363 files changed, 4430 insertions, 2308 deletions

diff --git a/Documentation/DocBook/media-entities.tmpl b/Documentation/DocBook/media-entities.tmpl
index 5d259c632cdf..fea63b45471a 100644
--- a/Documentation/DocBook/media-entities.tmpl
+++ b/Documentation/DocBook/media-entities.tmpl
@@ -294,6 +294,7 @@
 <!ENTITY sub-srggb10 SYSTEM "v4l/pixfmt-srggb10.xml">
 <!ENTITY sub-srggb8 SYSTEM "v4l/pixfmt-srggb8.xml">
 <!ENTITY sub-y10 SYSTEM "v4l/pixfmt-y10.xml">
+<!ENTITY sub-y12 SYSTEM "v4l/pixfmt-y12.xml">
 <!ENTITY sub-pixfmt SYSTEM "v4l/pixfmt.xml">
 <!ENTITY sub-cropcap SYSTEM "v4l/vidioc-cropcap.xml">
 <!ENTITY sub-dbg-g-register SYSTEM "v4l/vidioc-dbg-g-register.xml">
diff --git a/Documentation/DocBook/v4l/media-ioc-setup-link.xml b/Documentation/DocBook/v4l/media-ioc-setup-link.xml
index 2331e76ded17..cec97af4dab4 100644
--- a/Documentation/DocBook/v4l/media-ioc-setup-link.xml
+++ b/Documentation/DocBook/v4l/media-ioc-setup-link.xml
@@ -34,7 +34,7 @@
       <varlistentry>
         <term><parameter>request</parameter></term>
         <listitem>
-          <para>MEDIA_IOC_ENUM_LINKS</para>
+          <para>MEDIA_IOC_SETUP_LINK</para>
         </listitem>
       </varlistentry>
       <varlistentry>
diff --git a/Documentation/DocBook/v4l/pixfmt-y12.xml b/Documentation/DocBook/v4l/pixfmt-y12.xml
new file mode 100644
index 000000000000..ff417b858cc9
--- /dev/null
+++ b/Documentation/DocBook/v4l/pixfmt-y12.xml
@@ -0,0 +1,79 @@
+<refentry id="V4L2-PIX-FMT-Y12">
+  <refmeta>
+    <refentrytitle>V4L2_PIX_FMT_Y12 ('Y12 ')</refentrytitle>
+    &manvol;
+  </refmeta>
+  <refnamediv>
+    <refname><constant>V4L2_PIX_FMT_Y12</constant></refname>
+    <refpurpose>Grey-scale image</refpurpose>
+  </refnamediv>
+  <refsect1>
+    <title>Description</title>
+
+    <para>This is a grey-scale image with a depth of 12 bits per pixel. Pixels
+are stored in 16-bit words with unused high bits padded with 0. The least
+significant byte is stored at lower memory addresses (little-endian).</para>
+
+    <example>
+      <title><constant>V4L2_PIX_FMT_Y12</constant> 4 &times; 4
+pixel image</title>
+
+      <formalpara>
+        <title>Byte Order.</title>
+        <para>Each cell is one byte.
+          <informaltable frame="none">
+            <tgroup cols="9" align="center">
+              <colspec align="left" colwidth="2*" />
+              <tbody valign="top">
+                <row>
+                  <entry>start&nbsp;+&nbsp;0:</entry>
+                  <entry>Y'<subscript>00low</subscript></entry>
+                  <entry>Y'<subscript>00high</subscript></entry>
+                  <entry>Y'<subscript>01low</subscript></entry>
+                  <entry>Y'<subscript>01high</subscript></entry>
+                  <entry>Y'<subscript>02low</subscript></entry>
+                  <entry>Y'<subscript>02high</subscript></entry>
+                  <entry>Y'<subscript>03low</subscript></entry>
+                  <entry>Y'<subscript>03high</subscript></entry>
+                </row>
+                <row>
+                  <entry>start&nbsp;+&nbsp;8:</entry>
+                  <entry>Y'<subscript>10low</subscript></entry>
+                  <entry>Y'<subscript>10high</subscript></entry>
+                  <entry>Y'<subscript>11low</subscript></entry>
+                  <entry>Y'<subscript>11high</subscript></entry>
+                  <entry>Y'<subscript>12low</subscript></entry>
+                  <entry>Y'<subscript>12high</subscript></entry>
+                  <entry>Y'<subscript>13low</subscript></entry>
+                  <entry>Y'<subscript>13high</subscript></entry>
+                </row>
+                <row>
+                  <entry>start&nbsp;+&nbsp;16:</entry>
+                  <entry>Y'<subscript>20low</subscript></entry>
+                  <entry>Y'<subscript>20high</subscript></entry>
+                  <entry>Y'<subscript>21low</subscript></entry>
+                  <entry>Y'<subscript>21high</subscript></entry>
+                  <entry>Y'<subscript>22low</subscript></entry>
+                  <entry>Y'<subscript>22high</subscript></entry>
+                  <entry>Y'<subscript>23low</subscript></entry>
+                  <entry>Y'<subscript>23high</subscript></entry>
+                </row>
+                <row>
+                  <entry>start&nbsp;+&nbsp;24:</entry>
+                  <entry>Y'<subscript>30low</subscript></entry>
+                  <entry>Y'<subscript>30high</subscript></entry>
+                  <entry>Y'<subscript>31low</subscript></entry>
+                  <entry>Y'<subscript>31high</subscript></entry>
+                  <entry>Y'<subscript>32low</subscript></entry>
+                  <entry>Y'<subscript>32high</subscript></entry>
+                  <entry>Y'<subscript>33low</subscript></entry>
+                  <entry>Y'<subscript>33high</subscript></entry>
+                </row>
+              </tbody>
+            </tgroup>
+          </informaltable>
+        </para>
+      </formalpara>
+    </example>
+  </refsect1>
+</refentry>
diff --git a/Documentation/DocBook/v4l/pixfmt.xml b/Documentation/DocBook/v4l/pixfmt.xml
index c6fdcbbd1b41..40af4beb48b9 100644
--- a/Documentation/DocBook/v4l/pixfmt.xml
+++ b/Documentation/DocBook/v4l/pixfmt.xml
@@ -696,6 +696,7 @@ information.</para>
     &sub-packed-yuv;
     &sub-grey;
     &sub-y10;
+    &sub-y12;
     &sub-y16;
     &sub-yuyv;
     &sub-uyvy;
diff --git a/Documentation/DocBook/v4l/subdev-formats.xml b/Documentation/DocBook/v4l/subdev-formats.xml
index 7041127d6dfc..d7ccd25edcc1 100644
--- a/Documentation/DocBook/v4l/subdev-formats.xml
+++ b/Documentation/DocBook/v4l/subdev-formats.xml
@@ -456,6 +456,23 @@
               <entry>b<subscript>1</subscript></entry>
               <entry>b<subscript>0</subscript></entry>
             </row>
+            <row id="V4L2-MBUS-FMT-SGBRG8-1X8">
+              <entry>V4L2_MBUS_FMT_SGBRG8_1X8</entry>
+              <entry>0x3013</entry>
+              <entry></entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>g<subscript>7</subscript></entry>
+              <entry>g<subscript>6</subscript></entry>
+              <entry>g<subscript>5</subscript></entry>
+              <entry>g<subscript>4</subscript></entry>
+              <entry>g<subscript>3</subscript></entry>
+              <entry>g<subscript>2</subscript></entry>
+              <entry>g<subscript>1</subscript></entry>
+              <entry>g<subscript>0</subscript></entry>
+            </row>
             <row id="V4L2-MBUS-FMT-SGRBG8-1X8">
               <entry>V4L2_MBUS_FMT_SGRBG8_1X8</entry>
               <entry>0x3002</entry>
@@ -473,6 +490,23 @@
               <entry>g<subscript>1</subscript></entry>
               <entry>g<subscript>0</subscript></entry>
             </row>
+            <row id="V4L2-MBUS-FMT-SRGGB8-1X8">
+              <entry>V4L2_MBUS_FMT_SRGGB8_1X8</entry>
+              <entry>0x3014</entry>
+              <entry></entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>r<subscript>7</subscript></entry>
+              <entry>r<subscript>6</subscript></entry>
+              <entry>r<subscript>5</subscript></entry>
+              <entry>r<subscript>4</subscript></entry>
+              <entry>r<subscript>3</subscript></entry>
+              <entry>r<subscript>2</subscript></entry>
+              <entry>r<subscript>1</subscript></entry>
+              <entry>r<subscript>0</subscript></entry>
+            </row>
             <row id="V4L2-MBUS-FMT-SBGGR10-DPCM8-1X8">
               <entry>V4L2_MBUS_FMT_SBGGR10_DPCM8_1X8</entry>
               <entry>0x300b</entry>
@@ -2159,6 +2193,31 @@
               <entry>u<subscript>1</subscript></entry>
               <entry>u<subscript>0</subscript></entry>
             </row>
+            <row id="V4L2-MBUS-FMT-Y12-1X12">
+              <entry>V4L2_MBUS_FMT_Y12_1X12</entry>
+              <entry>0x2013</entry>
+              <entry></entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>y<subscript>11</subscript></entry>
+              <entry>y<subscript>10</subscript></entry>
+              <entry>y<subscript>9</subscript></entry>
+              <entry>y<subscript>8</subscript></entry>
+              <entry>y<subscript>7</subscript></entry>
+              <entry>y<subscript>6</subscript></entry>
+              <entry>y<subscript>5</subscript></entry>
+              <entry>y<subscript>4</subscript></entry>
+              <entry>y<subscript>3</subscript></entry>
+              <entry>y<subscript>2</subscript></entry>
+              <entry>y<subscript>1</subscript></entry>
+              <entry>y<subscript>0</subscript></entry>
+            </row>
             <row id="V4L2-MBUS-FMT-UYVY8-1X16">
               <entry>V4L2_MBUS_FMT_UYVY8_1X16</entry>
               <entry>0x200f</entry>
diff --git a/Documentation/cgroups/memory.txt b/Documentation/cgroups/memory.txt
index b6ed61c95856..7c163477fcd8 100644
--- a/Documentation/cgroups/memory.txt
+++ b/Documentation/cgroups/memory.txt
@@ -52,8 +52,10 @@ Brief summary of control files.
  tasks                           # attach a task(thread) and show list of threads
  cgroup.procs                    # show list of processes
  cgroup.event_control            # an interface for event_fd()
- memory.usage_in_bytes           # show current memory(RSS+Cache) usage.
- memory.memsw.usage_in_bytes     # show current memory+Swap usage
+ memory.usage_in_bytes           # show current res_counter usage for memory
+                                 (See 5.5 for details)
+ memory.memsw.usage_in_bytes     # show current res_counter usage for memory+Swap
+                                 (See 5.5 for details)
  memory.limit_in_bytes           # set/show limit of memory usage
  memory.memsw.limit_in_bytes     # set/show limit of memory+Swap usage
  memory.failcnt                  # show the number of memory usage hits limits
@@ -453,6 +455,15 @@ memory under it will be reclaimed.
 You can reset failcnt by writing 0 to failcnt file.
 # echo 0 > .../memory.failcnt
 
+5.5 usage_in_bytes
+
+For efficiency, as other kernel components, memory cgroup uses some optimization
+to avoid unnecessary cacheline false sharing. usage_in_bytes is affected by the
+method and doesn't show 'exact' value of memory(and swap) usage, it's an fuzz
+value for efficient access. (Of course, when necessary, it's synchronized.)
+If you want to know more exact memory usage, you should use RSS+CACHE(+SWAP)
+value in memory.stat(see 5.2).
+
 6. Hierarchy support
 
 The memory controller supports a deep hierarchy and hierarchical accounting.
diff --git a/Documentation/flexible-arrays.txt b/Documentation/flexible-arrays.txt
index cb8a3a00cc92..df904aec9904 100644
--- a/Documentation/flexible-arrays.txt
+++ b/Documentation/flexible-arrays.txt
@@ -66,10 +66,10 @@ trick is to ensure that any needed memory allocations are done before
 entering atomic context, using:
 
     int flex_array_prealloc(struct flex_array *array, unsigned int start,
-                            unsigned int end, gfp_t flags);
+                            unsigned int nr_elements, gfp_t flags);
 
 This function will ensure that memory for the elements indexed in the range
-defined by start and end has been allocated.  Thereafter, a
+defined by start and nr_elements has been allocated.  Thereafter, a
 flex_array_put() call on an element in that range is guaranteed not to
 block.
 
diff --git a/Documentation/hwmon/adm1021 b/Documentation/hwmon/adm1021
index 03d02bfb3df1..02ad96cf9b2b 100644
--- a/Documentation/hwmon/adm1021
+++ b/Documentation/hwmon/adm1021
@@ -14,10 +14,6 @@ Supported chips:
     Prefix: 'gl523sm'
     Addresses scanned: I2C 0x18 - 0x1a, 0x29 - 0x2b, 0x4c - 0x4e
     Datasheet:
-  * Intel Xeon Processor
-    Prefix: - any other - may require 'force_adm1021' parameter
-    Addresses scanned: none
-    Datasheet: Publicly available at Intel website
   * Maxim MAX1617
     Prefix: 'max1617'
     Addresses scanned: I2C 0x18 - 0x1a, 0x29 - 0x2b, 0x4c - 0x4e
@@ -91,21 +87,27 @@ will do no harm, but will return 'old' values. It is possible to make
 ADM1021-clones do faster measurements, but there is really no good reason
 for that.
 
-Xeon support
-------------
 
-Some Xeon processors have real max1617, adm1021, or compatible chips
-within them, with two temperature sensors.
+Netburst-based Xeon support
+---------------------------
 
-Other Xeons have chips with only one sensor.
+Some Xeon processors based on the Netburst (early Pentium 4, from 2001 to
+2003) microarchitecture had real MAX1617, ADM1021, or compatible chips
+within them, with two temperature sensors. Other Xeon processors of this
+era (with 400 MHz FSB) had chips with only one temperature sensor.
 
-If you have a Xeon, and the adm1021 module loads, and both temperatures
-appear valid, then things are good.
+If you have such an old Xeon, and you get two valid temperatures when
+loading the adm1021 module, then things are good.
 
-If the adm1021 module doesn't load, you should try this:
-        modprobe adm1021 force_adm1021=BUS,ADDRESS
-        ADDRESS can only be 0x18, 0x1a, 0x29, 0x2b, 0x4c, or 0x4e.
+If nothing happens when loading the adm1021 module, and you are certain
+that your specific Xeon processor model includes compatible sensors, you
+will have to explicitly instantiate the sensor chips from user-space. See
+method 4 in Documentation/i2c/instantiating-devices. Possible slave
+addresses are 0x18, 0x1a, 0x29, 0x2b, 0x4c, or 0x4e. It is likely that
+only temp2 will be correct and temp1 will have to be ignored.
 
-If you have dual Xeons you may have appear to have two separate
-adm1021-compatible chips, or two single-temperature sensors, at distinct
-addresses.
+Previous generations of the Xeon processor (based on Pentium II/III)
+didn't have these sensors. Next generations of Xeon processors (533 MHz
+FSB and faster) lost them, until the Core-based generation which
+introduced integrated digital thermal sensors. These are supported by
+the coretemp driver.
diff --git a/Documentation/hwmon/lm90 b/Documentation/hwmon/lm90
index fa475c0a48a3..f3efd18e87f4 100644
--- a/Documentation/hwmon/lm90
+++ b/Documentation/hwmon/lm90
@@ -32,6 +32,16 @@ Supported chips:
     Addresses scanned: I2C 0x4c and 0x4d
     Datasheet: Publicly available at the ON Semiconductor website
                http://www.onsemi.com/PowerSolutions/product.do?id=ADT7461
+  * Analog Devices ADT7461A
+    Prefix: 'adt7461a'
+    Addresses scanned: I2C 0x4c and 0x4d
+    Datasheet: Publicly available at the ON Semiconductor website
+               http://www.onsemi.com/PowerSolutions/product.do?id=ADT7461A
+  * ON Semiconductor NCT1008
+    Prefix: 'nct1008'
+    Addresses scanned: I2C 0x4c and 0x4d
+    Datasheet: Publicly available at the ON Semiconductor website
+               http://www.onsemi.com/PowerSolutions/product.do?id=NCT1008
   * Maxim MAX6646
     Prefix: 'max6646'
     Addresses scanned: I2C 0x4d
@@ -149,7 +159,7 @@ ADM1032:
   * ALERT is triggered by open remote sensor.
   * SMBus PEC support for Write Byte and Receive Byte transactions.
 
-ADT7461:
+ADT7461, ADT7461A, NCT1008:
   * Extended temperature range (breaks compatibility)
   * Lower resolution for remote temperature
 
@@ -195,9 +205,9 @@ are exported, one for each channel, but these values are of course linked.
 Only the local hysteresis can be set from user-space, and the same delta
 applies to the remote hysteresis.
 
-The lm90 driver will not update its values more frequently than every
-other second; reading them more often will do no harm, but will return
-'old' values.
+The lm90 driver will not update its values more frequently than configured with
+the update_interval attribute; reading them more often will do no harm, but will
+return 'old' values.
 
 SMBus Alert Support
 -------------------
@@ -205,11 +215,12 @@ SMBus Alert Support
 This driver has basic support for SMBus alert. When an alert is received,
 the status register is read and the faulty temperature channel is logged.
 
-The Analog Devices chips (ADM1032 and ADT7461) do not implement the SMBus
-alert protocol properly so additional care is needed: the ALERT output is
-disabled when an alert is received, and is re-enabled only when the alarm
-is gone. Otherwise the chip would block alerts from other chips in the bus
-as long as the alarm is active.
+The Analog Devices chips (ADM1032, ADT7461 and ADT7461A) and ON
+Semiconductor chips (NCT1008) do not implement the SMBus alert protocol
+properly so additional care is needed: the ALERT output is disabled when
+an alert is received, and is re-enabled only when the alarm is gone.
+Otherwise the chip would block alerts from other chips in the bus as long
+as the alarm is active.
 
 PEC Support
 -----------
diff --git a/Documentation/video4linux/sh_mobile_ceu_camera.txt b/Documentation/video4linux/sh_mobile_ceu_camera.txt
index cb47e723af74..1e96ce6e2d2f 100644
--- a/Documentation/video4linux/sh_mobile_ceu_camera.txt
+++ b/Documentation/video4linux/sh_mobile_ceu_camera.txt
@@ -37,7 +37,7 @@ Generic scaling / cropping scheme
 -1'-
 
 In the above chart minuses and slashes represent "real" data amounts, points and
-accents represent "useful" data, basically, CEU scaled amd cropped output,
+accents represent "useful" data, basically, CEU scaled and cropped output,
 mapped back onto the client's source plane.
 
 Such a configuration can be produced by user requests:
@@ -65,7 +65,7 @@ Do not touch input rectangle - it is already optimal.
 
 1. Calculate current sensor scales:
 
-        scale_s = ((3') - (3)) / ((2') - (2))
+        scale_s = ((2') - (2)) / ((3') - (3))
 
 2. Calculate "effective" input crop (sensor subwindow) - CEU crop scaled back at
 current sensor scales onto input window - this is user S_CROP:
@@ -80,7 +80,7 @@ window:
 4. Calculate sensor output window by applying combined scales to real input
 window:
 
-        width_s_out = ((2') - (2)) / scale_comb
+        width_s_out = ((7') - (7)) = ((2') - (2)) / scale_comb
 
 5. Apply iterative sensor S_FMT for sensor output window.
 
diff --git a/Documentation/workqueue.txt b/Documentation/workqueue.txt
index 01c513fac40e..a0b577de918f 100644
--- a/Documentation/workqueue.txt
+++ b/Documentation/workqueue.txt
@@ -12,6 +12,7 @@ CONTENTS
 4. Application Programming Interface (API)
 5. Example Execution Scenarios
 6. Guidelines
+7. Debugging
 
 
 1. Introduction
@@ -379,3 +380,42 @@ If q1 has WQ_CPU_INTENSIVE set,
 * Unless work items are expected to consume a huge amount of CPU
   cycles, using a bound wq is usually beneficial due to the increased
   level of locality in wq operations and work item execution.
+
+
+7. Debugging
+
+Because the work functions are executed by generic worker threads
+there are a few tricks needed to shed some light on misbehaving
+workqueue users.
+
+Worker threads show up in the process list as:
+
+root      5671  0.0  0.0      0     0 ?        S    12:07   0:00 [kworker/0:1]
+root      5672  0.0  0.0      0     0 ?        S    12:07   0:00 [kworker/1:2]
+root      5673  0.0  0.0      0     0 ?        S    12:12   0:00 [kworker/0:0]
+root      5674  0.0  0.0      0     0 ?        S    12:13   0:00 [kworker/1:0]
+
+If kworkers are going crazy (using too much cpu), there are two types
+of possible problems:
+
+        1. Something beeing scheduled in rapid succession
+        2. A single work item that consumes lots of cpu cycles
+
+The first one can be tracked using tracing:
+
+        $ echo workqueue:workqueue_queue_work > /sys/kernel/debug/tracing/set_event
+        $ cat /sys/kernel/debug/tracing/trace_pipe > out.txt
+        (wait a few secs)
+        ^C
+
+If something is busy looping on work queueing, it would be dominating
+the output and the offender can be determined with the work item
+function.
+
+For the second type of problems it should be possible to just check
+the stack trace of the offending worker thread.
+
+        $ cat /proc/THE_OFFENDING_KWORKER/stack
+
+The work item's function should be trivially visible in the stack
+trace.
diff --git a/MAINTAINERS b/MAINTAINERS
index 13803127b68f..16a5c5f2c6a6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1032,12 +1032,13 @@ W:	http://www.fluff.org/ben/linux/
 S:      Maintained
 F:      arch/arm/mach-s3c64xx/
 
-ARM/S5P ARM ARCHITECTURES
+ARM/S5P EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene.kim@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-s5p*/
+F:      arch/arm/mach-exynos*/
 
 ARM/SAMSUNG MOBILE MACHINE SUPPORT
 M:      Kyungmin Park <kyungmin.park@samsung.com>
@@ -2808,7 +2809,7 @@ GPIO SUBSYSTEM
 M:      Grant Likely <grant.likely@secretlab.ca>
 S:      Maintained
 T:      git git://git.secretlab.ca/git/linux-2.6.git
-F:      Documentation/gpio/gpio.txt
+F:      Documentation/gpio.txt
 F:      drivers/gpio/
 F:      include/linux/gpio*
 
@@ -6555,7 +6556,7 @@ S:	Maintained
 F:      drivers/usb/host/uhci*
 
 USB "USBNET" DRIVER FRAMEWORK
-M:      David Brownell <dbrownell@users.sourceforge.net>
+M:      Oliver Neukum <oneukum@suse.de>
 L:      netdev@vger.kernel.org
 W:      http://www.linux-usb.org/usbnet
 S:      Maintained
@@ -6921,6 +6922,18 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86.
 S:      Maintained
 F:      drivers/platform/x86
 
+XEN HYPERVISOR INTERFACE
+M:      Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+L:      xen-devel@lists.xensource.com (moderated for non-subscribers)
+L:      virtualization@lists.linux-foundation.org
+S:      Supported
+F:      arch/x86/xen/
+F:      drivers/*/xen-*front.c
+F:      drivers/xen/
+F:      arch/x86/include/asm/xen/
+F:      include/xen/
+
 XEN NETWORK BACKEND DRIVER
 M:      Ian Campbell <ian.campbell@citrix.com>
 L:      xen-devel@lists.xensource.com (moderated for non-subscribers)
@@ -6942,18 +6955,6 @@ S:	Supported
 F:      arch/x86/xen/*swiotlb*
 F:      drivers/xen/*swiotlb*
 
-XEN HYPERVISOR INTERFACE
-M:      Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
-M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-L:      xen-devel@lists.xensource.com (moderated for non-subscribers)
-L:      virtualization@lists.linux-foundation.org
-S:      Supported
-F:      arch/x86/xen/
-F:      drivers/*/xen-*front.c
-F:      drivers/xen/
-F:      arch/x86/include/asm/xen/
-F:      include/xen/
-
 XFS FILESYSTEM
 P:      Silicon Graphics Inc
 M:      Alex Elder <aelder@sgi.com>
diff --git a/Makefile b/Makefile
index b967b967572b..41ea6fbec55a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 39
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc7
 NAME = Flesh-Eating Bats with Fangs
 
 # *DOCUMENTATION*
diff --git a/arch/arm/configs/at91x40_defconfig b/arch/arm/configs/at91x40_defconfig
new file mode 100644
index 000000000000..c55e9212fcbb
--- /dev/null
+++ b/arch/arm/configs/at91x40_defconfig
@@ -0,0 +1,48 @@
+CONFIG_EXPERIMENTAL=y
+CONFIG_LOG_BUF_SHIFT=14
+CONFIG_EMBEDDED=y
+# CONFIG_HOTPLUG is not set
+# CONFIG_ELF_CORE is not set
+# CONFIG_FUTEX is not set
+# CONFIG_TIMERFD is not set
+# CONFIG_VM_EVENT_COUNTERS is not set
+# CONFIG_COMPAT_BRK is not set
+CONFIG_SLAB=y
+# CONFIG_LBDAF is not set
+# CONFIG_BLK_DEV_BSG is not set
+# CONFIG_IOSCHED_DEADLINE is not set
+# CONFIG_IOSCHED_CFQ is not set
+# CONFIG_MMU is not set
+CONFIG_ARCH_AT91=y
+CONFIG_ARCH_AT91X40=y
+CONFIG_MACH_AT91EB01=y
+CONFIG_AT91_EARLY_USART0=y
+CONFIG_CPU_ARM7TDMI=y
+CONFIG_SET_MEM_PARAM=y
+CONFIG_DRAM_BASE=0x01000000
+CONFIG_DRAM_SIZE=0x00400000
+CONFIG_FLASH_MEM_BASE=0x01400000
+CONFIG_PROCESSOR_ID=0x14000040
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_BINFMT_FLAT=y
+# CONFIG_SUSPEND is not set
+# CONFIG_FW_LOADER is not set
+CONFIG_MTD=y
+CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_CHAR=y
+CONFIG_MTD_BLOCK=y
+CONFIG_MTD_RAM=y
+CONFIG_MTD_ROM=y
+CONFIG_BLK_DEV_RAM=y
+# CONFIG_INPUT is not set
+# CONFIG_SERIO is not set
+# CONFIG_VT is not set
+# CONFIG_DEVKMEM is not set
+# CONFIG_HW_RANDOM is not set
+# CONFIG_HWMON is not set
+# CONFIG_USB_SUPPORT is not set
+CONFIG_EXT2_FS=y
+# CONFIG_DNOTIFY is not set
+CONFIG_ROMFS_FS=y
+# CONFIG_ENABLE_MUST_CHECK is not set
diff --git a/arch/arm/include/asm/kprobes.h b/arch/arm/include/asm/kprobes.h
index bb8a19bd5822..e46bdd0097eb 100644
--- a/arch/arm/include/asm/kprobes.h
+++ b/arch/arm/include/asm/kprobes.h
@@ -39,10 +39,13 @@ typedef u32 kprobe_opcode_t;
 struct kprobe;
 typedef void (kprobe_insn_handler_t)(struct kprobe *, struct pt_regs *);
 
+typedef unsigned long (kprobe_check_cc)(unsigned long);
+
 /* Architecture specific copy of original instruction. */
 struct arch_specific_insn {
         kprobe_opcode_t         *insn;
         kprobe_insn_handler_t   *insn_handler;
+        kprobe_check_cc         *insn_check_cc;
 };
 
 struct prev_kprobe {
diff --git a/arch/arm/kernel/kprobes-decode.c b/arch/arm/kernel/kprobes-decode.c
index 23891317dc4b..15eeff6aea0e 100644
--- a/arch/arm/kernel/kprobes-decode.c
+++ b/arch/arm/kernel/kprobes-decode.c
@@ -34,9 +34,6 @@
  *
  *   *) If the PC is written to by the instruction, the
  *      instruction must be fully simulated in software.
- *      If it is a conditional instruction, the handler
- *      will use insn[0] to copy its condition code to
- *      set r0 to 1 and insn[1] to "mov pc, lr" to return.
  *
  *   *) Otherwise, a modified form of the instruction is
  *      directly executed.  Its handler calls the
@@ -68,13 +65,17 @@
 
 #define branch_displacement(insn) sign_extend(((insn) & 0xffffff) << 2, 25)
 
+#define is_r15(insn, bitpos) (((insn) & (0xf << bitpos)) == (0xf << bitpos))
+
+/*
+ * Test if load/store instructions writeback the address register.
+ * if P (bit 24) == 0 or W (bit 21) == 1
+ */
+#define is_writeback(insn) ((insn ^ 0x01000000) & 0x01200000)
+
 #define PSR_fs  (PSR_f|PSR_s)
 
 #define KPROBE_RETURN_INSTRUCTION       0xe1a0f00e      /* mov pc, lr */
-#define SET_R0_TRUE_INSTRUCTION         0xe3a00001      /* mov  r0, #1 */
-
-#define truecc_insn(insn)       (((insn) & 0xf0000000) | \
-                                 (SET_R0_TRUE_INSTRUCTION & 0x0fffffff))
 
 typedef long (insn_0arg_fn_t)(void);
 typedef long (insn_1arg_fn_t)(long);
@@ -419,14 +420,10 @@ insnslot_llret_4arg_rwflags(long r0, long r1, long r2, long r3, long *cpsr,
 
 static void __kprobes simulate_bbl(struct kprobe *p, struct pt_regs *regs)
 {
-        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
         long iaddr = (long)p->addr;
         int disp  = branch_displacement(insn);
 
-        if (!insnslot_1arg_rflags(0, regs->ARM_cpsr, i_fn))
-                return;
-
         if (insn & (1 << 24))
                 regs->ARM_lr = iaddr + 4;
 
@@ -446,14 +443,10 @@ static void __kprobes simulate_blx1(struct kprobe *p, struct pt_regs *regs)
 
 static void __kprobes simulate_blx2bx(struct kprobe *p, struct pt_regs *regs)
 {
-        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
         int rm = insn & 0xf;
         long rmv = regs->uregs[rm];
 
-        if (!insnslot_1arg_rflags(0, regs->ARM_cpsr, i_fn))
-                return;
-
         if (insn & (1 << 5))
                 regs->ARM_lr = (long)p->addr + 4;
 
@@ -463,9 +456,16 @@ static void __kprobes simulate_blx2bx(struct kprobe *p, struct pt_regs *regs)
                 regs->ARM_cpsr |= PSR_T_BIT;
 }
 
+static void __kprobes simulate_mrs(struct kprobe *p, struct pt_regs *regs)
+{
+        kprobe_opcode_t insn = p->opcode;
+        int rd = (insn >> 12) & 0xf;
+        unsigned long mask = 0xf8ff03df; /* Mask out execution state */
+        regs->uregs[rd] = regs->ARM_cpsr & mask;
+}
+
 static void __kprobes simulate_ldm1stm1(struct kprobe *p, struct pt_regs *regs)
 {
-        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
         int rn = (insn >> 16) & 0xf;
         int lbit = insn & (1 << 20);
@@ -476,9 +476,6 @@ static void __kprobes simulate_ldm1stm1(struct kprobe *p, struct pt_regs *regs)
         int reg_bit_vector;
         int reg_count;
 
-        if (!insnslot_1arg_rflags(0, regs->ARM_cpsr, i_fn))
-                return;
-
         reg_count = 0;
         reg_bit_vector = insn & 0xffff;
         while (reg_bit_vector) {
@@ -510,11 +507,6 @@ static void __kprobes simulate_ldm1stm1(struct kprobe *p, struct pt_regs *regs)
 
 static void __kprobes simulate_stm1_pc(struct kprobe *p, struct pt_regs *regs)
 {
-        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
-
-        if (!insnslot_1arg_rflags(0, regs->ARM_cpsr, i_fn))
-                return;
-
         regs->ARM_pc = (long)p->addr + str_pc_offset;
         simulate_ldm1stm1(p, regs);
         regs->ARM_pc = (long)p->addr + 4;
@@ -525,24 +517,16 @@ static void __kprobes simulate_mov_ipsp(struct kprobe *p, struct pt_regs *regs)
         regs->uregs[12] = regs->uregs[13];
 }
 
-static void __kprobes emulate_ldcstc(struct kprobe *p, struct pt_regs *regs)
-{
-        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
-        kprobe_opcode_t insn = p->opcode;
-        int rn = (insn >> 16) & 0xf;
-        long rnv = regs->uregs[rn];
-
-        /* Save Rn in case of writeback. */
-        regs->uregs[rn] = insnslot_1arg_rflags(rnv, regs->ARM_cpsr, i_fn);
-}
-
 static void __kprobes emulate_ldrd(struct kprobe *p, struct pt_regs *regs)
 {
         insn_2arg_fn_t *i_fn = (insn_2arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
+        long ppc = (long)p->addr + 8;
         int rd = (insn >> 12) & 0xf;
         int rn = (insn >> 16) & 0xf;
         int rm = insn & 0xf;  /* rm may be invalid, don't care. */
+        long rmv = (rm == 15) ? ppc : regs->uregs[rm];
+        long rnv = (rn == 15) ? ppc : regs->uregs[rn];
 
         /* Not following the C calling convention here, so need asm(). */
         __asm__ __volatile__ (
@@ -554,29 +538,36 @@ static void __kprobes emulate_ldrd(struct kprobe *p, struct pt_regs *regs)
                 "str    r0, %[rn]       \n\t"   /* in case of writeback */
                 "str    r2, %[rd0]      \n\t"
                 "str    r3, %[rd1]      \n\t"
-                : [rn]  "+m" (regs->uregs[rn]),
+                : [rn]  "+m" (rnv),
                   [rd0] "=m" (regs->uregs[rd]),
                   [rd1] "=m" (regs->uregs[rd+1])
-                : [rm]   "m" (regs->uregs[rm]),
+                : [rm]   "m" (rmv),
                   [cpsr] "r" (regs->ARM_cpsr),
                   [i_fn] "r" (i_fn)
                 : "r0", "r1", "r2", "r3", "lr", "cc"
         );
+        if (is_writeback(insn))
+                regs->uregs[rn] = rnv;
 }
 
 static void __kprobes emulate_strd(struct kprobe *p, struct pt_regs *regs)
 {
         insn_4arg_fn_t *i_fn = (insn_4arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
+        long ppc = (long)p->addr + 8;
         int rd = (insn >> 12) & 0xf;
         int rn = (insn >> 16) & 0xf;
         int rm  = insn & 0xf;
-        long rnv = regs->uregs[rn];
-        long rmv = regs->uregs[rm];  /* rm/rmv may be invalid, don't care. */
+        long rnv = (rn == 15) ? ppc : regs->uregs[rn];
+        /* rm/rmv may be invalid, don't care. */
+        long rmv = (rm == 15) ? ppc : regs->uregs[rm];
+        long rnv_wb;
 
-        regs->uregs[rn] = insnslot_4arg_rflags(rnv, rmv, regs->uregs[rd],
+        rnv_wb = insnslot_4arg_rflags(rnv, rmv, regs->uregs[rd],
                                                regs->uregs[rd+1],
                                                regs->ARM_cpsr, i_fn);
+        if (is_writeback(insn))
+                regs->uregs[rn] = rnv_wb;
 }
 
 static void __kprobes emulate_ldr(struct kprobe *p, struct pt_regs *regs)
@@ -630,31 +621,6 @@ static void __kprobes emulate_str(struct kprobe *p, struct pt_regs *regs)
                 regs->uregs[rn] = rnv_wb;  /* Save Rn in case of writeback. */
 }
 
-static void __kprobes emulate_mrrc(struct kprobe *p, struct pt_regs *regs)
-{
-        insn_llret_0arg_fn_t *i_fn = (insn_llret_0arg_fn_t *)&p->ainsn.insn[0];
-        kprobe_opcode_t insn = p->opcode;
-        union reg_pair fnr;
-        int rd = (insn >> 12) & 0xf;
-        int rn = (insn >> 16) & 0xf;
-
-        fnr.dr = insnslot_llret_0arg_rflags(regs->ARM_cpsr, i_fn);
-        regs->uregs[rn] = fnr.r0;
-        regs->uregs[rd] = fnr.r1;
-}
-
-static void __kprobes emulate_mcrr(struct kprobe *p, struct pt_regs *regs)
-{
-        insn_2arg_fn_t *i_fn = (insn_2arg_fn_t *)&p->ainsn.insn[0];
-        kprobe_opcode_t insn = p->opcode;
-        int rd = (insn >> 12) & 0xf;
-        int rn = (insn >> 16) & 0xf;
-        long rnv = regs->uregs[rn];
-        long rdv = regs->uregs[rd];
-
-        insnslot_2arg_rflags(rnv, rdv, regs->ARM_cpsr, i_fn);
-}
-
 static void __kprobes emulate_sat(struct kprobe *p, struct pt_regs *regs)
 {
         insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
@@ -688,32 +654,32 @@ static void __kprobes emulate_none(struct kprobe *p, struct pt_regs *regs)
         insnslot_0arg_rflags(regs->ARM_cpsr, i_fn);
 }
 
-static void __kprobes emulate_rd12(struct kprobe *p, struct pt_regs *regs)
+static void __kprobes emulate_nop(struct kprobe *p, struct pt_regs *regs)
 {
-        insn_0arg_fn_t *i_fn = (insn_0arg_fn_t *)&p->ainsn.insn[0];
-        kprobe_opcode_t insn = p->opcode;
-        int rd = (insn >> 12) & 0xf;
-
-        regs->uregs[rd] = insnslot_0arg_rflags(regs->ARM_cpsr, i_fn);
 }
 
-static void __kprobes emulate_ird12(struct kprobe *p, struct pt_regs *regs)
+static void __kprobes
+emulate_rd12_modify(struct kprobe *p, struct pt_regs *regs)
 {
         insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
-        int ird = (insn >> 12) & 0xf;
+        int rd = (insn >> 12) & 0xf;
+        long rdv = regs->uregs[rd];
 
-        insnslot_1arg_rflags(regs->uregs[ird], regs->ARM_cpsr, i_fn);
+        regs->uregs[rd] = insnslot_1arg_rflags(rdv, regs->ARM_cpsr, i_fn);
 }
 
-static void __kprobes emulate_rn16(struct kprobe *p, struct pt_regs *regs)
+static void __kprobes
+emulate_rd12rn0_modify(struct kprobe *p, struct pt_regs *regs)
 {
-        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
+        insn_2arg_fn_t *i_fn = (insn_2arg_fn_t *)&p->ainsn.insn[0];
         kprobe_opcode_t insn = p->opcode;
-        int rn = (insn >> 16) & 0xf;
+        int rd = (insn >> 12) & 0xf;
+        int rn = insn & 0xf;
+        long rdv = regs->uregs[rd];
         long rnv = regs->uregs[rn];
 
-        insnslot_1arg_rflags(rnv, regs->ARM_cpsr, i_fn);
+        regs->uregs[rd] = insnslot_2arg_rflags(rdv, rnv, regs->ARM_cpsr, i_fn);
 }
 
 static void __kprobes emulate_rd12rm0(struct kprobe *p, struct pt_regs *regs)
@@ -819,6 +785,17 @@ emulate_alu_imm_rwflags(struct kprobe *p, struct pt_regs *regs)
 }
 
 static void __kprobes
+emulate_alu_tests_imm(struct kprobe *p, struct pt_regs *regs)
+{
+        insn_1arg_fn_t *i_fn = (insn_1arg_fn_t *)&p->ainsn.insn[0];
+        kprobe_opcode_t insn = p->opcode;
+        int rn = (insn >> 16) & 0xf;
+        long rnv = (rn == 15) ? (long)p->addr + 8 : regs->uregs[rn];
+
+        insnslot_1arg_rwflags(rnv, &regs->ARM_cpsr, i_fn);
+}
+
+static void __kprobes
 emulate_alu_rflags(struct kprobe *p, struct pt_regs *regs)
 {
         insn_3arg_fn_t *i_fn = (insn_3arg_fn_t *)&p->ainsn.insn[0];
@@ -854,14 +831,34 @@ emulate_alu_rwflags(struct kprobe *p, struct pt_regs *regs)
                 insnslot_3arg_rwflags(rnv, rmv, rsv, &regs->ARM_cpsr, i_fn);
 }
 
+static void __kprobes
+emulate_alu_tests(struct kprobe *p, struct pt_regs *regs)
+{
+        insn_3arg_fn_t *i_fn = (insn_3arg_fn_t *)&p->ainsn.insn[0];
+        kprobe_opcode_t insn = p->opcode;
+        long ppc = (long)p->addr + 8;
+        int rn = (insn >> 16) & 0xf;
+        int rs = (insn >> 8) & 0xf;     /* rs/rsv may be invalid, don't care. */
+        int rm = insn & 0xf;
+        long rnv = (rn == 15) ? ppc : regs->uregs[rn];
+        long rmv = (rm == 15) ? ppc : regs->uregs[rm];
+        long rsv = regs->uregs[rs];
+
+        insnslot_3arg_rwflags(rnv, rmv, rsv, &regs->ARM_cpsr, i_fn);
+}
+
 static enum kprobe_insn __kprobes
 prep_emulate_ldr_str(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
-        int ibit = (insn & (1 << 26)) ? 25 : 22;
+        int not_imm = (insn & (1 << 26)) ? (insn & (1 << 25))
+                                         : (~insn & (1 << 22));
+
+        if (is_writeback(insn) && is_r15(insn, 16))
+                return INSN_REJECTED;   /* Writeback to PC */
 
         insn &= 0xfff00fff;
         insn |= 0x00001000;     /* Rn = r0, Rd = r1 */
-        if (insn & (1 << ibit)) {
+        if (not_imm) {
                 insn &= ~0xf;
                 insn |= 2;      /* Rm = r2 */
         }
@@ -871,20 +868,40 @@ prep_emulate_ldr_str(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 }
 
 static enum kprobe_insn __kprobes
-prep_emulate_rd12rm0(kprobe_opcode_t insn, struct arch_specific_insn *asi)
+prep_emulate_rd12_modify(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
-        insn &= 0xffff0ff0;     /* Rd = r0, Rm = r0 */
+        if (is_r15(insn, 12))
+                return INSN_REJECTED;   /* Rd is PC */
+
+        insn &= 0xffff0fff;     /* Rd = r0 */
         asi->insn[0] = insn;
-        asi->insn_handler = emulate_rd12rm0;
+        asi->insn_handler = emulate_rd12_modify;
         return INSN_GOOD;
 }
 
 static enum kprobe_insn __kprobes
-prep_emulate_rd12(kprobe_opcode_t insn, struct arch_specific_insn *asi)
+prep_emulate_rd12rn0_modify(kprobe_opcode_t insn,
+                            struct arch_specific_insn *asi)
 {
-        insn &= 0xffff0fff;     /* Rd = r0 */
+        if (is_r15(insn, 12))
+                return INSN_REJECTED;   /* Rd is PC */
+
+        insn &= 0xffff0ff0;     /* Rd = r0 */
+        insn |= 0x00000001;     /* Rn = r1 */
+        asi->insn[0] = insn;
+        asi->insn_handler = emulate_rd12rn0_modify;
+        return INSN_GOOD;
+}
+
+static enum kprobe_insn __kprobes
+prep_emulate_rd12rm0(kprobe_opcode_t insn, struct arch_specific_insn *asi)
+{
+        if (is_r15(insn, 12))
+                return INSN_REJECTED;   /* Rd is PC */
+
+        insn &= 0xffff0ff0;     /* Rd = r0, Rm = r0 */
         asi->insn[0] = insn;
-        asi->insn_handler = emulate_rd12;
+        asi->insn_handler = emulate_rd12rm0;
         return INSN_GOOD;
 }
 
@@ -892,6 +909,9 @@ static enum kprobe_insn __kprobes
 prep_emulate_rd12rn16rm0_wflags(kprobe_opcode_t insn,
                                 struct arch_specific_insn *asi)
 {
+        if (is_r15(insn, 12))
+                return INSN_REJECTED;   /* Rd is PC */
+
         insn &= 0xfff00ff0;     /* Rd = r0, Rn = r0 */
         insn |= 0x00000001;     /* Rm = r1 */
         asi->insn[0] = insn;
@@ -903,6 +923,9 @@ static enum kprobe_insn __kprobes
 prep_emulate_rd16rs8rm0_wflags(kprobe_opcode_t insn,
                                struct arch_specific_insn *asi)
 {
+        if (is_r15(insn, 16))
+                return INSN_REJECTED;   /* Rd is PC */
+
         insn &= 0xfff0f0f0;     /* Rd = r0, Rs = r0 */
         insn |= 0x00000001;     /* Rm = r1          */
         asi->insn[0] = insn;
@@ -914,6 +937,9 @@ static enum kprobe_insn __kprobes
 prep_emulate_rd16rn12rs8rm0_wflags(kprobe_opcode_t insn,
                                    struct arch_specific_insn *asi)
 {
+        if (is_r15(insn, 16))
+                return INSN_REJECTED;   /* Rd is PC */
+
         insn &= 0xfff000f0;     /* Rd = r0, Rn = r0 */
         insn |= 0x00000102;     /* Rs = r1, Rm = r2 */
         asi->insn[0] = insn;
@@ -925,6 +951,9 @@ static enum kprobe_insn __kprobes
 prep_emulate_rdhi16rdlo12rs8rm0_wflags(kprobe_opcode_t insn,
                                        struct arch_specific_insn *asi)
 {
+        if (is_r15(insn, 16) || is_r15(insn, 12))
+                return INSN_REJECTED;   /* RdHi or RdLo is PC */
+
         insn &= 0xfff000f0;     /* RdHi = r0, RdLo = r1 */
         insn |= 0x00001203;     /* Rs = r2, Rm = r3 */
         asi->insn[0] = insn;
@@ -945,20 +974,13 @@ prep_emulate_rdhi16rdlo12rs8rm0_wflags(kprobe_opcode_t insn,
 static enum kprobe_insn __kprobes
 space_1111(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
-        /* CPS mmod == 1 : 1111 0001 0000 xx10 xxxx xxxx xx0x xxxx */
-        /* RFE           : 1111 100x x0x1 xxxx xxxx 1010 xxxx xxxx */
-        /* SRS           : 1111 100x x1x0 1101 xxxx 0101 xxxx xxxx */
-        if ((insn & 0xfff30020) == 0xf1020000 ||
-            (insn & 0xfe500f00) == 0xf8100a00 ||
-            (insn & 0xfe5f0f00) == 0xf84d0500)
-                return INSN_REJECTED;
-
-        /* PLD : 1111 01x1 x101 xxxx xxxx xxxx xxxx xxxx : */
-        if ((insn & 0xfd700000) == 0xf4500000) {
-                insn &= 0xfff0ffff;     /* Rn = r0 */
-                asi->insn[0] = insn;
-                asi->insn_handler = emulate_rn16;
-                return INSN_GOOD;
+        /* memory hint : 1111 0100 x001 xxxx xxxx xxxx xxxx xxxx : */
+        /* PLDI        : 1111 0100 x101 xxxx xxxx xxxx xxxx xxxx : */
+        /* PLDW        : 1111 0101 x001 xxxx xxxx xxxx xxxx xxxx : */
+        /* PLD         : 1111 0101 x101 xxxx xxxx xxxx xxxx xxxx : */
+        if ((insn & 0xfe300000) == 0xf4100000) {
+                asi->insn_handler = emulate_nop;
+                return INSN_GOOD_NO_SLOT;
         }
 
         /* BLX(1) : 1111 101x xxxx xxxx xxxx xxxx xxxx xxxx : */
@@ -967,41 +989,22 @@ space_1111(kprobe_opcode_t insn, struct arch_specific_insn *asi)
                 return INSN_GOOD_NO_SLOT;
         }
 
-        /* SETEND : 1111 0001 0000 0001 xxxx xxxx 0000 xxxx */
-        /* CDP2   : 1111 1110 xxxx xxxx xxxx xxxx xxx0 xxxx */
-        if ((insn & 0xffff00f0) == 0xf1010000 ||
-            (insn & 0xff000010) == 0xfe000000) {
-                asi->insn[0] = insn;
-                asi->insn_handler = emulate_none;
-                return INSN_GOOD;
-        }
+        /* CPS   : 1111 0001 0000 xxx0 xxxx xxxx xx0x xxxx */
+        /* SETEND: 1111 0001 0000 0001 xxxx xxxx 0000 xxxx */
 
+        /* SRS   : 1111 100x x1x0 xxxx xxxx xxxx xxxx xxxx */
+        /* RFE   : 1111 100x x0x1 xxxx xxxx xxxx xxxx xxxx */
+
+        /* Coprocessor instructions... */
         /* MCRR2 : 1111 1100 0100 xxxx xxxx xxxx xxxx xxxx : (Rd != Rn) */
         /* MRRC2 : 1111 1100 0101 xxxx xxxx xxxx xxxx xxxx : (Rd != Rn) */
-        if ((insn & 0xffe00000) == 0xfc400000) {
-                insn &= 0xfff00fff;     /* Rn = r0 */
-                insn |= 0x00001000;     /* Rd = r1 */
-                asi->insn[0] = insn;
-                asi->insn_handler =
-                        (insn & (1 << 20)) ? emulate_mrrc : emulate_mcrr;
-                return INSN_GOOD;
-        }
+        /* LDC2  : 1111 110x xxx1 xxxx xxxx xxxx xxxx xxxx */
+        /* STC2  : 1111 110x xxx0 xxxx xxxx xxxx xxxx xxxx */
+        /* CDP2  : 1111 1110 xxxx xxxx xxxx xxxx xxx0 xxxx */
+        /* MCR2  : 1111 1110 xxx0 xxxx xxxx xxxx xxx1 xxxx */
+        /* MRC2  : 1111 1110 xxx1 xxxx xxxx xxxx xxx1 xxxx */
 
-        /* LDC2 : 1111 110x xxx1 xxxx xxxx xxxx xxxx xxxx */
-        /* STC2 : 1111 110x xxx0 xxxx xxxx xxxx xxxx xxxx */
-        if ((insn & 0xfe000000) == 0xfc000000) {
-                insn &= 0xfff0ffff;      /* Rn = r0 */
-                asi->insn[0] = insn;
-                asi->insn_handler = emulate_ldcstc;
-                return INSN_GOOD;
-        }
-
-        /* MCR2 : 1111 1110 xxx0 xxxx xxxx xxxx xxx1 xxxx */
-        /* MRC2 : 1111 1110 xxx1 xxxx xxxx xxxx xxx1 xxxx */
-        insn &= 0xffff0fff;     /* Rd = r0 */
-        asi->insn[0]      = insn;
-        asi->insn_handler = (insn & (1 << 20)) ? emulate_rd12 : emulate_ird12;
-        return INSN_GOOD;
+        return INSN_REJECTED;
 }
 
 static enum kprobe_insn __kprobes
@@ -1010,19 +1013,18 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
         /* cccc 0001 0xx0 xxxx xxxx xxxx xxxx xxx0 xxxx */
         if ((insn & 0x0f900010) == 0x01000000) {
 
-                /* BXJ  : cccc 0001 0010 xxxx xxxx xxxx 0010 xxxx */
-                /* MSR  : cccc 0001 0x10 xxxx xxxx xxxx 0000 xxxx */
-                if ((insn & 0x0ff000f0) == 0x01200020 ||
-                    (insn & 0x0fb000f0) == 0x01200000)
-                        return INSN_REJECTED;
-
-                /* MRS : cccc 0001 0x00 xxxx xxxx xxxx 0000 xxxx */
-                if ((insn & 0x0fb00010) == 0x01000000)
-                        return prep_emulate_rd12(insn, asi);
+                /* MRS cpsr : cccc 0001 0000 xxxx xxxx xxxx 0000 xxxx */
+                if ((insn & 0x0ff000f0) == 0x01000000) {
+                        if (is_r15(insn, 12))
+                                return INSN_REJECTED;   /* Rd is PC */
+                        asi->insn_handler = simulate_mrs;
+                        return INSN_GOOD_NO_SLOT;
+                }
 
                 /* SMLALxy : cccc 0001 0100 xxxx xxxx xxxx 1xx0 xxxx */
                 if ((insn & 0x0ff00090) == 0x01400080)
-                        return prep_emulate_rdhi16rdlo12rs8rm0_wflags(insn, asi);
+                        return prep_emulate_rdhi16rdlo12rs8rm0_wflags(insn,
+                                                                        asi);
 
                 /* SMULWy : cccc 0001 0010 xxxx xxxx xxxx 1x10 xxxx */
                 /* SMULxy : cccc 0001 0110 xxxx xxxx xxxx 1xx0 xxxx */
@@ -1031,24 +1033,29 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
                         return prep_emulate_rd16rs8rm0_wflags(insn, asi);
 
                 /* SMLAxy : cccc 0001 0000 xxxx xxxx xxxx 1xx0 xxxx : Q */
-                /* SMLAWy : cccc 0001 0010 xxxx xxxx xxxx 0x00 xxxx : Q */
-                return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
+                /* SMLAWy : cccc 0001 0010 xxxx xxxx xxxx 1x00 xxxx : Q */
+                if ((insn & 0x0ff00090) == 0x01000080 ||
+                    (insn & 0x0ff000b0) == 0x01200080)
+                        return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
+
+                /* BXJ      : cccc 0001 0010 xxxx xxxx xxxx 0010 xxxx */
+                /* MSR      : cccc 0001 0x10 xxxx xxxx xxxx 0000 xxxx */
+                /* MRS spsr : cccc 0001 0100 xxxx xxxx xxxx 0000 xxxx */
 
+                /* Other instruction encodings aren't yet defined */
+                return INSN_REJECTED;
         }
 
         /* cccc 0001 0xx0 xxxx xxxx xxxx xxxx 0xx1 xxxx */
         else if ((insn & 0x0f900090) == 0x01000010) {
 
-                /* BKPT : 1110 0001 0010 xxxx xxxx xxxx 0111 xxxx */
-                if ((insn & 0xfff000f0) == 0xe1200070)
-                        return INSN_REJECTED;
-
                 /* BLX(2) : cccc 0001 0010 xxxx xxxx xxxx 0011 xxxx */
                 /* BX     : cccc 0001 0010 xxxx xxxx xxxx 0001 xxxx */
                 if ((insn & 0x0ff000d0) == 0x01200010) {
-                        asi->insn[0] = truecc_insn(insn);
+                        if ((insn & 0x0ff000ff) == 0x0120003f)
+                                return INSN_REJECTED; /* BLX pc */
                         asi->insn_handler = simulate_blx2bx;
-                        return INSN_GOOD;
+                        return INSN_GOOD_NO_SLOT;
                 }
 
                 /* CLZ : cccc 0001 0110 xxxx xxxx xxxx 0001 xxxx */
@@ -1059,17 +1066,27 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
                 /* QSUB    : cccc 0001 0010 xxxx xxxx xxxx 0101 xxxx :Q */
                 /* QDADD   : cccc 0001 0100 xxxx xxxx xxxx 0101 xxxx :Q */
                 /* QDSUB   : cccc 0001 0110 xxxx xxxx xxxx 0101 xxxx :Q */
-                return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+                if ((insn & 0x0f9000f0) == 0x01000050)
+                        return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+
+                /* BKPT : 1110 0001 0010 xxxx xxxx xxxx 0111 xxxx */
+                /* SMC  : cccc 0001 0110 xxxx xxxx xxxx 0111 xxxx */
+
+                /* Other instruction encodings aren't yet defined */
+                return INSN_REJECTED;
         }
 
         /* cccc 0000 xxxx xxxx xxxx xxxx xxxx 1001 xxxx */
-        else if ((insn & 0x0f000090) == 0x00000090) {
+        else if ((insn & 0x0f0000f0) == 0x00000090) {
 
                 /* MUL    : cccc 0000 0000 xxxx xxxx xxxx 1001 xxxx :   */
                 /* MULS   : cccc 0000 0001 xxxx xxxx xxxx 1001 xxxx :cc */
                 /* MLA    : cccc 0000 0010 xxxx xxxx xxxx 1001 xxxx :   */
                 /* MLAS   : cccc 0000 0011 xxxx xxxx xxxx 1001 xxxx :cc */
                 /* UMAAL  : cccc 0000 0100 xxxx xxxx xxxx 1001 xxxx :   */
+                /* undef  : cccc 0000 0101 xxxx xxxx xxxx 1001 xxxx :   */
+                /* MLS    : cccc 0000 0110 xxxx xxxx xxxx 1001 xxxx :   */
+                /* undef  : cccc 0000 0111 xxxx xxxx xxxx 1001 xxxx :   */
                 /* UMULL  : cccc 0000 1000 xxxx xxxx xxxx 1001 xxxx :   */
                 /* UMULLS : cccc 0000 1001 xxxx xxxx xxxx 1001 xxxx :cc */
                 /* UMLAL  : cccc 0000 1010 xxxx xxxx xxxx 1001 xxxx :   */
@@ -1078,13 +1095,15 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
                 /* SMULLS : cccc 0000 1101 xxxx xxxx xxxx 1001 xxxx :cc */
                 /* SMLAL  : cccc 0000 1110 xxxx xxxx xxxx 1001 xxxx :   */
                 /* SMLALS : cccc 0000 1111 xxxx xxxx xxxx 1001 xxxx :cc */
-                if ((insn & 0x0fe000f0) == 0x00000090) {
-                       return prep_emulate_rd16rs8rm0_wflags(insn, asi);
-                } else if  ((insn & 0x0fe000f0) == 0x00200090) {
-                       return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
-                } else {
-                       return prep_emulate_rdhi16rdlo12rs8rm0_wflags(insn, asi);
-                }
+                if ((insn & 0x00d00000) == 0x00500000)
+                        return INSN_REJECTED;
+                else if ((insn & 0x00e00000) == 0x00000000)
+                        return prep_emulate_rd16rs8rm0_wflags(insn, asi);
+                else if ((insn & 0x00a00000) == 0x00200000)
+                        return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
+                else
+                        return prep_emulate_rdhi16rdlo12rs8rm0_wflags(insn,
+                                                                        asi);
         }
 
         /* cccc 000x xxxx xxxx xxxx xxxx xxxx 1xx1 xxxx */
@@ -1092,23 +1111,45 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 
                 /* SWP   : cccc 0001 0000 xxxx xxxx xxxx 1001 xxxx */
                 /* SWPB  : cccc 0001 0100 xxxx xxxx xxxx 1001 xxxx */
-                /* LDRD  : cccc 000x xxx0 xxxx xxxx xxxx 1101 xxxx */
-                /* STRD  : cccc 000x xxx0 xxxx xxxx xxxx 1111 xxxx */
+                /* ???   : cccc 0001 0x01 xxxx xxxx xxxx 1001 xxxx */
+                /* ???   : cccc 0001 0x10 xxxx xxxx xxxx 1001 xxxx */
+                /* ???   : cccc 0001 0x11 xxxx xxxx xxxx 1001 xxxx */
                 /* STREX : cccc 0001 1000 xxxx xxxx xxxx 1001 xxxx */
                 /* LDREX : cccc 0001 1001 xxxx xxxx xxxx 1001 xxxx */
+                /* STREXD: cccc 0001 1010 xxxx xxxx xxxx 1001 xxxx */
+                /* LDREXD: cccc 0001 1011 xxxx xxxx xxxx 1001 xxxx */
+                /* STREXB: cccc 0001 1100 xxxx xxxx xxxx 1001 xxxx */
+                /* LDREXB: cccc 0001 1101 xxxx xxxx xxxx 1001 xxxx */
+                /* STREXH: cccc 0001 1110 xxxx xxxx xxxx 1001 xxxx */
+                /* LDREXH: cccc 0001 1111 xxxx xxxx xxxx 1001 xxxx */
+
+                /* LDRD  : cccc 000x xxx0 xxxx xxxx xxxx 1101 xxxx */
+                /* STRD  : cccc 000x xxx0 xxxx xxxx xxxx 1111 xxxx */
                 /* LDRH  : cccc 000x xxx1 xxxx xxxx xxxx 1011 xxxx */
                 /* STRH  : cccc 000x xxx0 xxxx xxxx xxxx 1011 xxxx */
                 /* LDRSB : cccc 000x xxx1 xxxx xxxx xxxx 1101 xxxx */
                 /* LDRSH : cccc 000x xxx1 xxxx xxxx xxxx 1111 xxxx */
-                if ((insn & 0x0fb000f0) == 0x01000090) {
-                        /* SWP/SWPB */
-                        return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+                if ((insn & 0x0f0000f0) == 0x01000090) {
+                        if ((insn & 0x0fb000f0) == 0x01000090) {
+                                /* SWP/SWPB */
+                                return prep_emulate_rd12rn16rm0_wflags(insn,
+                                                                        asi);
+                        } else {
+                                /* STREX/LDREX variants and unallocaed space */
+                                return INSN_REJECTED;
+                        }
+
                 } else if ((insn & 0x0e1000d0) == 0x00000d0) {
                         /* STRD/LDRD */
+                        if ((insn & 0x0000e000) == 0x0000e000)
+                                return INSN_REJECTED;   /* Rd is LR or PC */
+                        if (is_writeback(insn) && is_r15(insn, 16))
+                                return INSN_REJECTED;   /* Writeback to PC */
+
                         insn &= 0xfff00fff;
                         insn |= 0x00002000;     /* Rn = r0, Rd = r2 */
-                        if (insn & (1 << 22)) {
-                                /* I bit */
+                        if (!(insn & (1 << 22))) {
+                                /* Register index */
                                 insn &= ~0xf;
                                 insn |= 1;      /* Rm = r1 */
                         }
@@ -1118,6 +1159,9 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
                         return INSN_GOOD;
                 }
 
+                /* LDRH/STRH/LDRSB/LDRSH */
+                if (is_r15(insn, 12))
+                        return INSN_REJECTED;   /* Rd is PC */
                 return prep_emulate_ldr_str(insn, asi);
         }
 
@@ -1125,7 +1169,7 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 
         /*
          * ALU op with S bit and Rd == 15 :
-         *      cccc 000x xxx1 xxxx 1111 xxxx xxxx xxxx
+         *      cccc 000x xxx1 xxxx 1111 xxxx xxxx xxxx
          */
         if ((insn & 0x0e10f000) == 0x0010f000)
                 return INSN_REJECTED;
@@ -1154,22 +1198,61 @@ space_cccc_000x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
                 insn |= 0x00000200;     /* Rs = r2 */
         }
         asi->insn[0] = insn;
-        asi->insn_handler = (insn & (1 << 20)) ?  /* S-bit */
+
+        if ((insn & 0x0f900000) == 0x01100000) {
+                /*
+                 * TST : cccc 0001 0001 xxxx xxxx xxxx xxxx xxxx
+                 * TEQ : cccc 0001 0011 xxxx xxxx xxxx xxxx xxxx
+                 * CMP : cccc 0001 0101 xxxx xxxx xxxx xxxx xxxx
+                 * CMN : cccc 0001 0111 xxxx xxxx xxxx xxxx xxxx
+                 */
+                asi->insn_handler = emulate_alu_tests;
+        } else {
+                /* ALU ops which write to Rd */
+                asi->insn_handler = (insn & (1 << 20)) ?  /* S-bit */
                                 emulate_alu_rwflags : emulate_alu_rflags;
+        }
         return INSN_GOOD;
 }
 
 static enum kprobe_insn __kprobes
 space_cccc_001x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
+        /* MOVW  : cccc 0011 0000 xxxx xxxx xxxx xxxx xxxx */
+        /* MOVT  : cccc 0011 0100 xxxx xxxx xxxx xxxx xxxx */
+        if ((insn & 0x0fb00000) == 0x03000000)
+                return prep_emulate_rd12_modify(insn, asi);
+
+        /* hints : cccc 0011 0010 0000 xxxx xxxx xxxx xxxx */
+        if ((insn & 0x0fff0000) == 0x03200000) {
+                unsigned op2 = insn & 0x000000ff;
+                if (op2 == 0x01 || op2 == 0x04) {
+                        /* YIELD : cccc 0011 0010 0000 xxxx xxxx 0000 0001 */
+                        /* SEV   : cccc 0011 0010 0000 xxxx xxxx 0000 0100 */
+                        asi->insn[0] = insn;
+                        asi->insn_handler = emulate_none;
+                        return INSN_GOOD;
+                } else if (op2 <= 0x03) {
+                        /* NOP   : cccc 0011 0010 0000 xxxx xxxx 0000 0000 */
+                        /* WFE   : cccc 0011 0010 0000 xxxx xxxx 0000 0010 */
+                        /* WFI   : cccc 0011 0010 0000 xxxx xxxx 0000 0011 */
+                        /*
+                         * We make WFE and WFI true NOPs to avoid stalls due
+                         * to missing events whilst processing the probe.
+                         */
+                        asi->insn_handler = emulate_nop;
+                        return INSN_GOOD_NO_SLOT;
+                }
+                /* For DBG and unallocated hints it's safest to reject them */
+                return INSN_REJECTED;
+        }
+
         /*
          * MSR   : cccc 0011 0x10 xxxx xxxx xxxx xxxx xxxx
-         * Undef : cccc 0011 0100 xxxx xxxx xxxx xxxx xxxx
          * ALU op with S bit and Rd == 15 :
          *         cccc 001x xxx1 xxxx 1111 xxxx xxxx xxxx
          */
         if ((insn & 0x0fb00000) == 0x03200000 ||        /* MSR */
-            (insn & 0x0ff00000) == 0x03400000 ||        /* Undef */
             (insn & 0x0e10f000) == 0x0210f000)          /* ALU s-bit, R15  */
                 return INSN_REJECTED;
 
@@ -1180,10 +1263,22 @@ space_cccc_001x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
          * *S (bit 20) updates condition codes
          * ADC/SBC/RSC reads the C flag
          */
-        insn &= 0xffff0fff;     /* Rd = r0 */
+        insn &= 0xfff00fff;     /* Rn = r0 and Rd = r0 */
         asi->insn[0] = insn;
-        asi->insn_handler = (insn & (1 << 20)) ?  /* S-bit */
+
+        if ((insn & 0x0f900000) == 0x03100000) {
+                /*
+                 * TST : cccc 0011 0001 xxxx xxxx xxxx xxxx xxxx
+                 * TEQ : cccc 0011 0011 xxxx xxxx xxxx xxxx xxxx
+                 * CMP : cccc 0011 0101 xxxx xxxx xxxx xxxx xxxx
+                 * CMN : cccc 0011 0111 xxxx xxxx xxxx xxxx xxxx
+                 */
+                asi->insn_handler = emulate_alu_tests_imm;
+        } else {
+                /* ALU ops which write to Rd */
+                asi->insn_handler = (insn & (1 << 20)) ?  /* S-bit */
                         emulate_alu_imm_rwflags : emulate_alu_imm_rflags;
+        }
         return INSN_GOOD;
 }
 
@@ -1192,6 +1287,8 @@ space_cccc_0110__1(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
         /* SEL : cccc 0110 1000 xxxx xxxx xxxx 1011 xxxx GE: !!! */
         if ((insn & 0x0ff000f0) == 0x068000b0) {
+                if (is_r15(insn, 12))
+                        return INSN_REJECTED;   /* Rd is PC */
                 insn &= 0xfff00ff0;     /* Rd = r0, Rn = r0 */
                 insn |= 0x00000001;     /* Rm = r1 */
                 asi->insn[0] = insn;
@@ -1205,6 +1302,8 @@ space_cccc_0110__1(kprobe_opcode_t insn, struct arch_specific_insn *asi)
         /* USAT16 : cccc 0110 1110 xxxx xxxx xxxx 0011 xxxx :Q */
         if ((insn & 0x0fa00030) == 0x06a00010 ||
             (insn & 0x0fb000f0) == 0x06a00030) {
+                if (is_r15(insn, 12))
+                        return INSN_REJECTED;   /* Rd is PC */
                 insn &= 0xffff0ff0;     /* Rd = r0, Rm = r0 */
                 asi->insn[0] = insn;
                 asi->insn_handler = emulate_sat;
@@ -1213,57 +1312,101 @@ space_cccc_0110__1(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 
         /* REV    : cccc 0110 1011 xxxx xxxx xxxx 0011 xxxx */
         /* REV16  : cccc 0110 1011 xxxx xxxx xxxx 1011 xxxx */
+        /* RBIT   : cccc 0110 1111 xxxx xxxx xxxx 0011 xxxx */
         /* REVSH  : cccc 0110 1111 xxxx xxxx xxxx 1011 xxxx */
         if ((insn & 0x0ff00070) == 0x06b00030 ||
-            (insn & 0x0ff000f0) == 0x06f000b0)
+            (insn & 0x0ff00070) == 0x06f00030)
                 return prep_emulate_rd12rm0(insn, asi);
 
+        /* ???       : cccc 0110 0000 xxxx xxxx xxxx xxx1 xxxx :   */
         /* SADD16    : cccc 0110 0001 xxxx xxxx xxxx 0001 xxxx :GE */
         /* SADDSUBX  : cccc 0110 0001 xxxx xxxx xxxx 0011 xxxx :GE */
         /* SSUBADDX  : cccc 0110 0001 xxxx xxxx xxxx 0101 xxxx :GE */
         /* SSUB16    : cccc 0110 0001 xxxx xxxx xxxx 0111 xxxx :GE */
         /* SADD8     : cccc 0110 0001 xxxx xxxx xxxx 1001 xxxx :GE */
+        /* ???       : cccc 0110 0001 xxxx xxxx xxxx 1011 xxxx :   */
+        /* ???       : cccc 0110 0001 xxxx xxxx xxxx 1101 xxxx :   */
         /* SSUB8     : cccc 0110 0001 xxxx xxxx xxxx 1111 xxxx :GE */
         /* QADD16    : cccc 0110 0010 xxxx xxxx xxxx 0001 xxxx :   */
         /* QADDSUBX  : cccc 0110 0010 xxxx xxxx xxxx 0011 xxxx :   */
         /* QSUBADDX  : cccc 0110 0010 xxxx xxxx xxxx 0101 xxxx :   */
         /* QSUB16    : cccc 0110 0010 xxxx xxxx xxxx 0111 xxxx :   */
         /* QADD8     : cccc 0110 0010 xxxx xxxx xxxx 1001 xxxx :   */
+        /* ???       : cccc 0110 0010 xxxx xxxx xxxx 1011 xxxx :   */
+        /* ???       : cccc 0110 0010 xxxx xxxx xxxx 1101 xxxx :   */
         /* QSUB8     : cccc 0110 0010 xxxx xxxx xxxx 1111 xxxx :   */
         /* SHADD16   : cccc 0110 0011 xxxx xxxx xxxx 0001 xxxx :   */
         /* SHADDSUBX : cccc 0110 0011 xxxx xxxx xxxx 0011 xxxx :   */
         /* SHSUBADDX : cccc 0110 0011 xxxx xxxx xxxx 0101 xxxx :   */
         /* SHSUB16   : cccc 0110 0011 xxxx xxxx xxxx 0111 xxxx :   */
         /* SHADD8    : cccc 0110 0011 xxxx xxxx xxxx 1001 xxxx :   */
+        /* ???       : cccc 0110 0011 xxxx xxxx xxxx 1011 xxxx :   */
+        /* ???       : cccc 0110 0011 xxxx xxxx xxxx 1101 xxxx :   */
         /* SHSUB8    : cccc 0110 0011 xxxx xxxx xxxx 1111 xxxx :   */
+        /* ???       : cccc 0110 0100 xxxx xxxx xxxx xxx1 xxxx :   */
         /* UADD16    : cccc 0110 0101 xxxx xxxx xxxx 0001 xxxx :GE */
         /* UADDSUBX  : cccc 0110 0101 xxxx xxxx xxxx 0011 xxxx :GE */
         /* USUBADDX  : cccc 0110 0101 xxxx xxxx xxxx 0101 xxxx :GE */
         /* USUB16    : cccc 0110 0101 xxxx xxxx xxxx 0111 xxxx :GE */
         /* UADD8     : cccc 0110 0101 xxxx xxxx xxxx 1001 xxxx :GE */
+        /* ???       : cccc 0110 0101 xxxx xxxx xxxx 1011 xxxx :   */
+        /* ???       : cccc 0110 0101 xxxx xxxx xxxx 1101 xxxx :   */
         /* USUB8     : cccc 0110 0101 xxxx xxxx xxxx 1111 xxxx :GE */
         /* UQADD16   : cccc 0110 0110 xxxx xxxx xxxx 0001 xxxx :   */
         /* UQADDSUBX : cccc 0110 0110 xxxx xxxx xxxx 0011 xxxx :   */
         /* UQSUBADDX : cccc 0110 0110 xxxx xxxx xxxx 0101 xxxx :   */
         /* UQSUB16   : cccc 0110 0110 xxxx xxxx xxxx 0111 xxxx :   */
         /* UQADD8    : cccc 0110 0110 xxxx xxxx xxxx 1001 xxxx :   */
+        /* ???       : cccc 0110 0110 xxxx xxxx xxxx 1011 xxxx :   */
+        /* ???       : cccc 0110 0110 xxxx xxxx xxxx 1101 xxxx :   */
         /* UQSUB8    : cccc 0110 0110 xxxx xxxx xxxx 1111 xxxx :   */
         /* UHADD16   : cccc 0110 0111 xxxx xxxx xxxx 0001 xxxx :   */
         /* UHADDSUBX : cccc 0110 0111 xxxx xxxx xxxx 0011 xxxx :   */
         /* UHSUBADDX : cccc 0110 0111 xxxx xxxx xxxx 0101 xxxx :   */
         /* UHSUB16   : cccc 0110 0111 xxxx xxxx xxxx 0111 xxxx :   */
         /* UHADD8    : cccc 0110 0111 xxxx xxxx xxxx 1001 xxxx :   */
+        /* ???       : cccc 0110 0111 xxxx xxxx xxxx 1011 xxxx :   */
+        /* ???       : cccc 0110 0111 xxxx xxxx xxxx 1101 xxxx :   */
         /* UHSUB8    : cccc 0110 0111 xxxx xxxx xxxx 1111 xxxx :   */
+        if ((insn & 0x0f800010) == 0x06000010) {
+                if ((insn & 0x00300000) == 0x00000000 ||
+                    (insn & 0x000000e0) == 0x000000a0 ||
+                    (insn & 0x000000e0) == 0x000000c0)
+                        return INSN_REJECTED;   /* Unallocated space */
+                return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+        }
+
         /* PKHBT     : cccc 0110 1000 xxxx xxxx xxxx x001 xxxx :   */
         /* PKHTB     : cccc 0110 1000 xxxx xxxx xxxx x101 xxxx :   */
+        if ((insn & 0x0ff00030) == 0x06800010)
+                return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+
         /* SXTAB16   : cccc 0110 1000 xxxx xxxx xxxx 0111 xxxx :   */
-        /* SXTB      : cccc 0110 1010 xxxx xxxx xxxx 0111 xxxx :   */
+        /* SXTB16    : cccc 0110 1000 1111 xxxx xxxx 0111 xxxx :   */
+        /* ???       : cccc 0110 1001 xxxx xxxx xxxx 0111 xxxx :   */
         /* SXTAB     : cccc 0110 1010 xxxx xxxx xxxx 0111 xxxx :   */
+        /* SXTB      : cccc 0110 1010 1111 xxxx xxxx 0111 xxxx :   */
         /* SXTAH     : cccc 0110 1011 xxxx xxxx xxxx 0111 xxxx :   */
+        /* SXTH      : cccc 0110 1011 1111 xxxx xxxx 0111 xxxx :   */
         /* UXTAB16   : cccc 0110 1100 xxxx xxxx xxxx 0111 xxxx :   */
+        /* UXTB16    : cccc 0110 1100 1111 xxxx xxxx 0111 xxxx :   */
+        /* ???       : cccc 0110 1101 xxxx xxxx xxxx 0111 xxxx :   */
         /* UXTAB     : cccc 0110 1110 xxxx xxxx xxxx 0111 xxxx :   */
+        /* UXTB      : cccc 0110 1110 1111 xxxx xxxx 0111 xxxx :   */
         /* UXTAH     : cccc 0110 1111 xxxx xxxx xxxx 0111 xxxx :   */
-        return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+        /* UXTH      : cccc 0110 1111 1111 xxxx xxxx 0111 xxxx :   */
+        if ((insn & 0x0f8000f0) == 0x06800070) {
+                if ((insn & 0x00300000) == 0x00100000)
+                        return INSN_REJECTED;   /* Unallocated space */
+
+                if ((insn & 0x000f0000) == 0x000f0000)
+                        return prep_emulate_rd12rm0(insn, asi);
+                else
+                        return prep_emulate_rd12rn16rm0_wflags(insn, asi);
+        }
+
+        /* Other instruction encodings aren't yet defined */
+        return INSN_REJECTED;
 }
 
 static enum kprobe_insn __kprobes
@@ -1273,29 +1416,49 @@ space_cccc_0111__1(kprobe_opcode_t insn, struct arch_specific_insn *asi)
         if ((insn & 0x0ff000f0) == 0x03f000f0)
                 return INSN_REJECTED;
 
-        /* USADA8 : cccc 0111 1000 xxxx xxxx xxxx 0001 xxxx */
-        /* USAD8  : cccc 0111 1000 xxxx 1111 xxxx 0001 xxxx */
-        if ((insn & 0x0ff000f0) == 0x07800010)
-                 return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
-
         /* SMLALD : cccc 0111 0100 xxxx xxxx xxxx 00x1 xxxx */
         /* SMLSLD : cccc 0111 0100 xxxx xxxx xxxx 01x1 xxxx */
         if ((insn & 0x0ff00090) == 0x07400010)
                 return prep_emulate_rdhi16rdlo12rs8rm0_wflags(insn, asi);
 
         /* SMLAD  : cccc 0111 0000 xxxx xxxx xxxx 00x1 xxxx :Q */
+        /* SMUAD  : cccc 0111 0000 xxxx 1111 xxxx 00x1 xxxx :Q */
         /* SMLSD  : cccc 0111 0000 xxxx xxxx xxxx 01x1 xxxx :Q */
+        /* SMUSD  : cccc 0111 0000 xxxx 1111 xxxx 01x1 xxxx :  */
         /* SMMLA  : cccc 0111 0101 xxxx xxxx xxxx 00x1 xxxx :  */
-        /* SMMLS  : cccc 0111 0101 xxxx xxxx xxxx 11x1 xxxx :  */
+        /* SMMUL  : cccc 0111 0101 xxxx 1111 xxxx 00x1 xxxx :  */
+        /* USADA8 : cccc 0111 1000 xxxx xxxx xxxx 0001 xxxx :  */
+        /* USAD8  : cccc 0111 1000 xxxx 1111 xxxx 0001 xxxx :  */
         if ((insn & 0x0ff00090) == 0x07000010 ||
             (insn & 0x0ff000d0) == 0x07500010 ||
-            (insn & 0x0ff000d0) == 0x075000d0)
+            (insn & 0x0ff000f0) == 0x07800010) {
+
+                if ((insn & 0x0000f000) == 0x0000f000)
+                        return prep_emulate_rd16rs8rm0_wflags(insn, asi);
+                else
+                        return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
+        }
+
+        /* SMMLS  : cccc 0111 0101 xxxx xxxx xxxx 11x1 xxxx :  */
+        if ((insn & 0x0ff000d0) == 0x075000d0)
                 return prep_emulate_rd16rn12rs8rm0_wflags(insn, asi);
 
-        /* SMUSD  : cccc 0111 0000 xxxx xxxx xxxx 01x1 xxxx :  */
-        /* SMUAD  : cccc 0111 0000 xxxx 1111 xxxx 00x1 xxxx :Q */
-        /* SMMUL  : cccc 0111 0101 xxxx 1111 xxxx 00x1 xxxx :  */
-        return prep_emulate_rd16rs8rm0_wflags(insn, asi);
+        /* SBFX   : cccc 0111 101x xxxx xxxx xxxx x101 xxxx :  */
+        /* UBFX   : cccc 0111 111x xxxx xxxx xxxx x101 xxxx :  */
+        if ((insn & 0x0fa00070) == 0x07a00050)
+                return prep_emulate_rd12rm0(insn, asi);
+
+        /* BFI    : cccc 0111 110x xxxx xxxx xxxx x001 xxxx :  */
+        /* BFC    : cccc 0111 110x xxxx xxxx xxxx x001 1111 :  */
+        if ((insn & 0x0fe00070) == 0x07c00010) {
+
+                if ((insn & 0x0000000f) == 0x0000000f)
+                        return prep_emulate_rd12_modify(insn, asi);
+                else
+                        return prep_emulate_rd12rn0_modify(insn, asi);
+        }
+
+        return INSN_REJECTED;
 }
 
 static enum kprobe_insn __kprobes
@@ -1309,6 +1472,10 @@ space_cccc_01xx(kprobe_opcode_t insn, struct arch_specific_insn *asi)
         /* STRB  : cccc 01xx x1x0 xxxx xxxx xxxx xxxx xxxx */
         /* STRBT : cccc 01x0 x110 xxxx xxxx xxxx xxxx xxxx */
         /* STRT  : cccc 01x0 x010 xxxx xxxx xxxx xxxx xxxx */
+
+        if ((insn & 0x00500000) == 0x00500000 && is_r15(insn, 12))
+                return INSN_REJECTED;   /* LDRB into PC */
+
         return prep_emulate_ldr_str(insn, asi);
 }
 
@@ -1323,10 +1490,9 @@ space_cccc_100x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 
         /* LDM(1) : cccc 100x x0x1 xxxx xxxx xxxx xxxx xxxx */
         /* STM(1) : cccc 100x x0x0 xxxx xxxx xxxx xxxx xxxx */
-        asi->insn[0] = truecc_insn(insn);
         asi->insn_handler = ((insn & 0x108000) == 0x008000) ? /* STM & R15 */
                                 simulate_stm1_pc : simulate_ldm1stm1;
-        return INSN_GOOD;
+        return INSN_GOOD_NO_SLOT;
 }
 
 static enum kprobe_insn __kprobes
@@ -1334,58 +1500,117 @@ space_cccc_101x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
         /* B  : cccc 1010 xxxx xxxx xxxx xxxx xxxx xxxx */
         /* BL : cccc 1011 xxxx xxxx xxxx xxxx xxxx xxxx */
-        asi->insn[0] = truecc_insn(insn);
         asi->insn_handler = simulate_bbl;
-        return INSN_GOOD;
+        return INSN_GOOD_NO_SLOT;
 }
 
 static enum kprobe_insn __kprobes
-space_cccc_1100_010x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
+space_cccc_11xx(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
+        /* Coprocessor instructions... */
         /* MCRR : cccc 1100 0100 xxxx xxxx xxxx xxxx xxxx : (Rd!=Rn) */
         /* MRRC : cccc 1100 0101 xxxx xxxx xxxx xxxx xxxx : (Rd!=Rn) */
-        insn &= 0xfff00fff;
-        insn |= 0x00001000;     /* Rn = r0, Rd = r1 */
-        asi->insn[0] = insn;
-        asi->insn_handler = (insn & (1 << 20)) ? emulate_mrrc : emulate_mcrr;
-        return INSN_GOOD;
+        /* LDC  : cccc 110x xxx1 xxxx xxxx xxxx xxxx xxxx */
+        /* STC  : cccc 110x xxx0 xxxx xxxx xxxx xxxx xxxx */
+        /* CDP  : cccc 1110 xxxx xxxx xxxx xxxx xxx0 xxxx */
+        /* MCR  : cccc 1110 xxx0 xxxx xxxx xxxx xxx1 xxxx */
+        /* MRC  : cccc 1110 xxx1 xxxx xxxx xxxx xxx1 xxxx */
+
+        /* SVC  : cccc 1111 xxxx xxxx xxxx xxxx xxxx xxxx */
+
+        return INSN_REJECTED;
 }
 
-static enum kprobe_insn __kprobes
-space_cccc_110x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
+static unsigned long __kprobes __check_eq(unsigned long cpsr)
 {
-        /* LDC : cccc 110x xxx1 xxxx xxxx xxxx xxxx xxxx */
-        /* STC : cccc 110x xxx0 xxxx xxxx xxxx xxxx xxxx */
-        insn &= 0xfff0ffff;     /* Rn = r0 */
-        asi->insn[0] = insn;
-        asi->insn_handler = emulate_ldcstc;
-        return INSN_GOOD;
+        return cpsr & PSR_Z_BIT;
 }
 
-static enum kprobe_insn __kprobes
-space_cccc_111x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
+static unsigned long __kprobes __check_ne(unsigned long cpsr)
 {
-        /* BKPT : 1110 0001 0010 xxxx xxxx xxxx 0111 xxxx */
-        /* SWI  : cccc 1111 xxxx xxxx xxxx xxxx xxxx xxxx */
-        if ((insn & 0xfff000f0) == 0xe1200070 ||
-            (insn & 0x0f000000) == 0x0f000000)
-                return INSN_REJECTED;
+        return (~cpsr) & PSR_Z_BIT;
+}
 
-        /* CDP : cccc 1110 xxxx xxxx xxxx xxxx xxx0 xxxx */
-        if ((insn & 0x0f000010) == 0x0e000000) {
-                asi->insn[0] = insn;
-                asi->insn_handler = emulate_none;
-                return INSN_GOOD;
-        }
+static unsigned long __kprobes __check_cs(unsigned long cpsr)
+{
+        return cpsr & PSR_C_BIT;
+}
 
-        /* MCR : cccc 1110 xxx0 xxxx xxxx xxxx xxx1 xxxx */
-        /* MRC : cccc 1110 xxx1 xxxx xxxx xxxx xxx1 xxxx */
-        insn &= 0xffff0fff;     /* Rd = r0 */
-        asi->insn[0] = insn;
-        asi->insn_handler = (insn & (1 << 20)) ? emulate_rd12 : emulate_ird12;
-        return INSN_GOOD;
+static unsigned long __kprobes __check_cc(unsigned long cpsr)
+{
+        return (~cpsr) & PSR_C_BIT;
+}
+
+static unsigned long __kprobes __check_mi(unsigned long cpsr)
+{
+        return cpsr & PSR_N_BIT;
+}
+
+static unsigned long __kprobes __check_pl(unsigned long cpsr)
+{
+        return (~cpsr) & PSR_N_BIT;
+}
+
+static unsigned long __kprobes __check_vs(unsigned long cpsr)
+{
+        return cpsr & PSR_V_BIT;
+}
+
+static unsigned long __kprobes __check_vc(unsigned long cpsr)
+{
+        return (~cpsr) & PSR_V_BIT;
+}
+
+static unsigned long __kprobes __check_hi(unsigned long cpsr)
+{
+        cpsr &= ~(cpsr >> 1); /* PSR_C_BIT &= ~PSR_Z_BIT */
+        return cpsr & PSR_C_BIT;
 }
 
+static unsigned long __kprobes __check_ls(unsigned long cpsr)
+{
+        cpsr &= ~(cpsr >> 1); /* PSR_C_BIT &= ~PSR_Z_BIT */
+        return (~cpsr) & PSR_C_BIT;
+}
+
+static unsigned long __kprobes __check_ge(unsigned long cpsr)
+{
+        cpsr ^= (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */
+        return (~cpsr) & PSR_N_BIT;
+}
+
+static unsigned long __kprobes __check_lt(unsigned long cpsr)
+{
+        cpsr ^= (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */
+        return cpsr & PSR_N_BIT;
+}
+
+static unsigned long __kprobes __check_gt(unsigned long cpsr)
+{
+        unsigned long temp = cpsr ^ (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */
+        temp |= (cpsr << 1);                     /* PSR_N_BIT |= PSR_Z_BIT */
+        return (~temp) & PSR_N_BIT;
+}
+
+static unsigned long __kprobes __check_le(unsigned long cpsr)
+{
+        unsigned long temp = cpsr ^ (cpsr << 3); /* PSR_N_BIT ^= PSR_V_BIT */
+        temp |= (cpsr << 1);                     /* PSR_N_BIT |= PSR_Z_BIT */
+        return temp & PSR_N_BIT;
+}
+
+static unsigned long __kprobes __check_al(unsigned long cpsr)
+{
+        return true;
+}
+
+static kprobe_check_cc * const condition_checks[16] = {
+        &__check_eq, &__check_ne, &__check_cs, &__check_cc,
+        &__check_mi, &__check_pl, &__check_vs, &__check_vc,
+        &__check_hi, &__check_ls, &__check_ge, &__check_lt,
+        &__check_gt, &__check_le, &__check_al, &__check_al
+};
+
 /* Return:
  *   INSN_REJECTED     If instruction is one not allowed to kprobe,
  *   INSN_GOOD         If instruction is supported and uses instruction slot,
@@ -1401,133 +1626,45 @@ space_cccc_111x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 enum kprobe_insn __kprobes
 arm_kprobe_decode_insn(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
+        asi->insn_check_cc = condition_checks[insn>>28];
         asi->insn[1] = KPROBE_RETURN_INSTRUCTION;
 
-        if ((insn & 0xf0000000) == 0xf0000000) {
+        if ((insn & 0xf0000000) == 0xf0000000)
 
                 return space_1111(insn, asi);
 
-        } else if ((insn & 0x0e000000) == 0x00000000) {
+        else if ((insn & 0x0e000000) == 0x00000000)
 
                 return space_cccc_000x(insn, asi);
 
-        } else if ((insn & 0x0e000000) == 0x02000000) {
+        else if ((insn & 0x0e000000) == 0x02000000)
 
                 return space_cccc_001x(insn, asi);
 
-        } else if ((insn & 0x0f000010) == 0x06000010) {
+        else if ((insn & 0x0f000010) == 0x06000010)
 
                 return space_cccc_0110__1(insn, asi);
 
-        } else if ((insn & 0x0f000010) == 0x07000010) {
+        else if ((insn & 0x0f000010) == 0x07000010)
 
                 return space_cccc_0111__1(insn, asi);
 
-        } else if ((insn & 0x0c000000) == 0x04000000) {
+        else if ((insn & 0x0c000000) == 0x04000000)
 
                 return space_cccc_01xx(insn, asi);
 
-        } else if ((insn & 0x0e000000) == 0x08000000) {
+        else if ((insn & 0x0e000000) == 0x08000000)
 
                 return space_cccc_100x(insn, asi);
 
-        } else if ((insn & 0x0e000000) == 0x0a000000) {
+        else if ((insn & 0x0e000000) == 0x0a000000)
 
                 return space_cccc_101x(insn, asi);
 
