184 files changed, 2324 insertions, 1016 deletions
diff --git a/Documentation/input/multi-touch-protocol.txt b/Documentation/input/multi-touch-protocol.txt
index 9f09557aea39..a12ea3b586e6 100644
--- a/Documentation/input/multi-touch-protocol.txt
+++ b/Documentation/input/multi-touch-protocol.txt
@@ -18,8 +18,12 @@ Usage
 Anonymous finger details are sent sequentially as separate packets of ABS
 events. Only the ABS_MT events are recognized as part of a finger
 packet. The end of a packet is marked by calling the input_mt_sync()
-function, which generates a SYN_MT_REPORT event. The end of multi-touch
+function, which generates a SYN_MT_REPORT event. This instructs the
-transfer is marked by calling the usual input_sync() function.
+receiver to accept the data for the current finger and prepare to receive
+another. The end of a multi-touch transfer is marked by calling the usual
+input_sync() function. This instructs the receiver to act upon events
+accumulated since last EV_SYN/SYN_REPORT and prepare to receive a new
+set of events/packets.
 A set of ABS_MT events with the desired properties is defined. The events
 are divided into categories, to allow for partial implementation.  The
@@ -27,11 +31,26 @@ minimum set consists of ABS_MT_TOUCH_MAJOR, ABS_MT_POSITION_X and
 ABS_MT_POSITION_Y, which allows for multiple fingers to be tracked.  If the
 device supports it, the ABS_MT_WIDTH_MAJOR may be used to provide the size
 of the approaching finger. Anisotropy and direction may be specified with
-ABS_MT_TOUCH_MINOR, ABS_MT_WIDTH_MINOR and ABS_MT_ORIENTATION. Devices with
+ABS_MT_TOUCH_MINOR, ABS_MT_WIDTH_MINOR and ABS_MT_ORIENTATION.  The
-more granular information may specify general shapes as blobs, i.e., as a
+ABS_MT_TOOL_TYPE may be used to specify whether the touching tool is a
-sequence of rectangular shapes grouped together by an
+finger or a pen or something else.  Devices with more granular information
-ABS_MT_BLOB_ID. Finally, the ABS_MT_TOOL_TYPE may be used to specify
+may specify general shapes as blobs, i.e., as a sequence of rectangular
-whether the touching tool is a finger or a pen or something else.
+shapes grouped together by an ABS_MT_BLOB_ID. Finally, for the few devices
+that currently support it, the ABS_MT_TRACKING_ID event may be used to
+report finger tracking from hardware [5].
+Here is what a minimal event sequence for a two-finger touch would look
+like:
+   ABS_MT_TOUCH_MAJOR
+   ABS_MT_POSITION_X
+   ABS_MT_POSITION_Y
+   SYN_MT_REPORT
+   ABS_MT_TOUCH_MAJOR
+   ABS_MT_POSITION_X
+   ABS_MT_POSITION_Y
+   SYN_MT_REPORT
+   SYN_REPORT
 Event Semantics
@@ -44,24 +63,24 @@ ABS_MT_TOUCH_MAJOR
 The length of the major axis of the contact. The length should be given in
 surface units. If the surface has an X times Y resolution, the largest
-possible value of ABS_MT_TOUCH_MAJOR is sqrt(X^2 + Y^2), the diagonal.
+possible value of ABS_MT_TOUCH_MAJOR is sqrt(X^2 + Y^2), the diagonal [4].
 ABS_MT_TOUCH_MINOR
 The length, in surface units, of the minor axis of the contact. If the
-contact is circular, this event can be omitted.
+contact is circular, this event can be omitted [4].
 ABS_MT_WIDTH_MAJOR
 The length, in surface units, of the major axis of the approaching
 tool. This should be understood as the size of the tool itself. The
 orientation of the contact and the approaching tool are assumed to be the
-same.
+same [4].
 ABS_MT_WIDTH_MINOR
 The length, in surface units, of the minor axis of the approaching
-tool. Omit if circular.
+tool. Omit if circular [4].
 The above four values can be used to derive additional information about
 the contact. The ratio ABS_MT_TOUCH_MAJOR / ABS_MT_WIDTH_MAJOR approximates
@@ -70,14 +89,17 @@ different characteristic widths [1].
 ABS_MT_ORIENTATION
-The orientation of the ellipse. The value should describe half a revolution
+The orientation of the ellipse. The value should describe a signed quarter
-clockwise around the touch center. The scale of the value is arbitrary, but
+of a revolution clockwise around the touch center. The signed value range
-zero should be returned for an ellipse aligned along the Y axis of the
+is arbitrary, but zero should be returned for a finger aligned along the Y
-surface. As an example, an index finger placed straight onto the axis could
+axis of the surface, a negative value when finger is turned to the left, and
-return zero orientation, something negative when twisted to the left, and
+a positive value when finger turned to the right. When completely aligned with
-something positive when twisted to the right. This value can be omitted if
+the X axis, the range max should be returned.  Orientation can be omitted
-the touching object is circular, or if the information is not available in
+if the touching object is circular, or if the information is not available
-the kernel driver.
+in the kernel driver. Partial orientation support is possible if the device
+can distinguish between the two axis, but not (uniquely) any values in
+between. In such cases, the range of ABS_MT_ORIENTATION should be [0, 1]
+[4].
 ABS_MT_POSITION_X
@@ -98,8 +120,35 @@ ABS_MT_BLOB_ID
 The BLOB_ID groups several packets together into one arbitrarily shaped
 contact. This is a low-level anonymous grouping, and should not be confused
-with the high-level contactID, explained below. Most kernel drivers will
+with the high-level trackingID [5]. Most kernel drivers will not have blob
-not have this capability, and can safely omit the event.
+capability, and can safely omit the event.
+ABS_MT_TRACKING_ID
+The TRACKING_ID identifies an initiated contact throughout its life cycle
+[5]. There are currently only a few devices that support it, so this event
+should normally be omitted.
+Event Computation
+-----------------
+The flora of different hardware unavoidably leads to some devices fitting
+better to the MT protocol than others. To simplify and unify the mapping,
+this section gives recipes for how to compute certain events.
+For devices reporting contacts as rectangular shapes, signed orientation
+cannot be obtained. Assuming X and Y are the lengths of the sides of the
+touching rectangle, here is a simple formula that retains the most
+information possible:
+   ABS_MT_TOUCH_MAJOR := max(X, Y)
+   ABS_MT_TOUCH_MINOR := min(X, Y)
+   ABS_MT_ORIENTATION := bool(X > Y)
+The range of ABS_MT_ORIENTATION should be set to [0, 1], to indicate that
+the device can distinguish between a finger along the Y axis (0) and a
+finger along the X axis (1).
 Finger Tracking
@@ -109,14 +158,18 @@ The kernel driver should generate an arbitrary enumeration of the set of
 anonymous contacts currently on the surface. The order in which the packets
 appear in the event stream is not important.
-The process of finger tracking, i.e., to assign a unique contactID to each
+The process of finger tracking, i.e., to assign a unique trackingID to each
 initiated contact on the surface, is left to user space; preferably the
-multi-touch X driver [3]. In that driver, the contactID stays the same and
+multi-touch X driver [3]. In that driver, the trackingID stays the same and
 unique until the contact vanishes (when the finger leaves the surface). The
 problem of assigning a set of anonymous fingers to a set of identified
 fingers is a euclidian bipartite matching problem at each event update, and
 relies on a sufficiently rapid update rate.
+There are a few devices that support trackingID in hardware. User space can
+make use of these native identifiers to reduce bandwidth and cpu usage.
 Notes
 -----
@@ -136,5 +189,7 @@ could be used to derive tilt.
 time of writing (April 2009), the MT protocol is not yet merged, and the
 prototype implements finger matching, basic mouse support and two-finger
 scrolling. The project aims at improving the quality of current multi-touch
-functionality available in the synaptics X driver, and in addition
+functionality available in the Synaptics X driver, and in addition
 implement more advanced gestures.
+[4] See the section on event computation.
+[5] See the section on finger tracking.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e87bdbfbcc75..fd5cac013037 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1535,6 +1535,10 @@ and is between 256 and 4096 characters. It is defined in the file
                        register save and restore. The kernel will only save
                        legacy floating-point registers on task switch.
+        noxsave         [BUGS=X86] Disables x86 extended register state save
+                        and restore using xsave. The kernel will fallback to
+                        enabling legacy floating-point and sse state.
        nohlt           [BUGS=ARM,SH] Tells the kernel that the sleep(SH) or
                        wfi(ARM) instruction doesn't work correctly and not to
                        use it. This is also useful when using JTAG debugger.
diff --git a/Documentation/sound/alsa/HD-Audio-Models.txt b/Documentation/sound/alsa/HD-Audio-Models.txt
index 8eec05bc079e..322869fc8a9e 100644
--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -334,6 +334,7 @@ STAC9227/9228/9229/927x
  ref-no-jd     Reference board without HP/Mic jack detection
  3stack        D965 3stack
  5stack        D965 5stack + SPDIF
+  5stack-no-fp  D965 5stack without front panel
  dell-3stack   Dell Dimension E520
  dell-bios     Fixes with Dell BIOS setup
  auto          BIOS setup (default)
diff --git a/Documentation/sound/alsa/Procfile.txt b/Documentation/sound/alsa/Procfile.txt
index bba2dbb79d81..cfac20cf9e33 100644
--- a/Documentation/sound/alsa/Procfile.txt
+++ b/Documentation/sound/alsa/Procfile.txt
@@ -104,6 +104,11 @@ card*/pcm*/xrun_debug
        When this value is greater than 1, the driver will show the
        stack trace additionally.  This may help the debugging.
+        Since 2.6.30, this option also enables the hwptr check using
+        jiffies.  This detects spontaneous invalid pointer callback
+        values, but can be lead to too much corrections for a (mostly
+        buggy) hardware that doesn't give smooth pointer updates.
 card*/pcm*/sub*/info
        The general information of this PCM sub-stream.
diff --git a/MAINTAINERS b/MAINTAINERS
index 77cbfb1a696c..873ca1fce020 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -434,7 +434,7 @@ F:	arch/alpha/
 AMD GEODE CS5536 USB DEVICE CONTROLLER DRIVER
 P:      Thomas Dahlmann
-M:      thomas.dahlmann@amd.com
+M:      dahlmann.thomas@arcor.de
 L:      linux-geode@lists.infradead.org (moderated for non-subscribers)
 S:      Supported
 F:      drivers/usb/gadget/amd5536udc.*
@@ -624,6 +624,7 @@ M:	paulius.zaleckas@teltonika.lt
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
 T:      git git://gitorious.org/linux-gemini/mainline.git
 S:      Maintained
+F:      arch/arm/mach-gemini/
 ARM/EBSA110 MACHINE SUPPORT
 P:      Russell King
@@ -650,6 +651,7 @@ P:	Paulius Zaleckas
 M:      paulius.zaleckas@teltonika.lt
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
 S:      Maintained
+F:      arch/arm/mm/*-fa*
 ARM/FOOTBRIDGE ARCHITECTURE
 P:      Russell King
@@ -1132,17 +1134,17 @@ F:	fs/bfs/
 F:      include/linux/bfs_fs.h
 BLACKFIN ARCHITECTURE
-P:      Bryan Wu
+P:      Mike Frysinger
-M:      cooloney@kernel.org
+M:      vapier@gentoo.org
 L:      uclinux-dist-devel@blackfin.uclinux.org
 W:      http://blackfin.uclinux.org
 S:      Supported
 F:      arch/blackfin/
 BLACKFIN EMAC DRIVER
-P:      Bryan Wu
+P:      Michael Hennerich
-M:      cooloney@kernel.org
+M:      michael.hennerich@analog.com
-L:      uclinux-dist-devel@blackfin.uclinux.org (subscribers-only)
+L:      uclinux-dist-devel@blackfin.uclinux.org
 W:      http://blackfin.uclinux.org
 S:      Supported
 F:      drivers/net/bfin_mac.*
@@ -1150,7 +1152,7 @@ F:	drivers/net/bfin_mac.*
 BLACKFIN RTC DRIVER
 P:      Mike Frysinger
 M:      vapier.adi@gmail.com
-L:      uclinux-dist-devel@blackfin.uclinux.org (subscribers-only)
+L:      uclinux-dist-devel@blackfin.uclinux.org
 W:      http://blackfin.uclinux.org
 S:      Supported
 F:      drivers/rtc/rtc-bfin.c
@@ -1158,7 +1160,7 @@ F:	drivers/rtc/rtc-bfin.c
 BLACKFIN SERIAL DRIVER
 P:      Sonic Zhang
 M:      sonic.zhang@analog.com
-L:      uclinux-dist-devel@blackfin.uclinux.org (subscribers-only)
+L:      uclinux-dist-devel@blackfin.uclinux.org
 W:      http://blackfin.uclinux.org
 S:      Supported
 F:      drivers/serial/bfin_5xx.c
@@ -1166,7 +1168,7 @@ F:	drivers/serial/bfin_5xx.c
 BLACKFIN WATCHDOG DRIVER
 P:      Mike Frysinger
 M:      vapier.adi@gmail.com
-L:      uclinux-dist-devel@blackfin.uclinux.org (subscribers-only)
+L:      uclinux-dist-devel@blackfin.uclinux.org
 W:      http://blackfin.uclinux.org
 S:      Supported
 F:      drivers/watchdog/bfin_wdt.c
@@ -1174,7 +1176,7 @@ F:	drivers/watchdog/bfin_wdt.c
 BLACKFIN I2C TWI DRIVER
 P:      Sonic Zhang
 M:      sonic.zhang@analog.com
-L:      uclinux-dist-devel@blackfin.uclinux.org (subscribers-only)
+L:      uclinux-dist-devel@blackfin.uclinux.org
 W:      http://blackfin.uclinux.org/
 S:      Supported
 F:      drivers/i2c/busses/i2c-bfin-twi.c
@@ -1971,8 +1973,8 @@ F:	include/linux/edac.h
 EDAC-E752X
 P:      Mark Gross
-P:      Doug Thompson
 M:      mark.gross@intel.com
+P:      Doug Thompson
 M:      dougthompson@xmission.com
 L:      bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
 W:      bluesmoke.sourceforge.net
@@ -2249,7 +2251,7 @@ P:	Li Yang
 M:      leoli@freescale.com
 P:      Zhang Wei
 M:      zw@zh-kernel.org
-L:      linuxppc-embedded@ozlabs.org
+L:      linuxppc-dev@ozlabs.org
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 F:      drivers/dma/fsldma.*
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 6116e4893c0a..15f8a092b700 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -114,3 +114,16 @@
        .align  3;                              \
        .long   9999b,9001f;                    \
        .previous
+/*
+ * SMP data memory barrier
+ */
+        .macro  smp_dmb
+#ifdef CONFIG_SMP
+#if __LINUX_ARM_ARCH__ >= 7
+        dmb
+#elif __LINUX_ARM_ARCH__ == 6
+        mcr     p15, 0, r0, c7, c10, 5  @ dmb
+#endif
+#endif
+        .endm
diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
index ee99723b3a6c..16b52f397983 100644
--- a/arch/arm/include/asm/atomic.h
+++ b/arch/arm/include/asm/atomic.h
@@ -44,11 +44,29 @@ static inline void atomic_set(atomic_t *v, int i)
        : "cc");
 }
+static inline void atomic_add(int i, atomic_t *v)
+{
+        unsigned long tmp;
+        int result;
+        __asm__ __volatile__("@ atomic_add\n"
+"1:     ldrex   %0, [%2]\n"
+"       add     %0, %0, %3\n"
+"       strex   %1, %0, [%2]\n"
+"       teq     %1, #0\n"
+"       bne     1b"
+        : "=&r" (result), "=&r" (tmp)
+        : "r" (&v->counter), "Ir" (i)
+        : "cc");
+}
 static inline int atomic_add_return(int i, atomic_t *v)
 {
        unsigned long tmp;
        int result;
+        smp_mb();
        __asm__ __volatile__("@ atomic_add_return\n"
 "1:     ldrex   %0, [%2]\n"
 "       add     %0, %0, %3\n"
@@ -59,14 +77,34 @@ static inline int atomic_add_return(int i, atomic_t *v)
        : "r" (&v->counter), "Ir" (i)
        : "cc");
+        smp_mb();
        return result;
 }
+static inline void atomic_sub(int i, atomic_t *v)
+{
+        unsigned long tmp;
+        int result;
+        __asm__ __volatile__("@ atomic_sub\n"
+"1:     ldrex   %0, [%2]\n"
+"       sub     %0, %0, %3\n"
+"       strex   %1, %0, [%2]\n"
+"       teq     %1, #0\n"
+"       bne     1b"
+        : "=&r" (result), "=&r" (tmp)
+        : "r" (&v->counter), "Ir" (i)
+        : "cc");
+}
 static inline int atomic_sub_return(int i, atomic_t *v)
 {
        unsigned long tmp;
        int result;
+        smp_mb();
        __asm__ __volatile__("@ atomic_sub_return\n"
 "1:     ldrex   %0, [%2]\n"
 "       sub     %0, %0, %3\n"
@@ -77,6 +115,8 @@ static inline int atomic_sub_return(int i, atomic_t *v)
        : "r" (&v->counter), "Ir" (i)
        : "cc");
+        smp_mb();
        return result;
 }
@@ -84,6 +124,8 @@ static inline int atomic_cmpxchg(atomic_t *ptr, int old, int new)
 {
        unsigned long oldval, res;
+        smp_mb();
        do {
                __asm__ __volatile__("@ atomic_cmpxchg\n"
                "ldrex  %1, [%2]\n"
@@ -95,6 +137,8 @@ static inline int atomic_cmpxchg(atomic_t *ptr, int old, int new)
                    : "cc");
        } while (res);
+        smp_mb();
        return oldval;
 }
@@ -135,6 +179,7 @@ static inline int atomic_add_return(int i, atomic_t *v)
        return val;
 }
+#define atomic_add(i, v)        (void) atomic_add_return(i, v)
 static inline int atomic_sub_return(int i, atomic_t *v)
 {
@@ -148,6 +193,7 @@ static inline int atomic_sub_return(int i, atomic_t *v)
        return val;
 }
+#define atomic_sub(i, v)        (void) atomic_sub_return(i, v)
 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
 {
@@ -187,10 +233,8 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u)
 }
 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-#define atomic_add(i, v)        (void) atomic_add_return(i, v)
+#define atomic_inc(v)           atomic_add(1, v)
-#define atomic_inc(v)           (void) atomic_add_return(1, v)
+#define atomic_dec(v)           atomic_sub(1, v)
-#define atomic_sub(i, v)        (void) atomic_sub_return(i, v)
-#define atomic_dec(v)           (void) atomic_sub_return(1, v)
 #define atomic_inc_and_test(v)  (atomic_add_return(1, v) == 0)
 #define atomic_dec_and_test(v)  (atomic_sub_return(1, v) == 0)
@@ -200,11 +244,10 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u)
 #define atomic_add_negative(i,v) (atomic_add_return(i, v) < 0)
-/* Atomic operations are already serializing on ARM */
+#define smp_mb__before_atomic_dec()     smp_mb()
-#define smp_mb__before_atomic_dec()     barrier()
+#define smp_mb__after_atomic_dec()      smp_mb()
-#define smp_mb__after_atomic_dec()      barrier()
+#define smp_mb__before_atomic_inc()     smp_mb()
-#define smp_mb__before_atomic_inc()     barrier()
+#define smp_mb__after_atomic_inc()      smp_mb()
-#define smp_mb__after_atomic_inc()      barrier()
 #include <asm-generic/atomic.h>
 #endif
diff --git a/arch/arm/include/asm/flat.h b/arch/arm/include/asm/flat.h
index 1d77e51907f6..59426a4595c9 100644
--- a/arch/arm/include/asm/flat.h
+++ b/arch/arm/include/asm/flat.h
@@ -5,9 +5,6 @@
 #ifndef __ARM_FLAT_H__
 #define __ARM_FLAT_H__
-/* An odd number of words will be pushed after this alignment, so
-   deliberately misalign the value.  */
-#define flat_stack_align(sp)    sp = (void *)(((unsigned long)(sp) - 4) | 4)
 #define flat_argvp_envp_on_stack()              1
 #define flat_old_ram_flag(flags)                (flags)
 #define flat_reloc_valid(reloc, size)           ((reloc) <= (size))
diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
index bd4dc8ed53d5..d65b2f5bf41f 100644
--- a/arch/arm/include/asm/system.h
+++ b/arch/arm/include/asm/system.h
@@ -248,6 +248,8 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size
        unsigned int tmp;
 #endif
+        smp_mb();
        switch (size) {
 #if __LINUX_ARM_ARCH__ >= 6
        case 1:
@@ -307,6 +309,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size
                __bad_xchg(ptr, size), ret = 0;
                break;
        }
+        smp_mb();
        return ret;
 }
@@ -316,6 +319,12 @@ extern void enable_hlt(void);
 #include <asm-generic/cmpxchg-local.h>
+#if __LINUX_ARM_ARCH__ < 6
+#ifdef CONFIG_SMP
+#error "SMP is not supported on this platform"
+#endif
 /*
 * cmpxchg_local and cmpxchg64_local are atomic wrt current CPU. Always make
 * them available.
@@ -329,6 +338,173 @@ extern void enable_hlt(void);
 #include <asm-generic/cmpxchg.h>
 #endif
+#else   /* __LINUX_ARM_ARCH__ >= 6 */
+extern void __bad_cmpxchg(volatile void *ptr, int size);
+/*
+ * cmpxchg only support 32-bits operands on ARMv6.
+ */
+static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old,
+                                      unsigned long new, int size)
+{
+        unsigned long oldval, res;
+        switch (size) {
+#ifdef CONFIG_CPU_32v6K
+        case 1:
+                do {
+                        asm volatile("@ __cmpxchg1\n"
+                        "       ldrexb  %1, [%2]\n"
+                        "       mov     %0, #0\n"
+                        "       teq     %1, %3\n"
+                        "       strexbeq %0, %4, [%2]\n"
+                                : "=&r" (res), "=&r" (oldval)
+                                : "r" (ptr), "Ir" (old), "r" (new)
+                                : "memory", "cc");
+                } while (res);
+                break;
+        case 2:
+                do {
+                        asm volatile("@ __cmpxchg1\n"
+                        "       ldrexh  %1, [%2]\n"
+                        "       mov     %0, #0\n"
+                        "       teq     %1, %3\n"
+                        "       strexheq %0, %4, [%2]\n"
+                                : "=&r" (res), "=&r" (oldval)
+                                : "r" (ptr), "Ir" (old), "r" (new)
+                                : "memory", "cc");
+                } while (res);
+                break;
+#endif /* CONFIG_CPU_32v6K */
+        case 4:
+                do {
+                        asm volatile("@ __cmpxchg4\n"
+                        "       ldrex   %1, [%2]\n"
+                        "       mov     %0, #0\n"
+                        "       teq     %1, %3\n"
+                        "       strexeq %0, %4, [%2]\n"
+                                : "=&r" (res), "=&r" (oldval)
+                                : "r" (ptr), "Ir" (old), "r" (new)
+                                : "memory", "cc");
+                } while (res);
+                break;
+        default:
+                __bad_cmpxchg(ptr, size);
+                oldval = 0;
+        }
+        return oldval;
+}
+static inline unsigned long __cmpxchg_mb(volatile void *ptr, unsigned long old,
+                                         unsigned long new, int size)
+{
+        unsigned long ret;
+        smp_mb();
+        ret = __cmpxchg(ptr, old, new, size);
+        smp_mb();
+        return ret;
+}
+#define cmpxchg(ptr,o,n)                                                \
+        ((__typeof__(*(ptr)))__cmpxchg_mb((ptr),                        \
+                                          (unsigned long)(o),           \
+                                          (unsigned long)(n),           \
+                                          sizeof(*(ptr))))
+static inline unsigned long __cmpxchg_local(volatile void *ptr,
+                                            unsigned long old,
+                                            unsigned long new, int size)
+{
+        unsigned long ret;
+        switch (size) {
+#ifndef CONFIG_CPU_32v6K
+        case 1:
+        case 2:
+                ret = __cmpxchg_local_generic(ptr, old, new, size);
+                break;
+#endif  /* !CONFIG_CPU_32v6K */
+        default:
+                ret = __cmpxchg(ptr, old, new, size);
+        }
+        return ret;
+}
+#define cmpxchg_local(ptr,o,n)                                          \
+        ((__typeof__(*(ptr)))__cmpxchg_local((ptr),                     \
+                                       (unsigned long)(o),              \
+                                       (unsigned long)(n),              \
+                                       sizeof(*(ptr))))
+#ifdef CONFIG_CPU_32v6K
+/*
+ * Note : ARMv7-M (currently unsupported by Linux) does not support
+ * ldrexd/strexd. If ARMv7-M is ever supported by the Linux kernel, it should
+ * not be allowed to use __cmpxchg64.
+ */
+static inline unsigned long long __cmpxchg64(volatile void *ptr,
+                                             unsigned long long old,
+                                             unsigned long long new)
+{
+        register unsigned long long oldval asm("r0");
+        register unsigned long long __old asm("r2") = old;
+        register unsigned long long __new asm("r4") = new;
+        unsigned long res;
+        do {
+                asm volatile(
+                "       @ __cmpxchg8\n"
+                "       ldrexd  %1, %H1, [%2]\n"
+                "       mov     %0, #0\n"
+                "       teq     %1, %3\n"
+                "       teqeq   %H1, %H3\n"
+                "       strexdeq %0, %4, %H4, [%2]\n"
+                        : "=&r" (res), "=&r" (oldval)
+                        : "r" (ptr), "Ir" (__old), "r" (__new)
+                        : "memory", "cc");
+        } while (res);
+        return oldval;
+}
+static inline unsigned long long __cmpxchg64_mb(volatile void *ptr,
+                                                unsigned long long old,
+                                                unsigned long long new)
+{
+        unsigned long long ret;
+        smp_mb();
+        ret = __cmpxchg64(ptr, old, new);
+        smp_mb();
+        return ret;
+}
+#define cmpxchg64(ptr,o,n)                                              \
+        ((__typeof__(*(ptr)))__cmpxchg64_mb((ptr),                      \
+                                            (unsigned long long)(o),    \
+                                            (unsigned long long)(n)))
+#define cmpxchg64_local(ptr,o,n)                                        \
+        ((__typeof__(*(ptr)))__cmpxchg64((ptr),                         \
+                                         (unsigned long long)(o),       \
+                                         (unsigned long long)(n)))
+#else   /* !CONFIG_CPU_32v6K */
+#define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
+#endif  /* CONFIG_CPU_32v6K */
+#endif  /* __LINUX_ARM_ARCH__ >= 6 */
 #endif /* __ASSEMBLY__ */
 #define arch_align_stack(x) (x)
diff --git a/arch/arm/kernel/elf.c b/arch/arm/kernel/elf.c
index d4a0da1e48f4..950391f194c4 100644
--- a/arch/arm/kernel/elf.c
+++ b/arch/arm/kernel/elf.c
@@ -78,6 +78,15 @@ int arm_elf_read_implies_exec(const struct elf32_hdr *x, int executable_stack)
                return 1;
        if (cpu_architecture() < CPU_ARCH_ARMv6)
                return 1;
+#if !defined(CONFIG_AEABI) || defined(CONFIG_OABI_COMPAT)
+        /*
+         * If we have support for OABI programs, we can never allow NX
+         * support - our signal syscall restart mechanism relies upon
+         * being able to execute code placed on the user stack.
