424 files changed, 6228 insertions, 2999 deletions

diff --git a/Documentation/filesystems/afs.txt b/Documentation/filesystems/afs.txt
index 12ad6c7f4e50..ffef91c4e0d6 100644
--- a/Documentation/filesystems/afs.txt
+++ b/Documentation/filesystems/afs.txt
@@ -23,15 +23,13 @@ it does support include:
 
  (*) Security (currently only AFS kaserver and KerberosIV tickets).
 
- (*) File reading.
+ (*) File reading and writing.
 
  (*) Automounting.
 
-It does not yet support the following AFS features:
-
- (*) Write support.
+ (*) Local caching (via fscache).
 
- (*) Local caching.
+It does not yet support the following AFS features:
 
  (*) pioctl() system call.
 
@@ -56,7 +54,7 @@ They permit the debugging messages to be turned on dynamically by manipulating
 the masks in the following files:
 
         /sys/module/af_rxrpc/parameters/debug
-        /sys/module/afs/parameters/debug
+        /sys/module/kafs/parameters/debug
 
 
 =====
@@ -66,9 +64,9 @@ USAGE
 When inserting the driver modules the root cell must be specified along with a
 list of volume location server IP addresses:
 
-        insmod af_rxrpc.o
-        insmod rxkad.o
-        insmod kafs.o rootcell=cambridge.redhat.com:172.16.18.73:172.16.18.91
+        modprobe af_rxrpc
+        modprobe rxkad
+        modprobe kafs rootcell=cambridge.redhat.com:172.16.18.73:172.16.18.91
 
 The first module is the AF_RXRPC network protocol driver.  This provides the
 RxRPC remote operation protocol and may also be accessed from userspace.  See:
@@ -81,7 +79,7 @@ is the actual filesystem driver for the AFS filesystem.
 Once the module has been loaded, more modules can be added by the following
 procedure:
 
-        echo add grand.central.org 18.7.14.88:128.2.191.224 >/proc/fs/afs/cells
+        echo add grand.central.org 18.9.48.14:128.2.203.61:130.237.48.87 >/proc/fs/afs/cells
 
 Where the parameters to the "add" command are the name of a cell and a list of
 volume location servers within that cell, with the latter separated by colons.
@@ -101,7 +99,7 @@ The name of the volume can be suffixes with ".backup" or ".readonly" to
 specify connection to only volumes of those types.
 
 The name of the cell is optional, and if not given during a mount, then the
-named volume will be looked up in the cell specified during insmod.
+named volume will be looked up in the cell specified during modprobe.
 
 Additional cells can be added through /proc (see later section).
 
@@ -163,14 +161,14 @@ THE CELL DATABASE
 
 The filesystem maintains an internal database of all the cells it knows and the
 IP addresses of the volume location servers for those cells.  The cell to which
-the system belongs is added to the database when insmod is performed by the
+the system belongs is added to the database when modprobe is performed by the
 "rootcell=" argument or, if compiled in, using a "kafs.rootcell=" argument on
 the kernel command line.
 
 Further cells can be added by commands similar to the following:
 
         echo add CELLNAME VLADDR[:VLADDR][:VLADDR]... >/proc/fs/afs/cells
-        echo add grand.central.org 18.7.14.88:128.2.191.224 >/proc/fs/afs/cells
+        echo add grand.central.org 18.9.48.14:128.2.203.61:130.237.48.87 >/proc/fs/afs/cells
 
 No other cell database operations are available at this time.
 
@@ -233,7 +231,7 @@ insmod /tmp/kafs.o rootcell=cambridge.redhat.com:172.16.18.91
 mount -t afs \%root.afs. /afs
 mount -t afs \%cambridge.redhat.com:root.cell. /afs/cambridge.redhat.com/
 
-echo add grand.central.org 18.7.14.88:128.2.191.224 > /proc/fs/afs/cells
+echo add grand.central.org 18.9.48.14:128.2.203.61:130.237.48.87 > /proc/fs/afs/cells
 mount -t afs "#grand.central.org:root.cell." /afs/grand.central.org/
 mount -t afs "#grand.central.org:root.archive." /afs/grand.central.org/archive
 mount -t afs "#grand.central.org:root.contrib." /afs/grand.central.org/contrib
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index fad18f9456e4..ffead13f9443 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -1167,13 +1167,11 @@ CHAPTER 3: PER-PROCESS PARAMETERS
 3.1 /proc/<pid>/oom_adj - Adjust the oom-killer score
 ------------------------------------------------------
 
-This file can be used to adjust the score used to select which processes should
-be killed in an out-of-memory situation.  The oom_adj value is a characteristic
-of the task's mm, so all threads that share an mm with pid will have the same
-oom_adj value.  A high value will increase the likelihood of this process being
-killed by the oom-killer.  Valid values are in the range -16 to +15 as
-explained below and a special value of -17, which disables oom-killing
-altogether for threads sharing pid's mm.
+This file can be used to adjust the score used to select which processes
+should be killed in an  out-of-memory  situation.  Giving it a high score will
+increase the likelihood of this process being killed by the oom-killer.  Valid
+values are in the range -16 to +15, plus the special value -17, which disables
+oom-killing altogether for this process.
 
 The process to be killed in an out-of-memory situation is selected among all others
 based on its badness score. This value equals the original memory size of the process
@@ -1187,9 +1185,6 @@ the parent's score if they do not share the same memory. Thus forking servers
 are the prime candidates to be killed. Having only one 'hungry' child will make
 parent less preferable than the child.
 
-/proc/<pid>/oom_adj cannot be changed for kthreads since they are immune from
-oom-killing already.
-
 /proc/<pid>/oom_score shows process' current badness score.
 
 The following heuristics are then applied:
diff --git a/Documentation/ioctl/ioctl-number.txt b/Documentation/ioctl/ioctl-number.txt
index 7bb0d934b6d8..dbea4f95fc85 100644
--- a/Documentation/ioctl/ioctl-number.txt
+++ b/Documentation/ioctl/ioctl-number.txt
@@ -139,6 +139,7 @@ Code	Seq#	Include File		Comments
 'm'     all     linux/synclink.h        conflict!
 'm'     00-1F   net/irda/irmod.h        conflict!
 'n'     00-7F   linux/ncp_fs.h
+'n'     80-8F   linux/nilfs2_fs.h       NILFS2
 'n'     E0-FF   video/matrox.h          matroxfb
 'o'     00-1F   fs/ocfs2/ocfs2_fs.h     OCFS2
 'o'     00-03   include/mtd/ubi-user.h  conflict! (OCFS2 and UBI overlaps)
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index dd1a6d4bb747..7936b801fe6a 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1115,6 +1115,10 @@ and is between 256 and 4096 characters. It is defined in the file
                         libata.dma=4      Compact Flash DMA only 
                         Combinations also work, so libata.dma=3 enables DMA
                         for disks and CDROMs, but not CFs.
+        
+        libata.ignore_hpa=      [LIBATA] Ignore HPA limit
+                        libata.ignore_hpa=0       keep BIOS limits (default)
+                        libata.ignore_hpa=1       ignore limits, using full disk
 
         libata.noacpi   [LIBATA] Disables use of ACPI in libata suspend/resume
                         when set.
diff --git a/Documentation/video4linux/CARDLIST.em28xx b/Documentation/video4linux/CARDLIST.em28xx
index 68c236c01846..e352d754875c 100644
--- a/Documentation/video4linux/CARDLIST.em28xx
+++ b/Documentation/video4linux/CARDLIST.em28xx
@@ -1,5 +1,5 @@
   0 -> Unknown EM2800 video grabber             (em2800)        [eb1a:2800]
-  1 -> Unknown EM2750/28xx video grabber        (em2820/em2840) [eb1a:2820,eb1a:2821,eb1a:2860,eb1a:2861,eb1a:2870,eb1a:2881,eb1a:2883]
+  1 -> Unknown EM2750/28xx video grabber        (em2820/em2840) [eb1a:2710,eb1a:2820,eb1a:2821,eb1a:2860,eb1a:2861,eb1a:2870,eb1a:2881,eb1a:2883]
   2 -> Terratec Cinergy 250 USB                 (em2820/em2840) [0ccd:0036]
   3 -> Pinnacle PCTV USB 2                      (em2820/em2840) [2304:0208]
   4 -> Hauppauge WinTV USB 2                    (em2820/em2840) [2040:4200,2040:4201]
diff --git a/Documentation/video4linux/CARDLIST.saa7134 b/Documentation/video4linux/CARDLIST.saa7134
index 15562427e8a9..c913e5614195 100644
--- a/Documentation/video4linux/CARDLIST.saa7134
+++ b/Documentation/video4linux/CARDLIST.saa7134
@@ -153,8 +153,8 @@
 152 -> Asus Tiger Rev:1.00                      [1043:4857]
 153 -> Kworld Plus TV Analog Lite PCI           [17de:7128]
 154 -> Avermedia AVerTV GO 007 FM Plus          [1461:f31d]
-155 -> Hauppauge WinTV-HVR1120 ATSC/QAM-Hybrid  [0070:6706,0070:6708]
-156 -> Hauppauge WinTV-HVR1110r3 DVB-T/Hybrid   [0070:6707,0070:6709,0070:670a]
+155 -> Hauppauge WinTV-HVR1150 ATSC/QAM-Hybrid  [0070:6706,0070:6708]
+156 -> Hauppauge WinTV-HVR1120 DVB-T/Hybrid     [0070:6707,0070:6709,0070:670a]
 157 -> Avermedia AVerTV Studio 507UA            [1461:a11b]
 158 -> AVerMedia Cardbus TV/Radio (E501R)       [1461:b7e9]
 159 -> Beholder BeholdTV 505 RDS                [0000:505B]
diff --git a/MAINTAINERS b/MAINTAINERS
index aee67a888897..60299a9a7adb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2238,6 +2238,14 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
 S:      Maintained
 F:      drivers/media/video/gspca/pac207.c
 
+GSPCA SN9C20X SUBDRIVER
+P:      Brian Johnson
+M:      brijohn@gmail.com
+L:      linux-media@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
+S:      Maintained
+F:      drivers/media/video/gspca/sn9c20x.c
+
 GSPCA T613 SUBDRIVER
 M:      Leandro Costantino <lcostantino@gmail.com>
 L:      linux-media@vger.kernel.org
@@ -3421,6 +3429,7 @@ F:	drivers/mfd/
 
 MULTIMEDIA CARD (MMC), SECURE DIGITAL (SD) AND SDIO SUBSYSTEM
 S:      Orphan
+L:      linux-mmc@vger.kernel.org
 F:      drivers/mmc/
 F:      include/linux/mmc/
 
@@ -3801,7 +3810,7 @@ W:	http://open-osd.org
 T:      git git://git.open-osd.org/open-osd.git
 S:      Maintained
 F:      drivers/scsi/osd/
-F:      drivers/include/scsi/osd_*
+F:      include/scsi/osd_*
 F:      fs/exofs/
 
 P54 WIRELESS DRIVER
diff --git a/Makefile b/Makefile
index 0d46615bffe5..9c87e60d169c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 31
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc7
 NAME = Man-Eating Seals of Antiquity
 
 # *DOCUMENTATION*
diff --git a/REPORTING-BUGS b/REPORTING-BUGS
index ab0c56630a8c..55a6074ccbb7 100644
--- a/REPORTING-BUGS
+++ b/REPORTING-BUGS
@@ -15,7 +15,10 @@ worry too much about getting the wrong person. If you are unsure send it
 to the person responsible for the code relevant to what you were doing.
 If it occurs repeatably try and describe how to recreate it. That is
 worth even more than the oops itself.  The list of maintainers and
-mailing lists is in the MAINTAINERS file in this directory.
+mailing lists is in the MAINTAINERS file in this directory.  If you
+know the file name that causes the problem you can use the following
+command in this directory to find some of the maintainers of that file:
+     perl scripts/get_maintainer.pl -f <filename>
 
       If it is a security bug, please copy the Security Contact listed
 in the MAINTAINERS file.  They can help coordinate bugfix and disclosure.
diff --git a/arch/arm/configs/kirkwood_defconfig b/arch/arm/configs/kirkwood_defconfig
index 0a1abb978d7e..af74cc2de8b6 100644
--- a/arch/arm/configs/kirkwood_defconfig
+++ b/arch/arm/configs/kirkwood_defconfig
@@ -629,7 +629,7 @@ CONFIG_SCSI_LOWLEVEL=y
 CONFIG_ATA=y
 # CONFIG_ATA_NONSTANDARD is not set
 CONFIG_SATA_PMP=y
-# CONFIG_SATA_AHCI is not set
+CONFIG_SATA_AHCI=y
 # CONFIG_SATA_SIL24 is not set
 CONFIG_ATA_SFF=y
 # CONFIG_SATA_SVW is not set
diff --git a/arch/arm/configs/rx51_defconfig b/arch/arm/configs/rx51_defconfig
index eb2cb31825c0..f238df66efd4 100644
--- a/arch/arm/configs/rx51_defconfig
+++ b/arch/arm/configs/rx51_defconfig
@@ -282,7 +282,7 @@ CONFIG_ALIGNMENT_TRAP=y
 #
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="init=/sbin/preinit ubi.mtd=rootfs root=ubi0:rootfs rootfstype=ubifs rootflags=bulk_read,no_chk_data_crc rw console=ttyMTD,log console=tty0"
+CONFIG_CMDLINE="init=/sbin/preinit ubi.mtd=rootfs root=ubi0:rootfs rootfstype=ubifs rootflags=bulk_read,no_chk_data_crc rw console=ttyMTD,log console=tty0 console=ttyS2,115200n8"
 # CONFIG_XIP_KERNEL is not set
 # CONFIG_KEXEC is not set
 
@@ -1354,7 +1354,7 @@ CONFIG_USB_OTG_UTILS=y
 # CONFIG_USB_GPIO_VBUS is not set
 # CONFIG_ISP1301_OMAP is not set
 CONFIG_TWL4030_USB=y
-CONFIG_MMC=m
+CONFIG_MMC=y
 # CONFIG_MMC_DEBUG is not set
 # CONFIG_MMC_UNSAFE_RESUME is not set
 
@@ -1449,7 +1449,8 @@ CONFIG_RTC_DRV_TWL4030=m
 # on-CPU RTC drivers
 #
 # CONFIG_DMADEVICES is not set
-# CONFIG_REGULATOR is not set
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_TWL4030=y
 # CONFIG_UIO is not set
 # CONFIG_STAGING is not set
 
diff --git a/arch/arm/include/asm/setup.h b/arch/arm/include/asm/setup.h
index ee1304f22f94..5ccce0a9b03c 100644
--- a/arch/arm/include/asm/setup.h
+++ b/arch/arm/include/asm/setup.h
@@ -201,7 +201,8 @@ static struct tagtable __tagtable_##fn __tag = { tag, fn }
 struct membank {
         unsigned long start;
         unsigned long size;
-        int           node;
+        unsigned short node;
+        unsigned short highmem;
 };
 
 struct meminfo {
diff --git a/arch/arm/mach-ixp4xx/include/mach/io.h b/arch/arm/mach-ixp4xx/include/mach/io.h
index ce63048d45eb..8a947d42a6f1 100644
--- a/arch/arm/mach-ixp4xx/include/mach/io.h
+++ b/arch/arm/mach-ixp4xx/include/mach/io.h
@@ -17,7 +17,7 @@
 
 #include <mach/hardware.h>
 
-#define IO_SPACE_LIMIT 0xffff0000
+#define IO_SPACE_LIMIT 0x0000ffff
 
 extern int (*ixp4xx_pci_read)(u32 addr, u32 cmd, u32* data);
 extern int ixp4xx_pci_write(u32 addr, u32 cmd, u32 data);
diff --git a/arch/arm/mach-kirkwood/ts219-setup.c b/arch/arm/mach-kirkwood/ts219-setup.c
index 01aa213c0a6f..ec1a64f263d2 100644
--- a/arch/arm/mach-kirkwood/ts219-setup.c
+++ b/arch/arm/mach-kirkwood/ts219-setup.c
@@ -206,6 +206,15 @@ static void __init qnap_ts219_init(void)
 
 }
 
+static int __init ts219_pci_init(void)
+{
+   if (machine_is_ts219())
+           kirkwood_pcie_init();
+
+   return 0;
+}
+subsys_initcall(ts219_pci_init);
+
 MACHINE_START(TS219, "QNAP TS-119/TS-219")
         /* Maintainer: Martin Michlmayr <tbm@cyrius.com> */
         .phys_io        = KIRKWOOD_REGS_PHYS_BASE,
diff --git a/arch/arm/mach-mx3/mx31moboard-devboard.c b/arch/arm/mach-mx3/mx31moboard-devboard.c
index 4704405165a1..b48581e7dedd 100644
--- a/arch/arm/mach-mx3/mx31moboard-devboard.c
+++ b/arch/arm/mach-mx3/mx31moboard-devboard.c
@@ -63,7 +63,7 @@ static struct imxuart_platform_data uart_pdata = {
 
 static int devboard_sdhc2_get_ro(struct device *dev)
 {
-        return gpio_get_value(SDHC2_WP);
+        return !gpio_get_value(SDHC2_WP);
 }
 
 static int devboard_sdhc2_init(struct device *dev, irq_handler_t detect_irq,
diff --git a/arch/arm/mach-mx3/mx31moboard-marxbot.c b/arch/arm/mach-mx3/mx31moboard-marxbot.c
index 641c3d6153ae..901fb0166c0e 100644
--- a/arch/arm/mach-mx3/mx31moboard-marxbot.c
+++ b/arch/arm/mach-mx3/mx31moboard-marxbot.c
@@ -67,7 +67,7 @@ static unsigned int marxbot_pins[] = {
 
 static int marxbot_sdhc2_get_ro(struct device *dev)
 {
-        return gpio_get_value(SDHC2_WP);
+        return !gpio_get_value(SDHC2_WP);
 }
 
 static int marxbot_sdhc2_init(struct device *dev, irq_handler_t detect_irq,
diff --git a/arch/arm/mach-mx3/mx31moboard.c b/arch/arm/mach-mx3/mx31moboard.c
index a17f2e411609..2a2da4739ecf 100644
--- a/arch/arm/mach-mx3/mx31moboard.c
+++ b/arch/arm/mach-mx3/mx31moboard.c
@@ -94,7 +94,7 @@ static struct imxi2c_platform_data moboard_i2c1_pdata = {
 
 static int moboard_sdhc1_get_ro(struct device *dev)
 {
-        return gpio_get_value(SDHC1_WP);
+        return !gpio_get_value(SDHC1_WP);
 }
 
 static int moboard_sdhc1_init(struct device *dev, irq_handler_t detect_irq,
diff --git a/arch/arm/mach-mx3/pcm037_eet.c b/arch/arm/mach-mx3/pcm037_eet.c
index fe52fb1bb8b7..8d386000fc40 100644
--- a/arch/arm/mach-mx3/pcm037_eet.c
+++ b/arch/arm/mach-mx3/pcm037_eet.c
@@ -24,15 +24,6 @@
 #include "devices.h"
 
 static unsigned int pcm037_eet_pins[] = {
-        /* SPI #1 */
-        MX31_PIN_CSPI1_MISO__MISO,
-        MX31_PIN_CSPI1_MOSI__MOSI,
-        MX31_PIN_CSPI1_SCLK__SCLK,
-        MX31_PIN_CSPI1_SPI_RDY__SPI_RDY,
-        MX31_PIN_CSPI1_SS0__SS0,
-        MX31_PIN_CSPI1_SS1__SS1,
-        MX31_PIN_CSPI1_SS2__SS2,
-
         /* Reserve and hardwire GPIO 57 high - S6E63D6 chipselect */
         IOMUX_MODE(MX31_PIN_KEY_COL7, IOMUX_CONFIG_GPIO),
         /* GPIO keys */
diff --git a/arch/arm/mach-omap2/board-2430sdp.c b/arch/arm/mach-omap2/board-2430sdp.c
index 9c3fdcdf76c3..8ec2a132904d 100644
--- a/arch/arm/mach-omap2/board-2430sdp.c
+++ b/arch/arm/mach-omap2/board-2430sdp.c
@@ -141,7 +141,7 @@ static inline void board_smc91x_init(void)
 
 static void __init omap_2430sdp_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
         omap_init_irq();
         omap_gpio_init();
 }
diff --git a/arch/arm/mach-omap2/board-3430sdp.c b/arch/arm/mach-omap2/board-3430sdp.c
index 496a90e4ea7a..ac262cd74503 100644
--- a/arch/arm/mach-omap2/board-3430sdp.c
+++ b/arch/arm/mach-omap2/board-3430sdp.c
@@ -169,7 +169,7 @@ static struct platform_device *sdp3430_devices[] __initdata = {
 
 static void __init omap_3430sdp_init_irq(void)
 {
-        omap2_init_common_hw(hyb18m512160af6_sdrc_params);
+        omap2_init_common_hw(hyb18m512160af6_sdrc_params, NULL);
         omap_init_irq();
         omap_gpio_init();
 }
diff --git a/arch/arm/mach-omap2/board-4430sdp.c b/arch/arm/mach-omap2/board-4430sdp.c
index 57e477bd89c6..b0c7402248f7 100644
--- a/arch/arm/mach-omap2/board-4430sdp.c
+++ b/arch/arm/mach-omap2/board-4430sdp.c
@@ -59,7 +59,7 @@ static void __init gic_init_irq(void)
 
 static void __init omap_4430sdp_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
 #ifdef CONFIG_OMAP_32K_TIMER
         omap2_gp_clockevent_set_gptimer(1);
 #endif
diff --git a/arch/arm/mach-omap2/board-apollon.c b/arch/arm/mach-omap2/board-apollon.c
index 06dfba888b0c..dcfc20d03894 100644
--- a/arch/arm/mach-omap2/board-apollon.c
+++ b/arch/arm/mach-omap2/board-apollon.c
@@ -250,7 +250,7 @@ out:
 
 static void __init omap_apollon_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
         omap_init_irq();
         omap_gpio_init();
         apollon_init_smc91x();
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index 3492162a65c3..fd00aa03690c 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -33,7 +33,7 @@
 
 static void __init omap_generic_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
         omap_init_irq();
 }
 
diff --git a/arch/arm/mach-omap2/board-h4.c b/arch/arm/mach-omap2/board-h4.c
index e7d017cdc438..7b1d61d5bb2c 100644
--- a/arch/arm/mach-omap2/board-h4.c
+++ b/arch/arm/mach-omap2/board-h4.c
@@ -270,7 +270,7 @@ static void __init h4_init_flash(void)
 
 static void __init omap_h4_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
         omap_init_irq();
         omap_gpio_init();
         h4_init_flash();
diff --git a/arch/arm/mach-omap2/board-ldp.c b/arch/arm/mach-omap2/board-ldp.c
index d8bc0a7dcb8d..ea383f88cb1b 100644
--- a/arch/arm/mach-omap2/board-ldp.c
+++ b/arch/arm/mach-omap2/board-ldp.c
@@ -270,7 +270,7 @@ static inline void __init ldp_init_smsc911x(void)
 
 static void __init omap_ldp_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
         omap_init_irq();
         omap_gpio_init();
         ldp_init_smsc911x();
diff --git a/arch/arm/mach-omap2/board-omap3beagle.c b/arch/arm/mach-omap2/board-omap3beagle.c
index 991ac9c38032..e00ba128cece 100644
--- a/arch/arm/mach-omap2/board-omap3beagle.c
+++ b/arch/arm/mach-omap2/board-omap3beagle.c
@@ -282,7 +282,8 @@ static int __init omap3_beagle_i2c_init(void)
 
 static void __init omap3_beagle_init_irq(void)
 {
-        omap2_init_common_hw(mt46h32m32lf6_sdrc_params);
+        omap2_init_common_hw(mt46h32m32lf6_sdrc_params,
+                             mt46h32m32lf6_sdrc_params);
         omap_init_irq();
 #ifdef CONFIG_OMAP_32K_TIMER
         omap2_gp_clockevent_set_gptimer(12);
@@ -408,6 +409,10 @@ static void __init omap3_beagle_init(void)
 
         usb_musb_init();
         omap3beagle_flash_init();
+
+        /* Ensure SDRC pins are mux'd for self-refresh */
+        omap_cfg_reg(H16_34XX_SDRC_CKE0);
+        omap_cfg_reg(H17_34XX_SDRC_CKE1);
 }
 
 static void __init omap3_beagle_map_io(void)
diff --git a/arch/arm/mach-omap2/board-omap3evm.c b/arch/arm/mach-omap2/board-omap3evm.c
index cf3dd771a678..c4b144647dc5 100644
--- a/arch/arm/mach-omap2/board-omap3evm.c
+++ b/arch/arm/mach-omap2/board-omap3evm.c
@@ -280,7 +280,7 @@ struct spi_board_info omap3evm_spi_board_info[] = {
 
 static void __init omap3_evm_init_irq(void)
 {
-        omap2_init_common_hw(mt46h32m32lf6_sdrc_params);
+        omap2_init_common_hw(mt46h32m32lf6_sdrc_params, NULL);
         omap_init_irq();
         omap_gpio_init();
         omap3evm_init_smc911x();
diff --git a/arch/arm/mach-omap2/board-omap3pandora.c b/arch/arm/mach-omap2/board-omap3pandora.c
index e32aa23ce962..864ee3d021f7 100644
--- a/arch/arm/mach-omap2/board-omap3pandora.c
+++ b/arch/arm/mach-omap2/board-omap3pandora.c
@@ -40,6 +40,7 @@
 #include <mach/mcspi.h>
 #include <mach/usb.h>
 #include <mach/keypad.h>
+#include <mach/mux.h>
 