-        } else if ((insn & 0x0fe00000) == 0x0c400000) {
-
-                return space_cccc_1100_010x(insn, asi);
-
-        } else if ((insn & 0x0e000000) == 0x0c000000) {
-
-                return space_cccc_110x(insn, asi);
-
-        }
-
-        return space_cccc_111x(insn, asi);
+        return space_cccc_11xx(insn, asi);
 }
 
 void __init arm_kprobe_decode_init(void)
 {
         find_str_pc_offset();
 }
-
-
-/*
- * All ARM instructions listed below.
- *
- * Instructions and their general purpose registers are given.
- * If a particular register may not use R15, it is prefixed with a "!".
- * If marked with a "*" means the value returned by reading R15
- * is implementation defined.
- *
- * ADC/ADD/AND/BIC/CMN/CMP/EOR/MOV/MVN/ORR/RSB/RSC/SBC/SUB/TEQ
- *     TST: Rd, Rn, Rm, !Rs
- * BX: Rm
- * BLX(2): !Rm
- * BX: Rm (R15 legal, but discouraged)
- * BXJ: !Rm,
- * CLZ: !Rd, !Rm
- * CPY: Rd, Rm
- * LDC/2,STC/2 immediate offset & unindex: Rn
- * LDC/2,STC/2 immediate pre/post-indexed: !Rn
- * LDM(1/3): !Rn, register_list
- * LDM(2): !Rn, !register_list
- * LDR,STR,PLD immediate offset: Rd, Rn
- * LDR,STR,PLD register offset: Rd, Rn, !Rm
- * LDR,STR,PLD scaled register offset: Rd, !Rn, !Rm
- * LDR,STR immediate pre/post-indexed: Rd, !Rn
- * LDR,STR register pre/post-indexed: Rd, !Rn, !Rm
- * LDR,STR scaled register pre/post-indexed: Rd, !Rn, !Rm
- * LDRB,STRB immediate offset: !Rd, Rn
- * LDRB,STRB register offset: !Rd, Rn, !Rm
- * LDRB,STRB scaled register offset: !Rd, !Rn, !Rm
- * LDRB,STRB immediate pre/post-indexed: !Rd, !Rn
- * LDRB,STRB register pre/post-indexed: !Rd, !Rn, !Rm
- * LDRB,STRB scaled register pre/post-indexed: !Rd, !Rn, !Rm
- * LDRT,LDRBT,STRBT immediate pre/post-indexed: !Rd, !Rn
- * LDRT,LDRBT,STRBT register pre/post-indexed: !Rd, !Rn, !Rm
- * LDRT,LDRBT,STRBT scaled register pre/post-indexed: !Rd, !Rn, !Rm
- * LDRH/SH/SB/D,STRH/SH/SB/D immediate offset: !Rd, Rn
- * LDRH/SH/SB/D,STRH/SH/SB/D register offset: !Rd, Rn, !Rm
- * LDRH/SH/SB/D,STRH/SH/SB/D immediate pre/post-indexed: !Rd, !Rn
- * LDRH/SH/SB/D,STRH/SH/SB/D register pre/post-indexed: !Rd, !Rn, !Rm
- * LDREX: !Rd, !Rn
- * MCR/2: !Rd
- * MCRR/2,MRRC/2: !Rd, !Rn
- * MLA: !Rd, !Rn, !Rm, !Rs
- * MOV: Rd
- * MRC/2: !Rd (if Rd==15, only changes cond codes, not the register)
- * MRS,MSR: !Rd
- * MUL: !Rd, !Rm, !Rs
- * PKH{BT,TB}: !Rd, !Rn, !Rm
- * QDADD,[U]QADD/16/8/SUBX: !Rd, !Rm, !Rn
- * QDSUB,[U]QSUB/16/8/ADDX: !Rd, !Rm, !Rn
- * REV/16/SH: !Rd, !Rm
- * RFE: !Rn
- * {S,U}[H]ADD{16,8,SUBX},{S,U}[H]SUB{16,8,ADDX}: !Rd, !Rn, !Rm
- * SEL: !Rd, !Rn, !Rm
- * SMLA<x><y>,SMLA{D,W<y>},SMLSD,SMML{A,S}: !Rd, !Rn, !Rm, !Rs
- * SMLAL<x><y>,SMLA{D,LD},SMLSLD,SMMULL,SMULW<y>: !RdHi, !RdLo, !Rm, !Rs
- * SMMUL,SMUAD,SMUL<x><y>,SMUSD: !Rd, !Rm, !Rs
- * SSAT/16: !Rd, !Rm
- * STM(1/2): !Rn, register_list* (R15 in reg list not recommended)
- * STRT immediate pre/post-indexed: Rd*, !Rn
- * STRT register pre/post-indexed: Rd*, !Rn, !Rm
- * STRT scaled register pre/post-indexed: Rd*, !Rn, !Rm
- * STREX: !Rd, !Rn, !Rm
- * SWP/B: !Rd, !Rn, !Rm
- * {S,U}XTA{B,B16,H}: !Rd, !Rn, !Rm
- * {S,U}XT{B,B16,H}: !Rd, !Rm
- * UM{AA,LA,UL}L: !RdHi, !RdLo, !Rm, !Rs
- * USA{D8,A8,T,T16}: !Rd, !Rm, !Rs
- *
- * May transfer control by writing R15 (possible mode changes or alternate
- * mode accesses marked by "*"):
- * ALU op (* with s-bit), B, BL, BKPT, BLX(1/2), BX, BXJ, CPS*, CPY,
- * LDM(1), LDM(2/3)*, LDR, MOV, RFE*, SWI*
- *
- * Instructions that do not take general registers, nor transfer control:
- * CDP/2, SETEND, SRS*
- */
diff --git a/arch/arm/kernel/kprobes.c b/arch/arm/kernel/kprobes.c
index 2ba7deb3072e..1656c87501c0 100644
--- a/arch/arm/kernel/kprobes.c
+++ b/arch/arm/kernel/kprobes.c
@@ -134,7 +134,8 @@ static void __kprobes singlestep(struct kprobe *p, struct pt_regs *regs,
                                  struct kprobe_ctlblk *kcb)
 {
         regs->ARM_pc += 4;
-        p->ainsn.insn_handler(p, regs);
+        if (p->ainsn.insn_check_cc(regs->ARM_cpsr))
+                p->ainsn.insn_handler(p, regs);
 }
 
 /*
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 979da3947f42..139e3c827369 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -746,7 +746,8 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
 
         tail = (struct frame_tail __user *)regs->ARM_fp - 1;
 
-        while (tail && !((unsigned long)tail & 0x3))
+        while ((entry->nr < PERF_MAX_STACK_DEPTH) &&
+               tail && !((unsigned long)tail & 0x3))
                 tail = user_backtrace(tail, entry);
 }
 
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 2bf27f364d09..8182f45ca493 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -767,12 +767,20 @@ long arch_ptrace(struct task_struct *child, long request,
 
 #ifdef CONFIG_HAVE_HW_BREAKPOINT
                 case PTRACE_GETHBPREGS:
+                        if (ptrace_get_breakpoints(child) < 0)
+                                return -ESRCH;
+
                         ret = ptrace_gethbpregs(child, addr,
                                                 (unsigned long __user *)data);
+                        ptrace_put_breakpoints(child);
                         break;
                 case PTRACE_SETHBPREGS:
+                        if (ptrace_get_breakpoints(child) < 0)
+                                return -ESRCH;
+
                         ret = ptrace_sethbpregs(child, addr,
                                                 (unsigned long __user *)data);
+                        ptrace_put_breakpoints(child);
                         break;
 #endif
 
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 8fe05ad932e4..f29b8a29b174 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -479,7 +479,7 @@ static void broadcast_timer_set_mode(enum clock_event_mode mode,
 {
 }
 
-static void broadcast_timer_setup(struct clock_event_device *evt)
+static void __cpuinit broadcast_timer_setup(struct clock_event_device *evt)
 {
         evt->name       = "dummy_timer";
         evt->features   = CLOCK_EVT_FEAT_ONESHOT |
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index 4ad8da15ef2b..af0aaebf4de6 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -311,7 +311,7 @@ asmlinkage long sys_oabi_semtimedop(int semid,
         long err;
         int i;
 
-        if (nsops < 1)
+        if (nsops < 1 || nsops > SEMOPM)
                 return -EINVAL;
         sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
         if (!sops)
diff --git a/arch/arm/mach-at91/Kconfig b/arch/arm/mach-at91/Kconfig
index 19390231a0e9..2d299bf5d72f 100644
--- a/arch/arm/mach-at91/Kconfig
+++ b/arch/arm/mach-at91/Kconfig
@@ -83,6 +83,7 @@ config ARCH_AT91CAP9
         select CPU_ARM926T
         select GENERIC_CLOCKEVENTS
         select HAVE_FB_ATMEL
+        select HAVE_NET_MACB
 
 config ARCH_AT572D940HF
         bool "AT572D940HF"
diff --git a/arch/arm/mach-at91/board-eb01.c b/arch/arm/mach-at91/board-eb01.c
index 1f9d3cb64c50..d8df59a3426d 100644
--- a/arch/arm/mach-at91/board-eb01.c
+++ b/arch/arm/mach-at91/board-eb01.c
@@ -30,6 +30,11 @@
 #include <mach/board.h>
 #include "generic.h"
 
+static void __init at91eb01_init_irq(void)
+{
+        at91x40_init_interrupts(NULL);
+}
+
 static void __init at91eb01_map_io(void)
 {
         at91x40_initialize(40000000);
@@ -38,7 +43,7 @@ static void __init at91eb01_map_io(void)
 MACHINE_START(AT91EB01, "Atmel AT91 EB01")
         /* Maintainer: Greg Ungerer <gerg@snapgear.com> */
         .timer          = &at91x40_timer,
-        .init_irq       = at91x40_init_interrupts,
+        .init_irq       = at91eb01_init_irq,
         .map_io         = at91eb01_map_io,
 MACHINE_END
 
diff --git a/arch/arm/mach-at91/include/mach/cpu.h b/arch/arm/mach-at91/include/mach/cpu.h
index 3bef931d0b1c..0700f2125305 100644
--- a/arch/arm/mach-at91/include/mach/cpu.h
+++ b/arch/arm/mach-at91/include/mach/cpu.h
@@ -27,6 +27,7 @@
 #define ARCH_ID_AT91SAM9G45     0x819b05a0
 #define ARCH_ID_AT91SAM9G45MRL  0x819b05a2      /* aka 9G45-ES2 & non ES lots */
 #define ARCH_ID_AT91SAM9G45ES   0x819b05a1      /* 9G45-ES (Engineering Sample) */
+#define ARCH_ID_AT91SAM9X5      0x819a05a0
 #define ARCH_ID_AT91CAP9        0x039A03A0
 
 #define ARCH_ID_AT91SAM9XE128   0x329973a0
@@ -55,6 +56,12 @@ static inline unsigned long at91_cpu_fully_identify(void)
 #define ARCH_EXID_AT91SAM9G46   0x00000003
 #define ARCH_EXID_AT91SAM9G45   0x00000004
 
+#define ARCH_EXID_AT91SAM9G15   0x00000000
+#define ARCH_EXID_AT91SAM9G35   0x00000001
+#define ARCH_EXID_AT91SAM9X35   0x00000002
+#define ARCH_EXID_AT91SAM9G25   0x00000003
+#define ARCH_EXID_AT91SAM9X25   0x00000004
+
 static inline unsigned long at91_exid_identify(void)
 {
         return at91_sys_read(AT91_DBGU_EXID);
@@ -143,6 +150,27 @@ static inline unsigned long at91cap9_rev_identify(void)
 #define cpu_is_at91sam9m11()    (0)
 #endif
 
+#ifdef CONFIG_ARCH_AT91SAM9X5
+#define cpu_is_at91sam9x5()     (at91_cpu_identify() == ARCH_ID_AT91SAM9X5)
+#define cpu_is_at91sam9g15()    (cpu_is_at91sam9x5() && \
+                                (at91_exid_identify() == ARCH_EXID_AT91SAM9G15))
+#define cpu_is_at91sam9g35()    (cpu_is_at91sam9x5() && \
+                                (at91_exid_identify() == ARCH_EXID_AT91SAM9G35))
+#define cpu_is_at91sam9x35()    (cpu_is_at91sam9x5() && \
+                                (at91_exid_identify() == ARCH_EXID_AT91SAM9X35))
+#define cpu_is_at91sam9g25()    (cpu_is_at91sam9x5() && \
+                                (at91_exid_identify() == ARCH_EXID_AT91SAM9G25))
+#define cpu_is_at91sam9x25()    (cpu_is_at91sam9x5() && \
+                                (at91_exid_identify() == ARCH_EXID_AT91SAM9X25))
+#else
+#define cpu_is_at91sam9x5()     (0)
+#define cpu_is_at91sam9g15()    (0)
+#define cpu_is_at91sam9g35()    (0)
+#define cpu_is_at91sam9x35()    (0)
+#define cpu_is_at91sam9g25()    (0)
+#define cpu_is_at91sam9x25()    (0)
+#endif
+
 #ifdef CONFIG_ARCH_AT91CAP9
 #define cpu_is_at91cap9()       (at91_cpu_identify() == ARCH_ID_AT91CAP9)
 #define cpu_is_at91cap9_revB()  (at91cap9_rev_identify() == ARCH_REVISION_CAP9_B)
diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig
index 32f147998cd9..c0deacae778d 100644
--- a/arch/arm/mach-davinci/Kconfig
+++ b/arch/arm/mach-davinci/Kconfig
@@ -63,6 +63,7 @@ config MACH_DAVINCI_EVM
         depends on ARCH_DAVINCI_DM644x
         select MISC_DEVICES
         select EEPROM_AT24
+        select I2C
         help
           Configure this option to specify the whether the board used
           for development is a DM644x EVM
@@ -72,6 +73,7 @@ config MACH_SFFSDR
         depends on ARCH_DAVINCI_DM644x
         select MISC_DEVICES
         select EEPROM_AT24
+        select I2C
         help
           Say Y here to select the Lyrtech Small Form Factor
           Software Defined Radio (SFFSDR) board.
@@ -105,6 +107,7 @@ config MACH_DAVINCI_DM6467_EVM
         select MACH_DAVINCI_DM6467TEVM
         select MISC_DEVICES
         select EEPROM_AT24
+        select I2C
         help
           Configure this option to specify the whether the board used
           for development is a DM6467 EVM
@@ -118,6 +121,7 @@ config MACH_DAVINCI_DM365_EVM
         depends on ARCH_DAVINCI_DM365
         select MISC_DEVICES
         select EEPROM_AT24
+        select I2C
         help
           Configure this option to specify whether the board used
           for development is a DM365 EVM
@@ -129,6 +133,7 @@ config MACH_DAVINCI_DA830_EVM
         select GPIO_PCF857X
         select MISC_DEVICES
         select EEPROM_AT24
+        select I2C
         help
           Say Y here to select the TI DA830/OMAP-L137/AM17x Evaluation Module.
 
@@ -205,6 +210,7 @@ config MACH_MITYOMAPL138
         depends on ARCH_DAVINCI_DA850
         select MISC_DEVICES
         select EEPROM_AT24
+        select I2C
         help
           Say Y here to select the Critical Link MityDSP-L138/MityARM-1808
           System on Module.  Information on this SoM may be found at
diff --git a/arch/arm/mach-davinci/board-mityomapl138.c b/arch/arm/mach-davinci/board-mityomapl138.c
index 2aa79c54f98e..606a6f27ed6c 100644
--- a/arch/arm/mach-davinci/board-mityomapl138.c
+++ b/arch/arm/mach-davinci/board-mityomapl138.c
@@ -29,7 +29,7 @@
 #include <mach/mux.h>
 #include <mach/spi.h>
 
-#define MITYOMAPL138_PHY_ID             "0:03"
+#define MITYOMAPL138_PHY_ID             ""
 
 #define FACTORY_CONFIG_MAGIC    0x012C0138
 #define FACTORY_CONFIG_VERSION  0x00010001
@@ -414,7 +414,7 @@ static struct resource mityomapl138_nandflash_resource[] = {
 
 static struct platform_device mityomapl138_nandflash_device = {
         .name           = "davinci_nand",
-        .id             = 0,
+        .id             = 1,
         .dev            = {
                 .platform_data  = &mityomapl138_nandflash_data,
         },
diff --git a/arch/arm/mach-davinci/devices-da8xx.c b/arch/arm/mach-davinci/devices-da8xx.c
index 625d4b66718b..58a02dc7b15a 100644
--- a/arch/arm/mach-davinci/devices-da8xx.c
+++ b/arch/arm/mach-davinci/devices-da8xx.c
@@ -39,7 +39,8 @@
 #define DA8XX_GPIO_BASE                 0x01e26000
 #define DA8XX_I2C1_BASE                 0x01e28000
 #define DA8XX_SPI0_BASE                 0x01c41000
-#define DA8XX_SPI1_BASE                 0x01f0e000
+#define DA830_SPI1_BASE                 0x01e12000
+#define DA850_SPI1_BASE                 0x01f0e000
 
 #define DA8XX_EMAC_CTRL_REG_OFFSET      0x3000
 #define DA8XX_EMAC_MOD_REG_OFFSET       0x2000
@@ -762,8 +763,8 @@ static struct resource da8xx_spi0_resources[] = {
 
 static struct resource da8xx_spi1_resources[] = {
         [0] = {
-                .start  = DA8XX_SPI1_BASE,
-                .end    = DA8XX_SPI1_BASE + SZ_4K - 1,
+                .start  = DA830_SPI1_BASE,
+                .end    = DA830_SPI1_BASE + SZ_4K - 1,
                 .flags  = IORESOURCE_MEM,
         },
         [1] = {
@@ -832,5 +833,10 @@ int __init da8xx_register_spi(int instance, struct spi_board_info *info,
 
         da8xx_spi_pdata[instance].num_chipselect = len;
 
+        if (instance == 1 && cpu_is_davinci_da850()) {
+                da8xx_spi1_resources[0].start = DA850_SPI1_BASE;
+                da8xx_spi1_resources[0].end = DA850_SPI1_BASE + SZ_4K - 1;
+        }
+
         return platform_device_register(&da8xx_spi_device[instance]);
 }
diff --git a/arch/arm/mach-davinci/dm355.c b/arch/arm/mach-davinci/dm355.c
index f68012239641..a3a94e9c9378 100644
--- a/arch/arm/mach-davinci/dm355.c
+++ b/arch/arm/mach-davinci/dm355.c
@@ -314,7 +314,7 @@ static struct clk timer2_clk = {
         .name = "timer2",
         .parent = &pll1_aux_clk,
         .lpsc = DAVINCI_LPSC_TIMER2,
-        .usecount = 1,              /* REVISIT: why can't' this be disabled? */
+        .usecount = 1,              /* REVISIT: why can't this be disabled? */
 };
 
 static struct clk timer3_clk = {
diff --git a/arch/arm/mach-davinci/dm644x.c b/arch/arm/mach-davinci/dm644x.c
index 5f8a65424184..4c82c2716293 100644
--- a/arch/arm/mach-davinci/dm644x.c
+++ b/arch/arm/mach-davinci/dm644x.c
@@ -274,7 +274,7 @@ static struct clk timer2_clk = {
         .name = "timer2",
         .parent = &pll1_aux_clk,
         .lpsc = DAVINCI_LPSC_TIMER2,
-        .usecount = 1,              /* REVISIT: why can't' this be disabled? */
+        .usecount = 1,              /* REVISIT: why can't this be disabled? */
 };
 
 static struct clk_lookup dm644x_clks[] = {
diff --git a/arch/arm/mach-davinci/include/mach/debug-macro.S b/arch/arm/mach-davinci/include/mach/debug-macro.S
index 9f1befc5ac38..f8b7ea4f6235 100644
--- a/arch/arm/mach-davinci/include/mach/debug-macro.S
+++ b/arch/arm/mach-davinci/include/mach/debug-macro.S
@@ -24,6 +24,9 @@
 
 #define UART_SHIFT      2
 
+#define davinci_uart_v2p(x)     ((x) - PAGE_OFFSET + PLAT_PHYS_OFFSET)
+#define davinci_uart_p2v(x)     ((x) - PLAT_PHYS_OFFSET + PAGE_OFFSET)
+
                 .pushsection .data
 davinci_uart_phys:      .word   0
 davinci_uart_virt:      .word   0
@@ -34,7 +37,7 @@ davinci_uart_virt:	.word	0
                 /* Use davinci_uart_phys/virt if already configured */
 10:             mrc     p15, 0, \rp, c1, c0
                 tst     \rp, #1                 @ MMU enabled?
-                ldreq   \rp, =__virt_to_phys(davinci_uart_phys)
+                ldreq   \rp, =davinci_uart_v2p(davinci_uart_phys)
                 ldrne   \rp, =davinci_uart_phys
                 add     \rv, \rp, #4            @ davinci_uart_virt
                 ldr     \rp, [\rp, #0]
@@ -48,18 +51,18 @@ davinci_uart_virt:	.word	0
                 tst     \rp, #1                 @ MMU enabled?
 
                 /* Copy uart phys address from decompressor uart info */
-                ldreq   \rv, =__virt_to_phys(davinci_uart_phys)
+                ldreq   \rv, =davinci_uart_v2p(davinci_uart_phys)
                 ldrne   \rv, =davinci_uart_phys
                 ldreq   \rp, =DAVINCI_UART_INFO
-                ldrne   \rp, =__phys_to_virt(DAVINCI_UART_INFO)
+                ldrne   \rp, =davinci_uart_p2v(DAVINCI_UART_INFO)
                 ldr     \rp, [\rp, #0]
                 str     \rp, [\rv]
 
                 /* Copy uart virt address from decompressor uart info */
-                ldreq   \rv, =__virt_to_phys(davinci_uart_virt)
+                ldreq   \rv, =davinci_uart_v2p(davinci_uart_virt)
                 ldrne   \rv, =davinci_uart_virt
                 ldreq   \rp, =DAVINCI_UART_INFO
-                ldrne   \rp, =__phys_to_virt(DAVINCI_UART_INFO)
+                ldrne   \rp, =davinci_uart_p2v(DAVINCI_UART_INFO)
                 ldr     \rp, [\rp, #4]
                 str     \rp, [\rv]
 
diff --git a/arch/arm/mach-davinci/include/mach/serial.h b/arch/arm/mach-davinci/include/mach/serial.h
index 8051110b8ac3..c9e6ce185a66 100644
--- a/arch/arm/mach-davinci/include/mach/serial.h
+++ b/arch/arm/mach-davinci/include/mach/serial.h
@@ -22,7 +22,7 @@
  *
  * This area sits just below the page tables (see arch/arm/kernel/head.S).
  */
-#define DAVINCI_UART_INFO       (PHYS_OFFSET + 0x3ff8)
+#define DAVINCI_UART_INFO       (PLAT_PHYS_OFFSET + 0x3ff8)
 
 #define DAVINCI_UART0_BASE      (IO_PHYS + 0x20000)
 #define DAVINCI_UART1_BASE      (IO_PHYS + 0x20400)
diff --git a/arch/arm/mach-mx3/mach-vpr200.c b/arch/arm/mach-mx3/mach-vpr200.c
index 2cf390fbd980..47a69cbc31a8 100644
--- a/arch/arm/mach-mx3/mach-vpr200.c
+++ b/arch/arm/mach-mx3/mach-vpr200.c
@@ -257,11 +257,16 @@ static const struct fsl_usb2_platform_data otg_device_pdata __initconst = {
         .workaround     = FLS_USB2_WORKAROUND_ENGCM09152,
 };
 
+static int vpr200_usbh_init(struct platform_device *pdev)
+{
+        return mx35_initialize_usb_hw(pdev->id,
+                        MXC_EHCI_INTERFACE_SINGLE_UNI | MXC_EHCI_INTERNAL_PHY);
+}
+
 /* USB HOST config */
 static const struct mxc_usbh_platform_data usb_host_pdata __initconst = {
-        .portsc         = MXC_EHCI_MODE_SERIAL,
-        .flags          = MXC_EHCI_INTERFACE_SINGLE_UNI |
-                          MXC_EHCI_INTERNAL_PHY,
+        .init = vpr200_usbh_init,
+        .portsc = MXC_EHCI_MODE_SERIAL,
 };
 
 static struct platform_device *devices[] __initdata = {
diff --git a/arch/arm/mach-mx5/board-mx53_loco.c b/arch/arm/mach-mx5/board-mx53_loco.c
index 10a1bea10548..6206b1191fe8 100644
--- a/arch/arm/mach-mx5/board-mx53_loco.c
+++ b/arch/arm/mach-mx5/board-mx53_loco.c
@@ -193,7 +193,7 @@ static iomux_v3_cfg_t mx53_loco_pads[] = {
         .wakeup         = wake,                                 \
 }
 
-static const struct gpio_keys_button loco_buttons[] __initconst = {
+static struct gpio_keys_button loco_buttons[] = {
         GPIO_BUTTON(MX53_LOCO_POWER, KEY_POWER, 1, "power", 0),
         GPIO_BUTTON(MX53_LOCO_UI1, KEY_VOLUMEUP, 1, "volume-up", 0),
         GPIO_BUTTON(MX53_LOCO_UI2, KEY_VOLUMEDOWN, 1, "volume-down", 0),
diff --git a/arch/arm/mach-mxs/clock-mx28.c b/arch/arm/mach-mxs/clock-mx28.c
index 1ad97fed1e94..5dcc59d5b9ec 100644
--- a/arch/arm/mach-mxs/clock-mx28.c
+++ b/arch/arm/mach-mxs/clock-mx28.c
@@ -295,11 +295,11 @@ static int name##_set_rate(struct clk *clk, unsigned long rate)		\
         unsigned long diff, parent_rate, calc_rate;                     \
         int i;                                                          \
                                                                         \
-        parent_rate = clk_get_rate(clk->parent);                        \
         div_max = BM_CLKCTRL_##dr##_DIV >> BP_CLKCTRL_##dr##_DIV;       \
         bm_busy = BM_CLKCTRL_##dr##_BUSY;                               \
                                                                         \
         if (clk->parent == &ref_xtal_clk) {                             \
+                parent_rate = clk_get_rate(clk->parent);                \
                 div = DIV_ROUND_UP(parent_rate, rate);                  \
                 if (clk == &cpu_clk) {                                  \
                         div_max = BM_CLKCTRL_CPU_DIV_XTAL >>            \
@@ -309,6 +309,11 @@ static int name##_set_rate(struct clk *clk, unsigned long rate)		\
                 if (div == 0 || div > div_max)                          \
                         return -EINVAL;                                 \
         } else {                                                        \
+                /*                                                      \
+                 * hack alert: this block modifies clk->parent, too,    \
+                 * so the base to use it the grand parent.              \
+                 */                                                     \
+                parent_rate = clk_get_rate(clk->parent->parent);        \
                 rate >>= PARENT_RATE_SHIFT;                             \
                 parent_rate >>= PARENT_RATE_SHIFT;                      \
                 diff = parent_rate;                                     \
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index a45cd6409686..512b15204450 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -68,7 +68,7 @@ obj-$(CONFIG_OMAP_SMARTREFLEX)          += sr_device.o smartreflex.o
 obj-$(CONFIG_OMAP_SMARTREFLEX_CLASS3)   += smartreflex-class3.o
 
 AFLAGS_sleep24xx.o                      :=-Wa,-march=armv6
-AFLAGS_sleep34xx.o                      :=-Wa,-march=armv7-a
+AFLAGS_sleep34xx.o                      :=-Wa,-march=armv7-a$(plus_sec)
 
 ifeq ($(CONFIG_PM_VERBOSE),y)
 CFLAGS_pm_bus.o                         += -DDEBUG
diff --git a/arch/arm/mach-omap2/board-rx51.c b/arch/arm/mach-omap2/board-rx51.c
index e964895b80e8..f8ba20a14e62 100644
--- a/arch/arm/mach-omap2/board-rx51.c
+++ b/arch/arm/mach-omap2/board-rx51.c
@@ -141,14 +141,19 @@ static void __init rx51_init(void)
 static void __init rx51_map_io(void)
 {
         omap2_set_globals_3xxx();
-        rx51_video_mem_init();
         omap34xx_map_common_io();
 }
 
+static void __init rx51_reserve(void)
+{
+        rx51_video_mem_init();
+        omap_reserve();
+}
+
 MACHINE_START(NOKIA_RX51, "Nokia RX-51 board")
         /* Maintainer: Lauri Leukkunen <lauri.leukkunen@nokia.com> */
         .boot_params    = 0x80000100,
-        .reserve        = omap_reserve,
+        .reserve        = rx51_reserve,
         .map_io         = rx51_map_io,
         .init_early     = rx51_init_early,
         .init_irq       = omap_init_irq,
diff --git a/arch/arm/mach-omap2/clock44xx_data.c b/arch/arm/mach-omap2/clock44xx_data.c
index 276992d3b7fb..8c965671b4d4 100644
--- a/arch/arm/mach-omap2/clock44xx_data.c
+++ b/arch/arm/mach-omap2/clock44xx_data.c
@@ -3116,14 +3116,9 @@ static struct omap_clk omap44xx_clks[] = {
         CLK(NULL,       "dsp_fck",                      &dsp_fck,       CK_443X),
         CLK("omapdss_dss",      "sys_clk",                      &dss_sys_clk,   CK_443X),
         CLK("omapdss_dss",      "tv_clk",                       &dss_tv_clk,    CK_443X),
-        CLK("omapdss_dss",      "dss_clk",                      &dss_dss_clk,   CK_443X),
         CLK("omapdss_dss",      "video_clk",                    &dss_48mhz_clk, CK_443X),
-        CLK("omapdss_dss",      "fck",                          &dss_fck,       CK_443X),
-        /*
-         * On OMAP4, DSS ick is a dummy clock; this is needed for compatibility
-         * with OMAP2/3.
-         */
-        CLK("omapdss_dss",      "ick",                          &dummy_ck,      CK_443X),
+        CLK("omapdss_dss",      "fck",                          &dss_dss_clk,   CK_443X),
+        CLK("omapdss_dss",      "ick",                          &dss_fck,       CK_443X),
         CLK(NULL,       "efuse_ctrl_cust_fck",          &efuse_ctrl_cust_fck,   CK_443X),
         CLK(NULL,       "emif1_fck",                    &emif1_fck,     CK_443X),
         CLK(NULL,       "emif2_fck",                    &emif2_fck,     CK_443X),
diff --git a/arch/arm/mach-omap2/cm2xxx_3xxx.c b/arch/arm/mach-omap2/cm2xxx_3xxx.c
index 9d0dec806e92..38830d8d4783 100644
--- a/arch/arm/mach-omap2/cm2xxx_3xxx.c
+++ b/arch/arm/mach-omap2/cm2xxx_3xxx.c
@@ -247,6 +247,7 @@ struct omap3_cm_regs {
         u32 per_cm_clksel;
         u32 emu_cm_clksel;
         u32 emu_cm_clkstctrl;
+        u32 pll_cm_autoidle;
         u32 pll_cm_autoidle2;
         u32 pll_cm_clksel4;
         u32 pll_cm_clksel5;
@@ -319,6 +320,15 @@ void omap3_cm_save_context(void)
                 omap2_cm_read_mod_reg(OMAP3430_EMU_MOD, CM_CLKSEL1);
         cm_context.emu_cm_clkstctrl =
                 omap2_cm_read_mod_reg(OMAP3430_EMU_MOD, OMAP2_CM_CLKSTCTRL);
+        /*
+         * As per erratum i671, ROM code does not respect the PER DPLL
+         * programming scheme if CM_AUTOIDLE_PLL.AUTO_PERIPH_DPLL == 1.
+         * In this case, even though this register has been saved in
+         * scratchpad contents, we need to restore AUTO_PERIPH_DPLL
+         * by ourselves. So, we need to save it anyway.
+         */
+        cm_context.pll_cm_autoidle =
+                omap2_cm_read_mod_reg(PLL_MOD, CM_AUTOIDLE);
         cm_context.pll_cm_autoidle2 =
                 omap2_cm_read_mod_reg(PLL_MOD, CM_AUTOIDLE2);
         cm_context.pll_cm_clksel4 =
@@ -441,6 +451,13 @@ void omap3_cm_restore_context(void)
                                CM_CLKSEL1);
         omap2_cm_write_mod_reg(cm_context.emu_cm_clkstctrl, OMAP3430_EMU_MOD,
                                OMAP2_CM_CLKSTCTRL);
+        /*
+         * As per erratum i671, ROM code does not respect the PER DPLL
+         * programming scheme if CM_AUTOIDLE_PLL.AUTO_PERIPH_DPLL == 1.
+         * In this case, we need to restore AUTO_PERIPH_DPLL by ourselves.
+         */
+        omap2_cm_write_mod_reg(cm_context.pll_cm_autoidle, PLL_MOD,
+                               CM_AUTOIDLE);
         omap2_cm_write_mod_reg(cm_context.pll_cm_autoidle2, PLL_MOD,
                                CM_AUTOIDLE2);
         omap2_cm_write_mod_reg(cm_context.pll_cm_clksel4, PLL_MOD,
diff --git a/arch/arm/mach-omap2/control.c b/arch/arm/mach-omap2/control.c
index 695279419020..da53ba3917ca 100644
--- a/arch/arm/mach-omap2/control.c
+++ b/arch/arm/mach-omap2/control.c
@@ -316,8 +316,14 @@ void omap3_save_scratchpad_contents(void)
                         omap2_cm_read_mod_reg(WKUP_MOD, CM_CLKSEL);
         prcm_block_contents.cm_clken_pll =
                         omap2_cm_read_mod_reg(PLL_MOD, CM_CLKEN);
+        /*
+         * As per erratum i671, ROM code does not respect the PER DPLL
+         * programming scheme if CM_AUTOIDLE_PLL..AUTO_PERIPH_DPLL == 1.
+         * Then,  in anycase, clear these bits to avoid extra latencies.
+         */
         prcm_block_contents.cm_autoidle_pll =
-                        omap2_cm_read_mod_reg(PLL_MOD, OMAP3430_CM_AUTOIDLE_PLL);
+                        omap2_cm_read_mod_reg(PLL_MOD, CM_AUTOIDLE) &
+                        ~OMAP3430_AUTO_PERIPH_DPLL_MASK;
         prcm_block_contents.cm_clksel1_pll =
                         omap2_cm_read_mod_reg(PLL_MOD, OMAP3430_CM_CLKSEL1_PLL);
         prcm_block_contents.cm_clksel2_pll =
diff --git a/arch/arm/mach-omap2/omap_hwmod_2420_data.c b/arch/arm/mach-omap2/omap_hwmod_2420_data.c
index 8eb3ce1bbfbe..c4d0ae87d62a 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2420_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2420_data.c
@@ -1639,6 +1639,7 @@ static struct omap_hwmod_ocp_if *omap2420_gpio1_slaves[] = {
 
 static struct omap_hwmod omap2420_gpio1_hwmod = {
         .name           = "gpio1",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap242x_gpio1_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap242x_gpio1_irqs),
         .main_clk       = "gpios_fck",
@@ -1669,6 +1670,7 @@ static struct omap_hwmod_ocp_if *omap2420_gpio2_slaves[] = {
 
 static struct omap_hwmod omap2420_gpio2_hwmod = {
         .name           = "gpio2",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap242x_gpio2_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap242x_gpio2_irqs),
         .main_clk       = "gpios_fck",
@@ -1699,6 +1701,7 @@ static struct omap_hwmod_ocp_if *omap2420_gpio3_slaves[] = {
 
 static struct omap_hwmod omap2420_gpio3_hwmod = {
         .name           = "gpio3",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap242x_gpio3_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap242x_gpio3_irqs),
         .main_clk       = "gpios_fck",
@@ -1729,6 +1732,7 @@ static struct omap_hwmod_ocp_if *omap2420_gpio4_slaves[] = {
 
 static struct omap_hwmod omap2420_gpio4_hwmod = {
         .name           = "gpio4",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap242x_gpio4_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap242x_gpio4_irqs),
         .main_clk       = "gpios_fck",
@@ -1782,7 +1786,7 @@ static struct omap_hwmod_irq_info omap2420_dma_system_irqs[] = {
 static struct omap_hwmod_addr_space omap2420_dma_system_addrs[] = {
         {
                 .pa_start       = 0x48056000,
-                .pa_end         = 0x4a0560ff,
+                .pa_end         = 0x48056fff,
                 .flags          = ADDR_TYPE_RT
         },
 };
diff --git a/arch/arm/mach-omap2/omap_hwmod_2430_data.c b/arch/arm/mach-omap2/omap_hwmod_2430_data.c
index e6e3810db77f..9682dd519f8d 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2430_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2430_data.c
@@ -1742,6 +1742,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio1_slaves[] = {
 
 static struct omap_hwmod omap2430_gpio1_hwmod = {
         .name           = "gpio1",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap243x_gpio1_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio1_irqs),
         .main_clk       = "gpios_fck",
@@ -1772,6 +1773,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio2_slaves[] = {
 
 static struct omap_hwmod omap2430_gpio2_hwmod = {
         .name           = "gpio2",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap243x_gpio2_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio2_irqs),
         .main_clk       = "gpios_fck",
@@ -1802,6 +1804,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio3_slaves[] = {
 
 static struct omap_hwmod omap2430_gpio3_hwmod = {
         .name           = "gpio3",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap243x_gpio3_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio3_irqs),
         .main_clk       = "gpios_fck",
@@ -1832,6 +1835,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio4_slaves[] = {
 
 static struct omap_hwmod omap2430_gpio4_hwmod = {
         .name           = "gpio4",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap243x_gpio4_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio4_irqs),
         .main_clk       = "gpios_fck",
@@ -1862,6 +1866,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio5_slaves[] = {
 
 static struct omap_hwmod omap2430_gpio5_hwmod = {
         .name           = "gpio5",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap243x_gpio5_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio5_irqs),
         .main_clk       = "gpio5_fck",
@@ -1915,7 +1920,7 @@ static struct omap_hwmod_irq_info omap2430_dma_system_irqs[] = {
 static struct omap_hwmod_addr_space omap2430_dma_system_addrs[] = {
         {
                 .pa_start       = 0x48056000,
-                .pa_end         = 0x4a0560ff,
+                .pa_end         = 0x48056fff,
                 .flags          = ADDR_TYPE_RT
         },
 };
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index b98e2dfcba28..909a84de6682 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -2141,6 +2141,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio1_slaves[] = {
 
 static struct omap_hwmod omap3xxx_gpio1_hwmod = {
         .name           = "gpio1",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap3xxx_gpio1_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio1_irqs),
         .main_clk       = "gpio1_ick",
@@ -2177,6 +2178,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio2_slaves[] = {
 
 static struct omap_hwmod omap3xxx_gpio2_hwmod = {
         .name           = "gpio2",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap3xxx_gpio2_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio2_irqs),
         .main_clk       = "gpio2_ick",
@@ -2213,6 +2215,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio3_slaves[] = {
 
 static struct omap_hwmod omap3xxx_gpio3_hwmod = {
         .name           = "gpio3",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap3xxx_gpio3_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio3_irqs),
         .main_clk       = "gpio3_ick",
@@ -2249,6 +2252,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio4_slaves[] = {
 
 static struct omap_hwmod omap3xxx_gpio4_hwmod = {
         .name           = "gpio4",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap3xxx_gpio4_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio4_irqs),
         .main_clk       = "gpio4_ick",
@@ -2285,6 +2289,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio5_slaves[] = {
 
 static struct omap_hwmod omap3xxx_gpio5_hwmod = {
         .name           = "gpio5",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap3xxx_gpio5_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio5_irqs),
         .main_clk       = "gpio5_ick",
@@ -2321,6 +2326,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio6_slaves[] = {
 
 static struct omap_hwmod omap3xxx_gpio6_hwmod = {
         .name           = "gpio6",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
         .mpu_irqs       = omap3xxx_gpio6_irqs,
         .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio6_irqs),
         .main_clk       = "gpio6_ick",
@@ -2386,7 +2392,7 @@ static struct omap_hwmod_irq_info omap3xxx_dma_system_irqs[] = {
 static struct omap_hwmod_addr_space omap3xxx_dma_system_addrs[] = {
         {
                 .pa_start       = 0x48056000,
-                .pa_end         = 0x4a0560ff,
+                .pa_end         = 0x48056fff,
                 .flags          = ADDR_TYPE_RT
         },
 };
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index 3e88dd3f8ef3..abc548a0c98d 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -885,7 +885,7 @@ static struct omap_hwmod_ocp_if *omap44xx_dma_system_masters[] = {
 static struct omap_hwmod_addr_space omap44xx_dma_system_addrs[] = {
         {
                 .pa_start       = 0x4a056000,
-                .pa_end         = 0x4a0560ff,
+                .pa_end         = 0x4a056fff,
                 .flags          = ADDR_TYPE_RT
         },
 };
diff --git a/arch/arm/mach-omap2/omap_l3_smx.c b/arch/arm/mach-omap2/omap_l3_smx.c
index 5f2da7565b68..4321e7938929 100644
--- a/arch/arm/mach-omap2/omap_l3_smx.c
+++ b/arch/arm/mach-omap2/omap_l3_smx.c
@@ -196,11 +196,11 @@ static irqreturn_t omap3_l3_app_irq(int irq, void *_l3)
                 /* No timeout error for debug sources */
         }
 
-        base = ((l3->rt) + (*(omap3_l3_bases[int_type] + err_source)));
-
         /* identify the error source */
         for (err_source = 0; !(status & (1 << err_source)); err_source++)
                                                                         ;
+
+        base = l3->rt + *(omap3_l3_bases[int_type] + err_source);
         error = omap3_l3_readll(base, L3_ERROR_LOG);
 
         if (error) {
diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
index 30af3351c2d6..49486f522dca 100644
--- a/arch/arm/mach-omap2/pm.c
+++ b/arch/arm/mach-omap2/pm.c
@@ -89,6 +89,7 @@ static void omap2_init_processor_devices(void)
         if (cpu_is_omap44xx()) {
                 _init_omap_device("l3_main_1", &l3_dev);
                 _init_omap_device("dsp", &dsp_dev);
+                _init_omap_device("iva", &iva_dev);
         } else {
                 _init_omap_device("l3_main", &l3_dev);
         }
diff --git a/arch/arm/mach-omap2/voltage.c b/arch/arm/mach-omap2/voltage.c
index 6fb520999b6e..0c1552d9d995 100644
--- a/arch/arm/mach-omap2/voltage.c
+++ b/arch/arm/mach-omap2/voltage.c
@@ -114,7 +114,6 @@ static int __init _config_common_vdd_data(struct omap_vdd_info *vdd)
         sys_clk_speed /= 1000;
 
         /* Generic voltage parameters */
-        vdd->curr_volt = 1200000;
         vdd->volt_scale = vp_forceupdate_scale_voltage;
         vdd->vp_enabled = false;
 
diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c
index 6de0ad0eea65..9cdcca597924 100644
--- a/arch/arm/mach-pxa/hx4700.c
+++ b/arch/arm/mach-pxa/hx4700.c
@@ -711,7 +711,7 @@ static struct regulator_consumer_supply bq24022_consumers[] = {
 static struct regulator_init_data bq24022_init_data = {
         .constraints = {
                 .max_uA         = 500000,
-                .valid_ops_mask = REGULATOR_CHANGE_CURRENT,
+                .valid_ops_mask = REGULATOR_CHANGE_CURRENT|REGULATOR_CHANGE_STATUS,
         },
         .num_consumer_supplies  = ARRAY_SIZE(bq24022_consumers),
         .consumer_supplies      = bq24022_consumers,
diff --git a/arch/arm/mach-pxa/magician.c b/arch/arm/mach-pxa/magician.c
index a72993dde2b3..9984ef70bd79 100644
--- a/arch/arm/mach-pxa/magician.c
+++ b/arch/arm/mach-pxa/magician.c
@@ -599,7 +599,7 @@ static struct regulator_consumer_supply bq24022_consumers[] = {
 static struct regulator_init_data bq24022_init_data = {
         .constraints = {
                 .max_uA         = 500000,
-                .valid_ops_mask = REGULATOR_CHANGE_CURRENT,
+                .valid_ops_mask = REGULATOR_CHANGE_CURRENT | REGULATOR_CHANGE_STATUS,
         },
         .num_consumer_supplies  = ARRAY_SIZE(bq24022_consumers),
         .consumer_supplies      = bq24022_consumers,
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index ce233bcbf506..42af97664c9d 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -395,7 +395,7 @@ ENTRY(xscale_dma_a0_map_area)
         teq     r2, #DMA_TO_DEVICE
         beq     xscale_dma_clean_range
         b       xscale_dma_flush_range
-ENDPROC(xscsale_dma_a0_map_area)
+ENDPROC(xscale_dma_a0_map_area)
 
 /*
  *      dma_unmap_area(start, size, dir)
diff --git a/arch/arm/plat-mxc/gpio.c b/arch/arm/plat-mxc/gpio.c
index 7a107246fd98..6cd6d7f686f6 100644
--- a/arch/arm/plat-mxc/gpio.c
+++ b/arch/arm/plat-mxc/gpio.c
@@ -295,6 +295,12 @@ static int mxc_gpio_direction_output(struct gpio_chip *chip,
         return 0;
 }
 
+/*
+ * This lock class tells lockdep that GPIO irqs are in a different
+ * category than their parents, so it won't report false recursion.
+ */
+static struct lock_class_key gpio_lock_class;
+
 int __init mxc_gpio_init(struct mxc_gpio_port *port, int cnt)
 {
         int i, j;
@@ -311,6 +317,7 @@ int __init mxc_gpio_init(struct mxc_gpio_port *port, int cnt)
                 __raw_writel(~0, port[i].base + GPIO_ISR);
                 for (j = port[i].virtual_irq_start;
                         j < port[i].virtual_irq_start + 32; j++) {
+                        irq_set_lockdep_class(j, &gpio_lock_class);
                         irq_set_chip_and_handler(j, &gpio_irq_chip,
                                                  handle_level_irq);
                         set_irq_flags(j, IRQF_VALID);
diff --git a/arch/arm/plat-mxc/ssi-fiq.S b/arch/arm/plat-mxc/ssi-fiq.S
index 4ddce565b353..8397a2dd19f2 100644
--- a/arch/arm/plat-mxc/ssi-fiq.S
+++ b/arch/arm/plat-mxc/ssi-fiq.S
@@ -124,6 +124,8 @@ imx_ssi_fiq_start:
 1:
                 @ return from FIQ
                 subs    pc, lr, #4
+
+                .align
 imx_ssi_fiq_base:
                 .word 0x0
 imx_ssi_fiq_rx_buffer:
diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
index 02b7a03e4226..8b3db1c587fc 100644
--- a/arch/m68k/mm/motorola.c
+++ b/arch/m68k/mm/motorola.c
@@ -300,6 +300,8 @@ void __init paging_init(void)
                 zones_size[ZONE_DMA] = m68k_memory[i].size >> PAGE_SHIFT;
                 free_area_init_node(i, zones_size,
                                     m68k_memory[i].addr >> PAGE_SHIFT, NULL);
+                if (node_present_pages(i))
+                        node_set_state(i, N_NORMAL_MEMORY);
         }
 }
 
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index b7ed8d7a9b33..b1d126258dee 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -266,8 +266,10 @@ static void __init setup_bootmem(void)
         }
         memset(pfnnid_map, 0xff, sizeof(pfnnid_map));
 
-        for (i = 0; i < npmem_ranges; i++)
+        for (i = 0; i < npmem_ranges; i++) {
+                node_set_state(i, N_NORMAL_MEMORY);
                 node_set_online(i);
+        }
 #endif
 
         /*
diff --git a/arch/powerpc/include/asm/8xx_immap.h b/arch/powerpc/include/asm/8xx_immap.h
index 6b6dc20b0beb..bdf0563ba423 100644
--- a/arch/powerpc/include/asm/8xx_immap.h
+++ b/arch/powerpc/include/asm/8xx_immap.h
@@ -393,8 +393,8 @@ typedef struct fec {
         uint    fec_addr_low;           /* lower 32 bits of station address     */
         ushort  fec_addr_high;          /* upper 16 bits of station address     */
         ushort  res1;                   /* reserved                             */
-        uint    fec_hash_table_high;    /* upper 32-bits of hash table          */
-        uint    fec_hash_table_low;     /* lower 32-bits of hash table          */
+        uint    fec_grp_hash_table_high;        /* upper 32-bits of hash table          */
+        uint    fec_grp_hash_table_low; /* lower 32-bits of hash table          */
         uint    fec_r_des_start;        /* beginning of Rx descriptor ring      */
         uint    fec_x_des_start;        /* beginning of Tx descriptor ring      */
         uint    fec_r_buff_size;        /* Rx buffer size                       */
diff --git a/arch/powerpc/include/asm/uninorth.h b/arch/powerpc/include/asm/uninorth.h
index ae9c899c8a6d..d12b11d7641e 100644
--- a/arch/powerpc/include/asm/uninorth.h
+++ b/arch/powerpc/include/asm/uninorth.h
@@ -60,7 +60,7 @@
  *
  * Obviously, the GART is not cache coherent and so any change to it
  * must be flushed to memory (or maybe just make the GART space non
- * cachable). AGP memory itself does't seem to be cache coherent neither.
+ * cachable). AGP memory itself doesn't seem to be cache coherent neither.
  *
  * In order to invalidate the GART (which is probably necessary to inval
  * the bridge internal TLBs), the following sequence has to be written,
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 55613e33e263..a6ae1cfad86c 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -933,12 +933,16 @@ int ptrace_set_debugreg(struct task_struct *task, unsigned long addr,
         if (data && !(data & DABR_TRANSLATION))
                 return -EIO;
 #ifdef CONFIG_HAVE_HW_BREAKPOINT
+        if (ptrace_get_breakpoints(task) < 0)
+                return -ESRCH;
+
         bp = thread->ptrace_bps[0];
         if ((!data) || !(data & (DABR_DATA_WRITE | DABR_DATA_READ))) {
                 if (bp) {
                         unregister_hw_breakpoint(bp);
                         thread->ptrace_bps[0] = NULL;
                 }
+                ptrace_put_breakpoints(task);
                 return 0;
         }
         if (bp) {
@@ -948,9 +952,12 @@ int ptrace_set_debugreg(struct task_struct *task, unsigned long addr,
                                         (DABR_DATA_WRITE | DABR_DATA_READ),
                                                         &attr.bp_type);
                 ret =  modify_user_hw_breakpoint(bp, &attr);
-                if (ret)
+                if (ret) {
+                        ptrace_put_breakpoints(task);
                         return ret;
+                }
                 thread->ptrace_bps[0] = bp;
+                ptrace_put_breakpoints(task);
                 thread->dabr = data;
                 return 0;
         }
@@ -965,9 +972,12 @@ int ptrace_set_debugreg(struct task_struct *task, unsigned long addr,
                                                         ptrace_triggered, task);
         if (IS_ERR(bp)) {
                 thread->ptrace_bps[0] = NULL;
+                ptrace_put_breakpoints(task);
                 return PTR_ERR(bp);
         }
 
+        ptrace_put_breakpoints(task);
+
 #endif /* CONFIG_HAVE_HW_BREAKPOINT */
 
         /* Move contents to the DABR register */
diff --git a/arch/s390/crypto/prng.c b/arch/s390/crypto/prng.c
index 975e3ab13cb5..8b16c479585b 100644
--- a/arch/s390/crypto/prng.c
+++ b/arch/s390/crypto/prng.c
@@ -76,7 +76,7 @@ static void prng_seed(int nbytes)
 
         /* Add the entropy */
         while (nbytes >= 8) {
-                *((__u64 *)parm_block) ^= *((__u64 *)buf+i*8);
+                *((__u64 *)parm_block) ^= *((__u64 *)(buf+i));
                 prng_add_entropy();
                 i += 8;
                 nbytes -= 8;
diff --git a/arch/s390/kvm/sie64a.S b/arch/s390/kvm/sie64a.S
index 7e9d30d567b0..ab0e041ac54c 100644
--- a/arch/s390/kvm/sie64a.S
+++ b/arch/s390/kvm/sie64a.S
@@ -48,10 +48,10 @@ sie_irq_handler:
         tm      __TI_flags+7(%r2),_TIF_EXIT_SIE
         jz      0f
         larl    %r2,sie_exit                    # work pending, leave sie
-        stg     %r2,__LC_RETURN_PSW+8
+        stg     %r2,SPI_PSW+8(0,%r15)
         br      %r14
 0:      larl    %r2,sie_reenter                 # re-enter with guest id
-        stg     %r2,__LC_RETURN_PSW+8
+        stg     %r2,SPI_PSW+8(0,%r15)
 1:      br      %r14
 
 /*
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 9217e332b118..ab988135e5c6 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -543,7 +543,6 @@ static void pfault_interrupt(unsigned int ext_int_code,
         struct task_struct *tsk;
         __u16 subcode;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_PFL]++;
         /*
          * Get the external interruption subcode & pfault
          * initial/completion signal bit. VM stores this 
@@ -553,14 +552,15 @@ static void pfault_interrupt(unsigned int ext_int_code,
         subcode = ext_int_code >> 16;
         if ((subcode & 0xff00) != __SUBCODE_MASK)
                 return;
+        kstat_cpu(smp_processor_id()).irqs[EXTINT_PFL]++;
 
         /*
          * Get the token (= address of the task structure of the affected task).
          */
 #ifdef CONFIG_64BIT
-        tsk = *(struct task_struct **) param64;
+        tsk = (struct task_struct *) param64;
 #else
-        tsk = *(struct task_struct **) param32;
+        tsk = (struct task_struct *) param32;
 #endif
 
         if (subcode & 0x0080) {
diff --git a/arch/s390/mm/pageattr.c b/arch/s390/mm/pageattr.c
index 122ffbd08ce0..0607e4b14b27 100644
--- a/arch/s390/mm/pageattr.c
+++ b/arch/s390/mm/pageattr.c
@@ -24,12 +24,13 @@ static void change_page_attr(unsigned long addr, int numpages,
                         WARN_ON_ONCE(1);
                         continue;
                 }
-                ptep = pte_offset_kernel(pmdp, addr + i * PAGE_SIZE);
+                ptep = pte_offset_kernel(pmdp, addr);
 
                 pte = *ptep;
                 pte = set(pte);
-                ptep_invalidate(&init_mm, addr + i * PAGE_SIZE, ptep);
+                ptep_invalidate(&init_mm, addr, ptep);
                 *ptep = pte;
+                addr += PAGE_SIZE;
         }
 }
 
diff --git a/arch/sh/kernel/ptrace_32.c b/arch/sh/kernel/ptrace_32.c
index 2130ca674e9b..3d7b209b2178 100644
--- a/arch/sh/kernel/ptrace_32.c
+++ b/arch/sh/kernel/ptrace_32.c
@@ -117,7 +117,11 @@ void user_enable_single_step(struct task_struct *child)
 
         set_tsk_thread_flag(child, TIF_SINGLESTEP);
 
+        if (ptrace_get_breakpoints(child) < 0)
+                return;
+
         set_single_step(child, pc);
+        ptrace_put_breakpoints(child);
 }
 
 void user_disable_single_step(struct task_struct *child)
diff --git a/arch/um/Kconfig.um b/arch/um/Kconfig.um
index 90a438acbfaf..b5e675e370c6 100644
--- a/arch/um/Kconfig.um
+++ b/arch/um/Kconfig.um
@@ -47,7 +47,7 @@ config HOSTFS
 
 config HPPFS
         tristate "HoneyPot ProcFS (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        depends on EXPERIMENTAL && PROC_FS
         help
           hppfs (HoneyPot ProcFS) is a filesystem which allows UML /proc
           entries to be overridden, removed, or fabricated from the host.
diff --git a/arch/um/include/asm/thread_info.h b/arch/um/include/asm/thread_info.h
index e2cf786bda0a..5bd1bad33fab 100644
--- a/arch/um/include/asm/thread_info.h
+++ b/arch/um/include/asm/thread_info.h
@@ -49,7 +49,10 @@ static inline struct thread_info *current_thread_info(void)
 {
         struct thread_info *ti;
         unsigned long mask = THREAD_SIZE - 1;
-        ti = (struct thread_info *) (((unsigned long) &ti) & ~mask);
+        void *p;
+
+        asm volatile ("" : "=r" (p) : "0" (&ti));
+        ti = (struct thread_info *) (((unsigned long)p) & ~mask);
         return ti;
 }
 
diff --git a/arch/um/sys-i386/Makefile b/arch/um/sys-i386/Makefile
index 804b28dd0328..b1da91c1b200 100644
--- a/arch/um/sys-i386/Makefile
+++ b/arch/um/sys-i386/Makefile
@@ -4,7 +4,7 @@
 
 obj-y = bug.o bugs.o checksum.o delay.o fault.o ksyms.o ldt.o ptrace.o \
         ptrace_user.o setjmp.o signal.o stub.o stub_segv.o syscalls.o sysrq.o \
-        sys_call_table.o tls.o
+        sys_call_table.o tls.o atomic64_cx8_32.o
 
 obj-$(CONFIG_BINFMT_ELF) += elfcore.o
 
diff --git a/arch/um/sys-i386/atomic64_cx8_32.S b/arch/um/sys-i386/atomic64_cx8_32.S
new file mode 100644
index 000000000000..1e901d3d4a95
--- /dev/null
+++ b/arch/um/sys-i386/atomic64_cx8_32.S
@@ -0,0 +1,225 @@
+/*
+ * atomic64_t for 586+
+ *
+ * Copied from arch/x86/lib/atomic64_cx8_32.S
+ *
+ * Copyright © 2010  Luca Barbieri
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+
+#include <linux/linkage.h>
+#include <asm/alternative-asm.h>
+#include <asm/dwarf2.h>
+
+.macro SAVE reg
+        pushl_cfi %\reg
+        CFI_REL_OFFSET \reg, 0
+.endm
+
+.macro RESTORE reg
+        popl_cfi %\reg
+        CFI_RESTORE \reg
+.endm
+
+.macro read64 reg
+        movl %ebx, %eax
+        movl %ecx, %edx
+/* we need LOCK_PREFIX since otherwise cmpxchg8b always does the write */
+        LOCK_PREFIX
+        cmpxchg8b (\reg)
+.endm
+
+ENTRY(atomic64_read_cx8)
+        CFI_STARTPROC
+
+        read64 %ecx
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_read_cx8)
+
+ENTRY(atomic64_set_cx8)
+        CFI_STARTPROC
+
+1:
+/* we don't need LOCK_PREFIX since aligned 64-bit writes
+ * are atomic on 586 and newer */
+        cmpxchg8b (%esi)
+        jne 1b
+
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_set_cx8)
+
+ENTRY(atomic64_xchg_cx8)
+        CFI_STARTPROC
+
+        movl %ebx, %eax
+        movl %ecx, %edx
+1:
+        LOCK_PREFIX
+        cmpxchg8b (%esi)
+        jne 1b
+
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_xchg_cx8)
+
+.macro addsub_return func ins insc
+ENTRY(atomic64_\func\()_return_cx8)
+        CFI_STARTPROC
+        SAVE ebp
+        SAVE ebx
+        SAVE esi
+        SAVE edi
+
+        movl %eax, %esi
+        movl %edx, %edi
+        movl %ecx, %ebp
+
+        read64 %ebp
+1:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        \ins\()l %esi, %ebx
+        \insc\()l %edi, %ecx
+        LOCK_PREFIX
+        cmpxchg8b (%ebp)
+        jne 1b
+
+10:
+        movl %ebx, %eax
+        movl %ecx, %edx
+        RESTORE edi
+        RESTORE esi
+        RESTORE ebx
+        RESTORE ebp
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_\func\()_return_cx8)
+.endm
+
+addsub_return add add adc
+addsub_return sub sub sbb
+
+.macro incdec_return func ins insc
+ENTRY(atomic64_\func\()_return_cx8)
+        CFI_STARTPROC
+        SAVE ebx
+
+        read64 %esi
+1:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        \ins\()l $1, %ebx
+        \insc\()l $0, %ecx
+        LOCK_PREFIX
+        cmpxchg8b (%esi)
+        jne 1b
+
+10:
+        movl %ebx, %eax
+        movl %ecx, %edx
+        RESTORE ebx
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_\func\()_return_cx8)
+.endm
+
+incdec_return inc add adc
+incdec_return dec sub sbb
+
+ENTRY(atomic64_dec_if_positive_cx8)
+        CFI_STARTPROC
+        SAVE ebx
+
+        read64 %esi
+1:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        subl $1, %ebx
+        sbb $0, %ecx
+        js 2f
+        LOCK_PREFIX
+        cmpxchg8b (%esi)
+        jne 1b
+
+2:
+        movl %ebx, %eax
+        movl %ecx, %edx
+        RESTORE ebx
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_dec_if_positive_cx8)
+
+ENTRY(atomic64_add_unless_cx8)
+        CFI_STARTPROC
+        SAVE ebp
+        SAVE ebx
+/* these just push these two parameters on the stack */
+        SAVE edi
+        SAVE esi
+
+        movl %ecx, %ebp
+        movl %eax, %esi
+        movl %edx, %edi
+
+        read64 %ebp
+1:
+        cmpl %eax, 0(%esp)
+        je 4f
+2:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        addl %esi, %ebx
+        adcl %edi, %ecx
+        LOCK_PREFIX
+        cmpxchg8b (%ebp)
+        jne 1b
+
+        movl $1, %eax
+3:
+        addl $8, %esp
+        CFI_ADJUST_CFA_OFFSET -8
+        RESTORE ebx
+        RESTORE ebp
+        ret
+4:
+        cmpl %edx, 4(%esp)
+        jne 2b
+        xorl %eax, %eax
+        jmp 3b
+        CFI_ENDPROC
+ENDPROC(atomic64_add_unless_cx8)
+
+ENTRY(atomic64_inc_not_zero_cx8)
+        CFI_STARTPROC
+        SAVE ebx
+
+        read64 %esi
+1:
+        testl %eax, %eax
+        je 4f
+2:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        addl $1, %ebx
+        adcl $0, %ecx
+        LOCK_PREFIX
+        cmpxchg8b (%esi)
+        jne 1b
+
+        movl $1, %eax
+3:
+        RESTORE ebx
+        ret
+4:
+        testl %edx, %edx
+        jne 2b
+        jmp 3b
+        CFI_ENDPROC
+ENDPROC(atomic64_inc_not_zero_cx8)
diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
index cae3feb1035e..db75d07c3645 100644
--- a/arch/x86/boot/memory.c
+++ b/arch/x86/boot/memory.c
@@ -91,7 +91,7 @@ static int detect_memory_e801(void)
         if (oreg.ax > 15*1024) {
                 return -1;      /* Bogus! */
         } else if (oreg.ax == 15*1024) {
-                boot_params.alt_mem_k = (oreg.dx << 6) + oreg.ax;
+                boot_params.alt_mem_k = (oreg.bx << 6) + oreg.ax;
         } else {
                 /*
                  * This ignores memory above 16MB if we have a memory
diff --git a/arch/x86/include/asm/io_apic.h b/arch/x86/include/asm/io_apic.h
index c4bd267dfc50..a97a240f67f3 100644
--- a/arch/x86/include/asm/io_apic.h
+++ b/arch/x86/include/asm/io_apic.h
@@ -150,7 +150,7 @@ void setup_IO_APIC_irq_extra(u32 gsi);
 extern void ioapic_and_gsi_init(void);
 extern void ioapic_insert_resources(void);
 
-int io_apic_setup_irq_pin(unsigned int irq, int node, struct io_apic_irq_attr *attr);
+int io_apic_setup_irq_pin_once(unsigned int irq, int node, struct io_apic_irq_attr *attr);
 
 extern struct IO_APIC_route_entry **alloc_ioapic_entries(void);
 extern void free_ioapic_entries(struct IO_APIC_route_entry **ioapic_entries);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 68df09bba92e..45fd33d1fd3a 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -128,8 +128,8 @@ static int __init parse_noapic(char *str)
 }
 early_param("noapic", parse_noapic);
 
-static int io_apic_setup_irq_pin_once(unsigned int irq, int node,
-                                      struct io_apic_irq_attr *attr);
+static int io_apic_setup_irq_pin(unsigned int irq, int node,
+                                 struct io_apic_irq_attr *attr);
 
 /* Will be called in mpparse/acpi/sfi codes for saving IRQ info */
 void mp_save_irq(struct mpc_intsrc *m)
@@ -3570,7 +3570,7 @@ int arch_setup_ht_irq(unsigned int irq, struct pci_dev *dev)
 }
 #endif /* CONFIG_HT_IRQ */
 
-int
+static int
 io_apic_setup_irq_pin(unsigned int irq, int node, struct io_apic_irq_attr *attr)
 {
         struct irq_cfg *cfg = alloc_irq_and_cfg_at(irq, node);
@@ -3585,8 +3585,8 @@ io_apic_setup_irq_pin(unsigned int irq, int node, struct io_apic_irq_attr *attr)
         return ret;
 }
 
-static int io_apic_setup_irq_pin_once(unsigned int irq, int node,
-                                      struct io_apic_irq_attr *attr)
+int io_apic_setup_irq_pin_once(unsigned int irq, int node,
+                               struct io_apic_irq_attr *attr)
 {
         unsigned int id = attr->ioapic, pin = attr->ioapic_pin;
         int ret;
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 3532d3bf8105..bb9eb29a52dd 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -698,7 +698,7 @@ cpu_dev_register(amd_cpu_dev);
  */
 
 const int amd_erratum_400[] =
-        AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf),
+        AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0x0f, 0x4, 0x2, 0xff, 0xf),
                             AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf));
 EXPORT_SYMBOL_GPL(amd_erratum_400);
 
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 61cbf4831d71..41178c826c48 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -184,26 +184,23 @@ static __initconst const u64 snb_hw_cache_event_ids
         },
  },
  [ C(LL  ) ] = {
-        /*
-         * TBD: Need Off-core Response Performance Monitoring support
-         */
         [ C(OP_READ) ] = {
-                /* OFFCORE_RESPONSE_0.ANY_DATA.LOCAL_CACHE */
+                /* OFFCORE_RESPONSE.ANY_DATA.LOCAL_CACHE */
                 [ C(RESULT_ACCESS) ] = 0x01b7,
-                /* OFFCORE_RESPONSE_1.ANY_DATA.ANY_LLC_MISS */
-                [ C(RESULT_MISS)   ] = 0x01bb,
+                /* OFFCORE_RESPONSE.ANY_DATA.ANY_LLC_MISS */
+                [ C(RESULT_MISS)   ] = 0x01b7,
         },
         [ C(OP_WRITE) ] = {
-                /* OFFCORE_RESPONSE_0.ANY_RFO.LOCAL_CACHE */
+                /* OFFCORE_RESPONSE.ANY_RFO.LOCAL_CACHE */
                 [ C(RESULT_ACCESS) ] = 0x01b7,
-                /* OFFCORE_RESPONSE_1.ANY_RFO.ANY_LLC_MISS */
-                [ C(RESULT_MISS)   ] = 0x01bb,
+                /* OFFCORE_RESPONSE.ANY_RFO.ANY_LLC_MISS */
+                [ C(RESULT_MISS)   ] = 0x01b7,
         },
         [ C(OP_PREFETCH) ] = {
-                /* OFFCORE_RESPONSE_0.PREFETCH.LOCAL_CACHE */
+                /* OFFCORE_RESPONSE.PREFETCH.LOCAL_CACHE */
                 [ C(RESULT_ACCESS) ] = 0x01b7,
-                /* OFFCORE_RESPONSE_1.PREFETCH.ANY_LLC_MISS */
-                [ C(RESULT_MISS)   ] = 0x01bb,
+                /* OFFCORE_RESPONSE.PREFETCH.ANY_LLC_MISS */
+                [ C(RESULT_MISS)   ] = 0x01b7,
         },
  },
  [ C(DTLB) ] = {
@@ -285,26 +282,26 @@ static __initconst const u64 westmere_hw_cache_event_ids
  },
  [ C(LL  ) ] = {
         [ C(OP_READ) ] = {
-                /* OFFCORE_RESPONSE_0.ANY_DATA.LOCAL_CACHE */
+                /* OFFCORE_RESPONSE.ANY_DATA.LOCAL_CACHE */
                 [ C(RESULT_ACCESS) ] = 0x01b7,
-                /* OFFCORE_RESPONSE_1.ANY_DATA.ANY_LLC_MISS */
-                [ C(RESULT_MISS)   ] = 0x01bb,
+                /* OFFCORE_RESPONSE.ANY_DATA.ANY_LLC_MISS */
+                [ C(RESULT_MISS)   ] = 0x01b7,
         },
         /*
          * Use RFO, not WRITEBACK, because a write miss would typically occur
          * on RFO.
          */
         [ C(OP_WRITE) ] = {
-                /* OFFCORE_RESPONSE_1.ANY_RFO.LOCAL_CACHE */
-                [ C(RESULT_ACCESS) ] = 0x01bb,
-                /* OFFCORE_RESPONSE_0.ANY_RFO.ANY_LLC_MISS */
+                /* OFFCORE_RESPONSE.ANY_RFO.LOCAL_CACHE */
+                [ C(RESULT_ACCESS) ] = 0x01b7,
+                /* OFFCORE_RESPONSE.ANY_RFO.ANY_LLC_MISS */
                 [ C(RESULT_MISS)   ] = 0x01b7,
         },
         [ C(OP_PREFETCH) ] = {
-                /* OFFCORE_RESPONSE_0.PREFETCH.LOCAL_CACHE */
+                /* OFFCORE_RESPONSE.PREFETCH.LOCAL_CACHE */
                 [ C(RESULT_ACCESS) ] = 0x01b7,
-                /* OFFCORE_RESPONSE_1.PREFETCH.ANY_LLC_MISS */
-                [ C(RESULT_MISS)   ] = 0x01bb,
+                /* OFFCORE_RESPONSE.PREFETCH.ANY_LLC_MISS */
+                [ C(RESULT_MISS)   ] = 0x01b7,
         },
  },
  [ C(DTLB) ] = {
@@ -352,16 +349,36 @@ static __initconst const u64 westmere_hw_cache_event_ids
 };
 
 /*
- * OFFCORE_RESPONSE MSR bits (subset), See IA32 SDM Vol 3 30.6.1.3
+ * Nehalem/Westmere MSR_OFFCORE_RESPONSE bits;
+ * See IA32 SDM Vol 3B 30.6.1.3
  */
 
-#define DMND_DATA_RD     (1 << 0)
-#define DMND_RFO         (1 << 1)
-#define DMND_WB          (1 << 3)
-#define PF_DATA_RD       (1 << 4)
-#define PF_DATA_RFO      (1 << 5)
-#define RESP_UNCORE_HIT  (1 << 8)
-#define RESP_MISS        (0xf600) /* non uncore hit */
+#define NHM_DMND_DATA_RD        (1 << 0)
+#define NHM_DMND_RFO            (1 << 1)
+#define NHM_DMND_IFETCH         (1 << 2)
+#define NHM_DMND_WB             (1 << 3)
+#define NHM_PF_DATA_RD          (1 << 4)
+#define NHM_PF_DATA_RFO         (1 << 5)
+#define NHM_PF_IFETCH           (1 << 6)
+#define NHM_OFFCORE_OTHER       (1 << 7)
+#define NHM_UNCORE_HIT          (1 << 8)
+#define NHM_OTHER_CORE_HIT_SNP  (1 << 9)
+#define NHM_OTHER_CORE_HITM     (1 << 10)
+                                /* reserved */
+#define NHM_REMOTE_CACHE_FWD    (1 << 12)
+#define NHM_REMOTE_DRAM         (1 << 13)
+#define NHM_LOCAL_DRAM          (1 << 14)
+#define NHM_NON_DRAM            (1 << 15)
+
+#define NHM_ALL_DRAM            (NHM_REMOTE_DRAM|NHM_LOCAL_DRAM)
+
+#define NHM_DMND_READ           (NHM_DMND_DATA_RD)
+#define NHM_DMND_WRITE          (NHM_DMND_RFO|NHM_DMND_WB)
+#define NHM_DMND_PREFETCH       (NHM_PF_DATA_RD|NHM_PF_DATA_RFO)
+
+#define NHM_L3_HIT      (NHM_UNCORE_HIT|NHM_OTHER_CORE_HIT_SNP|NHM_OTHER_CORE_HITM)
+#define NHM_L3_MISS     (NHM_NON_DRAM|NHM_ALL_DRAM|NHM_REMOTE_CACHE_FWD)
+#define NHM_L3_ACCESS   (NHM_L3_HIT|NHM_L3_MISS)
 
 static __initconst const u64 nehalem_hw_cache_extra_regs
                                 [PERF_COUNT_HW_CACHE_MAX]
@@ -370,16 +387,16 @@ static __initconst const u64 nehalem_hw_cache_extra_regs
 {
  [ C(LL  ) ] = {
         [ C(OP_READ) ] = {
-                [ C(RESULT_ACCESS) ] = DMND_DATA_RD|RESP_UNCORE_HIT,
-                [ C(RESULT_MISS)   ] = DMND_DATA_RD|RESP_MISS,
+                [ C(RESULT_ACCESS) ] = NHM_DMND_READ|NHM_L3_ACCESS,
+                [ C(RESULT_MISS)   ] = NHM_DMND_READ|NHM_L3_MISS,
         },
         [ C(OP_WRITE) ] = {
-                [ C(RESULT_ACCESS) ] = DMND_RFO|DMND_WB|RESP_UNCORE_HIT,
-                [ C(RESULT_MISS)   ] = DMND_RFO|DMND_WB|RESP_MISS,
+                [ C(RESULT_ACCESS) ] = NHM_DMND_WRITE|NHM_L3_ACCESS,
+                [ C(RESULT_MISS)   ] = NHM_DMND_WRITE|NHM_L3_MISS,
         },
         [ C(OP_PREFETCH) ] = {
-                [ C(RESULT_ACCESS) ] = PF_DATA_RD|PF_DATA_RFO|RESP_UNCORE_HIT,
-                [ C(RESULT_MISS)   ] = PF_DATA_RD|PF_DATA_RFO|RESP_MISS,
+                [ C(RESULT_ACCESS) ] = NHM_DMND_PREFETCH|NHM_L3_ACCESS,
+                [ C(RESULT_MISS)   ] = NHM_DMND_PREFETCH|NHM_L3_MISS,
         },
  }
 };
diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c
index 706a9fb46a58..e90f08458e6b 100644
--- a/arch/x86/kernel/devicetree.c
+++ b/arch/x86/kernel/devicetree.c
@@ -391,7 +391,7 @@ static int ioapic_xlate(struct irq_domain *id, const u32 *intspec, u32 intsize,
 
         set_io_apic_irq_attr(&attr, idx, line, it->trigger, it->polarity);
 
-        return io_apic_setup_irq_pin(*out_hwirq, cpu_to_node(0), &attr);
+        return io_apic_setup_irq_pin_once(*out_hwirq, cpu_to_node(0), &attr);
 }
 
 static void __init ioapic_add_ofnode(struct device_node *np)
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 45892dc4b72a..f65e5b521dbd 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -608,6 +608,9 @@ static int ptrace_write_dr7(struct task_struct *tsk, unsigned long data)
         unsigned len, type;
         struct perf_event *bp;
 
+        if (ptrace_get_breakpoints(tsk) < 0)
+                return -ESRCH;
+
         data &= ~DR_CONTROL_RESERVED;
         old_dr7 = ptrace_get_dr7(thread->ptrace_bps);
 restore:
@@ -655,6 +658,9 @@ restore:
                 }
                 goto restore;
         }
+
+        ptrace_put_breakpoints(tsk);
+
         return ((orig_ret < 0) ? orig_ret : rc);
 }
 
@@ -668,10 +674,17 @@ static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n)
 
         if (n < HBP_NUM) {
                 struct perf_event *bp;
+
+                if (ptrace_get_breakpoints(tsk) < 0)
+                        return -ESRCH;
+
                 bp = thread->ptrace_bps[n];
                 if (!bp)
-                        return 0;
-                val = bp->hw.info.address;
+                        val = 0;
+                else
+                        val = bp->hw.info.address;
+
+                ptrace_put_breakpoints(tsk);
         } else if (n == 6) {
                 val = thread->debugreg6;
          } else if (n == 7) {
@@ -686,6 +699,10 @@ static int ptrace_set_breakpoint_addr(struct task_struct *tsk, int nr,
         struct perf_event *bp;
         struct thread_struct *t = &tsk->thread;
         struct perf_event_attr attr;
+        int err = 0;
+
+        if (ptrace_get_breakpoints(tsk) < 0)
+                return -ESRCH;
 
         if (!t->ptrace_bps[nr]) {
                 ptrace_breakpoint_init(&attr);
@@ -709,24 +726,23 @@ static int ptrace_set_breakpoint_addr(struct task_struct *tsk, int nr,
                  * writing for the user. And anyway this is the previous
                  * behaviour.
                  */
-                if (IS_ERR(bp))
-                        return PTR_ERR(bp);
+                if (IS_ERR(bp)) {
+                        err = PTR_ERR(bp);
+                        goto put;
+                }
 
                 t->ptrace_bps[nr] = bp;
         } else {
-                int err;
-
                 bp = t->ptrace_bps[nr];
 
                 attr = bp->attr;
                 attr.bp_addr = addr;
                 err = modify_user_hw_breakpoint(bp, &attr);
-                if (err)
-                        return err;
         }
 
-
-        return 0;
+put:
+        ptrace_put_breakpoints(tsk);
+        return err;
 }
 
 /*
diff --git a/arch/x86/kernel/reboot_32.S b/arch/x86/kernel/reboot_32.S
index 29092b38d816..1d5c46df0d78 100644
--- a/arch/x86/kernel/reboot_32.S
+++ b/arch/x86/kernel/reboot_32.S
@@ -21,26 +21,26 @@ r_base = .
         /* Get our own relocated address */
         call    1f
 1:      popl    %ebx
-        subl    $1b, %ebx
+        subl    $(1b - r_base), %ebx
 
         /* Compute the equivalent real-mode segment */
         movl    %ebx, %ecx
         shrl    $4, %ecx
         
         /* Patch post-real-mode segment jump */
-        movw    dispatch_table(%ebx,%eax,2),%ax
-        movw    %ax, 101f(%ebx)
-        movw    %cx, 102f(%ebx)
+        movw    (dispatch_table - r_base)(%ebx,%eax,2),%ax
+        movw    %ax, (101f - r_base)(%ebx)
+        movw    %cx, (102f - r_base)(%ebx)
 
         /* Set up the IDT for real mode. */
-        lidtl   machine_real_restart_idt(%ebx)
+        lidtl   (machine_real_restart_idt - r_base)(%ebx)
 
         /*
          * Set up a GDT from which we can load segment descriptors for real
          * mode.  The GDT is not used in real mode; it is just needed here to
          * prepare the descriptors.
          */
-        lgdtl   machine_real_restart_gdt(%ebx)
+        lgdtl   (machine_real_restart_gdt - r_base)(%ebx)
 
         /*
          * Load the data segment registers with 16-bit compatible values
diff --git a/arch/x86/mm/numa_64.c b/arch/x86/mm/numa_64.c
index e8c00cc72033..85b52fc03084 100644
--- a/arch/x86/mm/numa_64.c
+++ b/arch/x86/mm/numa_64.c
@@ -306,7 +306,7 @@ int __init numa_cleanup_meminfo(struct numa_meminfo *mi)
                 bi->end = min(bi->end, high);
 
                 /* and there's no empty block */
-                if (bi->start == bi->end) {
+                if (bi->start >= bi->end) {
                         numa_remove_memblk_from(i--, mi);
                         continue;
                 }
diff --git a/arch/x86/platform/ce4100/falconfalls.dts b/arch/x86/platform/ce4100/falconfalls.dts
index 2d6d226f2b10..e70be38ce039 100644
--- a/arch/x86/platform/ce4100/falconfalls.dts
+++ b/arch/x86/platform/ce4100/falconfalls.dts
@@ -347,7 +347,7 @@
                                                    "pciclass0c03";
 
                                         reg = <0x16800 0x0 0x0 0x0 0x0>;
-                                        interrupts = <22 3>;
+                                        interrupts = <22 1>;
                                 };
 
                                 usb@d,1 {
@@ -357,7 +357,7 @@
                                                    "pciclass0c03";
 
                                         reg = <0x16900 0x0 0x0 0x0 0x0>;
-                                        interrupts = <22 3>;
+                                        interrupts = <22 1>;
                                 };
 
                                 sata@e,0 {
@@ -367,7 +367,7 @@
                                                    "pciclass0106";
 
                                         reg = <0x17000 0x0 0x0 0x0 0x0>;
-                                        interrupts = <23 3>;
+                                        interrupts = <23 1>;
                                 };
 
                                 flash@f,0 {
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index aef7af92b28b..55c965b38c27 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1463,6 +1463,119 @@ static int xen_pgd_alloc(struct mm_struct *mm)
         return ret;
 }
 
+#ifdef CONFIG_X86_64
+static __initdata u64 __last_pgt_set_rw = 0;
+static __initdata u64 __pgt_buf_start = 0;
+static __initdata u64 __pgt_buf_end = 0;
+static __initdata u64 __pgt_buf_top = 0;
+/*
+ * As a consequence of the commit:
+ * 
+ * commit 4b239f458c229de044d6905c2b0f9fe16ed9e01e
+ * Author: Yinghai Lu <yinghai@kernel.org>
+ * Date:   Fri Dec 17 16:58:28 2010 -0800
+ * 
+ *     x86-64, mm: Put early page table high
+ * 
+ * at some point init_memory_mapping is going to reach the pagetable pages
+ * area and map those pages too (mapping them as normal memory that falls
+ * in the range of addresses passed to init_memory_mapping as argument).
+ * Some of those pages are already pagetable pages (they are in the range
+ * pgt_buf_start-pgt_buf_end) therefore they are going to be mapped RO and
+ * everything is fine.
+ * Some of these pages are not pagetable pages yet (they fall in the range
+ * pgt_buf_end-pgt_buf_top; for example the page at pgt_buf_end) so they
+ * are going to be mapped RW.  When these pages become pagetable pages and
+ * are hooked into the pagetable, xen will find that the guest has already
+ * a RW mapping of them somewhere and fail the operation.
+ * The reason Xen requires pagetables to be RO is that the hypervisor needs
+ * to verify that the pagetables are valid before using them. The validation
+ * operations are called "pinning".
+ * 
+ * In order to fix the issue we mark all the pages in the entire range
+ * pgt_buf_start-pgt_buf_top as RO, however when the pagetable allocation
+ * is completed only the range pgt_buf_start-pgt_buf_end is reserved by
+ * init_memory_mapping. Hence the kernel is going to crash as soon as one
+ * of the pages in the range pgt_buf_end-pgt_buf_top is reused (b/c those
+ * ranges are RO).
+ * 
+ * For this reason, 'mark_rw_past_pgt' is introduced which is called _after_
+ * the init_memory_mapping has completed (in a perfect world we would
+ * call this function from init_memory_mapping, but lets ignore that).
+ * 
+ * Because we are called _after_ init_memory_mapping the pgt_buf_[start,
+ * end,top] have all changed to new values (b/c init_memory_mapping
+ * is called and setting up another new page-table). Hence, the first time
+ * we enter this function, we save away the pgt_buf_start value and update
+ * the pgt_buf_[end,top].
+ * 
+ * When we detect that the "old" pgt_buf_start through pgt_buf_end
+ * PFNs have been reserved (so memblock_x86_reserve_range has been called),
+ * we immediately set out to RW the "old" pgt_buf_end through pgt_buf_top.
+ * 
+ * And then we update those "old" pgt_buf_[end|top] with the new ones
+ * so that we can redo this on the next pagetable.
+ */
+static __init void mark_rw_past_pgt(void) {
+
+        if (pgt_buf_end > pgt_buf_start) {
+                u64 addr, size;
+
+                /* Save it away. */
+                if (!__pgt_buf_start) {
+                        __pgt_buf_start = pgt_buf_start;
+                        __pgt_buf_end = pgt_buf_end;
+                        __pgt_buf_top = pgt_buf_top;
+                        return;
+                }
+                /* If we get the range that starts at __pgt_buf_end that means
+                 * the range is reserved, and that in 'init_memory_mapping'
+                 * the 'memblock_x86_reserve_range' has been called with the
+                 * outdated __pgt_buf_start, __pgt_buf_end (the "new"
+                 * pgt_buf_[start|end|top] refer now to a new pagetable.
+                 * Note: we are called _after_ the pgt_buf_[..] have been
+                 * updated.*/
+
+                addr = memblock_x86_find_in_range_size(PFN_PHYS(__pgt_buf_start),
+                                                       &size, PAGE_SIZE);
+
+                /* Still not reserved, meaning 'memblock_x86_reserve_range'
+                 * hasn't been called yet. Update the _end and _top.*/
+                if (addr == PFN_PHYS(__pgt_buf_start)) {
+                        __pgt_buf_end = pgt_buf_end;
+                        __pgt_buf_top = pgt_buf_top;
+                        return;
+                }
+
+                /* OK, the area is reserved, meaning it is time for us to
+                 * set RW for the old end->top PFNs. */
+
+                /* ..unless we had already done this. */
+                if (__pgt_buf_end == __last_pgt_set_rw)
+                        return;
+
+                addr = PFN_PHYS(__pgt_buf_end);
+                
+                /* set as RW the rest */
+                printk(KERN_DEBUG "xen: setting RW the range %llx - %llx\n",
+                        PFN_PHYS(__pgt_buf_end), PFN_PHYS(__pgt_buf_top));
+                
+                while (addr < PFN_PHYS(__pgt_buf_top)) {
+                        make_lowmem_page_readwrite(__va(addr));
+                        addr += PAGE_SIZE;
+                }
+                /* And update everything so that we are ready for the next
+                 * pagetable (the one created for regions past 4GB) */
+                __last_pgt_set_rw = __pgt_buf_end;
+                __pgt_buf_start = pgt_buf_start;
+                __pgt_buf_end = pgt_buf_end;
+                __pgt_buf_top = pgt_buf_top;
+        }
+        return;
+}
+#else
+static __init void mark_rw_past_pgt(void) { }
+#endif
 static void xen_pgd_free(struct mm_struct *mm, pgd_t *pgd)
 {
 #ifdef CONFIG_X86_64
@@ -1489,13 +1602,21 @@ static __init pte_t mask_rw_pte(pte_t *ptep, pte_t pte)
         unsigned long pfn = pte_pfn(pte);
 
         /*
+         * A bit of optimization. We do not need to call the workaround
+         * when xen_set_pte_init is called with a PTE with 0 as PFN.
+         * That is b/c the pagetable at that point are just being populated
+         * with empty values and we can save some cycles by not calling
+         * the 'memblock' code.*/
+        if (pfn)
+                mark_rw_past_pgt();
+        /*
          * If the new pfn is within the range of the newly allocated
          * kernel pagetable, and it isn't being mapped into an
          * early_ioremap fixmap slot as a freshly allocated page, make sure
          * it is RO.
          */
         if (((!is_early_ioremap_ptep(ptep) &&
-                        pfn >= pgt_buf_start && pfn < pgt_buf_end)) ||
+                        pfn >= pgt_buf_start && pfn < pgt_buf_top)) ||
                         (is_early_ioremap_ptep(ptep) && pfn != (pgt_buf_end - 1)))
                 pte = pte_wrprotect(pte);
 
@@ -1997,6 +2118,8 @@ __init void xen_ident_map_ISA(void)
 
 static __init void xen_post_allocator_init(void)
 {
+        mark_rw_past_pgt();
+
 #ifdef CONFIG_XEN_DEBUG
         pv_mmu_ops.make_pte = PV_CALLEE_SAVE(xen_make_pte_debug);
 #endif
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index b136c9c1e531..449c556274c0 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -943,6 +943,10 @@ static int acpi_bus_get_flags(struct acpi_device *device)
         if (ACPI_SUCCESS(status))
                 device->flags.lockable = 1;
 
+        /* Power resources cannot be power manageable. */
+        if (device->device_type == ACPI_BUS_TYPE_POWER)
+                return 0;
+
         /* Presence of _PS0|_PR0 indicates 'power manageable' */
         status = acpi_get_handle(device->handle, "_PS0", &temp);
         if (ACPI_FAILURE(status))
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index fbc5b6e7c591..abe3ab709e87 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -63,6 +63,7 @@ void device_pm_init(struct device *dev)
         dev->power.wakeup = NULL;
         spin_lock_init(&dev->power.lock);
         pm_runtime_init(dev);
+        INIT_LIST_HEAD(&dev->power.entry);
 }
 
 /**
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 4573c83df6dd..abbbd33e8d8a 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -258,7 +258,7 @@ void device_set_wakeup_capable(struct device *dev, bool capable)
         if (!!dev->power.can_wakeup == !!capable)
                 return;
 
-        if (device_is_registered(dev)) {
+        if (device_is_registered(dev) && !list_empty(&dev->power.entry)) {
                 if (capable) {
                         if (wakeup_sysfs_add(dev))
                                 return;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 16dc3645291c..3e904717c1c0 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -777,9 +777,9 @@ static int rbd_do_request(struct request *rq,
                                       ops,
                                       false,
                                       GFP_NOIO, pages, bio);
-        if (IS_ERR(req)) {
+        if (!req) {
                 up_read(&header->snap_rwsem);
-                ret = PTR_ERR(req);
+                ret = -ENOMEM;
                 goto done_pages;
         }
 
diff --git a/drivers/clk/clkdev.c b/drivers/clk/clkdev.c
index 0fc0a79852de..6db161f64ae0 100644
--- a/drivers/clk/clkdev.c
+++ b/drivers/clk/clkdev.c
@@ -32,10 +32,9 @@ static DEFINE_MUTEX(clocks_mutex);
  * Then we take the most specific entry - with the following
  * order of precedence: dev+con > dev only > con only.
  */
-static struct clk *clk_find(const char *dev_id, const char *con_id)
+static struct clk_lookup *clk_find(const char *dev_id, const char *con_id)
 {
-        struct clk_lookup *p;
-        struct clk *clk = NULL;
+        struct clk_lookup *p, *cl = NULL;
         int match, best = 0;
 
         list_for_each_entry(p, &clocks, node) {
@@ -52,27 +51,27 @@ static struct clk *clk_find(const char *dev_id, const char *con_id)
                 }
 
                 if (match > best) {
-                        clk = p->clk;
+                        cl = p;
                         if (match != 3)
                                 best = match;
                         else
                                 break;
                 }
         }
-        return clk;
+        return cl;
 }
 
 struct clk *clk_get_sys(const char *dev_id, const char *con_id)
 {
-        struct clk *clk;
+        struct clk_lookup *cl;
 
         mutex_lock(&clocks_mutex);
-        clk = clk_find(dev_id, con_id);
-        if (clk && !__clk_get(clk))
-                clk = NULL;
+        cl = clk_find(dev_id, con_id);
+        if (cl && !__clk_get(cl->clk))
+                cl = NULL;
         mutex_unlock(&clocks_mutex);
 
-        return clk ? clk : ERR_PTR(-ENOENT);
+        return cl ? cl->clk : ERR_PTR(-ENOENT);
 }
 EXPORT_SYMBOL(clk_get_sys);
 
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 31e71c4fc831..9a8bebcf6b17 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -211,8 +211,6 @@ static int amd64_get_scrub_rate(struct mem_ctl_info *mci)
 
         scrubval = scrubval & 0x001F;
 
-        amd64_debug("pci-read, sdram scrub control value: %d\n", scrubval);
-
         for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
                 if (scrubrates[i].scrubval == scrubval) {
                         retval = scrubrates[i].bandwidth;
@@ -933,25 +931,74 @@ static int k8_early_channel_count(struct amd64_pvt *pvt)
 /* On F10h and later ErrAddr is MC4_ADDR[47:1] */
 static u64 get_error_address(struct mce *m)
 {
+        struct cpuinfo_x86 *c = &boot_cpu_data;
+        u64 addr;
         u8 start_bit = 1;
         u8 end_bit   = 47;
 
-        if (boot_cpu_data.x86 == 0xf) {
+        if (c->x86 == 0xf) {
                 start_bit = 3;
                 end_bit   = 39;
         }
 
-        return m->addr & GENMASK(start_bit, end_bit);
+        addr = m->addr & GENMASK(start_bit, end_bit);
+
+        /*
+         * Erratum 637 workaround
+         */
+        if (c->x86 == 0x15) {
+                struct amd64_pvt *pvt;
+                u64 cc6_base, tmp_addr;
+                u32 tmp;
+                u8 mce_nid, intlv_en;
+
+                if ((addr & GENMASK(24, 47)) >> 24 != 0x00fdf7)
+                        return addr;
+
+                mce_nid = amd_get_nb_id(m->extcpu);
+                pvt     = mcis[mce_nid]->pvt_info;
+
+                amd64_read_pci_cfg(pvt->F1, DRAM_LOCAL_NODE_LIM, &tmp);
+                intlv_en = tmp >> 21 & 0x7;
+
+                /* add [47:27] + 3 trailing bits */
+                cc6_base  = (tmp & GENMASK(0, 20)) << 3;
+
+                /* reverse and add DramIntlvEn */
+                cc6_base |= intlv_en ^ 0x7;
+
+                /* pin at [47:24] */
+                cc6_base <<= 24;
+
+                if (!intlv_en)
+                        return cc6_base | (addr & GENMASK(0, 23));
+
+                amd64_read_pci_cfg(pvt->F1, DRAM_LOCAL_NODE_BASE, &tmp);
+
+                                                        /* faster log2 */
+                tmp_addr  = (addr & GENMASK(12, 23)) << __fls(intlv_en + 1);
+
+                /* OR DramIntlvSel into bits [14:12] */
+                tmp_addr |= (tmp & GENMASK(21, 23)) >> 9;
+
+                /* add remaining [11:0] bits from original MC4_ADDR */
+                tmp_addr |= addr & GENMASK(0, 11);
+
+                return cc6_base | tmp_addr;
+        }
+
+        return addr;
 }
 
 static void read_dram_base_limit_regs(struct amd64_pvt *pvt, unsigned range)
 {
+        struct cpuinfo_x86 *c = &boot_cpu_data;
         int off = range << 3;
 
         amd64_read_pci_cfg(pvt->F1, DRAM_BASE_LO + off,  &pvt->ranges[range].base.lo);
         amd64_read_pci_cfg(pvt->F1, DRAM_LIMIT_LO + off, &pvt->ranges[range].lim.lo);
 
-        if (boot_cpu_data.x86 == 0xf)
+        if (c->x86 == 0xf)
                 return;
 
         if (!dram_rw(pvt, range))
@@ -959,6 +1006,31 @@ static void read_dram_base_limit_regs(struct amd64_pvt *pvt, unsigned range)
 
         amd64_read_pci_cfg(pvt->F1, DRAM_BASE_HI + off,  &pvt->ranges[range].base.hi);
         amd64_read_pci_cfg(pvt->F1, DRAM_LIMIT_HI + off, &pvt->ranges[range].lim.hi);
+
+        /* Factor in CC6 save area by reading dst node's limit reg */
+        if (c->x86 == 0x15) {
+                struct pci_dev *f1 = NULL;
+                u8 nid = dram_dst_node(pvt, range);
+                u32 llim;
+
+                f1 = pci_get_domain_bus_and_slot(0, 0, PCI_DEVFN(0x18 + nid, 1));
+                if (WARN_ON(!f1))
+                        return;
+
+                amd64_read_pci_cfg(f1, DRAM_LOCAL_NODE_LIM, &llim);
+
+                pvt->ranges[range].lim.lo &= GENMASK(0, 15);
+
+                                            /* {[39:27],111b} */
+                pvt->ranges[range].lim.lo |= ((llim & 0x1fff) << 3 | 0x7) << 16;
+
+                pvt->ranges[range].lim.hi &= GENMASK(0, 7);
+
+                                            /* [47:40] */
+                pvt->ranges[range].lim.hi |= llim >> 13;
+
+                pci_dev_put(f1);
+        }
 }
 
 static void k8_map_sysaddr_to_csrow(struct mem_ctl_info *mci, u64 sys_addr,
@@ -1403,12 +1475,8 @@ static int f1x_match_to_this_node(struct amd64_pvt *pvt, unsigned range,
                 return -EINVAL;
         }
 
-        if (intlv_en &&
-            (intlv_sel != ((sys_addr >> 12) & intlv_en))) {
-                amd64_warn("Botched intlv bits, en: 0x%x, sel: 0x%x\n",
-                           intlv_en, intlv_sel);
+        if (intlv_en && (intlv_sel != ((sys_addr >> 12) & intlv_en)))
                 return -EINVAL;
-        }
 
         sys_addr = f1x_swap_interleaved_region(pvt, sys_addr);
 
diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
index 11be36a311eb..9a666cb985b2 100644
--- a/drivers/edac/amd64_edac.h
+++ b/drivers/edac/amd64_edac.h
@@ -196,6 +196,9 @@
 
 #define DCT_CFG_SEL                     0x10C
 
+#define DRAM_LOCAL_NODE_BASE            0x120
+#define DRAM_LOCAL_NODE_LIM             0x124
+
 #define DRAM_BASE_HI                    0x140
 #define DRAM_LIMIT_HI                   0x144
 
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index 26343fd46596..29ffa350bfbe 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -458,13 +458,13 @@ static ssize_t mci_sdram_scrub_rate_store(struct mem_ctl_info *mci,
                 return -EINVAL;
 
         new_bw = mci->set_sdram_scrub_rate(mci, bandwidth);
-        if (new_bw >= 0) {
-                edac_printk(KERN_DEBUG, EDAC_MC, "Scrub rate set to %d\n", new_bw);
-                return count;
+        if (new_bw < 0) {
+                edac_printk(KERN_WARNING, EDAC_MC,
+                            "Error setting scrub rate to: %lu\n", bandwidth);
+                return -EINVAL;
         }
 
-        edac_printk(KERN_DEBUG, EDAC_MC, "Error setting scrub rate to: %lu\n", bandwidth);
-        return -EINVAL;
+        return count;
 }
 
 /*
@@ -483,7 +483,6 @@ static ssize_t mci_sdram_scrub_rate_show(struct mem_ctl_info *mci, char *data)
                 return bandwidth;
         }
 
-        edac_printk(KERN_DEBUG, EDAC_MC, "Read scrub rate: %d\n", bandwidth);
         return sprintf(data, "%d\n", bandwidth);
 }
 
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index f903d7b6f34a..23d1468ad253 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2199,7 +2199,6 @@ static int ohci_set_config_rom(struct fw_card *card,
 {
         struct fw_ohci *ohci;
         unsigned long flags;
-        int ret = -EBUSY;
         __be32 *next_config_rom;
         dma_addr_t uninitialized_var(next_config_rom_bus);
 
@@ -2240,22 +2239,37 @@ static int ohci_set_config_rom(struct fw_card *card,
 
         spin_lock_irqsave(&ohci->lock, flags);
 
+        /*
+         * If there is not an already pending config_rom update,
+         * push our new allocation into the ohci->next_config_rom
+         * and then mark the local variable as null so that we
+         * won't deallocate the new buffer.
+         *
+         * OTOH, if there is a pending config_rom update, just
+         * use that buffer with the new config_rom data, and
+         * let this routine free the unused DMA allocation.
+         */
+
         if (ohci->next_config_rom == NULL) {
                 ohci->next_config_rom = next_config_rom;
                 ohci->next_config_rom_bus = next_config_rom_bus;
+                next_config_rom = NULL;
+        }
 
-                copy_config_rom(ohci->next_config_rom, config_rom, length);
+        copy_config_rom(ohci->next_config_rom, config_rom, length);
 
-                ohci->next_header = config_rom[0];
-                ohci->next_config_rom[0] = 0;
+        ohci->next_header = config_rom[0];
+        ohci->next_config_rom[0] = 0;
 
-                reg_write(ohci, OHCI1394_ConfigROMmap,
-                          ohci->next_config_rom_bus);
-                ret = 0;
-        }
+        reg_write(ohci, OHCI1394_ConfigROMmap, ohci->next_config_rom_bus);
 
         spin_unlock_irqrestore(&ohci->lock, flags);
 
+        /* If we didn't use the DMA allocation, delete it. */
+        if (next_config_rom != NULL)
+                dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
+                                  next_config_rom, next_config_rom_bus);
+
         /*
          * Now initiate a bus reset to have the changes take
          * effect. We clean up the old config rom memory and DMA
@@ -2263,13 +2277,10 @@ static int ohci_set_config_rom(struct fw_card *card,
          * controller could need to access it before the bus reset
          * takes effect.
          */
-        if (ret == 0)
-                fw_schedule_bus_reset(&ohci->card, true, true);
-        else
-                dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
-                                  next_config_rom, next_config_rom_bus);
 
-        return ret;
+        fw_schedule_bus_reset(&ohci->card, true, true);
+
+        return 0;
 }
 
 static void ohci_send_request(struct fw_card *card, struct fw_packet *packet)
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index c58f691ec3ce..b493663c7ba7 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -24,6 +24,7 @@ config DRM_KMS_HELPER
         depends on DRM
         select FB
         select FRAMEBUFFER_CONSOLE if !EXPERT
+        select FRAMEBUFFER_CONSOLE_DETECT_PRIMARY if FRAMEBUFFER_CONSOLE
         help
           FB and CRTC helpers for KMS drivers.
 