+         */
+        return 1;
+#else
        return 0;
+#endif
 }
 EXPORT_SYMBOL(arm_elf_read_implies_exec);
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index d662a2f1fd85..83b1da6b7baa 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -815,10 +815,7 @@ __kuser_helper_start:
 */
 __kuser_memory_barrier:                         @ 0xffff0fa0
+        smp_dmb
-#if __LINUX_ARM_ARCH__ >= 6 && defined(CONFIG_SMP)
-        mcr     p15, 0, r0, c7, c10, 5  @ dmb
-#endif
        usr_ret lr
        .align  5
diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h
index 2e787d40d599..c7f2627385e7 100644
--- a/arch/arm/lib/bitops.h
+++ b/arch/arm/lib/bitops.h
@@ -18,12 +18,14 @@
        mov     r2, #1
        add     r1, r1, r0, lsr #3      @ Get byte offset
        mov     r3, r2, lsl r3          @ create mask
+        smp_dmb
 1:      ldrexb  r2, [r1]
        ands    r0, r2, r3              @ save old value of bit
        \instr  r2, r2, r3                      @ toggle bit
        strexb  ip, r2, [r1]
        cmp     ip, #0
        bne     1b
+        smp_dmb
        cmp     r0, #0
        movne   r0, #1
 2:      mov     pc, lr
diff --git a/arch/arm/mach-gemini/include/mach/hardware.h b/arch/arm/mach-gemini/include/mach/hardware.h
index de6752674c05..213a4fcfeb1c 100644
--- a/arch/arm/mach-gemini/include/mach/hardware.h
+++ b/arch/arm/mach-gemini/include/mach/hardware.h
@@ -15,10 +15,9 @@
 /*
 * Memory Map definitions
 */
-/* FIXME: Does it really swap SRAM like this? */
 #ifdef CONFIG_GEMINI_MEM_SWAP
 # define GEMINI_DRAM_BASE       0x00000000
-# define GEMINI_SRAM_BASE       0x20000000
+# define GEMINI_SRAM_BASE       0x70000000
 #else
 # define GEMINI_SRAM_BASE       0x00000000
 # define GEMINI_DRAM_BASE       0x10000000
diff --git a/arch/arm/mach-kirkwood/common.c b/arch/arm/mach-kirkwood/common.c
index eeb00240d784..be1ca28fed3f 100644
--- a/arch/arm/mach-kirkwood/common.c
+++ b/arch/arm/mach-kirkwood/common.c
@@ -144,6 +144,9 @@ static struct platform_device kirkwood_ge00 = {
        .id             = 0,
        .num_resources  = 1,
        .resource       = kirkwood_ge00_resources,
+        .dev            = {
+                .coherent_dma_mask      = 0xffffffff,
+        },
 };
 void __init kirkwood_ge00_init(struct mv643xx_eth_platform_data *eth_data)
@@ -202,6 +205,9 @@ static struct platform_device kirkwood_ge01 = {
        .id             = 1,
        .num_resources  = 1,
        .resource       = kirkwood_ge01_resources,
+        .dev            = {
+                .coherent_dma_mask      = 0xffffffff,
+        },
 };
 void __init kirkwood_ge01_init(struct mv643xx_eth_platform_data *eth_data)
@@ -386,12 +392,10 @@ static struct mv64xxx_i2c_pdata kirkwood_i2c_pdata = {
 static struct resource kirkwood_i2c_resources[] = {
        {
-                .name   = "i2c",
                .start  = I2C_PHYS_BASE,
                .end    = I2C_PHYS_BASE + 0x1f,
                .flags  = IORESOURCE_MEM,
        }, {
-                .name   = "i2c",
                .start  = IRQ_KIRKWOOD_TWSI,
                .end    = IRQ_KIRKWOOD_TWSI,
                .flags  = IORESOURCE_IRQ,
diff --git a/arch/arm/mach-kirkwood/ts219-setup.c b/arch/arm/mach-kirkwood/ts219-setup.c
index dda5743cf3e0..01aa213c0a6f 100644
--- a/arch/arm/mach-kirkwood/ts219-setup.c
+++ b/arch/arm/mach-kirkwood/ts219-setup.c
@@ -142,6 +142,8 @@ static unsigned int qnap_ts219_mpp_config[] __initdata = {
        MPP1_SPI_MOSI,
        MPP2_SPI_SCK,
        MPP3_SPI_MISO,
+        MPP4_SATA1_ACTn,
+        MPP5_SATA0_ACTn,
        MPP8_TW_SDA,
        MPP9_TW_SCK,
        MPP10_UART0_TXD,
@@ -150,10 +152,6 @@ static unsigned int qnap_ts219_mpp_config[] __initdata = {
        MPP14_UART1_RXD,        /* PIC controller */
        MPP15_GPIO,             /* USB Copy button */
        MPP16_GPIO,             /* Reset button */
-        MPP20_SATA1_ACTn,
-        MPP21_SATA0_ACTn,
-        MPP22_SATA1_PRESENTn,
-        MPP23_SATA0_PRESENTn,
        0
 };
diff --git a/arch/arm/mach-loki/common.c b/arch/arm/mach-loki/common.c
index c0d2d9d12e74..818f19d7ab1f 100644
--- a/arch/arm/mach-loki/common.c
+++ b/arch/arm/mach-loki/common.c
@@ -82,6 +82,9 @@ static struct platform_device loki_ge0 = {
        .id             = 0,
        .num_resources  = 1,
        .resource       = loki_ge0_resources,
+        .dev            = {
+                .coherent_dma_mask      = 0xffffffff,
+        },
 };
 void __init loki_ge0_init(struct mv643xx_eth_platform_data *eth_data)
@@ -136,6 +139,9 @@ static struct platform_device loki_ge1 = {
        .id             = 1,
        .num_resources  = 1,
        .resource       = loki_ge1_resources,
+        .dev            = {
+                .coherent_dma_mask      = 0xffffffff,
+        },
 };
 void __init loki_ge1_init(struct mv643xx_eth_platform_data *eth_data)
diff --git a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
index d0bdb6e3682b..2e914649b9e4 100644
--- a/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
+++ b/arch/arm/mach-mmp/include/mach/mfp-pxa168.h
@@ -3,6 +3,11 @@
 #include <mach/mfp.h>
+#define MFP_DRIVE_VERY_SLOW     (0x0 << 13)
+#define MFP_DRIVE_SLOW          (0x1 << 13)
+#define MFP_DRIVE_MEDIUM        (0x2 << 13)
+#define MFP_DRIVE_FAST          (0x3 << 13)
 /* GPIO */
 #define GPIO0_GPIO              MFP_CFG(GPIO0, AF5)
 #define GPIO1_GPIO              MFP_CFG(GPIO1, AF5)
diff --git a/arch/arm/mach-mmp/include/mach/mfp-pxa910.h b/arch/arm/mach-mmp/include/mach/mfp-pxa910.h
index 48a1cbc7c56b..d97de36c50ad 100644
--- a/arch/arm/mach-mmp/include/mach/mfp-pxa910.h
+++ b/arch/arm/mach-mmp/include/mach/mfp-pxa910.h
@@ -3,6 +3,11 @@
 #include <mach/mfp.h>
+#define MFP_DRIVE_VERY_SLOW     (0x0 << 13)
+#define MFP_DRIVE_SLOW          (0x2 << 13)
+#define MFP_DRIVE_MEDIUM        (0x4 << 13)
+#define MFP_DRIVE_FAST          (0x8 << 13)
 /* UART2 */
 #define GPIO47_UART2_RXD        MFP_CFG(GPIO47, AF6)
 #define GPIO48_UART2_TXD        MFP_CFG(GPIO48, AF6)
diff --git a/arch/arm/mach-mmp/include/mach/mfp.h b/arch/arm/mach-mmp/include/mach/mfp.h
index 277ea4cd0f9f..62e510e80a58 100644
--- a/arch/arm/mach-mmp/include/mach/mfp.h
+++ b/arch/arm/mach-mmp/include/mach/mfp.h
@@ -12,16 +12,13 @@
 * possible, we make the following compromise:
 *
 * 1. SLEEP_OE_N will always be programmed to '1' (by MFP_LPM_FLOAT)
- * 2. DRIVE strength definitions redefined to include the reserved bit10
+ * 2. DRIVE strength definitions redefined to include the reserved bit
+ *    - the reserved bit differs between pxa168 and pxa910, and the
+ *      MFP_DRIVE_* macros are individually defined in mfp-pxa{168,910}.h
 * 3. Override MFP_CFG() and MFP_CFG_DRV()
 * 4. Drop the use of MFP_CFG_LPM() and MFP_CFG_X()
 */
-#define MFP_DRIVE_VERY_SLOW     (0x0 << 13)
-#define MFP_DRIVE_SLOW          (0x2 << 13)
-#define MFP_DRIVE_MEDIUM        (0x4 << 13)
-#define MFP_DRIVE_FAST          (0x8 << 13)
 #undef MFP_CFG
 #undef MFP_CFG_DRV
 #undef MFP_CFG_LPM
diff --git a/arch/arm/mach-mmp/time.c b/arch/arm/mach-mmp/time.c
index b03a6eda7419..a8400bb891e7 100644
--- a/arch/arm/mach-mmp/time.c
+++ b/arch/arm/mach-mmp/time.c
@@ -136,7 +136,7 @@ static struct clock_event_device ckevt = {
        .set_mode       = timer_set_mode,
 };
-static cycle_t clksrc_read(void)
+static cycle_t clksrc_read(struct clocksource *cs)
 {
        return timer_read();
 }
diff --git a/arch/arm/mach-mv78xx0/common.c b/arch/arm/mach-mv78xx0/common.c
index 9ba595083dab..1b22e4af8791 100644
--- a/arch/arm/mach-mv78xx0/common.c
+++ b/arch/arm/mach-mv78xx0/common.c
@@ -321,6 +321,9 @@ static struct platform_device mv78xx0_ge00 = {
        .id             = 0,
        .num_resources  = 1,
        .resource       = mv78xx0_ge00_resources,
+        .dev            = {
+                .coherent_dma_mask      = 0xffffffff,
+        },
 };
 void __init mv78xx0_ge00_init(struct mv643xx_eth_platform_data *eth_data)
@@ -375,6 +378,9 @@ static struct platform_device mv78xx0_ge01 = {
        .id             = 1,
        .num_resources  = 1,
        .resource       = mv78xx0_ge01_resources,
+        .dev            = {
+                .coherent_dma_mask      = 0xffffffff,
+        },
 };
 void __init mv78xx0_ge01_init(struct mv643xx_eth_platform_data *eth_data)
@@ -429,6 +435,9 @@ static struct platform_device mv78xx0_ge10 = {
        .id             = 2,
        .num_resources  = 1,
        .resource       = mv78xx0_ge10_resources,
+        .dev            = {
+                .coherent_dma_mask      = 0xffffffff,
+        },
 };
 void __init mv78xx0_ge10_init(struct mv643xx_eth_platform_data *eth_data)
@@ -496,6 +505,9 @@ static struct platform_device mv78xx0_ge11 = {
        .id             = 3,
        .num_resources  = 1,
        .resource       = mv78xx0_ge11_resources,
+        .dev            = {
+                .coherent_dma_mask      = 0xffffffff,
+        },
 };
 void __init mv78xx0_ge11_init(struct mv643xx_eth_platform_data *eth_data)
@@ -532,12 +544,10 @@ static struct mv64xxx_i2c_pdata mv78xx0_i2c_0_pdata = {
 static struct resource mv78xx0_i2c_0_resources[] = {
        {
-                .name   = "i2c 0 base",
                .start  = I2C_0_PHYS_BASE,
                .end    = I2C_0_PHYS_BASE + 0x1f,
                .flags  = IORESOURCE_MEM,
        }, {
-                .name   = "i2c 0 irq",
                .start  = IRQ_MV78XX0_I2C_0,
                .end    = IRQ_MV78XX0_I2C_0,
                .flags  = IORESOURCE_IRQ,
@@ -567,12 +577,10 @@ static struct mv64xxx_i2c_pdata mv78xx0_i2c_1_pdata = {
 static struct resource mv78xx0_i2c_1_resources[] = {
        {
-                .name   = "i2c 1 base",
                .start  = I2C_1_PHYS_BASE,
                .end    = I2C_1_PHYS_BASE + 0x1f,
                .flags  = IORESOURCE_MEM,
        }, {
-                .name   = "i2c 1 irq",
                .start  = IRQ_MV78XX0_I2C_1,
                .end    = IRQ_MV78XX0_I2C_1,
                .flags  = IORESOURCE_IRQ,
diff --git a/arch/arm/mach-orion5x/common.c b/arch/arm/mach-orion5x/common.c
index 6af99ddabdfb..b1c7778d9f96 100644
--- a/arch/arm/mach-orion5x/common.c
+++ b/arch/arm/mach-orion5x/common.c
@@ -188,6 +188,9 @@ static struct platform_device orion5x_eth = {
        .id             = 0,
        .num_resources  = 1,
        .resource       = orion5x_eth_resources,
+        .dev            = {
+                .coherent_dma_mask      = 0xffffffff,
+        },
 };
 void __init orion5x_eth_init(struct mv643xx_eth_platform_data *eth_data)
@@ -248,12 +251,10 @@ static struct mv64xxx_i2c_pdata orion5x_i2c_pdata = {
 static struct resource orion5x_i2c_resources[] = {
        {
-                .name   = "i2c base",
                .start  = I2C_PHYS_BASE,
                .end    = I2C_PHYS_BASE + 0x1f,
                .flags  = IORESOURCE_MEM,
        }, {
-                .name   = "i2c irq",
                .start  = IRQ_ORION5X_I2C,
                .end    = IRQ_ORION5X_I2C,
                .flags  = IORESOURCE_IRQ,
diff --git a/arch/arm/mach-pxa/ezx.c b/arch/arm/mach-pxa/ezx.c
index 92ba16e1b6fc..7db966dc29ce 100644
--- a/arch/arm/mach-pxa/ezx.c
+++ b/arch/arm/mach-pxa/ezx.c
@@ -111,9 +111,9 @@ static unsigned long ezx_pin_config[] __initdata = {
        GPIO25_SSP1_TXD,
        GPIO26_SSP1_RXD,
        GPIO24_GPIO,                            /* pcap chip select */
-        GPIO1_GPIO,                             /* pcap interrupt */
+        GPIO1_GPIO | WAKEUP_ON_EDGE_RISE,       /* pcap interrupt */
-        GPIO4_GPIO,                             /* WDI_AP */
+        GPIO4_GPIO | MFP_LPM_DRIVE_HIGH,        /* WDI_AP */
-        GPIO55_GPIO,                            /* SYS_RESTART */
+        GPIO55_GPIO | MFP_LPM_DRIVE_HIGH,       /* SYS_RESTART */
        /* MMC */
        GPIO32_MMC_CLK,
@@ -144,20 +144,20 @@ static unsigned long ezx_pin_config[] __initdata = {
 #if defined(CONFIG_MACH_EZX_A780) || defined(CONFIG_MACH_EZX_E680)
 static unsigned long gen1_pin_config[] __initdata = {
        /* flip / lockswitch */
-        GPIO12_GPIO,
+        GPIO12_GPIO | WAKEUP_ON_EDGE_BOTH,
        /* bluetooth (bcm2035) */
-        GPIO14_GPIO | WAKEUP_ON_LEVEL_HIGH,     /* HOSTWAKE */
+        GPIO14_GPIO | WAKEUP_ON_EDGE_RISE,      /* HOSTWAKE */
        GPIO48_GPIO,                            /* RESET */
        GPIO28_GPIO,                            /* WAKEUP */
        /* Neptune handshake */
-        GPIO0_GPIO | WAKEUP_ON_LEVEL_HIGH,      /* BP_RDY */
+        GPIO0_GPIO | WAKEUP_ON_EDGE_FALL,       /* BP_RDY */
-        GPIO57_GPIO,                            /* AP_RDY */
+        GPIO57_GPIO | MFP_LPM_DRIVE_HIGH,       /* AP_RDY */
-        GPIO13_GPIO | WAKEUP_ON_LEVEL_HIGH,     /* WDI */
+        GPIO13_GPIO | WAKEUP_ON_EDGE_BOTH,      /* WDI */
-        GPIO3_GPIO | WAKEUP_ON_LEVEL_HIGH,      /* WDI2 */
+        GPIO3_GPIO | WAKEUP_ON_EDGE_BOTH,       /* WDI2 */
-        GPIO82_GPIO,                            /* RESET */
+        GPIO82_GPIO | MFP_LPM_DRIVE_HIGH,       /* RESET */
-        GPIO99_GPIO,                            /* TC_MM_EN */
+        GPIO99_GPIO | MFP_LPM_DRIVE_HIGH,       /* TC_MM_EN */
        /* sound */
        GPIO52_SSP3_SCLK,
@@ -199,21 +199,21 @@ static unsigned long gen1_pin_config[] __initdata = {
        defined(CONFIG_MACH_EZX_E2) || defined(CONFIG_MACH_EZX_E6)
 static unsigned long gen2_pin_config[] __initdata = {
        /* flip / lockswitch */
-        GPIO15_GPIO,
+        GPIO15_GPIO | WAKEUP_ON_EDGE_BOTH,
        /* EOC */
-        GPIO10_GPIO,
+        GPIO10_GPIO | WAKEUP_ON_EDGE_RISE,
        /* bluetooth (bcm2045) */
-        GPIO13_GPIO | WAKEUP_ON_LEVEL_HIGH,     /* HOSTWAKE */
+        GPIO13_GPIO | WAKEUP_ON_EDGE_RISE,      /* HOSTWAKE */
        GPIO37_GPIO,                            /* RESET */
        GPIO57_GPIO,                            /* WAKEUP */
        /* Neptune handshake */
-        GPIO0_GPIO | WAKEUP_ON_LEVEL_HIGH,      /* BP_RDY */
+        GPIO0_GPIO | WAKEUP_ON_EDGE_FALL,       /* BP_RDY */
-        GPIO96_GPIO,                            /* AP_RDY */
+        GPIO96_GPIO | MFP_LPM_DRIVE_HIGH,       /* AP_RDY */
-        GPIO3_GPIO | WAKEUP_ON_LEVEL_HIGH,      /* WDI */
+        GPIO3_GPIO | WAKEUP_ON_EDGE_FALL,       /* WDI */
-        GPIO116_GPIO,                           /* RESET */
+        GPIO116_GPIO | MFP_LPM_DRIVE_HIGH,      /* RESET */
        GPIO41_GPIO,                            /* BP_FLASH */
        /* sound */
diff --git a/arch/arm/mach-pxa/include/mach/reset.h b/arch/arm/mach-pxa/include/mach/reset.h
index 31e6a7b6ad80..b6c10556fbc7 100644
--- a/arch/arm/mach-pxa/include/mach/reset.h
+++ b/arch/arm/mach-pxa/include/mach/reset.h
@@ -13,8 +13,9 @@ extern void clear_reset_status(unsigned int mask);
 /**
 * init_gpio_reset() - register GPIO as reset generator
 * @gpio: gpio nr
- * @output: set gpio as out/low instead of input during normal work
+ * @output: set gpio as output instead of input during normal work
+ * @level: output level
 */
-extern int init_gpio_reset(int gpio, int output);
+extern int init_gpio_reset(int gpio, int output, int level);
 #endif /* __ASM_ARCH_RESET_H */
diff --git a/arch/arm/mach-pxa/mfp-pxa2xx.c b/arch/arm/mach-pxa/mfp-pxa2xx.c
index 7ffb91d64c39..cf6b720c055f 100644
--- a/arch/arm/mach-pxa/mfp-pxa2xx.c
+++ b/arch/arm/mach-pxa/mfp-pxa2xx.c
@@ -322,6 +322,7 @@ static inline void pxa27x_mfp_init(void) {}
 #ifdef CONFIG_PM
 static unsigned long saved_gafr[2][4];
 static unsigned long saved_gpdr[4];
+static unsigned long saved_pgsr[4];
 static int pxa2xx_mfp_suspend(struct sys_device *d, pm_message_t state)
 {
@@ -332,6 +333,7 @@ static int pxa2xx_mfp_suspend(struct sys_device *d, pm_message_t state)
                saved_gafr[0][i] = GAFR_L(i);
                saved_gafr[1][i] = GAFR_U(i);
                saved_gpdr[i] = GPDR(i * 32);
+                saved_pgsr[i] = PGSR(i);
                GPDR(i * 32) = gpdr_lpm[i];
        }
@@ -346,6 +348,7 @@ static int pxa2xx_mfp_resume(struct sys_device *d)
                GAFR_L(i) = saved_gafr[0][i];
                GAFR_U(i) = saved_gafr[1][i];
                GPDR(i * 32) = saved_gpdr[i];
+                PGSR(i) = saved_pgsr[i];
        }
        PSSR = PSSR_RDH | PSSR_PH;
        return 0;
@@ -374,6 +377,9 @@ static int __init pxa2xx_mfp_init(void)
        if (cpu_is_pxa27x())
                pxa27x_mfp_init();
+        /* clear RDH bit to enable GPIO receivers after reset/sleep exit */
+        PSSR = PSSR_RDH;
        /* initialize gafr_run[], pgsr_lpm[] from existing values */
        for (i = 0; i <= gpio_to_bank(pxa_last_gpio); i++)
                gpdr_lpm[i] = GPDR(i * 32);
diff --git a/arch/arm/mach-pxa/palmld.c b/arch/arm/mach-pxa/palmld.c
index 1cec1806f002..471a853e548b 100644
--- a/arch/arm/mach-pxa/palmld.c
+++ b/arch/arm/mach-pxa/palmld.c
@@ -62,6 +62,8 @@ static unsigned long palmld_pin_config[] __initdata = {
        GPIO29_AC97_SDATA_IN_0,
        GPIO30_AC97_SDATA_OUT,
        GPIO31_AC97_SYNC,
+        GPIO89_AC97_SYSCLK,
+        GPIO95_AC97_nRESET,
        /* IrDA */
        GPIO108_GPIO,   /* ir disable */
diff --git a/arch/arm/mach-pxa/palmt5.c b/arch/arm/mach-pxa/palmt5.c
index 30662363907b..05bf979b78a6 100644
--- a/arch/arm/mach-pxa/palmt5.c
+++ b/arch/arm/mach-pxa/palmt5.c
@@ -64,6 +64,7 @@ static unsigned long palmt5_pin_config[] __initdata = {
        GPIO29_AC97_SDATA_IN_0,
        GPIO30_AC97_SDATA_OUT,
        GPIO31_AC97_SYNC,
+        GPIO89_AC97_SYSCLK,
        GPIO95_AC97_nRESET,
        /* IrDA */
diff --git a/arch/arm/mach-pxa/palmtx.c b/arch/arm/mach-pxa/palmtx.c
index e2d44b1a8a9b..e99a893c58a7 100644
--- a/arch/arm/mach-pxa/palmtx.c
+++ b/arch/arm/mach-pxa/palmtx.c
@@ -65,6 +65,7 @@ static unsigned long palmtx_pin_config[] __initdata = {
        GPIO29_AC97_SDATA_IN_0,
        GPIO30_AC97_SDATA_OUT,
        GPIO31_AC97_SYNC,
+        GPIO89_AC97_SYSCLK,
        GPIO95_AC97_nRESET,
        /* IrDA */
diff --git a/arch/arm/mach-pxa/reset.c b/arch/arm/mach-pxa/reset.c
index df29d45fb4e7..01e9d643394a 100644
--- a/arch/arm/mach-pxa/reset.c
+++ b/arch/arm/mach-pxa/reset.c
@@ -20,7 +20,7 @@ static void do_hw_reset(void);
 static int reset_gpio = -1;
-int init_gpio_reset(int gpio, int output)
+int init_gpio_reset(int gpio, int output, int level)
 {
        int rc;
@@ -31,7 +31,7 @@ int init_gpio_reset(int gpio, int output)
        }
        if (output)
-                rc = gpio_direction_output(gpio, 0);
+                rc = gpio_direction_output(gpio, level);
        else
                rc = gpio_direction_input(gpio);
        if (rc) {
diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
index c18e34acafcb..5a45fe340a10 100644
--- a/arch/arm/mach-pxa/spitz.c
+++ b/arch/arm/mach-pxa/spitz.c
@@ -531,9 +531,15 @@ static int spitz_ohci_init(struct device *dev)
        return gpio_direction_output(SPITZ_GPIO_USB_HOST, 1);
 }
+static void spitz_ohci_exit(struct device *dev)
+{
+        gpio_free(SPITZ_GPIO_USB_HOST);
+}
 static struct pxaohci_platform_data spitz_ohci_platform_data = {
        .port_mode      = PMM_NPS_MODE,
        .init           = spitz_ohci_init,
+        .exit           = spitz_ohci_exit,
        .flags          = ENABLE_PORT_ALL | NO_OC_PROTECTION,
        .power_budget   = 150,
 };
@@ -731,7 +737,7 @@ static void spitz_restart(char mode, const char *cmd)
 static void __init common_init(void)
 {
-        init_gpio_reset(SPITZ_GPIO_ON_RESET, 1);
+        init_gpio_reset(SPITZ_GPIO_ON_RESET, 1, 0);
        pm_power_off = spitz_poweroff;
        arm_pm_restart = spitz_restart;
diff --git a/arch/arm/mach-pxa/tosa.c b/arch/arm/mach-pxa/tosa.c
index afac5b6d3d78..a0bd46ef5d30 100644
--- a/arch/arm/mach-pxa/tosa.c
+++ b/arch/arm/mach-pxa/tosa.c
@@ -897,7 +897,7 @@ static void __init tosa_init(void)
        gpio_set_wake(MFP_PIN_GPIO1, 1);
        /* We can't pass to gpio-keys since it will drop the Reset altfunc */
-        init_gpio_reset(TOSA_GPIO_ON_RESET, 0);
+        init_gpio_reset(TOSA_GPIO_ON_RESET, 0, 0);
        pm_power_off = tosa_poweroff;
        arm_pm_restart = tosa_restart;
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 945e0d237a1d..fec64678a63a 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Mon Mar 23 20:09:01 2009
+# Last update: Fri May 29 10:14:20 2009
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -916,7 +916,7 @@ nxdb500			MACH_NXDB500		NXDB500			905
 apf9328                 MACH_APF9328            APF9328                 906
 omap_wipoq              MACH_OMAP_WIPOQ         OMAP_WIPOQ              907
 omap_twip               MACH_OMAP_TWIP          OMAP_TWIP               908
-palmt650                MACH_PALMT650           PALMT650                909
+treo650                 MACH_TREO650            TREO650                 909
 acumen                  MACH_ACUMEN             ACUMEN                  910
 xp100                   MACH_XP100              XP100                   911
 fs2410                  MACH_FS2410             FS2410                  912
@@ -1232,7 +1232,7 @@ ql202b			MACH_QL202B		QL202B			1226
 vpac270                 MACH_VPAC270            VPAC270                 1227
 rd129                   MACH_RD129              RD129                   1228
 htcwizard               MACH_HTCWIZARD          HTCWIZARD               1229
-xscale_treo680          MACH_XSCALE_TREO680     XSCALE_TREO680          1230
+treo680                 MACH_TREO680            TREO680                 1230
 tecon_tmezon            MACH_TECON_TMEZON       TECON_TMEZON            1231
 zylonite                MACH_ZYLONITE           ZYLONITE                1233
 gene1270                MACH_GENE1270           GENE1270                1234
@@ -1418,10 +1418,10 @@ looxc550		MACH_LOOXC550		LOOXC550		1417
 cnty_titan              MACH_CNTY_TITAN         CNTY_TITAN              1418
 app3xx                  MACH_APP3XX             APP3XX                  1419
 sideoatsgrama           MACH_SIDEOATSGRAMA      SIDEOATSGRAMA           1420
-palmtreo700p            MACH_PALMTREO700P       PALMTREO700P            1421
+treo700p                MACH_TREO700P           TREO700P                1421
-palmtreo700w            MACH_PALMTREO700W       PALMTREO700W            1422
+treo700w                MACH_TREO700W           TREO700W                1422
-palmtreo750             MACH_PALMTREO750        PALMTREO750             1423
+treo750                 MACH_TREO750            TREO750                 1423
-palmtreo755p            MACH_PALMTREO755P       PALMTREO755P            1424
+treo755p                MACH_TREO755P           TREO755P                1424
 ezreganut9200           MACH_EZREGANUT9200      EZREGANUT9200           1425
 sarge                   MACH_SARGE              SARGE                   1426
 a696                    MACH_A696               A696                    1427
@@ -1721,7 +1721,7 @@ sapphire		MACH_SAPPHIRE		SAPPHIRE		1729
 csb637xo                MACH_CSB637XO           CSB637XO                1730
 evisiong                MACH_EVISIONG           EVISIONG                1731
 stmp37xx                MACH_STMP37XX           STMP37XX                1732
-stmp378x                MACH_STMP38XX           STMP38XX                1733
+stmp378x                MACH_STMP378X           STMP378X                1733
 tnt                     MACH_TNT                TNT                     1734
 tbxt                    MACH_TBXT               TBXT                    1735
 playmate                MACH_PLAYMATE           PLAYMATE                1736
@@ -1817,7 +1817,7 @@ smdkc100		MACH_SMDKC100		SMDKC100		1826
 tavorevb                MACH_TAVOREVB           TAVOREVB                1827
 saar                    MACH_SAAR               SAAR                    1828
 deister_eyecam          MACH_DEISTER_EYECAM     DEISTER_EYECAM          1829
-at91sam9m10ek           MACH_AT91SAM9M10EK      AT91SAM9M10EK           1830
+at91sam9m10g45ek        MACH_AT91SAM9M10G45EK   AT91SAM9M10G45EK        1830
 linkstation_produo      MACH_LINKSTATION_PRODUO LINKSTATION_PRODUO      1831
 hit_b0                  MACH_HIT_B0             HIT_B0                  1832
 adx_rmu                 MACH_ADX_RMU            ADX_RMU                 1833
@@ -2132,3 +2132,116 @@ apollo			MACH_APOLLO		APOLLO			2141
 at91cap9stk             MACH_AT91CAP9STK        AT91CAP9STK             2142
 spc300                  MACH_SPC300             SPC300                  2143
 eko                     MACH_EKO                EKO                     2144
+ccw9m2443               MACH_CCW9M2443          CCW9M2443               2145
+ccw9m2443js             MACH_CCW9M2443JS        CCW9M2443JS             2146
+m2m_router_device       MACH_M2M_ROUTER_DEVICE  M2M_ROUTER_DEVICE       2147
+str9104nas              MACH_STAR9104NAS        STAR9104NAS             2148
+pca100                  MACH_PCA100             PCA100                  2149
+z3_dm365_mod_01         MACH_Z3_DM365_MOD_01    Z3_DM365_MOD_01         2150
+hipox                   MACH_HIPOX              HIPOX                   2151
+omap3_piteds            MACH_OMAP3_PITEDS       OMAP3_PITEDS            2152
+bm150r                  MACH_BM150R             BM150R                  2153
+tbone                   MACH_TBONE              TBONE                   2154
+merlin                  MACH_MERLIN             MERLIN                  2155
+falcon                  MACH_FALCON             FALCON                  2156
+davinci_da850_evm       MACH_DAVINCI_DA850_EVM  DAVINCI_DA850_EVM       2157
+s5p6440                 MACH_S5P6440            S5P6440                 2158
+at91sam9g10ek           MACH_AT91SAM9G10EK      AT91SAM9G10EK           2159
+omap_4430sdp            MACH_OMAP_4430SDP       OMAP_4430SDP            2160
+lpc313x                 MACH_LPC313X            LPC313X                 2161
+magx_zn5                MACH_MAGX_ZN5           MAGX_ZN5                2162
+magx_em30               MACH_MAGX_EM30          MAGX_EM30               2163
+magx_ve66               MACH_MAGX_VE66          MAGX_VE66               2164
+meesc                   MACH_MEESC              MEESC                   2165
+otc570                  MACH_OTC570             OTC570                  2166
+bcu2412                 MACH_BCU2412            BCU2412                 2167
+beacon                  MACH_BEACON             BEACON                  2168
+actia_tgw               MACH_ACTIA_TGW          ACTIA_TGW               2169
+e4430                   MACH_E4430              E4430                   2170
+ql300                   MACH_QL300              QL300                   2171
+btmavb101               MACH_BTMAVB101          BTMAVB101               2172
+btmawb101               MACH_BTMAWB101          BTMAWB101               2173
+sq201                   MACH_SQ201              SQ201                   2174
+quatro45xx              MACH_QUATRO45XX         QUATRO45XX              2175
+openpad                 MACH_OPENPAD            OPENPAD                 2176
+tx25                    MACH_TX25               TX25                    2177
+omap3_torpedo           MACH_OMAP3_TORPEDO      OMAP3_TORPEDO           2178
+htcraphael_k            MACH_HTCRAPHAEL_K       HTCRAPHAEL_K            2179
+lal43                   MACH_LAL43              LAL43                   2181
+htcraphael_cdma500      MACH_HTCRAPHAEL_CDMA500 HTCRAPHAEL_CDMA500      2182
+anw6410                 MACH_ANW6410            ANW6410                 2183
+htcprophet              MACH_HTCPROPHET         HTCPROPHET              2185
+cfa_10022               MACH_CFA_10022          CFA_10022               2186
+imx27_visstrim_m10      MACH_IMX27_VISSTRIM_M10 IMX27_VISSTRIM_M10      2187
+px2imx27                MACH_PX2IMX27           PX2IMX27                2188
+stm3210e_eval           MACH_STM3210E_EVAL      STM3210E_EVAL           2189
+dvs10                   MACH_DVS10              DVS10                   2190
+portuxg20               MACH_PORTUXG20          PORTUXG20               2191
+arm_spv                 MACH_ARM_SPV            ARM_SPV                 2192
+smdkc110                MACH_SMDKC110           SMDKC110                2193
+cabespresso             MACH_CABESPRESSO        CABESPRESSO             2194
+hmc800                  MACH_HMC800             HMC800                  2195
+sholes                  MACH_SHOLES             SHOLES                  2196
+btmxc31                 MACH_BTMXC31            BTMXC31                 2197
+dt501                   MACH_DT501              DT501                   2198
+ktx                     MACH_KTX                KTX                     2199
+omap3517evm             MACH_OMAP3517EVM        OMAP3517EVM             2200
+netspace_v2             MACH_NETSPACE_V2        NETSPACE_V2             2201
+netspace_max_v2         MACH_NETSPACE_MAX_V2    NETSPACE_MAX_V2         2202
+d2net_v2                MACH_D2NET_V2           D2NET_V2                2203
+net2big_v2              MACH_NET2BIG_V2         NET2BIG_V2              2204
+net4big_v2              MACH_NET4BIG_V2         NET4BIG_V2              2205
+net5big_v2              MACH_NET5BIG_V2         NET5BIG_V2              2206
+endb2443                MACH_ENDB2443           ENDB2443                2207
+inetspace_v2            MACH_INETSPACE_V2       INETSPACE_V2            2208
+tros                    MACH_TROS               TROS                    2209
+pelco_homer             MACH_PELCO_HOMER        PELCO_HOMER             2210
+ofsp8                   MACH_OFSP8              OFSP8                   2211
+at91sam9g45ekes         MACH_AT91SAM9G45EKES    AT91SAM9G45EKES         2212
+guf_cupid               MACH_GUF_CUPID          GUF_CUPID               2213
+eab1r                   MACH_EAB1R              EAB1R                   2214
+desirec                 MACH_DESIREC            DESIREC                 2215
+cordoba                 MACH_CORDOBA            CORDOBA                 2216
+irvine                  MACH_IRVINE             IRVINE                  2217
+sff772                  MACH_SFF772             SFF772                  2218
+pelco_milano            MACH_PELCO_MILANO       PELCO_MILANO            2219
+pc7302                  MACH_PC7302             PC7302                  2220
+bip6000                 MACH_BIP6000            BIP6000                 2221
+silvermoon              MACH_SILVERMOON         SILVERMOON              2222
+vc0830                  MACH_VC0830             VC0830                  2223
+dt430                   MACH_DT430              DT430                   2224
+ji42pf                  MACH_JI42PF             JI42PF                  2225
+gnet_ksm                MACH_GNET_KSM           GNET_KSM                2226
+gnet_sgm                MACH_GNET_SGM           GNET_SGM                2227
+gnet_sgr                MACH_GNET_SGR           GNET_SGR                2228
+omap3_icetekevm         MACH_OMAP3_ICETEKEVM    OMAP3_ICETEKEVM         2229
+pnp                     MACH_PNP                PNP                     2230
+ctera_2bay_k            MACH_CTERA_2BAY_K       CTERA_2BAY_K            2231
+ctera_2bay_u            MACH_CTERA_2BAY_U       CTERA_2BAY_U            2232
+sas_c                   MACH_SAS_C              SAS_C                   2233
+vma2315                 MACH_VMA2315            VMA2315                 2234
+vcs                     MACH_VCS                VCS                     2235
+spear600                MACH_SPEAR600           SPEAR600                2236
+spear300                MACH_SPEAR300           SPEAR300                2237
+spear1300               MACH_SPEAR1300          SPEAR1300               2238
+lilly1131               MACH_LILLY1131          LILLY1131               2239
+arvoo_ax301             MACH_ARVOO_AX301        ARVOO_AX301             2240
+mapphone                MACH_MAPPHONE           MAPPHONE                2241
+legend                  MACH_LEGEND             LEGEND                  2242
+salsa                   MACH_SALSA              SALSA                   2243
+lounge                  MACH_LOUNGE             LOUNGE                  2244
+vision                  MACH_VISION             VISION                  2245
+vmb20                   MACH_VMB20              VMB20                   2246
+hy2410                  MACH_HY2410             HY2410                  2247
+hy9315                  MACH_HY9315             HY9315                  2248
+bullwinkle              MACH_BULLWINKLE         BULLWINKLE              2249
+arm_ultimator2          MACH_ARM_ULTIMATOR2     ARM_ULTIMATOR2          2250
+vs_v210                 MACH_VS_V210            VS_V210                 2252
+vs_v212                 MACH_VS_V212            VS_V212                 2253
+hmt                     MACH_HMT                HMT                     2254
+suen3                   MACH_SUEN3              SUEN3                   2255
+vesper                  MACH_VESPER             VESPER                  2256
+str9                    MACH_STR9               STR9                    2257
+omap3_wl_ff             MACH_OMAP3_WL_FF        OMAP3_WL_FF             2258
+simcom                  MACH_SIMCOM             SIMCOM                  2259
+mcwebio                 MACH_MCWEBIO            MCWEBIO                 2260
diff --git a/arch/blackfin/include/asm/.gitignore b/arch/blackfin/include/asm/.gitignore
deleted file mode 100644
index 7858564a4466..000000000000
--- a/arch/blackfin/include/asm/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-+mach
diff --git a/arch/blackfin/include/asm/flat.h b/arch/blackfin/include/asm/flat.h
index e70074e05f4e..733a178d782d 100644
--- a/arch/blackfin/include/asm/flat.h
+++ b/arch/blackfin/include/asm/flat.h
@@ -10,7 +10,6 @@
 #include <asm/unaligned.h>
-#define flat_stack_align(sp)    /* nothing needed */
 #define flat_argvp_envp_on_stack()              0
 #define flat_old_ram_flag(flags)                (flags)
diff --git a/arch/blackfin/include/asm/unistd.h b/arch/blackfin/include/asm/unistd.h
index 1e57b636e0bc..cf5066d3efd2 100644
--- a/arch/blackfin/include/asm/unistd.h
+++ b/arch/blackfin/include/asm/unistd.h
@@ -378,8 +378,10 @@
 #define __NR_dup3               363
 #define __NR_pipe2              364
 #define __NR_inotify_init1      365
+#define __NR_preadv             366
+#define __NR_pwritev            367
-#define __NR_syscall            366
+#define __NR_syscall            368
 #define NR_syscalls             __NR_syscall
 /* Old optional stuff no one actually uses */
diff --git a/arch/blackfin/kernel/.gitignore b/arch/blackfin/kernel/.gitignore
new file mode 100644
index 000000000000..c5f676c3c224
--- /dev/null
+++ b/arch/blackfin/kernel/.gitignore
@@ -0,0 +1 @@
+vmlinux.lds
diff --git a/arch/blackfin/lib/strncmp.c b/arch/blackfin/lib/strncmp.c
index 2aaae78a68e0..46518b1d2983 100644
--- a/arch/blackfin/lib/strncmp.c
+++ b/arch/blackfin/lib/strncmp.c
@@ -8,9 +8,8 @@
 #define strncmp __inline_strncmp
 #include <asm/string.h>
-#undef strncmp
 #include <linux/module.h>
+#undef strncmp
 int strncmp(const char *cs, const char *ct, size_t count)
 {
diff --git a/arch/blackfin/mach-common/entry.S b/arch/blackfin/mach-common/entry.S
index 21e65a339a22..a063a434f7e3 100644
--- a/arch/blackfin/mach-common/entry.S
+++ b/arch/blackfin/mach-common/entry.S
@@ -1581,6 +1581,8 @@ ENTRY(_sys_call_table)
        .long _sys_dup3
        .long _sys_pipe2
        .long _sys_inotify_init1        /* 365 */
+        .long _sys_preadv
+        .long _sys_pwritev
        .rept NR_syscalls-(.-_sys_call_table)/4
        .long _sys_ni_syscall
diff --git a/arch/h8300/include/asm/flat.h b/arch/h8300/include/asm/flat.h
index 2a873508a9a1..bd12b31b90e6 100644
--- a/arch/h8300/include/asm/flat.h
+++ b/arch/h8300/include/asm/flat.h
@@ -5,7 +5,6 @@
 #ifndef __H8300_FLAT_H__
 #define __H8300_FLAT_H__
-#define flat_stack_align(sp)                    /* nothing needed */
 #define flat_argvp_envp_on_stack()              1
 #define flat_old_ram_flag(flags)                1
 #define flat_reloc_valid(reloc, size)           ((reloc) <= (size))
diff --git a/arch/m32r/include/asm/flat.h b/arch/m32r/include/asm/flat.h
index d851cf0c4aa5..5d711c4688fb 100644
--- a/arch/m32r/include/asm/flat.h
+++ b/arch/m32r/include/asm/flat.h
@@ -12,7 +12,6 @@
 #ifndef __ASM_M32R_FLAT_H
 #define __ASM_M32R_FLAT_H
-#define flat_stack_align(sp)            (*sp += (*sp & 3 ? (4 - (*sp & 3)): 0))
 #define flat_argvp_envp_on_stack()              0
 #define flat_old_ram_flag(flags)                (flags)
 #define flat_set_persistent(relval, p)          0
diff --git a/arch/m68k/include/asm/flat.h b/arch/m68k/include/asm/flat.h
index 814b5174a8e0..a0e290793978 100644
--- a/arch/m68k/include/asm/flat.h
+++ b/arch/m68k/include/asm/flat.h
@@ -5,7 +5,6 @@
 #ifndef __M68KNOMMU_FLAT_H__
 #define __M68KNOMMU_FLAT_H__
-#define flat_stack_align(sp)                    /* nothing needed */
 #define flat_argvp_envp_on_stack()              1
 #define flat_old_ram_flag(flags)                (flags)
 #define flat_reloc_valid(reloc, size)           ((reloc) <= (size))
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index a0d1146a0578..cdc9a6ff4be8 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -868,6 +868,18 @@ config TASK_SIZE
        default "0x80000000" if PPC_PREP || PPC_8xx
        default "0xc0000000"
+config CONSISTENT_SIZE_BOOL
+        bool "Set custom consistent memory pool size"
+        depends on ADVANCED_OPTIONS && NOT_COHERENT_CACHE
+        help
+          This option allows you to set the size of the
+          consistent memory pool.  This pool of virtual memory
+          is used to make consistent memory allocations.
+config CONSISTENT_SIZE
+        hex "Size of consistent memory pool" if CONSISTENT_SIZE_BOOL
+        default "0x00200000" if NOT_COHERENT_CACHE
 config PIN_TLB
        bool "Pinned Kernel TLBs (860 ONLY)"
        depends on ADVANCED_OPTIONS && 8xx
diff --git a/arch/powerpc/include/asm/dma-mapping.h b/arch/powerpc/include/asm/dma-mapping.h
index c69f2b5f0cc4..cb448d68452c 100644
--- a/arch/powerpc/include/asm/dma-mapping.h
+++ b/arch/powerpc/include/asm/dma-mapping.h
@@ -26,7 +26,9 @@
 * allocate the space "normally" and use the cache management functions
 * to ensure it is consistent.
 */
-extern void *__dma_alloc_coherent(size_t size, dma_addr_t *handle, gfp_t gfp);
+struct device;
+extern void *__dma_alloc_coherent(struct device *dev, size_t size,
+                                  dma_addr_t *handle, gfp_t gfp);
 extern void __dma_free_coherent(size_t size, void *vaddr);
 extern void __dma_sync(void *vaddr, size_t size, int direction);
 extern void __dma_sync_page(struct page *page, unsigned long offset,
@@ -37,7 +39,7 @@ extern void __dma_sync_page(struct page *page, unsigned long offset,
 * Cache coherent cores.
