform_device *pdev)
                 ret = sr_late_init(sr_info);
                 if (ret) {
                         pr_warning("%s: Error in SR late init\n", __func__);
-                        return ret;
+                        goto err_release_region;
                 }
         }
 
@@ -890,14 +891,17 @@ static int __init omap_sr_probe(struct platform_device *pdev)
          * not try to create rest of the debugfs entries.
          */
         vdd_dbg_dir = omap_voltage_get_dbgdir(sr_info->voltdm);
-        if (!vdd_dbg_dir)
-                return -EINVAL;
+        if (!vdd_dbg_dir) {
+                ret = -EINVAL;
+                goto err_release_region;
+        }
 
         dbg_dir = debugfs_create_dir("smartreflex", vdd_dbg_dir);
         if (IS_ERR(dbg_dir)) {
                 dev_err(&pdev->dev, "%s: Unable to create debugfs directory\n",
                         __func__);
-                return PTR_ERR(dbg_dir);
+                ret = PTR_ERR(dbg_dir);
+                goto err_release_region;
         }
 
         (void) debugfs_create_file("autocomp", S_IRUGO | S_IWUSR, dbg_dir,
@@ -913,7 +917,8 @@ static int __init omap_sr_probe(struct platform_device *pdev)
         if (IS_ERR(nvalue_dir)) {
                 dev_err(&pdev->dev, "%s: Unable to create debugfs directory"
                         "for n-values\n", __func__);
-                return PTR_ERR(nvalue_dir);
+                ret = PTR_ERR(nvalue_dir);
+                goto err_release_region;
         }
 
         omap_voltage_get_volttable(sr_info->voltdm, &volt_data);
@@ -922,23 +927,15 @@ static int __init omap_sr_probe(struct platform_device *pdev)
                         " corresponding vdd vdd_%s. Cannot create debugfs"
                         "entries for n-values\n",
                         __func__, sr_info->voltdm->name);
-                return -ENODATA;
+                ret = -ENODATA;
+                goto err_release_region;
         }
 
         for (i = 0; i < sr_info->nvalue_count; i++) {
-                char *name;
-                char volt_name[32];
-
-                name = kzalloc(NVALUE_NAME_LEN + 1, GFP_KERNEL);
-                if (!name) {
-                        dev_err(&pdev->dev, "%s: Unable to allocate memory"
-                                " for n-value directory name\n",  __func__);
-                        return -ENOMEM;
-                }
+                char name[NVALUE_NAME_LEN + 1];
 
-                strcpy(name, "volt_");
-                sprintf(volt_name, "%d", volt_data[i].volt_nominal);
-                strcat(name, volt_name);
+                snprintf(name, sizeof(name), "volt_%d",
+                         volt_data[i].volt_nominal);
                 (void) debugfs_create_x32(name, S_IRUGO | S_IWUSR, nvalue_dir,
                                 &(sr_info->nvalue_table[i].nvalue));
         }
diff --git a/arch/arm/mach-pxa/pxa25x.c b/arch/arm/mach-pxa/pxa25x.c
index fbc5b775f895..b166b1d845d7 100644
--- a/arch/arm/mach-pxa/pxa25x.c
+++ b/arch/arm/mach-pxa/pxa25x.c
@@ -347,6 +347,7 @@ static struct platform_device *pxa25x_devices[] __initdata = {
         &pxa25x_device_assp,
         &pxa25x_device_pwm0,
         &pxa25x_device_pwm1,
+        &pxa_device_asoc_platform,
 };
 
 static struct sys_device pxa25x_sysdev[] = {
diff --git a/arch/arm/mach-pxa/tosa-bt.c b/arch/arm/mach-pxa/tosa-bt.c
index c31e601eb49c..b9b1e5c2b290 100644
--- a/arch/arm/mach-pxa/tosa-bt.c
+++ b/arch/arm/mach-pxa/tosa-bt.c
@@ -81,8 +81,6 @@ static int tosa_bt_probe(struct platform_device *dev)
                 goto err_rfk_alloc;
         }
 
-        rfkill_set_led_trigger_name(rfk, "tosa-bt");
-
         rc = rfkill_register(rfk);
         if (rc)
                 goto err_rfkill;
diff --git a/arch/arm/mach-pxa/tosa.c b/arch/arm/mach-pxa/tosa.c
index af152e70cfcf..f2582ec300d9 100644
--- a/arch/arm/mach-pxa/tosa.c
+++ b/arch/arm/mach-pxa/tosa.c
@@ -875,6 +875,11 @@ static struct platform_device sharpsl_rom_device = {
         .dev.platform_data = &sharpsl_rom_data,
 };
 
+static struct platform_device wm9712_device = {
+        .name   = "wm9712-codec",
+        .id     = -1,
+};
+
 static struct platform_device *devices[] __initdata = {
         &tosascoop_device,
         &tosascoop_jc_device,
@@ -885,6 +890,7 @@ static struct platform_device *devices[] __initdata = {
         &tosaled_device,
         &tosa_bt_device,
         &sharpsl_rom_device,
+        &wm9712_device,
 };
 
 static void tosa_poweroff(void)
diff --git a/arch/arm/mach-s3c2440/Kconfig b/arch/arm/mach-s3c2440/Kconfig
index a0cb2581894f..50825a3f91cc 100644
--- a/arch/arm/mach-s3c2440/Kconfig
+++ b/arch/arm/mach-s3c2440/Kconfig
@@ -99,6 +99,7 @@ config MACH_NEO1973_GTA02
         select POWER_SUPPLY
         select MACH_NEO1973
         select S3C2410_PWM
+        select S3C_DEV_USB_HOST
         help
            Say Y here if you are using the Openmoko GTA02 / Freerunner GSM Phone
 
diff --git a/arch/arm/mach-s3c2440/include/mach/gta02.h b/arch/arm/mach-s3c2440/include/mach/gta02.h
index 953331d8d56a..3a56a229cac6 100644
--- a/arch/arm/mach-s3c2440/include/mach/gta02.h
+++ b/arch/arm/mach-s3c2440/include/mach/gta02.h
@@ -44,19 +44,19 @@
 #define GTA02v3_GPIO_nUSB_FLT   S3C2410_GPG(10) /* v3 + v4 only */
 #define GTA02v3_GPIO_nGSM_OC    S3C2410_GPG(11) /* v3 + v4 only */
 
-#define GTA02_GPIO_AMP_SHUT     S3C2440_GPJ1    /* v2 + v3 + v4 only */
-#define GTA02v1_GPIO_WLAN_GPIO10        S3C2440_GPJ2
-#define GTA02_GPIO_HP_IN        S3C2440_GPJ2    /* v2 + v3 + v4 only */
-#define GTA02_GPIO_INT0         S3C2440_GPJ3    /* v2 + v3 + v4 only */
-#define GTA02_GPIO_nGSM_EN      S3C2440_GPJ4
-#define GTA02_GPIO_3D_RESET     S3C2440_GPJ5
-#define GTA02_GPIO_nDL_GSM      S3C2440_GPJ6    /* v4 + v5 only */
-#define GTA02_GPIO_WLAN_GPIO0   S3C2440_GPJ7
-#define GTA02v1_GPIO_BAT_ID     S3C2440_GPJ8
-#define GTA02_GPIO_KEEPACT      S3C2440_GPJ8
-#define GTA02v1_GPIO_HP_IN      S3C2440_GPJ10
-#define GTA02_CHIP_PWD          S3C2440_GPJ11   /* v2 + v3 + v4 only */
-#define GTA02_GPIO_nWLAN_RESET  S3C2440_GPJ12   /* v2 + v3 + v4 only */
+#define GTA02_GPIO_AMP_SHUT     S3C2410_GPJ(1)  /* v2 + v3 + v4 only */
+#define GTA02v1_GPIO_WLAN_GPIO10        S3C2410_GPJ(2)
+#define GTA02_GPIO_HP_IN        S3C2410_GPJ(2)  /* v2 + v3 + v4 only */
+#define GTA02_GPIO_INT0         S3C2410_GPJ(3)  /* v2 + v3 + v4 only */
+#define GTA02_GPIO_nGSM_EN      S3C2410_GPJ(4)
+#define GTA02_GPIO_3D_RESET     S3C2410_GPJ(5)
+#define GTA02_GPIO_nDL_GSM      S3C2410_GPJ(6)  /* v4 + v5 only */
+#define GTA02_GPIO_WLAN_GPIO0   S3C2410_GPJ(7)
+#define GTA02v1_GPIO_BAT_ID     S3C2410_GPJ(8)
+#define GTA02_GPIO_KEEPACT      S3C2410_GPJ(8)
+#define GTA02v1_GPIO_HP_IN      S3C2410_GPJ(10)
+#define GTA02_CHIP_PWD          S3C2410_GPJ(11) /* v2 + v3 + v4 only */
+#define GTA02_GPIO_nWLAN_RESET  S3C2410_GPJ(12) /* v2 + v3 + v4 only */
 
 #define GTA02_IRQ_GSENSOR_1     IRQ_EINT0
 #define GTA02_IRQ_MODEM         IRQ_EINT1
diff --git a/arch/arm/mach-s3c64xx/clock.c b/arch/arm/mach-s3c64xx/clock.c
index dd3782064508..fdfc4d5e37a1 100644
--- a/arch/arm/mach-s3c64xx/clock.c
+++ b/arch/arm/mach-s3c64xx/clock.c
@@ -151,6 +151,12 @@ static struct clk init_clocks_off[] = {
                 .enable         = s3c64xx_pclk_ctrl,
                 .ctrlbit        = S3C_CLKCON_PCLK_IIC,
         }, {
+                .name           = "i2c",
+                .id             = 1,
+                .parent         = &clk_p,
+                .enable         = s3c64xx_pclk_ctrl,
+                .ctrlbit        = S3C6410_CLKCON_PCLK_I2C1,
+        }, {
                 .name           = "iis",
                 .id             = 0,
                 .parent         = &clk_p,
diff --git a/arch/arm/mach-s3c64xx/dma.c b/arch/arm/mach-s3c64xx/dma.c
index 135db1b41252..c35585cf8c4f 100644
--- a/arch/arm/mach-s3c64xx/dma.c
+++ b/arch/arm/mach-s3c64xx/dma.c
@@ -690,12 +690,12 @@ static int s3c64xx_dma_init1(int chno, enum dma_ch chbase,
 
         regptr = regs + PL080_Cx_BASE(0);
 
-        for (ch = 0; ch < 8; ch++, chno++, chptr++) {
-                printk(KERN_INFO "%s: registering DMA %d (%p)\n",
-                       __func__, chno, regptr);
+        for (ch = 0; ch < 8; ch++, chptr++) {
+                pr_debug("%s: registering DMA %d (%p)\n",
+                         __func__, chno + ch, regptr);
 
                 chptr->bit = 1 << ch;
-                chptr->number = chno;
+                chptr->number = chno + ch;
                 chptr->dmac = dmac;
                 chptr->regs = regptr;
                 regptr += PL080_Cx_STRIDE;
@@ -704,7 +704,8 @@ static int s3c64xx_dma_init1(int chno, enum dma_ch chbase,
         /* for the moment, permanently enable the controller */
         writel(PL080_CONFIG_ENABLE, regs + PL080_CONFIG);
 
-        printk(KERN_INFO "PL080: IRQ %d, at %p\n", irq, regs);
+        printk(KERN_INFO "PL080: IRQ %d, at %p, channels %d..%d\n",
+               irq, regs, chno, chno+8);
 
         return 0;
 
diff --git a/arch/arm/mach-s3c64xx/gpiolib.c b/arch/arm/mach-s3c64xx/gpiolib.c
index fd99a82e82c4..92b09085caaa 100644
--- a/arch/arm/mach-s3c64xx/gpiolib.c
+++ b/arch/arm/mach-s3c64xx/gpiolib.c
@@ -72,7 +72,7 @@ static struct s3c_gpio_cfg gpio_4bit_cfg_eint0011 = {
         .get_pull       = s3c_gpio_getpull_updown,
 };
 
-int s3c64xx_gpio2int_gpm(struct gpio_chip *chip, unsigned pin)
+static int s3c64xx_gpio2int_gpm(struct gpio_chip *chip, unsigned pin)
 {
         return pin < 5 ? IRQ_EINT(23) + pin : -ENXIO;
 }
@@ -138,7 +138,7 @@ static struct s3c_gpio_chip gpio_4bit[] = {
         },
 };
 
-int s3c64xx_gpio2int_gpl(struct gpio_chip *chip, unsigned pin)
+static int s3c64xx_gpio2int_gpl(struct gpio_chip *chip, unsigned pin)
 {
         return pin >= 8 ? IRQ_EINT(16) + pin - 8 : -ENXIO;
 }
diff --git a/arch/arm/mach-s3c64xx/mach-smdk6410.c b/arch/arm/mach-s3c64xx/mach-smdk6410.c
index e85192a86fbe..a80a3163dd30 100644
--- a/arch/arm/mach-s3c64xx/mach-smdk6410.c
+++ b/arch/arm/mach-s3c64xx/mach-smdk6410.c
@@ -28,6 +28,7 @@
 #include <linux/delay.h>
 #include <linux/smsc911x.h>
 #include <linux/regulator/fixed.h>
+#include <linux/regulator/machine.h>
 
 #ifdef CONFIG_SMDK6410_WM1190_EV1
 #include <linux/mfd/wm8350/core.h>
@@ -351,7 +352,7 @@ static struct regulator_init_data smdk6410_vddpll = {
 /* VDD_UH_MMC, LDO5 on J5 */
 static struct regulator_init_data smdk6410_vdduh_mmc = {
         .constraints = {
-                .name = "PVDD_UH/PVDD_MMC",
+                .name = "PVDD_UH+PVDD_MMC",
                 .always_on = 1,
         },
 };
@@ -417,7 +418,7 @@ static struct regulator_init_data smdk6410_vddaudio = {
 /* S3C64xx internal logic & PLL */
 static struct regulator_init_data wm8350_dcdc1_data = {
         .constraints = {
-                .name = "PVDD_INT/PVDD_PLL",
+                .name = "PVDD_INT+PVDD_PLL",
                 .min_uV = 1200000,
                 .max_uV = 1200000,
                 .always_on = 1,
@@ -452,7 +453,7 @@ static struct regulator_consumer_supply wm8350_dcdc4_consumers[] = {
 
 static struct regulator_init_data wm8350_dcdc4_data = {
         .constraints = {
-                .name = "PVDD_HI/PVDD_EXT/PVDD_SYS/PVCCM2MTV",
+                .name = "PVDD_HI+PVDD_EXT+PVDD_SYS+PVCCM2MTV",
                 .min_uV = 3000000,
                 .max_uV = 3000000,
                 .always_on = 1,
@@ -464,7 +465,7 @@ static struct regulator_init_data wm8350_dcdc4_data = {
 /* OTGi/1190-EV1 HPVDD & AVDD */
 static struct regulator_init_data wm8350_ldo4_data = {
         .constraints = {
-                .name = "PVDD_OTGI/HPVDD/AVDD",
+                .name = "PVDD_OTGI+HPVDD+AVDD",
                 .min_uV = 1200000,
                 .max_uV = 1200000,
                 .apply_uV = 1,
@@ -552,7 +553,7 @@ static struct wm831x_backlight_pdata wm1192_backlight_pdata = {
 
 static struct regulator_init_data wm1192_dcdc3 = {
         .constraints = {
-                .name = "PVDD_MEM/PVDD_GPS",
+                .name = "PVDD_MEM+PVDD_GPS",
                 .always_on = 1,
         },
 };
@@ -563,7 +564,7 @@ static struct regulator_consumer_supply wm1192_ldo1_consumers[] = {
 
 static struct regulator_init_data wm1192_ldo1 = {
         .constraints = {
-                .name = "PVDD_LCD/PVDD_EXT",
+                .name = "PVDD_LCD+PVDD_EXT",
                 .always_on = 1,
         },
         .consumer_supplies = wm1192_ldo1_consumers,
diff --git a/arch/arm/mach-s3c64xx/setup-keypad.c b/arch/arm/mach-s3c64xx/setup-keypad.c
index f8ed0d22db70..1d4d0ee9e870 100644
--- a/arch/arm/mach-s3c64xx/setup-keypad.c
+++ b/arch/arm/mach-s3c64xx/setup-keypad.c
@@ -17,7 +17,7 @@
 void samsung_keypad_cfg_gpio(unsigned int rows, unsigned int cols)
 {
         /* Set all the necessary GPK pins to special-function 3: KP_ROW[x] */
-        s3c_gpio_cfgrange_nopull(S3C64XX_GPK(8), 8 + rows, S3C_GPIO_SFN(3));
+        s3c_gpio_cfgrange_nopull(S3C64XX_GPK(8), rows, S3C_GPIO_SFN(3));
 
         /* Set all the necessary GPL pins to special-function 3: KP_COL[x] */
         s3c_gpio_cfgrange_nopull(S3C64XX_GPL(0), cols, S3C_GPIO_SFN(3));
diff --git a/arch/arm/mach-s3c64xx/setup-sdhci.c b/arch/arm/mach-s3c64xx/setup-sdhci.c
index 1a942037c4ef..f344a222bc84 100644
--- a/arch/arm/mach-s3c64xx/setup-sdhci.c
+++ b/arch/arm/mach-s3c64xx/setup-sdhci.c
@@ -56,7 +56,7 @@ void s3c6400_setup_sdhci_cfg_card(struct platform_device *dev,
         else
                 ctrl3 = (S3C_SDHCI_CTRL3_FCSEL1 | S3C_SDHCI_CTRL3_FCSEL0);
 
-        printk(KERN_INFO "%s: CTRL 2=%08x, 3=%08x\n", __func__, ctrl2, ctrl3);
+        pr_debug("%s: CTRL 2=%08x, 3=%08x\n", __func__, ctrl2, ctrl3);
         writel(ctrl2, r + S3C_SDHCI_CONTROL2);
         writel(ctrl3, r + S3C_SDHCI_CONTROL3);
 }
diff --git a/arch/arm/mach-s5p64x0/include/mach/gpio.h b/arch/arm/mach-s5p64x0/include/mach/gpio.h
index 5486c8f01f1d..adb5f298ead8 100644
--- a/arch/arm/mach-s5p64x0/include/mach/gpio.h
+++ b/arch/arm/mach-s5p64x0/include/mach/gpio.h
@@ -23,7 +23,7 @@
 #define S5P6440_GPIO_A_NR       (6)
 #define S5P6440_GPIO_B_NR       (7)
 #define S5P6440_GPIO_C_NR       (8)
-#define S5P6440_GPIO_F_NR       (2)
+#define S5P6440_GPIO_F_NR       (16)
 #define S5P6440_GPIO_G_NR       (7)
 #define S5P6440_GPIO_H_NR       (10)
 #define S5P6440_GPIO_I_NR       (16)
@@ -36,7 +36,7 @@
 #define S5P6450_GPIO_B_NR       (7)
 #define S5P6450_GPIO_C_NR       (8)
 #define S5P6450_GPIO_D_NR       (8)
-#define S5P6450_GPIO_F_NR       (2)
+#define S5P6450_GPIO_F_NR       (16)
 #define S5P6450_GPIO_G_NR       (14)
 #define S5P6450_GPIO_H_NR       (10)
 #define S5P6450_GPIO_I_NR       (16)
diff --git a/arch/arm/mach-shmobile/board-ag5evm.c b/arch/arm/mach-shmobile/board-ag5evm.c
index 2123b96b5638..4303a86e6e38 100644
--- a/arch/arm/mach-shmobile/board-ag5evm.c
+++ b/arch/arm/mach-shmobile/board-ag5evm.c
@@ -454,6 +454,7 @@ static void __init ag5evm_init(void)
         gpio_direction_output(GPIO_PORT217, 0);
         mdelay(1);
         gpio_set_value(GPIO_PORT217, 1);
+        mdelay(100);
 
         /* LCD backlight controller */
         gpio_request(GPIO_PORT235, NULL); /* RESET */
diff --git a/arch/arm/mach-shmobile/board-ap4evb.c b/arch/arm/mach-shmobile/board-ap4evb.c
index 3cf0951caa2d..81d6536552a9 100644
--- a/arch/arm/mach-shmobile/board-ap4evb.c
+++ b/arch/arm/mach-shmobile/board-ap4evb.c
@@ -1303,7 +1303,7 @@ static void __init ap4evb_init(void)
 
         lcdc_info.clock_source                  = LCDC_CLK_BUS;
         lcdc_info.ch[0].interface_type          = RGB18;
-        lcdc_info.ch[0].clock_divider           = 2;
+        lcdc_info.ch[0].clock_divider           = 3;
         lcdc_info.ch[0].flags                   = 0;
         lcdc_info.ch[0].lcd_size_cfg.width      = 152;
         lcdc_info.ch[0].lcd_size_cfg.height     = 91;
diff --git a/arch/arm/mach-shmobile/board-mackerel.c b/arch/arm/mach-shmobile/board-mackerel.c
index fb4213a4e15a..1657eac5dde2 100644
--- a/arch/arm/mach-shmobile/board-mackerel.c
+++ b/arch/arm/mach-shmobile/board-mackerel.c
@@ -303,7 +303,7 @@ static struct sh_mobile_lcdc_info lcdc_info = {
                 .lcd_cfg = mackerel_lcdc_modes,
                 .num_cfg = ARRAY_SIZE(mackerel_lcdc_modes),
                 .interface_type         = RGB24,
-                .clock_divider          = 2,
+                .clock_divider          = 3,
                 .flags                  = 0,
                 .lcd_size_cfg.width     = 152,
                 .lcd_size_cfg.height    = 91,
diff --git a/arch/arm/mach-shmobile/clock-sh73a0.c b/arch/arm/mach-shmobile/clock-sh73a0.c
index ddd4a1b775f0..7e58904c1c8c 100644
--- a/arch/arm/mach-shmobile/clock-sh73a0.c
+++ b/arch/arm/mach-shmobile/clock-sh73a0.c
@@ -263,7 +263,7 @@ static struct clk div6_clks[DIV6_NR] = {
 };
 
 enum { MSTP001,
-        MSTP125, MSTP118, MSTP116, MSTP100,
+        MSTP129, MSTP128, MSTP127, MSTP126, MSTP125, MSTP118, MSTP116, MSTP100,
         MSTP219,
         MSTP207, MSTP206, MSTP204, MSTP203, MSTP202, MSTP201, MSTP200,
         MSTP331, MSTP329, MSTP325, MSTP323, MSTP312,
@@ -275,6 +275,10 @@ enum { MSTP001,
 
 static struct clk mstp_clks[MSTP_NR] = {
         [MSTP001] = MSTP(&div4_clks[DIV4_HP], SMSTPCR0, 1, 0), /* IIC2 */
+        [MSTP129] = MSTP(&div4_clks[DIV4_B], SMSTPCR1, 29, 0), /* CEU1 */
+        [MSTP128] = MSTP(&div4_clks[DIV4_B], SMSTPCR1, 28, 0), /* CSI2-RX1 */
+        [MSTP127] = MSTP(&div4_clks[DIV4_B], SMSTPCR1, 27, 0), /* CEU0 */
+        [MSTP126] = MSTP(&div4_clks[DIV4_B], SMSTPCR1, 26, 0), /* CSI2-RX0 */
         [MSTP125] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR1, 25, 0), /* TMU0 */
         [MSTP118] = MSTP(&div4_clks[DIV4_B], SMSTPCR1, 18, 0), /* DSITX0 */
         [MSTP116] = MSTP(&div4_clks[DIV4_HP], SMSTPCR1, 16, 0), /* IIC0 */
@@ -306,6 +310,9 @@ static struct clk_lookup lookups[] = {
         CLKDEV_CON_ID("r_clk", &r_clk),
 
         /* DIV6 clocks */
+        CLKDEV_CON_ID("vck1_clk", &div6_clks[DIV6_VCK1]),
+        CLKDEV_CON_ID("vck2_clk", &div6_clks[DIV6_VCK2]),
+        CLKDEV_CON_ID("vck3_clk", &div6_clks[DIV6_VCK3]),
         CLKDEV_ICK_ID("dsit_clk", "sh-mipi-dsi.0", &div6_clks[DIV6_DSIT]),
         CLKDEV_ICK_ID("dsit_clk", "sh-mipi-dsi.1", &div6_clks[DIV6_DSIT]),
         CLKDEV_ICK_ID("dsi0p_clk", "sh-mipi-dsi.0", &div6_clks[DIV6_DSI0P]),
@@ -313,11 +320,15 @@ static struct clk_lookup lookups[] = {
 
         /* MSTP32 clocks */
         CLKDEV_DEV_ID("i2c-sh_mobile.2", &mstp_clks[MSTP001]), /* I2C2 */
-        CLKDEV_DEV_ID("sh_mobile_lcdc_fb.0", &mstp_clks[MSTP100]), /* LCDC0 */
+        CLKDEV_DEV_ID("sh_mobile_ceu.1", &mstp_clks[MSTP129]), /* CEU1 */
+        CLKDEV_DEV_ID("sh-mobile-csi2.1", &mstp_clks[MSTP128]), /* CSI2-RX1 */
+        CLKDEV_DEV_ID("sh_mobile_ceu.0", &mstp_clks[MSTP127]), /* CEU0 */
+        CLKDEV_DEV_ID("sh-mobile-csi2.0", &mstp_clks[MSTP126]), /* CSI2-RX0 */
         CLKDEV_DEV_ID("sh_tmu.0", &mstp_clks[MSTP125]), /* TMU00 */
         CLKDEV_DEV_ID("sh_tmu.1", &mstp_clks[MSTP125]), /* TMU01 */
-        CLKDEV_DEV_ID("i2c-sh_mobile.0", &mstp_clks[MSTP116]), /* I2C0 */
         CLKDEV_DEV_ID("sh-mipi-dsi.0", &mstp_clks[MSTP118]), /* DSITX */
+        CLKDEV_DEV_ID("i2c-sh_mobile.0", &mstp_clks[MSTP116]), /* I2C0 */
+        CLKDEV_DEV_ID("sh_mobile_lcdc_fb.0", &mstp_clks[MSTP100]), /* LCDC0 */
         CLKDEV_DEV_ID("sh-sci.7", &mstp_clks[MSTP219]), /* SCIFA7 */
         CLKDEV_DEV_ID("sh-sci.5", &mstp_clks[MSTP207]), /* SCIFA5 */
         CLKDEV_DEV_ID("sh-sci.8", &mstp_clks[MSTP206]), /* SCIFB */
diff --git a/arch/arm/mach-shmobile/include/mach/head-ap4evb.txt b/arch/arm/mach-shmobile/include/mach/head-ap4evb.txt
index efd3687ba190..3029aba38688 100644
--- a/arch/arm/mach-shmobile/include/mach/head-ap4evb.txt
+++ b/arch/arm/mach-shmobile/include/mach/head-ap4evb.txt
@@ -6,13 +6,10 @@ LIST "RWT Setting"
 EW 0xE6020004, 0xA500
 EW 0xE6030004, 0xA500
 
-DD 0x01001000, 0x01001000
-
 LIST "GPIO Setting"
 EB 0xE6051013, 0xA2
 
 LIST "CPG"
-ED 0xE6150080, 0x00000180
 ED 0xE61500C0, 0x00000002
 
 WAIT 1, 0xFE40009C
@@ -37,6 +34,9 @@ ED 0xE615002C, 0x93000040
 
 WAIT 1, 0xFE40009C
 
+LIST "SUB/USBClk"
+ED 0xE6150080, 0x00000180
+
 LIST "BSC"
 ED 0xFEC10000, 0x00E0001B
 
@@ -53,7 +53,7 @@ ED 0xFE400048, 0x20C18505
 ED 0xFE40004C, 0x00110209
 ED 0xFE400010, 0x00000087
 
-WAIT 10, 0xFE40009C
+WAIT 30, 0xFE40009C
 
 ED 0xFE400084, 0x0000003F
 EB 0xFE500000, 0x00
@@ -84,7 +84,7 @@ ED 0xE6150004, 0x80331050
 
 WAIT 1, 0xFE40009C
 
-ED 0xE6150354, 0x00000002
+ED 0xFE400354, 0x01AD8002
 
 LIST "SCIF0 - Serial port for earlyprintk"
 EB 0xE6053098, 0x11
diff --git a/arch/arm/mach-shmobile/include/mach/head-mackerel.txt b/arch/arm/mach-shmobile/include/mach/head-mackerel.txt
index efd3687ba190..3029aba38688 100644
--- a/arch/arm/mach-shmobile/include/mach/head-mackerel.txt
+++ b/arch/arm/mach-shmobile/include/mach/head-mackerel.txt
@@ -6,13 +6,10 @@ LIST "RWT Setting"
 EW 0xE6020004, 0xA500
 EW 0xE6030004, 0xA500
 
-DD 0x01001000, 0x01001000
-
 LIST "GPIO Setting"
 EB 0xE6051013, 0xA2
 
 LIST "CPG"
-ED 0xE6150080, 0x00000180
 ED 0xE61500C0, 0x00000002
 
 WAIT 1, 0xFE40009C
@@ -37,6 +34,9 @@ ED 0xE615002C, 0x93000040
 
 WAIT 1, 0xFE40009C
 
+LIST "SUB/USBClk"
+ED 0xE6150080, 0x00000180
+
 LIST "BSC"
 ED 0xFEC10000, 0x00E0001B
 
@@ -53,7 +53,7 @@ ED 0xFE400048, 0x20C18505
 ED 0xFE40004C, 0x00110209
 ED 0xFE400010, 0x00000087
 
-WAIT 10, 0xFE40009C
+WAIT 30, 0xFE40009C
 
 ED 0xFE400084, 0x0000003F
 EB 0xFE500000, 0x00
@@ -84,7 +84,7 @@ ED 0xE6150004, 0x80331050
 
 WAIT 1, 0xFE40009C
 
-ED 0xE6150354, 0x00000002
+ED 0xFE400354, 0x01AD8002
 
 LIST "SCIF0 - Serial port for earlyprintk"
 EB 0xE6053098, 0x11
diff --git a/arch/arm/plat-samsung/dev-uart.c b/arch/arm/plat-samsung/dev-uart.c
index 3776cd952450..5928105490fa 100644
--- a/arch/arm/plat-samsung/dev-uart.c
+++ b/arch/arm/plat-samsung/dev-uart.c
@@ -15,6 +15,8 @@
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
 
+#include <plat/devs.h>
+
 /* uart devices */
 
 static struct platform_device s3c24xx_uart_device0 = {
diff --git a/arch/blackfin/lib/outs.S b/arch/blackfin/lib/outs.S
index 250f4d4b9436..06a5e674401f 100644
--- a/arch/blackfin/lib/outs.S
+++ b/arch/blackfin/lib/outs.S
@@ -13,6 +13,8 @@
 .align 2
 
 ENTRY(_outsl)
+        CC = R2 == 0;
+        IF CC JUMP 1f;
         P0 = R0;        /* P0 = port */
         P1 = R1;        /* P1 = address */
         P2 = R2;        /* P2 = count */
@@ -20,10 +22,12 @@ ENTRY(_outsl)
         LSETUP( .Llong_loop_s, .Llong_loop_e) LC0 = P2;
 .Llong_loop_s: R0 = [P1++];
 .Llong_loop_e: [P0] = R0;
-        RTS;
+1:      RTS;
 ENDPROC(_outsl)
 
 ENTRY(_outsw)
+        CC = R2 == 0;
+        IF CC JUMP 1f;
         P0 = R0;        /* P0 = port */
         P1 = R1;        /* P1 = address */
         P2 = R2;        /* P2 = count */
@@ -31,10 +35,12 @@ ENTRY(_outsw)
         LSETUP( .Lword_loop_s, .Lword_loop_e) LC0 = P2;
 .Lword_loop_s: R0 = W[P1++];
 .Lword_loop_e: W[P0] = R0;
-        RTS;
+1:      RTS;
 ENDPROC(_outsw)
 
 ENTRY(_outsb)
+        CC = R2 == 0;
+        IF CC JUMP 1f;
         P0 = R0;        /* P0 = port */
         P1 = R1;        /* P1 = address */
         P2 = R2;        /* P2 = count */
@@ -42,10 +48,12 @@ ENTRY(_outsb)
         LSETUP( .Lbyte_loop_s, .Lbyte_loop_e) LC0 = P2;
 .Lbyte_loop_s: R0 = B[P1++];
 .Lbyte_loop_e: B[P0] = R0;
-        RTS;
+1:      RTS;
 ENDPROC(_outsb)
 
 ENTRY(_outsw_8)
+        CC = R2 == 0;
+        IF CC JUMP 1f;
         P0 = R0;        /* P0 = port */
         P1 = R1;        /* P1 = address */
         P2 = R2;        /* P2 = count */
@@ -56,5 +64,5 @@ ENTRY(_outsw_8)
                 R0 = R0 << 8;
                 R0 = R0 + R1;
 .Lword8_loop_e: W[P0] = R0;
-        RTS;
+1:      RTS;
 ENDPROC(_outsw_8)
diff --git a/arch/blackfin/mach-common/cache.S b/arch/blackfin/mach-common/cache.S
index 790c767ca95a..ab4a925a443e 100644
--- a/arch/blackfin/mach-common/cache.S
+++ b/arch/blackfin/mach-common/cache.S
@@ -58,6 +58,8 @@
 1:
 .ifeqs "\flushins", BROK_FLUSH_INST
         \flushins [P0++];
+        nop;
+        nop;
 2:      nop;
 .else
 2:      \flushins [P0++];
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index f5ecc0566bc2..d88983516e26 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -4,6 +4,7 @@ config MIPS
         select HAVE_GENERIC_DMA_COHERENT
         select HAVE_IDE
         select HAVE_OPROFILE
+        select HAVE_IRQ_WORK
         select HAVE_PERF_EVENTS
         select PERF_USE_VMALLOC
         select HAVE_ARCH_KGDB
@@ -208,6 +209,7 @@ config MACH_JZ4740
         select ARCH_REQUIRE_GPIOLIB
         select SYS_HAS_EARLY_PRINTK
         select HAVE_PWM
+        select HAVE_CLK
 
 config LASAT
         bool "LASAT Networks platforms"
@@ -333,6 +335,8 @@ config PNX8550_STB810
 config PMC_MSP
         bool "PMC-Sierra MSP chipsets"
         depends on EXPERIMENTAL
+        select CEVT_R4K
+        select CSRC_R4K
         select DMA_NONCOHERENT
         select SWAP_IO_SPACE
         select NO_EXCEPT_FILL
diff --git a/arch/mips/alchemy/mtx-1/board_setup.c b/arch/mips/alchemy/mtx-1/board_setup.c
index 6398fa95905c..40b84b991191 100644
--- a/arch/mips/alchemy/mtx-1/board_setup.c
+++ b/arch/mips/alchemy/mtx-1/board_setup.c
@@ -54,8 +54,8 @@ int mtx1_pci_idsel(unsigned int devsel, int assert);
 
 static void mtx1_reset(char *c)
 {
-        /* Hit BCSR.SYSTEM_CONTROL[SW_RST] */
-        au_writel(0x00000000, 0xAE00001C);
+        /* Jump to the reset vector */
+        __asm__ __volatile__("jr\t%0"::"r"(0xbfc00000));
 }
 
 static void mtx1_power_off(void)
diff --git a/arch/mips/alchemy/mtx-1/platform.c b/arch/mips/alchemy/mtx-1/platform.c
index e30e42add697..956f946218c5 100644
--- a/arch/mips/alchemy/mtx-1/platform.c
+++ b/arch/mips/alchemy/mtx-1/platform.c
@@ -28,6 +28,8 @@
 #include <linux/mtd/physmap.h>
 #include <mtd/mtd-abi.h>
 
+#include <asm/mach-au1x00/au1xxx_eth.h>
+
 static struct gpio_keys_button mtx1_gpio_button[] = {
         {
                 .gpio = 207,
@@ -140,10 +142,17 @@ static struct __initdata platform_device * mtx1_devs[] = {
         &mtx1_mtd,
 };
 
+static struct au1000_eth_platform_data mtx1_au1000_eth0_pdata = {
+        .phy_search_highest_addr        = 1,
+        .phy1_search_mac0               = 1,
+};
+
 static int __init mtx1_register_devices(void)
 {
         int rc;
 
+        au1xxx_override_eth_cfg(0, &mtx1_au1000_eth0_pdata);
+
         rc = gpio_request(mtx1_gpio_button[0].gpio,
                                         mtx1_gpio_button[0].desc);
         if (rc < 0) {
diff --git a/arch/mips/alchemy/xxs1500/board_setup.c b/arch/mips/alchemy/xxs1500/board_setup.c
index b43c918925d3..80c521e5290d 100644
--- a/arch/mips/alchemy/xxs1500/board_setup.c
+++ b/arch/mips/alchemy/xxs1500/board_setup.c
@@ -36,8 +36,8 @@
 
 static void xxs1500_reset(char *c)
 {
-        /* Hit BCSR.SYSTEM_CONTROL[SW_RST] */
-        au_writel(0x00000000, 0xAE00001C);
+        /* Jump to the reset vector */
+        __asm__ __volatile__("jr\t%0"::"r"(0xbfc00000));
 }
 
 static void xxs1500_power_off(void)
diff --git a/arch/mips/include/asm/perf_event.h b/arch/mips/include/asm/perf_event.h
index e00007cf8162..d0c77496c728 100644
--- a/arch/mips/include/asm/perf_event.h
+++ b/arch/mips/include/asm/perf_event.h
@@ -11,15 +11,5 @@
 
 #ifndef __MIPS_PERF_EVENT_H__
 #define __MIPS_PERF_EVENT_H__
-
-/*
- * MIPS performance counters do not raise NMI upon overflow, a regular
- * interrupt will be signaled. Hence we can do the pending perf event
- * work at the tail of the irq handler.
- */
-static inline void
-set_perf_event_pending(void)
-{
-}
-
+/* Leave it empty here. The file is required by linux/perf_event.h */
 #endif /* __MIPS_PERF_EVENT_H__ */
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index 5a84a1f11231..94ca2b018af7 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -17,29 +17,13 @@
 #include <asm/cacheflush.h>
 #include <asm/uasm.h>
 
-/*
- * If the Instruction Pointer is in module space (0xc0000000), return true;
- * otherwise, it is in kernel space (0x80000000), return false.
- *
- * FIXME: This will not work when the kernel space and module space are the
- * same. If they are the same, we need to modify scripts/recordmcount.pl,
- * ftrace_make_nop/call() and the other related parts to ensure the
- * enabling/disabling of the calling site to _mcount is right for both kernel
- * and module.
- */
-
-static inline int in_module(unsigned long ip)
-{
-        return ip & 0x40000000;
-}
+#include <asm-generic/sections.h>
 
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 #define JAL 0x0c000000          /* jump & link: ip --> ra, jump to target */
 #define ADDR_MASK 0x03ffffff    /*  op_code|addr : 31...26|25 ....0 */
 
-#define INSN_B_1F_4 0x10000004  /* b 1f; offset = 4 */
-#define INSN_B_1F_5 0x10000005  /* b 1f; offset = 5 */
 #define INSN_NOP 0x00000000     /* nop */
 #define INSN_JAL(addr)  \
         ((unsigned int)(JAL | (((addr) >> 2) & ADDR_MASK)))
@@ -69,6 +53,20 @@ static inline void ftrace_dyn_arch_init_insns(void)
 #endif
 }
 
+/*
+ * Check if the address is in kernel space
+ *
+ * Clone core_kernel_text() from kernel/extable.c, but doesn't call
+ * init_kernel_text() for Ftrace doesn't trace functions in init sections.
+ */
+static inline int in_kernel_space(unsigned long ip)
+{
+        if (ip >= (unsigned long)_stext &&
+            ip <= (unsigned long)_etext)
+                return 1;
+        return 0;
+}
+
 static int ftrace_modify_code(unsigned long ip, unsigned int new_code)
 {
         int faulted;
@@ -84,6 +82,42 @@ static int ftrace_modify_code(unsigned long ip, unsigned int new_code)
         return 0;
 }
 
+/*
+ * The details about the calling site of mcount on MIPS
+ *
+ * 1. For kernel:
+ *
+ * move at, ra
+ * jal _mcount          --> nop
+ *
+ * 2. For modules:
+ *
+ * 2.1 For KBUILD_MCOUNT_RA_ADDRESS and CONFIG_32BIT
+ *
+ * lui v1, hi_16bit_of_mcount        --> b 1f (0x10000005)
+ * addiu v1, v1, low_16bit_of_mcount
+ * move at, ra
+ * move $12, ra_address
+ * jalr v1
+ *  sub sp, sp, 8
+ *                                  1: offset = 5 instructions
+ * 2.2 For the Other situations
+ *
+ * lui v1, hi_16bit_of_mcount        --> b 1f (0x10000004)
+ * addiu v1, v1, low_16bit_of_mcount
+ * move at, ra
+ * jalr v1
+ *  nop | move $12, ra_address | sub sp, sp, 8
+ *                                  1: offset = 4 instructions
+ */
+
+#if defined(KBUILD_MCOUNT_RA_ADDRESS) && defined(CONFIG_32BIT)
+#define MCOUNT_OFFSET_INSNS 5
+#else
+#define MCOUNT_OFFSET_INSNS 4
+#endif
+#define INSN_B_1F (0x10000000 | MCOUNT_OFFSET_INSNS)
+
 int ftrace_make_nop(struct module *mod,
                     struct dyn_ftrace *rec, unsigned long addr)
 {
@@ -91,39 +125,11 @@ int ftrace_make_nop(struct module *mod,
         unsigned long ip = rec->ip;
 
         /*
-         * We have compiled module with -mlong-calls, but compiled the kernel
-         * without it, we need to cope with them respectively.
+         * If ip is in kernel space, no long call, otherwise, long call is
+         * needed.
          */
-        if (in_module(ip)) {
-#if defined(KBUILD_MCOUNT_RA_ADDRESS) && defined(CONFIG_32BIT)
-                /*
-                 * lui v1, hi_16bit_of_mcount        --> b 1f (0x10000005)
-                 * addiu v1, v1, low_16bit_of_mcount
-                 * move at, ra
-                 * move $12, ra_address
-                 * jalr v1
-                 *  sub sp, sp, 8
-                 *                                  1: offset = 5 instructions
-                 */
-                new = INSN_B_1F_5;
-#else
-                /*
-                 * lui v1, hi_16bit_of_mcount        --> b 1f (0x10000004)
-                 * addiu v1, v1, low_16bit_of_mcount
-                 * move at, ra
-                 * jalr v1
-                 *  nop | move $12, ra_address | sub sp, sp, 8
-                 *                                  1: offset = 4 instructions
-                 */
-                new = INSN_B_1F_4;
-#endif
-        } else {
-                /*
-                 * move at, ra
-                 * jal _mcount          --> nop
-                 */
-                new = INSN_NOP;
-        }
+        new = in_kernel_space(ip) ? INSN_NOP : INSN_B_1F;
+
         return ftrace_modify_code(ip, new);
 }
 
@@ -132,8 +138,8 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
         unsigned int new;
         unsigned long ip = rec->ip;
 
-        /* ip, module: 0xc0000000, kernel: 0x80000000 */
-        new = in_module(ip) ? insn_lui_v1_hi16_mcount : insn_jal_ftrace_caller;
+        new = in_kernel_space(ip) ? insn_jal_ftrace_caller :
+                insn_lui_v1_hi16_mcount;
 
         return ftrace_modify_code(ip, new);
 }
@@ -190,29 +196,25 @@ int ftrace_disable_ftrace_graph_caller(void)
 #define S_R_SP  (0xafb0 << 16)  /* s{d,w} R, offset(sp) */
 #define OFFSET_MASK     0xffff  /* stack offset range: 0 ~ PT_SIZE */
 
-unsigned long ftrace_get_parent_addr(unsigned long self_addr,
-                                     unsigned long parent,
-                                     unsigned long parent_addr,
-                                     unsigned long fp)
+unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long
+                old_parent_ra, unsigned long parent_ra_addr, unsigned long fp)
 {
-        unsigned long sp, ip, ra;
+        unsigned long sp, ip, tmp;
         unsigned int code;
         int faulted;
 
         /*
-         * For module, move the ip from calling site of mcount to the
-         * instruction "lui v1, hi_16bit_of_mcount"(offset is 20), but for
-         * kernel, move to the instruction "move ra, at"(offset is 12)
+         * For module, move the ip from the return address after the
+         * instruction "lui v1, hi_16bit_of_mcount"(offset is 24), but for
+         * kernel, move after the instruction "move ra, at"(offset is 16)
          */
-        ip = self_addr - (in_module(self_addr) ? 20 : 12);
+        ip = self_ra - (in_kernel_space(self_ra) ? 16 : 24);
 
         /*
          * search the text until finding the non-store instruction or "s{d,w}
          * ra, offset(sp)" instruction
          */
         do {
-                ip -= 4;
-
                 /* get the code at "ip": code = *(unsigned int *)ip; */
                 safe_load_code(code, ip, faulted);
 
@@ -224,18 +226,20 @@ unsigned long ftrace_get_parent_addr(unsigned long self_addr,
                  * store the ra on the stack
                  */
                 if ((code & S_R_SP) != S_R_SP)
-                        return parent_addr;
+                        return parent_ra_addr;
 
-        } while (((code & S_RA_SP) != S_RA_SP));
+                /* Move to the next instruction */
+                ip -= 4;
+        } while ((code & S_RA_SP) != S_RA_SP);
 
         sp = fp + (code & OFFSET_MASK);
 
-        /* ra = *(unsigned long *)sp; */
-        safe_load_stack(ra, sp, faulted);
+        /* tmp = *(unsigned long *)sp; */
+        safe_load_stack(tmp, sp, faulted);
         if (unlikely(faulted))
                 return 0;
 
-        if (ra == parent)
+        if (tmp == old_parent_ra)
                 return sp;
         return 0;
 }
@@ -246,21 +250,21 @@ unsigned long ftrace_get_parent_addr(unsigned long self_addr,
  * Hook the return address and push it in the stack of return addrs
  * in current thread info.
  */
-void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+void prepare_ftrace_return(unsigned long *parent_ra_addr, unsigned long self_ra,
                            unsigned long fp)
 {
-        unsigned long old;
+        unsigned long old_parent_ra;
         struct ftrace_graph_ent trace;
         unsigned long return_hooker = (unsigned long)
             &return_to_handler;
-        int faulted;
+        int faulted, insns;
 
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 return;
 
         /*
-         * "parent" is the stack address saved the return address of the caller
-         * of _mcount.
+         * "parent_ra_addr" is the stack address saved the return address of
+         * the caller of _mcount.
          *
          * if the gcc < 4.5, a leaf function does not save the return address
          * in the stack address, so, we "emulate" one in _mcount's stack space,
@@ -275,37 +279,44 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
          * do it in ftrace_graph_caller of mcount.S.
          */
 
-        /* old = *parent; */
-        safe_load_stack(old, parent, faulted);
+        /* old_parent_ra = *parent_ra_addr; */
+        safe_load_stack(old_parent_ra, parent_ra_addr, faulted);
         if (unlikely(faulted))
                 goto out;
 #ifndef KBUILD_MCOUNT_RA_ADDRESS
-        parent = (unsigned long *)ftrace_get_parent_addr(self_addr, old,
-                        (unsigned long)parent, fp);
+        parent_ra_addr = (unsigned long *)ftrace_get_parent_ra_addr(self_ra,
+                        old_parent_ra, (unsigned long)parent_ra_addr, fp);
         /*
          * If fails when getting the stack address of the non-leaf function's
          * ra, stop function graph tracer and return
          */
-        if (parent == 0)
+        if (parent_ra_addr == 0)
                 goto out;
 #endif
-        /* *parent = return_hooker; */
-        safe_store_stack(return_hooker, parent, faulted);
+        /* *parent_ra_addr = return_hooker; */
+        safe_store_stack(return_hooker, parent_ra_addr, faulted);
         if (unlikely(faulted))
                 goto out;
 
-        if (ftrace_push_return_trace(old, self_addr, &trace.depth, fp) ==
-            -EBUSY) {
-                *parent = old;
+        if (ftrace_push_return_trace(old_parent_ra, self_ra, &trace.depth, fp)
+            == -EBUSY) {
+                *parent_ra_addr = old_parent_ra;
                 return;
         }
 
-        trace.func = self_addr;
+        /*
+         * Get the recorded ip of the current mcount calling site in the
+         * __mcount_loc section, which will be used to filter the function
+         * entries configured through the tracing/set_graph_function interface.
+         */
+
+        insns = in_kernel_space(self_ra) ? 2 : MCOUNT_OFFSET_INSNS + 1;
+        trace.func = self_ra - (MCOUNT_INSN_SIZE * insns);
 
         /* Only trace if the calling function expects to */
         if (!ftrace_graph_entry(&trace)) {
                 current->curr_ret_stack--;
-                *parent = old;
+                *parent_ra_addr = old_parent_ra;
         }
         return;
 out:
diff --git a/arch/mips/kernel/perf_event.c b/arch/mips/kernel/perf_event.c
index 2b7f3f703b83..a8244854d3dc 100644
--- a/arch/mips/kernel/perf_event.c
+++ b/arch/mips/kernel/perf_event.c
@@ -161,41 +161,6 @@ mipspmu_event_set_period(struct perf_event *event,
         return ret;
 }
 
-static int mipspmu_enable(struct perf_event *event)
-{
-        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
-        struct hw_perf_event *hwc = &event->hw;
-        int idx;
-        int err = 0;
-
-        /* To look for a free counter for this event. */
-        idx = mipspmu->alloc_counter(cpuc, hwc);
-        if (idx < 0) {
-                err = idx;
-                goto out;
-        }
-
-        /*
-         * If there is an event in the counter we are going to use then
-         * make sure it is disabled.
-         */
-        event->hw.idx = idx;
-        mipspmu->disable_event(idx);
-        cpuc->events[idx] = event;
-
-        /* Set the period for the event. */
-        mipspmu_event_set_period(event, hwc, idx);
-
-        /* Enable the event. */
-        mipspmu->enable_event(hwc, idx);
-
-        /* Propagate our changes to the userspace mapping. */
-        perf_event_update_userpage(event);
-
-out:
-        return err;
-}
-
 static void mipspmu_event_update(struct perf_event *event,
                         struct hw_perf_event *hwc,
                         int idx)
@@ -204,7 +169,7 @@ static void mipspmu_event_update(struct perf_event *event,
         unsigned long flags;
         int shift = 64 - TOTAL_BITS;
         s64 prev_raw_count, new_raw_count;
-        s64 delta;
+        u64 delta;
 
 again:
         prev_raw_count = local64_read(&hwc->prev_count);
@@ -231,32 +196,90 @@ again:
         return;
 }
 
-static void mipspmu_disable(struct perf_event *event)
+static void mipspmu_start(struct perf_event *event, int flags)
+{
+        struct hw_perf_event *hwc = &event->hw;
+
+        if (!mipspmu)
+                return;
+
+        if (flags & PERF_EF_RELOAD)
+                WARN_ON_ONCE(!(hwc->state & PERF_HES_UPTODATE));
+
+        hwc->state = 0;
+
+        /* Set the period for the event. */
+        mipspmu_event_set_period(event, hwc, hwc->idx);
+
+        /* Enable the event. */
+        mipspmu->enable_event(hwc, hwc->idx);
+}
+
+static void mipspmu_stop(struct perf_event *event, int flags)
+{
+        struct hw_perf_event *hwc = &event->hw;
+
+        if (!mipspmu)
+                return;
+
+        if (!(hwc->state & PERF_HES_STOPPED)) {
+                /* We are working on a local event. */
+                mipspmu->disable_event(hwc->idx);
+                barrier();
+                mipspmu_event_update(event, hwc, hwc->idx);
+                hwc->state |= PERF_HES_STOPPED | PERF_HES_UPTODATE;
+        }
+}
+
+static int mipspmu_add(struct perf_event *event, int flags)
 {
         struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
         struct hw_perf_event *hwc = &event->hw;
-        int idx = hwc->idx;
+        int idx;
+        int err = 0;
 
+        perf_pmu_disable(event->pmu);
 
-        WARN_ON(idx < 0 || idx >= mipspmu->num_counters);
+        /* To look for a free counter for this event. */
+        idx = mipspmu->alloc_counter(cpuc, hwc);
+        if (idx < 0) {
+                err = idx;
+                goto out;
+        }
 
-        /* We are working on a local event. */
+        /*
+         * If there is an event in the counter we are going to use then
+         * make sure it is disabled.
+         */
+        event->hw.idx = idx;
         mipspmu->disable_event(idx);
+        cpuc->events[idx] = event;
 
-        barrier();
-
-        mipspmu_event_update(event, hwc, idx);
-        cpuc->events[idx] = NULL;
-        clear_bit(idx, cpuc->used_mask);
+        hwc->state = PERF_HES_STOPPED | PERF_HES_UPTODATE;
+        if (flags & PERF_EF_START)
+                mipspmu_start(event, PERF_EF_RELOAD);
 
+        /* Propagate our changes to the userspace mapping. */
         perf_event_update_userpage(event);
+
+out:
+        perf_pmu_enable(event->pmu);
+        return err;
 }
 
-static void mipspmu_unthrottle(struct perf_event *event)
+static void mipspmu_del(struct perf_event *event, int flags)
 {
+        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
         struct hw_perf_event *hwc = &event->hw;
+        int idx = hwc->idx;
 
-        mipspmu->enable_event(hwc, hwc->idx);
+        WARN_ON(idx < 0 || idx >= mipspmu->num_counters);
+
+        mipspmu_stop(event, PERF_EF_UPDATE);
+        cpuc->events[idx] = NULL;
+        clear_bit(idx, cpuc->used_mask);
+
+        perf_event_update_userpage(event);
 }
 
 static void mipspmu_read(struct perf_event *event)
@@ -270,12 +293,17 @@ static void mipspmu_read(struct perf_event *event)
         mipspmu_event_update(event, hwc, hwc->idx);
 }
 
-static struct pmu pmu = {
-        .enable         = mipspmu_enable,
-        .disable        = mipspmu_disable,
-        .unthrottle     = mipspmu_unthrottle,
-        .read           = mipspmu_read,
-};
+static void mipspmu_enable(struct pmu *pmu)
+{
+        if (mipspmu)
+                mipspmu->start();
+}
+
+static void mipspmu_disable(struct pmu *pmu)
+{
+        if (mipspmu)
+                mipspmu->stop();
+}
 
 static atomic_t active_events = ATOMIC_INIT(0);
 static DEFINE_MUTEX(pmu_reserve_mutex);
@@ -318,6 +346,82 @@ static void mipspmu_free_irq(void)
                 perf_irq = save_perf_irq;
 }
 
+/*
+ * mipsxx/rm9000/loongson2 have different performance counters, they have
+ * specific low-level init routines.
+ */
+static void reset_counters(void *arg);
+static int __hw_perf_event_init(struct perf_event *event);
+
+static void hw_perf_event_destroy(struct perf_event *event)
+{
+        if (atomic_dec_and_mutex_lock(&active_events,
+                                &pmu_reserve_mutex)) {
+                /*
+                 * We must not call the destroy function with interrupts
+                 * disabled.
+                 */
+                on_each_cpu(reset_counters,
+                        (void *)(long)mipspmu->num_counters, 1);
+                mipspmu_free_irq();
+                mutex_unlock(&pmu_reserve_mutex);
+        }
+}
+
+static int mipspmu_event_init(struct perf_event *event)
+{
+        int err = 0;
+
+        switch (event->attr.type) {
+        case PERF_TYPE_RAW:
+        case PERF_TYPE_HARDWARE:
+        case PERF_TYPE_HW_CACHE:
+                break;
+
+        default:
+                return -ENOENT;
+        }
+
+        if (!mipspmu || event->cpu >= nr_cpumask_bits ||
+                (event->cpu >= 0 && !cpu_online(event->cpu)))
+                return -ENODEV;
+
+        if (!atomic_inc_not_zero(&active_events)) {
+                if (atomic_read(&active_events) > MIPS_MAX_HWEVENTS) {
+                        atomic_dec(&active_events);
+                        return -ENOSPC;
+                }
+
+                mutex_lock(&pmu_reserve_mutex);
+                if (atomic_read(&active_events) == 0)
+                        err = mipspmu_get_irq();
+
+                if (!err)
+                        atomic_inc(&active_events);
+                mutex_unlock(&pmu_reserve_mutex);
+        }
+
+        if (err)
+                return err;
+
+        err = __hw_perf_event_init(event);
+        if (err)
+                hw_perf_event_destroy(event);
+
+        return err;
+}
+
+static struct pmu pmu = {
+        .pmu_enable     = mipspmu_enable,
+        .pmu_disable    = mipspmu_disable,
+        .event_init     = mipspmu_event_init,
+        .add            = mipspmu_add,
+        .del            = mipspmu_del,
+        .start          = mipspmu_start,
+        .stop           = mipspmu_stop,
+        .read           = mipspmu_read,
+};
+
 static inline unsigned int
 mipspmu_perf_event_encode(const struct mips_perf_event *pev)
 {
@@ -382,8 +486,9 @@ static int validate_event(struct cpu_hw_events *cpuc,
 {
         struct hw_perf_event fake_hwc = event->hw;
 