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 950720473967..11d7a72c22d9 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -342,9 +342,22 @@ int drm_fb_helper_debug_leave(struct fb_info *info)
 }
 EXPORT_SYMBOL(drm_fb_helper_debug_leave);
 
+bool drm_fb_helper_restore_fbdev_mode(struct drm_fb_helper *fb_helper)
+{
+        bool error = false;
+        int i, ret;
+        for (i = 0; i < fb_helper->crtc_count; i++) {
+                struct drm_mode_set *mode_set = &fb_helper->crtc_info[i].mode_set;
+                ret = drm_crtc_helper_set_config(mode_set);
+                if (ret)
+                        error = true;
+        }
+        return error;
+}
+EXPORT_SYMBOL(drm_fb_helper_restore_fbdev_mode);
+
 bool drm_fb_helper_force_kernel_mode(void)
 {
-        int i = 0;
         bool ret, error = false;
         struct drm_fb_helper *helper;
 
@@ -352,12 +365,12 @@ bool drm_fb_helper_force_kernel_mode(void)
                 return false;
 
         list_for_each_entry(helper, &kernel_fb_helper_list, kernel_fb_list) {
-                for (i = 0; i < helper->crtc_count; i++) {
-                        struct drm_mode_set *mode_set = &helper->crtc_info[i].mode_set;
-                        ret = drm_crtc_helper_set_config(mode_set);
-                        if (ret)
-                                error = true;
-                }
+                if (helper->dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+                        continue;
+
+                ret = drm_fb_helper_restore_fbdev_mode(helper);
+                if (ret)
+                        error = true;
         }
         return error;
 }
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 741457bd1c46..a1f12cb043de 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -932,11 +932,34 @@ EXPORT_SYMBOL(drm_vblank_put);
 
 void drm_vblank_off(struct drm_device *dev, int crtc)
 {
+        struct drm_pending_vblank_event *e, *t;
+        struct timeval now;
         unsigned long irqflags;
+        unsigned int seq;
 
         spin_lock_irqsave(&dev->vbl_lock, irqflags);
         vblank_disable_and_save(dev, crtc);
         DRM_WAKEUP(&dev->vbl_queue[crtc]);
+
+        /* Send any queued vblank events, lest the natives grow disquiet */
+        seq = drm_vblank_count_and_time(dev, crtc, &now);
+        list_for_each_entry_safe(e, t, &dev->vblank_event_list, base.link) {
+                if (e->pipe != crtc)
+                        continue;
+                DRM_DEBUG("Sending premature vblank event on disable: \
+                          wanted %d, current %d\n",
+                          e->event.sequence, seq);
+
+                e->event.sequence = seq;
+                e->event.tv_sec = now.tv_sec;
+                e->event.tv_usec = now.tv_usec;
+                drm_vblank_put(dev, e->pipe);
+                list_move_tail(&e->base.link, &e->base.file_priv->event_list);
+                wake_up_interruptible(&e->base.file_priv->event_wait);
+                trace_drm_vblank_event_delivered(e->base.pid, e->pipe,
+                                                 e->event.sequence);
+        }
+
         spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
 }
 EXPORT_SYMBOL(drm_vblank_off);
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 5d00b0fc0d91..959186cbf328 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -431,7 +431,7 @@ EXPORT_SYMBOL(drm_mm_search_free_in_range);
 void drm_mm_replace_node(struct drm_mm_node *old, struct drm_mm_node *new)
 {
         list_replace(&old->node_list, &new->node_list);
-        list_replace(&old->node_list, &new->hole_stack);
+        list_replace(&old->hole_stack, &new->hole_stack);
         new->hole_follows = old->hole_follows;
         new->mm = old->mm;
         new->start = old->start;
@@ -699,8 +699,8 @@ int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
                                 entry->size);
                 total_used += entry->size;
                 if (entry->hole_follows) {
-                        hole_start = drm_mm_hole_node_start(&mm->head_node);
-                        hole_end = drm_mm_hole_node_end(&mm->head_node);
+                        hole_start = drm_mm_hole_node_start(entry);
+                        hole_end = drm_mm_hole_node_end(entry);
                         hole_size = hole_end - hole_start;
                         seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: free\n",
                                         hole_start, hole_end, hole_size);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 72730377a01b..12876f2795d2 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -2207,7 +2207,7 @@ void i915_driver_lastclose(struct drm_device * dev)
         drm_i915_private_t *dev_priv = dev->dev_private;
 
         if (!dev_priv || drm_core_check_feature(dev, DRIVER_MODESET)) {
-                drm_fb_helper_restore();
+                intel_fb_restore_mode(dev);
                 vga_switcheroo_process_delayed_switch();
                 return;
         }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e522c702b04e..373c2a005ec1 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5154,8 +5154,6 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
 
         I915_WRITE(DSPCNTR(plane), dspcntr);
         POSTING_READ(DSPCNTR(plane));
-        if (!HAS_PCH_SPLIT(dev))
-                intel_enable_plane(dev_priv, plane, pipe);
 
         ret = intel_pipe_set_base(crtc, x, y, old_fb);
 
@@ -5605,9 +5603,9 @@ static int intel_crtc_clock_get(struct drm_device *dev, struct drm_crtc *crtc)
         intel_clock_t clock;
 
         if ((dpll & DISPLAY_RATE_SELECT_FPA1) == 0)
-                fp = FP0(pipe);
+                fp = I915_READ(FP0(pipe));
         else
-                fp = FP1(pipe);
+                fp = I915_READ(FP1(pipe));
 
         clock.m1 = (fp & FP_M1_DIV_MASK) >> FP_M1_DIV_SHIFT;
         if (IS_PINEVIEW(dev)) {
@@ -6579,8 +6577,10 @@ intel_user_framebuffer_create(struct drm_device *dev,
                 return ERR_PTR(-ENOENT);
 
         intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
-        if (!intel_fb)
+        if (!intel_fb) {
+                drm_gem_object_unreference_unlocked(&obj->base);
                 return ERR_PTR(-ENOMEM);
+        }
 
         ret = intel_framebuffer_init(dev, intel_fb, mode_cmd, obj);
         if (ret) {
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index cb8578b7e443..a4d80314e7f8 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1470,7 +1470,8 @@ intel_dp_link_down(struct intel_dp *intel_dp)
 
         if (!HAS_PCH_CPT(dev) &&
             I915_READ(intel_dp->output_reg) & DP_PIPEB_SELECT) {
-                struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.base.crtc);
+                struct drm_crtc *crtc = intel_dp->base.base.crtc;
+
                 /* Hardware workaround: leaving our transcoder select
                  * set to transcoder B while it's off will prevent the
                  * corresponding HDMI output on transcoder A.
@@ -1485,7 +1486,19 @@ intel_dp_link_down(struct intel_dp *intel_dp)
                 /* Changes to enable or select take place the vblank
                  * after being written.
                  */
-                intel_wait_for_vblank(dev, intel_crtc->pipe);
+                if (crtc == NULL) {
+                        /* We can arrive here never having been attached
+                         * to a CRTC, for instance, due to inheriting
+                         * random state from the BIOS.
+                         *
+                         * If the pipe is not running, play safe and
+                         * wait for the clocks to stabilise before
+                         * continuing.
+                         */
+                        POSTING_READ(intel_dp->output_reg);
+                        msleep(50);
+                } else
+                        intel_wait_for_vblank(dev, to_intel_crtc(crtc)->pipe);
         }
 
         I915_WRITE(intel_dp->output_reg, DP & ~DP_PORT_EN);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index f5b0d8306d83..1d20712d527f 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -338,4 +338,5 @@ extern int intel_overlay_attrs(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
 
 extern void intel_fb_output_poll_changed(struct drm_device *dev);
+extern void intel_fb_restore_mode(struct drm_device *dev);
 #endif /* __INTEL_DRV_H__ */
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 512782728e51..ec49bae73382 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -264,3 +264,13 @@ void intel_fb_output_poll_changed(struct drm_device *dev)
         drm_i915_private_t *dev_priv = dev->dev_private;
         drm_fb_helper_hotplug_event(&dev_priv->fbdev->helper);
 }
+
+void intel_fb_restore_mode(struct drm_device *dev)
+{
+        int ret;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+
+        ret = drm_fb_helper_restore_fbdev_mode(&dev_priv->fbdev->helper);
+        if (ret)
+                DRM_DEBUG("failed to restore crtc mode\n");
+}
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index a562bd2648c7..67cb076d271b 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -539,6 +539,9 @@ static int intel_lid_notify(struct notifier_block *nb, unsigned long val,
         struct drm_device *dev = dev_priv->dev;
         struct drm_connector *connector = dev_priv->int_lvds_connector;
 
+        if (dev->switch_power_state != DRM_SWITCH_POWER_ON)
+                return NOTIFY_OK;
+
         /*
          * check and update the status of LVDS connector after receiving
          * the LID nofication event.
diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 5045f8b921d6..c3e953b08992 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -152,8 +152,6 @@ nouveau_mem_vram_fini(struct drm_device *dev)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
 
-        nouveau_bo_ref(NULL, &dev_priv->vga_ram);
-
         ttm_bo_device_release(&dev_priv->ttm.bdev);
 
         nouveau_ttm_global_release(dev_priv);
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
index a30adec5beaa..915fbce89595 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -768,6 +768,11 @@ static void nouveau_card_takedown(struct drm_device *dev)
         engine->mc.takedown(dev);
         engine->display.late_takedown(dev);
 
+        if (dev_priv->vga_ram) {
+                nouveau_bo_unpin(dev_priv->vga_ram);
+                nouveau_bo_ref(NULL, &dev_priv->vga_ram);
+        }
+
         mutex_lock(&dev->struct_mutex);
         ttm_bo_clean_mm(&dev_priv->ttm.bdev, TTM_PL_VRAM);
         ttm_bo_clean_mm(&dev_priv->ttm.bdev, TTM_PL_TT);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index e9bc135d9189..c20eac3379e6 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -862,9 +862,15 @@ int evergreen_pcie_gart_enable(struct radeon_device *rdev)
                 SYSTEM_ACCESS_MODE_NOT_IN_SYS |
                 SYSTEM_APERTURE_UNMAPPED_ACCESS_PASS_THRU |
                 EFFECTIVE_L1_TLB_SIZE(5) | EFFECTIVE_L1_QUEUE_SIZE(5);
-        WREG32(MC_VM_MD_L1_TLB0_CNTL, tmp);
-        WREG32(MC_VM_MD_L1_TLB1_CNTL, tmp);
-        WREG32(MC_VM_MD_L1_TLB2_CNTL, tmp);
+        if (rdev->flags & RADEON_IS_IGP) {
+                WREG32(FUS_MC_VM_MD_L1_TLB0_CNTL, tmp);
+                WREG32(FUS_MC_VM_MD_L1_TLB1_CNTL, tmp);
+                WREG32(FUS_MC_VM_MD_L1_TLB2_CNTL, tmp);
+        } else {
+                WREG32(MC_VM_MD_L1_TLB0_CNTL, tmp);
+                WREG32(MC_VM_MD_L1_TLB1_CNTL, tmp);
+                WREG32(MC_VM_MD_L1_TLB2_CNTL, tmp);
+        }
         WREG32(MC_VM_MB_L1_TLB0_CNTL, tmp);
         WREG32(MC_VM_MB_L1_TLB1_CNTL, tmp);
         WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
@@ -2923,11 +2929,6 @@ static int evergreen_startup(struct radeon_device *rdev)
                 rdev->asic->copy = NULL;
                 dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
         }
-        /* XXX: ontario has problems blitting to gart at the moment */
-        if (rdev->family == CHIP_PALM) {
-                rdev->asic->copy = NULL;
-                radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
-        }
 
         /* allocate wb buffer */
         r = radeon_wb_init(rdev);
diff --git a/drivers/gpu/drm/radeon/evergreend.h b/drivers/gpu/drm/radeon/evergreend.h
index 9aaa3f0c9372..94533849927e 100644
--- a/drivers/gpu/drm/radeon/evergreend.h
+++ b/drivers/gpu/drm/radeon/evergreend.h
@@ -221,6 +221,11 @@
 #define MC_VM_MD_L1_TLB0_CNTL                           0x2654
 #define MC_VM_MD_L1_TLB1_CNTL                           0x2658
 #define MC_VM_MD_L1_TLB2_CNTL                           0x265C
+
+#define FUS_MC_VM_MD_L1_TLB0_CNTL                       0x265C
+#define FUS_MC_VM_MD_L1_TLB1_CNTL                       0x2660
+#define FUS_MC_VM_MD_L1_TLB2_CNTL                       0x2664
+
 #define MC_VM_SYSTEM_APERTURE_DEFAULT_ADDR              0x203C
 #define MC_VM_SYSTEM_APERTURE_HIGH_ADDR                 0x2038
 #define MC_VM_SYSTEM_APERTURE_LOW_ADDR                  0x2034
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index f5d12fb103fa..dd881d035f09 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -431,7 +431,7 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                 }
         }
 
-        /* Acer laptop (Acer TravelMate 5730G) has an HDMI port
+        /* Acer laptop (Acer TravelMate 5730/5730G) has an HDMI port
          * on the laptop and a DVI port on the docking station and
          * both share the same encoder, hpd pin, and ddc line.
          * So while the bios table is technically correct,
@@ -440,7 +440,7 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
          * with different crtcs which isn't possible on the hardware
          * side and leaves no crtcs for LVDS or VGA.
          */
-        if ((dev->pdev->device == 0x95c4) &&
+        if (((dev->pdev->device == 0x95c4) || (dev->pdev->device == 0x9591)) &&
             (dev->pdev->subsystem_vendor == 0x1025) &&
             (dev->pdev->subsystem_device == 0x013c)) {
                 if ((*connector_type == DRM_MODE_CONNECTOR_DVII) &&
@@ -1599,9 +1599,10 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct
                                                         memcpy((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0],
                                                                fake_edid_record->ucFakeEDIDLength);
 
-                                                        if (drm_edid_is_valid(edid))
+                                                        if (drm_edid_is_valid(edid)) {
                                                                 rdev->mode_info.bios_hardcoded_edid = edid;
-                                                        else
+                                                                rdev->mode_info.bios_hardcoded_edid_size = edid_size;
+                                                        } else
                                                                 kfree(edid);
                                                 }
                                         }
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index ed5dfe58f29c..9d95792bea3e 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -15,6 +15,9 @@
 #define ATPX_VERSION 0
 #define ATPX_GPU_PWR 2
 #define ATPX_MUX_SELECT 3
+#define ATPX_I2C_MUX_SELECT 4
+#define ATPX_SWITCH_START 5
+#define ATPX_SWITCH_END 6
 
 #define ATPX_INTEGRATED 0
 #define ATPX_DISCRETE 1
@@ -149,13 +152,35 @@ static int radeon_atpx_switch_mux(acpi_handle handle, int mux_id)
         return radeon_atpx_execute(handle, ATPX_MUX_SELECT, mux_id);
 }
 
+static int radeon_atpx_switch_i2c_mux(acpi_handle handle, int mux_id)
+{
+        return radeon_atpx_execute(handle, ATPX_I2C_MUX_SELECT, mux_id);
+}
+
+static int radeon_atpx_switch_start(acpi_handle handle, int gpu_id)
+{
+        return radeon_atpx_execute(handle, ATPX_SWITCH_START, gpu_id);
+}
+
+static int radeon_atpx_switch_end(acpi_handle handle, int gpu_id)
+{
+        return radeon_atpx_execute(handle, ATPX_SWITCH_END, gpu_id);
+}
 
 static int radeon_atpx_switchto(enum vga_switcheroo_client_id id)
 {
+        int gpu_id;
+
         if (id == VGA_SWITCHEROO_IGD)
-                radeon_atpx_switch_mux(radeon_atpx_priv.atpx_handle, 0);
+                gpu_id = ATPX_INTEGRATED;
         else
-                radeon_atpx_switch_mux(radeon_atpx_priv.atpx_handle, 1);
+                gpu_id = ATPX_DISCRETE;
+
+        radeon_atpx_switch_start(radeon_atpx_priv.atpx_handle, gpu_id);
+        radeon_atpx_switch_mux(radeon_atpx_priv.atpx_handle, gpu_id);
+        radeon_atpx_switch_i2c_mux(radeon_atpx_priv.atpx_handle, gpu_id);
+        radeon_atpx_switch_end(radeon_atpx_priv.atpx_handle, gpu_id);
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index bdf2fa1189ae..3189a7efb2e9 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -167,9 +167,6 @@ int radeon_crtc_cursor_set(struct drm_crtc *crtc,
                 return -EINVAL;
         }
 
-        radeon_crtc->cursor_width = width;
-        radeon_crtc->cursor_height = height;
-
         obj = drm_gem_object_lookup(crtc->dev, file_priv, handle);
         if (!obj) {
                 DRM_ERROR("Cannot find cursor object %x for crtc %d\n", handle, radeon_crtc->crtc_id);
@@ -180,6 +177,9 @@ int radeon_crtc_cursor_set(struct drm_crtc *crtc,
         if (ret)
                 goto fail;
 
+        radeon_crtc->cursor_width = width;
+        radeon_crtc->cursor_height = height;
+
         radeon_lock_cursor(crtc, true);
         /* XXX only 27 bit offset for legacy cursor */
         radeon_set_cursor(crtc, obj, gpu_addr);
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index bf7d4c061451..bd58af658581 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -221,6 +221,22 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                         return -EINVAL;
                 }
                 break;
+        case RADEON_INFO_NUM_TILE_PIPES:
+                if (rdev->family >= CHIP_CAYMAN)
+                        value = rdev->config.cayman.max_tile_pipes;
+                else if (rdev->family >= CHIP_CEDAR)
+                        value = rdev->config.evergreen.max_tile_pipes;
+                else if (rdev->family >= CHIP_RV770)
+                        value = rdev->config.rv770.max_tile_pipes;
+                else if (rdev->family >= CHIP_R600)
+                        value = rdev->config.r600.max_tile_pipes;
+                else {
+                        return -EINVAL;
+                }
+                break;
+        case RADEON_INFO_FUSION_GART_WORKING:
+                value = 1;
+                break;
         default:
                 DRM_DEBUG_KMS("Invalid request %d\n", info->request);
                 return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/reg_srcs/r600 b/drivers/gpu/drm/radeon/reg_srcs/r600
index af0da4ae3f55..92f1900dc7ca 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/r600
+++ b/drivers/gpu/drm/radeon/reg_srcs/r600
@@ -708,6 +708,7 @@ r600 0x9400
 0x00028D0C DB_RENDER_CONTROL
 0x00028D10 DB_RENDER_OVERRIDE
 0x0002880C DB_SHADER_CONTROL
+0x00028D28 DB_SRESULTS_COMPARE_STATE0
 0x00028D2C DB_SRESULTS_COMPARE_STATE1
 0x00028430 DB_STENCILREFMASK
 0x00028434 DB_STENCILREFMASK_BF
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 060ef6327876..50e40dbd8bb6 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -110,8 +110,7 @@ config SENSORS_ADM1021
         help
           If you say yes here you get support for Analog Devices ADM1021
           and ADM1023 sensor chips and clones: Maxim MAX1617 and MAX1617A,
-          Genesys Logic GL523SM, National Semiconductor LM84, TI THMC10,
-          and the XEON processor built-in sensor.
+          Genesys Logic GL523SM, National Semiconductor LM84 and TI THMC10.
 
           This driver can also be built as a module.  If so, the module
           will be called adm1021.
@@ -618,10 +617,10 @@ config SENSORS_LM90
         depends on I2C
         help
           If you say yes here you get support for National Semiconductor LM90,
-          LM86, LM89 and LM99, Analog Devices ADM1032 and ADT7461, Maxim
-          MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
-          MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, and Winbond/Nuvoton
-          W83L771W/G/AWG/ASG sensor chips.
+          LM86, LM89 and LM99, Analog Devices ADM1032, ADT7461, and ADT7461A,
+          Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
+          MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ON Semiconductor NCT1008,
+          and Winbond/Nuvoton W83L771W/G/AWG/ASG sensor chips.
 
           This driver can also be built as a module.  If so, the module
           will be called lm90.
diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index 250d099ca398..da72dc12068c 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -1094,6 +1094,7 @@ static struct attribute *lm85_attributes_minctl[] = {
         &sensor_dev_attr_pwm1_auto_pwm_minctl.dev_attr.attr,
         &sensor_dev_attr_pwm2_auto_pwm_minctl.dev_attr.attr,
         &sensor_dev_attr_pwm3_auto_pwm_minctl.dev_attr.attr,
+        NULL
 };
 
 static const struct attribute_group lm85_group_minctl = {
@@ -1104,6 +1105,7 @@ static struct attribute *lm85_attributes_temp_off[] = {
         &sensor_dev_attr_temp1_auto_temp_off.dev_attr.attr,
         &sensor_dev_attr_temp2_auto_temp_off.dev_attr.attr,
         &sensor_dev_attr_temp3_auto_temp_off.dev_attr.attr,
+        NULL
 };
 
 static const struct attribute_group lm85_group_temp_off = {
@@ -1329,11 +1331,11 @@ static int lm85_probe(struct i2c_client *client,
         if (data->type != emc6d103s) {
                 err = sysfs_create_group(&client->dev.kobj, &lm85_group_minctl);
                 if (err)
-                        goto err_kfree;
+                        goto err_remove_files;
                 err = sysfs_create_group(&client->dev.kobj,
                                          &lm85_group_temp_off);
                 if (err)
-                        goto err_kfree;
+                        goto err_remove_files;
         }
 
         /* The ADT7463/68 have an optional VRM 10 mode where pin 21 is used
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index c43b4e9f96a9..2f94f9504804 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -49,10 +49,10 @@
  * chips, but support three temperature sensors instead of two. MAX6695
  * and MAX6696 only differ in the pinout so they can be treated identically.
  *
- * This driver also supports the ADT7461 chip from Analog Devices.
- * It's supported in both compatibility and extended mode. It is mostly
- * compatible with LM90 except for a data format difference for the
- * temperature value registers.
+ * This driver also supports ADT7461 and ADT7461A from Analog Devices as well as
+ * NCT1008 from ON Semiconductor. The chips are supported in both compatibility
+ * and extended mode. They are mostly compatible with LM90 except for a data
+ * format difference for the temperature value registers.
  *
  * Since the LM90 was the first chipset supported by this driver, most
  * comments will refer to this chipset, but are actually general and
@@ -88,9 +88,10 @@
  * Addresses to scan
  * Address is fully defined internally and cannot be changed except for
  * MAX6659, MAX6680 and MAX6681.
- * LM86, LM89, LM90, LM99, ADM1032, ADM1032-1, ADT7461, MAX6649, MAX6657,
- * MAX6658 and W83L771 have address 0x4c.
- * ADM1032-2, ADT7461-2, LM89-1, LM99-1 and MAX6646 have address 0x4d.
+ * LM86, LM89, LM90, LM99, ADM1032, ADM1032-1, ADT7461, ADT7461A, MAX6649,
+ * MAX6657, MAX6658, NCT1008 and W83L771 have address 0x4c.
+ * ADM1032-2, ADT7461-2, ADT7461A-2, LM89-1, LM99-1, MAX6646, and NCT1008D
+ * have address 0x4d.
  * MAX6647 has address 0x4e.
  * MAX6659 can have address 0x4c, 0x4d or 0x4e.
  * MAX6680 and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b,
@@ -174,6 +175,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
 static const struct i2c_device_id lm90_id[] = {
         { "adm1032", adm1032 },
         { "adt7461", adt7461 },
+        { "adt7461a", adt7461 },
         { "lm90", lm90 },
         { "lm86", lm86 },
         { "lm89", lm86 },
@@ -188,6 +190,7 @@ static const struct i2c_device_id lm90_id[] = {
         { "max6681", max6680 },
         { "max6695", max6696 },
         { "max6696", max6696 },
+        { "nct1008", adt7461 },
         { "w83l771", w83l771 },
         { }
 };
@@ -1153,6 +1156,11 @@ static int lm90_detect(struct i2c_client *new_client,
                  && (reg_config1 & 0x1B) == 0x00
                  && reg_convrate <= 0x0A) {
                         name = "adt7461";
+                } else
+                if (chip_id == 0x57 /* ADT7461A, NCT1008 */
+                 && (reg_config1 & 0x1B) == 0x00
+                 && reg_convrate <= 0x0A) {
+                        name = "adt7461a";
                 }
         } else
         if (man_id == 0x4D) { /* Maxim */
diff --git a/drivers/hwmon/twl4030-madc-hwmon.c b/drivers/hwmon/twl4030-madc-hwmon.c
index de5819199e2e..57240740b161 100644
--- a/drivers/hwmon/twl4030-madc-hwmon.c
+++ b/drivers/hwmon/twl4030-madc-hwmon.c
@@ -98,7 +98,6 @@ static const struct attribute_group twl4030_madc_group = {
 static int __devinit twl4030_madc_hwmon_probe(struct platform_device *pdev)
 {
         int ret;
-        int status;
         struct device *hwmon;
 
         ret = sysfs_create_group(&pdev->dev.kobj, &twl4030_madc_group);
@@ -107,7 +106,7 @@ static int __devinit twl4030_madc_hwmon_probe(struct platform_device *pdev)
         hwmon = hwmon_device_register(&pdev->dev);
         if (IS_ERR(hwmon)) {
                 dev_err(&pdev->dev, "hwmon_device_register failed.\n");
-                status = PTR_ERR(hwmon);
+                ret = PTR_ERR(hwmon);
                 goto err_reg;
         }
 
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 72c0415f6f94..455e909bc768 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -134,10 +134,15 @@
                                  SMBHSTSTS_BUS_ERR | SMBHSTSTS_DEV_ERR | \
                                  SMBHSTSTS_INTR)
 
+/* Older devices have their ID defined in <linux/pci_ids.h> */
+#define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS   0x1c22
+#define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS      0x1d22
 /* Patsburg also has three 'Integrated Device Function' SMBus controllers */
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF0 0x1d70
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF1 0x1d71
 #define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF2 0x1d72
+#define PCI_DEVICE_ID_INTEL_DH89XXCC_SMBUS      0x2330
+#define PCI_DEVICE_ID_INTEL_5_3400_SERIES_SMBUS 0x3b30
 
 struct i801_priv {
         struct i2c_adapter adapter;
diff --git a/drivers/i2c/busses/i2c-parport.c b/drivers/i2c/busses/i2c-parport.c
index 0eb1515541e7..2dbba163b102 100644
--- a/drivers/i2c/busses/i2c-parport.c
+++ b/drivers/i2c/busses/i2c-parport.c
@@ -1,7 +1,7 @@
 /* ------------------------------------------------------------------------ *
  * i2c-parport.c I2C bus over parallel port                                 *
  * ------------------------------------------------------------------------ *
-   Copyright (C) 2003-2010 Jean Delvare <khali@linux-fr.org>
+   Copyright (C) 2003-2011 Jean Delvare <khali@linux-fr.org>
    
    Based on older i2c-philips-par.c driver
    Copyright (C) 1995-2000 Simon G. Vogl
@@ -33,6 +33,8 @@
 #include <linux/i2c-algo-bit.h>
 #include <linux/i2c-smbus.h>
 #include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
 #include "i2c-parport.h"
 
 /* ----- Device list ------------------------------------------------------ */
@@ -43,10 +45,11 @@ struct i2c_par {
         struct i2c_algo_bit_data algo_data;
         struct i2c_smbus_alert_setup alert_data;
         struct i2c_client *ara;
-        struct i2c_par *next;
+        struct list_head node;
 };
 
-static struct i2c_par *adapter_list;
+static LIST_HEAD(adapter_list);
+static DEFINE_MUTEX(adapter_list_lock);
 
 /* ----- Low-level parallel port access ----------------------------------- */
 
@@ -228,8 +231,9 @@ static void i2c_parport_attach (struct parport *port)
         }
 
         /* Add the new adapter to the list */
-        adapter->next = adapter_list;
-        adapter_list = adapter;
+        mutex_lock(&adapter_list_lock);
+        list_add_tail(&adapter->node, &adapter_list);
+        mutex_unlock(&adapter_list_lock);
         return;
 
 ERROR1:
@@ -241,11 +245,11 @@ ERROR0:
 
 static void i2c_parport_detach (struct parport *port)
 {
-        struct i2c_par *adapter, *prev;
+        struct i2c_par *adapter, *_n;
 
         /* Walk the list */
-        for (prev = NULL, adapter = adapter_list; adapter;
-             prev = adapter, adapter = adapter->next) {
+        mutex_lock(&adapter_list_lock);
+        list_for_each_entry_safe(adapter, _n, &adapter_list, node) {
                 if (adapter->pdev->port == port) {
                         if (adapter->ara) {
                                 parport_disable_irq(port);
@@ -259,14 +263,11 @@ static void i2c_parport_detach (struct parport *port)
                                 
                         parport_release(adapter->pdev);
                         parport_unregister_device(adapter->pdev);
-                        if (prev)
-                                prev->next = adapter->next;
-                        else
-                                adapter_list = adapter->next;
+                        list_del(&adapter->node);
                         kfree(adapter);
-                        return;
                 }
         }
+        mutex_unlock(&adapter_list_lock);
 }
 
 static struct parport_driver i2c_parport_driver = {
diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
index 7de4b7ebffc5..d8ca0a0b970d 100644
--- a/drivers/infiniband/hw/qib/qib_iba6120.c
+++ b/drivers/infiniband/hw/qib/qib_iba6120.c
@@ -1799,7 +1799,7 @@ static int qib_6120_setup_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT);
         dd->int_counter = 0; /* so we check interrupts work again */
diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
index 74fe0360bec7..c765a2eb04cf 100644
--- a/drivers/infiniband/hw/qib/qib_iba7220.c
+++ b/drivers/infiniband/hw/qib/qib_iba7220.c
@@ -2111,7 +2111,7 @@ static int qib_setup_7220_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT);
         dd->int_counter = 0; /* so we check interrupts work again */
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 55de3cf3441c..6bab3eaea70f 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -3299,7 +3299,7 @@ static int qib_do_7322_reset(struct qib_devdata *dd)
         /*
          * Keep chip from being accessed until we are ready.  Use
          * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
          */
         dd->flags &= ~(QIB_INITTED | QIB_PRESENT | QIB_BADINTR);
         dd->flags |= QIB_DOING_RESET;
diff --git a/drivers/input/touchscreen/wm831x-ts.c b/drivers/input/touchscreen/wm831x-ts.c
index 6ae054f8e0aa..9175d49d2546 100644
--- a/drivers/input/touchscreen/wm831x-ts.c
+++ b/drivers/input/touchscreen/wm831x-ts.c
@@ -68,8 +68,23 @@ struct wm831x_ts {
         unsigned int pd_irq;
         bool pressure;
         bool pen_down;
+        struct work_struct pd_data_work;
 };
 
+static void wm831x_pd_data_work(struct work_struct *work)
+{
+        struct wm831x_ts *wm831x_ts =
+                container_of(work, struct wm831x_ts, pd_data_work);
+
+        if (wm831x_ts->pen_down) {
+                enable_irq(wm831x_ts->data_irq);
+                dev_dbg(wm831x_ts->wm831x->dev, "IRQ PD->DATA done\n");
+        } else {
+                enable_irq(wm831x_ts->pd_irq);
+                dev_dbg(wm831x_ts->wm831x->dev, "IRQ DATA->PD done\n");
+        }
+}
+
 static irqreturn_t wm831x_ts_data_irq(int irq, void *irq_data)
 {
         struct wm831x_ts *wm831x_ts = irq_data;
@@ -110,6 +125,9 @@ static irqreturn_t wm831x_ts_data_irq(int irq, void *irq_data)
         }
 
         if (!wm831x_ts->pen_down) {
+                /* Switch from data to pen down */
+                dev_dbg(wm831x->dev, "IRQ DATA->PD\n");
+
                 disable_irq_nosync(wm831x_ts->data_irq);
 
                 /* Don't need data any more */
@@ -128,6 +146,10 @@ static irqreturn_t wm831x_ts_data_irq(int irq, void *irq_data)
                                          ABS_PRESSURE, 0);
 
                 input_report_key(wm831x_ts->input_dev, BTN_TOUCH, 0);
+
+                schedule_work(&wm831x_ts->pd_data_work);
+        } else {
+                input_report_key(wm831x_ts->input_dev, BTN_TOUCH, 1);
         }
 
         input_sync(wm831x_ts->input_dev);
@@ -141,6 +163,11 @@ static irqreturn_t wm831x_ts_pen_down_irq(int irq, void *irq_data)
         struct wm831x *wm831x = wm831x_ts->wm831x;
         int ena = 0;
 
+        if (wm831x_ts->pen_down)
+                return IRQ_HANDLED;
+
+        disable_irq_nosync(wm831x_ts->pd_irq);
+
         /* Start collecting data */
         if (wm831x_ts->pressure)
                 ena |= WM831X_TCH_Z_ENA;
@@ -149,14 +176,14 @@ static irqreturn_t wm831x_ts_pen_down_irq(int irq, void *irq_data)
                         WM831X_TCH_X_ENA | WM831X_TCH_Y_ENA | WM831X_TCH_Z_ENA,
                         WM831X_TCH_X_ENA | WM831X_TCH_Y_ENA | ena);
 
-        input_report_key(wm831x_ts->input_dev, BTN_TOUCH, 1);
-        input_sync(wm831x_ts->input_dev);
-
         wm831x_set_bits(wm831x, WM831X_INTERRUPT_STATUS_1,
                         WM831X_TCHPD_EINT, WM831X_TCHPD_EINT);
 
         wm831x_ts->pen_down = true;
-        enable_irq(wm831x_ts->data_irq);
+
+        /* Switch from pen down to data */
+        dev_dbg(wm831x->dev, "IRQ PD->DATA\n");
+        schedule_work(&wm831x_ts->pd_data_work);
 
         return IRQ_HANDLED;
 }
@@ -182,13 +209,28 @@ static void wm831x_ts_input_close(struct input_dev *idev)
         struct wm831x_ts *wm831x_ts = input_get_drvdata(idev);
         struct wm831x *wm831x = wm831x_ts->wm831x;
 
+        /* Shut the controller down, disabling all other functionality too */
         wm831x_set_bits(wm831x, WM831X_TOUCH_CONTROL_1,
-                        WM831X_TCH_ENA | WM831X_TCH_CVT_ENA |
-                        WM831X_TCH_X_ENA | WM831X_TCH_Y_ENA |
-                        WM831X_TCH_Z_ENA, 0);
+                        WM831X_TCH_ENA | WM831X_TCH_X_ENA |
+                        WM831X_TCH_Y_ENA | WM831X_TCH_Z_ENA, 0);
 
-        if (wm831x_ts->pen_down)
+        /* Make sure any pending IRQs are done, the above will prevent
+         * new ones firing.
+         */
+        synchronize_irq(wm831x_ts->data_irq);
+        synchronize_irq(wm831x_ts->pd_irq);
+
+        /* Make sure the IRQ completion work is quiesced */
+        flush_work_sync(&wm831x_ts->pd_data_work);
+
+        /* If we ended up with the pen down then make sure we revert back
+         * to pen detection state for the next time we start up.
+         */
+        if (wm831x_ts->pen_down) {
                 disable_irq(wm831x_ts->data_irq);
+                enable_irq(wm831x_ts->pd_irq);
+                wm831x_ts->pen_down = false;
+        }
 }
 
 static __devinit int wm831x_ts_probe(struct platform_device *pdev)
@@ -198,7 +240,7 @@ static __devinit int wm831x_ts_probe(struct platform_device *pdev)
         struct wm831x_pdata *core_pdata = dev_get_platdata(pdev->dev.parent);
         struct wm831x_touch_pdata *pdata = NULL;
         struct input_dev *input_dev;
-        int error;
+        int error, irqf;
 
         if (core_pdata)
                 pdata = core_pdata->touch;
@@ -212,6 +254,7 @@ static __devinit int wm831x_ts_probe(struct platform_device *pdev)
 
         wm831x_ts->wm831x = wm831x;
         wm831x_ts->input_dev = input_dev;
+        INIT_WORK(&wm831x_ts->pd_data_work, wm831x_pd_data_work);
 
         /*
          * If we have a direct IRQ use it, otherwise use the interrupt
@@ -270,9 +313,14 @@ static __devinit int wm831x_ts_probe(struct platform_device *pdev)
         wm831x_set_bits(wm831x, WM831X_TOUCH_CONTROL_1,
                         WM831X_TCH_RATE_MASK, 6);
 
+        if (pdata && pdata->data_irqf)
+                irqf = pdata->data_irqf;
+        else
+                irqf = IRQF_TRIGGER_HIGH;
+
         error = request_threaded_irq(wm831x_ts->data_irq,
                                      NULL, wm831x_ts_data_irq,
-                                     IRQF_ONESHOT,
+                                     irqf | IRQF_ONESHOT,
                                      "Touchscreen data", wm831x_ts);
         if (error) {
                 dev_err(&pdev->dev, "Failed to request data IRQ %d: %d\n",
@@ -281,9 +329,14 @@ static __devinit int wm831x_ts_probe(struct platform_device *pdev)
         }
         disable_irq(wm831x_ts->data_irq);
 
+        if (pdata && pdata->pd_irqf)
+                irqf = pdata->pd_irqf;
+        else
+                irqf = IRQF_TRIGGER_HIGH;
+
         error = request_threaded_irq(wm831x_ts->pd_irq,
                                      NULL, wm831x_ts_pen_down_irq,
-                                     IRQF_ONESHOT,
+                                     irqf | IRQF_ONESHOT,
                                      "Touchscreen pen down", wm831x_ts);
         if (error) {
                 dev_err(&pdev->dev, "Failed to request pen down IRQ %d: %d\n",
diff --git a/drivers/media/common/tuners/tda18271-common.c b/drivers/media/common/tuners/tda18271-common.c
index 5466d47db899..aae40e52af5b 100644
--- a/drivers/media/common/tuners/tda18271-common.c
+++ b/drivers/media/common/tuners/tda18271-common.c
@@ -533,16 +533,7 @@ int tda18271_calc_main_pll(struct dvb_frontend *fe, u32 freq)
         if (tda_fail(ret))
                 goto fail;
 
-        regs[R_MPD]   = (0x77 & pd);
-
-        switch (priv->mode) {
-        case TDA18271_ANALOG:
-                regs[R_MPD]  &= ~0x08;
-                break;
-        case TDA18271_DIGITAL:
-                regs[R_MPD]  |=  0x08;
-                break;
-        }
+        regs[R_MPD]   = (0x7f & pd);
 
         div =  ((d * (freq / 1000)) << 7) / 125;
 
diff --git a/drivers/media/common/tuners/tda18271-fe.c b/drivers/media/common/tuners/tda18271-fe.c
index 9ad4454a148d..d884f5eee73c 100644
--- a/drivers/media/common/tuners/tda18271-fe.c
+++ b/drivers/media/common/tuners/tda18271-fe.c
@@ -579,8 +579,8 @@ static int tda18271_rf_tracking_filters_init(struct dvb_frontend *fe, u32 freq)
 #define RF3 2
         u32 rf_default[3];
         u32 rf_freq[3];
-        u8 prog_cal[3];
-        u8 prog_tab[3];
+        s32 prog_cal[3];
+        s32 prog_tab[3];
 
         i = tda18271_lookup_rf_band(fe, &freq, NULL);
 
@@ -602,32 +602,33 @@ static int tda18271_rf_tracking_filters_init(struct dvb_frontend *fe, u32 freq)
                         return bcal;
 
                 tda18271_calc_rf_cal(fe, &rf_freq[rf]);
-                prog_tab[rf] = regs[R_EB14];
+                prog_tab[rf] = (s32)regs[R_EB14];
 
                 if (1 == bcal)
-                        prog_cal[rf] = tda18271_calibrate_rf(fe, rf_freq[rf]);
+                        prog_cal[rf] =
+                                (s32)tda18271_calibrate_rf(fe, rf_freq[rf]);
                 else
                         prog_cal[rf] = prog_tab[rf];
 
                 switch (rf) {
                 case RF1:
                         map[i].rf_a1 = 0;
-                        map[i].rf_b1 = (s32)(prog_cal[RF1] - prog_tab[RF1]);
+                        map[i].rf_b1 = (prog_cal[RF1] - prog_tab[RF1]);
                         map[i].rf1   = rf_freq[RF1] / 1000;
                         break;
                 case RF2:
-                        dividend = (s32)(prog_cal[RF2] - prog_tab[RF2]) -
-                                   (s32)(prog_cal[RF1] + prog_tab[RF1]);
+                        dividend = (prog_cal[RF2] - prog_tab[RF2] -
+                                    prog_cal[RF1] + prog_tab[RF1]);
                         divisor = (s32)(rf_freq[RF2] - rf_freq[RF1]) / 1000;
                         map[i].rf_a1 = (dividend / divisor);
                         map[i].rf2   = rf_freq[RF2] / 1000;
                         break;
                 case RF3:
-                        dividend = (s32)(prog_cal[RF3] - prog_tab[RF3]) -
-                                   (s32)(prog_cal[RF2] + prog_tab[RF2]);
+                        dividend = (prog_cal[RF3] - prog_tab[RF3] -
+                                    prog_cal[RF2] + prog_tab[RF2]);
                         divisor = (s32)(rf_freq[RF3] - rf_freq[RF2]) / 1000;
                         map[i].rf_a2 = (dividend / divisor);
-                        map[i].rf_b2 = (s32)(prog_cal[RF2] - prog_tab[RF2]);
+                        map[i].rf_b2 = (prog_cal[RF2] - prog_tab[RF2]);
                         map[i].rf3   = rf_freq[RF3] / 1000;
                         break;
                 default:
diff --git a/drivers/media/common/tuners/tda18271-maps.c b/drivers/media/common/tuners/tda18271-maps.c
index e7f84c705da8..3d5b6ab7e332 100644
--- a/drivers/media/common/tuners/tda18271-maps.c
+++ b/drivers/media/common/tuners/tda18271-maps.c
@@ -229,8 +229,7 @@ static struct tda18271_map tda18271c2_km[] = {
 static struct tda18271_map tda18271_rf_band[] = {
         { .rfmax =  47900, .val = 0x00 },
         { .rfmax =  61100, .val = 0x01 },
-/*      { .rfmax = 152600, .val = 0x02 }, */
-        { .rfmax = 121200, .val = 0x02 },
+        { .rfmax = 152600, .val = 0x02 },
         { .rfmax = 164700, .val = 0x03 },
         { .rfmax = 203500, .val = 0x04 },
         { .rfmax = 457800, .val = 0x05 },
@@ -448,7 +447,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 150000, .val = 0xb0 },
         { .rfmax = 151000, .val = 0xb1 },
         { .rfmax = 152000, .val = 0xb7 },
-        { .rfmax = 153000, .val = 0xbd },
+        { .rfmax = 152600, .val = 0xbd },
         { .rfmax = 154000, .val = 0x20 },
         { .rfmax = 155000, .val = 0x22 },
         { .rfmax = 156000, .val = 0x24 },
@@ -459,7 +458,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 161000, .val = 0x2d },
         { .rfmax = 163000, .val = 0x2e },
         { .rfmax = 164000, .val = 0x2f },
-        { .rfmax = 165000, .val = 0x30 },
+        { .rfmax = 164700, .val = 0x30 },
         { .rfmax = 166000, .val = 0x11 },
         { .rfmax = 167000, .val = 0x12 },
         { .rfmax = 168000, .val = 0x13 },
@@ -510,7 +509,8 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 236000, .val = 0x1b },
         { .rfmax = 237000, .val = 0x1c },
         { .rfmax = 240000, .val = 0x1d },
-        { .rfmax = 242000, .val = 0x1f },
+        { .rfmax = 242000, .val = 0x1e },
+        { .rfmax = 244000, .val = 0x1f },
         { .rfmax = 247000, .val = 0x20 },
         { .rfmax = 249000, .val = 0x21 },
         { .rfmax = 252000, .val = 0x22 },
@@ -624,7 +624,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
         { .rfmax = 453000, .val = 0x93 },
         { .rfmax = 454000, .val = 0x94 },
         { .rfmax = 456000, .val = 0x96 },
-        { .rfmax = 457000, .val = 0x98 },
+        { .rfmax = 457800, .val = 0x98 },
         { .rfmax = 461000, .val = 0x11 },
         { .rfmax = 468000, .val = 0x12 },
         { .rfmax = 472000, .val = 0x13 },
diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
index 955254090a0e..03f96d6ca894 100644
--- a/drivers/media/dvb/b2c2/flexcop-pci.c
+++ b/drivers/media/dvb/b2c2/flexcop-pci.c
@@ -38,7 +38,7 @@ MODULE_PARM_DESC(debug,
         DEBSTATUS);
 
 #define DRIVER_VERSION "0.1"
-#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
+#define DRIVER_NAME "flexcop-pci"
 #define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@desy.de>"
 
 struct flexcop_pci {
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index fe4f894183ff..c545039287ad 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -356,13 +356,15 @@ config DVB_USB_LME2510
         select DVB_TDA826X if !DVB_FE_CUSTOMISE
         select DVB_STV0288 if !DVB_FE_CUSTOMISE
         select DVB_IX2505V if !DVB_FE_CUSTOMISE
+        select DVB_STV0299 if !DVB_FE_CUSTOMISE
+        select DVB_PLL if !DVB_FE_CUSTOMISE
         help
           Say Y here to support the LME DM04/QQBOX DVB-S USB2.0 .
 
 config DVB_USB_TECHNISAT_USB2
         tristate "Technisat DVB-S/S2 USB2.0 support"
         depends on DVB_USB
-        select DVB_STB0899 if !DVB_FE_CUSTOMISE
-        select DVB_STB6100 if !DVB_FE_CUSTOMISE
+        select DVB_STV090x if !DVB_FE_CUSTOMISE
+        select DVB_STV6110x if !DVB_FE_CUSTOMISE
         help
           Say Y here to support the Technisat USB2 DVB-S/S2 device
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index 97af266d7f1d..65214af5cd74 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -2162,7 +2162,7 @@ struct dibx000_agc_config dib7090_agc_config[2] = {
                 .agc1_pt3       = 98,
                 .agc1_slope1    = 0,
                 .agc1_slope2    = 167,
-                .agc1_pt1       = 98,
+                .agc2_pt1       = 98,
                 .agc2_pt2       = 255,
                 .agc2_slope1    = 104,
                 .agc2_slope2    = 0,
@@ -2440,11 +2440,11 @@ static int tfe7090pvr_frontend0_attach(struct dvb_usb_adapter *adap)
         dib0700_set_i2c_speed(adap->dev, 340);
         adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x90, &tfe7090pvr_dib7000p_config[0]);
 
-        dib7090_slave_reset(adap->fe);
-
         if (adap->fe == NULL)
                 return -ENODEV;
 
+        dib7090_slave_reset(adap->fe);
+
         return 0;
 }
 
diff --git a/drivers/media/dvb/ngene/ngene-core.c b/drivers/media/dvb/ngene/ngene-core.c
index ccc2d1af49d4..6927c726ce35 100644
--- a/drivers/media/dvb/ngene/ngene-core.c
+++ b/drivers/media/dvb/ngene/ngene-core.c
@@ -1520,6 +1520,7 @@ static int init_channel(struct ngene_channel *chan)
         if (dev->ci.en && (io & NGENE_IO_TSOUT)) {
                 dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1);
                 set_transfer(chan, 1);
+                chan->dev->channel[2].DataFormatFlags = DF_SWAP32;
                 set_transfer(&chan->dev->channel[2], 1);
                 dvb_register_device(adapter, &chan->ci_dev,
                                     &ngene_dvbdev_ci, (void *) chan,
diff --git a/drivers/media/media-entity.c b/drivers/media/media-entity.c
index 23640ed44d85..056138f63c7d 100644
--- a/drivers/media/media-entity.c
+++ b/drivers/media/media-entity.c
@@ -378,7 +378,6 @@ EXPORT_SYMBOL_GPL(media_entity_create_link);
 
 static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
 {
-        const u32 mask = MEDIA_LNK_FL_ENABLED;
         int ret;
 
         /* Notify both entities. */
@@ -395,7 +394,7 @@ static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
                 return ret;
         }
 
-        link->flags = (link->flags & ~mask) | (flags & mask);
+        link->flags = flags;
         link->reverse->flags = link->flags;
 
         return 0;
@@ -417,6 +416,7 @@ static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
  */
 int __media_entity_setup_link(struct media_link *link, u32 flags)
 {
+        const u32 mask = MEDIA_LNK_FL_ENABLED;
         struct media_device *mdev;
         struct media_entity *source, *sink;
         int ret = -EBUSY;
@@ -424,6 +424,10 @@ int __media_entity_setup_link(struct media_link *link, u32 flags)
         if (link == NULL)
                 return -EINVAL;
 
+        /* The non-modifiable link flags must not be modified. */
+        if ((link->flags & ~mask) != (flags & ~mask))
+                return -EINVAL;
+
         if (link->flags & MEDIA_LNK_FL_IMMUTABLE)
                 return link->flags == flags ? 0 : -EINVAL;
 
diff --git a/drivers/media/radio/radio-sf16fmr2.c b/drivers/media/radio/radio-sf16fmr2.c
index dc3f04c52d5e..87bad7678d92 100644
--- a/drivers/media/radio/radio-sf16fmr2.c
+++ b/drivers/media/radio/radio-sf16fmr2.c
@@ -170,7 +170,7 @@ static int fmr2_setfreq(struct fmr2 *dev)
         return 0;
 }
 
-/* !!! not tested, in my card this does't work !!! */
+/* !!! not tested, in my card this doesn't work !!! */
 static int fmr2_setvolume(struct fmr2 *dev)
 {
         int vol[16] = { 0x021, 0x084, 0x090, 0x104,
diff --git a/drivers/media/radio/saa7706h.c b/drivers/media/radio/saa7706h.c
index 585680ffbfb6..b1193dfc5087 100644
--- a/drivers/media/radio/saa7706h.c
+++ b/drivers/media/radio/saa7706h.c
@@ -376,7 +376,7 @@ static int __devinit saa7706h_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%02x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct saa7706h_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct saa7706h_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
         sd = &state->sd;
diff --git a/drivers/media/radio/tef6862.c b/drivers/media/radio/tef6862.c
index 7c0d77751f6e..0991e1973678 100644
--- a/drivers/media/radio/tef6862.c
+++ b/drivers/media/radio/tef6862.c
@@ -176,7 +176,7 @@ static int __devinit tef6862_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%02x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct tef6862_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tef6862_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
         state->freq = TEF6862_LO_FREQ;
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index ebd68edf5b24..8fc0f081b470 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -46,7 +46,7 @@
 #define MOD_AUTHOR      "Jarod Wilson <jarod@wilsonet.com>"
 #define MOD_DESC        "Driver for SoundGraph iMON MultiMedia IR/Display"
 #define MOD_NAME        "imon"
-#define MOD_VERSION     "0.9.2"
+#define MOD_VERSION     "0.9.3"
 
 #define DISPLAY_MINOR_BASE      144
 #define DEVICE_NAME     "lcd%d"
@@ -460,8 +460,9 @@ static int display_close(struct inode *inode, struct file *file)
 }
 
 /**
- * Sends a packet to the device -- this function must be called
- * with ictx->lock held.
+ * Sends a packet to the device -- this function must be called with
+ * ictx->lock held, or its unlock/lock sequence while waiting for tx
+ * to complete can/will lead to a deadlock.
  */
 static int send_packet(struct imon_context *ictx)
 {
@@ -991,12 +992,21 @@ static void imon_touch_display_timeout(unsigned long data)
  * the iMON remotes, and those used by the Windows MCE remotes (which is
  * really just RC-6), but only one or the other at a time, as the signals
  * are decoded onboard the receiver.
+ *
+ * This function gets called two different ways, one way is from
+ * rc_register_device, for initial protocol selection/setup, and the other is
+ * via a userspace-initiated protocol change request, either by direct sysfs
+ * prodding or by something like ir-keytable. In the rc_register_device case,
+ * the imon context lock is already held, but when initiated from userspace,
+ * it is not, so we must acquire it prior to calling send_packet, which
+ * requires that the lock is held.
  */
 static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
 {
         int retval;
         struct imon_context *ictx = rc->priv;
         struct device *dev = ictx->dev;
+        bool unlock = false;
         unsigned char ir_proto_packet[] = {
                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x86 };
 
@@ -1029,6 +1039,11 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
 
         memcpy(ictx->usb_tx_buf, &ir_proto_packet, sizeof(ir_proto_packet));
 
+        if (!mutex_is_locked(&ictx->lock)) {
+                unlock = true;
+                mutex_lock(&ictx->lock);
+        }
+
         retval = send_packet(ictx);
         if (retval)
                 goto out;
@@ -1037,6 +1052,9 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
         ictx->pad_mouse = false;
 
 out:
+        if (unlock)
+                mutex_unlock(&ictx->lock);
+
         return retval;
 }
 
@@ -2134,6 +2152,7 @@ static struct imon_context *imon_init_intf0(struct usb_interface *intf)
                 goto rdev_setup_failed;
         }
 
+        mutex_unlock(&ictx->lock);
         return ictx;
 
 rdev_setup_failed:
@@ -2205,6 +2224,7 @@ static struct imon_context *imon_init_intf1(struct usb_interface *intf,
                 goto urb_submit_failed;
         }
 
+        mutex_unlock(&ictx->lock);
         return ictx;
 
 urb_submit_failed:
@@ -2299,6 +2319,8 @@ static int __devinit imon_probe(struct usb_interface *interface,
         usb_set_intfdata(interface, ictx);
 
         if (ifnum == 0) {
+                mutex_lock(&ictx->lock);
+
                 if (product == 0xffdc && ictx->rf_device) {
                         sysfs_err = sysfs_create_group(&interface->dev.kobj,
                                                        &imon_rf_attr_group);
@@ -2309,13 +2331,14 @@ static int __devinit imon_probe(struct usb_interface *interface,
 
                 if (ictx->display_supported)
                         imon_init_display(ictx, interface);
+
+                mutex_unlock(&ictx->lock);
         }
 
         dev_info(dev, "iMON device (%04x:%04x, intf%d) on "
                  "usb<%d:%d> initialized\n", vendor, product, ifnum,
                  usbdev->bus->busnum, usbdev->devnum);
 
-        mutex_unlock(&ictx->lock);
         mutex_unlock(&driver_lock);
 
         return 0;
diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
index accaf6c9789a..43908a70bd8b 100644
--- a/drivers/media/rc/ite-cir.c
+++ b/drivers/media/rc/ite-cir.c
@@ -36,6 +36,7 @@
 #include <linux/io.h>
 #include <linux/interrupt.h>
 #include <linux/sched.h>
+#include <linux/delay.h>
 #include <linux/slab.h>
 #include <linux/input.h>
 #include <linux/bitops.h>
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index 044fb7a382d6..0c273ec465c9 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -220,6 +220,8 @@ static struct usb_device_id mceusb_dev_table[] = {
         { USB_DEVICE(VENDOR_PHILIPS, 0x206c) },
         /* Philips/Spinel plus IR transceiver for ASUS */
         { USB_DEVICE(VENDOR_PHILIPS, 0x2088) },
+        /* Philips IR transceiver (Dell branded) */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x2093) },
         /* Realtek MCE IR Receiver and card reader */
         { USB_DEVICE(VENDOR_REALTEK, 0x0161),
           .driver_info = MULTIFUNCTION },
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index f53f9c68d38d..a2706648e365 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -707,7 +707,8 @@ static void ir_close(struct input_dev *idev)
 {
         struct rc_dev *rdev = input_get_drvdata(idev);
 
-        rdev->close(rdev);
+         if (rdev)
+                rdev->close(rdev);
 }
 
 /* class for /sys/class/rc */
@@ -733,6 +734,7 @@ static struct {
         { RC_TYPE_SONY,         "sony"          },
         { RC_TYPE_RC5_SZ,       "rc-5-sz"       },
         { RC_TYPE_LIRC,         "lirc"          },
+        { RC_TYPE_OTHER,        "other"         },
 };
 
 #define PROTO_NONE      "none"
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index 4498b944dec8..00f51dd121f3 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -875,7 +875,7 @@ config MX3_VIDEO
 config VIDEO_MX3
         tristate "i.MX3x Camera Sensor Interface driver"
         depends on VIDEO_DEV && MX3_IPU && SOC_CAMERA
-        select VIDEOBUF_DMA_CONTIG
+        select VIDEOBUF2_DMA_CONTIG
         select MX3_VIDEO
         ---help---
           This is a v4l2 driver for the i.MX3x Camera Sensor Interface
diff --git a/drivers/media/video/cx18/cx18-streams.c b/drivers/media/video/cx18/cx18-streams.c
index c6e2ca3b1149..6fbc356113c1 100644
--- a/drivers/media/video/cx18/cx18-streams.c
+++ b/drivers/media/video/cx18/cx18-streams.c
@@ -350,9 +350,17 @@ void cx18_streams_cleanup(struct cx18 *cx, int unregister)
 
                 /* No struct video_device, but can have buffers allocated */
                 if (type == CX18_ENC_STREAM_TYPE_IDX) {
+                        /* If the module params didn't inhibit IDX ... */
                         if (cx->stream_buffers[type] != 0) {
                                 cx->stream_buffers[type] = 0;
-                                cx18_stream_free(&cx->streams[type]);
+                                /*
+                                 * Before calling cx18_stream_free(),
+                                 * check if the IDX stream was actually set up.
+                                 * Needed, since the cx18_probe() error path
+                                 * exits through here as well as normal clean up
+                                 */
+                                if (cx->streams[type].buffers != 0)
+                                        cx18_stream_free(&cx->streams[type]);
                         }
                         continue;
                 }
diff --git a/drivers/media/video/cx23885/Kconfig b/drivers/media/video/cx23885/Kconfig
index 3b6e7f28568e..caab1bfb79e2 100644
--- a/drivers/media/video/cx23885/Kconfig
+++ b/drivers/media/video/cx23885/Kconfig
@@ -22,6 +22,7 @@ config VIDEO_CX23885
         select DVB_CX24116 if !DVB_FE_CUSTOMISE
         select DVB_STV0900 if !DVB_FE_CUSTOMISE
         select DVB_DS3000 if !DVB_FE_CUSTOMISE
+        select DVB_STV0367 if !DVB_FE_CUSTOMISE
         select MEDIA_TUNER_MT2131 if !MEDIA_TUNER_CUSTOMISE
         select MEDIA_TUNER_XC2028 if !MEDIA_TUNER_CUSTOMISE
         select MEDIA_TUNER_TDA8290 if !MEDIA_TUNER_CUSTOMISE
diff --git a/drivers/media/video/imx074.c b/drivers/media/video/imx074.c
index 1a1169115716..0382ea752e6f 100644
--- a/drivers/media/video/imx074.c
+++ b/drivers/media/video/imx074.c
@@ -298,7 +298,7 @@ static unsigned long imx074_query_bus_param(struct soc_camera_device *icd)
 static int imx074_set_bus_param(struct soc_camera_device *icd,
                                  unsigned long flags)
 {
-        return -1;
+        return -EINVAL;
 }
 
 static struct soc_camera_ops imx074_ops = {
diff --git a/drivers/media/video/m52790.c b/drivers/media/video/m52790.c
index 5e1c9a81984c..303ffa7df4ac 100644
--- a/drivers/media/video/m52790.c
+++ b/drivers/media/video/m52790.c
@@ -174,7 +174,7 @@ static int m52790_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct m52790_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct m52790_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/media/video/omap3isp/isp.c b/drivers/media/video/omap3isp/isp.c
index 503bd7922bd6..472a69359e60 100644
--- a/drivers/media/video/omap3isp/isp.c
+++ b/drivers/media/video/omap3isp/isp.c
@@ -215,20 +215,21 @@ static u32 isp_set_xclk(struct isp_device *isp, u32 xclk, u8 xclksel)
         }
 
         switch (xclksel) {
-        case 0:
+        case ISP_XCLK_A:
                 isp_reg_clr_set(isp, OMAP3_ISP_IOMEM_MAIN, ISP_TCTRL_CTRL,
                                 ISPTCTRL_CTRL_DIVA_MASK,
                                 divisor << ISPTCTRL_CTRL_DIVA_SHIFT);
                 dev_dbg(isp->dev, "isp_set_xclk(): cam_xclka set to %d Hz\n",
                         currentxclk);
                 break;
-        case 1:
+        case ISP_XCLK_B:
                 isp_reg_clr_set(isp, OMAP3_ISP_IOMEM_MAIN, ISP_TCTRL_CTRL,
                                 ISPTCTRL_CTRL_DIVB_MASK,
                                 divisor << ISPTCTRL_CTRL_DIVB_SHIFT);
                 dev_dbg(isp->dev, "isp_set_xclk(): cam_xclkb set to %d Hz\n",
                         currentxclk);
                 break;
+        case ISP_XCLK_NONE:
         default:
                 omap3isp_put(isp);
                 dev_dbg(isp->dev, "ISP_ERR: isp_set_xclk(): Invalid requested "
@@ -237,13 +238,13 @@ static u32 isp_set_xclk(struct isp_device *isp, u32 xclk, u8 xclksel)
         }
 
         /* Do we go from stable whatever to clock? */
-        if (divisor >= 2 && isp->xclk_divisor[xclksel] < 2)
+        if (divisor >= 2 && isp->xclk_divisor[xclksel - 1] < 2)
                 omap3isp_get(isp);
         /* Stopping the clock. */
-        else if (divisor < 2 && isp->xclk_divisor[xclksel] >= 2)
+        else if (divisor < 2 && isp->xclk_divisor[xclksel - 1] >= 2)
                 omap3isp_put(isp);
 
-        isp->xclk_divisor[xclksel] = divisor;
+        isp->xclk_divisor[xclksel - 1] = divisor;
 
         omap3isp_put(isp);
 
@@ -285,7 +286,8 @@ static void isp_power_settings(struct isp_device *isp, int idle)
  */
 void omap3isp_configure_bridge(struct isp_device *isp,
                                enum ccdc_input_entity input,
-                               const struct isp_parallel_platform_data *pdata)
+                               const struct isp_parallel_platform_data *pdata,
+                               unsigned int shift)
 {
         u32 ispctrl_val;
 
@@ -298,9 +300,9 @@ void omap3isp_configure_bridge(struct isp_device *isp,
         switch (input) {
         case CCDC_INPUT_PARALLEL:
                 ispctrl_val |= ISPCTRL_PAR_SER_CLK_SEL_PARALLEL;
-                ispctrl_val |= pdata->data_lane_shift << ISPCTRL_SHIFT_SHIFT;
                 ispctrl_val |= pdata->clk_pol << ISPCTRL_PAR_CLK_POL_SHIFT;
                 ispctrl_val |= pdata->bridge << ISPCTRL_PAR_BRIDGE_SHIFT;
+                shift += pdata->data_lane_shift * 2;
                 break;
 
         case CCDC_INPUT_CSI2A:
@@ -319,6 +321,8 @@ void omap3isp_configure_bridge(struct isp_device *isp,
                 return;
         }
 
+        ispctrl_val |= ((shift/2) << ISPCTRL_SHIFT_SHIFT) & ISPCTRL_SHIFT_MASK;
+
         ispctrl_val &= ~ISPCTRL_SYNC_DETECT_MASK;
         ispctrl_val |= ISPCTRL_SYNC_DETECT_VSRISE;
 
@@ -658,6 +662,8 @@ int omap3isp_pipeline_pm_use(struct media_entity *entity, int use)
 
         /* Apply power change to connected non-nodes. */
         ret = isp_pipeline_pm_power(entity, change);
+        if (ret < 0)
+                entity->use_count -= change;
 
         mutex_unlock(&entity->parent->graph_mutex);
 
@@ -872,6 +878,9 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe)
                 }
         }
 
+        if (failure < 0)
+                isp->needs_reset = true;
+
         return failure;
 }
 
@@ -884,7 +893,8 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe)
  * single-shot or continuous mode.
  *
  * Return 0 if successful, or the return value of the failed video::s_stream
- * operation otherwise.
+ * operation otherwise. The pipeline state is not updated when the operation
+ * fails, except when stopping the pipeline.
  */
 int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                                  enum isp_pipeline_stream_state state)
@@ -895,7 +905,9 @@ int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                 ret = isp_pipeline_disable(pipe);
         else
                 ret = isp_pipeline_enable(pipe, state);
-        pipe->stream_state = state;
+
+        if (ret == 0 || state == ISP_PIPELINE_STREAM_STOPPED)
+                pipe->stream_state = state;
 
         return ret;
 }
@@ -1481,6 +1493,10 @@ void omap3isp_put(struct isp_device *isp)
         if (--isp->ref_count == 0) {
                 isp_disable_interrupts(isp);
                 isp_save_ctx(isp);
+                if (isp->needs_reset) {
+                        isp_reset(isp);
+                        isp->needs_reset = false;
+                }
                 isp_disable_clocks(isp);
         }
         mutex_unlock(&isp->isp_mutex);
diff --git a/drivers/media/video/omap3isp/isp.h b/drivers/media/video/omap3isp/isp.h
index cf5214e95a92..2620c405f5e4 100644
--- a/drivers/media/video/omap3isp/isp.h
+++ b/drivers/media/video/omap3isp/isp.h
@@ -132,7 +132,6 @@ struct isp_reg {
 
 /**
  * struct isp_parallel_platform_data - Parallel interface platform data
- * @width: Parallel bus width in bits (8, 10, 11 or 12)
  * @data_lane_shift: Data lane shifter
  *              0 - CAMEXT[13:0] -> CAM[13:0]
  *              1 - CAMEXT[13:2] -> CAM[11:0]
@@ -146,7 +145,6 @@ struct isp_reg {
  *              ISPCTRL_PAR_BRIDGE_BENDIAN - Big endian
  */
 struct isp_parallel_platform_data {
-        unsigned int width;
         unsigned int data_lane_shift:2;
         unsigned int clk_pol:1;
         unsigned int bridge:4;
@@ -262,6 +260,7 @@ struct isp_device {
         /* ISP Obj */
         spinlock_t stat_lock;   /* common lock for statistic drivers */
         struct mutex isp_mutex; /* For handling ref_count field */
+        bool needs_reset;
         int has_context;
         int ref_count;
         unsigned int autoidle;
@@ -311,11 +310,12 @@ int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                                  enum isp_pipeline_stream_state state);
 void omap3isp_configure_bridge(struct isp_device *isp,
                                enum ccdc_input_entity input,
-                               const struct isp_parallel_platform_data *pdata);
+                               const struct isp_parallel_platform_data *pdata,
+                               unsigned int shift);
 
-#define ISP_XCLK_NONE                   -1
-#define ISP_XCLK_A                      0
-#define ISP_XCLK_B                      1
+#define ISP_XCLK_NONE                   0
+#define ISP_XCLK_A                      1
+#define ISP_XCLK_B                      2
 
 struct isp_device *omap3isp_get(struct isp_device *isp);
 void omap3isp_put(struct isp_device *isp);
diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index 5ff9d14ce710..39d501bda636 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -43,6 +43,12 @@ __ccdc_get_format(struct isp_ccdc_device *ccdc, struct v4l2_subdev_fh *fh,
 
 static const unsigned int ccdc_fmts[] = {
         V4L2_MBUS_FMT_Y8_1X8,
+        V4L2_MBUS_FMT_Y10_1X10,
+        V4L2_MBUS_FMT_Y12_1X12,
+        V4L2_MBUS_FMT_SGRBG8_1X8,
+        V4L2_MBUS_FMT_SRGGB8_1X8,
+        V4L2_MBUS_FMT_SBGGR8_1X8,
+        V4L2_MBUS_FMT_SGBRG8_1X8,
         V4L2_MBUS_FMT_SGRBG10_1X10,
         V4L2_MBUS_FMT_SRGGB10_1X10,
         V4L2_MBUS_FMT_SBGGR10_1X10,
@@ -1110,21 +1116,38 @@ static void ccdc_configure(struct isp_ccdc_device *ccdc)
         struct isp_parallel_platform_data *pdata = NULL;
         struct v4l2_subdev *sensor;
         struct v4l2_mbus_framefmt *format;
+        const struct isp_format_info *fmt_info;
+        struct v4l2_subdev_format fmt_src;
+        unsigned int depth_out;
+        unsigned int depth_in = 0;
         struct media_pad *pad;
         unsigned long flags;
+        unsigned int shift;
         u32 syn_mode;
         u32 ccdc_pattern;
 
-        if (ccdc->input == CCDC_INPUT_PARALLEL) {
-                pad = media_entity_remote_source(&ccdc->pads[CCDC_PAD_SINK]);
-                sensor = media_entity_to_v4l2_subdev(pad->entity);
+        pad = media_entity_remote_source(&ccdc->pads[CCDC_PAD_SINK]);
+        sensor = media_entity_to_v4l2_subdev(pad->entity);
+        if (ccdc->input == CCDC_INPUT_PARALLEL)
                 pdata = &((struct isp_v4l2_subdevs_group *)sensor->host_priv)
                         ->bus.parallel;
+
+        /* Compute shift value for lane shifter to configure the bridge. */
+        fmt_src.pad = pad->index;
+        fmt_src.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+        if (!v4l2_subdev_call(sensor, pad, get_fmt, NULL, &fmt_src)) {
+                fmt_info = omap3isp_video_format_info(fmt_src.format.code);
+                depth_in = fmt_info->bpp;
         }
 
-        omap3isp_configure_bridge(isp, ccdc->input, pdata);
+        fmt_info = omap3isp_video_format_info
+                (isp->isp_ccdc.formats[CCDC_PAD_SINK].code);
+        depth_out = fmt_info->bpp;
+
+        shift = depth_in - depth_out;
+        omap3isp_configure_bridge(isp, ccdc->input, pdata, shift);
 
-        ccdc->syncif.datsz = pdata ? pdata->width : 10;
+        ccdc->syncif.datsz = depth_out;
         ccdc_config_sync_if(ccdc, &ccdc->syncif);
 
         /* CCDC_PAD_SINK */
@@ -1338,7 +1361,7 @@ static int ccdc_sbl_wait_idle(struct isp_ccdc_device *ccdc,
  * @ccdc: Pointer to ISP CCDC device.
  * @event: Pointing which event trigger handler
  *
- * Return 1 when the event and stopping request combination is satisfyied,
+ * Return 1 when the event and stopping request combination is satisfied,
  * zero otherwise.
  */
 static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event)
@@ -1618,7 +1641,7 @@ static int ccdc_video_queue(struct isp_video *video, struct isp_buffer *buffer)
 
         ccdc_set_outaddr(ccdc, buffer->isp_addr);
 
-        /* We now have a buffer queued on the output, restart the pipeline in
+        /* We now have a buffer queued on the output, restart the pipeline
          * on the next CCDC interrupt if running in continuous mode (or when
          * starting the stream).
          */
diff --git a/drivers/media/video/omap3isp/isppreview.c b/drivers/media/video/omap3isp/isppreview.c
index 2b16988a501d..aba537af87e4 100644
--- a/drivers/media/video/omap3isp/isppreview.c
+++ b/drivers/media/video/omap3isp/isppreview.c
@@ -755,7 +755,7 @@ static struct preview_update update_attrs[] = {
  * @configs - pointer to update config structure.
  * @config - return pointer to appropriate structure field.
  * @bit - for which feature to return pointers.
- * Return size of coresponding prev_params member
+ * Return size of corresponding prev_params member
  */
 static u32
 __preview_get_ptrs(struct prev_params *params, void **param,
diff --git a/drivers/media/video/omap3isp/ispqueue.c b/drivers/media/video/omap3isp/ispqueue.c
index 8fddc5806b0d..9c317148205f 100644
--- a/drivers/media/video/omap3isp/ispqueue.c
+++ b/drivers/media/video/omap3isp/ispqueue.c
@@ -339,7 +339,7 @@ static int isp_video_buffer_prepare_user(struct isp_video_buffer *buf)
         up_read(&current->mm->mmap_sem);
 
         if (ret != buf->npages) {
-                buf->npages = ret;
+                buf->npages = ret < 0 ? 0 : ret;
                 isp_video_buffer_cleanup(buf);
                 return -EFAULT;
         }
@@ -408,8 +408,8 @@ done:
  * isp_video_buffer_prepare_vm_flags - Get VMA flags for a userspace address
  *
  * This function locates the VMAs for the buffer's userspace address and checks
- * that their flags match. The onlflag that we need to care for at the moment is
- * VM_PFNMAP.
+ * that their flags match. The only flag that we need to care for at the moment
+ * is VM_PFNMAP.
  *
  * The buffer vm_flags field is set to the first VMA flags.
  *
diff --git a/drivers/media/video/omap3isp/ispresizer.c b/drivers/media/video/omap3isp/ispresizer.c
index 653f88ba56db..0bb0f8cd36f5 100644
--- a/drivers/media/video/omap3isp/ispresizer.c
+++ b/drivers/media/video/omap3isp/ispresizer.c
@@ -714,19 +714,50 @@ static void resizer_print_status(struct isp_res_device *res)
  * iw and ih are the input width and height after cropping. Those equations need
  * to be satisfied exactly for the resizer to work correctly.
  *
- * Reverting the equations, we can compute the resizing ratios with
+ * The equations can't be easily reverted, as the >> 8 operation is not linear.
+ * In addition, not all input sizes can be achieved for a given output size. To
+ * get the highest input size lower than or equal to the requested input size,
+ * we need to compute the highest resizing ratio that satisfies the following
+ * inequality (taking the 4-tap mode width equation as an example)
+ *
+ *      iw >= (32 * sph + (ow - 1) * hrsz + 16) >> 8 - 7
+ *
+ * (where iw is the requested input width) which can be rewritten as
+ *
+ *        iw - 7            >= (32 * sph + (ow - 1) * hrsz + 16) >> 8
+ *       (iw - 7) << 8      >=  32 * sph + (ow - 1) * hrsz + 16 - b
+ *      ((iw - 7) << 8) + b >=  32 * sph + (ow - 1) * hrsz + 16
+ *
+ * where b is the value of the 8 least significant bits of the right hand side
+ * expression of the last inequality. The highest resizing ratio value will be
+ * achieved when b is equal to its maximum value of 255. That resizing ratio
+ * value will still satisfy the original inequality, as b will disappear when
+ * the expression will be shifted right by 8.
+ *
+ * The reverted the equations thus become
  *
  * - 8-phase, 4-tap mode
- *      hrsz = ((iw - 7) * 256 - 16 - 32 * sph) / (ow - 1)
- *      vrsz = ((ih - 4) * 256 - 16 - 32 * spv) / (oh - 1)
+ *      hrsz = ((iw - 7) * 256 + 255 - 16 - 32 * sph) / (ow - 1)
+ *      vrsz = ((ih - 4) * 256 + 255 - 16 - 32 * spv) / (oh - 1)
  * - 4-phase, 7-tap mode
- *      hrsz = ((iw - 7) * 256 - 32 - 64 * sph) / (ow - 1)
- *      vrsz = ((ih - 7) * 256 - 32 - 64 * spv) / (oh - 1)
+ *      hrsz = ((iw - 7) * 256 + 255 - 32 - 64 * sph) / (ow - 1)
+ *      vrsz = ((ih - 7) * 256 + 255 - 32 - 64 * spv) / (oh - 1)
  *
- * The ratios are integer values, and must be rounded down to ensure that the
- * cropped input size is not bigger than the uncropped input size. As the ratio
- * in 7-tap mode is always smaller than the ratio in 4-tap mode, we can use the
- * 7-tap mode equations to compute a ratio approximation.
+ * The ratios are integer values, and are rounded down to ensure that the
+ * cropped input size is not bigger than the uncropped input size.
+ *
+ * As the number of phases/taps, used to select the correct equations to compute
+ * the ratio, depends on the ratio, we start with the 4-tap mode equations to
+ * compute an approximation of the ratio, and switch to the 7-tap mode equations
+ * if the approximation is higher than the ratio threshold.
+ *
+ * As the 7-tap mode equations will return a ratio smaller than or equal to the
+ * 4-tap mode equations, the resulting ratio could become lower than or equal to
+ * the ratio threshold. This 'equations loop' isn't an issue as long as the
+ * correct equations are used to compute the final input size. Starting with the
+ * 4-tap mode equations ensure that, in case of values resulting in a 'ratio
+ * loop', the smallest of the ratio values will be used, never exceeding the
+ * requested input size.
  *
  * We first clamp the output size according to the hardware capabilitie to avoid
  * auto-cropping the input more than required to satisfy the TRM equations. The
@@ -775,6 +806,8 @@ static void resizer_calc_ratios(struct isp_res_device *res,
         unsigned int max_width;
         unsigned int max_height;
         unsigned int width_alignment;
+        unsigned int width;
+        unsigned int height;
 
         /*
          * Clamp the output height based on the hardware capabilities and
@@ -786,19 +819,22 @@ static void resizer_calc_ratios(struct isp_res_device *res,
         max_height = min_t(unsigned int, max_height, MAX_OUT_HEIGHT);
         output->height = clamp(output->height, min_height, max_height);
 
-        ratio->vert = ((input->height - 7) * 256 - 32 - 64 * spv)
+        ratio->vert = ((input->height - 4) * 256 + 255 - 16 - 32 * spv)
                     / (output->height - 1);
+        if (ratio->vert > MID_RESIZE_VALUE)
+                ratio->vert = ((input->height - 7) * 256 + 255 - 32 - 64 * spv)
+                            / (output->height - 1);
         ratio->vert = clamp_t(unsigned int, ratio->vert,
                               MIN_RESIZE_VALUE, MAX_RESIZE_VALUE);
 
         if (ratio->vert <= MID_RESIZE_VALUE) {
                 upscaled_height = (output->height - 1) * ratio->vert
                                 + 32 * spv + 16;
-                input->height = (upscaled_height >> 8) + 4;
+                height = (upscaled_height >> 8) + 4;
         } else {
                 upscaled_height = (output->height - 1) * ratio->vert
                                 + 64 * spv + 32;
-                input->height = (upscaled_height >> 8) + 7;
+                height = (upscaled_height >> 8) + 7;
         }
 
         /*
@@ -854,20 +890,29 @@ static void resizer_calc_ratios(struct isp_res_device *res,
                               max_width & ~(width_alignment - 1));
         output->width = ALIGN(output->width, width_alignment);
 
-        ratio->horz = ((input->width - 7) * 256 - 32 - 64 * sph)
+        ratio->horz = ((input->width - 7) * 256 + 255 - 16 - 32 * sph)
                     / (output->width - 1);
+        if (ratio->horz > MID_RESIZE_VALUE)
+                ratio->horz = ((input->width - 7) * 256 + 255 - 32 - 64 * sph)
+                            / (output->width - 1);
         ratio->horz = clamp_t(unsigned int, ratio->horz,
                               MIN_RESIZE_VALUE, MAX_RESIZE_VALUE);
 
         if (ratio->horz <= MID_RESIZE_VALUE) {
                 upscaled_width = (output->width - 1) * ratio->horz
                                + 32 * sph + 16;
-                input->width = (upscaled_width >> 8) + 7;
+                width = (upscaled_width >> 8) + 7;
         } else {
                 upscaled_width = (output->width - 1) * ratio->horz
                                + 64 * sph + 32;
-                input->width = (upscaled_width >> 8) + 7;
+                width = (upscaled_width >> 8) + 7;
         }
+
+        /* Center the new crop rectangle. */
+        input->left += (input->width - width) / 2;
+        input->top += (input->height - height) / 2;
+        input->width = width;
+        input->height = height;
 }
 