 */
-#define __dma_alloc_coherent(gfp, size, handle) NULL
+#define __dma_alloc_coherent(dev, gfp, size, handle)    NULL
 #define __dma_free_coherent(size, addr)         ((void)0)
 #define __dma_sync(addr, size, rw)              ((void)0)
 #define __dma_sync_page(pg, off, sz, rw)        ((void)0)
diff --git a/arch/powerpc/include/asm/fixmap.h b/arch/powerpc/include/asm/fixmap.h
index d60fd18f428c..f1f4e23a84e9 100644
--- a/arch/powerpc/include/asm/fixmap.h
+++ b/arch/powerpc/include/asm/fixmap.h
@@ -14,8 +14,6 @@
 #ifndef _ASM_FIXMAP_H
 #define _ASM_FIXMAP_H
-extern unsigned long FIXADDR_TOP;
 #ifndef __ASSEMBLY__
 #include <linux/kernel.h>
 #include <asm/page.h>
@@ -24,6 +22,8 @@ extern unsigned long FIXADDR_TOP;
 #include <asm/kmap_types.h>
 #endif
+#define FIXADDR_TOP     ((unsigned long)(-PAGE_SIZE))
 /*
 * Here we define all the compile-time 'special' virtual
 * addresses. The point is to have a constant address at
diff --git a/arch/powerpc/include/asm/pgtable-ppc32.h b/arch/powerpc/include/asm/pgtable-ppc32.h
index ba45c997830f..c9ff9d75990e 100644
--- a/arch/powerpc/include/asm/pgtable-ppc32.h
+++ b/arch/powerpc/include/asm/pgtable-ppc32.h
@@ -10,7 +10,7 @@
 extern unsigned long va_to_phys(unsigned long address);
 extern pte_t *va_to_pte(unsigned long address);
-extern unsigned long ioremap_bot, ioremap_base;
+extern unsigned long ioremap_bot;
 #ifdef CONFIG_44x
 extern int icache_44x_need_flush;
@@ -56,8 +56,30 @@ extern int icache_44x_need_flush;
        printk("%s:%d: bad pgd %08lx.\n", __FILE__, __LINE__, pgd_val(e))
 /*
+ * This is the bottom of the PKMAP area with HIGHMEM or an arbitrary
+ * value (for now) on others, from where we can start layout kernel
+ * virtual space that goes below PKMAP and FIXMAP
+ */
+#ifdef CONFIG_HIGHMEM
+#define KVIRT_TOP       PKMAP_BASE
+#else
+#define KVIRT_TOP       (0xfe000000UL)  /* for now, could be FIXMAP_BASE ? */
+#endif
+/*
+ * ioremap_bot starts at that address. Early ioremaps move down from there,
+ * until mem_init() at which point this becomes the top of the vmalloc
+ * and ioremap space
+ */
+#ifdef CONFIG_NOT_COHERENT_CACHE
+#define IOREMAP_TOP     ((KVIRT_TOP - CONFIG_CONSISTENT_SIZE) & PAGE_MASK)
+#else
+#define IOREMAP_TOP     KVIRT_TOP
+#endif
+/*
 * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 64MB value just means that there will be a 64MB "hole" after the
+ * current 16MB value just means that there will be a 64MB "hole" after the
 * physical memory until the kernel virtual memory starts.  That means that
 * any out-of-bounds memory accesses will hopefully be caught.
 * The vmalloc() routines leaves a hole of 4kB between each vmalloced
diff --git a/arch/powerpc/kernel/dma.c b/arch/powerpc/kernel/dma.c
index 53c7788cba78..6b02793dc75b 100644
--- a/arch/powerpc/kernel/dma.c
+++ b/arch/powerpc/kernel/dma.c
@@ -32,7 +32,7 @@ void *dma_direct_alloc_coherent(struct device *dev, size_t size,
 {
        void *ret;
 #ifdef CONFIG_NOT_COHERENT_CACHE
-        ret = __dma_alloc_coherent(size, dma_handle, flag);
+        ret = __dma_alloc_coherent(dev, size, dma_handle, flag);
        if (ret == NULL)
                return NULL;
        *dma_handle += get_dma_direct_offset(dev);
diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
index 8db35278a4b4..29b742b90f1f 100644
--- a/arch/powerpc/lib/Makefile
+++ b/arch/powerpc/lib/Makefile
@@ -18,7 +18,6 @@ obj-$(CONFIG_PPC64)	+= copypage_64.o copyuser_64.o \
                           memcpy_64.o usercopy_64.o mem_64.o string.o
 obj-$(CONFIG_XMON)      += sstep.o
 obj-$(CONFIG_KPROBES)   += sstep.o
-obj-$(CONFIG_NOT_COHERENT_CACHE)        += dma-noncoherent.o
 ifeq ($(CONFIG_PPC64),y)
 obj-$(CONFIG_SMP)       += locks.o
diff --git a/arch/powerpc/lib/dma-noncoherent.c b/arch/powerpc/lib/dma-noncoherent.c
deleted file mode 100644
index 005a28d380af..000000000000
--- a/arch/powerpc/lib/dma-noncoherent.c
+++ /dev/null
@@ -1,237 +0,0 @@
-/*
- *  PowerPC version derived from arch/arm/mm/consistent.c
- *    Copyright (C) 2001 Dan Malek (dmalek@jlc.net)
- *
- *  Copyright (C) 2000 Russell King
- *
- * Consistent memory allocators.  Used for DMA devices that want to
- * share uncached memory with the processor core.  The function return
- * is the virtual address and 'dma_handle' is the physical address.
- * Mostly stolen from the ARM port, with some changes for PowerPC.
- *                                              -- Dan
- *
- * Reorganized to get rid of the arch-specific consistent_* functions
- * and provide non-coherent implementations for the DMA API. -Matt
- *
- * Added in_interrupt() safe dma_alloc_coherent()/dma_free_coherent()
- * implementation. This is pulled straight from ARM and barely
- * modified. -Matt
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <linux/sched.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/string.h>
-#include <linux/types.h>
-#include <linux/highmem.h>
-#include <linux/dma-mapping.h>
-#include <linux/vmalloc.h>
-#include <asm/tlbflush.h>
-/*
- * Allocate DMA-coherent memory space and return both the kernel remapped
- * virtual and bus address for that space.
- */
-void *
-__dma_alloc_coherent(size_t size, dma_addr_t *handle, gfp_t gfp)
-{
-        struct page *page;
-        unsigned long order;
-        int i;
-        unsigned int nr_pages = PAGE_ALIGN(size)>>PAGE_SHIFT;
-        unsigned int array_size = nr_pages * sizeof(struct page *);
-        struct page **pages;
-        struct page *end;
-        u64 mask = 0x00ffffff, limit; /* ISA default */
-        struct vm_struct *area;
-        BUG_ON(!mem_init_done);
-        size = PAGE_ALIGN(size);
-        limit = (mask + 1) & ~mask;
-        if (limit && size >= limit) {
-                printk(KERN_WARNING "coherent allocation too big (requested "
-                                "%#x mask %#Lx)\n", size, mask);
-                return NULL;
-        }
-        order = get_order(size);
-        if (mask != 0xffffffff)
-                gfp |= GFP_DMA;
-        page = alloc_pages(gfp, order);
-        if (!page)
-                goto no_page;
-        end = page + (1 << order);
-        /*
-         * Invalidate any data that might be lurking in the
-         * kernel direct-mapped region for device DMA.
-         */
-        {
-                unsigned long kaddr = (unsigned long)page_address(page);
-                memset(page_address(page), 0, size);
-                flush_dcache_range(kaddr, kaddr + size);
-        }
-        split_page(page, order);
-        /*
-         * Set the "dma handle"
-         */
-        *handle = page_to_phys(page);
-        area = get_vm_area_caller(size, VM_IOREMAP,
-                        __builtin_return_address(1));
-        if (!area)
-                goto out_free_pages;
-        if (array_size > PAGE_SIZE) {
-                pages = vmalloc(array_size);
-                area->flags |= VM_VPAGES;
-        } else {
-                pages = kmalloc(array_size, GFP_KERNEL);
-        }
-        if (!pages)
-                goto out_free_area;
-        area->pages = pages;
-        area->nr_pages = nr_pages;
-        for (i = 0; i < nr_pages; i++)
-                pages[i] = page + i;
-        if (map_vm_area(area, pgprot_noncached(PAGE_KERNEL), &pages))
-                goto out_unmap;
-        /*
-         * Free the otherwise unused pages.
-         */
-        page += nr_pages;
-        while (page < end) {
-                __free_page(page);
-                page++;
-        }
-        return area->addr;
-out_unmap:
-        vunmap(area->addr);
-        if (array_size > PAGE_SIZE)
-                vfree(pages);
-        else
-                kfree(pages);
-        goto out_free_pages;
-out_free_area:
-        free_vm_area(area);
-out_free_pages:
-        if (page)
-                __free_pages(page, order);
-no_page:
-        return NULL;
-}
-EXPORT_SYMBOL(__dma_alloc_coherent);
-/*
- * free a page as defined by the above mapping.
- */
-void __dma_free_coherent(size_t size, void *vaddr)
-{
-        vfree(vaddr);
-}
-EXPORT_SYMBOL(__dma_free_coherent);
-/*
- * make an area consistent.
- */
-void __dma_sync(void *vaddr, size_t size, int direction)
-{
-        unsigned long start = (unsigned long)vaddr;
-        unsigned long end   = start + size;
-        switch (direction) {
-        case DMA_NONE:
-                BUG();
-        case DMA_FROM_DEVICE:
-                /*
-                 * invalidate only when cache-line aligned otherwise there is
-                 * the potential for discarding uncommitted data from the cache
-                 */
-                if ((start & (L1_CACHE_BYTES - 1)) || (size & (L1_CACHE_BYTES - 1)))
-                        flush_dcache_range(start, end);
-                else
-                        invalidate_dcache_range(start, end);
-                break;
-        case DMA_TO_DEVICE:             /* writeback only */
-                clean_dcache_range(start, end);
-                break;
-        case DMA_BIDIRECTIONAL: /* writeback and invalidate */
-                flush_dcache_range(start, end);
-                break;
-        }
-}
-EXPORT_SYMBOL(__dma_sync);
-#ifdef CONFIG_HIGHMEM
-/*
- * __dma_sync_page() implementation for systems using highmem.
- * In this case, each page of a buffer must be kmapped/kunmapped
- * in order to have a virtual address for __dma_sync(). This must
- * not sleep so kmap_atomic()/kunmap_atomic() are used.
- *
- * Note: yes, it is possible and correct to have a buffer extend
- * beyond the first page.
- */
-static inline void __dma_sync_page_highmem(struct page *page,
-                unsigned long offset, size_t size, int direction)
-{
-        size_t seg_size = min((size_t)(PAGE_SIZE - offset), size);
-        size_t cur_size = seg_size;
-        unsigned long flags, start, seg_offset = offset;
-        int nr_segs = 1 + ((size - seg_size) + PAGE_SIZE - 1)/PAGE_SIZE;
-        int seg_nr = 0;
-        local_irq_save(flags);
-        do {
-                start = (unsigned long)kmap_atomic(page + seg_nr,
-                                KM_PPC_SYNC_PAGE) + seg_offset;
-                /* Sync this buffer segment */
-                __dma_sync((void *)start, seg_size, direction);
-                kunmap_atomic((void *)start, KM_PPC_SYNC_PAGE);
-                seg_nr++;
-                /* Calculate next buffer segment size */
-                seg_size = min((size_t)PAGE_SIZE, size - cur_size);
-                /* Add the segment size to our running total */
-                cur_size += seg_size;
-                seg_offset = 0;
-        } while (seg_nr < nr_segs);
-        local_irq_restore(flags);
-}
-#endif /* CONFIG_HIGHMEM */
-/*
- * __dma_sync_page makes memory consistent. identical to __dma_sync, but
- * takes a struct page instead of a virtual address
- */
-void __dma_sync_page(struct page *page, unsigned long offset,
-        size_t size, int direction)
-{
-#ifdef CONFIG_HIGHMEM
-        __dma_sync_page_highmem(page, offset, size, direction);
-#else
-        unsigned long start = (unsigned long)page_address(page) + offset;
-        __dma_sync((void *)start, size, direction);
-#endif
-}
-EXPORT_SYMBOL(__dma_sync_page);
diff --git a/arch/powerpc/mm/Makefile b/arch/powerpc/mm/Makefile
index 17290bcedc5e..b746f4ca4209 100644
--- a/arch/powerpc/mm/Makefile
+++ b/arch/powerpc/mm/Makefile
@@ -26,3 +26,4 @@ obj-$(CONFIG_NEED_MULTIPLE_NODES) += numa.o
 obj-$(CONFIG_PPC_MM_SLICES)     += slice.o
 obj-$(CONFIG_HUGETLB_PAGE)      += hugetlbpage.o
 obj-$(CONFIG_PPC_SUBPAGE_PROT)  += subpage-prot.o
+obj-$(CONFIG_NOT_COHERENT_CACHE) += dma-noncoherent.o
diff --git a/arch/powerpc/mm/dma-noncoherent.c b/arch/powerpc/mm/dma-noncoherent.c
new file mode 100644
index 000000000000..36692f5c9a76
--- /dev/null
+++ b/arch/powerpc/mm/dma-noncoherent.c
@@ -0,0 +1,400 @@
+/*
+ *  PowerPC version derived from arch/arm/mm/consistent.c
+ *    Copyright (C) 2001 Dan Malek (dmalek@jlc.net)
+ *
+ *  Copyright (C) 2000 Russell King
+ *
+ * Consistent memory allocators.  Used for DMA devices that want to
+ * share uncached memory with the processor core.  The function return
+ * is the virtual address and 'dma_handle' is the physical address.
+ * Mostly stolen from the ARM port, with some changes for PowerPC.
+ *                                              -- Dan
+ *
+ * Reorganized to get rid of the arch-specific consistent_* functions
+ * and provide non-coherent implementations for the DMA API. -Matt
+ *
+ * Added in_interrupt() safe dma_alloc_coherent()/dma_free_coherent()
+ * implementation. This is pulled straight from ARM and barely
+ * modified. -Matt
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/sched.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/highmem.h>
+#include <linux/dma-mapping.h>
+#include <asm/tlbflush.h>
+#include "mmu_decl.h"
+/*
+ * This address range defaults to a value that is safe for all
+ * platforms which currently set CONFIG_NOT_COHERENT_CACHE. It
+ * can be further configured for specific applications under
+ * the "Advanced Setup" menu. -Matt
+ */
+#define CONSISTENT_BASE         (IOREMAP_TOP)
+#define CONSISTENT_END          (CONSISTENT_BASE + CONFIG_CONSISTENT_SIZE)
+#define CONSISTENT_OFFSET(x)    (((unsigned long)(x) - CONSISTENT_BASE) >> PAGE_SHIFT)
+/*
+ * This is the page table (2MB) covering uncached, DMA consistent allocations
+ */
+static DEFINE_SPINLOCK(consistent_lock);
+/*
+ * VM region handling support.
+ *
+ * This should become something generic, handling VM region allocations for
+ * vmalloc and similar (ioremap, module space, etc).
+ *
+ * I envisage vmalloc()'s supporting vm_struct becoming:
+ *
+ *  struct vm_struct {
+ *    struct vm_region  region;
+ *    unsigned long     flags;
+ *    struct page       **pages;
+ *    unsigned int      nr_pages;
+ *    unsigned long     phys_addr;
+ *  };
+ *
+ * get_vm_area() would then call vm_region_alloc with an appropriate
+ * struct vm_region head (eg):
+ *
+ *  struct vm_region vmalloc_head = {
+ *      .vm_list        = LIST_HEAD_INIT(vmalloc_head.vm_list),
+ *      .vm_start       = VMALLOC_START,
+ *      .vm_end         = VMALLOC_END,
+ *  };
+ *
+ * However, vmalloc_head.vm_start is variable (typically, it is dependent on
+ * the amount of RAM found at boot time.)  I would imagine that get_vm_area()
+ * would have to initialise this each time prior to calling vm_region_alloc().
+ */
+struct ppc_vm_region {
+        struct list_head        vm_list;
+        unsigned long           vm_start;
+        unsigned long           vm_end;
+};
+static struct ppc_vm_region consistent_head = {
+        .vm_list        = LIST_HEAD_INIT(consistent_head.vm_list),
+        .vm_start       = CONSISTENT_BASE,
+        .vm_end         = CONSISTENT_END,
+};
+static struct ppc_vm_region *
+ppc_vm_region_alloc(struct ppc_vm_region *head, size_t size, gfp_t gfp)
+{
+        unsigned long addr = head->vm_start, end = head->vm_end - size;
+        unsigned long flags;
+        struct ppc_vm_region *c, *new;
+        new = kmalloc(sizeof(struct ppc_vm_region), gfp);
+        if (!new)
+                goto out;
+        spin_lock_irqsave(&consistent_lock, flags);
+        list_for_each_entry(c, &head->vm_list, vm_list) {
+                if ((addr + size) < addr)
+                        goto nospc;
+                if ((addr + size) <= c->vm_start)
+                        goto found;
+                addr = c->vm_end;
+                if (addr > end)
+                        goto nospc;
+        }
+ found:
+        /*
+         * Insert this entry _before_ the one we found.
+         */
+        list_add_tail(&new->vm_list, &c->vm_list);
+        new->vm_start = addr;
+        new->vm_end = addr + size;
+        spin_unlock_irqrestore(&consistent_lock, flags);
+        return new;
+ nospc:
+        spin_unlock_irqrestore(&consistent_lock, flags);
+        kfree(new);
+ out:
+        return NULL;
+}
+static struct ppc_vm_region *ppc_vm_region_find(struct ppc_vm_region *head, unsigned long addr)
+{
+        struct ppc_vm_region *c;
+        list_for_each_entry(c, &head->vm_list, vm_list) {
+                if (c->vm_start == addr)
+                        goto out;
+        }
+        c = NULL;
+ out:
+        return c;
+}
+/*
+ * Allocate DMA-coherent memory space and return both the kernel remapped
+ * virtual and bus address for that space.
+ */
+void *
+__dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *handle, gfp_t gfp)
+{
+        struct page *page;
+        struct ppc_vm_region *c;
+        unsigned long order;
+        u64 mask = ISA_DMA_THRESHOLD, limit;
+        if (dev) {
+                mask = dev->coherent_dma_mask;
+                /*
+                 * Sanity check the DMA mask - it must be non-zero, and
+                 * must be able to be satisfied by a DMA allocation.
+                 */
+                if (mask == 0) {
+                        dev_warn(dev, "coherent DMA mask is unset\n");
+                        goto no_page;
+                }
+                if ((~mask) & ISA_DMA_THRESHOLD) {
+                        dev_warn(dev, "coherent DMA mask %#llx is smaller "
+                                 "than system GFP_DMA mask %#llx\n",
+                                 mask, (unsigned long long)ISA_DMA_THRESHOLD);
+                        goto no_page;
+                }
+        }
+        size = PAGE_ALIGN(size);
+        limit = (mask + 1) & ~mask;
+        if ((limit && size >= limit) ||
+            size >= (CONSISTENT_END - CONSISTENT_BASE)) {
+                printk(KERN_WARNING "coherent allocation too big (requested %#x mask %#Lx)\n",
+                       size, mask);
+                return NULL;
+        }
+        order = get_order(size);
+        /* Might be useful if we ever have a real legacy DMA zone... */
+        if (mask != 0xffffffff)
+                gfp |= GFP_DMA;
+        page = alloc_pages(gfp, order);
+        if (!page)
+                goto no_page;
+        /*
+         * Invalidate any data that might be lurking in the
+         * kernel direct-mapped region for device DMA.
+         */
+        {
+                unsigned long kaddr = (unsigned long)page_address(page);
+                memset(page_address(page), 0, size);
+                flush_dcache_range(kaddr, kaddr + size);
+        }
+        /*
+         * Allocate a virtual address in the consistent mapping region.
+         */
+        c = ppc_vm_region_alloc(&consistent_head, size,
+                            gfp & ~(__GFP_DMA | __GFP_HIGHMEM));
+        if (c) {
+                unsigned long vaddr = c->vm_start;
+                struct page *end = page + (1 << order);
+                split_page(page, order);
+                /*
+                 * Set the "dma handle"
+                 */
+                *handle = page_to_phys(page);
+                do {
+                        SetPageReserved(page);
+                        map_page(vaddr, page_to_phys(page),
+                                 pgprot_noncached(PAGE_KERNEL));
+                        page++;
+                        vaddr += PAGE_SIZE;
+                } while (size -= PAGE_SIZE);
+                /*
+                 * Free the otherwise unused pages.
+                 */
+                while (page < end) {
+                        __free_page(page);
+                        page++;
+                }
+                return (void *)c->vm_start;
+        }
+        if (page)
+                __free_pages(page, order);
+ no_page:
+        return NULL;
+}
+EXPORT_SYMBOL(__dma_alloc_coherent);
+/*
+ * free a page as defined by the above mapping.
+ */
+void __dma_free_coherent(size_t size, void *vaddr)
+{
+        struct ppc_vm_region *c;
+        unsigned long flags, addr;
+        
+        size = PAGE_ALIGN(size);
+        spin_lock_irqsave(&consistent_lock, flags);
+        c = ppc_vm_region_find(&consistent_head, (unsigned long)vaddr);
+        if (!c)
+                goto no_area;
+        if ((c->vm_end - c->vm_start) != size) {
+                printk(KERN_ERR "%s: freeing wrong coherent size (%ld != %d)\n",
+                       __func__, c->vm_end - c->vm_start, size);
+                dump_stack();
+                size = c->vm_end - c->vm_start;
+        }
+        addr = c->vm_start;
+        do {
+                pte_t *ptep;
+                unsigned long pfn;
+                ptep = pte_offset_kernel(pmd_offset(pud_offset(pgd_offset_k(addr),
+                                                               addr),
+                                                    addr),
+                                         addr);
+                if (!pte_none(*ptep) && pte_present(*ptep)) {
+                        pfn = pte_pfn(*ptep);
+                        pte_clear(&init_mm, addr, ptep);
+                        if (pfn_valid(pfn)) {
+                                struct page *page = pfn_to_page(pfn);
+                                ClearPageReserved(page);
+                                __free_page(page);
+                        }
+                }
+                addr += PAGE_SIZE;
+        } while (size -= PAGE_SIZE);
+        flush_tlb_kernel_range(c->vm_start, c->vm_end);
+        list_del(&c->vm_list);
+        spin_unlock_irqrestore(&consistent_lock, flags);
+        kfree(c);
+        return;
+ no_area:
+        spin_unlock_irqrestore(&consistent_lock, flags);
+        printk(KERN_ERR "%s: trying to free invalid coherent area: %p\n",
+               __func__, vaddr);
+        dump_stack();
+}
+EXPORT_SYMBOL(__dma_free_coherent);
+/*
+ * make an area consistent.
+ */
+void __dma_sync(void *vaddr, size_t size, int direction)
+{
+        unsigned long start = (unsigned long)vaddr;
+        unsigned long end   = start + size;
+        switch (direction) {
+        case DMA_NONE:
+                BUG();
+        case DMA_FROM_DEVICE:
+                /*
+                 * invalidate only when cache-line aligned otherwise there is
+                 * the potential for discarding uncommitted data from the cache
+                 */
+                if ((start & (L1_CACHE_BYTES - 1)) || (size & (L1_CACHE_BYTES - 1)))
+                        flush_dcache_range(start, end);
+                else
+                        invalidate_dcache_range(start, end);
+                break;
+        case DMA_TO_DEVICE:             /* writeback only */
+                clean_dcache_range(start, end);
+                break;
+        case DMA_BIDIRECTIONAL: /* writeback and invalidate */
+                flush_dcache_range(start, end);
+                break;
+        }
+}
+EXPORT_SYMBOL(__dma_sync);
+#ifdef CONFIG_HIGHMEM
+/*
+ * __dma_sync_page() implementation for systems using highmem.
+ * In this case, each page of a buffer must be kmapped/kunmapped
+ * in order to have a virtual address for __dma_sync(). This must
+ * not sleep so kmap_atomic()/kunmap_atomic() are used.
+ *
+ * Note: yes, it is possible and correct to have a buffer extend
+ * beyond the first page.
+ */
+static inline void __dma_sync_page_highmem(struct page *page,
+                unsigned long offset, size_t size, int direction)
+{
+        size_t seg_size = min((size_t)(PAGE_SIZE - offset), size);
+        size_t cur_size = seg_size;
+        unsigned long flags, start, seg_offset = offset;
+        int nr_segs = 1 + ((size - seg_size) + PAGE_SIZE - 1)/PAGE_SIZE;
+        int seg_nr = 0;
+        local_irq_save(flags);
+        do {
+                start = (unsigned long)kmap_atomic(page + seg_nr,
+                                KM_PPC_SYNC_PAGE) + seg_offset;
+                /* Sync this buffer segment */
+                __dma_sync((void *)start, seg_size, direction);
+                kunmap_atomic((void *)start, KM_PPC_SYNC_PAGE);
+                seg_nr++;
+                /* Calculate next buffer segment size */
+                seg_size = min((size_t)PAGE_SIZE, size - cur_size);
+                /* Add the segment size to our running total */
+                cur_size += seg_size;
+                seg_offset = 0;
+        } while (seg_nr < nr_segs);
+        local_irq_restore(flags);
+}
+#endif /* CONFIG_HIGHMEM */
+/*
+ * __dma_sync_page makes memory consistent. identical to __dma_sync, but
+ * takes a struct page instead of a virtual address
+ */
+void __dma_sync_page(struct page *page, unsigned long offset,
+        size_t size, int direction)
+{
+#ifdef CONFIG_HIGHMEM
+        __dma_sync_page_highmem(page, offset, size, direction);
+#else
+        unsigned long start = (unsigned long)page_address(page) + offset;
+        __dma_sync((void *)start, size, direction);
+#endif
+}
+EXPORT_SYMBOL(__dma_sync_page);
diff --git a/arch/powerpc/mm/init_32.c b/arch/powerpc/mm/init_32.c
index 666a5e8a5be1..3de6a0d93824 100644
--- a/arch/powerpc/mm/init_32.c
+++ b/arch/powerpc/mm/init_32.c
@@ -168,12 +168,8 @@ void __init MMU_init(void)
                ppc_md.progress("MMU:mapin", 0x301);
        mapin_ram();
-#ifdef CONFIG_HIGHMEM
+        /* Initialize early top-down ioremap allocator */
-        ioremap_base = PKMAP_BASE;
+        ioremap_bot = IOREMAP_TOP;
-#else
-        ioremap_base = 0xfe000000UL;    /* for now, could be 0xfffff000 */
-#endif /* CONFIG_HIGHMEM */
-        ioremap_bot = ioremap_base;
        /* Map in I/O resources */
        if (ppc_md.progress)
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index d0602a76bf7f..579382c163a9 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -380,6 +380,23 @@ void __init mem_init(void)
                bsssize >> 10,
                initsize >> 10);
+#ifdef CONFIG_PPC32
+        pr_info("Kernel virtual memory layout:\n");
+        pr_info("  * 0x%08lx..0x%08lx  : fixmap\n", FIXADDR_START, FIXADDR_TOP);
+#ifdef CONFIG_HIGHMEM
+        pr_info("  * 0x%08lx..0x%08lx  : highmem PTEs\n",
+                PKMAP_BASE, PKMAP_ADDR(LAST_PKMAP));
+#endif /* CONFIG_HIGHMEM */
+#ifdef CONFIG_NOT_COHERENT_CACHE
+        pr_info("  * 0x%08lx..0x%08lx  : consistent mem\n",
+                IOREMAP_TOP, IOREMAP_TOP + CONFIG_CONSISTENT_SIZE);
+#endif /* CONFIG_NOT_COHERENT_CACHE */
+        pr_info("  * 0x%08lx..0x%08lx  : early ioremap\n",
+                ioremap_bot, IOREMAP_TOP);
+        pr_info("  * 0x%08lx..0x%08lx  : vmalloc & ioremap\n",
+                VMALLOC_START, VMALLOC_END);
+#endif /* CONFIG_PPC32 */
        mem_init_done = 1;
 }
diff --git a/arch/powerpc/mm/mmu_context_nohash.c b/arch/powerpc/mm/mmu_context_nohash.c
index a70e311bd457..030d0005b4d2 100644
--- a/arch/powerpc/mm/mmu_context_nohash.c
+++ b/arch/powerpc/mm/mmu_context_nohash.c
@@ -127,12 +127,12 @@ static unsigned int steal_context_up(unsigned int id)
        pr_debug("[%d] steal context %d from mm @%p\n", cpu, id, mm);
-        /* Mark this mm has having no context anymore */
-        mm->context.id = MMU_NO_CONTEXT;
        /* Flush the TLB for that context */
        local_flush_tlb_mm(mm);
+        /* Mark this mm has having no context anymore */
+        mm->context.id = MMU_NO_CONTEXT;
        /* XXX This clear should ultimately be part of local_flush_tlb_mm */
        __clear_bit(id, stale_map[cpu]);
diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c
index 430d0908fa50..5422169626ba 100644
--- a/arch/powerpc/mm/pgtable_32.c
+++ b/arch/powerpc/mm/pgtable_32.c
@@ -399,8 +399,6 @@ void kernel_map_pages(struct page *page, int numpages, int enable)
 #endif /* CONFIG_DEBUG_PAGEALLOC */
 static int fixmaps;
-unsigned long FIXADDR_TOP = (-PAGE_SIZE);
-EXPORT_SYMBOL(FIXADDR_TOP);
 void __set_fixmap (enum fixed_addresses idx, phys_addr_t phys, pgprot_t flags)
 {
diff --git a/arch/sh/include/asm/flat.h b/arch/sh/include/asm/flat.h
index d3b2b4f109e3..5d84df5e27f6 100644
--- a/arch/sh/include/asm/flat.h
+++ b/arch/sh/include/asm/flat.h
@@ -12,7 +12,6 @@
 #ifndef __ASM_SH_FLAT_H
 #define __ASM_SH_FLAT_H
-#define flat_stack_align(sp)                    /* nothing needed */
 #define flat_argvp_envp_on_stack()              0
 #define flat_old_ram_flag(flags)                (flags)
 #define flat_reloc_valid(reloc, size)           ((reloc) <= (size))
diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
index 857e492c571e..bbeb0c3fbd90 100644
--- a/arch/x86/boot/compressed/relocs.c
+++ b/arch/x86/boot/compressed/relocs.c
@@ -504,8 +504,11 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
                        if (sym->st_shndx == SHN_ABS) {
                                continue;
                        }
-                        if (r_type == R_386_PC32) {
+                        if (r_type == R_386_NONE || r_type == R_386_PC32) {
-                                /* PC relative relocations don't need to be adjusted */
+                                /*
+                                 * NONE can be ignored and and PC relative
+                                 * relocations don't need to be adjusted.
+                                 */
                        }
                        else if (r_type == R_386_32) {
                                /* Visit relocations that need to be adjusted */
diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
index 5054c2ddd1a0..74b3d2ba84e9 100644
--- a/arch/x86/boot/memory.c
+++ b/arch/x86/boot/memory.c
@@ -17,11 +17,6 @@
 #define SMAP    0x534d4150      /* ASCII "SMAP" */
-struct e820_ext_entry {
-        struct e820entry std;
-        u32 ext_flags;
-} __attribute__((packed));
 static int detect_memory_e820(void)
 {
        int count = 0;
@@ -29,13 +24,21 @@ static int detect_memory_e820(void)
        u32 size, id, edi;
        u8 err;
        struct e820entry *desc = boot_params.e820_map;
-        static struct e820_ext_entry buf; /* static so it is zeroed */
+        static struct e820entry buf; /* static so it is zeroed */
        /*
-         * Set this here so that if the BIOS doesn't change this field
+         * Note: at least one BIOS is known which assumes that the
-         * but still doesn't change %ecx, we're still okay...
+         * buffer pointed to by one e820 call is the same one as
+         * the previous call, and only changes modified fields.  Therefore,
+         * we use a temporary buffer and copy the results entry by entry.
+         *
+         * This routine deliberately does not try to account for
+         * ACPI 3+ extended attributes.  This is because there are
+         * BIOSes in the field which report zero for the valid bit for
+         * all ranges, and we don't currently make any use of the
+         * other attribute bits.  Revisit this if we see the extended
+         * attribute bits deployed in a meaningful way in the future.
         */
-        buf.ext_flags = 1;
        do {
                size = sizeof buf;
@@ -66,13 +69,7 @@ static int detect_memory_e820(void)
                        break;
                }
-                /* ACPI 3.0 added the extended flags support.  If bit 0
+                *desc++ = buf;
-                   in the extended flags is zero, we're supposed to simply
-                   ignore the entry -- a backwards incompatible change! */
-                if (size > 20 && !(buf.ext_flags & 1))
-                        continue;
-                *desc++ = buf.std;
                count++;
        } while (next && count < ARRAY_SIZE(boot_params.e820_map));
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index c1caefc82e62..77848d9fca68 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -114,6 +114,13 @@ DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
 } };
 EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
+static int __init x86_xsave_setup(char *s)
+{
+        setup_clear_cpu_cap(X86_FEATURE_XSAVE);
+        return 1;
+}
+__setup("noxsave", x86_xsave_setup);
 #ifdef CONFIG_X86_32
 static int cachesize_override __cpuinitdata = -1;
 static int disable_x86_serial_nr __cpuinitdata = 1;
diff --git a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
index 208ecf6643df..54b6de2cd947 100644
--- a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
+++ b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
@@ -693,8 +693,8 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
        if (perf->control_register.space_id == ACPI_ADR_SPACE_FIXED_HARDWARE &&
            policy->cpuinfo.transition_latency > 20 * 1000) {
                policy->cpuinfo.transition_latency = 20 * 1000;
-                        printk_once(KERN_INFO "Capping off P-state tranision"
+                printk_once(KERN_INFO
-                                    " latency at 20 uS\n");
+                            "P-state transition latency capped at 20 uS\n");
        }
        /* table init */
diff --git a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
index 6ac55bd341ae..869615193720 100644
--- a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
+++ b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
@@ -168,6 +168,7 @@ static unsigned int cpufreq_p4_get_frequency(struct cpuinfo_x86 *c)
                case 0x0E: /* Core */
                case 0x0F: /* Core Duo */
                case 0x16: /* Celeron Core */
+                case 0x1C: /* Atom */
                        p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
                        return speedstep_get_frequency(SPEEDSTEP_CPU_PCORE);
                case 0x0D: /* Pentium M (Dothan) */
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k7.c b/arch/x86/kernel/cpu/cpufreq/powernow-k7.c
index 3c28ccd49742..a8363e5be4ef 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k7.c
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k7.c
@@ -168,10 +168,12 @@ static int check_powernow(void)
        return 1;
 }
+#ifdef CONFIG_X86_POWERNOW_K7_ACPI
 static void invalidate_entry(unsigned int entry)
 {
        powernow_table[entry].frequency = CPUFREQ_ENTRY_INVALID;
 }
+#endif
 static int get_ranges(unsigned char *pst)
 {
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
index 4709ead2db52..f6b32d112357 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -649,6 +649,20 @@ static void print_basics(struct powernow_k8_data *data)
                                data->batps);
 }
+static u32 freq_from_fid_did(u32 fid, u32 did)
+{
+        u32 mhz = 0;
+        if (boot_cpu_data.x86 == 0x10)
+                mhz = (100 * (fid + 0x10)) >> did;
+        else if (boot_cpu_data.x86 == 0x11)
+                mhz = (100 * (fid + 8)) >> did;
+        else
+                BUG();
+        return mhz * 1000;
+}
 static int fill_powernow_table(struct powernow_k8_data *data,
                struct pst_s *pst, u8 maxvid)
 {
@@ -923,8 +937,13 @@ static int fill_powernow_table_pstate(struct powernow_k8_data *data,
                powernow_table[i].index = index;
-                powernow_table[i].frequency =
+                /* Frequency may be rounded for these */
-                        data->acpi_data.states[i].core_frequency * 1000;
+                if (boot_cpu_data.x86 == 0x10 || boot_cpu_data.x86 == 0x11) {
+                        powernow_table[i].frequency =
+                                freq_from_fid_did(lo & 0x3f, (lo >> 6) & 7);
+                } else
+                        powernow_table[i].frequency =
+                                data->acpi_data.states[i].core_frequency * 1000;
        }
        return 0;
 }
@@ -1215,13 +1234,16 @@ static int powernowk8_verify(struct cpufreq_policy *pol)
        return cpufreq_frequency_table_verify(pol, data->powernow_table);
 }
+static const char ACPI_PSS_BIOS_BUG_MSG[] =
+        KERN_ERR FW_BUG PFX "No compatible ACPI _PSS objects found.\n"
+        KERN_ERR FW_BUG PFX "Try again with latest BIOS.\n";
 /* per CPU init entry point to the driver */
 static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
 {
        struct powernow_k8_data *data;
        cpumask_t oldmask;
        int rc;
-        static int print_once;
        if (!cpu_online(pol->cpu))
                return -ENODEV;
@@ -1244,19 +1266,7 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
                 * an UP version, and is deprecated by AMD.