 #include "sdram-micron-mt46h32m32lf-6.h"
 #include "mmc-twl4030.h"
@@ -310,7 +311,8 @@ static int __init omap3pandora_i2c_init(void)
 
 static void __init omap3pandora_init_irq(void)
 {
-        omap2_init_common_hw(mt46h32m32lf6_sdrc_params);
+        omap2_init_common_hw(mt46h32m32lf6_sdrc_params,
+                             mt46h32m32lf6_sdrc_params);
         omap_init_irq();
         omap_gpio_init();
 }
@@ -397,6 +399,10 @@ static void __init omap3pandora_init(void)
         omap3pandora_ads7846_init();
         pandora_keys_gpio_init();
         usb_musb_init();
+
+        /* Ensure SDRC pins are mux'd for self-refresh */
+        omap_cfg_reg(H16_34XX_SDRC_CKE0);
+        omap_cfg_reg(H17_34XX_SDRC_CKE1);
 }
 
 static void __init omap3pandora_map_io(void)
diff --git a/arch/arm/mach-omap2/board-overo.c b/arch/arm/mach-omap2/board-overo.c
index dff5528fbfb5..6bce23004aa4 100644
--- a/arch/arm/mach-omap2/board-overo.c
+++ b/arch/arm/mach-omap2/board-overo.c
@@ -44,6 +44,7 @@
 #include <mach/gpmc.h>
 #include <mach/hardware.h>
 #include <mach/nand.h>
+#include <mach/mux.h>
 #include <mach/usb.h>
 
 #include "sdram-micron-mt46h32m32lf-6.h"
@@ -51,6 +52,7 @@
 
 #define OVERO_GPIO_BT_XGATE     15
 #define OVERO_GPIO_W2W_NRESET   16
+#define OVERO_GPIO_PENDOWN      114
 #define OVERO_GPIO_BT_NRESET    164
 #define OVERO_GPIO_USBH_CPEN    168
 #define OVERO_GPIO_USBH_NRESET  183
@@ -146,7 +148,7 @@ static struct platform_device overo_smsc911x_device = {
         .name           = "smsc911x",
         .id             = -1,
         .num_resources  = ARRAY_SIZE(overo_smsc911x_resources),
-        .resource       = &overo_smsc911x_resources,
+        .resource       = overo_smsc911x_resources,
         .dev            = {
                 .platform_data = &overo_smsc911x_config,
         },
@@ -360,7 +362,8 @@ static int __init overo_i2c_init(void)
 
 static void __init overo_init_irq(void)
 {
-        omap2_init_common_hw(mt46h32m32lf6_sdrc_params);
+        omap2_init_common_hw(mt46h32m32lf6_sdrc_params,
+                             mt46h32m32lf6_sdrc_params);
         omap_init_irq();
         omap_gpio_init();
 }
@@ -395,6 +398,10 @@ static void __init overo_init(void)
         overo_ads7846_init();
         overo_init_smsc911x();
 
+        /* Ensure SDRC pins are mux'd for self-refresh */
+        omap_cfg_reg(H16_34XX_SDRC_CKE0);
+        omap_cfg_reg(H17_34XX_SDRC_CKE1);
+
         if ((gpio_request(OVERO_GPIO_W2W_NRESET,
                           "OVERO_GPIO_W2W_NRESET") == 0) &&
             (gpio_direction_output(OVERO_GPIO_W2W_NRESET, 1) == 0)) {
diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
index 9a0bf6744a05..56d931a425f7 100644
--- a/arch/arm/mach-omap2/board-rx51-peripherals.c
+++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
@@ -278,6 +278,10 @@ static struct twl4030_gpio_platform_data rx51_gpio_data = {
         .setup                  = rx51_twlgpio_setup,
 };
 
+static struct twl4030_usb_data rx51_usb_data = {
+        .usb_mode               = T2_USB_MODE_ULPI,
+};
+
 static struct twl4030_platform_data rx51_twldata = {
         .irq_base               = TWL4030_IRQ_BASE,
         .irq_end                = TWL4030_IRQ_END,
@@ -286,6 +290,7 @@ static struct twl4030_platform_data rx51_twldata = {
         .gpio                   = &rx51_gpio_data,
         .keypad                 = &rx51_kp_data,
         .madc                   = &rx51_madc_data,
+        .usb                    = &rx51_usb_data,
 
         .vaux1                  = &rx51_vaux1,
         .vaux2                  = &rx51_vaux2,
diff --git a/arch/arm/mach-omap2/board-rx51.c b/arch/arm/mach-omap2/board-rx51.c
index 374ff63c3eb2..1c9e07fe8266 100644
--- a/arch/arm/mach-omap2/board-rx51.c
+++ b/arch/arm/mach-omap2/board-rx51.c
@@ -61,7 +61,7 @@ static struct omap_board_config_kernel rx51_config[] = {
 
 static void __init rx51_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
         omap_init_irq();
         omap_gpio_init();
 }
@@ -75,6 +75,10 @@ static void __init rx51_init(void)
         omap_serial_init();
         usb_musb_init();
         rx51_peripherals_init();
+
+        /* Ensure SDRC pins are mux'd for self-refresh */
+        omap_cfg_reg(H16_34XX_SDRC_CKE0);
+        omap_cfg_reg(H17_34XX_SDRC_CKE1);
 }
 
 static void __init rx51_map_io(void)
diff --git a/arch/arm/mach-omap2/board-zoom2.c b/arch/arm/mach-omap2/board-zoom2.c
index bcc0f7632dea..427b7b8b1237 100644
--- a/arch/arm/mach-omap2/board-zoom2.c
+++ b/arch/arm/mach-omap2/board-zoom2.c
@@ -25,7 +25,7 @@
 
 static void __init omap_zoom2_init_irq(void)
 {
-        omap2_init_common_hw(NULL);
+        omap2_init_common_hw(NULL, NULL);
         omap_init_irq();
         omap_gpio_init();
 }
diff --git a/arch/arm/mach-omap2/clock.c b/arch/arm/mach-omap2/clock.c
index b0665f161c03..456e2ad5f621 100644
--- a/arch/arm/mach-omap2/clock.c
+++ b/arch/arm/mach-omap2/clock.c
@@ -27,6 +27,7 @@
 #include <mach/clock.h>
 #include <mach/clockdomain.h>
 #include <mach/cpu.h>
+#include <mach/prcm.h>
 #include <asm/div64.h>
 
 #include <mach/sdrc.h>
@@ -38,8 +39,6 @@
 #include "cm-regbits-24xx.h"
 #include "cm-regbits-34xx.h"
 
-#define MAX_CLOCK_ENABLE_WAIT           100000
-
 /* DPLL rate rounding: minimum DPLL multiplier, divider values */
 #define DPLL_MIN_MULTIPLIER             1
 #define DPLL_MIN_DIVIDER                1
@@ -274,83 +273,97 @@ unsigned long omap2_fixed_divisor_recalc(struct clk *clk)
 }
 
 /**
- * omap2_wait_clock_ready - wait for clock to enable
- * @reg: physical address of clock IDLEST register
- * @mask: value to mask against to determine if the clock is active
- * @name: name of the clock (for printk)
+ * omap2_clk_dflt_find_companion - find companion clock to @clk
+ * @clk: struct clk * to find the companion clock of
+ * @other_reg: void __iomem ** to return the companion clock CM_*CLKEN va in
+ * @other_bit: u8 ** to return the companion clock bit shift in
+ *
+ * Note: We don't need special code here for INVERT_ENABLE for the
+ * time being since INVERT_ENABLE only applies to clocks enabled by
+ * CM_CLKEN_PLL
  *
- * Returns 1 if the clock enabled in time, or 0 if it failed to enable
- * in roughly MAX_CLOCK_ENABLE_WAIT microseconds.
+ * Convert CM_ICLKEN* <-> CM_FCLKEN*.  This conversion assumes it's
+ * just a matter of XORing the bits.
+ *
+ * Some clocks don't have companion clocks.  For example, modules with
+ * only an interface clock (such as MAILBOXES) don't have a companion
+ * clock.  Right now, this code relies on the hardware exporting a bit
+ * in the correct companion register that indicates that the
+ * nonexistent 'companion clock' is active.  Future patches will
+ * associate this type of code with per-module data structures to
+ * avoid this issue, and remove the casts.  No return value.
  */
-int omap2_wait_clock_ready(void __iomem *reg, u32 mask, const char *name)
+void omap2_clk_dflt_find_companion(struct clk *clk, void __iomem **other_reg,
+                                   u8 *other_bit)
 {
-        int i = 0;
-        int ena = 0;
+        u32 r;
 
         /*
-         * 24xx uses 0 to indicate not ready, and 1 to indicate ready.
-         * 34xx reverses this, just to keep us on our toes
+         * Convert CM_ICLKEN* <-> CM_FCLKEN*.  This conversion assumes
+         * it's just a matter of XORing the bits.
          */
-        if (cpu_mask & (RATE_IN_242X | RATE_IN_243X))
-                ena = mask;
-        else if (cpu_mask & RATE_IN_343X)
-                ena = 0;
-
-        /* Wait for lock */
-        while (((__raw_readl(reg) & mask) != ena) &&
-               (i++ < MAX_CLOCK_ENABLE_WAIT)) {
-                udelay(1);
-        }
-
-        if (i <= MAX_CLOCK_ENABLE_WAIT)
-                pr_debug("Clock %s stable after %d loops\n", name, i);
-        else
-                printk(KERN_ERR "Clock %s didn't enable in %d tries\n",
-                       name, MAX_CLOCK_ENABLE_WAIT);
-
-
-        return (i < MAX_CLOCK_ENABLE_WAIT) ? 1 : 0;
-};
+        r = ((__force u32)clk->enable_reg ^ (CM_FCLKEN ^ CM_ICLKEN));
 
+        *other_reg = (__force void __iomem *)r;
+        *other_bit = clk->enable_bit;
+}
 
-/*
- * Note: We don't need special code here for INVERT_ENABLE
- * for the time being since INVERT_ENABLE only applies to clocks enabled by
- * CM_CLKEN_PLL
+/**
+ * omap2_clk_dflt_find_idlest - find CM_IDLEST reg va, bit shift for @clk
+ * @clk: struct clk * to find IDLEST info for
+ * @idlest_reg: void __iomem ** to return the CM_IDLEST va in
+ * @idlest_bit: u8 ** to return the CM_IDLEST bit shift in
+ *
+ * Return the CM_IDLEST register address and bit shift corresponding
+ * to the module that "owns" this clock.  This default code assumes
+ * that the CM_IDLEST bit shift is the CM_*CLKEN bit shift, and that
+ * the IDLEST register address ID corresponds to the CM_*CLKEN
+ * register address ID (e.g., that CM_FCLKEN2 corresponds to
+ * CM_IDLEST2).  This is not true for all modules.  No return value.
  */
-static void omap2_clk_wait_ready(struct clk *clk)
+void omap2_clk_dflt_find_idlest(struct clk *clk, void __iomem **idlest_reg,
+                                u8 *idlest_bit)
 {
-        void __iomem *reg, *other_reg, *st_reg;
-        u32 bit;
+        u32 r;
 
-        /*
-         * REVISIT: This code is pretty ugly.  It would be nice to generalize
-         * it and pull it into struct clk itself somehow.
-         */
-        reg = clk->enable_reg;
+        r = (((__force u32)clk->enable_reg & ~0xf0) | 0x20);
+        *idlest_reg = (__force void __iomem *)r;
+        *idlest_bit = clk->enable_bit;
+}
 
-        /*
-         * Convert CM_ICLKEN* <-> CM_FCLKEN*.  This conversion assumes
-         * it's just a matter of XORing the bits.
-         */
-        other_reg = (void __iomem *)((u32)reg ^ (CM_FCLKEN ^ CM_ICLKEN));
+/**
+ * omap2_module_wait_ready - wait for an OMAP module to leave IDLE
+ * @clk: struct clk * belonging to the module
+ *
+ * If the necessary clocks for the OMAP hardware IP block that
+ * corresponds to clock @clk are enabled, then wait for the module to
+ * indicate readiness (i.e., to leave IDLE).  This code does not
+ * belong in the clock code and will be moved in the medium term to
+ * module-dependent code.  No return value.
+ */
+static void omap2_module_wait_ready(struct clk *clk)
+{
+        void __iomem *companion_reg, *idlest_reg;
+        u8 other_bit, idlest_bit;
+
+        /* Not all modules have multiple clocks that their IDLEST depends on */
+        if (clk->ops->find_companion) {
+                clk->ops->find_companion(clk, &companion_reg, &other_bit);
+                if (!(__raw_readl(companion_reg) & (1 << other_bit)))
+                        return;
+        }
 
-        /* Check if both functional and interface clocks
-         * are running. */
-        bit = 1 << clk->enable_bit;
-        if (!(__raw_readl(other_reg) & bit))
-                return;
-        st_reg = (void __iomem *)(((u32)other_reg & ~0xf0) | 0x20); /* CM_IDLEST* */
+        clk->ops->find_idlest(clk, &idlest_reg, &idlest_bit);
 
-        omap2_wait_clock_ready(st_reg, bit, clk->name);
+        omap2_cm_wait_idlest(idlest_reg, (1 << idlest_bit), clk->name);
 }
 
-static int omap2_dflt_clk_enable(struct clk *clk)
+int omap2_dflt_clk_enable(struct clk *clk)
 {
         u32 v;
 
         if (unlikely(clk->enable_reg == NULL)) {
-                printk(KERN_ERR "clock.c: Enable for %s without enable code\n",
+                pr_err("clock.c: Enable for %s without enable code\n",
                        clk->name);
                 return 0; /* REVISIT: -EINVAL */
         }
@@ -363,26 +376,13 @@ static int omap2_dflt_clk_enable(struct clk *clk)
         __raw_writel(v, clk->enable_reg);
         v = __raw_readl(clk->enable_reg); /* OCP barrier */
 
-        return 0;
-}
+        if (clk->ops->find_idlest)
+                omap2_module_wait_ready(clk);
 
-static int omap2_dflt_clk_enable_wait(struct clk *clk)
-{
-        int ret;
-
-        if (!clk->enable_reg) {
-                printk(KERN_ERR "clock.c: Enable for %s without enable code\n",
-                       clk->name);
-                return 0; /* REVISIT: -EINVAL */
-        }
-
-        ret = omap2_dflt_clk_enable(clk);
-        if (ret == 0)
-                omap2_clk_wait_ready(clk);
-        return ret;
+        return 0;
 }
 
-static void omap2_dflt_clk_disable(struct clk *clk)
+void omap2_dflt_clk_disable(struct clk *clk)
 {
         u32 v;
 
@@ -406,8 +406,10 @@ static void omap2_dflt_clk_disable(struct clk *clk)
 }
 
 const struct clkops clkops_omap2_dflt_wait = {
-        .enable         = omap2_dflt_clk_enable_wait,
+        .enable         = omap2_dflt_clk_enable,
         .disable        = omap2_dflt_clk_disable,
+        .find_companion = omap2_clk_dflt_find_companion,
+        .find_idlest    = omap2_clk_dflt_find_idlest,
 };
 
 const struct clkops clkops_omap2_dflt = {
diff --git a/arch/arm/mach-omap2/clock.h b/arch/arm/mach-omap2/clock.h
index 2679ddfa6424..9ae7540f8af2 100644
--- a/arch/arm/mach-omap2/clock.h
+++ b/arch/arm/mach-omap2/clock.h
@@ -65,6 +65,12 @@ int omap2_clksel_set_rate(struct clk *clk, unsigned long rate);
 u32 omap2_get_dpll_rate(struct clk *clk);
 int omap2_wait_clock_ready(void __iomem *reg, u32 cval, const char *name);
 void omap2_clk_prepare_for_reboot(void);
+int omap2_dflt_clk_enable(struct clk *clk);
+void omap2_dflt_clk_disable(struct clk *clk);
+void omap2_clk_dflt_find_companion(struct clk *clk, void __iomem **other_reg,
+                                   u8 *other_bit);
+void omap2_clk_dflt_find_idlest(struct clk *clk, void __iomem **idlest_reg,
+                                u8 *idlest_bit);
 
 extern const struct clkops clkops_omap2_dflt_wait;
 extern const struct clkops clkops_omap2_dflt;
diff --git a/arch/arm/mach-omap2/clock24xx.c b/arch/arm/mach-omap2/clock24xx.c
index 44de0271fc2f..bc5d3ac66611 100644
--- a/arch/arm/mach-omap2/clock24xx.c
+++ b/arch/arm/mach-omap2/clock24xx.c
@@ -30,6 +30,7 @@
 
 #include <mach/clock.h>
 #include <mach/sram.h>
+#include <mach/prcm.h>
 #include <asm/div64.h>
 #include <asm/clkdev.h>
 
@@ -43,6 +44,18 @@
 static const struct clkops clkops_oscck;
 static const struct clkops clkops_fixed;
 
+static void omap2430_clk_i2chs_find_idlest(struct clk *clk,
+                                           void __iomem **idlest_reg,
+                                           u8 *idlest_bit);
+
+/* 2430 I2CHS has non-standard IDLEST register */
+static const struct clkops clkops_omap2430_i2chs_wait = {
+        .enable         = omap2_dflt_clk_enable,
+        .disable        = omap2_dflt_clk_disable,
+        .find_idlest    = omap2430_clk_i2chs_find_idlest,
+        .find_companion = omap2_clk_dflt_find_companion,
+};
+
 #include "clock24xx.h"
 
 struct omap_clk {
@@ -240,6 +253,26 @@ static void __iomem *prcm_clksrc_ctrl;
  *-------------------------------------------------------------------------*/
 
 /**
+ * omap2430_clk_i2chs_find_idlest - return CM_IDLEST info for 2430 I2CHS
+ * @clk: struct clk * being enabled
+ * @idlest_reg: void __iomem ** to store CM_IDLEST reg address into
+ * @idlest_bit: pointer to a u8 to store the CM_IDLEST bit shift into
+ *
+ * OMAP2430 I2CHS CM_IDLEST bits are in CM_IDLEST1_CORE, but the
+ * CM_*CLKEN bits are in CM_{I,F}CLKEN2_CORE.  This custom function
+ * passes back the correct CM_IDLEST register address for I2CHS
+ * modules.  No return value.
+ */
+static void omap2430_clk_i2chs_find_idlest(struct clk *clk,
+                                           void __iomem **idlest_reg,
+                                           u8 *idlest_bit)
+{
+        *idlest_reg = OMAP_CM_REGADDR(CORE_MOD, CM_IDLEST);
+        *idlest_bit = clk->enable_bit;
+}
+
+
+/**
  * omap2xxx_clk_get_core_rate - return the CORE_CLK rate
  * @clk: pointer to the combined dpll_ck + core_ck (currently "dpll_ck")
  *
@@ -325,8 +358,8 @@ static int omap2_clk_fixed_enable(struct clk *clk)
         else if (clk == &apll54_ck)
                 cval = OMAP24XX_ST_54M_APLL;
 
-        omap2_wait_clock_ready(OMAP_CM_REGADDR(PLL_MOD, CM_IDLEST), cval,
-                            clk->name);
+        omap2_cm_wait_idlest(OMAP_CM_REGADDR(PLL_MOD, CM_IDLEST), cval,
+                             clk->name);
 
         /*
          * REVISIT: Should we return an error code if omap2_wait_clock_ready()
diff --git a/arch/arm/mach-omap2/clock24xx.h b/arch/arm/mach-omap2/clock24xx.h
index 458f00cdcbea..d19cf7a7d8db 100644
--- a/arch/arm/mach-omap2/clock24xx.h
+++ b/arch/arm/mach-omap2/clock24xx.h
@@ -2337,7 +2337,7 @@ static struct clk i2c2_fck = {
 
 static struct clk i2chs2_fck = {
         .name           = "i2c_fck",
-        .ops            = &clkops_omap2_dflt_wait,
+        .ops            = &clkops_omap2430_i2chs_wait,
         .id             = 2,
         .parent         = &func_96m_ck,
         .clkdm_name     = "core_l4_clkdm",
@@ -2370,7 +2370,7 @@ static struct clk i2c1_fck = {
 
 static struct clk i2chs1_fck = {
         .name           = "i2c_fck",
-        .ops            = &clkops_omap2_dflt_wait,
+        .ops            = &clkops_omap2430_i2chs_wait,
         .id             = 1,
         .parent         = &func_96m_ck,
         .clkdm_name     = "core_l4_clkdm",
diff --git a/arch/arm/mach-omap2/clock34xx.c b/arch/arm/mach-omap2/clock34xx.c
index 045da923e75b..cd7819cc0c9e 100644
--- a/arch/arm/mach-omap2/clock34xx.c
+++ b/arch/arm/mach-omap2/clock34xx.c
@@ -2,7 +2,7 @@
  * OMAP3-specific clock framework functions
  *
  * Copyright (C) 2007-2008 Texas Instruments, Inc.
- * Copyright (C) 2007-2008 Nokia Corporation
+ * Copyright (C) 2007-2009 Nokia Corporation
  *
  * Written by Paul Walmsley
  * Testing and integration fixes by Jouni Högander
@@ -41,6 +41,37 @@
 
 static const struct clkops clkops_noncore_dpll_ops;
 