-        if (event->pmu && event->pmu != &pmu)
-                return 0;
+        /* Allow mixed event group. So return 1 to pass validation. */
+        if (event->pmu != &pmu || event->state <= PERF_EVENT_STATE_OFF)
+                return 1;
 
         return mipspmu->alloc_counter(cpuc, &fake_hwc) >= 0;
 }
@@ -409,73 +514,6 @@ static int validate_group(struct perf_event *event)
         return 0;
 }
 
-/*
- * mipsxx/rm9000/loongson2 have different performance counters, they have
- * specific low-level init routines.
- */
-static void reset_counters(void *arg);
-static int __hw_perf_event_init(struct perf_event *event);
-
-static void hw_perf_event_destroy(struct perf_event *event)
-{
-        if (atomic_dec_and_mutex_lock(&active_events,
-                                &pmu_reserve_mutex)) {
-                /*
-                 * We must not call the destroy function with interrupts
-                 * disabled.
-                 */
-                on_each_cpu(reset_counters,
-                        (void *)(long)mipspmu->num_counters, 1);
-                mipspmu_free_irq();
-                mutex_unlock(&pmu_reserve_mutex);
-        }
-}
-
-const struct pmu *hw_perf_event_init(struct perf_event *event)
-{
-        int err = 0;
-
-        if (!mipspmu || event->cpu >= nr_cpumask_bits ||
-                (event->cpu >= 0 && !cpu_online(event->cpu)))
-                return ERR_PTR(-ENODEV);
-
-        if (!atomic_inc_not_zero(&active_events)) {
-                if (atomic_read(&active_events) > MIPS_MAX_HWEVENTS) {
-                        atomic_dec(&active_events);
-                        return ERR_PTR(-ENOSPC);
-                }
-
-                mutex_lock(&pmu_reserve_mutex);
-                if (atomic_read(&active_events) == 0)
-                        err = mipspmu_get_irq();
-
-                if (!err)
-                        atomic_inc(&active_events);
-                mutex_unlock(&pmu_reserve_mutex);
-        }
-
-        if (err)
-                return ERR_PTR(err);
-
-        err = __hw_perf_event_init(event);
-        if (err)
-                hw_perf_event_destroy(event);
-
-        return err ? ERR_PTR(err) : &pmu;
-}
-
-void hw_perf_enable(void)
-{
-        if (mipspmu)
-                mipspmu->start();
-}
-
-void hw_perf_disable(void)
-{
-        if (mipspmu)
-                mipspmu->stop();
-}
-
 /* This is needed by specific irq handlers in perf_event_*.c */
 static void
 handle_associated_event(struct cpu_hw_events *cpuc,
@@ -496,21 +534,13 @@ handle_associated_event(struct cpu_hw_events *cpuc,
 #include "perf_event_mipsxx.c"
 
 /* Callchain handling code. */
-static inline void
-callchain_store(struct perf_callchain_entry *entry,
-                u64 ip)
-{
-        if (entry->nr < PERF_MAX_STACK_DEPTH)
-                entry->ip[entry->nr++] = ip;
-}
 
 /*
  * Leave userspace callchain empty for now. When we find a way to trace
  * the user stack callchains, we add here.
  */
-static void
-perf_callchain_user(struct pt_regs *regs,
-                    struct perf_callchain_entry *entry)
+void perf_callchain_user(struct perf_callchain_entry *entry,
+                    struct pt_regs *regs)
 {
 }
 
@@ -523,23 +553,21 @@ static void save_raw_perf_callchain(struct perf_callchain_entry *entry,
         while (!kstack_end(sp)) {
                 addr = *sp++;
                 if (__kernel_text_address(addr)) {
-                        callchain_store(entry, addr);
+                        perf_callchain_store(entry, addr);
                         if (entry->nr >= PERF_MAX_STACK_DEPTH)
                                 break;
                 }
         }
 }
 
-static void
-perf_callchain_kernel(struct pt_regs *regs,
-                      struct perf_callchain_entry *entry)
+void perf_callchain_kernel(struct perf_callchain_entry *entry,
+                      struct pt_regs *regs)
 {
         unsigned long sp = regs->regs[29];
 #ifdef CONFIG_KALLSYMS
         unsigned long ra = regs->regs[31];
         unsigned long pc = regs->cp0_epc;
 
-        callchain_store(entry, PERF_CONTEXT_KERNEL);
         if (raw_show_trace || !__kernel_text_address(pc)) {
                 unsigned long stack_page =
                         (unsigned long)task_stack_page(current);
@@ -549,53 +577,12 @@ perf_callchain_kernel(struct pt_regs *regs,
                 return;
         }
         do {
-                callchain_store(entry, pc);
+                perf_callchain_store(entry, pc);
                 if (entry->nr >= PERF_MAX_STACK_DEPTH)
                         break;
                 pc = unwind_stack(current, &sp, pc, &ra);
         } while (pc);
 #else
-        callchain_store(entry, PERF_CONTEXT_KERNEL);
         save_raw_perf_callchain(entry, sp);
 #endif
 }
-
-static void
-perf_do_callchain(struct pt_regs *regs,
-                  struct perf_callchain_entry *entry)
-{
-        int is_user;
-
-        if (!regs)
-                return;
-
-        is_user = user_mode(regs);
-
-        if (!current || !current->pid)
-                return;
-
-        if (is_user && current->state != TASK_RUNNING)
-                return;
-
-        if (!is_user) {
-                perf_callchain_kernel(regs, entry);
-                if (current->mm)
-                        regs = task_pt_regs(current);
-                else
-                        regs = NULL;
-        }
-        if (regs)
-                perf_callchain_user(regs, entry);
-}
-
-static DEFINE_PER_CPU(struct perf_callchain_entry, pmc_irq_entry);
-
-struct perf_callchain_entry *
-perf_callchain(struct pt_regs *regs)
-{
-        struct perf_callchain_entry *entry = &__get_cpu_var(pmc_irq_entry);
-
-        entry->nr = 0;
-        perf_do_callchain(regs, entry);
-        return entry;
-}
diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
index 183e0d226669..d9a7db78ed62 100644
--- a/arch/mips/kernel/perf_event_mipsxx.c
+++ b/arch/mips/kernel/perf_event_mipsxx.c
@@ -696,7 +696,7 @@ static int mipsxx_pmu_handle_shared_irq(void)
          * interrupt, not NMI.
          */
         if (handled == IRQ_HANDLED)
-                perf_event_do_pending();
+                irq_work_run();
 
 #ifdef CONFIG_MIPS_MT_SMP
         read_unlock(&pmuint_rwlock);
@@ -1045,6 +1045,8 @@ init_hw_perf_events(void)
                         "CPU, irq %d%s\n", mipspmu->name, counters, irq,
                         irq < 0 ? " (share with timer interrupt)" : "");
 
+        perf_pmu_register(&pmu, "cpu", PERF_TYPE_RAW);
+
         return 0;
 }
 early_initcall(init_hw_perf_events);
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index 5922342bca39..dbbe0ce48d89 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -84,7 +84,7 @@ static int protected_save_fp_context(struct sigcontext __user *sc)
 
 static int protected_restore_fp_context(struct sigcontext __user *sc)
 {
-        int err, tmp;
+        int err, tmp __maybe_unused;
         while (1) {
                 lock_fpu_owner();
                 own_fpu_inatomic(0);
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index a0ed0e052b2e..aae986613795 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -115,7 +115,7 @@ static int protected_save_fp_context32(struct sigcontext32 __user *sc)
 
 static int protected_restore_fp_context32(struct sigcontext32 __user *sc)
 {
-        int err, tmp;
+        int err, tmp __maybe_unused;
         while (1) {
                 lock_fpu_owner();
                 own_fpu_inatomic(0);
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index 383aeb95cb49..32a256101082 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -193,6 +193,22 @@ void __devinit smp_prepare_boot_cpu(void)
  */
 static struct task_struct *cpu_idle_thread[NR_CPUS];
 
+struct create_idle {
+        struct work_struct work;
+        struct task_struct *idle;
+        struct completion done;
+        int cpu;
+};
+
+static void __cpuinit do_fork_idle(struct work_struct *work)
+{
+        struct create_idle *c_idle =
+                container_of(work, struct create_idle, work);
+
+        c_idle->idle = fork_idle(c_idle->cpu);
+        complete(&c_idle->done);
+}
+
 int __cpuinit __cpu_up(unsigned int cpu)
 {
         struct task_struct *idle;
@@ -203,8 +219,19 @@ int __cpuinit __cpu_up(unsigned int cpu)
          * Linux can schedule processes on this slave.
          */
         if (!cpu_idle_thread[cpu]) {
-                idle = fork_idle(cpu);
-                cpu_idle_thread[cpu] = idle;
+                /*
+                 * Schedule work item to avoid forking user task
+                 * Ported from arch/x86/kernel/smpboot.c
+                 */
+                struct create_idle c_idle = {
+                        .cpu    = cpu,
+                        .done   = COMPLETION_INITIALIZER_ONSTACK(c_idle.done),
+                };
+
+                INIT_WORK_ONSTACK(&c_idle.work, do_fork_idle);
+                schedule_work(&c_idle.work);
+                wait_for_completion(&c_idle.done);
+                idle = cpu_idle_thread[cpu] = c_idle.idle;
 
                 if (IS_ERR(idle))
                         panic(KERN_ERR "Fork failed for CPU %d", cpu);
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 1dc6edff45e0..58beabf50b3c 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -383,12 +383,11 @@ save_static_function(sys_sysmips);
 static int __used noinline
 _sys_sysmips(nabi_no_regargs struct pt_regs regs)
 {
-        long cmd, arg1, arg2, arg3;
+        long cmd, arg1, arg2;
 
         cmd = regs.regs[4];
         arg1 = regs.regs[5];
         arg2 = regs.regs[6];
-        arg3 = regs.regs[7];
 
         switch (cmd) {
         case MIPS_ATOMIC_SET:
@@ -405,7 +404,7 @@ _sys_sysmips(nabi_no_regargs struct pt_regs regs)
                 if (arg1 & 2)
                         set_thread_flag(TIF_LOGADE);
                 else
-                        clear_thread_flag(TIF_FIXADE);
+                        clear_thread_flag(TIF_LOGADE);
 
                 return 0;
 
diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c
index 6a1fdfef8fde..ab52b7cf3b6b 100644
--- a/arch/mips/kernel/vpe.c
+++ b/arch/mips/kernel/vpe.c
@@ -148,9 +148,9 @@ struct {
         spinlock_t tc_list_lock;
         struct list_head tc_list;       /* Thread contexts */
 } vpecontrol = {
-        .vpe_list_lock  = SPIN_LOCK_UNLOCKED,
+        .vpe_list_lock  = __SPIN_LOCK_UNLOCKED(vpe_list_lock),
         .vpe_list       = LIST_HEAD_INIT(vpecontrol.vpe_list),
-        .tc_list_lock   = SPIN_LOCK_UNLOCKED,
+        .tc_list_lock   = __SPIN_LOCK_UNLOCKED(tc_list_lock),
         .tc_list        = LIST_HEAD_INIT(vpecontrol.tc_list)
 };
 
diff --git a/arch/mips/loongson/Kconfig b/arch/mips/loongson/Kconfig
index 6e1b77fec7ea..aca93eed8779 100644
--- a/arch/mips/loongson/Kconfig
+++ b/arch/mips/loongson/Kconfig
@@ -1,6 +1,7 @@
+if MACH_LOONGSON
+
 choice
         prompt "Machine Type"
-        depends on MACH_LOONGSON
 
 config LEMOTE_FULOONG2E
         bool "Lemote Fuloong(2e) mini-PC"
@@ -87,3 +88,5 @@ config LOONGSON_UART_BASE
 config LOONGSON_MC146818
         bool
         default n
+
+endif # MACH_LOONGSON
diff --git a/arch/mips/loongson/common/cmdline.c b/arch/mips/loongson/common/cmdline.c
index 1a06defc4f7f..353e1d2e41a5 100644
--- a/arch/mips/loongson/common/cmdline.c
+++ b/arch/mips/loongson/common/cmdline.c
@@ -44,10 +44,5 @@ void __init prom_init_cmdline(void)
                 strcat(arcs_cmdline, " ");
         }
 
-        if ((strstr(arcs_cmdline, "console=")) == NULL)
-                strcat(arcs_cmdline, " console=ttyS0,115200");
-        if ((strstr(arcs_cmdline, "root=")) == NULL)
-                strcat(arcs_cmdline, " root=/dev/hda1");
-
         prom_init_machtype();
 }
diff --git a/arch/mips/loongson/common/machtype.c b/arch/mips/loongson/common/machtype.c
index 81fbe6b73f91..2efd5d9dee27 100644
--- a/arch/mips/loongson/common/machtype.c
+++ b/arch/mips/loongson/common/machtype.c
@@ -41,7 +41,7 @@ void __weak __init mach_prom_init_machtype(void)
 
 void __init prom_init_machtype(void)
 {
-        char *p, str[MACHTYPE_LEN];
+        char *p, str[MACHTYPE_LEN + 1];
         int machtype = MACH_LEMOTE_FL2E;
 
         mips_machtype = LOONGSON_MACHTYPE;
@@ -53,6 +53,7 @@ void __init prom_init_machtype(void)
         }
         p += strlen("machtype=");
         strncpy(str, p, MACHTYPE_LEN);
+        str[MACHTYPE_LEN] = '\0';
         p = strstr(str, " ");
         if (p)
                 *p = '\0';
diff --git a/arch/mips/math-emu/ieee754int.h b/arch/mips/math-emu/ieee754int.h
index 2701d9500959..2a7d43f4f161 100644
--- a/arch/mips/math-emu/ieee754int.h
+++ b/arch/mips/math-emu/ieee754int.h
@@ -70,7 +70,7 @@
 
 
 #define COMPXSP \
-  unsigned xm; int xe; int xs; int xc
+  unsigned xm; int xe; int xs __maybe_unused; int xc
 
 #define COMPYSP \
   unsigned ym; int ye; int ys; int yc
@@ -104,7 +104,7 @@
 
 
 #define COMPXDP \
-u64 xm; int xe; int xs; int xc
+u64 xm; int xe; int xs __maybe_unused; int xc
 
 #define COMPYDP \
 u64 ym; int ye; int ys; int yc
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index 2efcbd24c82f..279599e9a779 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -324,7 +324,7 @@ int page_is_ram(unsigned long pagenr)
 void __init paging_init(void)
 {
         unsigned long max_zone_pfns[MAX_NR_ZONES];
-        unsigned long lastpfn;
+        unsigned long lastpfn __maybe_unused;
 
         pagetable_init();
 
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 083d3412d0bc..04f9e17db9d0 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -109,6 +109,8 @@ static bool scratchpad_available(void)
 static int scratchpad_offset(int i)
 {
         BUG();
+        /* Really unreachable, but evidently some GCC want this. */
+        return 0;
 }
 #endif
 /*
diff --git a/arch/mips/pci/ops-pmcmsp.c b/arch/mips/pci/ops-pmcmsp.c
index b7c03d80c88c..68798f869c0f 100644
--- a/arch/mips/pci/ops-pmcmsp.c
+++ b/arch/mips/pci/ops-pmcmsp.c
@@ -308,7 +308,7 @@ static struct resource pci_mem_resource = {
  *  RETURNS:     PCIBIOS_SUCCESSFUL  - success
  *
  ****************************************************************************/
-static int bpci_interrupt(int irq, void *dev_id)
+static irqreturn_t bpci_interrupt(int irq, void *dev_id)
 {
         struct msp_pci_regs *preg = (void *)PCI_BASE_REG;
         unsigned int stat = preg->if_status;
@@ -326,7 +326,7 @@ static int bpci_interrupt(int irq, void *dev_id)
         /* write to clear all asserted interrupts */
         preg->if_status = stat;
 
-        return PCIBIOS_SUCCESSFUL;
+        return IRQ_HANDLED;
 }
 
 /*****************************************************************************
diff --git a/arch/mips/pmc-sierra/Kconfig b/arch/mips/pmc-sierra/Kconfig
index c139988bb85d..8d798497c614 100644
--- a/arch/mips/pmc-sierra/Kconfig
+++ b/arch/mips/pmc-sierra/Kconfig
@@ -4,15 +4,11 @@ choice
 
 config PMC_MSP4200_EVAL
         bool "PMC-Sierra MSP4200 Eval Board"
-        select CEVT_R4K
-        select CSRC_R4K
         select IRQ_MSP_SLP
         select HW_HAS_PCI
 
 config PMC_MSP4200_GW
         bool "PMC-Sierra MSP4200 VoIP Gateway"
-        select CEVT_R4K
-        select CSRC_R4K
         select IRQ_MSP_SLP
         select HW_HAS_PCI
 
diff --git a/arch/mips/pmc-sierra/msp71xx/msp_time.c b/arch/mips/pmc-sierra/msp71xx/msp_time.c
index cca64e15f57f..01df84ce31e2 100644
--- a/arch/mips/pmc-sierra/msp71xx/msp_time.c
+++ b/arch/mips/pmc-sierra/msp71xx/msp_time.c
@@ -81,7 +81,7 @@ void __init plat_time_init(void)
         mips_hpt_frequency = cpu_rate/2;
 }
 
-unsigned int __init get_c0_compare_int(void)
+unsigned int __cpuinit get_c0_compare_int(void)
 {
         return MSP_INT_VPE0_TIMER;
 }
diff --git a/arch/mn10300/include/asm/atomic.h b/arch/mn10300/include/asm/atomic.h
index 92d2f9298e38..9d773a639513 100644
--- a/arch/mn10300/include/asm/atomic.h
+++ b/arch/mn10300/include/asm/atomic.h
@@ -139,7 +139,7 @@ static inline unsigned long __cmpxchg(volatile unsigned long *m,
  * Atomically reads the value of @v.  Note that the guaranteed
  * useful range of an atomic_t is only 24 bits.
  */
-#define atomic_read(v)  ((v)->counter)
+#define atomic_read(v)  (ACCESS_ONCE((v)->counter))
 
 /**
  * atomic_set - set atomic variable
diff --git a/arch/mn10300/include/asm/uaccess.h b/arch/mn10300/include/asm/uaccess.h
index 679dee0bbd08..3d6e60dad9d9 100644
--- a/arch/mn10300/include/asm/uaccess.h
+++ b/arch/mn10300/include/asm/uaccess.h
@@ -160,9 +160,10 @@ struct __large_struct { unsigned long buf[100]; };
 
 #define __get_user_check(x, ptr, size)                                  \
 ({                                                                      \
+        const __typeof__(ptr) __guc_ptr = (ptr);                        \
         int _e;                                                         \
-        if (likely(__access_ok((unsigned long) (ptr), (size))))         \
-                _e = __get_user_nocheck((x), (ptr), (size));            \
+        if (likely(__access_ok((unsigned long) __guc_ptr, (size))))     \
+                _e = __get_user_nocheck((x), __guc_ptr, (size));        \
         else {                                                          \
                 _e = -EFAULT;                                           \
                 (x) = (__typeof__(x))0;                                 \
diff --git a/arch/mn10300/mm/cache-inv-icache.c b/arch/mn10300/mm/cache-inv-icache.c
index a8933a60b2d4..a6b63dde603d 100644
--- a/arch/mn10300/mm/cache-inv-icache.c
+++ b/arch/mn10300/mm/cache-inv-icache.c
@@ -69,7 +69,7 @@ static void flush_icache_page_range(unsigned long start, unsigned long end)
 
         /* invalidate the icache coverage on that region */
         mn10300_local_icache_inv_range2(addr + off, size);
-        smp_cache_call(SMP_ICACHE_INV_FLUSH_RANGE, start, end);
+        smp_cache_call(SMP_ICACHE_INV_RANGE, start, end);
 }
 
 /**
@@ -101,7 +101,7 @@ void flush_icache_range(unsigned long start, unsigned long end)
                  * directly */
                 start_page = (start >= 0x80000000UL) ? start : 0x80000000UL;
                 mn10300_icache_inv_range(start_page, end);
-                smp_cache_call(SMP_ICACHE_INV_FLUSH_RANGE, start, end);
+                smp_cache_call(SMP_ICACHE_INV_RANGE, start, end);
                 if (start_page == start)
                         goto done;
                 end = start_page;
diff --git a/arch/powerpc/include/asm/lppaca.h b/arch/powerpc/include/asm/lppaca.h
index 380d48bacd16..26b8c807f8f1 100644
--- a/arch/powerpc/include/asm/lppaca.h
+++ b/arch/powerpc/include/asm/lppaca.h
@@ -33,9 +33,25 @@
 //
 //----------------------------------------------------------------------------
 #include <linux/cache.h>
+#include <linux/threads.h>
 #include <asm/types.h>
 #include <asm/mmu.h>
 
+/*
+ * We only have to have statically allocated lppaca structs on
+ * legacy iSeries, which supports at most 64 cpus.
+ */
+#ifdef CONFIG_PPC_ISERIES
+#if NR_CPUS < 64
+#define NR_LPPACAS      NR_CPUS
+#else
+#define NR_LPPACAS      64
+#endif
+#else /* not iSeries */
+#define NR_LPPACAS      1
+#endif
+
+
 /* The Hypervisor barfs if the lppaca crosses a page boundary.  A 1k
  * alignment is sufficient to prevent this */
 struct lppaca {
diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h
index 991d5998d6be..fe56a23e1ff0 100644
--- a/arch/powerpc/include/asm/machdep.h
+++ b/arch/powerpc/include/asm/machdep.h
@@ -240,6 +240,12 @@ struct machdep_calls {
          * claims to support kexec.
          */
         int (*machine_kexec_prepare)(struct kimage *image);
+
+        /* Called to perform the _real_ kexec.
+         * Do NOT allocate memory or fail here. We are past the point of
+         * no return.
+         */
+        void (*machine_kexec)(struct kimage *image);
 #endif /* CONFIG_KEXEC */
 
 #ifdef CONFIG_SUSPEND
diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
index 49a170af8145..a5f8672eeff3 100644
--- a/arch/powerpc/kernel/machine_kexec.c
+++ b/arch/powerpc/kernel/machine_kexec.c
@@ -87,7 +87,10 @@ void machine_kexec(struct kimage *image)
 
         save_ftrace_enabled = __ftrace_enabled_save();
 
-        default_machine_kexec(image);
+        if (ppc_md.machine_kexec)
+                ppc_md.machine_kexec(image);
+        else
+                default_machine_kexec(image);
 
         __ftrace_enabled_restore(save_ftrace_enabled);
 
diff --git a/arch/powerpc/kernel/paca.c b/arch/powerpc/kernel/paca.c
index ebf9846f3c3b..f4adf89d7614 100644
--- a/arch/powerpc/kernel/paca.c
+++ b/arch/powerpc/kernel/paca.c
@@ -27,20 +27,6 @@ extern unsigned long __toc_start;
 #ifdef CONFIG_PPC_BOOK3S
 
 /*
- * We only have to have statically allocated lppaca structs on
- * legacy iSeries, which supports at most 64 cpus.
- */
-#ifdef CONFIG_PPC_ISERIES
-#if NR_CPUS < 64
-#define NR_LPPACAS      NR_CPUS
-#else
-#define NR_LPPACAS      64
-#endif
-#else /* not iSeries */
-#define NR_LPPACAS      1
-#endif
-
-/*
  * The structure which the hypervisor knows about - this structure
  * should not cross a page boundary.  The vpa_init/register_vpa call
  * is now known to fail if the lppaca structure crosses a page
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 7a1d5cb76932..8303a6c65ef7 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -353,6 +353,7 @@ static void switch_booke_debug_regs(struct thread_struct *new_thread)
                         prime_debug_regs(new_thread);
 }
 #else   /* !CONFIG_PPC_ADV_DEBUG_REGS */
+#ifndef CONFIG_HAVE_HW_BREAKPOINT
 static void set_debug_reg_defaults(struct thread_struct *thread)
 {
         if (thread->dabr) {
@@ -360,6 +361,7 @@ static void set_debug_reg_defaults(struct thread_struct *thread)
                 set_dabr(0);
         }
 }
+#endif /* !CONFIG_HAVE_HW_BREAKPOINT */
 #endif  /* CONFIG_PPC_ADV_DEBUG_REGS */
 
 int set_dabr(unsigned long dabr)
@@ -670,11 +672,11 @@ void flush_thread(void)
 {
         discard_lazy_cpu_state();
 
-#ifdef CONFIG_HAVE_HW_BREAKPOINTS
+#ifdef CONFIG_HAVE_HW_BREAKPOINT
         flush_ptrace_hw_breakpoint(current);
-#else /* CONFIG_HAVE_HW_BREAKPOINTS */
+#else /* CONFIG_HAVE_HW_BREAKPOINT */
         set_debug_reg_defaults(&current->thread);
-#endif /* CONFIG_HAVE_HW_BREAKPOINTS */
+#endif /* CONFIG_HAVE_HW_BREAKPOINT */
 }
 
 void
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index fd4812329570..0dc95c0aa3be 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1516,7 +1516,8 @@ int start_topology_update(void)
 {
         int rc = 0;
 
-        if (firmware_has_feature(FW_FEATURE_VPHN) &&
+        /* Disabled until races with load balancing are fixed */
+        if (0 && firmware_has_feature(FW_FEATURE_VPHN) &&
             get_lppaca()->shared_proc) {
                 vphn_enabled = 1;
                 setup_cpu_associativity_change_counters();
diff --git a/arch/powerpc/mm/tlb_hash64.c b/arch/powerpc/mm/tlb_hash64.c
index 1ec06576f619..c14d09f614f3 100644
--- a/arch/powerpc/mm/tlb_hash64.c
+++ b/arch/powerpc/mm/tlb_hash64.c
@@ -38,13 +38,11 @@ DEFINE_PER_CPU(struct ppc64_tlb_batch, ppc64_tlb_batch);
  * neesd to be flushed. This function will either perform the flush
  * immediately or will batch it up if the current CPU has an active
  * batch on it.
- *
- * Must be called from within some kind of spinlock/non-preempt region...
  */
 void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
                      pte_t *ptep, unsigned long pte, int huge)
 {
-        struct ppc64_tlb_batch *batch = &__get_cpu_var(ppc64_tlb_batch);
+        struct ppc64_tlb_batch *batch = &get_cpu_var(ppc64_tlb_batch);
         unsigned long vsid, vaddr;
         unsigned int psize;
         int ssize;
@@ -99,6 +97,7 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
          */
         if (!batch->active) {
                 flush_hash_page(vaddr, rpte, psize, ssize, 0);
+                put_cpu_var(ppc64_tlb_batch);
                 return;
         }
 
@@ -127,6 +126,7 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
         batch->index = ++i;
         if (i >= PPC64_TLB_BATCH_NR)
                 __flush_tlb_pending(batch);
+        put_cpu_var(ppc64_tlb_batch);
 }
 
 /*
diff --git a/arch/powerpc/platforms/iseries/dt.c b/arch/powerpc/platforms/iseries/dt.c
index fdb7384c0c4f..f0491cc28900 100644
--- a/arch/powerpc/platforms/iseries/dt.c
+++ b/arch/powerpc/platforms/iseries/dt.c
@@ -242,8 +242,8 @@ static void __init dt_cpus(struct iseries_flat_dt *dt)
         pft_size[0] = 0; /* NUMA CEC cookie, 0 for non NUMA  */
         pft_size[1] = __ilog2(HvCallHpt_getHptPages() * HW_PAGE_SIZE);
 
-        for (i = 0; i < NR_CPUS; i++) {
-                if (lppaca_of(i).dyn_proc_status >= 2)
+        for (i = 0; i < NR_LPPACAS; i++) {
+                if (lppaca[i].dyn_proc_status >= 2)
                         continue;
 
                 snprintf(p, 32 - (p - buf), "@%d", i);
@@ -251,7 +251,7 @@ static void __init dt_cpus(struct iseries_flat_dt *dt)
 
                 dt_prop_str(dt, "device_type", device_type_cpu);
 
-                index = lppaca_of(i).dyn_hv_phys_proc_index;
+                index = lppaca[i].dyn_hv_phys_proc_index;
                 d = &xIoHriProcessorVpd[index];
 
                 dt_prop_u32(dt, "i-cache-size", d->xInstCacheSize * 1024);
diff --git a/arch/powerpc/platforms/iseries/setup.c b/arch/powerpc/platforms/iseries/setup.c
index b0863410517f..2946ae10fbfd 100644
--- a/arch/powerpc/platforms/iseries/setup.c
+++ b/arch/powerpc/platforms/iseries/setup.c
@@ -680,6 +680,7 @@ void * __init iSeries_early_setup(void)
          * on but calling this function multiple times is fine.
          */
         identify_cpu(0, mfspr(SPRN_PVR));
+        initialise_paca(&boot_paca, 0);
 
         powerpc_firmware_features |= FW_FEATURE_ISERIES;
         powerpc_firmware_features |= FW_FEATURE_LPAR;
diff --git a/arch/sh/include/asm/sections.h b/arch/sh/include/asm/sections.h
index a78701da775b..4a5350037c8f 100644
--- a/arch/sh/include/asm/sections.h
+++ b/arch/sh/include/asm/sections.h
@@ -3,7 +3,7 @@
 
 #include <asm-generic/sections.h>
 
-extern void __nosave_begin, __nosave_end;
+extern long __nosave_begin, __nosave_end;
 extern long __machvec_start, __machvec_end;
 extern char __uncached_start, __uncached_end;
 extern char _ebss[];
diff --git a/arch/sh/kernel/cpu/sh4/setup-sh7750.c b/arch/sh/kernel/cpu/sh4/setup-sh7750.c
index 672944f5b19c..e53b4b38bd11 100644
--- a/arch/sh/kernel/cpu/sh4/setup-sh7750.c
+++ b/arch/sh/kernel/cpu/sh4/setup-sh7750.c
@@ -14,7 +14,7 @@
 #include <linux/io.h>
 #include <linux/sh_timer.h>
 #include <linux/serial_sci.h>
-#include <asm/machtypes.h>
+#include <generated/machtypes.h>
 
 static struct resource rtc_resources[] = {
         [0] = {
@@ -255,12 +255,17 @@ static struct platform_device *sh7750_early_devices[] __initdata = {
 
 void __init plat_early_device_setup(void)
 {
+        struct platform_device *dev[1];
+
         if (mach_is_rts7751r2d()) {
                 scif_platform_data.scscr |= SCSCR_CKE1;
-                early_platform_add_devices(&scif_device, 1);
+                dev[0] = &scif_device;
+                early_platform_add_devices(dev, 1);
         } else {
-                early_platform_add_devices(&sci_device, 1);
-                early_platform_add_devices(&scif_device, 1);
+                dev[0] = &sci_device;
+                early_platform_add_devices(dev, 1);
+                dev[0] = &scif_device;
+                early_platform_add_devices(dev, 1);
         }
 
         early_platform_add_devices(sh7750_early_devices,
diff --git a/arch/sh/lib/delay.c b/arch/sh/lib/delay.c
index faa8f86c0db4..0901b2f14e15 100644
--- a/arch/sh/lib/delay.c
+++ b/arch/sh/lib/delay.c
@@ -10,6 +10,16 @@
 void __delay(unsigned long loops)
 {
         __asm__ __volatile__(
+                /*
+                 * ST40-300 appears to have an issue with this code,
+                 * normally taking two cycles each loop, as with all
+                 * other SH variants. If however the branch and the
+                 * delay slot straddle an 8 byte boundary, this increases
+                 * to 3 cycles.
+                 * This align directive ensures this doesn't occur.
+                 */
+                ".balign 8\n\t"
+
                 "tst    %0, %0\n\t"
                 "1:\t"
                 "bf/s   1b\n\t"
diff --git a/arch/sh/mm/cache.c b/arch/sh/mm/cache.c
index 88d3dc3d30d5..5a580ea04429 100644
--- a/arch/sh/mm/cache.c
+++ b/arch/sh/mm/cache.c
@@ -108,7 +108,8 @@ void copy_user_highpage(struct page *to, struct page *from,
                 kunmap_atomic(vfrom, KM_USER0);
         }
 
-        if (pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
+        if (pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK) ||
+            (vma->vm_flags & VM_EXEC))
                 __flush_purge_region(vto, PAGE_SIZE);
 
         kunmap_atomic(vto, KM_USER1);
diff --git a/arch/x86/boot/compressed/mkpiggy.c b/arch/x86/boot/compressed/mkpiggy.c
index 646aa78ba5fd..46a823882437 100644
--- a/arch/x86/boot/compressed/mkpiggy.c
+++ b/arch/x86/boot/compressed/mkpiggy.c
@@ -62,7 +62,12 @@ int main(int argc, char *argv[])
         if (fseek(f, -4L, SEEK_END)) {
                 perror(argv[1]);
         }
-        fread(&olen, sizeof olen, 1, f);
+
+        if (fread(&olen, sizeof(olen), 1, f) != 1) {
+                perror(argv[1]);
+                return 1;
+        }
+
         ilen = ftell(f);
         olen = getle32(&olen);
         fclose(f);
diff --git a/arch/x86/include/asm/ce4100.h b/arch/x86/include/asm/ce4100.h
new file mode 100644
index 000000000000..e656ad8c0a2e
--- /dev/null
+++ b/arch/x86/include/asm/ce4100.h
@@ -0,0 +1,6 @@
+#ifndef _ASM_CE4100_H_
+#define _ASM_CE4100_H_
+
+int ce4100_pci_init(void);
+
+#endif
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 4d0dfa0d998e..43a18c77676d 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -36,6 +36,11 @@
 #define MSR_IA32_PERFCTR1               0x000000c2
 #define MSR_FSB_FREQ                    0x000000cd
 
+#define MSR_NHM_SNB_PKG_CST_CFG_CTL     0x000000e2
+#define NHM_C3_AUTO_DEMOTE              (1UL << 25)
+#define NHM_C1_AUTO_DEMOTE              (1UL << 26)
+#define ATM_LNC_C6_AUTO_DEMOTE          (1UL << 25)
+
 #define MSR_MTRRcap                     0x000000fe
 #define MSR_IA32_BBL_CR_CTL             0x00000119
 
diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
index ce1d54c8a433..3e094af443c3 100644
--- a/arch/x86/include/asm/uv/uv_bau.h
+++ b/arch/x86/include/asm/uv/uv_bau.h
@@ -176,7 +176,7 @@ struct bau_msg_payload {
 struct bau_msg_header {
         unsigned int dest_subnodeid:6;  /* must be 0x10, for the LB */
         /* bits 5:0 */
-        unsigned int base_dest_nodeid:15; /* nasid (pnode<<1) of */
+        unsigned int base_dest_nodeid:15; /* nasid of the */
         /* bits 20:6 */                   /* first bit in uvhub map */
         unsigned int command:8; /* message type */
         /* bits 28:21 */
diff --git a/arch/x86/kernel/check.c b/arch/x86/kernel/check.c
index 13a389179514..452932d34730 100644
--- a/arch/x86/kernel/check.c
+++ b/arch/x86/kernel/check.c
@@ -106,8 +106,8 @@ void __init setup_bios_corruption_check(void)
                 addr += size;
         }
 
-        printk(KERN_INFO "Scanning %d areas for low memory corruption\n",
-               num_scan_areas);
+        if (num_scan_areas)
+                printk(KERN_INFO "Scanning %d areas for low memory corruption\n", num_scan_areas);
 }
 
 
@@ -143,12 +143,12 @@ static void check_corruption(struct work_struct *dummy)
 {
         check_for_bios_corruption();
         schedule_delayed_work(&bios_check_work,
-                round_jiffies_relative(corruption_check_period*HZ)); 
+                round_jiffies_relative(corruption_check_period*HZ));
 }
 
 static int start_periodic_check_for_corruption(void)
 {
-        if (!memory_corruption_check || corruption_check_period == 0)
+        if (!num_scan_areas || !memory_corruption_check || corruption_check_period == 0)
                 return 0;
 
         printk(KERN_INFO "Scanning for low memory corruption every %d seconds\n",
diff --git a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
index bd1cac747f67..52c93648e492 100644
--- a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
+++ b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
@@ -158,9 +158,9 @@ static unsigned int cpufreq_p4_get_frequency(struct cpuinfo_x86 *c)
 {
         if (c->x86 == 0x06) {
                 if (cpu_has(c, X86_FEATURE_EST))
-                        printk(KERN_WARNING PFX "Warning: EST-capable CPU "
-                               "detected. The acpi-cpufreq module offers "
-                               "voltage scaling in addition of frequency "
+                        printk_once(KERN_WARNING PFX "Warning: EST-capable "
+                               "CPU detected. The acpi-cpufreq module offers "
+                               "voltage scaling in addition to frequency "
                                "scaling. You should use that instead of "
                                "p4-clockmod, if possible.\n");
                 switch (c->x86_model) {
diff --git a/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
index 4f6f679f2799..4a5a42b842ad 100644
--- a/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
+++ b/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
@@ -195,7 +195,7 @@ static unsigned int pcc_get_freq(unsigned int cpu)
 cmd_incomplete:
         iowrite16(0, &pcch_hdr->status);
         spin_unlock(&pcc_lock);
-        return -EINVAL;
+        return 0;
 }
 
 static int pcc_cpufreq_target(struct cpufreq_policy *policy,
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
index 35c7e65e59be..c567dec854f6 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -1537,6 +1537,7 @@ static struct notifier_block cpb_nb = {
 static int __cpuinit powernowk8_init(void)
 {
         unsigned int i, supported_cpus = 0, cpu;
+        int rv;
 
         for_each_online_cpu(i) {
                 int rc;
@@ -1555,14 +1556,14 @@ static int __cpuinit powernowk8_init(void)
 
                 cpb_capable = true;
 
-                register_cpu_notifier(&cpb_nb);
-
                 msrs = msrs_alloc();
                 if (!msrs) {
                         printk(KERN_ERR "%s: Error allocating msrs!\n", __func__);
                         return -ENOMEM;
                 }
 
+                register_cpu_notifier(&cpb_nb);
+
                 rdmsr_on_cpus(cpu_online_mask, MSR_K7_HWCR, msrs);
 
                 for_each_cpu(cpu, cpu_online_mask) {
@@ -1574,7 +1575,13 @@ static int __cpuinit powernowk8_init(void)
                         (cpb_enabled ? "on" : "off"));
         }
 
-        return cpufreq_register_driver(&cpufreq_amd64_driver);
+        rv = cpufreq_register_driver(&cpufreq_amd64_driver);
+        if (rv < 0 && boot_cpu_has(X86_FEATURE_CPB)) {
+                unregister_cpu_notifier(&cpb_nb);
+                msrs_free(msrs);
+                msrs = NULL;
+        }
+        return rv;
 }
 
 /* driver entry point for term */
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 7d90ceb882a4..20e3f8702d1e 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -229,15 +229,14 @@ void vmalloc_sync_all(void)
         for (address = VMALLOC_START & PMD_MASK;
              address >= TASK_SIZE && address < FIXADDR_TOP;
              address += PMD_SIZE) {
-
-                unsigned long flags;
                 struct page *page;
 
-                spin_lock_irqsave(&pgd_lock, flags);
+                spin_lock(&pgd_lock);
                 list_for_each_entry(page, &pgd_list, lru) {
                         spinlock_t *pgt_lock;
                         pmd_t *ret;
 
+                        /* the pgt_lock only for Xen */
                         pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
 
                         spin_lock(pgt_lock);
@@ -247,7 +246,7 @@ void vmalloc_sync_all(void)
                         if (!ret)
                                 break;
                 }
-                spin_unlock_irqrestore(&pgd_lock, flags);
+                spin_unlock(&pgd_lock);
         }
 }
 
@@ -828,6 +827,13 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
                unsigned long address, unsigned int fault)
 {
         if (fault & VM_FAULT_OOM) {
+                /* Kernel mode? Handle exceptions or die: */
+                if (!(error_code & PF_USER)) {
+                        up_read(&current->mm->mmap_sem);
+                        no_context(regs, error_code, address);
+                        return;
+                }
+
                 out_of_memory(regs, error_code, address);
         } else {
                 if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 71a59296af80..c14a5422e152 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -105,18 +105,18 @@ void sync_global_pgds(unsigned long start, unsigned long end)
 
         for (address = start; address <= end; address += PGDIR_SIZE) {
                 const pgd_t *pgd_ref = pgd_offset_k(address);
-                unsigned long flags;
                 struct page *page;
 
                 if (pgd_none(*pgd_ref))
                         continue;
 
-                spin_lock_irqsave(&pgd_lock, flags);
+                spin_lock(&pgd_lock);
                 list_for_each_entry(page, &pgd_list, lru) {
                         pgd_t *pgd;
                         spinlock_t *pgt_lock;
 
                         pgd = (pgd_t *)page_address(page) + pgd_index(address);
+                        /* the pgt_lock only for Xen */
                         pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
                         spin_lock(pgt_lock);
 
@@ -128,7 +128,7 @@ void sync_global_pgds(unsigned long start, unsigned long end)
 
                         spin_unlock(pgt_lock);
                 }
-                spin_unlock_irqrestore(&pgd_lock, flags);
+                spin_unlock(&pgd_lock);
         }
 }
 
diff --git a/arch/x86/mm/numa_64.c b/arch/x86/mm/numa_64.c
index 95ea1551eebc..1337c51b07d7 100644
--- a/arch/x86/mm/numa_64.c
+++ b/arch/x86/mm/numa_64.c
@@ -780,11 +780,7 @@ void __cpuinit numa_add_cpu(int cpu)
         int physnid;
         int nid = NUMA_NO_NODE;
 
-        apicid = early_per_cpu(x86_cpu_to_apicid, cpu);
-        if (apicid != BAD_APICID)
-                nid = apicid_to_node[apicid];
-        if (nid == NUMA_NO_NODE)
-                nid = early_cpu_to_node(cpu);
+        nid = early_cpu_to_node(cpu);
         BUG_ON(nid == NUMA_NO_NODE || !node_online(nid));
 
         /*
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index d343b3c81f3c..90825f2eb0f4 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -57,12 +57,10 @@ static unsigned long direct_pages_count[PG_LEVEL_NUM];
 
 void update_page_count(int level, unsigned long pages)
 {
-        unsigned long flags;
-
         /* Protect against CPA */
-        spin_lock_irqsave(&pgd_lock, flags);
+        spin_lock(&pgd_lock);
         direct_pages_count[level] += pages;
-        spin_unlock_irqrestore(&pgd_lock, flags);
+        spin_unlock(&pgd_lock);
 }
 
 static void split_page_count(int level)
@@ -394,7 +392,7 @@ static int
 try_preserve_large_page(pte_t *kpte, unsigned long address,
                         struct cpa_data *cpa)
 {
-        unsigned long nextpage_addr, numpages, pmask, psize, flags, addr, pfn;
+        unsigned long nextpage_addr, numpages, pmask, psize, addr, pfn;
         pte_t new_pte, old_pte, *tmp;
         pgprot_t old_prot, new_prot, req_prot;
         int i, do_split = 1;
@@ -403,7 +401,7 @@ try_preserve_large_page(pte_t *kpte, unsigned long address,
         if (cpa->force_split)
                 return 1;
 
-        spin_lock_irqsave(&pgd_lock, flags);
+        spin_lock(&pgd_lock);
         /*
          * Check for races, another CPU might have split this page
          * up already:
@@ -498,14 +496,14 @@ try_preserve_large_page(pte_t *kpte, unsigned long address,
         }
 
 out_unlock:
-        spin_unlock_irqrestore(&pgd_lock, flags);
+        spin_unlock(&pgd_lock);
 
         return do_split;
 }
 
 static int split_large_page(pte_t *kpte, unsigned long address)
 {
-        unsigned long flags, pfn, pfninc = 1;
+        unsigned long pfn, pfninc = 1;
         unsigned int i, level;
         pte_t *pbase, *tmp;
         pgprot_t ref_prot;
@@ -519,7 +517,7 @@ static int split_large_page(pte_t *kpte, unsigned long address)
         if (!base)
                 return -ENOMEM;
 
-        spin_lock_irqsave(&pgd_lock, flags);
+        spin_lock(&pgd_lock);
         /*
          * Check for races, another CPU might have split this page
          * up for us already:
@@ -591,7 +589,7 @@ out_unlock:
          */
         if (base)
                 __free_page(base);
-        spin_unlock_irqrestore(&pgd_lock, flags);
+        spin_unlock(&pgd_lock);
 
         return 0;
 }
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index 500242d3c96d..0113d19c8aa6 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -121,14 +121,12 @@ static void pgd_ctor(struct mm_struct *mm, pgd_t *pgd)
 
 static void pgd_dtor(pgd_t *pgd)
 {
-        unsigned long flags; /* can be called from interrupt context */
-
         if (SHARED_KERNEL_PMD)
                 return;
 
-        spin_lock_irqsave(&pgd_lock, flags);
+        spin_lock(&pgd_lock);
         pgd_list_del(pgd);
-        spin_unlock_irqrestore(&pgd_lock, flags);
+        spin_unlock(&pgd_lock);
 }
 
 /*
@@ -260,7 +258,6 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
 {
         pgd_t *pgd;
         pmd_t *pmds[PREALLOCATED_PMDS];
-        unsigned long flags;
 
         pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
 
@@ -280,12 +277,12 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
          * respect to anything walking the pgd_list, so that they
          * never see a partially populated pgd.
          */
-        spin_lock_irqsave(&pgd_lock, flags);
+        spin_lock(&pgd_lock);
 
         pgd_ctor(mm, pgd);
         pgd_prepopulate_pmd(mm, pgd, pmds);
 
-        spin_unlock_irqrestore(&pgd_lock, flags);
+        spin_unlock(&pgd_lock);
 
         return pgd;
 
diff --git a/arch/x86/pci/ce4100.c b/arch/x86/pci/ce4100.c
index 85b68ef5e809..9260b3eb18d4 100644
--- a/arch/x86/pci/ce4100.c
+++ b/arch/x86/pci/ce4100.c
@@ -34,6 +34,7 @@
 #include <linux/pci.h>
 #include <linux/init.h>
 
+#include <asm/ce4100.h>
 #include <asm/pci_x86.h>
 
 struct sim_reg {
@@ -306,10 +307,10 @@ struct pci_raw_ops ce4100_pci_conf = {
         .write = ce4100_conf_write,
 };
 
-static int __init ce4100_pci_init(void)
+int __init ce4100_pci_init(void)
 {
         init_sim_regs();
         raw_pci_ops = &ce4100_pci_conf;
-        return 0;
+        /* Indicate caller that it should invoke pci_legacy_init() */
+        return 1;
 }
-subsys_initcall(ce4100_pci_init);
diff --git a/arch/x86/platform/ce4100/ce4100.c b/arch/x86/platform/ce4100/ce4100.c
index d2c0d51a7178..cd6f184c3b3f 100644
--- a/arch/x86/platform/ce4100/ce4100.c
+++ b/arch/x86/platform/ce4100/ce4100.c
@@ -15,6 +15,7 @@
 #include <linux/serial_reg.h>
 #include <linux/serial_8250.h>
 
+#include <asm/ce4100.h>
 #include <asm/setup.h>
 #include <asm/io.h>
 
@@ -129,4 +130,5 @@ void __init x86_ce4100_early_setup(void)
         x86_init.resources.probe_roms = x86_init_noop;
         x86_init.mpparse.get_smp_config = x86_init_uint_noop;
         x86_init.mpparse.find_smp_config = sdv_find_smp_config;
+        x86_init.pci.init = ce4100_pci_init;
 }
diff --git a/arch/x86/platform/olpc/olpc_dt.c b/arch/x86/platform/olpc/olpc_dt.c
index dab874647530..044bda5b3174 100644
--- a/arch/x86/platform/olpc/olpc_dt.c
+++ b/arch/x86/platform/olpc/olpc_dt.c
@@ -140,8 +140,7 @@ void * __init prom_early_alloc(unsigned long size)
                  * wasted bootmem) and hand off chunks of it to callers.
                  */
                 res = alloc_bootmem(chunk_size);
-                if (!res)
-                        return NULL;
+                BUG_ON(!res);
                 prom_early_allocated += chunk_size;
                 memset(res, 0, chunk_size);
                 free_mem = chunk_size;
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index df58e9cad96a..a7b38d35c29a 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -1364,11 +1364,11 @@ uv_activation_descriptor_init(int node, int pnode)
                 memset(bd2, 0, sizeof(struct bau_desc));
                 bd2->header.sw_ack_flag = 1;
                 /*
-                 * base_dest_nodeid is the nasid (pnode<<1) of the first uvhub
+                 * base_dest_nodeid is the nasid of the first uvhub
                  * in the partition. The bit map will indicate uvhub numbers,
                  * which are 0-N in a partition. Pnodes are unique system-wide.
                  */
-                bd2->header.base_dest_nodeid = uv_partition_base_pnode << 1;
+                bd2->header.base_dest_nodeid = UV_PNODE_TO_NASID(uv_partition_base_pnode);
                 bd2->header.dest_subnodeid = 0x10; /* the LB */
                 bd2->header.command = UV_NET_ENDPOINT_INTD;
                 bd2->header.int_both = 1;
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 5e92b61ad574..f6089421147a 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -986,10 +986,9 @@ static void xen_pgd_pin(struct mm_struct *mm)
  */
 void xen_mm_pin_all(void)
 {
-        unsigned long flags;
         struct page *page;
 
-        spin_lock_irqsave(&pgd_lock, flags);
+        spin_lock(&pgd_lock);
 
         list_for_each_entry(page, &pgd_list, lru) {
                 if (!PagePinned(page)) {
@@ -998,7 +997,7 @@ void xen_mm_pin_all(void)
                 }
         }
 
-        spin_unlock_irqrestore(&pgd_lock, flags);
+        spin_unlock(&pgd_lock);
 }
 
 /*
@@ -1099,10 +1098,9 @@ static void xen_pgd_unpin(struct mm_struct *mm)
  */
 void xen_mm_unpin_all(void)
 {
-        unsigned long flags;
         struct page *page;
 
-        spin_lock_irqsave(&pgd_lock, flags);
+        spin_lock(&pgd_lock);
 
         list_for_each_entry(page, &pgd_list, lru) {
                 if (PageSavePinned(page)) {
@@ -1112,7 +1110,7 @@ void xen_mm_unpin_all(void)
                 }
         }
 
-        spin_unlock_irqrestore(&pgd_lock, flags);
+        spin_unlock(&pgd_lock);
 }
 
 void xen_activate_mm(struct mm_struct *prev, struct mm_struct *next)
diff --git a/block/blk-core.c b/block/blk-core.c
index 2f4002f79a24..518dd423a5fe 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -352,7 +352,7 @@ void blk_start_queue(struct request_queue *q)
         WARN_ON(!irqs_disabled());
 
         queue_flag_clear(QUEUE_FLAG_STOPPED, q);
-        __blk_run_queue(q);
+        __blk_run_queue(q, false);
 }
 EXPORT_SYMBOL(blk_start_queue);
 
@@ -403,13 +403,14 @@ EXPORT_SYMBOL(blk_sync_queue);
 /**
  * __blk_run_queue - run a single device queue
  * @q:  The queue to run
+ * @force_kblockd: Don't run @q->request_fn directly.  Use kblockd.
  *
  * Description:
  *    See @blk_run_queue. This variant must be called with the queue lock
  *    held and interrupts disabled.
  *
  */
-void __blk_run_queue(struct request_queue *q)
+void __blk_run_queue(struct request_queue *q, bool force_kblockd)
 {
         blk_remove_plug(q);
 
@@ -423,7 +424,7 @@ void __blk_run_queue(struct request_queue *q)
          * Only recurse once to avoid overrunning the stack, let the unplug
          * handling reinvoke the handler shortly if we already got there.
          */
-        if (!queue_flag_test_and_set(QUEUE_FLAG_REENTER, q)) {
+        if (!force_kblockd && !queue_flag_test_and_set(QUEUE_FLAG_REENTER, q)) {
                 q->request_fn(q);
                 queue_flag_clear(QUEUE_FLAG_REENTER, q);
         } else {
@@ -446,7 +447,7 @@ void blk_run_queue(struct request_queue *q)
         unsigned long flags;
 
         spin_lock_irqsave(q->queue_lock, flags);
-        __blk_run_queue(q);
+        __blk_run_queue(q, false);
         spin_unlock_irqrestore(q->queue_lock, flags);
 }
 EXPORT_SYMBOL(blk_run_queue);
@@ -1053,7 +1054,7 @@ void blk_insert_request(struct request_queue *q, struct request *rq,
 
         drive_stat_acct(rq, 1);
         __elv_add_request(q, rq, where, 0);
-        __blk_run_queue(q);
+        __blk_run_queue(q, false);
         spin_unlock_irqrestore(q->queue_lock, flags);
 }
 EXPORT_SYMBOL(blk_insert_request);
@@ -2610,13 +2611,6 @@ int kblockd_schedule_work(struct request_queue *q, struct work_struct *work)
 }
 EXPORT_SYMBOL(kblockd_schedule_work);
 
-int kblockd_schedule_delayed_work(struct request_queue *q,
-                        struct delayed_work *dwork, unsigned long delay)
-{
-        return queue_delayed_work(kblockd_workqueue, dwork, delay);
-}
-EXPORT_SYMBOL(kblockd_schedule_delayed_work);
-
 int __init blk_dev_init(void)
 {
         BUILD_BUG_ON(__REQ_NR_BITS > 8 *
diff --git a/block/blk-flush.c b/block/blk-flush.c
index 54b123d6563e..b27d0208611b 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -66,10 +66,12 @@ static void blk_flush_complete_seq_end_io(struct request_queue *q,
 
         /*
          * Moving a request silently to empty queue_head may stall the
-         * queue.  Kick the queue in those cases.
+         * queue.  Kick the queue in those cases.  This function is called
+         * from request completion path and calling directly into
+         * request_fn may confuse the driver.  Always use kblockd.
          */
         if (was_empty && next_rq)
-                __blk_run_queue(q);
+                __blk_run_queue(q, true);
 }
 
 static void pre_flush_end_io(struct request *rq, int error)
@@ -130,7 +132,7 @@ static struct request *queue_next_fseq(struct request_queue *q)
                 BUG();
         }
 
-        elv_insert(q, rq, ELEVATOR_INSERT_FRONT);
+        elv_insert(q, rq, ELEVATOR_INSERT_REQUEUE);
         return rq;
 }
 
diff --git a/block/blk-lib.c b/block/blk-lib.c
index 1a320d2406b0..bd3e8df4d5e2 100644
--- a/block/blk-lib.c
+++ b/block/blk-lib.c
@@ -109,7 +109,6 @@ struct bio_batch
         atomic_t                done;
         unsigned long           flags;
         struct completion       *wait;
-        bio_end_io_t            *end_io;
 };
 
 static void bio_batch_end_io(struct bio *bio, int err)
@@ -122,17 +121,14 @@ static void bio_batch_end_io(struct bio *bio, int err)
                 else
                         clear_bit(BIO_UPTODATE, &bb->flags);
         }
-        if (bb) {
-                if (bb->end_io)
-                        bb->end_io(bio, err);
-                atomic_inc(&bb->done);
-                complete(bb->wait);
-        }
+        if (bb)
+                if (atomic_dec_and_test(&bb->done))
+                        complete(bb->wait);
         bio_put(bio);
 }
 
 /**
- * blkdev_issue_zeroout generate number of zero filed write bios
+ * blkdev_issue_zeroout - generate number of zero filed write bios
  * @bdev:       blockdev to issue
  * @sector:     start sector
  * @nr_sects:   number of sectors to write
@@ -150,13 +146,12 @@ int blkdev_issue_zeroout(struct block_device *bdev, sector_t sector,
         int ret;
         struct bio *bio;
         struct bio_batch bb;
-        unsigned int sz, issued = 0;
+        unsigned int sz;
         DECLARE_COMPLETION_ONSTACK(wait);
 