                 */
                if (num_online_cpus() != 1) {
-                        /*
+                        printk_once(ACPI_PSS_BIOS_BUG_MSG);
-                         * Replace this one with print_once as soon as such a
-                         * thing gets introduced
-                         */
-                        if (!print_once) {
-                                WARN_ONCE(1, KERN_ERR FW_BUG PFX "Your BIOS "
-                                        "does not provide ACPI _PSS objects "
-                                        "in a way that Linux understands. "
-                                        "Please report this to the Linux ACPI"
-                                        " maintainers and complain to your "
-                                        "BIOS vendor.\n");
-                                print_once++;
-                        }
                        goto err_out;
                }
                if (pol->cpu != 0) {
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 1340dad417f4..667188e0b5a0 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -232,6 +232,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "Dell DXP061"),
                },
        },
+        {       /* Handle problems with rebooting on Sony VGN-Z540N */
+                .callback = set_bios_reboot,
+                .ident = "Sony VGN-Z540N",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "VGN-Z540N"),
+                },
+        },
        { }
 };
diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
index 3a97a4cf1872..8f0e13be36b3 100644
--- a/arch/x86/kernel/setup_percpu.c
+++ b/arch/x86/kernel/setup_percpu.c
@@ -160,8 +160,10 @@ static ssize_t __init setup_pcpu_remap(size_t static_size)
        /*
         * If large page isn't supported, there's no benefit in doing
         * this.  Also, on non-NUMA, embedding is better.
+         *
+         * NOTE: disabled for now.
         */
-        if (!cpu_has_pse || !pcpu_need_numa())
+        if (true || !cpu_has_pse || !pcpu_need_numa())
                return -EINVAL;
        /*
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index b6caf1329b1b..32cf11e5728a 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2897,8 +2897,7 @@ static int kvm_pv_mmu_write(struct kvm_vcpu *vcpu,
 static int kvm_pv_mmu_flush_tlb(struct kvm_vcpu *vcpu)
 {
-        kvm_x86_ops->tlb_flush(vcpu);
+        kvm_set_cr3(vcpu, vcpu->arch.cr3);
-        set_bit(KVM_REQ_MMU_SYNC, &vcpu->requests);
        return 1;
 }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 49079a46687b..3944e917e794 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -338,6 +338,9 @@ EXPORT_SYMBOL_GPL(kvm_lmsw);
 void kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
 {
+        unsigned long old_cr4 = vcpu->arch.cr4;
+        unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE;
        if (cr4 & CR4_RESERVED_BITS) {
                printk(KERN_DEBUG "set_cr4: #GP, reserved bits\n");
                kvm_inject_gp(vcpu, 0);
@@ -351,7 +354,8 @@ void kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
                        kvm_inject_gp(vcpu, 0);
                        return;
                }
-        } else if (is_paging(vcpu) && !is_pae(vcpu) && (cr4 & X86_CR4_PAE)
+        } else if (is_paging(vcpu) && (cr4 & X86_CR4_PAE)
+                   && ((cr4 ^ old_cr4) & pdptr_bits)
                   && !load_pdptrs(vcpu, vcpu->arch.cr3)) {
                printk(KERN_DEBUG "set_cr4: #GP, pdptrs reserved bits\n");
                kvm_inject_gp(vcpu, 0);
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index 8f307d914c2e..f46c340727b8 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -26,12 +26,16 @@ static unsigned long page_table_shareable(struct vm_area_struct *svma,
        unsigned long sbase = saddr & PUD_MASK;
        unsigned long s_end = sbase + PUD_SIZE;
+        /* Allow segments to share if only one is marked locked */
+        unsigned long vm_flags = vma->vm_flags & ~VM_LOCKED;
+        unsigned long svm_flags = svma->vm_flags & ~VM_LOCKED;
        /*
         * match the virtual addresses, permission and the alignment of the
         * page table page.
         */
        if (pmd_index(addr) != pmd_index(saddr) ||
-            vma->vm_flags != svma->vm_flags ||
+            vm_flags != svm_flags ||
            sbase < svma->vm_start || svma->vm_end < s_end)
                return 0;
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 797f9f107cb6..e17efed088c5 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -153,7 +153,7 @@ static void __cpa_flush_all(void *arg)
         */
        __flush_tlb_all();
-        if (cache && boot_cpu_data.x86_model >= 4)
+        if (cache && boot_cpu_data.x86 >= 4)
                wbinvd();
 }
@@ -208,20 +208,15 @@ static void cpa_flush_array(unsigned long *start, int numpages, int cache,
                            int in_flags, struct page **pages)
 {
        unsigned int i, level;
+        unsigned long do_wbinvd = cache && numpages >= 1024; /* 4M threshold */
        BUG_ON(irqs_disabled());
-        on_each_cpu(__cpa_flush_range, NULL, 1);
+        on_each_cpu(__cpa_flush_all, (void *) do_wbinvd, 1);
-        if (!cache)
+        if (!cache || do_wbinvd)
                return;
-        /* 4M threshold */
-        if (numpages >= 1024) {
-                if (boot_cpu_data.x86_model >= 4)
-                        wbinvd();
-                return;
-        }
        /*
         * We only need to flush on one CPU,
         * clflush is a MESI-coherent instruction that
diff --git a/drivers/acpi/pci_bind.c b/drivers/acpi/pci_bind.c
index 95650f83ce2e..bc46de3d967f 100644
--- a/drivers/acpi/pci_bind.c
+++ b/drivers/acpi/pci_bind.c
@@ -116,9 +116,6 @@ int acpi_pci_bind(struct acpi_device *device)
        struct acpi_pci_data *pdata;
        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
        acpi_handle handle;
-        struct pci_dev *dev;
-        struct pci_bus *bus;
        if (!device || !device->parent)
                return -EINVAL;
@@ -176,20 +173,9 @@ int acpi_pci_bind(struct acpi_device *device)
         * Locate matching device in PCI namespace.  If it doesn't exist
         * this typically means that the device isn't currently inserted
         * (e.g. docking station, port replicator, etc.).
-         * We cannot simply search the global pci device list, since
-         * PCI devices are added to the global pci list when the root
-         * bridge start ops are run, which may not have happened yet.
         */
-        bus = pci_find_bus(data->id.segment, data->id.bus);
+        data->dev = pci_get_slot(pdata->bus,
-        if (bus) {
+                                PCI_DEVFN(data->id.device, data->id.function));
-                list_for_each_entry(dev, &bus->devices, bus_list) {
-                        if (dev->devfn == PCI_DEVFN(data->id.device,
-                                                    data->id.function)) {
-                                data->dev = dev;
-                                break;
-                        }
-                }
-        }
        if (!data->dev) {
                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                  "Device %04x:%02x:%02x.%d not present in PCI namespace\n",
@@ -259,9 +245,10 @@ int acpi_pci_bind(struct acpi_device *device)
      end:
        kfree(buffer.pointer);
-        if (result)
+        if (result) {
+                pci_dev_put(data->dev);
                kfree(data);
+        }
        return result;
 }
@@ -303,6 +290,7 @@ static int acpi_pci_unbind(struct acpi_device *device)
        if (data->dev->subordinate) {
                acpi_pci_irq_del_prt(data->id.segment, data->bus->number);
        }
+        pci_dev_put(data->dev);
        kfree(data);
      end:
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 72069ba5f1ed..10a2d913635a 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -148,6 +148,9 @@ static void acpi_timer_check_state(int state, struct acpi_processor *pr,
        if (cpu_has(&cpu_data(pr->id), X86_FEATURE_ARAT))
                return;
+        if (boot_cpu_has(X86_FEATURE_AMDC1E))
+                type = ACPI_STATE_C1;
        /*
         * Check, if one of the previous states already marked the lapic
         * unstable
@@ -611,6 +614,7 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
                switch (cx->type) {
                case ACPI_STATE_C1:
                        cx->valid = 1;
+                        acpi_timer_check_state(i, pr, cx);
                        break;
                case ACPI_STATE_C2:
@@ -830,11 +834,12 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
        /* Do not access any ACPI IO ports in suspend path */
        if (acpi_idle_suspend) {
-                acpi_safe_halt();
                local_irq_enable();
+                cpu_relax();
                return 0;
        }
+        acpi_state_timer_broadcast(pr, cx, 1);
        kt1 = ktime_get_real();
        acpi_idle_do_entry(cx);
        kt2 = ktime_get_real();
@@ -842,6 +847,7 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
        local_irq_enable();
        cx->usage++;
+        acpi_state_timer_broadcast(pr, cx, 0);
        return idle_time;
 }
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index cafb41000f6b..60e543d3234e 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -309,9 +309,15 @@ static int acpi_processor_get_performance_states(struct acpi_processor *pr)
                                  (u32) px->bus_master_latency,
                                  (u32) px->control, (u32) px->status));
-                if (!px->core_frequency) {
+                /*
-                        printk(KERN_ERR PREFIX
+                 * Check that ACPI's u64 MHz will be valid as u32 KHz in cpufreq
-                                    "Invalid _PSS data: freq is zero\n");
+                 */
+                if (!px->core_frequency ||
+                    ((u32)(px->core_frequency * 1000) !=
+                     (px->core_frequency * 1000))) {
+                        printk(KERN_ERR FW_BUG PREFIX
+                               "Invalid BIOS _PSS frequency: 0x%llx MHz\n",
+                               px->core_frequency);
                        result = -EFAULT;
                        kfree(pr->performance->states);
                        goto end;
diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
index 7f16f5f8e7d3..227543789ba9 100644
--- a/drivers/acpi/processor_throttling.c
+++ b/drivers/acpi/processor_throttling.c
@@ -840,7 +840,7 @@ static int acpi_processor_get_throttling_ptc(struct acpi_processor *pr)
                state = acpi_get_throttling_state(pr, value);
                if (state == -1) {
                        ACPI_WARNING((AE_INFO,
-                                "Invalid throttling state, reset\n"));
+                                "Invalid throttling state, reset"));
                        state = 0;
                        ret = acpi_processor_set_throttling(pr, state);
                        if (ret)
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 810cca90ca7f..1bdfb37377e3 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -570,6 +570,22 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
                DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5710Z"),
                },
        },
+        {
+         .callback = video_set_bqc_offset,
+         .ident = "eMachines E510",
+         .matches = {
+                DMI_MATCH(DMI_BOARD_VENDOR, "EMACHINES"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "eMachines E510"),
+                },
+        },
+        {
+         .callback = video_set_bqc_offset,
+         .ident = "Acer Aspire 5315",
+         .matches = {
+                DMI_MATCH(DMI_BOARD_VENDOR, "Acer"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5315"),
+                },
+        },
        {}
 };
@@ -2334,7 +2350,7 @@ static int __init acpi_video_init(void)
        return acpi_video_register();
 }
-void __exit acpi_video_exit(void)
+void acpi_video_exit(void)
 {
        acpi_bus_unregister_driver(&acpi_video_bus);
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index dc030f1f00f1..c6599618523e 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -700,8 +700,10 @@ int bus_add_driver(struct device_driver *drv)
        }
        kobject_uevent(&priv->kobj, KOBJ_ADD);
-        return error;
+        return 0;
 out_unregister:
+        kfree(drv->p);
+        drv->p = NULL;
        kobject_put(&priv->kobj);
 out_put_bus:
        bus_put(bus);
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 4aa527b8a913..1977d4beb89e 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -879,7 +879,7 @@ int device_add(struct device *dev)
        }
        if (!dev_name(dev))
-                goto done;
+                goto name_error;
        pr_debug("device: '%s': %s\n", dev_name(dev), __func__);
@@ -978,6 +978,9 @@ done:
        cleanup_device_parent(dev);
        if (parent)
                put_device(parent);
+name_error:
+        kfree(dev->p);
+        dev->p = NULL;
        goto done;
 }
diff --git a/drivers/base/driver.c b/drivers/base/driver.c
index c51f11bb29ae..8ae0f63602e0 100644
--- a/drivers/base/driver.c
+++ b/drivers/base/driver.c
@@ -257,6 +257,10 @@ EXPORT_SYMBOL_GPL(driver_register);
 */
 void driver_unregister(struct device_driver *drv)
 {
+        if (!drv || !drv->p) {
+                WARN(1, "Unexpected driver unregister!\n");
+                return;
+        }
        driver_remove_groups(drv, drv->groups);
        bus_remove_driver(drv);
 }
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 69b4ddb7de3b..3e4bc699bc0f 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -357,6 +357,7 @@ static void dpm_power_up(pm_message_t state)
 {
        struct device *dev;
+        mutex_lock(&dpm_list_mtx);
        list_for_each_entry(dev, &dpm_list, power.entry)
                if (dev->power.status > DPM_OFF) {
                        int error;
@@ -366,6 +367,7 @@ static void dpm_power_up(pm_message_t state)
                        if (error)
                                pm_dev_err(dev, state, " early", error);
                }
+        mutex_unlock(&dpm_list_mtx);
 }
 /**
@@ -614,6 +616,7 @@ int device_power_down(pm_message_t state)
        int error = 0;
        suspend_device_irqs();
+        mutex_lock(&dpm_list_mtx);
        list_for_each_entry_reverse(dev, &dpm_list, power.entry) {
                error = suspend_device_noirq(dev, state);
                if (error) {
@@ -622,6 +625,7 @@ int device_power_down(pm_message_t state)
                }
                dev->power.status = DPM_OFF_IRQ;
        }
+        mutex_unlock(&dpm_list_mtx);
        if (error)
                device_power_up(resume_event(state));
        return error;
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index d270e8eb3e67..47d2ad0ae079 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1070,11 +1070,11 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
        spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
 #endif
+        unlock_policy_rwsem_write(cpu);
        if (cpufreq_driver->target)
                __cpufreq_governor(data, CPUFREQ_GOV_STOP);
-        unlock_policy_rwsem_write(cpu);
        kobject_put(&data->kobj);
        /* we need to make sure that the underlying kobj is actually
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 2ecd95e4ab1a..7a74d175287b 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -91,6 +91,9 @@ static unsigned int dbs_enable;	/* number of CPUs using this policy */
 * (like __cpufreq_driver_target()) is being called with dbs_mutex taken, then
 * cpu_hotplug lock should be taken before that. Note that cpu_hotplug lock
 * is recursive for the same process. -Venki
+ * DEADLOCK ALERT! (2) : do_dbs_timer() must not take the dbs_mutex, because it
+ * would deadlock with cancel_delayed_work_sync(), which is needed for proper
+ * raceless workqueue teardown.
 */
 static DEFINE_MUTEX(dbs_mutex);
@@ -542,7 +545,7 @@ static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
 static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
        dbs_info->enable = 0;
-        cancel_delayed_work(&dbs_info->work);
+        cancel_delayed_work_sync(&dbs_info->work);
 }
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 338f428a15b7..e741c339df76 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -98,6 +98,9 @@ static unsigned int dbs_enable;	/* number of CPUs using this policy */
 * (like __cpufreq_driver_target()) is being called with dbs_mutex taken, then
 * cpu_hotplug lock should be taken before that. Note that cpu_hotplug lock
 * is recursive for the same process. -Venki
+ * DEADLOCK ALERT! (2) : do_dbs_timer() must not take the dbs_mutex, because it
+ * would deadlock with cancel_delayed_work_sync(), which is needed for proper
+ * raceless workqueue teardown.
 */
 static DEFINE_MUTEX(dbs_mutex);
@@ -562,7 +565,7 @@ static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
 static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
        dbs_info->enable = 0;
-        cancel_delayed_work(&dbs_info->work);
+        cancel_delayed_work_sync(&dbs_info->work);
 }
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index da8a8ed9e411..f18d1bde0439 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -179,9 +179,14 @@ static void dma_halt(struct fsl_dma_chan *fsl_chan)
 static void set_ld_eol(struct fsl_dma_chan *fsl_chan,
                        struct fsl_desc_sw *desc)
 {
+        u64 snoop_bits;
+        snoop_bits = ((fsl_chan->feature & FSL_DMA_IP_MASK) == FSL_DMA_IP_83XX)
+                ? FSL_DMA_SNEN : 0;
        desc->hw.next_ln_addr = CPU_TO_DMA(fsl_chan,
-                DMA_TO_CPU(fsl_chan, desc->hw.next_ln_addr, 64) | FSL_DMA_EOL,
+                DMA_TO_CPU(fsl_chan, desc->hw.next_ln_addr, 64) | FSL_DMA_EOL
-                64);
+                        | snoop_bits, 64);
 }
 static void append_ld_queue(struct fsl_dma_chan *fsl_chan,
@@ -313,8 +318,8 @@ static void fsl_chan_toggle_ext_start(struct fsl_dma_chan *fsl_chan, int enable)
 static dma_cookie_t fsl_dma_tx_submit(struct dma_async_tx_descriptor *tx)
 {
-        struct fsl_desc_sw *desc = tx_to_fsl_desc(tx);
        struct fsl_dma_chan *fsl_chan = to_fsl_chan(tx->chan);
+        struct fsl_desc_sw *desc;
        unsigned long flags;
        dma_cookie_t cookie;
@@ -322,14 +327,17 @@ static dma_cookie_t fsl_dma_tx_submit(struct dma_async_tx_descriptor *tx)
        spin_lock_irqsave(&fsl_chan->desc_lock, flags);
        cookie = fsl_chan->common.cookie;
-        cookie++;
+        list_for_each_entry(desc, &tx->tx_list, node) {
-        if (cookie < 0)
+                cookie++;
-                cookie = 1;
+                if (cookie < 0)
-        desc->async_tx.cookie = cookie;
+                        cookie = 1;
-        fsl_chan->common.cookie = desc->async_tx.cookie;
-        append_ld_queue(fsl_chan, desc);
+                desc->async_tx.cookie = cookie;
-        list_splice_init(&desc->async_tx.tx_list, fsl_chan->ld_queue.prev);
+        }
+        fsl_chan->common.cookie = cookie;
+        append_ld_queue(fsl_chan, tx_to_fsl_desc(tx));
+        list_splice_init(&tx->tx_list, fsl_chan->ld_queue.prev);
        spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
@@ -454,8 +462,8 @@ static struct dma_async_tx_descriptor *fsl_dma_prep_memcpy(
 {
        struct fsl_dma_chan *fsl_chan;
        struct fsl_desc_sw *first = NULL, *prev = NULL, *new;
+        struct list_head *list;
        size_t copy;
-        LIST_HEAD(link_chain);
        if (!chan)
                return NULL;
@@ -472,7 +480,7 @@ static struct dma_async_tx_descriptor *fsl_dma_prep_memcpy(
                if (!new) {
                        dev_err(fsl_chan->dev,
                                        "No free memory for link descriptor\n");
-                        return NULL;
+                        goto fail;
                }
 #ifdef FSL_DMA_LD_DEBUG
                dev_dbg(fsl_chan->dev, "new link desc alloc %p\n", new);
@@ -507,7 +515,19 @@ static struct dma_async_tx_descriptor *fsl_dma_prep_memcpy(
        /* Set End-of-link to the last link descriptor of new list*/
        set_ld_eol(fsl_chan, new);
-        return first ? &first->async_tx : NULL;
+        return &first->async_tx;
+fail:
+        if (!first)
+                return NULL;
+        list = &first->async_tx.tx_list;
+        list_for_each_entry_safe_reverse(new, prev, list, node) {
+                list_del(&new->node);
+                dma_pool_free(fsl_chan->desc_pool, new, new->async_tx.phys);
+        }
+        return NULL;
 }
 /**
@@ -598,15 +618,16 @@ static void fsl_chan_xfer_ld_queue(struct fsl_dma_chan *fsl_chan)
        dma_addr_t next_dest_addr;
        unsigned long flags;
+        spin_lock_irqsave(&fsl_chan->desc_lock, flags);
        if (!dma_is_idle(fsl_chan))
-                return;
+                goto out_unlock;
        dma_halt(fsl_chan);
        /* If there are some link descriptors
         * not transfered in queue. We need to start it.
         */
-        spin_lock_irqsave(&fsl_chan->desc_lock, flags);
        /* Find the first un-transfer desciptor */
        for (ld_node = fsl_chan->ld_queue.next;
@@ -617,19 +638,20 @@ static void fsl_chan_xfer_ld_queue(struct fsl_dma_chan *fsl_chan)
                                fsl_chan->common.cookie) == DMA_SUCCESS);
                ld_node = ld_node->next);
-        spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
        if (ld_node != &fsl_chan->ld_queue) {
                /* Get the ld start address from ld_queue */
                next_dest_addr = to_fsl_desc(ld_node)->async_tx.phys;
-                dev_dbg(fsl_chan->dev, "xfer LDs staring from %p\n",
+                dev_dbg(fsl_chan->dev, "xfer LDs staring from 0x%llx\n",
-                                (void *)next_dest_addr);
+                                (unsigned long long)next_dest_addr);
                set_cdar(fsl_chan, next_dest_addr);
                dma_start(fsl_chan);
        } else {
                set_cdar(fsl_chan, 0);
                set_ndar(fsl_chan, 0);
        }
+out_unlock:
+        spin_unlock_irqrestore(&fsl_chan->desc_lock, flags);
 }
 /**
@@ -734,8 +756,9 @@ static irqreturn_t fsl_dma_chan_do_interrupt(int irq, void *data)
         */
        if (stat & FSL_DMA_SR_EOSI) {
                dev_dbg(fsl_chan->dev, "event: End-of-segments INT\n");
-                dev_dbg(fsl_chan->dev, "event: clndar %p, nlndar %p\n",
+                dev_dbg(fsl_chan->dev, "event: clndar 0x%llx, nlndar 0x%llx\n",
-                        (void *)get_cdar(fsl_chan), (void *)get_ndar(fsl_chan));
+                        (unsigned long long)get_cdar(fsl_chan),
+                        (unsigned long long)get_ndar(fsl_chan));
                stat &= ~FSL_DMA_SR_EOSI;
                update_cookie = 1;
        }
@@ -830,7 +853,7 @@ static int __devinit fsl_dma_chan_probe(struct fsl_dma_device *fdev,
                        new_fsl_chan->reg.end - new_fsl_chan->reg.start + 1);
        new_fsl_chan->id = ((new_fsl_chan->reg.start - 0x100) & 0xfff) >> 7;
-        if (new_fsl_chan->id > FSL_DMA_MAX_CHANS_PER_DEVICE) {
+        if (new_fsl_chan->id >= FSL_DMA_MAX_CHANS_PER_DEVICE) {
                dev_err(fdev->dev, "There is no %d channel!\n",
                                new_fsl_chan->id);
                err = -EINVAL;
@@ -925,8 +948,8 @@ static int __devinit of_fsl_dma_probe(struct of_device *dev,
        }
        dev_info(&dev->dev, "Probe the Freescale DMA driver for %s "
-                        "controller at %p...\n",
+                        "controller at 0x%llx...\n",
-                        match->compatible, (void *)fdev->reg.start);
+                        match->compatible, (unsigned long long)fdev->reg.start);
        fdev->reg_base = ioremap(fdev->reg.start, fdev->reg.end
                                                - fdev->reg.start + 1);
diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c
index 1955ee8d6d20..a600fc0f7962 100644
--- a/drivers/dma/ioat_dma.c
+++ b/drivers/dma/ioat_dma.c
@@ -173,7 +173,7 @@ static int ioat_dma_enumerate_channels(struct ioatdma_device *device)
        xfercap = (xfercap_scale == 0 ? -1 : (1UL << xfercap_scale));
 #ifdef  CONFIG_I7300_IDLE_IOAT_CHANNEL
-        if (i7300_idle_platform_probe(NULL, NULL) == 0) {
+        if (i7300_idle_platform_probe(NULL, NULL, 1) == 0) {
                device->common.chancnt--;
        }
 #endif
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index e5f5c5a8ba6c..956982f8739b 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -192,16 +192,20 @@ config EDAC_PPC4XX
 config EDAC_AMD8131
        tristate "AMD8131 HyperTransport PCI-X Tunnel"
-        depends on EDAC_MM_EDAC && PCI
+        depends on EDAC_MM_EDAC && PCI && PPC_MAPLE
        help
          Support for error detection and correction on the
          AMD8131 HyperTransport PCI-X Tunnel chip.
+          Note, add more Kconfig dependency if it's adopted
+          on some machine other than Maple.
 config EDAC_AMD8111
        tristate "AMD8111 HyperTransport I/O Hub"
-        depends on EDAC_MM_EDAC && PCI
+        depends on EDAC_MM_EDAC && PCI && PPC_MAPLE
        help
          Support for error detection and correction on the
          AMD8111 HyperTransport I/O Hub chip.
+          Note, add more Kconfig dependency if it's adopted
+          on some machine other than Maple.
 endif # EDAC
diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile
index a5fdcf02f591..59076819135d 100644
--- a/drivers/edac/Makefile
+++ b/drivers/edac/Makefile
@@ -35,3 +35,5 @@ obj-$(CONFIG_EDAC_MPC85XX)		+= mpc85xx_edac.o
 obj-$(CONFIG_EDAC_MV64X60)              += mv64x60_edac.o
 obj-$(CONFIG_EDAC_CELL)                 += cell_edac.o
 obj-$(CONFIG_EDAC_PPC4XX)               += ppc4xx_edac.o
+obj-$(CONFIG_EDAC_AMD8111)              += amd8111_edac.o
+obj-$(CONFIG_EDAC_AMD8131)              += amd8131_edac.o
diff --git a/drivers/edac/amd8111_edac.c b/drivers/edac/amd8111_edac.c
index 614692181120..2cb58ef743e0 100644
--- a/drivers/edac/amd8111_edac.c
+++ b/drivers/edac/amd8111_edac.c
@@ -389,7 +389,7 @@ static int amd8111_dev_probe(struct pci_dev *dev,
        dev_info->edac_dev->dev = &dev_info->dev->dev;
        dev_info->edac_dev->mod_name = AMD8111_EDAC_MOD_STR;
        dev_info->edac_dev->ctl_name = dev_info->ctl_name;
-        dev_info->edac_dev->dev_name = dev_info->dev->dev.bus_id;
+        dev_info->edac_dev->dev_name = dev_name(&dev_info->dev->dev);
        if (edac_op_state == EDAC_OPSTATE_POLL)
                dev_info->edac_dev->edac_check = dev_info->check;
@@ -473,7 +473,7 @@ static int amd8111_pci_probe(struct pci_dev *dev,
        pci_info->edac_dev->dev = &pci_info->dev->dev;
        pci_info->edac_dev->mod_name = AMD8111_EDAC_MOD_STR;
        pci_info->edac_dev->ctl_name = pci_info->ctl_name;
-        pci_info->edac_dev->dev_name = pci_info->dev->dev.bus_id;
+        pci_info->edac_dev->dev_name = dev_name(&pci_info->dev->dev);
        if (edac_op_state == EDAC_OPSTATE_POLL)
                pci_info->edac_dev->edac_check = pci_info->check;
diff --git a/drivers/edac/amd8131_edac.c b/drivers/edac/amd8131_edac.c
index c083b31cac5a..b432d60c622a 100644
--- a/drivers/edac/amd8131_edac.c
+++ b/drivers/edac/amd8131_edac.c
@@ -287,7 +287,7 @@ static int amd8131_probe(struct pci_dev *dev, const struct pci_device_id *id)
        dev_info->edac_dev->dev = &dev_info->dev->dev;
        dev_info->edac_dev->mod_name = AMD8131_EDAC_MOD_STR;
        dev_info->edac_dev->ctl_name = dev_info->ctl_name;
-        dev_info->edac_dev->dev_name = dev_info->dev->dev.bus_id;
+        dev_info->edac_dev->dev_name = dev_name(&dev_info->dev->dev);
        if (edac_op_state == EDAC_OPSTATE_POLL)
                dev_info->edac_dev->edac_check = amd8131_chipset.check;
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 4cd35d8fd799..f5d46e7199d4 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -67,12 +67,18 @@ config DRM_I830
          will load the correct one.
 config DRM_I915
+        tristate "i915 driver"
        select FB_CFB_FILLRECT
        select FB_CFB_COPYAREA
        select FB_CFB_IMAGEBLIT
        select FB
        select FRAMEBUFFER_CONSOLE if !EMBEDDED
-        tristate "i915 driver"
+        # i915 depends on ACPI_VIDEO when ACPI is enabled
+        # but for select to work, need to select ACPI_VIDEO's dependencies, ick
+        select VIDEO_OUTPUT_CONTROL if ACPI
+        select BACKLIGHT_CLASS_DEVICE if ACPI
+        select INPUT if ACPI
+        select ACPI_VIDEO if ACPI
        help
          Choose this option if you have a system that has Intel 830M, 845G,
          852GM, 855GM 865G or 915G integrated graphics.  If M is selected, the
@@ -84,12 +90,6 @@ config DRM_I915
 config DRM_I915_KMS
        bool "Enable modesetting on intel by default"
        depends on DRM_I915
-        # i915 KMS depends on ACPI_VIDEO when ACPI is enabled
-        # but for select to work, need to select ACPI_VIDEO's dependencies, ick
-        select VIDEO_OUTPUT_CONTROL if ACPI
-        select BACKLIGHT_CLASS_DEVICE if ACPI
-        select INPUT if ACPI
-        select ACPI_VIDEO if ACPI
        help
          Choose this option if you want kernel modesetting enabled by default,
          and you have a new enough userspace to support this. Running old
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 9b149fe824c3..c431fa54bbb5 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -180,7 +180,8 @@ typedef struct drm_i915_private {
        int backlight_duty_cycle;  /* restore backlight to this value */
        bool panel_wants_dither;
        struct drm_display_mode *panel_fixed_mode;
-        struct drm_display_mode *vbt_mode; /* if any */
+        struct drm_display_mode *lfp_lvds_vbt_mode; /* if any */
+        struct drm_display_mode *sdvo_lvds_vbt_mode; /* if any */
        /* Feature bits from the VBIOS */
        unsigned int int_tv_support:1;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index b189b49c7602..670d12881468 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -349,7 +349,7 @@ i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
        last_data_page = (data_ptr + args->size - 1) / PAGE_SIZE;
        num_pages = last_data_page - first_data_page + 1;
-        user_pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL);
+        user_pages = drm_calloc_large(num_pages, sizeof(struct page *));
        if (user_pages == NULL)
                return -ENOMEM;
@@ -429,7 +429,7 @@ fail_put_user_pages:
                SetPageDirty(user_pages[i]);
                page_cache_release(user_pages[i]);
        }
-        kfree(user_pages);
+        drm_free_large(user_pages);
        return ret;
 }
@@ -649,7 +649,7 @@ i915_gem_gtt_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
        last_data_page = (data_ptr + args->size - 1) / PAGE_SIZE;
        num_pages = last_data_page - first_data_page + 1;
-        user_pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL);
+        user_pages = drm_calloc_large(num_pages, sizeof(struct page *));
        if (user_pages == NULL)
                return -ENOMEM;
@@ -719,7 +719,7 @@ out_unlock:
 out_unpin_pages:
        for (i = 0; i < pinned_pages; i++)
                page_cache_release(user_pages[i]);
-        kfree(user_pages);
+        drm_free_large(user_pages);
        return ret;
 }
@@ -824,7 +824,7 @@ i915_gem_shmem_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
        last_data_page = (data_ptr + args->size - 1) / PAGE_SIZE;
        num_pages = last_data_page - first_data_page + 1;
-        user_pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL);
+        user_pages = drm_calloc_large(num_pages, sizeof(struct page *));
        if (user_pages == NULL)
                return -ENOMEM;
@@ -902,7 +902,7 @@ fail_unlock:
 fail_put_user_pages:
        for (i = 0; i < pinned_pages; i++)
                page_cache_release(user_pages[i]);
-        kfree(user_pages);
+        drm_free_large(user_pages);
        return ret;
 }
@@ -1145,7 +1145,14 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
                        mutex_unlock(&dev->struct_mutex);
                        return VM_FAULT_SIGBUS;
                }
-                list_add(&obj_priv->list, &dev_priv->mm.inactive_list);
+                ret = i915_gem_object_set_to_gtt_domain(obj, write);
+                if (ret) {
+                        mutex_unlock(&dev->struct_mutex);
+                        return VM_FAULT_SIGBUS;
+                }
+                list_add_tail(&obj_priv->list, &dev_priv->mm.inactive_list);
        }
        /* Need a new fence register? */
@@ -1375,7 +1382,7 @@ i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
                        mutex_unlock(&dev->struct_mutex);
                        return ret;
                }
-                list_add(&obj_priv->list, &dev_priv->mm.inactive_list);
+                list_add_tail(&obj_priv->list, &dev_priv->mm.inactive_list);
        }
        drm_gem_object_unreference(obj);
@@ -1408,9 +1415,7 @@ i915_gem_object_put_pages(struct drm_gem_object *obj)
                }
        obj_priv->dirty = 0;
-        drm_free(obj_priv->pages,
+        drm_free_large(obj_priv->pages);
-                 page_count * sizeof(struct page *),
-                 DRM_MEM_DRIVER);
        obj_priv->pages = NULL;
 }
@@ -2024,8 +2029,7 @@ i915_gem_object_get_pages(struct drm_gem_object *obj)
         */
        page_count = obj->size / PAGE_SIZE;
        BUG_ON(obj_priv->pages != NULL);
-        obj_priv->pages = drm_calloc(page_count, sizeof(struct page *),
+        obj_priv->pages = drm_calloc_large(page_count, sizeof(struct page *));
-                                     DRM_MEM_DRIVER);
        if (obj_priv->pages == NULL) {
                DRM_ERROR("Faled to allocate page list\n");
                obj_priv->pages_refcount--;
@@ -2131,8 +2135,10 @@ static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
                return;
        }
-        pitch_val = (obj_priv->stride / 128) - 1;
+        pitch_val = obj_priv->stride / 128;
-        WARN_ON(pitch_val & ~0x0000000f);
+        pitch_val = ffs(pitch_val) - 1;
+        WARN_ON(pitch_val > I830_FENCE_MAX_PITCH_VAL);
        val = obj_priv->gtt_offset;
        if (obj_priv->tiling_mode == I915_TILING_Y)
                val |= 1 << I830_FENCE_TILING_Y_SHIFT;
@@ -2424,6 +2430,16 @@ i915_gem_clflush_object(struct drm_gem_object *obj)
        if (obj_priv->pages == NULL)
                return;
+        /* XXX: The 865 in particular appears to be weird in how it handles
+         * cache flushing.  We haven't figured it out, but the
+         * clflush+agp_chipset_flush doesn't appear to successfully get the
+         * data visible to the PGU, while wbinvd + agp_chipset_flush does.