+static void omap3430es2_clk_ssi_find_idlest(struct clk *clk,
+                                            void __iomem **idlest_reg,
+                                            u8 *idlest_bit);
+static void omap3430es2_clk_hsotgusb_find_idlest(struct clk *clk,
+                                            void __iomem **idlest_reg,
+                                            u8 *idlest_bit);
+static void omap3430es2_clk_dss_usbhost_find_idlest(struct clk *clk,
+                                                    void __iomem **idlest_reg,
+                                                    u8 *idlest_bit);
+
+static const struct clkops clkops_omap3430es2_ssi_wait = {
+        .enable         = omap2_dflt_clk_enable,
+        .disable        = omap2_dflt_clk_disable,
+        .find_idlest    = omap3430es2_clk_ssi_find_idlest,
+        .find_companion = omap2_clk_dflt_find_companion,
+};
+
+static const struct clkops clkops_omap3430es2_hsotgusb_wait = {
+        .enable         = omap2_dflt_clk_enable,
+        .disable        = omap2_dflt_clk_disable,
+        .find_idlest    = omap3430es2_clk_hsotgusb_find_idlest,
+        .find_companion = omap2_clk_dflt_find_companion,
+};
+
+static const struct clkops clkops_omap3430es2_dss_usbhost_wait = {
+        .enable         = omap2_dflt_clk_enable,
+        .disable        = omap2_dflt_clk_disable,
+        .find_idlest    = omap3430es2_clk_dss_usbhost_find_idlest,
+        .find_companion = omap2_clk_dflt_find_companion,
+};
+
 #include "clock34xx.h"
 
 struct omap_clk {
@@ -157,10 +188,13 @@ static struct omap_clk omap34xx_clks[] = {
         CLK(NULL,       "fshostusb_fck", &fshostusb_fck, CK_3430ES1),
         CLK(NULL,       "core_12m_fck", &core_12m_fck,  CK_343X),
         CLK("omap_hdq.0", "fck",        &hdq_fck,       CK_343X),
-        CLK(NULL,       "ssi_ssr_fck",  &ssi_ssr_fck,   CK_343X),
-        CLK(NULL,       "ssi_sst_fck",  &ssi_sst_fck,   CK_343X),
+        CLK(NULL,       "ssi_ssr_fck",  &ssi_ssr_fck_3430es1,   CK_3430ES1),
+        CLK(NULL,       "ssi_ssr_fck",  &ssi_ssr_fck_3430es2,   CK_3430ES2),
+        CLK(NULL,       "ssi_sst_fck",  &ssi_sst_fck_3430es1,   CK_3430ES1),
+        CLK(NULL,       "ssi_sst_fck",  &ssi_sst_fck_3430es2,   CK_3430ES2),
         CLK(NULL,       "core_l3_ick",  &core_l3_ick,   CK_343X),
-        CLK("musb_hdrc",        "ick",  &hsotgusb_ick,  CK_343X),
+        CLK("musb_hdrc",        "ick",  &hsotgusb_ick_3430es1,  CK_3430ES1),
+        CLK("musb_hdrc",        "ick",  &hsotgusb_ick_3430es2,  CK_3430ES2),
         CLK(NULL,       "sdrc_ick",     &sdrc_ick,      CK_343X),
         CLK(NULL,       "gpmc_fck",     &gpmc_fck,      CK_343X),
         CLK(NULL,       "security_l3_ick", &security_l3_ick, CK_343X),
@@ -193,18 +227,21 @@ static struct omap_clk omap34xx_clks[] = {
         CLK(NULL,       "mailboxes_ick", &mailboxes_ick, CK_343X),
         CLK(NULL,       "omapctrl_ick", &omapctrl_ick,  CK_343X),
         CLK(NULL,       "ssi_l4_ick",   &ssi_l4_ick,    CK_343X),
-        CLK(NULL,       "ssi_ick",      &ssi_ick,       CK_343X),
+        CLK(NULL,       "ssi_ick",      &ssi_ick_3430es1,       CK_3430ES1),
+        CLK(NULL,       "ssi_ick",      &ssi_ick_3430es2,       CK_3430ES2),
         CLK(NULL,       "usb_l4_ick",   &usb_l4_ick,    CK_3430ES1),
         CLK(NULL,       "security_l4_ick2", &security_l4_ick2, CK_343X),
         CLK(NULL,       "aes1_ick",     &aes1_ick,      CK_343X),
         CLK("omap_rng", "ick",          &rng_ick,       CK_343X),
         CLK(NULL,       "sha11_ick",    &sha11_ick,     CK_343X),
         CLK(NULL,       "des1_ick",     &des1_ick,      CK_343X),
-        CLK("omapfb",   "dss1_fck",     &dss1_alwon_fck, CK_343X),
+        CLK("omapfb",   "dss1_fck",     &dss1_alwon_fck_3430es1, CK_3430ES1),
+        CLK("omapfb",   "dss1_fck",     &dss1_alwon_fck_3430es2, CK_3430ES2),
         CLK("omapfb",   "tv_fck",       &dss_tv_fck,    CK_343X),
         CLK("omapfb",   "video_fck",    &dss_96m_fck,   CK_343X),
         CLK("omapfb",   "dss2_fck",     &dss2_alwon_fck, CK_343X),
-        CLK("omapfb",   "ick",          &dss_ick,       CK_343X),
+        CLK("omapfb",   "ick",          &dss_ick_3430es1,       CK_3430ES1),
+        CLK("omapfb",   "ick",          &dss_ick_3430es2,       CK_3430ES2),
         CLK(NULL,       "cam_mclk",     &cam_mclk,      CK_343X),
         CLK(NULL,       "cam_ick",      &cam_ick,       CK_343X),
         CLK(NULL,       "csi2_96m_fck", &csi2_96m_fck,  CK_343X),
@@ -301,6 +338,73 @@ static struct omap_clk omap34xx_clks[] = {
 #define SDRC_MPURATE_LOOPS              96
 
 /**
+ * omap3430es2_clk_ssi_find_idlest - return CM_IDLEST info for SSI
+ * @clk: struct clk * being enabled
+ * @idlest_reg: void __iomem ** to store CM_IDLEST reg address into
+ * @idlest_bit: pointer to a u8 to store the CM_IDLEST bit shift into
+ *
+ * The OMAP3430ES2 SSI target CM_IDLEST bit is at a different shift
+ * from the CM_{I,F}CLKEN bit.  Pass back the correct info via
+ * @idlest_reg and @idlest_bit.  No return value.
+ */
+static void omap3430es2_clk_ssi_find_idlest(struct clk *clk,
+                                            void __iomem **idlest_reg,
+                                            u8 *idlest_bit)
+{
+        u32 r;
+
+        r = (((__force u32)clk->enable_reg & ~0xf0) | 0x20);
+        *idlest_reg = (__force void __iomem *)r;
+        *idlest_bit = OMAP3430ES2_ST_SSI_IDLE_SHIFT;
+}
+
+/**
+ * omap3430es2_clk_dss_usbhost_find_idlest - CM_IDLEST info for DSS, USBHOST
+ * @clk: struct clk * being enabled
+ * @idlest_reg: void __iomem ** to store CM_IDLEST reg address into
+ * @idlest_bit: pointer to a u8 to store the CM_IDLEST bit shift into
+ *
+ * Some OMAP modules on OMAP3 ES2+ chips have both initiator and
+ * target IDLEST bits.  For our purposes, we are concerned with the
+ * target IDLEST bits, which exist at a different bit position than
+ * the *CLKEN bit position for these modules (DSS and USBHOST) (The
+ * default find_idlest code assumes that they are at the same
+ * position.)  No return value.
+ */
+static void omap3430es2_clk_dss_usbhost_find_idlest(struct clk *clk,
+                                                    void __iomem **idlest_reg,
+                                                    u8 *idlest_bit)
+{
+        u32 r;
+
+        r = (((__force u32)clk->enable_reg & ~0xf0) | 0x20);
+        *idlest_reg = (__force void __iomem *)r;
+        /* USBHOST_IDLE has same shift */
+        *idlest_bit = OMAP3430ES2_ST_DSS_IDLE_SHIFT;
+}
+
+/**
+ * omap3430es2_clk_hsotgusb_find_idlest - return CM_IDLEST info for HSOTGUSB
+ * @clk: struct clk * being enabled
+ * @idlest_reg: void __iomem ** to store CM_IDLEST reg address into
+ * @idlest_bit: pointer to a u8 to store the CM_IDLEST bit shift into
+ *
+ * The OMAP3430ES2 HSOTGUSB target CM_IDLEST bit is at a different
+ * shift from the CM_{I,F}CLKEN bit.  Pass back the correct info via
+ * @idlest_reg and @idlest_bit.  No return value.
+ */
+static void omap3430es2_clk_hsotgusb_find_idlest(struct clk *clk,
+                                                 void __iomem **idlest_reg,
+                                                 u8 *idlest_bit)
+{
+        u32 r;
+
+        r = (((__force u32)clk->enable_reg & ~0xf0) | 0x20);
+        *idlest_reg = (__force void __iomem *)r;
+        *idlest_bit = OMAP3430ES2_ST_HSOTGUSB_IDLE_SHIFT;
+}
+
+/**
  * omap3_dpll_recalc - recalculate DPLL rate
  * @clk: DPLL struct clk
  *
@@ -725,7 +829,9 @@ static int omap3_core_dpll_m2_set_rate(struct clk *clk, unsigned long rate)
         u32 unlock_dll = 0;
         u32 c;
         unsigned long validrate, sdrcrate, mpurate;
-        struct omap_sdrc_params *sp;
+        struct omap_sdrc_params *sdrc_cs0;
+        struct omap_sdrc_params *sdrc_cs1;
+        int ret;
 
         if (!clk || !rate)
                 return -EINVAL;
@@ -743,8 +849,8 @@ static int omap3_core_dpll_m2_set_rate(struct clk *clk, unsigned long rate)
         else
                 sdrcrate >>= ((clk->rate / rate) >> 1);
 
-        sp = omap2_sdrc_get_params(sdrcrate);
-        if (!sp)
+        ret = omap2_sdrc_get_params(sdrcrate, &sdrc_cs0, &sdrc_cs1);
+        if (ret)
                 return -EINVAL;
 
         if (sdrcrate < MIN_SDRC_DLL_LOCK_FREQ) {
@@ -765,12 +871,29 @@ static int omap3_core_dpll_m2_set_rate(struct clk *clk, unsigned long rate)
 
         pr_debug("clock: changing CORE DPLL rate from %lu to %lu\n", clk->rate,
                  validrate);
-        pr_debug("clock: SDRC timing params used: %08x %08x %08x\n",
-                 sp->rfr_ctrl, sp->actim_ctrla, sp->actim_ctrlb);
-
-        omap3_configure_core_dpll(sp->rfr_ctrl, sp->actim_ctrla,
-                                  sp->actim_ctrlb, new_div, unlock_dll, c,
-                                  sp->mr, rate > clk->rate);
+        pr_debug("clock: SDRC CS0 timing params used:"
+                 " RFR %08x CTRLA %08x CTRLB %08x MR %08x\n",
+                 sdrc_cs0->rfr_ctrl, sdrc_cs0->actim_ctrla,
+                 sdrc_cs0->actim_ctrlb, sdrc_cs0->mr);
+        if (sdrc_cs1)
+                pr_debug("clock: SDRC CS1 timing params used: "
+                 " RFR %08x CTRLA %08x CTRLB %08x MR %08x\n",
+                 sdrc_cs1->rfr_ctrl, sdrc_cs1->actim_ctrla,
+                 sdrc_cs1->actim_ctrlb, sdrc_cs1->mr);
+
+        if (sdrc_cs1)
+                omap3_configure_core_dpll(
+                                  new_div, unlock_dll, c, rate > clk->rate,
+                                  sdrc_cs0->rfr_ctrl, sdrc_cs0->actim_ctrla,
+                                  sdrc_cs0->actim_ctrlb, sdrc_cs0->mr,
+                                  sdrc_cs1->rfr_ctrl, sdrc_cs1->actim_ctrla,
+                                  sdrc_cs1->actim_ctrlb, sdrc_cs1->mr);
+        else
+                omap3_configure_core_dpll(
+                                  new_div, unlock_dll, c, rate > clk->rate,
+                                  sdrc_cs0->rfr_ctrl, sdrc_cs0->actim_ctrla,
+                                  sdrc_cs0->actim_ctrlb, sdrc_cs0->mr,
+                                  0, 0, 0, 0);
 
         return 0;
 }
diff --git a/arch/arm/mach-omap2/clock34xx.h b/arch/arm/mach-omap2/clock34xx.h
index e433aec4efdd..57cc2725b923 100644
--- a/arch/arm/mach-omap2/clock34xx.h
+++ b/arch/arm/mach-omap2/clock34xx.h
@@ -1568,7 +1568,7 @@ static const struct clksel ssi_ssr_clksel[] = {
         { .parent = NULL }
 };
 
-static struct clk ssi_ssr_fck = {
+static struct clk ssi_ssr_fck_3430es1 = {
         .name           = "ssi_ssr_fck",
         .ops            = &clkops_omap2_dflt,
         .init           = &omap2_init_clksel_parent,
@@ -1581,10 +1581,31 @@ static struct clk ssi_ssr_fck = {
         .recalc         = &omap2_clksel_recalc,
 };
 
-static struct clk ssi_sst_fck = {
+static struct clk ssi_ssr_fck_3430es2 = {
+        .name           = "ssi_ssr_fck",
+        .ops            = &clkops_omap3430es2_ssi_wait,
+        .init           = &omap2_init_clksel_parent,
+        .enable_reg     = OMAP_CM_REGADDR(CORE_MOD, CM_FCLKEN1),
+        .enable_bit     = OMAP3430_EN_SSI_SHIFT,
+        .clksel_reg     = OMAP_CM_REGADDR(CORE_MOD, CM_CLKSEL),
+        .clksel_mask    = OMAP3430_CLKSEL_SSI_MASK,
+        .clksel         = ssi_ssr_clksel,
+        .clkdm_name     = "core_l4_clkdm",
+        .recalc         = &omap2_clksel_recalc,
+};
+
+static struct clk ssi_sst_fck_3430es1 = {
         .name           = "ssi_sst_fck",
         .ops            = &clkops_null,
-        .parent         = &ssi_ssr_fck,
+        .parent         = &ssi_ssr_fck_3430es1,
+        .fixed_div      = 2,
+        .recalc         = &omap2_fixed_divisor_recalc,
+};
+
+static struct clk ssi_sst_fck_3430es2 = {
+        .name           = "ssi_sst_fck",
+        .ops            = &clkops_null,
+        .parent         = &ssi_ssr_fck_3430es2,
         .fixed_div      = 2,
         .recalc         = &omap2_fixed_divisor_recalc,
 };
@@ -1606,9 +1627,19 @@ static struct clk core_l3_ick = {
         .recalc         = &followparent_recalc,
 };
 
-static struct clk hsotgusb_ick = {
+static struct clk hsotgusb_ick_3430es1 = {
         .name           = "hsotgusb_ick",
-        .ops            = &clkops_omap2_dflt_wait,
+        .ops            = &clkops_omap2_dflt,
+        .parent         = &core_l3_ick,
+        .enable_reg     = OMAP_CM_REGADDR(CORE_MOD, CM_ICLKEN1),
+        .enable_bit     = OMAP3430_EN_HSOTGUSB_SHIFT,
+        .clkdm_name     = "core_l3_clkdm",
+        .recalc         = &followparent_recalc,
+};
+
+static struct clk hsotgusb_ick_3430es2 = {
+        .name           = "hsotgusb_ick",
+        .ops            = &clkops_omap3430es2_hsotgusb_wait,
         .parent         = &core_l3_ick,
         .enable_reg     = OMAP_CM_REGADDR(CORE_MOD, CM_ICLKEN1),
         .enable_bit     = OMAP3430_EN_HSOTGUSB_SHIFT,
@@ -1947,7 +1978,7 @@ static struct clk ssi_l4_ick = {
         .recalc         = &followparent_recalc,
 };
 
-static struct clk ssi_ick = {
+static struct clk ssi_ick_3430es1 = {
         .name           = "ssi_ick",
         .ops            = &clkops_omap2_dflt,
         .parent         = &ssi_l4_ick,
@@ -1957,6 +1988,16 @@ static struct clk ssi_ick = {
         .recalc         = &followparent_recalc,
 };
 
+static struct clk ssi_ick_3430es2 = {
+        .name           = "ssi_ick",
+        .ops            = &clkops_omap3430es2_ssi_wait,
+        .parent         = &ssi_l4_ick,
+        .enable_reg     = OMAP_CM_REGADDR(CORE_MOD, CM_ICLKEN1),
+        .enable_bit     = OMAP3430_EN_SSI_SHIFT,
+        .clkdm_name     = "core_l4_clkdm",
+        .recalc         = &followparent_recalc,
+};
+
 /* REVISIT: Technically the TRM claims that this is CORE_CLK based,
  * but l4_ick makes more sense to me */
 
@@ -2024,7 +2065,7 @@ static struct clk des1_ick = {
 };
 
 /* DSS */
-static struct clk dss1_alwon_fck = {
+static struct clk dss1_alwon_fck_3430es1 = {
         .name           = "dss1_alwon_fck",
         .ops            = &clkops_omap2_dflt,
         .parent         = &dpll4_m4x2_ck,
@@ -2034,6 +2075,16 @@ static struct clk dss1_alwon_fck = {
         .recalc         = &followparent_recalc,
 };
 
+static struct clk dss1_alwon_fck_3430es2 = {
+        .name           = "dss1_alwon_fck",
+        .ops            = &clkops_omap3430es2_dss_usbhost_wait,
+        .parent         = &dpll4_m4x2_ck,
+        .enable_reg     = OMAP_CM_REGADDR(OMAP3430_DSS_MOD, CM_FCLKEN),
+        .enable_bit     = OMAP3430_EN_DSS1_SHIFT,
+        .clkdm_name     = "dss_clkdm",
+        .recalc         = &followparent_recalc,
+};
+
 static struct clk dss_tv_fck = {
         .name           = "dss_tv_fck",
         .ops            = &clkops_omap2_dflt,
@@ -2067,7 +2118,7 @@ static struct clk dss2_alwon_fck = {
         .recalc         = &followparent_recalc,
 };
 
-static struct clk dss_ick = {
+static struct clk dss_ick_3430es1 = {
         /* Handles both L3 and L4 clocks */
         .name           = "dss_ick",
         .ops            = &clkops_omap2_dflt,
@@ -2079,6 +2130,18 @@ static struct clk dss_ick = {
         .recalc         = &followparent_recalc,
 };
 
+static struct clk dss_ick_3430es2 = {
+        /* Handles both L3 and L4 clocks */
+        .name           = "dss_ick",
+        .ops            = &clkops_omap3430es2_dss_usbhost_wait,
+        .parent         = &l4_ick,
+        .init           = &omap2_init_clk_clkdm,
+        .enable_reg     = OMAP_CM_REGADDR(OMAP3430_DSS_MOD, CM_ICLKEN),
+        .enable_bit     = OMAP3430_CM_ICLKEN_DSS_EN_DSS_SHIFT,
+        .clkdm_name     = "dss_clkdm",
+        .recalc         = &followparent_recalc,
+};
+
 /* CAM */
 
 static struct clk cam_mclk = {
@@ -2118,7 +2181,7 @@ static struct clk csi2_96m_fck = {
 
 static struct clk usbhost_120m_fck = {
         .name           = "usbhost_120m_fck",
-        .ops            = &clkops_omap2_dflt_wait,
+        .ops            = &clkops_omap2_dflt,
         .parent         = &dpll5_m2_ck,
         .init           = &omap2_init_clk_clkdm,
         .enable_reg     = OMAP_CM_REGADDR(OMAP3430ES2_USBHOST_MOD, CM_FCLKEN),
@@ -2129,7 +2192,7 @@ static struct clk usbhost_120m_fck = {
 
 static struct clk usbhost_48m_fck = {
         .name           = "usbhost_48m_fck",
-        .ops            = &clkops_omap2_dflt_wait,
+        .ops            = &clkops_omap3430es2_dss_usbhost_wait,
         .parent         = &omap_48m_fck,
         .init           = &omap2_init_clk_clkdm,
         .enable_reg     = OMAP_CM_REGADDR(OMAP3430ES2_USBHOST_MOD, CM_FCLKEN),
@@ -2141,7 +2204,7 @@ static struct clk usbhost_48m_fck = {
 static struct clk usbhost_ick = {
         /* Handles both L3 and L4 clocks */
         .name           = "usbhost_ick",
-        .ops            = &clkops_omap2_dflt_wait,
+        .ops            = &clkops_omap3430es2_dss_usbhost_wait,
         .parent         = &l4_ick,
         .init           = &omap2_init_clk_clkdm,
         .enable_reg     = OMAP_CM_REGADDR(OMAP3430ES2_USBHOST_MOD, CM_ICLKEN),
diff --git a/arch/arm/mach-omap2/cm.h b/arch/arm/mach-omap2/cm.h
index 1d3c93bf86d3..f3c91a1ca391 100644
--- a/arch/arm/mach-omap2/cm.h
+++ b/arch/arm/mach-omap2/cm.h
@@ -29,9 +29,9 @@
  * These registers appear once per CM module.
  */
 
-#define OMAP3430_CM_REVISION            OMAP_CM_REGADDR(OCP_MOD, 0x0000)
-#define OMAP3430_CM_SYSCONFIG           OMAP_CM_REGADDR(OCP_MOD, 0x0010)
-#define OMAP3430_CM_POLCTRL             OMAP_CM_REGADDR(OCP_MOD, 0x009c)
+#define OMAP3430_CM_REVISION            OMAP34XX_CM_REGADDR(OCP_MOD, 0x0000)
+#define OMAP3430_CM_SYSCONFIG           OMAP34XX_CM_REGADDR(OCP_MOD, 0x0010)
+#define OMAP3430_CM_POLCTRL             OMAP34XX_CM_REGADDR(OCP_MOD, 0x009c)
 
 #define OMAP3_CM_CLKOUT_CTRL_OFFSET     0x0070
 #define OMAP3430_CM_CLKOUT_CTRL         OMAP_CM_REGADDR(OMAP3430_CCR_MOD, 0x0070)
diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
index 3a86b0f66031..e9b9bcb19b4e 100644
--- a/arch/arm/mach-omap2/io.c
+++ b/arch/arm/mach-omap2/io.c
@@ -276,14 +276,15 @@ static int __init _omap2_init_reprogram_sdrc(void)
         return v;
 }
 
-void __init omap2_init_common_hw(struct omap_sdrc_params *sp)
+void __init omap2_init_common_hw(struct omap_sdrc_params *sdrc_cs0,
+                                 struct omap_sdrc_params *sdrc_cs1)
 {
         omap2_mux_init();
 #ifndef CONFIG_ARCH_OMAP4 /* FIXME: Remove this once the clkdev is ready */
         pwrdm_init(powerdomains_omap);
         clkdm_init(clockdomains_omap, clkdm_pwrdm_autodeps);
         omap2_clk_init();
-        omap2_sdrc_init(sp);
+        omap2_sdrc_init(sdrc_cs0, sdrc_cs1);
         _omap2_init_reprogram_sdrc();
 #endif
         gpmc_init();
diff --git a/arch/arm/mach-omap2/mmc-twl4030.c b/arch/arm/mach-omap2/mmc-twl4030.c
index 1541fd4c8d0f..3c04c2f1b23f 100644
--- a/arch/arm/mach-omap2/mmc-twl4030.c
+++ b/arch/arm/mach-omap2/mmc-twl4030.c
@@ -119,6 +119,7 @@ static int twl_mmc_late_init(struct device *dev)
                                 if (i != 0)
                                         break;
                                 ret = PTR_ERR(reg);
+                                hsmmc[i].vcc = NULL;
                                 goto err;
                         }
                         hsmmc[i].vcc = reg;
@@ -165,8 +166,13 @@ done:
 static void twl_mmc_cleanup(struct device *dev)
 {
         struct omap_mmc_platform_data *mmc = dev->platform_data;
+        int i;
 
         gpio_free(mmc->slots[0].switch_pin);
+        for(i = 0; i < ARRAY_SIZE(hsmmc); i++) {
+                regulator_put(hsmmc[i].vcc);
+                regulator_put(hsmmc[i].vcc_aux);
+        }
 }
 
 #ifdef CONFIG_PM
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index 026c4fc883a7..43d6b92b65f2 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -486,6 +486,12 @@ MUX_CFG_34XX("H19_34XX_GPIO164_OUT", 0x19c,
                 OMAP34XX_MUX_MODE4 | OMAP34XX_PIN_OUTPUT)
 MUX_CFG_34XX("J25_34XX_GPIO170", 0x1c6,
                 OMAP34XX_MUX_MODE4 | OMAP34XX_PIN_INPUT)
+
+/* OMAP3 SDRC CKE signals to SDR/DDR ram chips */
+MUX_CFG_34XX("H16_34XX_SDRC_CKE0", 0x262,
+                OMAP34XX_MUX_MODE0 | OMAP34XX_PIN_OUTPUT)
+MUX_CFG_34XX("H17_34XX_SDRC_CKE1", 0x264,
+                OMAP34XX_MUX_MODE0 | OMAP34XX_PIN_OUTPUT)
 };
 
 #define OMAP34XX_PINS_SZ        ARRAY_SIZE(omap34xx_pins)
diff --git a/arch/arm/mach-omap2/pm.h b/arch/arm/mach-omap2/pm.h
index f7b3baf76678..21201cd4117b 100644
--- a/arch/arm/mach-omap2/pm.h
+++ b/arch/arm/mach-omap2/pm.h
@@ -11,9 +11,6 @@
 #ifndef __ARCH_ARM_MACH_OMAP2_PM_H
 #define __ARCH_ARM_MACH_OMAP2_PM_H
 
-extern int omap2_pm_init(void);
-extern int omap3_pm_init(void);
-
 #ifdef CONFIG_PM_DEBUG
 extern void omap2_pm_dump(int mode, int resume, unsigned int us);
 extern int omap2_pm_debug;
diff --git a/arch/arm/mach-omap2/pm24xx.c b/arch/arm/mach-omap2/pm24xx.c
index db1025562fb0..528dbdc26e23 100644
--- a/arch/arm/mach-omap2/pm24xx.c
+++ b/arch/arm/mach-omap2/pm24xx.c
@@ -470,7 +470,7 @@ static void __init prcm_setup_regs(void)
                           WKUP_MOD, PM_WKEN);
 }
 
-int __init omap2_pm_init(void)
+static int __init omap2_pm_init(void)
 {
         u32 l;
 
diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
index 841d4c5ed8be..488d595d8e4b 100644
--- a/arch/arm/mach-omap2/pm34xx.c
+++ b/arch/arm/mach-omap2/pm34xx.c
@@ -39,7 +39,9 @@
 struct power_state {
         struct powerdomain *pwrdm;
         u32 next_state;
+#ifdef CONFIG_SUSPEND
         u32 saved_state;
+#endif
         struct list_head node;
 };
 