-        atomic_set(&bb.done, 0);
+        atomic_set(&bb.done, 1);
         bb.flags = 1 << BIO_UPTODATE;
         bb.wait = &wait;
-        bb.end_io = NULL;
 
 submit:
         ret = 0;
@@ -185,12 +180,12 @@ submit:
                                 break;
                 }
                 ret = 0;
-                issued++;
+                atomic_inc(&bb.done);
                 submit_bio(WRITE, bio);
         }
 
         /* Wait for bios in-flight */
-        while (issued != atomic_read(&bb.done))
+        if (!atomic_dec_and_test(&bb.done))
                 wait_for_completion(&wait);
 
         if (!test_bit(BIO_UPTODATE, &bb.flags))
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index a89043a3caa4..e36cc10a346c 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -20,6 +20,11 @@ static int throtl_quantum = 32;
 /* Throttling is performed over 100ms slice and after that slice is renewed */
 static unsigned long throtl_slice = HZ/10;      /* 100 ms */
 
+/* A workqueue to queue throttle related work */
+static struct workqueue_struct *kthrotld_workqueue;
+static void throtl_schedule_delayed_work(struct throtl_data *td,
+                                unsigned long delay);
+
 struct throtl_rb_root {
         struct rb_root rb;
         struct rb_node *left;
@@ -345,10 +350,9 @@ static void throtl_schedule_next_dispatch(struct throtl_data *td)
         update_min_dispatch_time(st);
 
         if (time_before_eq(st->min_disptime, jiffies))
-                throtl_schedule_delayed_work(td->queue, 0);
+                throtl_schedule_delayed_work(td, 0);
         else
-                throtl_schedule_delayed_work(td->queue,
-                                (st->min_disptime - jiffies));
+                throtl_schedule_delayed_work(td, (st->min_disptime - jiffies));
 }
 
 static inline void
@@ -815,10 +819,10 @@ void blk_throtl_work(struct work_struct *work)
 }
 
 /* Call with queue lock held */
-void throtl_schedule_delayed_work(struct request_queue *q, unsigned long delay)
+static void
+throtl_schedule_delayed_work(struct throtl_data *td, unsigned long delay)
 {
 
-        struct throtl_data *td = q->td;
         struct delayed_work *dwork = &td->throtl_work;
 
         if (total_nr_queued(td) > 0) {
@@ -827,12 +831,11 @@ void throtl_schedule_delayed_work(struct request_queue *q, unsigned long delay)
                  * Cancel that and schedule a new one.
                  */
                 __cancel_delayed_work(dwork);
-                kblockd_schedule_delayed_work(q, dwork, delay);
+                queue_delayed_work(kthrotld_workqueue, dwork, delay);
                 throtl_log(td, "schedule work. delay=%lu jiffies=%lu",
                                 delay, jiffies);
         }
 }
-EXPORT_SYMBOL(throtl_schedule_delayed_work);
 
 static void
 throtl_destroy_tg(struct throtl_data *td, struct throtl_grp *tg)
@@ -920,7 +923,7 @@ static void throtl_update_blkio_group_read_bps(void *key,
         smp_mb__after_atomic_inc();
 
         /* Schedule a work now to process the limit change */
-        throtl_schedule_delayed_work(td->queue, 0);
+        throtl_schedule_delayed_work(td, 0);
 }
 
 static void throtl_update_blkio_group_write_bps(void *key,
@@ -934,7 +937,7 @@ static void throtl_update_blkio_group_write_bps(void *key,
         smp_mb__before_atomic_inc();
         atomic_inc(&td->limits_changed);
         smp_mb__after_atomic_inc();
-        throtl_schedule_delayed_work(td->queue, 0);
+        throtl_schedule_delayed_work(td, 0);
 }
 
 static void throtl_update_blkio_group_read_iops(void *key,
@@ -948,7 +951,7 @@ static void throtl_update_blkio_group_read_iops(void *key,
         smp_mb__before_atomic_inc();
         atomic_inc(&td->limits_changed);
         smp_mb__after_atomic_inc();
-        throtl_schedule_delayed_work(td->queue, 0);
+        throtl_schedule_delayed_work(td, 0);
 }
 
 static void throtl_update_blkio_group_write_iops(void *key,
@@ -962,7 +965,7 @@ static void throtl_update_blkio_group_write_iops(void *key,
         smp_mb__before_atomic_inc();
         atomic_inc(&td->limits_changed);
         smp_mb__after_atomic_inc();
-        throtl_schedule_delayed_work(td->queue, 0);
+        throtl_schedule_delayed_work(td, 0);
 }
 
 void throtl_shutdown_timer_wq(struct request_queue *q)
@@ -1135,6 +1138,10 @@ void blk_throtl_exit(struct request_queue *q)
 
 static int __init throtl_init(void)
 {
+        kthrotld_workqueue = alloc_workqueue("kthrotld", WQ_MEM_RECLAIM, 0);
+        if (!kthrotld_workqueue)
+                panic("Failed to create kthrotld\n");
+
         blkio_policy_register(&blkio_policy_throtl);
         return 0;
 }
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 7be4c7959625..ea83a4f0c27d 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -3355,7 +3355,7 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
                             cfqd->busy_queues > 1) {
                                 cfq_del_timer(cfqd, cfqq);
                                 cfq_clear_cfqq_wait_request(cfqq);
-                                __blk_run_queue(cfqd->queue);
+                                __blk_run_queue(cfqd->queue, false);
                         } else {
                                 cfq_blkiocg_update_idle_time_stats(
                                                 &cfqq->cfqg->blkg);
@@ -3370,7 +3370,7 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
                  * this new queue is RT and the current one is BE
                  */
                 cfq_preempt_queue(cfqd, cfqq);
-                __blk_run_queue(cfqd->queue);
+                __blk_run_queue(cfqd->queue, false);
         }
 }
 
@@ -3731,7 +3731,7 @@ static void cfq_kick_queue(struct work_struct *work)
         struct request_queue *q = cfqd->queue;
 
         spin_lock_irq(q->queue_lock);
-        __blk_run_queue(cfqd->queue);
+        __blk_run_queue(cfqd->queue, false);
         spin_unlock_irq(q->queue_lock);
 }
 
diff --git a/block/elevator.c b/block/elevator.c
index 2569512830d3..236e93c1f46c 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -602,7 +602,7 @@ void elv_quiesce_start(struct request_queue *q)
          */
         elv_drain_elevator(q);
         while (q->rq.elvpriv) {
-                __blk_run_queue(q);
+                __blk_run_queue(q, false);
                 spin_unlock_irq(q->queue_lock);
                 msleep(10);
                 spin_lock_irq(q->queue_lock);
@@ -651,7 +651,7 @@ void elv_insert(struct request_queue *q, struct request *rq, int where)
                  *   with anything.  There's no point in delaying queue
                  *   processing.
                  */
-                __blk_run_queue(q);
+                __blk_run_queue(q, false);
                 break;
 
         case ELEVATOR_INSERT_SORT:
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 49e6a545eb63..dbf31ec9114d 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -78,7 +78,6 @@
 
 #include <asm/uaccess.h>
 
-static DEFINE_MUTEX(loop_mutex);
 static LIST_HEAD(loop_devices);
 static DEFINE_MUTEX(loop_devices_mutex);
 
@@ -1501,11 +1500,9 @@ static int lo_open(struct block_device *bdev, fmode_t mode)
 {
         struct loop_device *lo = bdev->bd_disk->private_data;
 
-        mutex_lock(&loop_mutex);
         mutex_lock(&lo->lo_ctl_mutex);
         lo->lo_refcnt++;
         mutex_unlock(&lo->lo_ctl_mutex);
-        mutex_unlock(&loop_mutex);
 
         return 0;
 }
@@ -1515,7 +1512,6 @@ static int lo_release(struct gendisk *disk, fmode_t mode)
         struct loop_device *lo = disk->private_data;
         int err;
 
-        mutex_lock(&loop_mutex);
         mutex_lock(&lo->lo_ctl_mutex);
 
         if (--lo->lo_refcnt)
@@ -1540,7 +1536,6 @@ static int lo_release(struct gendisk *disk, fmode_t mode)
 out:
         mutex_unlock(&lo->lo_ctl_mutex);
 out_unlocked:
-        mutex_unlock(&loop_mutex);
         return 0;
 }
 
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 7855f9f45b8e..62787e30d508 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -900,6 +900,14 @@ static void sender(void                *send_info,
         printk("**Enqueue: %d.%9.9d\n", t.tv_sec, t.tv_usec);
 #endif
 
+        /*
+         * last_timeout_jiffies is updated here to avoid
+         * smi_timeout() handler passing very large time_diff
+         * value to smi_event_handler() that causes
+         * the send command to abort.
+         */
+        smi_info->last_timeout_jiffies = jiffies;
+
         mod_timer(&smi_info->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
 
         if (smi_info->thread)
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 490393186338..84b164d1eb2b 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -388,6 +388,10 @@ static void discard_port_data(struct port *port)
         unsigned int len;
         int ret;
 
+        if (!port->portdev) {
+                /* Device has been unplugged.  vqs are already gone. */
+                return;
+        }
         vq = port->in_vq;
         if (port->inbuf)
                 buf = port->inbuf;
@@ -470,6 +474,10 @@ static void reclaim_consumed_buffers(struct port *port)
         void *buf;
         unsigned int len;
 
+        if (!port->portdev) {
+                /* Device has been unplugged.  vqs are already gone. */
+                return;
+        }
         while ((buf = virtqueue_get_buf(port->out_vq, &len))) {
                 kfree(buf);
                 port->outvq_full = false;
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 1109f6848a43..5cb4d09919d6 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1919,8 +1919,10 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
 
         ret = sysdev_driver_register(&cpu_sysdev_class,
                                         &cpufreq_sysdev_driver);
+        if (ret)
+                goto err_null_driver;
 
-        if ((!ret) && !(cpufreq_driver->flags & CPUFREQ_STICKY)) {
+        if (!(cpufreq_driver->flags & CPUFREQ_STICKY)) {
                 int i;
                 ret = -ENODEV;
 
@@ -1935,21 +1937,22 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
                 if (ret) {
                         dprintk("no CPU initialized for driver %s\n",
                                                         driver_data->name);
-                        sysdev_driver_unregister(&cpu_sysdev_class,
-                                                &cpufreq_sysdev_driver);
-
-                        spin_lock_irqsave(&cpufreq_driver_lock, flags);
-                        cpufreq_driver = NULL;
-                        spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
+                        goto err_sysdev_unreg;
                 }
         }
 
-        if (!ret) {
-                register_hotcpu_notifier(&cpufreq_cpu_notifier);
-                dprintk("driver %s up and running\n", driver_data->name);
-                cpufreq_debug_enable_ratelimit();
-        }
+        register_hotcpu_notifier(&cpufreq_cpu_notifier);
+        dprintk("driver %s up and running\n", driver_data->name);
+        cpufreq_debug_enable_ratelimit();
 
+        return 0;
+err_sysdev_unreg:
+        sysdev_driver_unregister(&cpu_sysdev_class,
+                        &cpufreq_sysdev_driver);
+err_null_driver:
+        spin_lock_irqsave(&cpufreq_driver_lock, flags);
+        cpufreq_driver = NULL;
+        spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
         return ret;
 }
 EXPORT_SYMBOL_GPL(cpufreq_register_driver);
diff --git a/drivers/gpio/ml_ioh_gpio.c b/drivers/gpio/ml_ioh_gpio.c
index cead8e6ff345..7f6f01a4b145 100644
--- a/drivers/gpio/ml_ioh_gpio.c
+++ b/drivers/gpio/ml_ioh_gpio.c
@@ -326,6 +326,7 @@ static DEFINE_PCI_DEVICE_TABLE(ioh_gpio_pcidev_id) = {
         { PCI_DEVICE(PCI_VENDOR_ID_ROHM, 0x802E) },
         { 0, }
 };
+MODULE_DEVICE_TABLE(pci, ioh_gpio_pcidev_id);
 
 static struct pci_driver ioh_gpio_driver = {
         .name = "ml_ioh_gpio",
diff --git a/drivers/gpio/pch_gpio.c b/drivers/gpio/pch_gpio.c
index 0eba0a75c804..2c6af8705103 100644
--- a/drivers/gpio/pch_gpio.c
+++ b/drivers/gpio/pch_gpio.c
@@ -286,6 +286,7 @@ static DEFINE_PCI_DEVICE_TABLE(pch_gpio_pcidev_id) = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x8803) },
         { 0, }
 };
+MODULE_DEVICE_TABLE(pci, pch_gpio_pcidev_id);
 
 static struct pci_driver pch_gpio_driver = {
         .name = "pch_gpio",
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 6977a1ce9d98..f73ef4390db6 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -672,7 +672,7 @@ int drm_fb_helper_setcmap(struct fb_cmap *cmap, struct fb_info *info)
         struct drm_crtc_helper_funcs *crtc_funcs;
         u16 *red, *green, *blue, *transp;
         struct drm_crtc *crtc;
-        int i, rc = 0;
+        int i, j, rc = 0;
         int start;
 
         for (i = 0; i < fb_helper->crtc_count; i++) {
@@ -685,7 +685,7 @@ int drm_fb_helper_setcmap(struct fb_cmap *cmap, struct fb_info *info)
                 transp = cmap->transp;
                 start = cmap->start;
 
-                for (i = 0; i < cmap->len; i++) {
+                for (j = 0; j < cmap->len; j++) {
                         u16 hred, hgreen, hblue, htransp = 0xffff;
 
                         hred = *red++;
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 3601466c5502..4ff9b6cc973f 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -865,7 +865,7 @@ static int i915_cur_delayinfo(struct seq_file *m, void *unused)
                 int max_freq;
 
                 /* RPSTAT1 is in the GT power well */
-                __gen6_force_wake_get(dev_priv);
+                __gen6_gt_force_wake_get(dev_priv);
 
                 seq_printf(m, "GT_PERF_STATUS: 0x%08x\n", gt_perf_status);
                 seq_printf(m, "RPSTAT1: 0x%08x\n", I915_READ(GEN6_RPSTAT1));
@@ -888,7 +888,7 @@ static int i915_cur_delayinfo(struct seq_file *m, void *unused)
                 seq_printf(m, "Max non-overclocked (RP0) frequency: %dMHz\n",
                            max_freq * 100);
 
-                __gen6_force_wake_put(dev_priv);
+                __gen6_gt_force_wake_put(dev_priv);
         } else {
                 seq_printf(m, "no P-state info available\n");
         }
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 17bd766f2081..e33d9be7df3b 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1895,6 +1895,17 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         if (IS_GEN2(dev))
                 dma_set_coherent_mask(&dev->pdev->dev, DMA_BIT_MASK(30));
 
+        /* 965GM sometimes incorrectly writes to hardware status page (HWS)
+         * using 32bit addressing, overwriting memory if HWS is located
+         * above 4GB.
+         *
+         * The documentation also mentions an issue with undefined
+         * behaviour if any general state is accessed within a page above 4GB,
+         * which also needs to be handled carefully.
+         */
+        if (IS_BROADWATER(dev) || IS_CRESTLINE(dev))
+                dma_set_coherent_mask(&dev->pdev->dev, DMA_BIT_MASK(32));
+
         mmio_bar = IS_GEN2(dev) ? 1 : 0;
         dev_priv->regs = pci_iomap(dev->pdev, mmio_bar, 0);
         if (!dev_priv->regs) {
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 0ad533f06af9..22ec066adae6 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -46,6 +46,9 @@ module_param_named(fbpercrtc, i915_fbpercrtc, int, 0400);
 unsigned int i915_powersave = 1;
 module_param_named(powersave, i915_powersave, int, 0600);
 
+unsigned int i915_semaphores = 0;
+module_param_named(semaphores, i915_semaphores, int, 0600);
+
 unsigned int i915_enable_rc6 = 0;
 module_param_named(i915_enable_rc6, i915_enable_rc6, int, 0600);
 
@@ -254,7 +257,7 @@ void intel_detect_pch (struct drm_device *dev)
         }
 }
 
-void __gen6_force_wake_get(struct drm_i915_private *dev_priv)
+void __gen6_gt_force_wake_get(struct drm_i915_private *dev_priv)
 {
         int count;
 
@@ -270,12 +273,22 @@ void __gen6_force_wake_get(struct drm_i915_private *dev_priv)
                 udelay(10);
 }
 
-void __gen6_force_wake_put(struct drm_i915_private *dev_priv)
+void __gen6_gt_force_wake_put(struct drm_i915_private *dev_priv)
 {
         I915_WRITE_NOTRACE(FORCEWAKE, 0);
         POSTING_READ(FORCEWAKE);
 }
 
+void __gen6_gt_wait_for_fifo(struct drm_i915_private *dev_priv)
+{
+        int loop = 500;
+        u32 fifo = I915_READ_NOTRACE(GT_FIFO_FREE_ENTRIES);
+        while (fifo < 20 && loop--) {
+                udelay(10);
+                fifo = I915_READ_NOTRACE(GT_FIFO_FREE_ENTRIES);
+        }
+}
+
 static int i915_drm_freeze(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 65dfe81d0035..456f40484838 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -956,6 +956,7 @@ extern struct drm_ioctl_desc i915_ioctls[];
 extern int i915_max_ioctl;
 extern unsigned int i915_fbpercrtc;
 extern unsigned int i915_powersave;
+extern unsigned int i915_semaphores;
 extern unsigned int i915_lvds_downclock;
 extern unsigned int i915_panel_use_ssc;
 extern unsigned int i915_enable_rc6;
@@ -1177,6 +1178,9 @@ void i915_gem_detach_phys_object(struct drm_device *dev,
 void i915_gem_free_all_phys_object(struct drm_device *dev);
 void i915_gem_release(struct drm_device *dev, struct drm_file *file);
 
+uint32_t
+i915_gem_get_unfenced_gtt_alignment(struct drm_i915_gem_object *obj);
+
 /* i915_gem_gtt.c */
 void i915_gem_restore_gtt_mappings(struct drm_device *dev);
 int __must_check i915_gem_gtt_bind_object(struct drm_i915_gem_object *obj);
@@ -1353,22 +1357,32 @@ __i915_write(64, q)
  * must be set to prevent GT core from power down and stale values being
  * returned.
  */
-void __gen6_force_wake_get(struct drm_i915_private *dev_priv);
-void __gen6_force_wake_put (struct drm_i915_private *dev_priv);
-static inline u32 i915_safe_read(struct drm_i915_private *dev_priv, u32 reg)
+void __gen6_gt_force_wake_get(struct drm_i915_private *dev_priv);
+void __gen6_gt_force_wake_put(struct drm_i915_private *dev_priv);
+void __gen6_gt_wait_for_fifo(struct drm_i915_private *dev_priv);
+
+static inline u32 i915_gt_read(struct drm_i915_private *dev_priv, u32 reg)
 {
         u32 val;
 
         if (dev_priv->info->gen >= 6) {
-                __gen6_force_wake_get(dev_priv);
+                __gen6_gt_force_wake_get(dev_priv);
                 val = I915_READ(reg);
-                __gen6_force_wake_put(dev_priv);
+                __gen6_gt_force_wake_put(dev_priv);
         } else
                 val = I915_READ(reg);
 
         return val;
 }
 
+static inline void i915_gt_write(struct drm_i915_private *dev_priv,
+                                u32 reg, u32 val)
+{
+        if (dev_priv->info->gen >= 6)
+                __gen6_gt_wait_for_fifo(dev_priv);
+        I915_WRITE(reg, val);
+}
+
 static inline void
 i915_write(struct drm_i915_private *dev_priv, u32 reg, u64 val, int len)
 {
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index cf4f74c7c6fb..36e66cc5225e 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1398,7 +1398,7 @@ i915_gem_get_gtt_alignment(struct drm_i915_gem_object *obj)
  * Return the required GTT alignment for an object, only taking into account
  * unfenced tiled surface requirements.
  */
-static uint32_t
+uint32_t
 i915_gem_get_unfenced_gtt_alignment(struct drm_i915_gem_object *obj)
 {
         struct drm_device *dev = obj->base.dev;
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index d2f445e825f2..50ab1614571c 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -772,8 +772,8 @@ i915_gem_execbuffer_sync_rings(struct drm_i915_gem_object *obj,
         if (from == NULL || to == from)
                 return 0;
 
-        /* XXX gpu semaphores are currently causing hard hangs on SNB mobile */
-        if (INTEL_INFO(obj->base.dev)->gen < 6 || IS_MOBILE(obj->base.dev))
+        /* XXX gpu semaphores are implicated in various hard hangs on SNB */
+        if (INTEL_INFO(obj->base.dev)->gen < 6 || !i915_semaphores)
                 return i915_gem_object_wait_rendering(obj, true);
 
         idx = intel_ring_sync_index(from, to);
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 79a04fde69b5..d64843e18df2 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -184,7 +184,7 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
 static bool
 i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
 {
-        int tile_width, tile_height;
+        int tile_width;
 
         /* Linear is always fine */
         if (tiling_mode == I915_TILING_NONE)
@@ -215,20 +215,6 @@ i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
                 }
         }
 
-        if (IS_GEN2(dev) ||
-            (tiling_mode == I915_TILING_Y && HAS_128_BYTE_Y_TILING(dev)))
-                tile_height = 32;
-        else
-                tile_height = 8;
-        /* i8xx is strange: It has 2 interleaved rows of tiles, so needs an even
-         * number of tile rows. */
-        if (IS_GEN2(dev))
-                tile_height *= 2;
-
-        /* Size needs to be aligned to a full tile row */
-        if (size & (tile_height * stride - 1))
-                return false;
-
         /* 965+ just needs multiples of tile width */
         if (INTEL_INFO(dev)->gen >= 4) {
                 if (stride & (tile_width - 1))
@@ -363,14 +349,27 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                         (obj->gtt_offset + obj->base.size <= dev_priv->mm.gtt_mappable_end &&
                          i915_gem_object_fence_ok(obj, args->tiling_mode));
 
-                obj->tiling_changed = true;
-                obj->tiling_mode = args->tiling_mode;
-                obj->stride = args->stride;
+                /* Rebind if we need a change of alignment */
+                if (!obj->map_and_fenceable) {
+                        u32 unfenced_alignment =
+                                i915_gem_get_unfenced_gtt_alignment(obj);
+                        if (obj->gtt_offset & (unfenced_alignment - 1))
+                                ret = i915_gem_object_unbind(obj);
+                }
+
+                if (ret == 0) {
+                        obj->tiling_changed = true;
+                        obj->tiling_mode = args->tiling_mode;
+                        obj->stride = args->stride;
+                }
         }
+        /* we have to maintain this existing ABI... */
+        args->stride = obj->stride;
+        args->tiling_mode = obj->tiling_mode;
         drm_gem_object_unreference(&obj->base);
         mutex_unlock(&dev->struct_mutex);
 
-        return 0;
+        return ret;
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 729d4233b763..2abe240dae58 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -1553,7 +1553,17 @@
 
 /* Backlight control */
 #define BLC_PWM_CTL             0x61254
+#define   BACKLIGHT_MODULATION_FREQ_SHIFT               (17)
 #define BLC_PWM_CTL2            0x61250 /* 965+ only */
+#define   BLM_COMBINATION_MODE (1 << 30)
+/*
+ * This is the most significant 15 bits of the number of backlight cycles in a
+ * complete cycle of the modulated backlight control.
+ *
+ * The actual value is this field multiplied by two.
+ */
+#define   BACKLIGHT_MODULATION_FREQ_MASK                (0x7fff << 17)
+#define   BLM_LEGACY_MODE                               (1 << 16)
 /*
  * This is the number of cycles out of the backlight modulation cycle for which
  * the backlight is on.
@@ -3261,6 +3271,8 @@
 #define  FORCEWAKE                              0xA18C
 #define  FORCEWAKE_ACK                          0x130090
 
+#define  GT_FIFO_FREE_ENTRIES                   0x120008
+
 #define GEN6_RPNSWREQ                           0xA008
 #define   GEN6_TURBO_DISABLE                    (1<<31)
 #define   GEN6_FREQUENCY(x)                     ((x)<<25)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e79b25bbee6c..49fb54fd9a18 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1219,7 +1219,7 @@ static void sandybridge_blit_fbc_update(struct drm_device *dev)
         u32 blt_ecoskpd;
 
         /* Make sure blitter notifies FBC of writes */
-        __gen6_force_wake_get(dev_priv);
+        __gen6_gt_force_wake_get(dev_priv);
         blt_ecoskpd = I915_READ(GEN6_BLITTER_ECOSKPD);
         blt_ecoskpd |= GEN6_BLITTER_FBC_NOTIFY <<
                 GEN6_BLITTER_LOCK_SHIFT;
@@ -1230,7 +1230,7 @@ static void sandybridge_blit_fbc_update(struct drm_device *dev)
                          GEN6_BLITTER_LOCK_SHIFT);
         I915_WRITE(GEN6_BLITTER_ECOSKPD, blt_ecoskpd);
         POSTING_READ(GEN6_BLITTER_ECOSKPD);
-        __gen6_force_wake_put(dev_priv);
+        __gen6_gt_force_wake_put(dev_priv);
 }
 
 static void ironlake_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
@@ -6282,7 +6282,7 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
          * userspace...
          */
         I915_WRITE(GEN6_RC_STATE, 0);
-        __gen6_force_wake_get(dev_priv);
+        __gen6_gt_force_wake_get(dev_priv);
 
         /* disable the counters and set deterministic thresholds */
         I915_WRITE(GEN6_RC_CONTROL, 0);
@@ -6380,7 +6380,7 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
         /* enable all PM interrupts */
         I915_WRITE(GEN6_PMINTRMSK, 0);
 
-        __gen6_force_wake_put(dev_priv);
+        __gen6_gt_force_wake_put(dev_priv);
 }
 
 void intel_enable_clock_gating(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index d860abeda70f..f8f86e57df22 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -30,6 +30,8 @@
 
 #include "intel_drv.h"
 
+#define PCI_LBPC 0xf4 /* legacy/combination backlight modes */
+
 void
 intel_fixed_panel_mode(struct drm_display_mode *fixed_mode,
                        struct drm_display_mode *adjusted_mode)
@@ -110,6 +112,19 @@ done:
         dev_priv->pch_pf_size = (width << 16) | height;
 }
 
+static int is_backlight_combination_mode(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        if (INTEL_INFO(dev)->gen >= 4)
+                return I915_READ(BLC_PWM_CTL2) & BLM_COMBINATION_MODE;
+
+        if (IS_GEN2(dev))
+                return I915_READ(BLC_PWM_CTL) & BLM_LEGACY_MODE;
+
+        return 0;
+}
+
 static u32 i915_read_blc_pwm_ctl(struct drm_i915_private *dev_priv)
 {
         u32 val;
@@ -166,6 +181,9 @@ u32 intel_panel_get_max_backlight(struct drm_device *dev)
                         if (INTEL_INFO(dev)->gen < 4)
                                 max &= ~1;
                 }
+
+                if (is_backlight_combination_mode(dev))
+                        max *= 0xff;
         }
 
         DRM_DEBUG_DRIVER("max backlight PWM = %d\n", max);
@@ -183,6 +201,14 @@ u32 intel_panel_get_backlight(struct drm_device *dev)
                 val = I915_READ(BLC_PWM_CTL) & BACKLIGHT_DUTY_CYCLE_MASK;
                 if (IS_PINEVIEW(dev))
                         val >>= 1;
+
+                if (is_backlight_combination_mode(dev)){
+                        u8 lbpc;
+
+                        val &= ~1;
+                        pci_read_config_byte(dev->pdev, PCI_LBPC, &lbpc);
+                        val *= lbpc;
+                }
         }
 
         DRM_DEBUG_DRIVER("get backlight PWM = %d\n", val);
@@ -205,6 +231,16 @@ void intel_panel_set_backlight(struct drm_device *dev, u32 level)
 
         if (HAS_PCH_SPLIT(dev))
                 return intel_pch_panel_set_backlight(dev, level);
+
+        if (is_backlight_combination_mode(dev)){
+                u32 max = intel_panel_get_max_backlight(dev);
+                u8 lbpc;
+
+                lbpc = level * 0xfe / max + 1;
+                level /= lbpc;
+                pci_write_config_byte(dev->pdev, PCI_LBPC, lbpc);
+        }
+
         tmp = I915_READ(BLC_PWM_CTL);
         if (IS_PINEVIEW(dev)) {
                 tmp &= ~(BACKLIGHT_DUTY_CYCLE_MASK - 1);
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 6d6fde85a636..34306865a5df 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -14,22 +14,23 @@ struct  intel_hw_status_page {
         struct          drm_i915_gem_object *obj;
 };
 
-#define I915_RING_READ(reg) i915_safe_read(dev_priv, reg)
+#define I915_RING_READ(reg) i915_gt_read(dev_priv, reg)
+#define I915_RING_WRITE(reg, val) i915_gt_write(dev_priv, reg, val)
 
 #define I915_READ_TAIL(ring) I915_RING_READ(RING_TAIL((ring)->mmio_base))
-#define I915_WRITE_TAIL(ring, val) I915_WRITE(RING_TAIL((ring)->mmio_base), val)
+#define I915_WRITE_TAIL(ring, val) I915_RING_WRITE(RING_TAIL((ring)->mmio_base), val)
 
 #define I915_READ_START(ring) I915_RING_READ(RING_START((ring)->mmio_base))
-#define I915_WRITE_START(ring, val) I915_WRITE(RING_START((ring)->mmio_base), val)
+#define I915_WRITE_START(ring, val) I915_RING_WRITE(RING_START((ring)->mmio_base), val)
 
 #define I915_READ_HEAD(ring)  I915_RING_READ(RING_HEAD((ring)->mmio_base))
-#define I915_WRITE_HEAD(ring, val) I915_WRITE(RING_HEAD((ring)->mmio_base), val)
+#define I915_WRITE_HEAD(ring, val) I915_RING_WRITE(RING_HEAD((ring)->mmio_base), val)
 
 #define I915_READ_CTL(ring) I915_RING_READ(RING_CTL((ring)->mmio_base))
-#define I915_WRITE_CTL(ring, val) I915_WRITE(RING_CTL((ring)->mmio_base), val)
+#define I915_WRITE_CTL(ring, val) I915_RING_WRITE(RING_CTL((ring)->mmio_base), val)
 
-#define I915_WRITE_IMR(ring, val) I915_WRITE(RING_IMR((ring)->mmio_base), val)
 #define I915_READ_IMR(ring) I915_RING_READ(RING_IMR((ring)->mmio_base))
+#define I915_WRITE_IMR(ring, val) I915_RING_WRITE(RING_IMR((ring)->mmio_base), val)
 
 #define I915_READ_NOPID(ring) I915_RING_READ(RING_NOPID((ring)->mmio_base))
 #define I915_READ_SYNC_0(ring) I915_RING_READ(RING_SYNC_0((ring)->mmio_base))
diff --git a/drivers/gpu/drm/nouveau/nouveau_dma.c b/drivers/gpu/drm/nouveau/nouveau_dma.c
index 65699bfaaaea..b368ed74aad7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dma.c
@@ -83,7 +83,8 @@ nouveau_dma_init(struct nouveau_channel *chan)
                 return ret;
 
         /* NV_MEMORY_TO_MEMORY_FORMAT requires a notifier object */
-        ret = nouveau_notifier_alloc(chan, NvNotify0, 32, &chan->m2mf_ntfy);
+        ret = nouveau_notifier_alloc(chan, NvNotify0, 32, 0xfd0, 0x1000,
+                                     &chan->m2mf_ntfy);
         if (ret)
                 return ret;
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 9821fcacc3d2..982d70b12722 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -852,7 +852,8 @@ extern const struct ttm_mem_type_manager_func nouveau_vram_manager;
 extern int  nouveau_notifier_init_channel(struct nouveau_channel *);
 extern void nouveau_notifier_takedown_channel(struct nouveau_channel *);
 extern int  nouveau_notifier_alloc(struct nouveau_channel *, uint32_t handle,
-                                   int cout, uint32_t *offset);
+                                   int cout, uint32_t start, uint32_t end,
+                                   uint32_t *offset);
 extern int  nouveau_notifier_offset(struct nouveau_gpuobj *, uint32_t *);
 extern int  nouveau_ioctl_notifier_alloc(struct drm_device *, void *data,
                                          struct drm_file *);
diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 26347b7cd872..b0fb9bdcddb7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -725,8 +725,10 @@ nouveau_vram_manager_new(struct ttm_mem_type_manager *man,
         ret = vram->get(dev, mem->num_pages << PAGE_SHIFT,
                         mem->page_alignment << PAGE_SHIFT, size_nc,
                         (nvbo->tile_flags >> 8) & 0xff, &node);
-        if (ret)
-                return ret;
+        if (ret) {
+                mem->mm_node = NULL;
+                return (ret == -ENOSPC) ? 0 : ret;
+        }
 
         node->page_shift = 12;
         if (nvbo->vma.node)
diff --git a/drivers/gpu/drm/nouveau/nouveau_mm.c b/drivers/gpu/drm/nouveau/nouveau_mm.c
index 8844b50c3e54..7609756b6faf 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mm.c
@@ -123,7 +123,7 @@ nouveau_mm_get(struct nouveau_mm *rmm, int type, u32 size, u32 size_nc,
                 return 0;
         }
 
-        return -ENOMEM;
+        return -ENOSPC;
 }
 
 int
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index fe29d604b820..5ea167623a82 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -96,7 +96,8 @@ nouveau_notifier_gpuobj_dtor(struct drm_device *dev,
 
 int
 nouveau_notifier_alloc(struct nouveau_channel *chan, uint32_t handle,
-                       int size, uint32_t *b_offset)
+                       int size, uint32_t start, uint32_t end,
+                       uint32_t *b_offset)
 {
         struct drm_device *dev = chan->dev;
         struct nouveau_gpuobj *nobj = NULL;
@@ -104,9 +105,10 @@ nouveau_notifier_alloc(struct nouveau_channel *chan, uint32_t handle,
         uint32_t offset;
         int target, ret;
 
-        mem = drm_mm_search_free(&chan->notifier_heap, size, 0, 0);
+        mem = drm_mm_search_free_in_range(&chan->notifier_heap, size, 0,
+                                          start, end, 0);
         if (mem)
-                mem = drm_mm_get_block(mem, size, 0);
+                mem = drm_mm_get_block_range(mem, size, 0, start, end);
         if (!mem) {
                 NV_ERROR(dev, "Channel %d notifier block full\n", chan->id);
                 return -ENOMEM;
@@ -177,7 +179,8 @@ nouveau_ioctl_notifier_alloc(struct drm_device *dev, void *data,
         if (IS_ERR(chan))
                 return PTR_ERR(chan);
 
-        ret = nouveau_notifier_alloc(chan, na->handle, na->size, &na->offset);
+        ret = nouveau_notifier_alloc(chan, na->handle, na->size, 0, 0x1000,
+                                     &na->offset);
         nouveau_channel_put(&chan);
         return ret;
 }
diff --git a/drivers/gpu/drm/nouveau/nv50_instmem.c b/drivers/gpu/drm/nouveau/nv50_instmem.c
index ea0041810ae3..e57caa2a00e3 100644
--- a/drivers/gpu/drm/nouveau/nv50_instmem.c
+++ b/drivers/gpu/drm/nouveau/nv50_instmem.c
@@ -403,16 +403,24 @@ nv50_instmem_unmap(struct nouveau_gpuobj *gpuobj)
 void
 nv50_instmem_flush(struct drm_device *dev)
 {
+        struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+        spin_lock(&dev_priv->ramin_lock);
         nv_wr32(dev, 0x00330c, 0x00000001);
         if (!nv_wait(dev, 0x00330c, 0x00000002, 0x00000000))
                 NV_ERROR(dev, "PRAMIN flush timeout\n");
+        spin_unlock(&dev_priv->ramin_lock);
 }
 
 void
 nv84_instmem_flush(struct drm_device *dev)
 {
+        struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+        spin_lock(&dev_priv->ramin_lock);
         nv_wr32(dev, 0x070000, 0x00000001);
         if (!nv_wait(dev, 0x070000, 0x00000002, 0x00000000))
                 NV_ERROR(dev, "PRAMIN flush timeout\n");
+        spin_unlock(&dev_priv->ramin_lock);
 }
 
diff --git a/drivers/gpu/drm/nouveau/nv50_vm.c b/drivers/gpu/drm/nouveau/nv50_vm.c
index 459ff08241e5..6144156f255a 100644
--- a/drivers/gpu/drm/nouveau/nv50_vm.c
+++ b/drivers/gpu/drm/nouveau/nv50_vm.c
@@ -169,7 +169,11 @@ nv50_vm_flush(struct nouveau_vm *vm)
 void
 nv50_vm_flush_engine(struct drm_device *dev, int engine)
 {
+        struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+        spin_lock(&dev_priv->ramin_lock);
         nv_wr32(dev, 0x100c80, (engine << 16) | 1);
         if (!nv_wait(dev, 0x100c80, 0x00000001, 0x00000000))
                 NV_ERROR(dev, "vm flush timeout: engine %d\n", engine);
+        spin_unlock(&dev_priv->ramin_lock);
 }
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index d270b3ff896b..6140ea1de45a 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2194,7 +2194,6 @@ int evergreen_mc_init(struct radeon_device *rdev)
                 rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
         }
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         r700_vram_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
 
@@ -2934,7 +2933,7 @@ static int evergreen_startup(struct radeon_device *rdev)
         /* XXX: ontario has problems blitting to gart at the moment */
         if (rdev->family == CHIP_PALM) {
                 rdev->asic->copy = NULL;
-                rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
+                radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
         }
 
         /* allocate wb buffer */
diff --git a/drivers/gpu/drm/radeon/evergreen_blit_kms.c b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
index 2adfb03f479b..2be698e78ff2 100644
--- a/drivers/gpu/drm/radeon/evergreen_blit_kms.c
+++ b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
@@ -623,7 +623,7 @@ done:
                 dev_err(rdev->dev, "(%d) pin blit object failed\n", r);
                 return r;
         }
-        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.real_vram_size);
         return 0;
 }
 
@@ -631,7 +631,7 @@ void evergreen_blit_fini(struct radeon_device *rdev)
 {
         int r;
 
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
         if (rdev->r600_blit.shader_obj == NULL)
                 return;
         /* If we can't reserve the bo, unref should be enough to destroy
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 93fa735c8c1a..e372f9e1e5ce 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -70,23 +70,6 @@ MODULE_FIRMWARE(FIRMWARE_R520);
 
 void r100_pre_page_flip(struct radeon_device *rdev, int crtc)
 {
-        struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc];
-        u32 tmp;
-
-        /* make sure flip is at vb rather than hb */
-        tmp = RREG32(RADEON_CRTC_OFFSET_CNTL + radeon_crtc->crtc_offset);
-        tmp &= ~RADEON_CRTC_OFFSET_FLIP_CNTL;
-        /* make sure pending bit is asserted */
-        tmp |= RADEON_CRTC_GUI_TRIG_OFFSET_LEFT_EN;
-        WREG32(RADEON_CRTC_OFFSET_CNTL + radeon_crtc->crtc_offset, tmp);
-
-        /* set pageflip to happen as late as possible in the vblank interval.
-         * same field for crtc1/2
-         */
-        tmp = RREG32(RADEON_CRTC_GEN_CNTL);
-        tmp &= ~RADEON_CRTC_VSTAT_MODE_MASK;
-        WREG32(RADEON_CRTC_GEN_CNTL, tmp);
-
         /* enable the pflip int */
         radeon_irq_kms_pflip_irq_get(rdev, crtc);
 }
@@ -1041,7 +1024,7 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
                 return r;
         }
         rdev->cp.ready = true;
-        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.real_vram_size);
         return 0;
 }
 
@@ -1059,7 +1042,7 @@ void r100_cp_fini(struct radeon_device *rdev)
 void r100_cp_disable(struct radeon_device *rdev)
 {
         /* Disable ring */
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
         rdev->cp.ready = false;
         WREG32(RADEON_CP_CSQ_MODE, 0);
         WREG32(RADEON_CP_CSQ_CNTL, 0);
@@ -2329,7 +2312,6 @@ void r100_vram_init_sizes(struct radeon_device *rdev)
         /* FIXME we don't use the second aperture yet when we could use it */
         if (rdev->mc.visible_vram_size > rdev->mc.aper_size)
                 rdev->mc.visible_vram_size = rdev->mc.aper_size;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         config_aper_size = RREG32(RADEON_CONFIG_APER_SIZE);
         if (rdev->flags & RADEON_IS_IGP) {
                 uint32_t tom;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index de88624d5f87..9b3fad23b76c 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1255,7 +1255,6 @@ int r600_mc_init(struct radeon_device *rdev)
         rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         r600_vram_gtt_location(rdev, &rdev->mc);
 
         if (rdev->flags & RADEON_IS_IGP) {
@@ -1937,7 +1936,7 @@ void r600_pciep_wreg(struct radeon_device *rdev, u32 reg, u32 v)
  */
 void r600_cp_stop(struct radeon_device *rdev)
 {
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
         WREG32(R_0086D8_CP_ME_CNTL, S_0086D8_CP_ME_HALT(1));
         WREG32(SCRATCH_UMSK, 0);
 }
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index 41f7aafc97c4..df68d91e8190 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -558,7 +558,7 @@ done:
                 dev_err(rdev->dev, "(%d) pin blit object failed\n", r);
                 return r;
         }
-        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.real_vram_size);
         return 0;
 }
 
@@ -566,7 +566,7 @@ void r600_blit_fini(struct radeon_device *rdev)
 {
         int r;
 
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
         if (rdev->r600_blit.shader_obj == NULL)
                 return;
         /* If we can't reserve the bo, unref should be enough to destroy
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 56c48b67ef3d..6b3429495118 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -345,7 +345,6 @@ struct radeon_mc {
          * about vram size near mc fb location */
         u64                     mc_vram_size;
         u64                     visible_vram_size;
-        u64                     active_vram_size;
         u64                     gtt_size;
         u64                     gtt_start;
         u64                     gtt_end;
@@ -1448,6 +1447,7 @@ extern void radeon_vram_location(struct radeon_device *rdev, struct radeon_mc *m
 extern void radeon_gtt_location(struct radeon_device *rdev, struct radeon_mc *mc);
 extern int radeon_resume_kms(struct drm_device *dev);
 extern int radeon_suspend_kms(struct drm_device *dev, pm_message_t state);
+extern void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size);
 
 /* r600, rv610, rv630, rv620, rv635, rv670, rs780, rs880 */
 extern bool r600_card_posted(struct radeon_device *rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index e75d63b8e21d..793c5e6026ad 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -834,6 +834,9 @@ static struct radeon_asic sumo_asic = {
         .pm_finish = &evergreen_pm_finish,
         .pm_init_profile = &rs780_pm_init_profile,
         .pm_get_dynpm_state = &r600_pm_get_dynpm_state,
+        .pre_page_flip = &evergreen_pre_page_flip,
+        .page_flip = &evergreen_page_flip,
+        .post_page_flip = &evergreen_post_page_flip,
 };
 
 static struct radeon_asic btc_asic = {
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index df95eb83dac6..1fe95dfe48c9 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -156,9 +156,12 @@ int radeon_gem_info_ioctl(struct drm_device *dev, void *data,
 {
         struct radeon_device *rdev = dev->dev_private;
         struct drm_radeon_gem_info *args = data;
+        struct ttm_mem_type_manager *man;
+
+        man = &rdev->mman.bdev.man[TTM_PL_VRAM];
 
         args->vram_size = rdev->mc.real_vram_size;
-        args->vram_visible = rdev->mc.real_vram_size;
+        args->vram_visible = (u64)man->size << PAGE_SHIFT;
         if (rdev->stollen_vga_memory)
                 args->vram_visible -= radeon_bo_size(rdev->stollen_vga_memory);
         args->vram_visible -= radeon_fbdev_total_size(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
index cf0638c3b7c7..78968b738e88 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
@@ -443,7 +443,7 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
                        (target_fb->bits_per_pixel * 8));
         crtc_pitch |= crtc_pitch << 16;
 
-
+        crtc_offset_cntl |= RADEON_CRTC_GUI_TRIG_OFFSET_LEFT_EN;
         if (tiling_flags & RADEON_TILING_MACRO) {
                 if (ASIC_IS_R300(rdev))
                         crtc_offset_cntl |= (R300_CRTC_X_Y_MODE_EN |
@@ -502,6 +502,7 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
         gen_cntl_val = RREG32(gen_cntl_reg);
         gen_cntl_val &= ~(0xf << 8);
         gen_cntl_val |= (format << 8);
+        gen_cntl_val &= ~RADEON_CRTC_VSTAT_MODE_MASK;
         WREG32(gen_cntl_reg, gen_cntl_val);
 
         crtc_offset = (u32)base;
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index e5b2cf10cbf4..8389b4c63d12 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -589,6 +589,20 @@ void radeon_ttm_fini(struct radeon_device *rdev)
         DRM_INFO("radeon: ttm finalized\n");
 }
 
+/* this should only be called at bootup or when userspace
+ * isn't running */
+void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size)
+{
+        struct ttm_mem_type_manager *man;
+
+        if (!rdev->mman.initialized)
+                return;
+
+        man = &rdev->mman.bdev.man[TTM_PL_VRAM];
+        /* this just adjusts TTM size idea, which sets lpfn to the correct value */
+        man->size = size >> PAGE_SHIFT;
+}
+
 static struct vm_operations_struct radeon_ttm_vm_ops;
 static const struct vm_operations_struct *ttm_vm_ops = NULL;
 
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 5afe294ed51f..8af4679db23e 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -751,7 +751,6 @@ void rs600_mc_init(struct radeon_device *rdev)
         rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
         rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
         base = RREG32_MC(R_000004_MC_FB_LOCATION);
         base = G_000004_MC_FB_START(base) << 16;
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 6638c8e4c81b..66c949b7c18c 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -157,7 +157,6 @@ void rs690_mc_init(struct radeon_device *rdev)
         rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
         rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         base = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
         base = G_000100_MC_FB_START(base) << 16;
         rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index d8ba67690656..714ad45757d0 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -307,7 +307,7 @@ static void rv770_mc_program(struct radeon_device *rdev)
  */
 void r700_cp_stop(struct radeon_device *rdev)
 {
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
         WREG32(CP_ME_CNTL, (CP_ME_HALT | CP_PFP_HALT));
         WREG32(SCRATCH_UMSK, 0);
 }
@@ -1123,7 +1123,6 @@ int rv770_mc_init(struct radeon_device *rdev)
         rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         r700_vram_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
 
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index 3f49dd376f02..6e06019015a5 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -37,7 +37,7 @@
 #define SIO_F71858FG_LD_HWM     0x02    /* Hardware monitor logical device */
 #define SIO_F71882FG_LD_HWM     0x04    /* Hardware monitor logical device */
 #define SIO_UNLOCK_KEY          0x87    /* Key to enable Super-I/O */
-#define SIO_LOCK_KEY            0xAA    /* Key to diasble Super-I/O */
+#define SIO_LOCK_KEY            0xAA    /* Key to disable Super-I/O */
 
 #define SIO_REG_LDSEL           0x07    /* Logical device select */
 #define SIO_REG_DEVID           0x20    /* Device ID (2 bytes) */
@@ -2111,7 +2111,6 @@ static int f71882fg_remove(struct platform_device *pdev)
         int nr_fans = (data->type == f71882fg) ? 4 : 3;
         u8 start_reg = f71882fg_read8(data, F71882FG_REG_START);
 
-        platform_set_drvdata(pdev, NULL);
         if (data->hwmon_dev)
                 hwmon_device_unregister(data->hwmon_dev);
 
@@ -2178,6 +2177,7 @@ static int f71882fg_remove(struct platform_device *pdev)
                 }
         }
 
+        platform_set_drvdata(pdev, NULL);
         kfree(data);
 
         return 0;
diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index 2e067dd2ee51..50ea1f43bdc1 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -29,6 +29,7 @@
 #include <linux/pci.h>
 #include <linux/mutex.h>
 #include <linux/ktime.h>
+#include <linux/slab.h>
 
 #define PCH_EVENT_SET   0       /* I2C Interrupt Event Set Status */
 #define PCH_EVENT_NONE  1       /* I2C Interrupt Event Clear Status */
diff --git a/drivers/i2c/busses/i2c-ocores.c b/drivers/i2c/busses/i2c-ocores.c
index ef3bcb1ce864..61653f079671 100644
--- a/drivers/i2c/busses/i2c-ocores.c
+++ b/drivers/i2c/busses/i2c-ocores.c
@@ -249,7 +249,7 @@ static struct i2c_adapter ocores_adapter = {
 static int ocores_i2c_of_probe(struct platform_device* pdev,
                                 struct ocores_i2c* i2c)
 {
-        __be32* val;
+        const __be32* val;
 
         val = of_get_property(pdev->dev.of_node, "regstep", NULL);
         if (!val) {
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 829a2a1029f7..58a58c7eaa17 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -378,9 +378,7 @@ static int omap_i2c_init(struct omap_i2c_dev *dev)
                          * REVISIT: Some wkup sources might not be needed.
                          */
                         dev->westate = OMAP_I2C_WE_ALL;
-                        if (dev->rev < OMAP_I2C_REV_ON_4430)
-                                omap_i2c_write_reg(dev, OMAP_I2C_WE_REG,
-                                                                dev->westate);
+                        omap_i2c_write_reg(dev, OMAP_I2C_WE_REG, dev->westate);
                 }
         }
         omap_i2c_write_reg(dev, OMAP_I2C_CON_REG, 0);
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 1fa091e05690..4a5c4a44ffb1 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -62,6 +62,7 @@
 #include <linux/notifier.h>
 #include <linux/cpu.h>
 #include <asm/mwait.h>
+#include <asm/msr.h>
 
 #define INTEL_IDLE_VERSION "0.4"
 #define PREFIX "intel_idle: "
@@ -85,6 +86,12 @@ static int intel_idle(struct cpuidle_device *dev, struct cpuidle_state *state);
 static struct cpuidle_state *cpuidle_state_table;
 
 /*
+ * Hardware C-state auto-demotion may not always be optimal.
+ * Indicate which enable bits to clear here.
+ */
+static unsigned long long auto_demotion_disable_flags;
+
+/*
  * Set this flag for states where the HW flushes the TLB for us
  * and so we don't need cross-calls to keep it consistent.
  * If this flag is set, SW flushes the TLB, so even if the
@@ -281,6 +288,15 @@ static struct notifier_block setup_broadcast_notifier = {
         .notifier_call = setup_broadcast_cpuhp_notify,
 };
 
+static void auto_demotion_disable(void *dummy)
+{
+        unsigned long long msr_bits;
+
+        rdmsrl(MSR_NHM_SNB_PKG_CST_CFG_CTL, msr_bits);
+        msr_bits &= ~auto_demotion_disable_flags;
+        wrmsrl(MSR_NHM_SNB_PKG_CST_CFG_CTL, msr_bits);
+}
+
 /*
  * intel_idle_probe()
  */
@@ -324,11 +340,17 @@ static int intel_idle_probe(void)
         case 0x25:      /* Westmere */
         case 0x2C:      /* Westmere */
                 cpuidle_state_table = nehalem_cstates;
+                auto_demotion_disable_flags =
+                        (NHM_C1_AUTO_DEMOTE | NHM_C3_AUTO_DEMOTE);
                 break;
 
         case 0x1C:      /* 28 - Atom Processor */
+                cpuidle_state_table = atom_cstates;
+                break;
+
         case 0x26:      /* 38 - Lincroft Atom Processor */
                 cpuidle_state_table = atom_cstates;
+                auto_demotion_disable_flags = ATM_LNC_C6_AUTO_DEMOTE;
                 break;
 
         case 0x2A:      /* SNB */
@@ -436,6 +458,8 @@ static int intel_idle_cpuidle_devices_init(void)
                         return -EIO;
                 }
         }
+        if (auto_demotion_disable_flags)
+                smp_call_function(auto_demotion_disable, NULL, 1);
 
         return 0;
 }
diff --git a/drivers/isdn/hardware/eicon/istream.c b/drivers/isdn/hardware/eicon/istream.c
index 18f8798442fa..7bd5baa547be 100644
--- a/drivers/isdn/hardware/eicon/istream.c
+++ b/drivers/isdn/hardware/eicon/istream.c
@@ -62,7 +62,7 @@ void diva_xdi_provide_istream_info (ADAPTER* a,
   stream interface.
   If synchronous service was requested, then function
   does return amount of data written to stream.
-  'final' does indicate that pice of data to be written is
+  'final' does indicate that piece of data to be written is
   final part of frame (necessary only by structured datatransfer)
   return  0 if zero lengh packet was written
   return -1 if stream is full
diff --git a/drivers/media/common/tuners/tda8290.c b/drivers/media/common/tuners/tda8290.c
index bc6a67768af1..8c4852114eeb 100644
--- a/drivers/media/common/tuners/tda8290.c
+++ b/drivers/media/common/tuners/tda8290.c
@@ -658,13 +658,13 @@ static int tda8290_probe(struct tuner_i2c_props *i2c_props)
 #define TDA8290_ID 0x89
         u8 reg = 0x1f, id;
         struct i2c_msg msg_read[] = {
-                { .addr = 0x4b, .flags = 0, .len = 1, .buf = &reg },
-                { .addr = 0x4b, .flags = I2C_M_RD, .len = 1, .buf = &id },
+                { .addr = i2c_props->addr, .flags = 0, .len = 1, .buf = &reg },
+                { .addr = i2c_props->addr, .flags = I2C_M_RD, .len = 1, .buf = &id },
         };
 
         /* detect tda8290 */
         if (i2c_transfer(i2c_props->adap, msg_read, 2) != 2) {
-                printk(KERN_WARNING "%s: tda8290 couldn't read register 0x%02x\n",
+                printk(KERN_WARNING "%s: couldn't read register 0x%02x\n",
                                __func__, reg);
                 return -ENODEV;
         }
@@ -685,13 +685,13 @@ static int tda8295_probe(struct tuner_i2c_props *i2c_props)
 #define TDA8295C2_ID 0x8b
         u8 reg = 0x2f, id;
         struct i2c_msg msg_read[] = {
-                { .addr = 0x4b, .flags = 0, .len = 1, .buf = &reg },
-                { .addr = 0x4b, .flags = I2C_M_RD, .len = 1, .buf = &id },
+                { .addr = i2c_props->addr, .flags = 0, .len = 1, .buf = &reg },
+                { .addr = i2c_props->addr, .flags = I2C_M_RD, .len = 1, .buf = &id },
         };
 
-        /* detect tda8290 */
+        /* detect tda8295 */
         if (i2c_transfer(i2c_props->adap, msg_read, 2) != 2) {
-                printk(KERN_WARNING "%s: tda8290 couldn't read register 0x%02x\n",
+                printk(KERN_WARNING "%s: couldn't read register 0x%02x\n",
                                __func__, reg);
                 return -ENODEV;
         }
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index defd83964ce2..193cdb77b76a 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -870,6 +870,23 @@ static int dib7070p_tuner_attach(struct dvb_usb_adapter *adap)
         return 0;
 }
 
+static int stk7700p_pid_filter(struct dvb_usb_adapter *adapter, int index,
+                u16 pid, int onoff)
+{
+        struct dib0700_state *st = adapter->dev->priv;
+        if (st->is_dib7000pc)
+                return dib7000p_pid_filter(adapter->fe, index, pid, onoff);
+        return dib7000m_pid_filter(adapter->fe, index, pid, onoff);
+}
+
+static int stk7700p_pid_filter_ctrl(struct dvb_usb_adapter *adapter, int onoff)
+{
+        struct dib0700_state *st = adapter->dev->priv;
+        if (st->is_dib7000pc)
+                return dib7000p_pid_filter_ctrl(adapter->fe, onoff);
+        return dib7000m_pid_filter_ctrl(adapter->fe, onoff);
+}
+
 static int stk70x0p_pid_filter(struct dvb_usb_adapter *adapter, int index, u16 pid, int onoff)
 {
     return dib7000p_pid_filter(adapter->fe, index, pid, onoff);
@@ -1875,8 +1892,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                         {
                                 .caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
                                 .pid_filter_count = 32,
-                                .pid_filter       = stk70x0p_pid_filter,
-                                .pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
+                                .pid_filter       = stk7700p_pid_filter,
+                                .pid_filter_ctrl  = stk7700p_pid_filter_ctrl,
                                 .frontend_attach  = stk7700p_frontend_attach,
                                 .tuner_attach     = stk7700p_tuner_attach,
 
diff --git a/drivers/media/dvb/dvb-usb/lmedm04.c b/drivers/media/dvb/dvb-usb/lmedm04.c
index 9eea4188303b..46ccd01a7696 100644
--- a/drivers/media/dvb/dvb-usb/lmedm04.c
+++ b/drivers/media/dvb/dvb-usb/lmedm04.c
@@ -659,7 +659,7 @@ static int lme2510_download_firmware(struct usb_device *dev,
 }
 