 /*
diff --git a/drivers/media/video/omap3isp/ispstat.h b/drivers/media/video/omap3isp/ispstat.h
index 820950c9ef46..d86da94fa50d 100644
--- a/drivers/media/video/omap3isp/ispstat.h
+++ b/drivers/media/video/omap3isp/ispstat.h
@@ -131,9 +131,9 @@ struct ispstat {
 struct ispstat_generic_config {
         /*
          * Fields must be in the same order as in:
-         *  - isph3a_aewb_config
-         *  - isph3a_af_config
-         *  - isphist_config
+         *  - omap3isp_h3a_aewb_config
+         *  - omap3isp_h3a_af_config
+         *  - omap3isp_hist_config
          */
         u32 buf_size;
         u16 config_counter;
diff --git a/drivers/media/video/omap3isp/ispvideo.c b/drivers/media/video/omap3isp/ispvideo.c
index 208a7ec739d7..9cd8f1aa567b 100644
--- a/drivers/media/video/omap3isp/ispvideo.c
+++ b/drivers/media/video/omap3isp/ispvideo.c
@@ -47,29 +47,59 @@
 
 static struct isp_format_info formats[] = {
         { V4L2_MBUS_FMT_Y8_1X8, V4L2_MBUS_FMT_Y8_1X8,
-          V4L2_MBUS_FMT_Y8_1X8, V4L2_PIX_FMT_GREY, 8, },
+          V4L2_MBUS_FMT_Y8_1X8, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_GREY, 8, },
+        { V4L2_MBUS_FMT_Y10_1X10, V4L2_MBUS_FMT_Y10_1X10,
+          V4L2_MBUS_FMT_Y10_1X10, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_Y10, 10, },
+        { V4L2_MBUS_FMT_Y12_1X12, V4L2_MBUS_FMT_Y10_1X10,
+          V4L2_MBUS_FMT_Y12_1X12, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_Y12, 12, },
+        { V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR8, 8, },
+        { V4L2_MBUS_FMT_SGBRG8_1X8, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_MBUS_FMT_SGBRG8_1X8, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG8, 8, },
+        { V4L2_MBUS_FMT_SGRBG8_1X8, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_MBUS_FMT_SGRBG8_1X8, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG8, 8, },
+        { V4L2_MBUS_FMT_SRGGB8_1X8, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_MBUS_FMT_SRGGB8_1X8, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB8, 8, },
         { V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8, V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8,
-          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10DPCM8, 8, },
+          V4L2_MBUS_FMT_SGRBG10_1X10, 0,
+          V4L2_PIX_FMT_SGRBG10DPCM8, 8, },
         { V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_MBUS_FMT_SBGGR10_1X10,
-          V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_PIX_FMT_SBGGR10, 10, },
+          V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR10, 10, },
         { V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_MBUS_FMT_SGBRG10_1X10,
-          V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_PIX_FMT_SGBRG10, 10, },
+          V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG10, 10, },
         { V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_MBUS_FMT_SGRBG10_1X10,
-          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10, 10, },
+          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG10, 10, },
         { V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_MBUS_FMT_SRGGB10_1X10,
-          V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_PIX_FMT_SRGGB10, 10, },
+          V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB10, 10, },
         { V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_MBUS_FMT_SBGGR10_1X10,
-          V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_PIX_FMT_SBGGR12, 12, },
+          V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR12, 12, },
         { V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_MBUS_FMT_SGBRG10_1X10,
-          V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_PIX_FMT_SGBRG12, 12, },
+          V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG12, 12, },
         { V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_MBUS_FMT_SGRBG10_1X10,
-          V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_PIX_FMT_SGRBG12, 12, },
+          V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG12, 12, },
         { V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_MBUS_FMT_SRGGB10_1X10,
-          V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_PIX_FMT_SRGGB12, 12, },
+          V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB12, 12, },
         { V4L2_MBUS_FMT_UYVY8_1X16, V4L2_MBUS_FMT_UYVY8_1X16,
-          V4L2_MBUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_UYVY, 16, },
+          V4L2_MBUS_FMT_UYVY8_1X16, 0,
+          V4L2_PIX_FMT_UYVY, 16, },
         { V4L2_MBUS_FMT_YUYV8_1X16, V4L2_MBUS_FMT_YUYV8_1X16,
-          V4L2_MBUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_YUYV, 16, },
+          V4L2_MBUS_FMT_YUYV8_1X16, 0,
+          V4L2_PIX_FMT_YUYV, 16, },
 };
 
 const struct isp_format_info *
@@ -86,6 +116,37 @@ omap3isp_video_format_info(enum v4l2_mbus_pixelcode code)
 }
 
 /*
+ * Decide whether desired output pixel code can be obtained with
+ * the lane shifter by shifting the input pixel code.
+ * @in: input pixelcode to shifter
+ * @out: output pixelcode from shifter
+ * @additional_shift: # of bits the sensor's LSB is offset from CAMEXT[0]
+ *
+ * return true if the combination is possible
+ * return false otherwise
+ */
+static bool isp_video_is_shiftable(enum v4l2_mbus_pixelcode in,
+                enum v4l2_mbus_pixelcode out,
+                unsigned int additional_shift)
+{
+        const struct isp_format_info *in_info, *out_info;
+
+        if (in == out)
+                return true;
+
+        in_info = omap3isp_video_format_info(in);
+        out_info = omap3isp_video_format_info(out);
+
+        if ((in_info->flavor == 0) || (out_info->flavor == 0))
+                return false;
+
+        if (in_info->flavor != out_info->flavor)
+                return false;
+
+        return in_info->bpp - out_info->bpp + additional_shift <= 6;
+}
+
+/*
  * isp_video_mbus_to_pix - Convert v4l2_mbus_framefmt to v4l2_pix_format
  * @video: ISP video instance
  * @mbus: v4l2_mbus_framefmt format (input)
@@ -235,6 +296,7 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                 return -EPIPE;
 
         while (1) {
+                unsigned int shifter_link;
                 /* Retrieve the sink format */
                 pad = &subdev->entity.pads[0];
                 if (!(pad->flags & MEDIA_PAD_FL_SINK))
@@ -263,6 +325,10 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                                 return -ENOSPC;
                 }
 
+                /* If sink pad is on CCDC, the link has the lane shifter
+                 * in the middle of it. */
+                shifter_link = subdev == &isp->isp_ccdc.subdev;
+
                 /* Retrieve the source format */
                 pad = media_entity_remote_source(pad);
                 if (pad == NULL ||
@@ -278,10 +344,24 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                         return -EPIPE;
 
                 /* Check if the two ends match */
-                if (fmt_source.format.code != fmt_sink.format.code ||
-                    fmt_source.format.width != fmt_sink.format.width ||
+                if (fmt_source.format.width != fmt_sink.format.width ||
                     fmt_source.format.height != fmt_sink.format.height)
                         return -EPIPE;
+
+                if (shifter_link) {
+                        unsigned int parallel_shift = 0;
+                        if (isp->isp_ccdc.input == CCDC_INPUT_PARALLEL) {
+                                struct isp_parallel_platform_data *pdata =
+                                        &((struct isp_v4l2_subdevs_group *)
+                                              subdev->host_priv)->bus.parallel;
+                                parallel_shift = pdata->data_lane_shift * 2;
+                        }
+                        if (!isp_video_is_shiftable(fmt_source.format.code,
+                                                fmt_sink.format.code,
+                                                parallel_shift))
+                                return -EPIPE;
+                } else if (fmt_source.format.code != fmt_sink.format.code)
+                        return -EPIPE;
         }
 
         return 0;
diff --git a/drivers/media/video/omap3isp/ispvideo.h b/drivers/media/video/omap3isp/ispvideo.h
index 524a1acd0906..911bea64e78a 100644
--- a/drivers/media/video/omap3isp/ispvideo.h
+++ b/drivers/media/video/omap3isp/ispvideo.h
@@ -49,6 +49,8 @@ struct v4l2_pix_format;
  *      bits. Identical to @code if the format is 10 bits wide or less.
  * @uncompressed: V4L2 media bus format code for the corresponding uncompressed
  *      format. Identical to @code if the format is not DPCM compressed.
+ * @flavor: V4L2 media bus format code for the same pixel layout but
+ *      shifted to be 8 bits per pixel. =0 if format is not shiftable.
  * @pixelformat: V4L2 pixel format FCC identifier
  * @bpp: Bits per pixel
  */
@@ -56,6 +58,7 @@ struct isp_format_info {
         enum v4l2_mbus_pixelcode code;
         enum v4l2_mbus_pixelcode truncated;
         enum v4l2_mbus_pixelcode uncompressed;
+        enum v4l2_mbus_pixelcode flavor;
         u32 pixelformat;
         unsigned int bpp;
 };
diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
index 95f8b4e11e46..d142b40ea64e 100644
--- a/drivers/media/video/s5p-fimc/fimc-capture.c
+++ b/drivers/media/video/s5p-fimc/fimc-capture.c
@@ -527,7 +527,7 @@ static int fimc_cap_s_fmt_mplane(struct file *file, void *priv,
         if (ret)
                 return ret;
 
-        if (vb2_is_streaming(&fimc->vid_cap.vbq) || fimc_capture_active(fimc))
+        if (vb2_is_busy(&fimc->vid_cap.vbq) || fimc_capture_active(fimc))
                 return -EBUSY;
 
         frame = &ctx->d_frame;
@@ -539,8 +539,10 @@ static int fimc_cap_s_fmt_mplane(struct file *file, void *priv,
                 return -EINVAL;
         }
 
-        for (i = 0; i < frame->fmt->colplanes; i++)
-                frame->payload[i] = pix->plane_fmt[i].bytesperline * pix->height;
+        for (i = 0; i < frame->fmt->colplanes; i++) {
+                frame->payload[i] =
+                        (pix->width * pix->height * frame->fmt->depth[i]) >> 3;
+        }
 
         /* Output DMA frame pixel size and offsets. */
         frame->f_width = pix->plane_fmt[0].bytesperline * 8
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index 6c919b38a3d8..dc91a8511af6 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -361,10 +361,20 @@ static void fimc_capture_irq_handler(struct fimc_dev *fimc)
 {
         struct fimc_vid_cap *cap = &fimc->vid_cap;
         struct fimc_vid_buffer *v_buf;
+        struct timeval *tv;
+        struct timespec ts;
 
         if (!list_empty(&cap->active_buf_q) &&
             test_bit(ST_CAPT_RUN, &fimc->state)) {
+                ktime_get_real_ts(&ts);
+
                 v_buf = active_queue_pop(cap);
+
+                tv = &v_buf->vb.v4l2_buf.timestamp;
+                tv->tv_sec = ts.tv_sec;
+                tv->tv_usec = ts.tv_nsec / NSEC_PER_USEC;
+                v_buf->vb.v4l2_buf.sequence = cap->frame_count++;
+
                 vb2_buffer_done(&v_buf->vb, VB2_BUF_STATE_DONE);
         }
 
@@ -758,7 +768,7 @@ static void fimc_unlock(struct vb2_queue *vq)
         mutex_unlock(&ctx->fimc_dev->lock);
 }
 
-struct vb2_ops fimc_qops = {
+static struct vb2_ops fimc_qops = {
         .queue_setup     = fimc_queue_setup,
         .buf_prepare     = fimc_buf_prepare,
         .buf_queue       = fimc_buf_queue,
@@ -927,23 +937,23 @@ int fimc_vidioc_try_fmt_mplane(struct file *file, void *priv,
         pix->num_planes = fmt->memplanes;
         pix->colorspace = V4L2_COLORSPACE_JPEG;
 
-        for (i = 0; i < pix->num_planes; ++i) {
-                int bpl = pix->plane_fmt[i].bytesperline;
 
-                dbg("[%d] bpl: %d, depth: %d, w: %d, h: %d",
-                    i, bpl, fmt->depth[i], pix->width, pix->height);
+        for (i = 0; i < pix->num_planes; ++i) {
+                u32 bpl = pix->plane_fmt[i].bytesperline;
+                u32 *sizeimage = &pix->plane_fmt[i].sizeimage;
 
-                if (!bpl || (bpl * 8 / fmt->depth[i]) > pix->width)
-                        bpl = (pix->width * fmt->depth[0]) >> 3;
+                if (fmt->colplanes > 1 && (bpl == 0 || bpl < pix->width))
+                        bpl = pix->width; /* Planar */
 
-                if (!pix->plane_fmt[i].sizeimage)
-                        pix->plane_fmt[i].sizeimage = pix->height * bpl;
+                if (fmt->colplanes == 1 && /* Packed */
+                    (bpl == 0 || ((bpl * 8) / fmt->depth[i]) < pix->width))
+                        bpl = (pix->width * fmt->depth[0]) / 8;
 
-                pix->plane_fmt[i].bytesperline = bpl;
+                if (i == 0) /* Same bytesperline for each plane. */
+                        mod_x = bpl;
 
-                dbg("[%d]: bpl: %d, sizeimage: %d",
-                    i, pix->plane_fmt[i].bytesperline,
-                    pix->plane_fmt[i].sizeimage);
+                pix->plane_fmt[i].bytesperline = mod_x;
+                *sizeimage = (pix->width * pix->height * fmt->depth[i]) / 8;
         }
 
         return 0;
@@ -965,7 +975,7 @@ static int fimc_m2m_s_fmt_mplane(struct file *file, void *priv,
 
         vq = v4l2_m2m_get_vq(ctx->m2m_ctx, f->type);
 
-        if (vb2_is_streaming(vq)) {
+        if (vb2_is_busy(vq)) {
                 v4l2_err(&fimc->m2m.v4l2_dev, "queue (%d) busy\n", f->type);
                 return -EBUSY;
         }
@@ -985,8 +995,10 @@ static int fimc_m2m_s_fmt_mplane(struct file *file, void *priv,
         if (!frame->fmt)
                 return -EINVAL;
 
-        for (i = 0; i < frame->fmt->colplanes; i++)
-                frame->payload[i] = pix->plane_fmt[i].bytesperline * pix->height;
+        for (i = 0; i < frame->fmt->colplanes; i++) {
+                frame->payload[i] =
+                        (pix->width * pix->height * frame->fmt->depth[i]) / 8;
+        }
 
         frame->f_width  = pix->plane_fmt[0].bytesperline * 8 /
                 frame->fmt->depth[0];
@@ -1750,7 +1762,7 @@ static int __devexit fimc_remove(struct platform_device *pdev)
 }
 
 /* Image pixel limits, similar across several FIMC HW revisions. */
-static struct fimc_pix_limit s5p_pix_limit[3] = {
+static struct fimc_pix_limit s5p_pix_limit[4] = {
         [0] = {
                 .scaler_en_w    = 3264,
                 .scaler_dis_w   = 8192,
@@ -1775,6 +1787,14 @@ static struct fimc_pix_limit s5p_pix_limit[3] = {
                 .out_rot_en_w   = 1280,
                 .out_rot_dis_w  = 1920,
         },
+        [3] = {
+                .scaler_en_w    = 1920,
+                .scaler_dis_w   = 8192,
+                .in_rot_en_h    = 1366,
+                .in_rot_dis_w   = 8192,
+                .out_rot_en_w   = 1366,
+                .out_rot_dis_w  = 1920,
+        },
 };
 
 static struct samsung_fimc_variant fimc0_variant_s5p = {
@@ -1827,7 +1847,7 @@ static struct samsung_fimc_variant fimc2_variant_s5pv210 = {
         .pix_limit       = &s5p_pix_limit[2],
 };
 
-static struct samsung_fimc_variant fimc0_variant_s5pv310 = {
+static struct samsung_fimc_variant fimc0_variant_exynos4 = {
         .pix_hoff        = 1,
         .has_inp_rot     = 1,
         .has_out_rot     = 1,
@@ -1840,7 +1860,7 @@ static struct samsung_fimc_variant fimc0_variant_s5pv310 = {
         .pix_limit       = &s5p_pix_limit[1],
 };
 
-static struct samsung_fimc_variant fimc2_variant_s5pv310 = {
+static struct samsung_fimc_variant fimc2_variant_exynos4 = {
         .pix_hoff        = 1,
         .has_cistatus2   = 1,
         .has_mainscaler_ext = 1,
@@ -1848,7 +1868,7 @@ static struct samsung_fimc_variant fimc2_variant_s5pv310 = {
         .min_out_pixsize = 16,
         .hor_offs_align  = 1,
         .out_buf_count   = 32,
-        .pix_limit       = &s5p_pix_limit[2],
+        .pix_limit       = &s5p_pix_limit[3],
 };
 
 /* S5PC100 */
@@ -1874,12 +1894,12 @@ static struct samsung_fimc_driverdata fimc_drvdata_s5pv210 = {
 };
 
 /* S5PV310, S5PC210 */
-static struct samsung_fimc_driverdata fimc_drvdata_s5pv310 = {
+static struct samsung_fimc_driverdata fimc_drvdata_exynos4 = {
         .variant = {
-                [0] = &fimc0_variant_s5pv310,
-                [1] = &fimc0_variant_s5pv310,
-                [2] = &fimc0_variant_s5pv310,
-                [3] = &fimc2_variant_s5pv310,
+                [0] = &fimc0_variant_exynos4,
+                [1] = &fimc0_variant_exynos4,
+                [2] = &fimc0_variant_exynos4,
+                [3] = &fimc2_variant_exynos4,
         },
         .num_entities = 4,
         .lclk_frequency = 166000000UL,
@@ -1893,8 +1913,8 @@ static struct platform_device_id fimc_driver_ids[] = {
                 .name           = "s5pv210-fimc",
                 .driver_data    = (unsigned long)&fimc_drvdata_s5pv210,
         }, {
-                .name           = "s5pv310-fimc",
-                .driver_data    = (unsigned long)&fimc_drvdata_s5pv310,
+                .name           = "exynos4-fimc",
+                .driver_data    = (unsigned long)&fimc_drvdata_exynos4,
         },
         {},
 };
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 3fe54bf41142..134e86bf6d97 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -922,7 +922,7 @@ static int sh_mobile_ceu_get_formats(struct soc_camera_device *icd, unsigned int
                         /* Try 2560x1920, 1280x960, 640x480, 320x240 */
                         mf.width        = 2560 >> shift;
                         mf.height       = 1920 >> shift;
-                        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                          s_mbus_fmt, &mf);
                         if (ret < 0)
                                 return ret;
@@ -1224,7 +1224,7 @@ static int client_s_fmt(struct soc_camera_device *icd,
         struct v4l2_cropcap cap;
         int ret;
 
-        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                          s_mbus_fmt, mf);
         if (ret < 0)
                 return ret;
@@ -1254,7 +1254,7 @@ static int client_s_fmt(struct soc_camera_device *icd,
                 tmp_h = min(2 * tmp_h, max_height);
                 mf->width = tmp_w;
                 mf->height = tmp_h;
-                ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                  s_mbus_fmt, mf);
                 dev_geo(dev, "Camera scaled to %ux%u\n",
                         mf->width, mf->height);
@@ -1658,7 +1658,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
         mf.code         = xlate->code;
         mf.colorspace   = pix->colorspace;
 
-        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video, try_mbus_fmt, &mf);
+        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video, try_mbus_fmt, &mf);
         if (ret < 0)
                 return ret;
 
@@ -1682,7 +1682,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
                          */
                         mf.width = 2560;
                         mf.height = 1920;
-                        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                          try_mbus_fmt, &mf);
                         if (ret < 0) {
                                 /* Shouldn't actually happen... */
diff --git a/drivers/media/video/sh_mobile_csi2.c b/drivers/media/video/sh_mobile_csi2.c
index dd1b81b1442b..98b87481fa94 100644
--- a/drivers/media/video/sh_mobile_csi2.c
+++ b/drivers/media/video/sh_mobile_csi2.c
@@ -38,6 +38,8 @@ struct sh_csi2 {
         void __iomem                    *base;
         struct platform_device          *pdev;
         struct sh_csi2_client_config    *client;
+        unsigned long (*query_bus_param)(struct soc_camera_device *);
+        int (*set_bus_param)(struct soc_camera_device *, unsigned long);
 };
 
 static int sh_csi2_try_fmt(struct v4l2_subdev *sd,
@@ -208,6 +210,7 @@ static int sh_csi2_notify(struct notifier_block *nb,
         case BUS_NOTIFY_BOUND_DRIVER:
                 snprintf(priv->subdev.name, V4L2_SUBDEV_NAME_SIZE, "%s%s",
                          dev_name(v4l2_dev->dev), ".mipi-csi");
+                priv->subdev.grp_id = (long)icd;
                 ret = v4l2_device_register_subdev(v4l2_dev, &priv->subdev);
                 dev_dbg(dev, "%s(%p): ret(register_subdev) = %d\n", __func__, priv, ret);
                 if (ret < 0)
@@ -215,6 +218,8 @@ static int sh_csi2_notify(struct notifier_block *nb,
 
                 priv->client = pdata->clients + i;
 
+                priv->set_bus_param             = icd->ops->set_bus_param;
+                priv->query_bus_param           = icd->ops->query_bus_param;
                 icd->ops->set_bus_param         = sh_csi2_set_bus_param;
                 icd->ops->query_bus_param       = sh_csi2_query_bus_param;
 
@@ -226,8 +231,10 @@ static int sh_csi2_notify(struct notifier_block *nb,
                 priv->client = NULL;
 
                 /* Driver is about to be unbound */
-                icd->ops->set_bus_param         = NULL;
-                icd->ops->query_bus_param       = NULL;
+                icd->ops->set_bus_param         = priv->set_bus_param;
+                icd->ops->query_bus_param       = priv->query_bus_param;
+                priv->set_bus_param             = NULL;
+                priv->query_bus_param           = NULL;
 
                 v4l2_device_unregister_subdev(&priv->subdev);
 
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 46284489e4eb..3973f9a94753 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -996,10 +996,11 @@ static void soc_camera_free_i2c(struct soc_camera_device *icd)
 {
         struct i2c_client *client =
                 to_i2c_client(to_soc_camera_control(icd));
+        struct i2c_adapter *adap = client->adapter;
         dev_set_drvdata(&icd->dev, NULL);
         v4l2_device_unregister_subdev(i2c_get_clientdata(client));
         i2c_unregister_device(client);
-        i2c_put_adapter(client->adapter);
+        i2c_put_adapter(adap);
 }
 #else
 #define soc_camera_init_i2c(icd, icl)   (-ENODEV)
@@ -1071,6 +1072,9 @@ static int soc_camera_probe(struct device *dev)
                 }
         }
 
+        sd = soc_camera_to_subdev(icd);
+        sd->grp_id = (long)icd;
+
         /* At this point client .probe() should have run already */
         ret = soc_camera_init_user_formats(icd);
         if (ret < 0)
@@ -1092,7 +1096,6 @@ static int soc_camera_probe(struct device *dev)
                 goto evidstart;
 
         /* Try to improve our guess of a reasonable window format */
-        sd = soc_camera_to_subdev(icd);
         if (!v4l2_subdev_call(sd, video, g_mbus_fmt, &mf)) {
                 icd->user_width         = mf.width;
                 icd->user_height        = mf.height;
diff --git a/drivers/media/video/tda9840.c b/drivers/media/video/tda9840.c
index 5d4cf3b3d435..22fa8202d5ca 100644
--- a/drivers/media/video/tda9840.c
+++ b/drivers/media/video/tda9840.c
@@ -171,7 +171,7 @@ static int tda9840_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
+        sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
         if (sd == NULL)
                 return -ENOMEM;
         v4l2_i2c_subdev_init(sd, client, &tda9840_ops);
diff --git a/drivers/media/video/tea6415c.c b/drivers/media/video/tea6415c.c
index 19621ed523ec..827425c5b866 100644
--- a/drivers/media/video/tea6415c.c
+++ b/drivers/media/video/tea6415c.c
@@ -152,7 +152,7 @@ static int tea6415c_probe(struct i2c_client *client,
 
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
-        sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
+        sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
         if (sd == NULL)
                 return -ENOMEM;
         v4l2_i2c_subdev_init(sd, client, &tea6415c_ops);
diff --git a/drivers/media/video/tea6420.c b/drivers/media/video/tea6420.c
index 5ea840401f21..f350b6c24500 100644
--- a/drivers/media/video/tea6420.c
+++ b/drivers/media/video/tea6420.c
@@ -125,7 +125,7 @@ static int tea6420_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
+        sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
         if (sd == NULL)
                 return -ENOMEM;
         v4l2_i2c_subdev_init(sd, client, &tea6420_ops);
diff --git a/drivers/media/video/upd64031a.c b/drivers/media/video/upd64031a.c
index f8138c75be8b..1aab96a88203 100644
--- a/drivers/media/video/upd64031a.c
+++ b/drivers/media/video/upd64031a.c
@@ -230,7 +230,7 @@ static int upd64031a_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
         sd = &state->sd;
diff --git a/drivers/media/video/upd64083.c b/drivers/media/video/upd64083.c
index 28e0e6b6ca84..9bbe61700fd5 100644
--- a/drivers/media/video/upd64083.c
+++ b/drivers/media/video/upd64083.c
@@ -202,7 +202,7 @@ static int upd64083_probe(struct i2c_client *client,
         v4l_info(client, "chip found @ 0x%x (%s)\n",
                         client->addr << 1, client->adapter->name);
 
-        state = kmalloc(sizeof(struct upd64083_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct upd64083_state), GFP_KERNEL);
         if (state == NULL)
                 return -ENOMEM;
         sd = &state->sd;
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 498e6742579e..6dc7196296b3 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -389,7 +389,8 @@ static int v4l2_open(struct inode *inode, struct file *filp)
         video_get(vdev);
         mutex_unlock(&videodev_lock);
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev) {
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV) {
                 entity = media_entity_get(&vdev->entity);
                 if (!entity) {
                         ret = -EBUSY;
@@ -415,7 +416,8 @@ err:
         /* decrease the refcount in case of an error */
         if (ret) {
 #if defined(CONFIG_MEDIA_CONTROLLER)
-                if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+                if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+                    vdev->vfl_type != VFL_TYPE_SUBDEV)
                         media_entity_put(entity);
 #endif
                 video_put(vdev);
@@ -437,7 +439,8 @@ static int v4l2_release(struct inode *inode, struct file *filp)
                         mutex_unlock(vdev->lock);
         }
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV)
                 media_entity_put(&vdev->entity);
 #endif
         /* decrease the refcount unconditionally since the release()
@@ -686,7 +689,8 @@ int __video_register_device(struct video_device *vdev, int type, int nr,
 
 #if defined(CONFIG_MEDIA_CONTROLLER)
         /* Part 5: Register the entity. */
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev) {
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV) {
                 vdev->entity.type = MEDIA_ENT_T_DEVNODE_V4L;
                 vdev->entity.name = vdev->name;
                 vdev->entity.v4l.major = VIDEO_MAJOR;
@@ -733,7 +737,8 @@ void video_unregister_device(struct video_device *vdev)
                 return;
 
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV)
                 media_device_unregister_entity(&vdev->entity);
 #endif
 
diff --git a/drivers/media/video/videobuf2-core.c b/drivers/media/video/videobuf2-core.c
index 6698c77e0f64..6ba1461d51ef 100644
--- a/drivers/media/video/videobuf2-core.c
+++ b/drivers/media/video/videobuf2-core.c
@@ -37,6 +37,9 @@ module_param(debug, int, 0644);
 #define call_qop(q, op, args...)                                        \
         (((q)->ops->op) ? ((q)->ops->op(args)) : 0)
 
+#define V4L2_BUFFER_STATE_FLAGS (V4L2_BUF_FLAG_MAPPED | V4L2_BUF_FLAG_QUEUED | \
+                                 V4L2_BUF_FLAG_DONE | V4L2_BUF_FLAG_ERROR)
+
 /**
  * __vb2_buf_mem_alloc() - allocate video memory for the given buffer
  */
@@ -51,7 +54,7 @@ static int __vb2_buf_mem_alloc(struct vb2_buffer *vb,
         for (plane = 0; plane < vb->num_planes; ++plane) {
                 mem_priv = call_memop(q, plane, alloc, q->alloc_ctx[plane],
                                         plane_sizes[plane]);
-                if (!mem_priv)
+                if (IS_ERR_OR_NULL(mem_priv))
                         goto free;
 
                 /* Associate allocator private data with this plane */
@@ -284,7 +287,7 @@ static int __fill_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b)
         struct vb2_queue *q = vb->vb2_queue;
         int ret = 0;
 
-        /* Copy back data such as timestamp, input, etc. */
+        /* Copy back data such as timestamp, flags, input, etc. */
         memcpy(b, &vb->v4l2_buf, offsetof(struct v4l2_buffer, m));
         b->input = vb->v4l2_buf.input;
         b->reserved = vb->v4l2_buf.reserved;
@@ -313,7 +316,10 @@ static int __fill_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b)
                         b->m.userptr = vb->v4l2_planes[0].m.userptr;
         }
 
-        b->flags = 0;
+        /*
+         * Clear any buffer state related flags.
+         */
+        b->flags &= ~V4L2_BUFFER_STATE_FLAGS;
 
         switch (vb->state) {
         case VB2_BUF_STATE_QUEUED:
@@ -519,6 +525,7 @@ int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
         num_buffers = min_t(unsigned int, req->count, VIDEO_MAX_FRAME);
         memset(plane_sizes, 0, sizeof(plane_sizes));
         memset(q->alloc_ctx, 0, sizeof(q->alloc_ctx));
+        q->memory = req->memory;
 
         /*
          * Ask the driver how many buffers and planes per buffer it requires.
@@ -560,8 +567,6 @@ int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
                 ret = num_buffers;
         }
 
-        q->memory = req->memory;
-
         /*
          * Return the number of successfully allocated buffers
          * to the userspace.
@@ -715,6 +720,8 @@ static int __fill_vb2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b,
 
         vb->v4l2_buf.field = b->field;
         vb->v4l2_buf.timestamp = b->timestamp;
+        vb->v4l2_buf.input = b->input;
+        vb->v4l2_buf.flags = b->flags & ~V4L2_BUFFER_STATE_FLAGS;
 
         return 0;
 }
diff --git a/drivers/media/video/videobuf2-dma-contig.c b/drivers/media/video/videobuf2-dma-contig.c
index 58205d596138..a790a5f8c06f 100644
--- a/drivers/media/video/videobuf2-dma-contig.c
+++ b/drivers/media/video/videobuf2-dma-contig.c
@@ -46,7 +46,7 @@ static void *vb2_dma_contig_alloc(void *alloc_ctx, unsigned long size)
                                         GFP_KERNEL);
         if (!buf->vaddr) {
                 dev_err(conf->dev, "dma_alloc_coherent of size %ld failed\n",
-                        buf->size);
+                        size);
                 kfree(buf);
                 return ERR_PTR(-ENOMEM);
         }
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index 53450f433f10..2e165117457b 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -25,7 +25,6 @@
 #include <linux/dma-mapping.h>
 #include <linux/spinlock.h>
 #include <linux/gpio.h>
-#include <linux/regulator/consumer.h>
 #include <plat/usb.h>
 
 #define USBHS_DRIVER_NAME       "usbhs-omap"
@@ -700,8 +699,7 @@ static int usbhs_enable(struct device *dev)
         dev_dbg(dev, "starting TI HSUSB Controller\n");
         if (!pdata) {
                 dev_dbg(dev, "missing platform_data\n");
-                ret =  -ENODEV;
-                goto end_enable;
+                return  -ENODEV;
         }
 
         spin_lock_irqsave(&omap->lock, flags);
@@ -915,7 +913,8 @@ static int usbhs_enable(struct device *dev)
 
 end_count:
         omap->count++;
-        goto end_enable;
+        spin_unlock_irqrestore(&omap->lock, flags);
+        return 0;
 
 err_tll:
         if (pdata->ehci_data->phy_reset) {
@@ -931,8 +930,6 @@ err_tll:
         clk_disable(omap->usbhost_fs_fck);
         clk_disable(omap->usbhost_hs_fck);
         clk_disable(omap->usbhost_ick);
-
-end_enable:
         spin_unlock_irqrestore(&omap->lock, flags);
         return ret;
 }
diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c
index 63667a8f140c..d6d62fd07ee9 100644
--- a/drivers/mmc/core/bus.c
+++ b/drivers/mmc/core/bus.c
@@ -284,6 +284,7 @@ int mmc_add_card(struct mmc_card *card)
                 type = "SD-combo";
                 if (mmc_card_blockaddr(card))
                         type = "SDHC-combo";
+                break;
         default:
                 type = "?";
                 break;
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 461e6a17fb90..2b200c1cfbba 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -94,7 +94,7 @@ static void mmc_host_clk_gate_delayed(struct mmc_host *host)
                 spin_unlock_irqrestore(&host->clk_lock, flags);
                 return;
         }
-        mutex_lock(&host->clk_gate_mutex);
+        mmc_claim_host(host);
         spin_lock_irqsave(&host->clk_lock, flags);
         if (!host->clk_requests) {
                 spin_unlock_irqrestore(&host->clk_lock, flags);
@@ -104,7 +104,7 @@ static void mmc_host_clk_gate_delayed(struct mmc_host *host)
                 pr_debug("%s: gated MCI clock\n", mmc_hostname(host));
         }
         spin_unlock_irqrestore(&host->clk_lock, flags);
-        mutex_unlock(&host->clk_gate_mutex);
+        mmc_release_host(host);
 }
 
 /*
@@ -130,7 +130,7 @@ void mmc_host_clk_ungate(struct mmc_host *host)
 {
         unsigned long flags;
 
-        mutex_lock(&host->clk_gate_mutex);
+        mmc_claim_host(host);
         spin_lock_irqsave(&host->clk_lock, flags);
         if (host->clk_gated) {
                 spin_unlock_irqrestore(&host->clk_lock, flags);
@@ -140,7 +140,7 @@ void mmc_host_clk_ungate(struct mmc_host *host)
         }
         host->clk_requests++;
         spin_unlock_irqrestore(&host->clk_lock, flags);
-        mutex_unlock(&host->clk_gate_mutex);
+        mmc_release_host(host);
 }
 
 /**
@@ -215,7 +215,6 @@ static inline void mmc_host_clk_init(struct mmc_host *host)
         host->clk_gated = false;
         INIT_WORK(&host->clk_gate_work, mmc_host_clk_gate_work);
         spin_lock_init(&host->clk_lock);
-        mutex_init(&host->clk_gate_mutex);
 }
 
 /**
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index 2e032f0e8cf4..a6c329040140 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -832,7 +832,7 @@ static irqreturn_t mmc_omap_irq(int irq, void *dev_id)
                 return IRQ_HANDLED;
         }
 
-        if (end_command)
+        if (end_command && host->cmd)
                 mmc_omap_cmd_done(host, host->cmd);
         if (host->data != NULL) {
                 if (transfer_error)
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index a136be706347..f8b5f37007b2 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -957,6 +957,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
         host->ioaddr = pci_ioremap_bar(pdev, bar);
         if (!host->ioaddr) {
                 dev_err(&pdev->dev, "failed to remap registers\n");
+                ret = -ENOMEM;
                 goto release;
         }
 
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 9e15f41f87be..5d20661bc357 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1334,6 +1334,13 @@ static void sdhci_tasklet_finish(unsigned long param)
 
         host = (struct sdhci_host*)param;
 
+        /*
+         * If this tasklet gets rescheduled while running, it will
+         * be run again afterwards but without any active request.
+         */
+        if (!host->mrq)
+                return;
+
         spin_lock_irqsave(&host->lock, flags);
 
         del_timer(&host->timer);
@@ -1345,7 +1352,7 @@ static void sdhci_tasklet_finish(unsigned long param)
          * upon error conditions.
          */
         if (!(host->flags & SDHCI_DEVICE_DEAD) &&
-                (mrq->cmd->error ||
+            ((mrq->cmd && mrq->cmd->error) ||
                  (mrq->data && (mrq->data->error ||
                   (mrq->data->stop && mrq->data->stop->error))) ||
                    (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) {
diff --git a/drivers/mmc/host/tmio_mmc_pio.c b/drivers/mmc/host/tmio_mmc_pio.c
index 62d37de6de76..710339a85c84 100644
--- a/drivers/mmc/host/tmio_mmc_pio.c
+++ b/drivers/mmc/host/tmio_mmc_pio.c
@@ -728,15 +728,15 @@ static void tmio_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 tmio_mmc_set_clock(host, ios->clock);
 
         /* Power sequence - OFF -> UP -> ON */
-        if (ios->power_mode == MMC_POWER_OFF || !ios->clock) {
+        if (ios->power_mode == MMC_POWER_UP) {
+                /* power up SD bus */
+                if (host->set_pwr)
+                        host->set_pwr(host->pdev, 1);
+        } else if (ios->power_mode == MMC_POWER_OFF || !ios->clock) {
                 /* power down SD bus */
                 if (ios->power_mode == MMC_POWER_OFF && host->set_pwr)
                         host->set_pwr(host->pdev, 0);
                 tmio_mmc_clk_stop(host);
-        } else if (ios->power_mode == MMC_POWER_UP) {
-                /* power up SD bus */
-                if (host->set_pwr)
-                        host->set_pwr(host->pdev, 1);
         } else {
                 /* start bus clock */
                 tmio_mmc_clk_start(host);
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index 96c0b34ba8db..657b9f4b6f9b 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -400,7 +400,7 @@ static uint16_t __init doc200x_ident_chip(struct mtd_info *mtd, int nr)
         doc200x_hwcontrol(mtd, 0, NAND_CTRL_ALE | NAND_CTRL_CHANGE);
         doc200x_hwcontrol(mtd, NAND_CMD_NONE, NAND_NCE | NAND_CTRL_CHANGE);
 
-        /* We can't' use dev_ready here, but at least we wait for the
+        /* We can't use dev_ready here, but at least we wait for the
          * command to complete
          */
         udelay(50);
diff --git a/drivers/net/amd8111e.c b/drivers/net/amd8111e.c
index 88495c48a81d..241b185e6569 100644
--- a/drivers/net/amd8111e.c
+++ b/drivers/net/amd8111e.c
@@ -106,7 +106,7 @@ MODULE_DESCRIPTION ("AMD8111 based 10/100 Ethernet Controller. Driver Version "M
 MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(pci, amd8111e_pci_tbl);
 module_param_array(speed_duplex, int, NULL, 0);
-MODULE_PARM_DESC(speed_duplex, "Set device speed and duplex modes, 0: Auto Negotitate, 1: 10Mbps Half Duplex, 2: 10Mbps Full Duplex, 3: 100Mbps Half Duplex, 4: 100Mbps Full Duplex");
+MODULE_PARM_DESC(speed_duplex, "Set device speed and duplex modes, 0: Auto Negotiate, 1: 10Mbps Half Duplex, 2: 10Mbps Full Duplex, 3: 100Mbps Half Duplex, 4: 100Mbps Full Duplex");
 module_param_array(coalesce, bool, NULL, 0);
 MODULE_PARM_DESC(coalesce, "Enable or Disable interrupt coalescing, 1: Enable, 0: Disable");
 module_param_array(dynamic_ipg, bool, NULL, 0);
diff --git a/drivers/net/atl1c/atl1c.h b/drivers/net/atl1c/atl1c.h
index 7cb375e0e29c..925929d764ca 100644
--- a/drivers/net/atl1c/atl1c.h
+++ b/drivers/net/atl1c/atl1c.h
@@ -566,9 +566,9 @@ struct atl1c_adapter {
 #define __AT_TESTING        0x0001
 #define __AT_RESETTING      0x0002
 #define __AT_DOWN           0x0003
-        u8 work_event;
-#define ATL1C_WORK_EVENT_RESET          0x01
-#define ATL1C_WORK_EVENT_LINK_CHANGE    0x02
+        unsigned long work_event;
+#define ATL1C_WORK_EVENT_RESET          0
+#define ATL1C_WORK_EVENT_LINK_CHANGE    1
         u32 msg_enable;
 
         bool have_msi;
diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
index 7d9d5067a65c..a6e1c36e48e6 100644
--- a/drivers/net/atl1c/atl1c_main.c
+++ b/drivers/net/atl1c/atl1c_main.c
@@ -325,7 +325,7 @@ static void atl1c_link_chg_event(struct atl1c_adapter *adapter)
                 }
         }
 
-        adapter->work_event |= ATL1C_WORK_EVENT_LINK_CHANGE;
+        set_bit(ATL1C_WORK_EVENT_LINK_CHANGE, &adapter->work_event);
         schedule_work(&adapter->common_task);
 }
 
@@ -337,20 +337,16 @@ static void atl1c_common_task(struct work_struct *work)
         adapter = container_of(work, struct atl1c_adapter, common_task);
         netdev = adapter->netdev;
 
-        if (adapter->work_event & ATL1C_WORK_EVENT_RESET) {
-                adapter->work_event &= ~ATL1C_WORK_EVENT_RESET;
+        if (test_and_clear_bit(ATL1C_WORK_EVENT_RESET, &adapter->work_event)) {
                 netif_device_detach(netdev);
                 atl1c_down(adapter);
                 atl1c_up(adapter);
                 netif_device_attach(netdev);
-                return;
         }
 
-        if (adapter->work_event & ATL1C_WORK_EVENT_LINK_CHANGE) {
-                adapter->work_event &= ~ATL1C_WORK_EVENT_LINK_CHANGE;
+        if (test_and_clear_bit(ATL1C_WORK_EVENT_LINK_CHANGE,
+                &adapter->work_event))
                 atl1c_check_link_status(adapter);
-        }
-        return;
 }
 
 
@@ -369,7 +365,7 @@ static void atl1c_tx_timeout(struct net_device *netdev)
         struct atl1c_adapter *adapter = netdev_priv(netdev);
 
         /* Do the reset outside of interrupt context */
-        adapter->work_event |= ATL1C_WORK_EVENT_RESET;
+        set_bit(ATL1C_WORK_EVENT_RESET, &adapter->work_event);
         schedule_work(&adapter->common_task);
 }
 
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 7cb5a114c733..02a0443d1821 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -1873,6 +1873,7 @@ static void be_worker(struct work_struct *work)
                 be_detect_dump_ue(adapter);
 
 reschedule:
+        adapter->work_counter++;
         schedule_delayed_work(&adapter->work, msecs_to_jiffies(1000));
 }
 
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 8e6d618b5305..d8383a9af9ad 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -8413,6 +8413,8 @@ bnx2_remove_one(struct pci_dev *pdev)
 
         unregister_netdev(dev);
 
+        del_timer_sync(&bp->timer);
+
         if (bp->mips_firmware)
                 release_firmware(bp->mips_firmware);
         if (bp->rv2p_firmware)
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index e83ac6dd6fc0..16581df5ee4e 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -2019,15 +2019,23 @@ static inline void bnx2x_set_pbd_gso(struct sk_buff *skb,
 static inline  u8 bnx2x_set_pbd_csum_e2(struct bnx2x *bp, struct sk_buff *skb,
         u32 *parsing_data, u32 xmit_type)
 {
-        *parsing_data |= ((tcp_hdrlen(skb)/4) <<
-                ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW_SHIFT) &
-                ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW;
+        *parsing_data |=
+                        ((((u8 *)skb_transport_header(skb) - skb->data) >> 1) <<
+                        ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W_SHIFT) &
+                        ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W;
 
-        *parsing_data |= ((((u8 *)tcp_hdr(skb) - skb->data) / 2) <<
-                ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W_SHIFT) &
-                ETH_TX_PARSE_BD_E2_TCP_HDR_START_OFFSET_W;
+        if (xmit_type & XMIT_CSUM_TCP) {
+                *parsing_data |= ((tcp_hdrlen(skb) / 4) <<
+                        ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW_SHIFT) &
+                        ETH_TX_PARSE_BD_E2_TCP_HDR_LENGTH_DW;
 
-        return skb_transport_header(skb) + tcp_hdrlen(skb) - skb->data;
+                return skb_transport_header(skb) + tcp_hdrlen(skb) - skb->data;
+        } else
+                /* We support checksum offload for TCP and UDP only.
+                 * No need to pass the UDP header length - it's a constant.
+                 */
+                return skb_transport_header(skb) +
+                                sizeof(struct udphdr) - skb->data;
 }
 
 /**
@@ -2043,7 +2051,7 @@ static inline u8 bnx2x_set_pbd_csum(struct bnx2x *bp, struct sk_buff *skb,
         struct eth_tx_parse_bd_e1x *pbd,
         u32 xmit_type)
 {
-        u8 hlen = (skb_network_header(skb) - skb->data) / 2;
+        u8 hlen = (skb_network_header(skb) - skb->data) >> 1;
 
         /* for now NS flag is not used in Linux */
         pbd->global_data =
@@ -2051,9 +2059,15 @@ static inline u8 bnx2x_set_pbd_csum(struct bnx2x *bp, struct sk_buff *skb,
                          ETH_TX_PARSE_BD_E1X_LLC_SNAP_EN_SHIFT));
 
         pbd->ip_hlen_w = (skb_transport_header(skb) -
-                        skb_network_header(skb)) / 2;
+                        skb_network_header(skb)) >> 1;
 
-        hlen += pbd->ip_hlen_w + tcp_hdrlen(skb) / 2;
+        hlen += pbd->ip_hlen_w;
+
+        /* We support checksum offload for TCP and UDP only */
+        if (xmit_type & XMIT_CSUM_TCP)
+                hlen += tcp_hdrlen(skb) / 2;
+        else
+                hlen += sizeof(struct udphdr) / 2;
 
         pbd->total_hlen_w = cpu_to_le16(hlen);
         hlen = hlen*2;
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 494bf960442d..31912f17653f 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1482,8 +1482,11 @@ static struct aggregator *ad_agg_selection_test(struct aggregator *best,
 
 static int agg_device_up(const struct aggregator *agg)
 {
-        return (netif_running(agg->slave->dev) &&
-                netif_carrier_ok(agg->slave->dev));
+        struct port *port = agg->lag_ports;
+        if (!port)
+                return 0;
+        return (netif_running(port->slave->dev) &&
+                netif_carrier_ok(port->slave->dev));
 }
 
 /**
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index f75d3144b8a5..53c0f04b1b23 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -3040,11 +3040,14 @@ static void ehea_rereg_mrs(void)
 
                                         if (dev->flags & IFF_UP) {
                                                 mutex_lock(&port->port_lock);
-                                                port_napi_enable(port);
                                                 ret = ehea_restart_qps(dev);
-                                                check_sqs(port);
-                                                if (!ret)
+                                                if (!ret) {
+                                                        check_sqs(port);
+                                                        port_napi_enable(port);
                                                         netif_wake_queue(dev);
+                                                } else {
+                                                        netdev_err(dev, "Unable to restart QPS\n");
+                                                }
                                                 mutex_unlock(&port->port_lock);
                                         }
                                 }
diff --git a/drivers/net/fs_enet/mac-fec.c b/drivers/net/fs_enet/mac-fec.c
index 61035fc5599b..b9fbc83d64a7 100644
--- a/drivers/net/fs_enet/mac-fec.c
+++ b/drivers/net/fs_enet/mac-fec.c
@@ -226,8 +226,8 @@ static void set_multicast_finish(struct net_device *dev)
         }
 
         FC(fecp, r_cntrl, FEC_RCNTRL_PROM);
-        FW(fecp, hash_table_high, fep->fec.hthi);
-        FW(fecp, hash_table_low, fep->fec.htlo);
+        FW(fecp, grp_hash_table_high, fep->fec.hthi);
+        FW(fecp, grp_hash_table_low, fep->fec.htlo);
 }
 
 static void set_multicast_list(struct net_device *dev)
@@ -273,8 +273,8 @@ static void restart(struct net_device *dev)
         /*
          * Reset all multicast.
          */
-        FW(fecp, hash_table_high, fep->fec.hthi);
-        FW(fecp, hash_table_low, fep->fec.htlo);
+        FW(fecp, grp_hash_table_high, fep->fec.hthi);
+        FW(fecp, grp_hash_table_low, fep->fec.htlo);
 
         /*
          * Set maximum receive buffer size.
diff --git a/drivers/net/ftmac100.c b/drivers/net/ftmac100.c
index a31661948c42..9bd7746cbfcf 100644
--- a/drivers/net/ftmac100.c
+++ b/drivers/net/ftmac100.c
@@ -139,11 +139,11 @@ static int ftmac100_reset(struct ftmac100 *priv)
                          * that hardware reset completed (what the f*ck).
                          * We still need to wait for a while.
                          */
-                        usleep_range(500, 1000);
+                        udelay(500);
                         return 0;
                 }
 
-                usleep_range(1000, 10000);
+                udelay(1000);
         }
 
         netdev_err(netdev, "software reset failed\n");
@@ -772,7 +772,7 @@ static int ftmac100_mdio_read(struct net_device *netdev, int phy_id, int reg)
                 if ((phycr & FTMAC100_PHYCR_MIIRD) == 0)
                         return phycr & FTMAC100_PHYCR_MIIRDATA;
 
-                usleep_range(100, 1000);
+                udelay(100);
         }
 
         netdev_err(netdev, "mdio read timed out\n");
@@ -801,7 +801,7 @@ static void ftmac100_mdio_write(struct net_device *netdev, int phy_id, int reg,
                 if ((phycr & FTMAC100_PHYCR_MIIWR) == 0)
                         return;
 
-                usleep_range(100, 1000);
+                udelay(100);
         }
 
         netdev_err(netdev, "mdio write timed out\n");
diff --git a/drivers/net/mii.c b/drivers/net/mii.c
index 0a6c6a2e7550..d4fc00b1ff93 100644
--- a/drivers/net/mii.c
+++ b/drivers/net/mii.c
@@ -49,6 +49,10 @@ static u32 mii_get_an(struct mii_if_info *mii, u16 addr)
                 result |= ADVERTISED_100baseT_Half;
         if (advert & ADVERTISE_100FULL)
                 result |= ADVERTISED_100baseT_Full;
+        if (advert & ADVERTISE_PAUSE_CAP)
+                result |= ADVERTISED_Pause;
+        if (advert & ADVERTISE_PAUSE_ASYM)
+                result |= ADVERTISED_Asym_Pause;
 
         return result;
 }
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index dfb67eb2a94b..eb41e44921e6 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -671,6 +671,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
                 goto done;
 
         spin_lock_irqsave(&target_list_lock, flags);
+restart:
         list_for_each_entry(nt, &target_list, list) {
                 netconsole_target_get(nt);
                 if (nt->np.dev == dev) {
@@ -683,9 +684,16 @@ static int netconsole_netdev_event(struct notifier_block *this,
                                  * rtnl_lock already held
                                  */
                                 if (nt->np.dev) {
+                                        spin_unlock_irqrestore(
+                                                              &target_list_lock,
+                                                              flags);
                                         __netpoll_cleanup(&nt->np);
+                                        spin_lock_irqsave(&target_list_lock,
+                                                          flags);
                                         dev_put(nt->np.dev);
                                         nt->np.dev = NULL;
+                                        netconsole_target_put(nt);
+                                        goto restart;
                                 }
                                 /* Fall through */
                         case NETDEV_GOING_DOWN:
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 493b0de3848b..397c36810a15 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -170,6 +170,16 @@ static const struct {
 };
 #undef _R
 
+static const struct rtl_firmware_info {
+        int mac_version;
+        const char *fw_name;
+} rtl_firmware_infos[] = {
+        { .mac_version = RTL_GIGA_MAC_VER_25, .fw_name = FIRMWARE_8168D_1 },
+        { .mac_version = RTL_GIGA_MAC_VER_26, .fw_name = FIRMWARE_8168D_2 },
+        { .mac_version = RTL_GIGA_MAC_VER_29, .fw_name = FIRMWARE_8105E_1 },
+        { .mac_version = RTL_GIGA_MAC_VER_30, .fw_name = FIRMWARE_8105E_1 }
+};
+
 enum cfg_version {
         RTL_CFG_0 = 0x00,
         RTL_CFG_1,
@@ -565,6 +575,7 @@ struct rtl8169_private {
         u32 saved_wolopts;
 
         const struct firmware *fw;
+#define RTL_FIRMWARE_UNKNOWN    ERR_PTR(-EAGAIN);
 };
 
 MODULE_AUTHOR("Realtek and the Linux r8169 crew <netdev@vger.kernel.org>");
@@ -1789,25 +1800,26 @@ rtl_phy_write_fw(struct rtl8169_private *tp, const struct firmware *fw)
 
 static void rtl_release_firmware(struct rtl8169_private *tp)
 {
-        release_firmware(tp->fw);
-        tp->fw = NULL;
+        if (!IS_ERR_OR_NULL(tp->fw))
+                release_firmware(tp->fw);
+        tp->fw = RTL_FIRMWARE_UNKNOWN;
 }
 
-static int rtl_apply_firmware(struct rtl8169_private *tp, const char *fw_name)
+static void rtl_apply_firmware(struct rtl8169_private *tp)
 {
-        const struct firmware **fw = &tp->fw;
-        int rc = !*fw;
-
-        if (rc) {
-                rc = request_firmware(fw, fw_name, &tp->pci_dev->dev);
-                if (rc < 0)
-                        goto out;
-        }
+        const struct firmware *fw = tp->fw;
 
         /* TODO: release firmware once rtl_phy_write_fw signals failures. */
-        rtl_phy_write_fw(tp, *fw);
-out:
-        return rc;
+        if (!IS_ERR_OR_NULL(fw))
+                rtl_phy_write_fw(tp, fw);
+}
+
+static void rtl_apply_firmware_cond(struct rtl8169_private *tp, u8 reg, u16 val)
+{
+        if (rtl_readphy(tp, reg) != val)
+                netif_warn(tp, hw, tp->dev, "chipset not ready for firmware\n");
+        else
+                rtl_apply_firmware(tp);
 }
 
 static void rtl8169s_hw_phy_config(struct rtl8169_private *tp)
@@ -2246,10 +2258,8 @@ static void rtl8168d_1_hw_phy_config(struct rtl8169_private *tp)
 
         rtl_writephy(tp, 0x1f, 0x0005);
         rtl_writephy(tp, 0x05, 0x001b);
-        if ((rtl_readphy(tp, 0x06) != 0xbf00) ||
-            (rtl_apply_firmware(tp, FIRMWARE_8168D_1) < 0)) {
-                netif_warn(tp, probe, tp->dev, "unable to apply firmware patch\n");
-        }
+
+        rtl_apply_firmware_cond(tp, MII_EXPANSION, 0xbf00);
 
         rtl_writephy(tp, 0x1f, 0x0000);
 }
@@ -2351,10 +2361,8 @@ static void rtl8168d_2_hw_phy_config(struct rtl8169_private *tp)
 
         rtl_writephy(tp, 0x1f, 0x0005);
         rtl_writephy(tp, 0x05, 0x001b);
-        if ((rtl_readphy(tp, 0x06) != 0xb300) ||
-            (rtl_apply_firmware(tp, FIRMWARE_8168D_2) < 0)) {
-                netif_warn(tp, probe, tp->dev, "unable to apply firmware patch\n");
-        }
+
+        rtl_apply_firmware_cond(tp, MII_EXPANSION, 0xb300);
 
         rtl_writephy(tp, 0x1f, 0x0000);
 }
@@ -2474,8 +2482,7 @@ static void rtl8105e_hw_phy_config(struct rtl8169_private *tp)
         rtl_writephy(tp, 0x18, 0x0310);
         msleep(100);
 
-        if (rtl_apply_firmware(tp, FIRMWARE_8105E_1) < 0)
-                netif_warn(tp, probe, tp->dev, "unable to apply firmware patch\n");
+        rtl_apply_firmware(tp);
 
         rtl_writephy_batch(tp, phy_reg_init, ARRAY_SIZE(phy_reg_init));
 }
@@ -3237,6 +3244,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         tp->timer.data = (unsigned long) dev;
         tp->timer.function = rtl8169_phy_timer;
 
+        tp->fw = RTL_FIRMWARE_UNKNOWN;
+
         rc = register_netdev(dev);
         if (rc < 0)
                 goto err_out_msi_4;
@@ -3288,10 +3297,10 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
 
         cancel_delayed_work_sync(&tp->task);
 
-        rtl_release_firmware(tp);
-
         unregister_netdev(dev);
 
+        rtl_release_firmware(tp);
+
         if (pci_dev_run_wake(pdev))
                 pm_runtime_get_noresume(&pdev->dev);
 
@@ -3303,6 +3312,37 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
         pci_set_drvdata(pdev, NULL);
 }
 
+static void rtl_request_firmware(struct rtl8169_private *tp)
+{
+        int i;
+
+        /* Return early if the firmware is already loaded / cached. */
+        if (!IS_ERR(tp->fw))
+                goto out;
+
+        for (i = 0; i < ARRAY_SIZE(rtl_firmware_infos); i++) {
+                const struct rtl_firmware_info *info = rtl_firmware_infos + i;
+
+                if (info->mac_version == tp->mac_version) {
+                        const char *name = info->fw_name;
+                        int rc;
+
+                        rc = request_firmware(&tp->fw, name, &tp->pci_dev->dev);
+                        if (rc < 0) {
+                                netif_warn(tp, ifup, tp->dev, "unable to load "
+                                        "firmware patch %s (%d)\n", name, rc);
+                                goto out_disable_request_firmware;
+                        }
+                        goto out;
+                }
+        }
+
+out_disable_request_firmware:
+        tp->fw = NULL;
+out:
+        return;
+}
+
 static int rtl8169_open(struct net_device *dev)
 {
         struct rtl8169_private *tp = netdev_priv(dev);
@@ -3334,11 +3374,13 @@ static int rtl8169_open(struct net_device *dev)
 
         smp_mb();
 
+        rtl_request_firmware(tp);
+
         retval = request_irq(dev->irq, rtl8169_interrupt,
                              (tp->features & RTL_FEATURE_MSI) ? 0 : IRQF_SHARED,
                              dev->name, dev);
         if (retval < 0)
-                goto err_release_ring_2;
+                goto err_release_fw_2;
 
         napi_enable(&tp->napi);
 
@@ -3359,7 +3401,8 @@ static int rtl8169_open(struct net_device *dev)
 out:
         return retval;
 
-err_release_ring_2:
+err_release_fw_2:
+        rtl_release_firmware(tp);
         rtl8169_rx_clear(tp);
 err_free_rx_1:
         dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index b8c5f35577e4..7a5daefb6f33 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -12327,8 +12327,10 @@ static void __devinit tg3_get_eeprom_hw_cfg(struct tg3 *tp)
                 if (val & VCPU_CFGSHDW_ASPM_DBNC)
                         tp->tg3_flags |= TG3_FLAG_ASPM_WORKAROUND;
                 if ((val & VCPU_CFGSHDW_WOL_ENABLE) &&
-                    (val & VCPU_CFGSHDW_WOL_MAGPKT))
+                    (val & VCPU_CFGSHDW_WOL_MAGPKT)) {
                         tp->tg3_flags |= TG3_FLAG_WOL_ENABLE;
+                        device_set_wakeup_enable(&tp->pdev->dev, true);
+                }
                 goto done;
         }
 
@@ -12461,8 +12463,10 @@ static void __devinit tg3_get_eeprom_hw_cfg(struct tg3 *tp)
                         tp->tg3_flags &= ~TG3_FLAG_WOL_CAP;
 
                 if ((tp->tg3_flags & TG3_FLAG_WOL_CAP) &&
-                    (nic_cfg & NIC_SRAM_DATA_CFG_WOL_ENABLE))
+                    (nic_cfg & NIC_SRAM_DATA_CFG_WOL_ENABLE)) {
                         tp->tg3_flags |= TG3_FLAG_WOL_ENABLE;
+                        device_set_wakeup_enable(&tp->pdev->dev, true);
+                }
 
                 if (cfg2 & (1 << 17))
                         tp->phy_flags |= TG3_PHYFLG_CAPACITIVE_COUPLING;
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 341f7056a800..a301479ecc60 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -460,7 +460,7 @@ static const struct driver_info	cdc_info = {
         .manage_power = cdc_manage_power,
 };
 
-static const struct driver_info mbm_info = {
+static const struct driver_info wwan_info = {
         .description =  "Mobile Broadband Network Device",
         .flags =        FLAG_WWAN,
         .bind =         usbnet_cdc_bind,
@@ -471,6 +471,7 @@ static const struct driver_info mbm_info = {
 
 /*-------------------------------------------------------------------------*/
 
+#define HUAWEI_VENDOR_ID        0x12D1
 
 static const struct usb_device_id       products [] = {
 /*
@@ -587,8 +588,17 @@ static const struct usb_device_id	products [] = {
 }, {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MDLM,
                         USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long)&mbm_info,
+        .driver_info = (unsigned long)&wwan_info,
 
+}, {
+        /* Various Huawei modems with a network port like the UMG1831 */
+        .match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
+                 | USB_DEVICE_ID_MATCH_INT_INFO,
+        .idVendor               = HUAWEI_VENDOR_ID,
+        .bInterfaceClass        = USB_CLASS_COMM,
+        .bInterfaceSubClass     = USB_CDC_SUBCLASS_ETHERNET,
+        .bInterfaceProtocol     = 255,
+        .driver_info = (unsigned long)&wwan_info,
 },
         { },            // END
 };
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 967371f04454..1033ef6476a4 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -54,13 +54,13 @@
 #include <linux/usb/usbnet.h>
 #include <linux/usb/cdc.h>
 
-#define DRIVER_VERSION                          "7-Feb-2011"
+#define DRIVER_VERSION                          "23-Apr-2011"
 
 /* CDC NCM subclass 3.2.1 */
 #define USB_CDC_NCM_NDP16_LENGTH_MIN            0x10
 
 /* Maximum NTB length */
-#define CDC_NCM_NTB_MAX_SIZE_TX                 16384   /* bytes */
+#define CDC_NCM_NTB_MAX_SIZE_TX                 (16384 + 4) /* bytes, must be short terminated */
 #define CDC_NCM_NTB_MAX_SIZE_RX                 16384   /* bytes */
 
 /* Minimum value for MaxDatagramSize, ch. 6.2.9 */
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 47a6c870b51f..48d4efdb4959 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -730,7 +730,7 @@ static int smsc95xx_phy_initialize(struct usbnet *dev)
                 msleep(10);
                 bmcr = smsc95xx_mdio_read(dev->net, dev->mii.phy_id, MII_BMCR);
                 timeout++;
-        } while ((bmcr & MII_BMCR) && (timeout < 100));
+        } while ((bmcr & BMCR_RESET) && (timeout < 100));
 
         if (timeout >= 100) {
                 netdev_warn(dev->net, "timeout on PHY Reset");
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 069c1cf0fdf7..009bba3d753e 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -736,6 +736,7 @@ int usbnet_open (struct net_device *net)
                 }
         }
 
+        set_bit(EVENT_DEV_OPEN, &dev->flags);
         netif_start_queue (net);
         netif_info(dev, ifup, dev->net,
                    "open: enable queueing (rx %d, tx %d) mtu %d %s framing\n",
@@ -1259,6 +1260,9 @@ void usbnet_disconnect (struct usb_interface *intf)
         if (dev->driver_info->unbind)
                 dev->driver_info->unbind (dev, intf);
 
+        usb_kill_urb(dev->interrupt);
+        usb_free_urb(dev->interrupt);
+
         free_netdev(net);
         usb_put_dev (xdev);
 }
@@ -1498,6 +1502,10 @@ int usbnet_resume (struct usb_interface *intf)
         int                     retval;
 
         if (!--dev->suspend_count) {
+                /* resume interrupt URBs */
+                if (dev->interrupt && test_bit(EVENT_DEV_OPEN, &dev->flags))
+                        usb_submit_urb(dev->interrupt, GFP_NOIO);
+
                 spin_lock_irq(&dev->txq.lock);
                 while ((res = usb_get_from_anchor(&dev->deferred))) {
 
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 2de9b90c5f8f..3b99f64104fd 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -403,6 +403,17 @@ static int veth_newlink(struct net *src_net, struct net_device *dev,
         if (tb[IFLA_ADDRESS] == NULL)
                 random_ether_addr(dev->dev_addr);
 
+        if (tb[IFLA_IFNAME])
+                nla_strlcpy(dev->name, tb[IFLA_IFNAME], IFNAMSIZ);
+        else
+                snprintf(dev->name, IFNAMSIZ, DRV_NAME "%%d");
+
+        if (strchr(dev->name, '%')) {
+                err = dev_alloc_name(dev, dev->name);
+                if (err < 0)
+                        goto err_alloc_name;
+        }
+
         err = register_netdevice(dev);
         if (err < 0)
                 goto err_register_dev;
@@ -422,6 +433,7 @@ static int veth_newlink(struct net *src_net, struct net_device *dev,
 
 err_register_dev:
         /* nothing to do */
+err_alloc_name:
 err_configure_peer:
         unregister_netdevice(peer);
         return err;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index dcd19bc337d1..b29c80def35e 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -506,7 +506,7 @@ bool ath_stoprecv(struct ath_softc *sc)
                         "confusing the DMA engine when we start RX up\n");
                 ATH_DBG_WARN_ON_ONCE(!stopped);
         }
-        return stopped || reset;
+        return stopped && !reset;
 }
 
 void ath_flushrecv(struct ath_softc *sc)
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index d59b0168c14a..5af40d9170a0 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -72,6 +72,7 @@ MODULE_FIRMWARE("b43/ucode11.fw");
 MODULE_FIRMWARE("b43/ucode13.fw");
 MODULE_FIRMWARE("b43/ucode14.fw");
 MODULE_FIRMWARE("b43/ucode15.fw");
+MODULE_FIRMWARE("b43/ucode16_mimo.fw");
 MODULE_FIRMWARE("b43/ucode5.fw");
 MODULE_FIRMWARE("b43/ucode9.fw");
 
diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-tx.c b/drivers/net/wireless/iwlegacy/iwl-4965-tx.c
index 5c40502f869a..79ac081832fb 100644
--- a/drivers/net/wireless/iwlegacy/iwl-4965-tx.c
+++ b/drivers/net/wireless/iwlegacy/iwl-4965-tx.c
@@ -316,12 +316,18 @@ int iwl4965_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         hdr_len = ieee80211_hdrlen(fc);
 
-        /* Find index into station table for destination station */
-        sta_id = iwl_legacy_sta_id_or_broadcast(priv, ctx, info->control.sta);
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
-                               hdr->addr1);
-                goto drop_unlock;
+        /* For management frames use broadcast id to do not break aggregation */
+        if (!ieee80211_is_data(fc))
+                sta_id = ctx->bcast_sta_id;
+        else {
+                /* Find index into station table for destination station */
+                sta_id = iwl_legacy_sta_id_or_broadcast(priv, ctx, info->control.sta);
+
+                if (sta_id == IWL_INVALID_STATION) {
+                        IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
+                                       hdr->addr1);
+                        goto drop_unlock;
+                }
         }
 
         IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
@@ -1127,12 +1133,16 @@ int iwl4965_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
              q->read_ptr = iwl_legacy_queue_inc_wrap(q->read_ptr, q->n_bd)) {
 
                 tx_info = &txq->txb[txq->q.read_ptr];
-                iwl4965_tx_status(priv, tx_info,
-                                 txq_id >= IWL4965_FIRST_AMPDU_QUEUE);
+
+                if (WARN_ON_ONCE(tx_info->skb == NULL))
+                        continue;
 
                 hdr = (struct ieee80211_hdr *)tx_info->skb->data;
-                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                if (ieee80211_is_data_qos(hdr->frame_control))
                         nfreed++;
+
+                iwl4965_tx_status(priv, tx_info,
+                                 txq_id >= IWL4965_FIRST_AMPDU_QUEUE);
                 tx_info->skb = NULL;
 
                 priv->cfg->ops->lib->txq_free_tfd(priv, txq);
diff --git a/drivers/net/wireless/iwlegacy/iwl-led.c b/drivers/net/wireless/iwlegacy/iwl-led.c
index 15eb8b707157..bda0d61b2c0d 100644
--- a/drivers/net/wireless/iwlegacy/iwl-led.c
+++ b/drivers/net/wireless/iwlegacy/iwl-led.c
@@ -48,8 +48,21 @@ module_param(led_mode, int, S_IRUGO);
 MODULE_PARM_DESC(led_mode, "0=system default, "
                 "1=On(RF On)/Off(RF Off), 2=blinking");
 
+/* Throughput           OFF time(ms)    ON time (ms)
+ *      >300                    25              25
+ *      >200 to 300             40              40
+ *      >100 to 200             55              55
+ *      >70 to 100              65              65
+ *      >50 to 70               75              75
+ *      >20 to 50               85              85
+ *      >10 to 20               95              95
+ *      >5 to 10                110             110
+ *      >1 to 5                 130             130
+ *      >0 to 1                 167             167
+ *      <=0                                     SOLID ON
+ */
 static const struct ieee80211_tpt_blink iwl_blink[] = {
-        { .throughput = 0 * 1024 - 1, .blink_time = 334 },
+        { .throughput = 0, .blink_time = 334 },
         { .throughput = 1 * 1024 - 1, .blink_time = 260 },
         { .throughput = 5 * 1024 - 1, .blink_time = 220 },
         { .throughput = 10 * 1024 - 1, .blink_time = 190 },
@@ -101,6 +114,11 @@ static int iwl_legacy_led_cmd(struct iwl_priv *priv,
         if (priv->blink_on == on && priv->blink_off == off)
                 return 0;
 
+        if (off == 0) {
+                /* led is SOLID_ON */
+                on = IWL_LED_SOLID;
+        }
+
         IWL_DEBUG_LED(priv, "Led blink time compensation=%u\n",
                         priv->cfg->base_params->led_compensation);
         led_cmd.on = iwl_legacy_blink_compensation(priv, on,
diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c
index d484c3678163..a62fe24ee594 100644
--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
@@ -2984,15 +2984,15 @@ static void iwl4965_bg_txpower_work(struct work_struct *work)
         struct iwl_priv *priv = container_of(work, struct iwl_priv,
                         txpower_work);
 
+        mutex_lock(&priv->mutex);
+
         /* If a scan happened to start before we got here
          * then just return; the statistics notification will
          * kick off another scheduled work to compensate for
          * any temperature delta we missed here. */
         if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
             test_bit(STATUS_SCANNING, &priv->status))
-                return;
-
-        mutex_lock(&priv->mutex);
+                goto out;
 
         /* Regardless of if we are associated, we must reconfigure the
          * TX power since frames can be sent on non-radar channels while
@@ -3002,7 +3002,7 @@ static void iwl4965_bg_txpower_work(struct work_struct *work)
         /* Update last_temperature to keep is_calib_needed from running
          * when it isn't needed... */
         priv->last_temperature = priv->temperature;
-
+out:
         mutex_unlock(&priv->mutex);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
index dfdbea6e8f99..fbbde0712fa5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
@@ -335,7 +335,6 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
         struct ieee80211_channel *channel = conf->channel;
         const struct iwl_channel_info *ch_info;
         int ret = 0;
-        bool ht_changed[NUM_IWL_RXON_CTX] = {};
 
         IWL_DEBUG_MAC80211(priv, "changed %#x", changed);
 
@@ -383,10 +382,8 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
 
                 for_each_context(priv, ctx) {
                         /* Configure HT40 channels */
-                        if (ctx->ht.enabled != conf_is_ht(conf)) {
+                        if (ctx->ht.enabled != conf_is_ht(conf))
                                 ctx->ht.enabled = conf_is_ht(conf);
-                                ht_changed[ctx->ctxid] = true;
-                        }
 
                         if (ctx->ht.enabled) {
                                 if (conf_is_ht40_minus(conf)) {
@@ -455,8 +452,6 @@ int iwlagn_mac_config(struct ieee80211_hw *hw, u32 changed)
                 if (!memcmp(&ctx->staging, &ctx->active, sizeof(ctx->staging)))
                         continue;
                 iwlagn_commit_rxon(priv, ctx);
-                if (ht_changed[ctx->ctxid])
-                        iwlagn_update_qos(priv, ctx);
         }
  out:
         mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index a709d05c5868..0712b67283a4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -568,12 +568,17 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
         hdr_len = ieee80211_hdrlen(fc);
 
-        /* Find index into station table for destination station */
-        sta_id = iwl_sta_id_or_broadcast(priv, ctx, info->control.sta);
-        if (sta_id == IWL_INVALID_STATION) {
-                IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
-                               hdr->addr1);
-                goto drop_unlock;
+        /* For management frames use broadcast id to do not break aggregation */
+        if (!ieee80211_is_data(fc))
+                sta_id = ctx->bcast_sta_id;
+        else {
+                /* Find index into station table for destination station */
+                sta_id = iwl_sta_id_or_broadcast(priv, ctx, info->control.sta);
+                if (sta_id == IWL_INVALID_STATION) {
+                        IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
+                                       hdr->addr1);
+                        goto drop_unlock;
+                }
         }
 
         IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
@@ -1224,12 +1229,16 @@ int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
 
                 tx_info = &txq->txb[txq->q.read_ptr];
-                iwlagn_tx_status(priv, tx_info,
-                                 txq_id >= IWLAGN_FIRST_AMPDU_QUEUE);
+
+                if (WARN_ON_ONCE(tx_info->skb == NULL))
+                        continue;
 
                 hdr = (struct ieee80211_hdr *)tx_info->skb->data;
-                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                if (ieee80211_is_data_qos(hdr->frame_control))
                         nfreed++;
+
+                iwlagn_tx_status(priv, tx_info,
+                                 txq_id >= IWLAGN_FIRST_AMPDU_QUEUE);
                 tx_info->skb = NULL;
 
                 if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index fe77e8223841..e8c19def1b0f 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -173,7 +173,7 @@ static int pcmcia_access_config(struct pcmcia_device *p_dev,
         c = p_dev->function_config;
 
         if (!(c->state & CONFIG_LOCKED)) {
-                dev_dbg(&p_dev->dev, "Configuration isn't't locked\n");
+                dev_dbg(&p_dev->dev, "Configuration isn't locked\n");
                 mutex_unlock(&s->ops_mutex);
                 return -EACCES;
         }
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index 5f2dd386152b..2c1abf63957f 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -585,8 +585,9 @@ static bool eeepc_wlan_rfkill_blocked(struct eeepc_laptop *eeepc)
         return true;
 }
 
-static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc)
+static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc, acpi_handle handle)
 {
+        struct pci_dev *port;
         struct pci_dev *dev;
         struct pci_bus *bus;
         bool blocked = eeepc_wlan_rfkill_blocked(eeepc);
@@ -599,9 +600,16 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc)
         mutex_lock(&eeepc->hotplug_lock);
 
         if (eeepc->hotplug_slot) {
-                bus = pci_find_bus(0, 1);
+                port = acpi_get_pci_dev(handle);
+                if (!port) {
+                        pr_warning("Unable to find port\n");
+                        goto out_unlock;
+                }
+
+                bus = port->subordinate;
+
                 if (!bus) {
-                        pr_warning("Unable to find PCI bus 1?\n");
+                        pr_warning("Unable to find PCI bus?\n");
                         goto out_unlock;
                 }
 
@@ -609,6 +617,7 @@ static void eeepc_rfkill_hotplug(struct eeepc_laptop *eeepc)
                         pr_err("Unable to read PCI config space?\n");
                         goto out_unlock;
                 }
+
                 absent = (l == 0xffffffff);
 
                 if (blocked != absent) {
@@ -647,6 +656,17 @@ out_unlock:
         mutex_unlock(&eeepc->hotplug_lock);
 }
 
+static void eeepc_rfkill_hotplug_update(struct eeepc_laptop *eeepc, char *node)
+{
+        acpi_status status = AE_OK;
+        acpi_handle handle;
+
+        status = acpi_get_handle(NULL, node, &handle);
+
+        if (ACPI_SUCCESS(status))
+                eeepc_rfkill_hotplug(eeepc, handle);
+}
+
 static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
 {
         struct eeepc_laptop *eeepc = data;
@@ -654,7 +674,7 @@ static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
         if (event != ACPI_NOTIFY_BUS_CHECK)
                 return;
 
-        eeepc_rfkill_hotplug(eeepc);
+        eeepc_rfkill_hotplug(eeepc, handle);
 }
 
 static int eeepc_register_rfkill_notifier(struct eeepc_laptop *eeepc,
@@ -672,6 +692,11 @@ static int eeepc_register_rfkill_notifier(struct eeepc_laptop *eeepc,
                                                      eeepc);
                 if (ACPI_FAILURE(status))
                         pr_warning("Failed to register notify on %s\n", node);
+                /*
+                 * Refresh pci hotplug in case the rfkill state was
+                 * changed during setup.
+                 */
+                eeepc_rfkill_hotplug(eeepc, handle);
         } else
                 return -ENODEV;
 
@@ -693,6 +718,12 @@ static void eeepc_unregister_rfkill_notifier(struct eeepc_laptop *eeepc,
                 if (ACPI_FAILURE(status))
                         pr_err("Error removing rfkill notify handler %s\n",
                                 node);
+                        /*
+                         * Refresh pci hotplug in case the rfkill
+                         * state was changed after
+                         * eeepc_unregister_rfkill_notifier()
+                         */
+                eeepc_rfkill_hotplug(eeepc, handle);
         }
 }
 
@@ -816,11 +847,7 @@ static void eeepc_rfkill_exit(struct eeepc_laptop *eeepc)
                 rfkill_destroy(eeepc->wlan_rfkill);
                 eeepc->wlan_rfkill = NULL;
         }
-        /*
-         * Refresh pci hotplug in case the rfkill state was changed after
-         * eeepc_unregister_rfkill_notifier()
-         */
-        eeepc_rfkill_hotplug(eeepc);
+
         if (eeepc->hotplug_slot)
                 pci_hp_deregister(eeepc->hotplug_slot);
 
@@ -889,11 +916,6 @@ static int eeepc_rfkill_init(struct eeepc_laptop *eeepc)
         eeepc_register_rfkill_notifier(eeepc, "\\_SB.PCI0.P0P5");
         eeepc_register_rfkill_notifier(eeepc, "\\_SB.PCI0.P0P6");
         eeepc_register_rfkill_notifier(eeepc, "\\_SB.PCI0.P0P7");
-        /*
-         * Refresh pci hotplug in case the rfkill state was changed during
-         * setup.
-         */
-        eeepc_rfkill_hotplug(eeepc);
 
 exit:
         if (result && result != -ENODEV)
@@ -928,8 +950,11 @@ static int eeepc_hotk_restore(struct device *device)
         struct eeepc_laptop *eeepc = dev_get_drvdata(device);
 
         /* Refresh both wlan rfkill state and pci hotplug */
-        if (eeepc->wlan_rfkill)
-                eeepc_rfkill_hotplug(eeepc);
+        if (eeepc->wlan_rfkill) {
+                eeepc_rfkill_hotplug_update(eeepc, "\\_SB.PCI0.P0P5");
+                eeepc_rfkill_hotplug_update(eeepc, "\\_SB.PCI0.P0P6");
+                eeepc_rfkill_hotplug_update(eeepc, "\\_SB.PCI0.P0P7");
+        }
 
         if (eeepc->bluetooth_rfkill)
                 rfkill_set_sw_state(eeepc->bluetooth_rfkill,
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index 8f709aec4da0..6fe8cd6e23b5 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -934,6 +934,14 @@ static ssize_t sony_nc_sysfs_store(struct device *dev,
 /*
  * Backlight device
  */
+struct sony_backlight_props {
+        struct backlight_device *dev;
+        int                     handle;
+        u8                      offset;
+        u8                      maxlvl;
+};
+struct sony_backlight_props sony_bl_props;
+
 static int sony_backlight_update_status(struct backlight_device *bd)
 {
         return acpi_callsetfunc(sony_nc_acpi_handle, "SBRT",
@@ -954,21 +962,26 @@ static int sony_nc_get_brightness_ng(struct backlight_device *bd)
 {
         int result;
         int *handle = (int *)bl_get_data(bd);
+        struct sony_backlight_props *sdev =
+                (struct sony_backlight_props *)bl_get_data(bd);
 
-        sony_call_snc_handle(*handle, 0x0200, &result);
+        sony_call_snc_handle(sdev->handle, 0x0200, &result);
 
-        return result & 0xff;
+        return (result & 0xff) - sdev->offset;
 }
 
 static int sony_nc_update_status_ng(struct backlight_device *bd)
 {
         int value, result;
         int *handle = (int *)bl_get_data(bd);
+        struct sony_backlight_props *sdev =
+                (struct sony_backlight_props *)bl_get_data(bd);
 
-        value = bd->props.brightness;
-        sony_call_snc_handle(*handle, 0x0100 | (value << 16), &result);
+        value = bd->props.brightness + sdev->offset;
+        if (sony_call_snc_handle(sdev->handle, 0x0100 | (value << 16), &result))
+                return -EIO;
 
-        return sony_nc_get_brightness_ng(bd);
+        return value;
 }
 
 static const struct backlight_ops sony_backlight_ops = {
@@ -981,8 +994,6 @@ static const struct backlight_ops sony_backlight_ng_ops = {
         .update_status = sony_nc_update_status_ng,
         .get_brightness = sony_nc_get_brightness_ng,
 };
-static int backlight_ng_handle;
-static struct backlight_device *sony_backlight_device;
 
 /*
  * New SNC-only Vaios event mapping to driver known keys
@@ -1549,6 +1560,75 @@ static void sony_nc_kbd_backlight_resume(void)
                                 &ignore);
 }
 
+static void sony_nc_backlight_ng_read_limits(int handle,
+                struct sony_backlight_props *props)
+{
+        int offset;
+        acpi_status status;
+        u8 brlvl, i;
+        u8 min = 0xff, max = 0x00;
+        struct acpi_object_list params;
+        union acpi_object in_obj;
+        union acpi_object *lvl_enum;
+        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+
+        props->handle = handle;
+        props->offset = 0;
+        props->maxlvl = 0xff;
+
+        offset = sony_find_snc_handle(handle);
+        if (offset < 0)
+                return;
+
+        /* try to read the boundaries from ACPI tables, if we fail the above
+         * defaults should be reasonable
+         */
+        params.count = 1;
+        params.pointer = &in_obj;
+        in_obj.type = ACPI_TYPE_INTEGER;
+        in_obj.integer.value = offset;
+        status = acpi_evaluate_object(sony_nc_acpi_handle, "SN06", &params,
+                        &buffer);
+        if (ACPI_FAILURE(status))
+                return;
+
+        lvl_enum = (union acpi_object *) buffer.pointer;
+        if (!lvl_enum) {
+                pr_err("No SN06 return object.");
+                return;
+        }
+        if (lvl_enum->type != ACPI_TYPE_BUFFER) {
+                pr_err("Invalid SN06 return object 0x%.2x\n",
+                       lvl_enum->type);
+                goto out_invalid;
+        }
+
+        /* the buffer lists brightness levels available, brightness levels are
+         * from 0 to 8 in the array, other values are used by ALS control.
+         */
+        for (i = 0; i < 9 && i < lvl_enum->buffer.length; i++) {
+
+                brlvl = *(lvl_enum->buffer.pointer + i);
+                dprintk("Brightness level: %d\n", brlvl);
+
+                if (!brlvl)
+                        break;
+
+                if (brlvl > max)
+                        max = brlvl;
+                if (brlvl < min)
+                        min = brlvl;
+        }
+        props->offset = min;
+        props->maxlvl = max;
+        dprintk("Brightness levels: min=%d max=%d\n", props->offset,
+                        props->maxlvl);
+
+out_invalid:
+        kfree(buffer.pointer);
+        return;
+}
+
 static void sony_nc_backlight_setup(void)
 {
         acpi_handle unused;
@@ -1557,14 +1637,14 @@ static void sony_nc_backlight_setup(void)
         struct backlight_properties props;
 
         if (sony_find_snc_handle(0x12f) != -1) {
-                backlight_ng_handle = 0x12f;
                 ops = &sony_backlight_ng_ops;
-                max_brightness = 0xff;
+                sony_nc_backlight_ng_read_limits(0x12f, &sony_bl_props);
+                max_brightness = sony_bl_props.maxlvl - sony_bl_props.offset;
 
         } else if (sony_find_snc_handle(0x137) != -1) {
-                backlight_ng_handle = 0x137;
                 ops = &sony_backlight_ng_ops;
-                max_brightness = 0xff;
+                sony_nc_backlight_ng_read_limits(0x137, &sony_bl_props);
+                max_brightness = sony_bl_props.maxlvl - sony_bl_props.offset;
 
         } else if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle, "GBRT",
                                                 &unused))) {
@@ -1577,22 +1657,22 @@ static void sony_nc_backlight_setup(void)
         memset(&props, 0, sizeof(struct backlight_properties));
         props.type = BACKLIGHT_PLATFORM;
         props.max_brightness = max_brightness;
-        sony_backlight_device = backlight_device_register("sony", NULL,
-                                                          &backlight_ng_handle,
-                                                          ops, &props);
+        sony_bl_props.dev = backlight_device_register("sony", NULL,
+                                                      &sony_bl_props,
+                                                      ops, &props);
 
-        if (IS_ERR(sony_backlight_device)) {
-                pr_warning(DRV_PFX "unable to register backlight device\n");
-                sony_backlight_device = NULL;
+        if (IS_ERR(sony_bl_props.dev)) {
+                pr_warn(DRV_PFX "unable to register backlight device\n");
+                sony_bl_props.dev = NULL;
         } else
-                sony_backlight_device->props.brightness =
-                    ops->get_brightness(sony_backlight_device);
+                sony_bl_props.dev->props.brightness =
+                        ops->get_brightness(sony_bl_props.dev);
 }
 
 static void sony_nc_backlight_cleanup(void)
 {
-        if (sony_backlight_device)
-                backlight_device_unregister(sony_backlight_device);
+        if (sony_bl_props.dev)
+                backlight_device_unregister(sony_bl_props.dev);
 }
 
 static int sony_nc_add(struct acpi_device *device)
@@ -2590,7 +2670,7 @@ static long sonypi_misc_ioctl(struct file *fp, unsigned int cmd,
         mutex_lock(&spic_dev.lock);
         switch (cmd) {
         case SONYPI_IOCGBRT:
-                if (sony_backlight_device == NULL) {
+                if (sony_bl_props.dev == NULL) {
                         ret = -EIO;
                         break;
                 }
@@ -2603,7 +2683,7 @@ static long sonypi_misc_ioctl(struct file *fp, unsigned int cmd,
                                 ret = -EFAULT;
                 break;
         case SONYPI_IOCSBRT:
-                if (sony_backlight_device == NULL) {
+                if (sony_bl_props.dev == NULL) {
                         ret = -EIO;
                         break;
                 }
@@ -2617,8 +2697,8 @@ static long sonypi_misc_ioctl(struct file *fp, unsigned int cmd,
                         break;
                 }
                 /* sync the backlight device status */
-                sony_backlight_device->props.brightness =
-                    sony_backlight_get_brightness(sony_backlight_device);
+                sony_bl_props.dev->props.brightness =
+                    sony_backlight_get_brightness(sony_bl_props.dev);
                 break;
         case SONYPI_IOCGBAT1CAP:
                 if (ec_read16(SONYPI_BAT1_FULL, &val16)) {
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index efb3b6b9bcdb..562fcf0dd2b5 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -128,7 +128,8 @@ enum {
 };
 
 /* ACPI HIDs */
-#define TPACPI_ACPI_HKEY_HID            "IBM0068"
+#define TPACPI_ACPI_IBM_HKEY_HID        "IBM0068"
+#define TPACPI_ACPI_LENOVO_HKEY_HID     "LEN0068"
 #define TPACPI_ACPI_EC_HID              "PNP0C09"
 
 /* Input IDs */
@@ -3879,7 +3880,8 @@ errexit:
 }
 
 static const struct acpi_device_id ibm_htk_device_ids[] = {
-        {TPACPI_ACPI_HKEY_HID, 0},
+        {TPACPI_ACPI_IBM_HKEY_HID, 0},
+        {TPACPI_ACPI_LENOVO_HKEY_HID, 0},
         {"", 0},
 };
 
diff --git a/drivers/rtc/rtc-max8925.c b/drivers/rtc/rtc-max8925.c
index 174036dda786..20494b5edc3c 100644
--- a/drivers/rtc/rtc-max8925.c
+++ b/drivers/rtc/rtc-max8925.c
@@ -257,6 +257,8 @@ static int __devinit max8925_rtc_probe(struct platform_device *pdev)
                 goto out_irq;
         }
 
+        dev_set_drvdata(&pdev->dev, info);
+
         info->rtc_dev = rtc_device_register("max8925-rtc", &pdev->dev,
                                         &max8925_rtc_ops, THIS_MODULE);
         ret = PTR_ERR(info->rtc_dev);
@@ -265,7 +267,6 @@ static int __devinit max8925_rtc_probe(struct platform_device *pdev)
                 goto out_rtc;
         }
 
-        dev_set_drvdata(&pdev->dev, info);
         platform_set_drvdata(pdev, info);
 
         return 0;
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 4d2df2f76ea0..475e603fc584 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2314,15 +2314,14 @@ static void dasd_flush_request_queue(struct dasd_block *block)
 
 static int dasd_open(struct block_device *bdev, fmode_t mode)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
         struct dasd_device *base;
         int rc;
 
-        if (!block)
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
                 return -ENODEV;
 
-        base = block->base;
-        atomic_inc(&block->open_count);
+        atomic_inc(&base->block->open_count);
         if (test_bit(DASD_FLAG_OFFLINE, &base->flags)) {
                 rc = -ENODEV;
                 goto unlock;
@@ -2355,21 +2354,28 @@ static int dasd_open(struct block_device *bdev, fmode_t mode)
                 goto out;
         }
 
+        dasd_put_device(base);
         return 0;
 
 out:
         module_put(base->discipline->owner);
 unlock:
-        atomic_dec(&block->open_count);
+        atomic_dec(&base->block->open_count);
+        dasd_put_device(base);
         return rc;
 }
 
 static int dasd_release(struct gendisk *disk, fmode_t mode)
 {
-        struct dasd_block *block = disk->private_data;
+        struct dasd_device *base;
 
-        atomic_dec(&block->open_count);
-        module_put(block->base->discipline->owner);
+        base = dasd_device_from_gendisk(disk);
+        if (!base)
+                return -ENODEV;
+
+        atomic_dec(&base->block->open_count);
+        module_put(base->discipline->owner);
+        dasd_put_device(base);
         return 0;
 }
 
@@ -2378,20 +2384,20 @@ static int dasd_release(struct gendisk *disk, fmode_t mode)
  */
 static int dasd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 {
-        struct dasd_block *block;
         struct dasd_device *base;
 
-        block = bdev->bd_disk->private_data;
-        if (!block)
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
                 return -ENODEV;
-        base = block->base;
 
         if (!base->discipline ||
-            !base->discipline->fill_geometry)
+            !base->discipline->fill_geometry) {
+                dasd_put_device(base);
                 return -EINVAL;
-
-        base->discipline->fill_geometry(block, geo);
-        geo->start = get_start_sect(bdev) >> block->s2b_shift;
+        }
+        base->discipline->fill_geometry(base->block, geo);
+        geo->start = get_start_sect(bdev) >> base->block->s2b_shift;
+        dasd_put_device(base);
         return 0;
 }
 
@@ -2528,7 +2534,6 @@ void dasd_generic_remove(struct ccw_device *cdev)
         dasd_set_target_state(device, DASD_STATE_NEW);
         /* dasd_delete_device destroys the device reference. */
         block = device->block;
-        device->block = NULL;
         dasd_delete_device(device);
         /*
          * life cycle of block is bound to device, so delete it after
@@ -2650,7 +2655,6 @@ int dasd_generic_set_offline(struct ccw_device *cdev)
         dasd_set_target_state(device, DASD_STATE_NEW);
         /* dasd_delete_device destroys the device reference. */
         block = device->block;
-        device->block = NULL;
         dasd_delete_device(device);
         /*
          * life cycle of block is bound to device, so delete it after
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index 42e1bf35f689..d71511c7850a 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -674,6 +674,36 @@ dasd_device_from_cdev(struct ccw_device *cdev)
         return device;
 }
 