@@ -293,6 +295,9 @@ out:
         local_irq_enable();
 }
 
+#ifdef CONFIG_SUSPEND
+static suspend_state_t suspend_state;
+
 static int omap3_pm_prepare(void)
 {
         disable_hlt();
@@ -321,7 +326,6 @@ static int omap3_pm_suspend(void)
 restore:
         /* Restore next_pwrsts */
         list_for_each_entry(pwrst, &pwrst_list, node) {
-                set_pwrdm_state(pwrst->pwrdm, pwrst->saved_state);
                 state = pwrdm_read_prev_pwrst(pwrst->pwrdm);
                 if (state > pwrst->next_state) {
                         printk(KERN_INFO "Powerdomain (%s) didn't enter "
@@ -329,6 +333,7 @@ restore:
                                pwrst->pwrdm->name, pwrst->next_state);
                         ret = -1;
                 }
+                set_pwrdm_state(pwrst->pwrdm, pwrst->saved_state);
         }
         if (ret)
                 printk(KERN_ERR "Could not enter target state in pm_suspend\n");
@@ -339,11 +344,11 @@ restore:
         return ret;
 }
 
-static int omap3_pm_enter(suspend_state_t state)
+static int omap3_pm_enter(suspend_state_t unused)
 {
         int ret = 0;
 
-        switch (state) {
+        switch (suspend_state) {
         case PM_SUSPEND_STANDBY:
         case PM_SUSPEND_MEM:
                 ret = omap3_pm_suspend();
@@ -360,12 +365,30 @@ static void omap3_pm_finish(void)
         enable_hlt();
 }
 
+/* Hooks to enable / disable UART interrupts during suspend */
+static int omap3_pm_begin(suspend_state_t state)
+{
+        suspend_state = state;
+        omap_uart_enable_irqs(0);
+        return 0;
+}
+
+static void omap3_pm_end(void)
+{
+        suspend_state = PM_SUSPEND_ON;
+        omap_uart_enable_irqs(1);
+        return;
+}
+
 static struct platform_suspend_ops omap_pm_ops = {
+        .begin          = omap3_pm_begin,
+        .end            = omap3_pm_end,
         .prepare        = omap3_pm_prepare,
         .enter          = omap3_pm_enter,
         .finish         = omap3_pm_finish,
         .valid          = suspend_valid_only_mem,
 };
+#endif /* CONFIG_SUSPEND */
 
 
 /**
@@ -613,6 +636,24 @@ static void __init prcm_setup_regs(void)
         /* Clear any pending PRCM interrupts */
         prm_write_mod_reg(0, OCP_MOD, OMAP3_PRM_IRQSTATUS_MPU_OFFSET);
 
+        /* Don't attach IVA interrupts */
+        prm_write_mod_reg(0, WKUP_MOD, OMAP3430_PM_IVAGRPSEL);
+        prm_write_mod_reg(0, CORE_MOD, OMAP3430_PM_IVAGRPSEL1);
+        prm_write_mod_reg(0, CORE_MOD, OMAP3430ES2_PM_IVAGRPSEL3);
+        prm_write_mod_reg(0, OMAP3430_PER_MOD, OMAP3430_PM_IVAGRPSEL);
+
+        /* Clear any pending 'reset' flags */
+        prm_write_mod_reg(0xffffffff, MPU_MOD, RM_RSTST);
+        prm_write_mod_reg(0xffffffff, CORE_MOD, RM_RSTST);
+        prm_write_mod_reg(0xffffffff, OMAP3430_PER_MOD, RM_RSTST);
+        prm_write_mod_reg(0xffffffff, OMAP3430_EMU_MOD, RM_RSTST);
+        prm_write_mod_reg(0xffffffff, OMAP3430_NEON_MOD, RM_RSTST);
+        prm_write_mod_reg(0xffffffff, OMAP3430_DSS_MOD, RM_RSTST);
+        prm_write_mod_reg(0xffffffff, OMAP3430ES2_USBHOST_MOD, RM_RSTST);
+
+        /* Clear any pending PRCM interrupts */
+        prm_write_mod_reg(0, OCP_MOD, OMAP3_PRM_IRQSTATUS_MPU_OFFSET);
+
         omap3_iva_idle();
         omap3_d2d_idle();
 }
@@ -652,7 +693,7 @@ static int __init clkdms_setup(struct clockdomain *clkdm)
         return 0;
 }
 
-int __init omap3_pm_init(void)
+static int __init omap3_pm_init(void)
 {
         struct power_state *pwrst, *tmp;
         int ret;
@@ -692,7 +733,9 @@ int __init omap3_pm_init(void)
         _omap_sram_idle = omap_sram_push(omap34xx_cpu_suspend,
                                          omap34xx_cpu_suspend_sz);
 
+#ifdef CONFIG_SUSPEND
         suspend_set_ops(&omap_pm_ops);
+#endif /* CONFIG_SUSPEND */
 
         pm_idle = omap3_pm_idle;
 
diff --git a/arch/arm/mach-omap2/prcm.c b/arch/arm/mach-omap2/prcm.c
index f945156d5585..ced555a4cd1a 100644
--- a/arch/arm/mach-omap2/prcm.c
+++ b/arch/arm/mach-omap2/prcm.c
@@ -17,6 +17,7 @@
 #include <linux/init.h>
 #include <linux/clk.h>
 #include <linux/io.h>
+#include <linux/delay.h>
 
 #include <mach/common.h>
 #include <mach/prcm.h>
@@ -28,6 +29,8 @@
 static void __iomem *prm_base;
 static void __iomem *cm_base;
 
+#define MAX_MODULE_ENABLE_WAIT          100000
+
 u32 omap_prcm_get_reset_sources(void)
 {
         /* XXX This presumably needs modification for 34XX */
@@ -120,6 +123,46 @@ u32 cm_rmw_mod_reg_bits(u32 mask, u32 bits, s16 module, s16 idx)
 }
 EXPORT_SYMBOL(cm_rmw_mod_reg_bits);
 
+/**
+ * omap2_cm_wait_idlest - wait for IDLEST bit to indicate module readiness
+ * @reg: physical address of module IDLEST register
+ * @mask: value to mask against to determine if the module is active
+ * @name: name of the clock (for printk)
+ *
+ * Returns 1 if the module indicated readiness in time, or 0 if it
+ * failed to enable in roughly MAX_MODULE_ENABLE_WAIT microseconds.
+ */
+int omap2_cm_wait_idlest(void __iomem *reg, u32 mask, const char *name)
+{
+        int i = 0;
+        int ena = 0;
+
+        /*
+         * 24xx uses 0 to indicate not ready, and 1 to indicate ready.
+         * 34xx reverses this, just to keep us on our toes
+         */
+        if (cpu_is_omap24xx())
+                ena = mask;
+        else if (cpu_is_omap34xx())
+                ena = 0;
+        else
+                BUG();
+
+        /* Wait for lock */
+        while (((__raw_readl(reg) & mask) != ena) &&
+               (i++ < MAX_MODULE_ENABLE_WAIT))
+                udelay(1);
+
+        if (i < MAX_MODULE_ENABLE_WAIT)
+                pr_debug("cm: Module associated with clock %s ready after %d "
+                         "loops\n", name, i);
+        else
+                pr_err("cm: Module associated with clock %s didn't enable in "
+                       "%d tries\n", name, MAX_MODULE_ENABLE_WAIT);
+
+        return (i < MAX_MODULE_ENABLE_WAIT) ? 1 : 0;
+};
+
 void __init omap2_set_globals_prcm(struct omap_globals *omap2_globals)
 {
         prm_base = omap2_globals->prm;
diff --git a/arch/arm/mach-omap2/sdrc.c b/arch/arm/mach-omap2/sdrc.c
index 2045441e8385..9e3bd4fa7810 100644
--- a/arch/arm/mach-omap2/sdrc.c
+++ b/arch/arm/mach-omap2/sdrc.c
@@ -32,7 +32,7 @@
 #include <mach/sdrc.h>
 #include "sdrc.h"
 
-static struct omap_sdrc_params *sdrc_init_params;
+static struct omap_sdrc_params *sdrc_init_params_cs0, *sdrc_init_params_cs1;
 
 void __iomem *omap2_sdrc_base;
 void __iomem *omap2_sms_base;
@@ -45,33 +45,49 @@ void __iomem *omap2_sms_base;
 /**
  * omap2_sdrc_get_params - return SDRC register values for a given clock rate
  * @r: SDRC clock rate (in Hz)
+ * @sdrc_cs0: chip select 0 ram timings **
+ * @sdrc_cs1: chip select 1 ram timings **
  *
  * Return pre-calculated values for the SDRC_ACTIM_CTRLA,
- * SDRC_ACTIM_CTRLB, SDRC_RFR_CTRL, and SDRC_MR registers, for a given
- * SDRC clock rate 'r'.  These parameters control various timing
- * delays in the SDRAM controller that are expressed in terms of the
- * number of SDRC clock cycles to wait; hence the clock rate
- * dependency. Note that sdrc_init_params must be sorted rate
- * descending.  Also assumes that both chip-selects use the same
- * timing parameters.  Returns a struct omap_sdrc_params * upon
- * success, or NULL upon failure.
+ *  SDRC_ACTIM_CTRLB, SDRC_RFR_CTRL and SDRC_MR registers in sdrc_cs[01]
+ *  structs,for a given SDRC clock rate 'r'.
+ * These parameters control various timing delays in the SDRAM controller
+ *  that are expressed in terms of the number of SDRC clock cycles to
+ *  wait; hence the clock rate dependency.
+ *
+ * Supports 2 different timing parameters for both chip selects.
+ *
+ * Note 1: the sdrc_init_params_cs[01] must be sorted rate descending.
+ * Note 2: If sdrc_init_params_cs_1 is not NULL it must be of same size
+ *  as sdrc_init_params_cs_0.
+ *
+ * Fills in the struct omap_sdrc_params * for each chip select.
+ * Returns 0 upon success or -1 upon failure.
  */
-struct omap_sdrc_params *omap2_sdrc_get_params(unsigned long r)
+int omap2_sdrc_get_params(unsigned long r,
+                          struct omap_sdrc_params **sdrc_cs0,
+                          struct omap_sdrc_params **sdrc_cs1)
 {
-        struct omap_sdrc_params *sp;
+        struct omap_sdrc_params *sp0, *sp1;
 
-        if (!sdrc_init_params)
-                return NULL;
+        if (!sdrc_init_params_cs0)
+                return -1;
 
-        sp = sdrc_init_params;
+        sp0 = sdrc_init_params_cs0;
+        sp1 = sdrc_init_params_cs1;
 
-        while (sp->rate && sp->rate != r)
-                sp++;
+        while (sp0->rate && sp0->rate != r) {
+                sp0++;
+                if (sdrc_init_params_cs1)
+                        sp1++;
+        }
 
-        if (!sp->rate)
-                return NULL;
+        if (!sp0->rate)
+                return -1;
 
-        return sp;
+        *sdrc_cs0 = sp0;
+        *sdrc_cs1 = sp1;
+        return 0;
 }
 
 
@@ -83,13 +99,15 @@ void __init omap2_set_globals_sdrc(struct omap_globals *omap2_globals)
 
 /**
  * omap2_sdrc_init - initialize SMS, SDRC devices on boot
- * @sp: pointer to a null-terminated list of struct omap_sdrc_params
+ * @sdrc_cs[01]: pointers to a null-terminated list of struct omap_sdrc_params
+ *  Support for 2 chip selects timings
  *
  * Turn on smart idle modes for SDRAM scheduler and controller.
  * Program a known-good configuration for the SDRC to deal with buggy
  * bootloaders.
  */
-void __init omap2_sdrc_init(struct omap_sdrc_params *sp)
+void __init omap2_sdrc_init(struct omap_sdrc_params *sdrc_cs0,
+                            struct omap_sdrc_params *sdrc_cs1)
 {
         u32 l;
 
@@ -103,11 +121,15 @@ void __init omap2_sdrc_init(struct omap_sdrc_params *sp)
         l |= (0x2 << 3);
         sdrc_write_reg(l, SDRC_SYSCONFIG);
 
-        sdrc_init_params = sp;
+        sdrc_init_params_cs0 = sdrc_cs0;
+        sdrc_init_params_cs1 = sdrc_cs1;
 
         /* XXX Enable SRFRONIDLEREQ here also? */
+        /*
+         * PWDENA should not be set due to 34xx erratum 1.150 - PWDENA
+         * can cause random memory corruption
+         */
         l = (1 << SDRC_POWER_EXTCLKDIS_SHIFT) |
-                (1 << SDRC_POWER_PWDENA_SHIFT) |
                 (1 << SDRC_POWER_PAGEPOLICY_SHIFT);
         sdrc_write_reg(l, SDRC_POWER);
 }
diff --git a/arch/arm/mach-omap2/serial.c b/arch/arm/mach-omap2/serial.c
index b094c15bfe47..a7421a50410b 100644
--- a/arch/arm/mach-omap2/serial.c
+++ b/arch/arm/mach-omap2/serial.c
@@ -54,6 +54,7 @@ struct omap_uart_state {
 
         struct plat_serial8250_port *p;
         struct list_head node;
+        struct platform_device pdev;
 
 #if defined(CONFIG_ARCH_OMAP3) && defined(CONFIG_PM)
         int context_valid;
@@ -68,10 +69,9 @@ struct omap_uart_state {
 #endif
 };
 
-static struct omap_uart_state omap_uart[OMAP_MAX_NR_PORTS];
 static LIST_HEAD(uart_list);
 
-static struct plat_serial8250_port serial_platform_data[] = {
+static struct plat_serial8250_port serial_platform_data0[] = {
         {
                 .membase        = IO_ADDRESS(OMAP_UART1_BASE),
                 .mapbase        = OMAP_UART1_BASE,
@@ -81,6 +81,12 @@ static struct plat_serial8250_port serial_platform_data[] = {
                 .regshift       = 2,
                 .uartclk        = OMAP24XX_BASE_BAUD * 16,
         }, {
+                .flags          = 0
+        }
+};
+
+static struct plat_serial8250_port serial_platform_data1[] = {
+        {
                 .membase        = IO_ADDRESS(OMAP_UART2_BASE),
                 .mapbase        = OMAP_UART2_BASE,
                 .irq            = 73,
@@ -89,6 +95,12 @@ static struct plat_serial8250_port serial_platform_data[] = {
                 .regshift       = 2,
                 .uartclk        = OMAP24XX_BASE_BAUD * 16,
         }, {
+                .flags          = 0
+        }
+};
+
+static struct plat_serial8250_port serial_platform_data2[] = {
+        {
                 .membase        = IO_ADDRESS(OMAP_UART3_BASE),
                 .mapbase        = OMAP_UART3_BASE,
                 .irq            = 74,
@@ -217,6 +229,40 @@ static inline void omap_uart_disable_clocks(struct omap_uart_state *uart)
         clk_disable(uart->fck);
 }
 
+static void omap_uart_enable_wakeup(struct omap_uart_state *uart)
+{
+        /* Set wake-enable bit */
+        if (uart->wk_en && uart->wk_mask) {
+                u32 v = __raw_readl(uart->wk_en);
+                v |= uart->wk_mask;
+                __raw_writel(v, uart->wk_en);
+        }
+
+        /* Ensure IOPAD wake-enables are set */
+        if (cpu_is_omap34xx() && uart->padconf) {
+                u16 v = omap_ctrl_readw(uart->padconf);
+                v |= OMAP3_PADCONF_WAKEUPENABLE0;
+                omap_ctrl_writew(v, uart->padconf);
+        }
+}
+
+static void omap_uart_disable_wakeup(struct omap_uart_state *uart)
+{
+        /* Clear wake-enable bit */
+        if (uart->wk_en && uart->wk_mask) {
+                u32 v = __raw_readl(uart->wk_en);
+                v &= ~uart->wk_mask;
+                __raw_writel(v, uart->wk_en);
+        }
+
+        /* Ensure IOPAD wake-enables are cleared */
+        if (cpu_is_omap34xx() && uart->padconf) {
+                u16 v = omap_ctrl_readw(uart->padconf);
+                v &= ~OMAP3_PADCONF_WAKEUPENABLE0;
+                omap_ctrl_writew(v, uart->padconf);
+        }
+}
+
 static void omap_uart_smart_idle_enable(struct omap_uart_state *uart,
                                           int enable)
 {
@@ -246,6 +292,11 @@ static void omap_uart_block_sleep(struct omap_uart_state *uart)
 
 static void omap_uart_allow_sleep(struct omap_uart_state *uart)
 {
+        if (device_may_wakeup(&uart->pdev.dev))
+                omap_uart_enable_wakeup(uart);
+        else
+                omap_uart_disable_wakeup(uart);
+
         if (!uart->clocked)
                 return;
 
@@ -292,7 +343,6 @@ void omap_uart_resume_idle(int num)
                         /* Check for normal UART wakeup */
                         if (__raw_readl(uart->wk_st) & uart->wk_mask)
                                 omap_uart_block_sleep(uart);
-
                         return;
                 }
         }
@@ -346,16 +396,13 @@ static irqreturn_t omap_uart_interrupt(int irq, void *dev_id)
         return IRQ_NONE;
 }
 
-static u32 sleep_timeout = DEFAULT_TIMEOUT;
-
 static void omap_uart_idle_init(struct omap_uart_state *uart)
 {
-        u32 v;
         struct plat_serial8250_port *p = uart->p;
         int ret;
 
         uart->can_sleep = 0;
-        uart->timeout = sleep_timeout;
+        uart->timeout = DEFAULT_TIMEOUT;
         setup_timer(&uart->timer, omap_uart_idle_timer,
                     (unsigned long) uart);
         mod_timer(&uart->timer, jiffies + uart->timeout);
@@ -413,76 +460,101 @@ static void omap_uart_idle_init(struct omap_uart_state *uart)
                 uart->padconf = 0;
         }
 
-        /* Set wake-enable bit */
-        if (uart->wk_en && uart->wk_mask) {
-                v = __raw_readl(uart->wk_en);
-                v |= uart->wk_mask;
-                __raw_writel(v, uart->wk_en);
-        }
-
-        /* Ensure IOPAD wake-enables are set */
-        if (cpu_is_omap34xx() && uart->padconf) {
-                u16 v;
-
-                v = omap_ctrl_readw(uart->padconf);
-                v |= OMAP3_PADCONF_WAKEUPENABLE0;
-                omap_ctrl_writew(v, uart->padconf);
-        }
-
         p->flags |= UPF_SHARE_IRQ;
         ret = request_irq(p->irq, omap_uart_interrupt, IRQF_SHARED,
                           "serial idle", (void *)uart);
         WARN_ON(ret);
 }
 
-static ssize_t sleep_timeout_show(struct kobject *kobj,
-                                  struct kobj_attribute *attr,
+void omap_uart_enable_irqs(int enable)
+{
+        int ret;
+        struct omap_uart_state *uart;
+
+        list_for_each_entry(uart, &uart_list, node) {
+                if (enable)
+                        ret = request_irq(uart->p->irq, omap_uart_interrupt,
+                                IRQF_SHARED, "serial idle", (void *)uart);
+                else
+                        free_irq(uart->p->irq, (void *)uart);
+        }
+}
+
+static ssize_t sleep_timeout_show(struct device *dev,
+                                  struct device_attribute *attr,
                                   char *buf)
 {
-        return sprintf(buf, "%u\n", sleep_timeout / HZ);
+        struct platform_device *pdev = container_of(dev,
+                                        struct platform_device, dev);
+        struct omap_uart_state *uart = container_of(pdev,
+                                        struct omap_uart_state, pdev);
+
+        return sprintf(buf, "%u\n", uart->timeout / HZ);
 }
 
-static ssize_t sleep_timeout_store(struct kobject *kobj,
-                                   struct kobj_attribute *attr,
+static ssize_t sleep_timeout_store(struct device *dev,
+                                   struct device_attribute *attr,
                                    const char *buf, size_t n)
 {
-        struct omap_uart_state *uart;
+        struct platform_device *pdev = container_of(dev,
+                                        struct platform_device, dev);
+        struct omap_uart_state *uart = container_of(pdev,
+                                        struct omap_uart_state, pdev);
         unsigned int value;
 
         if (sscanf(buf, "%u", &value) != 1) {
                 printk(KERN_ERR "sleep_timeout_store: Invalid value\n");
                 return -EINVAL;
         }
-        sleep_timeout = value * HZ;
-        list_for_each_entry(uart, &uart_list, node) {
-                uart->timeout = sleep_timeout;
-                if (uart->timeout)
-                        mod_timer(&uart->timer, jiffies + uart->timeout);
-                else
-                        /* A zero value means disable timeout feature */
-                        omap_uart_block_sleep(uart);
-        }
+
+        uart->timeout = value * HZ;
+        if (uart->timeout)
+                mod_timer(&uart->timer, jiffies + uart->timeout);
+        else
+                /* A zero value means disable timeout feature */
+                omap_uart_block_sleep(uart);
+
         return n;
 }
 
-static struct kobj_attribute sleep_timeout_attr =
-        __ATTR(sleep_timeout, 0644, sleep_timeout_show, sleep_timeout_store);
-
+DEVICE_ATTR(sleep_timeout, 0644, sleep_timeout_show, sleep_timeout_store);
+#define DEV_CREATE_FILE(dev, attr) WARN_ON(device_create_file(dev, attr))
 #else
 static inline void omap_uart_idle_init(struct omap_uart_state *uart) {}
+#define DEV_CREATE_FILE(dev, attr)
 #endif /* CONFIG_PM */
 
-static struct platform_device serial_device = {
-        .name                   = "serial8250",
-        .id                     = PLAT8250_DEV_PLATFORM,
-        .dev                    = {
-                .platform_data  = serial_platform_data,
+static struct omap_uart_state omap_uart[OMAP_MAX_NR_PORTS] = {
+        {
+                .pdev = {
+                        .name                   = "serial8250",
+                        .id                     = PLAT8250_DEV_PLATFORM,
+                        .dev                    = {
+                                .platform_data  = serial_platform_data0,
+                        },
+                },
+        }, {
+                .pdev = {
+                        .name                   = "serial8250",
+                        .id                     = PLAT8250_DEV_PLATFORM1,
+                        .dev                    = {
+                                .platform_data  = serial_platform_data1,
+                        },
+                },
+        }, {
+                .pdev = {
+                        .name                   = "serial8250",
+                        .id                     = PLAT8250_DEV_PLATFORM2,
+                        .dev                    = {
+                                .platform_data  = serial_platform_data2,
+                        },
+                },
         },
 };
 
 void __init omap_serial_init(void)
 {
-        int i, err;
+        int i;
         const struct omap_uart_config *info;
         char name[16];
 
@@ -496,14 +568,12 @@ void __init omap_serial_init(void)
 
         if (info == NULL)
                 return;
-        if (cpu_is_omap44xx()) {
-                for (i = 0; i < OMAP_MAX_NR_PORTS; i++)
-                        serial_platform_data[i].irq += 32;
-        }
 
         for (i = 0; i < OMAP_MAX_NR_PORTS; i++) {
-                struct plat_serial8250_port *p = serial_platform_data + i;
                 struct omap_uart_state *uart = &omap_uart[i];
+                struct platform_device *pdev = &uart->pdev;
+                struct device *dev = &pdev->dev;
+                struct plat_serial8250_port *p = dev->platform_data;
 
                 if (!(info->enabled_uarts & (1 << i))) {
                         p->membase = NULL;
@@ -531,20 +601,21 @@ void __init omap_serial_init(void)
                 uart->num = i;
                 p->private_data = uart;
                 uart->p = p;
-                list_add(&uart->node, &uart_list);
+                list_add_tail(&uart->node, &uart_list);
+
+                if (cpu_is_omap44xx())
+                        p->irq += 32;
 
                 omap_uart_enable_clocks(uart);
                 omap_uart_reset(uart);
                 omap_uart_idle_init(uart);
-        }
-
-        err = platform_device_register(&serial_device);
-
-#ifdef CONFIG_PM
-        if (!err)
-                err = sysfs_create_file(&serial_device.dev.kobj,
-                                        &sleep_timeout_attr.attr);
-#endif
 
+                if (WARN_ON(platform_device_register(pdev)))
+                        continue;
+                if ((cpu_is_omap34xx() && uart->padconf) ||
+                    (uart->wk_en && uart->wk_mask)) {
+                        device_init_wakeup(dev, true);
+                        DEV_CREATE_FILE(dev, &dev_attr_sleep_timeout);
+                }
+        }
 }
-
diff --git a/arch/arm/mach-omap2/sram34xx.S b/arch/arm/mach-omap2/sram34xx.S
index f41f8d96ddba..82aa4a3d160c 100644
--- a/arch/arm/mach-omap2/sram34xx.S
+++ b/arch/arm/mach-omap2/sram34xx.S
@@ -36,7 +36,7 @@
 
         .text
 
-/* r4 parameters */
+/* r1 parameters */
 #define SDRC_NO_UNLOCK_DLL              0x0
 #define SDRC_UNLOCK_DLL                 0x1
 
@@ -58,7 +58,6 @@
 
 /* SDRC_POWER bit settings */
 #define SRFRONIDLEREQ_MASK              0x40
-#define PWDENA_MASK                     0x4
 
 /* CM_IDLEST1_CORE bit settings */
 #define ST_SDRC_MASK                    0x2
@@ -71,41 +70,72 @@
 