 /* Default firmware for LME2510C */
-const char lme_firmware[50] = "dvb-usb-lme2510c-s7395.fw";
+char lme_firmware[50] = "dvb-usb-lme2510c-s7395.fw";
 
 static void lme_coldreset(struct usb_device *dev)
 {
@@ -1006,7 +1006,7 @@ static struct dvb_usb_device_properties lme2510c_properties = {
         .caps = DVB_USB_IS_AN_I2C_ADAPTER,
         .usb_ctrl = DEVICE_SPECIFIC,
         .download_firmware = lme2510_download_firmware,
-        .firmware = lme_firmware,
+        .firmware = (const char *)&lme_firmware,
         .size_of_priv = sizeof(struct lme2510_state),
         .num_adapters = 1,
         .adapter = {
@@ -1109,5 +1109,5 @@ module_exit(lme2510_module_exit);
 
 MODULE_AUTHOR("Malcolm Priestley <tvboxspy@gmail.com>");
 MODULE_DESCRIPTION("LME2510(C) DVB-S USB2.0");
-MODULE_VERSION("1.74");
+MODULE_VERSION("1.75");
 MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/frontends/dib7000m.c b/drivers/media/dvb/frontends/dib7000m.c
index c7f5ccf54aa5..289a79837f24 100644
--- a/drivers/media/dvb/frontends/dib7000m.c
+++ b/drivers/media/dvb/frontends/dib7000m.c
@@ -1285,6 +1285,25 @@ struct i2c_adapter * dib7000m_get_i2c_master(struct dvb_frontend *demod, enum di
 }
 EXPORT_SYMBOL(dib7000m_get_i2c_master);
 
+int dib7000m_pid_filter_ctrl(struct dvb_frontend *fe, u8 onoff)
+{
+        struct dib7000m_state *state = fe->demodulator_priv;
+        u16 val = dib7000m_read_word(state, 294 + state->reg_offs) & 0xffef;
+        val |= (onoff & 0x1) << 4;
+        dprintk("PID filter enabled %d", onoff);
+        return dib7000m_write_word(state, 294 + state->reg_offs, val);
+}
+EXPORT_SYMBOL(dib7000m_pid_filter_ctrl);
+
+int dib7000m_pid_filter(struct dvb_frontend *fe, u8 id, u16 pid, u8 onoff)
+{
+        struct dib7000m_state *state = fe->demodulator_priv;
+        dprintk("PID filter: index %x, PID %d, OnOff %d", id, pid, onoff);
+        return dib7000m_write_word(state, 300 + state->reg_offs + id,
+                        onoff ? (1 << 13) | pid : 0);
+}
+EXPORT_SYMBOL(dib7000m_pid_filter);
+
 #if 0
 /* used with some prototype boards */
 int dib7000m_i2c_enumeration(struct i2c_adapter *i2c, int no_of_demods,
diff --git a/drivers/media/dvb/frontends/dib7000m.h b/drivers/media/dvb/frontends/dib7000m.h
index 113819ce9f0d..81fcf2241c64 100644
--- a/drivers/media/dvb/frontends/dib7000m.h
+++ b/drivers/media/dvb/frontends/dib7000m.h
@@ -46,6 +46,8 @@ extern struct dvb_frontend *dib7000m_attach(struct i2c_adapter *i2c_adap,
 extern struct i2c_adapter *dib7000m_get_i2c_master(struct dvb_frontend *,
                                                    enum dibx000_i2c_interface,
                                                    int);
+extern int dib7000m_pid_filter(struct dvb_frontend *, u8 id, u16 pid, u8 onoff);
+extern int dib7000m_pid_filter_ctrl(struct dvb_frontend *fe, u8 onoff);
 #else
 static inline
 struct dvb_frontend *dib7000m_attach(struct i2c_adapter *i2c_adap,
@@ -63,6 +65,19 @@ struct i2c_adapter *dib7000m_get_i2c_master(struct dvb_frontend *demod,
         printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
         return NULL;
 }
+static inline int dib7000m_pid_filter(struct dvb_frontend *fe, u8 id,
+                                                u16 pid, u8 onoff)
+{
+        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+        return -ENODEV;
+}
+
+static inline int dib7000m_pid_filter_ctrl(struct dvb_frontend *fe,
+                                                uint8_t onoff)
+{
+        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+        return -ENODEV;
+}
 #endif
 
 /* TODO
diff --git a/drivers/media/dvb/mantis/mantis_pci.c b/drivers/media/dvb/mantis/mantis_pci.c
index 59feeb84aec7..10a432a79d00 100644
--- a/drivers/media/dvb/mantis/mantis_pci.c
+++ b/drivers/media/dvb/mantis/mantis_pci.c
@@ -22,7 +22,6 @@
 #include <linux/moduleparam.h>
 #include <linux/kernel.h>
 #include <asm/io.h>
-#include <asm/pgtable.h>
 #include <asm/page.h>
 #include <linux/kmod.h>
 #include <linux/vmalloc.h>
diff --git a/drivers/media/rc/ir-raw.c b/drivers/media/rc/ir-raw.c
index 73230ff93b8a..01f258a2a57a 100644
--- a/drivers/media/rc/ir-raw.c
+++ b/drivers/media/rc/ir-raw.c
@@ -112,7 +112,7 @@ int ir_raw_event_store_edge(struct rc_dev *dev, enum raw_event_type type)
 {
         ktime_t                 now;
         s64                     delta; /* ns */
-        struct ir_raw_event     ev;
+        DEFINE_IR_RAW_EVENT(ev);
         int                     rc = 0;
 
         if (!dev->raw)
@@ -125,7 +125,6 @@ int ir_raw_event_store_edge(struct rc_dev *dev, enum raw_event_type type)
          * being called for the first time, note that delta can't
          * possibly be negative.
          */
-        ev.duration = 0;
         if (delta > IR_MAX_DURATION || !dev->raw->last_type)
                 type |= IR_START_EVENT;
         else
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index 6df0a4980645..e4f8eac7f717 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -148,6 +148,7 @@ enum mceusb_model_type {
         MCE_GEN2_TX_INV,
         POLARIS_EVK,
         CX_HYBRID_TV,
+        MULTIFUNCTION,
 };
 
 struct mceusb_model {
@@ -155,9 +156,10 @@ struct mceusb_model {
         u32 mce_gen2:1;
         u32 mce_gen3:1;
         u32 tx_mask_normal:1;
-        u32 is_polaris:1;
         u32 no_tx:1;
 
+        int ir_intfnum;
+
         const char *rc_map;     /* Allow specify a per-board map */
         const char *name;       /* per-board name */
 };
@@ -179,7 +181,6 @@ static const struct mceusb_model mceusb_model[] = {
                 .tx_mask_normal = 1,
         },
         [POLARIS_EVK] = {
-                .is_polaris = 1,
                 /*
                  * In fact, the EVK is shipped without
                  * remotes, but we should have something handy,
@@ -189,10 +190,13 @@ static const struct mceusb_model mceusb_model[] = {
                 .name = "Conexant Hybrid TV (cx231xx) MCE IR",
         },
         [CX_HYBRID_TV] = {
-                .is_polaris = 1,
                 .no_tx = 1, /* tx isn't wired up at all */
                 .name = "Conexant Hybrid TV (cx231xx) MCE IR",
         },
+        [MULTIFUNCTION] = {
+                .mce_gen2 = 1,
+                .ir_intfnum = 2,
+        },
 };
 
 static struct usb_device_id mceusb_dev_table[] = {
@@ -216,8 +220,9 @@ static struct usb_device_id mceusb_dev_table[] = {
         { USB_DEVICE(VENDOR_PHILIPS, 0x206c) },
         /* Philips/Spinel plus IR transceiver for ASUS */
         { USB_DEVICE(VENDOR_PHILIPS, 0x2088) },
-        /* Realtek MCE IR Receiver */
-        { USB_DEVICE(VENDOR_REALTEK, 0x0161) },
+        /* Realtek MCE IR Receiver and card reader */
+        { USB_DEVICE(VENDOR_REALTEK, 0x0161),
+          .driver_info = MULTIFUNCTION },
         /* SMK/Toshiba G83C0004D410 */
         { USB_DEVICE(VENDOR_SMK, 0x031d),
           .driver_info = MCE_GEN2_TX_INV },
@@ -1101,7 +1106,7 @@ static int __devinit mceusb_dev_probe(struct usb_interface *intf,
         bool is_gen3;
         bool is_microsoft_gen1;
         bool tx_mask_normal;
-        bool is_polaris;
+        int ir_intfnum;
 
         dev_dbg(&intf->dev, "%s called\n", __func__);
 
@@ -1110,13 +1115,11 @@ static int __devinit mceusb_dev_probe(struct usb_interface *intf,
         is_gen3 = mceusb_model[model].mce_gen3;
         is_microsoft_gen1 = mceusb_model[model].mce_gen1;
         tx_mask_normal = mceusb_model[model].tx_mask_normal;
-        is_polaris = mceusb_model[model].is_polaris;
+        ir_intfnum = mceusb_model[model].ir_intfnum;
 
-        if (is_polaris) {
-                /* Interface 0 is IR */
-                if (idesc->desc.bInterfaceNumber)
-                        return -ENODEV;
-        }
+        /* There are multi-function devices with non-IR interfaces */
+        if (idesc->desc.bInterfaceNumber != ir_intfnum)
+                return -ENODEV;
 
         /* step through the endpoints to find first bulk in and out endpoint */
         for (i = 0; i < idesc->desc.bNumEndpoints; ++i) {
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index 273d9d674792..d4d64492a057 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -385,8 +385,9 @@ static void nvt_cir_regs_init(struct nvt_dev *nvt)
 
 static void nvt_cir_wake_regs_init(struct nvt_dev *nvt)
 {
-        /* set number of bytes needed for wake key comparison (default 67) */
-        nvt_cir_wake_reg_write(nvt, CIR_WAKE_FIFO_LEN, CIR_WAKE_FIFO_CMP_DEEP);
+        /* set number of bytes needed for wake from s3 (default 65) */
+        nvt_cir_wake_reg_write(nvt, CIR_WAKE_FIFO_CMP_BYTES,
+                               CIR_WAKE_FIFO_CMP_DEEP);
 
         /* set tolerance/variance allowed per byte during wake compare */
         nvt_cir_wake_reg_write(nvt, CIR_WAKE_CMP_TOLERANCE,
diff --git a/drivers/media/rc/nuvoton-cir.h b/drivers/media/rc/nuvoton-cir.h
index 1df82351cb03..048135eea702 100644
--- a/drivers/media/rc/nuvoton-cir.h
+++ b/drivers/media/rc/nuvoton-cir.h
@@ -305,8 +305,11 @@ struct nvt_dev {
 #define CIR_WAKE_IRFIFOSTS_RX_EMPTY     0x20
 #define CIR_WAKE_IRFIFOSTS_RX_FULL      0x10
 
-/* CIR Wake FIFO buffer is 67 bytes long */
-#define CIR_WAKE_FIFO_LEN               67
+/*
+ * The CIR Wake FIFO buffer is 67 bytes long, but the stock remote wakes
+ * the system comparing only 65 bytes (fails with this set to 67)
+ */
+#define CIR_WAKE_FIFO_CMP_BYTES         65
 /* CIR Wake byte comparison tolerance */
 #define CIR_WAKE_CMP_TOLERANCE          5
 
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 512a2f4ada0e..5b4422ef4e6d 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -850,7 +850,7 @@ static ssize_t store_protocols(struct device *device,
                         count++;
                 } else {
                         for (i = 0; i < ARRAY_SIZE(proto_names); i++) {
-                                if (!strncasecmp(tmp, proto_names[i].name, strlen(proto_names[i].name))) {
+                                if (!strcasecmp(tmp, proto_names[i].name)) {
                                         tmp += strlen(proto_names[i].name);
                                         mask = proto_names[i].type;
                                         break;
diff --git a/drivers/media/video/au0828/au0828-video.c b/drivers/media/video/au0828/au0828-video.c
index e41e4ad5cc40..9c475c600fc9 100644
--- a/drivers/media/video/au0828/au0828-video.c
+++ b/drivers/media/video/au0828/au0828-video.c
@@ -1758,7 +1758,12 @@ static int vidioc_reqbufs(struct file *file, void *priv,
         if (rc < 0)
                 return rc;
 
-        return videobuf_reqbufs(&fh->vb_vidq, rb);
+        if (fh->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                rc = videobuf_reqbufs(&fh->vb_vidq, rb);
+        else if (fh->type == V4L2_BUF_TYPE_VBI_CAPTURE)
+                rc = videobuf_reqbufs(&fh->vb_vbiq, rb);
+
+        return rc;
 }
 
 static int vidioc_querybuf(struct file *file, void *priv,
@@ -1772,7 +1777,12 @@ static int vidioc_querybuf(struct file *file, void *priv,
         if (rc < 0)
                 return rc;
 
-        return videobuf_querybuf(&fh->vb_vidq, b);
+        if (fh->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                rc = videobuf_querybuf(&fh->vb_vidq, b);
+        else if (fh->type == V4L2_BUF_TYPE_VBI_CAPTURE)
+                rc = videobuf_querybuf(&fh->vb_vbiq, b);
+
+        return rc;
 }
 
 static int vidioc_qbuf(struct file *file, void *priv, struct v4l2_buffer *b)
@@ -1785,7 +1795,12 @@ static int vidioc_qbuf(struct file *file, void *priv, struct v4l2_buffer *b)
         if (rc < 0)
                 return rc;
 
-        return videobuf_qbuf(&fh->vb_vidq, b);
+        if (fh->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                rc = videobuf_qbuf(&fh->vb_vidq, b);
+        else if (fh->type == V4L2_BUF_TYPE_VBI_CAPTURE)
+                rc = videobuf_qbuf(&fh->vb_vbiq, b);
+
+        return rc;
 }
 
 static int vidioc_dqbuf(struct file *file, void *priv, struct v4l2_buffer *b)
@@ -1806,7 +1821,12 @@ static int vidioc_dqbuf(struct file *file, void *priv, struct v4l2_buffer *b)
                 dev->greenscreen_detected = 0;
         }
 
-        return videobuf_dqbuf(&fh->vb_vidq, b, file->f_flags & O_NONBLOCK);
+        if (fh->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                rc = videobuf_dqbuf(&fh->vb_vidq, b, file->f_flags & O_NONBLOCK);
+        else if (fh->type == V4L2_BUF_TYPE_VBI_CAPTURE)
+                rc = videobuf_dqbuf(&fh->vb_vbiq, b, file->f_flags & O_NONBLOCK);
+
+        return rc;
 }
 
 static struct v4l2_file_operations au0828_v4l_fops = {
diff --git a/drivers/media/video/cx18/cx18-cards.c b/drivers/media/video/cx18/cx18-cards.c
index 87177733cf92..68ad1963f421 100644
--- a/drivers/media/video/cx18/cx18-cards.c
+++ b/drivers/media/video/cx18/cx18-cards.c
@@ -95,6 +95,53 @@ static const struct cx18_card cx18_card_hvr1600_esmt = {
         .i2c = &cx18_i2c_std,
 };
 
+static const struct cx18_card cx18_card_hvr1600_s5h1411 = {
+        .type = CX18_CARD_HVR_1600_S5H1411,
+        .name = "Hauppauge HVR-1600",
+        .comment = "Simultaneous Digital and Analog TV capture supported\n",
+        .v4l2_capabilities = CX18_CAP_ENCODER,
+        .hw_audio_ctrl = CX18_HW_418_AV,
+        .hw_muxer = CX18_HW_CS5345,
+        .hw_all = CX18_HW_TVEEPROM | CX18_HW_418_AV | CX18_HW_TUNER |
+                  CX18_HW_CS5345 | CX18_HW_DVB | CX18_HW_GPIO_RESET_CTRL |
+                  CX18_HW_Z8F0811_IR_HAUP,
+        .video_inputs = {
+                { CX18_CARD_INPUT_VID_TUNER,  0, CX18_AV_COMPOSITE7 },
+                { CX18_CARD_INPUT_SVIDEO1,    1, CX18_AV_SVIDEO1    },
+                { CX18_CARD_INPUT_COMPOSITE1, 1, CX18_AV_COMPOSITE3 },
+                { CX18_CARD_INPUT_SVIDEO2,    2, CX18_AV_SVIDEO2    },
+                { CX18_CARD_INPUT_COMPOSITE2, 2, CX18_AV_COMPOSITE4 },
+        },
+        .audio_inputs = {
+                { CX18_CARD_INPUT_AUD_TUNER,
+                  CX18_AV_AUDIO8, CS5345_IN_1 | CS5345_MCLK_1_5 },
+                { CX18_CARD_INPUT_LINE_IN1,
+                  CX18_AV_AUDIO_SERIAL1, CS5345_IN_2 },
+                { CX18_CARD_INPUT_LINE_IN2,
+                  CX18_AV_AUDIO_SERIAL1, CS5345_IN_3 },
+        },
+        .radio_input = { CX18_CARD_INPUT_AUD_TUNER,
+                         CX18_AV_AUDIO_SERIAL1, CS5345_IN_4 },
+        .ddr = {
+                /* ESMT M13S128324A-5B memory */
+                .chip_config = 0x003,
+                .refresh = 0x30c,
+                .timing1 = 0x44220e82,
+                .timing2 = 0x08,
+                .tune_lane = 0,
+                .initial_emrs = 0,
+        },
+        .gpio_init.initial_value = 0x3001,
+        .gpio_init.direction = 0x3001,
+        .gpio_i2c_slave_reset = {
+                .active_lo_mask = 0x3001,
+                .msecs_asserted = 10,
+                .msecs_recovery = 40,
+                .ir_reset_mask  = 0x0001,
+        },
+        .i2c = &cx18_i2c_std,
+};
+
 static const struct cx18_card cx18_card_hvr1600_samsung = {
         .type = CX18_CARD_HVR_1600_SAMSUNG,
         .name = "Hauppauge HVR-1600 (Preproduction)",
@@ -523,7 +570,8 @@ static const struct cx18_card *cx18_card_list[] = {
         &cx18_card_toshiba_qosmio_dvbt,
         &cx18_card_leadtek_pvr2100,
         &cx18_card_leadtek_dvr3100h,
-        &cx18_card_gotview_dvd3
+        &cx18_card_gotview_dvd3,
+        &cx18_card_hvr1600_s5h1411
 };
 
 const struct cx18_card *cx18_get_card(u16 index)
diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
index 944af8adbe0c..b1c3cbd92743 100644
--- a/drivers/media/video/cx18/cx18-driver.c
+++ b/drivers/media/video/cx18/cx18-driver.c
@@ -157,6 +157,7 @@ MODULE_PARM_DESC(cardtype,
                  "\t\t\t 7 = Leadtek WinFast PVR2100\n"
                  "\t\t\t 8 = Leadtek WinFast DVR3100 H\n"
                  "\t\t\t 9 = GoTView PCI DVD3 Hybrid\n"
+                 "\t\t\t 10 = Hauppauge HVR 1600 (S5H1411)\n"
                  "\t\t\t 0 = Autodetect (default)\n"
                  "\t\t\t-1 = Ignore this card\n\t\t");
 MODULE_PARM_DESC(pal, "Set PAL standard: B, G, H, D, K, I, M, N, Nc, 60");
@@ -337,6 +338,7 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
         switch (cx->card->type) {
         case CX18_CARD_HVR_1600_ESMT:
         case CX18_CARD_HVR_1600_SAMSUNG:
+        case CX18_CARD_HVR_1600_S5H1411:
                 tveeprom_hauppauge_analog(&c, tv, eedata);
                 break;
         case CX18_CARD_YUAN_MPC718:
@@ -365,7 +367,25 @@ static void cx18_process_eeprom(struct cx18 *cx)
            from the model number. Use the cardtype module option if you
            have one of these preproduction models. */
         switch (tv.model) {
-        case 74000 ... 74999:
+        case 74301: /* Retail models */
+        case 74321:
+        case 74351: /* OEM models */
+        case 74361:
+                /* Digital side is s5h1411/tda18271 */
+                cx->card = cx18_get_card(CX18_CARD_HVR_1600_S5H1411);
+                break;
+        case 74021: /* Retail models */
+        case 74031:
+        case 74041:
+        case 74141:
+        case 74541: /* OEM models */
+        case 74551:
+        case 74591:
+        case 74651:
+        case 74691:
+        case 74751:
+        case 74891:
+                /* Digital side is s5h1409/mxl5005s */
                 cx->card = cx18_get_card(CX18_CARD_HVR_1600_ESMT);
                 break;
         case 0x718:
@@ -377,7 +397,8 @@ static void cx18_process_eeprom(struct cx18 *cx)
                 CX18_ERR("Invalid EEPROM\n");
                 return;
         default:
-                CX18_ERR("Unknown model %d, defaulting to HVR-1600\n", tv.model);
+                CX18_ERR("Unknown model %d, defaulting to original HVR-1600 "
+                         "(cardtype=1)\n", tv.model);
                 cx->card = cx18_get_card(CX18_CARD_HVR_1600_ESMT);
                 break;
         }
diff --git a/drivers/media/video/cx18/cx18-driver.h b/drivers/media/video/cx18/cx18-driver.h
index 306caac6d3fc..f736679d2517 100644
--- a/drivers/media/video/cx18/cx18-driver.h
+++ b/drivers/media/video/cx18/cx18-driver.h
@@ -85,7 +85,8 @@
 #define CX18_CARD_LEADTEK_PVR2100     6 /* Leadtek WinFast PVR2100 */
 #define CX18_CARD_LEADTEK_DVR3100H    7 /* Leadtek WinFast DVR3100 H */
 #define CX18_CARD_GOTVIEW_PCI_DVD3    8 /* GoTView PCI DVD3 Hybrid */
-#define CX18_CARD_LAST                8
+#define CX18_CARD_HVR_1600_S5H1411    9 /* Hauppauge HVR 1600 s5h1411/tda18271*/
+#define CX18_CARD_LAST                9
 
 #define CX18_ENC_STREAM_TYPE_MPG  0
 #define CX18_ENC_STREAM_TYPE_TS   1
diff --git a/drivers/media/video/cx18/cx18-dvb.c b/drivers/media/video/cx18/cx18-dvb.c
index f0381d62518d..f41922bd4020 100644
--- a/drivers/media/video/cx18/cx18-dvb.c
+++ b/drivers/media/video/cx18/cx18-dvb.c
@@ -29,6 +29,8 @@
 #include "cx18-gpio.h"
 #include "s5h1409.h"
 #include "mxl5005s.h"
+#include "s5h1411.h"
+#include "tda18271.h"
 #include "zl10353.h"
 
 #include <linux/firmware.h>
@@ -77,6 +79,32 @@ static struct s5h1409_config hauppauge_hvr1600_config = {
 };
 
 /*
+ * CX18_CARD_HVR_1600_S5H1411
+ */
+static struct s5h1411_config hcw_s5h1411_config = {
+        .output_mode   = S5H1411_SERIAL_OUTPUT,
+        .gpio          = S5H1411_GPIO_OFF,
+        .vsb_if        = S5H1411_IF_44000,
+        .qam_if        = S5H1411_IF_4000,
+        .inversion     = S5H1411_INVERSION_ON,
+        .status_mode   = S5H1411_DEMODLOCKING,
+        .mpeg_timing   = S5H1411_MPEGTIMING_CONTINOUS_NONINVERTING_CLOCK,
+};
+
+static struct tda18271_std_map hauppauge_tda18271_std_map = {
+        .atsc_6   = { .if_freq = 5380, .agc_mode = 3, .std = 3,
+                      .if_lvl = 6, .rfagc_top = 0x37 },
+        .qam_6    = { .if_freq = 4000, .agc_mode = 3, .std = 0,
+                      .if_lvl = 6, .rfagc_top = 0x37 },
+};
+
+static struct tda18271_config hauppauge_tda18271_config = {
+        .std_map = &hauppauge_tda18271_std_map,
+        .gate    = TDA18271_GATE_DIGITAL,
+        .output_opt = TDA18271_OUTPUT_LT_OFF,
+};
+
+/*
  * CX18_CARD_LEADTEK_DVR3100H
  */
 /* Information/confirmation of proper config values provided by Terry Wu */
@@ -244,6 +272,7 @@ static int cx18_dvb_start_feed(struct dvb_demux_feed *feed)
         switch (cx->card->type) {
         case CX18_CARD_HVR_1600_ESMT:
         case CX18_CARD_HVR_1600_SAMSUNG:
+        case CX18_CARD_HVR_1600_S5H1411:
                 v = cx18_read_reg(cx, CX18_REG_DMUX_NUM_PORT_0_CONTROL);
                 v |= 0x00400000; /* Serial Mode */
                 v |= 0x00002000; /* Data Length - Byte */
@@ -455,6 +484,15 @@ static int dvb_register(struct cx18_stream *stream)
                         ret = 0;
                 }
                 break;
+        case CX18_CARD_HVR_1600_S5H1411:
+                dvb->fe = dvb_attach(s5h1411_attach,
+                                     &hcw_s5h1411_config,
+                                     &cx->i2c_adap[0]);
+                if (dvb->fe != NULL)
+                        dvb_attach(tda18271_attach, dvb->fe,
+                                   0x60, &cx->i2c_adap[0],
+                                   &hauppauge_tda18271_config);
+                break;
         case CX18_CARD_LEADTEK_DVR3100H:
                 dvb->fe = dvb_attach(zl10353_attach,
                                      &leadtek_dvr3100h_demod,
diff --git a/drivers/media/video/cx23885/cx23885-i2c.c b/drivers/media/video/cx23885/cx23885-i2c.c
index ed3d8f55029b..307ff543c254 100644
--- a/drivers/media/video/cx23885/cx23885-i2c.c
+++ b/drivers/media/video/cx23885/cx23885-i2c.c
@@ -122,10 +122,6 @@ static int i2c_sendbytes(struct i2c_adapter *i2c_adap,
 
         if (!i2c_wait_done(i2c_adap))
                 goto eio;
-        if (!i2c_slave_did_ack(i2c_adap)) {
-                retval = -ENXIO;
-                goto err;
-        }
         if (i2c_debug) {
                 printk(" <W %02x %02x", msg->addr << 1, msg->buf[0]);
                 if (!(ctrl & I2C_NOSTOP))
@@ -158,7 +154,6 @@ static int i2c_sendbytes(struct i2c_adapter *i2c_adap,
 
  eio:
         retval = -EIO;
- err:
         if (i2c_debug)
                 printk(KERN_ERR " ERR: %d\n", retval);
         return retval;
@@ -209,10 +204,6 @@ static int i2c_readbytes(struct i2c_adapter *i2c_adap,
 
                 if (!i2c_wait_done(i2c_adap))
                         goto eio;
-                if (cnt == 0 && !i2c_slave_did_ack(i2c_adap)) {
-                        retval = -ENXIO;
-                        goto err;
-                }
                 msg->buf[cnt] = cx_read(bus->reg_rdata) & 0xff;
                 if (i2c_debug) {
                         dprintk(1, " %02x", msg->buf[cnt]);
@@ -224,7 +215,6 @@ static int i2c_readbytes(struct i2c_adapter *i2c_adap,
 
  eio:
         retval = -EIO;
- err:
         if (i2c_debug)
                 printk(KERN_ERR " ERR: %d\n", retval);
         return retval;
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 6fc09dd41b9d..35796e035247 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -2015,7 +2015,8 @@ static int cx25840_probe(struct i2c_client *client,
                 kfree(state);
                 return err;
         }
-        v4l2_ctrl_cluster(2, &state->volume);
+        if (!is_cx2583x(state))
+                v4l2_ctrl_cluster(2, &state->volume);
         v4l2_ctrl_handler_setup(&state->hdl);
 
         if (client->dev.platform_data) {
diff --git a/drivers/media/video/ivtv/ivtv-irq.c b/drivers/media/video/ivtv/ivtv-irq.c
index 9b4faf009196..9c29e964d400 100644
--- a/drivers/media/video/ivtv/ivtv-irq.c
+++ b/drivers/media/video/ivtv/ivtv-irq.c
@@ -628,22 +628,66 @@ static void ivtv_irq_enc_pio_complete(struct ivtv *itv)
 static void ivtv_irq_dma_err(struct ivtv *itv)
 {
         u32 data[CX2341X_MBOX_MAX_DATA];
+        u32 status;
 
         del_timer(&itv->dma_timer);
+
         ivtv_api_get_data(&itv->enc_mbox, IVTV_MBOX_DMA_END, 2, data);
+        status = read_reg(IVTV_REG_DMASTATUS);
         IVTV_DEBUG_WARN("DMA ERROR %08x %08x %08x %d\n", data[0], data[1],
-                                read_reg(IVTV_REG_DMASTATUS), itv->cur_dma_stream);
-        write_reg(read_reg(IVTV_REG_DMASTATUS) & 3, IVTV_REG_DMASTATUS);
+                                status, itv->cur_dma_stream);
+        /*
+         * We do *not* write back to the IVTV_REG_DMASTATUS register to
+         * clear the error status, if either the encoder write (0x02) or
+         * decoder read (0x01) bus master DMA operation do not indicate
+         * completed.  We can race with the DMA engine, which may have
+         * transitioned to completed status *after* we read the register.
+         * Setting a IVTV_REG_DMASTATUS flag back to "busy" status, after the
+         * DMA engine has completed, will cause the DMA engine to stop working.
+         */
+        status &= 0x3;
+        if (status == 0x3)
+                write_reg(status, IVTV_REG_DMASTATUS);
+
         if (!test_bit(IVTV_F_I_UDMA, &itv->i_flags) &&
             itv->cur_dma_stream >= 0 && itv->cur_dma_stream < IVTV_MAX_STREAMS) {
                 struct ivtv_stream *s = &itv->streams[itv->cur_dma_stream];
 
-                /* retry */
-                if (s->type >= IVTV_DEC_STREAM_TYPE_MPG)
+                if (s->type >= IVTV_DEC_STREAM_TYPE_MPG) {
+                        /* retry */
+                        /*
+                         * FIXME - handle cases of DMA error similar to
+                         * encoder below, except conditioned on status & 0x1
+                         */
                         ivtv_dma_dec_start(s);
-                else
-                        ivtv_dma_enc_start(s);
-                return;
+                        return;
+                } else {
+                        if ((status & 0x2) == 0) {
+                                /*
+                                 * CX2341x Bus Master DMA write is ongoing.
+                                 * Reset the timer and let it complete.
+                                 */
+                                itv->dma_timer.expires =
+                                                jiffies + msecs_to_jiffies(600);
+                                add_timer(&itv->dma_timer);
+                                return;
+                        }
+
+                        if (itv->dma_retries < 3) {
+                                /*
+                                 * CX2341x Bus Master DMA write has ended.
+                                 * Retry the write, starting with the first
+                                 * xfer segment. Just retrying the current
+                                 * segment is not sufficient.
+                                 */
+                                s->sg_processed = 0;
+                                itv->dma_retries++;
+                                ivtv_dma_enc_start_xfer(s);
+                                return;
+                        }
+                        /* Too many retries, give up on this one */
+                }
+
         }
         if (test_bit(IVTV_F_I_UDMA, &itv->i_flags)) {
                 ivtv_udma_start(itv);
diff --git a/drivers/media/video/mem2mem_testdev.c b/drivers/media/video/mem2mem_testdev.c
index c179041d91f8..e7e717800ee2 100644
--- a/drivers/media/video/mem2mem_testdev.c
+++ b/drivers/media/video/mem2mem_testdev.c
@@ -1011,7 +1011,6 @@ static int m2mtest_remove(struct platform_device *pdev)
         v4l2_m2m_release(dev->m2m_dev);
         del_timer_sync(&dev->timer);
         video_unregister_device(dev->vfd);
-        video_device_release(dev->vfd);
         v4l2_device_unregister(&dev->v4l2_dev);
         kfree(dev);
 
diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c
index b63f8cafa671..561909b65ce6 100644
--- a/drivers/media/video/s2255drv.c
+++ b/drivers/media/video/s2255drv.c
@@ -57,7 +57,7 @@
 #include <linux/usb.h>
 
 #define S2255_MAJOR_VERSION     1
-#define S2255_MINOR_VERSION     20
+#define S2255_MINOR_VERSION     21
 #define S2255_RELEASE           0
 #define S2255_VERSION           KERNEL_VERSION(S2255_MAJOR_VERSION, \
                                                S2255_MINOR_VERSION, \
@@ -312,9 +312,9 @@ struct s2255_fh {
 };
 
 /* current cypress EEPROM firmware version */
-#define S2255_CUR_USB_FWVER     ((3 << 8) | 6)
+#define S2255_CUR_USB_FWVER     ((3 << 8) | 11)
 /* current DSP FW version */
-#define S2255_CUR_DSP_FWVER     8
+#define S2255_CUR_DSP_FWVER     10102
 /* Need DSP version 5+ for video status feature */
 #define S2255_MIN_DSP_STATUS      5
 #define S2255_MIN_DSP_COLORFILTER 8
@@ -492,9 +492,11 @@ static void planar422p_to_yuv_packed(const unsigned char *in,
 
 static void s2255_reset_dsppower(struct s2255_dev *dev)
 {
-        s2255_vendor_req(dev, 0x40, 0x0b0b, 0x0b0b, NULL, 0, 1);
+        s2255_vendor_req(dev, 0x40, 0x0b0b, 0x0b01, NULL, 0, 1);
         msleep(10);
         s2255_vendor_req(dev, 0x50, 0x0000, 0x0000, NULL, 0, 1);
+        msleep(600);
+        s2255_vendor_req(dev, 0x10, 0x0000, 0x0000, NULL, 0, 1);
         return;
 }
 
diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
index 6a1f94042612..c45e6305b26f 100644
--- a/drivers/mfd/asic3.c
+++ b/drivers/mfd/asic3.c
@@ -143,9 +143,9 @@ static void asic3_irq_demux(unsigned int irq, struct irq_desc *desc)
         unsigned long flags;
         struct asic3 *asic;
 
-        desc->chip->ack(irq);
+        desc->irq_data.chip->irq_ack(&desc->irq_data);
 
-        asic = desc->handler_data;
+        asic = get_irq_data(irq);
 
         for (iter = 0 ; iter < MAX_ASIC_ISR_LOOPS; iter++) {
                 u32 status;
diff --git a/drivers/mfd/davinci_voicecodec.c b/drivers/mfd/davinci_voicecodec.c
index 33c923d215c7..fdd8a1b8bc67 100644
--- a/drivers/mfd/davinci_voicecodec.c
+++ b/drivers/mfd/davinci_voicecodec.c
@@ -118,12 +118,12 @@ static int __init davinci_vc_probe(struct platform_device *pdev)
 
         /* Voice codec interface client */
         cell = &davinci_vc->cells[DAVINCI_VC_VCIF_CELL];
-        cell->name = "davinci_vcif";
+        cell->name = "davinci-vcif";
         cell->driver_data = davinci_vc;
 
         /* Voice codec CQ93VC client */
         cell = &davinci_vc->cells[DAVINCI_VC_CQ93VC_CELL];
-        cell->name = "cq93vc";
+        cell->name = "cq93vc-codec";
         cell->driver_data = davinci_vc;
 
         ret = mfd_add_devices(&pdev->dev, pdev->id, davinci_vc->cells,
diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
index 627cf577b16d..e9018d1394ee 100644
--- a/drivers/mfd/tps6586x.c
+++ b/drivers/mfd/tps6586x.c
@@ -150,12 +150,12 @@ static inline int __tps6586x_write(struct i2c_client *client,
 static inline int __tps6586x_writes(struct i2c_client *client, int reg,
                                   int len, uint8_t *val)
 {
-        int ret;
+        int ret, i;
 
-        ret = i2c_smbus_write_i2c_block_data(client, reg, len, val);
-        if (ret < 0) {
-                dev_err(&client->dev, "failed writings to 0x%02x\n", reg);
-                return ret;
+        for (i = 0; i < len; i++) {
+                ret = __tps6586x_write(client, reg + i, *(val + i));
+                if (ret < 0)
+                        return ret;
         }
 
         return 0;
diff --git a/drivers/mfd/ucb1x00-ts.c b/drivers/mfd/ucb1x00-ts.c
index 000cb414a78a..92b85e28a15e 100644
--- a/drivers/mfd/ucb1x00-ts.c
+++ b/drivers/mfd/ucb1x00-ts.c
@@ -385,12 +385,18 @@ static int ucb1x00_ts_add(struct ucb1x00_dev *dev)
         idev->close      = ucb1x00_ts_close;
 
         __set_bit(EV_ABS, idev->evbit);
-        __set_bit(ABS_X, idev->absbit);
-        __set_bit(ABS_Y, idev->absbit);
-        __set_bit(ABS_PRESSURE, idev->absbit);
 
         input_set_drvdata(idev, ts);
 
+        ucb1x00_adc_enable(ts->ucb);
+        ts->x_res = ucb1x00_ts_read_xres(ts);
+        ts->y_res = ucb1x00_ts_read_yres(ts);
+        ucb1x00_adc_disable(ts->ucb);
+
+        input_set_abs_params(idev, ABS_X, 0, ts->x_res, 0, 0);
+        input_set_abs_params(idev, ABS_Y, 0, ts->y_res, 0, 0);
+        input_set_abs_params(idev, ABS_PRESSURE, 0, 0, 0, 0);
+
         err = input_register_device(idev);
         if (err)
                 goto fail;
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index 41233c7fa581..f4016a075fd6 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -246,6 +246,16 @@ static int wm8994_suspend(struct device *dev)
         struct wm8994 *wm8994 = dev_get_drvdata(dev);
         int ret;
 
+        /* Don't actually go through with the suspend if the CODEC is
+         * still active (eg, for audio passthrough from CP. */
+        ret = wm8994_reg_read(wm8994, WM8994_POWER_MANAGEMENT_1);
+        if (ret < 0) {
+                dev_err(dev, "Failed to read power status: %d\n", ret);
+        } else if (ret & WM8994_VMID_SEL_MASK) {
+                dev_dbg(dev, "CODEC still active, ignoring suspend\n");
+                return 0;
+        }
+
         /* GPIO configuration state is saved here since we may be configuring
          * the GPIO alternate functions even if we're not using the gpiolib
          * driver for them.
@@ -261,6 +271,8 @@ static int wm8994_suspend(struct device *dev)
         if (ret < 0)
                 dev_err(dev, "Failed to save LDO registers: %d\n", ret);
 
+        wm8994->suspended = true;
+
         ret = regulator_bulk_disable(wm8994->num_supplies,
                                      wm8994->supplies);
         if (ret != 0) {
@@ -276,6 +288,10 @@ static int wm8994_resume(struct device *dev)
         struct wm8994 *wm8994 = dev_get_drvdata(dev);
         int ret;
 
+        /* We may have lied to the PM core about suspending */
+        if (!wm8994->suspended)
+                return 0;
+
         ret = regulator_bulk_enable(wm8994->num_supplies,
                                     wm8994->supplies);
         if (ret != 0) {
@@ -298,6 +314,8 @@ static int wm8994_resume(struct device *dev)
         if (ret < 0)
                 dev_err(dev, "Failed to restore GPIO registers: %d\n", ret);
 
+        wm8994->suspended = false;
+
         return 0;
 }
 #endif
diff --git a/drivers/misc/bmp085.c b/drivers/misc/bmp085.c
index 63ee4c1a5315..b6e1c9a6679e 100644
--- a/drivers/misc/bmp085.c
+++ b/drivers/misc/bmp085.c
@@ -449,6 +449,7 @@ static const struct i2c_device_id bmp085_id[] = {
         { "bmp085", 0 },
         { }
 };
+MODULE_DEVICE_TABLE(i2c, bmp085_id);
 
 static struct i2c_driver bmp085_driver = {
         .driver = {
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 6625c057be05..150b5f3cd401 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1529,7 +1529,7 @@ void mmc_rescan(struct work_struct *work)
          * still present
          */
         if (host->bus_ops && host->bus_ops->detect && !host->bus_dead
-            && mmc_card_is_removable(host))
+            && !(host->caps & MMC_CAP_NONREMOVABLE))
                 host->bus_ops->detect(host);
 
         /*
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index 5c4a54d9b6a4..ebc62ad4cc56 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -792,7 +792,6 @@ int mmc_attach_sdio(struct mmc_host *host)
          */
         mmc_release_host(host);
         err = mmc_add_card(host->card);
-        mmc_claim_host(host);
         if (err)
                 goto remove_added;
 
@@ -805,12 +804,12 @@ int mmc_attach_sdio(struct mmc_host *host)
                         goto remove_added;
         }
 
+        mmc_claim_host(host);
         return 0;
 
 
 remove_added:
         /* Remove without lock if the device has been added. */
-        mmc_release_host(host);
         mmc_sdio_remove(host);
         mmc_claim_host(host);
 remove:
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index a8c3e1c9b02a..4aaa88f8ab5f 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -1230,10 +1230,32 @@ static int inval_cache_and_wait_for_operation(
         sleep_time = chip_op_time / 2;
 
         for (;;) {
+                if (chip->state != chip_state) {
+                        /* Someone's suspended the operation: sleep */
+                        DECLARE_WAITQUEUE(wait, current);
+                        set_current_state(TASK_UNINTERRUPTIBLE);
+                        add_wait_queue(&chip->wq, &wait);
+                        mutex_unlock(&chip->mutex);
+                        schedule();
+                        remove_wait_queue(&chip->wq, &wait);
+                        mutex_lock(&chip->mutex);
+                        continue;
+                }
+
                 status = map_read(map, cmd_adr);
                 if (map_word_andequal(map, status, status_OK, status_OK))
                         break;
 
+                if (chip->erase_suspended && chip_state == FL_ERASING)  {
+                        /* Erase suspend occured while sleep: reset timeout */
+                        timeo = reset_timeo;
+                        chip->erase_suspended = 0;
+                }
+                if (chip->write_suspended && chip_state == FL_WRITING)  {
+                        /* Write suspend occured while sleep: reset timeout */
+                        timeo = reset_timeo;
+                        chip->write_suspended = 0;
+                }
                 if (!timeo) {
                         map_write(map, CMD(0x70), cmd_adr);
                         chip->state = FL_STATUS;
@@ -1257,27 +1279,6 @@ static int inval_cache_and_wait_for_operation(
                         timeo--;
                 }
                 mutex_lock(&chip->mutex);
-
-                while (chip->state != chip_state) {
-                        /* Someone's suspended the operation: sleep */
-                        DECLARE_WAITQUEUE(wait, current);
-                        set_current_state(TASK_UNINTERRUPTIBLE);
-                        add_wait_queue(&chip->wq, &wait);
-                        mutex_unlock(&chip->mutex);
-                        schedule();
-                        remove_wait_queue(&chip->wq, &wait);
-                        mutex_lock(&chip->mutex);
-                }
-                if (chip->erase_suspended && chip_state == FL_ERASING)  {
-                        /* Erase suspend occured while sleep: reset timeout */
-                        timeo = reset_timeo;
-                        chip->erase_suspended = 0;
-                }
-                if (chip->write_suspended && chip_state == FL_WRITING)  {
-                        /* Write suspend occured while sleep: reset timeout */
-                        timeo = reset_timeo;
-                        chip->write_suspended = 0;
-                }
         }
 
         /* Done and happy. */
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index d72a5fb2d041..4e1be51cc122 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -1935,14 +1935,14 @@ static void jedec_reset(u32 base, struct map_info *map, struct cfi_private *cfi)
 }
 
 
-static int cfi_jedec_setup(struct cfi_private *p_cfi, int index)
+static int cfi_jedec_setup(struct map_info *map, struct cfi_private *cfi, int index)
 {
         int i,num_erase_regions;
         uint8_t uaddr;
 
-        if (! (jedec_table[index].devtypes & p_cfi->device_type)) {
+        if (!(jedec_table[index].devtypes & cfi->device_type)) {
                 DEBUG(MTD_DEBUG_LEVEL1, "Rejecting potential %s with incompatible %d-bit device type\n",
-                      jedec_table[index].name, 4 * (1<<p_cfi->device_type));
+                      jedec_table[index].name, 4 * (1<<cfi->device_type));
                 return 0;
         }
 
@@ -1950,27 +1950,28 @@ static int cfi_jedec_setup(struct cfi_private *p_cfi, int index)
 
         num_erase_regions = jedec_table[index].nr_regions;
 
-        p_cfi->cfiq = kmalloc(sizeof(struct cfi_ident) + num_erase_regions * 4, GFP_KERNEL);
-        if (!p_cfi->cfiq) {
+        cfi->cfiq = kmalloc(sizeof(struct cfi_ident) + num_erase_regions * 4, GFP_KERNEL);
+        if (!cfi->cfiq) {
                 //xx printk(KERN_WARNING "%s: kmalloc failed for CFI ident structure\n", map->name);
                 return 0;
         }
 
-        memset(p_cfi->cfiq,0,sizeof(struct cfi_ident));
+        memset(cfi->cfiq, 0, sizeof(struct cfi_ident));
 
-        p_cfi->cfiq->P_ID = jedec_table[index].cmd_set;
-        p_cfi->cfiq->NumEraseRegions = jedec_table[index].nr_regions;
-        p_cfi->cfiq->DevSize = jedec_table[index].dev_size;
-        p_cfi->cfi_mode = CFI_MODE_JEDEC;
+        cfi->cfiq->P_ID = jedec_table[index].cmd_set;
+        cfi->cfiq->NumEraseRegions = jedec_table[index].nr_regions;
+        cfi->cfiq->DevSize = jedec_table[index].dev_size;
+        cfi->cfi_mode = CFI_MODE_JEDEC;
+        cfi->sector_erase_cmd = CMD(0x30);
 
         for (i=0; i<num_erase_regions; i++){
-                p_cfi->cfiq->EraseRegionInfo[i] = jedec_table[index].regions[i];
+                cfi->cfiq->EraseRegionInfo[i] = jedec_table[index].regions[i];
         }
-        p_cfi->cmdset_priv = NULL;
+        cfi->cmdset_priv = NULL;
 
         /* This may be redundant for some cases, but it doesn't hurt */
-        p_cfi->mfr = jedec_table[index].mfr_id;
-        p_cfi->id = jedec_table[index].dev_id;
+        cfi->mfr = jedec_table[index].mfr_id;
+        cfi->id = jedec_table[index].dev_id;
 
         uaddr = jedec_table[index].uaddr;
 
@@ -1978,8 +1979,8 @@ static int cfi_jedec_setup(struct cfi_private *p_cfi, int index)
            our brains explode when we see the datasheets talking about address
            lines numbered from A-1 to A18. The CFI table has unlock addresses
            in device-words according to the mode the device is connected in */
-        p_cfi->addr_unlock1 = unlock_addrs[uaddr].addr1 / p_cfi->device_type;
-        p_cfi->addr_unlock2 = unlock_addrs[uaddr].addr2 / p_cfi->device_type;
+        cfi->addr_unlock1 = unlock_addrs[uaddr].addr1 / cfi->device_type;
+        cfi->addr_unlock2 = unlock_addrs[uaddr].addr2 / cfi->device_type;
 
         return 1;       /* ok */
 }
@@ -2175,7 +2176,7 @@ static int jedec_probe_chip(struct map_info *map, __u32 base,
                                        "MTD %s(): matched device 0x%x,0x%x unlock_addrs: 0x%.4x 0x%.4x\n",
                                        __func__, cfi->mfr, cfi->id,
                                        cfi->addr_unlock1, cfi->addr_unlock2 );
-                                if (!cfi_jedec_setup(cfi, i))
+                                if (!cfi_jedec_setup(map, cfi, i))
                                         return 0;
                                 goto ok_out;
                         }
diff --git a/drivers/mtd/maps/amd76xrom.c b/drivers/mtd/maps/amd76xrom.c
index 77d64ce19e9f..92de7e3a49a5 100644
--- a/drivers/mtd/maps/amd76xrom.c
+++ b/drivers/mtd/maps/amd76xrom.c
@@ -151,6 +151,7 @@ static int __devinit amd76xrom_init_one (struct pci_dev *pdev,
                 printk(KERN_ERR MOD_NAME
                        " %s(): Unable to register resource %pR - kernel bug?\n",
                        __func__, &window->rsrc);
+                return -EBUSY;
         }
 
 
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index cb20c67995d8..e0a2373bf0e2 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -413,7 +413,6 @@ error3:
 error2:
         list_del(&new->list);
 error1:
-        kfree(new);
         return ret;
 }
 
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index 15682ec8530e..28af71c61834 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -968,6 +968,6 @@ static void __exit omap_nand_exit(void)
 module_init(omap_nand_init);
 module_exit(omap_nand_exit);
 
-MODULE_ALIAS(DRIVER_NAME);
+MODULE_ALIAS("platform:" DRIVER_NAME);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Glue layer for NAND flash on TI OMAP boards");
diff --git a/drivers/mtd/onenand/generic.c b/drivers/mtd/onenand/generic.c
index e78914938c5c..ac08750748a3 100644
--- a/drivers/mtd/onenand/generic.c
+++ b/drivers/mtd/onenand/generic.c
@@ -131,7 +131,7 @@ static struct platform_driver generic_onenand_driver = {
         .remove         = __devexit_p(generic_onenand_remove),
 };
 
-MODULE_ALIAS(DRIVER_NAME);
+MODULE_ALIAS("platform:" DRIVER_NAME);
 
 static int __init generic_onenand_init(void)
 {
diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c
index ac31f461cc1c..c849cacf4b2f 100644
--- a/drivers/mtd/onenand/omap2.c
+++ b/drivers/mtd/onenand/omap2.c
@@ -860,7 +860,7 @@ static void __exit omap2_onenand_exit(void)
 module_init(omap2_onenand_init);
 module_exit(omap2_onenand_exit);
 
-MODULE_ALIAS(DRIVER_NAME);
+MODULE_ALIAS("platform:" DRIVER_NAME);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Jarkko Lavinen <jarkko.lavinen@nokia.com>");
 MODULE_DESCRIPTION("Glue layer for OneNAND flash on OMAP2 / OMAP3");
diff --git a/drivers/net/ariadne.c b/drivers/net/ariadne.c
index 39214e512452..7ca0eded2561 100644
--- a/drivers/net/ariadne.c
+++ b/drivers/net/ariadne.c
@@ -425,11 +425,6 @@ static irqreturn_t ariadne_interrupt(int irq, void *data)
     int csr0, boguscnt;
     int handled = 0;
 
-    if (dev == NULL) {
-        printk(KERN_WARNING "ariadne_interrupt(): irq for unknown device.\n");
-        return IRQ_NONE;
-    }
-
     lance->RAP = CSR0;                  /* PCnet-ISA Controller Status */
 
     if (!(lance->RDP & INTR))           /* Check if any interrupt has been */
diff --git a/drivers/net/bnx2x/bnx2x.h b/drivers/net/bnx2x/bnx2x.h
index 653c62475cb6..8849699c66c4 100644
--- a/drivers/net/bnx2x/bnx2x.h
+++ b/drivers/net/bnx2x/bnx2x.h
@@ -22,7 +22,7 @@
  * (you will need to reboot afterwards) */
 /* #define BNX2X_STOP_ON_ERROR */
 
-#define DRV_MODULE_VERSION      "1.62.00-5"
+#define DRV_MODULE_VERSION      "1.62.00-6"
 #define DRV_MODULE_RELDATE      "2011/01/30"
 #define BNX2X_BC_VER            0x040200
 
@@ -1211,6 +1211,7 @@ struct bnx2x {
         /* DCBX Negotation results */
         struct dcbx_features                    dcbx_local_feat;
         u32                                     dcbx_error;
+        u32                                     pending_max;
 };
 
 /**
@@ -1613,19 +1614,23 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 #define BNX2X_BTR                       4
 #define MAX_SPQ_PENDING                 8
 
-
-/* CMNG constants
-   derived from lab experiments, and not from system spec calculations !!! */
-#define DEF_MIN_RATE                    100
-/* resolution of the rate shaping timer - 100 usec */
-#define RS_PERIODIC_TIMEOUT_USEC        100
-/* resolution of fairness algorithm in usecs -
-   coefficient for calculating the actual t fair */
-#define T_FAIR_COEF                     10000000
+/* CMNG constants, as derived from system spec calculations */
+/* default MIN rate in case VNIC min rate is configured to zero - 100Mbps */
+#define DEF_MIN_RATE                                    100
+/* resolution of the rate shaping timer - 400 usec */
+#define RS_PERIODIC_TIMEOUT_USEC                        400
 /* number of bytes in single QM arbitration cycle -
-   coefficient for calculating the fairness timer */
-#define QM_ARB_BYTES                    40000
-#define FAIR_MEM                        2
+ * coefficient for calculating the fairness timer */
+#define QM_ARB_BYTES                                    160000
+/* resolution of Min algorithm 1:100 */
+#define MIN_RES                                         100
+/* how many bytes above threshold for the minimal credit of Min algorithm*/
+#define MIN_ABOVE_THRESH                                32768
+/* Fairness algorithm integration time coefficient -
+ * for calculating the actual Tfair */
+#define T_FAIR_COEF     ((MIN_ABOVE_THRESH +  QM_ARB_BYTES) * 8 * MIN_RES)
+/* Memory of fairness algorithm . 2 cycles */
+#define FAIR_MEM                                        2
 
 
 #define ATTN_NIG_FOR_FUNC               (1L << 8)
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index 710ce5d04c53..a71b32940533 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -259,10 +259,44 @@ static void bnx2x_tpa_start(struct bnx2x_fastpath *fp, u16 queue,
 #endif
 }
 
+/* Timestamp option length allowed for TPA aggregation:
+ *
+ *              nop nop kind length echo val
+ */
+#define TPA_TSTAMP_OPT_LEN      12
+/**
+ * Calculate the approximate value of the MSS for this
+ * aggregation using the first packet of it.
+ *
+ * @param bp
+ * @param parsing_flags Parsing flags from the START CQE
+ * @param len_on_bd Total length of the first packet for the
+ *                   aggregation.
+ */
+static inline u16 bnx2x_set_lro_mss(struct bnx2x *bp, u16 parsing_flags,
+                                    u16 len_on_bd)
+{
+        /* TPA arrgregation won't have an IP options and TCP options
+         * other than timestamp.
+         */
+        u16 hdrs_len = ETH_HLEN + sizeof(struct iphdr) + sizeof(struct tcphdr);
+
+
+        /* Check if there was a TCP timestamp, if there is it's will
+         * always be 12 bytes length: nop nop kind length echo val.
+         *
+         * Otherwise FW would close the aggregation.
+         */
+        if (parsing_flags & PARSING_FLAGS_TIME_STAMP_EXIST_FLAG)
+                hdrs_len += TPA_TSTAMP_OPT_LEN;
+
+        return len_on_bd - hdrs_len;
+}
+
 static int bnx2x_fill_frag_skb(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                                struct sk_buff *skb,
                                struct eth_fast_path_rx_cqe *fp_cqe,
-                               u16 cqe_idx)
+                               u16 cqe_idx, u16 parsing_flags)
 {
         struct sw_rx_page *rx_pg, old_rx_pg;
         u16 len_on_bd = le16_to_cpu(fp_cqe->len_on_bd);
@@ -275,8 +309,8 @@ static int bnx2x_fill_frag_skb(struct bnx2x *bp, struct bnx2x_fastpath *fp,
 
         /* This is needed in order to enable forwarding support */
         if (frag_size)
-                skb_shinfo(skb)->gso_size = min((u32)SGE_PAGE_SIZE,
-                                               max(frag_size, (u32)len_on_bd));
+                skb_shinfo(skb)->gso_size = bnx2x_set_lro_mss(bp, parsing_flags,
+                                                              len_on_bd);
 