+         */
+        if (IS_I865G(obj->dev)) {
+                wbinvd();
+                return;
+        }
        drm_clflush_pages(obj_priv->pages, obj->size / PAGE_SIZE);
 }
@@ -3111,7 +3127,7 @@ i915_gem_get_relocs_from_user(struct drm_i915_gem_exec_object *exec_list,
                reloc_count += exec_list[i].relocation_count;
        }
-        *relocs = drm_calloc(reloc_count, sizeof(**relocs), DRM_MEM_DRIVER);
+        *relocs = drm_calloc_large(reloc_count, sizeof(**relocs));
        if (*relocs == NULL)
                return -ENOMEM;
@@ -3125,8 +3141,7 @@ i915_gem_get_relocs_from_user(struct drm_i915_gem_exec_object *exec_list,
                                     exec_list[i].relocation_count *
                                     sizeof(**relocs));
                if (ret != 0) {
-                        drm_free(*relocs, reloc_count * sizeof(**relocs),
+                        drm_free_large(*relocs);
-                                 DRM_MEM_DRIVER);
                        *relocs = NULL;
                        return -EFAULT;
                }
@@ -3165,7 +3180,7 @@ i915_gem_put_relocs_to_user(struct drm_i915_gem_exec_object *exec_list,
        }
 err:
-        drm_free(relocs, reloc_count * sizeof(*relocs), DRM_MEM_DRIVER);
+        drm_free_large(relocs);
        return ret;
 }
@@ -3198,10 +3213,8 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
                return -EINVAL;
        }
        /* Copy in the exec list from userland */
-        exec_list = drm_calloc(sizeof(*exec_list), args->buffer_count,
+        exec_list = drm_calloc_large(sizeof(*exec_list), args->buffer_count);
-                               DRM_MEM_DRIVER);
+        object_list = drm_calloc_large(sizeof(*object_list), args->buffer_count);
-        object_list = drm_calloc(sizeof(*object_list), args->buffer_count,
-                                 DRM_MEM_DRIVER);
        if (exec_list == NULL || object_list == NULL) {
                DRM_ERROR("Failed to allocate exec or object list "
                          "for %d buffers\n",
@@ -3462,10 +3475,8 @@ err:
        }
 pre_mutex_err:
-        drm_free(object_list, sizeof(*object_list) * args->buffer_count,
+        drm_free_large(object_list);
-                 DRM_MEM_DRIVER);
+        drm_free_large(exec_list);
-        drm_free(exec_list, sizeof(*exec_list) * args->buffer_count,
-                 DRM_MEM_DRIVER);
        drm_free(cliprects, sizeof(*cliprects) * args->num_cliprects,
                 DRM_MEM_DRIVER);
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 52a059354e83..540dd336e6ec 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -213,7 +213,8 @@ i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
        if (tiling_mode == I915_TILING_NONE)
                return true;
-        if (tiling_mode == I915_TILING_Y && HAS_128_BYTE_Y_TILING(dev))
+        if (!IS_I9XX(dev) ||
+            (tiling_mode == I915_TILING_Y && HAS_128_BYTE_Y_TILING(dev)))
                tile_width = 128;
        else
                tile_width = 512;
@@ -225,11 +226,18 @@ i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
                if (stride / 128 > I965_FENCE_MAX_PITCH_VAL)
                        return false;
        } else if (IS_I9XX(dev)) {
-                if (stride / tile_width > I830_FENCE_MAX_PITCH_VAL ||
+                uint32_t pitch_val = ffs(stride / tile_width) - 1;
+                /* XXX: For Y tiling, FENCE_MAX_PITCH_VAL is actually 6 (8KB)
+                 * instead of 4 (2KB) on 945s.
+                 */
+                if (pitch_val > I915_FENCE_MAX_PITCH_VAL ||
                    size > (I830_FENCE_MAX_SIZE_VAL << 20))
                        return false;
        } else {
-                if (stride / 128 > I830_FENCE_MAX_PITCH_VAL ||
+                uint32_t pitch_val = ffs(stride / tile_width) - 1;
+                if (pitch_val > I830_FENCE_MAX_PITCH_VAL ||
                    size > (I830_FENCE_MAX_SIZE_VAL << 19))
                        return false;
        }
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 15da44cf21b1..375569d01d01 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -190,7 +190,8 @@
 #define   I830_FENCE_SIZE_BITS(size)    ((ffs((size) >> 19) - 1) << 8)
 #define   I830_FENCE_PITCH_SHIFT        4
 #define   I830_FENCE_REG_VALID          (1<<0)
-#define   I830_FENCE_MAX_PITCH_VAL      0x10
+#define   I915_FENCE_MAX_PITCH_VAL      0x10
+#define   I830_FENCE_MAX_PITCH_VAL      6
 #define   I830_FENCE_MAX_SIZE_VAL       (1<<8)
 #define   I915_FENCE_START_MASK         0x0ff00000
@@ -1410,9 +1411,25 @@
 /* Cursor A & B regs */
 #define CURACNTR                0x70080
+/* Old style CUR*CNTR flags (desktop 8xx) */
+#define   CURSOR_ENABLE         0x80000000
+#define   CURSOR_GAMMA_ENABLE   0x40000000
+#define   CURSOR_STRIDE_MASK    0x30000000
+#define   CURSOR_FORMAT_SHIFT   24
+#define   CURSOR_FORMAT_MASK    (0x07 << CURSOR_FORMAT_SHIFT)
+#define   CURSOR_FORMAT_2C      (0x00 << CURSOR_FORMAT_SHIFT)
+#define   CURSOR_FORMAT_3C      (0x01 << CURSOR_FORMAT_SHIFT)
+#define   CURSOR_FORMAT_4C      (0x02 << CURSOR_FORMAT_SHIFT)
+#define   CURSOR_FORMAT_ARGB    (0x04 << CURSOR_FORMAT_SHIFT)
+#define   CURSOR_FORMAT_XRGB    (0x05 << CURSOR_FORMAT_SHIFT)
+/* New style CUR*CNTR flags */
+#define   CURSOR_MODE           0x27
 #define   CURSOR_MODE_DISABLE   0x00
 #define   CURSOR_MODE_64_32B_AX 0x07
 #define   CURSOR_MODE_64_ARGB_AX ((1 << 5) | CURSOR_MODE_64_32B_AX)
+#define   MCURSOR_PIPE_SELECT   (1 << 28)
+#define   MCURSOR_PIPE_A        0x00
+#define   MCURSOR_PIPE_B        (1 << 28)
 #define   MCURSOR_GAMMA_ENABLE  (1 << 26)
 #define CURABASE                0x70084
 #define CURAPOS                 0x70088
@@ -1420,6 +1437,7 @@
 #define   CURSOR_POS_SIGN       0x8000
 #define   CURSOR_X_SHIFT        0
 #define   CURSOR_Y_SHIFT        16
+#define CURSIZE                 0x700a0
 #define CURBCNTR                0x700c0
 #define CURBBASE                0x700c4
 #define CURBPOS                 0x700c8
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index fc28e2bbd542..9d78cff33b24 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -57,9 +57,43 @@ find_section(struct bdb_header *bdb, int section_id)
        return NULL;
 }
-/* Try to find panel data */
 static void
-parse_panel_data(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
+fill_detail_timing_data(struct drm_display_mode *panel_fixed_mode,
+                        struct lvds_dvo_timing *dvo_timing)
+{
+        panel_fixed_mode->hdisplay = (dvo_timing->hactive_hi << 8) |
+                dvo_timing->hactive_lo;
+        panel_fixed_mode->hsync_start = panel_fixed_mode->hdisplay +
+                ((dvo_timing->hsync_off_hi << 8) | dvo_timing->hsync_off_lo);
+        panel_fixed_mode->hsync_end = panel_fixed_mode->hsync_start +
+                dvo_timing->hsync_pulse_width;
+        panel_fixed_mode->htotal = panel_fixed_mode->hdisplay +
+                ((dvo_timing->hblank_hi << 8) | dvo_timing->hblank_lo);
+        panel_fixed_mode->vdisplay = (dvo_timing->vactive_hi << 8) |
+                dvo_timing->vactive_lo;
+        panel_fixed_mode->vsync_start = panel_fixed_mode->vdisplay +
+                dvo_timing->vsync_off;
+        panel_fixed_mode->vsync_end = panel_fixed_mode->vsync_start +
+                dvo_timing->vsync_pulse_width;
+        panel_fixed_mode->vtotal = panel_fixed_mode->vdisplay +
+                ((dvo_timing->vblank_hi << 8) | dvo_timing->vblank_lo);
+        panel_fixed_mode->clock = dvo_timing->clock * 10;
+        panel_fixed_mode->type = DRM_MODE_TYPE_PREFERRED;
+        /* Some VBTs have bogus h/vtotal values */
+        if (panel_fixed_mode->hsync_end > panel_fixed_mode->htotal)
+                panel_fixed_mode->htotal = panel_fixed_mode->hsync_end + 1;
+        if (panel_fixed_mode->vsync_end > panel_fixed_mode->vtotal)
+                panel_fixed_mode->vtotal = panel_fixed_mode->vsync_end + 1;
+        drm_mode_set_name(panel_fixed_mode);
+}
+/* Try to find integrated panel data */
+static void
+parse_lfp_panel_data(struct drm_i915_private *dev_priv,
+                            struct bdb_header *bdb)
 {
        struct bdb_lvds_options *lvds_options;
        struct bdb_lvds_lfp_data *lvds_lfp_data;
@@ -91,38 +125,45 @@ parse_panel_data(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
        panel_fixed_mode = drm_calloc(1, sizeof(*panel_fixed_mode),
                                      DRM_MEM_DRIVER);
-        panel_fixed_mode->hdisplay = (dvo_timing->hactive_hi << 8) |
+        fill_detail_timing_data(panel_fixed_mode, dvo_timing);
-                dvo_timing->hactive_lo;
-        panel_fixed_mode->hsync_start = panel_fixed_mode->hdisplay +
-                ((dvo_timing->hsync_off_hi << 8) | dvo_timing->hsync_off_lo);
-        panel_fixed_mode->hsync_end = panel_fixed_mode->hsync_start +
-                dvo_timing->hsync_pulse_width;
-        panel_fixed_mode->htotal = panel_fixed_mode->hdisplay +
-                ((dvo_timing->hblank_hi << 8) | dvo_timing->hblank_lo);
-        panel_fixed_mode->vdisplay = (dvo_timing->vactive_hi << 8) |
+        dev_priv->lfp_lvds_vbt_mode = panel_fixed_mode;
-                dvo_timing->vactive_lo;
-        panel_fixed_mode->vsync_start = panel_fixed_mode->vdisplay +
-                dvo_timing->vsync_off;
-        panel_fixed_mode->vsync_end = panel_fixed_mode->vsync_start +
-                dvo_timing->vsync_pulse_width;
-        panel_fixed_mode->vtotal = panel_fixed_mode->vdisplay +
-                ((dvo_timing->vblank_hi << 8) | dvo_timing->vblank_lo);
-        panel_fixed_mode->clock = dvo_timing->clock * 10;
-        panel_fixed_mode->type = DRM_MODE_TYPE_PREFERRED;
-        /* Some VBTs have bogus h/vtotal values */
+        DRM_DEBUG("Found panel mode in BIOS VBT tables:\n");
-        if (panel_fixed_mode->hsync_end > panel_fixed_mode->htotal)
+        drm_mode_debug_printmodeline(panel_fixed_mode);
-                panel_fixed_mode->htotal = panel_fixed_mode->hsync_end + 1;
-        if (panel_fixed_mode->vsync_end > panel_fixed_mode->vtotal)
-                panel_fixed_mode->vtotal = panel_fixed_mode->vsync_end + 1;
-        drm_mode_set_name(panel_fixed_mode);
+        return;
+}
+/* Try to find sdvo panel data */
+static void
+parse_sdvo_panel_data(struct drm_i915_private *dev_priv,
+                      struct bdb_header *bdb)
+{
+        struct bdb_sdvo_lvds_options *sdvo_lvds_options;
+        struct lvds_dvo_timing *dvo_timing;
+        struct drm_display_mode *panel_fixed_mode;
-        dev_priv->vbt_mode = panel_fixed_mode;
+        dev_priv->sdvo_lvds_vbt_mode = NULL;
-        DRM_DEBUG("Found panel mode in BIOS VBT tables:\n");
+        sdvo_lvds_options = find_section(bdb, BDB_SDVO_LVDS_OPTIONS);
-        drm_mode_debug_printmodeline(panel_fixed_mode);
+        if (!sdvo_lvds_options)
+                return;
+        dvo_timing = find_section(bdb, BDB_SDVO_PANEL_DTDS);
+        if (!dvo_timing)
+                return;
+        panel_fixed_mode = drm_calloc(1, sizeof(*panel_fixed_mode),
+                                      DRM_MEM_DRIVER);
+        if (!panel_fixed_mode)
+                return;
+        fill_detail_timing_data(panel_fixed_mode,
+                        dvo_timing + sdvo_lvds_options->panel_type);
+        dev_priv->sdvo_lvds_vbt_mode = panel_fixed_mode;
        return;
 }
@@ -199,7 +240,8 @@ intel_init_bios(struct drm_device *dev)
        /* Grab useful general definitions */
        parse_general_features(dev_priv, bdb);
-        parse_panel_data(dev_priv, bdb);
+        parse_lfp_panel_data(dev_priv, bdb);
+        parse_sdvo_panel_data(dev_priv, bdb);
        pci_unmap_rom(pdev, bios);
diff --git a/drivers/gpu/drm/i915/intel_bios.h b/drivers/gpu/drm/i915/intel_bios.h
index de621aad85b5..8ca2cde15804 100644
--- a/drivers/gpu/drm/i915/intel_bios.h
+++ b/drivers/gpu/drm/i915/intel_bios.h
@@ -279,6 +279,23 @@ struct vch_bdb_22 {
        struct vch_panel_data panels[16];
 } __attribute__((packed));
+struct bdb_sdvo_lvds_options {
+        u8 panel_backlight;
+        u8 h40_set_panel_type;
+        u8 panel_type;
+        u8 ssc_clk_freq;
+        u16 als_low_trip;
+        u16 als_high_trip;
+        u8 sclalarcoeff_tab_row_num;
+        u8 sclalarcoeff_tab_row_size;
+        u8 coefficient[8];
+        u8 panel_misc_bits_1;
+        u8 panel_misc_bits_2;
+        u8 panel_misc_bits_3;
+        u8 panel_misc_bits_4;
+} __attribute__((packed));
 bool intel_init_bios(struct drm_device *dev);
 /*
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 19148c3df637..640f5158effc 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -198,9 +198,142 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector)
        return intel_ddc_probe(intel_output);
 }
+static enum drm_connector_status
+intel_crt_load_detect(struct drm_crtc *crtc, struct intel_output *intel_output)
+{
+        struct drm_encoder *encoder = &intel_output->enc;
+        struct drm_device *dev = encoder->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+        uint32_t pipe = intel_crtc->pipe;
+        uint32_t save_bclrpat;
+        uint32_t save_vtotal;
+        uint32_t vtotal, vactive;
+        uint32_t vsample;
+        uint32_t vblank, vblank_start, vblank_end;
+        uint32_t dsl;
+        uint32_t bclrpat_reg;
+        uint32_t vtotal_reg;
+        uint32_t vblank_reg;
+        uint32_t vsync_reg;
+        uint32_t pipeconf_reg;
+        uint32_t pipe_dsl_reg;
+        uint8_t st00;
+        enum drm_connector_status status;
+        if (pipe == 0) {
+                bclrpat_reg = BCLRPAT_A;
+                vtotal_reg = VTOTAL_A;
+                vblank_reg = VBLANK_A;
+                vsync_reg = VSYNC_A;
+                pipeconf_reg = PIPEACONF;
+                pipe_dsl_reg = PIPEADSL;
+        } else {
+                bclrpat_reg = BCLRPAT_B;
+                vtotal_reg = VTOTAL_B;
+                vblank_reg = VBLANK_B;
+                vsync_reg = VSYNC_B;
+                pipeconf_reg = PIPEBCONF;
+                pipe_dsl_reg = PIPEBDSL;
+        }
+        save_bclrpat = I915_READ(bclrpat_reg);
+        save_vtotal = I915_READ(vtotal_reg);
+        vblank = I915_READ(vblank_reg);
+        vtotal = ((save_vtotal >> 16) & 0xfff) + 1;
+        vactive = (save_vtotal & 0x7ff) + 1;
+        vblank_start = (vblank & 0xfff) + 1;
+        vblank_end = ((vblank >> 16) & 0xfff) + 1;
+        /* Set the border color to purple. */
+        I915_WRITE(bclrpat_reg, 0x500050);
+        if (IS_I9XX(dev)) {
+                uint32_t pipeconf = I915_READ(pipeconf_reg);
+                I915_WRITE(pipeconf_reg, pipeconf | PIPECONF_FORCE_BORDER);
+                /* Wait for next Vblank to substitue
+                 * border color for Color info */
+                intel_wait_for_vblank(dev);
+                st00 = I915_READ8(VGA_MSR_WRITE);
+                status = ((st00 & (1 << 4)) != 0) ?
+                        connector_status_connected :
+                        connector_status_disconnected;
+                I915_WRITE(pipeconf_reg, pipeconf);
+        } else {
+                bool restore_vblank = false;
+                int count, detect;
+                /*
+                * If there isn't any border, add some.
+                * Yes, this will flicker
+                */
+                if (vblank_start <= vactive && vblank_end >= vtotal) {
+                        uint32_t vsync = I915_READ(vsync_reg);
+                        uint32_t vsync_start = (vsync & 0xffff) + 1;
+                        vblank_start = vsync_start;
+                        I915_WRITE(vblank_reg,
+                                   (vblank_start - 1) |
+                                   ((vblank_end - 1) << 16));
+                        restore_vblank = true;
+                }
+                /* sample in the vertical border, selecting the larger one */
+                if (vblank_start - vactive >= vtotal - vblank_end)
+                        vsample = (vblank_start + vactive) >> 1;
+                else
+                        vsample = (vtotal + vblank_end) >> 1;
+                /*
+                 * Wait for the border to be displayed
+                 */
+                while (I915_READ(pipe_dsl_reg) >= vactive)
+                        ;
+                while ((dsl = I915_READ(pipe_dsl_reg)) <= vsample)
+                        ;
+                /*
+                 * Watch ST00 for an entire scanline
+                 */
+                detect = 0;
+                count = 0;
+                do {
+                        count++;
+                        /* Read the ST00 VGA status register */
+                        st00 = I915_READ8(VGA_MSR_WRITE);
+                        if (st00 & (1 << 4))
+                                detect++;
+                } while ((I915_READ(pipe_dsl_reg) == dsl));
+                /* restore vblank if necessary */
+                if (restore_vblank)
+                        I915_WRITE(vblank_reg, vblank);
+                /*
+                 * If more than 3/4 of the scanline detected a monitor,
+                 * then it is assumed to be present. This works even on i830,
+                 * where there isn't any way to force the border color across
+                 * the screen
+                 */
+                status = detect * 4 > count * 3 ?
+                         connector_status_connected :
+                         connector_status_disconnected;
+        }
+        /* Restore previous settings */
+        I915_WRITE(bclrpat_reg, save_bclrpat);
+        return status;
+}
 static enum drm_connector_status intel_crt_detect(struct drm_connector *connector)
 {
        struct drm_device *dev = connector->dev;
+        struct intel_output *intel_output = to_intel_output(connector);
+        struct drm_encoder *encoder = &intel_output->enc;
+        struct drm_crtc *crtc;
+        int dpms_mode;
+        enum drm_connector_status status;
        if (IS_I9XX(dev) && !IS_I915G(dev) && !IS_I915GM(dev)) {
                if (intel_crt_detect_hotplug(connector))
@@ -212,8 +345,20 @@ static enum drm_connector_status intel_crt_detect(struct drm_connector *connecto
        if (intel_crt_detect_ddc(connector))
                return connector_status_connected;
-        /* TODO use load detect */
+        /* for pre-945g platforms use load detect */
-        return connector_status_unknown;
+        if (encoder->crtc && encoder->crtc->enabled) {
+                status = intel_crt_load_detect(encoder->crtc, intel_output);
+        } else {
+                crtc = intel_get_load_detect_pipe(intel_output,
+                                                  NULL, &dpms_mode);
+                if (crtc) {
+                        status = intel_crt_load_detect(crtc, intel_output);
+                        intel_release_load_detect_pipe(intel_output, dpms_mode);
+                } else
+                        status = connector_status_unknown;
+        }
+        return status;
 }
 static void intel_crt_destroy(struct drm_connector *connector)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3387cf32f385..c9d6f10ba92e 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1357,7 +1357,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
        int pipe = intel_crtc->pipe;
        uint32_t control = (pipe == 0) ? CURACNTR : CURBCNTR;
        uint32_t base = (pipe == 0) ? CURABASE : CURBBASE;
-        uint32_t temp;
+        uint32_t temp = I915_READ(control);
        size_t addr;
        int ret;
@@ -1366,7 +1366,12 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
        /* if we want to turn off the cursor ignore width and height */
        if (!handle) {
                DRM_DEBUG("cursor off\n");
-                temp = CURSOR_MODE_DISABLE;
+                if (IS_MOBILE(dev) || IS_I9XX(dev)) {
+                        temp &= ~(CURSOR_MODE | MCURSOR_GAMMA_ENABLE);
+                        temp |= CURSOR_MODE_DISABLE;
+                } else {
+                        temp &= ~(CURSOR_ENABLE | CURSOR_GAMMA_ENABLE);
+                }
                addr = 0;
                bo = NULL;
                mutex_lock(&dev->struct_mutex);
@@ -1409,10 +1414,19 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
                addr = obj_priv->phys_obj->handle->busaddr;
        }
-        temp = 0;
+        if (!IS_I9XX(dev))
-        /* set the pipe for the cursor */
+                I915_WRITE(CURSIZE, (height << 12) | width);
-        temp |= (pipe << 28);
-        temp |= CURSOR_MODE_64_ARGB_AX | MCURSOR_GAMMA_ENABLE;
+        /* Hooray for CUR*CNTR differences */
+        if (IS_MOBILE(dev) || IS_I9XX(dev)) {
+                temp &= ~(CURSOR_MODE | MCURSOR_PIPE_SELECT);
+                temp |= CURSOR_MODE_64_ARGB_AX | MCURSOR_GAMMA_ENABLE;
+                temp |= (pipe << 28); /* Connect to correct pipe */
+        } else {
+                temp &= ~(CURSOR_FORMAT_MASK);
+                temp |= CURSOR_ENABLE;
+                temp |= CURSOR_FORMAT_ARGB | CURSOR_GAMMA_ENABLE;
+        }
 finish:
        I915_WRITE(control, temp);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 439a86514993..53731f0ffcb5 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -511,10 +511,10 @@ void intel_lvds_init(struct drm_device *dev)
        }
        /* Failed to get EDID, what about VBT? */
-        if (dev_priv->vbt_mode) {
+        if (dev_priv->lfp_lvds_vbt_mode) {
                mutex_lock(&dev->mode_config.mutex);
                dev_priv->panel_fixed_mode =
-                        drm_mode_duplicate(dev, dev_priv->vbt_mode);
+                        drm_mode_duplicate(dev, dev_priv->lfp_lvds_vbt_mode);
                mutex_unlock(&dev->mode_config.mutex);
                if (dev_priv->panel_fixed_mode) {
                        dev_priv->panel_fixed_mode->type |=
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 9913651c1e17..f3ef6bfd8ffc 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -69,6 +69,10 @@ struct intel_sdvo_priv {
         * This is set if we treat the device as HDMI, instead of DVI.
         */
        bool is_hdmi;
+        /**
+         * This is set if we detect output of sdvo device as LVDS.
+         */
+        bool is_lvds;
        /**
         * Returned SDTV resolutions allowed for the current format, if the
@@ -1398,10 +1402,8 @@ static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connect
 static void intel_sdvo_get_ddc_modes(struct drm_connector *connector)
 {
        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
        /* set the bus switch and get the modes */
-        intel_sdvo_set_control_bus_switch(intel_output, sdvo_priv->ddc_bus);
        intel_ddc_get_modes(intel_output);
 #if 0
@@ -1543,6 +1545,37 @@ static void intel_sdvo_get_tv_modes(struct drm_connector *connector)
                }
 }
+static void intel_sdvo_get_lvds_modes(struct drm_connector *connector)
+{
+        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct drm_i915_private *dev_priv = connector->dev->dev_private;
+        /*
+         * Attempt to get the mode list from DDC.
+         * Assume that the preferred modes are
+         * arranged in priority order.
+         */
+        /* set the bus switch and get the modes */
+        intel_sdvo_set_control_bus_switch(intel_output, sdvo_priv->ddc_bus);
+        intel_ddc_get_modes(intel_output);
+        if (list_empty(&connector->probed_modes) == false)
+                return;
+        /* Fetch modes from VBT */
+        if (dev_priv->sdvo_lvds_vbt_mode != NULL) {
+                struct drm_display_mode *newmode;
+                newmode = drm_mode_duplicate(connector->dev,
+                                             dev_priv->sdvo_lvds_vbt_mode);
+                if (newmode != NULL) {
+                        /* Guarantee the mode is preferred */
+                        newmode->type = (DRM_MODE_TYPE_PREFERRED |
+                                         DRM_MODE_TYPE_DRIVER);
+                        drm_mode_probed_add(connector, newmode);
+                }
+        }
+}
 static int intel_sdvo_get_modes(struct drm_connector *connector)
 {
        struct intel_output *output = to_intel_output(connector);
@@ -1550,6 +1583,8 @@ static int intel_sdvo_get_modes(struct drm_connector *connector)
        if (sdvo_priv->is_tv)
                intel_sdvo_get_tv_modes(connector);
+        else if (sdvo_priv->is_lvds == true)
+                intel_sdvo_get_lvds_modes(connector);
        else
                intel_sdvo_get_ddc_modes(connector);
@@ -1564,6 +1599,9 @@ static void intel_sdvo_destroy(struct drm_connector *connector)
        if (intel_output->i2c_bus)
                intel_i2c_destroy(intel_output->i2c_bus);
+        if (intel_output->ddc_bus)
+                intel_i2c_destroy(intel_output->ddc_bus);
        drm_sysfs_connector_remove(connector);
        drm_connector_cleanup(connector);
        kfree(intel_output);
@@ -1660,12 +1698,56 @@ intel_sdvo_get_digital_encoding_mode(struct intel_output *output)
        return true;
 }
+static struct intel_output *
+intel_sdvo_chan_to_intel_output(struct intel_i2c_chan *chan)
+{
+        struct drm_device *dev = chan->drm_dev;
+        struct drm_connector *connector;
+        struct intel_output *intel_output = NULL;
+        list_for_each_entry(connector,
+                        &dev->mode_config.connector_list, head) {
+                if (to_intel_output(connector)->ddc_bus == chan) {
+                        intel_output = to_intel_output(connector);
+                        break;
+                }
+        }
+        return intel_output;
+}
+static int intel_sdvo_master_xfer(struct i2c_adapter *i2c_adap,
+                                  struct i2c_msg msgs[], int num)
+{
+        struct intel_output *intel_output;
+        struct intel_sdvo_priv *sdvo_priv;
+        struct i2c_algo_bit_data *algo_data;
+        struct i2c_algorithm *algo;
+        algo_data = (struct i2c_algo_bit_data *)i2c_adap->algo_data;
+        intel_output =
+                intel_sdvo_chan_to_intel_output(
+                                (struct intel_i2c_chan *)(algo_data->data));
+        if (intel_output == NULL)
+                return -EINVAL;
+        sdvo_priv = intel_output->dev_priv;
+        algo = (struct i2c_algorithm *)intel_output->i2c_bus->adapter.algo;
+        intel_sdvo_set_control_bus_switch(intel_output, sdvo_priv->ddc_bus);
+        return algo->master_xfer(i2c_adap, msgs, num);
+}
+static struct i2c_algorithm intel_sdvo_i2c_bit_algo = {
+        .master_xfer    = intel_sdvo_master_xfer,
+};
 bool intel_sdvo_init(struct drm_device *dev, int output_device)
 {
        struct drm_connector *connector;
        struct intel_output *intel_output;
        struct intel_sdvo_priv *sdvo_priv;
        struct intel_i2c_chan *i2cbus = NULL;
+        struct intel_i2c_chan *ddcbus = NULL;
        int connector_type;
        u8 ch[0x40];
        int i;
@@ -1676,17 +1758,9 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
                return false;
        }
-        connector = &intel_output->base;
-        drm_connector_init(dev, connector, &intel_sdvo_connector_funcs,
-                           DRM_MODE_CONNECTOR_Unknown);
-        drm_connector_helper_add(connector, &intel_sdvo_connector_helper_funcs);
        sdvo_priv = (struct intel_sdvo_priv *)(intel_output + 1);
        intel_output->type = INTEL_OUTPUT_SDVO;
-        connector->interlace_allowed = 0;
-        connector->doublescan_allowed = 0;
        /* setup the DDC bus. */
        if (output_device == SDVOB)
                i2cbus = intel_i2c_create(dev, GPIOE, "SDVOCTRL_E for SDVOB");
@@ -1694,7 +1768,7 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
                i2cbus = intel_i2c_create(dev, GPIOE, "SDVOCTRL_E for SDVOC");
        if (!i2cbus)
-                goto err_connector;
+                goto err_inteloutput;
        sdvo_priv->i2c_bus = i2cbus;
@@ -1710,7 +1784,6 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
        intel_output->i2c_bus = i2cbus;
        intel_output->dev_priv = sdvo_priv;
        /* Read the regs to test if we can talk to the device */
        for (i = 0; i < 0x40; i++) {
                if (!intel_sdvo_read_byte(intel_output, i, &ch[i])) {
@@ -1720,6 +1793,22 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
                }
        }
+        /* setup the DDC bus. */
+        if (output_device == SDVOB)
+                ddcbus = intel_i2c_create(dev, GPIOE, "SDVOB DDC BUS");
+        else
+                ddcbus = intel_i2c_create(dev, GPIOE, "SDVOC DDC BUS");
+        if (ddcbus == NULL)
+                goto err_i2c;
+        intel_sdvo_i2c_bit_algo.functionality =
+                intel_output->i2c_bus->adapter.algo->functionality;
+        ddcbus->adapter.algo = &intel_sdvo_i2c_bit_algo;
+        intel_output->ddc_bus = ddcbus;
+        /* In defaut case sdvo lvds is false */
+        sdvo_priv->is_lvds = false;
        intel_sdvo_get_capabilities(intel_output, &sdvo_priv->caps);
        if (sdvo_priv->caps.output_flags &
@@ -1729,7 +1818,6 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
                else
                        sdvo_priv->controlled_output = SDVO_OUTPUT_TMDS1;
-                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                encoder_type = DRM_MODE_ENCODER_TMDS;
                connector_type = DRM_MODE_CONNECTOR_DVID;
@@ -1747,7 +1835,6 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_SVID0)
        {
                sdvo_priv->controlled_output = SDVO_OUTPUT_SVID0;
-                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                encoder_type = DRM_MODE_ENCODER_TVDAC;
                connector_type = DRM_MODE_CONNECTOR_SVIDEO;
                sdvo_priv->is_tv = true;
@@ -1756,30 +1843,28 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_RGB0)
        {
                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB0;
-                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                encoder_type = DRM_MODE_ENCODER_DAC;
                connector_type = DRM_MODE_CONNECTOR_VGA;
        }
        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_RGB1)
        {
                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB1;
-                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                encoder_type = DRM_MODE_ENCODER_DAC;
                connector_type = DRM_MODE_CONNECTOR_VGA;
        }
        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_LVDS0)
        {
                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS0;
-                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                encoder_type = DRM_MODE_ENCODER_LVDS;
                connector_type = DRM_MODE_CONNECTOR_LVDS;
+                sdvo_priv->is_lvds = true;
        }
        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_LVDS1)
        {
                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS1;
-                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                encoder_type = DRM_MODE_ENCODER_LVDS;
                connector_type = DRM_MODE_CONNECTOR_LVDS;
+                sdvo_priv->is_lvds = true;
        }
        else
        {
@@ -1795,9 +1880,16 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
                goto err_i2c;
        }
+        connector = &intel_output->base;
+        drm_connector_init(dev, connector, &intel_sdvo_connector_funcs,
+                           connector_type);
+        drm_connector_helper_add(connector, &intel_sdvo_connector_helper_funcs);
+        connector->interlace_allowed = 0;
+        connector->doublescan_allowed = 0;
+        connector->display_info.subpixel_order = SubPixelHorizontalRGB;
        drm_encoder_init(dev, &intel_output->enc, &intel_sdvo_enc_funcs, encoder_type);
        drm_encoder_helper_add(&intel_output->enc, &intel_sdvo_helper_funcs);
-        connector->connector_type = connector_type;
        drm_mode_connector_attach_encoder(&intel_output->base, &intel_output->enc);
        drm_sysfs_connector_add(connector);
@@ -1829,14 +1921,13 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
                  sdvo_priv->caps.output_flags &
                        (SDVO_OUTPUT_TMDS1 | SDVO_OUTPUT_RGB1) ? 'Y' : 'N');
-        intel_output->ddc_bus = i2cbus;
        return true;
 err_i2c:
+        if (ddcbus != NULL)
+                intel_i2c_destroy(intel_output->ddc_bus);
        intel_i2c_destroy(intel_output->i2c_bus);
-err_connector:
+err_inteloutput:
-        drm_connector_cleanup(connector);
        kfree(intel_output);
        return false;
diff --git a/drivers/idle/i7300_idle.c b/drivers/idle/i7300_idle.c
index bf740394d704..949c97ff57e3 100644
--- a/drivers/idle/i7300_idle.c
+++ b/drivers/idle/i7300_idle.c
@@ -41,6 +41,10 @@ static int debug;
 module_param_named(debug, debug, uint, 0644);
 MODULE_PARM_DESC(debug, "Enable debug printks in this driver");
+static int forceload;
+module_param_named(forceload, forceload, uint, 0644);
+MODULE_PARM_DESC(debug, "Enable driver testing on unvalidated i5000");
 #define dprintk(fmt, arg...) \
        do { if (debug) printk(KERN_INFO I7300_PRINT fmt, ##arg); } while (0)
@@ -552,7 +556,7 @@ static int __init i7300_idle_init(void)
        cpus_clear(idle_cpumask);
        total_us = 0;
-        if (i7300_idle_platform_probe(&fbd_dev, &ioat_dev))
+        if (i7300_idle_platform_probe(&fbd_dev, &ioat_dev, forceload))
                return -ENODEV;
        if (i7300_idle_thrt_save())
diff --git a/drivers/input/input.c b/drivers/input/input.c
index e54e002665b0..5d445f48789b 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -42,6 +42,7 @@ static unsigned int input_abs_bypass_init_data[] __initdata = {
        ABS_MT_POSITION_Y,
        ABS_MT_TOOL_TYPE,
        ABS_MT_BLOB_ID,
+        ABS_MT_TRACKING_ID,
        0
 };
 static unsigned long input_abs_bypass[BITS_TO_LONGS(ABS_CNT)];
diff --git a/drivers/input/serio/libps2.c b/drivers/input/serio/libps2.c
index 67248c31e19a..be5bbbb8ae4e 100644
--- a/drivers/input/serio/libps2.c
+++ b/drivers/input/serio/libps2.c
@@ -210,7 +210,7 @@ int ps2_command(struct ps2dev *ps2dev, unsigned char *param, int command)
        timeout = wait_event_timeout(ps2dev->wait,
                                     !(ps2dev->flags & PS2_FLAG_CMD1), timeout);
-        if (ps2dev->cmdcnt && timeout > 0) {
+        if (ps2dev->cmdcnt && !(ps2dev->flags & PS2_FLAG_CMD1)) {
                timeout = ps2_adjust_timeout(ps2dev, command, timeout);
                wait_event_timeout(ps2dev->wait,
diff --git a/drivers/input/touchscreen/ucb1400_ts.c b/drivers/input/touchscreen/ucb1400_ts.c
index f100c7f4c1db..6954f5500108 100644
--- a/drivers/input/touchscreen/ucb1400_ts.c
+++ b/drivers/input/touchscreen/ucb1400_ts.c
@@ -419,7 +419,7 @@ static int ucb1400_ts_remove(struct platform_device *dev)
 #ifdef CONFIG_PM
 static int ucb1400_ts_resume(struct platform_device *dev)
 {
-        struct ucb1400_ts *ucb = platform_get_drvdata(dev);
+        struct ucb1400_ts *ucb = dev->dev.platform_data;
        if (ucb->ts_task) {
                /*
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index b171e75cb52e..29808c4fb1cb 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -175,7 +175,7 @@ int gigaset_isowbuf_getbytes(struct isowbuf_t *iwb, int size)
                return -EINVAL;
        }
        src = iwb->read;
-        if (unlikely(limit > BAS_OUTBUFSIZE + BAS_OUTBUFPAD ||
+        if (unlikely(limit >= BAS_OUTBUFSIZE + BAS_OUTBUFPAD ||
                     (read < src && limit >= src))) {
                pr_err("isoc write buffer frame reservation violated\n");
                return -EFAULT;
diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
index 1a83910f674f..eaf722fe309a 100644
--- a/drivers/lguest/x86/core.c
+++ b/drivers/lguest/x86/core.c
@@ -358,6 +358,16 @@ void lguest_arch_handle_trap(struct lg_cpu *cpu)
                        if (emulate_insn(cpu))
                                return;
                }
+                /* If KVM is active, the vmcall instruction triggers a
+                 * General Protection Fault.  Normally it triggers an
+                 * invalid opcode fault (6): */
+        case 6:
+                /* We need to check if ring == GUEST_PL and
+                 * faulting instruction == vmcall. */
+                if (is_hypercall(cpu)) {
+                        rewrite_hypercall(cpu);
+                        return;
+                }
                break;
        case 14: /* We've intercepted a Page Fault. */
                /* The Guest accessed a virtual address that wasn't mapped.