 /*
  * omap3_sram_configure_core_dpll - change DPLL3 M2 divider
- * r0 = new SDRC_RFR_CTRL register contents
- * r1 = new SDRC_ACTIM_CTRLA register contents
- * r2 = new SDRC_ACTIM_CTRLB register contents
- * r3 = new M2 divider setting (only 1 and 2 supported right now)
- * r4 = unlock SDRC DLL? (1 = yes, 0 = no).  Only unlock DLL for
+ *
+ * Params passed in registers:
+ *  r0 = new M2 divider setting (only 1 and 2 supported right now)
+ *  r1 = unlock SDRC DLL? (1 = yes, 0 = no).  Only unlock DLL for
  *      SDRC rates < 83MHz
- * r5 = number of MPU cycles to wait for SDRC to stabilize after
+ *  r2 = number of MPU cycles to wait for SDRC to stabilize after
  *      reprogramming the SDRC when switching to a slower MPU speed
- * r6 = new SDRC_MR_0 register value
- * r7 = increasing SDRC rate? (1 = yes, 0 = no)
+ *  r3 = increasing SDRC rate? (1 = yes, 0 = no)
+ *
+ * Params passed via the stack. The needed params will be copied in SRAM
+ *  before use by the code in SRAM (SDRAM is not accessible during SDRC
+ *  reconfiguration):
+ *  new SDRC_RFR_CTRL_0 register contents
+ *  new SDRC_ACTIM_CTRL_A_0 register contents
+ *  new SDRC_ACTIM_CTRL_B_0 register contents
+ *  new SDRC_MR_0 register value
+ *  new SDRC_RFR_CTRL_1 register contents
+ *  new SDRC_ACTIM_CTRL_A_1 register contents
+ *  new SDRC_ACTIM_CTRL_B_1 register contents
+ *  new SDRC_MR_1 register value
  *
+ * If the param SDRC_RFR_CTRL_1 is 0, the parameters
+ *  are not programmed into the SDRC CS1 registers
  */
 ENTRY(omap3_sram_configure_core_dpll)
         stmfd   sp!, {r1-r12, lr}       @ store regs to stack
-        ldr     r4, [sp, #52]           @ pull extra args off the stack
-        ldr     r5, [sp, #56]           @ load extra args from the stack
-        ldr     r6, [sp, #60]           @ load extra args from the stack
-        ldr     r7, [sp, #64]           @ load extra args from the stack
+
+                                        @ pull the extra args off the stack
+                                        @  and store them in SRAM
+        ldr     r4, [sp, #52]
+        str     r4, omap_sdrc_rfr_ctrl_0_val
+        ldr     r4, [sp, #56]
+        str     r4, omap_sdrc_actim_ctrl_a_0_val
+        ldr     r4, [sp, #60]
+        str     r4, omap_sdrc_actim_ctrl_b_0_val
+        ldr     r4, [sp, #64]
+        str     r4, omap_sdrc_mr_0_val
+        ldr     r4, [sp, #68]
+        str     r4, omap_sdrc_rfr_ctrl_1_val
+        cmp     r4, #0                  @ if SDRC_RFR_CTRL_1 is 0,
+        beq     skip_cs1_params         @  do not use cs1 params
+        ldr     r4, [sp, #72]
+        str     r4, omap_sdrc_actim_ctrl_a_1_val
+        ldr     r4, [sp, #76]
+        str     r4, omap_sdrc_actim_ctrl_b_1_val
+        ldr     r4, [sp, #80]
+        str     r4, omap_sdrc_mr_1_val
+skip_cs1_params:
         dsb                             @ flush buffered writes to interconnect
-        cmp     r7, #1                  @ if increasing SDRC clk rate,
+
+        cmp     r3, #1                  @ if increasing SDRC clk rate,
         bleq    configure_sdrc          @ program the SDRC regs early (for RFR)
-        cmp     r4, #SDRC_UNLOCK_DLL    @ set the intended DLL state
+        cmp     r1, #SDRC_UNLOCK_DLL    @ set the intended DLL state
         bleq    unlock_dll
         blne    lock_dll
         bl      sdram_in_selfrefresh    @ put SDRAM in self refresh, idle SDRC
         bl      configure_core_dpll     @ change the DPLL3 M2 divider
+        mov     r12, r2
+        bl      wait_clk_stable         @ wait for SDRC to stabilize
         bl      enable_sdrc             @ take SDRC out of idle
-        cmp     r4, #SDRC_UNLOCK_DLL    @ wait for DLL status to change
+        cmp     r1, #SDRC_UNLOCK_DLL    @ wait for DLL status to change
         bleq    wait_dll_unlock
         blne    wait_dll_lock
-        cmp     r7, #1                  @ if increasing SDRC clk rate,
+        cmp     r3, #1                  @ if increasing SDRC clk rate,
         beq     return_to_sdram         @ return to SDRAM code, otherwise,
         bl      configure_sdrc          @ reprogram SDRC regs now
-        mov     r12, r5
-        bl      wait_clk_stable         @ wait for SDRC to stabilize
 return_to_sdram:
         isb                             @ prevent speculative exec past here
         mov     r0, #0                  @ return value
@@ -113,7 +143,7 @@ return_to_sdram:
 unlock_dll:
         ldr     r11, omap3_sdrc_dlla_ctrl
         ldr     r12, [r11]
-        and     r12, r12, #FIXEDDELAY_MASK
+        bic     r12, r12, #FIXEDDELAY_MASK
         orr     r12, r12, #FIXEDDELAY_DEFAULT
         orr     r12, r12, #DLLIDLE_MASK
         str     r12, [r11]              @ (no OCP barrier needed)
@@ -129,7 +159,6 @@ sdram_in_selfrefresh:
         ldr     r12, [r11]              @ read the contents of SDRC_POWER
         mov     r9, r12                 @ keep a copy of SDRC_POWER bits
         orr     r12, r12, #SRFRONIDLEREQ_MASK   @ enable self refresh on idle
-        bic     r12, r12, #PWDENA_MASK  @ clear PWDENA
         str     r12, [r11]              @ write back to SDRC_POWER register
         ldr     r12, [r11]              @ posted-write barrier for SDRC
 idle_sdrc:
@@ -149,7 +178,7 @@ configure_core_dpll:
         ldr     r12, [r11]
         ldr     r10, core_m2_mask_val   @ modify m2 for core dpll
         and     r12, r12, r10
-        orr     r12, r12, r3, lsl #CORE_DPLL_CLKOUT_DIV_SHIFT
+        orr     r12, r12, r0, lsl #CORE_DPLL_CLKOUT_DIV_SHIFT
         str     r12, [r11]
         ldr     r12, [r11]              @ posted-write barrier for CM
         bx      lr
@@ -187,15 +216,34 @@ wait_dll_unlock:
         bne     wait_dll_unlock
         bx      lr
 configure_sdrc:
-        ldr     r11, omap3_sdrc_rfr_ctrl
-        str     r0, [r11]
-        ldr     r11, omap3_sdrc_actim_ctrla
-        str     r1, [r11]
-        ldr     r11, omap3_sdrc_actim_ctrlb
-        str     r2, [r11]
+        ldr     r12, omap_sdrc_rfr_ctrl_0_val   @ fetch value from SRAM
+        ldr     r11, omap3_sdrc_rfr_ctrl_0      @ fetch addr from SRAM
+        str     r12, [r11]                      @ store
+        ldr     r12, omap_sdrc_actim_ctrl_a_0_val
+        ldr     r11, omap3_sdrc_actim_ctrl_a_0
+        str     r12, [r11]
+        ldr     r12, omap_sdrc_actim_ctrl_b_0_val
+        ldr     r11, omap3_sdrc_actim_ctrl_b_0
+        str     r12, [r11]
+        ldr     r12, omap_sdrc_mr_0_val
         ldr     r11, omap3_sdrc_mr_0
-        str     r6, [r11]
-        ldr     r6, [r11]               @ posted-write barrier for SDRC
+        str     r12, [r11]
+        ldr     r12, omap_sdrc_rfr_ctrl_1_val
+        cmp     r12, #0                 @ if SDRC_RFR_CTRL_1 is 0,
+        beq     skip_cs1_prog           @  do not program cs1 params
+        ldr     r11, omap3_sdrc_rfr_ctrl_1
+        str     r12, [r11]
+        ldr     r12, omap_sdrc_actim_ctrl_a_1_val
+        ldr     r11, omap3_sdrc_actim_ctrl_a_1
+        str     r12, [r11]
+        ldr     r12, omap_sdrc_actim_ctrl_b_1_val
+        ldr     r11, omap3_sdrc_actim_ctrl_b_1
+        str     r12, [r11]
+        ldr     r12, omap_sdrc_mr_1_val
+        ldr     r11, omap3_sdrc_mr_1
+        str     r12, [r11]
+skip_cs1_prog:
+        ldr     r12, [r11]              @ posted-write barrier for SDRC
         bx      lr
 
 omap3_sdrc_power:
@@ -206,14 +254,40 @@ omap3_cm_idlest1_core:
         .word OMAP34XX_CM_REGADDR(CORE_MOD, CM_IDLEST)
 omap3_cm_iclken1_core:
         .word OMAP34XX_CM_REGADDR(CORE_MOD, CM_ICLKEN1)
-omap3_sdrc_rfr_ctrl:
+
+omap3_sdrc_rfr_ctrl_0:
         .word OMAP34XX_SDRC_REGADDR(SDRC_RFR_CTRL_0)
-omap3_sdrc_actim_ctrla:
+omap3_sdrc_rfr_ctrl_1:
+        .word OMAP34XX_SDRC_REGADDR(SDRC_RFR_CTRL_1)
+omap3_sdrc_actim_ctrl_a_0:
         .word OMAP34XX_SDRC_REGADDR(SDRC_ACTIM_CTRL_A_0)
-omap3_sdrc_actim_ctrlb:
+omap3_sdrc_actim_ctrl_a_1:
+        .word OMAP34XX_SDRC_REGADDR(SDRC_ACTIM_CTRL_A_1)
+omap3_sdrc_actim_ctrl_b_0:
         .word OMAP34XX_SDRC_REGADDR(SDRC_ACTIM_CTRL_B_0)
+omap3_sdrc_actim_ctrl_b_1:
+        .word OMAP34XX_SDRC_REGADDR(SDRC_ACTIM_CTRL_B_1)
 omap3_sdrc_mr_0:
         .word OMAP34XX_SDRC_REGADDR(SDRC_MR_0)
+omap3_sdrc_mr_1:
+        .word OMAP34XX_SDRC_REGADDR(SDRC_MR_1)
+omap_sdrc_rfr_ctrl_0_val:
+        .word 0xDEADBEEF
+omap_sdrc_rfr_ctrl_1_val:
+        .word 0xDEADBEEF
+omap_sdrc_actim_ctrl_a_0_val:
+        .word 0xDEADBEEF
+omap_sdrc_actim_ctrl_a_1_val:
+        .word 0xDEADBEEF
+omap_sdrc_actim_ctrl_b_0_val:
+        .word 0xDEADBEEF
+omap_sdrc_actim_ctrl_b_1_val:
+        .word 0xDEADBEEF
+omap_sdrc_mr_0_val:
+        .word 0xDEADBEEF
+omap_sdrc_mr_1_val:
+        .word 0xDEADBEEF
+
 omap3_sdrc_dlla_status:
         .word OMAP34XX_SDRC_REGADDR(SDRC_DLLA_STATUS)
 omap3_sdrc_dlla_ctrl:
@@ -223,3 +297,4 @@ core_m2_mask_val:
 
 ENTRY(omap3_sram_configure_core_dpll_sz)
         .word   . - omap3_sram_configure_core_dpll
+
diff --git a/arch/arm/mach-u300/core.c b/arch/arm/mach-u300/core.c
index 7936085dd758..2e9b8ccd8ec2 100644
--- a/arch/arm/mach-u300/core.c
+++ b/arch/arm/mach-u300/core.c
@@ -510,7 +510,7 @@ static struct db_chip db_chips[] __initdata = {
         }
 };
 
-static void u300_init_check_chip(void)
+static void __init u300_init_check_chip(void)
 {
 
         u16 val;
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 8277802ec859..3a7279c1ce5e 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -120,6 +120,32 @@ void show_mem(void)
         printk("%d pages swap cached\n", cached);
 }
 
+static void __init find_node_limits(int node, struct meminfo *mi,
+        unsigned long *min, unsigned long *max_low, unsigned long *max_high)
+{
+        int i;
+
+        *min = -1UL;
+        *max_low = *max_high = 0;
+
+        for_each_nodebank(i, mi, node) {
+                struct membank *bank = &mi->bank[i];
+                unsigned long start, end;
+
+                start = bank_pfn_start(bank);
+                end = bank_pfn_end(bank);
+
+                if (*min > start)
+                        *min = start;
+                if (*max_high < end)
+                        *max_high = end;
+                if (bank->highmem)
+                        continue;
+                if (*max_low < end)
+                        *max_low = end;
+        }
+}
+
 /*
  * FIXME: We really want to avoid allocating the bootmap bitmap
  * over the top of the initrd.  Hopefully, this is located towards
@@ -210,41 +236,25 @@ static inline void map_memory_bank(struct membank *bank)
 #endif
 }
 
-static unsigned long __init bootmem_init_node(int node, struct meminfo *mi)
+static void __init bootmem_init_node(int node, struct meminfo *mi,
+        unsigned long start_pfn, unsigned long end_pfn)
 {
-        unsigned long start_pfn, end_pfn, boot_pfn;
+        unsigned long boot_pfn;
         unsigned int boot_pages;
         pg_data_t *pgdat;
         int i;
 
-        start_pfn = -1UL;
-        end_pfn = 0;
-
         /*
-         * Calculate the pfn range, and map the memory banks for this node.
+         * Map the memory banks for this node.
          */
         for_each_nodebank(i, mi, node) {
                 struct membank *bank = &mi->bank[i];
-                unsigned long start, end;
 
-                start = bank_pfn_start(bank);
-                end = bank_pfn_end(bank);
-
-                if (start_pfn > start)
-                        start_pfn = start;
-                if (end_pfn < end)
-                        end_pfn = end;
-
-                map_memory_bank(bank);
+                if (!bank->highmem)
+                        map_memory_bank(bank);
         }
 
         /*
-         * If there is no memory in this node, ignore it.
-         */
-        if (end_pfn == 0)
-                return end_pfn;
-
-        /*
          * Allocate the bootmem bitmap page.
          */
         boot_pages = bootmem_bootmap_pages(end_pfn - start_pfn);
@@ -260,7 +270,8 @@ static unsigned long __init bootmem_init_node(int node, struct meminfo *mi)
 
         for_each_nodebank(i, mi, node) {
                 struct membank *bank = &mi->bank[i];
-                free_bootmem_node(pgdat, bank_phys_start(bank), bank_phys_size(bank));
+                if (!bank->highmem)
+                        free_bootmem_node(pgdat, bank_phys_start(bank), bank_phys_size(bank));
                 memory_present(node, bank_pfn_start(bank), bank_pfn_end(bank));
         }
 
@@ -269,8 +280,6 @@ static unsigned long __init bootmem_init_node(int node, struct meminfo *mi)
          */
         reserve_bootmem_node(pgdat, boot_pfn << PAGE_SHIFT,
                              boot_pages << PAGE_SHIFT, BOOTMEM_DEFAULT);
-
-        return end_pfn;
 }
 
 static void __init bootmem_reserve_initrd(int node)
@@ -297,33 +306,39 @@ static void __init bootmem_reserve_initrd(int node)
 static void __init bootmem_free_node(int node, struct meminfo *mi)
 {
         unsigned long zone_size[MAX_NR_ZONES], zhole_size[MAX_NR_ZONES];
-        unsigned long start_pfn, end_pfn;
-        pg_data_t *pgdat = NODE_DATA(node);
+        unsigned long min, max_low, max_high;
         int i;
 
-        start_pfn = pgdat->bdata->node_min_pfn;
-        end_pfn = pgdat->bdata->node_low_pfn;
+        find_node_limits(node, mi, &min, &max_low, &max_high);
 
         /*
          * initialise the zones within this node.
          */
         memset(zone_size, 0, sizeof(zone_size));
-        memset(zhole_size, 0, sizeof(zhole_size));
 
         /*
          * The size of this node has already been determined.  If we need
          * to do anything fancy with the allocation of this memory to the
          * zones, now is the time to do it.
          */
-        zone_size[0] = end_pfn - start_pfn;
+        zone_size[0] = max_low - min;
+#ifdef CONFIG_HIGHMEM
+        zone_size[ZONE_HIGHMEM] = max_high - max_low;
+#endif
 
         /*
          * For each bank in this node, calculate the size of the holes.
          *  holes = node_size - sum(bank_sizes_in_node)
          */
-        zhole_size[0] = zone_size[0];
-        for_each_nodebank(i, mi, node)
-                zhole_size[0] -= bank_pfn_size(&mi->bank[i]);
+        memcpy(zhole_size, zone_size, sizeof(zhole_size));
+        for_each_nodebank(i, mi, node) {
+                int idx = 0;
+#ifdef CONFIG_HIGHMEM
+                if (mi->bank[i].highmem)
+                        idx = ZONE_HIGHMEM;
+#endif
+                zhole_size[idx] -= bank_pfn_size(&mi->bank[i]);
+        }
 
         /*
          * Adjust the sizes according to any special requirements for
@@ -331,13 +346,13 @@ static void __init bootmem_free_node(int node, struct meminfo *mi)
          */
         arch_adjust_zones(node, zone_size, zhole_size);
 
-        free_area_init_node(node, zone_size, start_pfn, zhole_size);
+        free_area_init_node(node, zone_size, min, zhole_size);
 }
 
 void __init bootmem_init(void)
 {
         struct meminfo *mi = &meminfo;
-        unsigned long memend_pfn = 0;
+        unsigned long min, max_low, max_high;
         int node, initrd_node;
 
         /*
@@ -345,11 +360,29 @@ void __init bootmem_init(void)
          */
         initrd_node = check_initrd(mi);
 
+        max_low = max_high = 0;
+
         /*
          * Run through each node initialising the bootmem allocator.
          */
         for_each_node(node) {
-                unsigned long end_pfn = bootmem_init_node(node, mi);
+                unsigned long node_low, node_high;
+
+                find_node_limits(node, mi, &min, &node_low, &node_high);
+
+                if (node_low > max_low)
+                        max_low = node_low;
+                if (node_high > max_high)
+                        max_high = node_high;
+
+                /*
+                 * If there is no memory in this node, ignore it.
+                 * (We can't have nodes which have no lowmem)
+                 */
+                if (node_low == 0)
+                        continue;
+
+                bootmem_init_node(node, mi, min, node_low);
 
                 /*
                  * Reserve any special node zero regions.
@@ -362,12 +395,6 @@ void __init bootmem_init(void)
                  */
                 if (node == initrd_node)
                         bootmem_reserve_initrd(node);
-
-                /*
-                 * Remember the highest memory PFN.
-                 */
-                if (end_pfn > memend_pfn)
-                        memend_pfn = end_pfn;
         }
 
         /*
@@ -383,7 +410,7 @@ void __init bootmem_init(void)
         for_each_node(node)
                 bootmem_free_node(node, mi);
 
-        high_memory = __va((memend_pfn << PAGE_SHIFT) - 1) + 1;
+        high_memory = __va((max_low << PAGE_SHIFT) - 1) + 1;
 
         /*
          * This doesn't seem to be used by the Linux memory manager any
@@ -393,7 +420,8 @@ void __init bootmem_init(void)
          * Note: max_low_pfn and max_pfn reflect the number of _pages_ in
          * the system, not the maximum PFN.
          */
-        max_pfn = max_low_pfn = memend_pfn - PHYS_PFN_OFFSET;
+        max_low_pfn = max_low - PHYS_PFN_OFFSET;
+        max_pfn = max_high - PHYS_PFN_OFFSET;
 }
 
 static inline int free_area(unsigned long pfn, unsigned long end, char *s)
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 4722582b17b8..4426ee67ceca 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -687,13 +687,19 @@ __early_param("vmalloc=", early_vmalloc);
 
 static void __init sanity_check_meminfo(void)
 {
-        int i, j;
+        int i, j, highmem = 0;
 
         for (i = 0, j = 0; i < meminfo.nr_banks; i++) {
                 struct membank *bank = &meminfo.bank[j];
                 *bank = meminfo.bank[i];
 
 #ifdef CONFIG_HIGHMEM
+                if (__va(bank->start) > VMALLOC_MIN ||
+                    __va(bank->start) < (void *)PAGE_OFFSET)
+                        highmem = 1;
+
+                bank->highmem = highmem;
+
                 /*
                  * Split those memory banks which are partially overlapping
                  * the vmalloc area greatly simplifying things later.
@@ -714,6 +720,7 @@ static void __init sanity_check_meminfo(void)
                                 i++;
                                 bank[1].size -= VMALLOC_MIN - __va(bank->start);
                                 bank[1].start = __pa(VMALLOC_MIN - 1) + 1;
+                                bank[1].highmem = highmem = 1;
                                 j++;
                         }
                         bank->size = VMALLOC_MIN - __va(bank->start);
diff --git a/arch/arm/plat-omap/cpu-omap.c b/arch/arm/plat-omap/cpu-omap.c
index 843e8af64066..1868c0d8f9b5 100644
--- a/arch/arm/plat-omap/cpu-omap.c
+++ b/arch/arm/plat-omap/cpu-omap.c
@@ -78,10 +78,10 @@ static int omap_target(struct cpufreq_policy *policy,
 
         /* Ensure desired rate is within allowed range.  Some govenors
          * (ondemand) will just pass target_freq=0 to get the minimum. */
-        if (target_freq < policy->cpuinfo.min_freq)
-                target_freq = policy->cpuinfo.min_freq;
-        if (target_freq > policy->cpuinfo.max_freq)
-                target_freq = policy->cpuinfo.max_freq;
+        if (target_freq < policy->min)
+                target_freq = policy->min;
+        if (target_freq > policy->max)
+                target_freq = policy->max;
 
         freqs.old = omap_getspeed(0);
         freqs.new = clk_round_rate(mpu_clk, target_freq * 1000) / 1000;
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index 7677a4a1cef2..e3ac94f09006 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -946,7 +946,9 @@ void omap_start_dma(int lch)
 
                         cur_lch = next_lch;
                 } while (next_lch != -1);
-        } else if (cpu_class_is_omap2()) {
+        } else if (cpu_is_omap242x() ||
+                (cpu_is_omap243x() &&  omap_type() <= OMAP2430_REV_ES1_0)) {
+
                 /* Errata: Need to write lch even if not using chaining */
                 dma_write(lch, CLNK_CTRL(lch));
         }
diff --git a/arch/arm/plat-omap/gpio.c b/arch/arm/plat-omap/gpio.c
index 26b387c12423..9298bc0ab171 100644
--- a/arch/arm/plat-omap/gpio.c
+++ b/arch/arm/plat-omap/gpio.c
@@ -476,14 +476,12 @@ static void _set_gpio_dataout(struct gpio_bank *bank, int gpio, int enable)
         __raw_writel(l, reg);
 }
 
-static int __omap_get_gpio_datain(int gpio)
+static int _get_gpio_datain(struct gpio_bank *bank, int gpio)
 {
-        struct gpio_bank *bank;
         void __iomem *reg;
 
         if (check_gpio(gpio) < 0)
                 return -EINVAL;
-        bank = get_gpio_bank(gpio);
         reg = bank->base;
         switch (bank->method) {
 #ifdef CONFIG_ARCH_OMAP1
@@ -524,6 +522,53 @@ static int __omap_get_gpio_datain(int gpio)
                         & (1 << get_gpio_index(gpio))) != 0;
 }
 
+static int _get_gpio_dataout(struct gpio_bank *bank, int gpio)
+{
+        void __iomem *reg;
+
+        if (check_gpio(gpio) < 0)
+                return -EINVAL;
+        reg = bank->base;
+
+        switch (bank->method) {
+#ifdef CONFIG_ARCH_OMAP1
+        case METHOD_MPUIO:
+                reg += OMAP_MPUIO_OUTPUT;
+                break;
+#endif
+#ifdef CONFIG_ARCH_OMAP15XX
+        case METHOD_GPIO_1510:
+                reg += OMAP1510_GPIO_DATA_OUTPUT;
+                break;
+#endif
+#ifdef CONFIG_ARCH_OMAP16XX
+        case METHOD_GPIO_1610:
+                reg += OMAP1610_GPIO_DATAOUT;
+                break;
+#endif
+#ifdef CONFIG_ARCH_OMAP730
+        case METHOD_GPIO_730:
+                reg += OMAP730_GPIO_DATA_OUTPUT;
+                break;
+#endif
+#ifdef CONFIG_ARCH_OMAP850
+        case METHOD_GPIO_850:
+                reg += OMAP850_GPIO_DATA_OUTPUT;
+                break;
+#endif
+#if defined(CONFIG_ARCH_OMAP24XX) || defined(CONFIG_ARCH_OMAP34XX) || \
+                defined(CONFIG_ARCH_OMAP4)
+        case METHOD_GPIO_24XX:
+                reg += OMAP24XX_GPIO_DATAOUT;
+                break;
+#endif
+        default:
+                return -EINVAL;
+        }
+
+        return (__raw_readl(reg) & (1 << get_gpio_index(gpio))) != 0;
+}
+
 #define MOD_REG_BIT(reg, bit_mask, set) \
 do {    \
         int l = __raw_readl(base + reg); \
@@ -1189,6 +1234,7 @@ static void gpio_mask_irq(unsigned int irq)
         struct gpio_bank *bank = get_irq_chip_data(irq);
 