 #ifdef BNX2X_STOP_ON_ERROR
         if (pages > min_t(u32, 8, MAX_SKB_FRAGS)*SGE_PAGE_SIZE*PAGES_PER_SGE) {
@@ -344,6 +378,8 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
         if (likely(new_skb)) {
                 /* fix ip xsum and give it to the stack */
                 /* (no need to map the new skb) */
+                u16 parsing_flags =
+                        le16_to_cpu(cqe->fast_path_cqe.pars_flags.flags);
 
                 prefetch(skb);
                 prefetch(((char *)(skb)) + L1_CACHE_BYTES);
@@ -373,9 +409,9 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                 }
 
                 if (!bnx2x_fill_frag_skb(bp, fp, skb,
-                                         &cqe->fast_path_cqe, cqe_idx)) {
-                        if ((le16_to_cpu(cqe->fast_path_cqe.
-                            pars_flags.flags) & PARSING_FLAGS_VLAN))
+                                         &cqe->fast_path_cqe, cqe_idx,
+                                         parsing_flags)) {
+                        if (parsing_flags & PARSING_FLAGS_VLAN)
                                 __vlan_hwaccel_put_tag(skb,
                                                  le16_to_cpu(cqe->fast_path_cqe.
                                                              vlan_tag));
@@ -703,19 +739,20 @@ u16 bnx2x_get_mf_speed(struct bnx2x *bp)
 {
         u16 line_speed = bp->link_vars.line_speed;
         if (IS_MF(bp)) {
-                u16 maxCfg = (bp->mf_config[BP_VN(bp)] &
-                                                FUNC_MF_CFG_MAX_BW_MASK) >>
-                                                FUNC_MF_CFG_MAX_BW_SHIFT;
-                /* Calculate the current MAX line speed limit for the DCC
-                 * capable devices
+                u16 maxCfg = bnx2x_extract_max_cfg(bp,
+                                                   bp->mf_config[BP_VN(bp)]);
+
+                /* Calculate the current MAX line speed limit for the MF
+                 * devices
                  */
-                if (IS_MF_SD(bp)) {
+                if (IS_MF_SI(bp))
+                        line_speed = (line_speed * maxCfg) / 100;
+                else { /* SD mode */
                         u16 vn_max_rate = maxCfg * 100;
 
                         if (vn_max_rate < line_speed)
                                 line_speed = vn_max_rate;
-                } else /* IS_MF_SI(bp)) */
-                        line_speed = (line_speed * maxCfg) / 100;
+                }
         }
 
         return line_speed;
@@ -959,6 +996,23 @@ void bnx2x_free_skbs(struct bnx2x *bp)
         bnx2x_free_rx_skbs(bp);
 }
 
+void bnx2x_update_max_mf_config(struct bnx2x *bp, u32 value)
+{
+        /* load old values */
+        u32 mf_cfg = bp->mf_config[BP_VN(bp)];
+
+        if (value != bnx2x_extract_max_cfg(bp, mf_cfg)) {
+                /* leave all but MAX value */
+                mf_cfg &= ~FUNC_MF_CFG_MAX_BW_MASK;
+
+                /* set new MAX value */
+                mf_cfg |= (value << FUNC_MF_CFG_MAX_BW_SHIFT)
+                                & FUNC_MF_CFG_MAX_BW_MASK;
+
+                bnx2x_fw_command(bp, DRV_MSG_CODE_SET_MF_BW, mf_cfg);
+        }
+}
+
 static void bnx2x_free_msix_irqs(struct bnx2x *bp)
 {
         int i, offset = 1;
@@ -1427,6 +1481,11 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
 
         bnx2x_set_eth_mac(bp, 1);
 
+        if (bp->pending_max) {
+                bnx2x_update_max_mf_config(bp, bp->pending_max);
+                bp->pending_max = 0;
+        }
+
         if (bp->port.pmf)
                 bnx2x_initial_phy_init(bp, load_mode);
 
diff --git a/drivers/net/bnx2x/bnx2x_cmn.h b/drivers/net/bnx2x/bnx2x_cmn.h
index 03eb4d68e6bb..85ea7f26b51f 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/bnx2x/bnx2x_cmn.h
@@ -341,6 +341,15 @@ void bnx2x_dcbx_init(struct bnx2x *bp);
  */
 int bnx2x_set_power_state(struct bnx2x *bp, pci_power_t state);
 
+/**
+ * Updates MAX part of MF configuration in HW
+ * (if required)
+ *
+ * @param bp
+ * @param value
+ */
+void bnx2x_update_max_mf_config(struct bnx2x *bp, u32 value);
+
 /* dev_close main block */
 int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode);
 
@@ -1044,4 +1053,24 @@ static inline void storm_memset_cmng(struct bnx2x *bp,
 void bnx2x_acquire_phy_lock(struct bnx2x *bp);
 void bnx2x_release_phy_lock(struct bnx2x *bp);
 
+/**
+ * Extracts MAX BW part from MF configuration.
+ *
+ * @param bp
+ * @param mf_cfg
+ *
+ * @return u16
+ */
+static inline u16 bnx2x_extract_max_cfg(struct bnx2x *bp, u32 mf_cfg)
+{
+        u16 max_cfg = (mf_cfg & FUNC_MF_CFG_MAX_BW_MASK) >>
+                              FUNC_MF_CFG_MAX_BW_SHIFT;
+        if (!max_cfg) {
+                BNX2X_ERR("Illegal configuration detected for Max BW - "
+                          "using 100 instead\n");
+                max_cfg = 100;
+        }
+        return max_cfg;
+}
+
 #endif /* BNX2X_CMN_H */
diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
index 5b44a8b48509..7e92f9d0dcfd 100644
--- a/drivers/net/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/bnx2x/bnx2x_ethtool.c
@@ -238,7 +238,7 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
         speed |= (cmd->speed_hi << 16);
 
         if (IS_MF_SI(bp)) {
-                u32 param = 0;
+                u32 part;
                 u32 line_speed = bp->link_vars.line_speed;
 
                 /* use 10G if no link detected */
@@ -251,23 +251,22 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                                        REQ_BC_VER_4_SET_MF_BW);
                         return -EINVAL;
                 }
-                if (line_speed < speed) {
-                        BNX2X_DEV_INFO("New speed should be less or equal "
-                                       "to actual line speed\n");
+
+                part = (speed * 100) / line_speed;
+
+                if (line_speed < speed || !part) {
+                        BNX2X_DEV_INFO("Speed setting should be in a range "
+                                       "from 1%% to 100%% "
+                                       "of actual line speed\n");
                         return -EINVAL;
                 }
-                /* load old values */
-                param = bp->mf_config[BP_VN(bp)];
-
-                /* leave only MIN value */
-                param &= FUNC_MF_CFG_MIN_BW_MASK;
 
-                /* set new MAX value */
-                param |= (((speed * 100) / line_speed)
-                                 << FUNC_MF_CFG_MAX_BW_SHIFT)
-                                  & FUNC_MF_CFG_MAX_BW_MASK;
+                if (bp->state != BNX2X_STATE_OPEN)
+                        /* store value for following "load" */
+                        bp->pending_max = part;
+                else
+                        bnx2x_update_max_mf_config(bp, part);
 
-                bnx2x_fw_command(bp, DRV_MSG_CODE_SET_MF_BW, param);
                 return 0;
         }
 
@@ -1781,9 +1780,7 @@ static int bnx2x_test_nvram(struct bnx2x *bp)
                 { 0x100, 0x350 }, /* manuf_info */
                 { 0x450,  0xf0 }, /* feature_info */
                 { 0x640,  0x64 }, /* upgrade_key_info */
-                { 0x6a4,  0x64 },
                 { 0x708,  0x70 }, /* manuf_key_info */
-                { 0x778,  0x70 },
                 {     0,     0 }
         };
         __be32 buf[0x350 / 4];
@@ -1933,11 +1930,11 @@ static void bnx2x_self_test(struct net_device *dev,
                 buf[4] = 1;
                 etest->flags |= ETH_TEST_FL_FAILED;
         }
-        if (bp->port.pmf)
-                if (bnx2x_link_test(bp, is_serdes) != 0) {
-                        buf[5] = 1;
-                        etest->flags |= ETH_TEST_FL_FAILED;
-                }
+
+        if (bnx2x_link_test(bp, is_serdes) != 0) {
+                buf[5] = 1;
+                etest->flags |= ETH_TEST_FL_FAILED;
+        }
 
 #ifdef BNX2X_EXTRA_DEBUG
         bnx2x_panic_dump(bp);
diff --git a/drivers/net/bnx2x/bnx2x_init.h b/drivers/net/bnx2x/bnx2x_init.h
index 5a268e9a0895..fa6dbe3f2058 100644
--- a/drivers/net/bnx2x/bnx2x_init.h
+++ b/drivers/net/bnx2x/bnx2x_init.h
@@ -241,7 +241,7 @@ static const struct {
         /* Block IGU, MISC, PXP and PXP2 parity errors as long as we don't
          * want to handle "system kill" flow at the moment.
          */
-        BLOCK_PRTY_INFO(PXP, 0x3ffffff, 0x3ffffff, 0x3ffffff, 0x3ffffff),
+        BLOCK_PRTY_INFO(PXP, 0x7ffffff, 0x3ffffff, 0x3ffffff, 0x7ffffff),
         BLOCK_PRTY_INFO_0(PXP2, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff),
         BLOCK_PRTY_INFO_1(PXP2, 0x7ff, 0x7f, 0x7f, 0x7ff),
         BLOCK_PRTY_INFO(HC, 0x7, 0x7, 0x7, 0),
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index d584d32c747d..aa032339e321 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -1974,13 +1974,22 @@ static void bnx2x_init_vn_minmax(struct bnx2x *bp, int vn)
                 vn_max_rate = 0;
 
         } else {
+                u32 maxCfg = bnx2x_extract_max_cfg(bp, vn_cfg);
+
                 vn_min_rate = ((vn_cfg & FUNC_MF_CFG_MIN_BW_MASK) >>
                                 FUNC_MF_CFG_MIN_BW_SHIFT) * 100;
-                /* If min rate is zero - set it to 1 */
+                /* If fairness is enabled (not all min rates are zeroes) and
+                   if current min rate is zero - set it to 1.
+                   This is a requirement of the algorithm. */
                 if (bp->vn_weight_sum && (vn_min_rate == 0))
                         vn_min_rate = DEF_MIN_RATE;
-                vn_max_rate = ((vn_cfg & FUNC_MF_CFG_MAX_BW_MASK) >>
-                                FUNC_MF_CFG_MAX_BW_SHIFT) * 100;
+
+                if (IS_MF_SI(bp))
+                        /* maxCfg in percents of linkspeed */
+                        vn_max_rate = (bp->link_vars.line_speed * maxCfg) / 100;
+                else
+                        /* maxCfg is absolute in 100Mb units */
+                        vn_max_rate = maxCfg * 100;
         }
 
         DP(NETIF_MSG_IFUP,
@@ -2006,7 +2015,8 @@ static void bnx2x_init_vn_minmax(struct bnx2x *bp, int vn)
                 m_fair_vn.vn_credit_delta =
                         max_t(u32, (vn_min_rate * (T_FAIR_COEF /
                                                    (8 * bp->vn_weight_sum))),
-                              (bp->cmng.fair_vars.fair_threshold * 2));
+                              (bp->cmng.fair_vars.fair_threshold +
+                                                        MIN_ABOVE_THRESH));
                 DP(NETIF_MSG_IFUP, "m_fair_vn.vn_credit_delta %d\n",
                    m_fair_vn.vn_credit_delta);
         }
@@ -2082,8 +2092,9 @@ static void bnx2x_cmng_fns_init(struct bnx2x *bp, u8 read_cfg, u8 cmng_type)
                 bnx2x_calc_vn_weight_sum(bp);
 
                 /* calculate and set min-max rate for each vn */
-                for (vn = VN_0; vn < E1HVN_MAX; vn++)
-                        bnx2x_init_vn_minmax(bp, vn);
+                if (bp->port.pmf)
+                        for (vn = VN_0; vn < E1HVN_MAX; vn++)
+                                bnx2x_init_vn_minmax(bp, vn);
 
                 /* always enable rate shaping and fairness */
                 bp->cmng.flags.cmng_enables |=
@@ -2152,13 +2163,6 @@ static void bnx2x_link_attn(struct bnx2x *bp)
                         bnx2x_stats_handle(bp, STATS_EVENT_LINK_UP);
         }
 
-        /* indicate link status only if link status actually changed */
-        if (prev_link_status != bp->link_vars.link_status)
-                bnx2x_link_report(bp);
-
-        if (IS_MF(bp))
-                bnx2x_link_sync_notify(bp);
-
         if (bp->link_vars.link_up && bp->link_vars.line_speed) {
                 int cmng_fns = bnx2x_get_cmng_fns_mode(bp);
 
@@ -2170,6 +2174,13 @@ static void bnx2x_link_attn(struct bnx2x *bp)
                         DP(NETIF_MSG_IFUP,
                            "single function mode without fairness\n");
         }
+
+        if (IS_MF(bp))
+                bnx2x_link_sync_notify(bp);
+
+        /* indicate link status only if link status actually changed */
+        if (prev_link_status != bp->link_vars.link_status)
+                bnx2x_link_report(bp);
 }
 
 void bnx2x__link_status_update(struct bnx2x *bp)
diff --git a/drivers/net/bnx2x/bnx2x_stats.c b/drivers/net/bnx2x/bnx2x_stats.c
index bda60d590fa8..3445ded6674f 100644
--- a/drivers/net/bnx2x/bnx2x_stats.c
+++ b/drivers/net/bnx2x/bnx2x_stats.c
@@ -1239,14 +1239,14 @@ void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event)
         if (unlikely(bp->panic))
                 return;
 
+        bnx2x_stats_stm[bp->stats_state][event].action(bp);
+
         /* Protect a state change flow */
         spin_lock_bh(&bp->stats_lock);
         state = bp->stats_state;
         bp->stats_state = bnx2x_stats_stm[state][event].next_state;
         spin_unlock_bh(&bp->stats_lock);
 
-        bnx2x_stats_stm[state][event].action(bp);
-
         if ((event != STATS_EVENT_UPDATE) || netif_msg_timer(bp))
                 DP(BNX2X_MSG_STATS, "state %d -> event %d -> state %d\n",
                    state, event, bp->stats_state);
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 1024ae158227..a5d5d0b5b155 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -281,23 +281,23 @@ static inline int __check_agg_selection_timer(struct port *port)
 }
 
 /**
- * __get_rx_machine_lock - lock the port's RX machine
+ * __get_state_machine_lock - lock the port's state machines
  * @port: the port we're looking at
  *
  */
-static inline void __get_rx_machine_lock(struct port *port)
+static inline void __get_state_machine_lock(struct port *port)
 {
-        spin_lock_bh(&(SLAVE_AD_INFO(port->slave).rx_machine_lock));
+        spin_lock_bh(&(SLAVE_AD_INFO(port->slave).state_machine_lock));
 }
 
 /**
- * __release_rx_machine_lock - unlock the port's RX machine
+ * __release_state_machine_lock - unlock the port's state machines
  * @port: the port we're looking at
  *
  */
-static inline void __release_rx_machine_lock(struct port *port)
+static inline void __release_state_machine_lock(struct port *port)
 {
-        spin_unlock_bh(&(SLAVE_AD_INFO(port->slave).rx_machine_lock));
+        spin_unlock_bh(&(SLAVE_AD_INFO(port->slave).state_machine_lock));
 }
 
 /**
@@ -388,14 +388,14 @@ static u8 __get_duplex(struct port *port)
 }
 
 /**
- * __initialize_port_locks - initialize a port's RX machine spinlock
+ * __initialize_port_locks - initialize a port's STATE machine spinlock
  * @port: the port we're looking at
  *
  */
 static inline void __initialize_port_locks(struct port *port)
 {
         // make sure it isn't called twice
-        spin_lock_init(&(SLAVE_AD_INFO(port->slave).rx_machine_lock));
+        spin_lock_init(&(SLAVE_AD_INFO(port->slave).state_machine_lock));
 }
 
 //conversions
@@ -1025,9 +1025,6 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
 {
         rx_states_t last_state;
 
-        // Lock to prevent 2 instances of this function to run simultaneously(rx interrupt and periodic machine callback)
-        __get_rx_machine_lock(port);
-
         // keep current State Machine state to compare later if it was changed
         last_state = port->sm_rx_state;
 
@@ -1133,7 +1130,6 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
                                 pr_err("%s: An illegal loopback occurred on adapter (%s).\n"
                                        "Check the configuration to verify that all adapters are connected to 802.3ad compliant switch ports\n",
                                        port->slave->dev->master->name, port->slave->dev->name);
-                                __release_rx_machine_lock(port);
                                 return;
                         }
                         __update_selected(lacpdu, port);
@@ -1153,7 +1149,6 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
                         break;
                 }
         }
-        __release_rx_machine_lock(port);
 }
 
 /**
@@ -2155,6 +2150,12 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
                         goto re_arm;
                 }
 
+                /* Lock around state machines to protect data accessed
+                 * by all (e.g., port->sm_vars).  ad_rx_machine may run
+                 * concurrently due to incoming LACPDU.
+                 */
+                __get_state_machine_lock(port);
+
                 ad_rx_machine(NULL, port);
                 ad_periodic_machine(port);
                 ad_port_selection_logic(port);
@@ -2164,6 +2165,8 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
                 // turn off the BEGIN bit, since we already handled it
                 if (port->sm_vars & AD_PORT_BEGIN)
                         port->sm_vars &= ~AD_PORT_BEGIN;
+
+                __release_state_machine_lock(port);
         }
 
 re_arm:
@@ -2200,7 +2203,10 @@ static void bond_3ad_rx_indication(struct lacpdu *lacpdu, struct slave *slave, u
                 case AD_TYPE_LACPDU:
                         pr_debug("Received LACPDU on port %d\n",
                                  port->actor_port_number);
+                        /* Protect against concurrent state machines */
+                        __get_state_machine_lock(port);
                         ad_rx_machine(lacpdu, port);
+                        __release_state_machine_lock(port);
                         break;
 
                 case AD_TYPE_MARKER:
diff --git a/drivers/net/bonding/bond_3ad.h b/drivers/net/bonding/bond_3ad.h
index 2c46a154f2c6..b28baff70864 100644
--- a/drivers/net/bonding/bond_3ad.h
+++ b/drivers/net/bonding/bond_3ad.h
@@ -264,7 +264,8 @@ struct ad_bond_info {
 struct ad_slave_info {
         struct aggregator aggregator;       // 802.3ad aggregator structure
         struct port port;                   // 802.3ad port structure
-        spinlock_t rx_machine_lock; // To avoid race condition between callback and receive interrupt
+        spinlock_t state_machine_lock; /* mutex state machines vs.
+                                          incoming LACPDU */
         u16 id;
 };
 
diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c
index 5157e15e96eb..aeea9f9ff6e8 100644
--- a/drivers/net/can/softing/softing_main.c
+++ b/drivers/net/can/softing/softing_main.c
@@ -633,6 +633,7 @@ static const struct net_device_ops softing_netdev_ops = {
 };
 
 static const struct can_bittiming_const softing_btr_const = {
+        .name = "softing",
         .tseg1_min = 1,
         .tseg1_max = 16,
         .tseg2_min = 1,
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 7ff170cbc7dc..302be4aa69d6 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -2760,6 +2760,8 @@ static u32 cnic_service_bnx2_queues(struct cnic_dev *dev)
         u32 status_idx = (u16) *cp->kcq1.status_idx_ptr;
         int kcqe_cnt;
 
+        /* status block index must be read before reading other fields */
+        rmb();
         cp->kwq_con_idx = *cp->kwq_con_idx_ptr;
 
         while ((kcqe_cnt = cnic_get_kcqes(dev, &cp->kcq1))) {
@@ -2770,6 +2772,8 @@ static u32 cnic_service_bnx2_queues(struct cnic_dev *dev)
                 barrier();
                 if (status_idx != *cp->kcq1.status_idx_ptr) {
                         status_idx = (u16) *cp->kcq1.status_idx_ptr;
+                        /* status block index must be read first */
+                        rmb();
                         cp->kwq_con_idx = *cp->kwq_con_idx_ptr;
                 } else
                         break;
@@ -2888,6 +2892,8 @@ static u32 cnic_service_bnx2x_kcq(struct cnic_dev *dev, struct kcq_info *info)
         u32 last_status = *info->status_idx_ptr;
         int kcqe_cnt;
 
+        /* status block index must be read before reading the KCQ */
+        rmb();
         while ((kcqe_cnt = cnic_get_kcqes(dev, info))) {
 
                 service_kcqes(dev, kcqe_cnt);
@@ -2898,6 +2904,8 @@ static u32 cnic_service_bnx2x_kcq(struct cnic_dev *dev, struct kcq_info *info)
                         break;
 
                 last_status = *info->status_idx_ptr;
+                /* status block index must be read before reading the KCQ */
+                rmb();
         }
         return last_status;
 }
@@ -2906,26 +2914,35 @@ static void cnic_service_bnx2x_bh(unsigned long data)
 {
         struct cnic_dev *dev = (struct cnic_dev *) data;
         struct cnic_local *cp = dev->cnic_priv;
-        u32 status_idx;
+        u32 status_idx, new_status_idx;
 
         if (unlikely(!test_bit(CNIC_F_CNIC_UP, &dev->flags)))
                 return;
 
-        status_idx = cnic_service_bnx2x_kcq(dev, &cp->kcq1);
+        while (1) {
+                status_idx = cnic_service_bnx2x_kcq(dev, &cp->kcq1);
 
-        CNIC_WR16(dev, cp->kcq1.io_addr, cp->kcq1.sw_prod_idx + MAX_KCQ_IDX);
+                CNIC_WR16(dev, cp->kcq1.io_addr,
+                          cp->kcq1.sw_prod_idx + MAX_KCQ_IDX);
 
-        if (BNX2X_CHIP_IS_E2(cp->chip_id)) {
-                status_idx = cnic_service_bnx2x_kcq(dev, &cp->kcq2);
+                if (!BNX2X_CHIP_IS_E2(cp->chip_id)) {
+                        cnic_ack_bnx2x_int(dev, cp->bnx2x_igu_sb_id, USTORM_ID,
+                                           status_idx, IGU_INT_ENABLE, 1);
+                        break;
+                }
+
+                new_status_idx = cnic_service_bnx2x_kcq(dev, &cp->kcq2);
+
+                if (new_status_idx != status_idx)
+                        continue;
 
                 CNIC_WR16(dev, cp->kcq2.io_addr, cp->kcq2.sw_prod_idx +
                           MAX_KCQ_IDX);
 
                 cnic_ack_igu_sb(dev, cp->bnx2x_igu_sb_id, IGU_SEG_ACCESS_DEF,
                                 status_idx, IGU_INT_ENABLE, 1);
-        } else {
-                cnic_ack_bnx2x_int(dev, cp->bnx2x_igu_sb_id, USTORM_ID,
-                                   status_idx, IGU_INT_ENABLE, 1);
+
+                break;
         }
 }
 
diff --git a/drivers/net/davinci_emac.c b/drivers/net/davinci_emac.c
index 2a628d17d178..7018bfe408a4 100644
--- a/drivers/net/davinci_emac.c
+++ b/drivers/net/davinci_emac.c
@@ -1008,7 +1008,7 @@ static void emac_rx_handler(void *token, int len, int status)
         int                     ret;
 
         /* free and bail if we are shutting down */
-        if (unlikely(!netif_running(ndev))) {
+        if (unlikely(!netif_running(ndev) || !netif_carrier_ok(ndev))) {
                 dev_kfree_skb_any(skb);
                 return;
         }
diff --git a/drivers/net/dnet.c b/drivers/net/dnet.c
index 9d8a20b72fa9..8318ea06cb6d 100644
--- a/drivers/net/dnet.c
+++ b/drivers/net/dnet.c
@@ -337,8 +337,6 @@ static int dnet_mii_init(struct dnet *bp)
         for (i = 0; i < PHY_MAX_ADDR; i++)
                 bp->mii_bus->irq[i] = PHY_POLL;
 
-        platform_set_drvdata(bp->dev, bp->mii_bus);
-
         if (mdiobus_register(bp->mii_bus)) {
                 err = -ENXIO;
                 goto err_out_free_mdio_irq;
@@ -863,6 +861,7 @@ static int __devinit dnet_probe(struct platform_device *pdev)
         bp = netdev_priv(dev);
         bp->dev = dev;
 
+        platform_set_drvdata(pdev, dev);
         SET_NETDEV_DEV(dev, &pdev->dev);
 
         spin_lock_init(&bp->lock);
diff --git a/drivers/net/e1000/e1000_osdep.h b/drivers/net/e1000/e1000_osdep.h
index 55c1711f1688..33e7c45a4fe4 100644
--- a/drivers/net/e1000/e1000_osdep.h
+++ b/drivers/net/e1000/e1000_osdep.h
@@ -42,7 +42,8 @@
 #define GBE_CONFIG_RAM_BASE \
         ((unsigned int)(CONFIG_RAM_BASE + GBE_CONFIG_OFFSET))
 
-#define GBE_CONFIG_BASE_VIRT    phys_to_virt(GBE_CONFIG_RAM_BASE)
+#define GBE_CONFIG_BASE_VIRT \
+        ((void __iomem *)phys_to_virt(GBE_CONFIG_RAM_BASE))
 
 #define GBE_CONFIG_FLASH_WRITE(base, offset, count, data) \
         (iowrite16_rep(base + offset, data, count))
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 3fa110ddb041..2e5022849f18 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -5967,7 +5967,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
                 /* APME bit in EEPROM is mapped to WUC.APME */
                 eeprom_data = er32(WUC);
                 eeprom_apme_mask = E1000_WUC_APME;
-                if (eeprom_data & E1000_WUC_PHY_WAKE)
+                if ((hw->mac.type > e1000_ich10lan) &&
+                    (eeprom_data & E1000_WUC_PHY_WAKE))
                         adapter->flags2 |= FLAG2_HAS_PHY_WAKEUP;
         } else if (adapter->flags & FLAG_APME_IN_CTRL3) {
                 if (adapter->flags & FLAG_APME_CHECK_PORT_B &&
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 2a71373719ae..cd0282d5d40f 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -74,7 +74,8 @@ static struct platform_device_id fec_devtype[] = {
         }, {
                 .name = "imx28-fec",
                 .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_SWAP_FRAME,
-        }
+        },
+        { }
 };
 
 static unsigned char macaddr[ETH_ALEN];
diff --git a/drivers/net/igbvf/vf.c b/drivers/net/igbvf/vf.c
index 74486a8b009a..af3822f9ea9a 100644
--- a/drivers/net/igbvf/vf.c
+++ b/drivers/net/igbvf/vf.c
@@ -220,7 +220,7 @@ static u32 e1000_hash_mc_addr_vf(struct e1000_hw *hw, u8 *mc_addr)
  *  The parameter rar_count will usually be hw->mac.rar_entry_count
  *  unless there are workarounds that change this.
  **/
-void e1000_update_mc_addr_list_vf(struct e1000_hw *hw,
+static void e1000_update_mc_addr_list_vf(struct e1000_hw *hw,
                                   u8 *mc_addr_list, u32 mc_addr_count,
                                   u32 rar_used_count, u32 rar_count)
 {
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index f69e73e2191e..79ccb54ab00c 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -260,7 +260,7 @@ static int macb_mii_init(struct macb *bp)
         for (i = 0; i < PHY_MAX_ADDR; i++)
                 bp->mii_bus->irq[i] = PHY_POLL;
 
-        platform_set_drvdata(bp->dev, bp->mii_bus);
+        dev_set_drvdata(&bp->dev->dev, bp->mii_bus);
 
         if (mdiobus_register(bp->mii_bus))
                 goto err_out_free_mdio_irq;
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 5933621ac3ff..fc27a9926d9e 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -528,8 +528,9 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q,
                 vnet_hdr_len = q->vnet_hdr_sz;
 
                 err = -EINVAL;
-                if ((len -= vnet_hdr_len) < 0)
+                if (len < vnet_hdr_len)
                         goto err;
+                len -= vnet_hdr_len;
 
                 err = memcpy_fromiovecend((void *)&vnet_hdr, iv, 0,
                                            sizeof(vnet_hdr));
diff --git a/drivers/net/pcmcia/fmvj18x_cs.c b/drivers/net/pcmcia/fmvj18x_cs.c
index 9226cda4d054..530ab5a10bd3 100644
--- a/drivers/net/pcmcia/fmvj18x_cs.c
+++ b/drivers/net/pcmcia/fmvj18x_cs.c
@@ -691,6 +691,7 @@ static struct pcmcia_device_id fmvj18x_ids[] = {
         PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0105, 0x0e0a),
         PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x0e01),
         PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x0a05),
+        PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x0b05),
         PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x1101),
         PCMCIA_DEVICE_NULL,
 };
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 27e6f6d43cac..e3ebd90ae651 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -49,8 +49,8 @@
 #include <asm/processor.h>
 
 #define DRV_NAME        "r6040"
-#define DRV_VERSION     "0.26"
-#define DRV_RELDATE     "30May2010"
+#define DRV_VERSION     "0.27"
+#define DRV_RELDATE     "23Feb2011"
 
 /* PHY CHIP Address */
 #define PHY1_ADDR       1       /* For MAC1 */
@@ -69,6 +69,8 @@
 
 /* MAC registers */
 #define MCR0            0x00    /* Control register 0 */
+#define  MCR0_PROMISC   0x0020  /* Promiscuous mode */
+#define  MCR0_HASH_EN   0x0100  /* Enable multicast hash table function */
 #define MCR1            0x04    /* Control register 1 */
 #define  MAC_RST        0x0001  /* Reset the MAC */
 #define MBCR            0x08    /* Bus control */
@@ -851,77 +853,92 @@ static void r6040_multicast_list(struct net_device *dev)
 {
         struct r6040_private *lp = netdev_priv(dev);
         void __iomem *ioaddr = lp->base;
-        u16 *adrp;
-        u16 reg;
         unsigned long flags;
         struct netdev_hw_addr *ha;
         int i;
+        u16 *adrp;
+        u16 hash_table[4] = { 0 };
+
+        spin_lock_irqsave(&lp->lock, flags);
 
-        /* MAC Address */
+        /* Keep our MAC Address */
         adrp = (u16 *)dev->dev_addr;
         iowrite16(adrp[0], ioaddr + MID_0L);
         iowrite16(adrp[1], ioaddr + MID_0M);
         iowrite16(adrp[2], ioaddr + MID_0H);
 
-        /* Promiscous Mode */
-        spin_lock_irqsave(&lp->lock, flags);
-
         /* Clear AMCP & PROM bits */
-        reg = ioread16(ioaddr) & ~0x0120;
-        if (dev->flags & IFF_PROMISC) {
-                reg |= 0x0020;
-                lp->mcr0 |= 0x0020;
-        }
-        /* Too many multicast addresses
-         * accept all traffic */
-        else if ((netdev_mc_count(dev) > MCAST_MAX) ||
-                 (dev->flags & IFF_ALLMULTI))
-                reg |= 0x0020;
+        lp->mcr0 = ioread16(ioaddr + MCR0) & ~(MCR0_PROMISC | MCR0_HASH_EN);
 
-        iowrite16(reg, ioaddr);
-        spin_unlock_irqrestore(&lp->lock, flags);
+        /* Promiscuous mode */
+        if (dev->flags & IFF_PROMISC)
+                lp->mcr0 |= MCR0_PROMISC;
 
-        /* Build the hash table */
-        if (netdev_mc_count(dev) > MCAST_MAX) {
-                u16 hash_table[4];
-                u32 crc;
+        /* Enable multicast hash table function to
+         * receive all multicast packets. */
+        else if (dev->flags & IFF_ALLMULTI) {
+                lp->mcr0 |= MCR0_HASH_EN;
 
-                for (i = 0; i < 4; i++)
-                        hash_table[i] = 0;
+                for (i = 0; i < MCAST_MAX ; i++) {
+                        iowrite16(0, ioaddr + MID_1L + 8 * i);
+                        iowrite16(0, ioaddr + MID_1M + 8 * i);
+                        iowrite16(0, ioaddr + MID_1H + 8 * i);
+                }
 
+                for (i = 0; i < 4; i++)
+                        hash_table[i] = 0xffff;
+        }
+        /* Use internal multicast address registers if the number of
+         * multicast addresses is not greater than MCAST_MAX. */
+        else if (netdev_mc_count(dev) <= MCAST_MAX) {
+                i = 0;
                 netdev_for_each_mc_addr(ha, dev) {
-                        char *addrs = ha->addr;
+                        u16 *adrp = (u16 *) ha->addr;
+                        iowrite16(adrp[0], ioaddr + MID_1L + 8 * i);
+                        iowrite16(adrp[1], ioaddr + MID_1M + 8 * i);
+                        iowrite16(adrp[2], ioaddr + MID_1H + 8 * i);
+                        i++;
+                }
+                while (i < MCAST_MAX) {
+                        iowrite16(0, ioaddr + MID_1L + 8 * i);
+                        iowrite16(0, ioaddr + MID_1M + 8 * i);
+                        iowrite16(0, ioaddr + MID_1H + 8 * i);
+                        i++;
+                }
+        }
+        /* Otherwise, Enable multicast hash table function. */
+        else {
+                u32 crc;
 
-                        if (!(*addrs & 1))
-                                continue;
+                lp->mcr0 |= MCR0_HASH_EN;
+
+                for (i = 0; i < MCAST_MAX ; i++) {
+                        iowrite16(0, ioaddr + MID_1L + 8 * i);
+                        iowrite16(0, ioaddr + MID_1M + 8 * i);
+                        iowrite16(0, ioaddr + MID_1H + 8 * i);
+                }
 
-                        crc = ether_crc_le(6, addrs);
+                /* Build multicast hash table */
+                netdev_for_each_mc_addr(ha, dev) {
+                        u8 *addrs = ha->addr;
+
+                        crc = ether_crc(ETH_ALEN, addrs);
                         crc >>= 26;
-                        hash_table[crc >> 4] |= 1 << (15 - (crc & 0xf));
+                        hash_table[crc >> 4] |= 1 << (crc & 0xf);
                 }
-                /* Fill the MAC hash tables with their values */
+        }
+
+        iowrite16(lp->mcr0, ioaddr + MCR0);
+
+        /* Fill the MAC hash tables with their values */
+        if (lp->mcr0 && MCR0_HASH_EN) {
                 iowrite16(hash_table[0], ioaddr + MAR0);
                 iowrite16(hash_table[1], ioaddr + MAR1);
                 iowrite16(hash_table[2], ioaddr + MAR2);
                 iowrite16(hash_table[3], ioaddr + MAR3);
         }
-        /* Multicast Address 1~4 case */
-        i = 0;
-        netdev_for_each_mc_addr(ha, dev) {
-                if (i >= MCAST_MAX)
-                        break;
-                adrp = (u16 *) ha->addr;
-                iowrite16(adrp[0], ioaddr + MID_1L + 8 * i);
-                iowrite16(adrp[1], ioaddr + MID_1M + 8 * i);
-                iowrite16(adrp[2], ioaddr + MID_1H + 8 * i);
-                i++;
-        }
-        while (i < MCAST_MAX) {
-                iowrite16(0xffff, ioaddr + MID_1L + 8 * i);
-                iowrite16(0xffff, ioaddr + MID_1M + 8 * i);
-                iowrite16(0xffff, ioaddr + MID_1H + 8 * i);
-                i++;
-        }
+
+        spin_unlock_irqrestore(&lp->lock, flags);
 }
 
 static void netdev_get_drvinfo(struct net_device *dev,
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index ef2133b16f8c..7ffdb80adf40 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -25,6 +25,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/pm_runtime.h>
 #include <linux/firmware.h>
+#include <linux/pci-aspm.h>
 
 #include <asm/system.h>
 #include <asm/io.h>
@@ -3020,6 +3021,11 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         mii->reg_num_mask = 0x1f;
         mii->supports_gmii = !!(cfg->features & RTL_FEATURE_GMII);
 
+        /* disable ASPM completely as that cause random device stop working
+         * problems as well as full system hangs for some PCIe devices users */
+        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
+                                     PCIE_LINK_STATE_CLKPM);
+
         /* enable device (incl. PCI PM wakeup and hotplug setup) */
         rc = pci_enable_device(pdev);
         if (rc < 0) {
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 42daf98ba736..35b28f42d208 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -3856,9 +3856,6 @@ static struct net_device *skge_devinit(struct skge_hw *hw, int port,
         memcpy_fromio(dev->dev_addr, hw->regs + B2_MAC_1 + port*8, ETH_ALEN);
         memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
 
-        /* device is off until link detection */
-        netif_carrier_off(dev);
-
         return dev;
 }
 
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index 64bfdae5956f..d70bde95460b 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -1178,6 +1178,11 @@ static int smsc911x_open(struct net_device *dev)
         smsc911x_reg_write(pdata, HW_CFG, 0x00050000);
         smsc911x_reg_write(pdata, AFC_CFG, 0x006E3740);
 
+        /* Increase the legal frame size of VLAN tagged frames to 1522 bytes */
+        spin_lock_irq(&pdata->mac_lock);
+        smsc911x_mac_write(pdata, VLAN1, ETH_P_8021Q);
+        spin_unlock_irq(&pdata->mac_lock);
+
         /* Make sure EEPROM has finished loading before setting GPIO_CFG */
         timeout = 50;
         while ((smsc911x_reg_read(pdata, E2P_CMD) & E2P_CMD_EPC_BUSY_) &&
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 5ab3084eb9cb..07b1633b7f3f 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -219,8 +219,9 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
         struct tx_buf *tx_buf = NULL;
         struct sk_buff *nskb = NULL;
         int ret = 0, i;
-        u16 *hdr, tx_skb_cnt = 0;
+        u16 tx_skb_cnt = 0;
         u8 *buf;
+        __le16 *hdr;
 
         if (hif_dev->tx.tx_skb_cnt == 0)
                 return 0;
@@ -245,9 +246,9 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
 
                 buf = tx_buf->buf;
                 buf += tx_buf->offset;
-                hdr = (u16 *)buf;
-                *hdr++ = nskb->len;
-                *hdr++ = ATH_USB_TX_STREAM_MODE_TAG;
+                hdr = (__le16 *)buf;
+                *hdr++ = cpu_to_le16(nskb->len);
+                *hdr++ = cpu_to_le16(ATH_USB_TX_STREAM_MODE_TAG);
                 buf += 4;
                 memcpy(buf, nskb->data, nskb->len);
                 tx_buf->len = nskb->len + 4;
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 180170d3ce25..2915b11edefb 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -885,7 +885,7 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
         struct ath_common *common = ath9k_hw_common(ah);
 
         if (!(ints & ATH9K_INT_GLOBAL))
-                ath9k_hw_enable_interrupts(ah);
+                ath9k_hw_disable_interrupts(ah);
 
         ath_dbg(common, ATH_DBG_INTERRUPT, "0x%x => 0x%x\n", omask, ints);
 
@@ -963,7 +963,8 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
                         REG_CLR_BIT(ah, AR_IMR_S5, AR_IMR_S5_TIM_TIMER);
         }
 
-        ath9k_hw_enable_interrupts(ah);
+        if (ints & ATH9K_INT_GLOBAL)
+                ath9k_hw_enable_interrupts(ah);
 
         return;
 }
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index 537732e5964f..f82c400be288 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -118,6 +118,8 @@ static struct usb_device_id carl9170_usb_ids[] = {
         { USB_DEVICE(0x057c, 0x8402) },
         /* Qwest/Actiontec 802AIN Wireless N USB Network Adapter */
         { USB_DEVICE(0x1668, 0x1200) },
+        /* Airlive X.USB a/b/g/n */
+        { USB_DEVICE(0x1b75, 0x9170) },
 
         /* terminate */
         {}
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 79ab0a6b1386..537fb8c84e3a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -51,7 +51,7 @@
 #include "iwl-agn-debugfs.h"
 
 /* Highest firmware API version supported */
-#define IWL5000_UCODE_API_MAX 2
+#define IWL5000_UCODE_API_MAX 5
 #define IWL5150_UCODE_API_MAX 2
 
 /* Lowest firmware API version supported */
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 21713a7638c4..9b344a921e74 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -98,6 +98,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
         {USB_DEVICE(0x1435, 0x0427)},   /* Inventel UR054G */
         {USB_DEVICE(0x1668, 0x1050)},   /* Actiontec 802UIG-1 */
+        {USB_DEVICE(0x1740, 0x1000)},   /* Senao NUB-350 */
         {USB_DEVICE(0x2001, 0x3704)},   /* DLink DWL-G122 rev A2 */
         {USB_DEVICE(0x2001, 0x3705)},   /* D-Link DWL-G120 rev C1 */
         {USB_DEVICE(0x413c, 0x5513)},   /* Dell WLA3310 USB Wireless Adapter */
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 848cc2cce247..518542b4bf9e 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2597,6 +2597,9 @@ static int rndis_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
         __le32 mode;
         int ret;
 
+        if (priv->device_type != RNDIS_BCM4320B)
+                return -ENOTSUPP;
+
         netdev_dbg(usbdev->net, "%s(): %s, %d\n", __func__,
                                 enabled ? "enabled" : "disabled",
                                 timeout);
diff --git a/drivers/of/pdt.c b/drivers/of/pdt.c
index 28295d0a50f6..4d87b5dc9284 100644
--- a/drivers/of/pdt.c
+++ b/drivers/of/pdt.c
@@ -36,19 +36,55 @@ unsigned int of_pdt_unique_id __initdata;
         (p)->unique_id = of_pdt_unique_id++; \
 } while (0)
 
-static inline const char *of_pdt_node_name(struct device_node *dp)
+static char * __init of_pdt_build_full_name(struct device_node *dp)
 {
-        return dp->path_component_name;
+        int len, ourlen, plen;
+        char *n;
+
+        dp->path_component_name = build_path_component(dp);
+
+        plen = strlen(dp->parent->full_name);
+        ourlen = strlen(dp->path_component_name);
+        len = ourlen + plen + 2;
+
+        n = prom_early_alloc(len);
+        strcpy(n, dp->parent->full_name);
+        if (!of_node_is_root(dp->parent)) {
+                strcpy(n + plen, "/");
+                plen++;
+        }
+        strcpy(n + plen, dp->path_component_name);
+
+        return n;
 }
 
-#else
+#else /* CONFIG_SPARC */
 
 static inline void of_pdt_incr_unique_id(void *p) { }
 static inline void irq_trans_init(struct device_node *dp) { }
 
-static inline const char *of_pdt_node_name(struct device_node *dp)
+static char * __init of_pdt_build_full_name(struct device_node *dp)
 {
-        return dp->name;
+        static int failsafe_id = 0; /* for generating unique names on failure */
+        char *buf;
+        int len;
+
+        if (of_pdt_prom_ops->pkg2path(dp->phandle, NULL, 0, &len))
+                goto failsafe;
+
+        buf = prom_early_alloc(len + 1);
+        if (of_pdt_prom_ops->pkg2path(dp->phandle, buf, len, &len))
+                goto failsafe;
+        return buf;
+
+ failsafe:
+        buf = prom_early_alloc(strlen(dp->parent->full_name) +
+                               strlen(dp->name) + 16);
+        sprintf(buf, "%s/%s@unknown%i",
+                of_node_is_root(dp->parent) ? "" : dp->parent->full_name,
+                dp->name, failsafe_id++);
+        pr_err("%s: pkg2path failed; assigning %s\n", __func__, buf);
+        return buf;
 }
 
 #endif /* !CONFIG_SPARC */
@@ -132,47 +168,6 @@ static char * __init of_pdt_get_one_property(phandle node, const char *name)
         return buf;
 }
 
-static char * __init of_pdt_try_pkg2path(phandle node)
-{
-        char *res, *buf = NULL;
-        int len;
-
-        if (!of_pdt_prom_ops->pkg2path)
-                return NULL;
-
-        if (of_pdt_prom_ops->pkg2path(node, buf, 0, &len))
-                return NULL;
-        buf = prom_early_alloc(len + 1);
-        if (of_pdt_prom_ops->pkg2path(node, buf, len, &len)) {
-                pr_err("%s: package-to-path failed\n", __func__);
-                return NULL;
-        }
-
-        res = strrchr(buf, '/');
-        if (!res) {
-                pr_err("%s: couldn't find / in %s\n", __func__, buf);
-                return NULL;
-        }
-        return res+1;
-}
-
-/*
- * When fetching the node's name, first try using package-to-path; if
- * that fails (either because the arch hasn't supplied a PROM callback,
- * or some other random failure), fall back to just looking at the node's
- * 'name' property.
- */
-static char * __init of_pdt_build_name(phandle node)
-{
-        char *buf;
-
-        buf = of_pdt_try_pkg2path(node);
-        if (!buf)
-                buf = of_pdt_get_one_property(node, "name");
-
-        return buf;
-}
-
 static struct device_node * __init of_pdt_create_node(phandle node,
                                                     struct device_node *parent)
 {
@@ -187,7 +182,7 @@ static struct device_node * __init of_pdt_create_node(phandle node,
 
         kref_init(&dp->kref);
 
-        dp->name = of_pdt_build_name(node);
+        dp->name = of_pdt_get_one_property(node, "name");
         dp->type = of_pdt_get_one_property(node, "device_type");
         dp->phandle = node;
 
@@ -198,26 +193,6 @@ static struct device_node * __init of_pdt_create_node(phandle node,
         return dp;
 }
 
-static char * __init of_pdt_build_full_name(struct device_node *dp)
-{
-        int len, ourlen, plen;
-        char *n;
-
-        plen = strlen(dp->parent->full_name);
-        ourlen = strlen(of_pdt_node_name(dp));
-        len = ourlen + plen + 2;
-
-        n = prom_early_alloc(len);
-        strcpy(n, dp->parent->full_name);
-        if (!of_node_is_root(dp->parent)) {
-                strcpy(n + plen, "/");
-                plen++;
-        }
-        strcpy(n + plen, of_pdt_node_name(dp));
-
-        return n;
-}
-
 static struct device_node * __init of_pdt_build_tree(struct device_node *parent,
                                                    phandle node,
                                                    struct device_node ***nextp)
@@ -240,9 +215,6 @@ static struct device_node * __init of_pdt_build_tree(struct device_node *parent,
                 *(*nextp) = dp;
                 *nextp = &dp->allnext;
 
-#if defined(CONFIG_SPARC)
-                dp->path_component_name = build_path_component(dp);
-#endif
                 dp->full_name = of_pdt_build_full_name(dp);
 
                 dp->child = of_pdt_build_tree(dp,
diff --git a/drivers/pcmcia/pxa2xx_colibri.c b/drivers/pcmcia/pxa2xx_colibri.c
index c3f72192af66..a52039564e74 100644
--- a/drivers/pcmcia/pxa2xx_colibri.c
+++ b/drivers/pcmcia/pxa2xx_colibri.c
@@ -181,6 +181,9 @@ static int __init colibri_pcmcia_init(void)
 {
         int ret;
 
+        if (!machine_is_colibri() && !machine_is_colibri320())
+                return -ENODEV;
+
         colibri_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
         if (!colibri_pcmcia_device)
                 return -ENOMEM;
diff --git a/drivers/pps/generators/Kconfig b/drivers/pps/generators/Kconfig
index f3a73dd77660..e4c4f3dc0728 100644
--- a/drivers/pps/generators/Kconfig
+++ b/drivers/pps/generators/Kconfig
@@ -6,7 +6,7 @@ comment "PPS generators support"
 
 config PPS_GENERATOR_PARPORT
         tristate "Parallel port PPS signal generator"
-        depends on PARPORT
+        depends on PARPORT && BROKEN
         help
           If you say yes here you get support for a PPS signal generator which
           utilizes STROBE pin of a parallel port to send PPS signals. It uses
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index cf953ecbfca9..b80fa2882408 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -77,18 +77,20 @@ static irqreturn_t s3c_rtc_tickirq(int irq, void *id)
 }
 
 /* Update control registers */
-static void s3c_rtc_setaie(int to)
+static int s3c_rtc_setaie(struct device *dev, unsigned int enabled)
 {
         unsigned int tmp;
 
-        pr_debug("%s: aie=%d\n", __func__, to);
+        pr_debug("%s: aie=%d\n", __func__, enabled);
 
         tmp = readb(s3c_rtc_base + S3C2410_RTCALM) & ~S3C2410_RTCALM_ALMEN;
 
-        if (to)
+        if (enabled)
                 tmp |= S3C2410_RTCALM_ALMEN;
 
         writeb(tmp, s3c_rtc_base + S3C2410_RTCALM);
+
+        return 0;
 }
 
 static int s3c_rtc_setpie(struct device *dev, int enabled)
@@ -308,7 +310,7 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
 
         writeb(alrm_en, base + S3C2410_RTCALM);
 
-        s3c_rtc_setaie(alrm->enabled);
+        s3c_rtc_setaie(dev, alrm->enabled);
 
         return 0;
 }
@@ -440,7 +442,7 @@ static int __devexit s3c_rtc_remove(struct platform_device *dev)
         rtc_device_unregister(rtc);
 
         s3c_rtc_setpie(&dev->dev, 0);
-        s3c_rtc_setaie(0);
+        s3c_rtc_setaie(&dev->dev, 0);
 
         clk_disable(rtc_clk);
         clk_put(rtc_clk);
diff --git a/drivers/s390/block/xpram.c b/drivers/s390/block/xpram.c
index c881a14fa5dd..1f6a4d894e73 100644
--- a/drivers/s390/block/xpram.c
+++ b/drivers/s390/block/xpram.c
@@ -62,8 +62,8 @@ static int xpram_devs;
 /*
  * Parameter parsing functions.
  */
-static int __initdata devs = XPRAM_DEVS;
-static char __initdata *sizes[XPRAM_MAX_DEVS];
+static int devs = XPRAM_DEVS;
+static char *sizes[XPRAM_MAX_DEVS];
 
 module_param(devs, int, 0);
 module_param_array(sizes, charp, NULL, 0);
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index 8cd58e412b5e..5ad44daef73b 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -460,7 +460,8 @@ kbd_ioctl(struct kbd_data *kbd, struct file *file,
           unsigned int cmd, unsigned long arg)
 {
         void __user *argp;
-        int ct, perm;
+        unsigned int ct;
+        int perm;
 
         argp = (void __user *)arg;
 
diff --git a/drivers/s390/char/tape.h b/drivers/s390/char/tape.h
index 7a242f073632..267b54e8ff5a 100644
--- a/drivers/s390/char/tape.h
+++ b/drivers/s390/char/tape.h
@@ -280,6 +280,14 @@ tape_do_io_free(struct tape_device *device, struct tape_request *request)
         return rc;
 }
 
+static inline void
+tape_do_io_async_free(struct tape_device *device, struct tape_request *request)
+{
+        request->callback = (void *) tape_free_request;
+        request->callback_data = NULL;
+        tape_do_io_async(device, request);
+}
+
 extern int tape_oper_handler(int irq, int status);
 extern void tape_noper_handler(int irq, int status);
 extern int tape_open(struct tape_device *);
diff --git a/drivers/s390/char/tape_34xx.c b/drivers/s390/char/tape_34xx.c
index c17f35b6136a..c26511171ffe 100644
--- a/drivers/s390/char/tape_34xx.c
+++ b/drivers/s390/char/tape_34xx.c
@@ -53,23 +53,11 @@ static void tape_34xx_delete_sbid_from(struct tape_device *, int);
  * Medium sense for 34xx tapes. There is no 'real' medium sense call.
  * So we just do a normal sense.
  */
-static int
-tape_34xx_medium_sense(struct tape_device *device)
+static void __tape_34xx_medium_sense(struct tape_request *request)
 {
-        struct tape_request *request;
-        unsigned char       *sense;
-        int                  rc;
-
-        request = tape_alloc_request(1, 32);
-        if (IS_ERR(request)) {
-                DBF_EXCEPTION(6, "MSEN fail\n");
-                return PTR_ERR(request);
-        }
-
-        request->op = TO_MSEN;
-        tape_ccw_end(request->cpaddr, SENSE, 32, request->cpdata);
+        struct tape_device *device = request->device;
+        unsigned char *sense;
 
-        rc = tape_do_io_interruptible(device, request);
         if (request->rc == 0) {
                 sense = request->cpdata;
 
@@ -88,15 +76,47 @@ tape_34xx_medium_sense(struct tape_device *device)
                         device->tape_generic_status |= GMT_WR_PROT(~0);
                 else
                         device->tape_generic_status &= ~GMT_WR_PROT(~0);
-        } else {
+        } else
                 DBF_EVENT(4, "tape_34xx: medium sense failed with rc=%d\n",
                         request->rc);
-        }
         tape_free_request(request);
+}
+
+static int tape_34xx_medium_sense(struct tape_device *device)
+{
+        struct tape_request *request;
+        int rc;
+
+        request = tape_alloc_request(1, 32);
+        if (IS_ERR(request)) {
+                DBF_EXCEPTION(6, "MSEN fail\n");
+                return PTR_ERR(request);
+        }
 
+        request->op = TO_MSEN;
+        tape_ccw_end(request->cpaddr, SENSE, 32, request->cpdata);
+        rc = tape_do_io_interruptible(device, request);
+        __tape_34xx_medium_sense(request);
         return rc;
 }
 
+static void tape_34xx_medium_sense_async(struct tape_device *device)
+{
+        struct tape_request *request;
+
+        request = tape_alloc_request(1, 32);
+        if (IS_ERR(request)) {
+                DBF_EXCEPTION(6, "MSEN fail\n");
+                return;
+        }
+
+        request->op = TO_MSEN;
+        tape_ccw_end(request->cpaddr, SENSE, 32, request->cpdata);
+        request->callback = (void *) __tape_34xx_medium_sense;
+        request->callback_data = NULL;
+        tape_do_io_async(device, request);
+}
+
 struct tape_34xx_work {
         struct tape_device      *device;
         enum tape_op             op;
@@ -109,6 +129,9 @@ struct tape_34xx_work {
  * is inserted but cannot call tape_do_io* from an interrupt context.
  * Maybe that's useful for other actions we want to start from the
  * interrupt handler.
+ * Note: the work handler is called by the system work queue. The tape
+ * commands started by the handler need to be asynchrounous, otherwise
+ * a deadlock can occur e.g. in case of a deferred cc=1 (see __tape_do_irq).
  */
 static void
 tape_34xx_work_handler(struct work_struct *work)
@@ -119,7 +142,7 @@ tape_34xx_work_handler(struct work_struct *work)
 
         switch(p->op) {
                 case TO_MSEN:
-                        tape_34xx_medium_sense(device);
+                        tape_34xx_medium_sense_async(device);
                         break;
                 default:
                         DBF_EVENT(3, "T34XX: internal error: unknown work\n");
diff --git a/drivers/s390/char/tape_3590.c b/drivers/s390/char/tape_3590.c
index fbe361fcd2c0..de2e99e0a71b 100644
--- a/drivers/s390/char/tape_3590.c
+++ b/drivers/s390/char/tape_3590.c
@@ -329,17 +329,17 @@ out:
 /*
  * Enable encryption
  */
-static int tape_3592_enable_crypt(struct tape_device *device)
+static struct tape_request *__tape_3592_enable_crypt(struct tape_device *device)
 {
         struct tape_request *request;
         char *data;
 
         DBF_EVENT(6, "tape_3592_enable_crypt\n");
         if (!crypt_supported(device))
-                return -ENOSYS;
+                return ERR_PTR(-ENOSYS);
         request = tape_alloc_request(2, 72);
         if (IS_ERR(request))
-                return PTR_ERR(request);
+                return request;
         data = request->cpdata;
         memset(data,0,72);
 
@@ -354,23 +354,42 @@ static int tape_3592_enable_crypt(struct tape_device *device)
         request->op = TO_CRYPT_ON;
         tape_ccw_cc(request->cpaddr, MODE_SET_CB, 36, data);
         tape_ccw_end(request->cpaddr + 1, MODE_SET_CB, 36, data + 36);
+        return request;
+}
+
+static int tape_3592_enable_crypt(struct tape_device *device)
+{
+        struct tape_request *request;
+
+        request = __tape_3592_enable_crypt(device);
+        if (IS_ERR(request))
+                return PTR_ERR(request);
         return tape_do_io_free(device, request);
 }
 
+static void tape_3592_enable_crypt_async(struct tape_device *device)
+{
+        struct tape_request *request;
+
+        request = __tape_3592_enable_crypt(device);
+        if (!IS_ERR(request))
+                tape_do_io_async_free(device, request);
+}
+
 /*
  * Disable encryption
  */
-static int tape_3592_disable_crypt(struct tape_device *device)
+static struct tape_request *__tape_3592_disable_crypt(struct tape_device *device)
 {
         struct tape_request *request;
         char *data;
 
         DBF_EVENT(6, "tape_3592_disable_crypt\n");
         if (!crypt_supported(device))
-                return -ENOSYS;
+                return ERR_PTR(-ENOSYS);
         request = tape_alloc_request(2, 72);
         if (IS_ERR(request))
-                return PTR_ERR(request);
+                return request;
         data = request->cpdata;
         memset(data,0,72);
 
@@ -383,9 +402,28 @@ static int tape_3592_disable_crypt(struct tape_device *device)
         tape_ccw_cc(request->cpaddr, MODE_SET_CB, 36, data);
         tape_ccw_end(request->cpaddr + 1, MODE_SET_CB, 36, data + 36);
 