+void dasd_add_link_to_gendisk(struct gendisk *gdp, struct dasd_device *device)
+{
+        struct dasd_devmap *devmap;
+
+        devmap = dasd_find_busid(dev_name(&device->cdev->dev));
+        if (IS_ERR(devmap))
+                return;
+        spin_lock(&dasd_devmap_lock);
+        gdp->private_data = devmap;
+        spin_unlock(&dasd_devmap_lock);
+}
+
+struct dasd_device *dasd_device_from_gendisk(struct gendisk *gdp)
+{
+        struct dasd_device *device;
+        struct dasd_devmap *devmap;
+
+        if (!gdp->private_data)
+                return NULL;
+        device = NULL;
+        spin_lock(&dasd_devmap_lock);
+        devmap = gdp->private_data;
+        if (devmap && devmap->device) {
+                device = devmap->device;
+                dasd_get_device(device);
+        }
+        spin_unlock(&dasd_devmap_lock);
+        return device;
+}
+
 /*
  * SECTION: files in sysfs
  */
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index 29143eda9dd9..85dddb1e4126 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -239,7 +239,6 @@ static void dasd_ext_handler(unsigned int ext_int_code,
         addr_t ip;
         int rc;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_DSD]++;
         switch (ext_int_code >> 24) {
         case DASD_DIAG_CODE_31BIT:
                 ip = (addr_t) param32;
@@ -250,6 +249,7 @@ static void dasd_ext_handler(unsigned int ext_int_code,
         default:
                 return;
         }
+        kstat_cpu(smp_processor_id()).irqs[EXTINT_DSD]++;
         if (!ip) {              /* no intparm: unsolicited interrupt */
                 DBF_EVENT(DBF_NOTICE, "%s", "caught unsolicited "
                               "interrupt");
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index db8005d9f2fd..3ebdf5f92f8f 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -2037,7 +2037,7 @@ static void dasd_eckd_check_for_device_change(struct dasd_device *device,
                 return;
 
         /* summary unit check */
-        if ((sense[7] == 0x0D) &&
+        if ((sense[27] & DASD_SENSE_BIT_0) && (sense[7] == 0x0D) &&
             (scsw_dstat(&irb->scsw) & DEV_STAT_UNIT_CHECK)) {
                 dasd_alias_handle_summary_unit_check(device, irb);
                 return;
@@ -2053,7 +2053,8 @@ static void dasd_eckd_check_for_device_change(struct dasd_device *device,
         /* loss of device reservation is handled via base devices only
          * as alias devices may be used with several bases
          */
-        if (device->block && (sense[7] == 0x3F) &&
+        if (device->block && (sense[27] & DASD_SENSE_BIT_0) &&
+            (sense[7] == 0x3F) &&
             (scsw_dstat(&irb->scsw) & DEV_STAT_UNIT_CHECK) &&
             test_bit(DASD_FLAG_IS_RESERVED, &device->flags)) {
                 if (device->features & DASD_FEATURE_FAILONSLCK)
diff --git a/drivers/s390/block/dasd_genhd.c b/drivers/s390/block/dasd_genhd.c
index 5505bc07e1e7..19a1ff03d65e 100644
--- a/drivers/s390/block/dasd_genhd.c
+++ b/drivers/s390/block/dasd_genhd.c
@@ -73,7 +73,7 @@ int dasd_gendisk_alloc(struct dasd_block *block)
         if (base->features & DASD_FEATURE_READONLY ||
             test_bit(DASD_FLAG_DEVICE_RO, &base->flags))
                 set_disk_ro(gdp, 1);
-        gdp->private_data = block;
+        dasd_add_link_to_gendisk(gdp, base);
         gdp->queue = block->request_queue;
         block->gdp = gdp;
         set_capacity(block->gdp, 0);
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index df9f6999411d..d1e4f2c1264c 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -686,6 +686,9 @@ struct dasd_device *dasd_device_from_cdev(struct ccw_device *);
 struct dasd_device *dasd_device_from_cdev_locked(struct ccw_device *);
 struct dasd_device *dasd_device_from_devindex(int);
 
+void dasd_add_link_to_gendisk(struct gendisk *, struct dasd_device *);
+struct dasd_device *dasd_device_from_gendisk(struct gendisk *);
+
 int dasd_parse(void);
 int dasd_busid_known(const char *);
 
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index 26075e95b1ba..72261e4c516d 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -42,16 +42,22 @@ dasd_ioctl_api_version(void __user *argp)
 static int
 dasd_ioctl_enable(struct block_device *bdev)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_device *base;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
-        dasd_enable_device(block->base);
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+
+        dasd_enable_device(base);
         /* Formatting the dasd device can change the capacity. */
         mutex_lock(&bdev->bd_mutex);
-        i_size_write(bdev->bd_inode, (loff_t)get_capacity(block->gdp) << 9);
+        i_size_write(bdev->bd_inode,
+                     (loff_t)get_capacity(base->block->gdp) << 9);
         mutex_unlock(&bdev->bd_mutex);
+        dasd_put_device(base);
         return 0;
 }
 
@@ -62,11 +68,14 @@ dasd_ioctl_enable(struct block_device *bdev)
 static int
 dasd_ioctl_disable(struct block_device *bdev)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_device *base;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
         /*
          * Man this is sick. We don't do a real disable but only downgrade
          * the device to DASD_STATE_BASIC. The reason is that dasdfmt uses
@@ -75,7 +84,7 @@ dasd_ioctl_disable(struct block_device *bdev)
          * using the BIODASDFMT ioctl. Therefore the correct state for the
          * device is DASD_STATE_BASIC that allows to do basic i/o.
          */
-        dasd_set_target_state(block->base, DASD_STATE_BASIC);
+        dasd_set_target_state(base, DASD_STATE_BASIC);
         /*
          * Set i_size to zero, since read, write, etc. check against this
          * value.
@@ -83,6 +92,7 @@ dasd_ioctl_disable(struct block_device *bdev)
         mutex_lock(&bdev->bd_mutex);
         i_size_write(bdev->bd_inode, 0);
         mutex_unlock(&bdev->bd_mutex);
+        dasd_put_device(base);
         return 0;
 }
 
@@ -191,26 +201,36 @@ static int dasd_format(struct dasd_block *block, struct format_data_t *fdata)
 static int
 dasd_ioctl_format(struct block_device *bdev, void __user *argp)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_device *base;
         struct format_data_t fdata;
+        int rc;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
         if (!argp)
                 return -EINVAL;
-
-        if (block->base->features & DASD_FEATURE_READONLY ||
-            test_bit(DASD_FLAG_DEVICE_RO, &block->base->flags))
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+        if (base->features & DASD_FEATURE_READONLY ||
+            test_bit(DASD_FLAG_DEVICE_RO, &base->flags)) {
+                dasd_put_device(base);
                 return -EROFS;
-        if (copy_from_user(&fdata, argp, sizeof(struct format_data_t)))
+        }
+        if (copy_from_user(&fdata, argp, sizeof(struct format_data_t))) {
+                dasd_put_device(base);
                 return -EFAULT;
+        }
         if (bdev != bdev->bd_contains) {
                 pr_warning("%s: The specified DASD is a partition and cannot "
                            "be formatted\n",
-                           dev_name(&block->base->cdev->dev));
+                           dev_name(&base->cdev->dev));
+                dasd_put_device(base);
                 return -EINVAL;
         }
-        return dasd_format(block, &fdata);
+        rc = dasd_format(base->block, &fdata);
+        dasd_put_device(base);
+        return rc;
 }
 
 #ifdef CONFIG_DASD_PROFILE
@@ -340,8 +360,8 @@ static int dasd_ioctl_information(struct dasd_block *block,
 static int
 dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
 {
-        struct dasd_block *block =  bdev->bd_disk->private_data;
-        int intval;
+        struct dasd_device *base;
+        int intval, rc;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
@@ -350,10 +370,17 @@ dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
                 return -EINVAL;
         if (get_user(intval, (int __user *)argp))
                 return -EFAULT;
-        if (!intval && test_bit(DASD_FLAG_DEVICE_RO, &block->base->flags))
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+        if (!intval && test_bit(DASD_FLAG_DEVICE_RO, &base->flags)) {
+                dasd_put_device(base);
                 return -EROFS;
+        }
         set_disk_ro(bdev->bd_disk, intval);
-        return dasd_set_feature(block->base->cdev, DASD_FEATURE_READONLY, intval);
+        rc = dasd_set_feature(base->cdev, DASD_FEATURE_READONLY, intval);
+        dasd_put_device(base);
+        return rc;
 }
 
 static int dasd_ioctl_readall_cmb(struct dasd_block *block, unsigned int cmd,
@@ -372,59 +399,78 @@ static int dasd_ioctl_readall_cmb(struct dasd_block *block, unsigned int cmd,
 int dasd_ioctl(struct block_device *bdev, fmode_t mode,
                unsigned int cmd, unsigned long arg)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_block *block;
+        struct dasd_device *base;
         void __user *argp;
+        int rc;
 
         if (is_compat_task())
                 argp = compat_ptr(arg);
         else
                 argp = (void __user *)arg;
 
-        if (!block)
-                return -ENODEV;
-
         if ((_IOC_DIR(cmd) != _IOC_NONE) && !arg) {
                 PRINT_DEBUG("empty data ptr");
                 return -EINVAL;
         }
 
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+        block = base->block;
+        rc = 0;
         switch (cmd) {
         case BIODASDDISABLE:
-                return dasd_ioctl_disable(bdev);
+                rc = dasd_ioctl_disable(bdev);
+                break;
         case BIODASDENABLE:
-                return dasd_ioctl_enable(bdev);
+                rc = dasd_ioctl_enable(bdev);
+                break;
         case BIODASDQUIESCE:
-                return dasd_ioctl_quiesce(block);
+                rc = dasd_ioctl_quiesce(block);
+                break;
         case BIODASDRESUME:
-                return dasd_ioctl_resume(block);
+                rc = dasd_ioctl_resume(block);
+                break;
         case BIODASDFMT:
-                return dasd_ioctl_format(bdev, argp);
+                rc = dasd_ioctl_format(bdev, argp);
+                break;
         case BIODASDINFO:
-                return dasd_ioctl_information(block, cmd, argp);
+                rc = dasd_ioctl_information(block, cmd, argp);
+                break;
         case BIODASDINFO2:
-                return dasd_ioctl_information(block, cmd, argp);
+                rc = dasd_ioctl_information(block, cmd, argp);
+                break;
         case BIODASDPRRD:
-                return dasd_ioctl_read_profile(block, argp);
+                rc = dasd_ioctl_read_profile(block, argp);
+                break;
         case BIODASDPRRST:
-                return dasd_ioctl_reset_profile(block);
+                rc = dasd_ioctl_reset_profile(block);
+                break;
         case BLKROSET:
-                return dasd_ioctl_set_ro(bdev, argp);
+                rc = dasd_ioctl_set_ro(bdev, argp);
+                break;
         case DASDAPIVER:
-                return dasd_ioctl_api_version(argp);
+                rc = dasd_ioctl_api_version(argp);
+                break;
         case BIODASDCMFENABLE:
-                return enable_cmf(block->base->cdev);
+                rc = enable_cmf(base->cdev);
+                break;
         case BIODASDCMFDISABLE:
-                return disable_cmf(block->base->cdev);
+                rc = disable_cmf(base->cdev);
+                break;
         case BIODASDREADALLCMB:
-                return dasd_ioctl_readall_cmb(block, cmd, argp);
+                rc = dasd_ioctl_readall_cmb(block, cmd, argp);
+                break;
         default:
                 /* if the discipline has an ioctl method try it. */
-                if (block->base->discipline->ioctl) {
-                        int rval = block->base->discipline->ioctl(block, cmd, argp);
-                        if (rval != -ENOIOCTLCMD)
-                                return rval;
-                }
-
-                return -EINVAL;
+                if (base->discipline->ioctl) {
+                        rc = base->discipline->ioctl(block, cmd, argp);
+                        if (rc == -ENOIOCTLCMD)
+                                rc = -EINVAL;
+                } else
+                        rc = -EINVAL;
         }
+        dasd_put_device(base);
+        return rc;
 }
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index c532ba929ccd..e8f267eb8887 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -407,8 +407,11 @@ static inline void account_sbals(struct qdio_q *q, int count)
         q->q_stats.nr_sbals[pos]++;
 }
 
-static void announce_buffer_error(struct qdio_q *q, int count)
+static void process_buffer_error(struct qdio_q *q, int count)
 {
+        unsigned char state = (q->is_input_q) ? SLSB_P_INPUT_NOT_INIT :
+                                        SLSB_P_OUTPUT_NOT_INIT;
+
         q->qdio_error |= QDIO_ERROR_SLSB_STATE;
 
         /* special handling for no target buffer empty */
@@ -426,6 +429,12 @@ static void announce_buffer_error(struct qdio_q *q, int count)
         DBF_ERROR("F14:%2x F15:%2x",
                   q->sbal[q->first_to_check]->element[14].flags & 0xff,
                   q->sbal[q->first_to_check]->element[15].flags & 0xff);
+
+        /*
+         * Interrupts may be avoided as long as the error is present
+         * so change the buffer state immediately to avoid starvation.
+         */
+        set_buf_states(q, q->first_to_check, state, count);
 }
 
 static inline void inbound_primed(struct qdio_q *q, int count)
@@ -506,8 +515,7 @@ static int get_inbound_buffer_frontier(struct qdio_q *q)
                         account_sbals(q, count);
                 break;
         case SLSB_P_INPUT_ERROR:
-                announce_buffer_error(q, count);
-                /* process the buffer, the upper layer will take care of it */
+                process_buffer_error(q, count);
                 q->first_to_check = add_buf(q->first_to_check, count);
                 atomic_sub(count, &q->nr_buf_used);
                 if (q->irq_ptr->perf_stat_enabled)
@@ -677,8 +685,7 @@ static int get_outbound_buffer_frontier(struct qdio_q *q)
                         account_sbals(q, count);
                 break;
         case SLSB_P_OUTPUT_ERROR:
-                announce_buffer_error(q, count);
-                /* process the buffer, the upper layer will take care of it */
+                process_buffer_error(q, count);
                 q->first_to_check = add_buf(q->first_to_check, count);
                 atomic_sub(count, &q->nr_buf_used);
                 if (q->irq_ptr->perf_stat_enabled)
diff --git a/drivers/s390/kvm/kvm_virtio.c b/drivers/s390/kvm/kvm_virtio.c
index 414427d64a8f..607998f0b7d8 100644
--- a/drivers/s390/kvm/kvm_virtio.c
+++ b/drivers/s390/kvm/kvm_virtio.c
@@ -381,10 +381,10 @@ static void kvm_extint_handler(unsigned int ext_int_code,
         u16 subcode;
         u32 param;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_VRT]++;
         subcode = ext_int_code >> 16;
         if ((subcode & 0xff00) != VIRTIO_SUBCODE_64)
                 return;
+        kstat_cpu(smp_processor_id()).irqs[EXTINT_VRT]++;
 
         /* The LSB might be overloaded, we have to mask it */
         vq = (struct virtqueue *)(param64 & ~1UL);
diff --git a/drivers/scsi/device_handler/scsi_dh.c b/drivers/scsi/device_handler/scsi_dh.c
index 564e6ecd17c2..0119b8147797 100644
--- a/drivers/scsi/device_handler/scsi_dh.c
+++ b/drivers/scsi/device_handler/scsi_dh.c
@@ -394,12 +394,14 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
         unsigned long flags;
         struct scsi_device *sdev;
         struct scsi_device_handler *scsi_dh = NULL;
+        struct device *dev = NULL;
 
         spin_lock_irqsave(q->queue_lock, flags);
         sdev = q->queuedata;
         if (sdev && sdev->scsi_dh_data)
                 scsi_dh = sdev->scsi_dh_data->scsi_dh;
-        if (!scsi_dh || !get_device(&sdev->sdev_gendev) ||
+        dev = get_device(&sdev->sdev_gendev);
+        if (!scsi_dh || !dev ||
             sdev->sdev_state == SDEV_CANCEL ||
             sdev->sdev_state == SDEV_DEL)
                 err = SCSI_DH_NOSYS;
@@ -410,12 +412,13 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
         if (err) {
                 if (fn)
                         fn(data, err);
-                return err;
+                goto out;
         }
 
         if (scsi_dh->activate)
                 err = scsi_dh->activate(sdev, fn, data);
-        put_device(&sdev->sdev_gendev);
+out:
+        put_device(dev);
         return err;
 }
 EXPORT_SYMBOL_GPL(scsi_dh_activate);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
index 1c6d2b405eef..d72f1f2b1392 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
@@ -688,6 +688,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
                 goto out;
         }
 
+        /* Check for overflow and wraparound */
+        if (karg.data_sge_offset * 4 > ioc->request_sz ||
+            karg.data_sge_offset > (UINT_MAX / 4)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         /* copy in request message frame from user */
         if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
                 printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
@@ -1963,7 +1970,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
         Mpi2DiagBufferPostReply_t *mpi_reply;
         int rc, i;
         u8 buffer_type;
-        unsigned long timeleft;
+        unsigned long timeleft, request_size, copy_size;
         u16 smid;
         u16 ioc_status;
         u8 issue_reset = 0;
@@ -1999,6 +2006,8 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
                 return -ENOMEM;
         }
 
+        request_size = ioc->diag_buffer_sz[buffer_type];
+
         if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
                 printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
                     "or bytes_to_read are not 4 byte aligned\n", ioc->name,
@@ -2006,13 +2015,23 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
                 return -EINVAL;
         }
 
+        if (karg.starting_offset > request_size)
+                return -EINVAL;
+
         diag_data = (void *)(request_data + karg.starting_offset);
         dctlprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: diag_buffer(%p), "
             "offset(%d), sz(%d)\n", ioc->name, __func__,
             diag_data, karg.starting_offset, karg.bytes_to_read));
 
+        /* Truncate data on requests that are too large */
+        if ((diag_data + karg.bytes_to_read < diag_data) ||
+            (diag_data + karg.bytes_to_read > request_data + request_size))
+                copy_size = request_size - karg.starting_offset;
+        else
+                copy_size = karg.bytes_to_read;
+
         if (copy_to_user((void __user *)uarg->diagnostic_data,
-            diag_data, karg.bytes_to_read)) {
+            diag_data, copy_size)) {
                 printk(MPT2SAS_ERR_FMT "%s: Unable to write "
                     "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
                     __func__, diag_data);
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index 96d5ad0c1e42..7f636b118287 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -3814,6 +3814,9 @@ static long pmcraid_ioctl_passthrough(
                         rc = -EFAULT;
                         goto out_free_buffer;
                 }
+        } else if (request_size < 0) {
+                rc = -EINVAL;
+                goto out_free_buffer;
         }
 
         /* check if we have any additional command parameters */
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index e9901b8f8443..0bac91e72370 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -400,10 +400,15 @@ static inline int scsi_host_is_busy(struct Scsi_Host *shost)
 static void scsi_run_queue(struct request_queue *q)
 {
         struct scsi_device *sdev = q->queuedata;
-        struct Scsi_Host *shost = sdev->host;
+        struct Scsi_Host *shost;
         LIST_HEAD(starved_list);
         unsigned long flags;
 
+        /* if the device is dead, sdev will be NULL, so no queue to run */
+        if (!sdev)
+                return;
+
+        shost = sdev->host;
         if (scsi_target(sdev)->single_lun)
                 scsi_single_lun_run(sdev);
 
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index e44ff64233fd..e63912510fb9 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -322,14 +322,8 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
                 kfree(evt);
         }
 
-        if (sdev->request_queue) {
-                sdev->request_queue->queuedata = NULL;
-                /* user context needed to free queue */
-                scsi_free_queue(sdev->request_queue);
-                /* temporary expedient, try to catch use of queue lock
-                 * after free of sdev */
-                sdev->request_queue = NULL;
-        }
+        /* NULL queue means the device can't be used */
+        sdev->request_queue = NULL;
 
         scsi_target_reap(scsi_target(sdev));
 
@@ -937,6 +931,12 @@ void __scsi_remove_device(struct scsi_device *sdev)
         if (sdev->host->hostt->slave_destroy)
                 sdev->host->hostt->slave_destroy(sdev);
         transport_destroy_device(dev);
+
+        /* cause the request function to reject all I/O requests */
+        sdev->request_queue->queuedata = NULL;
+
+        /* Freeing the queue signals to block that we're done */
+        scsi_free_queue(sdev->request_queue);
         put_device(dev);
 }
 
diff --git a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_hw.c b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_hw.c
index eeb7dd43f9a8..830822f86e41 100644
--- a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_hw.c
+++ b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_hw.c
@@ -2288,7 +2288,3 @@ err_dev:
         free_netdev(dev);
         return NULL;
 }
-
-EXPORT_SYMBOL(init_ft1000_card);
-EXPORT_SYMBOL(stop_ft1000_card);
-EXPORT_SYMBOL(flarion_ft1000_cnt);
diff --git a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
index 935608e72007..bdfb1aec58df 100644
--- a/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
+++ b/drivers/staging/ft1000/ft1000-pcmcia/ft1000_proc.c
@@ -214,6 +214,3 @@ void ft1000CleanupProc(struct net_device *dev)
         remove_proc_entry(FT1000_PROC, init_net.proc_net);
         unregister_netdevice_notifier(&ft1000_netdev_notifier);
 }
-
-EXPORT_SYMBOL(ft1000InitProc);
-EXPORT_SYMBOL(ft1000CleanupProc);
diff --git a/drivers/staging/gma500/Kconfig b/drivers/staging/gma500/Kconfig
index 5501eb9b3355..ce8bedaeaac2 100644
--- a/drivers/staging/gma500/Kconfig
+++ b/drivers/staging/gma500/Kconfig
@@ -1,6 +1,6 @@
 config DRM_PSB
         tristate "Intel GMA500 KMS Framebuffer"
-        depends on DRM && PCI
+        depends on DRM && PCI && X86
         select FB_CFB_COPYAREA
         select FB_CFB_FILLRECT
         select FB_CFB_IMAGEBLIT
diff --git a/drivers/staging/intel_sst/intelmid_v1_control.c b/drivers/staging/intel_sst/intelmid_v1_control.c
index 9cc15c1c18d4..1ea814218059 100644
--- a/drivers/staging/intel_sst/intelmid_v1_control.c
+++ b/drivers/staging/intel_sst/intelmid_v1_control.c
@@ -28,6 +28,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/pci.h>
+#include <linux/delay.h>
 #include <linux/file.h>
 #include <asm/mrst.h>
 #include <sound/pcm.h>
diff --git a/drivers/staging/intel_sst/intelmid_v2_control.c b/drivers/staging/intel_sst/intelmid_v2_control.c
index 26d815a67eb8..3c6b3abff3c3 100644
--- a/drivers/staging/intel_sst/intelmid_v2_control.c
+++ b/drivers/staging/intel_sst/intelmid_v2_control.c
@@ -29,6 +29,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/pci.h>
+#include <linux/delay.h>
 #include <linux/file.h>
 #include "intel_sst.h"
 #include "intelmid_snd_control.h"
diff --git a/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c b/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
index b5d21f6497f9..22c04eabed41 100644
--- a/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
+++ b/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
@@ -12,6 +12,7 @@
  */
 #include <linux/cs5535.h>
 #include <linux/gpio.h>
+#include <linux/delay.h>
 #include <asm/olpc.h>
 
 #include "olpc_dcon.h"
diff --git a/drivers/staging/rt2860/common/cmm_data_pci.c b/drivers/staging/rt2860/common/cmm_data_pci.c
index bef0bbd8cef7..f01a51c381f1 100644
--- a/drivers/staging/rt2860/common/cmm_data_pci.c
+++ b/drivers/staging/rt2860/common/cmm_data_pci.c
@@ -444,7 +444,7 @@ int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
                         return (NDIS_STATUS_FAILURE);
                 }
         }
-        /* Drop not U2M frames, can't's drop here because we will drop beacon in this case */
+        /* Drop not U2M frames, can't drop here because we will drop beacon in this case */
         /* I am kind of doubting the U2M bit operation */
         /* if (pRxD->U2M == 0) */
         /*      return(NDIS_STATUS_FAILURE); */
diff --git a/drivers/staging/rt2860/common/cmm_data_usb.c b/drivers/staging/rt2860/common/cmm_data_usb.c
index 5637857ae9eb..83a62faa7e57 100644
--- a/drivers/staging/rt2860/common/cmm_data_usb.c
+++ b/drivers/staging/rt2860/common/cmm_data_usb.c
@@ -860,7 +860,7 @@ int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
                 DBGPRINT_RAW(RT_DEBUG_ERROR, ("received packet too long\n"));
                 return NDIS_STATUS_FAILURE;
         }
-        /* Drop not U2M frames, can't's drop here because we will drop beacon in this case */
+        /* Drop not U2M frames, can't drop here because we will drop beacon in this case */
         /* I am kind of doubting the U2M bit operation */
         /* if (pRxD->U2M == 0) */
         /*      return(NDIS_STATUS_FAILURE); */
diff --git a/drivers/staging/rts_pstor/debug.h b/drivers/staging/rts_pstor/debug.h
index e1408b0e7ae4..ab305be96fb5 100644
--- a/drivers/staging/rts_pstor/debug.h
+++ b/drivers/staging/rts_pstor/debug.h
@@ -28,7 +28,7 @@
 
 #define RTSX_STOR "rts_pstor: "
 
-#if CONFIG_RTS_PSTOR_DEBUG
+#ifdef CONFIG_RTS_PSTOR_DEBUG
 #define RTSX_DEBUGP(x...) printk(KERN_DEBUG RTSX_STOR x)
 #define RTSX_DEBUGPN(x...) printk(KERN_DEBUG x)
 #define RTSX_DEBUGPX(x...) printk(x)
diff --git a/drivers/staging/rts_pstor/ms.c b/drivers/staging/rts_pstor/ms.c
index 810e170894f5..d89795c6a3ac 100644
--- a/drivers/staging/rts_pstor/ms.c
+++ b/drivers/staging/rts_pstor/ms.c
@@ -23,6 +23,7 @@
 #include <linux/blkdev.h>
 #include <linux/kthread.h>
 #include <linux/sched.h>
+#include <linux/vmalloc.h>
 
 #include "rtsx.h"
 #include "rtsx_transport.h"
diff --git a/drivers/staging/rts_pstor/rtsx_chip.c b/drivers/staging/rts_pstor/rtsx_chip.c
index d2f1c715a684..4e60780ea804 100644
--- a/drivers/staging/rts_pstor/rtsx_chip.c
+++ b/drivers/staging/rts_pstor/rtsx_chip.c
@@ -24,6 +24,7 @@
 #include <linux/kthread.h>
 #include <linux/sched.h>
 #include <linux/workqueue.h>
+#include <linux/vmalloc.h>
 
 #include "rtsx.h"
 #include "rtsx_transport.h"
@@ -1311,11 +1312,11 @@ void rtsx_polling_func(struct rtsx_chip *chip)
 
 #ifdef SUPPORT_OCP
         if (CHECK_LUN_MODE(chip, SD_MS_2LUN)) {
-                #if CONFIG_RTS_PSTOR_DEBUG
+#ifdef CONFIG_RTS_PSTOR_DEBUG
                 if (chip->ocp_stat & (SD_OC_NOW | SD_OC_EVER | MS_OC_NOW | MS_OC_EVER)) {
                         RTSX_DEBUGP("Over current, OCPSTAT is 0x%x\n", chip->ocp_stat);
                 }
-                #endif
+#endif
 
                 if (chip->ocp_stat & (SD_OC_NOW | SD_OC_EVER)) {
                         if (chip->card_exist & SD_CARD) {
diff --git a/drivers/staging/rts_pstor/rtsx_scsi.c b/drivers/staging/rts_pstor/rtsx_scsi.c
index 20c2464a20f9..7de1fae443fc 100644
--- a/drivers/staging/rts_pstor/rtsx_scsi.c
+++ b/drivers/staging/rts_pstor/rtsx_scsi.c
@@ -23,6 +23,7 @@
 #include <linux/blkdev.h>
 #include <linux/kthread.h>
 #include <linux/sched.h>
+#include <linux/vmalloc.h>
 
 #include "rtsx.h"
 #include "rtsx_transport.h"
diff --git a/drivers/staging/rts_pstor/sd.c b/drivers/staging/rts_pstor/sd.c
index 8d066bd428c4..b1277a6c7a8b 100644
--- a/drivers/staging/rts_pstor/sd.c
+++ b/drivers/staging/rts_pstor/sd.c
@@ -909,7 +909,7 @@ static int sd_change_phase(struct rtsx_chip *chip, u8 sample_point, u8 tune_dir)
                 RTSX_WRITE_REG(chip, SD_VPCLK0_CTL, PHASE_NOT_RESET, PHASE_NOT_RESET);
                 RTSX_WRITE_REG(chip, CLK_CTL, CHANGE_CLK, 0);
         } else {
-#if CONFIG_RTS_PSTOR_DEBUG
+#ifdef CONFIG_RTS_PSTOR_DEBUG
                 rtsx_read_register(chip, SD_VP_CTL, &val);
                 RTSX_DEBUGP("SD_VP_CTL: 0x%x\n", val);
                 rtsx_read_register(chip, SD_DCMPS_CTL, &val);
@@ -958,7 +958,7 @@ static int sd_change_phase(struct rtsx_chip *chip, u8 sample_point, u8 tune_dir)
         return STATUS_SUCCESS;
 
 Fail:
-#if CONFIG_RTS_PSTOR_DEBUG
+#ifdef CONFIG_RTS_PSTOR_DEBUG
         rtsx_read_register(chip, SD_VP_CTL, &val);
         RTSX_DEBUGP("SD_VP_CTL: 0x%x\n", val);
         rtsx_read_register(chip, SD_DCMPS_CTL, &val);
diff --git a/drivers/staging/rts_pstor/trace.h b/drivers/staging/rts_pstor/trace.h
index 2c668bae6ff4..bc83b49a4eb4 100644
--- a/drivers/staging/rts_pstor/trace.h
+++ b/drivers/staging/rts_pstor/trace.h
@@ -82,7 +82,7 @@ do {													\
 #define TRACE_GOTO(chip, label) goto label
 #endif
 
-#if CONFIG_RTS_PSTOR_DEBUG
+#ifdef CONFIG_RTS_PSTOR_DEBUG
 static inline void rtsx_dump(u8 *buf, int buf_len)
 {
         int i;
diff --git a/drivers/staging/rts_pstor/xd.c b/drivers/staging/rts_pstor/xd.c
index 7bcd468b8f2c..9f3add1e8f59 100644
--- a/drivers/staging/rts_pstor/xd.c
+++ b/drivers/staging/rts_pstor/xd.c
@@ -23,6 +23,7 @@
 #include <linux/blkdev.h>
 #include <linux/kthread.h>
 #include <linux/sched.h>
+#include <linux/vmalloc.h>
 
 #include "rtsx.h"
 #include "rtsx_transport.h"
diff --git a/drivers/staging/solo6x10/Kconfig b/drivers/staging/solo6x10/Kconfig
index 2cf77c940860..03dcac4ea4d0 100644
--- a/drivers/staging/solo6x10/Kconfig
+++ b/drivers/staging/solo6x10/Kconfig
@@ -2,6 +2,7 @@ config SOLO6X10
         tristate "Softlogic 6x10 MPEG codec cards"
         depends on PCI && VIDEO_DEV && SND && I2C
         select VIDEOBUF_DMA_SG
+        select SND_PCM
         ---help---
           This driver supports the Softlogic based MPEG-4 and h.264 codec
           codec cards.
diff --git a/drivers/staging/spectra/ffsport.c b/drivers/staging/spectra/ffsport.c
index 20dae73d3b78..506547b603e1 100644
--- a/drivers/staging/spectra/ffsport.c
+++ b/drivers/staging/spectra/ffsport.c
@@ -653,7 +653,7 @@ static int SBD_setup_device(struct spectra_nand_dev *dev, int which)
         }
         dev->queue->queuedata = dev;
 
-        /* As Linux block layer does't support >4KB hardware sector,  */
+        /* As Linux block layer doesn't support >4KB hardware sector,  */
         /* Here we force report 512 byte hardware sector size to Kernel */
         blk_queue_logical_block_size(dev->queue, 512);
 
diff --git a/drivers/staging/tidspbridge/dynload/cload.c b/drivers/staging/tidspbridge/dynload/cload.c
index 5cecd237e3f6..fe1ef0addb09 100644
--- a/drivers/staging/tidspbridge/dynload/cload.c
+++ b/drivers/staging/tidspbridge/dynload/cload.c
@@ -718,7 +718,7 @@ static void dload_symbols(struct dload_state *dlthis)
          * as a temporary for .dllview record construction.
          * Allocate storage for the whole table.  Add 1 to the section count
          * in case a trampoline section is auto-generated as well as the
-         * size of the trampoline section name so DLLView does't get lost.
+         * size of the trampoline section name so DLLView doesn't get lost.
          */
 
         siz = sym_count * sizeof(struct local_symbol);
diff --git a/drivers/staging/tty/specialix.c b/drivers/staging/tty/specialix.c
index cb24c6d999db..5c3598ec7456 100644
--- a/drivers/staging/tty/specialix.c
+++ b/drivers/staging/tty/specialix.c
@@ -978,7 +978,7 @@ static void sx_change_speed(struct specialix_board *bp,
         spin_lock_irqsave(&bp->lock, flags);
         sx_out(bp, CD186x_CAR, port_No(port));
 
-        /* The Specialix board does't implement the RTS lines.
+        /* The Specialix board doesn't implement the RTS lines.
            They are used to set the IRQ level. Don't touch them. */
         if (sx_crtscts(tty))
                 port->MSVR = MSVR_DTR | (sx_in(bp, CD186x_MSVR) & MSVR_RTS);
diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
index 0f02a4b12ae4..4f4f13321f40 100644
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -876,8 +876,10 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
         }
 
         /* kill threads related to this sdev, if v.c. exists */
-        kthread_stop(vdev->ud.tcp_rx);
-        kthread_stop(vdev->ud.tcp_tx);
+        if (vdev->ud.tcp_rx)
+                kthread_stop(vdev->ud.tcp_rx);
+        if (vdev->ud.tcp_tx)
+                kthread_stop(vdev->ud.tcp_tx);
 
         usbip_uinfo("stop threads\n");
 
@@ -949,9 +951,6 @@ static void vhci_device_init(struct vhci_device *vdev)
 {
         memset(vdev, 0, sizeof(*vdev));
 
-        vdev->ud.tcp_rx = kthread_create(vhci_rx_loop, &vdev->ud, "vhci_rx");
-        vdev->ud.tcp_tx = kthread_create(vhci_tx_loop, &vdev->ud, "vhci_tx");
-
         vdev->ud.side   = USBIP_VHCI;
         vdev->ud.status = VDEV_ST_NULL;
         /* vdev->ud.lock   = SPIN_LOCK_UNLOCKED; */
@@ -1139,7 +1138,7 @@ static int vhci_hcd_probe(struct platform_device *pdev)
                 usbip_uerr("create hcd failed\n");
                 return -ENOMEM;
         }
-
+        hcd->has_tt = 1;
 
         /* this is private data for vhci_hcd */
         the_controller = hcd_to_vhci(hcd);
diff --git a/drivers/staging/usbip/vhci_sysfs.c b/drivers/staging/usbip/vhci_sysfs.c
index 3f2459f30415..e2dadbd5ef1e 100644
--- a/drivers/staging/usbip/vhci_sysfs.c
+++ b/drivers/staging/usbip/vhci_sysfs.c
@@ -21,6 +21,7 @@
 #include "vhci.h"
 
 #include <linux/in.h>
+#include <linux/kthread.h>
 
 /* TODO: refine locking ?*/
 
@@ -220,13 +221,13 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr,
         vdev->ud.tcp_socket = socket;
         vdev->ud.status     = VDEV_ST_NOTASSIGNED;
 
-        wake_up_process(vdev->ud.tcp_rx);
-        wake_up_process(vdev->ud.tcp_tx);
-
         spin_unlock(&vdev->ud.lock);
         spin_unlock(&the_controller->lock);
         /* end the lock */
 
+        vdev->ud.tcp_rx = kthread_run(vhci_rx_loop, &vdev->ud, "vhci_rx");
+        vdev->ud.tcp_tx = kthread_run(vhci_tx_loop, &vdev->ud, "vhci_tx");
+
         rh_port_connect(rhport, speed);
 
         return count;
diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
index 6a71f52c59b1..76378397b763 100644
--- a/drivers/staging/wlan-ng/cfg80211.c
+++ b/drivers/staging/wlan-ng/cfg80211.c
@@ -273,7 +273,7 @@ exit:
 }
 
 int prism2_set_default_key(struct wiphy *wiphy, struct net_device *dev,
-                           u8 key_index)
+                           u8 key_index, bool unicast, bool multicast)
 {
         wlandevice_t *wlandev = dev->ml_priv;
 
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index 7e41a95c5ceb..627f3a678759 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -40,6 +40,7 @@
 #include <linux/slab.h>
 #include <linux/usb/ulpi.h>
 #include <plat/usb.h>
+#include <linux/regulator/consumer.h>
 
 /* EHCI Register Set */
 #define EHCI_INSNREG04                                  (0xA0)
@@ -118,6 +119,8 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
         struct ehci_hcd                         *omap_ehci;
         int                                     ret = -ENODEV;
         int                                     irq;
+        int                                     i;
+        char                                    supply[7];
 
         if (usb_disabled())
                 return -ENODEV;
@@ -158,6 +161,23 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
         hcd->rsrc_len = resource_size(res);
         hcd->regs = regs;
 
+        /* get ehci regulator and enable */
+        for (i = 0 ; i < OMAP3_HS_USB_PORTS ; i++) {
+                if (pdata->port_mode[i] != OMAP_EHCI_PORT_MODE_PHY) {
+                        pdata->regulator[i] = NULL;
+                        continue;
+                }
+                snprintf(supply, sizeof(supply), "hsusb%d", i);
+                pdata->regulator[i] = regulator_get(dev, supply);
+                if (IS_ERR(pdata->regulator[i])) {
+                        pdata->regulator[i] = NULL;
+                        dev_dbg(dev,
+                        "failed to get ehci port%d regulator\n", i);
+                } else {
+                        regulator_enable(pdata->regulator[i]);
+                }
+        }
+
         ret = omap_usbhs_enable(dev);
         if (ret) {
                 dev_err(dev, "failed to start usbhs with err %d\n", ret);
diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
index 795345ad45e6..7b2e69aa2e98 100644
--- a/drivers/usb/host/isp1760-hcd.c
+++ b/drivers/usb/host/isp1760-hcd.c
@@ -1633,6 +1633,7 @@ static int isp1760_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                         ints[i].qh = NULL;
                         ints[i].qtd = NULL;
 
+                        urb->status = status;
                         isp1760_urb_done(hcd, urb);
                         if (qtd)
                                 pe(hcd, qh, qtd);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index a78f2ebd11b7..73f75d26436c 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -777,7 +777,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
                 if (t1 != t2)
                         xhci_writel(xhci, t2, port_array[port_index]);
 
-                if (DEV_HIGHSPEED(t1)) {
+                if (hcd->speed != HCD_USB3) {
                         /* enable remote wake up for USB 2.0 */
                         u32 __iomem *addr;
                         u32 tmp;
@@ -866,6 +866,21 @@ int xhci_bus_resume(struct usb_hcd *hcd)
                                 temp |= PORT_LINK_STROBE | XDEV_U0;
                                 xhci_writel(xhci, temp, port_array[port_index]);
                         }
+                        /* wait for the port to enter U0 and report port link
+                         * state change.
+                         */
+                        spin_unlock_irqrestore(&xhci->lock, flags);
+                        msleep(20);
+                        spin_lock_irqsave(&xhci->lock, flags);
+
+                        /* Clear PLC */
+                        temp = xhci_readl(xhci, port_array[port_index]);
+                        if (temp & PORT_PLC) {
+                                temp = xhci_port_state_to_neutral(temp);
+                                temp |= PORT_PLC;
+                                xhci_writel(xhci, temp, port_array[port_index]);
+                        }
+
                         slot_id = xhci_find_slot_id_by_port(hcd,
                                         xhci, port_index + 1);
                         if (slot_id)
@@ -873,7 +888,7 @@ int xhci_bus_resume(struct usb_hcd *hcd)
                 } else
                         xhci_writel(xhci, temp, port_array[port_index]);
 
-                if (DEV_HIGHSPEED(temp)) {
+                if (hcd->speed != HCD_USB3) {
                         /* disable remote wake up for USB 2.0 */
                         u32 __iomem *addr;
                         u32 tmp;
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 6dfbf9ffd7a6..f47c20197c61 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1887,11 +1887,9 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
                         otg_set_vbus(musb->xceiv, 1);
 
                 hcd->self.uses_pio_for_control = 1;
-
-                if (musb->xceiv->last_event == USB_EVENT_NONE)
-                        pm_runtime_put(musb->controller);
-
         }
+        if (musb->xceiv->last_event == USB_EVENT_NONE)
+                pm_runtime_put(musb->controller);
 
         return 0;
 
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 57a27fa954b4..e9e60b6e0583 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -270,7 +270,7 @@ static int musb_otg_notifications(struct notifier_block *nb,
                 DBG(4, "VBUS Disconnect\n");
 
 #ifdef CONFIG_USB_GADGET_MUSB_HDRC
-                if (is_otg_enabled(musb))
+                if (is_otg_enabled(musb) || is_peripheral_enabled(musb))
                         if (musb->gadget_driver)
 #endif
                         {
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index 35a0d12dad73..5fd020da7c55 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -35,6 +35,7 @@
  *      document number 324645-001, 324646-001: Cougar Point (CPT)
  *      document number TBD                   : Patsburg (PBG)
  *      document number TBD                   : DH89xxCC
+ *      document number TBD                   : Panther Point
  */
 
 /*
@@ -153,6 +154,38 @@ enum iTCO_chipsets {
         TCO_PBG1,       /* Patsburg */
         TCO_PBG2,       /* Patsburg */
         TCO_DH89XXCC,   /* DH89xxCC */
+        TCO_PPT0,       /* Panther Point */
+        TCO_PPT1,       /* Panther Point */
+        TCO_PPT2,       /* Panther Point */
+        TCO_PPT3,       /* Panther Point */
+        TCO_PPT4,       /* Panther Point */
+        TCO_PPT5,       /* Panther Point */
+        TCO_PPT6,       /* Panther Point */
+        TCO_PPT7,       /* Panther Point */
+        TCO_PPT8,       /* Panther Point */
+        TCO_PPT9,       /* Panther Point */
+        TCO_PPT10,      /* Panther Point */
+        TCO_PPT11,      /* Panther Point */
+        TCO_PPT12,      /* Panther Point */
+        TCO_PPT13,      /* Panther Point */
+        TCO_PPT14,      /* Panther Point */
+        TCO_PPT15,      /* Panther Point */
+        TCO_PPT16,      /* Panther Point */
+        TCO_PPT17,      /* Panther Point */
+        TCO_PPT18,      /* Panther Point */
+        TCO_PPT19,      /* Panther Point */
+        TCO_PPT20,      /* Panther Point */
+        TCO_PPT21,      /* Panther Point */
+        TCO_PPT22,      /* Panther Point */
+        TCO_PPT23,      /* Panther Point */
+        TCO_PPT24,      /* Panther Point */
+        TCO_PPT25,      /* Panther Point */
+        TCO_PPT26,      /* Panther Point */
+        TCO_PPT27,      /* Panther Point */
+        TCO_PPT28,      /* Panther Point */
+        TCO_PPT29,      /* Panther Point */
+        TCO_PPT30,      /* Panther Point */
+        TCO_PPT31,      /* Panther Point */
 };
 
 static struct {
@@ -244,6 +277,38 @@ static struct {
         {"Patsburg", 2},
         {"Patsburg", 2},
         {"DH89xxCC", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
         {NULL, 0}
 };
 
@@ -363,6 +428,38 @@ static DEFINE_PCI_DEVICE_TABLE(iTCO_wdt_pci_tbl) = {
         { ITCO_PCI_DEVICE(0x1d40,                               TCO_PBG1)},
         { ITCO_PCI_DEVICE(0x1d41,                               TCO_PBG2)},
         { ITCO_PCI_DEVICE(0x2310,                               TCO_DH89XXCC)},
+        { ITCO_PCI_DEVICE(0x1e40,                               TCO_PPT0)},
+        { ITCO_PCI_DEVICE(0x1e41,                               TCO_PPT1)},
+        { ITCO_PCI_DEVICE(0x1e42,                               TCO_PPT2)},
+        { ITCO_PCI_DEVICE(0x1e43,                               TCO_PPT3)},
+        { ITCO_PCI_DEVICE(0x1e44,                               TCO_PPT4)},
+        { ITCO_PCI_DEVICE(0x1e45,                               TCO_PPT5)},
+        { ITCO_PCI_DEVICE(0x1e46,                               TCO_PPT6)},
+        { ITCO_PCI_DEVICE(0x1e47,                               TCO_PPT7)},
+        { ITCO_PCI_DEVICE(0x1e48,                               TCO_PPT8)},
+        { ITCO_PCI_DEVICE(0x1e49,                               TCO_PPT9)},
+        { ITCO_PCI_DEVICE(0x1e4a,                               TCO_PPT10)},
+        { ITCO_PCI_DEVICE(0x1e4b,                               TCO_PPT11)},
+        { ITCO_PCI_DEVICE(0x1e4c,                               TCO_PPT12)},
+        { ITCO_PCI_DEVICE(0x1e4d,                               TCO_PPT13)},
+        { ITCO_PCI_DEVICE(0x1e4e,                               TCO_PPT14)},
+        { ITCO_PCI_DEVICE(0x1e4f,                               TCO_PPT15)},
+        { ITCO_PCI_DEVICE(0x1e50,                               TCO_PPT16)},
+        { ITCO_PCI_DEVICE(0x1e51,                               TCO_PPT17)},
+        { ITCO_PCI_DEVICE(0x1e52,                               TCO_PPT18)},
+        { ITCO_PCI_DEVICE(0x1e53,                               TCO_PPT19)},
+        { ITCO_PCI_DEVICE(0x1e54,                               TCO_PPT20)},
+        { ITCO_PCI_DEVICE(0x1e55,                               TCO_PPT21)},
+        { ITCO_PCI_DEVICE(0x1e56,                               TCO_PPT22)},
+        { ITCO_PCI_DEVICE(0x1e57,                               TCO_PPT23)},
+        { ITCO_PCI_DEVICE(0x1e58,                               TCO_PPT24)},
+        { ITCO_PCI_DEVICE(0x1e59,                               TCO_PPT25)},
+        { ITCO_PCI_DEVICE(0x1e5a,                               TCO_PPT26)},
+        { ITCO_PCI_DEVICE(0x1e5b,                               TCO_PPT27)},
+        { ITCO_PCI_DEVICE(0x1e5c,                               TCO_PPT28)},
+        { ITCO_PCI_DEVICE(0x1e5d,                               TCO_PPT29)},
+        { ITCO_PCI_DEVICE(0x1e5e,                               TCO_PPT30)},
+        { ITCO_PCI_DEVICE(0x1e5f,                               TCO_PPT31)},
         { 0, },                 /* End of list */
 };
 MODULE_DEVICE_TABLE(pci, iTCO_wdt_pci_tbl);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 2e61fe1b6b8c..8f4b81de3ae2 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -718,7 +718,7 @@ struct btrfs_space_info {
         u64 total_bytes;        /* total bytes in the space,
                                    this doesn't take mirrors into account */
         u64 bytes_used;         /* total bytes used,
-                                   this does't take mirrors into account */
+                                   this doesn't take mirrors into account */
         u64 bytes_pinned;       /* total bytes pinned, will be freed when the
                                    transaction finishes */
         u64 bytes_reserved;     /* total bytes the allocator has reserved for
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 68c84c8c24bd..228cf36ece83 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2824,6 +2824,7 @@ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
 
         spin_lock(&delayed_refs->lock);
         if (delayed_refs->num_entries == 0) {
+                spin_unlock(&delayed_refs->lock);
                 printk(KERN_INFO "delayed_refs has NO entry\n");
                 return ret;
         }
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 31f33ba56fe8..cd52f7f556ef 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -8059,6 +8059,10 @@ static noinline int relocate_one_extent(struct btrfs_root *extent_root,
                                 u64 group_start = group->key.objectid;
                                 new_extents = kmalloc(sizeof(*new_extents),
                                                       GFP_NOFS);
+                                if (!new_extents) {
+                                        ret = -ENOMEM;
+                                        goto out;
+                                }
                                 nr_extents = 1;
                                 ret = get_new_locations(reloc_inode,
                                                         extent_key,
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 315138605088..ba41da59e31b 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2681,7 +2681,7 @@ int extent_readpages(struct extent_io_tree *tree,
                 prefetchw(&page->flags);
                 list_del(&page->lru);
                 if (!add_to_page_cache_lru(page, mapping,
-                                        page->index, GFP_KERNEL)) {
+                                        page->index, GFP_NOFS)) {
                         __extent_read_full_page(tree, page, get_extent,
                                                 &bio, 0, &bio_flags);
                 }
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 11d2e9cea09e..63731a1fb0a1 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1768,10 +1768,13 @@ void btrfs_remove_free_space_cache(struct btrfs_block_group_cache *block_group)
 
         while ((node = rb_last(&block_group->free_space_offset)) != NULL) {
                 info = rb_entry(node, struct btrfs_free_space, offset_index);
-                unlink_free_space(block_group, info);
-                if (info->bitmap)
-                        kfree(info->bitmap);
-                kmem_cache_free(btrfs_free_space_cachep, info);
+                if (!info->bitmap) {
+                        unlink_free_space(block_group, info);
+                        kmem_cache_free(btrfs_free_space_cachep, info);
+                } else {
+                        free_bitmap(block_group, info);
+                }
+
                 if (need_resched()) {
                         spin_unlock(&block_group->tree_lock);
                         cond_resched();
@@ -2301,7 +2304,7 @@ int btrfs_trim_block_group(struct btrfs_block_group_cache *block_group,
                         start = entry->offset;
                         bytes = min(entry->bytes, end - start);
                         unlink_free_space(block_group, entry);
-                        kfree(entry);
+                        kmem_cache_free(btrfs_free_space_cachep, entry);
                 }
 
                 spin_unlock(&block_group->tree_lock);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index fcd66b6a8086..7cd8ab0ef04d 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -954,6 +954,7 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page,
                          1, 0, NULL, GFP_NOFS);
         while (start < end) {
                 async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
+                BUG_ON(!async_cow);
                 async_cow->inode = inode;
                 async_cow->root = root;
                 async_cow->locked_page = locked_page;
@@ -4731,9 +4732,10 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
         inode = btrfs_new_inode(trans, root, dir, dentry->d_name.name,
                                 dentry->d_name.len, dir->i_ino, objectid,
                                 BTRFS_I(dir)->block_group, mode, &index);
-        err = PTR_ERR(inode);
-        if (IS_ERR(inode))
+        if (IS_ERR(inode)) {
+                err = PTR_ERR(inode);
                 goto out_unlock;
+        }
 
         err = btrfs_init_inode_security(trans, inode, dir, &dentry->d_name);
         if (err) {
@@ -4792,9 +4794,10 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
         inode = btrfs_new_inode(trans, root, dir, dentry->d_name.name,
                                 dentry->d_name.len, dir->i_ino, objectid,
                                 BTRFS_I(dir)->block_group, mode, &index);
-        err = PTR_ERR(inode);
-        if (IS_ERR(inode))
+        if (IS_ERR(inode)) {
+                err = PTR_ERR(inode);
                 goto out_unlock;
+        }
 
         err = btrfs_init_inode_security(trans, inode, dir, &dentry->d_name);
         if (err) {
@@ -4999,6 +5002,8 @@ static noinline int uncompress_inline(struct btrfs_path *path,
         inline_size = btrfs_file_extent_inline_item_len(leaf,
                                         btrfs_item_nr(leaf, path->slots[0]));
         tmp = kmalloc(inline_size, GFP_NOFS);
+        if (!tmp)
+                return -ENOMEM;
         ptr = btrfs_file_extent_inline_start(item);
 
         read_extent_buffer(leaf, tmp, ptr, inline_size);
@@ -6036,7 +6041,7 @@ static int btrfs_submit_direct_hook(int rw, struct btrfs_dio_private *dip,
         ret = btrfs_map_block(map_tree, READ, start_sector << 9,
                               &map_length, NULL, 0);
         if (ret) {
-                bio_put(bio);
+                bio_put(orig_bio);
                 return -EIO;
         }
 
@@ -7273,9 +7278,10 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
                                 dentry->d_name.len, dir->i_ino, objectid,
                                 BTRFS_I(dir)->block_group, S_IFLNK|S_IRWXUGO,
                                 &index);
-        err = PTR_ERR(inode);
-        if (IS_ERR(inode))
+        if (IS_ERR(inode)) {
+                err = PTR_ERR(inode);
                 goto out_unlock;
+        }
 
         err = btrfs_init_inode_security(trans, inode, dir, &dentry->d_name);
         if (err) {
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index c50271ad3157..f997ec0c1ba4 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2209,8 +2209,10 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
 
         log = root->log_root;
         path = btrfs_alloc_path();
-        if (!path)
-                return -ENOMEM;
+        if (!path) {
+                err = -ENOMEM;
+                goto out_unlock;
+        }
 
         di = btrfs_lookup_dir_item(trans, log, path, dir->i_ino,
                                    name, name_len, -1);
@@ -2271,6 +2273,7 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
         }
 fail:
         btrfs_free_path(path);
+out_unlock:
         mutex_unlock(&BTRFS_I(dir)->log_mutex);
         if (ret == -ENOSPC) {
                 root->fs_info->last_trans_log_full_commit = trans->transid;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 309a57b9fc85..c7367ae5a3e6 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -155,6 +155,15 @@ static noinline int run_scheduled_bios(struct btrfs_device *device)
         unsigned long limit;
         unsigned long last_waited = 0;
         int force_reg = 0;
+        struct blk_plug plug;
+
+        /*
+         * this function runs all the bios we've collected for
+         * a particular device.  We don't want to wander off to
+         * another device without first sending all of these down.
+         * So, setup a plug here and finish it off before we return
+         */
+        blk_start_plug(&plug);
 
         bdi = blk_get_backing_dev_info(device->bdev);
         fs_info = device->dev_root->fs_info;
@@ -294,6 +303,7 @@ loop_lock:
         spin_unlock(&device->io_lock);
 
 done:
+        blk_finish_plug(&plug);
         return 0;
 }
 
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index e159c529fd2b..38b8ab554924 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -775,6 +775,13 @@ get_more_pages:
                                             ci->i_truncate_seq,
                                             ci->i_truncate_size,
                                             &inode->i_mtime, true, 1, 0);
+
+                                if (!req) {
+                                        rc = -ENOMEM;
+                                        unlock_page(page);
+                                        break;
+                                }
+
                                 max_pages = req->r_num_pages;
 
                                 alloc_page_vec(fsc, req);
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 5323c330bbf3..9fa08662a88d 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1331,10 +1331,11 @@ static void ceph_flush_snaps(struct ceph_inode_info *ci)
 }
 
 /*
- * Mark caps dirty.  If inode is newly dirty, add to the global dirty
- * list.
+ * Mark caps dirty.  If inode is newly dirty, return the dirty flags.
+ * Caller is then responsible for calling __mark_inode_dirty with the
+ * returned flags value.
  */
-void __ceph_mark_dirty_caps(struct ceph_inode_info *ci, int mask)
+int __ceph_mark_dirty_caps(struct ceph_inode_info *ci, int mask)
 {
         struct ceph_mds_client *mdsc =
                 ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc;
@@ -1357,7 +1358,7 @@ void __ceph_mark_dirty_caps(struct ceph_inode_info *ci, int mask)
                 list_add(&ci->i_dirty_item, &mdsc->cap_dirty);
                 spin_unlock(&mdsc->cap_dirty_lock);
                 if (ci->i_flushing_caps == 0) {
-                        igrab(inode);
+                        ihold(inode);
                         dirty |= I_DIRTY_SYNC;
                 }
         }
@@ -1365,9 +1366,8 @@ void __ceph_mark_dirty_caps(struct ceph_inode_info *ci, int mask)
         if (((was | ci->i_flushing_caps) & CEPH_CAP_FILE_BUFFER) &&
             (mask & CEPH_CAP_FILE_BUFFER))
                 dirty |= I_DIRTY_DATASYNC;
-        if (dirty)
-                __mark_inode_dirty(inode, dirty);
         __cap_delay_requeue(mdsc, ci);
+        return dirty;
 }
 
 /*
@@ -1991,7 +1991,7 @@ static void __take_cap_refs(struct ceph_inode_info *ci, int got)
                 ci->i_wr_ref++;
         if (got & CEPH_CAP_FILE_BUFFER) {
                 if (ci->i_wrbuffer_ref == 0)
-                        igrab(&ci->vfs_inode);
+                        ihold(&ci->vfs_inode);
                 ci->i_wrbuffer_ref++;
                 dout("__take_cap_refs %p wrbuffer %d -> %d (?)\n",
                      &ci->vfs_inode, ci->i_wrbuffer_ref-1, ci->i_wrbuffer_ref);
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 159b512d5a27..203252d88d9f 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -734,9 +734,12 @@ retry_snap:
                 }
         }
         if (ret >= 0) {
+                int dirty;
                 spin_lock(&inode->i_lock);
-                __ceph_mark_dirty_caps(ci, CEPH_CAP_FILE_WR);
+                dirty = __ceph_mark_dirty_caps(ci, CEPH_CAP_FILE_WR);
                 spin_unlock(&inode->i_lock);
+                if (dirty)
+                        __mark_inode_dirty(inode, dirty);
         }
 
 out:
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index b54c97da1c43..03d6dafda61f 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1567,6 +1567,7 @@ int ceph_setattr(struct dentry *dentry, struct iattr *attr)
         int release = 0, dirtied = 0;
         int mask = 0;
         int err = 0;
+        int inode_dirty_flags = 0;
 
         if (ceph_snap(inode) != CEPH_NOSNAP)
                 return -EROFS;
@@ -1725,13 +1726,16 @@ int ceph_setattr(struct dentry *dentry, struct iattr *attr)
                 dout("setattr %p ATTR_FILE ... hrm!\n", inode);
 
         if (dirtied) {
-                __ceph_mark_dirty_caps(ci, dirtied);
+                inode_dirty_flags = __ceph_mark_dirty_caps(ci, dirtied);
                 inode->i_ctime = CURRENT_TIME;
         }
 
         release &= issued;
         spin_unlock(&inode->i_lock);
 
+        if (inode_dirty_flags)
+                __mark_inode_dirty(inode, inode_dirty_flags);
+
         if (mask) {
                 req->r_inode = igrab(inode);
                 req->r_inode_drop = release;
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 619fe719968f..b1f1b8bb1271 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -506,7 +506,7 @@ static inline int __ceph_caps_dirty(struct ceph_inode_info *ci)
 {
         return ci->i_dirty_caps | ci->i_flushing_caps;
 }
-extern void __ceph_mark_dirty_caps(struct ceph_inode_info *ci, int mask);
+extern int __ceph_mark_dirty_caps(struct ceph_inode_info *ci, int mask);
 
 extern int ceph_caps_revoking(struct ceph_inode_info *ci, int mask);
 extern int __ceph_caps_used(struct ceph_inode_info *ci);
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 8c9eba6ef9df..f2b628696180 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -703,6 +703,7 @@ int ceph_setxattr(struct dentry *dentry, const char *name,
         struct ceph_inode_xattr *xattr = NULL;
         int issued;
         int required_blob_size;
+        int dirty;
 
         if (ceph_snap(inode) != CEPH_NOSNAP)
                 return -EROFS;
@@ -763,11 +764,12 @@ retry:
         dout("setxattr %p issued %s\n", inode, ceph_cap_string(issued));
         err = __set_xattr(ci, newname, name_len, newval,
                           val_len, 1, 1, 1, &xattr);
-        __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
+        dirty = __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
         ci->i_xattrs.dirty = true;
         inode->i_ctime = CURRENT_TIME;
         spin_unlock(&inode->i_lock);
-
+        if (dirty)
+                __mark_inode_dirty(inode, dirty);
         return err;
 
 do_sync:
@@ -810,6 +812,7 @@ int ceph_removexattr(struct dentry *dentry, const char *name)
         struct ceph_vxattr_cb *vxattrs = ceph_inode_vxattrs(inode);
         int issued;
         int err;
+        int dirty;
 
         if (ceph_snap(inode) != CEPH_NOSNAP)
                 return -EROFS;
@@ -833,12 +836,13 @@ int ceph_removexattr(struct dentry *dentry, const char *name)
                 goto do_sync;
 
         err = __remove_xattr_by_name(ceph_inode(inode), name);
-        __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
+        dirty = __ceph_mark_dirty_caps(ci, CEPH_CAP_XATTR_EXCL);
         ci->i_xattrs.dirty = true;
         inode->i_ctime = CURRENT_TIME;
 
         spin_unlock(&inode->i_lock);
-
+        if (dirty)
+                __mark_inode_dirty(inode, dirty);
         return err;
 do_sync:
         spin_unlock(&inode->i_lock);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index db9d55b507d0..05f1dcf7d79a 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -274,7 +274,8 @@ static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
         char *data_area_of_target;
         char *data_area_of_buf2;
         int remaining;
-        __u16 byte_count, total_data_size, total_in_buf, total_in_buf2;
+        unsigned int byte_count, total_in_buf;
+        __u16 total_data_size, total_in_buf2;
 
         total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 
@@ -287,7 +288,7 @@ static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
         remaining = total_data_size - total_in_buf;
 
         if (remaining < 0)
-                return -EINVAL;
+                return -EPROTO;
 
         if (remaining == 0) /* nothing to do, ignore */
                 return 0;
@@ -308,20 +309,29 @@ static int coalesce_t2(struct smb_hdr *psecond, struct smb_hdr *pTargetSMB)
         data_area_of_target += total_in_buf;
 
         /* copy second buffer into end of first buffer */
-        memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
         total_in_buf += total_in_buf2;
+        /* is the result too big for the field? */
+        if (total_in_buf > USHRT_MAX)
+                return -EPROTO;
         put_unaligned_le16(total_in_buf, &pSMBt->t2_rsp.DataCount);
+
+        /* fix up the BCC */
         byte_count = get_bcc_le(pTargetSMB);
         byte_count += total_in_buf2;
+        /* is the result too big for the field? */
+        if (byte_count > USHRT_MAX)
+                return -EPROTO;
         put_bcc_le(byte_count, pTargetSMB);
 
         byte_count = pTargetSMB->smb_buf_length;
         byte_count += total_in_buf2;
-
-        /* BB also add check that we are not beyond maximum buffer size */
-
+        /* don't allow buffer to overflow */
+        if (byte_count > CIFSMaxBufSize)
+                return -ENOBUFS;
         pTargetSMB->smb_buf_length = byte_count;
 
+        memcpy(data_area_of_target, data_area_of_buf2, total_in_buf2);
+
         if (remaining == total_in_buf2) {
                 cFYI(1, "found the last secondary response");
                 return 0; /* we are done */
@@ -607,59 +617,63 @@ incomplete_rcv:
                 list_for_each_safe(tmp, tmp2, &server->pending_mid_q) {
                         mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
 
-                        if ((mid_entry->mid == smb_buffer->Mid) &&
-                            (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
-                            (mid_entry->command == smb_buffer->Command)) {
-                                if (length == 0 &&
-                                   check2ndT2(smb_buffer, server->maxBuf) > 0) {
-                                        /* We have a multipart transact2 resp */
-                                        isMultiRsp = true;
-                                        if (mid_entry->resp_buf) {
-                                                /* merge response - fix up 1st*/
-                                                if (coalesce_t2(smb_buffer,
-                                                        mid_entry->resp_buf)) {
-                                                        mid_entry->multiRsp =
-                                                                 true;
-                                                        break;
-                                                } else {
-                                                        /* all parts received */
-                                                        mid_entry->multiEnd =
-                                                                 true;
-                                                        goto multi_t2_fnd;
-                                                }
+                        if (mid_entry->mid != smb_buffer->Mid ||
+                            mid_entry->midState != MID_REQUEST_SUBMITTED ||
+                            mid_entry->command != smb_buffer->Command) {
+                                mid_entry = NULL;
+                                continue;
+                        }
+
+                        if (length == 0 &&
+                            check2ndT2(smb_buffer, server->maxBuf) > 0) {
+                                /* We have a multipart transact2 resp */
+                                isMultiRsp = true;
+                                if (mid_entry->resp_buf) {
+                                        /* merge response - fix up 1st*/
+                                        length = coalesce_t2(smb_buffer,
+                                                        mid_entry->resp_buf);
+                                        if (length > 0) {
+                                                length = 0;
+                                                mid_entry->multiRsp = true;
+                                                break;
                                         } else {
-                                                if (!isLargeBuf) {
-                                                        cERROR(1, "1st trans2 resp needs bigbuf");
-                                        /* BB maybe we can fix this up,  switch
-                                           to already allocated large buffer? */
-                                                } else {
-                                                        /* Have first buffer */
-                                                        mid_entry->resp_buf =
-                                                                 smb_buffer;
-                                                        mid_entry->largeBuf =
-                                                                 true;
-                                                        bigbuf = NULL;
-                                                }
+                                                /* all parts received or
+                                                 * packet is malformed
+                                                 */
+                                                mid_entry->multiEnd = true;
+                                                goto multi_t2_fnd;
+                                        }
+                                } else {
+                                        if (!isLargeBuf) {
+                                                /*
+                                                 * FIXME: switch to already
+                                                 *        allocated largebuf?
+                                                 */
+                                                cERROR(1, "1st trans2 resp "
+                                                          "needs bigbuf");
+                                        } else {
+                                                /* Have first buffer */
+                                                mid_entry->resp_buf =
+                                                         smb_buffer;
+                                                mid_entry->largeBuf = true;
+                                                bigbuf = NULL;
                                         }
-                                        break;
                                 }
-                                mid_entry->resp_buf = smb_buffer;
-                                mid_entry->largeBuf = isLargeBuf;
+                                break;
+                        }
+                        mid_entry->resp_buf = smb_buffer;
+                        mid_entry->largeBuf = isLargeBuf;
 multi_t2_fnd:
-                                if (length == 0)
-                                        mid_entry->midState =
-                                                        MID_RESPONSE_RECEIVED;
-                                else
-                                        mid_entry->midState =
-                                                        MID_RESPONSE_MALFORMED;
+                        if (length == 0)
+                                mid_entry->midState = MID_RESPONSE_RECEIVED;
+                        else
+                                mid_entry->midState = MID_RESPONSE_MALFORMED;
 #ifdef CONFIG_CIFS_STATS2
-                                mid_entry->when_received = jiffies;
+                        mid_entry->when_received = jiffies;
 #endif
-                                list_del_init(&mid_entry->qhead);
-                                mid_entry->callback(mid_entry);
-                                break;
-                        }
-                        mid_entry = NULL;
+                        list_del_init(&mid_entry->qhead);
+                        mid_entry->callback(mid_entry);
+                        break;
                 }
                 spin_unlock(&GlobalMid_Lock);
 
@@ -807,8 +821,7 @@ static int
 cifs_parse_mount_options(char *options, const char *devname,
                          struct smb_vol *vol)
 {
-        char *value;
-        char *data;
+        char *value, *data, *end;
         unsigned int  temp_len, i, j;
         char separator[2];
         short int override_uid = -1;
@@ -851,6 +864,7 @@ cifs_parse_mount_options(char *options, const char *devname,
         if (!options)
                 return 1;
 
+        end = options + strlen(options);
         if (strncmp(options, "sep=", 4) == 0) {
                 if (options[4] != 0) {
                         separator[0] = options[4];
@@ -916,6 +930,7 @@ cifs_parse_mount_options(char *options, const char *devname,
                         the only illegal character in a password is null */
 
                         if ((value[temp_len] == 0) &&
+                            (value + temp_len < end) &&
                             (value[temp_len+1] == separator[0])) {
                                 /* reinsert comma */
                                 value[temp_len] = separator[0];
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index f6728eb6f4b9..645114ad0a10 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -276,7 +276,7 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
 }
 
 static void
-decode_unicode_ssetup(char **pbcc_area, __u16 bleft, struct cifsSesInfo *ses,
+decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifsSesInfo *ses,
                       const struct nls_table *nls_cp)
 {
         int len;
@@ -284,19 +284,6 @@ decode_unicode_ssetup(char **pbcc_area, __u16 bleft, struct cifsSesInfo *ses,
 
         cFYI(1, "bleft %d", bleft);
 
-        /*
-         * Windows servers do not always double null terminate their final
-         * Unicode string. Check to see if there are an uneven number of bytes
-         * left. If so, then add an extra NULL pad byte to the end of the
-         * response.
-         *
-         * See section 2.7.2 in "Implementing CIFS" for details
-         */
-        if (bleft % 2) {
-                data[bleft] = 0;
-                ++bleft;
-        }
-
         kfree(ses->serverOS);
         ses->serverOS = cifs_strndup_from_ucs(data, bleft, true, nls_cp);
         cFYI(1, "serverOS=%s", ses->serverOS);
@@ -929,7 +916,9 @@ ssetup_ntlmssp_authenticate:
         }
 
         /* BB check if Unicode and decode strings */
-        if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
+        if (bytes_remaining == 0) {
+                /* no string area to decode, do nothing */
+        } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
                 /* unicode string area must be word-aligned */
                 if (((unsigned long) bcc_ptr - (unsigned long) smb_buf) % 2) {
                         ++bcc_ptr;
diff --git a/fs/file.c b/fs/file.c
index 0be344755c02..4c6992d8f3ba 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -9,6 +9,7 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/mm.h>
+#include <linux/mmzone.h>
 #include <linux/time.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
@@ -39,14 +40,17 @@ int sysctl_nr_open_max = 1024 * 1024; /* raised later */
  */
 static DEFINE_PER_CPU(struct fdtable_defer, fdtable_defer_list);
 
-static inline void *alloc_fdmem(unsigned int size)
+static void *alloc_fdmem(unsigned int size)
 {
-        void *data;
-
-        data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
-        if (data != NULL)
-                return data;
-
+        /*
+         * Very large allocations can stress page reclaim, so fall back to
+         * vmalloc() if the allocation size will be considered "large" by the VM.
+         */
+        if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
+                void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
+                if (data != NULL)
+                        return data;
+        }
         return vmalloc(size);
 }
 
diff --git a/fs/hpfs/Kconfig b/fs/hpfs/Kconfig
index 0c39dc3ef7d7..56bd15c5bf6c 100644
--- a/fs/hpfs/Kconfig
+++ b/fs/hpfs/Kconfig
@@ -1,7 +1,6 @@
 config HPFS_FS
         tristate "OS/2 HPFS file system support"
         depends on BLOCK
-        depends on BROKEN || !PREEMPT
         help
           OS/2 is IBM's operating system for PC's, the same as Warp, and HPFS
           is the file system used for organizing files on OS/2 hard disk
diff --git a/fs/hpfs/alloc.c b/fs/hpfs/alloc.c
index 5503e2c28910..7a5eb2c718c8 100644
--- a/fs/hpfs/alloc.c
+++ b/fs/hpfs/alloc.c
@@ -8,8 +8,6 @@
 
 #include "hpfs_fn.h"
 
-static int hpfs_alloc_if_possible_nolock(struct super_block *s, secno sec);
-
 /*
  * Check if a sector is allocated in bitmap
  * This is really slow. Turned on only if chk==2
@@ -18,9 +16,9 @@ static int hpfs_alloc_if_possible_nolock(struct super_block *s, secno sec);
 static int chk_if_allocated(struct super_block *s, secno sec, char *msg)
 {
         struct quad_buffer_head qbh;
-        unsigned *bmp;
+        u32 *bmp;
         if (!(bmp = hpfs_map_bitmap(s, sec >> 14, &qbh, "chk"))) goto fail;
-        if ((bmp[(sec & 0x3fff) >> 5] >> (sec & 0x1f)) & 1) {
+        if ((cpu_to_le32(bmp[(sec & 0x3fff) >> 5]) >> (sec & 0x1f)) & 1) {
                 hpfs_error(s, "sector '%s' - %08x not allocated in bitmap", msg, sec);
                 goto fail1;
         }
@@ -28,7 +26,7 @@ static int chk_if_allocated(struct super_block *s, secno sec, char *msg)
         if (sec >= hpfs_sb(s)->sb_dirband_start && sec < hpfs_sb(s)->sb_dirband_start + hpfs_sb(s)->sb_dirband_size) {
                 unsigned ssec = (sec - hpfs_sb(s)->sb_dirband_start) / 4;
                 if (!(bmp = hpfs_map_dnode_bitmap(s, &qbh))) goto fail;
-                if ((bmp[ssec >> 5] >> (ssec & 0x1f)) & 1) {
+                if ((le32_to_cpu(bmp[ssec >> 5]) >> (ssec & 0x1f)) & 1) {
                         hpfs_error(s, "sector '%s' - %08x not allocated in directory bitmap", msg, sec);
                         goto fail1;
                 }
@@ -75,7 +73,6 @@ static secno alloc_in_bmp(struct super_block *s, secno near, unsigned n, unsigne
                 hpfs_error(s, "Bad allocation size: %d", n);
                 return 0;
         }
-        lock_super(s);
         if (bs != ~0x3fff) {
                 if (!(bmp = hpfs_map_bitmap(s, near >> 14, &qbh, "aib"))) goto uls;
         } else {
@@ -85,10 +82,6 @@ static secno alloc_in_bmp(struct super_block *s, secno near, unsigned n, unsigne
                 ret = bs + nr;
                 goto rt;
         }
-        /*if (!tstbits(bmp, nr + n, n + forward)) {
-                ret = bs + nr + n;
-                goto rt;
-        }*/
         q = nr + n; b = 0;
         while ((a = tstbits(bmp, q, n + forward)) != 0) {
                 q += a;
@@ -105,14 +98,14 @@ static secno alloc_in_bmp(struct super_block *s, secno near, unsigned n, unsigne
                 goto rt;
         }
         nr >>= 5;
-        /*for (i = nr + 1; i != nr; i++, i &= 0x1ff) {*/
+        /*for (i = nr + 1; i != nr; i++, i &= 0x1ff) */
         i = nr;
         do {
-                if (!bmp[i]) goto cont;
-                if (n + forward >= 0x3f && bmp[i] != -1) goto cont;
+                if (!le32_to_cpu(bmp[i])) goto cont;
+                if (n + forward >= 0x3f && le32_to_cpu(bmp[i]) != 0xffffffff) goto cont;
                 q = i<<5;
                 if (i > 0) {
-                        unsigned k = bmp[i-1];
+                        unsigned k = le32_to_cpu(bmp[i-1]);
                         while (k & 0x80000000) {
                                 q--; k <<= 1;
                         }
@@ -132,18 +125,17 @@ static secno alloc_in_bmp(struct super_block *s, secno near, unsigned n, unsigne
         } while (i != nr);
         rt:
         if (ret) {
-                if (hpfs_sb(s)->sb_chk && ((ret >> 14) != (bs >> 14) || (bmp[(ret & 0x3fff) >> 5] | ~(((1 << n) - 1) << (ret & 0x1f))) != 0xffffffff)) {
+                if (hpfs_sb(s)->sb_chk && ((ret >> 14) != (bs >> 14) || (le32_to_cpu(bmp[(ret & 0x3fff) >> 5]) | ~(((1 << n) - 1) << (ret & 0x1f))) != 0xffffffff)) {
                         hpfs_error(s, "Allocation doesn't work! Wanted %d, allocated at %08x", n, ret);
                         ret = 0;
                         goto b;
                 }
-                bmp[(ret & 0x3fff) >> 5] &= ~(((1 << n) - 1) << (ret & 0x1f));
+                bmp[(ret & 0x3fff) >> 5] &= cpu_to_le32(~(((1 << n) - 1) << (ret & 0x1f)));
                 hpfs_mark_4buffers_dirty(&qbh);
         }
         b:
         hpfs_brelse4(&qbh);
         uls:
-        unlock_super(s);
         return ret;
 }
 
@@ -155,7 +147,7 @@ static secno alloc_in_bmp(struct super_block *s, secno near, unsigned n, unsigne
  *                              sectors
  */
 
-secno hpfs_alloc_sector(struct super_block *s, secno near, unsigned n, int forward, int lock)
+secno hpfs_alloc_sector(struct super_block *s, secno near, unsigned n, int forward)
 {
         secno sec;
         int i;
@@ -167,7 +159,6 @@ secno hpfs_alloc_sector(struct super_block *s, secno near, unsigned n, int forwa
                 forward = -forward;
                 f_p = 1;
         }
-        if (lock) hpfs_lock_creation(s);
         n_bmps = (sbi->sb_fs_size + 0x4000 - 1) >> 14;
         if (near && near < sbi->sb_fs_size) {
                 if ((sec = alloc_in_bmp(s, near, n, f_p ? forward : forward/4))) goto ret;
@@ -214,18 +205,17 @@ secno hpfs_alloc_sector(struct super_block *s, secno near, unsigned n, int forwa
         ret:
         if (sec && f_p) {
                 for (i = 0; i < forward; i++) {
-                        if (!hpfs_alloc_if_possible_nolock(s, sec + i + 1)) {
+                        if (!hpfs_alloc_if_possible(s, sec + i + 1)) {
                                 hpfs_error(s, "Prealloc doesn't work! Wanted %d, allocated at %08x, can't allocate %d", forward, sec, i);
                                 sec = 0;
                                 break;
                         }
                 }
         }
-        if (lock) hpfs_unlock_creation(s);
         return sec;
 }
 
-static secno alloc_in_dirband(struct super_block *s, secno near, int lock)
+static secno alloc_in_dirband(struct super_block *s, secno near)
 {
         unsigned nr = near;
         secno sec;
@@ -236,49 +226,35 @@ static secno alloc_in_dirband(struct super_block *s, secno near, int lock)
                 nr = sbi->sb_dirband_start + sbi->sb_dirband_size - 4;
         nr -= sbi->sb_dirband_start;
         nr >>= 2;
-        if (lock) hpfs_lock_creation(s);
         sec = alloc_in_bmp(s, (~0x3fff) | nr, 1, 0);
-        if (lock) hpfs_unlock_creation(s);
         if (!sec) return 0;
         return ((sec & 0x3fff) << 2) + sbi->sb_dirband_start;
 }
 
 /* Alloc sector if it's free */
 
-static int hpfs_alloc_if_possible_nolock(struct super_block *s, secno sec)
+int hpfs_alloc_if_possible(struct super_block *s, secno sec)
 {
         struct quad_buffer_head qbh;
-        unsigned *bmp;
-        lock_super(s);
+        u32 *bmp;
         if (!(bmp = hpfs_map_bitmap(s, sec >> 14, &qbh, "aip"))) goto end;
-        if (bmp[(sec & 0x3fff) >> 5] & (1 << (sec & 0x1f))) {
-                bmp[(sec & 0x3fff) >> 5] &= ~(1 << (sec & 0x1f));
+        if (le32_to_cpu(bmp[(sec & 0x3fff) >> 5]) & (1 << (sec & 0x1f))) {
+                bmp[(sec & 0x3fff) >> 5] &= cpu_to_le32(~(1 << (sec & 0x1f)));
                 hpfs_mark_4buffers_dirty(&qbh);
                 hpfs_brelse4(&qbh);
-                unlock_super(s);
                 return 1;
         }
         hpfs_brelse4(&qbh);
         end:
-        unlock_super(s);
         return 0;
 }
 
-int hpfs_alloc_if_possible(struct super_block *s, secno sec)
-{
-        int r;
-        hpfs_lock_creation(s);
-        r = hpfs_alloc_if_possible_nolock(s, sec);
-        hpfs_unlock_creation(s);
-        return r;
-}
-
 /* Free sectors in bitmaps */
 
 void hpfs_free_sectors(struct super_block *s, secno sec, unsigned n)
 {
         struct quad_buffer_head qbh;
-        unsigned *bmp;
+        u32 *bmp;
         struct hpfs_sb_info *sbi = hpfs_sb(s);
         /*printk("2 - ");*/
         if (!n) return;
@@ -286,26 +262,22 @@ void hpfs_free_sectors(struct super_block *s, secno sec, unsigned n)
                 hpfs_error(s, "Trying to free reserved sector %08x", sec);
                 return;
         }
-        lock_super(s);
         sbi->sb_max_fwd_alloc += n > 0xffff ? 0xffff : n;
         if (sbi->sb_max_fwd_alloc > 0xffffff) sbi->sb_max_fwd_alloc = 0xffffff;
         new_map:
         if (!(bmp = hpfs_map_bitmap(s, sec >> 14, &qbh, "free"))) {
-                unlock_super(s);
                 return;
         }       
         new_tst:
-        if ((bmp[(sec & 0x3fff) >> 5] >> (sec & 0x1f) & 1)) {
+        if ((le32_to_cpu(bmp[(sec & 0x3fff) >> 5]) >> (sec & 0x1f) & 1)) {
                 hpfs_error(s, "sector %08x not allocated", sec);
                 hpfs_brelse4(&qbh);
-                unlock_super(s);
                 return;
         }
-        bmp[(sec & 0x3fff) >> 5] |= 1 << (sec & 0x1f);
+        bmp[(sec & 0x3fff) >> 5] |= cpu_to_le32(1 << (sec & 0x1f));
         if (!--n) {
                 hpfs_mark_4buffers_dirty(&qbh);
                 hpfs_brelse4(&qbh);
-                unlock_super(s);
                 return;
         }       
         if (!(++sec & 0x3fff)) {
@@ -327,13 +299,13 @@ int hpfs_check_free_dnodes(struct super_block *s, int n)
         int n_bmps = (hpfs_sb(s)->sb_fs_size + 0x4000 - 1) >> 14;
         int b = hpfs_sb(s)->sb_c_bitmap & 0x0fffffff;
         int i, j;
-        unsigned *bmp;
+        u32 *bmp;
         struct quad_buffer_head qbh;
         if ((bmp = hpfs_map_dnode_bitmap(s, &qbh))) {
                 for (j = 0; j < 512; j++) {
                         unsigned k;
-                        if (!bmp[j]) continue;
-                        for (k = bmp[j]; k; k >>= 1) if (k & 1) if (!--n) {
+                        if (!le32_to_cpu(bmp[j])) continue;
+                        for (k = le32_to_cpu(bmp[j]); k; k >>= 1) if (k & 1) if (!--n) {
                                 hpfs_brelse4(&qbh);
                                 return 0;
                         }
@@ -352,10 +324,10 @@ int hpfs_check_free_dnodes(struct super_block *s, int n)
         chk_bmp:
         if (bmp) {
                 for (j = 0; j < 512; j++) {
-                        unsigned k;
-                        if (!bmp[j]) continue;
+                        u32 k;
+                        if (!le32_to_cpu(bmp[j])) continue;
                         for (k = 0xf; k; k <<= 4)
-                                if ((bmp[j] & k) == k) {
+                                if ((le32_to_cpu(bmp[j]) & k) == k) {
                                         if (!--n) {
                                                 hpfs_brelse4(&qbh);
                                                 return 0;
@@ -379,44 +351,40 @@ void hpfs_free_dnode(struct super_block *s, dnode_secno dno)
                 hpfs_free_sectors(s, dno, 4);
         } else {
                 struct quad_buffer_head qbh;
-                unsigned *bmp;
+                u32 *bmp;
                 unsigned ssec = (dno - hpfs_sb(s)->sb_dirband_start) / 4;
-                lock_super(s);
                 if (!(bmp = hpfs_map_dnode_bitmap(s, &qbh))) {
-                        unlock_super(s);
                         return;
                 }
-                bmp[ssec >> 5] |= 1 << (ssec & 0x1f);
+                bmp[ssec >> 5] |= cpu_to_le32(1 << (ssec & 0x1f));
                 hpfs_mark_4buffers_dirty(&qbh);
                 hpfs_brelse4(&qbh);
-                unlock_super(s);
         }
 }
 
 struct dnode *hpfs_alloc_dnode(struct super_block *s, secno near,
-                         dnode_secno *dno, struct quad_buffer_head *qbh,
-                         int lock)
+                         dnode_secno *dno, struct quad_buffer_head *qbh)
 {
         struct dnode *d;
         if (hpfs_count_one_bitmap(s, hpfs_sb(s)->sb_dmap) > FREE_DNODES_ADD) {
-                if (!(*dno = alloc_in_dirband(s, near, lock)))
-                        if (!(*dno = hpfs_alloc_sector(s, near, 4, 0, lock))) return NULL;
+                if (!(*dno = alloc_in_dirband(s, near)))
+                        if (!(*dno = hpfs_alloc_sector(s, near, 4, 0))) return NULL;
         } else {
-                if (!(*dno = hpfs_alloc_sector(s, near, 4, 0, lock)))
-                        if (!(*dno = alloc_in_dirband(s, near, lock))) return NULL;
+                if (!(*dno = hpfs_alloc_sector(s, near, 4, 0)))
+                        if (!(*dno = alloc_in_dirband(s, near))) return NULL;
         }
         if (!(d = hpfs_get_4sectors(s, *dno, qbh))) {
                 hpfs_free_dnode(s, *dno);
                 return NULL;
         }
         memset(d, 0, 2048);
-        d->magic = DNODE_MAGIC;
-        d->first_free = 52;
+        d->magic = cpu_to_le32(DNODE_MAGIC);
+        d->first_free = cpu_to_le32(52);
         d->dirent[0] = 32;
         d->dirent[2] = 8;
         d->dirent[30] = 1;
         d->dirent[31] = 255;
-        d->self = *dno;
+        d->self = cpu_to_le32(*dno);
         return d;
 }
 
@@ -424,16 +392,16 @@ struct fnode *hpfs_alloc_fnode(struct super_block *s, secno near, fnode_secno *f
                           struct buffer_head **bh)
 {
         struct fnode *f;
-        if (!(*fno = hpfs_alloc_sector(s, near, 1, FNODE_ALLOC_FWD, 1))) return NULL;
+        if (!(*fno = hpfs_alloc_sector(s, near, 1, FNODE_ALLOC_FWD))) return NULL;
         if (!(f = hpfs_get_sector(s, *fno, bh))) {
                 hpfs_free_sectors(s, *fno, 1);
                 return NULL;
         }       
         memset(f, 0, 512);
-        f->magic = FNODE_MAGIC;
-        f->ea_offs = 0xc4;
+        f->magic = cpu_to_le32(FNODE_MAGIC);
+        f->ea_offs = cpu_to_le16(0xc4);
         f->btree.n_free_nodes = 8;
-        f->btree.first_free = 8;
+        f->btree.first_free = cpu_to_le16(8);
         return f;
 }
 