         _set_gpio_irqenable(bank, gpio, 0);
+        _set_gpio_triggering(bank, get_gpio_index(gpio), IRQ_TYPE_NONE);
 }
 
 static void gpio_unmask_irq(unsigned int irq)
@@ -1196,6 +1242,11 @@ static void gpio_unmask_irq(unsigned int irq)
         unsigned int gpio = irq - IH_GPIO_BASE;
         struct gpio_bank *bank = get_irq_chip_data(irq);
         unsigned int irq_mask = 1 << get_gpio_index(gpio);
+        struct irq_desc *desc = irq_to_desc(irq);
+        u32 trigger = desc->status & IRQ_TYPE_SENSE_MASK;
+
+        if (trigger)
+                _set_gpio_triggering(bank, get_gpio_index(gpio), trigger);
 
         /* For level-triggered GPIOs, the clearing must be done after
          * the HW source is cleared, thus after the handler has run */
@@ -1350,9 +1401,49 @@ static int gpio_input(struct gpio_chip *chip, unsigned offset)
         return 0;
 }
 
+static int gpio_is_input(struct gpio_bank *bank, int mask)
+{
+        void __iomem *reg = bank->base;
+
+        switch (bank->method) {
+        case METHOD_MPUIO:
+                reg += OMAP_MPUIO_IO_CNTL;
+                break;
+        case METHOD_GPIO_1510:
+                reg += OMAP1510_GPIO_DIR_CONTROL;
+                break;
+        case METHOD_GPIO_1610:
+                reg += OMAP1610_GPIO_DIRECTION;
+                break;
+        case METHOD_GPIO_730:
+                reg += OMAP730_GPIO_DIR_CONTROL;
+                break;
+        case METHOD_GPIO_850:
+                reg += OMAP850_GPIO_DIR_CONTROL;
+                break;
+        case METHOD_GPIO_24XX:
+                reg += OMAP24XX_GPIO_OE;
+                break;
+        }
+        return __raw_readl(reg) & mask;
+}
+
 static int gpio_get(struct gpio_chip *chip, unsigned offset)
 {
-        return __omap_get_gpio_datain(chip->base + offset);
+        struct gpio_bank *bank;
+        void __iomem *reg;
+        int gpio;
+        u32 mask;
+
+        gpio = chip->base + offset;
+        bank = get_gpio_bank(gpio);
+        reg = bank->base;
+        mask = 1 << get_gpio_index(gpio);
+
+        if (gpio_is_input(bank, mask))
+                return _get_gpio_datain(bank, gpio);
+        else
+                return _get_gpio_dataout(bank, gpio);
 }
 
 static int gpio_output(struct gpio_chip *chip, unsigned offset, int value)
@@ -1886,34 +1977,6 @@ arch_initcall(omap_gpio_sysinit);
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
 
-static int gpio_is_input(struct gpio_bank *bank, int mask)
-{
-        void __iomem *reg = bank->base;
-
-        switch (bank->method) {
-        case METHOD_MPUIO:
-                reg += OMAP_MPUIO_IO_CNTL;
-                break;
-        case METHOD_GPIO_1510:
-                reg += OMAP1510_GPIO_DIR_CONTROL;
-                break;
-        case METHOD_GPIO_1610:
-                reg += OMAP1610_GPIO_DIRECTION;
-                break;
-        case METHOD_GPIO_730:
-                reg += OMAP730_GPIO_DIR_CONTROL;
-                break;
-        case METHOD_GPIO_850:
-                reg += OMAP850_GPIO_DIR_CONTROL;
-                break;
-        case METHOD_GPIO_24XX:
-                reg += OMAP24XX_GPIO_OE;
-                break;
-        }
-        return __raw_readl(reg) & mask;
-}
-
-
 static int dbg_gpio_show(struct seq_file *s, void *unused)
 {
         unsigned        i, j, gpio;
diff --git a/arch/arm/plat-omap/include/mach/clock.h b/arch/arm/plat-omap/include/mach/clock.h
index f9f65e1ba3f1..4b8b0d65cbf2 100644
--- a/arch/arm/plat-omap/include/mach/clock.h
+++ b/arch/arm/plat-omap/include/mach/clock.h
@@ -20,6 +20,8 @@ struct clockdomain;
 struct clkops {
         int                     (*enable)(struct clk *);
         void                    (*disable)(struct clk *);
+        void                    (*find_idlest)(struct clk *, void __iomem **, u8 *);
+        void                    (*find_companion)(struct clk *, void __iomem **, u8 *);
 };
 
 #if defined(CONFIG_ARCH_OMAP2) || defined(CONFIG_ARCH_OMAP3) || \
diff --git a/arch/arm/plat-omap/include/mach/cpu.h b/arch/arm/plat-omap/include/mach/cpu.h
index 285eaa3a8275..11e73d9e8928 100644
--- a/arch/arm/plat-omap/include/mach/cpu.h
+++ b/arch/arm/plat-omap/include/mach/cpu.h
@@ -378,9 +378,6 @@ IS_OMAP_TYPE(3430, 0x3430)
 #define cpu_class_is_omap2()    (cpu_is_omap24xx() || cpu_is_omap34xx() || \
                                 cpu_is_omap44xx())
 
-#if defined(CONFIG_ARCH_OMAP2) || defined(CONFIG_ARCH_OMAP3) || \
-                        defined(CONFIG_ARCH_OMAP4)
-
 /* Various silicon revisions for omap2 */
 #define OMAP242X_CLASS          0x24200024
 #define OMAP2420_REV_ES1_0      0x24200024
@@ -436,5 +433,3 @@ IS_OMAP_TYPE(3430, 0x3430)
 
 int omap_chip_is(struct omap_chip_id oci);
 void omap2_check_revision(void);
-
-#endif    /* defined(CONFIG_ARCH_OMAP2) || defined(CONFIG_ARCH_OMAP3) */
diff --git a/arch/arm/plat-omap/include/mach/io.h b/arch/arm/plat-omap/include/mach/io.h
index 73f483d56ca6..21fb0efdda86 100644
--- a/arch/arm/plat-omap/include/mach/io.h
+++ b/arch/arm/plat-omap/include/mach/io.h
@@ -228,7 +228,8 @@ extern void omap1_map_common_io(void);
 extern void omap1_init_common_hw(void);
 
 extern void omap2_map_common_io(void);
-extern void omap2_init_common_hw(struct omap_sdrc_params *sp);
+extern void omap2_init_common_hw(struct omap_sdrc_params *sdrc_cs0,
+                                 struct omap_sdrc_params *sdrc_cs1);
 
 #define __arch_ioremap(p,s,t)   omap_ioremap(p,s,t)
 #define __arch_iounmap(v)       omap_iounmap(v)
diff --git a/arch/arm/plat-omap/include/mach/mux.h b/arch/arm/plat-omap/include/mach/mux.h
index 85a621705766..80281c458baf 100644
--- a/arch/arm/plat-omap/include/mach/mux.h
+++ b/arch/arm/plat-omap/include/mach/mux.h
@@ -853,6 +853,10 @@ enum omap34xx_index {
         AE5_34XX_GPIO143,
         H19_34XX_GPIO164_OUT,
         J25_34XX_GPIO170,
+
+        /* OMAP3 SDRC CKE signals to SDR/DDR ram chips */
+        H16_34XX_SDRC_CKE0,
+        H17_34XX_SDRC_CKE1,
 };
 
 struct omap_mux_cfg {
diff --git a/arch/arm/plat-omap/include/mach/prcm.h b/arch/arm/plat-omap/include/mach/prcm.h
index 24ac3c715912..cda2a70397b4 100644
--- a/arch/arm/plat-omap/include/mach/prcm.h
+++ b/arch/arm/plat-omap/include/mach/prcm.h
@@ -25,6 +25,7 @@
 
 u32 omap_prcm_get_reset_sources(void);
 void omap_prcm_arch_reset(char mode);
+int omap2_cm_wait_idlest(void __iomem *reg, u32 mask, const char *name);
 
 #endif
 
diff --git a/arch/arm/plat-omap/include/mach/sdrc.h b/arch/arm/plat-omap/include/mach/sdrc.h
index adc73522491f..0be18e4ff182 100644
--- a/arch/arm/plat-omap/include/mach/sdrc.h
+++ b/arch/arm/plat-omap/include/mach/sdrc.h
@@ -30,6 +30,10 @@
 #define SDRC_ACTIM_CTRL_A_0     0x09c
 #define SDRC_ACTIM_CTRL_B_0     0x0a0
 #define SDRC_RFR_CTRL_0         0x0a4
+#define SDRC_MR_1               0x0B4
+#define SDRC_ACTIM_CTRL_A_1     0x0C4
+#define SDRC_ACTIM_CTRL_B_1     0x0C8
+#define SDRC_RFR_CTRL_1         0x0D4
 
 /*
  * These values represent the number of memory clock cycles between
@@ -102,8 +106,11 @@ struct omap_sdrc_params {
         u32 mr;
 };
 
-void __init omap2_sdrc_init(struct omap_sdrc_params *sp);
-struct omap_sdrc_params *omap2_sdrc_get_params(unsigned long r);
+void __init omap2_sdrc_init(struct omap_sdrc_params *sdrc_cs0,
+                            struct omap_sdrc_params *sdrc_cs1);
+int omap2_sdrc_get_params(unsigned long r,
+                          struct omap_sdrc_params **sdrc_cs0,
+                          struct omap_sdrc_params **sdrc_cs1);
 
 #ifdef CONFIG_ARCH_OMAP2
 
diff --git a/arch/arm/plat-omap/include/mach/serial.h b/arch/arm/plat-omap/include/mach/serial.h
index 13abd02d1527..def0529c75eb 100644
--- a/arch/arm/plat-omap/include/mach/serial.h
+++ b/arch/arm/plat-omap/include/mach/serial.h
@@ -59,6 +59,7 @@ extern void omap_uart_check_wakeup(void);
 extern void omap_uart_prepare_suspend(void);
 extern void omap_uart_prepare_idle(int num);
 extern void omap_uart_resume_idle(int num);
+extern void omap_uart_enable_irqs(int enable);
 #endif
 
 #endif
diff --git a/arch/arm/plat-omap/include/mach/sram.h b/arch/arm/plat-omap/include/mach/sram.h
index 4d53cc59d7a3..8974e3fc2691 100644
--- a/arch/arm/plat-omap/include/mach/sram.h
+++ b/arch/arm/plat-omap/include/mach/sram.h
@@ -21,11 +21,12 @@ extern void omap2_sram_reprogram_sdrc(u32 perf_level, u32 dll_val,
                                       u32 mem_type);
 extern u32 omap2_set_prcm(u32 dpll_ctrl_val, u32 sdrc_rfr_val, int bypass);
 
-extern u32 omap3_configure_core_dpll(u32 sdrc_rfr_ctrl,
-                                     u32 sdrc_actim_ctrla,
-                                     u32 sdrc_actim_ctrlb, u32 m2,
-                                     u32 unlock_dll, u32 f, u32 sdrc_mr,
-                                     u32 inc);
+extern u32 omap3_configure_core_dpll(
+                        u32 m2, u32 unlock_dll, u32 f, u32 inc,
+                        u32 sdrc_rfr_ctrl_0, u32 sdrc_actim_ctrl_a_0,
+                        u32 sdrc_actim_ctrl_b_0, u32 sdrc_mr_0,
+                        u32 sdrc_rfr_ctrl_1, u32 sdrc_actim_ctrl_a_1,
+                        u32 sdrc_actim_ctrl_b_1, u32 sdrc_mr_1);
 
 /* Do not use these */
 extern void omap1_sram_reprogram_clock(u32 ckctl, u32 dpllctl);
@@ -59,12 +60,12 @@ extern void omap243x_sram_reprogram_sdrc(u32 perf_level, u32 dll_val,
                                                 u32 mem_type);
 extern unsigned long omap243x_sram_reprogram_sdrc_sz;
 
-
-extern u32 omap3_sram_configure_core_dpll(u32 sdrc_rfr_ctrl,
-                                          u32 sdrc_actim_ctrla,
-                                          u32 sdrc_actim_ctrlb, u32 m2,
-                                          u32 unlock_dll, u32 f, u32 sdrc_mr,
-                                          u32 inc);
+extern u32 omap3_sram_configure_core_dpll(
+                        u32 m2, u32 unlock_dll, u32 f, u32 inc,
+                        u32 sdrc_rfr_ctrl_0, u32 sdrc_actim_ctrl_a_0,
+                        u32 sdrc_actim_ctrl_b_0, u32 sdrc_mr_0,
+                        u32 sdrc_rfr_ctrl_1, u32 sdrc_actim_ctrl_a_1,
+                        u32 sdrc_actim_ctrl_b_1, u32 sdrc_mr_1);
 extern unsigned long omap3_sram_configure_core_dpll_sz;
 
 #endif
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index 4ea73804d21e..5eae7876979c 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -44,9 +44,9 @@
 #define OMAP2_SRAM_VA           0xe3000000
 #define OMAP2_SRAM_PUB_VA       (OMAP2_SRAM_VA + 0x800)
 #define OMAP3_SRAM_PA           0x40200000
-#define OMAP3_SRAM_VA           0xd7000000
+#define OMAP3_SRAM_VA           0xe3000000
 #define OMAP3_SRAM_PUB_PA       0x40208000
-#define OMAP3_SRAM_PUB_VA       0xd7008000
+#define OMAP3_SRAM_PUB_VA       (OMAP3_SRAM_VA + 0x8000)
 #define OMAP4_SRAM_PA           0x40200000              /*0x402f0000*/
 #define OMAP4_SRAM_VA           0xd7000000              /*0xd70f0000*/
 
@@ -373,20 +373,26 @@ static inline int omap243x_sram_init(void)
 
 #ifdef CONFIG_ARCH_OMAP3
 
-static u32 (*_omap3_sram_configure_core_dpll)(u32 sdrc_rfr_ctrl,
-                                              u32 sdrc_actim_ctrla,
-                                              u32 sdrc_actim_ctrlb,
-                                              u32 m2, u32 unlock_dll,
-                                              u32 f, u32 sdrc_mr, u32 inc);
-u32 omap3_configure_core_dpll(u32 sdrc_rfr_ctrl, u32 sdrc_actim_ctrla,
-                              u32 sdrc_actim_ctrlb, u32 m2, u32 unlock_dll,
-                              u32 f, u32 sdrc_mr, u32 inc)
+static u32 (*_omap3_sram_configure_core_dpll)(
+                        u32 m2, u32 unlock_dll, u32 f, u32 inc,
+                        u32 sdrc_rfr_ctrl_0, u32 sdrc_actim_ctrl_a_0,
+                        u32 sdrc_actim_ctrl_b_0, u32 sdrc_mr_0,
+                        u32 sdrc_rfr_ctrl_1, u32 sdrc_actim_ctrl_a_1,
+                        u32 sdrc_actim_ctrl_b_1, u32 sdrc_mr_1);
+
+u32 omap3_configure_core_dpll(u32 m2, u32 unlock_dll, u32 f, u32 inc,
+                        u32 sdrc_rfr_ctrl_0, u32 sdrc_actim_ctrl_a_0,
+                        u32 sdrc_actim_ctrl_b_0, u32 sdrc_mr_0,
+                        u32 sdrc_rfr_ctrl_1, u32 sdrc_actim_ctrl_a_1,
+                        u32 sdrc_actim_ctrl_b_1, u32 sdrc_mr_1)
 {
         BUG_ON(!_omap3_sram_configure_core_dpll);
-        return _omap3_sram_configure_core_dpll(sdrc_rfr_ctrl,
-                                               sdrc_actim_ctrla,
-                                               sdrc_actim_ctrlb, m2,
-                                               unlock_dll, f, sdrc_mr, inc);
+        return _omap3_sram_configure_core_dpll(
+                        m2, unlock_dll, f, inc,
+                        sdrc_rfr_ctrl_0, sdrc_actim_ctrl_a_0,
+                        sdrc_actim_ctrl_b_0, sdrc_mr_0,
+                        sdrc_rfr_ctrl_1, sdrc_actim_ctrl_a_1,
+                        sdrc_actim_ctrl_b_1, sdrc_mr_1);
 }
 
 /* REVISIT: Should this be same as omap34xx_sram_init() after off-idle? */
diff --git a/arch/arm/plat-orion/include/plat/gpio.h b/arch/arm/plat-orion/include/plat/gpio.h
index 9646a94ed3d0..07c430fdc9ef 100644
--- a/arch/arm/plat-orion/include/plat/gpio.h
+++ b/arch/arm/plat-orion/include/plat/gpio.h
@@ -11,6 +11,8 @@
 #ifndef __PLAT_GPIO_H
 #define __PLAT_GPIO_H
 
+#include <linux/init.h>
+
 /*
  * GENERIC_GPIO primitives.
  */
diff --git a/arch/arm/plat-s3c24xx/clock-dclk.c b/arch/arm/plat-s3c24xx/clock-dclk.c
index 5b75a797b5ab..0afb217a775e 100644
--- a/arch/arm/plat-s3c24xx/clock-dclk.c
+++ b/arch/arm/plat-s3c24xx/clock-dclk.c
@@ -129,7 +129,7 @@ static int s3c24xx_clkout_setparent(struct clk *clk, struct clk *parent)
 
         /* calculate the MISCCR setting for the clock */
 
-        if (parent == &clk_xtal)
+        if (parent == &clk_mpll)
                 source = S3C2410_MISCCR_CLK0_MPLL;
         else if (parent == &clk_upll)
                 source = S3C2410_MISCCR_CLK0_UPLL;
diff --git a/arch/avr32/boards/favr-32/setup.c b/arch/avr32/boards/favr-32/setup.c
index 46c9b0a224cf..75f19f47fb2f 100644
--- a/arch/avr32/boards/favr-32/setup.c
+++ b/arch/avr32/boards/favr-32/setup.c
@@ -72,6 +72,10 @@ static struct ads7846_platform_data ads7843_data = {
         .debounce_max           = 20,
         .debounce_rep           = 4,
         .debounce_tol           = 5,
+
+        .keep_vref_on           = true,
+        .settle_delay_usecs     = 500,
+        .penirq_recheck_delay_usecs = 100,
 };
 
 static struct spi_board_info __initdata spi1_board_info[] = {
diff --git a/arch/avr32/lib/memcpy.S b/arch/avr32/lib/memcpy.S
index 0abb26142b64..c2ca49d705af 100644
--- a/arch/avr32/lib/memcpy.S
+++ b/arch/avr32/lib/memcpy.S
@@ -24,8 +24,8 @@ memcpy:
         brne    1f
 
         /* At this point, "from" is word-aligned */
-2:      sub     r10, 4
-        mov     r9, r12
+2:      mov     r9, r12
+5:      sub     r10, 4
         brlt    4f
 
 3:      ld.w    r8, r11++
@@ -49,6 +49,7 @@ memcpy:
 
         /* Handle unaligned "from" pointer */
 1:      sub     r10, 4
+        movlt   r9, r12
         brlt    4b
         add     r10, r9
         lsl     r9, 2
@@ -59,4 +60,13 @@ memcpy:
         st.b    r12++, r8
         ld.ub   r8, r11++
         st.b    r12++, r8
-        rjmp    2b
+        mov     r8, r12
+        add     pc, pc, r9
+        sub     r8, 1
+        nop
+        sub     r8, 1
+        nop
+        sub     r8, 1
+        nop
+        mov     r9, r8
+        rjmp    5b
diff --git a/arch/ia64/Makefile b/arch/ia64/Makefile
index 58a7e46affda..e7cbaa02cd0b 100644
--- a/arch/ia64/Makefile
+++ b/arch/ia64/Makefile
@@ -41,11 +41,6 @@ $(error Sorry, you need a newer version of the assember, one that is built from
                 ftp://ftp.hpl.hp.com/pub/linux-ia64/gas-030124.tar.gz)
 endif
 
-ifeq ($(call cc-version),0304)
-        cflags-$(CONFIG_ITANIUM)        += -mtune=merced
-        cflags-$(CONFIG_MCKINLEY)       += -mtune=mckinley
-endif
-
 KBUILD_CFLAGS += $(cflags-y)
 head-y := arch/ia64/kernel/head.o arch/ia64/kernel/init_task.o
 
diff --git a/arch/ia64/include/asm/bitops.h b/arch/ia64/include/asm/bitops.h
index e2ca80037335..57a2787bc9fb 100644
--- a/arch/ia64/include/asm/bitops.h
+++ b/arch/ia64/include/asm/bitops.h
@@ -286,7 +286,7 @@ __test_and_clear_bit(int nr, volatile void * addr)
 {
         __u32 *p = (__u32 *) addr + (nr >> 5);
         __u32 m = 1 << (nr & 31);
-        int oldbitset = *p & m;
+        int oldbitset = (*p & m) != 0;
 
         *p &= ~m;
         return oldbitset;
diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
index 0a9cc73d35c7..8840a690d1e7 100644
--- a/arch/ia64/include/asm/pgtable.h
+++ b/arch/ia64/include/asm/pgtable.h
@@ -155,7 +155,6 @@
 #include <linux/bitops.h>
 #include <asm/cacheflush.h>
 #include <asm/mmu_context.h>
-#include <asm/processor.h>
 
 /*
  * Next come the mappings that determine how mmap() protection bits
diff --git a/arch/ia64/kernel/ia64_ksyms.c b/arch/ia64/kernel/ia64_ksyms.c
index 2d311864e359..8ebccb589e1c 100644
--- a/arch/ia64/kernel/ia64_ksyms.c
+++ b/arch/ia64/kernel/ia64_ksyms.c
@@ -21,6 +21,7 @@ EXPORT_SYMBOL(csum_ipv6_magic);
 
 #include <asm/page.h>
 EXPORT_SYMBOL(clear_page);
+EXPORT_SYMBOL(copy_page);
 
 #ifdef CONFIG_VIRTUAL_MEM_MAP
 #include <linux/bootmem.h>
@@ -60,9 +61,6 @@ EXPORT_SYMBOL(__udivdi3);
 EXPORT_SYMBOL(__moddi3);
 EXPORT_SYMBOL(__umoddi3);
 
-#include <asm/page.h>
-EXPORT_SYMBOL(copy_page);
-
 #if defined(CONFIG_MD_RAID456) || defined(CONFIG_MD_RAID456_MODULE)
 extern void xor_ia64_2(void);
 extern void xor_ia64_3(void);
diff --git a/arch/ia64/kernel/iosapic.c b/arch/ia64/kernel/iosapic.c
index c48b03f2b61d..dab4d393908c 100644
--- a/arch/ia64/kernel/iosapic.c
+++ b/arch/ia64/kernel/iosapic.c
@@ -1072,6 +1072,10 @@ iosapic_init (unsigned long phys_addr, unsigned int gsi_base)
         }
 
         addr = ioremap(phys_addr, 0);
+        if (addr == NULL) {
+                spin_unlock_irqrestore(&iosapic_lock, flags);
+                return -ENOMEM;
+        }
         ver = iosapic_version(addr);
         if ((err = iosapic_check_gsi_range(gsi_base, ver))) {
                 iounmap(addr);
diff --git a/arch/ia64/kernel/pci-dma.c b/arch/ia64/kernel/pci-dma.c
index 05695962fe44..f6b1ff0aea76 100644
--- a/arch/ia64/kernel/pci-dma.c
+++ b/arch/ia64/kernel/pci-dma.c
@@ -69,11 +69,6 @@ iommu_dma_init(void)
 
 int iommu_dma_supported(struct device *dev, u64 mask)
 {
-        struct dma_map_ops *ops = platform_dma_get_ops(dev);
-
-        if (ops->dma_supported)
-                return ops->dma_supported(dev, mask);
-
         /* Copied from i386. Doesn't make much sense, because it will
            only work for pci_alloc_coherent.
            The caller just has to use GFP_DMA in this case. */
diff --git a/arch/ia64/kernel/topology.c b/arch/ia64/kernel/topology.c
index bc80dff1df7a..8f060352e129 100644
--- a/arch/ia64/kernel/topology.c
+++ b/arch/ia64/kernel/topology.c
@@ -372,6 +372,10 @@ static int __cpuinit cache_add_dev(struct sys_device * sys_dev)
         retval = kobject_init_and_add(&all_cpu_cache_info[cpu].kobj,
                                       &cache_ktype_percpu_entry, &sys_dev->kobj,
                                       "%s", "cache");
+        if (unlikely(retval < 0)) {
+                cpu_cache_sysfs_exit(cpu);
+                return retval;
+        }
 
         for (i = 0; i < all_cpu_cache_info[cpu].num_cache_leaves; i++) {
                 this_object = LEAF_KOBJECT_PTR(cpu,i);
@@ -385,7 +389,7 @@ static int __cpuinit cache_add_dev(struct sys_device * sys_dev)
                         }
                         kobject_put(&all_cpu_cache_info[cpu].kobj);
                         cpu_cache_sysfs_exit(cpu);
-                        break;
+                        return retval;
                 }
                 kobject_uevent(&(this_object->kobj), KOBJ_ADD);
         }
diff --git a/arch/m68k/amiga/config.c b/arch/m68k/amiga/config.c
index 6e562751ad51..6c74751c7b82 100644
--- a/arch/m68k/amiga/config.c
+++ b/arch/m68k/amiga/config.c
@@ -574,10 +574,11 @@ static int a2000_hwclk(int op, struct rtc_time *t)
 
         tod_2000.cntrl1 = TOD2000_CNTRL1_HOLD;
 