@@ -403,15 +413,6 @@ void lguest_arch_handle_trap(struct lg_cpu *cpu)
                 * up the pointer now to indicate a hypercall is pending. */
                cpu->hcall = (struct hcall_args *)cpu->regs;
                return;
-        case 6:
-                /* kvm hypercalls trigger an invalid opcode fault (6).
-                 * We need to check if ring == GUEST_PL and
-                 * faulting instruction == vmcall. */
-                if (is_hypercall(cpu)) {
-                        rewrite_hypercall(cpu);
-                        return;
-                }
-                break;
        }
        /* We didn't handle the trap, so it needs to go to the Guest. */
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 47c68bc75a17..56df1cee8fb3 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1097,14 +1097,12 @@ void bitmap_daemon_work(struct bitmap *bitmap)
        }
        bitmap->allclean = 1;
+        spin_lock_irqsave(&bitmap->lock, flags);
        for (j = 0; j < bitmap->chunks; j++) {
                bitmap_counter_t *bmc;
-                spin_lock_irqsave(&bitmap->lock, flags);
+                if (!bitmap->filemap)
-                if (!bitmap->filemap) {
                        /* error or shutdown */
-                        spin_unlock_irqrestore(&bitmap->lock, flags);
                        break;
-                }
                page = filemap_get_page(bitmap, j);
@@ -1121,6 +1119,8 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                                        write_page(bitmap, page, 0);
                                        bitmap->allclean = 0;
                                }
+                                spin_lock_irqsave(&bitmap->lock, flags);
+                                j |= (PAGE_BITS - 1);
                                continue;
                        }
@@ -1181,9 +1181,10 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                                        ext2_clear_bit(file_page_offset(j), paddr);
                                kunmap_atomic(paddr, KM_USER0);
                        }
-                }
+                } else
-                spin_unlock_irqrestore(&bitmap->lock, flags);
+                        j |= PAGE_COUNTER_MASK;
        }
+        spin_unlock_irqrestore(&bitmap->lock, flags);
        /* now sync the final page */
        if (lastpage != NULL) {
diff --git a/drivers/md/md.c b/drivers/md/md.c
index fccc8343a250..641b211fe3fe 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1375,6 +1375,9 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
        sb->raid_disks = cpu_to_le32(mddev->raid_disks);
        sb->size = cpu_to_le64(mddev->dev_sectors);
+        sb->chunksize = cpu_to_le32(mddev->chunk_size >> 9);
+        sb->level = cpu_to_le32(mddev->level);
+        sb->layout = cpu_to_le32(mddev->layout);
        if (mddev->bitmap && mddev->bitmap_file == NULL) {
                sb->bitmap_offset = cpu_to_le32((__u32)mddev->bitmap_offset);
@@ -3303,7 +3306,9 @@ static ssize_t
 action_show(mddev_t *mddev, char *page)
 {
        char *type = "idle";
-        if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
+        if (test_bit(MD_RECOVERY_FROZEN, &mddev->recovery))
+                type = "frozen";
+        else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
            (!mddev->ro && test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))) {
                if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery))
                        type = "reshape";
@@ -3326,7 +3331,12 @@ action_store(mddev_t *mddev, const char *page, size_t len)
        if (!mddev->pers || !mddev->pers->sync_request)
                return -EINVAL;
-        if (cmd_match(page, "idle")) {
+        if (cmd_match(page, "frozen"))
+                set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+        else
+                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+        if (cmd_match(page, "idle") || cmd_match(page, "frozen")) {
                if (mddev->sync_thread) {
                        set_bit(MD_RECOVERY_INTR, &mddev->recovery);
                        md_unregister_thread(mddev->sync_thread);
@@ -3680,7 +3690,7 @@ array_size_store(mddev_t *mddev, const char *buf, size_t len)
                if (strict_blocks_to_sectors(buf, &sectors) < 0)
                        return -EINVAL;
                if (mddev->pers && mddev->pers->size(mddev, 0, 0) < sectors)
-                        return -EINVAL;
+                        return -E2BIG;
                mddev->external_size = 1;
        }
@@ -5557,7 +5567,7 @@ static struct block_device_operations md_fops =
        .owner          = THIS_MODULE,
        .open           = md_open,
        .release        = md_release,
-        .locked_ioctl   = md_ioctl,
+        .ioctl          = md_ioctl,
        .getgeo         = md_getgeo,
        .media_changed  = md_media_changed,
        .revalidate_disk= md_revalidate,
@@ -6352,12 +6362,13 @@ void md_do_sync(mddev_t *mddev)
                skipped = 0;
-                if ((mddev->curr_resync > mddev->curr_resync_completed &&
+                if (!test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
-                     (mddev->curr_resync - mddev->curr_resync_completed)
+                    ((mddev->curr_resync > mddev->curr_resync_completed &&
-                    > (max_sectors >> 4)) ||
+                      (mddev->curr_resync - mddev->curr_resync_completed)
-                    (j - mddev->curr_resync_completed)*2
+                      > (max_sectors >> 4)) ||
-                    >= mddev->resync_max - mddev->curr_resync_completed
+                     (j - mddev->curr_resync_completed)*2
-                        ) {
+                     >= mddev->resync_max - mddev->curr_resync_completed
+                            )) {
                        /* time to update curr_resync_completed */
                        blk_unplug(mddev->queue);
                        wait_event(mddev->recovery_wait,
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 4616bc3a6e71..5d400aef8d9b 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3811,13 +3811,13 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
        safepos = conf->reshape_safe;
        sector_div(safepos, data_disks);
        if (mddev->delta_disks < 0) {
-                writepos -= reshape_sectors;
+                writepos -= min_t(sector_t, reshape_sectors, writepos);
                readpos += reshape_sectors;
                safepos += reshape_sectors;
        } else {
                writepos += reshape_sectors;
-                readpos -= reshape_sectors;
+                readpos -= min_t(sector_t, reshape_sectors, readpos);
-                safepos -= reshape_sectors;
+                safepos -= min_t(sector_t, reshape_sectors, safepos);
        }
        /* 'writepos' is the most advanced device address we might write.
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index f3548d048014..40c26080ecda 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -831,6 +831,7 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
                break;
        case NAND_CMD_READID:
+                host->col_addr = 0;
                send_read_id(host);
                break;
@@ -867,6 +868,7 @@ static int __init mxcnd_probe(struct platform_device *pdev)
        mtd->priv = this;
        mtd->owner = THIS_MODULE;
        mtd->dev.parent = &pdev->dev;
+        mtd->name = "mxc_nand";
        /* 50 us command delay time */
        this->chip_delay = 5;
@@ -882,8 +884,10 @@ static int __init mxcnd_probe(struct platform_device *pdev)
        this->verify_buf = mxc_nand_verify_buf;
        host->clk = clk_get(&pdev->dev, "nfc");
-        if (IS_ERR(host->clk))
+        if (IS_ERR(host->clk)) {
+                err = PTR_ERR(host->clk);
                goto eclk;
+        }
        clk_enable(host->clk);
        host->clk_act = 1;
@@ -896,7 +900,7 @@ static int __init mxcnd_probe(struct platform_device *pdev)
        host->regs = ioremap(res->start, res->end - res->start + 1);
        if (!host->regs) {
-                err = -EIO;
+                err = -ENOMEM;
                goto eres;
        }
@@ -1011,30 +1015,35 @@ static int __devexit mxcnd_remove(struct platform_device *pdev)
 #ifdef CONFIG_PM
 static int mxcnd_suspend(struct platform_device *pdev, pm_message_t state)
 {
-        struct mtd_info *info = platform_get_drvdata(pdev);
+        struct mtd_info *mtd = platform_get_drvdata(pdev);
+        struct nand_chip *nand_chip = mtd->priv;
+        struct mxc_nand_host *host = nand_chip->priv;
        int ret = 0;
        DEBUG(MTD_DEBUG_LEVEL0, "MXC_ND : NAND suspend\n");
-        if (info)
+        if (mtd) {
-                ret = info->suspend(info);
+                ret = mtd->suspend(mtd);
+                /* Disable the NFC clock */
-        /* Disable the NFC clock */
+                clk_disable(host->clk);
-        clk_disable(nfc_clk);   /* FIXME */
+        }
        return ret;
 }
 static int mxcnd_resume(struct platform_device *pdev)
 {
-        struct mtd_info *info = platform_get_drvdata(pdev);
+        struct mtd_info *mtd = platform_get_drvdata(pdev);
+        struct nand_chip *nand_chip = mtd->priv;
+        struct mxc_nand_host *host = nand_chip->priv;
        int ret = 0;
        DEBUG(MTD_DEBUG_LEVEL0, "MXC_ND : NAND resume\n");
-        /* Enable the NFC clock */
-        clk_enable(nfc_clk);    /* FIXME */
-        if (info)
+        if (mtd) {
-                info->resume(info);
+                /* Enable the NFC clock */
+                clk_enable(host->clk);
+                mtd->resume(mtd);
+        }
        return ret;
 }
@@ -1055,13 +1064,7 @@ static struct platform_driver mxcnd_driver = {
 static int __init mxc_nd_init(void)
 {
-        /* Register the device driver structure. */
+        return platform_driver_probe(&mxcnd_driver, mxcnd_probe);
-        pr_info("MXC MTD nand Driver\n");
-        if (platform_driver_probe(&mxcnd_driver, mxcnd_probe) != 0) {
-                printk(KERN_ERR "Driver register failed for mxcnd_driver\n");
-                return -ENODEV;
-        }
-        return 0;
 }
 static void __exit mxc_nd_cleanup(void)
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index 1fc4602a6ff2..a1c25cb4669f 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -102,7 +102,7 @@ obj-$(CONFIG_HAMACHI) += hamachi.o
 obj-$(CONFIG_NET) += Space.o loopback.o
 obj-$(CONFIG_SEEQ8005) += seeq8005.o
 obj-$(CONFIG_NET_SB1000) += sb1000.o
-obj-$(CONFIG_MAC8390) += mac8390.o 8390.o
+obj-$(CONFIG_MAC8390) += mac8390.o
 obj-$(CONFIG_APNE) += apne.o 8390.o
 obj-$(CONFIG_PCMCIA_PCNET) += 8390.o
 obj-$(CONFIG_HP100) += hp100.o
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index b2c49679bba7..a0519184e54e 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1885,8 +1885,17 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
                        if (unlikely(!newskb))
                                newskb = skb;
-                        else if (skb)
+                        else if (skb) {
+                                /*
+                                 * We need to reset ->data to what it
+                                 * was before gfar_new_skb() re-aligned
+                                 * it to an RXBUF_ALIGNMENT boundary
+                                 * before we put the skb back on the
+                                 * recycle list.
+                                 */
+                                skb->data = skb->head + NET_SKB_PAD;
                                __skb_queue_head(&priv->rx_recycle, skb);
+                        }
                } else {
                        /* Increment the number of packets */
                        dev->stats.rx_packets++;
diff --git a/drivers/net/mac8390.c b/drivers/net/mac8390.c
index 8e884869a05b..f26667d5eaae 100644
--- a/drivers/net/mac8390.c
+++ b/drivers/net/mac8390.c
@@ -304,7 +304,7 @@ struct net_device * __init mac8390_probe(int unit)
        if (!MACH_IS_MAC)
                return ERR_PTR(-ENODEV);
-        dev = alloc_ei_netdev();
+        dev = ____alloc_ei_netdev(0);
        if (!dev)
                return ERR_PTR(-ENOMEM);
@@ -481,10 +481,10 @@ void cleanup_module(void)
 static const struct net_device_ops mac8390_netdev_ops = {
        .ndo_open               = mac8390_open,
        .ndo_stop               = mac8390_close,
-        .ndo_start_xmit         = ei_start_xmit,
+        .ndo_start_xmit         = __ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
+        .ndo_tx_timeout         = __ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
+        .ndo_get_stats          = __ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
        .ndo_validate_addr      = eth_validate_addr,
        .ndo_set_mac_address    = eth_mac_addr,
        .ndo_change_mtu         = eth_change_mtu,
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 0b6e8c896835..8247a945a1d9 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -3554,54 +3554,64 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
        int handled = 0;
        int status;
+        /* loop handling interrupts until we have no new ones or
+         * we hit a invalid/hotplug case.
+         */
        status = RTL_R16(IntrStatus);
+        while (status && status != 0xffff) {
+                handled = 1;
-        /* hotplug/major error/no more work/shared irq */
+                /* Handle all of the error cases first. These will reset
-        if ((status == 0xffff) || !status)
+                 * the chip, so just exit the loop.
-                goto out;
+                 */
+                if (unlikely(!netif_running(dev))) {
-        handled = 1;
+                        rtl8169_asic_down(ioaddr);
+                        break;
+                }
-        if (unlikely(!netif_running(dev))) {
+                /* Work around for rx fifo overflow */
-                rtl8169_asic_down(ioaddr);
+                if (unlikely(status & RxFIFOOver) &&
-                goto out;
+                (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
-        }
+                        netif_stop_queue(dev);
+                        rtl8169_tx_timeout(dev);
+                        break;
+                }
-        status &= tp->intr_mask;
+                if (unlikely(status & SYSErr)) {
-        RTL_W16(IntrStatus,
+                        rtl8169_pcierr_interrupt(dev);
-                (status & RxFIFOOver) ? (status | RxOverflow) : status);
+                        break;
+                }
-        if (!(status & tp->intr_event))
+                if (status & LinkChg)
-                goto out;
+                        rtl8169_check_link_status(dev, tp, ioaddr);
-        /* Work around for rx fifo overflow */
+                /* We need to see the lastest version of tp->intr_mask to
-        if (unlikely(status & RxFIFOOver) &&
+                 * avoid ignoring an MSI interrupt and having to wait for
-            (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
+                 * another event which may never come.
-                netif_stop_queue(dev);
+                 */
-                rtl8169_tx_timeout(dev);
+                smp_rmb();
-                goto out;
+                if (status & tp->intr_mask & tp->napi_event) {
-        }
+                        RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
+                        tp->intr_mask = ~tp->napi_event;
+                        if (likely(napi_schedule_prep(&tp->napi)))
+                                __napi_schedule(&tp->napi);
+                        else if (netif_msg_intr(tp)) {
+                                printk(KERN_INFO "%s: interrupt %04x in poll\n",
+                                dev->name, status);
+                        }
+                }
-        if (unlikely(status & SYSErr)) {
+                /* We only get a new MSI interrupt when all active irq
-                rtl8169_pcierr_interrupt(dev);
+                 * sources on the chip have been acknowledged. So, ack
-                goto out;
+                 * everything we've seen and check if new sources have become
+                 * active to avoid blocking all interrupts from the chip.
+                 */
+                RTL_W16(IntrStatus,
+                        (status & RxFIFOOver) ? (status | RxOverflow) : status);
+                status = RTL_R16(IntrStatus);
        }
-        if (status & LinkChg)
-                rtl8169_check_link_status(dev, tp, ioaddr);
-        if (status & tp->napi_event) {
-                RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
-                tp->intr_mask = ~tp->napi_event;
-                if (likely(napi_schedule_prep(&tp->napi)))
-                        __napi_schedule(&tp->napi);
-                else if (netif_msg_intr(tp)) {
-                        printk(KERN_INFO "%s: interrupt %04x in poll\n",
-                               dev->name, status);
-                }
-        }
-out:
        return IRQ_RETVAL(handled);
 }
@@ -3617,13 +3627,15 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
        if (work_done < budget) {
                napi_complete(napi);
-                tp->intr_mask = 0xffff;
-                /*
+                /* We need for force the visibility of tp->intr_mask
-                 * 20040426: the barrier is not strictly required but the
+                 * for other CPUs, as we can loose an MSI interrupt
-                 * behavior of the irq handler could be less predictable
+                 * and potentially wait for a retransmit timeout if we don't.
-                 * without it. Btw, the lack of flush for the posted pci
+                 * The posted write to IntrMask is safe, as it will
-                 * write is safe - FR
+                 * eventually make it to the chip and we won't loose anything
+                 * until it does.
                 */
+                tp->intr_mask = 0xffff;
                smp_wmb();
                RTL_W16(IntrMask, tp->intr_event);
        }
diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c
index ca4151a9e222..17851321b7fd 100644
--- a/drivers/net/wimax/i2400m/usb.c
+++ b/drivers/net/wimax/i2400m/usb.c
@@ -505,27 +505,52 @@ int i2400mu_suspend(struct usb_interface *iface, pm_message_t pm_msg)
 #ifdef CONFIG_PM
        struct usb_device *usb_dev = i2400mu->usb_dev;
 #endif
+        unsigned is_autosuspend = 0;
        struct i2400m *i2400m = &i2400mu->i2400m;
+#ifdef CONFIG_PM
+        if (usb_dev->auto_pm > 0)
+                is_autosuspend = 1;
+#endif
        d_fnstart(3, dev, "(iface %p pm_msg %u)\n", iface, pm_msg.event);
        if (i2400m->updown == 0)
                goto no_firmware;
-        d_printf(1, dev, "fw up, requesting standby\n");
+        if (i2400m->state == I2400M_SS_DATA_PATH_CONNECTED && is_autosuspend) {
+                /* ugh -- the device is connected and this suspend
+                 * request is an autosuspend one (not a system standby
+                 * / hibernate).
+                 *
+                 * The only way the device can go to standby is if the
+                 * link with the base station is in IDLE mode; that
+                 * were the case, we'd be in status
+                 * I2400M_SS_CONNECTED_IDLE. But we are not.
+                 *
+                 * If we *tell* him to go power save now, it'll reset
+                 * as a precautionary measure, so if this is an
+                 * autosuspend thing, say no and it'll come back
+                 * later, when the link is IDLE
+                 */
+                result = -EBADF;
+                d_printf(1, dev, "fw up, link up, not-idle, autosuspend: "
+                         "not entering powersave\n");
+                goto error_not_now;
+        }
+        d_printf(1, dev, "fw up: entering powersave\n");
        atomic_dec(&i2400mu->do_autopm);
        result = i2400m_cmd_enter_powersave(i2400m);
        atomic_inc(&i2400mu->do_autopm);
-#ifdef CONFIG_PM
+        if (result < 0 && !is_autosuspend) {
-        if (result < 0 && usb_dev->auto_pm == 0) {
                /* System suspend, can't fail */
                dev_err(dev, "failed to suspend, will reset on resume\n");
                result = 0;
        }
-#endif
        if (result < 0)
                goto error_enter_powersave;
        i2400mu_notification_release(i2400mu);
-        d_printf(1, dev, "fw up, got standby\n");
+        d_printf(1, dev, "powersave requested\n");
 error_enter_powersave:
+error_not_now:
 no_firmware:
        d_fnend(3, dev, "(iface %p pm_msg %u) = %d\n",
                iface, pm_msg.event, result);
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index d73475739127..9eabf4d1f2e7 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -6467,6 +6467,7 @@ static int airo_get_encode(struct net_device *dev,
 {
        struct airo_info *local = dev->ml_priv;
        int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+        int wep_key_len;
        u8 buf[16];
        if (!local->wep_capable)
@@ -6500,11 +6501,13 @@ static int airo_get_encode(struct net_device *dev,
        dwrq->flags |= index + 1;
        /* Copy the key to the user buffer */
-        dwrq->length = get_wep_key(local, index, &buf[0], sizeof(buf));
+        wep_key_len = get_wep_key(local, index, &buf[0], sizeof(buf));
-        if (dwrq->length != -1)
+        if (wep_key_len < 0) {
-                memcpy(extra, buf, dwrq->length);
-        else
                dwrq->length = 0;
+        } else {
+                dwrq->length = wep_key_len;
+                memcpy(extra, buf, dwrq->length);
+        }
        return 0;
 }
@@ -6617,7 +6620,7 @@ static int airo_get_encodeext(struct net_device *dev,
        struct airo_info *local = dev->ml_priv;
        struct iw_point *encoding = &wrqu->encoding;
        struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-        int idx, max_key_len;
+        int idx, max_key_len, wep_key_len;
        u8 buf[16];
        if (!local->wep_capable)
@@ -6661,11 +6664,13 @@ static int airo_get_encodeext(struct net_device *dev,
        memset(extra, 0, 16);
        
        /* Copy the key to the user buffer */
-        ext->key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
+        wep_key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
-        if (ext->key_len != -1)
+        if (wep_key_len < 0) {
-                memcpy(extra, buf, ext->key_len);
-        else
                ext->key_len = 0;
+        } else {
+                ext->key_len = wep_key_len;
+                memcpy(extra, buf, ext->key_len);
+        }
        return 0;
 }
diff --git a/drivers/net/wireless/ath5k/phy.c b/drivers/net/wireless/ath5k/phy.c
index 9e2faae5ae94..b48b29dca3d2 100644
--- a/drivers/net/wireless/ath5k/phy.c
+++ b/drivers/net/wireless/ath5k/phy.c
@@ -1487,28 +1487,35 @@ ath5k_get_linear_pcdac_min(const u8 *stepL, const u8 *stepR,
 {
        s8 tmp;
        s16 min_pwrL, min_pwrR;
-        s16 pwr_i = pwrL[0];
+        s16 pwr_i;
-        do {
+        if (pwrL[0] == pwrL[1])
-                pwr_i--;
+                min_pwrL = pwrL[0];
-                tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+        else {
-                                                pwrL[0], pwrL[1],
+                pwr_i = pwrL[0];
-                                                stepL[0], stepL[1]);
+                do {
+                        pwr_i--;
-        } while (tmp > 1);
+                        tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+                                                        pwrL[0], pwrL[1],
-        min_pwrL = pwr_i;
+                                                        stepL[0], stepL[1]);
+                } while (tmp > 1);
-        pwr_i = pwrR[0];
-        do {
+                min_pwrL = pwr_i;
-                pwr_i--;
+        }
-                tmp = (s8) ath5k_get_interpolated_value(pwr_i,
-                                                pwrR[0], pwrR[1],
-                                                stepR[0], stepR[1]);
-        } while (tmp > 1);
-        min_pwrR = pwr_i;
+        if (pwrR[0] == pwrR[1])
+                min_pwrR = pwrR[0];
+        else {
+                pwr_i = pwrR[0];
+                do {
+                        pwr_i--;
+                        tmp = (s8) ath5k_get_interpolated_value(pwr_i,
+                                                        pwrR[0], pwrR[1],
+                                                        stepR[0], stepR[1]);
+                } while (tmp > 1);
+                min_pwrR = pwr_i;
+        }
        /* Keep the right boundary so that it works for both curves */
        return max(min_pwrL, min_pwrR);
diff --git a/drivers/net/wireless/ath5k/reset.c b/drivers/net/wireless/ath5k/reset.c
index 7a17d31b2fd9..5f72c111c2e8 100644
--- a/drivers/net/wireless/ath5k/reset.c
+++ b/drivers/net/wireless/ath5k/reset.c
@@ -26,7 +26,7 @@
 \*****************************/
 #include <linux/pci.h>          /* To determine if a card is pci-e */
-#include <linux/bitops.h>       /* For get_bitmask_order */
+#include <linux/log2.h>
 #include "ath5k.h"
 #include "reg.h"
 #include "base.h"
@@ -69,10 +69,10 @@ static inline int ath5k_hw_write_ofdm_timings(struct ath5k_hw *ah,
        /* Get exponent
         * ALGO: coef_exp = 14 - highest set bit position */
-        coef_exp = get_bitmask_order(coef_scaled);
+        coef_exp = ilog2(coef_scaled);
        /* Doesn't make sense if it's zero*/
-        if (!coef_exp)
+        if (!coef_scaled || !coef_exp)
                return -EINVAL;
        /* Note: we've shifted coef_scaled by 24 */
@@ -359,7 +359,7 @@ int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial)
                        mode |= AR5K_PHY_MODE_FREQ_5GHZ;
                        if (ah->ah_radio == AR5K_RF5413)
-                                clock |= AR5K_PHY_PLL_40MHZ_5413;
+                                clock = AR5K_PHY_PLL_40MHZ_5413;
                        else
                                clock |= AR5K_PHY_PLL_40MHZ;
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index e5ca2511a81a..9452461ce864 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -46,7 +46,7 @@
 #include "iwl-6000-hw.h"
 /* Highest firmware API version supported */
-#define IWL5000_UCODE_API_MAX 1
+#define IWL5000_UCODE_API_MAX 2
 #define IWL5150_UCODE_API_MAX 2
 /* Lowest firmware API version supported */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 3bb28db4a40f..f46ba2475776 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -669,13 +669,6 @@ static int iwl_set_mode(struct iwl_priv *priv, int mode)
        if (!iwl_is_ready_rf(priv))
                return -EAGAIN;
-        cancel_delayed_work(&priv->scan_check);
-        if (iwl_scan_cancel_timeout(priv, 100)) {
-                IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
-                IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
-                return -EAGAIN;
-        }
        iwl_commit_rxon(priv);
        return 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index e7c65c4f741b..6330b91e37ce 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -227,9 +227,6 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
        /* The HW is no longer scanning */
        clear_bit(STATUS_SCAN_HW, &priv->status);
-        /* The scan completion notification came in, so kill that timer... */
-        cancel_delayed_work(&priv->scan_check);
        IWL_DEBUG_INFO(priv, "Scan pass on %sGHz took %dms\n",
                       (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
                                                "2.4" : "5.2",
@@ -712,6 +709,8 @@ static void iwl_bg_request_scan(struct work_struct *data)
        mutex_lock(&priv->mutex);
+        cancel_delayed_work(&priv->scan_check);
        if (!iwl_is_ready(priv)) {
                IWL_WARN(priv, "request scan called when driver not ready.\n");
                goto done;
@@ -925,6 +924,8 @@ void iwl_bg_scan_completed(struct work_struct *work)
        IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
+        cancel_delayed_work(&priv->scan_check);
        ieee80211_scan_completed(priv->hw, false);
        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 4cce66133500..ff4d0e41d7c4 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -782,13 +782,6 @@ static int iwl3945_set_mode(struct iwl_priv *priv, int mode)
        if (!iwl_is_ready_rf(priv))
                return -EAGAIN;
-        cancel_delayed_work(&priv->scan_check);
-        if (iwl_scan_cancel_timeout(priv, 100)) {
-                IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
-                IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
-                return -EAGAIN;
-        }
        iwl3945_commit_rxon(priv);
        return 0;
@@ -3298,6 +3291,8 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
        mutex_lock(&priv->mutex);
+        cancel_delayed_work(&priv->scan_check);
        if (!iwl_is_ready(priv)) {
                IWL_WARN(priv, "request scan called when driver not ready.\n");
                goto done;
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index 07d378ef0b46..7b3ee8c2eaef 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -138,7 +138,7 @@ void rt2x00debug_update_crypto(struct rt2x00_dev *rt2x00dev,
        if (cipher == CIPHER_TKIP_NO_MIC)
                cipher = CIPHER_TKIP;
-        if (cipher == CIPHER_NONE || cipher > CIPHER_MAX)
+        if (cipher == CIPHER_NONE || cipher >= CIPHER_MAX)
                return;
        /* Remove CIPHER_NONE index */
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
index f0e99d4c066b..242257b19441 100644
--- a/drivers/oprofile/cpu_buffer.c
+++ b/drivers/oprofile/cpu_buffer.c
@@ -78,16 +78,20 @@ void free_cpu_buffers(void)
        op_ring_buffer_write = NULL;
 }
+#define RB_EVENT_HDR_SIZE 4
 int alloc_cpu_buffers(void)
 {
        int i;
        unsigned long buffer_size = oprofile_cpu_buffer_size;
+        unsigned long byte_size = buffer_size * (sizeof(struct op_sample) +
+                                                 RB_EVENT_HDR_SIZE);
-        op_ring_buffer_read = ring_buffer_alloc(buffer_size, OP_BUFFER_FLAGS);
+        op_ring_buffer_read = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
        if (!op_ring_buffer_read)
                goto fail;
-        op_ring_buffer_write = ring_buffer_alloc(buffer_size, OP_BUFFER_FLAGS);
+        op_ring_buffer_write = ring_buffer_alloc(byte_size, OP_BUFFER_FLAGS);
        if (!op_ring_buffer_write)
                goto fail;
diff --git a/drivers/parport/parport_gsc.c b/drivers/parport/parport_gsc.c
index e6a7e847ee80..ea31a452b153 100644
--- a/drivers/parport/parport_gsc.c
+++ b/drivers/parport/parport_gsc.c
@@ -352,8 +352,8 @@ static int __devinit parport_init_chip(struct parisc_device *dev)
        unsigned long port;
        if (!dev->irq) {
-                printk(KERN_WARNING "IRQ not found for parallel device at 0x%lx\n",
+                printk(KERN_WARNING "IRQ not found for parallel device at 0x%llx\n",
-                        dev->hpa.start);
+                        (unsigned long long)dev->hpa.start);
                return -ENODEV;
        }
diff --git a/drivers/pci/hotplug/acpiphp.h b/drivers/pci/hotplug/acpiphp.h
index 4fc168b70095..e68d5f20ffb3 100644
--- a/drivers/pci/hotplug/acpiphp.h
+++ b/drivers/pci/hotplug/acpiphp.h
@@ -129,7 +129,6 @@ struct acpiphp_func {
        struct acpiphp_bridge *bridge;  /* Ejectable PCI-to-PCI bridge */
        struct list_head sibling;
-        struct pci_dev *pci_dev;
        struct notifier_block nb;
        acpi_handle     handle;
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index a33794d9e0dc..3a6064bce561 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -32,9 +32,6 @@
 /*
 * Lifetime rules for pci_dev:
- *  - The one in acpiphp_func has its refcount elevated by pci_get_slot()
- *    when the driver is loaded or when an insertion event occurs.  It loses
- *    a refcount when its ejected or the driver unloads.
 *  - The one in acpiphp_bridge has its refcount elevated by pci_get_slot()
 *    when the bridge is scanned and it loses a refcount when the bridge
 *    is removed.
@@ -130,6 +127,7 @@ register_slot(acpi_handle handle, u32 lvl, void *context, void **rv)
        unsigned long long adr, sun;
        int device, function, retval;
        struct pci_bus *pbus = bridge->pci_bus;
+        struct pci_dev *pdev;
        if (!acpi_pci_check_ejectable(pbus, handle) && !is_dock_device(handle))
                return AE_OK;
@@ -213,10 +211,10 @@ register_slot(acpi_handle handle, u32 lvl, void *context, void **rv)
        newfunc->slot = slot;
        list_add_tail(&newfunc->sibling, &slot->funcs);
-        /* associate corresponding pci_dev */
+        pdev = pci_get_slot(pbus, PCI_DEVFN(device, function));
-        newfunc->pci_dev = pci_get_slot(pbus, PCI_DEVFN(device, function));
+        if (pdev) {
-        if (newfunc->pci_dev) {
                slot->flags |= (SLOT_ENABLED | SLOT_POWEREDON);
+                pci_dev_put(pdev);
        }
        if (is_dock_device(handle)) {
@@ -617,7 +615,6 @@ static void cleanup_bridge(struct acpiphp_bridge *bridge)
                                if (ACPI_FAILURE(status))
                                        err("failed to remove notify handler\n");
                        }
-                        pci_dev_put(func->pci_dev);
                        list_del(list);
                        kfree(func);
                }
@@ -1101,22 +1098,24 @@ static int __ref enable_device(struct acpiphp_slot *slot)
        pci_enable_bridges(bus);
        pci_bus_add_devices(bus);
-        /* associate pci_dev to our representation */
        list_for_each (l, &slot->funcs) {
                func = list_entry(l, struct acpiphp_func, sibling);
-                func->pci_dev = pci_get_slot(bus, PCI_DEVFN(slot->device,
+                dev = pci_get_slot(bus, PCI_DEVFN(slot->device,
-                                                        func->function));
+                                                  func->function));
-                if (!func->pci_dev)
+                if (!dev)
                        continue;
-                if (func->pci_dev->hdr_type != PCI_HEADER_TYPE_BRIDGE &&
+                if (dev->hdr_type != PCI_HEADER_TYPE_BRIDGE &&
-                    func->pci_dev->hdr_type != PCI_HEADER_TYPE_CARDBUS)
+                    dev->hdr_type != PCI_HEADER_TYPE_CARDBUS) {
+                        pci_dev_put(dev);
                        continue;
+                }
                status = find_p2p_bridge(func->handle, (u32)1, bus, NULL);
                if (ACPI_FAILURE(status))
                        warn("find_p2p_bridge failed (error code = 0x%x)\n",
                                status);
+                pci_dev_put(dev);
        }
        slot->flags |= SLOT_ENABLED;
@@ -1142,17 +1141,14 @@ static void disable_bridges(struct pci_bus *bus)
 */
 static int disable_device(struct acpiphp_slot *slot)
 {
-        int retval = 0;
        struct acpiphp_func *func;
-        struct list_head *l;
+        struct pci_dev *pdev;
        /* is this slot already disabled? */
        if (!(slot->flags & SLOT_ENABLED))
                goto err_exit;
-        list_for_each (l, &slot->funcs) {
+        list_for_each_entry(func, &slot->funcs, sibling) {
-                func = list_entry(l, struct acpiphp_func, sibling);
                if (func->bridge) {
                        /* cleanup p2p bridges under this P2P bridge */
                        cleanup_p2p_bridge(func->bridge->handle,
@@ -1160,35 +1156,28 @@ static int disable_device(struct acpiphp_slot *slot)
                        func->bridge = NULL;
                }
-                if (func->pci_dev) {
+                pdev = pci_get_slot(slot->bridge->pci_bus,
-                        pci_stop_bus_device(func->pci_dev);
+                                    PCI_DEVFN(slot->device, func->function));
-                        if (func->pci_dev->subordinate) {
+                if (pdev) {
-                                disable_bridges(func->pci_dev->subordinate);
+                        pci_stop_bus_device(pdev);
-                                pci_disable_device(func->pci_dev);
+                        if (pdev->subordinate) {
+                                disable_bridges(pdev->subordinate);
+                                pci_disable_device(pdev);
                        }
+                        pci_remove_bus_device(pdev);
+                        pci_dev_put(pdev);
                }
        }
-        list_for_each (l, &slot->funcs) {
+        list_for_each_entry(func, &slot->funcs, sibling) {
-                func = list_entry(l, struct acpiphp_func, sibling);
                acpiphp_unconfigure_ioapics(func->handle);
                acpiphp_bus_trim(func->handle);
-                /* try to remove anyway.