@@ -441,16 +409,16 @@ struct anode *hpfs_alloc_anode(struct super_block *s, secno near, anode_secno *a
                           struct buffer_head **bh)
 {
         struct anode *a;
-        if (!(*ano = hpfs_alloc_sector(s, near, 1, ANODE_ALLOC_FWD, 1))) return NULL;
+        if (!(*ano = hpfs_alloc_sector(s, near, 1, ANODE_ALLOC_FWD))) return NULL;
         if (!(a = hpfs_get_sector(s, *ano, bh))) {
                 hpfs_free_sectors(s, *ano, 1);
                 return NULL;
         }
         memset(a, 0, 512);
-        a->magic = ANODE_MAGIC;
-        a->self = *ano;
+        a->magic = cpu_to_le32(ANODE_MAGIC);
+        a->self = cpu_to_le32(*ano);
         a->btree.n_free_nodes = 40;
         a->btree.n_used_nodes = 0;
-        a->btree.first_free = 8;
+        a->btree.first_free = cpu_to_le16(8);
         return a;
 }
diff --git a/fs/hpfs/anode.c b/fs/hpfs/anode.c
index 6a2f04bf3df0..08b503e8ed29 100644
--- a/fs/hpfs/anode.c
+++ b/fs/hpfs/anode.c
@@ -22,8 +22,8 @@ secno hpfs_bplus_lookup(struct super_block *s, struct inode *inode,
         if (hpfs_sb(s)->sb_chk) if (hpfs_stop_cycles(s, a, &c1, &c2, "hpfs_bplus_lookup")) return -1;
         if (btree->internal) {
                 for (i = 0; i < btree->n_used_nodes; i++)
-                        if (btree->u.internal[i].file_secno > sec) {
-                                a = btree->u.internal[i].down;
+                        if (le32_to_cpu(btree->u.internal[i].file_secno) > sec) {
+                                a = le32_to_cpu(btree->u.internal[i].down);
                                 brelse(bh);
                                 if (!(anode = hpfs_map_anode(s, a, &bh))) return -1;
                                 btree = &anode->btree;
@@ -34,18 +34,18 @@ secno hpfs_bplus_lookup(struct super_block *s, struct inode *inode,
                 return -1;
         }
         for (i = 0; i < btree->n_used_nodes; i++)
-                if (btree->u.external[i].file_secno <= sec &&
-                    btree->u.external[i].file_secno + btree->u.external[i].length > sec) {
-                        a = btree->u.external[i].disk_secno + sec - btree->u.external[i].file_secno;
+                if (le32_to_cpu(btree->u.external[i].file_secno) <= sec &&
+                    le32_to_cpu(btree->u.external[i].file_secno) + le32_to_cpu(btree->u.external[i].length) > sec) {
+                        a = le32_to_cpu(btree->u.external[i].disk_secno) + sec - le32_to_cpu(btree->u.external[i].file_secno);
                         if (hpfs_sb(s)->sb_chk) if (hpfs_chk_sectors(s, a, 1, "data")) {
                                 brelse(bh);
                                 return -1;
                         }
                         if (inode) {
                                 struct hpfs_inode_info *hpfs_inode = hpfs_i(inode);
-                                hpfs_inode->i_file_sec = btree->u.external[i].file_secno;
-                                hpfs_inode->i_disk_sec = btree->u.external[i].disk_secno;
-                                hpfs_inode->i_n_secs = btree->u.external[i].length;
+                                hpfs_inode->i_file_sec = le32_to_cpu(btree->u.external[i].file_secno);
+                                hpfs_inode->i_disk_sec = le32_to_cpu(btree->u.external[i].disk_secno);
+                                hpfs_inode->i_n_secs = le32_to_cpu(btree->u.external[i].length);
                         }
                         brelse(bh);
                         return a;
@@ -83,8 +83,8 @@ secno hpfs_add_sector_to_btree(struct super_block *s, secno node, int fnod, unsi
                 return -1;
         }
         if (btree->internal) {
-                a = btree->u.internal[n].down;
-                btree->u.internal[n].file_secno = -1;
+                a = le32_to_cpu(btree->u.internal[n].down);
+                btree->u.internal[n].file_secno = cpu_to_le32(-1);
                 mark_buffer_dirty(bh);
                 brelse(bh);
                 if (hpfs_sb(s)->sb_chk)
@@ -94,15 +94,15 @@ secno hpfs_add_sector_to_btree(struct super_block *s, secno node, int fnod, unsi
                 goto go_down;
         }
         if (n >= 0) {
-                if (btree->u.external[n].file_secno + btree->u.external[n].length != fsecno) {
+                if (le32_to_cpu(btree->u.external[n].file_secno) + le32_to_cpu(btree->u.external[n].length) != fsecno) {
                         hpfs_error(s, "allocated size %08x, trying to add sector %08x, %cnode %08x",
-                                btree->u.external[n].file_secno + btree->u.external[n].length, fsecno,
+                                le32_to_cpu(btree->u.external[n].file_secno) + le32_to_cpu(btree->u.external[n].length), fsecno,
                                 fnod?'f':'a', node);
                         brelse(bh);
                         return -1;
                 }
-                if (hpfs_alloc_if_possible(s, se = btree->u.external[n].disk_secno + btree->u.external[n].length)) {
-                        btree->u.external[n].length++;
+                if (hpfs_alloc_if_possible(s, se = le32_to_cpu(btree->u.external[n].disk_secno) + le32_to_cpu(btree->u.external[n].length))) {
+                        btree->u.external[n].length = cpu_to_le32(le32_to_cpu(btree->u.external[n].length) + 1);
                         mark_buffer_dirty(bh);
                         brelse(bh);
                         return se;
@@ -115,20 +115,20 @@ secno hpfs_add_sector_to_btree(struct super_block *s, secno node, int fnod, unsi
                 }
                 se = !fnod ? node : (node + 16384) & ~16383;
         }       
-        if (!(se = hpfs_alloc_sector(s, se, 1, fsecno*ALLOC_M>ALLOC_FWD_MAX ? ALLOC_FWD_MAX : fsecno*ALLOC_M<ALLOC_FWD_MIN ? ALLOC_FWD_MIN : fsecno*ALLOC_M, 1))) {
+        if (!(se = hpfs_alloc_sector(s, se, 1, fsecno*ALLOC_M>ALLOC_FWD_MAX ? ALLOC_FWD_MAX : fsecno*ALLOC_M<ALLOC_FWD_MIN ? ALLOC_FWD_MIN : fsecno*ALLOC_M))) {
                 brelse(bh);
                 return -1;
         }
-        fs = n < 0 ? 0 : btree->u.external[n].file_secno + btree->u.external[n].length;
+        fs = n < 0 ? 0 : le32_to_cpu(btree->u.external[n].file_secno) + le32_to_cpu(btree->u.external[n].length);
         if (!btree->n_free_nodes) {
-                up = a != node ? anode->up : -1;
+                up = a != node ? le32_to_cpu(anode->up) : -1;
                 if (!(anode = hpfs_alloc_anode(s, a, &na, &bh1))) {
                         brelse(bh);
                         hpfs_free_sectors(s, se, 1);
                         return -1;
                 }
                 if (a == node && fnod) {
-                        anode->up = node;
+                        anode->up = cpu_to_le32(node);
                         anode->btree.fnode_parent = 1;
                         anode->btree.n_used_nodes = btree->n_used_nodes;
                         anode->btree.first_free = btree->first_free;
@@ -137,9 +137,9 @@ secno hpfs_add_sector_to_btree(struct super_block *s, secno node, int fnod, unsi
                         btree->internal = 1;
                         btree->n_free_nodes = 11;
                         btree->n_used_nodes = 1;
-                        btree->first_free = (char *)&(btree->u.internal[1]) - (char *)btree;
-                        btree->u.internal[0].file_secno = -1;
-                        btree->u.internal[0].down = na;
+                        btree->first_free = cpu_to_le16((char *)&(btree->u.internal[1]) - (char *)btree);
+                        btree->u.internal[0].file_secno = cpu_to_le32(-1);
+                        btree->u.internal[0].down = cpu_to_le32(na);
                         mark_buffer_dirty(bh);
                 } else if (!(ranode = hpfs_alloc_anode(s, /*a*/0, &ra, &bh2))) {
                         brelse(bh);
@@ -153,15 +153,15 @@ secno hpfs_add_sector_to_btree(struct super_block *s, secno node, int fnod, unsi
                 btree = &anode->btree;
         }
         btree->n_free_nodes--; n = btree->n_used_nodes++;
-        btree->first_free += 12;
-        btree->u.external[n].disk_secno = se;
-        btree->u.external[n].file_secno = fs;
-        btree->u.external[n].length = 1;
+        btree->first_free = cpu_to_le16(le16_to_cpu(btree->first_free) + 12);
+        btree->u.external[n].disk_secno = cpu_to_le32(se);
+        btree->u.external[n].file_secno = cpu_to_le32(fs);
+        btree->u.external[n].length = cpu_to_le32(1);
         mark_buffer_dirty(bh);
         brelse(bh);
         if ((a == node && fnod) || na == -1) return se;
         c2 = 0;
-        while (up != -1) {
+        while (up != (anode_secno)-1) {
                 struct anode *new_anode;
                 if (hpfs_sb(s)->sb_chk)
                         if (hpfs_stop_cycles(s, up, &c1, &c2, "hpfs_add_sector_to_btree #2")) return -1;
@@ -174,47 +174,47 @@ secno hpfs_add_sector_to_btree(struct super_block *s, secno node, int fnod, unsi
                 }
                 if (btree->n_free_nodes) {
                         btree->n_free_nodes--; n = btree->n_used_nodes++;
-                        btree->first_free += 8;
-                        btree->u.internal[n].file_secno = -1;
-                        btree->u.internal[n].down = na;
-                        btree->u.internal[n-1].file_secno = fs;
+                        btree->first_free = cpu_to_le16(le16_to_cpu(btree->first_free) + 8);
+                        btree->u.internal[n].file_secno = cpu_to_le32(-1);
+                        btree->u.internal[n].down = cpu_to_le32(na);
+                        btree->u.internal[n-1].file_secno = cpu_to_le32(fs);
                         mark_buffer_dirty(bh);
                         brelse(bh);
                         brelse(bh2);
                         hpfs_free_sectors(s, ra, 1);
                         if ((anode = hpfs_map_anode(s, na, &bh))) {
-                                anode->up = up;
+                                anode->up = cpu_to_le32(up);
                                 anode->btree.fnode_parent = up == node && fnod;
                                 mark_buffer_dirty(bh);
                                 brelse(bh);
                         }
                         return se;
                 }
-                up = up != node ? anode->up : -1;
-                btree->u.internal[btree->n_used_nodes - 1].file_secno = /*fs*/-1;
+                up = up != node ? le32_to_cpu(anode->up) : -1;
+                btree->u.internal[btree->n_used_nodes - 1].file_secno = cpu_to_le32(/*fs*/-1);
                 mark_buffer_dirty(bh);
                 brelse(bh);
                 a = na;
                 if ((new_anode = hpfs_alloc_anode(s, a, &na, &bh))) {
                         anode = new_anode;
-                        /*anode->up = up != -1 ? up : ra;*/
+                        /*anode->up = cpu_to_le32(up != -1 ? up : ra);*/
                         anode->btree.internal = 1;
                         anode->btree.n_used_nodes = 1;
                         anode->btree.n_free_nodes = 59;
-                        anode->btree.first_free = 16;
-                        anode->btree.u.internal[0].down = a;
-                        anode->btree.u.internal[0].file_secno = -1;
+                        anode->btree.first_free = cpu_to_le16(16);
+                        anode->btree.u.internal[0].down = cpu_to_le32(a);
+                        anode->btree.u.internal[0].file_secno = cpu_to_le32(-1);
                         mark_buffer_dirty(bh);
                         brelse(bh);
                         if ((anode = hpfs_map_anode(s, a, &bh))) {
-                                anode->up = na;
+                                anode->up = cpu_to_le32(na);
                                 mark_buffer_dirty(bh);
                                 brelse(bh);
                         }
                 } else na = a;
         }
         if ((anode = hpfs_map_anode(s, na, &bh))) {
-                anode->up = node;
+                anode->up = cpu_to_le32(node);
                 if (fnod) anode->btree.fnode_parent = 1;
                 mark_buffer_dirty(bh);
                 brelse(bh);
@@ -232,14 +232,14 @@ secno hpfs_add_sector_to_btree(struct super_block *s, secno node, int fnod, unsi
                 }
                 btree = &fnode->btree;
         }
-        ranode->up = node;
-        memcpy(&ranode->btree, btree, btree->first_free);
+        ranode->up = cpu_to_le32(node);
+        memcpy(&ranode->btree, btree, le16_to_cpu(btree->first_free));
         if (fnod) ranode->btree.fnode_parent = 1;
         ranode->btree.n_free_nodes = (ranode->btree.internal ? 60 : 40) - ranode->btree.n_used_nodes;
         if (ranode->btree.internal) for (n = 0; n < ranode->btree.n_used_nodes; n++) {
                 struct anode *unode;
-                if ((unode = hpfs_map_anode(s, ranode->u.internal[n].down, &bh1))) {
-                        unode->up = ra;
+                if ((unode = hpfs_map_anode(s, le32_to_cpu(ranode->u.internal[n].down), &bh1))) {
+                        unode->up = cpu_to_le32(ra);
                         unode->btree.fnode_parent = 0;
                         mark_buffer_dirty(bh1);
                         brelse(bh1);
@@ -248,11 +248,11 @@ secno hpfs_add_sector_to_btree(struct super_block *s, secno node, int fnod, unsi
         btree->internal = 1;
         btree->n_free_nodes = fnod ? 10 : 58;
         btree->n_used_nodes = 2;
-        btree->first_free = (char *)&btree->u.internal[2] - (char *)btree;
-        btree->u.internal[0].file_secno = fs;
-        btree->u.internal[0].down = ra;
-        btree->u.internal[1].file_secno = -1;
-        btree->u.internal[1].down = na;
+        btree->first_free = cpu_to_le16((char *)&btree->u.internal[2] - (char *)btree);
+        btree->u.internal[0].file_secno = cpu_to_le32(fs);
+        btree->u.internal[0].down = cpu_to_le32(ra);
+        btree->u.internal[1].file_secno = cpu_to_le32(-1);
+        btree->u.internal[1].down = cpu_to_le32(na);
         mark_buffer_dirty(bh);
         brelse(bh);
         mark_buffer_dirty(bh2);
@@ -279,7 +279,7 @@ void hpfs_remove_btree(struct super_block *s, struct bplus_header *btree)
         go_down:
         d2 = 0;
         while (btree1->internal) {
-                ano = btree1->u.internal[pos].down;
+                ano = le32_to_cpu(btree1->u.internal[pos].down);
                 if (level) brelse(bh);
                 if (hpfs_sb(s)->sb_chk)
                         if (hpfs_stop_cycles(s, ano, &d1, &d2, "hpfs_remove_btree #1"))
@@ -290,7 +290,7 @@ void hpfs_remove_btree(struct super_block *s, struct bplus_header *btree)
                 pos = 0;
         }
         for (i = 0; i < btree1->n_used_nodes; i++)
-                hpfs_free_sectors(s, btree1->u.external[i].disk_secno, btree1->u.external[i].length);
+                hpfs_free_sectors(s, le32_to_cpu(btree1->u.external[i].disk_secno), le32_to_cpu(btree1->u.external[i].length));
         go_up:
         if (!level) return;
         brelse(bh);
@@ -298,13 +298,13 @@ void hpfs_remove_btree(struct super_block *s, struct bplus_header *btree)
                 if (hpfs_stop_cycles(s, ano, &c1, &c2, "hpfs_remove_btree #2")) return;
         hpfs_free_sectors(s, ano, 1);
         oano = ano;
-        ano = anode->up;
+        ano = le32_to_cpu(anode->up);
         if (--level) {
                 if (!(anode = hpfs_map_anode(s, ano, &bh))) return;
                 btree1 = &anode->btree;
         } else btree1 = btree;
         for (i = 0; i < btree1->n_used_nodes; i++) {
-                if (btree1->u.internal[i].down == oano) {
+                if (le32_to_cpu(btree1->u.internal[i].down) == oano) {
                         if ((pos = i + 1) < btree1->n_used_nodes)
                                 goto go_down;
                         else
@@ -411,7 +411,7 @@ void hpfs_truncate_btree(struct super_block *s, secno f, int fno, unsigned secs)
                 if (fno) {
                         btree->n_free_nodes = 8;
                         btree->n_used_nodes = 0;
-                        btree->first_free = 8;
+                        btree->first_free = cpu_to_le16(8);
                         btree->internal = 0;
                         mark_buffer_dirty(bh);
                 } else hpfs_free_sectors(s, f, 1);
@@ -421,22 +421,22 @@ void hpfs_truncate_btree(struct super_block *s, secno f, int fno, unsigned secs)
         while (btree->internal) {
                 nodes = btree->n_used_nodes + btree->n_free_nodes;
                 for (i = 0; i < btree->n_used_nodes; i++)
-                        if (btree->u.internal[i].file_secno >= secs) goto f;
+                        if (le32_to_cpu(btree->u.internal[i].file_secno) >= secs) goto f;
                 brelse(bh);
                 hpfs_error(s, "internal btree %08x doesn't end with -1", node);
                 return;
                 f:
                 for (j = i + 1; j < btree->n_used_nodes; j++)
-                        hpfs_ea_remove(s, btree->u.internal[j].down, 1, 0);
+                        hpfs_ea_remove(s, le32_to_cpu(btree->u.internal[j].down), 1, 0);
                 btree->n_used_nodes = i + 1;
                 btree->n_free_nodes = nodes - btree->n_used_nodes;
-                btree->first_free = 8 + 8 * btree->n_used_nodes;
+                btree->first_free = cpu_to_le16(8 + 8 * btree->n_used_nodes);
                 mark_buffer_dirty(bh);
-                if (btree->u.internal[i].file_secno == secs) {
+                if (btree->u.internal[i].file_secno == cpu_to_le32(secs)) {
                         brelse(bh);
                         return;
                 }
-                node = btree->u.internal[i].down;
+                node = le32_to_cpu(btree->u.internal[i].down);
                 brelse(bh);
                 if (hpfs_sb(s)->sb_chk)
                         if (hpfs_stop_cycles(s, node, &c1, &c2, "hpfs_truncate_btree"))
@@ -446,25 +446,25 @@ void hpfs_truncate_btree(struct super_block *s, secno f, int fno, unsigned secs)
         }       
         nodes = btree->n_used_nodes + btree->n_free_nodes;
         for (i = 0; i < btree->n_used_nodes; i++)
-                if (btree->u.external[i].file_secno + btree->u.external[i].length >= secs) goto ff;
+                if (le32_to_cpu(btree->u.external[i].file_secno) + le32_to_cpu(btree->u.external[i].length) >= secs) goto ff;
         brelse(bh);
         return;
         ff:
-        if (secs <= btree->u.external[i].file_secno) {
+        if (secs <= le32_to_cpu(btree->u.external[i].file_secno)) {
                 hpfs_error(s, "there is an allocation error in file %08x, sector %08x", f, secs);
                 if (i) i--;
         }
-        else if (btree->u.external[i].file_secno + btree->u.external[i].length > secs) {
-                hpfs_free_sectors(s, btree->u.external[i].disk_secno + secs -
-                        btree->u.external[i].file_secno, btree->u.external[i].length
-                        - secs + btree->u.external[i].file_secno); /* I hope gcc optimizes this :-) */
-                btree->u.external[i].length = secs - btree->u.external[i].file_secno;
+        else if (le32_to_cpu(btree->u.external[i].file_secno) + le32_to_cpu(btree->u.external[i].length) > secs) {
+                hpfs_free_sectors(s, le32_to_cpu(btree->u.external[i].disk_secno) + secs -
+                        le32_to_cpu(btree->u.external[i].file_secno), le32_to_cpu(btree->u.external[i].length)
+                        - secs + le32_to_cpu(btree->u.external[i].file_secno)); /* I hope gcc optimizes this :-) */
+                btree->u.external[i].length = cpu_to_le32(secs - le32_to_cpu(btree->u.external[i].file_secno));
         }
         for (j = i + 1; j < btree->n_used_nodes; j++)
-                hpfs_free_sectors(s, btree->u.external[j].disk_secno, btree->u.external[j].length);
+                hpfs_free_sectors(s, le32_to_cpu(btree->u.external[j].disk_secno), le32_to_cpu(btree->u.external[j].length));
         btree->n_used_nodes = i + 1;
         btree->n_free_nodes = nodes - btree->n_used_nodes;
-        btree->first_free = 8 + 12 * btree->n_used_nodes;
+        btree->first_free = cpu_to_le16(8 + 12 * btree->n_used_nodes);
         mark_buffer_dirty(bh);
         brelse(bh);
 }
@@ -480,12 +480,12 @@ void hpfs_remove_fnode(struct super_block *s, fnode_secno fno)
         struct extended_attribute *ea_end;
         if (!(fnode = hpfs_map_fnode(s, fno, &bh))) return;
         if (!fnode->dirflag) hpfs_remove_btree(s, &fnode->btree);
-        else hpfs_remove_dtree(s, fnode->u.external[0].disk_secno);
+        else hpfs_remove_dtree(s, le32_to_cpu(fnode->u.external[0].disk_secno));
         ea_end = fnode_end_ea(fnode);
         for (ea = fnode_ea(fnode); ea < ea_end; ea = next_ea(ea))
                 if (ea->indirect)
                         hpfs_ea_remove(s, ea_sec(ea), ea->anode, ea_len(ea));
-        hpfs_ea_ext_remove(s, fnode->ea_secno, fnode->ea_anode, fnode->ea_size_l);
+        hpfs_ea_ext_remove(s, le32_to_cpu(fnode->ea_secno), fnode->ea_anode, le32_to_cpu(fnode->ea_size_l));
         brelse(bh);
         hpfs_free_sectors(s, fno, 1);
 }
diff --git a/fs/hpfs/buffer.c b/fs/hpfs/buffer.c
index 793cb9d943d2..9ecde27d1e29 100644
--- a/fs/hpfs/buffer.c
+++ b/fs/hpfs/buffer.c
@@ -9,22 +9,6 @@
 #include <linux/slab.h>
 #include "hpfs_fn.h"
 
-void hpfs_lock_creation(struct super_block *s)
-{
-#ifdef DEBUG_LOCKS
-        printk("lock creation\n");
-#endif
-        mutex_lock(&hpfs_sb(s)->hpfs_creation_de);
-}
-
-void hpfs_unlock_creation(struct super_block *s)
-{
-#ifdef DEBUG_LOCKS
-        printk("unlock creation\n");
-#endif
-        mutex_unlock(&hpfs_sb(s)->hpfs_creation_de);
-}
-
 /* Map a sector into a buffer and return pointers to it and to the buffer. */
 
 void *hpfs_map_sector(struct super_block *s, unsigned secno, struct buffer_head **bhp,
@@ -32,6 +16,8 @@ void *hpfs_map_sector(struct super_block *s, unsigned secno, struct buffer_head
 {
         struct buffer_head *bh;
 
+        hpfs_lock_assert(s);
+
         cond_resched();
 
         *bhp = bh = sb_bread(s, secno);
@@ -50,6 +36,8 @@ void *hpfs_get_sector(struct super_block *s, unsigned secno, struct buffer_head
         struct buffer_head *bh;
         /*return hpfs_map_sector(s, secno, bhp, 0);*/
 
+        hpfs_lock_assert(s);
+
         cond_resched();
 
         if ((*bhp = bh = sb_getblk(s, secno)) != NULL) {
@@ -70,6 +58,8 @@ void *hpfs_map_4sectors(struct super_block *s, unsigned secno, struct quad_buffe
         struct buffer_head *bh;
         char *data;
 
+        hpfs_lock_assert(s);
+
         cond_resched();
 
         if (secno & 3) {
@@ -125,6 +115,8 @@ void *hpfs_get_4sectors(struct super_block *s, unsigned secno,
 {
         cond_resched();
 
+        hpfs_lock_assert(s);
+
         if (secno & 3) {
                 printk("HPFS: hpfs_get_4sectors: unaligned read\n");
                 return NULL;
diff --git a/fs/hpfs/dir.c b/fs/hpfs/dir.c
index b3d7c0ddb609..f46ae025bfb5 100644
--- a/fs/hpfs/dir.c
+++ b/fs/hpfs/dir.c
@@ -88,9 +88,9 @@ static int hpfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                         hpfs_error(inode->i_sb, "not a directory, fnode %08lx",
                                         (unsigned long)inode->i_ino);
                 }
-                if (hpfs_inode->i_dno != fno->u.external[0].disk_secno) {
+                if (hpfs_inode->i_dno != le32_to_cpu(fno->u.external[0].disk_secno)) {
                         e = 1;
-                        hpfs_error(inode->i_sb, "corrupted inode: i_dno == %08x, fnode -> dnode == %08x", hpfs_inode->i_dno, fno->u.external[0].disk_secno);
+                        hpfs_error(inode->i_sb, "corrupted inode: i_dno == %08x, fnode -> dnode == %08x", hpfs_inode->i_dno, le32_to_cpu(fno->u.external[0].disk_secno));
                 }
                 brelse(bh);
                 if (e) {
@@ -156,7 +156,7 @@ static int hpfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                         goto again;
                 }
                 tempname = hpfs_translate_name(inode->i_sb, de->name, de->namelen, lc, de->not_8x3);
-                if (filldir(dirent, tempname, de->namelen, old_pos, de->fnode, DT_UNKNOWN) < 0) {
+                if (filldir(dirent, tempname, de->namelen, old_pos, le32_to_cpu(de->fnode), DT_UNKNOWN) < 0) {
                         filp->f_pos = old_pos;
                         if (tempname != de->name) kfree(tempname);
                         hpfs_brelse4(&qbh);
@@ -221,7 +221,7 @@ struct dentry *hpfs_lookup(struct inode *dir, struct dentry *dentry, struct name
          * Get inode number, what we're after.
          */
 
-        ino = de->fnode;
+        ino = le32_to_cpu(de->fnode);
 
         /*
          * Go find or make an inode.
@@ -236,7 +236,7 @@ struct dentry *hpfs_lookup(struct inode *dir, struct dentry *dentry, struct name
                 hpfs_init_inode(result);
                 if (de->directory)
                         hpfs_read_inode(result);
-                else if (de->ea_size && hpfs_sb(dir->i_sb)->sb_eas)
+                else if (le32_to_cpu(de->ea_size) && hpfs_sb(dir->i_sb)->sb_eas)
                         hpfs_read_inode(result);
                 else {
                         result->i_mode |= S_IFREG;
@@ -250,8 +250,6 @@ struct dentry *hpfs_lookup(struct inode *dir, struct dentry *dentry, struct name
         hpfs_result = hpfs_i(result);
         if (!de->directory) hpfs_result->i_parent_dir = dir->i_ino;
 
-        hpfs_decide_conv(result, name, len);
-
         if (de->has_acl || de->has_xtd_perm) if (!(dir->i_sb->s_flags & MS_RDONLY)) {
                 hpfs_error(result->i_sb, "ACLs or XPERM found. This is probably HPFS386. This driver doesn't support it now. Send me some info on these structures");
                 goto bail1;
@@ -263,19 +261,19 @@ struct dentry *hpfs_lookup(struct inode *dir, struct dentry *dentry, struct name
          */
 
         if (!result->i_ctime.tv_sec) {
-                if (!(result->i_ctime.tv_sec = local_to_gmt(dir->i_sb, de->creation_date)))
+                if (!(result->i_ctime.tv_sec = local_to_gmt(dir->i_sb, le32_to_cpu(de->creation_date))))
                         result->i_ctime.tv_sec = 1;
                 result->i_ctime.tv_nsec = 0;
-                result->i_mtime.tv_sec = local_to_gmt(dir->i_sb, de->write_date);
+                result->i_mtime.tv_sec = local_to_gmt(dir->i_sb, le32_to_cpu(de->write_date));
                 result->i_mtime.tv_nsec = 0;
-                result->i_atime.tv_sec = local_to_gmt(dir->i_sb, de->read_date);
+                result->i_atime.tv_sec = local_to_gmt(dir->i_sb, le32_to_cpu(de->read_date));
                 result->i_atime.tv_nsec = 0;
-                hpfs_result->i_ea_size = de->ea_size;
+                hpfs_result->i_ea_size = le32_to_cpu(de->ea_size);
                 if (!hpfs_result->i_ea_mode && de->read_only)
                         result->i_mode &= ~0222;
                 if (!de->directory) {
                         if (result->i_size == -1) {
-                                result->i_size = de->file_size;
+                                result->i_size = le32_to_cpu(de->file_size);
                                 result->i_data.a_ops = &hpfs_aops;
                                 hpfs_i(result)->mmu_private = result->i_size;
                         /*
diff --git a/fs/hpfs/dnode.c b/fs/hpfs/dnode.c
index 9b2ffadfc8c4..1e0e2ac30fd3 100644
--- a/fs/hpfs/dnode.c
+++ b/fs/hpfs/dnode.c
@@ -14,11 +14,11 @@ static loff_t get_pos(struct dnode *d, struct hpfs_dirent *fde)
         struct hpfs_dirent *de_end = dnode_end_de(d);
         int i = 1;
         for (de = dnode_first_de(d); de < de_end; de = de_next_de(de)) {
-                if (de == fde) return ((loff_t) d->self << 4) | (loff_t)i;
+                if (de == fde) return ((loff_t) le32_to_cpu(d->self) << 4) | (loff_t)i;
                 i++;
         }
         printk("HPFS: get_pos: not_found\n");
-        return ((loff_t)d->self << 4) | (loff_t)1;
+        return ((loff_t)le32_to_cpu(d->self) << 4) | (loff_t)1;
 }
 
 void hpfs_add_pos(struct inode *inode, loff_t *pos)
@@ -130,29 +130,30 @@ static void set_last_pointer(struct super_block *s, struct dnode *d, dnode_secno
 {
         struct hpfs_dirent *de;
         if (!(de = dnode_last_de(d))) {
-                hpfs_error(s, "set_last_pointer: empty dnode %08x", d->self);
+                hpfs_error(s, "set_last_pointer: empty dnode %08x", le32_to_cpu(d->self));
                 return;
         }
         if (hpfs_sb(s)->sb_chk) {
                 if (de->down) {
                         hpfs_error(s, "set_last_pointer: dnode %08x has already last pointer %08x",
-                                d->self, de_down_pointer(de));
+                                le32_to_cpu(d->self), de_down_pointer(de));
                         return;
                 }
-                if (de->length != 32) {
-                        hpfs_error(s, "set_last_pointer: bad last dirent in dnode %08x", d->self);
+                if (le16_to_cpu(de->length) != 32) {
+                        hpfs_error(s, "set_last_pointer: bad last dirent in dnode %08x", le32_to_cpu(d->self));
                         return;
                 }
         }
         if (ptr) {
-                if ((d->first_free += 4) > 2048) {
-                        hpfs_error(s,"set_last_pointer: too long dnode %08x", d->self);
-                        d->first_free -= 4;
+                d->first_free = cpu_to_le32(le32_to_cpu(d->first_free) + 4);
+                if (le32_to_cpu(d->first_free) > 2048) {
+                        hpfs_error(s, "set_last_pointer: too long dnode %08x", le32_to_cpu(d->self));
+                        d->first_free = cpu_to_le32(le32_to_cpu(d->first_free) - 4);
                         return;
                 }
-                de->length = 36;
+                de->length = cpu_to_le16(36);
                 de->down = 1;
-                *(dnode_secno *)((char *)de + 32) = ptr;
+                *(dnode_secno *)((char *)de + 32) = cpu_to_le32(ptr);
         }
 }
 
@@ -168,7 +169,7 @@ struct hpfs_dirent *hpfs_add_de(struct super_block *s, struct dnode *d,
         for (de = dnode_first_de(d); de < de_end; de = de_next_de(de)) {
                 int c = hpfs_compare_names(s, name, namelen, de->name, de->namelen, de->last);
                 if (!c) {
-                        hpfs_error(s, "name (%c,%d) already exists in dnode %08x", *name, namelen, d->self);
+                        hpfs_error(s, "name (%c,%d) already exists in dnode %08x", *name, namelen, le32_to_cpu(d->self));
                         return NULL;
                 }
                 if (c < 0) break;
@@ -176,15 +177,14 @@ struct hpfs_dirent *hpfs_add_de(struct super_block *s, struct dnode *d,
         memmove((char *)de + d_size, de, (char *)de_end - (char *)de);
         memset(de, 0, d_size);
         if (down_ptr) {
-                *(int *)((char *)de + d_size - 4) = down_ptr;
+                *(dnode_secno *)((char *)de + d_size - 4) = cpu_to_le32(down_ptr);
                 de->down = 1;
         }
-        de->length = d_size;
-        if (down_ptr) de->down = 1;
+        de->length = cpu_to_le16(d_size);
         de->not_8x3 = hpfs_is_name_long(name, namelen);
         de->namelen = namelen;
         memcpy(de->name, name, namelen);
-        d->first_free += d_size;
+        d->first_free = cpu_to_le32(le32_to_cpu(d->first_free) + d_size);
         return de;
 }
 
@@ -194,25 +194,25 @@ static void hpfs_delete_de(struct super_block *s, struct dnode *d,
                            struct hpfs_dirent *de)
 {
         if (de->last) {
-                hpfs_error(s, "attempt to delete last dirent in dnode %08x", d->self);
+                hpfs_error(s, "attempt to delete last dirent in dnode %08x", le32_to_cpu(d->self));
                 return;
         }
-        d->first_free -= de->length;
-        memmove(de, de_next_de(de), d->first_free + (char *)d - (char *)de);
+        d->first_free = cpu_to_le32(le32_to_cpu(d->first_free) - le16_to_cpu(de->length));
+        memmove(de, de_next_de(de), le32_to_cpu(d->first_free) + (char *)d - (char *)de);
 }
 
 static void fix_up_ptrs(struct super_block *s, struct dnode *d)
 {
         struct hpfs_dirent *de;
         struct hpfs_dirent *de_end = dnode_end_de(d);
-        dnode_secno dno = d->self;
+        dnode_secno dno = le32_to_cpu(d->self);
         for (de = dnode_first_de(d); de < de_end; de = de_next_de(de))
                 if (de->down) {
                         struct quad_buffer_head qbh;
                         struct dnode *dd;
                         if ((dd = hpfs_map_dnode(s, de_down_pointer(de), &qbh))) {
-                                if (dd->up != dno || dd->root_dnode) {
-                                        dd->up = dno;
+                                if (le32_to_cpu(dd->up) != dno || dd->root_dnode) {
+                                        dd->up = cpu_to_le32(dno);
                                         dd->root_dnode = 0;
                                         hpfs_mark_4buffers_dirty(&qbh);
                                 }
@@ -262,7 +262,7 @@ static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
                         kfree(nname);
                         return 1;
                 }
-        if (d->first_free + de_size(namelen, down_ptr) <= 2048) {
+        if (le32_to_cpu(d->first_free) + de_size(namelen, down_ptr) <= 2048) {
                 loff_t t;
                 copy_de(de=hpfs_add_de(i->i_sb, d, name, namelen, down_ptr), new_de);
                 t = get_pos(d, de);
@@ -286,11 +286,11 @@ static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
                 kfree(nname);
                 return 1;
         }       
-        memcpy(nd, d, d->first_free);
+        memcpy(nd, d, le32_to_cpu(d->first_free));
         copy_de(de = hpfs_add_de(i->i_sb, nd, name, namelen, down_ptr), new_de);
         for_all_poss(i, hpfs_pos_ins, get_pos(nd, de), 1);
         h = ((char *)dnode_last_de(nd) - (char *)nd) / 2 + 10;
-        if (!(ad = hpfs_alloc_dnode(i->i_sb, d->up, &adno, &qbh1, 0))) {
+        if (!(ad = hpfs_alloc_dnode(i->i_sb, le32_to_cpu(d->up), &adno, &qbh1))) {
                 hpfs_error(i->i_sb, "unable to alloc dnode - dnode tree will be corrupted");
                 hpfs_brelse4(&qbh);
                 kfree(nd);
@@ -313,20 +313,21 @@ static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
         down_ptr = adno;
         set_last_pointer(i->i_sb, ad, de->down ? de_down_pointer(de) : 0);
         de = de_next_de(de);
-        memmove((char *)nd + 20, de, nd->first_free + (char *)nd - (char *)de);
-        nd->first_free -= (char *)de - (char *)nd - 20;
-        memcpy(d, nd, nd->first_free);
+        memmove((char *)nd + 20, de, le32_to_cpu(nd->first_free) + (char *)nd - (char *)de);
+        nd->first_free = cpu_to_le32(le32_to_cpu(nd->first_free) - ((char *)de - (char *)nd - 20));
+        memcpy(d, nd, le32_to_cpu(nd->first_free));
         for_all_poss(i, hpfs_pos_del, (loff_t)dno << 4, pos);
         fix_up_ptrs(i->i_sb, ad);
         if (!d->root_dnode) {
-                dno = ad->up = d->up;
+                ad->up = d->up;
+                dno = le32_to_cpu(ad->up);
                 hpfs_mark_4buffers_dirty(&qbh);
                 hpfs_brelse4(&qbh);
                 hpfs_mark_4buffers_dirty(&qbh1);
                 hpfs_brelse4(&qbh1);
                 goto go_up;
         }
-        if (!(rd = hpfs_alloc_dnode(i->i_sb, d->up, &rdno, &qbh2, 0))) {
+        if (!(rd = hpfs_alloc_dnode(i->i_sb, le32_to_cpu(d->up), &rdno, &qbh2))) {
                 hpfs_error(i->i_sb, "unable to alloc dnode - dnode tree will be corrupted");
                 hpfs_brelse4(&qbh);
                 hpfs_brelse4(&qbh1);
@@ -338,7 +339,7 @@ static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
         i->i_blocks += 4;
         rd->root_dnode = 1;
         rd->up = d->up;
-        if (!(fnode = hpfs_map_fnode(i->i_sb, d->up, &bh))) {
+        if (!(fnode = hpfs_map_fnode(i->i_sb, le32_to_cpu(d->up), &bh))) {
                 hpfs_free_dnode(i->i_sb, rdno);
                 hpfs_brelse4(&qbh);
                 hpfs_brelse4(&qbh1);
@@ -347,10 +348,11 @@ static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
                 kfree(nname);
                 return 1;
         }
-        fnode->u.external[0].disk_secno = rdno;
+        fnode->u.external[0].disk_secno = cpu_to_le32(rdno);
         mark_buffer_dirty(bh);
         brelse(bh);
-        d->up = ad->up = hpfs_i(i)->i_dno = rdno;
+        hpfs_i(i)->i_dno = rdno;
+        d->up = ad->up = cpu_to_le32(rdno);
         d->root_dnode = ad->root_dnode = 0;
         hpfs_mark_4buffers_dirty(&qbh);
         hpfs_brelse4(&qbh);
@@ -373,7 +375,7 @@ static int hpfs_add_to_dnode(struct inode *i, dnode_secno dno,
 
 int hpfs_add_dirent(struct inode *i,
                     const unsigned char *name, unsigned namelen,
-                    struct hpfs_dirent *new_de, int cdepth)
+                    struct hpfs_dirent *new_de)
 {
         struct hpfs_inode_info *hpfs_inode = hpfs_i(i);
         struct dnode *d;
@@ -403,7 +405,6 @@ int hpfs_add_dirent(struct inode *i,
                 }
         }
         hpfs_brelse4(&qbh);
-        if (!cdepth) hpfs_lock_creation(i->i_sb);
         if (hpfs_check_free_dnodes(i->i_sb, FREE_DNODES_ADD)) {
                 c = 1;
                 goto ret;
@@ -411,7 +412,6 @@ int hpfs_add_dirent(struct inode *i,
         i->i_version++;
         c = hpfs_add_to_dnode(i, dno, name, namelen, new_de, 0);
         ret:
-        if (!cdepth) hpfs_unlock_creation(i->i_sb);
         return c;
 }
 
@@ -437,9 +437,9 @@ static secno move_to_top(struct inode *i, dnode_secno from, dnode_secno to)
                                 return 0;
                 if (!(dnode = hpfs_map_dnode(i->i_sb, dno, &qbh))) return 0;
                 if (hpfs_sb(i->i_sb)->sb_chk) {
-                        if (dnode->up != chk_up) {
+                        if (le32_to_cpu(dnode->up) != chk_up) {
                                 hpfs_error(i->i_sb, "move_to_top: up pointer from %08x should be %08x, is %08x",
-                                        dno, chk_up, dnode->up);
+                                        dno, chk_up, le32_to_cpu(dnode->up));
                                 hpfs_brelse4(&qbh);
                                 return 0;
                         }
@@ -455,7 +455,7 @@ static secno move_to_top(struct inode *i, dnode_secno from, dnode_secno to)
                 hpfs_brelse4(&qbh);
         }
         while (!(de = dnode_pre_last_de(dnode))) {
-                dnode_secno up = dnode->up;
+                dnode_secno up = le32_to_cpu(dnode->up);
                 hpfs_brelse4(&qbh);
                 hpfs_free_dnode(i->i_sb, dno);
                 i->i_size -= 2048;
@@ -474,8 +474,8 @@ static secno move_to_top(struct inode *i, dnode_secno from, dnode_secno to)
                         hpfs_brelse4(&qbh);
                         return 0;
                 }
-                dnode->first_free -= 4;
-                de->length -= 4;
+                dnode->first_free = cpu_to_le32(le32_to_cpu(dnode->first_free) - 4);
+                de->length = cpu_to_le16(le16_to_cpu(de->length) - 4);
                 de->down = 0;
                 hpfs_mark_4buffers_dirty(&qbh);
                 dno = up;
@@ -483,12 +483,12 @@ static secno move_to_top(struct inode *i, dnode_secno from, dnode_secno to)
         t = get_pos(dnode, de);
         for_all_poss(i, hpfs_pos_subst, t, 4);
         for_all_poss(i, hpfs_pos_subst, t + 1, 5);
-        if (!(nde = kmalloc(de->length, GFP_NOFS))) {
+        if (!(nde = kmalloc(le16_to_cpu(de->length), GFP_NOFS))) {
                 hpfs_error(i->i_sb, "out of memory for dirent - directory will be corrupted");
                 hpfs_brelse4(&qbh);
                 return 0;
         }
-        memcpy(nde, de, de->length);
+        memcpy(nde, de, le16_to_cpu(de->length));
         ddno = de->down ? de_down_pointer(de) : 0;
         hpfs_delete_de(i->i_sb, dnode, de);
         set_last_pointer(i->i_sb, dnode, ddno);
@@ -517,11 +517,11 @@ static void delete_empty_dnode(struct inode *i, dnode_secno dno)
         try_it_again:
         if (hpfs_stop_cycles(i->i_sb, dno, &c1, &c2, "delete_empty_dnode")) return;
         if (!(dnode = hpfs_map_dnode(i->i_sb, dno, &qbh))) return;
-        if (dnode->first_free > 56) goto end;
-        if (dnode->first_free == 52 || dnode->first_free == 56) {
+        if (le32_to_cpu(dnode->first_free) > 56) goto end;
+        if (le32_to_cpu(dnode->first_free) == 52 || le32_to_cpu(dnode->first_free) == 56) {
                 struct hpfs_dirent *de_end;
                 int root = dnode->root_dnode;
-                up = dnode->up;
+                up = le32_to_cpu(dnode->up);
                 de = dnode_first_de(dnode);
                 down = de->down ? de_down_pointer(de) : 0;
                 if (hpfs_sb(i->i_sb)->sb_chk) if (root && !down) {
@@ -545,13 +545,13 @@ static void delete_empty_dnode(struct inode *i, dnode_secno dno)
                                 return;
                             }
                         if ((d1 = hpfs_map_dnode(i->i_sb, down, &qbh1))) {
-                                d1->up = up;
+                                d1->up = cpu_to_le32(up);
                                 d1->root_dnode = 1;
                                 hpfs_mark_4buffers_dirty(&qbh1);
                                 hpfs_brelse4(&qbh1);
                         }
                         if ((fnode = hpfs_map_fnode(i->i_sb, up, &bh))) {
-                                fnode->u.external[0].disk_secno = down;
+                                fnode->u.external[0].disk_secno = cpu_to_le32(down);
                                 mark_buffer_dirty(bh);
                                 brelse(bh);
                         }
@@ -570,22 +570,22 @@ static void delete_empty_dnode(struct inode *i, dnode_secno dno)
                 for_all_poss(i, hpfs_pos_subst, ((loff_t)dno << 4) | 1, ((loff_t)up << 4) | p);
                 if (!down) {
                         de->down = 0;
-                        de->length -= 4;
-                        dnode->first_free -= 4;
+                        de->length = cpu_to_le16(le16_to_cpu(de->length) - 4);
+                        dnode->first_free = cpu_to_le32(le32_to_cpu(dnode->first_free) - 4);
                         memmove(de_next_de(de), (char *)de_next_de(de) + 4,
-                                (char *)dnode + dnode->first_free - (char *)de_next_de(de));
+                                (char *)dnode + le32_to_cpu(dnode->first_free) - (char *)de_next_de(de));
                 } else {
                         struct dnode *d1;
                         struct quad_buffer_head qbh1;
-                        *(dnode_secno *) ((void *) de + de->length - 4) = down;
+                        *(dnode_secno *) ((void *) de + le16_to_cpu(de->length) - 4) = down;
                         if ((d1 = hpfs_map_dnode(i->i_sb, down, &qbh1))) {
-                                d1->up = up;
+                                d1->up = cpu_to_le32(up);
                                 hpfs_mark_4buffers_dirty(&qbh1);
                                 hpfs_brelse4(&qbh1);
                         }
                 }
         } else {
-                hpfs_error(i->i_sb, "delete_empty_dnode: dnode %08x, first_free == %03x", dno, dnode->first_free);
+                hpfs_error(i->i_sb, "delete_empty_dnode: dnode %08x, first_free == %03x", dno, le32_to_cpu(dnode->first_free));
                 goto end;
         }
 
@@ -596,18 +596,18 @@ static void delete_empty_dnode(struct inode *i, dnode_secno dno)
                 struct quad_buffer_head qbh1;
                 if (!de_next->down) goto endm;
                 ndown = de_down_pointer(de_next);
-                if (!(de_cp = kmalloc(de->length, GFP_NOFS))) {
+                if (!(de_cp = kmalloc(le16_to_cpu(de->length), GFP_NOFS))) {
                         printk("HPFS: out of memory for dtree balancing\n");
                         goto endm;
                 }
-                memcpy(de_cp, de, de->length);
+                memcpy(de_cp, de, le16_to_cpu(de->length));
                 hpfs_delete_de(i->i_sb, dnode, de);
                 hpfs_mark_4buffers_dirty(&qbh);
                 hpfs_brelse4(&qbh);
                 for_all_poss(i, hpfs_pos_subst, ((loff_t)up << 4) | p, 4);
                 for_all_poss(i, hpfs_pos_del, ((loff_t)up << 4) | p, 1);
                 if (de_cp->down) if ((d1 = hpfs_map_dnode(i->i_sb, de_down_pointer(de_cp), &qbh1))) {
-                        d1->up = ndown;
+                        d1->up = cpu_to_le32(ndown);
                         hpfs_mark_4buffers_dirty(&qbh1);
                         hpfs_brelse4(&qbh1);
                 }
@@ -635,7 +635,7 @@ static void delete_empty_dnode(struct inode *i, dnode_secno dno)
                         struct hpfs_dirent *del = dnode_last_de(d1);
                         dlp = del->down ? de_down_pointer(del) : 0;
                         if (!dlp && down) {
-                                if (d1->first_free > 2044) {
+                                if (le32_to_cpu(d1->first_free) > 2044) {
                                         if (hpfs_sb(i->i_sb)->sb_chk >= 2) {
                                                 printk("HPFS: warning: unbalanced dnode tree, see hpfs.txt 4 more info\n");
                                                 printk("HPFS: warning: terminating balancing operation\n");
@@ -647,38 +647,38 @@ static void delete_empty_dnode(struct inode *i, dnode_secno dno)
                                         printk("HPFS: warning: unbalanced dnode tree, see hpfs.txt 4 more info\n");
                                         printk("HPFS: warning: goin'on\n");
                                 }
-                                del->length += 4;
+                                del->length = cpu_to_le16(le16_to_cpu(del->length) + 4);
                                 del->down = 1;
-                                d1->first_free += 4;
+                                d1->first_free = cpu_to_le32(le32_to_cpu(d1->first_free) + 4);
                         }
                         if (dlp && !down) {
-                                del->length -= 4;
+                                del->length = cpu_to_le16(le16_to_cpu(del->length) - 4);
                                 del->down = 0;
-                                d1->first_free -= 4;
+                                d1->first_free = cpu_to_le32(le32_to_cpu(d1->first_free) - 4);
                         } else if (down)
-                                *(dnode_secno *) ((void *) del + del->length - 4) = down;
+                                *(dnode_secno *) ((void *) del + le16_to_cpu(del->length) - 4) = cpu_to_le32(down);
                 } else goto endm;
-                if (!(de_cp = kmalloc(de_prev->length, GFP_NOFS))) {
+                if (!(de_cp = kmalloc(le16_to_cpu(de_prev->length), GFP_NOFS))) {
                         printk("HPFS: out of memory for dtree balancing\n");
                         hpfs_brelse4(&qbh1);
                         goto endm;
                 }
                 hpfs_mark_4buffers_dirty(&qbh1);
                 hpfs_brelse4(&qbh1);
-                memcpy(de_cp, de_prev, de_prev->length);
+                memcpy(de_cp, de_prev, le16_to_cpu(de_prev->length));
                 hpfs_delete_de(i->i_sb, dnode, de_prev);
                 if (!de_prev->down) {
-                        de_prev->length += 4;
+                        de_prev->length = cpu_to_le16(le16_to_cpu(de_prev->length) + 4);
                         de_prev->down = 1;
-                        dnode->first_free += 4;
+                        dnode->first_free = cpu_to_le32(le32_to_cpu(dnode->first_free) + 4);
                 }
-                *(dnode_secno *) ((void *) de_prev + de_prev->length - 4) = ndown;
+                *(dnode_secno *) ((void *) de_prev + le16_to_cpu(de_prev->length) - 4) = cpu_to_le32(ndown);
                 hpfs_mark_4buffers_dirty(&qbh);
                 hpfs_brelse4(&qbh);
                 for_all_poss(i, hpfs_pos_subst, ((loff_t)up << 4) | (p - 1), 4);
                 for_all_poss(i, hpfs_pos_subst, ((loff_t)up << 4) | p, ((loff_t)up << 4) | (p - 1));
                 if (down) if ((d1 = hpfs_map_dnode(i->i_sb, de_down_pointer(de), &qbh1))) {
-                        d1->up = ndown;
+                        d1->up = cpu_to_le32(ndown);
                         hpfs_mark_4buffers_dirty(&qbh1);
                         hpfs_brelse4(&qbh1);
                 }
@@ -701,7 +701,6 @@ int hpfs_remove_dirent(struct inode *i, dnode_secno dno, struct hpfs_dirent *de,
 {
         struct dnode *dnode = qbh->data;
         dnode_secno down = 0;
-        int lock = 0;
         loff_t t;
         if (de->first || de->last) {
                 hpfs_error(i->i_sb, "hpfs_remove_dirent: attempt to delete first or last dirent in dnode %08x", dno);
@@ -710,11 +709,8 @@ int hpfs_remove_dirent(struct inode *i, dnode_secno dno, struct hpfs_dirent *de,
         }
         if (de->down) down = de_down_pointer(de);
         if (depth && (de->down || (de == dnode_first_de(dnode) && de_next_de(de)->last))) {
-                lock = 1;
-                hpfs_lock_creation(i->i_sb);
                 if (hpfs_check_free_dnodes(i->i_sb, FREE_DNODES_DEL)) {
                         hpfs_brelse4(qbh);
-                        hpfs_unlock_creation(i->i_sb);
                         return 2;
                 }
         }
@@ -727,11 +723,9 @@ int hpfs_remove_dirent(struct inode *i, dnode_secno dno, struct hpfs_dirent *de,
                 dnode_secno a = move_to_top(i, down, dno);
                 for_all_poss(i, hpfs_pos_subst, 5, t);
                 if (a) delete_empty_dnode(i, a);
-                if (lock) hpfs_unlock_creation(i->i_sb);
                 return !a;
         }
         delete_empty_dnode(i, dno);
-        if (lock) hpfs_unlock_creation(i->i_sb);
         return 0;
 }
 
@@ -751,8 +745,8 @@ void hpfs_count_dnodes(struct super_block *s, dnode_secno dno, int *n_dnodes,
         ptr = 0;
         go_up:
         if (!(dnode = hpfs_map_dnode(s, dno, &qbh))) return;
-        if (hpfs_sb(s)->sb_chk) if (odno && odno != -1 && dnode->up != odno)
-                hpfs_error(s, "hpfs_count_dnodes: bad up pointer; dnode %08x, down %08x points to %08x", odno, dno, dnode->up);
+        if (hpfs_sb(s)->sb_chk) if (odno && odno != -1 && le32_to_cpu(dnode->up) != odno)
+                hpfs_error(s, "hpfs_count_dnodes: bad up pointer; dnode %08x, down %08x points to %08x", odno, dno, le32_to_cpu(dnode->up));
         de = dnode_first_de(dnode);
         if (ptr) while(1) {
                 if (de->down) if (de_down_pointer(de) == ptr) goto process_de;
@@ -776,7 +770,7 @@ void hpfs_count_dnodes(struct super_block *s, dnode_secno dno, int *n_dnodes,
         if (!de->first && !de->last && n_items) (*n_items)++;
         if ((de = de_next_de(de)) < dnode_end_de(dnode)) goto next_de;
         ptr = dno;
-        dno = dnode->up;
+        dno = le32_to_cpu(dnode->up);
         if (dnode->root_dnode) {
                 hpfs_brelse4(&qbh);
                 return;
@@ -824,8 +818,8 @@ dnode_secno hpfs_de_as_down_as_possible(struct super_block *s, dnode_secno dno)
                         return d;
         if (!(de = map_nth_dirent(s, d, 1, &qbh, NULL))) return dno;
         if (hpfs_sb(s)->sb_chk)
-                if (up && ((struct dnode *)qbh.data)->up != up)
-                        hpfs_error(s, "hpfs_de_as_down_as_possible: bad up pointer; dnode %08x, down %08x points to %08x", up, d, ((struct dnode *)qbh.data)->up);
+                if (up && le32_to_cpu(((struct dnode *)qbh.data)->up) != up)
+                        hpfs_error(s, "hpfs_de_as_down_as_possible: bad up pointer; dnode %08x, down %08x points to %08x", up, d, le32_to_cpu(((struct dnode *)qbh.data)->up));
         if (!de->down) {
                 hpfs_brelse4(&qbh);
                 return d;
@@ -874,7 +868,7 @@ struct hpfs_dirent *map_pos_dirent(struct inode *inode, loff_t *posp,
         /* Going up */
         if (dnode->root_dnode) goto bail;
 
-        if (!(up_dnode = hpfs_map_dnode(inode->i_sb, dnode->up, &qbh0)))
+        if (!(up_dnode = hpfs_map_dnode(inode->i_sb, le32_to_cpu(dnode->up), &qbh0)))
                 goto bail;
 
         end_up_de = dnode_end_de(up_dnode);
@@ -882,16 +876,16 @@ struct hpfs_dirent *map_pos_dirent(struct inode *inode, loff_t *posp,
         for (up_de = dnode_first_de(up_dnode); up_de < end_up_de;
              up_de = de_next_de(up_de)) {
                 if (!(++c & 077)) hpfs_error(inode->i_sb,
-                        "map_pos_dirent: pos crossed dnode boundary; dnode = %08x", dnode->up);
+                        "map_pos_dirent: pos crossed dnode boundary; dnode = %08x", le32_to_cpu(dnode->up));
                 if (up_de->down && de_down_pointer(up_de) == dno) {
-                        *posp = ((loff_t) dnode->up << 4) + c;
+                        *posp = ((loff_t) le32_to_cpu(dnode->up) << 4) + c;
                         hpfs_brelse4(&qbh0);
                         return de;
                 }
         }
         
         hpfs_error(inode->i_sb, "map_pos_dirent: pointer to dnode %08x not found in parent dnode %08x",
-                dno, dnode->up);
+                dno, le32_to_cpu(dnode->up));
         hpfs_brelse4(&qbh0);
         
         bail:
@@ -1017,17 +1011,17 @@ struct hpfs_dirent *map_fnode_dirent(struct super_block *s, fnode_secno fno,
                 /*name2[15] = 0xff;*/
                 name1len = 15; name2len = 256;
         }
-        if (!(upf = hpfs_map_fnode(s, f->up, &bh))) {
+        if (!(upf = hpfs_map_fnode(s, le32_to_cpu(f->up), &bh))) {
                 kfree(name2);
                 return NULL;
         }       
         if (!upf->dirflag) {
                 brelse(bh);
-                hpfs_error(s, "fnode %08x has non-directory parent %08x", fno, f->up);
+                hpfs_error(s, "fnode %08x has non-directory parent %08x", fno, le32_to_cpu(f->up));
                 kfree(name2);
                 return NULL;
         }
-        dno = upf->u.external[0].disk_secno;
+        dno = le32_to_cpu(upf->u.external[0].disk_secno);
         brelse(bh);
         go_down:
         downd = 0;
@@ -1049,7 +1043,7 @@ struct hpfs_dirent *map_fnode_dirent(struct super_block *s, fnode_secno fno,
                 return NULL;
         }
         next_de:
-        if (de->fnode == fno) {
+        if (le32_to_cpu(de->fnode) == fno) {
                 kfree(name2);
                 return de;
         }
@@ -1065,7 +1059,7 @@ struct hpfs_dirent *map_fnode_dirent(struct super_block *s, fnode_secno fno,
                 goto go_down;
         }
         f:
-        if (de->fnode == fno) {
+        if (le32_to_cpu(de->fnode) == fno) {
                 kfree(name2);
                 return de;
         }
@@ -1074,7 +1068,7 @@ struct hpfs_dirent *map_fnode_dirent(struct super_block *s, fnode_secno fno,
         if ((de = de_next_de(de)) < de_end) goto next_de;
         if (d->root_dnode) goto not_found;
         downd = dno;
-        dno = d->up;
+        dno = le32_to_cpu(d->up);
         hpfs_brelse4(qbh);
         if (hpfs_sb(s)->sb_chk)
                 if (hpfs_stop_cycles(s, downd, &d1, &d2, "map_fnode_dirent #2")) {
diff --git a/fs/hpfs/ea.c b/fs/hpfs/ea.c
index 45e53d972b42..d8b84d113c89 100644
--- a/fs/hpfs/ea.c
+++ b/fs/hpfs/ea.c
@@ -24,7 +24,7 @@ void hpfs_ea_ext_remove(struct super_block *s, secno a, int ano, unsigned len)
                 }
                 if (hpfs_ea_read(s, a, ano, pos, 4, ex)) return;
                 if (ea->indirect) {
-                        if (ea->valuelen != 8) {
+                        if (ea_valuelen(ea) != 8) {
                                 hpfs_error(s, "ea->indirect set while ea->valuelen!=8, %s %08x, pos %08x",
                                         ano ? "anode" : "sectors", a, pos);
                                 return;
@@ -33,7 +33,7 @@ void hpfs_ea_ext_remove(struct super_block *s, secno a, int ano, unsigned len)
                                 return;
                         hpfs_ea_remove(s, ea_sec(ea), ea->anode, ea_len(ea));
                 }
-                pos += ea->namelen + ea->valuelen + 5;
+                pos += ea->namelen + ea_valuelen(ea) + 5;
         }
         if (!ano) hpfs_free_sectors(s, a, (len+511) >> 9);
         else {
@@ -76,24 +76,24 @@ int hpfs_read_ea(struct super_block *s, struct fnode *fnode, char *key,
         unsigned pos;
         int ano, len;
         secno a;
+        char ex[4 + 255 + 1 + 8];
         struct extended_attribute *ea;
         struct extended_attribute *ea_end = fnode_end_ea(fnode);
         for (ea = fnode_ea(fnode); ea < ea_end; ea = next_ea(ea))
                 if (!strcmp(ea->name, key)) {
                         if (ea->indirect)
                                 goto indirect;
-                        if (ea->valuelen >= size)
+                        if (ea_valuelen(ea) >= size)
                                 return -EINVAL;
-                        memcpy(buf, ea_data(ea), ea->valuelen);
-                        buf[ea->valuelen] = 0;
+                        memcpy(buf, ea_data(ea), ea_valuelen(ea));
+                        buf[ea_valuelen(ea)] = 0;
                         return 0;
                 }
-        a = fnode->ea_secno;
-        len = fnode->ea_size_l;
+        a = le32_to_cpu(fnode->ea_secno);
+        len = le32_to_cpu(fnode->ea_size_l);
         ano = fnode->ea_anode;
         pos = 0;
         while (pos < len) {
-                char ex[4 + 255 + 1 + 8];
                 ea = (struct extended_attribute *)ex;
                 if (pos + 4 > len) {
                         hpfs_error(s, "EAs don't end correctly, %s %08x, len %08x",
@@ -106,14 +106,14 @@ int hpfs_read_ea(struct super_block *s, struct fnode *fnode, char *key,
                 if (!strcmp(ea->name, key)) {
                         if (ea->indirect)
                                 goto indirect;
-                        if (ea->valuelen >= size)
+                        if (ea_valuelen(ea) >= size)
                                 return -EINVAL;
-                        if (hpfs_ea_read(s, a, ano, pos + 4 + ea->namelen + 1, ea->valuelen, buf))
+                        if (hpfs_ea_read(s, a, ano, pos + 4 + ea->namelen + 1, ea_valuelen(ea), buf))
                                 return -EIO;
-                        buf[ea->valuelen] = 0;
+                        buf[ea_valuelen(ea)] = 0;
                         return 0;
                 }
-                pos += ea->namelen + ea->valuelen + 5;
+                pos += ea->namelen + ea_valuelen(ea) + 5;
         }
         return -ENOENT;
 indirect:
@@ -138,16 +138,16 @@ char *hpfs_get_ea(struct super_block *s, struct fnode *fnode, char *key, int *si
                 if (!strcmp(ea->name, key)) {
                         if (ea->indirect)
                                 return get_indirect_ea(s, ea->anode, ea_sec(ea), *size = ea_len(ea));
-                        if (!(ret = kmalloc((*size = ea->valuelen) + 1, GFP_NOFS))) {
+                        if (!(ret = kmalloc((*size = ea_valuelen(ea)) + 1, GFP_NOFS))) {
                                 printk("HPFS: out of memory for EA\n");
                                 return NULL;
                         }
-                        memcpy(ret, ea_data(ea), ea->valuelen);
-                        ret[ea->valuelen] = 0;
+                        memcpy(ret, ea_data(ea), ea_valuelen(ea));
+                        ret[ea_valuelen(ea)] = 0;
                         return ret;
                 }
-        a = fnode->ea_secno;
-        len = fnode->ea_size_l;
+        a = le32_to_cpu(fnode->ea_secno);
+        len = le32_to_cpu(fnode->ea_size_l);
         ano = fnode->ea_anode;
         pos = 0;
         while (pos < len) {
@@ -164,18 +164,18 @@ char *hpfs_get_ea(struct super_block *s, struct fnode *fnode, char *key, int *si
                 if (!strcmp(ea->name, key)) {
                         if (ea->indirect)
                                 return get_indirect_ea(s, ea->anode, ea_sec(ea), *size = ea_len(ea));
-                        if (!(ret = kmalloc((*size = ea->valuelen) + 1, GFP_NOFS))) {
+                        if (!(ret = kmalloc((*size = ea_valuelen(ea)) + 1, GFP_NOFS))) {
                                 printk("HPFS: out of memory for EA\n");
                                 return NULL;
                         }
-                        if (hpfs_ea_read(s, a, ano, pos + 4 + ea->namelen + 1, ea->valuelen, ret)) {
+                        if (hpfs_ea_read(s, a, ano, pos + 4 + ea->namelen + 1, ea_valuelen(ea), ret)) {
                                 kfree(ret);
                                 return NULL;
                         }
-                        ret[ea->valuelen] = 0;
+                        ret[ea_valuelen(ea)] = 0;
                         return ret;
                 }
-                pos += ea->namelen + ea->valuelen + 5;
+                pos += ea->namelen + ea_valuelen(ea) + 5;
         }
         return NULL;
 }
@@ -202,13 +202,13 @@ void hpfs_set_ea(struct inode *inode, struct fnode *fnode, const char *key,
                         if (ea->indirect) {
                                 if (ea_len(ea) == size)
                                         set_indirect_ea(s, ea->anode, ea_sec(ea), data, size);
-                        } else if (ea->valuelen == size) {
+                        } else if (ea_valuelen(ea) == size) {
                                 memcpy(ea_data(ea), data, size);
                         }
                         return;
                 }
-        a = fnode->ea_secno;
-        len = fnode->ea_size_l;
+        a = le32_to_cpu(fnode->ea_secno);
+        len = le32_to_cpu(fnode->ea_size_l);
         ano = fnode->ea_anode;
         pos = 0;
         while (pos < len) {
@@ -228,68 +228,70 @@ void hpfs_set_ea(struct inode *inode, struct fnode *fnode, const char *key,
                                         set_indirect_ea(s, ea->anode, ea_sec(ea), data, size);
                         }
                         else {
-                                if (ea->valuelen == size)
+                                if (ea_valuelen(ea) == size)
                                         hpfs_ea_write(s, a, ano, pos + 4 + ea->namelen + 1, size, data);
                         }
                         return;
                 }
-                pos += ea->namelen + ea->valuelen + 5;
+                pos += ea->namelen + ea_valuelen(ea) + 5;
         }
-        if (!fnode->ea_offs) {
-                /*if (fnode->ea_size_s) {
+        if (!le16_to_cpu(fnode->ea_offs)) {
+                /*if (le16_to_cpu(fnode->ea_size_s)) {
                         hpfs_error(s, "fnode %08x: ea_size_s == %03x, ea_offs == 0",
-                                inode->i_ino, fnode->ea_size_s);
+                                inode->i_ino, le16_to_cpu(fnode->ea_size_s));
                         return;
                 }*/
-                fnode->ea_offs = 0xc4;
+                fnode->ea_offs = cpu_to_le16(0xc4);
         }
-        if (fnode->ea_offs < 0xc4 || fnode->ea_offs + fnode->acl_size_s + fnode->ea_size_s > 0x200) {
+        if (le16_to_cpu(fnode->ea_offs) < 0xc4 || le16_to_cpu(fnode->ea_offs) + le16_to_cpu(fnode->acl_size_s) + le16_to_cpu(fnode->ea_size_s) > 0x200) {
                 hpfs_error(s, "fnode %08lx: ea_offs == %03x, ea_size_s == %03x",
                         (unsigned long)inode->i_ino,
-                        fnode->ea_offs, fnode->ea_size_s);
+                        le32_to_cpu(fnode->ea_offs), le16_to_cpu(fnode->ea_size_s));
                 return;
         }
-        if ((fnode->ea_size_s || !fnode->ea_size_l) &&
-             fnode->ea_offs + fnode->acl_size_s + fnode->ea_size_s + strlen(key) + size + 5 <= 0x200) {
+        if ((le16_to_cpu(fnode->ea_size_s) || !le32_to_cpu(fnode->ea_size_l)) &&
+             le16_to_cpu(fnode->ea_offs) + le16_to_cpu(fnode->acl_size_s) + le16_to_cpu(fnode->ea_size_s) + strlen(key) + size + 5 <= 0x200) {
                 ea = fnode_end_ea(fnode);
                 *(char *)ea = 0;
                 ea->namelen = strlen(key);
-                ea->valuelen = size;
+                ea->valuelen_lo = size;
+                ea->valuelen_hi = size >> 8;
                 strcpy(ea->name, key);
                 memcpy(ea_data(ea), data, size);
-                fnode->ea_size_s += strlen(key) + size + 5;
+                fnode->ea_size_s = cpu_to_le16(le16_to_cpu(fnode->ea_size_s) + strlen(key) + size + 5);
                 goto ret;
         }
         /* Most the code here is 99.9993422% unused. I hope there are no bugs.
            But what .. HPFS.IFS has also bugs in ea management. */
-        if (fnode->ea_size_s && !fnode->ea_size_l) {
+        if (le16_to_cpu(fnode->ea_size_s) && !le32_to_cpu(fnode->ea_size_l)) {
                 secno n;
                 struct buffer_head *bh;
                 char *data;
-                if (!(n = hpfs_alloc_sector(s, fno, 1, 0, 1))) return;
+                if (!(n = hpfs_alloc_sector(s, fno, 1, 0))) return;
                 if (!(data = hpfs_get_sector(s, n, &bh))) {
                         hpfs_free_sectors(s, n, 1);
                         return;
                 }
-                memcpy(data, fnode_ea(fnode), fnode->ea_size_s);
-                fnode->ea_size_l = fnode->ea_size_s;
-                fnode->ea_size_s = 0;
-                fnode->ea_secno = n;
-                fnode->ea_anode = 0;
+                memcpy(data, fnode_ea(fnode), le16_to_cpu(fnode->ea_size_s));
+                fnode->ea_size_l = cpu_to_le32(le16_to_cpu(fnode->ea_size_s));
+                fnode->ea_size_s = cpu_to_le16(0);
+                fnode->ea_secno = cpu_to_le32(n);
+                fnode->ea_anode = cpu_to_le32(0);
                 mark_buffer_dirty(bh);
                 brelse(bh);
         }
-        pos = fnode->ea_size_l + 5 + strlen(key) + size;
-        len = (fnode->ea_size_l + 511) >> 9;
+        pos = le32_to_cpu(fnode->ea_size_l) + 5 + strlen(key) + size;
+        len = (le32_to_cpu(fnode->ea_size_l) + 511) >> 9;
         if (pos >= 30000) goto bail;
         while (((pos + 511) >> 9) > len) {
                 if (!len) {
-                        if (!(fnode->ea_secno = hpfs_alloc_sector(s, fno, 1, 0, 1)))
-                                goto bail;
+                        secno q = hpfs_alloc_sector(s, fno, 1, 0);
+                        if (!q) goto bail;
+                        fnode->ea_secno = cpu_to_le32(q);
                         fnode->ea_anode = 0;
                         len++;
                 } else if (!fnode->ea_anode) {
-                        if (hpfs_alloc_if_possible(s, fnode->ea_secno + len)) {
+                        if (hpfs_alloc_if_possible(s, le32_to_cpu(fnode->ea_secno) + len)) {
                                 len++;
                         } else {
                                 /* Aargh... don't know how to create ea anodes :-( */
@@ -298,26 +300,26 @@ void hpfs_set_ea(struct inode *inode, struct fnode *fnode, const char *key,
                                 anode_secno a_s;
                                 if (!(anode = hpfs_alloc_anode(s, fno, &a_s, &bh)))
                                         goto bail;
-                                anode->up = fno;
+                                anode->up = cpu_to_le32(fno);
                                 anode->btree.fnode_parent = 1;
                                 anode->btree.n_free_nodes--;
                                 anode->btree.n_used_nodes++;
-                                anode->btree.first_free += 12;
-                                anode->u.external[0].disk_secno = fnode->ea_secno;
-                                anode->u.external[0].file_secno = 0;
-                                anode->u.external[0].length = len;
+                                anode->btree.first_free = cpu_to_le16(le16_to_cpu(anode->btree.first_free) + 12);
+                                anode->u.external[0].disk_secno = cpu_to_le32(le32_to_cpu(fnode->ea_secno));
+                                anode->u.external[0].file_secno = cpu_to_le32(0);
+                                anode->u.external[0].length = cpu_to_le32(len);
                                 mark_buffer_dirty(bh);
                                 brelse(bh);
                                 fnode->ea_anode = 1;
-                                fnode->ea_secno = a_s;*/
+                                fnode->ea_secno = cpu_to_le32(a_s);*/
                                 secno new_sec;
                                 int i;
-                                if (!(new_sec = hpfs_alloc_sector(s, fno, 1, 1 - ((pos + 511) >> 9), 1)))
+                                if (!(new_sec = hpfs_alloc_sector(s, fno, 1, 1 - ((pos + 511) >> 9))))
                                         goto bail;
                                 for (i = 0; i < len; i++) {
                                         struct buffer_head *bh1, *bh2;
                                         void *b1, *b2;
-                                        if (!(b1 = hpfs_map_sector(s, fnode->ea_secno + i, &bh1, len - i - 1))) {
+                                        if (!(b1 = hpfs_map_sector(s, le32_to_cpu(fnode->ea_secno) + i, &bh1, len - i - 1))) {
                                                 hpfs_free_sectors(s, new_sec, (pos + 511) >> 9);
                                                 goto bail;
                                         }
@@ -331,13 +333,13 @@ void hpfs_set_ea(struct inode *inode, struct fnode *fnode, const char *key,
                                         mark_buffer_dirty(bh2);
                                         brelse(bh2);
                                 }
-                                hpfs_free_sectors(s, fnode->ea_secno, len);
-                                fnode->ea_secno = new_sec;
+                                hpfs_free_sectors(s, le32_to_cpu(fnode->ea_secno), len);
+                                fnode->ea_secno = cpu_to_le32(new_sec);
                                 len = (pos + 511) >> 9;
                         }
                 }
                 if (fnode->ea_anode) {
-                        if (hpfs_add_sector_to_btree(s, fnode->ea_secno,
+                        if (hpfs_add_sector_to_btree(s, le32_to_cpu(fnode->ea_secno),
                                                      0, len) != -1) {
                                 len++;
                         } else {
@@ -349,17 +351,17 @@ void hpfs_set_ea(struct inode *inode, struct fnode *fnode, const char *key,
         h[1] = strlen(key);
         h[2] = size & 0xff;
         h[3] = size >> 8;
-        if (hpfs_ea_write(s, fnode->ea_secno, fnode->ea_anode, fnode->ea_size_l, 4, h)) goto bail;
-        if (hpfs_ea_write(s, fnode->ea_secno, fnode->ea_anode, fnode->ea_size_l + 4, h[1] + 1, key)) goto bail;
-        if (hpfs_ea_write(s, fnode->ea_secno, fnode->ea_anode, fnode->ea_size_l + 5 + h[1], size, data)) goto bail;
-        fnode->ea_size_l = pos;
+        if (hpfs_ea_write(s, le32_to_cpu(fnode->ea_secno), fnode->ea_anode, le32_to_cpu(fnode->ea_size_l), 4, h)) goto bail;
+        if (hpfs_ea_write(s, le32_to_cpu(fnode->ea_secno), fnode->ea_anode, le32_to_cpu(fnode->ea_size_l) + 4, h[1] + 1, key)) goto bail;
+        if (hpfs_ea_write(s, le32_to_cpu(fnode->ea_secno), fnode->ea_anode, le32_to_cpu(fnode->ea_size_l) + 5 + h[1], size, data)) goto bail;
+        fnode->ea_size_l = cpu_to_le32(pos);
         ret:
         hpfs_i(inode)->i_ea_size += 5 + strlen(key) + size;
         return;
         bail:
-        if (fnode->ea_secno)
-                if (fnode->ea_anode) hpfs_truncate_btree(s, fnode->ea_secno, 1, (fnode->ea_size_l + 511) >> 9);
-                else hpfs_free_sectors(s, fnode->ea_secno + ((fnode->ea_size_l + 511) >> 9), len - ((fnode->ea_size_l + 511) >> 9));
-        else fnode->ea_secno = fnode->ea_size_l = 0;
+        if (le32_to_cpu(fnode->ea_secno))
+                if (fnode->ea_anode) hpfs_truncate_btree(s, le32_to_cpu(fnode->ea_secno), 1, (le32_to_cpu(fnode->ea_size_l) + 511) >> 9);
+                else hpfs_free_sectors(s, le32_to_cpu(fnode->ea_secno) + ((le32_to_cpu(fnode->ea_size_l) + 511) >> 9), len - ((le32_to_cpu(fnode->ea_size_l) + 511) >> 9));
+        else fnode->ea_secno = fnode->ea_size_l = cpu_to_le32(0);
 }
         
diff --git a/fs/hpfs/file.c b/fs/hpfs/file.c
index 9b9eb6933e43..89c500ee5213 100644
--- a/fs/hpfs/file.c
+++ b/fs/hpfs/file.c
@@ -20,8 +20,8 @@ static int hpfs_file_release(struct inode *inode, struct file *file)
 
 int hpfs_file_fsync(struct file *file, int datasync)
 {
-        /*return file_fsync(file, datasync);*/
-        return 0; /* Don't fsync :-) */
+        struct inode *inode = file->f_mapping->host;
+        return sync_blockdev(inode->i_sb->s_bdev);
 }
 
 /*
@@ -48,38 +48,46 @@ static secno hpfs_bmap(struct inode *inode, unsigned file_secno)
 static void hpfs_truncate(struct inode *i)
 {
         if (IS_IMMUTABLE(i)) return /*-EPERM*/;
-        hpfs_lock(i->i_sb);
+        hpfs_lock_assert(i->i_sb);
+
         hpfs_i(i)->i_n_secs = 0;
         i->i_blocks = 1 + ((i->i_size + 511) >> 9);
         hpfs_i(i)->mmu_private = i->i_size;
         hpfs_truncate_btree(i->i_sb, i->i_ino, 1, ((i->i_size + 511) >> 9));
         hpfs_write_inode(i);
         hpfs_i(i)->i_n_secs = 0;
-        hpfs_unlock(i->i_sb);
 }
 
 static int hpfs_get_block(struct inode *inode, sector_t iblock, struct buffer_head *bh_result, int create)
 {
+        int r;
         secno s;
+        hpfs_lock(inode->i_sb);
         s = hpfs_bmap(inode, iblock);
         if (s) {
                 map_bh(bh_result, inode->i_sb, s);
-                return 0;
+                goto ret_0;
         }
-        if (!create) return 0;
+        if (!create) goto ret_0;
         if (iblock<<9 != hpfs_i(inode)->mmu_private) {
                 BUG();
-                return -EIO;
+                r = -EIO;
+                goto ret_r;
         }
         if ((s = hpfs_add_sector_to_btree(inode->i_sb, inode->i_ino, 1, inode->i_blocks - 1)) == -1) {
                 hpfs_truncate_btree(inode->i_sb, inode->i_ino, 1, inode->i_blocks - 1);
-                return -ENOSPC;
+                r = -ENOSPC;
+                goto ret_r;
         }
         inode->i_blocks++;
         hpfs_i(inode)->mmu_private += 512;
         set_buffer_new(bh_result);
         map_bh(bh_result, inode->i_sb, s);
-        return 0;
+        ret_0:
+        r = 0;
+        ret_r:
+        hpfs_unlock(inode->i_sb);
+        return r;
 }
 
 static int hpfs_writepage(struct page *page, struct writeback_control *wbc)
@@ -130,8 +138,11 @@ static ssize_t hpfs_file_write(struct file *file, const char __user *buf,
         ssize_t retval;
 
         retval = do_sync_write(file, buf, count, ppos);
-        if (retval > 0)
+        if (retval > 0) {
+                hpfs_lock(file->f_path.dentry->d_sb);
                 hpfs_i(file->f_path.dentry->d_inode)->i_dirty = 1;
+                hpfs_unlock(file->f_path.dentry->d_sb);
+        }
         return retval;
 }
 
diff --git a/fs/hpfs/hpfs.h b/fs/hpfs/hpfs.h
index 0e84c73cd9c4..8b0650aae328 100644
--- a/fs/hpfs/hpfs.h
+++ b/fs/hpfs/hpfs.h
@@ -19,9 +19,13 @@
    For definitive information on HPFS, ask somebody else -- this is guesswork.
    There are certain to be many mistakes. */
 
+#if !defined(__LITTLE_ENDIAN) && !defined(__BIG_ENDIAN)
+#error unknown endian
+#endif
+
 /* Notation */
 
-typedef unsigned secno;                 /* sector number, partition relative */
+typedef u32 secno;                      /* sector number, partition relative */
 
 typedef secno dnode_secno;              /* sector number of a dnode */
 typedef secno fnode_secno;              /* sector number of an fnode */
@@ -38,28 +42,28 @@ typedef u32 time32_t;		/* 32-bit time_t type */
 
 struct hpfs_boot_block
 {
-  unsigned char jmp[3];
-  unsigned char oem_id[8];
-  unsigned char bytes_per_sector[2];    /* 512 */
-  unsigned char sectors_per_cluster;
-  unsigned char n_reserved_sectors[2];
-  unsigned char n_fats;
-  unsigned char n_rootdir_entries[2];
-  unsigned char n_sectors_s[2];
-  unsigned char media_byte;
-  unsigned short sectors_per_fat;
-  unsigned short sectors_per_track;
-  unsigned short heads_per_cyl;
-  unsigned int n_hidden_sectors;
-  unsigned int n_sectors_l;             /* size of partition */
-  unsigned char drive_number;
-  unsigned char mbz;
-  unsigned char sig_28h;                /* 28h */
-  unsigned char vol_serno[4];
-  unsigned char vol_label[11];
-  unsigned char sig_hpfs[8];            /* "HPFS    " */
-  unsigned char pad[448];
-  unsigned short magic;                 /* aa55 */
+  u8 jmp[3];
+  u8 oem_id[8];
+  u8 bytes_per_sector[2];       /* 512 */
+  u8 sectors_per_cluster;
+  u8 n_reserved_sectors[2];
+  u8 n_fats;
+  u8 n_rootdir_entries[2];
+  u8 n_sectors_s[2];
+  u8 media_byte;
+  u16 sectors_per_fat;
+  u16 sectors_per_track;
+  u16 heads_per_cyl;
+  u32 n_hidden_sectors;
+  u32 n_sectors_l;              /* size of partition */
+  u8 drive_number;
+  u8 mbz;
+  u8 sig_28h;                   /* 28h */
+  u8 vol_serno[4];
+  u8 vol_label[11];
+  u8 sig_hpfs[8];               /* "HPFS    " */
+  u8 pad[448];
+  u16 magic;                    /* aa55 */
 };
 
 
@@ -71,31 +75,29 @@ struct hpfs_boot_block
 
 struct hpfs_super_block
 {
-  unsigned magic;                       /* f995 e849 */
-  unsigned magic1;                      /* fa53 e9c5, more magic? */
-  /*unsigned huh202;*/                  /* ?? 202 = N. of B. in 1.00390625 S.*/
-  char version;                         /* version of a filesystem  usually 2 */
-  char funcversion;                     /* functional version - oldest version
+  u32 magic;                            /* f995 e849 */
+  u32 magic1;                           /* fa53 e9c5, more magic? */
+  u8 version;                           /* version of a filesystem  usually 2 */
+  u8 funcversion;                       /* functional version - oldest version
                                            of filesystem that can understand
                                            this disk */
-  unsigned short int zero;              /* 0 */
+  u16 zero;                             /* 0 */
   fnode_secno root;                     /* fnode of root directory */
   secno n_sectors;                      /* size of filesystem */
-  unsigned n_badblocks;                 /* number of bad blocks */
+  u32 n_badblocks;                      /* number of bad blocks */
   secno bitmaps;                        /* pointers to free space bit maps */
-  unsigned zero1;                       /* 0 */
+  u32 zero1;                            /* 0 */
   secno badblocks;                      /* bad block list */
-  unsigned zero3;                       /* 0 */
+  u32 zero3;                            /* 0 */
   time32_t last_chkdsk;                 /* date last checked, 0 if never */
-  /*unsigned zero4;*/                   /* 0 */
-  time32_t last_optimize;                       /* date last optimized, 0 if never */
+  time32_t last_optimize;               /* date last optimized, 0 if never */
   secno n_dir_band;                     /* number of sectors in dir band */
   secno dir_band_start;                 /* first sector in dir band */
   secno dir_band_end;                   /* last sector in dir band */
   secno dir_band_bitmap;                /* free space map, 1 dnode per bit */
-  char volume_name[32];                 /* not used */
+  u8 volume_name[32];                   /* not used */
   secno user_id_table;                  /* 8 preallocated sectors - user id */
-  unsigned zero6[103];                  /* 0 */
+  u32 zero6[103];                       /* 0 */
 };
 
 
@@ -107,44 +109,65 @@ struct hpfs_super_block
 
 struct hpfs_spare_block
 {
-  unsigned magic;                       /* f991 1849 */
-  unsigned magic1;                      /* fa52 29c5, more magic? */
-
-  unsigned dirty: 1;                    /* 0 clean, 1 "improperly stopped" */
-  /*unsigned flag1234: 4;*/             /* unknown flags */
-  unsigned sparedir_used: 1;            /* spare dirblks used */
-  unsigned hotfixes_used: 1;            /* hotfixes used */
-  unsigned bad_sector: 1;               /* bad sector, corrupted disk (???) */
-  unsigned bad_bitmap: 1;               /* bad bitmap */
-  unsigned fast: 1;                     /* partition was fast formatted */
-  unsigned old_wrote: 1;                /* old version wrote to partion */
-  unsigned old_wrote_1: 1;              /* old version wrote to partion (?) */
-  unsigned install_dasd_limits: 1;      /* HPFS386 flags */
-  unsigned resynch_dasd_limits: 1;
-  unsigned dasd_limits_operational: 1;
-  unsigned multimedia_active: 1;
-  unsigned dce_acls_active: 1;
-  unsigned dasd_limits_dirty: 1;
-  unsigned flag67: 2;
-  unsigned char mm_contlgulty;
-  unsigned char unused;
+  u32 magic;                            /* f991 1849 */
+  u32 magic1;                           /* fa52 29c5, more magic? */
+
+#ifdef __LITTLE_ENDIAN
+  u8 dirty: 1;                          /* 0 clean, 1 "improperly stopped" */
+  u8 sparedir_used: 1;                  /* spare dirblks used */
+  u8 hotfixes_used: 1;                  /* hotfixes used */
+  u8 bad_sector: 1;                     /* bad sector, corrupted disk (???) */
+  u8 bad_bitmap: 1;                     /* bad bitmap */
+  u8 fast: 1;                           /* partition was fast formatted */
+  u8 old_wrote: 1;                      /* old version wrote to partion */
+  u8 old_wrote_1: 1;                    /* old version wrote to partion (?) */
+#else
+  u8 old_wrote_1: 1;                    /* old version wrote to partion (?) */
+  u8 old_wrote: 1;                      /* old version wrote to partion */
+  u8 fast: 1;                           /* partition was fast formatted */
+  u8 bad_bitmap: 1;                     /* bad bitmap */
+  u8 bad_sector: 1;                     /* bad sector, corrupted disk (???) */
+  u8 hotfixes_used: 1;                  /* hotfixes used */
+  u8 sparedir_used: 1;                  /* spare dirblks used */
+  u8 dirty: 1;                          /* 0 clean, 1 "improperly stopped" */
+#endif
+
+#ifdef __LITTLE_ENDIAN
+  u8 install_dasd_limits: 1;            /* HPFS386 flags */
+  u8 resynch_dasd_limits: 1;
+  u8 dasd_limits_operational: 1;
+  u8 multimedia_active: 1;
+  u8 dce_acls_active: 1;
+  u8 dasd_limits_dirty: 1;
+  u8 flag67: 2;
+#else
+  u8 flag67: 2;
+  u8 dasd_limits_dirty: 1;
+  u8 dce_acls_active: 1;
+  u8 multimedia_active: 1;
+  u8 dasd_limits_operational: 1;
+  u8 resynch_dasd_limits: 1;
+  u8 install_dasd_limits: 1;            /* HPFS386 flags */
+#endif
+
+  u8 mm_contlgulty;
+  u8 unused;
 
   secno hotfix_map;                     /* info about remapped bad sectors */
-  unsigned n_spares_used;               /* number of hotfixes */
-  unsigned n_spares;                    /* number of spares in hotfix map */
-  unsigned n_dnode_spares_free;         /* spare dnodes unused */
-  unsigned n_dnode_spares;              /* length of spare_dnodes[] list,
+  u32 n_spares_used;                    /* number of hotfixes */
+  u32 n_spares;                         /* number of spares in hotfix map */
+  u32 n_dnode_spares_free;              /* spare dnodes unused */
+  u32 n_dnode_spares;                   /* length of spare_dnodes[] list,
                                            follows in this block*/
   secno code_page_dir;                  /* code page directory block */
-  unsigned n_code_pages;                /* number of code pages */
-  /*unsigned large_numbers[2];*/        /* ?? */
-  unsigned super_crc;                   /* on HPFS386 and LAN Server this is
+  u32 n_code_pages;                     /* number of code pages */
+  u32 super_crc;                        /* on HPFS386 and LAN Server this is
                                            checksum of superblock, on normal
                                            OS/2 unused */
-  unsigned spare_crc;                   /* on HPFS386 checksum of spareblock */
-  unsigned zero1[15];                   /* unused */
+  u32 spare_crc;                        /* on HPFS386 checksum of spareblock */
+  u32 zero1[15];                        /* unused */
   dnode_secno spare_dnodes[100];        /* emergency free dnode list */
-  unsigned zero2[1];                    /* room for more? */
+  u32 zero2[1];                         /* room for more? */
 };
 
 /* The bad block list is 4 sectors long.  The first word must be zero,
@@ -179,18 +202,18 @@ struct hpfs_spare_block
 
 struct code_page_directory
 {
-  unsigned magic;                       /* 4945 21f7 */
-  unsigned n_code_pages;                /* number of pointers following */
-  unsigned zero1[2];
+  u32 magic;                            /* 4945 21f7 */
+  u32 n_code_pages;                     /* number of pointers following */
+  u32 zero1[2];
   struct {
-    unsigned short ix;                  /* index */
-    unsigned short code_page_number;    /* code page number */
-    unsigned bounds;                    /* matches corresponding word
+    u16 ix;                             /* index */
+    u16 code_page_number;               /* code page number */
+    u32 bounds;                         /* matches corresponding word
                                            in data block */
     secno code_page_data;               /* sector number of a code_page_data
                                            containing c.p. array */
-    unsigned short index;               /* index in c.p. array in that sector*/
-    unsigned short unknown;             /* some unknown value; usually 0;
+    u16 index;                          /* index in c.p. array in that sector*/
+    u16 unknown;                        /* some unknown value; usually 0;
                                            2 in Japanese version */
   } array[31];                          /* unknown length */
 };
@@ -201,21 +224,21 @@ struct code_page_directory
 
 struct code_page_data
 {
-  unsigned magic;                       /* 8945 21f7 */
-  unsigned n_used;                      /* # elements used in c_p_data[] */
-  unsigned bounds[3];                   /* looks a bit like
+  u32 magic;                            /* 8945 21f7 */
+  u32 n_used;                           /* # elements used in c_p_data[] */
+  u32 bounds[3];                        /* looks a bit like
                                              (beg1,end1), (beg2,end2)
                                            one byte each */
-  unsigned short offs[3];               /* offsets from start of sector
+  u16 offs[3];                          /* offsets from start of sector
                                            to start of c_p_data[ix] */
   struct {
-    unsigned short ix;                  /* index */
-    unsigned short code_page_number;    /* code page number */
-    unsigned short unknown;             /* the same as in cp directory */
-    unsigned char map[128];             /* upcase table for chars 80..ff */
-    unsigned short zero2;
+    u16 ix;                             /* index */
+    u16 code_page_number;               /* code page number */
+    u16 unknown;                        /* the same as in cp directory */
+    u8 map[128];                        /* upcase table for chars 80..ff */
+    u16 zero2;
   } code_page[3];
-  unsigned char incognita[78];
+  u8 incognita[78];
 };
 