+        return request;
+}
+
+static int tape_3592_disable_crypt(struct tape_device *device)
+{
+        struct tape_request *request;
+
+        request = __tape_3592_disable_crypt(device);
+        if (IS_ERR(request))
+                return PTR_ERR(request);
         return tape_do_io_free(device, request);
 }
 
+static void tape_3592_disable_crypt_async(struct tape_device *device)
+{
+        struct tape_request *request;
+
+        request = __tape_3592_disable_crypt(device);
+        if (!IS_ERR(request))
+                tape_do_io_async_free(device, request);
+}
+
 /*
  * IOCTL: Set encryption status
  */
@@ -457,8 +495,7 @@ tape_3590_ioctl(struct tape_device *device, unsigned int cmd, unsigned long arg)
 /*
  * SENSE Medium: Get Sense data about medium state
  */
-static int
-tape_3590_sense_medium(struct tape_device *device)
+static int tape_3590_sense_medium(struct tape_device *device)
 {
         struct tape_request *request;
 
@@ -470,6 +507,18 @@ tape_3590_sense_medium(struct tape_device *device)
         return tape_do_io_free(device, request);
 }
 
+static void tape_3590_sense_medium_async(struct tape_device *device)
+{
+        struct tape_request *request;
+
+        request = tape_alloc_request(1, 128);
+        if (IS_ERR(request))
+                return;
+        request->op = TO_MSEN;
+        tape_ccw_end(request->cpaddr, MEDIUM_SENSE, 128, request->cpdata);
+        tape_do_io_async_free(device, request);
+}
+
 /*
  * MTTELL: Tell block. Return the number of block relative to current file.
  */
@@ -546,15 +595,14 @@ tape_3590_read_opposite(struct tape_device *device,
  * 2. The attention msg is written to the "read subsystem data" buffer.
  * In this case we probably should print it to the console.
  */
-static int
-tape_3590_read_attmsg(struct tape_device *device)
+static void tape_3590_read_attmsg_async(struct tape_device *device)
 {
         struct tape_request *request;
         char *buf;
 
         request = tape_alloc_request(3, 4096);
         if (IS_ERR(request))
-                return PTR_ERR(request);
+                return;
         request->op = TO_READ_ATTMSG;
         buf = request->cpdata;
         buf[0] = PREP_RD_SS_DATA;
@@ -562,12 +610,15 @@ tape_3590_read_attmsg(struct tape_device *device)
         tape_ccw_cc(request->cpaddr, PERFORM_SS_FUNC, 12, buf);
         tape_ccw_cc(request->cpaddr + 1, READ_SS_DATA, 4096 - 12, buf + 12);
         tape_ccw_end(request->cpaddr + 2, NOP, 0, NULL);
-        return tape_do_io_free(device, request);
+        tape_do_io_async_free(device, request);
 }
 
 /*
  * These functions are used to schedule follow-up actions from within an
  * interrupt context (like unsolicited interrupts).
+ * Note: the work handler is called by the system work queue. The tape
+ * commands started by the handler need to be asynchrounous, otherwise
+ * a deadlock can occur e.g. in case of a deferred cc=1 (see __tape_do_irq).
  */
 struct work_handler_data {
         struct tape_device *device;
@@ -583,16 +634,16 @@ tape_3590_work_handler(struct work_struct *work)
 
         switch (p->op) {
         case TO_MSEN:
-                tape_3590_sense_medium(p->device);
+                tape_3590_sense_medium_async(p->device);
                 break;
         case TO_READ_ATTMSG:
-                tape_3590_read_attmsg(p->device);
+                tape_3590_read_attmsg_async(p->device);
                 break;
         case TO_CRYPT_ON:
-                tape_3592_enable_crypt(p->device);
+                tape_3592_enable_crypt_async(p->device);
                 break;
         case TO_CRYPT_OFF:
-                tape_3592_disable_crypt(p->device);
+                tape_3592_disable_crypt_async(p->device);
                 break;
         default:
                 DBF_EVENT(3, "T3590: work handler undefined for "
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 9045c52abd25..fb2bb35c62cb 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -443,7 +443,7 @@ static void scsi_run_queue(struct request_queue *q)
                                         &sdev->request_queue->queue_flags);
                 if (flagset)
                         queue_flag_set(QUEUE_FLAG_REENTER, sdev->request_queue);
-                __blk_run_queue(sdev->request_queue);
+                __blk_run_queue(sdev->request_queue, false);
                 if (flagset)
                         queue_flag_clear(QUEUE_FLAG_REENTER, sdev->request_queue);
                 spin_unlock(sdev->request_queue->queue_lock);
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 998c01be3234..5c3ccfc6b622 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3829,7 +3829,7 @@ fc_bsg_goose_queue(struct fc_rport *rport)
                   !test_bit(QUEUE_FLAG_REENTER, &rport->rqst_q->queue_flags);
         if (flagset)
                 queue_flag_set(QUEUE_FLAG_REENTER, rport->rqst_q);
-        __blk_run_queue(rport->rqst_q);
+        __blk_run_queue(rport->rqst_q, false);
         if (flagset)
                 queue_flag_clear(QUEUE_FLAG_REENTER, rport->rqst_q);
         spin_unlock_irqrestore(rport->rqst_q->queue_lock, flags);
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 158cecbec718..4a109835e420 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -282,6 +282,9 @@ int core_tmr_lun_reset(
 
                         atomic_set(&task->task_active, 0);
                         atomic_set(&task->task_stop, 0);
+                } else {
+                        if (atomic_read(&task->task_execute_queue) != 0)
+                                transport_remove_task_from_execute_queue(task, dev);
                 }
                 __transport_stop_task_timer(task, &flags);
 
@@ -301,6 +304,7 @@ int core_tmr_lun_reset(
                         DEBUG_LR("LUN_RESET: got t_transport_active = 1 for"
                                 " task: %p, t_fe_count: %d dev: %p\n", task,
                                 fe_count, dev);
+                        atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
                         spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
                                                 flags);
                         core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
@@ -310,6 +314,7 @@ int core_tmr_lun_reset(
                 }
                 DEBUG_LR("LUN_RESET: Got t_transport_active = 0 for task: %p,"
                         " t_fe_count: %d dev: %p\n", task, fe_count, dev);
+                atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
                 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
                 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
 
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 236e22d8cfae..4bbf6c147f89 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1207,7 +1207,7 @@ transport_get_task_from_execute_queue(struct se_device *dev)
  *
  *
  */
-static void transport_remove_task_from_execute_queue(
+void transport_remove_task_from_execute_queue(
         struct se_task *task,
         struct se_device *dev)
 {
@@ -5549,7 +5549,8 @@ static void transport_generic_wait_for_tasks(
 
                 atomic_set(&T_TASK(cmd)->transport_lun_stop, 0);
         }
-        if (!atomic_read(&T_TASK(cmd)->t_transport_active))
+        if (!atomic_read(&T_TASK(cmd)->t_transport_active) ||
+             atomic_read(&T_TASK(cmd)->t_transport_aborted))
                 goto remove;
 
         atomic_set(&T_TASK(cmd)->t_transport_stop, 1);
@@ -5956,6 +5957,9 @@ static void transport_processing_shutdown(struct se_device *dev)
 
                         atomic_set(&task->task_active, 0);
                         atomic_set(&task->task_stop, 0);
+                } else {
+                        if (atomic_read(&task->task_execute_queue) != 0)
+                                transport_remove_task_from_execute_queue(task, dev);
                 }
                 __transport_stop_task_timer(task, &flags);
 
diff --git a/drivers/tty/serial/serial_cs.c b/drivers/tty/serial/serial_cs.c
index 93760b2ea172..1ef4df9bf7e4 100644
--- a/drivers/tty/serial/serial_cs.c
+++ b/drivers/tty/serial/serial_cs.c
@@ -712,6 +712,7 @@ static struct pcmcia_device_id serial_ids[] = {
         PCMCIA_PFC_DEVICE_PROD_ID12(1, "Xircom", "CreditCard Ethernet+Modem II", 0x2e3ee845, 0xeca401bf),
         PCMCIA_PFC_DEVICE_MANF_CARD(1, 0x0032, 0x0e01),
         PCMCIA_PFC_DEVICE_MANF_CARD(1, 0x0032, 0x0a05),
+        PCMCIA_PFC_DEVICE_MANF_CARD(1, 0x0032, 0x0b05),
         PCMCIA_PFC_DEVICE_MANF_CARD(1, 0x0032, 0x1101),
         PCMCIA_MFC_DEVICE_MANF_CARD(0, 0x0104, 0x0070),
         PCMCIA_MFC_DEVICE_MANF_CARD(1, 0x0101, 0x0562),
diff --git a/drivers/usb/gadget/f_phonet.c b/drivers/usb/gadget/f_phonet.c
index 3c6e1a058745..5e1495097ec3 100644
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -346,14 +346,19 @@ static void pn_rx_complete(struct usb_ep *ep, struct usb_request *req)
 
                 if (unlikely(!skb))
                         break;
-                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, 0,
-                                req->actual);
-                page = NULL;
 
-                if (req->actual < req->length) { /* Last fragment */
+                if (skb->len == 0) { /* First fragment */
                         skb->protocol = htons(ETH_P_PHONET);
                         skb_reset_mac_header(skb);
-                        pskb_pull(skb, 1);
+                        /* Can't use pskb_pull() on page in IRQ */
+                        memcpy(skb_put(skb, 1), page_address(page), 1);
+                }
+
+                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+                                skb->len == 0, req->actual);
+                page = NULL;
+
+                if (req->actual < req->length) { /* Last fragment */
                         skb->dev = dev;
                         dev->stats.rx_packets++;
                         dev->stats.rx_bytes += skb->len;
diff --git a/drivers/usb/host/ehci-xilinx-of.c b/drivers/usb/host/ehci-xilinx-of.c
index e8f4f36fdf0b..a6f21b891f68 100644
--- a/drivers/usb/host/ehci-xilinx-of.c
+++ b/drivers/usb/host/ehci-xilinx-of.c
@@ -29,6 +29,7 @@
 
 #include <linux/of.h>
 #include <linux/of_platform.h>
+#include <linux/of_address.h>
 
 /**
  * ehci_xilinx_of_setup - Initialize the device for ehci_reset()
diff --git a/drivers/video/backlight/ltv350qv.c b/drivers/video/backlight/ltv350qv.c
index 8010aaeb5adb..dd0e84a9bd2f 100644
--- a/drivers/video/backlight/ltv350qv.c
+++ b/drivers/video/backlight/ltv350qv.c
@@ -239,11 +239,15 @@ static int __devinit ltv350qv_probe(struct spi_device *spi)
         lcd->spi = spi;
         lcd->power = FB_BLANK_POWERDOWN;
         lcd->buffer = kzalloc(8, GFP_KERNEL);
+        if (!lcd->buffer) {
+                ret = -ENOMEM;
+                goto out_free_lcd;
+        }
 
         ld = lcd_device_register("ltv350qv", &spi->dev, lcd, &ltv_ops);
         if (IS_ERR(ld)) {
                 ret = PTR_ERR(ld);
-                goto out_free_lcd;
+                goto out_free_buffer;
         }
         lcd->ld = ld;
 
@@ -257,6 +261,8 @@ static int __devinit ltv350qv_probe(struct spi_device *spi)
 
 out_unregister:
         lcd_device_unregister(ld);
+out_free_buffer:
+        kfree(lcd->buffer);
 out_free_lcd:
         kfree(lcd);
         return ret;
@@ -268,6 +274,7 @@ static int __devexit ltv350qv_remove(struct spi_device *spi)
 
         ltv350qv_power(lcd, FB_BLANK_POWERDOWN);
         lcd_device_unregister(lcd->ld);
+        kfree(lcd->buffer);
         kfree(lcd);
 
         return 0;
diff --git a/drivers/watchdog/cpwd.c b/drivers/watchdog/cpwd.c
index eca855a55c0d..3de4ba0260a5 100644
--- a/drivers/watchdog/cpwd.c
+++ b/drivers/watchdog/cpwd.c
@@ -646,7 +646,7 @@ static int __devexit cpwd_remove(struct platform_device *op)
         struct cpwd *p = dev_get_drvdata(&op->dev);
         int i;
 
-        for (i = 0; i < 4; i++) {
+        for (i = 0; i < WD_NUMDEVS; i++) {
                 misc_deregister(&p->devs[i].misc);
 
                 if (!p->enabled) {
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 24b966d5061a..204a5603c4ae 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -710,7 +710,7 @@ static int __devinit hpwdt_init_nmi_decoding(struct pci_dev *dev)
         return 0;
 }
 
-static void __devexit hpwdt_exit_nmi_decoding(void)
+static void hpwdt_exit_nmi_decoding(void)
 {
         unregister_die_notifier(&die_notifier);
         if (cru_rom_addr)
@@ -726,7 +726,7 @@ static int __devinit hpwdt_init_nmi_decoding(struct pci_dev *dev)
         return 0;
 }
 
-static void __devexit hpwdt_exit_nmi_decoding(void)
+static void hpwdt_exit_nmi_decoding(void)
 {
 }
 #endif /* CONFIG_HPWDT_NMI_DECODING */
diff --git a/drivers/watchdog/sbc_fitpc2_wdt.c b/drivers/watchdog/sbc_fitpc2_wdt.c
index c7d67e9a7465..79906255eeb6 100644
--- a/drivers/watchdog/sbc_fitpc2_wdt.c
+++ b/drivers/watchdog/sbc_fitpc2_wdt.c
@@ -201,11 +201,14 @@ static struct miscdevice fitpc2_wdt_miscdev = {
 static int __init fitpc2_wdt_init(void)
 {
         int err;
+        const char *brd_name;
 
-        if (!strstr(dmi_get_system_info(DMI_BOARD_NAME), "SBC-FITPC2"))
+        brd_name = dmi_get_system_info(DMI_BOARD_NAME);
+
+        if (!brd_name || !strstr(brd_name, "SBC-FITPC2"))
                 return -ENODEV;
 
-        pr_info("%s found\n", dmi_get_system_info(DMI_BOARD_NAME));
+        pr_info("%s found\n", brd_name);
 
         if (!request_region(COMMAND_PORT, 1, WATCHDOG_NAME)) {
                 pr_err("I/O address 0x%04x already in use\n", COMMAND_PORT);
diff --git a/drivers/watchdog/sch311x_wdt.c b/drivers/watchdog/sch311x_wdt.c
index 0461858e07d0..b61ab1c54293 100644
--- a/drivers/watchdog/sch311x_wdt.c
+++ b/drivers/watchdog/sch311x_wdt.c
@@ -508,7 +508,7 @@ static int __init sch311x_detect(int sio_config_port, unsigned short *addr)
         sch311x_sio_outb(sio_config_port, 0x07, 0x0a);
 
         /* Check if Logical Device Register is currently active */
-        if (sch311x_sio_inb(sio_config_port, 0x30) && 0x01 == 0)
+        if ((sch311x_sio_inb(sio_config_port, 0x30) & 0x01) == 0)
                 printk(KERN_INFO PFX "Seems that LDN 0x0a is not active...\n");
 
         /* Get the base address of the runtime registers */
diff --git a/drivers/watchdog/w83697ug_wdt.c b/drivers/watchdog/w83697ug_wdt.c
index a6c12dec91a1..df2a64dc9672 100644
--- a/drivers/watchdog/w83697ug_wdt.c
+++ b/drivers/watchdog/w83697ug_wdt.c
@@ -109,7 +109,7 @@ static int w83697ug_select_wd_register(void)
         outb_p(0x08, WDT_EFDR); /* select logical device 8 (GPIO2) */
         outb_p(0x30, WDT_EFER); /* select CR30 */
         c = inb_p(WDT_EFDR);
-        outb_p(c || 0x01, WDT_EFDR); /* set bit 0 to activate GPIO2 */
+        outb_p(c | 0x01, WDT_EFDR); /* set bit 0 to activate GPIO2 */
 
         return 0;
 }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 6f820fa23df4..7f78cc78fdd0 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -729,6 +729,15 @@ struct btrfs_space_info {
         u64 disk_total;         /* total bytes on disk, takes mirrors into
                                    account */
 
+        /*
+         * we bump reservation progress every time we decrement
+         * bytes_reserved.  This way people waiting for reservations
+         * know something good has happened and they can check
+         * for progress.  The number here isn't to be trusted, it
+         * just shows reclaim activity
+         */
+        unsigned long reservation_progress;
+
         int full;               /* indicates that we cannot allocate any more
                                    chunks for this space */
         int force_alloc;        /* set if we need to force a chunk alloc for
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 588ff9849873..7b3089b5c2df 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3342,15 +3342,16 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
         u64 max_reclaim;
         u64 reclaimed = 0;
         long time_left;
-        int pause = 1;
         int nr_pages = (2 * 1024 * 1024) >> PAGE_CACHE_SHIFT;
         int loops = 0;
+        unsigned long progress;
 
         block_rsv = &root->fs_info->delalloc_block_rsv;
         space_info = block_rsv->space_info;
 
         smp_mb();
         reserved = space_info->bytes_reserved;
+        progress = space_info->reservation_progress;
 
         if (reserved == 0)
                 return 0;
@@ -3365,31 +3366,36 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
                 writeback_inodes_sb_nr_if_idle(root->fs_info->sb, nr_pages);
 
                 spin_lock(&space_info->lock);
-                if (reserved > space_info->bytes_reserved) {
-                        loops = 0;
+                if (reserved > space_info->bytes_reserved)
                         reclaimed += reserved - space_info->bytes_reserved;
-                } else {
-                        loops++;
-                }
                 reserved = space_info->bytes_reserved;
                 spin_unlock(&space_info->lock);
 
+                loops++;
+
                 if (reserved == 0 || reclaimed >= max_reclaim)
                         break;
 
                 if (trans && trans->transaction->blocked)
                         return -EAGAIN;
 
-                __set_current_state(TASK_INTERRUPTIBLE);
-                time_left = schedule_timeout(pause);
+                time_left = schedule_timeout_interruptible(1);
 
                 /* We were interrupted, exit */
                 if (time_left)
                         break;
 
-                pause <<= 1;
-                if (pause > HZ / 10)
-                        pause = HZ / 10;
+                /* we've kicked the IO a few times, if anything has been freed,
+                 * exit.  There is no sense in looping here for a long time
+                 * when we really need to commit the transaction, or there are
+                 * just too many writers without enough free space
+                 */
+
+                if (loops > 3) {
+                        smp_mb();
+                        if (progress != space_info->reservation_progress)
+                                break;
+                }
 
         }
         return reclaimed >= to_reclaim;
@@ -3612,6 +3618,7 @@ void block_rsv_release_bytes(struct btrfs_block_rsv *block_rsv,
                 if (num_bytes) {
                         spin_lock(&space_info->lock);
                         space_info->bytes_reserved -= num_bytes;
+                        space_info->reservation_progress++;
                         spin_unlock(&space_info->lock);
                 }
         }
@@ -3844,6 +3851,7 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
         if (block_rsv->reserved >= block_rsv->size) {
                 num_bytes = block_rsv->reserved - block_rsv->size;
                 sinfo->bytes_reserved -= num_bytes;
+                sinfo->reservation_progress++;
                 block_rsv->reserved = block_rsv->size;
                 block_rsv->full = 1;
         }
@@ -4005,7 +4013,6 @@ int btrfs_delalloc_reserve_metadata(struct inode *inode, u64 num_bytes)
                 to_reserve = 0;
         }
         spin_unlock(&BTRFS_I(inode)->accounting_lock);
-
         to_reserve += calc_csum_metadata_size(inode, num_bytes);
         ret = reserve_metadata_bytes(NULL, root, block_rsv, to_reserve, 1);
         if (ret)
@@ -4133,6 +4140,7 @@ static int update_block_group(struct btrfs_trans_handle *trans,
                         btrfs_set_block_group_used(&cache->item, old_val);
                         cache->reserved -= num_bytes;
                         cache->space_info->bytes_reserved -= num_bytes;
+                        cache->space_info->reservation_progress++;
                         cache->space_info->bytes_used += num_bytes;
                         cache->space_info->disk_used += num_bytes * factor;
                         spin_unlock(&cache->lock);
@@ -4184,6 +4192,7 @@ static int pin_down_extent(struct btrfs_root *root,
         if (reserved) {
                 cache->reserved -= num_bytes;
                 cache->space_info->bytes_reserved -= num_bytes;
+                cache->space_info->reservation_progress++;
         }
         spin_unlock(&cache->lock);
         spin_unlock(&cache->space_info->lock);
@@ -4234,6 +4243,7 @@ static int update_reserved_bytes(struct btrfs_block_group_cache *cache,
                                 space_info->bytes_readonly += num_bytes;
                         cache->reserved -= num_bytes;
                         space_info->bytes_reserved -= num_bytes;
+                        space_info->reservation_progress++;
                 }
                 spin_unlock(&cache->lock);
                 spin_unlock(&space_info->lock);
@@ -4712,6 +4722,7 @@ void btrfs_free_tree_block(struct btrfs_trans_handle *trans,
                 if (ret) {
                         spin_lock(&cache->space_info->lock);
                         cache->space_info->bytes_reserved -= buf->len;
+                        cache->space_info->reservation_progress++;
                         spin_unlock(&cache->space_info->lock);
                 }
                 goto out;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index fd3f172e94e6..714adc4ac4c2 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -3046,17 +3046,38 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
         }
 
         while (!end) {
-                off = extent_map_end(em);
-                if (off >= max)
-                        end = 1;
+                u64 offset_in_extent;
+
+                /* break if the extent we found is outside the range */
+                if (em->start >= max || extent_map_end(em) < off)
+                        break;
+
+                /*
+                 * get_extent may return an extent that starts before our
+                 * requested range.  We have to make sure the ranges
+                 * we return to fiemap always move forward and don't
+                 * overlap, so adjust the offsets here
+                 */
+                em_start = max(em->start, off);
 
-                em_start = em->start;
-                em_len = em->len;
+                /*
+                 * record the offset from the start of the extent
+                 * for adjusting the disk offset below
+                 */
+                offset_in_extent = em_start - em->start;
                 em_end = extent_map_end(em);
+                em_len = em_end - em_start;
                 emflags = em->flags;
                 disko = 0;
                 flags = 0;
 
+                /*
+                 * bump off for our next call to get_extent
+                 */
+                off = extent_map_end(em);
+                if (off >= max)
+                        end = 1;
+
                 if (em->block_start == EXTENT_MAP_LAST_BYTE) {
                         end = 1;
                         flags |= FIEMAP_EXTENT_LAST;
@@ -3067,7 +3088,7 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                         flags |= (FIEMAP_EXTENT_DELALLOC |
                                   FIEMAP_EXTENT_UNKNOWN);
                 } else {
-                        disko = em->block_start;
+                        disko = em->block_start + offset_in_extent;
                 }
                 if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags))
                         flags |= FIEMAP_EXTENT_ENCODED;
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 7084140d5940..f447b783bb84 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -70,6 +70,19 @@ static noinline int btrfs_copy_from_user(loff_t pos, int num_pages,
 
                 /* Flush processor's dcache for this page */
                 flush_dcache_page(page);
+
+                /*
+                 * if we get a partial write, we can end up with
+                 * partially up to date pages.  These add
+                 * a lot of complexity, so make sure they don't
+                 * happen by forcing this copy to be retried.
+                 *
+                 * The rest of the btrfs_file_write code will fall
+                 * back to page at a time copies after we return 0.
+                 */
+                if (!PageUptodate(page) && copied < count)
+                        copied = 0;
+
                 iov_iter_advance(i, copied);
                 write_bytes -= copied;
                 total_copied += copied;
@@ -763,6 +776,27 @@ out:
 }
 
 /*
+ * on error we return an unlocked page and the error value
+ * on success we return a locked page and 0
+ */
+static int prepare_uptodate_page(struct page *page, u64 pos)
+{
+        int ret = 0;
+
+        if ((pos & (PAGE_CACHE_SIZE - 1)) && !PageUptodate(page)) {
+                ret = btrfs_readpage(NULL, page);
+                if (ret)
+                        return ret;
+                lock_page(page);
+                if (!PageUptodate(page)) {
+                        unlock_page(page);
+                        return -EIO;
+                }
+        }
+        return 0;
+}
+
+/*
  * this gets pages into the page cache and locks them down, it also properly
  * waits for data=ordered extents to finish before allowing the pages to be
  * modified.
@@ -777,6 +811,7 @@ static noinline int prepare_pages(struct btrfs_root *root, struct file *file,
         unsigned long index = pos >> PAGE_CACHE_SHIFT;
         struct inode *inode = fdentry(file)->d_inode;
         int err = 0;
+        int faili = 0;
         u64 start_pos;
         u64 last_pos;
 
@@ -794,15 +829,24 @@ again:
         for (i = 0; i < num_pages; i++) {
                 pages[i] = grab_cache_page(inode->i_mapping, index + i);
                 if (!pages[i]) {
-                        int c;
-                        for (c = i - 1; c >= 0; c--) {
-                                unlock_page(pages[c]);
-                                page_cache_release(pages[c]);
-                        }
-                        return -ENOMEM;
+                        faili = i - 1;
+                        err = -ENOMEM;
+                        goto fail;
+                }
+
+                if (i == 0)
+                        err = prepare_uptodate_page(pages[i], pos);
+                if (i == num_pages - 1)
+                        err = prepare_uptodate_page(pages[i],
+                                                    pos + write_bytes);
+                if (err) {
+                        page_cache_release(pages[i]);
+                        faili = i - 1;
+                        goto fail;
                 }
                 wait_on_page_writeback(pages[i]);
         }
+        err = 0;
         if (start_pos < inode->i_size) {
                 struct btrfs_ordered_extent *ordered;
                 lock_extent_bits(&BTRFS_I(inode)->io_tree,
@@ -842,6 +886,14 @@ again:
                 WARN_ON(!PageLocked(pages[i]));
         }
         return 0;
+fail:
+        while (faili >= 0) {
+                unlock_page(pages[faili]);
+                page_cache_release(pages[faili]);
+                faili--;
+        }
+        return err;
+
 }
 
 static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
@@ -851,7 +903,6 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
         struct file *file = iocb->ki_filp;
         struct inode *inode = fdentry(file)->d_inode;
         struct btrfs_root *root = BTRFS_I(inode)->root;
-        struct page *pinned[2];
         struct page **pages = NULL;
         struct iov_iter i;
         loff_t *ppos = &iocb->ki_pos;
@@ -872,9 +923,6 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
         will_write = ((file->f_flags & O_DSYNC) || IS_SYNC(inode) ||
                       (file->f_flags & O_DIRECT));
 
-        pinned[0] = NULL;
-        pinned[1] = NULL;
-
         start_pos = pos;
 
         vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
@@ -962,32 +1010,6 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
         first_index = pos >> PAGE_CACHE_SHIFT;
         last_index = (pos + iov_iter_count(&i)) >> PAGE_CACHE_SHIFT;
 
-        /*
-         * there are lots of better ways to do this, but this code
-         * makes sure the first and last page in the file range are
-         * up to date and ready for cow
-         */
-        if ((pos & (PAGE_CACHE_SIZE - 1))) {
-                pinned[0] = grab_cache_page(inode->i_mapping, first_index);
-                if (!PageUptodate(pinned[0])) {
-                        ret = btrfs_readpage(NULL, pinned[0]);
-                        BUG_ON(ret);
-                        wait_on_page_locked(pinned[0]);
-                } else {
-                        unlock_page(pinned[0]);
-                }
-        }
-        if ((pos + iov_iter_count(&i)) & (PAGE_CACHE_SIZE - 1)) {
-                pinned[1] = grab_cache_page(inode->i_mapping, last_index);
-                if (!PageUptodate(pinned[1])) {
-                        ret = btrfs_readpage(NULL, pinned[1]);
-                        BUG_ON(ret);
-                        wait_on_page_locked(pinned[1]);
-                } else {
-                        unlock_page(pinned[1]);
-                }
-        }
-
         while (iov_iter_count(&i) > 0) {
                 size_t offset = pos & (PAGE_CACHE_SIZE - 1);
                 size_t write_bytes = min(iov_iter_count(&i),
@@ -1024,8 +1046,20 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb,
 
                 copied = btrfs_copy_from_user(pos, num_pages,
                                            write_bytes, pages, &i);
-                dirty_pages = (copied + offset + PAGE_CACHE_SIZE - 1) >>
-                                PAGE_CACHE_SHIFT;
+
+                /*
+                 * if we have trouble faulting in the pages, fall
+                 * back to one page at a time
+                 */
+                if (copied < write_bytes)
+                        nrptrs = 1;
+
+                if (copied == 0)
+                        dirty_pages = 0;
+                else
+                        dirty_pages = (copied + offset +
+                                       PAGE_CACHE_SIZE - 1) >>
+                                       PAGE_CACHE_SHIFT;
 
                 if (num_pages > dirty_pages) {
                         if (copied > 0)
@@ -1069,10 +1103,6 @@ out:
                 err = ret;
 
         kfree(pages);
-        if (pinned[0])
-                page_cache_release(pinned[0]);
-        if (pinned[1])
-                page_cache_release(pinned[1]);
         *ppos = pos;
 
         /*
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 0efdb65953c5..9007bbd01dbf 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4821,10 +4821,11 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
                 goto fail;
 
         /*
-         * 1 item for inode ref
+         * 2 items for inode and inode ref
          * 2 items for dir items
+         * 1 item for parent inode
          */
-        trans = btrfs_start_transaction(root, 3);
+        trans = btrfs_start_transaction(root, 5);
         if (IS_ERR(trans)) {
                 err = PTR_ERR(trans);
                 goto fail;
@@ -6056,6 +6057,7 @@ static void btrfs_submit_direct(int rw, struct bio *bio, struct inode *inode,
         if (!skip_sum) {
                 dip->csums = kmalloc(sizeof(u32) * bio->bi_vcnt, GFP_NOFS);
                 if (!dip->csums) {
+                        kfree(dip);
                         ret = -ENOMEM;
                         goto free_ordered;
                 }
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index f0aef787a102..ebafa65a29b6 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -60,7 +60,6 @@ int ceph_init_dentry(struct dentry *dentry)
         }
         di->dentry = dentry;
         di->lease_session = NULL;
-        di->parent_inode = igrab(dentry->d_parent->d_inode);
         dentry->d_fsdata = di;
         dentry->d_time = jiffies;
         ceph_dentry_lru_add(dentry);
@@ -410,7 +409,7 @@ more:
         spin_lock(&inode->i_lock);
         if (ci->i_release_count == fi->dir_release_count) {
                 dout(" marking %p complete\n", inode);
-                ci->i_ceph_flags |= CEPH_I_COMPLETE;
+                /* ci->i_ceph_flags |= CEPH_I_COMPLETE; */
                 ci->i_max_offset = filp->f_pos;
         }
         spin_unlock(&inode->i_lock);
@@ -497,6 +496,7 @@ struct dentry *ceph_finish_lookup(struct ceph_mds_request *req,
 
         /* .snap dir? */
         if (err == -ENOENT &&
+            ceph_snap(parent) == CEPH_NOSNAP &&
             strcmp(dentry->d_name.name,
                    fsc->mount_options->snapdir_name) == 0) {
                 struct inode *inode = ceph_get_snapdir(parent);
@@ -993,7 +993,7 @@ static int ceph_d_revalidate(struct dentry *dentry, struct nameidata *nd)
 {
         struct inode *dir;
 
-        if (nd->flags & LOOKUP_RCU)
+        if (nd && nd->flags & LOOKUP_RCU)
                 return -ECHILD;
 
         dir = dentry->d_parent->d_inode;
@@ -1030,28 +1030,8 @@ out_touch:
 static void ceph_dentry_release(struct dentry *dentry)
 {
         struct ceph_dentry_info *di = ceph_dentry(dentry);
-        struct inode *parent_inode = NULL;
-        u64 snapid = CEPH_NOSNAP;
 
-        if (!IS_ROOT(dentry)) {
-                parent_inode = di->parent_inode;
-                if (parent_inode)
-                        snapid = ceph_snap(parent_inode);
-        }
-        dout("dentry_release %p parent %p\n", dentry, parent_inode);
-        if (parent_inode && snapid != CEPH_SNAPDIR) {
-                struct ceph_inode_info *ci = ceph_inode(parent_inode);
-
-                spin_lock(&parent_inode->i_lock);
-                if (ci->i_shared_gen == di->lease_shared_gen ||
-                    snapid <= CEPH_MAXSNAP) {
-                        dout(" clearing %p complete (d_release)\n",
-                             parent_inode);
-                        ci->i_ceph_flags &= ~CEPH_I_COMPLETE;
-                        ci->i_release_count++;
-                }
-                spin_unlock(&parent_inode->i_lock);
-        }
+        dout("dentry_release %p\n", dentry);
         if (di) {
                 ceph_dentry_lru_del(dentry);
                 if (di->lease_session)
@@ -1059,8 +1039,6 @@ static void ceph_dentry_release(struct dentry *dentry)
                 kmem_cache_free(ceph_dentry_cachep, di);
                 dentry->d_fsdata = NULL;
         }
-        if (parent_inode)
-                iput(parent_inode);
 }
 
 static int ceph_snapdir_d_revalidate(struct dentry *dentry,
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 5625463aa479..193bfa5e9cbd 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -707,7 +707,7 @@ static int fill_inode(struct inode *inode,
                     (issued & CEPH_CAP_FILE_EXCL) == 0 &&
                     (ci->i_ceph_flags & CEPH_I_COMPLETE) == 0) {
                         dout(" marking %p complete (empty)\n", inode);
-                        ci->i_ceph_flags |= CEPH_I_COMPLETE;
+                        /* ci->i_ceph_flags |= CEPH_I_COMPLETE; */
                         ci->i_max_offset = 2;
                 }
                 break;
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 88fcaa21b801..20b907d76ae2 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -207,7 +207,6 @@ struct ceph_dentry_info {
         struct dentry *dentry;
         u64 time;
         u64 offset;
-        struct inode *parent_inode;
 };
 
 struct ceph_inode_xattrs_info {
diff --git a/fs/compat.c b/fs/compat.c
index f6fd0a00e6cc..691c3fd8ce1d 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1228,7 +1228,9 @@ compat_sys_preadv(unsigned long fd, const struct compat_iovec __user *vec,
         file = fget_light(fd, &fput_needed);
         if (!file)
                 return -EBADF;
-        ret = compat_readv(file, vec, vlen, &pos);
+        ret = -ESPIPE;
+        if (file->f_mode & FMODE_PREAD)
+                ret = compat_readv(file, vec, vlen, &pos);
         fput_light(file, fput_needed);
         return ret;
 }
@@ -1285,7 +1287,9 @@ compat_sys_pwritev(unsigned long fd, const struct compat_iovec __user *vec,
         file = fget_light(fd, &fput_needed);
         if (!file)
                 return -EBADF;
-        ret = compat_writev(file, vec, vlen, &pos);
+        ret = -ESPIPE;
+        if (file->f_mode & FMODE_PWRITE)
+                ret = compat_writev(file, vec, vlen, &pos);
         fput_light(file, fput_needed);
         return ret;
 }
diff --git a/fs/dcache.c b/fs/dcache.c
index 2a6bd9a4ae97..611ffe928c03 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1523,6 +1523,28 @@ struct dentry * d_alloc_root(struct inode * root_inode)
 }
 EXPORT_SYMBOL(d_alloc_root);
 
+static struct dentry * __d_find_any_alias(struct inode *inode)
+{
+        struct dentry *alias;
+
+        if (list_empty(&inode->i_dentry))
+                return NULL;
+        alias = list_first_entry(&inode->i_dentry, struct dentry, d_alias);
+        __dget(alias);
+        return alias;
+}
+
+static struct dentry * d_find_any_alias(struct inode *inode)
+{
+        struct dentry *de;
+
+        spin_lock(&inode->i_lock);
+        de = __d_find_any_alias(inode);
+        spin_unlock(&inode->i_lock);
+        return de;
+}
+
+
 /**
  * d_obtain_alias - find or allocate a dentry for a given inode
  * @inode: inode to allocate the dentry for
@@ -1552,7 +1574,7 @@ struct dentry *d_obtain_alias(struct inode *inode)
         if (IS_ERR(inode))
                 return ERR_CAST(inode);
 
-        res = d_find_alias(inode);
+        res = d_find_any_alias(inode);
         if (res)
                 goto out_iput;
 
@@ -1565,7 +1587,7 @@ struct dentry *d_obtain_alias(struct inode *inode)
 
 
         spin_lock(&inode->i_lock);
-        res = __d_find_alias(inode, 0);
+        res = __d_find_any_alias(inode);
         if (res) {
                 spin_unlock(&inode->i_lock);
                 dput(tmp);
diff --git a/fs/exofs/namei.c b/fs/exofs/namei.c
index 264e95d02830..4d70db110cfc 100644
--- a/fs/exofs/namei.c
+++ b/fs/exofs/namei.c
@@ -272,7 +272,6 @@ static int exofs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 new_de = exofs_find_entry(new_dir, new_dentry, &new_page);
                 if (!new_de)
                         goto out_dir;
-                inode_inc_link_count(old_inode);
                 err = exofs_set_link(new_dir, new_de, new_page, old_inode);
                 new_inode->i_ctime = CURRENT_TIME;
                 if (dir_de)
@@ -286,12 +285,9 @@ static int exofs_rename(struct inode *old_dir, struct dentry *old_dentry,
                         if (new_dir->i_nlink >= EXOFS_LINK_MAX)
                                 goto out_dir;
                 }
-                inode_inc_link_count(old_inode);
                 err = exofs_add_link(new_dentry, old_inode);
-                if (err) {
-                        inode_dec_link_count(old_inode);
+                if (err)
                         goto out_dir;
-                }
                 if (dir_de)
                         inode_inc_link_count(new_dir);
         }
@@ -299,7 +295,7 @@ static int exofs_rename(struct inode *old_dir, struct dentry *old_dentry,
         old_inode->i_ctime = CURRENT_TIME;
 
         exofs_delete_entry(old_de, old_page);
-        inode_dec_link_count(old_inode);
+        mark_inode_dirty(old_inode);
 
         if (dir_de) {
                 err = exofs_set_link(old_inode, dir_de, dir_page, new_dir);
diff --git a/fs/ext2/namei.c b/fs/ext2/namei.c
index 2e1d8341d827..adb91855ccd0 100644
--- a/fs/ext2/namei.c
+++ b/fs/ext2/namei.c
@@ -344,7 +344,6 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
                 new_de = ext2_find_entry (new_dir, &new_dentry->d_name, &new_page);
                 if (!new_de)
                         goto out_dir;
-                inode_inc_link_count(old_inode);
                 ext2_set_link(new_dir, new_de, new_page, old_inode, 1);
                 new_inode->i_ctime = CURRENT_TIME_SEC;
                 if (dir_de)
@@ -356,12 +355,9 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
                         if (new_dir->i_nlink >= EXT2_LINK_MAX)
                                 goto out_dir;
                 }
-                inode_inc_link_count(old_inode);
                 err = ext2_add_link(new_dentry, old_inode);
-                if (err) {
-                        inode_dec_link_count(old_inode);
+                if (err)
                         goto out_dir;
-                }
                 if (dir_de)
                         inode_inc_link_count(new_dir);
         }
@@ -369,12 +365,11 @@ static int ext2_rename (struct inode * old_dir, struct dentry * old_dentry,
         /*
          * Like most other Unix systems, set the ctime for inodes on a
          * rename.
-         * inode_dec_link_count() will mark the inode dirty.
          */
         old_inode->i_ctime = CURRENT_TIME_SEC;
+        mark_inode_dirty(old_inode);
 
         ext2_delete_entry (old_de, old_page);
-        inode_dec_link_count(old_inode);
 
         if (dir_de) {
                 if (old_dir != new_dir)
diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
index f88f752babd9..adae3fb7451a 100644
--- a/fs/fat/namei_vfat.c
+++ b/fs/fat/namei_vfat.c
@@ -43,7 +43,7 @@ static int vfat_revalidate_shortname(struct dentry *dentry)
 
 static int vfat_revalidate(struct dentry *dentry, struct nameidata *nd)
 {
-        if (nd->flags & LOOKUP_RCU)
+        if (nd && nd->flags & LOOKUP_RCU)
                 return -ECHILD;
 
         /* This is not negative dentry. Always valid. */
@@ -54,7 +54,7 @@ static int vfat_revalidate(struct dentry *dentry, struct nameidata *nd)
 
 static int vfat_revalidate_ci(struct dentry *dentry, struct nameidata *nd)
 {
-        if (nd->flags & LOOKUP_RCU)
+        if (nd && nd->flags & LOOKUP_RCU)
                 return -ECHILD;
 
         /*
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 83543b5ff941..8bd0ef9286c3 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -158,7 +158,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
 {
         struct inode *inode;
 
-        if (nd->flags & LOOKUP_RCU)
+        if (nd && nd->flags & LOOKUP_RCU)
                 return -ECHILD;
 
         inode = entry->d_inode;
diff --git a/fs/gfs2/dentry.c b/fs/gfs2/dentry.c
index 4a456338b873..0da8da2c991d 100644
--- a/fs/gfs2/dentry.c
+++ b/fs/gfs2/dentry.c
@@ -44,7 +44,7 @@ static int gfs2_drevalidate(struct dentry *dentry, struct nameidata *nd)
         int error;
         int had_lock = 0;
 
-        if (nd->flags & LOOKUP_RCU)
+        if (nd && nd->flags & LOOKUP_RCU)
                 return -ECHILD;
 
         parent = dget_parent(dentry);
diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c
index afa66aaa2237..b4d70b13be92 100644
--- a/fs/hfs/dir.c
+++ b/fs/hfs/dir.c
@@ -238,46 +238,22 @@ static int hfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 }
 
 /*
- * hfs_unlink()
+ * hfs_remove()
  *
- * This is the unlink() entry in the inode_operations structure for
- * regular HFS directories.  The purpose is to delete an existing
- * file, given the inode for the parent directory and the name
- * (and its length) of the existing file.
- */
-static int hfs_unlink(struct inode *dir, struct dentry *dentry)
-{
-        struct inode *inode;
-        int res;
-
-        inode = dentry->d_inode;
-        res = hfs_cat_delete(inode->i_ino, dir, &dentry->d_name);
-        if (res)
-                return res;
-
-        drop_nlink(inode);
-        hfs_delete_inode(inode);
-        inode->i_ctime = CURRENT_TIME_SEC;
-        mark_inode_dirty(inode);
-
-        return res;
-}
-
-/*
- * hfs_rmdir()
+ * This serves as both unlink() and rmdir() in the inode_operations
+ * structure for regular HFS directories.  The purpose is to delete
+ * an existing child, given the inode for the parent directory and
+ * the name (and its length) of the existing directory.
  *
- * This is the rmdir() entry in the inode_operations structure for
- * regular HFS directories.  The purpose is to delete an existing
- * directory, given the inode for the parent directory and the name
- * (and its length) of the existing directory.
+ * HFS does not have hardlinks, so both rmdir and unlink set the
+ * link count to 0.  The only difference is the emptiness check.
  */
-static int hfs_rmdir(struct inode *dir, struct dentry *dentry)
+static int hfs_remove(struct inode *dir, struct dentry *dentry)
 {
-        struct inode *inode;
+        struct inode *inode = dentry->d_inode;
         int res;
 
-        inode = dentry->d_inode;
-        if (inode->i_size != 2)
+        if (S_ISDIR(inode->i_mode) && inode->i_size != 2)
                 return -ENOTEMPTY;
         res = hfs_cat_delete(inode->i_ino, dir, &dentry->d_name);
         if (res)
@@ -307,7 +283,7 @@ static int hfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         /* Unlink destination if it already exists */
         if (new_dentry->d_inode) {
-                res = hfs_unlink(new_dir, new_dentry);
+                res = hfs_remove(new_dir, new_dentry);
                 if (res)
                         return res;
         }
@@ -332,9 +308,9 @@ const struct file_operations hfs_dir_operations = {
 const struct inode_operations hfs_dir_inode_operations = {
         .create         = hfs_create,
         .lookup         = hfs_lookup,
-        .unlink         = hfs_unlink,
+        .unlink         = hfs_remove,
         .mkdir          = hfs_mkdir,
-        .rmdir          = hfs_rmdir,
+        .rmdir          = hfs_remove,
         .rename         = hfs_rename,
         .setattr        = hfs_inode_setattr,
 };
diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 81ead850ddb6..5a2b269428a6 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1600,7 +1600,7 @@ out:
 
 static int jfs_ci_revalidate(struct dentry *dentry, struct nameidata *nd)
 {
-        if (nd->flags & LOOKUP_RCU)
+        if (nd && nd->flags & LOOKUP_RCU)
                 return -ECHILD;
         /*
          * This is not negative dentry. Always valid.
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index ce7337ddfdbf..6e6777f1b4b2 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -213,7 +213,6 @@ static int minix_rename(struct inode * old_dir, struct dentry *old_dentry,
                 new_de = minix_find_entry(new_dentry, &new_page);
                 if (!new_de)
                         goto out_dir;
-                inode_inc_link_count(old_inode);
                 minix_set_link(new_de, new_page, old_inode);
                 new_inode->i_ctime = CURRENT_TIME_SEC;
                 if (dir_de)
@@ -225,18 +224,15 @@ static int minix_rename(struct inode * old_dir, struct dentry *old_dentry,
                         if (new_dir->i_nlink >= info->s_link_max)
                                 goto out_dir;
                 }
-                inode_inc_link_count(old_inode);
                 err = minix_add_link(new_dentry, old_inode);
-                if (err) {
-                        inode_dec_link_count(old_inode);
+                if (err)
                         goto out_dir;
-                }
                 if (dir_de)
                         inode_inc_link_count(new_dir);
         }
 
         minix_delete_entry(old_de, old_page);
-        inode_dec_link_count(old_inode);
+        mark_inode_dirty(old_inode);
 
         if (dir_de) {
                 minix_set_link(dir_de, dir_page, new_dir);
diff --git a/fs/namei.c b/fs/namei.c
index 0087cf9c2c6b..a4689eb2df28 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1546,6 +1546,7 @@ static int path_walk(const char *name, struct nameidata *nd)
                 /* nd->path had been dropped */
                 current->total_link_count = 0;
                 nd->path = save;
+                nd->inode = save.dentry->d_inode;
                 path_get(&nd->path);
                 nd->flags |= LOOKUP_REVAL;
                 result = link_path_walk(name, nd);
@@ -2455,22 +2456,29 @@ struct file *do_filp_open(int dfd, const char *pathname,
         /* !O_CREAT, simple open */
         error = do_path_lookup(dfd, pathname, flags, &nd);
         if (unlikely(error))
-                goto out_filp;
+                goto out_filp2;
         error = -ELOOP;
         if (!(nd.flags & LOOKUP_FOLLOW)) {
                 if (nd.inode->i_op->follow_link)
-                        goto out_path;
+                        goto out_path2;
         }
         error = -ENOTDIR;
         if (nd.flags & LOOKUP_DIRECTORY) {
                 if (!nd.inode->i_op->lookup)
-                        goto out_path;
+                        goto out_path2;
         }
         audit_inode(pathname, nd.path.dentry);
         filp = finish_open(&nd, open_flag, acc_mode);
+out2:
         release_open_intent(&nd);
         return filp;
 
+out_path2:
+        path_put(&nd.path);
+out_filp2:
+        filp = ERR_PTR(error);
+        goto out2;
+
 creat:
         /* OK, have to create the file. Find the parent. */
         error = path_init_rcu(dfd, pathname,
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 1cc600e77bb4..2f8e61816d75 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -37,6 +37,7 @@
 #include <linux/inet.h>
 #include <linux/nfs_xdr.h>
 #include <linux/slab.h>
+#include <linux/compat.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -89,7 +90,11 @@ int nfs_wait_bit_killable(void *word)
  */
 u64 nfs_compat_user_ino64(u64 fileid)
 {
-        int ino;
+#ifdef CONFIG_COMPAT
+        compat_ulong_t ino;
+#else   
+        unsigned long ino;
+#endif
 
         if (enable_ino64)
                 return fileid;
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 7a7474073148..1be36cf65bfc 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -298,6 +298,11 @@ struct rpc_cred *nfs4_get_renew_cred_locked(struct nfs_client *clp);
 #if defined(CONFIG_NFS_V4_1)
 struct rpc_cred *nfs4_get_machine_cred_locked(struct nfs_client *clp);
 struct rpc_cred *nfs4_get_exchange_id_cred(struct nfs_client *clp);
+extern void nfs4_schedule_session_recovery(struct nfs4_session *);
+#else
+static inline void nfs4_schedule_session_recovery(struct nfs4_session *session)
+{
+}
 #endif /* CONFIG_NFS_V4_1 */
 
 extern struct nfs4_state_owner * nfs4_get_state_owner(struct nfs_server *, struct rpc_cred *);
@@ -307,10 +312,9 @@ extern void nfs4_put_open_state(struct nfs4_state *);
 extern void nfs4_close_state(struct path *, struct nfs4_state *, fmode_t);
 extern void nfs4_close_sync(struct path *, struct nfs4_state *, fmode_t);
 extern void nfs4_state_set_mode_locked(struct nfs4_state *, fmode_t);
-extern void nfs4_schedule_state_recovery(struct nfs_client *);
+extern void nfs4_schedule_lease_recovery(struct nfs_client *);
 extern void nfs4_schedule_state_manager(struct nfs_client *);
-extern int nfs4_state_mark_reclaim_nograce(struct nfs_client *clp, struct nfs4_state *state);
-extern int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state);
+extern void nfs4_schedule_stateid_recovery(const struct nfs_server *, struct nfs4_state *);
 extern void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags);
 extern void nfs41_handle_recall_slot(struct nfs_client *clp);
 extern void nfs4_put_lock_state(struct nfs4_lock_state *lsp);
diff --git a/fs/nfs/nfs4filelayoutdev.c b/fs/nfs/nfs4filelayoutdev.c
index f5c9b125e8cc..b73c34375f60 100644
--- a/fs/nfs/nfs4filelayoutdev.c
+++ b/fs/nfs/nfs4filelayoutdev.c
@@ -219,6 +219,10 @@ decode_and_add_ds(__be32 **pp, struct inode *inode)
                 goto out_err;
         }
         buf = kmalloc(rlen + 1, GFP_KERNEL);
+        if (!buf) {
+                dprintk("%s: Not enough memory\n", __func__);
+                goto out_err;
+        }
         buf[rlen] = '\0';
         memcpy(buf, r_addr, rlen);
 
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 78936a8f40ab..0a07e353a961 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -256,12 +256,13 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                 case -NFS4ERR_OPENMODE:
                         if (state == NULL)
                                 break;
-                        nfs4_state_mark_reclaim_nograce(clp, state);
-                        goto do_state_recovery;
+                        nfs4_schedule_stateid_recovery(server, state);
+                        goto wait_on_recovery;
                 case -NFS4ERR_STALE_STATEID:
                 case -NFS4ERR_STALE_CLIENTID:
                 case -NFS4ERR_EXPIRED:
-                        goto do_state_recovery;
+                        nfs4_schedule_lease_recovery(clp);
+                        goto wait_on_recovery;
 #if defined(CONFIG_NFS_V4_1)
                 case -NFS4ERR_BADSESSION:
                 case -NFS4ERR_BADSLOT:
@@ -272,7 +273,7 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                 case -NFS4ERR_SEQ_MISORDERED:
                         dprintk("%s ERROR: %d Reset session\n", __func__,
                                 errorcode);
-                        nfs4_schedule_state_recovery(clp);
+                        nfs4_schedule_session_recovery(clp->cl_session);
                         exception->retry = 1;
                         break;
 #endif /* defined(CONFIG_NFS_V4_1) */
@@ -295,8 +296,7 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
         }
         /* We failed to handle the error */
         return nfs4_map_errors(ret);
-do_state_recovery:
-        nfs4_schedule_state_recovery(clp);
+wait_on_recovery:
         ret = nfs4_wait_clnt_recover(clp);
         if (ret == 0)
                 exception->retry = 1;
@@ -435,8 +435,8 @@ static int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *
                 clp = res->sr_session->clp;
                 do_renew_lease(clp, timestamp);
                 /* Check sequence flags */
-                if (atomic_read(&clp->cl_count) > 1)
-                        nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags);
+                if (res->sr_status_flags != 0)
+                        nfs4_schedule_lease_recovery(clp);
                 break;
         case -NFS4ERR_DELAY:
                 /* The server detected a resend of the RPC call and
@@ -1255,14 +1255,13 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state
                         case -NFS4ERR_BAD_HIGH_SLOT:
                         case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
                         case -NFS4ERR_DEADSESSION:
-                                nfs4_schedule_state_recovery(
-                                        server->nfs_client);
+                                nfs4_schedule_session_recovery(server->nfs_client->cl_session);
                                 goto out;
                         case -NFS4ERR_STALE_CLIENTID:
                         case -NFS4ERR_STALE_STATEID:
                         case -NFS4ERR_EXPIRED:
                                 /* Don't recall a delegation if it was lost */
-                                nfs4_schedule_state_recovery(server->nfs_client);
+                                nfs4_schedule_lease_recovery(server->nfs_client);
                                 goto out;
                         case -ERESTARTSYS:
                                 /*
@@ -1271,7 +1270,7 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state
                                  */
                         case -NFS4ERR_ADMIN_REVOKED:
                         case -NFS4ERR_BAD_STATEID:
-                                nfs4_state_mark_reclaim_nograce(server->nfs_client, state);
+                                nfs4_schedule_stateid_recovery(server, state);
                         case -EKEYEXPIRED:
                                 /*
                                  * User RPCSEC_GSS context has expired.
@@ -1587,7 +1586,7 @@ static int nfs4_recover_expired_lease(struct nfs_server *server)
                 if (!test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) &&
                     !test_bit(NFS4CLNT_CHECK_LEASE,&clp->cl_state))
                         break;
-                nfs4_schedule_state_recovery(clp);
+                nfs4_schedule_state_manager(clp);
                 ret = -EIO;
         }
         return ret;
@@ -3178,7 +3177,7 @@ static void nfs4_renew_done(struct rpc_task *task, void *calldata)
         if (task->tk_status < 0) {
                 /* Unless we're shutting down, schedule state recovery! */
                 if (test_bit(NFS_CS_RENEWD, &clp->cl_res_state) != 0)
-                        nfs4_schedule_state_recovery(clp);
+                        nfs4_schedule_lease_recovery(clp);
                 return;
         }
         do_renew_lease(clp, timestamp);
@@ -3252,6 +3251,35 @@ static void buf_to_pages(const void *buf, size_t buflen,
         }
 }
 