-                 * acpiphp_bus_add might have been failed */
-                if (!func->pci_dev)
-                        continue;
-                pci_remove_bus_device(func->pci_dev);
-                pci_dev_put(func->pci_dev);
-                func->pci_dev = NULL;
        }
        slot->flags &= (~SLOT_ENABLED);
- err_exit:
+err_exit:
-        return retval;
+        return 0;
 }
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index b4b39811b445..a0127e93ade0 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -137,6 +137,7 @@ struct uart_8250_port {
        unsigned char           mcr;
        unsigned char           mcr_mask;       /* mask of user bits */
        unsigned char           mcr_force;      /* mask of forced bits */
+        unsigned char           cur_iotype;     /* Running I/O type */
        /*
         * Some bits in registers are cleared on a read, so they must
@@ -471,6 +472,7 @@ static void io_serial_out(struct uart_port *p, int offset, int value)
 static void set_io_from_upio(struct uart_port *p)
 {
+        struct uart_8250_port *up = (struct uart_8250_port *)p;
        switch (p->iotype) {
        case UPIO_HUB6:
                p->serial_in = hub6_serial_in;
@@ -509,6 +511,8 @@ static void set_io_from_upio(struct uart_port *p)
                p->serial_out = io_serial_out;
                break;
        }
+        /* Remember loaded iotype */
+        up->cur_iotype = p->iotype;
 }
 static void
@@ -1937,6 +1941,9 @@ static int serial8250_startup(struct uart_port *port)
        up->capabilities = uart_config[up->port.type].flags;
        up->mcr = 0;
+        if (up->port.iotype != up->cur_iotype)
+                set_io_from_upio(port);
        if (up->port.type == PORT_16C950) {
                /* Wake up and initialize UART */
                up->acr = 0;
@@ -2563,6 +2570,9 @@ static void serial8250_config_port(struct uart_port *port, int flags)
        if (ret < 0)
                probeflags &= ~PROBE_RSA;
+        if (up->port.iotype != up->cur_iotype)
+                set_io_from_upio(port);
        if (flags & UART_CONFIG_TYPE)
                autoconfig(up, probeflags);
        if (up->port.type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ)
@@ -2671,6 +2681,11 @@ serial8250_register_ports(struct uart_driver *drv, struct device *dev)
 {
        int i;
+        for (i = 0; i < nr_uarts; i++) {
+                struct uart_8250_port *up = &serial8250_ports[i];
+                up->cur_iotype = 0xFF;
+        }
        serial8250_isa_init_ports();
        for (i = 0; i < nr_uarts; i++) {
diff --git a/drivers/serial/8250_gsc.c b/drivers/serial/8250_gsc.c
index 418b4fe9a0a1..33149d982e82 100644
--- a/drivers/serial/8250_gsc.c
+++ b/drivers/serial/8250_gsc.c
@@ -39,9 +39,9 @@ static int __init serial_init_chip(struct parisc_device *dev)
                 */
                if (parisc_parent(dev)->id.hw_type != HPHW_IOA)
                        printk(KERN_INFO
-                                "Serial: device 0x%lx not configured.\n"
+                                "Serial: device 0x%llx not configured.\n"
                                "Enable support for Wax, Lasi, Asp or Dino.\n",
-                                dev->hpa.start);
+                                (unsigned long long)dev->hpa.start);
                return -ENODEV;
        }
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 7f72f8ceaa6f..b3feb6198d57 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -988,7 +988,7 @@ mpc52xx_console_setup(struct console *co, char *options)
        pr_debug("mpc52xx_console_setup co=%p, co->index=%i, options=%s\n",
                 co, co->index, options);
-        if ((co->index < 0) || (co->index > MPC52xx_PSC_MAXNUM)) {
+        if ((co->index < 0) || (co->index >= MPC52xx_PSC_MAXNUM)) {
                pr_debug("PSC%x out of range\n", co->index);
                return -EINVAL;
        }
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 0716cdb44cd8..0a3dc5ece634 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -11,7 +11,6 @@ obj-$(CONFIG_USB_MON)		+= mon/
 obj-$(CONFIG_PCI)               += host/
 obj-$(CONFIG_USB_EHCI_HCD)      += host/
 obj-$(CONFIG_USB_ISP116X_HCD)   += host/
-obj-$(CONFIG_USB_ISP1760_HCD)   += host/
 obj-$(CONFIG_USB_OHCI_HCD)      += host/
 obj-$(CONFIG_USB_UHCI_HCD)      += host/
 obj-$(CONFIG_USB_FHCI_HCD)      += host/
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 0a69c0977e3f..7a1164dd1d37 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1375,6 +1375,9 @@ static struct usb_device_id acm_ids[] = {
        { USB_DEVICE(0x0572, 0x1324), /* Conexant USB MODEM RD02-D400 */
        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
        },
+        { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
+        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+        },
        { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
        },
        { USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
index 563d57275448..05c913cc3658 100644
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -794,7 +794,8 @@ usba_ep_queue(struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
        if (ep->desc) {
                list_add_tail(&req->queue, &ep->queue);
-                if (ep->is_in || (ep_is_control(ep)
+                if ((!ep_is_control(ep) && ep->is_in) ||
+                        (ep_is_control(ep)
                                && (ep->state == DATA_STAGE_IN
                                        || ep->state == STATUS_STAGE_IN)))
                        usba_ep_writel(ep, CTL_ENB, USBA_TX_PK_RDY);
@@ -1940,7 +1941,7 @@ static int __init usba_udc_probe(struct platform_device *pdev)
        usba_writel(udc, CTRL, USBA_DISABLE_MASK);
        clk_disable(pclk);
-        usba_ep = kmalloc(sizeof(struct usba_ep) * pdata->num_ep,
+        usba_ep = kzalloc(sizeof(struct usba_ep) * pdata->num_ep,
                          GFP_KERNEL);
        if (!usba_ep)
                goto err_alloc_ep;
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index cd07ea3f0c63..15438469f21a 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -1658,6 +1658,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
        u32 reg_base, or_reg, skip_reg;
        unsigned long flags;
        struct ptd ptd;
+        packet_enqueue *pe;
        switch (usb_pipetype(urb->pipe)) {
        case PIPE_ISOCHRONOUS:
@@ -1669,6 +1670,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                reg_base = INT_REGS_OFFSET;
                or_reg = HC_INT_IRQ_MASK_OR_REG;
                skip_reg = HC_INT_PTD_SKIPMAP_REG;
+                pe = enqueue_an_INT_packet;
                break;
        default:
@@ -1676,6 +1678,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                reg_base = ATL_REGS_OFFSET;
                or_reg = HC_ATL_IRQ_MASK_OR_REG;
                skip_reg = HC_ATL_PTD_SKIPMAP_REG;
+                pe =  enqueue_an_ATL_packet;
                break;
        }
@@ -1687,6 +1690,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                        u32 skip_map;
                        u32 or_map;
                        struct isp1760_qtd *qtd;
+                        struct isp1760_qh *qh = ints->qh;
                        skip_map = isp1760_readl(hcd->regs + skip_reg);
                        skip_map |= 1 << i;
@@ -1699,8 +1703,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                        priv_write_copy(priv, (u32 *)&ptd, hcd->regs + reg_base
                                        + i * sizeof(ptd), sizeof(ptd));
                        qtd = ints->qtd;
+                        qtd = clean_up_qtdlist(qtd);
-                        clean_up_qtdlist(qtd);
                        free_mem(priv, ints->payload);
@@ -1711,7 +1714,24 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
                        ints->payload = 0;
                        isp1760_urb_done(priv, urb, status);
+                        if (qtd)
+                                pe(hcd, qh, qtd);
                        break;
+                } else if (ints->qtd) {
+                        struct isp1760_qtd *qtd, *prev_qtd = ints->qtd;
+                        for (qtd = ints->qtd->hw_next; qtd; qtd = qtd->hw_next) {
+                                if (qtd->urb == urb) {
+                                        prev_qtd->hw_next = clean_up_qtdlist(qtd);
+                                        isp1760_urb_done(priv, urb, status);
+                                        break;
+                                }
+                                prev_qtd = qtd;
+                        }
+                        /* we found the urb before the end of the list */
+                        if (qtd)
+                                break;
                }
                ints++;
        }
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 0a566eea49c0..f331e2bde88a 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -974,6 +974,7 @@ int usb_serial_probe(struct usb_interface *interface,
                if (retval > 0) {
                        /* quietly accept this device, but don't bind to a
                           serial port as it's about to disappear */
+                        serial->num_ports = 0;
                        goto exit;
                }
        }
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index 9a577a800db5..2fb63f6ea2f1 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -29,14 +29,8 @@
 /* configurable parameters */
 #define ATMEL_LCDC_CVAL_DEFAULT         0xc8
-#define ATMEL_LCDC_DMA_BURST_LEN        8
+#define ATMEL_LCDC_DMA_BURST_LEN        8       /* words */
+#define ATMEL_LCDC_FIFO_SIZE            512     /* words */
-#if defined(CONFIG_ARCH_AT91SAM9263) || defined(CONFIG_ARCH_AT91CAP9) || \
-        defined(CONFIG_ARCH_AT91SAM9RL)
-#define ATMEL_LCDC_FIFO_SIZE            2048
-#else
-#define ATMEL_LCDC_FIFO_SIZE            512
-#endif
 #if defined(CONFIG_ARCH_AT91)
 #define ATMEL_LCDFB_FBINFO_DEFAULT      (FBINFO_DEFAULT \
diff --git a/drivers/video/s3c-fb.c b/drivers/video/s3c-fb.c
index 5e9c6302433b..d3a568e6b169 100644
--- a/drivers/video/s3c-fb.c
+++ b/drivers/video/s3c-fb.c
@@ -947,7 +947,8 @@ static int __devexit s3c_fb_remove(struct platform_device *pdev)
        int win;
        for (win = 0; win <= S3C_FB_MAX_WIN; win++)
-                s3c_fb_release_win(sfb, sfb->windows[win]);
+                if (sfb->windows[win])
+                        s3c_fb_release_win(sfb, sfb->windows[win]);
        iounmap(sfb->regs);
@@ -985,11 +986,20 @@ static int s3c_fb_suspend(struct platform_device *pdev, pm_message_t state)
 static int s3c_fb_resume(struct platform_device *pdev)
 {
        struct s3c_fb *sfb = platform_get_drvdata(pdev);
+        struct s3c_fb_platdata *pd = sfb->pdata;
        struct s3c_fb_win *win;
        int win_no;
        clk_enable(sfb->bus_clk);
+        /* setup registers */
+        writel(pd->vidcon1, sfb->regs + VIDCON1);
+        /* zero all windows before we do anything */
+        for (win_no = 0; win_no < S3C_FB_MAX_WIN; win_no++)
+                s3c_fb_clear_win(sfb, win_no);
+        /* restore framebuffers */
        for (win_no = 0; win_no < S3C_FB_MAX_WIN; win_no++) {
                win = sfb->windows[win_no];
                if (!win)
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index 5cebf0b37798..697f6b5f1313 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -41,6 +41,7 @@
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
 #include <asm/cacheflush.h>
+#include <asm/page.h>
 /****************************************************************************/
@@ -54,6 +55,18 @@
 #define DBG_FLT(a...)
 #endif
+/*
+ * User data (stack, data section and bss) needs to be aligned
+ * for the same reasons as SLAB memory is, and to the same amount.
+ * Avoid duplicating architecture specific code by using the same
+ * macro as with SLAB allocation:
+ */
+#ifdef ARCH_SLAB_MINALIGN
+#define FLAT_DATA_ALIGN (ARCH_SLAB_MINALIGN)
+#else
+#define FLAT_DATA_ALIGN (sizeof(void *))
+#endif
 #define RELOC_FAILED 0xff00ff01         /* Relocation incorrect somewhere */
 #define UNLOADED_LIB 0x7ff000ff         /* Placeholder for unused library */
@@ -114,20 +127,18 @@ static unsigned long create_flat_tables(
        int envc = bprm->envc;
        char uninitialized_var(dummy);
-        sp = (unsigned long *) ((-(unsigned long)sizeof(char *))&(unsigned long) p);
+        sp = (unsigned long *)p;
+        sp -= (envc + argc + 2) + 1 + (flat_argvp_envp_on_stack() ? 2 : 0);
+        sp = (unsigned long *) ((unsigned long)sp & -FLAT_DATA_ALIGN);
+        argv = sp + 1 + (flat_argvp_envp_on_stack() ? 2 : 0);
+        envp = argv + (argc + 1);
-        sp -= envc+1;
-        envp = sp;
-        sp -= argc+1;
-        argv = sp;
-        flat_stack_align(sp);
        if (flat_argvp_envp_on_stack()) {
-                --sp; put_user((unsigned long) envp, sp);
+                put_user((unsigned long) envp, sp + 2);
-                --sp; put_user((unsigned long) argv, sp);
+                put_user((unsigned long) argv, sp + 1);
        }
-        put_user(argc,--sp);
+        put_user(argc, sp);
        current->mm->arg_start = (unsigned long) p;
        while (argc-->0) {
                put_user((unsigned long) p, argv++);
@@ -558,7 +569,9 @@ static int load_flat_file(struct linux_binprm * bprm,
                        ret = realdatastart;
                        goto err;
                }
-                datapos = realdatastart + MAX_SHARED_LIBS * sizeof(unsigned long);
+                datapos = ALIGN(realdatastart +
+                                MAX_SHARED_LIBS * sizeof(unsigned long),
+                                FLAT_DATA_ALIGN);
                DBG_FLT("BINFMT_FLAT: Allocated data+bss+stack (%d bytes): %x\n",
                                (int)(data_len + bss_len + stack_len), (int)datapos);
@@ -604,9 +617,12 @@ static int load_flat_file(struct linux_binprm * bprm,
                }
                realdatastart = textpos + ntohl(hdr->data_start);
-                datapos = realdatastart + MAX_SHARED_LIBS * sizeof(unsigned long);
+                datapos = ALIGN(realdatastart +
-                reloc = (unsigned long *) (textpos + ntohl(hdr->reloc_start) +
+                                MAX_SHARED_LIBS * sizeof(unsigned long),
-                                MAX_SHARED_LIBS * sizeof(unsigned long));
+                                FLAT_DATA_ALIGN);
+                reloc = (unsigned long *)
+                        (datapos + (ntohl(hdr->reloc_start) - text_len));
                memp = textpos;
                memp_size = len;
 #ifdef CONFIG_BINFMT_ZFLAT
@@ -854,7 +870,7 @@ static int load_flat_binary(struct linux_binprm * bprm, struct pt_regs * regs)
        stack_len = TOP_OF_ARGS - bprm->p;             /* the strings */
        stack_len += (bprm->argc + 1) * sizeof(char *); /* the argv array */
        stack_len += (bprm->envc + 1) * sizeof(char *); /* the envp array */
+        stack_len += FLAT_DATA_ALIGN - 1;  /* reserve for upcoming alignment */
        
        res = load_flat_file(bprm, &libinfo, 0, &stack_len);
        if (res > (unsigned long)-4096)
diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
index 19218e1463d6..f7c255f9c624 100644
--- a/fs/cachefiles/internal.h
+++ b/fs/cachefiles/internal.h
@@ -122,13 +122,13 @@ static inline void cachefiles_state_changed(struct cachefiles_cache *cache)
 }
 /*
- * cf-bind.c
+ * bind.c
 */
 extern int cachefiles_daemon_bind(struct cachefiles_cache *cache, char *args);
 extern void cachefiles_daemon_unbind(struct cachefiles_cache *cache);
 /*
- * cf-daemon.c
+ * daemon.c
 */
 extern const struct file_operations cachefiles_daemon_fops;
@@ -136,17 +136,17 @@ extern int cachefiles_has_space(struct cachefiles_cache *cache,
                                unsigned fnr, unsigned bnr);
 /*
- * cf-interface.c
+ * interface.c
 */
 extern const struct fscache_cache_ops cachefiles_cache_ops;
 /*
- * cf-key.c
+ * key.c
 */
 extern char *cachefiles_cook_key(const u8 *raw, int keylen, uint8_t type);
 /*
- * cf-namei.c
+ * namei.c
 */
 extern int cachefiles_delete_object(struct cachefiles_cache *cache,
                                    struct cachefiles_object *object);
@@ -165,7 +165,7 @@ extern int cachefiles_check_in_use(struct cachefiles_cache *cache,
                                   struct dentry *dir, char *filename);
 /*
- * cf-proc.c
+ * proc.c
 */
 #ifdef CONFIG_CACHEFILES_HISTOGRAM
 extern atomic_t cachefiles_lookup_histogram[HZ];
@@ -190,7 +190,7 @@ void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
 #endif
 /*
- * cf-rdwr.c
+ * rdwr.c
 */
 extern int cachefiles_read_or_alloc_page(struct fscache_retrieval *,
                                         struct page *, gfp_t);
@@ -205,7 +205,7 @@ extern int cachefiles_write_page(struct fscache_storage *, struct page *);
 extern void cachefiles_uncache_page(struct fscache_object *, struct page *);
 /*
- * cf-security.c
+ * security.c
 */
 extern int cachefiles_get_security_ID(struct cachefiles_cache *cache);
 extern int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
@@ -225,7 +225,7 @@ static inline void cachefiles_end_secure(struct cachefiles_cache *cache,
 }
 /*
- * cf-xattr.c
+ * xattr.c
 */
 extern int cachefiles_check_object_type(struct cachefiles_object *object);
 extern int cachefiles_set_object_xattr(struct cachefiles_object *object,
diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
index e0cbd16f6dc9..1c341304621f 100644
--- a/fs/fscache/internal.h
+++ b/fs/fscache/internal.h
@@ -28,7 +28,7 @@
 #define FSCACHE_MAX_THREADS     32
 /*
- * fsc-cache.c
+ * cache.c
 */
 extern struct list_head fscache_cache_list;
 extern struct rw_semaphore fscache_addremove_sem;
@@ -37,7 +37,7 @@ extern struct fscache_cache *fscache_select_cache_for_object(
        struct fscache_cookie *);
 /*
- * fsc-cookie.c
+ * cookie.c
 */
 extern struct kmem_cache *fscache_cookie_jar;
@@ -45,13 +45,13 @@ extern void fscache_cookie_init_once(void *);
 extern void __fscache_cookie_put(struct fscache_cookie *);
 /*
- * fsc-fsdef.c
+ * fsdef.c
 */
 extern struct fscache_cookie fscache_fsdef_index;
 extern struct fscache_cookie_def fscache_fsdef_netfs_def;
 /*
- * fsc-histogram.c
+ * histogram.c
 */
 #ifdef CONFIG_FSCACHE_HISTOGRAM
 extern atomic_t fscache_obj_instantiate_histogram[HZ];
@@ -75,7 +75,7 @@ extern const struct file_operations fscache_histogram_fops;
 #endif
 /*
- * fsc-main.c
+ * main.c
 */
 extern unsigned fscache_defer_lookup;
 extern unsigned fscache_defer_create;
@@ -86,14 +86,14 @@ extern int fscache_wait_bit(void *);
 extern int fscache_wait_bit_interruptible(void *);
 /*
- * fsc-object.c
+ * object.c
 */
 extern void fscache_withdrawing_object(struct fscache_cache *,
                                       struct fscache_object *);
 extern void fscache_enqueue_object(struct fscache_object *);
 /*
- * fsc-operation.c
+ * operation.c
 */
 extern int fscache_submit_exclusive_op(struct fscache_object *,
                                       struct fscache_operation *);
@@ -104,7 +104,7 @@ extern void fscache_start_operations(struct fscache_object *);
 extern void fscache_operation_gc(struct work_struct *);
 /*
- * fsc-proc.c
+ * proc.c
 */
 #ifdef CONFIG_PROC_FS
 extern int __init fscache_proc_init(void);
@@ -115,7 +115,7 @@ extern void fscache_proc_cleanup(void);
 #endif
 /*
- * fsc-stats.c
+ * stats.c
 */
 #ifdef CONFIG_FSCACHE_STATS
 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
index c32b4a1ad6cf..a0244740b75a 100644
--- a/fs/jffs2/erase.c
+++ b/fs/jffs2/erase.c
@@ -480,13 +480,6 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
        return;
 filebad:
-        mutex_lock(&c->erase_free_sem);
-        spin_lock(&c->erase_completion_lock);
-        /* Stick it on a list (any list) so erase_failed can take it
-           right off again.  Silly, but shouldn't happen often. */
-        list_move(&jeb->list, &c->erasing_list);
-        spin_unlock(&c->erase_completion_lock);
-        mutex_unlock(&c->erase_free_sem);
        jffs2_erase_failed(c, jeb, bad_offset);
        return;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index a4d242680299..4674f8092da8 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2594,12 +2594,9 @@ static void nfs4_renew_done(struct rpc_task *task, void *data)
        unsigned long timestamp = (unsigned long)data;
        if (task->tk_status < 0) {
-                switch (task->tk_status) {
+                /* Unless we're shutting down, schedule state recovery! */
-                        case -NFS4ERR_STALE_CLIENTID:
+                if (test_bit(NFS_CS_RENEWD, &clp->cl_res_state) != 0)
-                        case -NFS4ERR_EXPIRED:
+                        nfs4_schedule_state_recovery(clp);
-                        case -NFS4ERR_CB_PATH_DOWN:
-                                nfs4_schedule_state_recovery(clp);
-                }
                return;
        }
        spin_lock(&clp->cl_lock);
diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c
index d9ef602fbc5a..e3ed5908820b 100644
--- a/fs/nfs/nfsroot.c
+++ b/fs/nfs/nfsroot.c
@@ -129,7 +129,7 @@ enum {
        Opt_err
 };
-static match_table_t __initconst tokens = {
+static const match_table_t tokens __initconst = {
        {Opt_port, "port=%u"},
        {Opt_rsize, "rsize=%u"},
        {Opt_wsize, "wsize=%u"},
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 6c68ffd6b4bb..b660435978d2 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1015,6 +1015,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
        host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
        set_fs(oldfs);
        if (host_err >= 0) {
+                *cnt = host_err;
                nfsdstats.io_write += host_err;
                fsnotify_modify(file->f_path.dentry);
        }
@@ -1060,10 +1061,9 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
        }
        dprintk("nfsd: write complete host_err=%d\n", host_err);
-        if (host_err >= 0) {
+        if (host_err >= 0)
                err = 0;
-                *cnt = host_err;
+        else
-        } else
                err = nfserrno(host_err);
 out:
        return err;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index fb45615943c2..3326bbf9ab95 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1956,7 +1956,7 @@ static struct dentry *proc_pident_instantiate(struct inode *dir,
        const struct pid_entry *p = ptr;
        struct inode *inode;
        struct proc_inode *ei;
-        struct dentry *error = ERR_PTR(-EINVAL);
+        struct dentry *error = ERR_PTR(-ENOENT);
        inode = proc_pid_make_inode(dir->i_sb, task);
        if (!inode)
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index b1606e07b7a3..561a9c050cef 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -723,7 +723,7 @@ int sysfs_schedule_callback(struct kobject *kobj, void (*func)(void *),
        mutex_unlock(&sysfs_workq_mutex);
        if (sysfs_workqueue == NULL) {
-                sysfs_workqueue = create_workqueue("sysfsd");
+                sysfs_workqueue = create_singlethread_workqueue("sysfsd");
                if (sysfs_workqueue == NULL) {
                        module_put(owner);
                        return -ENOMEM;
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index c8c422151431..b84d8ae35e6f 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -1519,6 +1519,30 @@ static __inline__ void *drm_calloc(size_t nmemb, size_t size, int area)
 {
        return kcalloc(nmemb, size, GFP_KERNEL);
 }
+static __inline__ void *drm_calloc_large(size_t nmemb, size_t size)
+{
+        u8 *addr;
+        if (size <= PAGE_SIZE)
+            return kcalloc(nmemb, size, GFP_KERNEL);
+        addr = vmalloc(nmemb * size);
+        if (!addr)
+                return NULL;
+        memset(addr, 0, nmemb * size);
+        return addr;
+}
+static __inline void drm_free_large(void *ptr)
+{
+        if (!is_vmalloc_addr(ptr))
+                return kfree(ptr);
+        vfree(ptr);
+}
 #else
 extern void *drm_alloc(size_t size, int area);
 extern void drm_free(void *pt, size_t size, int area);
diff --git a/include/linux/cred.h b/include/linux/cred.h
index 3282ee4318e7..4fa999696310 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -13,6 +13,7 @@
 #define _LINUX_CRED_H
 #include <linux/capability.h>
+#include <linux/init.h>
 #include <linux/key.h>
 #include <asm/atomic.h>
diff --git a/include/linux/i7300_idle.h b/include/linux/i7300_idle.h
index 05a80c44513c..1587b7dec505 100644
--- a/include/linux/i7300_idle.h
+++ b/include/linux/i7300_idle.h
@@ -16,35 +16,33 @@
 struct fbd_ioat {
        unsigned int vendor;
        unsigned int ioat_dev;
+        unsigned int enabled;
 };
 /*
 * The i5000 chip-set has the same hooks as the i7300
- * but support is disabled by default because this driver
+ * but it is not enabled by default and must be manually
- * has not been validated on that platform.
+ * manually enabled with "forceload=1" because it is
+ * only lightly validated.
 */
-#define SUPPORT_I5000 0
 static const struct fbd_ioat fbd_ioat_list[] = {
-        {PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IOAT_CNB},
+        {PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IOAT_CNB, 1},
-#if SUPPORT_I5000
+        {PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IOAT, 0},
-        {PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IOAT},
-#endif
        {0, 0}
 };
 /* table of devices that work with this driver */
 static const struct pci_device_id pci_tbl[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_FBD_CNB) },
-#if SUPPORT_I5000
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5000_ERR) },
-#endif
        { } /* Terminating entry */
 };
 /* Check for known platforms with I/O-AT */
 static inline int i7300_idle_platform_probe(struct pci_dev **fbd_dev,
-                                                struct pci_dev **ioat_dev)
+                                                struct pci_dev **ioat_dev,
+                                                int enable_all)
 {
        int i;
        struct pci_dev *memdev, *dmadev;
@@ -69,6 +67,8 @@ static inline int i7300_idle_platform_probe(struct pci_dev **fbd_dev,
        for (i = 0; fbd_ioat_list[i].vendor != 0; i++) {
                if (dmadev->vendor == fbd_ioat_list[i].vendor &&
                    dmadev->device == fbd_ioat_list[i].ioat_dev) {
+                        if (!(fbd_ioat_list[i].enabled || enable_all))
+                                continue;
                        if (fbd_dev)
                                *fbd_dev = memdev;
                        if (ioat_dev)
diff --git a/include/linux/input.h b/include/linux/input.h
index 0e6ff5de3588..6fed4f6a9c9e 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -656,6 +656,7 @@ struct input_absinfo {
 #define ABS_MT_POSITION_Y       0x36    /* Center Y ellipse position */
 #define ABS_MT_TOOL_TYPE        0x37    /* Type of touching device */
 #define ABS_MT_BLOB_ID          0x38    /* Group a set of packets as a blob */
+#define ABS_MT_TRACKING_ID      0x39    /* Unique ID of initiated contact */
 #define ABS_MAX                 0x3f
 #define ABS_CNT                 (ABS_MAX+1)
diff --git a/include/linux/swap.h b/include/linux/swap.h
index 62d81435347a..d476aad3ff57 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -437,6 +437,11 @@ static inline int mem_cgroup_cache_charge_swapin(struct page *page,
        return 0;
 }
+static inline void
+mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent)
+{
+}
 #endif /* CONFIG_SWAP */
 #endif /* __KERNEL__*/
 #endif /* _LINUX_SWAP_H */
diff --git a/init/main.c b/init/main.c
index 3bbf93be744c..d721dad05dd7 100644
--- a/init/main.c
+++ b/init/main.c
@@ -566,8 +566,7 @@ asmlinkage void __init start_kernel(void)
        tick_init();
        boot_cpu_init();
        page_address_init();
-        printk(KERN_NOTICE);
+        printk(KERN_NOTICE "%s", linux_banner);
-        printk(linux_banner);
        setup_arch(&command_line);
        mm_init_owner(&init_mm, &init_task);
        setup_command_line(command_line);
diff --git a/kernel/async.c b/kernel/async.c
index 968ef9457d4e..50540301ed0f 100644
--- a/kernel/async.c
+++ b/kernel/async.c
@@ -92,19 +92,23 @@ extern int initcall_debug;
 static async_cookie_t  __lowest_in_progress(struct list_head *running)
 {
        struct async_entry *entry;
+        async_cookie_t ret = next_cookie; /* begin with "infinity" value */
        if (!list_empty(running)) {
                entry = list_first_entry(running,
                        struct async_entry, list);
-                return entry->cookie;
+                ret = entry->cookie;
-        } else if (!list_empty(&async_pending)) {
-                entry = list_first_entry(&async_pending,
-                        struct async_entry, list);
-                return entry->cookie;
-        } else {
-                /* nothing in progress... next_cookie is "infinity" */
-                return next_cookie;
        }
+        if (!list_empty(&async_pending)) {
+                list_for_each_entry(entry, &async_pending, list)
+                        if (entry->running == running) {
+                                ret = entry->cookie;
+                                break;
+                        }
+        }
+        return ret;
 }
 static async_cookie_t  lowest_in_progress(struct list_head *running)
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 5a758c6e4950..e4983770913b 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1451,7 +1451,6 @@ int kernel_kexec(void)
                error = device_suspend(PMSG_FREEZE);
                if (error)
                        goto Resume_console;
-                device_pm_lock();
                /* At this point, device_suspend() has been called,
                 * but *not* device_power_down(). We *must*
                 * device_power_down() now.  Otherwise, drivers for
@@ -1489,7 +1488,6 @@ int kernel_kexec(void)
                enable_nonboot_cpus();
                device_power_up(PMSG_RESTORE);
 Resume_devices:
-                device_pm_unlock();
                device_resume(PMSG_RESTORE);
 Resume_console:
                resume_console();
diff --git a/kernel/kmod.c b/kernel/kmod.c
index b750675251e5..7e95bedb2bfc 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -370,8 +370,10 @@ struct subprocess_info *call_usermodehelper_setup(char *path, char **argv,
        sub_info->argv = argv;
        sub_info->envp = envp;
        sub_info->cred = prepare_usermodehelper_creds();
-        if (!sub_info->cred)
+        if (!sub_info->cred) {
+                kfree(sub_info);
                return NULL;
+        }
  out:
        return sub_info;
diff --git a/kernel/power/disk.c b/kernel/power/disk.c
index b0dc9e7a0d17..5cb080e7eebd 100644
--- a/kernel/power/disk.c
+++ b/kernel/power/disk.c
@@ -215,8 +215,6 @@ static int create_image(int platform_mode)
        if (error)
                return error;
-        device_pm_lock();
        /* At this point, device_suspend() has been called, but *not*
         * device_power_down(). We *must* call device_power_down() now.
         * Otherwise, drivers for some devices (e.g. interrupt controllers)
@@ -227,7 +225,7 @@ static int create_image(int platform_mode)
        if (error) {
                printk(KERN_ERR "PM: Some devices failed to power down, "
                        "aborting hibernation\n");
-                goto Unlock;
+                return error;
        }
        error = platform_pre_snapshot(platform_mode);
@@ -280,9 +278,6 @@ static int create_image(int platform_mode)
        device_power_up(in_suspend ?
                (error ? PMSG_RECOVER : PMSG_THAW) : PMSG_RESTORE);
- Unlock:
-        device_pm_unlock();
        return error;
 }
@@ -344,13 +339,11 @@ static int resume_target_kernel(bool platform_mode)
 {
        int error;
-        device_pm_lock();
        error = device_power_down(PMSG_QUIESCE);
        if (error) {
                printk(KERN_ERR "PM: Some devices failed to power down, "
                        "aborting resume\n");
-                goto Unlock;
+                return error;
        }
        error = platform_pre_restore(platform_mode);
@@ -403,9 +396,6 @@ static int resume_target_kernel(bool platform_mode)
        device_power_up(PMSG_RECOVER);
- Unlock:
-        device_pm_unlock();
        return error;
 }
@@ -464,11 +454,9 @@ int hibernation_platform_enter(void)
                goto Resume_devices;
        }
-        device_pm_lock();
        error = device_power_down(PMSG_HIBERNATE);
        if (error)
-                goto Unlock;
+                goto Resume_devices;
        error = hibernation_ops->prepare();
        if (error)
@@ -493,9 +481,6 @@ int hibernation_platform_enter(void)
        device_power_up(PMSG_RESTORE);
- Unlock:
-        device_pm_unlock();
 Resume_devices:
        entering_platform_hibernation = false;
        device_resume(PMSG_RESTORE);
diff --git a/kernel/power/main.c b/kernel/power/main.c
index f99ed6a75eac..868028280d13 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -289,12 +289,10 @@ static int suspend_enter(suspend_state_t state)
 {
        int error;
-        device_pm_lock();
        if (suspend_ops->prepare) {
                error = suspend_ops->prepare();
                if (error)
-                        goto Done;
+                        return error;
        }
        error = device_power_down(PMSG_SUSPEND);
@@ -343,9 +341,6 @@ static int suspend_enter(suspend_state_t state)
        if (suspend_ops->finish)
                suspend_ops->finish();
- Done:
-        device_pm_unlock();
        return error;
 }
diff --git a/mm/filemap.c b/mm/filemap.c
index 379ff0bcbf6e..1b60f30cebfa 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -121,7 +121,6 @@ void __remove_from_page_cache(struct page *page)
        mapping->nrpages--;
        __dec_zone_page_state(page, NR_FILE_PAGES);
        BUG_ON(page_mapped(page));
-        mem_cgroup_uncharge_cache_page(page);
        /*
         * Some filesystems seem to re-dirty the page even after
@@ -145,6 +144,7 @@ void remove_from_page_cache(struct page *page)
        spin_lock_irq(&mapping->tree_lock);
        __remove_from_page_cache(page);
        spin_unlock_irq(&mapping->tree_lock);
+        mem_cgroup_uncharge_cache_page(page);
 }
 static int sync_page(void *word)
@@ -476,13 +476,13 @@ int add_to_page_cache_locked(struct page *page, struct address_space *mapping,
                if (likely(!error)) {
                        mapping->nrpages++;
                        __inc_zone_page_state(page, NR_FILE_PAGES);
+                        spin_unlock_irq(&mapping->tree_lock);
                } else {
                        page->mapping = NULL;
+                        spin_unlock_irq(&mapping->tree_lock);
                        mem_cgroup_uncharge_cache_page(page);
                        page_cache_release(page);
                }
-                spin_unlock_irq(&mapping->tree_lock);
                radix_tree_preload_end();
        } else
                mem_cgroup_uncharge_cache_page(page);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 28c655ba9353..e83ad2c9228c 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -316,7 +316,7 @@ static void resv_map_release(struct kref *ref)
 static struct resv_map *vma_resv_map(struct vm_area_struct *vma)
 {
        VM_BUG_ON(!is_vm_hugetlb_page(vma));
-        if (!(vma->vm_flags & VM_SHARED))
+        if (!(vma->vm_flags & VM_MAYSHARE))
                return (struct resv_map *)(get_vma_private_data(vma) &
                                                        ~HPAGE_RESV_MASK);
        return NULL;
@@ -325,7 +325,7 @@ static struct resv_map *vma_resv_map(struct vm_area_struct *vma)
 static void set_vma_resv_map(struct vm_area_struct *vma, struct resv_map *map)
 {
        VM_BUG_ON(!is_vm_hugetlb_page(vma));
-        VM_BUG_ON(vma->vm_flags & VM_SHARED);
+        VM_BUG_ON(vma->vm_flags & VM_MAYSHARE);
        set_vma_private_data(vma, (get_vma_private_data(vma) &
                                HPAGE_RESV_MASK) | (unsigned long)map);
@@ -334,7 +334,7 @@ static void set_vma_resv_map(struct vm_area_struct *vma, struct resv_map *map)
 static void set_vma_resv_flags(struct vm_area_struct *vma, unsigned long flags)
 {
        VM_BUG_ON(!is_vm_hugetlb_page(vma));
-        VM_BUG_ON(vma->vm_flags & VM_SHARED);
+        VM_BUG_ON(vma->vm_flags & VM_MAYSHARE);
        set_vma_private_data(vma, get_vma_private_data(vma) | flags);
 }
@@ -353,7 +353,7 @@ static void decrement_hugepage_resv_vma(struct hstate *h,
        if (vma->vm_flags & VM_NORESERVE)
                return;
-        if (vma->vm_flags & VM_SHARED) {
+        if (vma->vm_flags & VM_MAYSHARE) {
                /* Shared mappings always use reserves */
                h->resv_huge_pages--;
        } else if (is_vma_resv_set(vma, HPAGE_RESV_OWNER)) {
@@ -369,14 +369,14 @@ static void decrement_hugepage_resv_vma(struct hstate *h,
 void reset_vma_resv_huge_pages(struct vm_area_struct *vma)
 {
        VM_BUG_ON(!is_vm_hugetlb_page(vma));
-        if (!(vma->vm_flags & VM_SHARED))
+        if (!(vma->vm_flags & VM_MAYSHARE))
                vma->vm_private_data = (void *)0;
 }
 /* Returns true if the VMA has associated reserve pages */
 static int vma_has_reserves(struct vm_area_struct *vma)
 {
-        if (vma->vm_flags & VM_SHARED)
+        if (vma->vm_flags & VM_MAYSHARE)
                return 1;
        if (is_vma_resv_set(vma, HPAGE_RESV_OWNER))
                return 1;
@@ -924,7 +924,7 @@ static long vma_needs_reservation(struct hstate *h,
        struct address_space *mapping = vma->vm_file->f_mapping;
        struct inode *inode = mapping->host;
-        if (vma->vm_flags & VM_SHARED) {
+        if (vma->vm_flags & VM_MAYSHARE) {
                pgoff_t idx = vma_hugecache_offset(h, vma, addr);
                return region_chg(&inode->i_mapping->private_list,
                                                        idx, idx + 1);
@@ -949,7 +949,7 @@ static void vma_commit_reservation(struct hstate *h,
        struct address_space *mapping = vma->vm_file->f_mapping;
        struct inode *inode = mapping->host;
-        if (vma->vm_flags & VM_SHARED) {
+        if (vma->vm_flags & VM_MAYSHARE) {
                pgoff_t idx = vma_hugecache_offset(h, vma, addr);
                region_add(&inode->i_mapping->private_list, idx, idx + 1);
@@ -1893,7 +1893,7 @@ retry_avoidcopy:
         * at the time of fork() could consume its reserves on COW instead
         * of the full address range.