 
@@ -255,50 +278,84 @@ struct code_page_data
 #define DNODE_MAGIC   0x77e40aae
 
 struct dnode {
-  unsigned magic;                       /* 77e4 0aae */
-  unsigned first_free;                  /* offset from start of dnode to
+  u32 magic;                            /* 77e4 0aae */
+  u32 first_free;                       /* offset from start of dnode to
                                            first free dir entry */
-  unsigned root_dnode:1;                /* Is it root dnode? */
-  unsigned increment_me:31;             /* some kind of activity counter?
-                                           Neither HPFS.IFS nor CHKDSK cares
+#ifdef __LITTLE_ENDIAN
+  u8 root_dnode: 1;                     /* Is it root dnode? */
+  u8 increment_me: 7;                   /* some kind of activity counter? */
+                                        /* Neither HPFS.IFS nor CHKDSK cares
+                                           if you change this word */
+#else
+  u8 increment_me: 7;                   /* some kind of activity counter? */
+                                        /* Neither HPFS.IFS nor CHKDSK cares
                                            if you change this word */
+  u8 root_dnode: 1;                     /* Is it root dnode? */
+#endif
+  u8 increment_me2[3];
   secno up;                             /* (root dnode) directory's fnode
                                            (nonroot) parent dnode */
   dnode_secno self;                     /* pointer to this dnode */
-  unsigned char dirent[2028];           /* one or more dirents */
+  u8 dirent[2028];                      /* one or more dirents */
 };
 
 struct hpfs_dirent {
-  unsigned short length;                /* offset to next dirent */
-  unsigned first: 1;                    /* set on phony ^A^A (".") entry */
-  unsigned has_acl: 1;
-  unsigned down: 1;                     /* down pointer present (after name) */
-  unsigned last: 1;                     /* set on phony \377 entry */
-  unsigned has_ea: 1;                   /* entry has EA */
-  unsigned has_xtd_perm: 1;             /* has extended perm list (???) */
-  unsigned has_explicit_acl: 1;
-  unsigned has_needea: 1;               /* ?? some EA has NEEDEA set
+  u16 length;                           /* offset to next dirent */
+
+#ifdef __LITTLE_ENDIAN
+  u8 first: 1;                          /* set on phony ^A^A (".") entry */
+  u8 has_acl: 1;
+  u8 down: 1;                           /* down pointer present (after name) */
+  u8 last: 1;                           /* set on phony \377 entry */
+  u8 has_ea: 1;                         /* entry has EA */
+  u8 has_xtd_perm: 1;                   /* has extended perm list (???) */
+  u8 has_explicit_acl: 1;
+  u8 has_needea: 1;                     /* ?? some EA has NEEDEA set
+                                           I have no idea why this is
+                                           interesting in a dir entry */
+#else
+  u8 has_needea: 1;                     /* ?? some EA has NEEDEA set
                                            I have no idea why this is
                                            interesting in a dir entry */
-  unsigned read_only: 1;                /* dos attrib */
-  unsigned hidden: 1;                   /* dos attrib */
-  unsigned system: 1;                   /* dos attrib */
-  unsigned flag11: 1;                   /* would be volume label dos attrib */
-  unsigned directory: 1;                /* dos attrib */
-  unsigned archive: 1;                  /* dos attrib */
-  unsigned not_8x3: 1;                  /* name is not 8.3 */
-  unsigned flag15: 1;
+  u8 has_explicit_acl: 1;
+  u8 has_xtd_perm: 1;                   /* has extended perm list (???) */
+  u8 has_ea: 1;                         /* entry has EA */
+  u8 last: 1;                           /* set on phony \377 entry */
+  u8 down: 1;                           /* down pointer present (after name) */
+  u8 has_acl: 1;
+  u8 first: 1;                          /* set on phony ^A^A (".") entry */
+#endif
+
+#ifdef __LITTLE_ENDIAN
+  u8 read_only: 1;                      /* dos attrib */
+  u8 hidden: 1;                         /* dos attrib */
+  u8 system: 1;                         /* dos attrib */
+  u8 flag11: 1;                         /* would be volume label dos attrib */
+  u8 directory: 1;                      /* dos attrib */
+  u8 archive: 1;                        /* dos attrib */
+  u8 not_8x3: 1;                        /* name is not 8.3 */
+  u8 flag15: 1;
+#else
+  u8 flag15: 1;
+  u8 not_8x3: 1;                        /* name is not 8.3 */
+  u8 archive: 1;                        /* dos attrib */
+  u8 directory: 1;                      /* dos attrib */
+  u8 flag11: 1;                         /* would be volume label dos attrib */
+  u8 system: 1;                         /* dos attrib */
+  u8 hidden: 1;                         /* dos attrib */
+  u8 read_only: 1;                      /* dos attrib */
+#endif
+
   fnode_secno fnode;                    /* fnode giving allocation info */
   time32_t write_date;                  /* mtime */
-  unsigned file_size;                   /* file length, bytes */
+  u32 file_size;                        /* file length, bytes */
   time32_t read_date;                   /* atime */
   time32_t creation_date;                       /* ctime */
-  unsigned ea_size;                     /* total EA length, bytes */
-  unsigned char no_of_acls : 3;         /* number of ACL's */
-  unsigned char reserver : 5;
-  unsigned char ix;                     /* code page index (of filename), see
+  u32 ea_size;                          /* total EA length, bytes */
+  u8 no_of_acls;                        /* number of ACL's (low 3 bits) */
+  u8 ix;                                /* code page index (of filename), see
                                            struct code_page_data */
-  unsigned char namelen, name[1];       /* file name */
+  u8 namelen, name[1];                  /* file name */
   /* dnode_secno down;    btree down pointer, if present,
                           follows name on next word boundary, or maybe it
                           precedes next dirent, which is on a word boundary. */
@@ -318,38 +375,50 @@ struct hpfs_dirent {
 
 struct bplus_leaf_node
 {
-  unsigned file_secno;                  /* first file sector in extent */
-  unsigned length;                      /* length, sectors */
+  u32 file_secno;                       /* first file sector in extent */
+  u32 length;                           /* length, sectors */
   secno disk_secno;                     /* first corresponding disk sector */
 };
 
 struct bplus_internal_node
 {
-  unsigned file_secno;                  /* subtree maps sectors < this  */
+  u32 file_secno;                       /* subtree maps sectors < this  */
   anode_secno down;                     /* pointer to subtree */
 };
 
 struct bplus_header
 {
-  unsigned hbff: 1;     /* high bit of first free entry offset */
-  unsigned flag1: 1;
-  unsigned flag2: 1;
-  unsigned flag3: 1;
-  unsigned flag4: 1;
-  unsigned fnode_parent: 1;             /* ? we're pointed to by an fnode,
+#ifdef __LITTLE_ENDIAN
+  u8 hbff: 1;                   /* high bit of first free entry offset */
+  u8 flag1234: 4;
+  u8 fnode_parent: 1;                   /* ? we're pointed to by an fnode,
                                            the data btree or some ea or the
                                            main ea bootage pointer ea_secno */
                                         /* also can get set in fnodes, which
                                            may be a chkdsk glitch or may mean
                                            this bit is irrelevant in fnodes,
                                            or this interpretation is all wet */
-  unsigned binary_search: 1;            /* suggest binary search (unused) */
-  unsigned internal: 1;                 /* 1 -> (internal) tree of anodes
+  u8 binary_search: 1;                  /* suggest binary search (unused) */
+  u8 internal: 1;                       /* 1 -> (internal) tree of anodes
+                                           0 -> (leaf) list of extents */
+#else
+  u8 internal: 1;                       /* 1 -> (internal) tree of anodes
                                            0 -> (leaf) list of extents */
-  unsigned char fill[3];
-  unsigned char n_free_nodes;           /* free nodes in following array */
-  unsigned char n_used_nodes;           /* used nodes in following array */
-  unsigned short first_free;            /* offset from start of header to
+  u8 binary_search: 1;                  /* suggest binary search (unused) */
+  u8 fnode_parent: 1;                   /* ? we're pointed to by an fnode,
+                                           the data btree or some ea or the
+                                           main ea bootage pointer ea_secno */
+                                        /* also can get set in fnodes, which
+                                           may be a chkdsk glitch or may mean
+                                           this bit is irrelevant in fnodes,
+                                           or this interpretation is all wet */
+  u8 flag1234: 4;
+  u8 hbff: 1;                   /* high bit of first free entry offset */
+#endif
+  u8 fill[3];
+  u8 n_free_nodes;                      /* free nodes in following array */
+  u8 n_used_nodes;                      /* used nodes in following array */
+  u16 first_free;                       /* offset from start of header to
                                            first free node in array */
   union {
     struct bplus_internal_node internal[0]; /* (internal) 2-word entries giving
@@ -369,37 +438,38 @@ struct bplus_header
 
 struct fnode
 {
-  unsigned magic;                       /* f7e4 0aae */
-  unsigned zero1[2];                    /* read history */
-  unsigned char len, name[15];          /* true length, truncated name */
+  u32 magic;                            /* f7e4 0aae */
+  u32 zero1[2];                         /* read history */
+  u8 len, name[15];                     /* true length, truncated name */
   fnode_secno up;                       /* pointer to file's directory fnode */
-  /*unsigned zero2[3];*/
   secno acl_size_l;
   secno acl_secno;
-  unsigned short acl_size_s;
-  char acl_anode;
-  char zero2;                           /* history bit count */
-  unsigned ea_size_l;                   /* length of disk-resident ea's */
+  u16 acl_size_s;
+  u8 acl_anode;
+  u8 zero2;                             /* history bit count */
+  u32 ea_size_l;                        /* length of disk-resident ea's */
   secno ea_secno;                       /* first sector of disk-resident ea's*/
-  unsigned short ea_size_s;             /* length of fnode-resident ea's */
-
-  unsigned flag0: 1;
-  unsigned ea_anode: 1;                 /* 1 -> ea_secno is an anode */
-  unsigned flag2: 1;
-  unsigned flag3: 1;
-  unsigned flag4: 1;
-  unsigned flag5: 1;
-  unsigned flag6: 1;
-  unsigned flag7: 1;
-  unsigned dirflag: 1;                  /* 1 -> directory.  first & only extent
+  u16 ea_size_s;                        /* length of fnode-resident ea's */
+
+#ifdef __LITTLE_ENDIAN
+  u8 flag0: 1;
+  u8 ea_anode: 1;                       /* 1 -> ea_secno is an anode */
+  u8 flag234567: 6;
+#else
+  u8 flag234567: 6;
+  u8 ea_anode: 1;                       /* 1 -> ea_secno is an anode */
+  u8 flag0: 1;
+#endif
+
+#ifdef __LITTLE_ENDIAN
+  u8 dirflag: 1;                        /* 1 -> directory.  first & only extent
                                            points to dnode. */
-  unsigned flag9: 1;
-  unsigned flag10: 1;
-  unsigned flag11: 1;
-  unsigned flag12: 1;
-  unsigned flag13: 1;
-  unsigned flag14: 1;
-  unsigned flag15: 1;
+  u8 flag9012345: 7;
+#else
+  u8 flag9012345: 7;
+  u8 dirflag: 1;                        /* 1 -> directory.  first & only extent
+                                           points to dnode. */
+#endif
 
   struct bplus_header btree;            /* b+ tree, 8 extents or 12 subtrees */
   union {
@@ -407,17 +477,16 @@ struct fnode
     struct bplus_internal_node internal[12];
   } u;
 
-  unsigned file_size;                   /* file length, bytes */
-  unsigned n_needea;                    /* number of EA's with NEEDEA set */
-  char user_id[16];                     /* unused */
-  unsigned short ea_offs;               /* offset from start of fnode
+  u32 file_size;                        /* file length, bytes */
+  u32 n_needea;                         /* number of EA's with NEEDEA set */
+  u8 user_id[16];                       /* unused */
+  u16 ea_offs;                          /* offset from start of fnode
                                            to first fnode-resident ea */
-  char dasd_limit_treshhold;
-  char dasd_limit_delta;
-  unsigned dasd_limit;
-  unsigned dasd_usage;
-  /*unsigned zero5[2];*/
-  unsigned char ea[316];                /* zero or more EA's, packed together
+  u8 dasd_limit_treshhold;
+  u8 dasd_limit_delta;
+  u32 dasd_limit;
+  u32 dasd_usage;
+  u8 ea[316];                           /* zero or more EA's, packed together
                                            with no alignment padding.
                                            (Do not use this name, get here
                                            via fnode + ea_offs. I think.) */
@@ -430,7 +499,7 @@ struct fnode
 
 struct anode
 {
-  unsigned magic;                       /* 37e4 0aae */
+  u32 magic;                            /* 37e4 0aae */
   anode_secno self;                     /* pointer to this anode */
   secno up;                             /* parent anode or fnode */
 
@@ -440,7 +509,7 @@ struct anode
     struct bplus_internal_node internal[60];
   } u;
 
-  unsigned fill[3];                     /* unused */
+  u32 fill[3];                          /* unused */
 };
 
 
@@ -461,25 +530,31 @@ struct anode
 
 struct extended_attribute
 {
-  unsigned indirect: 1;                 /* 1 -> value gives sector number
+#ifdef __LITTLE_ENDIAN
+  u8 indirect: 1;                       /* 1 -> value gives sector number
                                            where real value starts */
-  unsigned anode: 1;                    /* 1 -> sector is an anode
+  u8 anode: 1;                          /* 1 -> sector is an anode
+                                           that points to fragmented value */
+  u8 flag23456: 5;
+  u8 needea: 1;                         /* required ea */
+#else
+  u8 needea: 1;                         /* required ea */
+  u8 flag23456: 5;
+  u8 anode: 1;                          /* 1 -> sector is an anode
                                            that points to fragmented value */
-  unsigned flag2: 1;
-  unsigned flag3: 1;
-  unsigned flag4: 1;
-  unsigned flag5: 1;
-  unsigned flag6: 1;
-  unsigned needea: 1;                   /* required ea */
-  unsigned char namelen;                /* length of name, bytes */
-  unsigned short valuelen;              /* length of value, bytes */
-  unsigned char name[0];
+  u8 indirect: 1;                       /* 1 -> value gives sector number
+                                           where real value starts */
+#endif
+  u8 namelen;                           /* length of name, bytes */
+  u8 valuelen_lo;                       /* length of value, bytes */
+  u8 valuelen_hi;                       /* length of value, bytes */
+  u8 name[0];
   /*
-    unsigned char name[namelen];        ascii attrib name
-    unsigned char nul;                  terminating '\0', not counted
-    unsigned char value[valuelen];      value, arbitrary
+    u8 name[namelen];                   ascii attrib name
+    u8 nul;                             terminating '\0', not counted
+    u8 value[valuelen];                 value, arbitrary
       if this.indirect, valuelen is 8 and the value is
-        unsigned length;                real length of value, bytes
+        u32 length;                     real length of value, bytes
         secno secno;                    sector address where it starts
       if this.anode, the above sector number is the root of an anode tree
         which points to the value.
diff --git a/fs/hpfs/hpfs_fn.h b/fs/hpfs/hpfs_fn.h
index c15adbca07ff..dd552f862c8f 100644
--- a/fs/hpfs/hpfs_fn.h
+++ b/fs/hpfs/hpfs_fn.h
@@ -13,6 +13,7 @@
 #include <linux/pagemap.h>
 #include <linux/buffer_head.h>
 #include <linux/slab.h>
+#include <asm/unaligned.h>
 
 #include "hpfs.h"
 
@@ -51,18 +52,16 @@ struct hpfs_inode_info {
         unsigned i_disk_sec;    /* (files) minimalist cache of alloc info */
         unsigned i_n_secs;      /* (files) minimalist cache of alloc info */
         unsigned i_ea_size;     /* size of extended attributes */
-        unsigned i_conv : 2;    /* (files) crlf->newline hackery */
         unsigned i_ea_mode : 1; /* file's permission is stored in ea */
         unsigned i_ea_uid : 1;  /* file's uid is stored in ea */
         unsigned i_ea_gid : 1;  /* file's gid is stored in ea */
         unsigned i_dirty : 1;
-        struct mutex i_mutex;
-        struct mutex i_parent_mutex;
         loff_t **i_rddir_off;
         struct inode vfs_inode;
 };
 
 struct hpfs_sb_info {
+        struct mutex hpfs_mutex;        /* global hpfs lock */
         ino_t sb_root;                  /* inode number of root dir */
         unsigned sb_fs_size;            /* file system size, sectors */
         unsigned sb_bitmaps;            /* sector number of bitmap list */
@@ -74,7 +73,6 @@ struct hpfs_sb_info {
         uid_t sb_uid;                   /* uid from mount options */
         gid_t sb_gid;                   /* gid from mount options */
         umode_t sb_mode;                /* mode from mount options */
-        unsigned sb_conv : 2;           /* crlf->newline hackery */
         unsigned sb_eas : 2;            /* eas: 0-ignore, 1-ro, 2-rw */
         unsigned sb_err : 2;            /* on errs: 0-cont, 1-ro, 2-panic */
         unsigned sb_chk : 2;            /* checks: 0-no, 1-normal, 2-strict */
@@ -87,20 +85,9 @@ struct hpfs_sb_info {
         unsigned *sb_bmp_dir;           /* main bitmap directory */
         unsigned sb_c_bitmap;           /* current bitmap */
         unsigned sb_max_fwd_alloc;      /* max forwad allocation */
-        struct mutex hpfs_creation_de;  /* when creating dirents, nobody else
-                                           can alloc blocks */
-        /*unsigned sb_mounting : 1;*/
         int sb_timeshift;
 };
 
-/*
- * conv= options
- */
-
-#define CONV_BINARY 0                   /* no conversion */
-#define CONV_TEXT 1                     /* crlf->newline */
-#define CONV_AUTO 2                     /* decide based on file contents */
-
 /* Four 512-byte buffers and the 2k block obtained by concatenating them */
 
 struct quad_buffer_head {
@@ -113,7 +100,7 @@ struct quad_buffer_head {
 static inline dnode_secno de_down_pointer (struct hpfs_dirent *de)
 {
   CHKCOND(de->down,("HPFS: de_down_pointer: !de->down\n"));
-  return *(dnode_secno *) ((void *) de + de->length - 4);
+  return le32_to_cpu(*(dnode_secno *) ((void *) de + le16_to_cpu(de->length) - 4));
 }
 
 /* The first dir entry in a dnode */
@@ -127,41 +114,46 @@ static inline struct hpfs_dirent *dnode_first_de (struct dnode *dnode)
 
 static inline struct hpfs_dirent *dnode_end_de (struct dnode *dnode)
 {
-  CHKCOND(dnode->first_free>=0x14 && dnode->first_free<=0xa00,("HPFS: dnode_end_de: dnode->first_free = %d\n",(int)dnode->first_free));
-  return (void *) dnode + dnode->first_free;
+  CHKCOND(le32_to_cpu(dnode->first_free)>=0x14 && le32_to_cpu(dnode->first_free)<=0xa00,("HPFS: dnode_end_de: dnode->first_free = %x\n",(unsigned)le32_to_cpu(dnode->first_free)));
+  return (void *) dnode + le32_to_cpu(dnode->first_free);
 }
 
 /* The dir entry after dir entry de */
 
 static inline struct hpfs_dirent *de_next_de (struct hpfs_dirent *de)
 {
-  CHKCOND(de->length>=0x20 && de->length<0x800,("HPFS: de_next_de: de->length = %d\n",(int)de->length));
-  return (void *) de + de->length;
+  CHKCOND(le16_to_cpu(de->length)>=0x20 && le16_to_cpu(de->length)<0x800,("HPFS: de_next_de: de->length = %x\n",(unsigned)le16_to_cpu(de->length)));
+  return (void *) de + le16_to_cpu(de->length);
 }
 
 static inline struct extended_attribute *fnode_ea(struct fnode *fnode)
 {
-        return (struct extended_attribute *)((char *)fnode + fnode->ea_offs + fnode->acl_size_s);
+        return (struct extended_attribute *)((char *)fnode + le16_to_cpu(fnode->ea_offs) + le16_to_cpu(fnode->acl_size_s));
 }
 
 static inline struct extended_attribute *fnode_end_ea(struct fnode *fnode)
 {
-        return (struct extended_attribute *)((char *)fnode + fnode->ea_offs + fnode->acl_size_s + fnode->ea_size_s);
+        return (struct extended_attribute *)((char *)fnode + le16_to_cpu(fnode->ea_offs) + le16_to_cpu(fnode->acl_size_s) + le16_to_cpu(fnode->ea_size_s));
+}
+
+static unsigned ea_valuelen(struct extended_attribute *ea)
+{
+        return ea->valuelen_lo + 256 * ea->valuelen_hi;
 }
 
 static inline struct extended_attribute *next_ea(struct extended_attribute *ea)
 {
-        return (struct extended_attribute *)((char *)ea + 5 + ea->namelen + ea->valuelen);
+        return (struct extended_attribute *)((char *)ea + 5 + ea->namelen + ea_valuelen(ea));
 }
 
 static inline secno ea_sec(struct extended_attribute *ea)
 {
-        return *(secno *)((char *)ea + 9 + ea->namelen);
+        return le32_to_cpu(get_unaligned((secno *)((char *)ea + 9 + ea->namelen)));
 }
 
 static inline secno ea_len(struct extended_attribute *ea)
 {
-        return *(secno *)((char *)ea + 5 + ea->namelen);
+        return le32_to_cpu(get_unaligned((secno *)((char *)ea + 5 + ea->namelen)));
 }
 
 static inline char *ea_data(struct extended_attribute *ea)
@@ -186,13 +178,13 @@ static inline void copy_de(struct hpfs_dirent *dst, struct hpfs_dirent *src)
         dst->not_8x3 = n;
 }
 
-static inline unsigned tstbits(unsigned *bmp, unsigned b, unsigned n)
+static inline unsigned tstbits(u32 *bmp, unsigned b, unsigned n)
 {
         int i;
         if ((b >= 0x4000) || (b + n - 1 >= 0x4000)) return n;
-        if (!((bmp[(b & 0x3fff) >> 5] >> (b & 0x1f)) & 1)) return 1;
+        if (!((le32_to_cpu(bmp[(b & 0x3fff) >> 5]) >> (b & 0x1f)) & 1)) return 1;
         for (i = 1; i < n; i++)
-                if (/*b+i < 0x4000 &&*/ !((bmp[((b+i) & 0x3fff) >> 5] >> ((b+i) & 0x1f)) & 1))
+                if (!((le32_to_cpu(bmp[((b+i) & 0x3fff) >> 5]) >> ((b+i) & 0x1f)) & 1))
                         return i + 1;
         return 0;
 }
@@ -200,12 +192,12 @@ static inline unsigned tstbits(unsigned *bmp, unsigned b, unsigned n)
 /* alloc.c */
 
 int hpfs_chk_sectors(struct super_block *, secno, int, char *);
-secno hpfs_alloc_sector(struct super_block *, secno, unsigned, int, int);
+secno hpfs_alloc_sector(struct super_block *, secno, unsigned, int);
 int hpfs_alloc_if_possible(struct super_block *, secno);
 void hpfs_free_sectors(struct super_block *, secno, unsigned);
 int hpfs_check_free_dnodes(struct super_block *, int);
 void hpfs_free_dnode(struct super_block *, secno);
-struct dnode *hpfs_alloc_dnode(struct super_block *, secno, dnode_secno *, struct quad_buffer_head *, int);
+struct dnode *hpfs_alloc_dnode(struct super_block *, secno, dnode_secno *, struct quad_buffer_head *);
 struct fnode *hpfs_alloc_fnode(struct super_block *, secno, fnode_secno *, struct buffer_head **);
 struct anode *hpfs_alloc_anode(struct super_block *, secno, anode_secno *, struct buffer_head **);
 
@@ -222,8 +214,6 @@ void hpfs_remove_fnode(struct super_block *, fnode_secno fno);
 
 /* buffer.c */
 
-void hpfs_lock_creation(struct super_block *);
-void hpfs_unlock_creation(struct super_block *);
 void *hpfs_map_sector(struct super_block *, unsigned, struct buffer_head **, int);
 void *hpfs_get_sector(struct super_block *, unsigned, struct buffer_head **);
 void *hpfs_map_4sectors(struct super_block *, unsigned, struct quad_buffer_head *, int);
@@ -247,7 +237,7 @@ void hpfs_del_pos(struct inode *, loff_t *);
 struct hpfs_dirent *hpfs_add_de(struct super_block *, struct dnode *,
                                 const unsigned char *, unsigned, secno);
 int hpfs_add_dirent(struct inode *, const unsigned char *, unsigned,
-                    struct hpfs_dirent *, int);
+                    struct hpfs_dirent *);
 int hpfs_remove_dirent(struct inode *, dnode_secno, struct hpfs_dirent *, struct quad_buffer_head *, int);
 void hpfs_count_dnodes(struct super_block *, dnode_secno, int *, int *, int *);
 dnode_secno hpfs_de_as_down_as_possible(struct super_block *, dnode_secno dno);
@@ -303,7 +293,6 @@ int hpfs_compare_names(struct super_block *, const unsigned char *, unsigned,
                        const unsigned char *, unsigned, int);
 int hpfs_is_name_long(const unsigned char *, unsigned);
 void hpfs_adjust_length(const unsigned char *, unsigned *);
-void hpfs_decide_conv(struct inode *, const unsigned char *, unsigned);
 
 /* namei.c */
 
@@ -346,21 +335,26 @@ static inline time32_t gmt_to_local(struct super_block *s, time_t t)
 /*
  * Locking:
  *
- * hpfs_lock() is a leftover from the big kernel lock.
- * Right now, these functions are empty and only left
- * for documentation purposes. The file system no longer
- * works on SMP systems, so the lock is not needed
- * any more.
+ * hpfs_lock() locks the whole filesystem. It must be taken
+ * on any method called by the VFS.
  *
- * If someone is interested in making it work again, this
- * would be the place to start by adding a per-superblock
- * mutex and fixing all the bugs and performance issues
- * caused by that.
+ * We don't do any per-file locking anymore, it is hard to
+ * review and HPFS is not performance-sensitive anyway.
  */
 static inline void hpfs_lock(struct super_block *s)
 {
+        struct hpfs_sb_info *sbi = hpfs_sb(s);
+        mutex_lock(&sbi->hpfs_mutex);
 }
 
 static inline void hpfs_unlock(struct super_block *s)
 {
+        struct hpfs_sb_info *sbi = hpfs_sb(s);
+        mutex_unlock(&sbi->hpfs_mutex);
+}
+
+static inline void hpfs_lock_assert(struct super_block *s)
+{
+        struct hpfs_sb_info *sbi = hpfs_sb(s);
+        WARN_ON(!mutex_is_locked(&sbi->hpfs_mutex));
 }
diff --git a/fs/hpfs/inode.c b/fs/hpfs/inode.c
index 87f1f787e767..338cd8368451 100644
--- a/fs/hpfs/inode.c
+++ b/fs/hpfs/inode.c
@@ -17,7 +17,6 @@ void hpfs_init_inode(struct inode *i)
         i->i_uid = hpfs_sb(sb)->sb_uid;
         i->i_gid = hpfs_sb(sb)->sb_gid;
         i->i_mode = hpfs_sb(sb)->sb_mode;
-        hpfs_inode->i_conv = hpfs_sb(sb)->sb_conv;
         i->i_size = -1;
         i->i_blocks = -1;
         
@@ -116,8 +115,8 @@ void hpfs_read_inode(struct inode *i)
                 i->i_mode |= S_IFDIR;
                 i->i_op = &hpfs_dir_iops;
                 i->i_fop = &hpfs_dir_ops;
-                hpfs_inode->i_parent_dir = fnode->up;
-                hpfs_inode->i_dno = fnode->u.external[0].disk_secno;
+                hpfs_inode->i_parent_dir = le32_to_cpu(fnode->up);
+                hpfs_inode->i_dno = le32_to_cpu(fnode->u.external[0].disk_secno);
                 if (hpfs_sb(sb)->sb_chk >= 2) {
                         struct buffer_head *bh0;
                         if (hpfs_map_fnode(sb, hpfs_inode->i_parent_dir, &bh0)) brelse(bh0);
@@ -133,7 +132,7 @@ void hpfs_read_inode(struct inode *i)
                 i->i_op = &hpfs_file_iops;
                 i->i_fop = &hpfs_file_ops;
                 i->i_nlink = 1;
-                i->i_size = fnode->file_size;
+                i->i_size = le32_to_cpu(fnode->file_size);
                 i->i_blocks = ((i->i_size + 511) >> 9) + 1;
                 i->i_data.a_ops = &hpfs_aops;
                 hpfs_i(i)->mmu_private = i->i_size;
@@ -144,7 +143,7 @@ void hpfs_read_inode(struct inode *i)
 static void hpfs_write_inode_ea(struct inode *i, struct fnode *fnode)
 {
         struct hpfs_inode_info *hpfs_inode = hpfs_i(i);
-        /*if (fnode->acl_size_l || fnode->acl_size_s) {
+        /*if (le32_to_cpu(fnode->acl_size_l) || le16_to_cpu(fnode->acl_size_s)) {
                    Some unknown structures like ACL may be in fnode,
                    we'd better not overwrite them
                 hpfs_error(i->i_sb, "fnode %08x has some unknown HPFS386 stuctures", i->i_ino);
@@ -187,9 +186,7 @@ void hpfs_write_inode(struct inode *i)
                 kfree(hpfs_inode->i_rddir_off);
                 hpfs_inode->i_rddir_off = NULL;
         }
-        mutex_lock(&hpfs_inode->i_parent_mutex);
         if (!i->i_nlink) {
-                mutex_unlock(&hpfs_inode->i_parent_mutex);
                 return;
         }
         parent = iget_locked(i->i_sb, hpfs_inode->i_parent_dir);
@@ -200,14 +197,9 @@ void hpfs_write_inode(struct inode *i)
                         hpfs_read_inode(parent);
                         unlock_new_inode(parent);
                 }
-                mutex_lock(&hpfs_inode->i_mutex);
                 hpfs_write_inode_nolock(i);
-                mutex_unlock(&hpfs_inode->i_mutex);
                 iput(parent);
-        } else {
-                mark_inode_dirty(i);
         }
-        mutex_unlock(&hpfs_inode->i_parent_mutex);
 }
 
 void hpfs_write_inode_nolock(struct inode *i)
@@ -226,30 +218,30 @@ void hpfs_write_inode_nolock(struct inode *i)
                 }
         } else de = NULL;
         if (S_ISREG(i->i_mode)) {
-                fnode->file_size = i->i_size;
-                if (de) de->file_size = i->i_size;
+                fnode->file_size = cpu_to_le32(i->i_size);
+                if (de) de->file_size = cpu_to_le32(i->i_size);
         } else if (S_ISDIR(i->i_mode)) {
-                fnode->file_size = 0;
-                if (de) de->file_size = 0;
+                fnode->file_size = cpu_to_le32(0);
+                if (de) de->file_size = cpu_to_le32(0);
         }
         hpfs_write_inode_ea(i, fnode);
         if (de) {
-                de->write_date = gmt_to_local(i->i_sb, i->i_mtime.tv_sec);
-                de->read_date = gmt_to_local(i->i_sb, i->i_atime.tv_sec);
-                de->creation_date = gmt_to_local(i->i_sb, i->i_ctime.tv_sec);
+                de->write_date = cpu_to_le32(gmt_to_local(i->i_sb, i->i_mtime.tv_sec));
+                de->read_date = cpu_to_le32(gmt_to_local(i->i_sb, i->i_atime.tv_sec));
+                de->creation_date = cpu_to_le32(gmt_to_local(i->i_sb, i->i_ctime.tv_sec));
                 de->read_only = !(i->i_mode & 0222);
-                de->ea_size = hpfs_inode->i_ea_size;
+                de->ea_size = cpu_to_le32(hpfs_inode->i_ea_size);
                 hpfs_mark_4buffers_dirty(&qbh);
                 hpfs_brelse4(&qbh);
         }
         if (S_ISDIR(i->i_mode)) {
                 if ((de = map_dirent(i, hpfs_inode->i_dno, "\001\001", 2, NULL, &qbh))) {
-                        de->write_date = gmt_to_local(i->i_sb, i->i_mtime.tv_sec);
-                        de->read_date = gmt_to_local(i->i_sb, i->i_atime.tv_sec);
-                        de->creation_date = gmt_to_local(i->i_sb, i->i_ctime.tv_sec);
+                        de->write_date = cpu_to_le32(gmt_to_local(i->i_sb, i->i_mtime.tv_sec));
+                        de->read_date = cpu_to_le32(gmt_to_local(i->i_sb, i->i_atime.tv_sec));
+                        de->creation_date = cpu_to_le32(gmt_to_local(i->i_sb, i->i_ctime.tv_sec));
                         de->read_only = !(i->i_mode & 0222);
-                        de->ea_size = /*hpfs_inode->i_ea_size*/0;
-                        de->file_size = 0;
+                        de->ea_size = cpu_to_le32(/*hpfs_inode->i_ea_size*/0);
+                        de->file_size = cpu_to_le32(0);
                         hpfs_mark_4buffers_dirty(&qbh);
                         hpfs_brelse4(&qbh);
                 } else
@@ -269,6 +261,10 @@ int hpfs_setattr(struct dentry *dentry, struct iattr *attr)
         hpfs_lock(inode->i_sb);
         if (inode->i_ino == hpfs_sb(inode->i_sb)->sb_root)
                 goto out_unlock;
+        if ((attr->ia_valid & ATTR_UID) && attr->ia_uid >= 0x10000)
+                goto out_unlock;
+        if ((attr->ia_valid & ATTR_GID) && attr->ia_gid >= 0x10000)
+                goto out_unlock;
         if ((attr->ia_valid & ATTR_SIZE) && attr->ia_size > inode->i_size)
                 goto out_unlock;
 
@@ -284,7 +280,6 @@ int hpfs_setattr(struct dentry *dentry, struct iattr *attr)
         }
 
         setattr_copy(inode, attr);
-        mark_inode_dirty(inode);
 
         hpfs_write_inode(inode);
 
diff --git a/fs/hpfs/map.c b/fs/hpfs/map.c
index 840d033ecee8..a790821366a7 100644
--- a/fs/hpfs/map.c
+++ b/fs/hpfs/map.c
@@ -21,7 +21,7 @@ unsigned int *hpfs_map_bitmap(struct super_block *s, unsigned bmp_block,
                 hpfs_error(s, "hpfs_map_bitmap called with bad parameter: %08x at %s", bmp_block, id);
                 return NULL;
         }
-        sec = hpfs_sb(s)->sb_bmp_dir[bmp_block];
+        sec = le32_to_cpu(hpfs_sb(s)->sb_bmp_dir[bmp_block]);
         if (!sec || sec > hpfs_sb(s)->sb_fs_size-4) {
                 hpfs_error(s, "invalid bitmap block pointer %08x -> %08x at %s", bmp_block, sec, id);
                 return NULL;
@@ -46,18 +46,18 @@ unsigned char *hpfs_load_code_page(struct super_block *s, secno cps)
         struct code_page_data *cpd;
         struct code_page_directory *cp = hpfs_map_sector(s, cps, &bh, 0);
         if (!cp) return NULL;
-        if (cp->magic != CP_DIR_MAGIC) {
-                printk("HPFS: Code page directory magic doesn't match (magic = %08x)\n", cp->magic);
+        if (le32_to_cpu(cp->magic) != CP_DIR_MAGIC) {
+                printk("HPFS: Code page directory magic doesn't match (magic = %08x)\n", le32_to_cpu(cp->magic));
                 brelse(bh);
                 return NULL;
         }
-        if (!cp->n_code_pages) {
+        if (!le32_to_cpu(cp->n_code_pages)) {
                 printk("HPFS: n_code_pages == 0\n");
                 brelse(bh);
                 return NULL;
         }
-        cpds = cp->array[0].code_page_data;
-        cpi = cp->array[0].index;
+        cpds = le32_to_cpu(cp->array[0].code_page_data);
+        cpi = le16_to_cpu(cp->array[0].index);
         brelse(bh);
 
         if (cpi >= 3) {
@@ -66,12 +66,12 @@ unsigned char *hpfs_load_code_page(struct super_block *s, secno cps)
         }
         
         if (!(cpd = hpfs_map_sector(s, cpds, &bh, 0))) return NULL;
-        if ((unsigned)cpd->offs[cpi] > 0x178) {
+        if (le16_to_cpu(cpd->offs[cpi]) > 0x178) {
                 printk("HPFS: Code page index out of sector\n");
                 brelse(bh);
                 return NULL;
         }
-        ptr = (unsigned char *)cpd + cpd->offs[cpi] + 6;
+        ptr = (unsigned char *)cpd + le16_to_cpu(cpd->offs[cpi]) + 6;
         if (!(cp_table = kmalloc(256, GFP_KERNEL))) {
                 printk("HPFS: out of memory for code page table\n");
                 brelse(bh);
@@ -125,7 +125,7 @@ struct fnode *hpfs_map_fnode(struct super_block *s, ino_t ino, struct buffer_hea
                 if (hpfs_sb(s)->sb_chk) {
                         struct extended_attribute *ea;
                         struct extended_attribute *ea_end;
-                        if (fnode->magic != FNODE_MAGIC) {
+                        if (le32_to_cpu(fnode->magic) != FNODE_MAGIC) {
                                 hpfs_error(s, "bad magic on fnode %08lx",
                                         (unsigned long)ino);
                                 goto bail;
@@ -138,7 +138,7 @@ struct fnode *hpfs_map_fnode(struct super_block *s, ino_t ino, struct buffer_hea
                                             (unsigned long)ino);
                                         goto bail;
                                 }
-                                if (fnode->btree.first_free !=
+                                if (le16_to_cpu(fnode->btree.first_free) !=
                                     8 + fnode->btree.n_used_nodes * (fnode->btree.internal ? 8 : 12)) {
                                         hpfs_error(s,
                                             "bad first_free pointer in fnode %08lx",
@@ -146,12 +146,12 @@ struct fnode *hpfs_map_fnode(struct super_block *s, ino_t ino, struct buffer_hea
                                         goto bail;
                                 }
                         }
-                        if (fnode->ea_size_s && ((signed int)fnode->ea_offs < 0xc4 ||
-                           (signed int)fnode->ea_offs + fnode->acl_size_s + fnode->ea_size_s > 0x200)) {
+                        if (le16_to_cpu(fnode->ea_size_s) && (le16_to_cpu(fnode->ea_offs) < 0xc4 ||
+                           le16_to_cpu(fnode->ea_offs) + le16_to_cpu(fnode->acl_size_s) + le16_to_cpu(fnode->ea_size_s) > 0x200)) {
                                 hpfs_error(s,
                                         "bad EA info in fnode %08lx: ea_offs == %04x ea_size_s == %04x",
                                         (unsigned long)ino,
-                                        fnode->ea_offs, fnode->ea_size_s);
+                                        le16_to_cpu(fnode->ea_offs), le16_to_cpu(fnode->ea_size_s));
                                 goto bail;
                         }
                         ea = fnode_ea(fnode);
@@ -178,16 +178,20 @@ struct anode *hpfs_map_anode(struct super_block *s, anode_secno ano, struct buff
         if (hpfs_sb(s)->sb_chk) if (hpfs_chk_sectors(s, ano, 1, "anode")) return NULL;
         if ((anode = hpfs_map_sector(s, ano, bhp, ANODE_RD_AHEAD)))
                 if (hpfs_sb(s)->sb_chk) {
-                        if (anode->magic != ANODE_MAGIC || anode->self != ano) {
+                        if (le32_to_cpu(anode->magic) != ANODE_MAGIC) {
                                 hpfs_error(s, "bad magic on anode %08x", ano);
                                 goto bail;
                         }
+                        if (le32_to_cpu(anode->self) != ano) {
+                                hpfs_error(s, "self pointer invalid on anode %08x", ano);
+                                goto bail;
+                        }
                         if ((unsigned)anode->btree.n_used_nodes + (unsigned)anode->btree.n_free_nodes !=
                             (anode->btree.internal ? 60 : 40)) {
                                 hpfs_error(s, "bad number of nodes in anode %08x", ano);
                                 goto bail;
                         }
-                        if (anode->btree.first_free !=
+                        if (le16_to_cpu(anode->btree.first_free) !=
                             8 + anode->btree.n_used_nodes * (anode->btree.internal ? 8 : 12)) {
                                 hpfs_error(s, "bad first_free pointer in anode %08x", ano);
                                 goto bail;
@@ -219,26 +223,26 @@ struct dnode *hpfs_map_dnode(struct super_block *s, unsigned secno,
                         unsigned p, pp = 0;
                         unsigned char *d = (unsigned char *)dnode;
                         int b = 0;
-                        if (dnode->magic != DNODE_MAGIC) {
+                        if (le32_to_cpu(dnode->magic) != DNODE_MAGIC) {
                                 hpfs_error(s, "bad magic on dnode %08x", secno);
                                 goto bail;
                         }
-                        if (dnode->self != secno)
-                                hpfs_error(s, "bad self pointer on dnode %08x self = %08x", secno, dnode->self);
+                        if (le32_to_cpu(dnode->self) != secno)
+                                hpfs_error(s, "bad self pointer on dnode %08x self = %08x", secno, le32_to_cpu(dnode->self));
                         /* Check dirents - bad dirents would cause infinite
                            loops or shooting to memory */
-                        if (dnode->first_free > 2048/* || dnode->first_free < 84*/) {
-                                hpfs_error(s, "dnode %08x has first_free == %08x", secno, dnode->first_free);
+                        if (le32_to_cpu(dnode->first_free) > 2048) {
+                                hpfs_error(s, "dnode %08x has first_free == %08x", secno, le32_to_cpu(dnode->first_free));
                                 goto bail;
                         }
-                        for (p = 20; p < dnode->first_free; p += d[p] + (d[p+1] << 8)) {
+                        for (p = 20; p < le32_to_cpu(dnode->first_free); p += d[p] + (d[p+1] << 8)) {
                                 struct hpfs_dirent *de = (struct hpfs_dirent *)((char *)dnode + p);
-                                if (de->length > 292 || (de->length < 32) || (de->length & 3) || p + de->length > 2048) {
+                                if (le16_to_cpu(de->length) > 292 || (le16_to_cpu(de->length) < 32) || (le16_to_cpu(de->length) & 3) || p + le16_to_cpu(de->length) > 2048) {
                                         hpfs_error(s, "bad dirent size in dnode %08x, dirent %03x, last %03x", secno, p, pp);
                                         goto bail;
                                 }
-                                if (((31 + de->namelen + de->down*4 + 3) & ~3) != de->length) {
-                                        if (((31 + de->namelen + de->down*4 + 3) & ~3) < de->length && s->s_flags & MS_RDONLY) goto ok;
+                                if (((31 + de->namelen + de->down*4 + 3) & ~3) != le16_to_cpu(de->length)) {
+                                        if (((31 + de->namelen + de->down*4 + 3) & ~3) < le16_to_cpu(de->length) && s->s_flags & MS_RDONLY) goto ok;
                                         hpfs_error(s, "namelen does not match dirent size in dnode %08x, dirent %03x, last %03x", secno, p, pp);
                                         goto bail;
                                 }
@@ -251,7 +255,7 @@ struct dnode *hpfs_map_dnode(struct super_block *s, unsigned secno,
                                 pp = p;
                                 
                         }
-                        if (p != dnode->first_free) {
+                        if (p != le32_to_cpu(dnode->first_free)) {
                                 hpfs_error(s, "size on last dirent does not match first_free; dnode %08x", secno);
                                 goto bail;
                         }
@@ -277,7 +281,7 @@ dnode_secno hpfs_fnode_dno(struct super_block *s, ino_t ino)
         if (!fnode)
                 return 0;
 
-        dno = fnode->u.external[0].disk_secno;
+        dno = le32_to_cpu(fnode->u.external[0].disk_secno);
         brelse(bh);
         return dno;
 }
diff --git a/fs/hpfs/name.c b/fs/hpfs/name.c
index f24736d7a439..9acdf338def0 100644
--- a/fs/hpfs/name.c
+++ b/fs/hpfs/name.c
@@ -8,39 +8,6 @@
 
 #include "hpfs_fn.h"
 
-static const char *text_postfix[]={
-".ASM", ".BAS", ".BAT", ".C", ".CC", ".CFG", ".CMD", ".CON", ".CPP", ".DEF",
-".DOC", ".DPR", ".ERX", ".H", ".HPP", ".HTM", ".HTML", ".JAVA", ".LOG", ".PAS",
-".RC", ".TEX", ".TXT", ".Y", ""};
-
-static const char *text_prefix[]={
-"AUTOEXEC.", "CHANGES", "COPYING", "CONFIG.", "CREDITS", "FAQ", "FILE_ID.DIZ",
-"MAKEFILE", "READ.ME", "README", "TERMCAP", ""};
-
-void hpfs_decide_conv(struct inode *inode, const unsigned char *name, unsigned len)
-{
-        struct hpfs_inode_info *hpfs_inode = hpfs_i(inode);
-        int i;
-        if (hpfs_inode->i_conv != CONV_AUTO) return;
-        for (i = 0; *text_postfix[i]; i++) {
-                int l = strlen(text_postfix[i]);
-                if (l <= len)
-                        if (!hpfs_compare_names(inode->i_sb, text_postfix[i], l, name + len - l, l, 0))
-                                goto text;
-        }
-        for (i = 0; *text_prefix[i]; i++) {
-                int l = strlen(text_prefix[i]);
-                if (l <= len)
-                        if (!hpfs_compare_names(inode->i_sb, text_prefix[i], l, name, l, 0))
-                                goto text;
-        }
-        hpfs_inode->i_conv = CONV_BINARY;
-        return;
-        text:
-        hpfs_inode->i_conv = CONV_TEXT;
-        return;
-}
-
 static inline int not_allowed_char(unsigned char c)
 {
         return c<' ' || c=='"' || c=='*' || c=='/' || c==':' || c=='<' ||
diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
index d5f8c8a19023..1f05839c27a7 100644
--- a/fs/hpfs/namei.c
+++ b/fs/hpfs/namei.c
@@ -29,7 +29,7 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         fnode = hpfs_alloc_fnode(dir->i_sb, hpfs_i(dir)->i_dno, &fno, &bh);
         if (!fnode)
                 goto bail;
-        dnode = hpfs_alloc_dnode(dir->i_sb, fno, &dno, &qbh0, 1);
+        dnode = hpfs_alloc_dnode(dir->i_sb, fno, &dno, &qbh0);
         if (!dnode)
                 goto bail1;
         memset(&dee, 0, sizeof dee);
@@ -37,8 +37,8 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         if (!(mode & 0222)) dee.read_only = 1;
         /*dee.archive = 0;*/
         dee.hidden = name[0] == '.';
-        dee.fnode = fno;
-        dee.creation_date = dee.write_date = dee.read_date = gmt_to_local(dir->i_sb, get_seconds());
+        dee.fnode = cpu_to_le32(fno);
+        dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(gmt_to_local(dir->i_sb, get_seconds()));
         result = new_inode(dir->i_sb);
         if (!result)
                 goto bail2;
@@ -46,7 +46,7 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         result->i_ino = fno;
         hpfs_i(result)->i_parent_dir = dir->i_ino;
         hpfs_i(result)->i_dno = dno;
-        result->i_ctime.tv_sec = result->i_mtime.tv_sec = result->i_atime.tv_sec = local_to_gmt(dir->i_sb, dee.creation_date);
+        result->i_ctime.tv_sec = result->i_mtime.tv_sec = result->i_atime.tv_sec = local_to_gmt(dir->i_sb, le32_to_cpu(dee.creation_date));
         result->i_ctime.tv_nsec = 0; 
         result->i_mtime.tv_nsec = 0; 
         result->i_atime.tv_nsec = 0; 
@@ -60,8 +60,7 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         if (dee.read_only)
                 result->i_mode &= ~0222;
 
-        mutex_lock(&hpfs_i(dir)->i_mutex);
-        r = hpfs_add_dirent(dir, name, len, &dee, 0);
+        r = hpfs_add_dirent(dir, name, len, &dee);
         if (r == 1)
                 goto bail3;
         if (r == -1) {
@@ -70,21 +69,21 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         }
         fnode->len = len;
         memcpy(fnode->name, name, len > 15 ? 15 : len);
-        fnode->up = dir->i_ino;
+        fnode->up = cpu_to_le32(dir->i_ino);
         fnode->dirflag = 1;
         fnode->btree.n_free_nodes = 7;
         fnode->btree.n_used_nodes = 1;
-        fnode->btree.first_free = 0x14;
-        fnode->u.external[0].disk_secno = dno;
-        fnode->u.external[0].file_secno = -1;
+        fnode->btree.first_free = cpu_to_le16(0x14);
+        fnode->u.external[0].disk_secno = cpu_to_le32(dno);
+        fnode->u.external[0].file_secno = cpu_to_le32(-1);
         dnode->root_dnode = 1;
-        dnode->up = fno;
+        dnode->up = cpu_to_le32(fno);
         de = hpfs_add_de(dir->i_sb, dnode, "\001\001", 2, 0);
-        de->creation_date = de->write_date = de->read_date = gmt_to_local(dir->i_sb, get_seconds());
+        de->creation_date = de->write_date = de->read_date = cpu_to_le32(gmt_to_local(dir->i_sb, get_seconds()));
         if (!(mode & 0222)) de->read_only = 1;
         de->first = de->directory = 1;
         /*de->hidden = de->system = 0;*/
-        de->fnode = fno;
+        de->fnode = cpu_to_le32(fno);
         mark_buffer_dirty(bh);
         brelse(bh);
         hpfs_mark_4buffers_dirty(&qbh0);
@@ -101,11 +100,9 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
                 hpfs_write_inode_nolock(result);
         }
         d_instantiate(dentry, result);
-        mutex_unlock(&hpfs_i(dir)->i_mutex);
         hpfs_unlock(dir->i_sb);
         return 0;
 bail3:
-        mutex_unlock(&hpfs_i(dir)->i_mutex);
         iput(result);
 bail2:
         hpfs_brelse4(&qbh0);
@@ -140,8 +137,8 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struc
         if (!(mode & 0222)) dee.read_only = 1;
         dee.archive = 1;
         dee.hidden = name[0] == '.';
-        dee.fnode = fno;
-        dee.creation_date = dee.write_date = dee.read_date = gmt_to_local(dir->i_sb, get_seconds());
+        dee.fnode = cpu_to_le32(fno);
+        dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(gmt_to_local(dir->i_sb, get_seconds()));
 
         result = new_inode(dir->i_sb);
         if (!result)
@@ -154,9 +151,8 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struc
         result->i_op = &hpfs_file_iops;
         result->i_fop = &hpfs_file_ops;
         result->i_nlink = 1;
-        hpfs_decide_conv(result, name, len);
         hpfs_i(result)->i_parent_dir = dir->i_ino;
-        result->i_ctime.tv_sec = result->i_mtime.tv_sec = result->i_atime.tv_sec = local_to_gmt(dir->i_sb, dee.creation_date);
+        result->i_ctime.tv_sec = result->i_mtime.tv_sec = result->i_atime.tv_sec = local_to_gmt(dir->i_sb, le32_to_cpu(dee.creation_date));
         result->i_ctime.tv_nsec = 0;
         result->i_mtime.tv_nsec = 0;
         result->i_atime.tv_nsec = 0;
@@ -168,8 +164,7 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struc
         result->i_data.a_ops = &hpfs_aops;
         hpfs_i(result)->mmu_private = 0;
 
-        mutex_lock(&hpfs_i(dir)->i_mutex);
-        r = hpfs_add_dirent(dir, name, len, &dee, 0);
+        r = hpfs_add_dirent(dir, name, len, &dee);
         if (r == 1)
                 goto bail2;
         if (r == -1) {
@@ -178,7 +173,7 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struc
         }
         fnode->len = len;
         memcpy(fnode->name, name, len > 15 ? 15 : len);
-        fnode->up = dir->i_ino;
+        fnode->up = cpu_to_le32(dir->i_ino);
         mark_buffer_dirty(bh);
         brelse(bh);
 
@@ -193,12 +188,10 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, int mode, struc
                 hpfs_write_inode_nolock(result);
         }
         d_instantiate(dentry, result);
-        mutex_unlock(&hpfs_i(dir)->i_mutex);
         hpfs_unlock(dir->i_sb);
         return 0;
 
 bail2:
-        mutex_unlock(&hpfs_i(dir)->i_mutex);
         iput(result);
 bail1:
         brelse(bh);
@@ -232,8 +225,8 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t
         if (!(mode & 0222)) dee.read_only = 1;
         dee.archive = 1;
         dee.hidden = name[0] == '.';
-        dee.fnode = fno;
-        dee.creation_date = dee.write_date = dee.read_date = gmt_to_local(dir->i_sb, get_seconds());
+        dee.fnode = cpu_to_le32(fno);
+        dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(gmt_to_local(dir->i_sb, get_seconds()));
 
         result = new_inode(dir->i_sb);
         if (!result)
@@ -242,7 +235,7 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t
         hpfs_init_inode(result);
         result->i_ino = fno;
         hpfs_i(result)->i_parent_dir = dir->i_ino;
-        result->i_ctime.tv_sec = result->i_mtime.tv_sec = result->i_atime.tv_sec = local_to_gmt(dir->i_sb, dee.creation_date);
+        result->i_ctime.tv_sec = result->i_mtime.tv_sec = result->i_atime.tv_sec = local_to_gmt(dir->i_sb, le32_to_cpu(dee.creation_date));
         result->i_ctime.tv_nsec = 0;
         result->i_mtime.tv_nsec = 0;
         result->i_atime.tv_nsec = 0;
@@ -254,8 +247,7 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t
         result->i_blocks = 1;
         init_special_inode(result, mode, rdev);
 
-        mutex_lock(&hpfs_i(dir)->i_mutex);
-        r = hpfs_add_dirent(dir, name, len, &dee, 0);
+        r = hpfs_add_dirent(dir, name, len, &dee);
         if (r == 1)
                 goto bail2;
         if (r == -1) {
@@ -264,19 +256,17 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t
         }
         fnode->len = len;
         memcpy(fnode->name, name, len > 15 ? 15 : len);
-        fnode->up = dir->i_ino;
+        fnode->up = cpu_to_le32(dir->i_ino);
         mark_buffer_dirty(bh);
 
         insert_inode_hash(result);
 
         hpfs_write_inode_nolock(result);
         d_instantiate(dentry, result);
-        mutex_unlock(&hpfs_i(dir)->i_mutex);
         brelse(bh);
         hpfs_unlock(dir->i_sb);
         return 0;
 bail2:
-        mutex_unlock(&hpfs_i(dir)->i_mutex);
         iput(result);
 bail1:
         brelse(bh);
@@ -310,8 +300,8 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
         memset(&dee, 0, sizeof dee);
         dee.archive = 1;
         dee.hidden = name[0] == '.';
-        dee.fnode = fno;
-        dee.creation_date = dee.write_date = dee.read_date = gmt_to_local(dir->i_sb, get_seconds());
+        dee.fnode = cpu_to_le32(fno);
+        dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(gmt_to_local(dir->i_sb, get_seconds()));
 
         result = new_inode(dir->i_sb);
         if (!result)
@@ -319,7 +309,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
         result->i_ino = fno;
         hpfs_init_inode(result);
         hpfs_i(result)->i_parent_dir = dir->i_ino;
-        result->i_ctime.tv_sec = result->i_mtime.tv_sec = result->i_atime.tv_sec = local_to_gmt(dir->i_sb, dee.creation_date);
+        result->i_ctime.tv_sec = result->i_mtime.tv_sec = result->i_atime.tv_sec = local_to_gmt(dir->i_sb, le32_to_cpu(dee.creation_date));
         result->i_ctime.tv_nsec = 0;
         result->i_mtime.tv_nsec = 0;
         result->i_atime.tv_nsec = 0;
@@ -333,8 +323,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
         result->i_op = &page_symlink_inode_operations;
         result->i_data.a_ops = &hpfs_symlink_aops;
 
-        mutex_lock(&hpfs_i(dir)->i_mutex);
-        r = hpfs_add_dirent(dir, name, len, &dee, 0);
+        r = hpfs_add_dirent(dir, name, len, &dee);
         if (r == 1)
                 goto bail2;
         if (r == -1) {
@@ -343,7 +332,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
         }
         fnode->len = len;
         memcpy(fnode->name, name, len > 15 ? 15 : len);
-        fnode->up = dir->i_ino;
+        fnode->up = cpu_to_le32(dir->i_ino);
         hpfs_set_ea(result, fnode, "SYMLINK", symlink, strlen(symlink));
         mark_buffer_dirty(bh);
         brelse(bh);
@@ -352,11 +341,9 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
 
         hpfs_write_inode_nolock(result);
         d_instantiate(dentry, result);
-        mutex_unlock(&hpfs_i(dir)->i_mutex);
         hpfs_unlock(dir->i_sb);
         return 0;
 bail2:
-        mutex_unlock(&hpfs_i(dir)->i_mutex);
         iput(result);
 bail1:
         brelse(bh);
@@ -374,7 +361,6 @@ static int hpfs_unlink(struct inode *dir, struct dentry *dentry)
         struct hpfs_dirent *de;
         struct inode *inode = dentry->d_inode;
         dnode_secno dno;
-        fnode_secno fno;
         int r;
         int rep = 0;
         int err;
@@ -382,8 +368,6 @@ static int hpfs_unlink(struct inode *dir, struct dentry *dentry)
         hpfs_lock(dir->i_sb);
         hpfs_adjust_length(name, &len);
 again:
-        mutex_lock(&hpfs_i(inode)->i_parent_mutex);
-        mutex_lock(&hpfs_i(dir)->i_mutex);
         err = -ENOENT;
         de = map_dirent(dir, hpfs_i(dir)->i_dno, name, len, &dno, &qbh);
         if (!de)
@@ -397,7 +381,6 @@ again:
         if (de->directory)
                 goto out1;
 
-        fno = de->fnode;
         r = hpfs_remove_dirent(dir, dno, de, &qbh, 1);
         switch (r) {
         case 1:
@@ -410,8 +393,6 @@ again:
                 if (rep++)
                         break;
 
-                mutex_unlock(&hpfs_i(dir)->i_mutex);
-                mutex_unlock(&hpfs_i(inode)->i_parent_mutex);
                 dentry_unhash(dentry);
                 if (!d_unhashed(dentry)) {
                         dput(dentry);
@@ -445,8 +426,6 @@ again:
 out1:
         hpfs_brelse4(&qbh);
 out:
-        mutex_unlock(&hpfs_i(dir)->i_mutex);
-        mutex_unlock(&hpfs_i(inode)->i_parent_mutex);
         hpfs_unlock(dir->i_sb);
         return err;
 }
@@ -459,15 +438,12 @@ static int hpfs_rmdir(struct inode *dir, struct dentry *dentry)
         struct hpfs_dirent *de;
         struct inode *inode = dentry->d_inode;
         dnode_secno dno;
-        fnode_secno fno;
         int n_items = 0;
         int err;
         int r;
 
         hpfs_adjust_length(name, &len);
         hpfs_lock(dir->i_sb);
-        mutex_lock(&hpfs_i(inode)->i_parent_mutex);
-        mutex_lock(&hpfs_i(dir)->i_mutex);
         err = -ENOENT;
         de = map_dirent(dir, hpfs_i(dir)->i_dno, name, len, &dno, &qbh);
         if (!de)
@@ -486,7 +462,6 @@ static int hpfs_rmdir(struct inode *dir, struct dentry *dentry)
         if (n_items)
                 goto out1;
 
-        fno = de->fnode;
         r = hpfs_remove_dirent(dir, dno, de, &qbh, 1);
         switch (r) {
         case 1:
@@ -505,8 +480,6 @@ static int hpfs_rmdir(struct inode *dir, struct dentry *dentry)
 out1:
         hpfs_brelse4(&qbh);
 out:
-        mutex_unlock(&hpfs_i(dir)->i_mutex);
-        mutex_unlock(&hpfs_i(inode)->i_parent_mutex);
         hpfs_unlock(dir->i_sb);
         return err;
 }
@@ -568,12 +541,6 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         hpfs_lock(i->i_sb);
         /* order doesn't matter, due to VFS exclusion */
-        mutex_lock(&hpfs_i(i)->i_parent_mutex);
-        if (new_inode)
-                mutex_lock(&hpfs_i(new_inode)->i_parent_mutex);
-        mutex_lock(&hpfs_i(old_dir)->i_mutex);
-        if (new_dir != old_dir)
-                mutex_lock(&hpfs_i(new_dir)->i_mutex);
         
         /* Erm? Moving over the empty non-busy directory is perfectly legal */
         if (new_inode && S_ISDIR(new_inode->i_mode)) {
@@ -610,9 +577,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 
         if (new_dir == old_dir) hpfs_brelse4(&qbh);
 
-        hpfs_lock_creation(i->i_sb);
-        if ((r = hpfs_add_dirent(new_dir, new_name, new_len, &de, 1))) {
-                hpfs_unlock_creation(i->i_sb);
+        if ((r = hpfs_add_dirent(new_dir, new_name, new_len, &de))) {
                 if (r == -1) hpfs_error(new_dir->i_sb, "hpfs_rename: dirent already exists!");
                 err = r == 1 ? -ENOSPC : -EFSERROR;
                 if (new_dir != old_dir) hpfs_brelse4(&qbh);
@@ -621,20 +586,17 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         
         if (new_dir == old_dir)
                 if (!(dep = map_dirent(old_dir, hpfs_i(old_dir)->i_dno, old_name, old_len, &dno, &qbh))) {
-                        hpfs_unlock_creation(i->i_sb);
                         hpfs_error(i->i_sb, "lookup succeeded but map dirent failed at #2");
                         err = -ENOENT;
                         goto end1;
                 }
 
         if ((r = hpfs_remove_dirent(old_dir, dno, dep, &qbh, 0))) {
-                hpfs_unlock_creation(i->i_sb);
                 hpfs_error(i->i_sb, "hpfs_rename: could not remove dirent");
                 err = r == 2 ? -ENOSPC : -EFSERROR;
                 goto end1;
         }
-        hpfs_unlock_creation(i->i_sb);
-        
+
         end:
         hpfs_i(i)->i_parent_dir = new_dir->i_ino;
         if (S_ISDIR(i->i_mode)) {
@@ -642,22 +604,14 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 drop_nlink(old_dir);
         }
         if ((fnode = hpfs_map_fnode(i->i_sb, i->i_ino, &bh))) {
-                fnode->up = new_dir->i_ino;
+                fnode->up = cpu_to_le32(new_dir->i_ino);
                 fnode->len = new_len;
                 memcpy(fnode->name, new_name, new_len>15?15:new_len);
                 if (new_len < 15) memset(&fnode->name[new_len], 0, 15 - new_len);
                 mark_buffer_dirty(bh);
                 brelse(bh);
         }
-        hpfs_i(i)->i_conv = hpfs_sb(i->i_sb)->sb_conv;
-        hpfs_decide_conv(i, new_name, new_len);
 end1:
-        if (old_dir != new_dir)
-                mutex_unlock(&hpfs_i(new_dir)->i_mutex);
-        mutex_unlock(&hpfs_i(old_dir)->i_mutex);
-        mutex_unlock(&hpfs_i(i)->i_parent_mutex);
-        if (new_inode)
-                mutex_unlock(&hpfs_i(new_inode)->i_parent_mutex);
         hpfs_unlock(i->i_sb);
         return err;
 }
diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
index c89b40808587..98580a3b5005 100644
--- a/fs/hpfs/super.c
+++ b/fs/hpfs/super.c
@@ -18,15 +18,16 @@
 
 /* Mark the filesystem dirty, so that chkdsk checks it when os/2 booted */
 
-static void mark_dirty(struct super_block *s)
+static void mark_dirty(struct super_block *s, int remount)
 {
-        if (hpfs_sb(s)->sb_chkdsk && !(s->s_flags & MS_RDONLY)) {
+        if (hpfs_sb(s)->sb_chkdsk && (remount || !(s->s_flags & MS_RDONLY))) {
                 struct buffer_head *bh;
                 struct hpfs_spare_block *sb;
                 if ((sb = hpfs_map_sector(s, 17, &bh, 0))) {
                         sb->dirty = 1;
                         sb->old_wrote = 0;
                         mark_buffer_dirty(bh);
+                        sync_dirty_buffer(bh);
                         brelse(bh);
                 }
         }
@@ -40,10 +41,12 @@ static void unmark_dirty(struct super_block *s)
         struct buffer_head *bh;
         struct hpfs_spare_block *sb;
         if (s->s_flags & MS_RDONLY) return;
+        sync_blockdev(s->s_bdev);
         if ((sb = hpfs_map_sector(s, 17, &bh, 0))) {
                 sb->dirty = hpfs_sb(s)->sb_chkdsk > 1 - hpfs_sb(s)->sb_was_error;
                 sb->old_wrote = hpfs_sb(s)->sb_chkdsk >= 2 && !hpfs_sb(s)->sb_was_error;
                 mark_buffer_dirty(bh);
+                sync_dirty_buffer(bh);
                 brelse(bh);
         }
 }
@@ -63,13 +66,13 @@ void hpfs_error(struct super_block *s, const char *fmt, ...)
         if (!hpfs_sb(s)->sb_was_error) {
                 if (hpfs_sb(s)->sb_err == 2) {
                         printk("; crashing the system because you wanted it\n");
-                        mark_dirty(s);
+                        mark_dirty(s, 0);
                         panic("HPFS panic");
                 } else if (hpfs_sb(s)->sb_err == 1) {
                         if (s->s_flags & MS_RDONLY) printk("; already mounted read-only\n");
                         else {
                                 printk("; remounting read-only\n");
-                                mark_dirty(s);
+                                mark_dirty(s, 0);
                                 s->s_flags |= MS_RDONLY;
                         }
                 } else if (s->s_flags & MS_RDONLY) printk("; going on - but anything won't be destroyed because it's read-only\n");
@@ -102,9 +105,12 @@ static void hpfs_put_super(struct super_block *s)
 {
         struct hpfs_sb_info *sbi = hpfs_sb(s);
 
+        hpfs_lock(s);
+        unmark_dirty(s);
+        hpfs_unlock(s);
+
         kfree(sbi->sb_cp_table);
         kfree(sbi->sb_bmp_dir);
-        unmark_dirty(s);
         s->s_fs_info = NULL;
         kfree(sbi);
 }
@@ -129,7 +135,7 @@ static unsigned count_bitmaps(struct super_block *s)
         n_bands = (hpfs_sb(s)->sb_fs_size + 0x3fff) >> 14;
         count = 0;
         for (n = 0; n < n_bands; n++)
-                count += hpfs_count_one_bitmap(s, hpfs_sb(s)->sb_bmp_dir[n]);
+                count += hpfs_count_one_bitmap(s, le32_to_cpu(hpfs_sb(s)->sb_bmp_dir[n]));
         return count;
 }
 
@@ -188,8 +194,6 @@ static void init_once(void *foo)
 {
         struct hpfs_inode_info *ei = (struct hpfs_inode_info *) foo;
 
-        mutex_init(&ei->i_mutex);
-        mutex_init(&ei->i_parent_mutex);
         inode_init_once(&ei->vfs_inode);
 }
 
@@ -218,7 +222,6 @@ static void destroy_inodecache(void)
 
 enum {
         Opt_help, Opt_uid, Opt_gid, Opt_umask, Opt_case_lower, Opt_case_asis,
-        Opt_conv_binary, Opt_conv_text, Opt_conv_auto,
         Opt_check_none, Opt_check_normal, Opt_check_strict,
         Opt_err_cont, Opt_err_ro, Opt_err_panic,
         Opt_eas_no, Opt_eas_ro, Opt_eas_rw,
@@ -233,9 +236,6 @@ static const match_table_t tokens = {
         {Opt_umask, "umask=%o"},
         {Opt_case_lower, "case=lower"},
         {Opt_case_asis, "case=asis"},
-        {Opt_conv_binary, "conv=binary"},
-        {Opt_conv_text, "conv=text"},
-        {Opt_conv_auto, "conv=auto"},
         {Opt_check_none, "check=none"},
         {Opt_check_normal, "check=normal"},
         {Opt_check_strict, "check=strict"},
@@ -253,7 +253,7 @@ static const match_table_t tokens = {
 };
 
 static int parse_opts(char *opts, uid_t *uid, gid_t *gid, umode_t *umask,
-                      int *lowercase, int *conv, int *eas, int *chk, int *errs,
+                      int *lowercase, int *eas, int *chk, int *errs,
                       int *chkdsk, int *timeshift)
 {
         char *p;
@@ -295,15 +295,6 @@ static int parse_opts(char *opts, uid_t *uid, gid_t *gid, umode_t *umask,
                 case Opt_case_asis:
                         *lowercase = 0;
                         break;
-                case Opt_conv_binary:
-                        *conv = CONV_BINARY;
-                        break;
-                case Opt_conv_text:
-                        *conv = CONV_TEXT;
-                        break;
-                case Opt_conv_auto:
-                        *conv = CONV_AUTO;
-                        break;
                 case Opt_check_none:
                         *chk = 0;
                         break;
@@ -370,9 +361,6 @@ HPFS filesystem options:\n\
       umask=xxx         set mode of files that don't have mode specified in eas\n\
       case=lower        lowercase all files\n\
       case=asis         do not lowercase files (default)\n\
-      conv=binary       do not convert CR/LF -> LF (default)\n\
-      conv=auto         convert only files with known text extensions\n\
-      conv=text         convert all files\n\
       check=none        no fs checks - kernel may crash on corrupted filesystem\n\
       check=normal      do some checks - it should not crash (default)\n\
       check=strict      do extra time-consuming checks, used for debugging\n\
@@ -394,7 +382,7 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data)
         uid_t uid;
         gid_t gid;
         umode_t umask;
-        int lowercase, conv, eas, chk, errs, chkdsk, timeshift;
+        int lowercase, eas, chk, errs, chkdsk, timeshift;
         int o;
         struct hpfs_sb_info *sbi = hpfs_sb(s);
         char *new_opts = kstrdup(data, GFP_KERNEL);
@@ -405,11 +393,11 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data)
         lock_super(s);
         uid = sbi->sb_uid; gid = sbi->sb_gid;
         umask = 0777 & ~sbi->sb_mode;
-        lowercase = sbi->sb_lowercase; conv = sbi->sb_conv;
+        lowercase = sbi->sb_lowercase;
         eas = sbi->sb_eas; chk = sbi->sb_chk; chkdsk = sbi->sb_chkdsk;
         errs = sbi->sb_err; timeshift = sbi->sb_timeshift;
 
-        if (!(o = parse_opts(data, &uid, &gid, &umask, &lowercase, &conv,
+        if (!(o = parse_opts(data, &uid, &gid, &umask, &lowercase,
             &eas, &chk, &errs, &chkdsk, &timeshift))) {
                 printk("HPFS: bad mount options.\n");
                 goto out_err;
@@ -427,11 +415,11 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data)
 
         sbi->sb_uid = uid; sbi->sb_gid = gid;
         sbi->sb_mode = 0777 & ~umask;
-        sbi->sb_lowercase = lowercase; sbi->sb_conv = conv;
+        sbi->sb_lowercase = lowercase;
         sbi->sb_eas = eas; sbi->sb_chk = chk; sbi->sb_chkdsk = chkdsk;
         sbi->sb_err = errs; sbi->sb_timeshift = timeshift;
 
-        if (!(*flags & MS_RDONLY)) mark_dirty(s);
+        if (!(*flags & MS_RDONLY)) mark_dirty(s, 1);
 
         replace_mount_options(s, new_opts);
 
@@ -471,7 +459,7 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
         uid_t uid;
         gid_t gid;
         umode_t umask;
-        int lowercase, conv, eas, chk, errs, chkdsk, timeshift;
+        int lowercase, eas, chk, errs, chkdsk, timeshift;
 
         dnode_secno root_dno;
         struct hpfs_dirent *de = NULL;
@@ -479,11 +467,6 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
 
         int o;
 
-        if (num_possible_cpus() > 1) {
-                printk(KERN_ERR "HPFS is not SMP safe\n");
-                return -EINVAL;
-        }
-
         save_mount_options(s, options);
 
         sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
@@ -495,20 +478,20 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
         sbi->sb_bmp_dir = NULL;
         sbi->sb_cp_table = NULL;
 
-        mutex_init(&sbi->hpfs_creation_de);
+        mutex_init(&sbi->hpfs_mutex);
+        hpfs_lock(s);
 
         uid = current_uid();
         gid = current_gid();
         umask = current_umask();
         lowercase = 0;
-        conv = CONV_BINARY;
         eas = 2;
         chk = 1;
         errs = 1;
         chkdsk = 1;
         timeshift = 0;
 
-        if (!(o = parse_opts(options, &uid, &gid, &umask, &lowercase, &conv,
+        if (!(o = parse_opts(options, &uid, &gid, &umask, &lowercase,
             &eas, &chk, &errs, &chkdsk, &timeshift))) {
                 printk("HPFS: bad mount options.\n");
                 goto bail0;
@@ -526,9 +509,9 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
         if (!(spareblock = hpfs_map_sector(s, 17, &bh2, 0))) goto bail3;
 
         /* Check magics */
-        if (/*bootblock->magic != BB_MAGIC
-            ||*/ superblock->magic != SB_MAGIC
-            || spareblock->magic != SP_MAGIC) {
+        if (/*le16_to_cpu(bootblock->magic) != BB_MAGIC
+            ||*/ le32_to_cpu(superblock->magic) != SB_MAGIC
+            || le32_to_cpu(spareblock->magic) != SP_MAGIC) {
                 if (!silent) printk("HPFS: Bad magic ... probably not HPFS\n");
                 goto bail4;
         }
@@ -549,19 +532,18 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
         s->s_op = &hpfs_sops;
         s->s_d_op = &hpfs_dentry_operations;
 
-        sbi->sb_root = superblock->root;
-        sbi->sb_fs_size = superblock->n_sectors;
-        sbi->sb_bitmaps = superblock->bitmaps;
-        sbi->sb_dirband_start = superblock->dir_band_start;
-        sbi->sb_dirband_size = superblock->n_dir_band;
-        sbi->sb_dmap = superblock->dir_band_bitmap;
+        sbi->sb_root = le32_to_cpu(superblock->root);
+        sbi->sb_fs_size = le32_to_cpu(superblock->n_sectors);
+        sbi->sb_bitmaps = le32_to_cpu(superblock->bitmaps);
+        sbi->sb_dirband_start = le32_to_cpu(superblock->dir_band_start);
+        sbi->sb_dirband_size = le32_to_cpu(superblock->n_dir_band);
+        sbi->sb_dmap = le32_to_cpu(superblock->dir_band_bitmap);
         sbi->sb_uid = uid;
         sbi->sb_gid = gid;
         sbi->sb_mode = 0777 & ~umask;
         sbi->sb_n_free = -1;
         sbi->sb_n_free_dnodes = -1;
         sbi->sb_lowercase = lowercase;
-        sbi->sb_conv = conv;
         sbi->sb_eas = eas;
         sbi->sb_chk = chk;
         sbi->sb_chkdsk = chkdsk;
@@ -573,7 +555,7 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
         sbi->sb_max_fwd_alloc = 0xffffff;
         
         /* Load bitmap directory */
-        if (!(sbi->sb_bmp_dir = hpfs_load_bitmap_directory(s, superblock->bitmaps)))
+        if (!(sbi->sb_bmp_dir = hpfs_load_bitmap_directory(s, le32_to_cpu(superblock->bitmaps))))
                 goto bail4;
         
         /* Check for general fs errors*/
@@ -591,20 +573,20 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
                 mark_buffer_dirty(bh2);
         }
 
-        if (spareblock->hotfixes_used || spareblock->n_spares_used) {
+        if (le32_to_cpu(spareblock->hotfixes_used) || le32_to_cpu(spareblock->n_spares_used)) {
                 if (errs >= 2) {
                         printk("HPFS: Hotfixes not supported here, try chkdsk\n");
-                        mark_dirty(s);
+                        mark_dirty(s, 0);
                         goto bail4;
                 }
                 hpfs_error(s, "hotfixes not supported here, try chkdsk");
                 if (errs == 0) printk("HPFS: Proceeding, but your filesystem will be probably corrupted by this driver...\n");
                 else printk("HPFS: This driver may read bad files or crash when operating on disk with hotfixes.\n");
         }
-        if (spareblock->n_dnode_spares != spareblock->n_dnode_spares_free) {
+        if (le32_to_cpu(spareblock->n_dnode_spares) != le32_to_cpu(spareblock->n_dnode_spares_free)) {
                 if (errs >= 2) {
                         printk("HPFS: Spare dnodes used, try chkdsk\n");
-                        mark_dirty(s);
+                        mark_dirty(s, 0);
                         goto bail4;
                 }
                 hpfs_error(s, "warning: spare dnodes used, try chkdsk");
@@ -612,26 +594,26 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
         }
         if (chk) {
                 unsigned a;
-                if (superblock->dir_band_end - superblock->dir_band_start + 1 != superblock->n_dir_band ||
-                    superblock->dir_band_end < superblock->dir_band_start || superblock->n_dir_band > 0x4000) {
+                if (le32_to_cpu(superblock->dir_band_end) - le32_to_cpu(superblock->dir_band_start) + 1 != le32_to_cpu(superblock->n_dir_band) ||
+                    le32_to_cpu(superblock->dir_band_end) < le32_to_cpu(superblock->dir_band_start) || le32_to_cpu(superblock->n_dir_band) > 0x4000) {
                         hpfs_error(s, "dir band size mismatch: dir_band_start==%08x, dir_band_end==%08x, n_dir_band==%08x",
-                                superblock->dir_band_start, superblock->dir_band_end, superblock->n_dir_band);
+                                le32_to_cpu(superblock->dir_band_start), le32_to_cpu(superblock->dir_band_end), le32_to_cpu(superblock->n_dir_band));
                         goto bail4;
                 }
                 a = sbi->sb_dirband_size;
                 sbi->sb_dirband_size = 0;
-                if (hpfs_chk_sectors(s, superblock->dir_band_start, superblock->n_dir_band, "dir_band") ||
-                    hpfs_chk_sectors(s, superblock->dir_band_bitmap, 4, "dir_band_bitmap") ||
-                    hpfs_chk_sectors(s, superblock->bitmaps, 4, "bitmaps")) {
-                        mark_dirty(s);
+                if (hpfs_chk_sectors(s, le32_to_cpu(superblock->dir_band_start), le32_to_cpu(superblock->n_dir_band), "dir_band") ||
+                    hpfs_chk_sectors(s, le32_to_cpu(superblock->dir_band_bitmap), 4, "dir_band_bitmap") ||
+                    hpfs_chk_sectors(s, le32_to_cpu(superblock->bitmaps), 4, "bitmaps")) {
+                        mark_dirty(s, 0);
                         goto bail4;
                 }
                 sbi->sb_dirband_size = a;
         } else printk("HPFS: You really don't want any checks? You are crazy...\n");
 
         /* Load code page table */
-        if (spareblock->n_code_pages)
-                if (!(sbi->sb_cp_table = hpfs_load_code_page(s, spareblock->code_page_dir)))
+        if (le32_to_cpu(spareblock->n_code_pages))
+                if (!(sbi->sb_cp_table = hpfs_load_code_page(s, le32_to_cpu(spareblock->code_page_dir))))
                         printk("HPFS: Warning: code page support is disabled\n");
 
         brelse(bh2);
@@ -660,13 +642,13 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
         if (!de)
                 hpfs_error(s, "unable to find root dir");
         else {
-                root->i_atime.tv_sec = local_to_gmt(s, de->read_date);
+                root->i_atime.tv_sec = local_to_gmt(s, le32_to_cpu(de->read_date));
                 root->i_atime.tv_nsec = 0;
-                root->i_mtime.tv_sec = local_to_gmt(s, de->write_date);
+                root->i_mtime.tv_sec = local_to_gmt(s, le32_to_cpu(de->write_date));
                 root->i_mtime.tv_nsec = 0;
-                root->i_ctime.tv_sec = local_to_gmt(s, de->creation_date);
+                root->i_ctime.tv_sec = local_to_gmt(s, le32_to_cpu(de->creation_date));
                 root->i_ctime.tv_nsec = 0;
-                hpfs_i(root)->i_ea_size = de->ea_size;
+                hpfs_i(root)->i_ea_size = le16_to_cpu(de->ea_size);
                 hpfs_i(root)->i_parent_dir = root->i_ino;
                 if (root->i_size == -1)
                         root->i_size = 2048;
@@ -674,6 +656,7 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
                         root->i_blocks = 5;
                 hpfs_brelse4(&qbh);
         }
+        hpfs_unlock(s);
         return 0;
 
 bail4:  brelse(bh2);
@@ -681,6 +664,7 @@ bail3:	brelse(bh1);
 bail2:  brelse(bh0);
 bail1:
 bail0:
+        hpfs_unlock(s);
         kfree(sbi->sb_bmp_dir);
         kfree(sbi->sb_cp_table);
         s->s_fs_info = NULL;
diff --git a/fs/logfs/super.c b/fs/logfs/super.c
index 33435e4b14d2..ce03a182c771 100644
--- a/fs/logfs/super.c
+++ b/fs/logfs/super.c
@@ -480,10 +480,6 @@ static int logfs_read_sb(struct super_block *sb, int read_only)
                         !read_only)
                 return -EIO;
 
-        mutex_init(&super->s_dirop_mutex);
-        mutex_init(&super->s_object_alias_mutex);
-        INIT_LIST_HEAD(&super->s_freeing_list);
-
         ret = logfs_init_rw(sb);
         if (ret)
                 return ret;
@@ -601,6 +597,10 @@ static struct dentry *logfs_mount(struct file_system_type *type, int flags,
         if (!super)
                 return ERR_PTR(-ENOMEM);
 
+        mutex_init(&super->s_dirop_mutex);
+        mutex_init(&super->s_object_alias_mutex);
+        INIT_LIST_HEAD(&super->s_freeing_list);
+
         if (!devname)
                 err = logfs_get_sb_bdev(super, type, devname);
         else if (strncmp(devname, "mtd", 3))
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 89fc160fd5b0..1f063bacd285 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -119,7 +119,7 @@ Elong:
 }
 
 #ifdef CONFIG_NFS_V4
-static rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *flavors, struct inode *inode)
+static rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *flavors)
 {
         struct gss_api_mech *mech;
         struct xdr_netobj oid;
@@ -166,7 +166,7 @@ static int nfs_negotiate_security(const struct dentry *parent,
                 }
                 flavors = page_address(page);
                 ret = secinfo(parent->d_inode, &dentry->d_name, flavors);
-                *flavor = nfs_find_best_sec(flavors, dentry->d_inode);
+                *flavor = nfs_find_best_sec(flavors);
                 put_page(page);
         }
 
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index e1c261ddd65d..c4a69833dd0d 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -47,6 +47,7 @@ enum nfs4_client_state {
         NFS4CLNT_LAYOUTRECALL,
         NFS4CLNT_SESSION_RESET,
         NFS4CLNT_RECALL_SLOT,
+        NFS4CLNT_LEASE_CONFIRM,
 };
 
 enum nfs4_session_state {
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 9bf41eab3e46..69c0f3c5ee7a 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -46,6 +46,7 @@
 #include <linux/nfs4.h>
 #include <linux/nfs_fs.h>
 #include <linux/nfs_page.h>
+#include <linux/nfs_mount.h>
 #include <linux/namei.h>
 #include <linux/mount.h>
 #include <linux/module.h>
@@ -443,8 +444,8 @@ static int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *
         if (res->sr_status == 1)
                 res->sr_status = NFS_OK;
 
-        /* -ERESTARTSYS can result in skipping nfs41_sequence_setup */
-        if (!res->sr_slot)
+        /* don't increment the sequence number if the task wasn't sent */
+        if (!RPC_WAS_SENT(task))
                 goto out;
 
         /* Check the SEQUENCE operation status */
@@ -2185,9 +2186,14 @@ static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
         struct nfs4_exception exception = { };
         int err;
         do {
-                err = nfs4_handle_exception(server,
-                                _nfs4_lookup_root(server, fhandle, info),
-                                &exception);
+                err = _nfs4_lookup_root(server, fhandle, info);
+                switch (err) {
+                case 0:
+                case -NFS4ERR_WRONGSEC:
+                        break;
+                default:
+                        err = nfs4_handle_exception(server, err, &exception);
+                }
         } while (exception.retry);
         return err;
 }
@@ -2208,25 +2214,47 @@ out:
         return ret;
 }
 
-/*
- * get the file handle for the "/" directory on the server
- */
-static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
+static int nfs4_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
                               struct nfs_fsinfo *info)
 {
         int i, len, status = 0;
-        rpc_authflavor_t flav_array[NFS_MAX_SECFLAVORS + 2];
+        rpc_authflavor_t flav_array[NFS_MAX_SECFLAVORS];
 
-        flav_array[0] = RPC_AUTH_UNIX;
-        len = gss_mech_list_pseudoflavors(&flav_array[1]);
-        flav_array[1+len] = RPC_AUTH_NULL;
-        len += 2;
+        len = gss_mech_list_pseudoflavors(&flav_array[0]);
+        flav_array[len] = RPC_AUTH_NULL;
+        len += 1;
 
         for (i = 0; i < len; i++) {
                 status = nfs4_lookup_root_sec(server, fhandle, info, flav_array[i]);
-                if (status != -EPERM)
-                        break;
+                if (status == -NFS4ERR_WRONGSEC || status == -EACCES)
+                        continue;
+                break;
         }
+        /*
+         * -EACCESS could mean that the user doesn't have correct permissions
+         * to access the mount.  It could also mean that we tried to mount
+         * with a gss auth flavor, but rpc.gssd isn't running.  Either way,
+         * existing mount programs don't handle -EACCES very well so it should
+         * be mapped to -EPERM instead.
+         */
+        if (status == -EACCES)
+                status = -EPERM;
+        return status;
+}
+
+/*
+ * get the file handle for the "/" directory on the server
+ */
+static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
+                              struct nfs_fsinfo *info)
+{
+        int status = nfs4_lookup_root(server, fhandle, info);
+        if ((status == -NFS4ERR_WRONGSEC) && !(server->flags & NFS_MOUNT_SECFLAVOUR))
+                /*
+                 * A status of -NFS4ERR_WRONGSEC will be mapped to -EPERM
+                 * by nfs4_map_errors() as this function exits.
+                 */
+                status = nfs4_find_root_sec(server, fhandle, info);
         if (status == 0)
                 status = nfs4_server_capabilities(server, fhandle);
         if (status == 0)
@@ -3723,21 +3751,20 @@ int nfs4_proc_setclientid(struct nfs_client *clp, u32 program,
                                 sizeof(setclientid.sc_uaddr), "%s.%u.%u",
                                 clp->cl_ipaddr, port >> 8, port & 255);
 
-                status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
+                status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
                 if (status != -NFS4ERR_CLID_INUSE)
                         break;
-                if (signalled())
+                if (loop != 0) {
+                        ++clp->cl_id_uniquifier;
                         break;
-                if (loop++ & 1)
-                        ssleep(clp->cl_lease_time / HZ + 1);
-                else
-                        if (++clp->cl_id_uniquifier == 0)
-                                break;
+                }
+                ++loop;
+                ssleep(clp->cl_lease_time / HZ + 1);
         }
         return status;
 }
 
-static int _nfs4_proc_setclientid_confirm(struct nfs_client *clp,
+int nfs4_proc_setclientid_confirm(struct nfs_client *clp,
                 struct nfs4_setclientid_res *arg,
                 struct rpc_cred *cred)
 {
@@ -3752,7 +3779,7 @@ static int _nfs4_proc_setclientid_confirm(struct nfs_client *clp,
         int status;
 
         now = jiffies;
-        status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
+        status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         if (status == 0) {
                 spin_lock(&clp->cl_lock);
                 clp->cl_lease_time = fsinfo.lease_time * HZ;
@@ -3762,26 +3789,6 @@ static int _nfs4_proc_setclientid_confirm(struct nfs_client *clp,
         return status;
 }
 
-int nfs4_proc_setclientid_confirm(struct nfs_client *clp,
-                struct nfs4_setclientid_res *arg,
-                struct rpc_cred *cred)
-{
-        long timeout = 0;
-        int err;
-        do {
-                err = _nfs4_proc_setclientid_confirm(clp, arg, cred);
-                switch (err) {
-                        case 0:
-                                return err;
-                        case -NFS4ERR_RESOURCE:
-                                /* The IBM lawyers misread another document! */
-                        case -NFS4ERR_DELAY:
-                                err = nfs4_delay(clp->cl_rpcclient, &timeout);
-                }
-        } while (err == 0);
-        return err;
-}
-
 struct nfs4_delegreturndata {
         struct nfs4_delegreturnargs args;
         struct nfs4_delegreturnres res;
@@ -4786,7 +4793,7 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
                                 init_utsname()->domainname,
                                 clp->cl_rpcclient->cl_auth->au_flavor);
 
-        status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
+        status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         if (!status)
                 status = nfs4_check_cl_exchange_flags(clp->cl_exchange_flags);
         dprintk("<-- %s status= %d\n", __func__, status);
@@ -4869,7 +4876,8 @@ int nfs4_proc_get_lease_time(struct nfs_client *clp, struct nfs_fsinfo *fsinfo)
                 .rpc_client = clp->cl_rpcclient,
                 .rpc_message = &msg,
                 .callback_ops = &nfs4_get_lease_time_ops,
-                .callback_data = &data
+                .callback_data = &data,
+                .flags = RPC_TASK_TIMEOUT,
         };
         int status;
 
@@ -5171,7 +5179,7 @@ static int _nfs4_proc_create_session(struct nfs_client *clp)
         nfs4_init_channel_attrs(&args);
         args.flags = (SESSION4_PERSIST | SESSION4_BACK_CHAN);
 
-        status = rpc_call_sync(session->clp->cl_rpcclient, &msg, 0);
+        status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
 
         if (!status)
                 /* Verify the session's negotiated channel_attrs values */
@@ -5194,20 +5202,10 @@ int nfs4_proc_create_session(struct nfs_client *clp)
         int status;
         unsigned *ptr;
         struct nfs4_session *session = clp->cl_session;
-        long timeout = 0;
-        int err;
 
         dprintk("--> %s clp=%p session=%p\n", __func__, clp, session);
 
-        do {
-                status = _nfs4_proc_create_session(clp);
-                if (status == -NFS4ERR_DELAY) {
-                        err = nfs4_delay(clp->cl_rpcclient, &timeout);
-                        if (err)
-                                status = err;
-                }
-        } while (status == -NFS4ERR_DELAY);
-
+        status = _nfs4_proc_create_session(clp);
         if (status)
                 goto out;
 
@@ -5248,7 +5246,7 @@ int nfs4_proc_destroy_session(struct nfs4_session *session)
         msg.rpc_argp = session;
         msg.rpc_resp = NULL;
         msg.rpc_cred = NULL;
-        status = rpc_call_sync(session->clp->cl_rpcclient, &msg, 0);
+        status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
 
         if (status)
                 printk(KERN_WARNING
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index a6804f704d9d..036f5adc9e1f 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -64,10 +64,15 @@ static LIST_HEAD(nfs4_clientid_list);
 
 int nfs4_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
 {
-        struct nfs4_setclientid_res clid;
+        struct nfs4_setclientid_res clid = {
+                .clientid = clp->cl_clientid,
+                .confirm = clp->cl_confirm,
+        };
         unsigned short port;
         int status;
 
+        if (test_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state))
+                goto do_confirm;
         port = nfs_callback_tcpport;
         if (clp->cl_addr.ss_family == AF_INET6)
                 port = nfs_callback_tcpport6;
@@ -75,10 +80,14 @@ int nfs4_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
         status = nfs4_proc_setclientid(clp, NFS4_CALLBACK, port, cred, &clid);
         if (status != 0)
                 goto out;
+        clp->cl_clientid = clid.clientid;
+        clp->cl_confirm = clid.confirm;
+        set_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+do_confirm:
         status = nfs4_proc_setclientid_confirm(clp, &clid, cred);
         if (status != 0)
                 goto out;
-        clp->cl_clientid = clid.clientid;
+        clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
         nfs4_schedule_state_renewal(clp);
 out:
         return status;
@@ -230,13 +239,18 @@ int nfs41_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
 {
         int status;
 
+        if (test_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state))
+                goto do_confirm;
         nfs4_begin_drain_session(clp);
         status = nfs4_proc_exchange_id(clp, cred);
         if (status != 0)
                 goto out;
+        set_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+do_confirm:
         status = nfs4_proc_create_session(clp);
         if (status != 0)
                 goto out;
+        clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
         nfs41_setup_state_renewal(clp);
         nfs_mark_client_ready(clp, NFS_CS_READY);
 out:
@@ -1584,20 +1598,23 @@ static int nfs4_recall_slot(struct nfs_client *clp) { return 0; }
  */
 static void nfs4_set_lease_expired(struct nfs_client *clp, int status)
 {
-        if (nfs4_has_session(clp)) {
-                switch (status) {
-                case -NFS4ERR_DELAY:
-                case -NFS4ERR_CLID_INUSE:
-                case -EAGAIN:
-                        break;
+        switch (status) {
+        case -NFS4ERR_CLID_INUSE:
+        case -NFS4ERR_STALE_CLIENTID:
+                clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+                break;
+        case -NFS4ERR_DELAY:
+        case -ETIMEDOUT:
+        case -EAGAIN:
+                ssleep(1);
+                break;
 
-                case -EKEYEXPIRED:
-                        nfs4_warn_keyexpired(clp->cl_hostname);
-                case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
-                                         * in nfs4_exchange_id */
-                default:
-                        return;
-                }
+        case -EKEYEXPIRED:
+                nfs4_warn_keyexpired(clp->cl_hostname);
+        case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
+                                 * in nfs4_exchange_id */
+        default:
+                return;
         }
         set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
 }
@@ -1607,7 +1624,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
         int status = 0;
 