+static int buf_to_pages_noslab(const void *buf, size_t buflen,
+                struct page **pages, unsigned int *pgbase)
+{
+        struct page *newpage, **spages;
+        int rc = 0;
+        size_t len;
+        spages = pages;
+
+        do {
+                len = min_t(size_t, PAGE_CACHE_SIZE, buflen);
+                newpage = alloc_page(GFP_KERNEL);
+
+                if (newpage == NULL)
+                        goto unwind;
+                memcpy(page_address(newpage), buf, len);
+                buf += len;
+                buflen -= len;
+                *pages++ = newpage;
+                rc++;
+        } while (buflen != 0);
+
+        return rc;
+
+unwind:
+        for(; rc > 0; rc--)
+                __free_page(spages[rc-1]);
+        return -ENOMEM;
+}
+
 struct nfs4_cached_acl {
         int cached;
         size_t len;
@@ -3420,13 +3448,23 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl
                 .rpc_argp       = &arg,
                 .rpc_resp       = &res,
         };
-        int ret;
+        int ret, i;
 
         if (!nfs4_server_supports_acls(server))
                 return -EOPNOTSUPP;
+        i = buf_to_pages_noslab(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
+        if (i < 0)
+                return i;
         nfs_inode_return_delegation(inode);
-        buf_to_pages(buf, buflen, arg.acl_pages, &arg.acl_pgbase);
         ret = nfs4_call_sync(server, &msg, &arg, &res, 1);
+
+        /*
+         * Free each page after tx, so the only ref left is
+         * held by the network stack
+         */
+        for (; i > 0; i--)
+                put_page(pages[i-1]);
+
         /*
          * Acl update can result in inode attribute update.
          * so mark the attribute cache invalid.
@@ -3464,12 +3502,13 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                 case -NFS4ERR_OPENMODE:
                         if (state == NULL)
                                 break;
-                        nfs4_state_mark_reclaim_nograce(clp, state);
-                        goto do_state_recovery;
+                        nfs4_schedule_stateid_recovery(server, state);
+                        goto wait_on_recovery;
                 case -NFS4ERR_STALE_STATEID:
                 case -NFS4ERR_STALE_CLIENTID:
                 case -NFS4ERR_EXPIRED:
-                        goto do_state_recovery;
+                        nfs4_schedule_lease_recovery(clp);
+                        goto wait_on_recovery;
 #if defined(CONFIG_NFS_V4_1)
                 case -NFS4ERR_BADSESSION:
                 case -NFS4ERR_BADSLOT:
@@ -3480,7 +3519,7 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                 case -NFS4ERR_SEQ_MISORDERED:
                         dprintk("%s ERROR %d, Reset session\n", __func__,
                                 task->tk_status);
-                        nfs4_schedule_state_recovery(clp);
+                        nfs4_schedule_session_recovery(clp->cl_session);
                         task->tk_status = 0;
                         return -EAGAIN;
 #endif /* CONFIG_NFS_V4_1 */
@@ -3497,9 +3536,8 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
         }
         task->tk_status = nfs4_map_errors(task->tk_status);
         return 0;
-do_state_recovery:
+wait_on_recovery:
         rpc_sleep_on(&clp->cl_rpcwaitq, task, NULL);
-        nfs4_schedule_state_recovery(clp);
         if (test_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) == 0)
                 rpc_wake_up_queued_task(&clp->cl_rpcwaitq, task);
         task->tk_status = 0;
@@ -4110,7 +4148,7 @@ static void nfs4_lock_release(void *calldata)
                 task = nfs4_do_unlck(&data->fl, data->ctx, data->lsp,
                                 data->arg.lock_seqid);
                 if (!IS_ERR(task))
-                        rpc_put_task(task);
+                        rpc_put_task_async(task);
                 dprintk("%s: cancelling lock!\n", __func__);
         } else
                 nfs_free_seqid(data->arg.lock_seqid);
@@ -4134,23 +4172,18 @@ static const struct rpc_call_ops nfs4_recover_lock_ops = {
 
 static void nfs4_handle_setlk_error(struct nfs_server *server, struct nfs4_lock_state *lsp, int new_lock_owner, int error)
 {
-        struct nfs_client *clp = server->nfs_client;
-        struct nfs4_state *state = lsp->ls_state;
-
         switch (error) {
         case -NFS4ERR_ADMIN_REVOKED:
         case -NFS4ERR_BAD_STATEID:
-        case -NFS4ERR_EXPIRED:
+                lsp->ls_seqid.flags &= ~NFS_SEQID_CONFIRMED;
                 if (new_lock_owner != 0 ||
                    (lsp->ls_flags & NFS_LOCK_INITIALIZED) != 0)
-                        nfs4_state_mark_reclaim_nograce(clp, state);
-                lsp->ls_seqid.flags &= ~NFS_SEQID_CONFIRMED;
+                        nfs4_schedule_stateid_recovery(server, lsp->ls_state);
                 break;
         case -NFS4ERR_STALE_STATEID:
-                if (new_lock_owner != 0 ||
-                    (lsp->ls_flags & NFS_LOCK_INITIALIZED) != 0)
-                        nfs4_state_mark_reclaim_reboot(clp, state);
                 lsp->ls_seqid.flags &= ~NFS_SEQID_CONFIRMED;
+        case -NFS4ERR_EXPIRED:
+                nfs4_schedule_lease_recovery(server->nfs_client);
         };
 }
 
@@ -4366,12 +4399,14 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
                         case -NFS4ERR_EXPIRED:
                         case -NFS4ERR_STALE_CLIENTID:
                         case -NFS4ERR_STALE_STATEID:
+                                nfs4_schedule_lease_recovery(server->nfs_client);
+                                goto out;
                         case -NFS4ERR_BADSESSION:
                         case -NFS4ERR_BADSLOT:
                         case -NFS4ERR_BAD_HIGH_SLOT:
                         case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
                         case -NFS4ERR_DEADSESSION:
-                                nfs4_schedule_state_recovery(server->nfs_client);
+                                nfs4_schedule_session_recovery(server->nfs_client->cl_session);
                                 goto out;
                         case -ERESTARTSYS:
                                 /*
@@ -4381,7 +4416,7 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
                         case -NFS4ERR_ADMIN_REVOKED:
                         case -NFS4ERR_BAD_STATEID:
                         case -NFS4ERR_OPENMODE:
-                                nfs4_state_mark_reclaim_nograce(server->nfs_client, state);
+                                nfs4_schedule_stateid_recovery(server, state);
                                 err = 0;
                                 goto out;
                         case -EKEYEXPIRED:
@@ -4988,10 +5023,20 @@ int nfs4_proc_create_session(struct nfs_client *clp)
         int status;
         unsigned *ptr;
         struct nfs4_session *session = clp->cl_session;
+        long timeout = 0;
+        int err;
 
         dprintk("--> %s clp=%p session=%p\n", __func__, clp, session);
 
-        status = _nfs4_proc_create_session(clp);
+        do {
+                status = _nfs4_proc_create_session(clp);
+                if (status == -NFS4ERR_DELAY) {
+                        err = nfs4_delay(clp->cl_rpcclient, &timeout);
+                        if (err)
+                                status = err;
+                }
+        } while (status == -NFS4ERR_DELAY);
+
         if (status)
                 goto out;
 
@@ -5100,7 +5145,7 @@ static int nfs41_sequence_handle_errors(struct rpc_task *task, struct nfs_client
                 rpc_delay(task, NFS4_POLL_RETRY_MAX);
                 return -EAGAIN;
         default:
-                nfs4_schedule_state_recovery(clp);
+                nfs4_schedule_lease_recovery(clp);
         }
         return 0;
 }
@@ -5187,7 +5232,7 @@ static int nfs41_proc_async_sequence(struct nfs_client *clp, struct rpc_cred *cr
         if (IS_ERR(task))
                 ret = PTR_ERR(task);
         else
-                rpc_put_task(task);
+                rpc_put_task_async(task);
         dprintk("<-- %s status=%d\n", __func__, ret);
         return ret;
 }
@@ -5203,8 +5248,13 @@ static int nfs4_proc_sequence(struct nfs_client *clp, struct rpc_cred *cred)
                 goto out;
         }
         ret = rpc_wait_for_completion_task(task);
-        if (!ret)
+        if (!ret) {
+                struct nfs4_sequence_res *res = task->tk_msg.rpc_resp;
+
+                if (task->tk_status == 0)
+                        nfs41_handle_sequence_flag_errors(clp, res->sr_status_flags);
                 ret = task->tk_status;
+        }
         rpc_put_task(task);
 out:
         dprintk("<-- %s status=%d\n", __func__, ret);
@@ -5241,7 +5291,7 @@ static int nfs41_reclaim_complete_handle_errors(struct rpc_task *task, struct nf
                 rpc_delay(task, NFS4_POLL_RETRY_MAX);
                 return -EAGAIN;
         default:
-                nfs4_schedule_state_recovery(clp);
+                nfs4_schedule_lease_recovery(clp);
         }
         return 0;
 }
@@ -5309,6 +5359,9 @@ static int nfs41_proc_reclaim_complete(struct nfs_client *clp)
                 status = PTR_ERR(task);
                 goto out;
         }
+        status = nfs4_wait_for_completion_rpc_task(task);
+        if (status == 0)
+                status = task->tk_status;
         rpc_put_task(task);
         return 0;
 out:
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index e6742b57a04c..0592288f9f06 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1007,9 +1007,9 @@ void nfs4_schedule_state_manager(struct nfs_client *clp)
 }
 
 /*
- * Schedule a state recovery attempt
+ * Schedule a lease recovery attempt
  */
-void nfs4_schedule_state_recovery(struct nfs_client *clp)
+void nfs4_schedule_lease_recovery(struct nfs_client *clp)
 {
         if (!clp)
                 return;
@@ -1018,7 +1018,7 @@ void nfs4_schedule_state_recovery(struct nfs_client *clp)
         nfs4_schedule_state_manager(clp);
 }
 
-int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state)
+static int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state)
 {
 
         set_bit(NFS_STATE_RECLAIM_REBOOT, &state->flags);
@@ -1032,7 +1032,7 @@ int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *st
         return 1;
 }
 
-int nfs4_state_mark_reclaim_nograce(struct nfs_client *clp, struct nfs4_state *state)
+static int nfs4_state_mark_reclaim_nograce(struct nfs_client *clp, struct nfs4_state *state)
 {
         set_bit(NFS_STATE_RECLAIM_NOGRACE, &state->flags);
         clear_bit(NFS_STATE_RECLAIM_REBOOT, &state->flags);
@@ -1041,6 +1041,14 @@ int nfs4_state_mark_reclaim_nograce(struct nfs_client *clp, struct nfs4_state *s
         return 1;
 }
 
+void nfs4_schedule_stateid_recovery(const struct nfs_server *server, struct nfs4_state *state)
+{
+        struct nfs_client *clp = server->nfs_client;
+
+        nfs4_state_mark_reclaim_nograce(clp, state);
+        nfs4_schedule_state_manager(clp);
+}
+
 static int nfs4_reclaim_locks(struct nfs4_state *state, const struct nfs4_state_recovery_ops *ops)
 {
         struct inode *inode = state->inode;
@@ -1436,10 +1444,15 @@ static int nfs4_reclaim_lease(struct nfs_client *clp)
 }
 
 #ifdef CONFIG_NFS_V4_1
+void nfs4_schedule_session_recovery(struct nfs4_session *session)
+{
+        nfs4_schedule_lease_recovery(session->clp);
+}
+
 void nfs41_handle_recall_slot(struct nfs_client *clp)
 {
         set_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
-        nfs4_schedule_state_recovery(clp);
+        nfs4_schedule_state_manager(clp);
 }
 
 static void nfs4_reset_all_state(struct nfs_client *clp)
@@ -1447,7 +1460,7 @@ static void nfs4_reset_all_state(struct nfs_client *clp)
         if (test_and_set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) == 0) {
                 clp->cl_boot_time = CURRENT_TIME;
                 nfs4_state_start_reclaim_nograce(clp);
-                nfs4_schedule_state_recovery(clp);
+                nfs4_schedule_state_manager(clp);
         }
 }
 
@@ -1455,7 +1468,7 @@ static void nfs41_handle_server_reboot(struct nfs_client *clp)
 {
         if (test_and_set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) == 0) {
                 nfs4_state_start_reclaim_reboot(clp);
-                nfs4_schedule_state_recovery(clp);
+                nfs4_schedule_state_manager(clp);
         }
 }
 
@@ -1475,7 +1488,7 @@ static void nfs41_handle_cb_path_down(struct nfs_client *clp)
 {
         nfs_expire_all_delegations(clp);
         if (test_and_set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state) == 0)
-                nfs4_schedule_state_recovery(clp);
+                nfs4_schedule_state_manager(clp);
 }
 
 void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags)
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 4e2c168b6ee9..94d50e86a124 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1660,7 +1660,7 @@ static void encode_create_session(struct xdr_stream *xdr,
 
         p = reserve_space(xdr, 20 + 2*28 + 20 + len + 12);
         *p++ = cpu_to_be32(OP_CREATE_SESSION);
-        p = xdr_encode_hyper(p, clp->cl_ex_clid);
+        p = xdr_encode_hyper(p, clp->cl_clientid);
         *p++ = cpu_to_be32(clp->cl_seqid);                      /*Sequence id */
         *p++ = cpu_to_be32(args->flags);                        /*flags */
 
@@ -4694,7 +4694,7 @@ static int decode_exchange_id(struct xdr_stream *xdr,
         p = xdr_inline_decode(xdr, 8);
         if (unlikely(!p))
                 goto out_overflow;
-        xdr_decode_hyper(p, &clp->cl_ex_clid);
+        xdr_decode_hyper(p, &clp->cl_clientid);
         p = xdr_inline_decode(xdr, 12);
         if (unlikely(!p))
                 goto out_overflow;
diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c
index 903908a20023..c541093a5bf2 100644
--- a/fs/nfs/nfsroot.c
+++ b/fs/nfs/nfsroot.c
@@ -86,11 +86,14 @@
 /* Default path we try to mount. "%s" gets replaced by our IP address */
 #define NFS_ROOT                "/tftpboot/%s"
 
+/* Default NFSROOT mount options. */
+#define NFS_DEF_OPTIONS         "udp"
+
 /* Parameters passed from the kernel command line */
 static char nfs_root_parms[256] __initdata = "";
 
 /* Text-based mount options passed to super.c */
-static char nfs_root_options[256] __initdata = "";
+static char nfs_root_options[256] __initdata = NFS_DEF_OPTIONS;
 
 /* Address of NFS server */
 static __be32 servaddr __initdata = htonl(INADDR_NONE);
@@ -160,8 +163,14 @@ static int __init root_nfs_copy(char *dest, const char *src,
 }
 
 static int __init root_nfs_cat(char *dest, const char *src,
-                                  const size_t destlen)
+                               const size_t destlen)
 {
+        size_t len = strlen(dest);
+
+        if (len && dest[len - 1] != ',')
+                if (strlcat(dest, ",", destlen) > destlen)
+                        return -1;
+
         if (strlcat(dest, src, destlen) > destlen)
                 return -1;
         return 0;
@@ -194,16 +203,6 @@ static int __init root_nfs_parse_options(char *incoming, char *exppath,
                 if (root_nfs_cat(nfs_root_options, incoming,
                                                 sizeof(nfs_root_options)))
                         return -1;
-
-        /*
-         * Possibly prepare for more options to be appended
-         */
-        if (nfs_root_options[0] != '\0' &&
-            nfs_root_options[strlen(nfs_root_options)] != ',')
-                if (root_nfs_cat(nfs_root_options, ",",
-                                                sizeof(nfs_root_options)))
-                        return -1;
-
         return 0;
 }
 
@@ -217,7 +216,7 @@ static int __init root_nfs_parse_options(char *incoming, char *exppath,
  */
 static int __init root_nfs_data(char *cmdline)
 {
-        char addr_option[sizeof("nolock,addr=") + INET_ADDRSTRLEN + 1];
+        char mand_options[sizeof("nolock,addr=") + INET_ADDRSTRLEN + 1];
         int len, retval = -1;
         char *tmp = NULL;
         const size_t tmplen = sizeof(nfs_export_path);
@@ -244,9 +243,9 @@ static int __init root_nfs_data(char *cmdline)
          * Append mandatory options for nfsroot so they override
          * what has come before
          */
-        snprintf(addr_option, sizeof(addr_option), "nolock,addr=%pI4",
+        snprintf(mand_options, sizeof(mand_options), "nolock,addr=%pI4",
                         &servaddr);
-        if (root_nfs_cat(nfs_root_options, addr_option,
+        if (root_nfs_cat(nfs_root_options, mand_options,
                                                 sizeof(nfs_root_options)))
                 goto out_optionstoolong;
 
diff --git a/fs/nfs/unlink.c b/fs/nfs/unlink.c
index e313a51acdd1..6481d537d69d 100644
--- a/fs/nfs/unlink.c
+++ b/fs/nfs/unlink.c
@@ -180,7 +180,7 @@ static int nfs_do_call_unlink(struct dentry *parent, struct inode *dir, struct n
         task_setup_data.rpc_client = NFS_CLIENT(dir);
         task = rpc_run_task(&task_setup_data);
         if (!IS_ERR(task))
-                rpc_put_task(task);
+                rpc_put_task_async(task);
         return 1;
 }
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index c8278f4046cb..42b92d7a9cc4 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1292,6 +1292,8 @@ static int nfs_commit_rpcsetup(struct list_head *head,
         task = rpc_run_task(&task_setup_data);
         if (IS_ERR(task))
                 return PTR_ERR(task);
+        if (how & FLUSH_SYNC)
+                rpc_wait_for_completion_task(task);
         rpc_put_task(task);
         return 0;
 }
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index cde36cb0f348..02eb4edf0ece 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -432,7 +432,7 @@ static int decode_cb_sequence4resok(struct xdr_stream *xdr,
          * If the server returns different values for sessionID, slotID or
          * sequence number, the server is looney tunes.
          */
-        p = xdr_inline_decode(xdr, NFS4_MAX_SESSIONID_LEN + 4 + 4);
+        p = xdr_inline_decode(xdr, NFS4_MAX_SESSIONID_LEN + 4 + 4 + 4 + 4);
         if (unlikely(p == NULL))
                 goto out_overflow;
         memcpy(id.data, p, NFS4_MAX_SESSIONID_LEN);
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 54b60bfceb8d..7b566ec14e18 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2445,15 +2445,16 @@ nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
 static struct nfs4_delegation *
 find_delegation_file(struct nfs4_file *fp, stateid_t *stid)
 {
-        struct nfs4_delegation *dp = NULL;
+        struct nfs4_delegation *dp;
 
         spin_lock(&recall_lock);
-        list_for_each_entry(dp, &fp->fi_delegations, dl_perfile) {
-                if (dp->dl_stateid.si_stateownerid == stid->si_stateownerid)
-                        break;
-        }
+        list_for_each_entry(dp, &fp->fi_delegations, dl_perfile)
+                if (dp->dl_stateid.si_stateownerid == stid->si_stateownerid) {
+                        spin_unlock(&recall_lock);
+                        return dp;
+                }
         spin_unlock(&recall_lock);
-        return dp;
+        return NULL;
 }
 
 int share_access_to_flags(u32 share_access)
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 1275b8655070..615f0a9f0600 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1142,7 +1142,7 @@ nfsd4_decode_create_session(struct nfsd4_compoundargs *argp,
 
         u32 dummy;
         char *machine_name;
-        int i;
+        int i, j;
         int nr_secflavs;
 
         READ_BUF(16);
@@ -1215,7 +1215,7 @@ nfsd4_decode_create_session(struct nfsd4_compoundargs *argp,
                         READ_BUF(4);
                         READ32(dummy);
                         READ_BUF(dummy * 4);
-                        for (i = 0; i < dummy; ++i)
+                        for (j = 0; j < dummy; ++j)
                                 READ32(dummy);
                         break;
                 case RPC_AUTH_GSS:
diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c
index 98034271cd02..161791d26458 100644
--- a/fs/nilfs2/namei.c
+++ b/fs/nilfs2/namei.c
@@ -397,7 +397,6 @@ static int nilfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 new_de = nilfs_find_entry(new_dir, &new_dentry->d_name, &new_page);
                 if (!new_de)
                         goto out_dir;
-                inc_nlink(old_inode);
                 nilfs_set_link(new_dir, new_de, new_page, old_inode);
                 nilfs_mark_inode_dirty(new_dir);
                 new_inode->i_ctime = CURRENT_TIME;
@@ -411,13 +410,9 @@ static int nilfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                         if (new_dir->i_nlink >= NILFS_LINK_MAX)
                                 goto out_dir;
                 }
-                inc_nlink(old_inode);
                 err = nilfs_add_link(new_dentry, old_inode);
-                if (err) {
-                        drop_nlink(old_inode);
-                        nilfs_mark_inode_dirty(old_inode);
+                if (err)
                         goto out_dir;
-                }
                 if (dir_de) {
                         inc_nlink(new_dir);
                         nilfs_mark_inode_dirty(new_dir);
@@ -431,7 +426,6 @@ static int nilfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         old_inode->i_ctime = CURRENT_TIME;
 
         nilfs_delete_entry(old_de, old_page);
-        drop_nlink(old_inode);
 
         if (dir_de) {
                 nilfs_set_link(old_inode, dir_de, dir_page, new_dir);
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 55ebae5c7f39..2de9f636792a 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -430,7 +430,8 @@ static void nilfs_segctor_begin_finfo(struct nilfs_sc_info *sci,
         nilfs_segctor_map_segsum_entry(
                 sci, &sci->sc_binfo_ptr, sizeof(struct nilfs_finfo));
 
-        if (inode->i_sb && !test_bit(NILFS_SC_HAVE_DELTA, &sci->sc_flags))
+        if (NILFS_I(inode)->i_root &&
+            !test_bit(NILFS_SC_HAVE_DELTA, &sci->sc_flags))
                 set_bit(NILFS_SC_HAVE_DELTA, &sci->sc_flags);
         /* skip finfo */
 }
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index 6d80ecc7834f..7eb90403fc8a 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -56,7 +56,7 @@ static int ocfs2_dentry_revalidate(struct dentry *dentry,
         int ret = 0;    /* if all else fails, just return false */
         struct ocfs2_super *osb;
 
-        if (nd->flags & LOOKUP_RCU)
+        if (nd && nd->flags & LOOKUP_RCU)
                 return -ECHILD;
 
         inode = dentry->d_inode;
diff --git a/fs/open.c b/fs/open.c
index 5a2c6ebc22b5..b47aab39c057 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -233,6 +233,14 @@ int do_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
 
         if (!(file->f_mode & FMODE_WRITE))
                 return -EBADF;
+
+        /* It's not possible punch hole on append only file */
+        if (mode & FALLOC_FL_PUNCH_HOLE && IS_APPEND(inode))
+                return -EPERM;
+
+        if (IS_IMMUTABLE(inode))
+                return -EPERM;
+
         /*
          * Revalidate the write permissions, in case security policy has
          * changed since the files were opened.
diff --git a/fs/partitions/osf.c b/fs/partitions/osf.c
index 48cec7cbca17..be03a0b08b47 100644
--- a/fs/partitions/osf.c
+++ b/fs/partitions/osf.c
@@ -10,10 +10,13 @@
 #include "check.h"
 #include "osf.h"
 
+#define MAX_OSF_PARTITIONS 8
+
 int osf_partition(struct parsed_partitions *state)
 {
         int i;
         int slot = 1;
+        unsigned int npartitions;
         Sector sect;
         unsigned char *data;
         struct disklabel {
@@ -45,7 +48,7 @@ int osf_partition(struct parsed_partitions *state)
                         u8  p_fstype;
                         u8  p_frag;
                         __le16 p_cpg;
-                } d_partitions[8];
+                } d_partitions[MAX_OSF_PARTITIONS];
         } * label;
         struct d_partition * partition;
 
@@ -63,7 +66,12 @@ int osf_partition(struct parsed_partitions *state)
                 put_dev_sector(sect);
                 return 0;
         }
-        for (i = 0 ; i < le16_to_cpu(label->d_npartitions); i++, partition++) {
+        npartitions = le16_to_cpu(label->d_npartitions);
+        if (npartitions > MAX_OSF_PARTITIONS) {
+                put_dev_sector(sect);
+                return 0;
+        }
+        for (i = 0 ; i < npartitions; i++, partition++) {
                 if (slot == state->limit)
                         break;
                 if (le32_to_cpu(partition->p_size))
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 9d096e82b201..d49c4b5d2c3e 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2620,35 +2620,6 @@ static const struct pid_entry proc_base_stuff[] = {
                 &proc_self_inode_operations, NULL, {}),
 };
 
-/*
- *      Exceptional case: normally we are not allowed to unhash a busy
- * directory. In this case, however, we can do it - no aliasing problems
- * due to the way we treat inodes.
- */
-static int proc_base_revalidate(struct dentry *dentry, struct nameidata *nd)
-{
-        struct inode *inode;
-        struct task_struct *task;
-
-        if (nd->flags & LOOKUP_RCU)
-                return -ECHILD;
-
-        inode = dentry->d_inode;
-        task = get_proc_task(inode);
-        if (task) {
-                put_task_struct(task);
-                return 1;
-        }
-        d_drop(dentry);
-        return 0;
-}
-
-static const struct dentry_operations proc_base_dentry_operations =
-{
-        .d_revalidate   = proc_base_revalidate,
-        .d_delete       = pid_delete_dentry,
-};
-
 static struct dentry *proc_base_instantiate(struct inode *dir,
         struct dentry *dentry, struct task_struct *task, const void *ptr)
 {
@@ -2685,7 +2656,6 @@ static struct dentry *proc_base_instantiate(struct inode *dir,
         if (p->fop)
                 inode->i_fop = p->fop;
         ei->op = p->op;
-        d_set_d_op(dentry, &proc_base_dentry_operations);
         d_add(dentry, inode);
         error = NULL;
 out:
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 176ce4cda68a..d6a7ca1fdac5 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -27,6 +27,7 @@
 static void proc_evict_inode(struct inode *inode)
 {
         struct proc_dir_entry *de;
+        struct ctl_table_header *head;
 
         truncate_inode_pages(&inode->i_data, 0);
         end_writeback(inode);
@@ -38,8 +39,11 @@ static void proc_evict_inode(struct inode *inode)
         de = PROC_I(inode)->pde;
         if (de)
                 pde_put(de);
-        if (PROC_I(inode)->sysctl)
-                sysctl_head_put(PROC_I(inode)->sysctl);
+        head = PROC_I(inode)->sysctl;
+        if (head) {
+                rcu_assign_pointer(PROC_I(inode)->sysctl, NULL);
+                sysctl_head_put(head);
+        }
 }
 
 struct vfsmount *proc_mnt;
diff --git a/fs/proc/proc_devtree.c b/fs/proc/proc_devtree.c
index d9396a4fc7ff..927cbd115e53 100644
--- a/fs/proc/proc_devtree.c
+++ b/fs/proc/proc_devtree.c
@@ -233,7 +233,7 @@ void __init proc_device_tree_init(void)
                 return;
         root = of_find_node_by_path("/");
         if (root == NULL) {
-                printk(KERN_ERR "/proc/device-tree: can't find root\n");
+                pr_debug("/proc/device-tree: can't find root\n");
                 return;
         }
         proc_device_tree_add_node(root, proc_device_tree);
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index 09a1f92a34ef..8eb2522111c5 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -408,15 +408,18 @@ static int proc_sys_compare(const struct dentry *parent,
                 const struct dentry *dentry, const struct inode *inode,
                 unsigned int len, const char *str, const struct qstr *name)
 {
+        struct ctl_table_header *head;
         /* Although proc doesn't have negative dentries, rcu-walk means
          * that inode here can be NULL */
+        /* AV: can it, indeed? */
         if (!inode)
-                return 0;
+                return 1;
         if (name->len != len)
                 return 1;
         if (memcmp(name->name, str, len))
                 return 1;
-        return !sysctl_is_seen(PROC_I(inode)->sysctl);
+        head = rcu_dereference(PROC_I(inode)->sysctl);
+        return !head || !sysctl_is_seen(head);
 }
 
 static const struct dentry_operations proc_sys_dentry_operations = {
diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
index ba5f51ec3458..68fdf45cc6c9 100644
--- a/fs/reiserfs/namei.c
+++ b/fs/reiserfs/namei.c
@@ -771,7 +771,7 @@ static int reiserfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
                                         EMPTY_DIR_SIZE_V1 : EMPTY_DIR_SIZE,
                                         dentry, inode, &security);
         if (retval) {
-                dir->i_nlink--;
+                DEC_DIR_INODE_NLINK(dir)
                 goto out_failed;
         }
 
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index 3cfb2e933644..5c11ca82b782 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -978,8 +978,6 @@ int reiserfs_permission(struct inode *inode, int mask, unsigned int flags)
 
 static int xattr_hide_revalidate(struct dentry *dentry, struct nameidata *nd)
 {
-        if (nd->flags & LOOKUP_RCU)
-                return -ECHILD;
         return -EPERM;
 }
 
diff --git a/fs/sysv/namei.c b/fs/sysv/namei.c
index b427b1208c26..e474fbcf8bde 100644
--- a/fs/sysv/namei.c
+++ b/fs/sysv/namei.c
@@ -245,7 +245,6 @@ static int sysv_rename(struct inode * old_dir, struct dentry * old_dentry,
                 new_de = sysv_find_entry(new_dentry, &new_page);
                 if (!new_de)
                         goto out_dir;
-                inode_inc_link_count(old_inode);
                 sysv_set_link(new_de, new_page, old_inode);
                 new_inode->i_ctime = CURRENT_TIME_SEC;
                 if (dir_de)
@@ -257,18 +256,15 @@ static int sysv_rename(struct inode * old_dir, struct dentry * old_dentry,
                         if (new_dir->i_nlink >= SYSV_SB(new_dir->i_sb)->s_link_max)
                                 goto out_dir;
                 }
-                inode_inc_link_count(old_inode);
                 err = sysv_add_link(new_dentry, old_inode);
-                if (err) {
-                        inode_dec_link_count(old_inode);
+                if (err)
                         goto out_dir;
-                }
                 if (dir_de)
                         inode_inc_link_count(new_dir);
         }
 
         sysv_delete_entry(old_de, old_page);
-        inode_dec_link_count(old_inode);
+        mark_inode_dirty(old_inode);
 
         if (dir_de) {
                 sysv_set_link(dir_de, dir_page, new_dir);
diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index 2be0f9eb86d2..b7c338d5e9df 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -32,6 +32,8 @@
 #include <linux/crc-itu-t.h>
 #include <linux/exportfs.h>
 
+enum { UDF_MAX_LINKS = 0xffff };
+
 static inline int udf_match(int len1, const unsigned char *name1, int len2,
                             const unsigned char *name2)
 {
@@ -650,7 +652,7 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         struct udf_inode_info *iinfo;
 
         err = -EMLINK;
-        if (dir->i_nlink >= (256 << sizeof(dir->i_nlink)) - 1)
+        if (dir->i_nlink >= UDF_MAX_LINKS)
                 goto out;
 
         err = -EIO;
@@ -1034,9 +1036,8 @@ static int udf_link(struct dentry *old_dentry, struct inode *dir,
         struct fileIdentDesc cfi, *fi;
         int err;
 
-        if (inode->i_nlink >= (256 << sizeof(inode->i_nlink)) - 1) {
+        if (inode->i_nlink >= UDF_MAX_LINKS)
                 return -EMLINK;
-        }
 
         fi = udf_add_entry(dir, dentry, &fibh, &cfi, &err);
         if (!fi) {
@@ -1131,9 +1132,7 @@ static int udf_rename(struct inode *old_dir, struct dentry *old_dentry,
                         goto end_rename;
 
                 retval = -EMLINK;
-                if (!new_inode &&
-                        new_dir->i_nlink >=
-                                (256 << sizeof(new_dir->i_nlink)) - 1)
+                if (!new_inode && new_dir->i_nlink >= UDF_MAX_LINKS)
                         goto end_rename;
         }
         if (!nfi) {
diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c
index 12f39b9e4437..d6f681535eb8 100644
--- a/fs/ufs/namei.c
+++ b/fs/ufs/namei.c
@@ -306,7 +306,6 @@ static int ufs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 new_de = ufs_find_entry(new_dir, &new_dentry->d_name, &new_page);
                 if (!new_de)
                         goto out_dir;
-                inode_inc_link_count(old_inode);
                 ufs_set_link(new_dir, new_de, new_page, old_inode);
                 new_inode->i_ctime = CURRENT_TIME_SEC;
                 if (dir_de)
@@ -318,12 +317,9 @@ static int ufs_rename(struct inode *old_dir, struct dentry *old_dentry,
                         if (new_dir->i_nlink >= UFS_LINK_MAX)
                                 goto out_dir;
                 }
-                inode_inc_link_count(old_inode);
                 err = ufs_add_link(new_dentry, old_inode);
-                if (err) {
-                        inode_dec_link_count(old_inode);
+                if (err)
                         goto out_dir;
-                }
                 if (dir_de)
                         inode_inc_link_count(new_dir);
         }
@@ -331,12 +327,11 @@ static int ufs_rename(struct inode *old_dir, struct dentry *old_dentry,
         /*
          * Like most other Unix systems, set the ctime for inodes on a
          * rename.
-         * inode_dec_link_count() will mark the inode dirty.
          */
         old_inode->i_ctime = CURRENT_TIME_SEC;
 
         ufs_delete_entry(old_dir, old_de, old_page);
-        inode_dec_link_count(old_inode);
+        mark_inode_dirty(old_inode);
 
         if (dir_de) {
                 ufs_set_link(old_inode, dir_de, dir_page, new_dir);
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index f5e2a19e0f8e..0ca0e3c024d7 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -695,14 +695,19 @@ xfs_ioc_fsgeometry_v1(
         xfs_mount_t             *mp,
         void                    __user *arg)
 {
-        xfs_fsop_geom_v1_t      fsgeo;
+        xfs_fsop_geom_t         fsgeo;
         int                     error;
 
-        error = xfs_fs_geometry(mp, (xfs_fsop_geom_t *)&fsgeo, 3);
+        error = xfs_fs_geometry(mp, &fsgeo, 3);
         if (error)
                 return -error;
 
-        if (copy_to_user(arg, &fsgeo, sizeof(fsgeo)))
+        /*
+         * Caller should have passed an argument of type
+         * xfs_fsop_geom_v1_t.  This is a proper subset of the
+         * xfs_fsop_geom_t that xfs_fs_geometry() fills in.
+         */
+        if (copy_to_user(arg, &fsgeo, sizeof(xfs_fsop_geom_v1_t)))
                 return -XFS_ERROR(EFAULT);
         return 0;
 }
diff --git a/include/keys/rxrpc-type.h b/include/keys/rxrpc-type.h
index 5cb86c307f5d..fc4875433817 100644
--- a/include/keys/rxrpc-type.h
+++ b/include/keys/rxrpc-type.h
@@ -99,7 +99,6 @@ struct rxrpc_key_token {
  * structure of raw payloads passed to add_key() or instantiate key
  */
 struct rxrpc_key_data_v1 {
-        u32             kif_version;            /* 1 */
         u16             security_index;
         u16             ticket_length;
         u32             expiry;                 /* time_t */
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 4d18ff34670a..d5063e1b5555 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -699,7 +699,7 @@ extern void blk_start_queue(struct request_queue *q);
 extern void blk_stop_queue(struct request_queue *q);
 extern void blk_sync_queue(struct request_queue *q);
 extern void __blk_stop_queue(struct request_queue *q);
-extern void __blk_run_queue(struct request_queue *);
+extern void __blk_run_queue(struct request_queue *q, bool force_kblockd);
 extern void blk_run_queue(struct request_queue *);
 extern int blk_rq_map_user(struct request_queue *, struct request *,
                            struct rq_map_data *, void __user *, unsigned long,
@@ -1088,7 +1088,6 @@ static inline void put_dev_sector(Sector p)
 
 struct work_struct;
 int kblockd_schedule_work(struct request_queue *q, struct work_struct *work);
-int kblockd_schedule_delayed_work(struct request_queue *q, struct delayed_work *dwork, unsigned long delay);
 
 #ifdef CONFIG_BLK_CGROUP
 /*
@@ -1136,7 +1135,6 @@ static inline uint64_t rq_io_start_time_ns(struct request *req)
 extern int blk_throtl_init(struct request_queue *q);
 extern void blk_throtl_exit(struct request_queue *q);
 extern int blk_throtl_bio(struct request_queue *q, struct bio **bio);
-extern void throtl_schedule_delayed_work(struct request_queue *q, unsigned long delay);
 extern void throtl_shutdown_timer_wq(struct request_queue *q);
 #else /* CONFIG_BLK_DEV_THROTTLING */
 static inline int blk_throtl_bio(struct request_queue *q, struct bio **bio)
@@ -1146,7 +1144,6 @@ static inline int blk_throtl_bio(struct request_queue *q, struct bio **bio)
 
 static inline int blk_throtl_init(struct request_queue *q) { return 0; }
 static inline int blk_throtl_exit(struct request_queue *q) { return 0; }
-static inline void throtl_schedule_delayed_work(struct request_queue *q, unsigned long delay) {}
 static inline void throtl_shutdown_timer_wq(struct request_queue *q) {}
 #endif /* CONFIG_BLK_DEV_THROTTLING */
 
diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
index 3395cf7130f5..b22fb0d3db0f 100644
--- a/include/linux/blktrace_api.h
+++ b/include/linux/blktrace_api.h
@@ -245,7 +245,6 @@ static inline int blk_cmd_buf_len(struct request *rq)
 
 extern void blk_dump_cmd(char *buf, struct request *rq);
 extern void blk_fill_rwbs(char *rwbs, u32 rw, int bytes);
-extern void blk_fill_rwbs_rq(char *rwbs, struct request *rq);
 
 #endif /* CONFIG_EVENT_TRACING && CONFIG_BLOCK */
 
diff --git a/include/linux/ceph/messenger.h b/include/linux/ceph/messenger.h
index c3011beac30d..31d91a64838b 100644
--- a/include/linux/ceph/messenger.h
+++ b/include/linux/ceph/messenger.h
@@ -123,6 +123,7 @@ struct ceph_msg_pos {
 #define SOCK_CLOSED     11 /* socket state changed to closed */
 #define OPENING         13 /* open connection w/ (possibly new) peer */
 #define DEAD            14 /* dead, about to kfree */
+#define BACKOFF         15
 
 /*
  * A single connection with another host.
@@ -160,7 +161,6 @@ struct ceph_connection {
         struct list_head out_queue;
         struct list_head out_sent;   /* sending or sent but unacked */
         u64 out_seq;                 /* last message queued for send */
-        bool out_keepalive_pending;
 
         u64 in_seq, in_seq_acked;  /* last message received, acked */
 
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 0b84c61607e8..dca31761b311 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -332,16 +332,19 @@ alloc_pages(gfp_t gfp_mask, unsigned int order)
         return alloc_pages_current(gfp_mask, order);
 }
 extern struct page *alloc_pages_vma(gfp_t gfp_mask, int order,
-                        struct vm_area_struct *vma, unsigned long addr);
+                        struct vm_area_struct *vma, unsigned long addr,
+                        int node);
 #else
 #define alloc_pages(gfp_mask, order) \
                 alloc_pages_node(numa_node_id(), gfp_mask, order)
-#define alloc_pages_vma(gfp_mask, order, vma, addr)     \
+#define alloc_pages_vma(gfp_mask, order, vma, addr, node)       \
         alloc_pages(gfp_mask, order)
 #endif
 #define alloc_page(gfp_mask) alloc_pages(gfp_mask, 0)
-#define alloc_page_vma(gfp_mask, vma, addr)     \
-        alloc_pages_vma(gfp_mask, 0, vma, addr)
+#define alloc_page_vma(gfp_mask, vma, addr)                     \
+        alloc_pages_vma(gfp_mask, 0, vma, addr, numa_node_id())
+#define alloc_page_vma_node(gfp_mask, vma, addr, node)          \
+        alloc_pages_vma(gfp_mask, 0, vma, addr, node)
 
 extern unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order);
 extern unsigned long get_zeroed_page(gfp_t gfp_mask);
diff --git a/include/linux/mfd/wm8994/core.h b/include/linux/mfd/wm8994/core.h
index 3fd36845ca45..ef4f0b6083a3 100644
--- a/include/linux/mfd/wm8994/core.h
+++ b/include/linux/mfd/wm8994/core.h
@@ -71,6 +71,7 @@ struct wm8994 {
         u16 irq_masks_cache[WM8994_NUM_IRQ_REGS];
 
         /* Used over suspend/resume */
+        bool suspended;
         u16 ldo_regs[WM8994_NUM_LDO_REGS];
         u16 gpio_regs[WM8994_NUM_GPIO_REGS];
 
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index d971346b0340..71caf7a5e6c6 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2392,6 +2392,9 @@ extern int netdev_notice(const struct net_device *dev, const char *format, ...)
 extern int netdev_info(const struct net_device *dev, const char *format, ...)
         __attribute__ ((format (printf, 2, 3)));
 
+#define MODULE_ALIAS_NETDEV(device) \
+        MODULE_ALIAS("netdev-" device)
+
 #if defined(DEBUG)
 #define netdev_dbg(__dev, format, args...)                      \
         netdev_printk(KERN_DEBUG, __dev, format, ##args)
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index b197563913bf..3e112de12d8d 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -68,11 +68,7 @@ struct nfs_client {
         unsigned char           cl_id_uniquifier;
         u32                     cl_cb_ident;    /* v4.0 callback identifier */
         const struct nfs4_minor_version_ops *cl_mvops;
-#endif /* CONFIG_NFS_V4 */
 
-#ifdef CONFIG_NFS_V4_1
-        /* clientid returned from EXCHANGE_ID, used by session operations */
-        u64                     cl_ex_clid;
         /* The sequence id to use for the next CREATE_SESSION */
         u32                     cl_seqid;
         /* The flags used for obtaining the clientid during EXCHANGE_ID */
@@ -80,7 +76,7 @@ struct nfs_client {
         struct nfs4_session     *cl_session;    /* sharred session */
         struct list_head        cl_layouts;
         struct pnfs_deviceid_cache *cl_devid_cache; /* pNFS deviceid cache */
-#endif /* CONFIG_NFS_V4_1 */
+#endif /* CONFIG_NFS_V4 */
 
 #ifdef CONFIG_NFS_FSCACHE
         struct fscache_cookie   *fscache;       /* client index cache cookie */
@@ -185,7 +181,7 @@ struct nfs_server {
 /* maximum number of slots to use */
 #define NFS4_MAX_SLOT_TABLE RPC_MAX_SLOT_TABLE
 
-#if defined(CONFIG_NFS_V4_1)
+#if defined(CONFIG_NFS_V4)
 
 /* Sessions */
 #define SLOT_TABLE_SZ (NFS4_MAX_SLOT_TABLE/(8*sizeof(long)))
@@ -225,5 +221,5 @@ struct nfs4_session {
         struct nfs_client               *clp;
 };
 
-#endif /* CONFIG_NFS_V4_1 */
+#endif /* CONFIG_NFS_V4 */
 #endif
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index 092a04f874a8..a1147e5dd245 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -102,11 +102,8 @@
 
 extern long arch_ptrace(struct task_struct *child, long request,
                         unsigned long addr, unsigned long data);
-extern int ptrace_traceme(void);
 extern int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst, int len);
 extern int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len);
-extern int ptrace_attach(struct task_struct *tsk);
-extern int ptrace_detach(struct task_struct *, unsigned int);
 extern void ptrace_disable(struct task_struct *);
 extern int ptrace_check_attach(struct task_struct *task, int kill);
 extern int ptrace_request(struct task_struct *child, long request,
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index 88513fd8e208..d81db8012c63 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -212,6 +212,7 @@ struct rpc_task *rpc_run_task(const struct rpc_task_setup *);
 struct rpc_task *rpc_run_bc_task(struct rpc_rqst *req,
                                 const struct rpc_call_ops *ops);
 void            rpc_put_task(struct rpc_task *);
+void            rpc_put_task_async(struct rpc_task *);
 void            rpc_exit_task(struct rpc_task *);
 void            rpc_exit(struct rpc_task *, int);
 void            rpc_release_calldata(const struct rpc_call_ops *, void *);
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 7bb5cb64f3b8..11684d9e6bd2 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -930,6 +930,7 @@ enum
 
 #ifdef __KERNEL__
 #include <linux/list.h>
+#include <linux/rcupdate.h>
 
 /* For the /proc/sys support */
 struct ctl_table;
@@ -1037,10 +1038,15 @@ struct ctl_table_root {
    struct ctl_table trees. */
 struct ctl_table_header
 {
-        struct ctl_table *ctl_table;
-        struct list_head ctl_entry;
-        int used;
-        int count;
+        union {
+                struct {
+                        struct ctl_table *ctl_table;
+                        struct list_head ctl_entry;
+                        int used;
+                        int count;
+                };
+                struct rcu_head rcu;
+        };
         struct completion *unregistering;
         struct ctl_table *ctl_table_arg;
         struct ctl_table_root *root;
diff --git a/include/target/target_core_transport.h b/include/target/target_core_transport.h
index 246940511579..2e8ec51f0615 100644
--- a/include/target/target_core_transport.h
+++ b/include/target/target_core_transport.h
@@ -135,6 +135,8 @@ extern void transport_complete_task(struct se_task *, int);
 extern void transport_add_task_to_execute_queue(struct se_task *,
                                                 struct se_task *,
                                                 struct se_device *);
+extern void transport_remove_task_from_execute_queue(struct se_task *,
+                                                struct se_device *);
 unsigned char *transport_dump_cmd_direction(struct se_cmd *);
 extern void transport_dump_dev_state(struct se_device *, char *, int *);
 extern void transport_dump_dev_info(struct se_device *, struct se_lun *,
diff --git a/include/trace/events/block.h b/include/trace/events/block.h
index aba421d68f6f..78f18adb49c8 100644
--- a/include/trace/events/block.h
+++ b/include/trace/events/block.h
@@ -31,7 +31,7 @@ DECLARE_EVENT_CLASS(block_rq_with_error,
                                         0 : blk_rq_sectors(rq);
                 __entry->errors    = rq->errors;
 
-                blk_fill_rwbs_rq(__entry->rwbs, rq);
+                blk_fill_rwbs(__entry->rwbs, rq->cmd_flags, blk_rq_bytes(rq));
                 blk_dump_cmd(__get_str(cmd), rq);
         ),
 
@@ -118,7 +118,7 @@ DECLARE_EVENT_CLASS(block_rq,
                 __entry->bytes     = (rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
                                         blk_rq_bytes(rq) : 0;
 
-                blk_fill_rwbs_rq(__entry->rwbs, rq);
+                blk_fill_rwbs(__entry->rwbs, rq->cmd_flags, blk_rq_bytes(rq));
                 blk_dump_cmd(__get_str(cmd), rq);
                 memcpy(__entry->comm, current->comm, TASK_COMM_LEN);
         ),
@@ -563,7 +563,7 @@ TRACE_EVENT(block_rq_remap,
                 __entry->nr_sector      = blk_rq_sectors(rq);
                 __entry->old_dev        = dev;
                 __entry->old_sector     = from;
-                blk_fill_rwbs_rq(__entry->rwbs, rq);
+                blk_fill_rwbs(__entry->rwbs, rq->cmd_flags, blk_rq_bytes(rq));
         ),
 
         TP_printk("%d,%d %s %llu + %u <- (%d,%d) %llu",
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 4349935c2ad8..e92e98189032 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -1575,8 +1575,10 @@ static int cpuset_write_resmask(struct cgroup *cgrp, struct cftype *cft,
                 return -ENODEV;
 
         trialcs = alloc_trial_cpuset(cs);
-        if (!trialcs)
-                return -ENOMEM;
+        if (!trialcs) {
+                retval = -ENOMEM;
+                goto out;
+        }
 
         switch (cft->private) {
         case FILE_CPULIST:
@@ -1591,6 +1593,7 @@ static int cpuset_write_resmask(struct cgroup *cgrp, struct cftype *cft,
         }
 
         free_trial_cpuset(trialcs);
+out:
         cgroup_unlock();
         return retval;
 }
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 1708b1e2972d..e2302e40b360 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -163,7 +163,7 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
         return !err;
 }
 
-int ptrace_attach(struct task_struct *task)
+static int ptrace_attach(struct task_struct *task)
 {
         int retval;
 
@@ -219,7 +219,7 @@ out:
  * Performs checks and sets PT_PTRACED.
  * Should be used by all ptrace implementations for PTRACE_TRACEME.
  */
-int ptrace_traceme(void)
+static int ptrace_traceme(void)
 {
         int ret = -EPERM;
 
@@ -293,7 +293,7 @@ static bool __ptrace_detach(struct task_struct *tracer, struct task_struct *p)
         return false;
 }
 
-int ptrace_detach(struct task_struct *child, unsigned int data)
+static int ptrace_detach(struct task_struct *child, unsigned int data)
 {
         bool dead = false;
 
diff --git a/kernel/sched.c b/kernel/sched.c
index 18d38e4ec7ba..42eab5a8437d 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4213,6 +4213,7 @@ void __wake_up_locked_key(wait_queue_head_t *q, unsigned int mode, void *key)
 {
         __wake_up_common(q, mode, 1, 0, key);
 }
+EXPORT_SYMBOL_GPL(__wake_up_locked_key);
 
 /**
  * __wake_up_sync_key - wake up threads blocked on a waitqueue.
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index ad6267714c84..01f75a5f17af 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -210,11 +210,12 @@ static void dequeue_rt_entity(struct sched_rt_entity *rt_se);
 
 static void sched_rt_rq_enqueue(struct rt_rq *rt_rq)
 {
-        int this_cpu = smp_processor_id();
         struct task_struct *curr = rq_of_rt_rq(rt_rq)->curr;
         struct sched_rt_entity *rt_se;
 
-        rt_se = rt_rq->tg->rt_se[this_cpu];
+        int cpu = cpu_of(rq_of_rt_rq(rt_rq));
+
+        rt_se = rt_rq->tg->rt_se[cpu];
 
         if (rt_rq->rt_nr_running) {
                 if (rt_se && !on_rt_rq(rt_se))
@@ -226,10 +227,10 @@ static void sched_rt_rq_enqueue(struct rt_rq *rt_rq)
 
 static void sched_rt_rq_dequeue(struct rt_rq *rt_rq)
 {
-        int this_cpu = smp_processor_id();
         struct sched_rt_entity *rt_se;
+        int cpu = cpu_of(rq_of_rt_rq(rt_rq));
 
-        rt_se = rt_rq->tg->rt_se[this_cpu];
+        rt_se = rt_rq->tg->rt_se[cpu];
 
         if (rt_se && on_rt_rq(rt_se))
                 dequeue_rt_entity(rt_se);
@@ -565,8 +566,11 @@ static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun)
                         if (rt_rq->rt_time || rt_rq->rt_nr_running)
                                 idle = 0;
                         raw_spin_unlock(&rt_rq->rt_runtime_lock);
-                } else if (rt_rq->rt_nr_running)
+                } else if (rt_rq->rt_nr_running) {
                         idle = 0;
+                        if (!rt_rq_throttled(rt_rq))
+                                enqueue = 1;
+                }
 
                 if (enqueue)
                         sched_rt_rq_enqueue(rt_rq);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 0f1bd83db985..4eed0af5d144 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -194,9 +194,9 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
 static struct ctl_table root_table[];
 static struct ctl_table_root sysctl_table_root;
 static struct ctl_table_header root_table_header = {
-        .count = 1,
+        {{.count = 1,
         .ctl_table = root_table,
-        .ctl_entry = LIST_HEAD_INIT(sysctl_table_root.default_set.list),
+        .ctl_entry = LIST_HEAD_INIT(sysctl_table_root.default_set.list),}},
         .root = &sysctl_table_root,
         .set = &sysctl_table_root.default_set,
 };
@@ -1567,11 +1567,16 @@ void sysctl_head_get(struct ctl_table_header *head)
         spin_unlock(&sysctl_lock);
 }
 
+static void free_head(struct rcu_head *rcu)
+{
+        kfree(container_of(rcu, struct ctl_table_header, rcu));
+}
+
 void sysctl_head_put(struct ctl_table_header *head)
 {
         spin_lock(&sysctl_lock);
         if (!--head->count)
-                kfree(head);
+                call_rcu(&head->rcu, free_head);
         spin_unlock(&sysctl_lock);
 }
 
@@ -1948,10 +1953,10 @@ void unregister_sysctl_table(struct ctl_table_header * header)
         start_unregistering(header);
         if (!--header->parent->count) {
                 WARN_ON(1);
-                kfree(header->parent);
+                call_rcu(&header->parent->rcu, free_head);
         }
         if (!--header->count)
-                kfree(header);
+                call_rcu(&header->rcu, free_head);
         spin_unlock(&sysctl_lock);
 }
 
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index d95721f33702..cbafed7d4f38 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -1827,21 +1827,5 @@ void blk_fill_rwbs(char *rwbs, u32 rw, int bytes)
         rwbs[i] = '\0';
 }
 
-void blk_fill_rwbs_rq(char *rwbs, struct request *rq)
-{
-        int rw = rq->cmd_flags & 0x03;
-        int bytes;
-
-        if (rq->cmd_flags & REQ_DISCARD)
-                rw |= REQ_DISCARD;
-
-        if (rq->cmd_flags & REQ_SECURE)
-                rw |= REQ_SECURE;
-
-        bytes = blk_rq_bytes(rq);
-
-        blk_fill_rwbs(rwbs, rw, bytes);
-}
-
 #endif /* CONFIG_EVENT_TRACING */
 
diff --git a/lib/nlattr.c b/lib/nlattr.c
index 5021cbc34411..ac09f2226dc7 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -148,7 +148,7 @@ nla_policy_len(const struct nla_policy *p, int n)
 {
         int i, len = 0;
 
-        for (i = 0; i < n; i++) {
+        for (i = 0; i < n; i++, p++) {
                 if (p->len)
                         len += nla_total_size(p->len);
                 else if (nla_attr_minlen[p->type])
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 3e29781ee762..113e35c47502 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -650,10 +650,10 @@ static inline gfp_t alloc_hugepage_gfpmask(int defrag)
 
 static inline struct page *alloc_hugepage_vma(int defrag,
                                               struct vm_area_struct *vma,
-                                              unsigned long haddr)
+                                              unsigned long haddr, int nd)
 {
         return alloc_pages_vma(alloc_hugepage_gfpmask(defrag),
-                               HPAGE_PMD_ORDER, vma, haddr);
+                               HPAGE_PMD_ORDER, vma, haddr, nd);
 }
 
 #ifndef CONFIG_NUMA
@@ -678,7 +678,7 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 if (unlikely(khugepaged_enter(vma)))
                         return VM_FAULT_OOM;
                 page = alloc_hugepage_vma(transparent_hugepage_defrag(vma),
-                                          vma, haddr);
+                                          vma, haddr, numa_node_id());
                 if (unlikely(!page))
                         goto out;
                 if (unlikely(mem_cgroup_newpage_charge(page, mm, GFP_KERNEL))) {
@@ -799,8 +799,8 @@ static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
         }
 
         for (i = 0; i < HPAGE_PMD_NR; i++) {
-                pages[i] = alloc_page_vma(GFP_HIGHUSER_MOVABLE,
-                                          vma, address);
+                pages[i] = alloc_page_vma_node(GFP_HIGHUSER_MOVABLE,
+                                               vma, address, page_to_nid(page));
                 if (unlikely(!pages[i] ||
                              mem_cgroup_newpage_charge(pages[i], mm,
                                                        GFP_KERNEL))) {
@@ -902,7 +902,7 @@ int do_huge_pmd_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
         if (transparent_hugepage_enabled(vma) &&
             !transparent_hugepage_debug_cow())
                 new_page = alloc_hugepage_vma(transparent_hugepage_defrag(vma),
-                                              vma, haddr);
+                                              vma, haddr, numa_node_id());
         else
                 new_page = NULL;
 
@@ -1745,7 +1745,8 @@ static void __collapse_huge_page_copy(pte_t *pte, struct page *page,
 static void collapse_huge_page(struct mm_struct *mm,
                                unsigned long address,
                                struct page **hpage,
-                               struct vm_area_struct *vma)
+                               struct vm_area_struct *vma,
+                               int node)
 {
         pgd_t *pgd;
         pud_t *pud;
@@ -1761,6 +1762,10 @@ static void collapse_huge_page(struct mm_struct *mm,
 #ifndef CONFIG_NUMA
         VM_BUG_ON(!*hpage);
         new_page = *hpage;
+        if (unlikely(mem_cgroup_newpage_charge(new_page, mm, GFP_KERNEL))) {
+                up_read(&mm->mmap_sem);
+                return;
+        }
 #else
         VM_BUG_ON(*hpage);
         /*
@@ -1773,18 +1778,19 @@ static void collapse_huge_page(struct mm_struct *mm,
          * mmap_sem in read mode is good idea also to allow greater
          * scalability.
          */
-        new_page = alloc_hugepage_vma(khugepaged_defrag(), vma, address);
+        new_page = alloc_hugepage_vma(khugepaged_defrag(), vma, address,
+                                      node);
         if (unlikely(!new_page)) {
                 up_read(&mm->mmap_sem);
                 *hpage = ERR_PTR(-ENOMEM);
                 return;
         }
-#endif
         if (unlikely(mem_cgroup_newpage_charge(new_page, mm, GFP_KERNEL))) {
                 up_read(&mm->mmap_sem);
                 put_page(new_page);
                 return;
         }
+#endif
 
         /* after allocating the hugepage upgrade to mmap_sem write mode */
         up_read(&mm->mmap_sem);
@@ -1919,6 +1925,7 @@ static int khugepaged_scan_pmd(struct mm_struct *mm,
         struct page *page;
         unsigned long _address;
         spinlock_t *ptl;
+        int node = -1;
 
         VM_BUG_ON(address & ~HPAGE_PMD_MASK);
 
@@ -1949,6 +1956,13 @@ static int khugepaged_scan_pmd(struct mm_struct *mm,
                 page = vm_normal_page(vma, _address, pteval);
                 if (unlikely(!page))
                         goto out_unmap;
+                /*
+                 * Chose the node of the first page. This could
+                 * be more sophisticated and look at more pages,
+                 * but isn't for now.
+                 */
+                if (node == -1)
+                        node = page_to_nid(page);
                 VM_BUG_ON(PageCompound(page));
                 if (!PageLRU(page) || PageLocked(page) || !PageAnon(page))
                         goto out_unmap;
@@ -1965,7 +1979,7 @@ out_unmap:
         pte_unmap_unlock(pte, ptl);
         if (ret)
                 /* collapse_huge_page will return with the mmap_sem released */
-                collapse_huge_page(mm, address, hpage, vma);
+                collapse_huge_page(mm, address, hpage, vma, node);
 out:
         return ret;
 }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 49355a970be2..b53ec99f1428 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1524,10 +1524,9 @@ static nodemask_t *policy_nodemask(gfp_t gfp, struct mempolicy *policy)
 }
 