         */
-        if (!(vma->vm_flags & VM_SHARED) &&
+        if (!(vma->vm_flags & VM_MAYSHARE) &&
                        is_vma_resv_set(vma, HPAGE_RESV_OWNER) &&
                        old_page != pagecache_page)
                outside_reserve = 1;
@@ -2000,7 +2000,7 @@ retry:
                clear_huge_page(page, address, huge_page_size(h));
                __SetPageUptodate(page);
-                if (vma->vm_flags & VM_SHARED) {
+                if (vma->vm_flags & VM_MAYSHARE) {
                        int err;
                        struct inode *inode = mapping->host;
@@ -2104,7 +2104,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                        goto out_mutex;
                }
-                if (!(vma->vm_flags & VM_SHARED))
+                if (!(vma->vm_flags & VM_MAYSHARE))
                        pagecache_page = hugetlbfs_pagecache_page(h,
                                                                vma, address);
        }
@@ -2289,7 +2289,7 @@ int hugetlb_reserve_pages(struct inode *inode,
         * to reserve the full area even if read-only as mprotect() may be
         * called to make the mapping read-write. Assume !vma is a shm mapping
         */
-        if (!vma || vma->vm_flags & VM_SHARED)
+        if (!vma || vma->vm_flags & VM_MAYSHARE)
                chg = region_chg(&inode->i_mapping->private_list, from, to);
        else {
                struct resv_map *resv_map = resv_map_alloc();
@@ -2330,7 +2330,7 @@ int hugetlb_reserve_pages(struct inode *inode,
         * consumed reservations are stored in the map. Hence, nothing
         * else has to be done for private mappings here
         */
-        if (!vma || vma->vm_flags & VM_SHARED)
+        if (!vma || vma->vm_flags & VM_MAYSHARE)
                region_add(&inode->i_mapping->private_list, from, to);
        return 0;
 }
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 01c2d8f14685..78eb8552818b 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -314,14 +314,6 @@ static struct mem_cgroup *try_get_mem_cgroup_from_mm(struct mm_struct *mm)
        return mem;
 }
-static bool mem_cgroup_is_obsolete(struct mem_cgroup *mem)
-{
-        if (!mem)
-                return true;
-        return css_is_removed(&mem->css);
-}
 /*
 * Call callback function against all cgroup under hierarchy tree.
 */
@@ -932,7 +924,7 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
        if (unlikely(!mem))
                return 0;
-        VM_BUG_ON(!mem || mem_cgroup_is_obsolete(mem));
+        VM_BUG_ON(css_is_removed(&mem->css));
        while (1) {
                int ret;
@@ -1488,8 +1480,9 @@ void mem_cgroup_uncharge_cache_page(struct page *page)
        __mem_cgroup_uncharge_common(page, MEM_CGROUP_CHARGE_TYPE_CACHE);
 }
+#ifdef CONFIG_SWAP
 /*
- * called from __delete_from_swap_cache() and drop "page" account.
+ * called after __delete_from_swap_cache() and drop "page" account.
 * memcg information is recorded to swap_cgroup of "ent"
 */
 void mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent)
@@ -1506,6 +1499,7 @@ void mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent)
        if (memcg)
                css_put(&memcg->css);
 }
+#endif
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
 /*
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 92bcf1db16b2..a7b2460e922b 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -284,22 +284,28 @@ static void dump_tasks(const struct mem_cgroup *mem)
        printk(KERN_INFO "[ pid ]   uid  tgid total_vm      rss cpu oom_adj "
               "name\n");
        do_each_thread(g, p) {
-                /*
+                struct mm_struct *mm;
-                 * total_vm and rss sizes do not exist for tasks with a
-                 * detached mm so there's no need to report them.
-                 */
-                if (!p->mm)
-                        continue;
                if (mem && !task_in_mem_cgroup(p, mem))
                        continue;
                if (!thread_group_leader(p))
                        continue;
                task_lock(p);
+                mm = p->mm;
+                if (!mm) {
+                        /*
+                         * total_vm and rss sizes do not exist for tasks with no
+                         * mm so there's no need to report them; they can't be
+                         * oom killed anyway.
+                         */
+                        task_unlock(p);
+                        continue;
+                }
                printk(KERN_INFO "[%5d] %5d %5d %8lu %8lu %3d     %3d %s\n",
-                       p->pid, __task_cred(p)->uid, p->tgid,
+                       p->pid, __task_cred(p)->uid, p->tgid, mm->total_vm,
-                       p->mm->total_vm, get_mm_rss(p->mm), (int)task_cpu(p),
+                       get_mm_rss(mm), (int)task_cpu(p), p->oomkilladj,
-                       p->oomkilladj, p->comm);
+                       p->comm);
                task_unlock(p);
        } while_each_thread(g, p);
 }
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 3ecea98ecb45..1416e7e9e02d 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -109,8 +109,6 @@ int add_to_swap_cache(struct page *page, swp_entry_t entry, gfp_t gfp_mask)
 */
 void __delete_from_swap_cache(struct page *page)
 {
-        swp_entry_t ent = {.val = page_private(page)};
        VM_BUG_ON(!PageLocked(page));
        VM_BUG_ON(!PageSwapCache(page));
        VM_BUG_ON(PageWriteback(page));
@@ -121,7 +119,6 @@ void __delete_from_swap_cache(struct page *page)
        total_swapcache_pages--;
        __dec_zone_page_state(page, NR_FILE_PAGES);
        INC_CACHE_INFO(del_total);
-        mem_cgroup_uncharge_swapcache(page, ent);
 }
 /**
@@ -191,6 +188,7 @@ void delete_from_swap_cache(struct page *page)
        __delete_from_swap_cache(page);
        spin_unlock_irq(&swapper_space.tree_lock);
+        mem_cgroup_uncharge_swapcache(page, entry);
        swap_free(entry);
        page_cache_release(page);
 }
diff --git a/mm/truncate.c b/mm/truncate.c
index 55206fab7b99..12e1579f9165 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -359,6 +359,7 @@ invalidate_complete_page2(struct address_space *mapping, struct page *page)
        BUG_ON(page_has_private(page));
        __remove_from_page_cache(page);
        spin_unlock_irq(&mapping->tree_lock);
+        mem_cgroup_uncharge_cache_page(page);
        page_cache_release(page);       /* pagecache ref */
        return 1;
 failed:
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 5fa3eda1f03f..d254306562cd 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -470,10 +470,12 @@ static int __remove_mapping(struct address_space *mapping, struct page *page)
                swp_entry_t swap = { .val = page_private(page) };
                __delete_from_swap_cache(page);
                spin_unlock_irq(&mapping->tree_lock);
+                mem_cgroup_uncharge_swapcache(page, swap);
                swap_free(swap);
        } else {
                __remove_from_page_cache(page);
                spin_unlock_irq(&mapping->tree_lock);
+                mem_cgroup_uncharge_cache_page(page);
        }
        return 1;
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 3779c1438c11..0666a827bc62 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2447,7 +2447,7 @@ static inline void free_SAs(struct pktgen_dev *pkt_dev)
        if (pkt_dev->cflows) {
                /* let go of the SAs if we have them */
                int i = 0;
-                for (;  i < pkt_dev->nflows; i++){
+                for (;  i < pkt_dev->cflows; i++) {
                        struct xfrm_state *x = pkt_dev->flows[i].x;
                        if (x) {
                                xfrm_state_put(x);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index ec0ae490f0b6..33c7c85dfe40 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -986,9 +986,12 @@ fib_find_node(struct trie *t, u32 key)
 static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
 {
        int wasfull;
-        t_key cindex, key = tn->key;
+        t_key cindex, key;
        struct tnode *tp;
+        preempt_disable();
+        key = tn->key;
        while (tn != NULL && (tp = node_parent((struct node *)tn)) != NULL) {
                cindex = tkey_extract_bits(key, tp->pos, tp->bits);
                wasfull = tnode_full(tp, tnode_get_child(tp, cindex));
@@ -1007,6 +1010,7 @@ static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
        if (IS_TNODE(tn))
                tn = (struct tnode *)resize(t, (struct tnode *)tn);
+        preempt_enable();
        return (struct node *)tn;
 }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index c4c60e9f068a..28205e5bfa9b 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -784,8 +784,8 @@ static void rt_check_expire(void)
 {
        static unsigned int rover;
        unsigned int i = rover, goal;
-        struct rtable *rth, **rthp;
+        struct rtable *rth, *aux, **rthp;
-        unsigned long length = 0, samples = 0;
+        unsigned long samples = 0;
        unsigned long sum = 0, sum2 = 0;
        u64 mult;
@@ -795,9 +795,9 @@ static void rt_check_expire(void)
        goal = (unsigned int)mult;
        if (goal > rt_hash_mask)
                goal = rt_hash_mask + 1;
-        length = 0;
        for (; goal > 0; goal--) {
                unsigned long tmo = ip_rt_gc_timeout;
+                unsigned long length;
                i = (i + 1) & rt_hash_mask;
                rthp = &rt_hash_table[i].chain;
@@ -809,8 +809,10 @@ static void rt_check_expire(void)
                if (*rthp == NULL)
                        continue;
+                length = 0;
                spin_lock_bh(rt_hash_lock_addr(i));
                while ((rth = *rthp) != NULL) {
+                        prefetch(rth->u.dst.rt_next);
                        if (rt_is_expired(rth)) {
                                *rthp = rth->u.dst.rt_next;
                                rt_free(rth);
@@ -819,33 +821,30 @@ static void rt_check_expire(void)
                        if (rth->u.dst.expires) {
                                /* Entry is expired even if it is in use */
                                if (time_before_eq(jiffies, rth->u.dst.expires)) {
+nofree:
                                        tmo >>= 1;
                                        rthp = &rth->u.dst.rt_next;
                                        /*
-                                         * Only bump our length if the hash
+                                         * We only count entries on
-                                         * inputs on entries n and n+1 are not
-                                         * the same, we only count entries on
                                         * a chain with equal hash inputs once
                                         * so that entries for different QOS
                                         * levels, and other non-hash input
                                         * attributes don't unfairly skew
                                         * the length computation
                                         */
-                                        if ((*rthp == NULL) ||
+                                        for (aux = rt_hash_table[i].chain;;) {
-                                            !compare_hash_inputs(&(*rthp)->fl,
+                                                if (aux == rth) {
-                                                                 &rth->fl))
+                                                        length += ONE;
-                                                length += ONE;
+                                                        break;
+                                                }
+                                                if (compare_hash_inputs(&aux->fl, &rth->fl))
+                                                        break;
+                                                aux = aux->u.dst.rt_next;
+                                        }
                                        continue;
                                }
-                        } else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout)) {
+                        } else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout))
-                                tmo >>= 1;
+                                goto nofree;
-                                rthp = &rth->u.dst.rt_next;
-                                if ((*rthp == NULL) ||
-                                    !compare_hash_inputs(&(*rthp)->fl,
-                                                         &rth->fl))
-                                        length += ONE;
-                                continue;
-                        }
                        /* Cleanup aged off entries. */
                        *rthp = rth->u.dst.rt_next;
@@ -1068,7 +1067,6 @@ out:	return 0;
 static int rt_intern_hash(unsigned hash, struct rtable *rt, struct rtable **rp)
 {
        struct rtable   *rth, **rthp;
-        struct rtable   *rthi;
        unsigned long   now;
        struct rtable *cand, **candp;
        u32             min_score;
@@ -1088,7 +1086,6 @@ restart:
        }
        rthp = &rt_hash_table[hash].chain;
-        rthi = NULL;
        spin_lock_bh(rt_hash_lock_addr(hash));
        while ((rth = *rthp) != NULL) {
@@ -1134,17 +1131,6 @@ restart:
                chain_length++;
                rthp = &rth->u.dst.rt_next;
-                /*
-                 * check to see if the next entry in the chain
-                 * contains the same hash input values as rt.  If it does
-                 * This is where we will insert into the list, instead of
-                 * at the head.  This groups entries that differ by aspects not
-                 * relvant to the hash function together, which we use to adjust
-                 * our chain length
-                 */
-                if (*rthp && compare_hash_inputs(&(*rthp)->fl, &rt->fl))
-                        rthi = rth;
        }
        if (cand) {
@@ -1205,10 +1191,7 @@ restart:
                }
        }
-        if (rthi)
+        rt->u.dst.rt_next = rt_hash_table[hash].chain;
-                rt->u.dst.rt_next = rthi->u.dst.rt_next;
-        else
-                rt->u.dst.rt_next = rt_hash_table[hash].chain;
 #if RT_CACHE_DEBUG >= 2
        if (rt->u.dst.rt_next) {
@@ -1224,10 +1207,7 @@ restart:
         * previous writes to rt are comitted to memory
         * before making rt visible to other CPUS.
         */
-        if (rthi)
+        rcu_assign_pointer(rt_hash_table[hash].chain, rt);
-                rcu_assign_pointer(rthi->u.dst.rt_next, rt);
-        else
-                rcu_assign_pointer(rt_hash_table[hash].chain, rt);
        spin_unlock_bh(rt_hash_lock_addr(hash));
        *rp = rt;
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
index a453aac91bd3..c6743eec9b7d 100644
--- a/net/ipv4/tcp_vegas.c
+++ b/net/ipv4/tcp_vegas.c
@@ -158,6 +158,11 @@ void tcp_vegas_cwnd_event(struct sock *sk, enum tcp_ca_event event)
 }
 EXPORT_SYMBOL_GPL(tcp_vegas_cwnd_event);
+static inline u32 tcp_vegas_ssthresh(struct tcp_sock *tp)
+{
+        return  min(tp->snd_ssthresh, tp->snd_cwnd-1);
+}
 static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 {
        struct tcp_sock *tp = tcp_sk(sk);
@@ -221,11 +226,10 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                         */
                        diff = tp->snd_cwnd * (rtt-vegas->baseRTT) / vegas->baseRTT;
-                        if (diff > gamma && tp->snd_ssthresh > 2 ) {
+                        if (diff > gamma && tp->snd_cwnd <= tp->snd_ssthresh) {
                                /* Going too fast. Time to slow down
                                 * and switch to congestion avoidance.
                                 */
-                                tp->snd_ssthresh = 2;
                                /* Set cwnd to match the actual rate
                                 * exactly:
@@ -235,6 +239,7 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                                 * utilization.
                                 */
                                tp->snd_cwnd = min(tp->snd_cwnd, (u32)target_cwnd+1);
+                                tp->snd_ssthresh = tcp_vegas_ssthresh(tp);
                        } else if (tp->snd_cwnd <= tp->snd_ssthresh) {
                                /* Slow start.  */
@@ -250,6 +255,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                                         * we slow down.
                                         */
                                        tp->snd_cwnd--;
+                                        tp->snd_ssthresh
+                                                = tcp_vegas_ssthresh(tp);
                                } else if (diff < alpha) {
                                        /* We don't have enough extra packets
                                         * in the network, so speed up.
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1394ddb6e35c..032a5ec391c5 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -137,6 +137,7 @@ static struct rt6_info ip6_null_entry_template = {
                }
        },
        .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
+        .rt6i_protocol  = RTPROT_KERNEL,
        .rt6i_metric    = ~(u32) 0,
        .rt6i_ref       = ATOMIC_INIT(1),
 };
@@ -159,6 +160,7 @@ static struct rt6_info ip6_prohibit_entry_template = {
                }
        },
        .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
+        .rt6i_protocol  = RTPROT_KERNEL,
        .rt6i_metric    = ~(u32) 0,
        .rt6i_ref       = ATOMIC_INIT(1),
 };
@@ -176,6 +178,7 @@ static struct rt6_info ip6_blk_hole_entry_template = {
                }
        },
        .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
+        .rt6i_protocol  = RTPROT_KERNEL,
        .rt6i_metric    = ~(u32) 0,
        .rt6i_ref       = ATOMIC_INIT(1),
 };
diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
index 0f1218b8d289..67e38a056240 100644
--- a/net/rxrpc/ar-connection.c
+++ b/net/rxrpc/ar-connection.c
@@ -343,9 +343,9 @@ static int rxrpc_connect_exclusive(struct rxrpc_sock *rx,
                /* not yet present - create a candidate for a new connection
                 * and then redo the check */
                conn = rxrpc_alloc_connection(gfp);
-                if (IS_ERR(conn)) {
+                if (!conn) {
-                        _leave(" = %ld", PTR_ERR(conn));
+                        _leave(" = -ENOMEM");
-                        return PTR_ERR(conn);
+                        return -ENOMEM;
                }
                conn->trans = trans;
@@ -508,9 +508,9 @@ int rxrpc_connect_call(struct rxrpc_sock *rx,
                /* not yet present - create a candidate for a new connection and then
                 * redo the check */
                candidate = rxrpc_alloc_connection(gfp);
-                if (IS_ERR(candidate)) {
+                if (!candidate) {
-                        _leave(" = %ld", PTR_ERR(candidate));
+                        _leave(" = -ENOMEM");
-                        return PTR_ERR(candidate);
+                        return -ENOMEM;
                }
                candidate->trans = trans;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index af3198814c15..9d504234af4a 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -345,6 +345,7 @@ static void svc_sock_setbufsize(struct socket *sock, unsigned int snd,
        lock_sock(sock->sk);
        sock->sk->sk_sndbuf = snd * 2;
        sock->sk->sk_rcvbuf = rcv * 2;
+        sock->sk->sk_userlocks |= SOCK_SNDBUF_LOCK|SOCK_RCVBUF_LOCK;
        release_sock(sock->sk);
 #endif
 }
@@ -796,6 +797,23 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                test_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags),
                test_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags));
+        if (test_and_clear_bit(XPT_CHNGBUF, &svsk->sk_xprt.xpt_flags))
+                /* sndbuf needs to have room for one request
+                 * per thread, otherwise we can stall even when the
+                 * network isn't a bottleneck.
+                 *
+                 * We count all threads rather than threads in a
+                 * particular pool, which provides an upper bound
+                 * on the number of threads which will access the socket.
+                 *
+                 * rcvbuf just needs to be able to hold a few requests.
+                 * Normally they will be removed from the queue
+                 * as soon a a complete request arrives.
+                 */
+                svc_sock_setbufsize(svsk->sk_sock,
+                                    (serv->sv_nrthreads+3) * serv->sv_max_mesg,
+                                    3 * serv->sv_max_mesg);
        clear_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
        /* Receive data. If we haven't got the record length yet, get
@@ -1043,6 +1061,15 @@ static void svc_tcp_init(struct svc_sock *svsk, struct svc_serv *serv)
                tcp_sk(sk)->nonagle |= TCP_NAGLE_OFF;
+                /* initialise setting must have enough space to
+                 * receive and respond to one request.
+                 * svc_tcp_recvfrom will re-adjust if necessary
+                 */
+                svc_sock_setbufsize(svsk->sk_sock,
+                                    3 * svsk->sk_xprt.xpt_server->sv_max_mesg,
+                                    3 * svsk->sk_xprt.xpt_server->sv_max_mesg);
+                set_bit(XPT_CHNGBUF, &svsk->sk_xprt.xpt_flags);
                set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
                if (sk->sk_state != TCP_ESTABLISHED)
                        set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
@@ -1112,14 +1139,8 @@ static struct svc_sock *svc_setup_socket(struct svc_serv *serv,
        /* Initialize the socket */
        if (sock->type == SOCK_DGRAM)
                svc_udp_init(svsk, serv);
-        else {
+        else
-                /* initialise setting must have enough space to
-                 * receive and respond to one request.
-                 */
-                svc_sock_setbufsize(svsk->sk_sock, 4 * serv->sv_max_mesg,
-                                        4 * serv->sv_max_mesg);
                svc_tcp_init(svsk, serv);
-        }
        dprintk("svc: svc_setup_socket created %p (inet %p)\n",
                                svsk, svsk->sk_sk);
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 8b510c5e8777..f11be72a1a80 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -128,7 +128,8 @@ static int fast_reg_xdr(struct svcxprt_rdma *xprt,
                page_bytes -= sge_bytes;
                frmr->page_list->page_list[page_no] =
-                        ib_dma_map_page(xprt->sc_cm_id->device, page, 0,
+                        ib_dma_map_single(xprt->sc_cm_id->device,
+                                          page_address(page),
                                          PAGE_SIZE, DMA_TO_DEVICE);
                if (ib_dma_mapping_error(xprt->sc_cm_id->device,
                                         frmr->page_list->page_list[page_no]))
@@ -532,18 +533,17 @@ static int send_reply(struct svcxprt_rdma *rdma,
                clear_bit(RDMACTXT_F_FAST_UNREG, &ctxt->flags);
        /* Prepare the SGE for the RPCRDMA Header */
+        ctxt->sge[0].lkey = rdma->sc_dma_lkey;
+        ctxt->sge[0].length = svc_rdma_xdr_get_reply_hdr_len(rdma_resp);
        ctxt->sge[0].addr =
-                ib_dma_map_page(rdma->sc_cm_id->device,
+                ib_dma_map_single(rdma->sc_cm_id->device, page_address(page),
-                                page, 0, PAGE_SIZE, DMA_TO_DEVICE);
+                                  ctxt->sge[0].length, DMA_TO_DEVICE);
        if (ib_dma_mapping_error(rdma->sc_cm_id->device, ctxt->sge[0].addr))
                goto err;
        atomic_inc(&rdma->sc_dma_used);
        ctxt->direction = DMA_TO_DEVICE;
-        ctxt->sge[0].length = svc_rdma_xdr_get_reply_hdr_len(rdma_resp);
-        ctxt->sge[0].lkey = rdma->sc_dma_lkey;
        /* Determine how many of our SGE are to be transmitted */
        for (sge_no = 1; byte_count && sge_no < vec->count; sge_no++) {
                sge_bytes = min_t(size_t, vec->sge[sge_no].iov_len, byte_count);
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 4b0c2fa15e0b..5151f9f6c573 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -500,8 +500,8 @@ int svc_rdma_post_recv(struct svcxprt_rdma *xprt)
                BUG_ON(sge_no >= xprt->sc_max_sge);
                page = svc_rdma_get_page();
                ctxt->pages[sge_no] = page;
-                pa = ib_dma_map_page(xprt->sc_cm_id->device,
+                pa = ib_dma_map_single(xprt->sc_cm_id->device,
-                                     page, 0, PAGE_SIZE,
+                                     page_address(page), PAGE_SIZE,
                                     DMA_FROM_DEVICE);
                if (ib_dma_mapping_error(xprt->sc_cm_id->device, pa))
                        goto err_put_ctxt;
@@ -1315,8 +1315,8 @@ void svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
        length = svc_rdma_xdr_encode_error(xprt, rmsgp, err, va);
        /* Prepare SGE for local address */
-        sge.addr = ib_dma_map_page(xprt->sc_cm_id->device,
+        sge.addr = ib_dma_map_single(xprt->sc_cm_id->device,
-                                   p, 0, PAGE_SIZE, DMA_FROM_DEVICE);
+                                   page_address(p), PAGE_SIZE, DMA_FROM_DEVICE);
        if (ib_dma_mapping_error(xprt->sc_cm_id->device, sge.addr)) {
                put_page(p);
                return;
@@ -1343,7 +1343,7 @@ void svc_rdma_send_error(struct svcxprt_rdma *xprt, struct rpcrdma_msg *rmsgp,
        if (ret) {
                dprintk("svcrdma: Error %d posting send for protocol error\n",
                        ret);
-                ib_dma_unmap_page(xprt->sc_cm_id->device,
+                ib_dma_unmap_single(xprt->sc_cm_id->device,
                                  sge.addr, PAGE_SIZE,
                                  DMA_FROM_DEVICE);
                svc_rdma_put_context(ctxt, 1);
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 3b21e0cc5e69..465aafc2007f 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1495,7 +1495,8 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg,
        frmr_wr.wr.fast_reg.page_shift = PAGE_SHIFT;
        frmr_wr.wr.fast_reg.length = i << PAGE_SHIFT;
        frmr_wr.wr.fast_reg.access_flags = (writing ?
-                                IB_ACCESS_REMOTE_WRITE : IB_ACCESS_REMOTE_READ);
+                                IB_ACCESS_REMOTE_WRITE | IB_ACCESS_LOCAL_WRITE :
+                                IB_ACCESS_REMOTE_READ);
        frmr_wr.wr.fast_reg.rkey = seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey;
        DECR_CQCOUNT(&r_xprt->rx_ep);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 08265ca15785..487cb627ddba 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1551,6 +1551,13 @@ static int regulatory_hint_core(const char *alpha2)
        queue_regulatory_request(request);
+        /*
+         * This ensures last_request is populated once modules
+         * come swinging in and calling regulatory hints and
+         * wiphy_apply_custom_regulatory().
+         */
+        flush_scheduled_work();
        return 0;
 }
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index cb6a5bb85d80..0e59f9ae9b81 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -786,6 +786,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                        err = -EFAULT;
                        goto out;
                }
+                if (cmd == SIOCSIWENCODEEXT) {
+                        struct iw_encode_ext *ee = (void *) extra;
+                        if (iwp->length < sizeof(*ee) + ee->key_len)
+                                return -EFAULT;
+                }
        }
        err = handler(dev, info, (union iwreq_data *) iwp, extra);
diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
index 5b481912752a..e42be5c4f055 100644
--- a/security/tomoyo/tomoyo.c
+++ b/security/tomoyo/tomoyo.c
@@ -27,6 +27,12 @@ static int tomoyo_cred_prepare(struct cred *new, const struct cred *old,
 static int tomoyo_bprm_set_creds(struct linux_binprm *bprm)
 {
+        int rc;
+        rc = cap_bprm_set_creds(bprm);
+        if (rc)
+                return rc;
        /*
         * Do only if this function is called for the first time of an execve
         * operation.
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index a2a792c18c40..d659995ac3ac 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -249,6 +249,11 @@ static int snd_pcm_update_hw_ptr_interrupt(struct snd_pcm_substream *substream)
                        new_hw_ptr = hw_base + pos;
                }
        }
+        /* Do jiffies check only in xrun_debug mode */
+        if (!xrun_debug(substream))
+                goto no_jiffies_check;
        /* Skip the jiffies check for hardwares with BATCH flag.
         * Such hardware usually just increases the position at each IRQ,
         * thus it can't give any strange position.
@@ -336,7 +341,9 @@ int snd_pcm_update_hw_ptr(struct snd_pcm_substream *substream)
                        hw_base = 0;
                new_hw_ptr = hw_base + pos;
        }
-        if (((delta * HZ) / runtime->rate) > jdelta + HZ/100) {
+        /* Do jiffies check only in xrun_debug mode */
+        if (xrun_debug(substream) &&
+            ((delta * HZ) / runtime->rate) > jdelta + HZ/100) {
                hw_ptr_error(substream,
                             "hw_ptr skipping! "
                             "(pos=%ld, delta=%ld, period=%ld, jdelta=%lu/%lu)\n",
@@ -1478,7 +1485,6 @@ static int snd_pcm_lib_ioctl_reset(struct snd_pcm_substream *substream,
                runtime->status->hw_ptr %= runtime->buffer_size;
        else
                runtime->status->hw_ptr = 0;
-        runtime->hw_ptr_jiffies = jiffies;
        snd_pcm_stream_unlock_irqrestore(substream, flags);
        return 0;
 }
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index fc6f98e257df..b5da656d1ece 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -848,6 +848,7 @@ static void snd_pcm_post_start(struct snd_pcm_substream *substream, int state)
 {
        struct snd_pcm_runtime *runtime = substream->runtime;
        snd_pcm_trigger_tstamp(substream);
+        runtime->hw_ptr_jiffies = jiffies;
        runtime->status->state = state;
        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
            runtime->silence_size > 0)
@@ -961,6 +962,11 @@ static int snd_pcm_do_pause(struct snd_pcm_substream *substream, int push)
 {
        if (substream->runtime->trigger_master != substream)
                return 0;
+        /* The jiffies check in snd_pcm_update_hw_ptr*() is done by
+         * a delta betwen the current jiffies, this gives a large enough
+         * delta, effectively to skip the check once.
+         */
+        substream->runtime->hw_ptr_jiffies = jiffies - HZ * 1000;
        return substream->ops->trigger(substream,
                                       push ? SNDRV_PCM_TRIGGER_PAUSE_PUSH :
                                              SNDRV_PCM_TRIGGER_PAUSE_RELEASE);
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 21e99cfa8c49..3128e1a6bc65 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2141,6 +2141,7 @@ static struct snd_pci_quirk probe_mask_list[] __devinitdata = {
        /* including bogus ALC268 in slot#2 that conflicts with ALC888 */
        SND_PCI_QUIRK(0x17c0, 0x4085, "Medion MD96630", 0x01),
        /* forced codec slots */
+        SND_PCI_QUIRK(0x1043, 0x1262, "ASUS W5Fm", 0x103),
        SND_PCI_QUIRK(0x1046, 0x1262, "ASUS W5F", 0x103),
        {}
 };
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 56ce19e68cb5..4fcbe21829ab 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -1848,6 +1848,7 @@ static const char *cxt5051_models[CXT5051_MODELS] = {
 static struct snd_pci_quirk cxt5051_cfg_tbl[] = {
        SND_PCI_QUIRK(0x103c, 0x30cf, "HP DV6736", CXT5051_HP_DV6736),
+        SND_PCI_QUIRK(0x103c, 0x360b, "Compaq Presario CQ60", CXT5051_HP),
        SND_PCI_QUIRK(0x14f1, 0x0101, "Conexant Reference board",
                      CXT5051_LAPTOP),
        SND_PCI_QUIRK(0x14f1, 0x5051, "HP Spartan 1.1", CXT5051_HP),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index bcbb736f94f0..0fd258eba3a5 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -776,6 +776,12 @@ static void alc_set_input_pin(struct hda_codec *codec, hda_nid_t nid,
                pincap = (pincap & AC_PINCAP_VREF) >> AC_PINCAP_VREF_SHIFT;
                if (pincap & AC_PINCAP_VREF_80)
                        val = PIN_VREF80;
+                else if (pincap & AC_PINCAP_VREF_50)
+                        val = PIN_VREF50;
+                else if (pincap & AC_PINCAP_VREF_100)
+                        val = PIN_VREF100;
+                else if (pincap & AC_PINCAP_VREF_GRD)
+                        val = PIN_VREFGRD;
        }
        snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, val);
 }
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 03b3646018a1..d2fd8ef6aef8 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -150,6 +150,7 @@ enum {
        STAC_D965_REF,
        STAC_D965_3ST,
        STAC_D965_5ST,
+        STAC_D965_5ST_NO_FP,
        STAC_DELL_3ST,
        STAC_DELL_BIOS,
        STAC_927X_MODELS
@@ -2154,6 +2155,13 @@ static unsigned int d965_5st_pin_configs[14] = {
        0x40000100, 0x40000100
 };
+static unsigned int d965_5st_no_fp_pin_configs[14] = {
+        0x40000100, 0x40000100, 0x0181304e, 0x01014010,
+        0x01a19040, 0x01011012, 0x01016011, 0x40000100,
+        0x40000100, 0x40000100, 0x40000100, 0x01442070,
+        0x40000100, 0x40000100
+};
 static unsigned int dell_3st_pin_configs[14] = {
        0x02211230, 0x02a11220, 0x01a19040, 0x01114210,
        0x01111212, 0x01116211, 0x01813050, 0x01112214,
@@ -2166,6 +2174,7 @@ static unsigned int *stac927x_brd_tbl[STAC_927X_MODELS] = {
        [STAC_D965_REF]  = ref927x_pin_configs,
        [STAC_D965_3ST]  = d965_3st_pin_configs,
        [STAC_D965_5ST]  = d965_5st_pin_configs,
+        [STAC_D965_5ST_NO_FP]  = d965_5st_no_fp_pin_configs,
        [STAC_DELL_3ST]  = dell_3st_pin_configs,
        [STAC_DELL_BIOS] = NULL,
 };
@@ -2176,6 +2185,7 @@ static const char *stac927x_models[STAC_927X_MODELS] = {
        [STAC_D965_REF]         = "ref",
        [STAC_D965_3ST]         = "3stack",
        [STAC_D965_5ST]         = "5stack",
+        [STAC_D965_5ST_NO_FP]   = "5stack-no-fp",
        [STAC_DELL_3ST]         = "dell-3stack",
        [STAC_DELL_BIOS]        = "dell-bios",
 };
diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index 823296d7d578..a6b88482637b 100644
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -3347,7 +3347,7 @@ static int snd_usb_create_quirk(struct snd_usb_audio *chip,
                [QUIRK_MIDI_YAMAHA] = snd_usb_create_midi_interface,
                [QUIRK_MIDI_MIDIMAN] = snd_usb_create_midi_interface,
                [QUIRK_MIDI_NOVATION] = snd_usb_create_midi_interface,
-                [QUIRK_MIDI_RAW] = snd_usb_create_midi_interface,
+                [QUIRK_MIDI_FASTLANE] = snd_usb_create_midi_interface,
                [QUIRK_MIDI_EMAGIC] = snd_usb_create_midi_interface,
                [QUIRK_MIDI_CME] = snd_usb_create_midi_interface,
                [QUIRK_AUDIO_STANDARD_INTERFACE] = create_standard_audio_quirk,
diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
index 36e4f7a29adc..8e7f78941ba6 100644
--- a/sound/usb/usbaudio.h
+++ b/sound/usb/usbaudio.h
@@ -153,7 +153,7 @@ enum quirk_type {
        QUIRK_MIDI_YAMAHA,
        QUIRK_MIDI_MIDIMAN,
        QUIRK_MIDI_NOVATION,
-        QUIRK_MIDI_RAW,
+        QUIRK_MIDI_FASTLANE,
        QUIRK_MIDI_EMAGIC,
        QUIRK_MIDI_CME,
        QUIRK_MIDI_US122L,
diff --git a/sound/usb/usbmidi.c b/sound/usb/usbmidi.c
index 26bad373fe65..2fb35cc22a30 100644
--- a/sound/usb/usbmidi.c
+++ b/sound/usb/usbmidi.c
@@ -1778,8 +1778,18 @@ int snd_usb_create_midi_interface(struct snd_usb_audio* chip,
                umidi->usb_protocol_ops = &snd_usbmidi_novation_ops;
                err = snd_usbmidi_detect_per_port_endpoints(umidi, endpoints);
                break;
-        case QUIRK_MIDI_RAW:
+        case QUIRK_MIDI_FASTLANE:
                umidi->usb_protocol_ops = &snd_usbmidi_raw_ops;
+                /*
+                 * Interface 1 contains isochronous endpoints, but with the same
+                 * numbers as in interface 0.  Since it is interface 1 that the
+                 * USB core has most recently seen, these descriptors are now
+                 * associated with the endpoint numbers.  This will foul up our
+                 * attempts to submit bulk/interrupt URBs to the endpoints in
+                 * interface 0, so we have to make sure that the USB core looks
+                 * again at interface 0 by calling usb_set_interface() on it.
+                 */
+                usb_set_interface(umidi->chip->dev, 0, 0);
                err = snd_usbmidi_detect_per_port_endpoints(umidi, endpoints);
                break;
        case QUIRK_MIDI_EMAGIC:
diff --git a/sound/usb/usbquirks.h b/sound/usb/usbquirks.h
index 647ef5029651..5d955aaad85f 100644
--- a/sound/usb/usbquirks.h
+++ b/sound/usb/usbquirks.h
@@ -1868,7 +1868,7 @@ YAMAHA_DEVICE(0x7010, "UB99"),
                .data = & (const struct snd_usb_audio_quirk[]) {
                        {
                                .ifnum = 0,
-                                .type = QUIRK_MIDI_RAW
+                                .type = QUIRK_MIDI_FASTLANE
                        },
                        {
                                .ifnum = 1,