-        while ((tod_2000.cntrl1 & TOD2000_CNTRL1_BUSY) && cnt--) {
+        while ((tod_2000.cntrl1 & TOD2000_CNTRL1_BUSY) && cnt) {
                 tod_2000.cntrl1 &= ~TOD2000_CNTRL1_HOLD;
                 udelay(70);
                 tod_2000.cntrl1 |= TOD2000_CNTRL1_HOLD;
+                --cnt;
         }
 
         if (!cnt)
@@ -649,10 +650,11 @@ static int amiga_set_clock_mmss(unsigned long nowtime)
 
                 tod_2000.cntrl1 |= TOD2000_CNTRL1_HOLD;
 
-                while ((tod_2000.cntrl1 & TOD2000_CNTRL1_BUSY) && cnt--) {
+                while ((tod_2000.cntrl1 & TOD2000_CNTRL1_BUSY) && cnt) {
                         tod_2000.cntrl1 &= ~TOD2000_CNTRL1_HOLD;
                         udelay(70);
                         tod_2000.cntrl1 |= TOD2000_CNTRL1_HOLD;
+                        --cnt;
                 }
 
                 if (!cnt)
diff --git a/arch/m68k/include/asm/motorola_pgalloc.h b/arch/m68k/include/asm/motorola_pgalloc.h
index 15ee4c74a9f0..2f02f264e694 100644
--- a/arch/m68k/include/asm/motorola_pgalloc.h
+++ b/arch/m68k/include/asm/motorola_pgalloc.h
@@ -36,12 +36,10 @@ static inline pgtable_t pte_alloc_one(struct mm_struct *mm, unsigned long addres
                 return NULL;
 
         pte = kmap(page);
-        if (pte) {
-                __flush_page_to_ram(pte);
-                flush_tlb_kernel_page(pte);
-                nocache_page(pte);
-        }
-        kunmap(pte);
+        __flush_page_to_ram(pte);
+        flush_tlb_kernel_page(pte);
+        nocache_page(pte);
+        kunmap(page);
         pgtable_page_ctor(page);
         return page;
 }
diff --git a/arch/m68k/include/asm/pgtable_mm.h b/arch/m68k/include/asm/pgtable_mm.h
index 0b604f0f192d..fe60e1abaee8 100644
--- a/arch/m68k/include/asm/pgtable_mm.h
+++ b/arch/m68k/include/asm/pgtable_mm.h
@@ -135,8 +135,6 @@ static inline void update_mmu_cache(struct vm_area_struct *vma,
 #endif
 
 #ifndef __ASSEMBLY__
-#include <asm-generic/pgtable.h>
-
 /*
  * Macro to mark a page protection value as "uncacheable".
  */
@@ -154,6 +152,7 @@ static inline void update_mmu_cache(struct vm_area_struct *vma,
             ? (__pgprot((pgprot_val(prot) & _CACHEMASK040) | _PAGE_NOCACHE_S))  \
             : (prot)))
 
+#include <asm-generic/pgtable.h>
 #endif /* !__ASSEMBLY__ */
 
 /*
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index aa29a8640f74..946d8691f2b0 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -334,10 +334,12 @@
 #define __NR_inotify_init1      328
 #define __NR_preadv             329
 #define __NR_pwritev            330
+#define __NR_rt_tgsigqueueinfo  331
+#define __NR_perf_counter_open  332
 
 #ifdef __KERNEL__
 
-#define NR_syscalls             331
+#define NR_syscalls             333
 
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S
index 8744f60c07a9..c3735cd6207e 100644
--- a/arch/m68k/kernel/entry.S
+++ b/arch/m68k/kernel/entry.S
@@ -755,4 +755,6 @@ sys_call_table:
         .long sys_inotify_init1
         .long sys_preadv
         .long sys_pwritev               /* 330 */
+        .long sys_rt_tgsigqueueinfo
+        .long sys_perf_counter_open
 
diff --git a/arch/m68knommu/kernel/syscalltable.S b/arch/m68knommu/kernel/syscalltable.S
index c0b8782832fd..0ae123e08985 100644
--- a/arch/m68knommu/kernel/syscalltable.S
+++ b/arch/m68knommu/kernel/syscalltable.S
@@ -349,6 +349,8 @@ ENTRY(sys_call_table)
         .long sys_inotify_init1
         .long sys_preadv
         .long sys_pwritev               /* 330 */
+        .long sys_rt_tgsigqueueinfo
+        .long sys_perf_counter_open
 
         .rept NR_syscalls-(.-sys_call_table)/4
                 .long sys_ni_syscall
diff --git a/arch/microblaze/configs/mmu_defconfig b/arch/microblaze/configs/mmu_defconfig
index bd0b85ec38f5..09c32962b66f 100644
--- a/arch/microblaze/configs/mmu_defconfig
+++ b/arch/microblaze/configs/mmu_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.30-rc6
-# Fri May 22 10:02:33 2009
+# Linux kernel version: 2.6.31-rc6
+# Tue Aug 18 11:00:02 2009
 #
 CONFIG_MICROBLAZE=y
 # CONFIG_SWAP is not set
@@ -18,7 +18,11 @@ CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_GENERIC_GPIO=y
+CONFIG_GENERIC_CSUM=y
+# CONFIG_PCI is not set
+CONFIG_NO_DMA=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_CONSTRUCTORS=y
 
 #
 # General setup
@@ -59,8 +63,8 @@ CONFIG_INITRAMFS_ROOT_GID=0
 CONFIG_RD_GZIP=y
 # CONFIG_RD_BZIP2 is not set
 # CONFIG_RD_LZMA is not set
-CONFIG_INITRAMFS_COMPRESSION_NONE=y
-# CONFIG_INITRAMFS_COMPRESSION_GZIP is not set
+# CONFIG_INITRAMFS_COMPRESSION_NONE is not set
+CONFIG_INITRAMFS_COMPRESSION_GZIP=y
 # CONFIG_INITRAMFS_COMPRESSION_BZIP2 is not set
 # CONFIG_INITRAMFS_COMPRESSION_LZMA is not set
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
@@ -71,7 +75,6 @@ CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
-# CONFIG_STRIP_ASM_SYMS is not set
 # CONFIG_HOTPLUG is not set
 CONFIG_PRINTK=y
 CONFIG_BUG=y
@@ -84,13 +87,22 @@ CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 # CONFIG_SHMEM is not set
 CONFIG_AIO=y
+
+#
+# Performance Counters
+#
 CONFIG_VM_EVENT_COUNTERS=y
+# CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_COMPAT_BRK=y
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
+
+#
+# GCOV-based kernel profiling
+#
 # CONFIG_SLOW_WORK is not set
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
@@ -102,7 +114,7 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_BLOCK=y
-# CONFIG_LBD is not set
+CONFIG_LBDAF=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
 
@@ -194,9 +206,9 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
-CONFIG_UNEVICTABLE_LRU=y
 CONFIG_HAVE_MLOCK=y
 CONFIG_HAVE_MLOCKED_PAGE_BIT=y
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 
 #
 # Exectuable file formats
@@ -262,6 +274,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_PHONET is not set
+# CONFIG_IEEE802154 is not set
 # CONFIG_NET_SCHED is not set
 # CONFIG_DCB is not set
 
@@ -325,7 +338,6 @@ CONFIG_MISC_DEVICES=y
 # CONFIG_ATA is not set
 # CONFIG_MD is not set
 CONFIG_NETDEVICES=y
-CONFIG_COMPAT_NET_DEV_OPS=y
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_MACVLAN is not set
@@ -344,7 +356,7 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
 # CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
-# CONFIG_B44 is not set
+# CONFIG_KS8842 is not set
 CONFIG_NETDEV_1000=y
 CONFIG_NETDEV_10000=y
 
@@ -410,6 +422,11 @@ CONFIG_LEGACY_PTY_COUNT=256
 # CONFIG_TCG_TPM is not set
 # CONFIG_I2C is not set
 # CONFIG_SPI is not set
+
+#
+# PPS support
+#
+# CONFIG_PPS is not set
 CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 # CONFIG_GPIOLIB is not set
 # CONFIG_W1 is not set
@@ -418,12 +435,6 @@ CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 # CONFIG_THERMAL is not set
 # CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
-CONFIG_SSB_POSSIBLE=y
-
-#
-# Sonics Silicon Backplane
-#
-# CONFIG_SSB is not set
 
 #
 # Multifunction device drivers
@@ -433,22 +444,7 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_HTC_PASIC3 is not set
 # CONFIG_MFD_TMIO is not set
 # CONFIG_REGULATOR is not set
-
-#
-# Multimedia devices
-#
-
-#
-# Multimedia core support
-#
-# CONFIG_VIDEO_DEV is not set
-# CONFIG_DVB_CORE is not set
-# CONFIG_VIDEO_MEDIA is not set
-
-#
-# Multimedia drivers
-#
-# CONFIG_DAB is not set
+# CONFIG_MEDIA_SUPPORT is not set
 
 #
 # Graphics support
@@ -469,9 +465,12 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
-# CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
+
+#
+# TI VLYNQ
+#
 # CONFIG_STAGING is not set
 
 #
@@ -485,12 +484,15 @@ CONFIG_EXT2_FS=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
-CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_BTRFS_FS is not set
+CONFIG_FILE_LOCKING=y
+CONFIG_FSNOTIFY=y
 # CONFIG_DNOTIFY is not set
 # CONFIG_INOTIFY is not set
+CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
@@ -678,6 +680,7 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_SYSCTL_SYSCALL_CHECK is not set
 # CONFIG_PAGE_POISONING is not set
 # CONFIG_SAMPLES is not set
+# CONFIG_KMEMCHECK is not set
 CONFIG_EARLY_PRINTK=y
 CONFIG_HEART_BEAT=y
 CONFIG_DEBUG_BOOTMEM=y
@@ -793,6 +796,5 @@ CONFIG_ZLIB_INFLATE=y
 CONFIG_DECOMPRESS_GZIP=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
-CONFIG_HAS_DMA=y
 CONFIG_HAVE_LMB=y
 CONFIG_NLATTR=y
diff --git a/arch/microblaze/configs/nommu_defconfig b/arch/microblaze/configs/nommu_defconfig
index 4ef6af0a8f31..8b638615a972 100644
--- a/arch/microblaze/configs/nommu_defconfig
+++ b/arch/microblaze/configs/nommu_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.30-rc5
-# Mon May 11 09:01:02 2009
+# Linux kernel version: 2.6.31-rc6
+# Tue Aug 18 10:35:30 2009
 #
 CONFIG_MICROBLAZE=y
 # CONFIG_SWAP is not set
@@ -17,9 +17,12 @@ CONFIG_GENERIC_TIME=y
 # CONFIG_GENERIC_TIME_VSYSCALL is not set
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
+CONFIG_GENERIC_GPIO=y
+CONFIG_GENERIC_CSUM=y
 # CONFIG_PCI is not set
-# CONFIG_NO_DMA is not set
+CONFIG_NO_DMA=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_CONSTRUCTORS=y
 
 #
 # General setup
@@ -64,7 +67,6 @@ CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
-# CONFIG_STRIP_ASM_SYMS is not set
 # CONFIG_HOTPLUG is not set
 CONFIG_PRINTK=y
 CONFIG_BUG=y
@@ -76,13 +78,23 @@ CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_AIO=y
+
+#
+# Performance Counters
+#
 CONFIG_VM_EVENT_COUNTERS=y
+# CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_COMPAT_BRK=y
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
 # CONFIG_MARKERS is not set
+
+#
+# GCOV-based kernel profiling
+#
+# CONFIG_GCOV_KERNEL is not set
 # CONFIG_SLOW_WORK is not set
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
@@ -95,7 +107,7 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_BLOCK=y
-# CONFIG_LBD is not set
+CONFIG_LBDAF=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
 
@@ -156,8 +168,16 @@ CONFIG_CMDLINE_BOOL=y
 CONFIG_CMDLINE="console=ttyUL0,115200"
 # CONFIG_CMDLINE_FORCE is not set
 CONFIG_OF=y
-CONFIG_OF_DEVICE=y
 CONFIG_PROC_DEVICETREE=y
+
+#
+# Advanced setup
+#
+
+#
+# Default settings for advanced configuration options are used
+#
+CONFIG_KERNEL_START=0x90000000
 CONFIG_SELECT_MEMORY_MODEL=y
 CONFIG_FLATMEM_MANUAL=y
 # CONFIG_DISCONTIGMEM_MANUAL is not set
@@ -169,7 +189,7 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
-CONFIG_UNEVICTABLE_LRU=y
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 CONFIG_NOMMU_INITIAL_TRIM_EXCESS=1
 
 #
@@ -237,6 +257,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_PHONET is not set
+# CONFIG_IEEE802154 is not set
 # CONFIG_NET_SCHED is not set
 # CONFIG_DCB is not set
 
@@ -254,7 +275,11 @@ CONFIG_WIRELESS=y
 CONFIG_WIRELESS_OLD_REGULATORY=y
 # CONFIG_WIRELESS_EXT is not set
 # CONFIG_LIB80211 is not set
-# CONFIG_MAC80211 is not set
+
+#
+# CFG80211 needs to be enabled for MAC80211
+#
+CONFIG_MAC80211_DEFAULT_PS_VALUE=0
 # CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
@@ -353,6 +378,7 @@ CONFIG_MTD_UCLINUX=y
 # UBI - Unsorted block images
 #
 # CONFIG_MTD_UBI is not set
+CONFIG_OF_DEVICE=y
 # CONFIG_PARPORT is not set
 CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_COW_COMMON is not set
@@ -364,6 +390,7 @@ CONFIG_BLK_DEV_RAM_SIZE=4096
 # CONFIG_BLK_DEV_XIP is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
+# CONFIG_XILINX_SYSACE is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_C2PORT is not set
@@ -383,7 +410,6 @@ CONFIG_MISC_DEVICES=y
 # CONFIG_ATA is not set
 # CONFIG_MD is not set
 CONFIG_NETDEVICES=y
-CONFIG_COMPAT_NET_DEV_OPS=y
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_MACVLAN is not set
@@ -402,7 +428,7 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
 # CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
-# CONFIG_B44 is not set
+# CONFIG_KS8842 is not set
 CONFIG_NETDEV_1000=y
 CONFIG_NETDEV_10000=y
 
@@ -463,23 +489,25 @@ CONFIG_HW_RANDOM=y
 # CONFIG_HW_RANDOM_TIMERIOMEM is not set
 # CONFIG_RTC is not set
 # CONFIG_GEN_RTC is not set
+# CONFIG_XILINX_HWICAP is not set
 # CONFIG_R3964 is not set
 # CONFIG_RAW_DRIVER is not set
 # CONFIG_TCG_TPM is not set
 # CONFIG_I2C is not set
 # CONFIG_SPI is not set
+
+#
+# PPS support
+#
+# CONFIG_PPS is not set
+CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
+# CONFIG_GPIOLIB is not set
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
 # CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
-CONFIG_SSB_POSSIBLE=y
-
-#
-# Sonics Silicon Backplane
-#
-# CONFIG_SSB is not set
 
 #
 # Multifunction device drivers
@@ -489,22 +517,7 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_HTC_PASIC3 is not set
 # CONFIG_MFD_TMIO is not set
 # CONFIG_REGULATOR is not set
-
-#
-# Multimedia devices
-#
-
-#
-# Multimedia core support
-#
-# CONFIG_VIDEO_DEV is not set
-# CONFIG_DVB_CORE is not set
-# CONFIG_VIDEO_MEDIA is not set
-
-#
-# Multimedia drivers
-#
-CONFIG_DAB=y
+# CONFIG_MEDIA_SUPPORT is not set
 
 #
 # Graphics support
@@ -520,9 +533,10 @@ CONFIG_VIDEO_OUTPUT_CONTROL=y
 # CONFIG_DISPLAY_SUPPORT is not set
 # CONFIG_SOUND is not set
 CONFIG_USB_SUPPORT=y
-# CONFIG_USB_ARCH_HAS_HCD is not set
+CONFIG_USB_ARCH_HAS_HCD=y
 # CONFIG_USB_ARCH_HAS_OHCI is not set
 # CONFIG_USB_ARCH_HAS_EHCI is not set
+# CONFIG_USB is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 # CONFIG_USB_OTG_BLACKLIST_HUB is not set
 
@@ -543,9 +557,12 @@ CONFIG_USB_SUPPORT=y
 # CONFIG_NEW_LEDS is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_RTC_CLASS is not set
-# CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
+
+#
+# TI VLYNQ
+#
 # CONFIG_STAGING is not set
 
 #
@@ -558,12 +575,15 @@ CONFIG_EXT2_FS=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
-CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_BTRFS_FS is not set
+CONFIG_FILE_LOCKING=y
+CONFIG_FSNOTIFY=y
 # CONFIG_DNOTIFY is not set
 # CONFIG_INOTIFY is not set
+CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
@@ -813,6 +833,5 @@ CONFIG_GENERIC_FIND_LAST_BIT=y
 CONFIG_ZLIB_INFLATE=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
-CONFIG_HAS_DMA=y
 CONFIG_HAVE_LMB=y
 CONFIG_NLATTR=y
diff --git a/arch/microblaze/include/asm/hardirq.h b/arch/microblaze/include/asm/hardirq.h
index 41e1e1aa36ac..cd1ac9aad56c 100644
--- a/arch/microblaze/include/asm/hardirq.h
+++ b/arch/microblaze/include/asm/hardirq.h
@@ -12,8 +12,6 @@
 /* should be defined in each interrupt controller driver */
 extern unsigned int get_irq(struct pt_regs *regs);
 
-#define ack_bad_irq ack_bad_irq
-void ack_bad_irq(unsigned int irq);
 #include <asm-generic/hardirq.h>
 
 #endif /* _ASM_MICROBLAZE_HARDIRQ_H */
diff --git a/arch/microblaze/kernel/intc.c b/arch/microblaze/kernel/intc.c
index b15605299a57..6eea6f92b84e 100644
--- a/arch/microblaze/kernel/intc.c
+++ b/arch/microblaze/kernel/intc.c
@@ -12,6 +12,7 @@
 #include <linux/irq.h>
 #include <asm/page.h>
 #include <linux/io.h>
+#include <linux/bug.h>
 
 #include <asm/prom.h>
 #include <asm/irq.h>
@@ -130,6 +131,7 @@ void __init init_IRQ(void)
                 if (intc)
                         break;
         }
+        BUG_ON(!intc);
 
         intc_baseaddr = *(int *) of_get_property(intc, "reg", NULL);
         intc_baseaddr = (unsigned long) ioremap(intc_baseaddr, PAGE_SIZE);
diff --git a/arch/microblaze/kernel/irq.c b/arch/microblaze/kernel/irq.c
index f688ee93e3b9..7d5ddd62d4d2 100644
--- a/arch/microblaze/kernel/irq.c
+++ b/arch/microblaze/kernel/irq.c
@@ -30,15 +30,6 @@ unsigned int irq_of_parse_and_map(struct device_node *dev, int index)
 }
 EXPORT_SYMBOL_GPL(irq_of_parse_and_map);
 
-/*
- * 'what should we do if we get a hw irq event on an illegal vector'.
- * each architecture has to answer this themselves.
- */
-void ack_bad_irq(unsigned int irq)
-{
-        printk(KERN_WARNING "unexpected IRQ trap at vector %02x\n", irq);
-}
-
 static u32 concurrent_irq;
 
 void do_IRQ(struct pt_regs *regs)
diff --git a/arch/microblaze/kernel/syscall_table.S b/arch/microblaze/kernel/syscall_table.S
index 216db817beb6..457216097dfd 100644
--- a/arch/microblaze/kernel/syscall_table.S
+++ b/arch/microblaze/kernel/syscall_table.S
@@ -313,7 +313,7 @@ ENTRY(sys_call_table)
         .long sys_fchmodat
         .long sys_faccessat
         .long sys_ni_syscall /* pselect6 */
-        .long sys_ni_syscall /* sys_ppoll */
+        .long sys_ppoll
         .long sys_unshare               /* 310 */
         .long sys_set_robust_list
         .long sys_get_robust_list
diff --git a/arch/microblaze/kernel/timer.c b/arch/microblaze/kernel/timer.c
index bdfa2f9f0c81..5499deae7fa6 100644
--- a/arch/microblaze/kernel/timer.c
+++ b/arch/microblaze/kernel/timer.c
@@ -22,6 +22,7 @@
 #include <linux/clocksource.h>
 #include <linux/clockchips.h>
 #include <linux/io.h>
+#include <linux/bug.h>
 #include <asm/cpuinfo.h>
 #include <asm/setup.h>
 #include <asm/prom.h>
@@ -234,6 +235,7 @@ void __init time_init(void)
                 if (timer)
                         break;
         }
+        BUG_ON(!timer);
 
         timer_baseaddr = *(int *) of_get_property(timer, "reg", NULL);
         timer_baseaddr = (unsigned long) ioremap(timer_baseaddr, PAGE_SIZE);
diff --git a/arch/microblaze/mm/init.c b/arch/microblaze/mm/init.c
index 8d92c4efe9a4..f207f1a94dbc 100644
--- a/arch/microblaze/mm/init.c
+++ b/arch/microblaze/mm/init.c
@@ -130,13 +130,13 @@ void __init setup_memory(void)
          * (in case the address isn't page-aligned).
          */
 #ifndef CONFIG_MMU
-        map_size = init_bootmem_node(NODE_DATA(0), PFN_UP(TOPHYS((u32)_end)),
+        map_size = init_bootmem_node(NODE_DATA(0), PFN_UP(TOPHYS((u32)klimit)),
                                         min_low_pfn, max_low_pfn);
 #else
         map_size = init_bootmem_node(&contig_page_data,
-                PFN_UP(TOPHYS((u32)_end)), min_low_pfn, max_low_pfn);
+                PFN_UP(TOPHYS((u32)klimit)), min_low_pfn, max_low_pfn);
 #endif
-        lmb_reserve(PFN_UP(TOPHYS((u32)_end)) << PAGE_SHIFT, map_size);
+        lmb_reserve(PFN_UP(TOPHYS((u32)klimit)) << PAGE_SHIFT, map_size);
 
         /* free bootmem is whole main memory */
         free_bootmem(memory_start, memory_size);
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index 96a14a426a7c..4320239cf4ef 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -32,10 +32,12 @@
 #define PAGE_SIZE       (1UL << PAGE_SHIFT)
 #define PAGE_MASK       (~((1 << PAGE_SHIFT) - 1))
 
+#ifdef CONFIG_HUGETLB_PAGE
 #define HPAGE_SHIFT     (PAGE_SHIFT + PAGE_SHIFT - 3)
 #define HPAGE_SIZE      ((1UL) << HPAGE_SHIFT)
 #define HPAGE_MASK      (~(HPAGE_SIZE - 1))
 #define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
+#endif /* CONFIG_HUGETLB_PAGE */
 