 /* Return a zonelist indicated by gfp for node representing a mempolicy */
-static struct zonelist *policy_zonelist(gfp_t gfp, struct mempolicy *policy)
+static struct zonelist *policy_zonelist(gfp_t gfp, struct mempolicy *policy,
+        int nd)
 {
-        int nd = numa_node_id();
-
         switch (policy->mode) {
         case MPOL_PREFERRED:
                 if (!(policy->flags & MPOL_F_LOCAL))
@@ -1679,7 +1678,7 @@ struct zonelist *huge_zonelist(struct vm_area_struct *vma, unsigned long addr,
                 zl = node_zonelist(interleave_nid(*mpol, vma, addr,
                                 huge_page_shift(hstate_vma(vma))), gfp_flags);
         } else {
-                zl = policy_zonelist(gfp_flags, *mpol);
+                zl = policy_zonelist(gfp_flags, *mpol, numa_node_id());
                 if ((*mpol)->mode == MPOL_BIND)
                         *nodemask = &(*mpol)->v.nodes;
         }
@@ -1820,7 +1819,7 @@ static struct page *alloc_page_interleave(gfp_t gfp, unsigned order,
  */
 struct page *
 alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
-                unsigned long addr)
+                unsigned long addr, int node)
 {
         struct mempolicy *pol = get_vma_policy(current, vma, addr);
         struct zonelist *zl;
@@ -1836,7 +1835,7 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
                 put_mems_allowed();
                 return page;
         }
-        zl = policy_zonelist(gfp, pol);
+        zl = policy_zonelist(gfp, pol, node);
         if (unlikely(mpol_needs_cond_ref(pol))) {
                 /*
                  * slow path: ref counted shared policy
@@ -1892,7 +1891,8 @@ struct page *alloc_pages_current(gfp_t gfp, unsigned order)
                 page = alloc_page_interleave(gfp, order, interleave_nodes(pol));
         else
                 page = __alloc_pages_nodemask(gfp, order,
-                        policy_zonelist(gfp, pol), policy_nodemask(gfp, pol));
+                                policy_zonelist(gfp, pol, numa_node_id()),
+                                policy_nodemask(gfp, pol));
         put_mems_allowed();
         return page;
 }
diff --git a/mm/rmap.c b/mm/rmap.c
index f21f4a1d6a1c..941bf82e8961 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -497,41 +497,51 @@ int page_referenced_one(struct page *page, struct vm_area_struct *vma,
         struct mm_struct *mm = vma->vm_mm;
         int referenced = 0;
 
-        /*
-         * Don't want to elevate referenced for mlocked page that gets this far,
-         * in order that it progresses to try_to_unmap and is moved to the
-         * unevictable list.
-         */
-        if (vma->vm_flags & VM_LOCKED) {
-                *mapcount = 0;  /* break early from loop */
-                *vm_flags |= VM_LOCKED;
-                goto out;
-        }
-
-        /* Pretend the page is referenced if the task has the
-           swap token and is in the middle of a page fault. */
-        if (mm != current->mm && has_swap_token(mm) &&
-                        rwsem_is_locked(&mm->mmap_sem))
-                referenced++;
-
         if (unlikely(PageTransHuge(page))) {
                 pmd_t *pmd;
 
                 spin_lock(&mm->page_table_lock);
+                /*
+                 * rmap might return false positives; we must filter
+                 * these out using page_check_address_pmd().
+                 */
                 pmd = page_check_address_pmd(page, mm, address,
                                              PAGE_CHECK_ADDRESS_PMD_FLAG);
-                if (pmd && !pmd_trans_splitting(*pmd) &&
-                    pmdp_clear_flush_young_notify(vma, address, pmd))
+                if (!pmd) {
+                        spin_unlock(&mm->page_table_lock);
+                        goto out;
+                }
+
+                if (vma->vm_flags & VM_LOCKED) {
+                        spin_unlock(&mm->page_table_lock);
+                        *mapcount = 0;  /* break early from loop */
+                        *vm_flags |= VM_LOCKED;
+                        goto out;
+                }
+
+                /* go ahead even if the pmd is pmd_trans_splitting() */
+                if (pmdp_clear_flush_young_notify(vma, address, pmd))
                         referenced++;
                 spin_unlock(&mm->page_table_lock);
         } else {
                 pte_t *pte;
                 spinlock_t *ptl;
 
+                /*
+                 * rmap might return false positives; we must filter
+                 * these out using page_check_address().
+                 */
                 pte = page_check_address(page, mm, address, &ptl, 0);
                 if (!pte)
                         goto out;
 
+                if (vma->vm_flags & VM_LOCKED) {
+                        pte_unmap_unlock(pte, ptl);
+                        *mapcount = 0;  /* break early from loop */
+                        *vm_flags |= VM_LOCKED;
+                        goto out;
+                }
+
                 if (ptep_clear_flush_young_notify(vma, address, pte)) {
                         /*
                          * Don't treat a reference through a sequentially read
@@ -546,6 +556,12 @@ int page_referenced_one(struct page *page, struct vm_area_struct *vma,
                 pte_unmap_unlock(pte, ptl);
         }
 
+        /* Pretend the page is referenced if the task has the
+           swap token and is in the middle of a page fault. */
+        if (mm != current->mm && has_swap_token(mm) &&
+                        rwsem_is_locked(&mm->mmap_sem))
+                referenced++;
+
         (*mapcount)--;
 
         if (referenced)
diff --git a/net/Makefile b/net/Makefile
index a3330ebe2c53..a51d9465e628 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -19,9 +19,7 @@ obj-$(CONFIG_NETFILTER)		+= netfilter/
 obj-$(CONFIG_INET)              += ipv4/
 obj-$(CONFIG_XFRM)              += xfrm/
 obj-$(CONFIG_UNIX)              += unix/
-ifneq ($(CONFIG_IPV6),)
-obj-y                           += ipv6/
-endif
+obj-$(CONFIG_NET)               += ipv6/
 obj-$(CONFIG_PACKET)            += packet/
 obj-$(CONFIG_NET_KEY)           += key/
 obj-$(CONFIG_BRIDGE)            += bridge/
diff --git a/net/bridge/Kconfig b/net/bridge/Kconfig
index 9190ae462cb4..6dee7bf648a9 100644
--- a/net/bridge/Kconfig
+++ b/net/bridge/Kconfig
@@ -6,6 +6,7 @@ config BRIDGE
         tristate "802.1d Ethernet Bridging"
         select LLC
         select STP
+        depends on IPV6 || IPV6=n
         ---help---
           If you say Y here, then your Linux box will be able to act as an
           Ethernet bridge, which means that the different Ethernet segments it
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 35b36b86d762..05f357828a2f 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -336,7 +336,6 @@ static void reset_connection(struct ceph_connection *con)
                 ceph_msg_put(con->out_msg);
                 con->out_msg = NULL;
         }
-        con->out_keepalive_pending = false;
         con->in_seq = 0;
         con->in_seq_acked = 0;
 }
@@ -1248,8 +1247,6 @@ static int process_connect(struct ceph_connection *con)
                      con->auth_retry);
                 if (con->auth_retry == 2) {
                         con->error_msg = "connect authorization failure";
-                        reset_connection(con);
-                        set_bit(CLOSED, &con->state);
                         return -1;
                 }
                 con->auth_retry = 1;
@@ -1715,14 +1712,6 @@ more:
 
         /* open the socket first? */
         if (con->sock == NULL) {
-                /*
-                 * if we were STANDBY and are reconnecting _this_
-                 * connection, bump connect_seq now.  Always bump
-                 * global_seq.
-                 */
-                if (test_and_clear_bit(STANDBY, &con->state))
-                        con->connect_seq++;
-
                 prepare_write_banner(msgr, con);
                 prepare_write_connect(msgr, con, 1);
                 prepare_read_banner(con);
@@ -1951,7 +1940,24 @@ static void con_work(struct work_struct *work)
                                                    work.work);
 
         mutex_lock(&con->mutex);
+        if (test_and_clear_bit(BACKOFF, &con->state)) {
+                dout("con_work %p backing off\n", con);
+                if (queue_delayed_work(ceph_msgr_wq, &con->work,
+                                       round_jiffies_relative(con->delay))) {
+                        dout("con_work %p backoff %lu\n", con, con->delay);
+                        mutex_unlock(&con->mutex);
+                        return;
+                } else {
+                        con->ops->put(con);
+                        dout("con_work %p FAILED to back off %lu\n", con,
+                             con->delay);
+                }
+        }
 
+        if (test_bit(STANDBY, &con->state)) {
+                dout("con_work %p STANDBY\n", con);
+                goto done;
+        }
         if (test_bit(CLOSED, &con->state)) { /* e.g. if we are replaced */
                 dout("con_work CLOSED\n");
                 con_close_socket(con);
@@ -2008,10 +2014,12 @@ static void ceph_fault(struct ceph_connection *con)
         /* Requeue anything that hasn't been acked */
         list_splice_init(&con->out_sent, &con->out_queue);
 
-        /* If there are no messages in the queue, place the connection
-         * in a STANDBY state (i.e., don't try to reconnect just yet). */
-        if (list_empty(&con->out_queue) && !con->out_keepalive_pending) {
-                dout("fault setting STANDBY\n");
+        /* If there are no messages queued or keepalive pending, place
+         * the connection in a STANDBY state */
+        if (list_empty(&con->out_queue) &&
+            !test_bit(KEEPALIVE_PENDING, &con->state)) {
+                dout("fault %p setting STANDBY clearing WRITE_PENDING\n", con);
+                clear_bit(WRITE_PENDING, &con->state);
                 set_bit(STANDBY, &con->state);
         } else {
                 /* retry after a delay. */
@@ -2019,11 +2027,24 @@ static void ceph_fault(struct ceph_connection *con)
                         con->delay = BASE_DELAY_INTERVAL;
                 else if (con->delay < MAX_DELAY_INTERVAL)
                         con->delay *= 2;
-                dout("fault queueing %p delay %lu\n", con, con->delay);
                 con->ops->get(con);
                 if (queue_delayed_work(ceph_msgr_wq, &con->work,
-                                       round_jiffies_relative(con->delay)) == 0)
+                                       round_jiffies_relative(con->delay))) {
+                        dout("fault queued %p delay %lu\n", con, con->delay);
+                } else {
                         con->ops->put(con);
+                        dout("fault failed to queue %p delay %lu, backoff\n",
+                             con, con->delay);
+                        /*
+                         * In many cases we see a socket state change
+                         * while con_work is running and end up
+                         * queuing (non-delayed) work, such that we
+                         * can't backoff with a delay.  Set a flag so
+                         * that when con_work restarts we schedule the
+                         * delay then.
+                         */
+                        set_bit(BACKOFF, &con->state);
+                }
         }
 
 out_unlock:
@@ -2094,6 +2115,19 @@ void ceph_messenger_destroy(struct ceph_messenger *msgr)
 }
 EXPORT_SYMBOL(ceph_messenger_destroy);
 
+static void clear_standby(struct ceph_connection *con)
+{
+        /* come back from STANDBY? */
+        if (test_and_clear_bit(STANDBY, &con->state)) {
+                mutex_lock(&con->mutex);
+                dout("clear_standby %p and ++connect_seq\n", con);
+                con->connect_seq++;
+                WARN_ON(test_bit(WRITE_PENDING, &con->state));
+                WARN_ON(test_bit(KEEPALIVE_PENDING, &con->state));
+                mutex_unlock(&con->mutex);
+        }
+}
+
 /*
  * Queue up an outgoing message on the given connection.
  */
@@ -2126,6 +2160,7 @@ void ceph_con_send(struct ceph_connection *con, struct ceph_msg *msg)
 
         /* if there wasn't anything waiting to send before, queue
          * new work */
+        clear_standby(con);
         if (test_and_set_bit(WRITE_PENDING, &con->state) == 0)
                 queue_con(con);
 }
@@ -2191,6 +2226,8 @@ void ceph_con_revoke_message(struct ceph_connection *con, struct ceph_msg *msg)
  */
 void ceph_con_keepalive(struct ceph_connection *con)
 {
+        dout("con_keepalive %p\n", con);
+        clear_standby(con);
         if (test_and_set_bit(KEEPALIVE_PENDING, &con->state) == 0 &&
             test_and_set_bit(WRITE_PENDING, &con->state) == 0)
                 queue_con(con);
diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c
index 1a040e64c69f..cd9c21df87d1 100644
--- a/net/ceph/pagevec.c
+++ b/net/ceph/pagevec.c
@@ -16,22 +16,30 @@ struct page **ceph_get_direct_page_vector(const char __user *data,
                                           int num_pages, bool write_page)
 {
         struct page **pages;
-        int rc;
+        int got = 0;
+        int rc = 0;
 
         pages = kmalloc(sizeof(*pages) * num_pages, GFP_NOFS);
         if (!pages)
                 return ERR_PTR(-ENOMEM);
 
         down_read(&current->mm->mmap_sem);
-        rc = get_user_pages(current, current->mm, (unsigned long)data,
-                            num_pages, write_page, 0, pages, NULL);
+        while (got < num_pages) {
+                rc = get_user_pages(current, current->mm,
+                    (unsigned long)data + ((unsigned long)got * PAGE_SIZE),
+                    num_pages - got, write_page, 0, pages + got, NULL);
+                if (rc < 0)
+                        break;
+                BUG_ON(rc == 0);
+                got += rc;
+        }
         up_read(&current->mm->mmap_sem);
-        if (rc < num_pages)
+        if (rc < 0)
                 goto fail;
         return pages;
 
 fail:
-        ceph_put_page_vector(pages, rc > 0 ? rc : 0, false);
+        ceph_put_page_vector(pages, got, false);
         return ERR_PTR(rc);
 }
 EXPORT_SYMBOL(ceph_get_direct_page_vector);
diff --git a/net/core/dev.c b/net/core/dev.c
index 8ae6631abcc2..6561021d22d1 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1114,13 +1114,21 @@ EXPORT_SYMBOL(netdev_bonding_change);
 void dev_load(struct net *net, const char *name)
 {
         struct net_device *dev;
+        int no_module;
 
         rcu_read_lock();
         dev = dev_get_by_name_rcu(net, name);
         rcu_read_unlock();
 
-        if (!dev && capable(CAP_NET_ADMIN))
-                request_module("%s", name);
+        no_module = !dev;
+        if (no_module && capable(CAP_NET_ADMIN))
+                no_module = request_module("netdev-%s", name);
+        if (no_module && capable(CAP_SYS_MODULE)) {
+                if (!request_module("%s", name))
+                        pr_err("Loading kernel module for a network device "
+"with CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-%s "
+"instead\n", name);
+        }
 }
 EXPORT_SYMBOL(dev_load);
 
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index 508f9c18992f..133fd22ea287 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -144,7 +144,7 @@ void __hw_addr_del_multiple(struct netdev_hw_addr_list *to_list,
 
         list_for_each_entry(ha, &from_list->list, list) {
                 type = addr_type ? addr_type : ha->type;
-                __hw_addr_del(to_list, ha->addr, addr_len, addr_type);
+                __hw_addr_del(to_list, ha->addr, addr_len, type);
         }
 }
 EXPORT_SYMBOL(__hw_addr_del_multiple);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index a9e7fc4c461f..b5bada92f637 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3321,7 +3321,7 @@ static void show_results(struct pktgen_dev *pkt_dev, int nr_frags)
                                     pkt_dev->started_at);
         ktime_t idle = ns_to_ktime(pkt_dev->idle_acc);
 
-        p += sprintf(p, "OK: %llu(c%llu+d%llu) nsec, %llu (%dbyte,%dfrags)\n",
+        p += sprintf(p, "OK: %llu(c%llu+d%llu) usec, %llu (%dbyte,%dfrags)\n",
                      (unsigned long long)ktime_to_us(elapsed),
                      (unsigned long long)ktime_to_us(ktime_sub(elapsed, idle)),
                      (unsigned long long)ktime_to_us(idle),
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index d5074a567289..c44348adba3b 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -1193,7 +1193,7 @@ static int dcbnl_ieee_set(struct net_device *netdev, struct nlattr **tb,
                         goto err;
         }
 
-        if (ieee[DCB_ATTR_IEEE_PFC] && ops->ieee_setets) {
+        if (ieee[DCB_ATTR_IEEE_PFC] && ops->ieee_setpfc) {
                 struct ieee_pfc *pfc = nla_data(ieee[DCB_ATTR_IEEE_PFC]);
                 err = ops->ieee_setpfc(netdev, pfc);
                 if (err)
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 8cde009e8b85..4222e7a654b0 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -614,6 +614,9 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 /* Caller (dccp_v4_do_rcv) will send Reset */
                 dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
                 return 1;
+        } else if (sk->sk_state == DCCP_CLOSED) {
+                dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
+                return 1;
         }
 
         if (sk->sk_state != DCCP_REQUESTING && sk->sk_state != DCCP_RESPOND) {
@@ -668,10 +671,6 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
         }
 
         switch (sk->sk_state) {
-        case DCCP_CLOSED:
-                dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
-                return 1;
-
         case DCCP_REQUESTING:
                 queued = dccp_rcv_request_sent_state_process(sk, skb, dh, len);
                 if (queued >= 0)
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index 739435a6af39..cfa7a5e1c5c9 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -67,8 +67,9 @@ dns_resolver_instantiate(struct key *key, const void *_data, size_t datalen)
         size_t result_len = 0;
         const char *data = _data, *end, *opt;
 
-        kenter("%%%d,%s,'%s',%zu",
-               key->serial, key->description, data, datalen);
+        kenter("%%%d,%s,'%*.*s',%zu",
+               key->serial, key->description,
+               (int)datalen, (int)datalen, data, datalen);
 
         if (datalen <= 1 || !data || data[datalen - 1] != '\0')
                 return -EINVAL;
@@ -217,6 +218,19 @@ static void dns_resolver_describe(const struct key *key, struct seq_file *m)
                 seq_printf(m, ": %u", key->datalen);
 }
 
+/*
+ * read the DNS data
+ * - the key's semaphore is read-locked
+ */
+static long dns_resolver_read(const struct key *key,
+                              char __user *buffer, size_t buflen)
+{
+        if (key->type_data.x[0])
+                return key->type_data.x[0];
+
+        return user_read(key, buffer, buflen);
+}
+
 struct key_type key_type_dns_resolver = {
         .name           = "dns_resolver",
         .instantiate    = dns_resolver_instantiate,
@@ -224,7 +238,7 @@ struct key_type key_type_dns_resolver = {
         .revoke         = user_revoke,
         .destroy        = user_destroy,
         .describe       = dns_resolver_describe,
-        .read           = user_read,
+        .read           = dns_resolver_read,
 };
 
 static int __init init_dns_resolver(void)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index df4616fce929..036652c8166d 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -670,7 +670,7 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                              ifap = &ifa->ifa_next) {
                                 if (!strcmp(ifr.ifr_name, ifa->ifa_label) &&
                                     sin_orig.sin_addr.s_addr ==
-                                                        ifa->ifa_address) {
+                                                        ifa->ifa_local) {
                                         break; /* found */
                                 }
                         }
@@ -1040,8 +1040,8 @@ static void inetdev_send_gratuitous_arp(struct net_device *dev,
                 return;
 
         arp_send(ARPOP_REQUEST, ETH_P_ARP,
-                 ifa->ifa_address, dev,
-                 ifa->ifa_address, NULL,
+                 ifa->ifa_local, dev,
+                 ifa->ifa_local, NULL,
                  dev->dev_addr, NULL);
 }
 
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 6613edfac28c..d1d0e2c256fc 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1765,4 +1765,4 @@ module_exit(ipgre_fini);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_RTNL_LINK("gre");
 MODULE_ALIAS_RTNL_LINK("gretap");
-MODULE_ALIAS("gre0");
+MODULE_ALIAS_NETDEV("gre0");
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 988f52fba54a..a5f58e7cbb26 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -913,4 +913,4 @@ static void __exit ipip_fini(void)
 module_init(ipip_init);
 module_exit(ipip_fini);
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("tunl0");
+MODULE_ALIAS_NETDEV("tunl0");
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 4f4483e697bd..e528a42a52be 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -57,6 +57,7 @@
 MODULE_AUTHOR("Ville Nuorvala");
 MODULE_DESCRIPTION("IPv6 tunneling device");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_NETDEV("ip6tnl0");
 
 #ifdef IP6_TNL_DEBUG
 #define IP6_TNL_TRACE(x...) printk(KERN_DEBUG "%s:" x "\n", __func__)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a998db6e7895..e7db7014e89f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -739,8 +739,10 @@ restart:
 
         if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
                 nrt = rt6_alloc_cow(rt, &fl->fl6_dst, &fl->fl6_src);
-        else
+        else if (!(rt->dst.flags & DST_HOST))
                 nrt = rt6_alloc_clone(rt, &fl->fl6_dst);
+        else
+                goto out2;
 
         dst_release(&rt->dst);
         rt = nrt ? : net->ipv6.ip6_null_entry;
@@ -2557,14 +2559,16 @@ static
 int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write,
                               void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-        struct net *net = current->nsproxy->net_ns;
-        int delay = net->ipv6.sysctl.flush_delay;
-        if (write) {
-                proc_dointvec(ctl, write, buffer, lenp, ppos);
-                fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
-                return 0;
-        } else
+        struct net *net;
+        int delay;
+        if (!write)
                 return -EINVAL;
+
+        net = (struct net *)ctl->extra1;
+        delay = net->ipv6.sysctl.flush_delay;
+        proc_dointvec(ctl, write, buffer, lenp, ppos);
+        fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
+        return 0;
 }
 
 ctl_table ipv6_route_table_template[] = {
@@ -2651,6 +2655,7 @@ struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
 
         if (table) {
                 table[0].data = &net->ipv6.sysctl.flush_delay;
+                table[0].extra1 = net;
                 table[1].data = &net->ipv6.ip6_dst_ops.gc_thresh;
                 table[2].data = &net->ipv6.sysctl.ip6_rt_max_size;
                 table[3].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 8ce38f10a547..d2c16e10f650 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1290,4 +1290,4 @@ static int __init sit_init(void)
 module_init(sit_init);
 module_exit(sit_cleanup);
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("sit0");
+MODULE_ALIAS_NETDEV("sit0");
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 22f7ad5101ab..ba98e1308f3c 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -808,9 +808,9 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
         dest->u_threshold = udest->u_threshold;
         dest->l_threshold = udest->l_threshold;
 
-        spin_lock(&dest->dst_lock);
+        spin_lock_bh(&dest->dst_lock);
         ip_vs_dst_reset(dest);
-        spin_unlock(&dest->dst_lock);
+        spin_unlock_bh(&dest->dst_lock);
 
         if (add)
                 ip_vs_new_estimator(&dest->stats);
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index b07393eab88e..91816998ed86 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -85,6 +85,8 @@ EXPORT_SYMBOL(nf_log_unregister);
 
 int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger)
 {
+        if (pf >= ARRAY_SIZE(nf_loggers))
+                return -EINVAL;
         mutex_lock(&nf_log_mutex);
         if (__find_logger(pf, logger->name) == NULL) {
                 mutex_unlock(&nf_log_mutex);
@@ -98,6 +100,8 @@ EXPORT_SYMBOL(nf_log_bind_pf);
 
 void nf_log_unbind_pf(u_int8_t pf)
 {
+        if (pf >= ARRAY_SIZE(nf_loggers))
+                return;
         mutex_lock(&nf_log_mutex);
         rcu_assign_pointer(nf_loggers[pf], NULL);
         mutex_unlock(&nf_log_mutex);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 478181d53c55..1f924595bdef 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1407,7 +1407,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         int noblock = flags&MSG_DONTWAIT;
         size_t copied;
         struct sk_buff *skb, *data_skb;
-        int err;
+        int err, ret;
 
         if (flags&MSG_OOB)
                 return -EOPNOTSUPP;
@@ -1470,8 +1470,13 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
 
         skb_free_datagram(sk, skb);
 
-        if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2)
-                netlink_dump(sk);
+        if (nlk->cb && atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) {
+                ret = netlink_dump(sk);
+                if (ret) {
+                        sk->sk_err = ret;
+                        sk->sk_error_report(sk);
+                }
+        }
 
         scm_recv(sock, msg, siocb->scm, flags);
 out:
@@ -1736,6 +1741,7 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
         struct netlink_callback *cb;
         struct sock *sk;
         struct netlink_sock *nlk;
+        int ret;
 
         cb = kzalloc(sizeof(*cb), GFP_KERNEL);
         if (cb == NULL)
@@ -1764,9 +1770,13 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
         nlk->cb = cb;
         mutex_unlock(nlk->cb_mutex);
 
-        netlink_dump(sk);
+        ret = netlink_dump(sk);
+
         sock_put(sk);
 
+        if (ret)
+                return ret;
+
         /* We successfully started a dump, by returning -EINTR we
          * signal not to send ACK even if it was requested.
          */
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index 71f373c421bc..c47a511f203d 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -551,7 +551,10 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
         if (conn->c_loopback
             && rm->m_inc.i_hdr.h_flags & RDS_FLAG_CONG_BITMAP) {
                 rds_cong_map_updated(conn->c_fcong, ~(u64) 0);
-                return sizeof(struct rds_header) + RDS_CONG_MAP_BYTES;
+                scat = &rm->data.op_sg[sg];
+                ret = sizeof(struct rds_header) + RDS_CONG_MAP_BYTES;
+                ret = min_t(int, ret, scat->length - conn->c_xmit_data_off);
+                return ret;
         }
 
         /* FIXME we may overallocate here */
diff --git a/net/rds/loop.c b/net/rds/loop.c
index aeec1d483b17..bca6761a3ca2 100644
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -61,10 +61,15 @@ static int rds_loop_xmit(struct rds_connection *conn, struct rds_message *rm,
                          unsigned int hdr_off, unsigned int sg,
                          unsigned int off)
 {
+        struct scatterlist *sgp = &rm->data.op_sg[sg];
+        int ret = sizeof(struct rds_header) +
+                        be32_to_cpu(rm->m_inc.i_hdr.h_len);
+
         /* Do not send cong updates to loopback */
         if (rm->m_inc.i_hdr.h_flags & RDS_FLAG_CONG_BITMAP) {
                 rds_cong_map_updated(conn->c_fcong, ~(u64) 0);
-                return sizeof(struct rds_header) + RDS_CONG_MAP_BYTES;
+                ret = min_t(int, ret, sgp->length - conn->c_xmit_data_off);
+                goto out;
         }
 
         BUG_ON(hdr_off || sg || off);
@@ -80,8 +85,8 @@ static int rds_loop_xmit(struct rds_connection *conn, struct rds_message *rm,
                             NULL);
 
         rds_inc_put(&rm->m_inc);
-
-        return sizeof(struct rds_header) + be32_to_cpu(rm->m_inc.i_hdr.h_len);
+out:
+        return ret;
 }
 
 /*
diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
index 89315009bab1..1a2b0633fece 100644
--- a/net/rxrpc/ar-input.c
+++ b/net/rxrpc/ar-input.c
@@ -423,6 +423,7 @@ void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
                         goto protocol_error;
                 }
 
+        case RXRPC_PACKET_TYPE_ACKALL:
         case RXRPC_PACKET_TYPE_ACK:
                 /* ACK processing is done in process context */
                 read_lock_bh(&call->state_lock);
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 243fc09b164e..59e599498e37 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -252,23 +252,37 @@ static void rpc_set_active(struct rpc_task *task)
 
 /*
  * Mark an RPC call as having completed by clearing the 'active' bit
+ * and then waking up all tasks that were sleeping.
  */
-static void rpc_mark_complete_task(struct rpc_task *task)
+static int rpc_complete_task(struct rpc_task *task)
 {
-        smp_mb__before_clear_bit();
+        void *m = &task->tk_runstate;
+        wait_queue_head_t *wq = bit_waitqueue(m, RPC_TASK_ACTIVE);
+        struct wait_bit_key k = __WAIT_BIT_KEY_INITIALIZER(m, RPC_TASK_ACTIVE);
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&wq->lock, flags);
         clear_bit(RPC_TASK_ACTIVE, &task->tk_runstate);
-        smp_mb__after_clear_bit();
-        wake_up_bit(&task->tk_runstate, RPC_TASK_ACTIVE);
+        ret = atomic_dec_and_test(&task->tk_count);
+        if (waitqueue_active(wq))
+                __wake_up_locked_key(wq, TASK_NORMAL, &k);
+        spin_unlock_irqrestore(&wq->lock, flags);
+        return ret;
 }
 
 /*
  * Allow callers to wait for completion of an RPC call
+ *
+ * Note the use of out_of_line_wait_on_bit() rather than wait_on_bit()
+ * to enforce taking of the wq->lock and hence avoid races with
+ * rpc_complete_task().
  */
 int __rpc_wait_for_completion_task(struct rpc_task *task, int (*action)(void *))
 {
         if (action == NULL)
                 action = rpc_wait_bit_killable;
-        return wait_on_bit(&task->tk_runstate, RPC_TASK_ACTIVE,
+        return out_of_line_wait_on_bit(&task->tk_runstate, RPC_TASK_ACTIVE,
                         action, TASK_KILLABLE);
 }
 EXPORT_SYMBOL_GPL(__rpc_wait_for_completion_task);
@@ -857,34 +871,67 @@ static void rpc_async_release(struct work_struct *work)
         rpc_free_task(container_of(work, struct rpc_task, u.tk_work));
 }
 
-void rpc_put_task(struct rpc_task *task)
+static void rpc_release_resources_task(struct rpc_task *task)
 {
-        if (!atomic_dec_and_test(&task->tk_count))
-                return;
-        /* Release resources */
         if (task->tk_rqstp)
                 xprt_release(task);
         if (task->tk_msg.rpc_cred)
                 put_rpccred(task->tk_msg.rpc_cred);
         rpc_task_release_client(task);
-        if (task->tk_workqueue != NULL) {
+}
+
+static void rpc_final_put_task(struct rpc_task *task,
+                struct workqueue_struct *q)
+{
+        if (q != NULL) {
                 INIT_WORK(&task->u.tk_work, rpc_async_release);
-                queue_work(task->tk_workqueue, &task->u.tk_work);
+                queue_work(q, &task->u.tk_work);
         } else
                 rpc_free_task(task);
 }
+
+static void rpc_do_put_task(struct rpc_task *task, struct workqueue_struct *q)
+{
+        if (atomic_dec_and_test(&task->tk_count)) {
+                rpc_release_resources_task(task);
+                rpc_final_put_task(task, q);
+        }
+}
+
+void rpc_put_task(struct rpc_task *task)
+{
+        rpc_do_put_task(task, NULL);
+}
 EXPORT_SYMBOL_GPL(rpc_put_task);
 
+void rpc_put_task_async(struct rpc_task *task)
+{
+        rpc_do_put_task(task, task->tk_workqueue);
+}
+EXPORT_SYMBOL_GPL(rpc_put_task_async);
+
 static void rpc_release_task(struct rpc_task *task)
 {
         dprintk("RPC: %5u release task\n", task->tk_pid);
 
         BUG_ON (RPC_IS_QUEUED(task));
 
-        /* Wake up anyone who is waiting for task completion */
-        rpc_mark_complete_task(task);
+        rpc_release_resources_task(task);
 
-        rpc_put_task(task);
+        /*
+         * Note: at this point we have been removed from rpc_clnt->cl_tasks,
+         * so it should be safe to use task->tk_count as a test for whether
+         * or not any other processes still hold references to our rpc_task.
+         */
+        if (atomic_read(&task->tk_count) != 1 + !RPC_IS_ASYNC(task)) {
+                /* Wake up anyone who may be waiting for task completion */
+                if (!rpc_complete_task(task))
+                        return;
+        } else {
+                if (!atomic_dec_and_test(&task->tk_count))
+                        return;
+        }
+        rpc_final_put_task(task, task->tk_workqueue);
 }
 
 int rpciod_up(void)
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 9df1eadc912a..1a10dcd999ea 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -1335,6 +1335,7 @@ void svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
                                             p, 0, length, DMA_FROM_DEVICE);
         if (ib_dma_mapping_error(xprt->sc_cm_id->device, ctxt->sge[0].addr)) {
                 put_page(p);
+                svc_rdma_put_context(ctxt, 1);
                 return;
         }
         atomic_inc(&xprt->sc_dma_used);
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index c431f5a57960..be96d429b475 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1631,7 +1631,8 @@ static struct socket *xs_create_sock(struct rpc_xprt *xprt,
         }
         xs_reclassify_socket(family, sock);
 
-        if (xs_bind(transport, sock)) {
+        err = xs_bind(transport, sock);
+        if (err) {
                 sock_release(sock);
                 goto out;
         }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index dd419d286204..437a99e560e1 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1724,7 +1724,11 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         msg->msg_namelen = 0;
 
-        mutex_lock(&u->readlock);
+        err = mutex_lock_interruptible(&u->readlock);
+        if (err) {
+                err = sock_intr_errno(sock_rcvtimeo(sk, noblock));
+                goto out;
+        }
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb) {
@@ -1864,7 +1868,11 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 memset(&tmp_scm, 0, sizeof(tmp_scm));
         }
 
-        mutex_lock(&u->readlock);
+        err = mutex_lock_interruptible(&u->readlock);
+        if (err) {
+                err = sock_intr_errno(timeo);
+                goto out;
+        }
 
         do {
                 int chunk;
@@ -1895,11 +1903,12 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                         timeo = unix_stream_data_wait(sk, timeo);
 
-                        if (signal_pending(current)) {
+                        if (signal_pending(current)
+                            ||  mutex_lock_interruptible(&u->readlock)) {
                                 err = sock_intr_errno(timeo);
                                 goto out;
                         }
-                        mutex_lock(&u->readlock);
+
                         continue;
  unlock:
                         unix_state_unlock(sk);
diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
index 6c94c6ce2925..291228e25984 100644
--- a/scripts/basic/fixdep.c
+++ b/scripts/basic/fixdep.c
@@ -309,6 +309,11 @@ static void do_config_file(const char *filename)
         close(fd);
 }
 
+/*
+ * Important: The below generated source_foo.o and deps_foo.o variable
+ * assignments are parsed not only by make, but also by the rather simple
+ * parser in scripts/mod/sumversion.c.
+ */
 static void parse_dep_file(void *map, size_t len)
 {
         char *m = map;
@@ -323,7 +328,6 @@ static void parse_dep_file(void *map, size_t len)
                 exit(1);
         }
         memcpy(s, m, p-m); s[p-m] = 0;
-        printf("deps_%s := \\\n", target);
         m = p+1;
 
         clear_config();
@@ -343,12 +347,15 @@ static void parse_dep_file(void *map, size_t len)
                     strrcmp(s, "arch/um/include/uml-config.h") &&
                     strrcmp(s, ".ver")) {
                         /*
-                         * Do not output the first dependency (the
-                         * source file), so that kbuild is not confused
-                         * if a .c file is rewritten into .S or vice
-                         * versa.
+                         * Do not list the source file as dependency, so that
+                         * kbuild is not confused if a .c file is rewritten
+                         * into .S or vice versa. Storing it in source_* is
+                         * needed for modpost to compute srcversions.
                          */
-                        if (!first)
+                        if (first) {
+                                printf("source_%s := %s\n\n", target, s);
+                                printf("deps_%s := \\\n", target);
+                        } else
                                 printf("  %s \\\n", s);
                         do_config_file(s);
                 }
diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
index ecf9c7dc1825..9dfcd6d988da 100644
--- a/scripts/mod/sumversion.c
+++ b/scripts/mod/sumversion.c
@@ -300,8 +300,8 @@ static int is_static_library(const char *objfile)
                 return 0;
 }
 
-/* We have dir/file.o.  Open dir/.file.o.cmd, look for deps_ line to
- * figure out source file. */
+/* We have dir/file.o.  Open dir/.file.o.cmd, look for source_ and deps_ line
+ * to figure out source files. */
 static int parse_source_files(const char *objfile, struct md4_ctx *md)
 {
         char *cmd, *file, *line, *dir;
@@ -340,6 +340,21 @@ static int parse_source_files(const char *objfile, struct md4_ctx *md)
         */
         while ((line = get_next_line(&pos, file, flen)) != NULL) {
                 char* p = line;
+
+                if (strncmp(line, "source_", sizeof("source_")-1) == 0) {
+                        p = strrchr(line, ' ');
+                        if (!p) {
+                                warn("malformed line: %s\n", line);
+                                goto out_file;
+                        }
+                        p++;
+                        if (!parse_file(p, md)) {
+                                warn("could not open %s: %s\n",
+                                     p, strerror(errno));
+                                goto out_file;
+                        }
+                        continue;
+                }
                 if (strncmp(line, "deps_", sizeof("deps_")-1) == 0) {
                         check_files = 1;
                         continue;
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index a07b031090d8..067982f4f182 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -1039,9 +1039,11 @@ static struct hda_verb cs_errata_init_verbs[] = {
         {0x11, AC_VERB_SET_PROC_COEF, 0x0008},
         {0x11, AC_VERB_SET_PROC_STATE, 0x00},
 
+#if 0 /* Don't to set to D3 as we are in power-up sequence */
         {0x07, AC_VERB_SET_POWER_STATE, 0x03}, /* S/PDIF Rx: D3 */
         {0x08, AC_VERB_SET_POWER_STATE, 0x03}, /* S/PDIF Tx: D3 */
         /*{0x01, AC_VERB_SET_POWER_STATE, 0x03},*/ /* AFG: D3 This is already handled */
+#endif
 
         {} /* terminator */
 };
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index a58767736727..ec0fa2dd0a27 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1634,6 +1634,9 @@ static struct hda_codec_preset snd_hda_preset_hdmi[] = {
 { .id = 0x10de0012, .name = "GPU 12 HDMI/DP",   .patch = patch_nvhdmi_8ch_89 },
 { .id = 0x10de0013, .name = "GPU 13 HDMI/DP",   .patch = patch_nvhdmi_8ch_89 },
 { .id = 0x10de0014, .name = "GPU 14 HDMI/DP",   .patch = patch_nvhdmi_8ch_89 },
+{ .id = 0x10de0015, .name = "GPU 15 HDMI/DP",   .patch = patch_nvhdmi_8ch_89 },
+{ .id = 0x10de0016, .name = "GPU 16 HDMI/DP",   .patch = patch_nvhdmi_8ch_89 },
+/* 17 is known to be absent */
 { .id = 0x10de0018, .name = "GPU 18 HDMI/DP",   .patch = patch_nvhdmi_8ch_89 },
 { .id = 0x10de0019, .name = "GPU 19 HDMI/DP",   .patch = patch_nvhdmi_8ch_89 },
 { .id = 0x10de001a, .name = "GPU 1a HDMI/DP",   .patch = patch_nvhdmi_8ch_89 },
@@ -1676,6 +1679,8 @@ MODULE_ALIAS("snd-hda-codec-id:10de0011");
 MODULE_ALIAS("snd-hda-codec-id:10de0012");
 MODULE_ALIAS("snd-hda-codec-id:10de0013");
 MODULE_ALIAS("snd-hda-codec-id:10de0014");
+MODULE_ALIAS("snd-hda-codec-id:10de0015");
+MODULE_ALIAS("snd-hda-codec-id:10de0016");
 MODULE_ALIAS("snd-hda-codec-id:10de0018");
 MODULE_ALIAS("snd-hda-codec-id:10de0019");
 MODULE_ALIAS("snd-hda-codec-id:10de001a");
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 3328a259a242..4261bb8eec1d 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1133,11 +1133,8 @@ static void alc_automute_speaker(struct hda_codec *codec, int pinctl)
                 nid = spec->autocfg.hp_pins[i];
                 if (!nid)
                         break;
-                if (snd_hda_jack_detect(codec, nid)) {
-                        spec->jack_present = 1;
-                        break;
-                }
-                alc_report_jack(codec, spec->autocfg.hp_pins[i]);
+                alc_report_jack(codec, nid);
+                spec->jack_present |= snd_hda_jack_detect(codec, nid);
         }
 
         mute = spec->jack_present ? HDA_AMP_MUTE : 0;
@@ -15015,7 +15012,7 @@ static struct snd_pci_quirk alc269_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x11e3, "ASUS U33Jc", ALC269VB_AMIC),
         SND_PCI_QUIRK(0x1043, 0x1273, "ASUS UL80Jt", ALC269VB_AMIC),
         SND_PCI_QUIRK(0x1043, 0x1283, "ASUS U53Jc", ALC269_AMIC),
-        SND_PCI_QUIRK(0x1043, 0x12b3, "ASUS N82Jv", ALC269_AMIC),
+        SND_PCI_QUIRK(0x1043, 0x12b3, "ASUS N82JV", ALC269VB_AMIC),
         SND_PCI_QUIRK(0x1043, 0x12d3, "ASUS N61Jv", ALC269_AMIC),
         SND_PCI_QUIRK(0x1043, 0x13a3, "ASUS UL30Vt", ALC269_AMIC),
         SND_PCI_QUIRK(0x1043, 0x1373, "ASUS G73JX", ALC269_AMIC),
diff --git a/sound/soc/codecs/wm8978.c b/sound/soc/codecs/wm8978.c
index 4bbc3442703f..8dfb0a0da673 100644
--- a/sound/soc/codecs/wm8978.c
+++ b/sound/soc/codecs/wm8978.c
@@ -145,18 +145,18 @@ static const struct snd_kcontrol_new wm8978_snd_controls[] = {
         SOC_SINGLE("DAC Playback Limiter Threshold",
                 WM8978_DAC_LIMITER_2, 4, 7, 0),
         SOC_SINGLE("DAC Playback Limiter Boost",
-                WM8978_DAC_LIMITER_2, 0, 15, 0),
+                WM8978_DAC_LIMITER_2, 0, 12, 0),
 
         SOC_ENUM("ALC Enable Switch", alc1),
         SOC_SINGLE("ALC Capture Min Gain", WM8978_ALC_CONTROL_1, 0, 7, 0),
         SOC_SINGLE("ALC Capture Max Gain", WM8978_ALC_CONTROL_1, 3, 7, 0),
 
-        SOC_SINGLE("ALC Capture Hold", WM8978_ALC_CONTROL_2, 4, 7, 0),
+        SOC_SINGLE("ALC Capture Hold", WM8978_ALC_CONTROL_2, 4, 10, 0),
         SOC_SINGLE("ALC Capture Target", WM8978_ALC_CONTROL_2, 0, 15, 0),
 
         SOC_ENUM("ALC Capture Mode", alc3),
-        SOC_SINGLE("ALC Capture Decay", WM8978_ALC_CONTROL_3, 4, 15, 0),
-        SOC_SINGLE("ALC Capture Attack", WM8978_ALC_CONTROL_3, 0, 15, 0),
+        SOC_SINGLE("ALC Capture Decay", WM8978_ALC_CONTROL_3, 4, 10, 0),
+        SOC_SINGLE("ALC Capture Attack", WM8978_ALC_CONTROL_3, 0, 10, 0),
 
         SOC_SINGLE("ALC Capture Noise Gate Switch", WM8978_NOISE_GATE, 3, 1, 0),
         SOC_SINGLE("ALC Capture Noise Gate Threshold",
@@ -211,8 +211,10 @@ static const struct snd_kcontrol_new wm8978_snd_controls[] = {
                 WM8978_LOUT2_SPK_CONTROL, WM8978_ROUT2_SPK_CONTROL, 6, 1, 1),
 
         /* DAC / ADC oversampling */
-        SOC_SINGLE("DAC 128x Oversampling Switch", WM8978_DAC_CONTROL, 8, 1, 0),
-        SOC_SINGLE("ADC 128x Oversampling Switch", WM8978_ADC_CONTROL, 8, 1, 0),
+        SOC_SINGLE("DAC 128x Oversampling Switch", WM8978_DAC_CONTROL,
+                   5, 1, 0),
+        SOC_SINGLE("ADC 128x Oversampling Switch", WM8978_ADC_CONTROL,
+                   5, 1, 0),
 };
 
 /* Mixer #1: Output (OUT1, OUT2) Mixer: mix AUX, Input mixer output and DAC */
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index ebaee5ca7434..c6c958ee5d59 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -110,6 +110,9 @@ struct wm8994_priv {
 
         unsigned int aif1clk_enable:1;
         unsigned int aif2clk_enable:1;
+
+        unsigned int aif1clk_disable:1;
+        unsigned int aif2clk_disable:1;
 };
 
 static int wm8994_readable(unsigned int reg)
@@ -1015,14 +1018,18 @@ static int late_enable_ev(struct snd_soc_dapm_widget *w,
 
         switch (event) {
         case SND_SOC_DAPM_PRE_PMU:
-                if (wm8994->aif1clk_enable)
+                if (wm8994->aif1clk_enable) {
                         snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
                                             WM8994_AIF1CLK_ENA_MASK,
                                             WM8994_AIF1CLK_ENA);
-                if (wm8994->aif2clk_enable)
+                        wm8994->aif1clk_enable = 0;
+                }
+                if (wm8994->aif2clk_enable) {
                         snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
                                             WM8994_AIF2CLK_ENA_MASK,
                                             WM8994_AIF2CLK_ENA);
+                        wm8994->aif2clk_enable = 0;
+                }
                 break;
         }
 
@@ -1037,15 +1044,15 @@ static int late_disable_ev(struct snd_soc_dapm_widget *w,
 
         switch (event) {
         case SND_SOC_DAPM_POST_PMD:
-                if (wm8994->aif1clk_enable) {
+                if (wm8994->aif1clk_disable) {
                         snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
                                             WM8994_AIF1CLK_ENA_MASK, 0);
-                        wm8994->aif1clk_enable = 0;
+                        wm8994->aif1clk_disable = 0;
                 }
-                if (wm8994->aif2clk_enable) {
+                if (wm8994->aif2clk_disable) {
                         snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
                                             WM8994_AIF2CLK_ENA_MASK, 0);
-                        wm8994->aif2clk_enable = 0;
+                        wm8994->aif2clk_disable = 0;
                 }
                 break;
         }
@@ -1063,6 +1070,9 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
         case SND_SOC_DAPM_PRE_PMU:
                 wm8994->aif1clk_enable = 1;
                 break;
+        case SND_SOC_DAPM_POST_PMD:
+                wm8994->aif1clk_disable = 1;
+                break;
         }
 
         return 0;
@@ -1078,11 +1088,21 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
         case SND_SOC_DAPM_PRE_PMU:
                 wm8994->aif2clk_enable = 1;
                 break;
+        case SND_SOC_DAPM_POST_PMD:
+                wm8994->aif2clk_disable = 1;
+                break;
         }
 
         return 0;
 }
 
+static int adc_mux_ev(struct snd_soc_dapm_widget *w,
+                      struct snd_kcontrol *kcontrol, int event)
+{
+        late_enable_ev(w, kcontrol, event);
+        return 0;
+}
+
 static int dac_ev(struct snd_soc_dapm_widget *w,
                   struct snd_kcontrol *kcontrol, int event)
 {
@@ -1398,11 +1418,23 @@ SND_SOC_DAPM_DAC_E("DAC1R", NULL, SND_SOC_NOPM, 0, 0,
 
 static const struct snd_soc_dapm_widget wm8994_dac_widgets[] = {
 SND_SOC_DAPM_DAC("DAC2L", NULL, WM8994_POWER_MANAGEMENT_5, 3, 0),
-SND_SOC_DAPM_DAC("DAC1R", NULL, WM8994_POWER_MANAGEMENT_5, 2, 0),
+SND_SOC_DAPM_DAC("DAC2R", NULL, WM8994_POWER_MANAGEMENT_5, 2, 0),
 SND_SOC_DAPM_DAC("DAC1L", NULL, WM8994_POWER_MANAGEMENT_5, 1, 0),
 SND_SOC_DAPM_DAC("DAC1R", NULL, WM8994_POWER_MANAGEMENT_5, 0, 0),
 };
 
+static const struct snd_soc_dapm_widget wm8994_adc_revd_widgets[] = {
+SND_SOC_DAPM_MUX_E("ADCL Mux", WM8994_POWER_MANAGEMENT_4, 1, 0, &adcl_mux,
+                   adc_mux_ev, SND_SOC_DAPM_PRE_PMU),
+SND_SOC_DAPM_MUX_E("ADCR Mux", WM8994_POWER_MANAGEMENT_4, 0, 0, &adcr_mux,
+                   adc_mux_ev, SND_SOC_DAPM_PRE_PMU),
+};
+
+static const struct snd_soc_dapm_widget wm8994_adc_widgets[] = {
+SND_SOC_DAPM_MUX("ADCL Mux", WM8994_POWER_MANAGEMENT_4, 1, 0, &adcl_mux),
+SND_SOC_DAPM_MUX("ADCR Mux", WM8994_POWER_MANAGEMENT_4, 0, 0, &adcr_mux),
+};
+
 static const struct snd_soc_dapm_widget wm8994_dapm_widgets[] = {
 SND_SOC_DAPM_INPUT("DMIC1DAT"),
 SND_SOC_DAPM_INPUT("DMIC2DAT"),
@@ -1497,9 +1529,6 @@ SND_SOC_DAPM_ADC("DMIC1R", NULL, WM8994_POWER_MANAGEMENT_4, 2, 0),
 SND_SOC_DAPM_ADC("ADCL", NULL, SND_SOC_NOPM, 1, 0),
 SND_SOC_DAPM_ADC("ADCR", NULL, SND_SOC_NOPM, 0, 0),
 
-SND_SOC_DAPM_MUX("ADCL Mux", WM8994_POWER_MANAGEMENT_4, 1, 0, &adcl_mux),
-SND_SOC_DAPM_MUX("ADCR Mux", WM8994_POWER_MANAGEMENT_4, 0, 0, &adcr_mux),
-
 SND_SOC_DAPM_MUX("Left Headphone Mux", SND_SOC_NOPM, 0, 0, &hpl_mux),
 SND_SOC_DAPM_MUX("Right Headphone Mux", SND_SOC_NOPM, 0, 0, &hpr_mux),
 
@@ -3280,11 +3309,15 @@ static int wm8994_codec_probe(struct snd_soc_codec *codec)
                 if (wm8994->revision < 4) {
                         snd_soc_dapm_new_controls(dapm, wm8994_lateclk_revd_widgets,
                                                   ARRAY_SIZE(wm8994_lateclk_revd_widgets));
+                        snd_soc_dapm_new_controls(dapm, wm8994_adc_revd_widgets,
+                                                  ARRAY_SIZE(wm8994_adc_revd_widgets));
                         snd_soc_dapm_new_controls(dapm, wm8994_dac_revd_widgets,
                                                   ARRAY_SIZE(wm8994_dac_revd_widgets));
                 } else {
                         snd_soc_dapm_new_controls(dapm, wm8994_lateclk_widgets,
                                                   ARRAY_SIZE(wm8994_lateclk_widgets));
+                        snd_soc_dapm_new_controls(dapm, wm8994_adc_widgets,
+                                                  ARRAY_SIZE(wm8994_adc_widgets));
                         snd_soc_dapm_new_controls(dapm, wm8994_dac_widgets,
                                                   ARRAY_SIZE(wm8994_dac_widgets));
                 }
@@ -3292,6 +3325,12 @@ static int wm8994_codec_probe(struct snd_soc_codec *codec)
         case WM8958:
                 snd_soc_add_controls(codec, wm8958_snd_controls,
                                      ARRAY_SIZE(wm8958_snd_controls));
+                snd_soc_dapm_new_controls(dapm, wm8994_lateclk_widgets,
+                                          ARRAY_SIZE(wm8994_lateclk_widgets));
+                snd_soc_dapm_new_controls(dapm, wm8994_adc_widgets,
+                                          ARRAY_SIZE(wm8994_adc_widgets));
+                snd_soc_dapm_new_controls(dapm, wm8994_dac_widgets,
+                                          ARRAY_SIZE(wm8994_dac_widgets));
                 snd_soc_dapm_new_controls(dapm, wm8958_dapm_widgets,
                                           ARRAY_SIZE(wm8958_dapm_widgets));
                 break;
@@ -3317,6 +3356,8 @@ static int wm8994_codec_probe(struct snd_soc_codec *codec)
                 }
                 break;
         case WM8958:
+                snd_soc_dapm_add_routes(dapm, wm8994_lateclk_intercon,
+                                        ARRAY_SIZE(wm8994_lateclk_intercon));
                 snd_soc_dapm_add_routes(dapm, wm8958_intercon,
                                         ARRAY_SIZE(wm8958_intercon));
                 break;
diff --git a/sound/soc/codecs/wm9081.c b/sound/soc/codecs/wm9081.c
index 43825b2102a5..cce704c275c6 100644
--- a/sound/soc/codecs/wm9081.c
+++ b/sound/soc/codecs/wm9081.c
@@ -15,6 +15,7 @@
 #include <linux/moduleparam.h>
 #include <linux/init.h>
 #include <linux/delay.h>
+#include <linux/device.h>
 #include <linux/pm.h>
 #include <linux/i2c.h>
 #include <linux/platform_device.h>
@@ -1341,6 +1342,10 @@ static __devinit int wm9081_i2c_probe(struct i2c_client *i2c,
         wm9081->control_type = SND_SOC_I2C;
         wm9081->control_data = i2c;
 
+        if (dev_get_platdata(&i2c->dev))
+                memcpy(&wm9081->retune, dev_get_platdata(&i2c->dev),
+                       sizeof(wm9081->retune));
+
         ret = snd_soc_register_codec(&i2c->dev,
                         &soc_codec_dev_wm9081, &wm9081_dai, 1);
         if (ret < 0)
diff --git a/sound/soc/omap/am3517evm.c b/sound/soc/omap/am3517evm.c
index 161750443ebc..73dde4a1adc3 100644
--- a/sound/soc/omap/am3517evm.c
+++ b/sound/soc/omap/am3517evm.c
@@ -139,7 +139,7 @@ static struct snd_soc_dai_link am3517evm_dai = {
         .cpu_dai_name ="omap-mcbsp-dai.0",
         .codec_dai_name = "tlv320aic23-hifi",
         .platform_name = "omap-pcm-audio",
-        .codec_name = "tlv320aic23-codec",
+        .codec_name = "tlv320aic23-codec.2-001a",
         .init = am3517evm_aic23_init,
         .ops = &am3517evm_ops,
 };
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 25e54230cc6a..1790f83ee665 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -941,7 +941,7 @@ static void dapm_seq_run(struct snd_soc_dapm_context *dapm,
         }
 
         if (!list_empty(&pending))
-                dapm_seq_run_coalesced(dapm, &pending);
+                dapm_seq_run_coalesced(cur_dapm, &pending);
 }
 
 static void dapm_widget_update(struct snd_soc_dapm_context *dapm)
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index f6a929e74981..0866bcdb5e8e 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -270,11 +270,15 @@ int build_id_cache__add_s(const char *sbuild_id, const char *debugdir,
                           const char *name, bool is_kallsyms)
 {
         const size_t size = PATH_MAX;
-        char *realname = realpath(name, NULL),
-             *filename = malloc(size),
+        char *realname, *filename = malloc(size),
              *linkname = malloc(size), *targetname;
         int len, err = -1;
 
+        if (is_kallsyms)
+                realname = (char *)name;
+        else
+                realname = realpath(name, NULL);
+
         if (realname == NULL || filename == NULL || linkname == NULL)
                 goto out_free;
 
@@ -306,7 +310,8 @@ int build_id_cache__add_s(const char *sbuild_id, const char *debugdir,
         if (symlink(targetname, linkname) == 0)
                 err = 0;
 out_free:
-        free(realname);
+        if (!is_kallsyms)
+                free(realname);
         free(filename);
         free(linkname);
         return err;
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 7821d0e6866f..b1bf490aff88 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1836,7 +1836,7 @@ int dso__load_vmlinux(struct dso *self, struct map *map,
         int err = -1, fd;
         char symfs_vmlinux[PATH_MAX];
 
-        snprintf(symfs_vmlinux, sizeof(symfs_vmlinux), "%s/%s",
+        snprintf(symfs_vmlinux, sizeof(symfs_vmlinux), "%s%s",
                  symbol_conf.symfs, vmlinux);
         fd = open(symfs_vmlinux, O_RDONLY);
         if (fd < 0)