         /* Ensure exclusive access to NFSv4 state */
-        for(;;) {
+        do {
                 if (test_and_clear_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state)) {
                         /* We're going to have to re-establish a clientid */
                         status = nfs4_reclaim_lease(clp);
@@ -1691,7 +1708,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
                         break;
                 if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
                         break;
-        }
+        } while (atomic_read(&clp->cl_count) > 1);
         return;
 out_error:
         printk(KERN_WARNING "Error: state manager failed on NFSv4 server %s"
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index dddfb5795d7b..c3ccd2c46834 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1452,26 +1452,25 @@ static void encode_read(struct xdr_stream *xdr, const struct nfs_readargs *args,
 
 static void encode_readdir(struct xdr_stream *xdr, const struct nfs4_readdir_arg *readdir, struct rpc_rqst *req, struct compound_hdr *hdr)
 {
-        uint32_t attrs[2] = {0, 0};
+        uint32_t attrs[2] = {
+                FATTR4_WORD0_RDATTR_ERROR,
+                FATTR4_WORD1_MOUNTED_ON_FILEID,
+        };
         uint32_t dircount = readdir->count >> 1;
         __be32 *p;
 
         if (readdir->plus) {
                 attrs[0] |= FATTR4_WORD0_TYPE|FATTR4_WORD0_CHANGE|FATTR4_WORD0_SIZE|
-                        FATTR4_WORD0_FSID|FATTR4_WORD0_FILEHANDLE;
+                        FATTR4_WORD0_FSID|FATTR4_WORD0_FILEHANDLE|FATTR4_WORD0_FILEID;
                 attrs[1] |= FATTR4_WORD1_MODE|FATTR4_WORD1_NUMLINKS|FATTR4_WORD1_OWNER|
                         FATTR4_WORD1_OWNER_GROUP|FATTR4_WORD1_RAWDEV|
                         FATTR4_WORD1_SPACE_USED|FATTR4_WORD1_TIME_ACCESS|
                         FATTR4_WORD1_TIME_METADATA|FATTR4_WORD1_TIME_MODIFY;
                 dircount >>= 1;
         }
-        attrs[0] |= FATTR4_WORD0_RDATTR_ERROR|FATTR4_WORD0_FILEID;
-        attrs[1] |= FATTR4_WORD1_MOUNTED_ON_FILEID;
-        /* Switch to mounted_on_fileid if the server supports it */
-        if (readdir->bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID)
-                attrs[0] &= ~FATTR4_WORD0_FILEID;
-        else
-                attrs[1] &= ~FATTR4_WORD1_MOUNTED_ON_FILEID;
+        /* Use mounted_on_fileid only if the server supports it */
+        if (!(readdir->bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID))
+                attrs[0] |= FATTR4_WORD0_FILEID;
 
         p = reserve_space(xdr, 12+NFS4_VERIFIER_SIZE+20);
         *p++ = cpu_to_be32(OP_READDIR);
@@ -3140,7 +3139,7 @@ static int decode_attr_mounted_on_fileid(struct xdr_stream *xdr, uint32_t *bitma
                         goto out_overflow;
                 xdr_decode_hyper(p, fileid);
                 bitmap[1] &= ~FATTR4_WORD1_MOUNTED_ON_FILEID;
-                ret = NFS_ATTR_FATTR_FILEID;
+                ret = NFS_ATTR_FATTR_MOUNTED_ON_FILEID;
         }
         dprintk("%s: fileid=%Lu\n", __func__, (unsigned long long)*fileid);
         return ret;
@@ -4002,7 +4001,6 @@ static int decode_getfattr_attrs(struct xdr_stream *xdr, uint32_t *bitmap,
 {
         int status;
         umode_t fmode = 0;
-        uint64_t fileid;
         uint32_t type;
 
         status = decode_attr_type(xdr, bitmap, &type);
@@ -4101,13 +4099,10 @@ static int decode_getfattr_attrs(struct xdr_stream *xdr, uint32_t *bitmap,
                 goto xdr_error;
         fattr->valid |= status;
 
-        status = decode_attr_mounted_on_fileid(xdr, bitmap, &fileid);
+        status = decode_attr_mounted_on_fileid(xdr, bitmap, &fattr->mounted_on_fileid);
         if (status < 0)
                 goto xdr_error;
-        if (status != 0 && !(fattr->valid & status)) {
-                fattr->fileid = fileid;
-                fattr->valid |= status;
-        }
+        fattr->valid |= status;
 
 xdr_error:
         dprintk("%s: xdr returned %d\n", __func__, -status);
@@ -4838,17 +4833,21 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
         struct nfs4_secinfo_flavor *sec_flavor;
         int status;
         __be32 *p;
-        int i;
+        int i, num_flavors;
 
         status = decode_op_hdr(xdr, OP_SECINFO);
+        if (status)
+                goto out;
         p = xdr_inline_decode(xdr, 4);
         if (unlikely(!p))
                 goto out_overflow;
-        res->flavors->num_flavors = be32_to_cpup(p);
 
-        for (i = 0; i < res->flavors->num_flavors; i++) {
+        res->flavors->num_flavors = 0;
+        num_flavors = be32_to_cpup(p);
+
+        for (i = 0; i < num_flavors; i++) {
                 sec_flavor = &res->flavors->flavors[i];
-                if ((char *)&sec_flavor[1] - (char *)res > PAGE_SIZE)
+                if ((char *)&sec_flavor[1] - (char *)res->flavors > PAGE_SIZE)
                         break;
 
                 p = xdr_inline_decode(xdr, 4);
@@ -4857,13 +4856,15 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
                 sec_flavor->flavor = be32_to_cpup(p);
 
                 if (sec_flavor->flavor == RPC_AUTH_GSS) {
-                        if (decode_secinfo_gss(xdr, sec_flavor))
-                                break;
+                        status = decode_secinfo_gss(xdr, sec_flavor);
+                        if (status)
+                                goto out;
                 }
+                res->flavors->num_flavors++;
         }
 
-        return 0;
-
+out:
+        return status;
 out_overflow:
         print_overflow_msg(__func__, xdr);
         return -EIO;
@@ -6408,7 +6409,9 @@ int nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
         if (decode_getfattr_attrs(xdr, bitmap, entry->fattr, entry->fh,
                                         entry->server, 1) < 0)
                 goto out_overflow;
-        if (entry->fattr->valid & NFS_ATTR_FATTR_FILEID)
+        if (entry->fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID)
+                entry->ino = entry->fattr->mounted_on_fileid;
+        else if (entry->fattr->valid & NFS_ATTR_FATTR_FILEID)
                 entry->ino = entry->fattr->fileid;
 
         entry->d_type = DT_UNKNOWN;
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index d9ab97269ce6..ff681ab65d31 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1004,6 +1004,7 @@ pnfs_set_layoutcommit(struct nfs_write_data *wdata)
 {
         struct nfs_inode *nfsi = NFS_I(wdata->inode);
         loff_t end_pos = wdata->args.offset + wdata->res.count;
+        bool mark_as_dirty = false;
 
         spin_lock(&nfsi->vfs_inode.i_lock);
         if (!test_and_set_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)) {
@@ -1011,13 +1012,18 @@ pnfs_set_layoutcommit(struct nfs_write_data *wdata)
                 get_lseg(wdata->lseg);
                 wdata->lseg->pls_lc_cred =
                         get_rpccred(wdata->args.context->state->owner->so_cred);
-                mark_inode_dirty_sync(wdata->inode);
+                mark_as_dirty = true;
                 dprintk("%s: Set layoutcommit for inode %lu ",
                         __func__, wdata->inode->i_ino);
         }
         if (end_pos > wdata->lseg->pls_end_pos)
                 wdata->lseg->pls_end_pos = end_pos;
         spin_unlock(&nfsi->vfs_inode.i_lock);
+
+        /* if pnfs_layoutcommit_inode() runs between inode locks, the next one
+         * will be a noop because NFS_INO_LAYOUTCOMMIT will not be set */
+        if (mark_as_dirty)
+                mark_inode_dirty_sync(wdata->inode);
 }
 EXPORT_SYMBOL_GPL(pnfs_set_layoutcommit);
 
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 2b8e9a5e366a..e288f06d3fa7 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1004,6 +1004,7 @@ static int nfs_parse_security_flavors(char *value,
                 return 0;
         }
 
+        mnt->flags |= NFS_MOUNT_SECFLAVOUR;
         mnt->auth_flavor_len = 1;
         return 1;
 }
@@ -1976,6 +1977,15 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data)
         if (error < 0)
                 goto out;
 
+        /*
+         * noac is a special case. It implies -o sync, but that's not
+         * necessarily reflected in the mtab options. do_remount_sb
+         * will clear MS_SYNCHRONOUS if -o sync wasn't specified in the
+         * remount options, so we have to explicitly reset it.
+         */
+        if (data->flags & NFS_MOUNT_NOAC)
+                *flags |= MS_SYNCHRONOUS;
+
         /* compare new mount options with old ones */
         error = nfs_compare_remount_data(nfss, data);
 out:
@@ -2235,8 +2245,7 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
         if (!s->s_root) {
                 /* initial superblock/root creation */
                 nfs_fill_super(s, data);
-                nfs_fscache_get_super_cookie(
-                        s, data ? data->fscache_uniq : NULL, NULL);
+                nfs_fscache_get_super_cookie(s, data->fscache_uniq, NULL);
         }
 
         mntroot = nfs_get_root(s, mntfh, dev_name);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index e4cbc11a74ab..3bd5d7e80f6c 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -680,7 +680,6 @@ static int nfs_writepage_setup(struct nfs_open_context *ctx, struct page *page,
         req = nfs_setup_write_request(ctx, page, offset, count);
         if (IS_ERR(req))
                 return PTR_ERR(req);
-        nfs_mark_request_dirty(req);
         /* Update file length */
         nfs_grow_file(page, offset, count);
         nfs_mark_uptodate(page, req->wb_pgbase, req->wb_bytes);
@@ -1418,8 +1417,7 @@ static void nfs_commit_done(struct rpc_task *task, void *calldata)
                                 task->tk_pid, task->tk_status);
 
         /* Call the NFS version-specific code */
-        if (NFS_PROTO(data->inode)->commit_done(task, data) != 0)
-                return;
+        NFS_PROTO(data->inode)->commit_done(task, data);
 }
 
 void nfs_commit_release_pages(struct nfs_write_data *data)
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index b68f87a83924..938387a10d5d 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -1019,7 +1019,7 @@ struct ocfs2_xattr_entry {
         __le16  xe_name_offset;  /* byte offset from the 1st entry in the
                                     local xattr storage(inode, xattr block or
                                     xattr bucket). */
-        __u8    xe_name_len;     /* xattr name len, does't include prefix. */
+        __u8    xe_name_len;     /* xattr name len, doesn't include prefix. */
         __u8    xe_type;         /* the low 7 bits indicate the name prefix
                                   * type and the highest bit indicates whether
                                   * the EA is stored in the local storage. */
diff --git a/fs/partitions/efi.c b/fs/partitions/efi.c
index ac0ccb5026a2..19d6750d1d6c 100644
--- a/fs/partitions/efi.c
+++ b/fs/partitions/efi.c
@@ -348,6 +348,12 @@ static int is_gpt_valid(struct parsed_partitions *state, u64 lba,
                 goto fail;
         }
 
+        /* Check that sizeof_partition_entry has the correct value */
+        if (le32_to_cpu((*gpt)->sizeof_partition_entry) != sizeof(gpt_entry)) {
+                pr_debug("GUID Partitition Entry Size check failed.\n");
+                goto fail;
+        }
+
         if (!(*ptes = alloc_read_gpt_entries(state, *gpt)))
                 goto fail;
 
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 2e7addfd9803..318d8654989b 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -214,7 +214,7 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
         int flags = vma->vm_flags;
         unsigned long ino = 0;
         unsigned long long pgoff = 0;
-        unsigned long start;
+        unsigned long start, end;
         dev_t dev = 0;
         int len;
 
@@ -227,13 +227,15 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
 
         /* We don't show the stack guard page in /proc/maps */
         start = vma->vm_start;
-        if (vma->vm_flags & VM_GROWSDOWN)
-                if (!vma_stack_continue(vma->vm_prev, vma->vm_start))
-                        start += PAGE_SIZE;
+        if (stack_guard_page_start(vma, start))
+                start += PAGE_SIZE;
+        end = vma->vm_end;
+        if (stack_guard_page_end(vma, end))
+                end -= PAGE_SIZE;
 
         seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
                         start,
-                        vma->vm_end,
+                        end,
                         flags & VM_READ ? 'r' : '-',
                         flags & VM_WRITE ? 'w' : '-',
                         flags & VM_EXEC ? 'x' : '-',
diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c
index 4d0cb1241460..40fa780ebea7 100644
--- a/fs/ubifs/log.c
+++ b/fs/ubifs/log.c
@@ -175,26 +175,6 @@ void ubifs_add_bud(struct ubifs_info *c, struct ubifs_bud *bud)
 }
 
 /**
- * ubifs_create_buds_lists - create journal head buds lists for remount rw.
- * @c: UBIFS file-system description object
- */
-void ubifs_create_buds_lists(struct ubifs_info *c)
-{
-        struct rb_node *p;
-
-        spin_lock(&c->buds_lock);
-        p = rb_first(&c->buds);
-        while (p) {
-                struct ubifs_bud *bud = rb_entry(p, struct ubifs_bud, rb);
-                struct ubifs_jhead *jhead = &c->jheads[bud->jhead];
-
-                list_add_tail(&bud->list, &jhead->buds_list);
-                p = rb_next(p);
-        }
-        spin_unlock(&c->buds_lock);
-}
-
-/**
  * ubifs_add_bud_to_log - add a new bud to the log.
  * @c: UBIFS file-system description object
  * @jhead: journal head the bud belongs to
diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
index eed0fcff8d73..d3d6d365bfc1 100644
--- a/fs/ubifs/replay.c
+++ b/fs/ubifs/replay.c
@@ -59,6 +59,7 @@ enum {
  * @new_size: truncation new size
  * @free: amount of free space in a bud
  * @dirty: amount of dirty space in a bud from padding and deletion nodes
+ * @jhead: journal head number of the bud
  *
  * UBIFS journal replay must compare node sequence numbers, which means it must
  * build a tree of node information to insert into the TNC.
@@ -80,6 +81,7 @@ struct replay_entry {
                 struct {
                         int free;
                         int dirty;
+                        int jhead;
                 };
         };
 };
@@ -159,6 +161,11 @@ static int set_bud_lprops(struct ubifs_info *c, struct replay_entry *r)
                 err = PTR_ERR(lp);
                 goto out;
         }
+
+        /* Make sure the journal head points to the latest bud */
+        err = ubifs_wbuf_seek_nolock(&c->jheads[r->jhead].wbuf, r->lnum,
+                                     c->leb_size - r->free, UBI_SHORTTERM);
+
 out:
         ubifs_release_lprops(c);
         return err;
@@ -627,10 +634,6 @@ static int replay_bud(struct ubifs_info *c, int lnum, int offs, int jhead,
         ubifs_assert(sleb->endpt - offs >= used);
         ubifs_assert(sleb->endpt % c->min_io_size == 0);
 
-        if (sleb->endpt + c->min_io_size <= c->leb_size && !c->ro_mount)
-                err = ubifs_wbuf_seek_nolock(&c->jheads[jhead].wbuf, lnum,
-                                             sleb->endpt, UBI_SHORTTERM);
-
         *dirty = sleb->endpt - offs - used;
         *free = c->leb_size - sleb->endpt;
 
@@ -653,12 +656,14 @@ out_dump:
  * @sqnum: sequence number
  * @free: amount of free space in bud
  * @dirty: amount of dirty space from padding and deletion nodes
+ * @jhead: journal head number for the bud
  *
  * This function inserts a reference node to the replay tree and returns zero
  * in case of success or a negative error code in case of failure.
  */
 static int insert_ref_node(struct ubifs_info *c, int lnum, int offs,
-                           unsigned long long sqnum, int free, int dirty)
+                           unsigned long long sqnum, int free, int dirty,
+                           int jhead)
 {
         struct rb_node **p = &c->replay_tree.rb_node, *parent = NULL;
         struct replay_entry *r;
@@ -688,6 +693,7 @@ static int insert_ref_node(struct ubifs_info *c, int lnum, int offs,
         r->flags = REPLAY_REF;
         r->free = free;
         r->dirty = dirty;
+        r->jhead = jhead;
 
         rb_link_node(&r->rb, parent, p);
         rb_insert_color(&r->rb, &c->replay_tree);
@@ -712,7 +718,7 @@ static int replay_buds(struct ubifs_info *c)
                 if (err)
                         return err;
                 err = insert_ref_node(c, b->bud->lnum, b->bud->start, b->sqnum,
-                                      free, dirty);
+                                      free, dirty, b->bud->jhead);
                 if (err)
                         return err;
         }
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index be6c7b008f38..04ad07f4fcc3 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1257,12 +1257,12 @@ static int mount_ubifs(struct ubifs_info *c)
                 goto out_free;
         }
 
+        err = alloc_wbufs(c);
+        if (err)
+                goto out_cbuf;
+
         sprintf(c->bgt_name, BGT_NAME_PATTERN, c->vi.ubi_num, c->vi.vol_id);
         if (!c->ro_mount) {
-                err = alloc_wbufs(c);
-                if (err)
-                        goto out_cbuf;
-
                 /* Create background thread */
                 c->bgt = kthread_create(ubifs_bg_thread, c, "%s", c->bgt_name);
                 if (IS_ERR(c->bgt)) {
@@ -1631,12 +1631,6 @@ static int ubifs_remount_rw(struct ubifs_info *c)
         if (err)
                 goto out;
 
-        err = alloc_wbufs(c);
-        if (err)
-                goto out;
-
-        ubifs_create_buds_lists(c);
-
         /* Create background thread */
         c->bgt = kthread_create(ubifs_bg_thread, c, "%s", c->bgt_name);
         if (IS_ERR(c->bgt)) {
@@ -1744,7 +1738,6 @@ static void ubifs_remount_ro(struct ubifs_info *c)
         if (err)
                 ubifs_ro_mode(c, err);
 
-        free_wbufs(c);
         vfree(c->orph_buf);
         c->orph_buf = NULL;
         kfree(c->write_reserve_buf);
diff --git a/include/drm/drm_fb_helper.h b/include/drm/drm_fb_helper.h
index f22e7fe4b6db..ade09d7b4271 100644
--- a/include/drm/drm_fb_helper.h
+++ b/include/drm/drm_fb_helper.h
@@ -118,6 +118,7 @@ int drm_fb_helper_setcolreg(unsigned regno,
                             unsigned transp,
                             struct fb_info *info);
 
+bool drm_fb_helper_restore_fbdev_mode(struct drm_fb_helper *fb_helper);
 void drm_fb_helper_restore(void);
 void drm_fb_helper_fill_var(struct fb_info *info, struct drm_fb_helper *fb_helper,
                             uint32_t fb_width, uint32_t fb_height);
diff --git a/include/drm/drm_mm.h b/include/drm/drm_mm.h
index c2f93a8ae2e1..564b14aa7e16 100644
--- a/include/drm/drm_mm.h
+++ b/include/drm/drm_mm.h
@@ -86,7 +86,7 @@ static inline bool drm_mm_initialized(struct drm_mm *mm)
 }
 #define drm_mm_for_each_node(entry, mm) list_for_each_entry(entry, \
                                                 &(mm)->head_node.node_list, \
-                                                node_list);
+                                                node_list)
 #define drm_mm_for_each_scanned_node_reverse(entry, n, mm) \
         for (entry = (mm)->prev_scanned_node, \
                 next = entry ? list_entry(entry->node_list.next, \
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 816e30cbd968..f04b2a3b0f49 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -155,6 +155,7 @@
         {0x1002, 0x6719, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAYMAN|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x671c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAYMAN|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x671d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAYMAN|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x671f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAYMAN|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6720, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6721, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6722, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
@@ -167,6 +168,7 @@
         {0x1002, 0x6729, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6738, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6739, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x673e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6740, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6741, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6742, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
@@ -199,6 +201,7 @@
         {0x1002, 0x688D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6898, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6899, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x689b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x689c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HEMLOCK|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x689d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HEMLOCK|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x689e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
@@ -209,7 +212,9 @@
         {0x1002, 0x68b0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x68b8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x68b9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x68ba, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x68be, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x68bf, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x68c0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x68c1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x68c7, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
diff --git a/include/drm/radeon_drm.h b/include/drm/radeon_drm.h
index 3bce1a4fc305..787f7b6fd622 100644
--- a/include/drm/radeon_drm.h
+++ b/include/drm/radeon_drm.h
@@ -909,6 +909,8 @@ struct drm_radeon_cs {
 #define RADEON_INFO_WANT_CMASK          0x08 /* get access to CMASK on r300 */
 #define RADEON_INFO_CLOCK_CRYSTAL_FREQ  0x09 /* clock crystal frequency */
 #define RADEON_INFO_NUM_BACKENDS        0x0a /* DB/backends for r600+ - need for OQ */
+#define RADEON_INFO_NUM_TILE_PIPES      0x0b /* tile pipes for r600+ */
+#define RADEON_INFO_FUSION_GART_WORKING 0x0c /* fusion writes to GTT were broken before this */
 
 struct drm_radeon_info {
         uint32_t                request;
diff --git a/include/linux/flex_array.h b/include/linux/flex_array.h
index 70e4efabe0fb..ebeb2f3ad068 100644
--- a/include/linux/flex_array.h
+++ b/include/linux/flex_array.h
@@ -61,7 +61,7 @@ struct flex_array {
 struct flex_array *flex_array_alloc(int element_size, unsigned int total,
                 gfp_t flags);
 int flex_array_prealloc(struct flex_array *fa, unsigned int start,
-                unsigned int end, gfp_t flags);
+                unsigned int nr_elements, gfp_t flags);
 void flex_array_free(struct flex_array *fa);
 void flex_array_free_parts(struct flex_array *fa);
 int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 22b32af1b5ec..b5a550a39a70 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -37,6 +37,7 @@ struct trace_entry {
         unsigned char           flags;
         unsigned char           preempt_count;
         int                     pid;
+        int                     padding;
 };
 
 #define FTRACE_MAX_EVENT                                                \
diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
index df29c8fde36b..8847c8c29791 100644
--- a/include/linux/huge_mm.h
+++ b/include/linux/huge_mm.h
@@ -117,7 +117,7 @@ static inline void vma_adjust_trans_huge(struct vm_area_struct *vma,
                                          unsigned long end,
                                          long adjust_next)
 {
-        if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
+        if (!vma->anon_vma || vma->vm_ops)
                 return;
         __vma_adjust_trans_huge(vma, start, end, adjust_next);
 }
diff --git a/include/linux/mfd/wm831x/pdata.h b/include/linux/mfd/wm831x/pdata.h
index afe4db49402d..632d1567a1b6 100644
--- a/include/linux/mfd/wm831x/pdata.h
+++ b/include/linux/mfd/wm831x/pdata.h
@@ -81,7 +81,9 @@ struct wm831x_touch_pdata {
         int rpu;               /** Pen down sensitivity resistor divider */
         int pressure;          /** Report pressure (boolean) */
         unsigned int data_irq; /** Touch data ready IRQ */
+        int data_irqf;         /** IRQ flags for data ready IRQ */
         unsigned int pd_irq;   /** Touch pendown detect IRQ */
+        int pd_irqf;           /** IRQ flags for pen down IRQ */
 };
 
 enum wm831x_watchdog_action {
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 692dbae6ffa7..6507dde38b16 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -137,7 +137,8 @@ extern unsigned int kobjsize(const void *objp);
 #define VM_RandomReadHint(v)            ((v)->vm_flags & VM_RAND_READ)
 
 /*
- * special vmas that are non-mergable, non-mlock()able
+ * Special vmas that are non-mergable, non-mlock()able.
+ * Note: mm/huge_memory.c VM_NO_THP depends on this definition.
  */
 #define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_PFNMAP)
 
@@ -1010,11 +1011,33 @@ int set_page_dirty_lock(struct page *page);
 int clear_page_dirty_for_io(struct page *page);
 
 /* Is the vma a continuation of the stack vma above it? */
-static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
+static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
 {
         return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
 }
 
+static inline int stack_guard_page_start(struct vm_area_struct *vma,
+                                             unsigned long addr)
+{
+        return (vma->vm_flags & VM_GROWSDOWN) &&
+                (vma->vm_start == addr) &&
+                !vma_growsdown(vma->vm_prev, addr);
+}
+
+/* Is the vma a continuation of the stack vma below it? */
+static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
+{
+        return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
+}
+
+static inline int stack_guard_page_end(struct vm_area_struct *vma,
+                                           unsigned long addr)
+{
+        return (vma->vm_flags & VM_GROWSUP) &&
+                (vma->vm_end == addr) &&
+                !vma_growsup(vma->vm_next, addr);
+}
+
 extern unsigned long move_page_tables(struct vm_area_struct *vma,
                 unsigned long old_addr, struct vm_area_struct *new_vma,
                 unsigned long new_addr, unsigned long len);
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index bcb793ec7374..eb792cb6d745 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -183,7 +183,6 @@ struct mmc_host {
         struct work_struct      clk_gate_work; /* delayed clock gate */
         unsigned int            clk_old;        /* old clock value cache */
         spinlock_t              clk_lock;       /* lock for clk fields */
-        struct mutex            clk_gate_mutex; /* mutex for clock gating */
 #endif
 
         /* host specific block data */
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index 216cea5db0aa..87694ca86914 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -47,6 +47,7 @@ struct nfs_client {
 
 #ifdef CONFIG_NFS_V4
         u64                     cl_clientid;    /* constant */
+        nfs4_verifier           cl_confirm;     /* Clientid verifier */
         unsigned long           cl_state;
 
         spinlock_t              cl_lock;
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 78b101e487ea..890dce242639 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -50,6 +50,7 @@ struct nfs_fattr {
         } du;
         struct nfs_fsid         fsid;
         __u64                   fileid;
+        __u64                   mounted_on_fileid;
         struct timespec         atime;
         struct timespec         mtime;
         struct timespec         ctime;
@@ -83,6 +84,7 @@ struct nfs_fattr {
 #define NFS_ATTR_FATTR_PRECHANGE        (1U << 18)
 #define NFS_ATTR_FATTR_V4_REFERRAL      (1U << 19)      /* NFSv4 referral */
 #define NFS_ATTR_FATTR_MOUNTPOINT       (1U << 20)      /* Treat as mountpoint */
+#define NFS_ATTR_FATTR_MOUNTED_ON_FILEID                (1U << 21)
 
 #define NFS_ATTR_FATTR (NFS_ATTR_FATTR_TYPE \
                 | NFS_ATTR_FATTR_MODE \
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 4e2c9150a785..8abe8d78c4bf 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2477,15 +2477,12 @@
 #define PCI_DEVICE_ID_INTEL_82840_HB    0x1a21
 #define PCI_DEVICE_ID_INTEL_82845_HB    0x1a30
 #define PCI_DEVICE_ID_INTEL_IOAT        0x1a38
-#define PCI_DEVICE_ID_INTEL_COUGARPOINT_SMBUS   0x1c22
 #define PCI_DEVICE_ID_INTEL_COUGARPOINT_LPC_MIN 0x1c41
 #define PCI_DEVICE_ID_INTEL_COUGARPOINT_LPC_MAX 0x1c5f
-#define PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS      0x1d22
 #define PCI_DEVICE_ID_INTEL_PATSBURG_LPC_0      0x1d40
 #define PCI_DEVICE_ID_INTEL_PATSBURG_LPC_1      0x1d41
 #define PCI_DEVICE_ID_INTEL_DH89XXCC_LPC_MIN    0x2310
 #define PCI_DEVICE_ID_INTEL_DH89XXCC_LPC_MAX    0x231f
-#define PCI_DEVICE_ID_INTEL_DH89XXCC_SMBUS      0x2330
 #define PCI_DEVICE_ID_INTEL_82801AA_0   0x2410
 #define PCI_DEVICE_ID_INTEL_82801AA_1   0x2411
 #define PCI_DEVICE_ID_INTEL_82801AA_3   0x2413
@@ -2696,7 +2693,6 @@
 #define PCI_DEVICE_ID_INTEL_ICH10_5     0x3a60
 #define PCI_DEVICE_ID_INTEL_5_3400_SERIES_LPC_MIN       0x3b00
 #define PCI_DEVICE_ID_INTEL_5_3400_SERIES_LPC_MAX       0x3b1f
-#define PCI_DEVICE_ID_INTEL_5_3400_SERIES_SMBUS 0x3b30
 #define PCI_DEVICE_ID_INTEL_IOAT_SNB    0x402f
 #define PCI_DEVICE_ID_INTEL_5100_16     0x65f0
 #define PCI_DEVICE_ID_INTEL_5100_21     0x65f5
diff --git a/include/linux/percpu.h b/include/linux/percpu.h
index 3a5c4449fd36..8b97308e65df 100644
--- a/include/linux/percpu.h
+++ b/include/linux/percpu.h
@@ -948,7 +948,7 @@ do {									\
         irqsafe_generic_cpu_cmpxchg_double(pcp1, pcp2, oval1, oval2, nval1, nval2)
 # endif
 # define irqsafe_cpu_cmpxchg_double(pcp1, pcp2, oval1, oval2, nval1, nval2)     \
-        __pcpu_double_call_return_int(irqsafe_cpu_cmpxchg_double_, (pcp1), (pcp2), (oval1), (oval2), (nval1), (nval2))
+        __pcpu_double_call_return_bool(irqsafe_cpu_cmpxchg_double_, (pcp1), (pcp2), (oval1), (oval2), (nval1), (nval2))
 #endif
 
 #endif /* __LINUX_PERCPU_H */
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index a1147e5dd245..9178d5cc0b01 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -189,6 +189,10 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace)
                 child->ptrace = current->ptrace;
                 __ptrace_link(child, current->parent);
         }
+
+#ifdef CONFIG_HAVE_HW_BREAKPOINT
+        atomic_set(&child->ptrace_bp_refcnt, 1);
+#endif
 }
 
 /**
@@ -350,6 +354,13 @@ extern int task_current_syscall(struct task_struct *target, long *callno,
                                 unsigned long args[6], unsigned int maxargs,
                                 unsigned long *sp, unsigned long *pc);
 
-#endif
+#ifdef CONFIG_HAVE_HW_BREAKPOINT
+extern int ptrace_get_breakpoints(struct task_struct *tsk);
+extern void ptrace_put_breakpoints(struct task_struct *tsk);
+#else
+static inline void ptrace_put_breakpoints(struct task_struct *tsk) { }
+#endif /* CONFIG_HAVE_HW_BREAKPOINT */
+
+#endif /* __KERNEL */
 
 #endif
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 18d63cea2848..781abd137673 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1537,6 +1537,9 @@ struct task_struct {
                 unsigned long memsw_nr_pages; /* uncharged mem+swap usage */
         } memcg_batch;
 #endif
+#ifdef CONFIG_HAVE_HW_BREAKPOINT
+        atomic_t ptrace_bp_refcnt;
+#endif
 };
 
 /* Future-safe accessor for struct task_struct's cpus_allowed. */
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index d81db8012c63..f73c482ec9c6 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -127,13 +127,16 @@ struct rpc_task_setup {
 #define RPC_TASK_KILLED         0x0100          /* task was killed */
 #define RPC_TASK_SOFT           0x0200          /* Use soft timeouts */
 #define RPC_TASK_SOFTCONN       0x0400          /* Fail if can't connect */
+#define RPC_TASK_SENT           0x0800          /* message was sent */
+#define RPC_TASK_TIMEOUT        0x1000          /* fail with ETIMEDOUT on timeout */
 
 #define RPC_IS_ASYNC(t)         ((t)->tk_flags & RPC_TASK_ASYNC)
 #define RPC_IS_SWAPPER(t)       ((t)->tk_flags & RPC_TASK_SWAPPER)
 #define RPC_DO_ROOTOVERRIDE(t)  ((t)->tk_flags & RPC_TASK_ROOTCREDS)
 #define RPC_ASSASSINATED(t)     ((t)->tk_flags & RPC_TASK_KILLED)
-#define RPC_IS_SOFT(t)          ((t)->tk_flags & RPC_TASK_SOFT)
+#define RPC_IS_SOFT(t)          ((t)->tk_flags & (RPC_TASK_SOFT|RPC_TASK_TIMEOUT))
 #define RPC_IS_SOFTCONN(t)      ((t)->tk_flags & RPC_TASK_SOFTCONN)
+#define RPC_WAS_SENT(t)         ((t)->tk_flags & RPC_TASK_SENT)
 
 #define RPC_TASK_RUNNING        0
 #define RPC_TASK_QUEUED         1
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 0e1855079fbb..605b0aa8d852 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -68,6 +68,7 @@ struct usbnet {
 #               define EVENT_RX_PAUSED  5
 #               define EVENT_DEV_WAKING 6
 #               define EVENT_DEV_ASLEEP 7
+#               define EVENT_DEV_OPEN   8
 };
 
 static inline struct usb_driver *driver_of(struct usb_interface *intf)
diff --git a/include/linux/v4l2-mediabus.h b/include/linux/v4l2-mediabus.h
index 7054a7a8065e..de5c15921025 100644
--- a/include/linux/v4l2-mediabus.h
+++ b/include/linux/v4l2-mediabus.h
@@ -47,7 +47,7 @@ enum v4l2_mbus_pixelcode {
         V4L2_MBUS_FMT_RGB565_2X8_BE = 0x1007,
         V4L2_MBUS_FMT_RGB565_2X8_LE = 0x1008,
 
-        /* YUV (including grey) - next is 0x2013 */
+        /* YUV (including grey) - next is 0x2014 */
         V4L2_MBUS_FMT_Y8_1X8 = 0x2001,
         V4L2_MBUS_FMT_UYVY8_1_5X8 = 0x2002,
         V4L2_MBUS_FMT_VYUY8_1_5X8 = 0x2003,
@@ -60,6 +60,7 @@ enum v4l2_mbus_pixelcode {
         V4L2_MBUS_FMT_Y10_1X10 = 0x200a,
         V4L2_MBUS_FMT_YUYV10_2X10 = 0x200b,
         V4L2_MBUS_FMT_YVYU10_2X10 = 0x200c,
+        V4L2_MBUS_FMT_Y12_1X12 = 0x2013,
         V4L2_MBUS_FMT_UYVY8_1X16 = 0x200f,
         V4L2_MBUS_FMT_VYUY8_1X16 = 0x2010,
         V4L2_MBUS_FMT_YUYV8_1X16 = 0x2011,
@@ -67,9 +68,11 @@ enum v4l2_mbus_pixelcode {
         V4L2_MBUS_FMT_YUYV10_1X20 = 0x200d,
         V4L2_MBUS_FMT_YVYU10_1X20 = 0x200e,
 
-        /* Bayer - next is 0x3013 */
+        /* Bayer - next is 0x3015 */
         V4L2_MBUS_FMT_SBGGR8_1X8 = 0x3001,
+        V4L2_MBUS_FMT_SGBRG8_1X8 = 0x3013,
         V4L2_MBUS_FMT_SGRBG8_1X8 = 0x3002,
+        V4L2_MBUS_FMT_SRGGB8_1X8 = 0x3014,
         V4L2_MBUS_FMT_SBGGR10_DPCM8_1X8 = 0x300b,
         V4L2_MBUS_FMT_SGBRG10_DPCM8_1X8 = 0x300c,
         V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8 = 0x3009,
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index aa6c393b7ae9..be82c8ead1af 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -308,6 +308,7 @@ struct v4l2_pix_format {
 #define V4L2_PIX_FMT_Y4      v4l2_fourcc('Y', '0', '4', ' ') /*  4  Greyscale     */
 #define V4L2_PIX_FMT_Y6      v4l2_fourcc('Y', '0', '6', ' ') /*  6  Greyscale     */
 #define V4L2_PIX_FMT_Y10     v4l2_fourcc('Y', '1', '0', ' ') /* 10  Greyscale     */
+#define V4L2_PIX_FMT_Y12     v4l2_fourcc('Y', '1', '2', ' ') /* 12  Greyscale     */
 #define V4L2_PIX_FMT_Y16     v4l2_fourcc('Y', '1', '6', ' ') /* 16  Greyscale     */
 
 /* Palette formats */
diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
index bd102cf509ac..d61febfb1668 100644
--- a/include/media/v4l2-device.h
+++ b/include/media/v4l2-device.h
@@ -163,7 +163,7 @@ v4l2_device_register_subdev_nodes(struct v4l2_device *v4l2_dev);
 ({                                                                      \
         struct v4l2_subdev *__sd;                                       \
         __v4l2_device_call_subdevs_until_err_p(v4l2_dev, __sd, cond, o, \
-                                                f, args...);            \
+                                                f , ##args);            \
 })
 
 /* Call the specified callback for all subdevs matching grp_id (if 0, then
diff --git a/init/Kconfig b/init/Kconfig
index 56240e724d9a..d886b1e9278e 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -924,14 +924,6 @@ menuconfig EXPERT
           environments which can tolerate a "non-standard" kernel.
           Only use this if you really know what you are doing.
 
-config EMBEDDED
-        bool "Embedded system"
-        select EXPERT
-        help
-          This option should be enabled if compiling the kernel for
-          an embedded system so certain expert options are available
-          for configuration.
-
 config UID16
         bool "Enable 16-bit UID system calls" if EXPERT
         depends on ARM || BLACKFIN || CRIS || FRV || H8300 || X86_32 || M68K || (S390 && !64BIT) || SUPERH || SPARC32 || (SPARC64 && COMPAT) || UML || (X86_64 && IA32_EMULATION)
@@ -1104,6 +1096,14 @@ config AIO
           by some high performance threaded applications. Disabling
           this option saves about 7k.
 
+config EMBEDDED
+        bool "Embedded system"
+        select EXPERT
+        help
+          This option should be enabled if compiling the kernel for
+          an embedded system so certain expert options are available
+          for configuration.
+
 config HAVE_PERF_EVENTS
         bool
         help
@@ -1226,6 +1226,7 @@ config SLAB
           per cpu and per node queues.
 
 config SLUB
+        depends on BROKEN || NUMA || !DISCONTIGMEM
         bool "SLUB (Unqueued Allocator)"
         help
            SLUB is a slab allocator that minimizes cache line usage
diff --git a/kernel/exit.c b/kernel/exit.c
index f5d2f63bae0b..8dd874181542 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1016,7 +1016,7 @@ NORET_TYPE void do_exit(long code)
         /*
          * FIXME: do that only when needed, using sched_exit tracepoint
          */
-        flush_ptrace_hw_breakpoint(tsk);
+        ptrace_put_breakpoints(tsk);
 
         exit_notify(tsk, group_dead);
 #ifdef CONFIG_NUMA
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 9017478c5d4c..87fdb3f8db14 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -81,7 +81,11 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
         }
 };
 
-static int hrtimer_clock_to_base_table[MAX_CLOCKS];
+static int hrtimer_clock_to_base_table[MAX_CLOCKS] = {
+        [CLOCK_REALTIME]        = HRTIMER_BASE_REALTIME,
+        [CLOCK_MONOTONIC]       = HRTIMER_BASE_MONOTONIC,
+        [CLOCK_BOOTTIME]        = HRTIMER_BASE_BOOTTIME,
+};
 
 static inline int hrtimer_clockid_to_base(clockid_t clock_id)
 {
@@ -1722,10 +1726,6 @@ static struct notifier_block __cpuinitdata hrtimers_nb = {
 
 void __init hrtimers_init(void)
 {
-        hrtimer_clock_to_base_table[CLOCK_REALTIME] = HRTIMER_BASE_REALTIME;
-        hrtimer_clock_to_base_table[CLOCK_MONOTONIC] = HRTIMER_BASE_MONOTONIC;
-        hrtimer_clock_to_base_table[CLOCK_BOOTTIME] = HRTIMER_BASE_BOOTTIME;
-
         hrtimer_cpu_notify(&hrtimers_nb, (unsigned long)CPU_UP_PREPARE,
                           (void *)(long)smp_processor_id());
         register_cpu_notifier(&hrtimers_nb);
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index dd201bd35103..834899f2500f 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -419,7 +419,7 @@ int show_interrupts(struct seq_file *p, void *v)
         } else {
                 seq_printf(p, " %8s", "None");
         }
-#ifdef CONFIG_GENIRC_IRQ_SHOW_LEVEL
+#ifdef CONFIG_GENERIC_IRQ_SHOW_LEVEL
         seq_printf(p, " %-8s", irqd_is_level_type(&desc->irq_data) ? "Level" : "Edge");
 #endif
         if (desc->name)
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 0fc1eed28d27..dc7ab65f3b36 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -22,6 +22,7 @@
 #include <linux/syscalls.h>
 #include <linux/uaccess.h>
 #include <linux/regset.h>
+#include <linux/hw_breakpoint.h>
 
 
 /*
@@ -879,3 +880,19 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
         return ret;
 }
 #endif  /* CONFIG_COMPAT */
+
+#ifdef CONFIG_HAVE_HW_BREAKPOINT
+int ptrace_get_breakpoints(struct task_struct *tsk)
+{
+        if (atomic_inc_not_zero(&tsk->ptrace_bp_refcnt))
+                return 0;
+
+        return -1;
+}
+
+void ptrace_put_breakpoints(struct task_struct *tsk)
+{
+        if (atomic_dec_and_test(&tsk->ptrace_bp_refcnt))
+                flush_ptrace_hw_breakpoint(tsk);
+}
+#endif /* CONFIG_HAVE_HW_BREAKPOINT */
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index e0e14ce0caab..ee9c921d7f21 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1110,6 +1110,7 @@ tracing_generic_entry_update(struct trace_entry *entry, unsigned long flags,
 
         entry->preempt_count            = pc & 0xff;
         entry->pid                      = (tsk) ? tsk->pid : 0;
+        entry->padding                  = 0;
         entry->flags =
 #ifdef CONFIG_TRACE_IRQFLAGS_SUPPORT
                 (irqs_disabled_flags(flags) ? TRACE_FLAG_IRQS_OFF : 0) |
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index e88f74fe1d4c..2fe110341359 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -116,6 +116,7 @@ static int trace_define_common_fields(void)
         __common_field(unsigned char, flags);
         __common_field(unsigned char, preempt_count);
         __common_field(int, pid);
+        __common_field(int, padding);
 
         return ret;
 }
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 140dce750450..14733d4d156b 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -430,9 +430,12 @@ static int watchdog_enable(int cpu)
                 p = kthread_create(watchdog, (void *)(unsigned long)cpu, "watchdog/%d", cpu);
                 if (IS_ERR(p)) {
                         printk(KERN_ERR "softlockup watchdog for %i failed\n", cpu);
-                        if (!err)
+                        if (!err) {
                                 /* if hardlockup hasn't already set this */
                                 err = PTR_ERR(p);
+                                /* and disable the perf event */
+                                watchdog_nmi_disable(cpu);
+                        }
                         goto out;
                 }
                 kthread_bind(p, cpu);
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 8859a41806dd..e3378e8d3a5c 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1291,8 +1291,14 @@ __acquires(&gcwq->lock)
                         return true;
                 spin_unlock_irq(&gcwq->lock);
 
-                /* CPU has come up in between, retry migration */
+                /*
+                 * We've raced with CPU hot[un]plug.  Give it a breather
+                 * and retry migration.  cond_resched() is required here;
+                 * otherwise, we might deadlock against cpu_stop trying to
+                 * bring down the CPU on non-preemptive kernel.
+                 */
                 cpu_relax();
+                cond_resched();
         }
 }
 
diff --git a/lib/flex_array.c b/lib/flex_array.c
index c0ea40ba2082..854b57bd7d9d 100644
--- a/lib/flex_array.c
+++ b/lib/flex_array.c
@@ -232,10 +232,10 @@ EXPORT_SYMBOL(flex_array_clear);
 
 /**
  * flex_array_prealloc - guarantee that array space exists
- * @fa:         the flex array for which to preallocate parts
- * @start:      index of first array element for which space is allocated
- * @end:        index of last (inclusive) element for which space is allocated
- * @flags:      page allocation flags
+ * @fa:                 the flex array for which to preallocate parts
+ * @start:              index of first array element for which space is allocated
+ * @nr_elements:        number of elements for which space is allocated
+ * @flags:              page allocation flags
  *
  * This will guarantee that no future calls to flex_array_put()
  * will allocate memory.  It can be used if you are expecting to
@@ -245,14 +245,24 @@ EXPORT_SYMBOL(flex_array_clear);
  * Locking must be provided by the caller.
  */
 int flex_array_prealloc(struct flex_array *fa, unsigned int start,
-                        unsigned int end, gfp_t flags)
+                        unsigned int nr_elements, gfp_t flags)
 {
         int start_part;
         int end_part;
         int part_nr;
+        unsigned int end;
         struct flex_array_part *part;
 
-        if (start >= fa->total_nr_elements || end >= fa->total_nr_elements)
+        if (!start && !nr_elements)
+                return 0;
+        if (start >= fa->total_nr_elements)
+                return -ENOSPC;
+        if (!nr_elements)
+                return 0;
+
+        end = start + nr_elements - 1;
+
+        if (end >= fa->total_nr_elements)
                 return -ENOSPC;
         if (elements_fit_in_base(fa))
                 return 0;
@@ -343,6 +353,8 @@ int flex_array_shrink(struct flex_array *fa)
         int part_nr;
         int ret = 0;
 
+        if (!fa->total_nr_elements)
+                return 0;
         if (elements_fit_in_base(fa))
                 return ret;
         for (part_nr = 0; part_nr < FLEX_ARRAY_NR_BASE_PTRS; part_nr++) {
diff --git a/lib/xz/xz_dec_lzma2.c b/lib/xz/xz_dec_lzma2.c
index ea5fa4fe9d67..a6cdc969ea42 100644
--- a/lib/xz/xz_dec_lzma2.c
+++ b/lib/xz/xz_dec_lzma2.c
@@ -969,6 +969,9 @@ XZ_EXTERN enum xz_ret xz_dec_lzma2_run(struct xz_dec_lzma2 *s,
                          */
                         tmp = b->in[b->in_pos++];
 
+                        if (tmp == 0x00)
+                                return XZ_STREAM_END;
+
                         if (tmp >= 0xE0 || tmp == 0x01) {
                                 s->lzma2.need_props = true;
                                 s->lzma2.need_dict_reset = false;
@@ -1001,9 +1004,6 @@ XZ_EXTERN enum xz_ret xz_dec_lzma2_run(struct xz_dec_lzma2 *s,
                                                 lzma_reset(s);
                                 }
                         } else {
-                                if (tmp == 0x00)
-                                        return XZ_STREAM_END;
-
                                 if (tmp > 0x02)
                                         return XZ_DATA_ERROR;
 
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 470dcda10add..83326ad66d9b 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1408,6 +1408,9 @@ out:
         return ret;
 }
 
+#define VM_NO_THP (VM_SPECIAL|VM_INSERTPAGE|VM_MIXEDMAP|VM_SAO| \
+                   VM_HUGETLB|VM_SHARED|VM_MAYSHARE)
+
 int hugepage_madvise(struct vm_area_struct *vma,
                      unsigned long *vm_flags, int advice)
 {
@@ -1416,11 +1419,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                 /*
                  * Be somewhat over-protective like KSM for now!
                  */
-                if (*vm_flags & (VM_HUGEPAGE |
-                                 VM_SHARED   | VM_MAYSHARE   |
-                                 VM_PFNMAP   | VM_IO      | VM_DONTEXPAND |
-                                 VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE |
-                                 VM_MIXEDMAP | VM_SAO))
+                if (*vm_flags & (VM_HUGEPAGE | VM_NO_THP))
                         return -EINVAL;
                 *vm_flags &= ~VM_NOHUGEPAGE;
                 *vm_flags |= VM_HUGEPAGE;
@@ -1436,11 +1435,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                 /*
                  * Be somewhat over-protective like KSM for now!
                  */
-                if (*vm_flags & (VM_NOHUGEPAGE |
-                                 VM_SHARED   | VM_MAYSHARE   |
-                                 VM_PFNMAP   | VM_IO      | VM_DONTEXPAND |
-                                 VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE |
-                                 VM_MIXEDMAP | VM_SAO))
+                if (*vm_flags & (VM_NOHUGEPAGE | VM_NO_THP))
                         return -EINVAL;
                 *vm_flags &= ~VM_HUGEPAGE;
                 *vm_flags |= VM_NOHUGEPAGE;
@@ -1574,10 +1569,14 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
                  * page fault if needed.
                  */
                 return 0;
-        if (vma->vm_file || vma->vm_ops)
+        if (vma->vm_ops)
                 /* khugepaged not yet working on file or special mappings */
                 return 0;
-        VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
+        /*
+         * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
+         * true too, verify it here.
+         */
+        VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
         hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
         hend = vma->vm_end & HPAGE_PMD_MASK;
         if (hstart < hend)
@@ -1828,12 +1827,15 @@ static void collapse_huge_page(struct mm_struct *mm,
             (vma->vm_flags & VM_NOHUGEPAGE))
                 goto out;
 
-        /* VM_PFNMAP vmas may have vm_ops null but vm_file set */
-        if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
+        if (!vma->anon_vma || vma->vm_ops)
                 goto out;
         if (is_vma_temporary_stack(vma))
                 goto out;
-        VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
+        /*
+         * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
+         * true too, verify it here.
+         */
+        VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
 
         pgd = pgd_offset(mm, address);
         if (!pgd_present(*pgd))
@@ -2066,13 +2068,16 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages,
                         progress++;
                         continue;
                 }
-                /* VM_PFNMAP vmas may have vm_ops null but vm_file set */
-                if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
+                if (!vma->anon_vma || vma->vm_ops)
                         goto skip;
                 if (is_vma_temporary_stack(vma))
                         goto skip;
-
-                VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
+                /*
+                 * If is_pfn_mapping() is true is_learn_pfn_mapping()
+                 * must be true too, verify it here.
+                 */
+                VM_BUG_ON(is_linear_pfn_mapping(vma) ||
+                          vma->vm_flags & VM_NO_THP);
 
                 hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
                 hend = vma->vm_end & HPAGE_PMD_MASK;
diff --git a/mm/memory.c b/mm/memory.c
index ce22a250926f..61e66f026563 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1359,7 +1359,7 @@ split_fallthrough:
                  */
                 mark_page_accessed(page);
         }
-        if (flags & FOLL_MLOCK) {
+        if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
                 /*
                  * The preliminary mapping check is mainly to avoid the
                  * pointless overhead of lock_page on the ZERO_PAGE
@@ -1412,9 +1412,8 @@ no_page_table:
 
 static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
 {
-        return (vma->vm_flags & VM_GROWSDOWN) &&
-                (vma->vm_start == addr) &&
-                !vma_stack_continue(vma->vm_prev, addr);
+        return stack_guard_page_start(vma, addr) ||
+               stack_guard_page_end(vma, addr+PAGE_SIZE);
 }
 
 /**
@@ -1551,13 +1550,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                         continue;
                 }
 
-                /*
-                 * If we don't actually want the page itself,
-                 * and it's the stack guard page, just skip it.
-                 */
-                if (!pages && stack_guard_page(vma, start))
-                        goto next_page;
-
                 do {
                         struct page *page;
                         unsigned int foll_flags = gup_flags;
@@ -1574,6 +1566,11 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                                 int ret;
                                 unsigned int fault_flags = 0;
 
+                                /* For mlock, just skip the stack guard page. */
+                                if (foll_flags & FOLL_MLOCK) {
+                                        if (stack_guard_page(vma, start))
+                                                goto next_page;
+                                }
                                 if (foll_flags & FOLL_WRITE)
                                         fault_flags |= FAULT_FLAG_WRITE;
                                 if (nonblocking)
@@ -3396,7 +3393,7 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
          * run pte_offset_map on the pmd, if an huge pmd could
          * materialize from under us from a different thread.
          */
-        if (unlikely(__pte_alloc(mm, vma, pmd, address)))
+        if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
                 return VM_FAULT_OOM;
         /* if an huge pmd materialized from under us just retry later */
         if (unlikely(pmd_trans_huge(*pmd)))
diff --git a/mm/mlock.c b/mm/mlock.c
index 6b55e3efe0df..516b2c2ddd5a 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -162,7 +162,7 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
         VM_BUG_ON(end   > vma->vm_end);
         VM_BUG_ON(!rwsem_is_locked(&mm->mmap_sem));
 
-        gup_flags = FOLL_TOUCH;
+        gup_flags = FOLL_TOUCH | FOLL_MLOCK;
         /*
          * We want to touch writable mappings with a write fault in order
          * to break COW, except for shared mappings because these don't COW
@@ -178,9 +178,6 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
         if (vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC))
                 gup_flags |= FOLL_FORCE;
 
-        if (vma->vm_flags & VM_LOCKED)
-                gup_flags |= FOLL_MLOCK;
-
         return __get_user_pages(current, mm, addr, nr_pages, gup_flags,
                                 NULL, NULL, nonblocking);
 }
diff --git a/mm/mmap.c b/mm/mmap.c
index e27e0cf0de03..772140c53ab1 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1767,10 +1767,13 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
                 size = address - vma->vm_start;
                 grow = (address - vma->vm_end) >> PAGE_SHIFT;
 
-                error = acct_stack_growth(vma, size, grow);
-                if (!error) {
-                        vma->vm_end = address;
-                        perf_event_mmap(vma);
+                error = -ENOMEM;
+                if (vma->vm_pgoff + (size >> PAGE_SHIFT) >= vma->vm_pgoff) {
+                        error = acct_stack_growth(vma, size, grow);
+                        if (!error) {
+                                vma->vm_end = address;
+                                perf_event_mmap(vma);
+                        }
                 }
         }
         vma_unlock_anon_vma(vma);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 83fb72c108b7..f52e85c80e8d 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -172,10 +172,13 @@ unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
 
         /*
          * The baseline for the badness score is the proportion of RAM that each
-         * task's rss and swap space use.
+         * task's rss, pagetable and swap space use.
          */
-        points = (get_mm_rss(p->mm) + get_mm_counter(p->mm, MM_SWAPENTS)) * 1000 /
-                        totalpages;
+        points = get_mm_rss(p->mm) + p->mm->nr_ptes;
+        points += get_mm_counter(p->mm, MM_SWAPENTS);
+
+        points *= 1000;
+        points /= totalpages;
         task_unlock(p);
 
         /*
diff --git a/mm/slub.c b/mm/slub.c
index 94d2a33a866e..9d2e5e46bf09 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1940,7 +1940,7 @@ redo:
                  * Since this is without lock semantics the protection is only against
                  * code executing on this cpu *not* from access by other cpus.
                  */
-                if (unlikely(!this_cpu_cmpxchg_double(
+                if (unlikely(!irqsafe_cpu_cmpxchg_double(
                                 s->cpu_slab->freelist, s->cpu_slab->tid,
                                 object, tid,
                                 get_freepointer(s, object), next_tid(tid)))) {
@@ -2145,7 +2145,7 @@ redo:
                 set_freepointer(s, object, c->freelist);
 
 #ifdef CONFIG_CMPXCHG_LOCAL
-                if (unlikely(!this_cpu_cmpxchg_double(
+                if (unlikely(!irqsafe_cpu_cmpxchg_double(
                                 s->cpu_slab->freelist, s->cpu_slab->tid,
                                 c->freelist, tid,
                                 object, next_tid(tid)))) {
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c83f618282f7..b5a8afc2be33 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -587,10 +587,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         hci_req_cancel(hdev, ENODEV);
         hci_req_lock(hdev);
 
-        /* Stop timer, it might be running */
-        del_timer_sync(&hdev->cmd_timer);
-
         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
+                del_timer_sync(&hdev->cmd_timer);
                 hci_req_unlock(hdev);
                 return 0;
         }
@@ -629,6 +627,7 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 
         /* Drop last sent command */
         if (hdev->sent_cmd) {
+                del_timer_sync(&hdev->cmd_timer);
                 kfree_skb(hdev->sent_cmd);
                 hdev->sent_cmd = NULL;
         }
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index cebe7588469f..b2570159a044 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2387,8 +2387,6 @@ static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *s
         if (!conn)
                 goto unlock;
 
-        hci_conn_hold(conn);
-
         conn->remote_cap = ev->capability;
         conn->remote_oob = ev->oob_data;
         conn->remote_auth = ev->authentication;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index ca27f3a41536..2c8dd4494c63 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1051,6 +1051,7 @@ static void l2cap_retransmit_one_frame(struct sock *sk, u8 tx_seq)
         tx_skb = skb_clone(skb, GFP_ATOMIC);
         bt_cb(skb)->retries++;
         control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
+        control &= L2CAP_CTRL_SAR;
 
         if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
                 control |= L2CAP_CTRL_FINAL;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 42fdffd1d76c..94954c74f6ae 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -369,6 +369,15 @@ static void __sco_sock_close(struct sock *sk)
 
         case BT_CONNECTED:
         case BT_CONFIG:
+                if (sco_pi(sk)->conn) {
+                        sk->sk_state = BT_DISCONN;
+                        sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
+                        hci_conn_put(sco_pi(sk)->conn->hcon);
+                        sco_pi(sk)->conn = NULL;
+                } else
+                        sco_chan_del(sk, ECONNRESET);
+                break;
+
         case BT_CONNECT:
         case BT_DISCONN:
                 sco_chan_del(sk, ECONNRESET);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index e2160792e1bc..0c7badad62af 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -164,7 +164,7 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
                         goto drop;
 
                 /* If STP is turned off, then forward */
-                if (p->br->stp_enabled == BR_NO_STP)
+                if (p->br->stp_enabled == BR_NO_STP && dest[5] == 0)
                         goto forward;
 
                 if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 57b1aed79014..8a6a05e7c3c8 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1427,9 +1427,14 @@ static int bcm_init(struct sock *sk)
 static int bcm_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
-        struct bcm_sock *bo = bcm_sk(sk);
+        struct bcm_sock *bo;
         struct bcm_op *op, *next;
 
+        if (sk == NULL)
+                return 0;
+
+        bo = bcm_sk(sk);
+
         /* remove bcm_ops, timer, rx_unregister(), etc. */
 
         unregister_netdevice_notifier(&bo->notifier);
diff --git a/net/can/raw.c b/net/can/raw.c
index 649acfa7c70a..0eb39a7fdf64 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -305,7 +305,12 @@ static int raw_init(struct sock *sk)
 static int raw_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
-        struct raw_sock *ro = raw_sk(sk);
+        struct raw_sock *ro;
+
+        if (!sk)
+                return 0;
+
+        ro = raw_sk(sk);
 
         unregister_netdevice_notifier(&ro->notifier);
 
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 05f357828a2f..e15a82ccc05f 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2267,6 +2267,19 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
         m->more_to_follow = false;
         m->pool = NULL;
 
+        /* middle */
+        m->middle = NULL;
+
+        /* data */
+        m->nr_pages = 0;
+        m->page_alignment = 0;
+        m->pages = NULL;
+        m->pagelist = NULL;
+        m->bio = NULL;
+        m->bio_iter = NULL;
+        m->bio_seg = 0;
+        m->trail = NULL;
+
         /* front */
         if (front_len) {
                 if (front_len > PAGE_CACHE_SIZE) {
@@ -2286,19 +2299,6 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
         }
         m->front.iov_len = front_len;
 
-        /* middle */
-        m->middle = NULL;
-
-        /* data */
-        m->nr_pages = 0;
-        m->page_alignment = 0;
-        m->pages = NULL;
-        m->pagelist = NULL;
-        m->bio = NULL;
-        m->bio_iter = NULL;
-        m->bio_seg = 0;
-        m->trail = NULL;
-
         dout("ceph_msg_new %p front %d\n", m, front_len);
         return m;
 
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 5a80f41c0cba..6b5dda1cb5df 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -470,8 +470,8 @@ struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
                                          snapc, ops,
                                          use_mempool,
                                          GFP_NOFS, NULL, NULL);
-        if (IS_ERR(req))
-                return req;
+        if (!req)
+                return NULL;
 
         /* calculate max write size */
         calc_layout(osdc, vino, layout, off, plen, req, ops);
diff --git a/net/core/dev.c b/net/core/dev.c
index c2ac599fa0f6..856b6ee9a1d5 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4773,7 +4773,7 @@ static int dev_ifsioc_locked(struct net *net, struct ifreq *ifr, unsigned int cm
                  * is never reached
                  */
                 WARN_ON(1);
-                err = -EINVAL;
+                err = -ENOTTY;
                 break;
 
         }
@@ -5041,7 +5041,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                 /* Set the per device memory buffer space.
                  * Not applicable in our case */
         case SIOCSIFLINK:
-                return -EINVAL;
+                return -ENOTTY;
 
         /*
          *      Unknown or private ioctl.
@@ -5062,7 +5062,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                 /* Take care of Wireless Extensions */
                 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)
                         return wext_handle_ioctl(net, &ifr, cmd, arg);
-                return -EINVAL;
+                return -ENOTTY;
         }
 }
 
diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
index 87bb5f4de0e8..c53ded2a98df 100644
--- a/net/dsa/Kconfig
+++ b/net/dsa/Kconfig
@@ -41,12 +41,12 @@ config NET_DSA_MV88E6XXX_NEED_PPU
         default n
 
 config NET_DSA_MV88E6131
-        bool "Marvell 88E6095/6095F/6131 ethernet switch chip support"
+        bool "Marvell 88E6085/6095/6095F/6131 ethernet switch chip support"
         select NET_DSA_MV88E6XXX
         select NET_DSA_MV88E6XXX_NEED_PPU
         select NET_DSA_TAG_DSA
         ---help---
-          This enables support for the Marvell 88E6095/6095F/6131
+          This enables support for the Marvell 88E6085/6095/6095F/6131
           ethernet switch chips.
 
 config NET_DSA_MV88E6123_61_65
diff --git a/net/dsa/mv88e6131.c b/net/dsa/mv88e6131.c
index 3da418894efc..45f7411e90ba 100644
--- a/net/dsa/mv88e6131.c
+++ b/net/dsa/mv88e6131.c
@@ -207,8 +207,15 @@ static int mv88e6131_setup_port(struct dsa_switch *ds, int p)
          * mode, but do not enable forwarding of unknown unicasts.
          */
         val = 0x0433;
-        if (p == dsa_upstream_port(ds))
+        if (p == dsa_upstream_port(ds)) {
                 val |= 0x0104;
+                /*
+                 * On 6085, unknown multicast forward is controlled
+                 * here rather than in Port Control 2 register.
+                 */
+                if (ps->id == ID_6085)
+                        val |= 0x0008;
+        }
         if (ds->dsa_port_mask & (1 << p))
                 val |= 0x0100;
         REG_WRITE(addr, 0x04, val);
@@ -251,10 +258,19 @@ static int mv88e6131_setup_port(struct dsa_switch *ds, int p)
          * If this is the upstream port for this switch, enable
          * forwarding of unknown multicast addresses.
          */
-        val = 0x0080 | dsa_upstream_port(ds);
-        if (p == dsa_upstream_port(ds))
-                val |= 0x0040;
-        REG_WRITE(addr, 0x08, val);
+        if (ps->id == ID_6085)
+                /*
+                 * on 6085, bits 3:0 are reserved, bit 6 control ARP
+                 * mirroring, and multicast forward is handled in
+                 * Port Control register.
+                 */
+                REG_WRITE(addr, 0x08, 0x0080);
+        else {
+                val = 0x0080 | dsa_upstream_port(ds);
+                if (p == dsa_upstream_port(ds))
+                        val |= 0x0040;
+                REG_WRITE(addr, 0x08, val);
+        }
 
         /*
          * Rate Control: disable ingress rate limiting.
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 5345b0bee6df..cd9ca0811cfa 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1680,7 +1680,7 @@ static void __devinet_sysctl_unregister(struct ipv4_devconf *cnf)
                 return;
 
         cnf->sysctl = NULL;
-        unregister_sysctl_table(t->sysctl_header);
+        unregister_net_sysctl_table(t->sysctl_header);
         kfree(t->dev_name);
         kfree(t);
 }
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index e9013d6c1f51..5fe9b8b41df3 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1978,9 +1978,6 @@ struct fib_table *fib_trie_table(u32 id)
         t = (struct trie *) tb->tb_data;
         memset(t, 0, sizeof(*t));
 
-        if (id == RT_TABLE_LOCAL)
-                pr_info("IPv4 FIB: Using LC-trie version %s\n", VERSION);
-
         return tb;
 }
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index c1acf69858fd..99e6e4bb1c72 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2690,6 +2690,12 @@ static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
 }
 
+static u32 *ipv4_rt_blackhole_cow_metrics(struct dst_entry *dst,
+                                          unsigned long old)
+{
+        return NULL;
+}
+
 static struct dst_ops ipv4_dst_blackhole_ops = {
         .family                 =       AF_INET,
         .protocol               =       cpu_to_be16(ETH_P_IP),
@@ -2698,6 +2704,7 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
         .default_mtu            =       ipv4_blackhole_default_mtu,
         .default_advmss         =       ipv4_default_advmss,
         .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
+        .cow_metrics            =       ipv4_rt_blackhole_cow_metrics,
 };
 
 struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 1493534116df..a7bda0757053 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4537,7 +4537,7 @@ static void __addrconf_sysctl_unregister(struct ipv6_devconf *p)
 
         t = p->sysctl;
         p->sysctl = NULL;
-        unregister_sysctl_table(t->sysctl_header);
+        unregister_net_sysctl_table(t->sysctl_header);
         kfree(t->dev_name);
         kfree(t);
 }
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 5aa8ec88f194..59dccfbb5b11 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -371,7 +371,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
         iv = esp_tmp_iv(aead, tmp, seqhilen);
         req = esp_tmp_req(aead, iv);
         asg = esp_req_sg(aead, req);
-        sg = asg + 1;
+        sg = asg + sglists;
 
         skb->ip_summed = CHECKSUM_NONE;
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 843406f14d7b..fd0eec6f88c6 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -153,6 +153,12 @@ static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
 }
 
+static u32 *ip6_rt_blackhole_cow_metrics(struct dst_entry *dst,
+                                         unsigned long old)
+{
+        return NULL;
+}
+
 static struct dst_ops ip6_dst_blackhole_ops = {
         .family                 =       AF_INET6,
         .protocol               =       cpu_to_be16(ETH_P_IPV6),
@@ -161,6 +167,7 @@ static struct dst_ops ip6_dst_blackhole_ops = {
         .default_mtu            =       ip6_blackhole_default_mtu,
         .default_advmss         =       ip6_default_advmss,
         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
+        .cow_metrics            =       ip6_rt_blackhole_cow_metrics,
 };
 
 static const u32 ip6_template_metrics[RTAX_MAX] = {
@@ -2012,7 +2019,6 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         rt->dst.output = ip6_output;
         rt->rt6i_dev = net->loopback_dev;
         rt->rt6i_idev = idev;
-        dst_metric_set(&rt->dst, RTAX_HOPLIMIT, -1);
         rt->dst.obsolete = -1;
 
         rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 15c37746845e..9e305d74b3d4 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1335,7 +1335,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
         skb->ip_summed = CHECKSUM_NONE;
 
         /* Check if there is enough headroom to insert fragment header. */
-        if ((skb_headroom(skb) < frag_hdr_sz) &&
+        if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
             pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
                 goto out;
 
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index fce9bd3bd3fe..5c04f3e42704 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -667,7 +667,7 @@ MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
 MODULE_DESCRIPTION("L2TP over IP");
 MODULE_VERSION("1.0");
 
-/* Use the value of SOCK_DGRAM (2) directory, because __stringify does't like
+/* Use the value of SOCK_DGRAM (2) directory, because __stringify doesn't like
  * enums
  */
 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 2, IPPROTO_L2TP);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 334213571ad0..44049733c4ea 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1504,6 +1504,8 @@ int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
         enum ieee80211_smps_mode old_req;
         int err;
 
+        lockdep_assert_held(&sdata->u.mgd.mtx);
+
         old_req = sdata->u.mgd.req_smps;
         sdata->u.mgd.req_smps = smps_mode;
 
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index dacace6b1393..9ea7c0d0103f 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -177,9 +177,9 @@ static int ieee80211_set_smps(struct ieee80211_sub_if_data *sdata,
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EOPNOTSUPP;
 
-        mutex_lock(&local->iflist_mtx);
+        mutex_lock(&sdata->u.mgd.mtx);
         err = __ieee80211_request_smps(sdata, smps_mode);
-        mutex_unlock(&local->iflist_mtx);
+        mutex_unlock(&sdata->u.mgd.mtx);
 
         return err;
 }
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index dff27d5e22fd..61b1f5ada96a 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -554,7 +554,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
         memcpy(&ssf->ssf_info, &chunk->sinfo, sizeof(struct sctp_sndrcvinfo));
 
         /* Per TSVWG discussion with Randy. Allow the application to
-         * resemble a fragmented message.
+         * reassemble a fragmented message.
          */
         ssf->ssf_info.sinfo_flags = chunk->chunk_hdr->flags;
 
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index 8873fd8ddacd..b2198e65d8bb 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -18,14 +18,13 @@ config SUNRPC_XPRT_RDMA
           If unsure, say N.
 
 config RPCSEC_GSS_KRB5
-        tristate
+        tristate "Secure RPC: Kerberos V mechanism"
         depends on SUNRPC && CRYPTO
-        prompt "Secure RPC: Kerberos V mechanism" if !(NFS_V4 || NFSD_V4)
+        depends on CRYPTO_MD5 && CRYPTO_DES && CRYPTO_CBC && CRYPTO_CTS
+        depends on CRYPTO_ECB && CRYPTO_HMAC && CRYPTO_SHA1 && CRYPTO_AES
+        depends on CRYPTO_ARC4
         default y
         select SUNRPC_GSS
-        select CRYPTO_MD5
-        select CRYPTO_DES
-        select CRYPTO_CBC
         help
           Choose Y here to enable Secure RPC using the Kerberos version 5
           GSS-API mechanism (RFC 1964).
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index f3914d0c5079..339ba64cce1e 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -520,7 +520,7 @@ gss_refresh_upcall(struct rpc_task *task)
                 warn_gssd();
                 task->tk_timeout = 15*HZ;
                 rpc_sleep_on(&pipe_version_rpc_waitqueue, task, NULL);
-                return 0;
+                return -EAGAIN;
         }
         if (IS_ERR(gss_msg)) {
                 err = PTR_ERR(gss_msg);
@@ -563,10 +563,12 @@ retry:
         if (PTR_ERR(gss_msg) == -EAGAIN) {
                 err = wait_event_interruptible_timeout(pipe_version_waitqueue,
                                 pipe_version >= 0, 15*HZ);
+                if (pipe_version < 0) {
+                        warn_gssd();
+                        err = -EACCES;
+                }
                 if (err)
                         goto out;
-                if (pipe_version < 0)
-                        warn_gssd();
                 goto retry;
         }
         if (IS_ERR(gss_msg)) {
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index e7a96e478f63..8d83f9d48713 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1508,7 +1508,10 @@ call_timeout(struct rpc_task *task)
                 if (clnt->cl_chatty)
                         printk(KERN_NOTICE "%s: server %s not responding, timed out\n",
                                 clnt->cl_protname, clnt->cl_server);
-                rpc_exit(task, -EIO);
+                if (task->tk_flags & RPC_TASK_TIMEOUT)
+                        rpc_exit(task, -ETIMEDOUT);
+                else
+                        rpc_exit(task, -EIO);
                 return;
         }
 
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 9494c3767356..ce5eb68a9664 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -906,6 +906,7 @@ void xprt_transmit(struct rpc_task *task)
         }
 
         dprintk("RPC: %5u xmit complete\n", task->tk_pid);
+        task->tk_flags |= RPC_TASK_SENT;
         spin_lock_bh(&xprt->transport_lock);
 
         xprt->ops->set_retrans_timeout(task);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 3a43a8304768..b1d75beb7e20 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -524,6 +524,8 @@ static int unix_dgram_connect(struct socket *, struct sockaddr *,
                               int, int);
 static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
                                   struct msghdr *, size_t);
+static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
+                                  struct msghdr *, size_t, int);
 
 static const struct proto_ops unix_stream_ops = {
         .family =       PF_UNIX,
@@ -583,7 +585,7 @@ static const struct proto_ops unix_seqpacket_ops = {
         .setsockopt =   sock_no_setsockopt,
         .getsockopt =   sock_no_getsockopt,
         .sendmsg =      unix_seqpacket_sendmsg,
-        .recvmsg =      unix_dgram_recvmsg,
+        .recvmsg =      unix_seqpacket_recvmsg,
         .mmap =         sock_no_mmap,
         .sendpage =     sock_no_sendpage,
 };
@@ -1699,6 +1701,18 @@ static int unix_seqpacket_sendmsg(struct kiocb *kiocb, struct socket *sock,
         return unix_dgram_sendmsg(kiocb, sock, msg, len);
 }
 
+static int unix_seqpacket_recvmsg(struct kiocb *iocb, struct socket *sock,
+                              struct msghdr *msg, size_t size,
+                              int flags)
+{
+        struct sock *sk = sock->sk;
+
+        if (sk->sk_state != TCP_ESTABLISHED)
+                return -ENOTCONN;
+
+        return unix_dgram_recvmsg(iocb, sock, msg, size, flags);
+}
+
 static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
 {
         struct unix_sock *u = unix_sk(sk);
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index f218385950ca..e8a781422feb 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -532,7 +532,7 @@ int xfrm_init_replay(struct xfrm_state *x)
 
         if (replay_esn) {
                 if (replay_esn->replay_window >
-                    replay_esn->bmp_len * sizeof(__u32))
+                    replay_esn->bmp_len * sizeof(__u32) * 8)
                         return -EINVAL;
 
         if ((x->props.flags & XFRM_STATE_ESN) && x->replay_esn)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 5d1d60d3ca83..c658cb3bc7c3 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -124,6 +124,9 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
 {
         struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
 
+        if ((p->flags & XFRM_STATE_ESN) && !rt)
+                return -EINVAL;
+
         if (!rt)
                 return 0;
 
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f7cf0ea6faea..8fb248843009 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1578,7 +1578,8 @@ static int may_create(struct inode *dir,
                 return rc;
 
         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
-                rc = security_transition_sid(sid, dsec->sid, tclass, NULL, &newsid);
+                rc = security_transition_sid(sid, dsec->sid, tclass,
+                                             &dentry->d_name, &newsid);
                 if (rc)
                         return rc;
         }
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index e7b850ad57ee..e6e7ce0d3d55 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -502,7 +502,7 @@ static int policydb_index(struct policydb *p)
                 goto out;
 
         rc = flex_array_prealloc(p->type_val_to_struct_array, 0,
-                                 p->p_types.nprim - 1, GFP_KERNEL | __GFP_ZERO);
+                                 p->p_types.nprim, GFP_KERNEL | __GFP_ZERO);
         if (rc)
                 goto out;
 
@@ -519,7 +519,7 @@ static int policydb_index(struct policydb *p)
                         goto out;
 
                 rc = flex_array_prealloc(p->sym_val_to_name[i],
-                                         0, p->symtab[i].nprim - 1,
+                                         0, p->symtab[i].nprim,
                                          GFP_KERNEL | __GFP_ZERO);
                 if (rc)
                         goto out;
@@ -2375,7 +2375,7 @@ int policydb_read(struct policydb *p, void *fp)
                 goto bad;
 
         /* preallocate so we don't have to worry about the put ever failing */
-        rc = flex_array_prealloc(p->type_attr_map_array, 0, p->p_types.nprim - 1,
+        rc = flex_array_prealloc(p->type_attr_map_array, 0, p->p_types.nprim,
                                  GFP_KERNEL | __GFP_ZERO);
         if (rc)
                 goto bad;
diff --git a/sound/aoa/codecs/tas.c b/sound/aoa/codecs/tas.c
index 58804c7acfcf..fd2188c3df2b 100644
--- a/sound/aoa/codecs/tas.c
+++ b/sound/aoa/codecs/tas.c
@@ -170,7 +170,7 @@ static void tas_set_volume(struct tas *tas)
         /* analysing the volume and mixer tables shows
          * that they are similar enough when we shift
          * the mixer table down by 4 bits. The error
-         * is minuscule, in just one item the error
+         * is miniscule, in just one item the error
          * is 1, at a value of 0x07f17b (mixer table
          * value is 0x07f17a) */
         tmp = tas_gaintable[left];
diff --git a/sound/pci/au88x0/au88x0_pcm.c b/sound/pci/au88x0/au88x0_pcm.c
index 33f0ba5559a7..62e959120c44 100644
--- a/sound/pci/au88x0/au88x0_pcm.c
+++ b/sound/pci/au88x0/au88x0_pcm.c
@@ -44,10 +44,10 @@ static struct snd_pcm_hardware snd_vortex_playback_hw_adb = {
         .channels_min = 1,
         .channels_max = 2,
         .buffer_bytes_max = 0x10000,
-        .period_bytes_min = 0x1,
+        .period_bytes_min = 0x20,
         .period_bytes_max = 0x1000,
         .periods_min = 2,
-        .periods_max = 32,
+        .periods_max = 1024,
 };
 
 #ifndef CHIP_AU8820
@@ -140,6 +140,9 @@ static int snd_vortex_pcm_open(struct snd_pcm_substream *substream)
                                         SNDRV_PCM_HW_PARAM_PERIOD_BYTES)) < 0)
                 return err;
 
+        snd_pcm_hw_constraint_step(runtime, 0,
+                                        SNDRV_PCM_HW_PARAM_BUFFER_BYTES, 64);
+
         if (VORTEX_PCM_TYPE(substream->pcm) != VORTEX_PCM_WT) {
 #ifndef CHIP_AU8820
                 if (VORTEX_PCM_TYPE(substream->pcm) == VORTEX_PCM_A3D) {
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index d3bd2c10180f..c82979a8cd09 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1704,11 +1704,11 @@ static void alc_apply_fixup(struct hda_codec *codec, int action)
                                    codec->chip_name, fix->type);
                         break;
                 }
-                if (!fix[id].chained)
+                if (!fix->chained)
                         break;
                 if (++depth > 10)
                         break;
-                id = fix[id].chain_id;
+                id = fix->chain_id;
         }
 }
 
@@ -5645,6 +5645,7 @@ static void fillup_priv_adc_nids(struct hda_codec *codec, hda_nid_t *nids,
 static struct snd_pci_quirk beep_white_list[] = {
         SND_PCI_QUIRK(0x1043, 0x829f, "ASUS", 1),
         SND_PCI_QUIRK(0x1043, 0x83ce, "EeePC", 1),
+        SND_PCI_QUIRK(0x1043, 0x831a, "EeePC", 1),
         SND_PCI_QUIRK(0x8086, 0xd613, "Intel", 1),
         {}
 };
@@ -9863,6 +9864,7 @@ static struct snd_pci_quirk alc882_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC883_LAPTOP_EAPD),
         SND_PCI_QUIRK(0x10f1, 0x2350, "TYAN-S2350", ALC888_6ST_DELL),
         SND_PCI_QUIRK(0x108e, 0x534d, NULL, ALC883_3ST_6ch),
+        SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte P35 DS3R", ALC882_6ST_DIG),
 
         SND_PCI_QUIRK(0x1462, 0x0349, "MSI", ALC883_TARGA_2ch_DIG),
         SND_PCI_QUIRK(0x1462, 0x040d, "MSI", ALC883_TARGA_2ch_DIG),
@@ -10699,7 +10701,6 @@ enum {
         PINFIX_LENOVO_Y530,
         PINFIX_PB_M5210,
         PINFIX_ACER_ASPIRE_7736,
-        PINFIX_GIGABYTE_880GM,
 };
 
 static const struct alc_fixup alc882_fixups[] = {
@@ -10731,13 +10732,6 @@ static const struct alc_fixup alc882_fixups[] = {
                 .type = ALC_FIXUP_SKU,
                 .v.sku = ALC_FIXUP_SKU_IGNORE,
         },
-        [PINFIX_GIGABYTE_880GM] = {
-                .type = ALC_FIXUP_PINS,
-                .v.pins = (const struct alc_pincfg[]) {
-                        { 0x14, 0x1114410 }, /* set as speaker */
-                        { }
-                }
-        },
 };
 
 static struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -10745,7 +10739,6 @@ static struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", PINFIX_LENOVO_Y530),
         SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", PINFIX_ABIT_AW9D_MAX),
         SND_PCI_QUIRK(0x1025, 0x0296, "Acer Aspire 7736z", PINFIX_ACER_ASPIRE_7736),
-        SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", PINFIX_GIGABYTE_880GM),
         {}
 };
 
@@ -18805,6 +18798,8 @@ static struct snd_pci_quirk alc662_cfg_tbl[] = {
                       ALC662_3ST_6ch_DIG),
         SND_PCI_QUIRK(0x1179, 0xff6e, "Toshiba NB20x", ALC662_AUTO),
         SND_PCI_QUIRK(0x144d, 0xca00, "Samsung NC10", ALC272_SAMSUNG_NC10),
+        SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte 945GCM-S2L",
+                      ALC662_3ST_6ch_DIG),
         SND_PCI_QUIRK(0x152d, 0x2304, "Quanta WH1", ALC663_ASUS_H13),
         SND_PCI_QUIRK(0x1565, 0x820f, "Biostar TA780G M2+", ALC662_3ST_6ch_DIG),
         SND_PCI_QUIRK(0x1631, 0xc10c, "PB RS65", ALC663_ASUS_M51VA),
@@ -19478,7 +19473,7 @@ enum {
         ALC662_FIXUP_IDEAPAD,
         ALC272_FIXUP_MARIO,
         ALC662_FIXUP_CZC_P10T,
-        ALC662_FIXUP_GIGABYTE,
+        ALC662_FIXUP_SKU_IGNORE,
 };
 
 static const struct alc_fixup alc662_fixups[] = {
@@ -19507,20 +19502,17 @@ static const struct alc_fixup alc662_fixups[] = {
                         {}
                 }
         },
-        [ALC662_FIXUP_GIGABYTE] = {
-                .type = ALC_FIXUP_PINS,
-                .v.pins = (const struct alc_pincfg[]) {
-                        { 0x14, 0x1114410 }, /* set as speaker */
-                        { }
-                }
+        [ALC662_FIXUP_SKU_IGNORE] = {
+                .type = ALC_FIXUP_SKU,
+                .v.sku = ALC_FIXUP_SKU_IGNORE,
         },
 };
 
 static struct snd_pci_quirk alc662_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
+        SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
         SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
-        SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", ALC662_FIXUP_GIGABYTE),
         SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
         SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index 1371b57c11e8..0997031c48d2 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -1292,14 +1292,18 @@ static void notify_aa_path_ctls(struct hda_codec *codec)
 {
         int i;
         struct snd_ctl_elem_id id;
-        const char *labels[] = {"Mic", "Front Mic", "Line"};
+        const char *labels[] = {"Mic", "Front Mic", "Line", "Rear Mic"};
+        struct snd_kcontrol *ctl;
 
         memset(&id, 0, sizeof(id));
         id.iface = SNDRV_CTL_ELEM_IFACE_MIXER;
         for (i = 0; i < ARRAY_SIZE(labels); i++) {
                 sprintf(id.name, "%s Playback Volume", labels[i]);
-                snd_ctl_notify(codec->bus->card, SNDRV_CTL_EVENT_MASK_VALUE,
-                               &id);
+                ctl = snd_hda_find_mixer_ctl(codec, id.name);
+                if (ctl)
+                        snd_ctl_notify(codec->bus->card,
+                                        SNDRV_CTL_EVENT_MASK_VALUE,
+                                        &ctl->id);
         }
 }
 
diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index a5af834c8ef5..4ddc6d3b6678 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -434,17 +434,21 @@ static int davinci_mcasp_set_dai_fmt(struct snd_soc_dai *cpu_dai,
                 mcasp_set_bits(base + DAVINCI_MCASP_ACLKRCTL_REG, ACLKRE);
                 mcasp_set_bits(base + DAVINCI_MCASP_RXFMCTL_REG, AFSRE);
 
-                mcasp_set_bits(base + DAVINCI_MCASP_PDIR_REG, (0x7 << 26));
+                mcasp_set_bits(base + DAVINCI_MCASP_PDIR_REG,
+                                ACLKX | AHCLKX | AFSX);
                 break;
         case SND_SOC_DAIFMT_CBM_CFS:
                 /* codec is clock master and frame slave */
-                mcasp_set_bits(base + DAVINCI_MCASP_ACLKXCTL_REG, ACLKXE);
+                mcasp_clr_bits(base + DAVINCI_MCASP_ACLKXCTL_REG, ACLKXE);
                 mcasp_set_bits(base + DAVINCI_MCASP_TXFMCTL_REG, AFSXE);
 
-                mcasp_set_bits(base + DAVINCI_MCASP_ACLKRCTL_REG, ACLKRE);
+                mcasp_clr_bits(base + DAVINCI_MCASP_ACLKRCTL_REG, ACLKRE);
                 mcasp_set_bits(base + DAVINCI_MCASP_RXFMCTL_REG, AFSRE);
 
-                mcasp_set_bits(base + DAVINCI_MCASP_PDIR_REG, (0x2d << 26));
+                mcasp_clr_bits(base + DAVINCI_MCASP_PDIR_REG,
+                                ACLKX | ACLKR);
+                mcasp_set_bits(base + DAVINCI_MCASP_PDIR_REG,
+                                AFSX | AFSR);
                 break;
         case SND_SOC_DAIFMT_CBM_CFM:
                 /* codec is clock and frame master */
@@ -454,7 +458,8 @@ static int davinci_mcasp_set_dai_fmt(struct snd_soc_dai *cpu_dai,
                 mcasp_clr_bits(base + DAVINCI_MCASP_ACLKRCTL_REG, ACLKRE);
                 mcasp_clr_bits(base + DAVINCI_MCASP_RXFMCTL_REG, AFSRE);
 
-                mcasp_clr_bits(base + DAVINCI_MCASP_PDIR_REG, (0x3f << 26));
+                mcasp_clr_bits(base + DAVINCI_MCASP_PDIR_REG,
+                                ACLKX | AHCLKX | AFSX | ACLKR | AHCLKR | AFSR);
                 break;
 
         default:
@@ -644,7 +649,7 @@ static void davinci_hw_param(struct davinci_audio_dev *dev, int stream)
                 mcasp_set_reg(dev->base + DAVINCI_MCASP_TXTDM_REG, mask);
                 mcasp_set_bits(dev->base + DAVINCI_MCASP_TXFMT_REG, TXORD);
 
-                if ((dev->tdm_slots >= 2) || (dev->tdm_slots <= 32))
+                if ((dev->tdm_slots >= 2) && (dev->tdm_slots <= 32))
                         mcasp_mod_bits(dev->base + DAVINCI_MCASP_TXFMCTL_REG,
                                         FSXMOD(dev->tdm_slots), FSXMOD(0x1FF));
                 else
@@ -660,7 +665,7 @@ static void davinci_hw_param(struct davinci_audio_dev *dev, int stream)
                                 AHCLKRE);
                 mcasp_set_reg(dev->base + DAVINCI_MCASP_RXTDM_REG, mask);
 
-                if ((dev->tdm_slots >= 2) || (dev->tdm_slots <= 32))
+                if ((dev->tdm_slots >= 2) && (dev->tdm_slots <= 32))
                         mcasp_mod_bits(dev->base + DAVINCI_MCASP_RXFMCTL_REG,
                                         FSRMOD(dev->tdm_slots), FSRMOD(0x1FF));
                 else
diff --git a/sound/soc/samsung/goni_wm8994.c b/sound/soc/samsung/goni_wm8994.c
index f6b3a3ce5919..0e80daee8b6f 100644
--- a/sound/soc/samsung/goni_wm8994.c
+++ b/sound/soc/samsung/goni_wm8994.c
@@ -236,18 +236,18 @@ static struct snd_soc_dai_link goni_dai[] = {
         .name = "WM8994",
         .stream_name = "WM8994 HiFi",
         .cpu_dai_name = "samsung-i2s.0",
-        .codec_dai_name = "wm8994-hifi",
+        .codec_dai_name = "wm8994-aif1",
         .platform_name = "samsung-audio",
-        .codec_name = "wm8994-codec.0-0x1a",
+        .codec_name = "wm8994-codec.0-001a",
         .init = goni_wm8994_init,
         .ops = &goni_hifi_ops,
 }, {
         .name = "WM8994 Voice",
         .stream_name = "Voice",
         .cpu_dai_name = "goni-voice-dai",
-        .codec_dai_name = "wm8994-voice",
+        .codec_dai_name = "wm8994-aif2",
         .platform_name = "samsung-audio",
-        .codec_name = "wm8994-codec.0-0x1a",
+        .codec_name = "wm8994-codec.0-001a",
         .ops = &goni_voice_ops,
 },
 };
diff --git a/sound/usb/format.c b/sound/usb/format.c
index 5b792d2c8061..f079b5e2ab28 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -176,9 +176,11 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof
                         if (!rate)
                                 continue;
                         /* C-Media CM6501 mislabels its 96 kHz altsetting */
+                        /* Terratec Aureon 7.1 USB C-Media 6206, too */
                         if (rate == 48000 && nr_rates == 1 &&
                             (chip->usb_id == USB_ID(0x0d8c, 0x0201) ||
-                             chip->usb_id == USB_ID(0x0d8c, 0x0102)) &&
+                             chip->usb_id == USB_ID(0x0d8c, 0x0102) ||
+                             chip->usb_id == USB_ID(0x0ccd, 0x00b1)) &&
                             fp->altsetting == 5 && fp->maxpacksize == 392)
                                 rate = 96000;
                         /* Creative VF0470 Live Cam reports 16 kHz instead of 8kHz */
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index ec07e62e53f3..1b94ec3a3368 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -533,6 +533,7 @@ int snd_usb_apply_boot_quirk(struct usb_device *dev,
 
         case USB_ID(0x0d8c, 0x0102):
                 /* C-Media CM6206 / CM106-Like Sound Device */
+        case USB_ID(0x0ccd, 0x00b1): /* Terratec Aureon 7.1 USB */
                 return snd_usb_cm6206_boot_quirk(dev);
 
         case USB_ID(0x133e, 0x0815):
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 91ad5cc95d85..1455413ec7a7 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -43,15 +43,21 @@ ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
                                   -e s/ppc.*/powerpc/ -e s/mips.*/mips/ \
                                   -e s/sh[234].*/sh/ )
 
+CC = $(CROSS_COMPILE)gcc
+AR = $(CROSS_COMPILE)ar
+
 # Additional ARCH settings for x86
 ifeq ($(ARCH),i386)
         ARCH := x86
 endif
 ifeq ($(ARCH),x86_64)
-        RAW_ARCH := x86_64
-        ARCH := x86
-        ARCH_CFLAGS := -DARCH_X86_64
-        ARCH_INCLUDE = ../../arch/x86/lib/memcpy_64.S
+        ARCH := x86
+        IS_X86_64 := $(shell echo __x86_64__ | ${CC} -E -xc - | tail -n 1)
+        ifeq (${IS_X86_64}, 1)
+                RAW_ARCH := x86_64
+                ARCH_CFLAGS := -DARCH_X86_64
+                ARCH_INCLUDE = ../../arch/x86/lib/memcpy_64.S
+        endif
 endif
 
 #
@@ -127,8 +133,6 @@ lib = lib
 
 export prefix bindir sharedir sysconfdir
 
-CC = $(CROSS_COMPILE)gcc
-AR = $(CROSS_COMPILE)ar
 RM = rm -f
 MKDIR = mkdir
 FIND = find