 #ifndef __ASSEMBLY__
 
diff --git a/arch/mn10300/include/asm/pci.h b/arch/mn10300/include/asm/pci.h
index 35d2ed6396f6..19aecc90f7a4 100644
--- a/arch/mn10300/include/asm/pci.h
+++ b/arch/mn10300/include/asm/pci.h
@@ -59,7 +59,6 @@ void pcibios_penalize_isa_irq(int irq);
 #include <linux/slab.h>
 #include <asm/scatterlist.h>
 #include <linux/string.h>
-#include <linux/mm.h>
 #include <asm/io.h>
 
 struct pci_dev;
diff --git a/arch/powerpc/configs/ps3_defconfig b/arch/powerpc/configs/ps3_defconfig
index e28e65e7a0e1..7de127e4ceef 100644
--- a/arch/powerpc/configs/ps3_defconfig
+++ b/arch/powerpc/configs/ps3_defconfig
@@ -1,13 +1,14 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.30-rc5
-# Fri May 15 10:37:00 2009
+# Linux kernel version: 2.6.31-rc7
+# Mon Aug 24 17:38:50 2009
 #
 CONFIG_PPC64=y
 
 #
 # Processor support
 #
+CONFIG_PPC_BOOK3S_64=y
 CONFIG_PPC_BOOK3S=y
 # CONFIG_POWER4_ONLY is not set
 CONFIG_POWER3=y
@@ -20,6 +21,7 @@ CONFIG_PPC_STD_MMU=y
 CONFIG_PPC_STD_MMU_64=y
 CONFIG_PPC_MM_SLICES=y
 CONFIG_VIRT_CPU_ACCOUNTING=y
+CONFIG_PPC_HAVE_PMU_SUPPORT=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=2
 CONFIG_64BIT=y
@@ -31,6 +33,7 @@ CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_HARDIRQS=y
+CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_HAVE_SETUP_PER_CPU_AREA=y
 CONFIG_IRQ_PER_CPU=y
 CONFIG_STACKTRACE_SUPPORT=y
@@ -41,7 +44,6 @@ CONFIG_RWSEM_XCHGADD_ALGORITHM=y
 CONFIG_ARCH_HAS_ILOG2_U32=y
 CONFIG_ARCH_HAS_ILOG2_U64=y
 CONFIG_GENERIC_HWEIGHT=y
-CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_ARCH_NO_VIRT_TO_BUS=y
 CONFIG_PPC=y
@@ -62,6 +64,7 @@ CONFIG_DTC=y
 # CONFIG_PPC_DCR_MMIO is not set
 CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_CONSTRUCTORS=y
 
 #
 # General setup
@@ -113,7 +116,6 @@ CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_KALLSYMS_EXTRA_PASS=y
-# CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
@@ -126,7 +128,14 @@ CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
 CONFIG_AIO=y
+CONFIG_HAVE_PERF_COUNTERS=y
+
+#
+# Performance Counters
+#
+# CONFIG_PERF_COUNTERS is not set
 CONFIG_VM_EVENT_COUNTERS=y
+# CONFIG_STRIP_ASM_SYMS is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
@@ -145,6 +154,11 @@ CONFIG_HAVE_KRETPROBES=y
 CONFIG_HAVE_ARCH_TRACEHOOK=y
 CONFIG_HAVE_DMA_ATTRS=y
 CONFIG_USE_GENERIC_SMP_HELPERS=y
+
+#
+# GCOV-based kernel profiling
+#
+# CONFIG_GCOV_KERNEL is not set
 # CONFIG_SLOW_WORK is not set
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
@@ -210,7 +224,7 @@ CONFIG_PPC_CELL=y
 #
 # Cell Broadband Engine options
 #
-CONFIG_SPU_FS=y
+CONFIG_SPU_FS=m
 CONFIG_SPU_FS_64K_LS=y
 # CONFIG_SPU_TRACE is not set
 CONFIG_SPU_BASE=y
@@ -255,6 +269,7 @@ CONFIG_BINFMT_MISC=y
 CONFIG_HUGETLB_PAGE_SIZE_VARIABLE=y
 # CONFIG_IOMMU_VMERGE is not set
 CONFIG_IOMMU_HELPER=y
+# CONFIG_SWIOTLB is not set
 CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 CONFIG_ARCH_HAS_WALK_MEMORY=y
 CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y
@@ -285,9 +300,9 @@ CONFIG_MIGRATION=y
 CONFIG_PHYS_ADDR_T_64BIT=y
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
-CONFIG_UNEVICTABLE_LRU=y
 CONFIG_HAVE_MLOCK=y
 CONFIG_HAVE_MLOCKED_PAGE_BIT=y
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 CONFIG_ARCH_MEMORY_PROBE=y
 CONFIG_PPC_HAS_HASH_64K=y
 CONFIG_PPC_4K_PAGES=y
@@ -399,6 +414,7 @@ CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_PHONET is not set
+# CONFIG_IEEE802154 is not set
 # CONFIG_NET_SCHED is not set
 # CONFIG_DCB is not set
 
@@ -433,11 +449,14 @@ CONFIG_BT_HCIBTUSB=m
 CONFIG_WIRELESS=y
 CONFIG_CFG80211=m
 # CONFIG_CFG80211_REG_DEBUG is not set
+# CONFIG_CFG80211_DEBUGFS is not set
 # CONFIG_WIRELESS_OLD_REGULATORY is not set
 CONFIG_WIRELESS_EXT=y
 # CONFIG_WIRELESS_EXT_SYSFS is not set
 # CONFIG_LIB80211 is not set
 CONFIG_MAC80211=m
+CONFIG_MAC80211_DEFAULT_PS=y
+CONFIG_MAC80211_DEFAULT_PS_VALUE=1
 
 #
 # Rate control algorithm selection
@@ -447,7 +466,6 @@ CONFIG_MAC80211_RC_PID=y
 CONFIG_MAC80211_RC_DEFAULT_PID=y
 # CONFIG_MAC80211_RC_DEFAULT_MINSTREL is not set
 CONFIG_MAC80211_RC_DEFAULT="pid"
-# CONFIG_MAC80211_MESH is not set
 # CONFIG_MAC80211_LEDS is not set
 # CONFIG_MAC80211_DEBUGFS is not set
 # CONFIG_MAC80211_DEBUG_MENU is not set
@@ -472,77 +490,7 @@ CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_DEBUG_DEVRES is not set
 # CONFIG_SYS_HYPERVISOR is not set
 # CONFIG_CONNECTOR is not set
-CONFIG_MTD=y
-CONFIG_MTD_DEBUG=y
-CONFIG_MTD_DEBUG_VERBOSE=0
-# CONFIG_MTD_CONCAT is not set
-# CONFIG_MTD_PARTITIONS is not set
-# CONFIG_MTD_TESTS is not set
-
-#
-# User Modules And Translation Layers
-#
-# CONFIG_MTD_CHAR is not set
-CONFIG_MTD_BLKDEVS=y
-CONFIG_MTD_BLOCK=y
-# CONFIG_FTL is not set
-# CONFIG_NFTL is not set
-# CONFIG_INFTL is not set
-# CONFIG_RFD_FTL is not set
-# CONFIG_SSFDC is not set
-# CONFIG_MTD_OOPS is not set
-
-#
-# RAM/ROM/Flash chip drivers
-#
-# CONFIG_MTD_CFI is not set
-# CONFIG_MTD_JEDECPROBE is not set
-CONFIG_MTD_MAP_BANK_WIDTH_1=y
-CONFIG_MTD_MAP_BANK_WIDTH_2=y
-CONFIG_MTD_MAP_BANK_WIDTH_4=y
-# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
-# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
-# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
-CONFIG_MTD_CFI_I1=y
-CONFIG_MTD_CFI_I2=y
-# CONFIG_MTD_CFI_I4 is not set
-# CONFIG_MTD_CFI_I8 is not set
-# CONFIG_MTD_RAM is not set
-# CONFIG_MTD_ROM is not set
-# CONFIG_MTD_ABSENT is not set
-
-#
-# Mapping drivers for chip access
-#
-# CONFIG_MTD_COMPLEX_MAPPINGS is not set
-# CONFIG_MTD_PLATRAM is not set
-
-#
-# Self-contained MTD device drivers
-#
-# CONFIG_MTD_SLRAM is not set
-# CONFIG_MTD_PHRAM is not set
-# CONFIG_MTD_MTDRAM is not set
-# CONFIG_MTD_BLOCK2MTD is not set
-
-#
-# Disk-On-Chip Device Drivers
-#
-# CONFIG_MTD_DOC2000 is not set
-# CONFIG_MTD_DOC2001 is not set
-# CONFIG_MTD_DOC2001PLUS is not set
-# CONFIG_MTD_NAND is not set
-# CONFIG_MTD_ONENAND is not set
-
-#
-# LPDDR flash memory drivers
-#
-# CONFIG_MTD_LPDDR is not set
-
-#
-# UBI - Unsorted block images
-#
-# CONFIG_MTD_UBI is not set
+# CONFIG_MTD is not set
 CONFIG_OF_DEVICE=y
 # CONFIG_PARPORT is not set
 CONFIG_BLK_DEV=y
@@ -590,10 +538,6 @@ CONFIG_BLK_DEV_SR=y
 # CONFIG_BLK_DEV_SR_VENDOR is not set
 CONFIG_CHR_DEV_SG=m
 # CONFIG_CHR_DEV_SCH is not set
-
-#
-# Some SCSI devices (e.g. CD jukebox) support multiple LUNs
-#
 CONFIG_SCSI_MULTI_LUN=y
 # CONFIG_SCSI_CONSTANTS is not set
 # CONFIG_SCSI_LOGGING is not set
@@ -626,7 +570,6 @@ CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_UEVENT is not set
 # CONFIG_MACINTOSH_DRIVERS is not set
 CONFIG_NETDEVICES=y
-CONFIG_COMPAT_NET_DEV_OPS=y
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_MACVLAN is not set
@@ -646,10 +589,11 @@ CONFIG_MII=m
 # CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 # CONFIG_B44 is not set
+# CONFIG_KS8842 is not set
 CONFIG_NETDEV_1000=y
 CONFIG_GELIC_NET=y
 CONFIG_GELIC_WIRELESS=y
-CONFIG_GELIC_WIRELESS_OLD_PSK_INTERFACE=y
+# CONFIG_GELIC_WIRELESS_OLD_PSK_INTERFACE is not set
 # CONFIG_NETDEV_10000 is not set
 
 #
@@ -669,8 +613,7 @@ CONFIG_WLAN_80211=y
 # CONFIG_HOSTAP is not set
 # CONFIG_B43 is not set
 # CONFIG_B43LEGACY is not set
-CONFIG_ZD1211RW=m
-# CONFIG_ZD1211RW_DEBUG is not set
+# CONFIG_ZD1211RW is not set
 # CONFIG_RT2X00 is not set
 
 #
@@ -682,7 +625,7 @@ CONFIG_ZD1211RW=m
 #
 # CONFIG_USB_CATC is not set
 # CONFIG_USB_KAWETH is not set
-CONFIG_USB_PEGASUS=m
+# CONFIG_USB_PEGASUS is not set
 # CONFIG_USB_RTL8150 is not set
 CONFIG_USB_USBNET=m
 CONFIG_USB_NET_AX8817X=m
@@ -693,10 +636,11 @@ CONFIG_USB_NET_AX8817X=m
 # CONFIG_USB_NET_GL620A is not set
 # CONFIG_USB_NET_NET1080 is not set
 # CONFIG_USB_NET_PLUSB is not set
-CONFIG_USB_NET_MCS7830=m
+# CONFIG_USB_NET_MCS7830 is not set
 # CONFIG_USB_NET_RNDIS_HOST is not set
 # CONFIG_USB_NET_CDC_SUBSET is not set
 # CONFIG_USB_NET_ZAURUS is not set
+# CONFIG_USB_NET_INT51X1 is not set
 # CONFIG_WAN is not set
 CONFIG_PPP=m
 CONFIG_PPP_MULTILINK=y
@@ -771,8 +715,7 @@ CONFIG_DEVKMEM=y
 #
 CONFIG_UNIX98_PTYS=y
 # CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
-CONFIG_LEGACY_PTYS=y
-CONFIG_LEGACY_PTY_COUNT=16
+# CONFIG_LEGACY_PTYS is not set
 # CONFIG_HVC_UDBG is not set
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_HW_RANDOM is not set
@@ -782,6 +725,11 @@ CONFIG_LEGACY_PTY_COUNT=16
 # CONFIG_TCG_TPM is not set
 # CONFIG_I2C is not set
 # CONFIG_SPI is not set
+
+#
+# PPS support
+#
+# CONFIG_PPS is not set
 CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 # CONFIG_GPIOLIB is not set
 # CONFIG_W1 is not set
@@ -805,22 +753,7 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_HTC_PASIC3 is not set
 # CONFIG_MFD_TMIO is not set
 # CONFIG_REGULATOR is not set
-
-#
-# Multimedia devices
-#
-
-#
-# Multimedia core support
-#
-# CONFIG_VIDEO_DEV is not set
-# CONFIG_DVB_CORE is not set
-# CONFIG_VIDEO_MEDIA is not set
-
-#
-# Multimedia drivers
-#
-# CONFIG_DAB is not set
+# CONFIG_MEDIA_SUPPORT is not set
 
 #
 # Graphics support
@@ -898,6 +831,11 @@ CONFIG_SND_SUPPORT_OLD_API=y
 CONFIG_SND_VERBOSE_PROCFS=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
+# CONFIG_SND_RAWMIDI_SEQ is not set
+# CONFIG_SND_OPL3_LIB_SEQ is not set
+# CONFIG_SND_OPL4_LIB_SEQ is not set
+# CONFIG_SND_SBAWE_SEQ is not set
+# CONFIG_SND_EMU10K1_SEQ is not set
 # CONFIG_SND_DRIVERS is not set
 CONFIG_SND_PPC=y
 CONFIG_SND_PS3=m
@@ -930,29 +868,34 @@ CONFIG_USB_HIDDEV=y
 # Special HID drivers
 #
 # CONFIG_HID_A4TECH is not set
-# CONFIG_HID_APPLE is not set
-# CONFIG_HID_BELKIN is not set
-# CONFIG_HID_CHERRY is not set
+CONFIG_HID_APPLE=m
+CONFIG_HID_BELKIN=m
+CONFIG_HID_CHERRY=m
 # CONFIG_HID_CHICONY is not set
 # CONFIG_HID_CYPRESS is not set
-# CONFIG_DRAGONRISE_FF is not set
-# CONFIG_HID_EZKEY is not set
+# CONFIG_HID_DRAGONRISE is not set
+CONFIG_HID_EZKEY=m
 # CONFIG_HID_KYE is not set
 # CONFIG_HID_GYRATION is not set
 # CONFIG_HID_KENSINGTON is not set
-# CONFIG_HID_LOGITECH is not set
-# CONFIG_HID_MICROSOFT is not set
+CONFIG_HID_LOGITECH=m
+# CONFIG_LOGITECH_FF is not set
+# CONFIG_LOGIRUMBLEPAD2_FF is not set
+CONFIG_HID_MICROSOFT=m
 # CONFIG_HID_MONTEREY is not set
 # CONFIG_HID_NTRIG is not set
 # CONFIG_HID_PANTHERLORD is not set
 # CONFIG_HID_PETALYNX is not set
 # CONFIG_HID_SAMSUNG is not set
 CONFIG_HID_SONY=m
-# CONFIG_HID_SUNPLUS is not set
-# CONFIG_GREENASIA_FF is not set
+CONFIG_HID_SUNPLUS=m
+# CONFIG_HID_GREENASIA is not set
+CONFIG_HID_SMARTJOYPLUS=m
+# CONFIG_SMARTJOYPLUS_FF is not set
 # CONFIG_HID_TOPSEED is not set
-# CONFIG_THRUSTMASTER_FF is not set
-# CONFIG_ZEROPLUS_FF is not set
+# CONFIG_HID_THRUSTMASTER is not set
+# CONFIG_HID_WACOM is not set
+# CONFIG_HID_ZEROPLUS is not set
 CONFIG_USB_SUPPORT=y
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
@@ -988,6 +931,8 @@ CONFIG_USB_EHCI_BIG_ENDIAN_MMIO=y
 # CONFIG_USB_ISP116X_HCD is not set
 # CONFIG_USB_ISP1760_HCD is not set
 CONFIG_USB_OHCI_HCD=m
+# CONFIG_USB_OHCI_HCD_PPC_OF_BE is not set
+# CONFIG_USB_OHCI_HCD_PPC_OF_LE is not set
 # CONFIG_USB_OHCI_HCD_PPC_OF is not set
 # CONFIG_USB_OHCI_BIG_ENDIAN_DESC is not set
 CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
@@ -1115,6 +1060,10 @@ CONFIG_RTC_DRV_PS3=m
 # CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
+
+#
+# TI VLYNQ
+#
 # CONFIG_STAGING is not set
 
 #
@@ -1141,11 +1090,12 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
-CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_BTRFS_FS is not set
+CONFIG_FILE_LOCKING=y
+CONFIG_FSNOTIFY=y
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
@@ -1205,7 +1155,6 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
-# CONFIG_JFFS2_FS is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
@@ -1222,6 +1171,7 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 CONFIG_NFS_V4=y
+# CONFIG_NFS_V4_1 is not set
 CONFIG_ROOT_NFS=y
 # CONFIG_NFSD is not set
 CONFIG_LOCKD=y
@@ -1359,7 +1309,6 @@ CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_DEBUG_LIST=y
 # CONFIG_DEBUG_SG is not set
 # CONFIG_DEBUG_NOTIFIERS is not set
-# CONFIG_BOOT_PRINTK_DELAY is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_RCU_CPU_STALL_DETECTOR is not set
 # CONFIG_BACKTRACE_SELF_TEST is not set
@@ -1374,31 +1323,21 @@ CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
 CONFIG_HAVE_DYNAMIC_FTRACE=y
 CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
 CONFIG_RING_BUFFER=y
+CONFIG_EVENT_TRACING=y
+CONFIG_CONTEXT_SWITCH_TRACER=y
 CONFIG_TRACING=y
 CONFIG_TRACING_SUPPORT=y
-
-#
-# Tracers
-#
-# CONFIG_FUNCTION_TRACER is not set
-# CONFIG_IRQSOFF_TRACER is not set
-# CONFIG_SCHED_TRACER is not set
-# CONFIG_CONTEXT_SWITCH_TRACER is not set
-# CONFIG_EVENT_TRACER is not set
-# CONFIG_BOOT_TRACER is not set
-# CONFIG_TRACE_BRANCH_PROFILING is not set
-# CONFIG_STACK_TRACER is not set
-# CONFIG_KMEMTRACE is not set
-# CONFIG_WORKQUEUE_TRACER is not set
-# CONFIG_BLK_DEV_IO_TRACE is not set
-# CONFIG_FTRACE_STARTUP_TEST is not set
+# CONFIG_FTRACE is not set
 # CONFIG_DYNAMIC_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 # CONFIG_KGDB is not set
+# CONFIG_PPC_DISABLE_WERROR is not set
+CONFIG_PPC_WERROR=y
 CONFIG_PRINT_STACK_DEPTH=64
 CONFIG_DEBUG_STACKOVERFLOW=y
 # CONFIG_DEBUG_STACK_USAGE is not set
+# CONFIG_PPC_EMULATED_STATS is not set
 # CONFIG_CODE_PATCHING_SELFTEST is not set
 # CONFIG_FTR_FIXUP_SELFTEST is not set
 # CONFIG_MSI_BITMAP_SELFTEST is not set
diff --git a/arch/powerpc/kernel/dma.c b/arch/powerpc/kernel/dma.c
index 20a60d661ba8..ccf129d47d84 100644
--- a/arch/powerpc/kernel/dma.c
+++ b/arch/powerpc/kernel/dma.c
@@ -7,6 +7,7 @@
 
 #include <linux/device.h>
 #include <linux/dma-mapping.h>
+#include <linux/lmb.h>
 #include <asm/bug.h>
 #include <asm/abs_addr.h>
 
@@ -90,11 +91,10 @@ static void dma_direct_unmap_sg(struct device *dev, struct scatterlist *sg,
 static int dma_direct_dma_supported(struct device *dev, u64 mask)
 {
 #ifdef CONFIG_PPC64
-        /* Could be improved to check for memory though it better be
-         * done via some global so platforms can set the limit in case
+        /* Could be improved so platforms can set the limit in case
          * they have limited DMA windows
          */
-        return mask >= DMA_BIT_MASK(32);
+        return mask >= (lmb_end_of_DRAM() - 1);
 #else
         return 1;
 #endif
diff --git a/arch/powerpc/kernel/perf_counter.c b/arch/powerpc/kernel/perf_counter.c
index 809fdf94b95f..70e1f57f7dd8 100644
--- a/arch/powerpc/kernel/perf_counter.c
+++ b/arch/powerpc/kernel/perf_counter.c
@@ -518,6 +518,8 @@ void hw_perf_disable(void)
         struct cpu_hw_counters *cpuhw;
         unsigned long flags;
 
+        if (!ppmu)
+                return;
         local_irq_save(flags);
         cpuhw = &__get_cpu_var(cpu_hw_counters);
 
@@ -572,6 +574,8 @@ void hw_perf_enable(void)
         int n_lim;
         int idx;
 
+        if (!ppmu)
+                return;
         local_irq_save(flags);
         cpuhw = &__get_cpu_var(cpu_hw_counters);
         if (!cpuhw->disabled) {
@@ -737,6 +741,8 @@ int hw_perf_group_sched_in(struct perf_counter *group_leader,
         long i, n, n0;
         struct perf_counter *sub;
 
+        if (!ppmu)
+                return 0;
         cpuhw = &__get_cpu_var(cpu_hw_counters);
         n0 = cpuhw->n_counters;
         n = collect_events(group_leader, ppmu->n_counter - n0,
@@ -1281,6 +1287,8 @@ void hw_perf_counter_setup(int cpu)
 {
         struct cpu_hw_counters *cpuhw = &per_cpu(cpu_hw_counters, cpu);
 
+        if (!ppmu)
+                return;
         memset(cpuhw, 0, sizeof(*cpuhw));
         cpuhw->mmcr[0] = MMCR0_FC;
 }
diff --git a/arch/powerpc/platforms/ps3/time.c b/arch/powerpc/platforms/ps3/time.c
index b178a1e66c91..40b5cb433005 100644
--- a/arch/powerpc/platforms/ps3/time.c
+++ b/arch/powerpc/platforms/ps3/time.c
@@ -21,6 +21,7 @@
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
 
+#include <asm/firmware.h>
 #include <asm/rtc.h>
 #include <asm/lv1call.h>
 #include <asm/ps3.h>
@@ -84,6 +85,9 @@ static int __init ps3_rtc_init(void)
 {
         struct platform_device *pdev;
 
+        if (!firmware_has_feature(FW_FEATURE_PS3_LV1))
+                return -ENODEV;
+
         pdev = platform_device_register_simple("rtc-ps3", -1, NULL, 0);
         if (IS_ERR(pdev))
                 return PTR_ERR(pdev);
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 9717717c6fea..cbb897bc50bd 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -154,6 +154,20 @@ static int __init condev_setup(char *str)
 
 __setup("condev=", condev_setup);
 
+static void __init set_preferred_console(void)
+{
+        if (MACHINE_IS_KVM) {
+                add_preferred_console("hvc", 0, NULL);
+                s390_virtio_console_init();
+                return;
+        }
+
+        if (CONSOLE_IS_3215 || CONSOLE_IS_SCLP)
+                add_preferred_console("ttyS", 0, NULL);
+        if (CONSOLE_IS_3270)
+                add_preferred_console("tty3270", 0, NULL);
+}
+
 static int __init conmode_setup(char *str)
 {
 #if defined(CONFIG_SCLP_CONSOLE) || defined(CONFIG_SCLP_VT220_CONSOLE)
@@ -168,6 +182,7 @@ static int __init conmode_setup(char *str)
         if (strncmp(str, "3270", 5) == 0)
                 SET_CONSOLE_3270;
 #endif
+        set_preferred_console();
         return 1;
 }
 
@@ -780,9 +795,6 @@ static void __init setup_hwcaps(void)
 void __init
 setup_arch(char **cmdline_p)
 {
-        /* set up preferred console */
-        add_preferred_console("ttyS", 0, NULL);
-
         /*
          * print what head.S has found out about the machine
          */
@@ -802,11 +814,9 @@ setup_arch(char **cmdline_p)
         if (MACHINE_IS_VM)
                 pr_info("Linux is running as a z/VM "
                         "guest operating system in 64-bit mode\n");
-        else if (MACHINE_IS_KVM) {
+        else if (MACHINE_IS_KVM)
                 pr_info("Linux is running under KVM in 64-bit mode\n");
-                add_preferred_console("hvc", 0, NULL);
-                s390_virtio_console_init();
-        } else
+        else
                 pr_info("Linux is running natively in 64-bit mode\n");
 #endif /* CONFIG_64BIT */
 
@@ -851,6 +861,7 @@ setup_arch(char **cmdline_p)
 
         /* Setup default console */
         conmode_default();
+        set_preferred_console();
 
         /* Setup zfcpdump support */
         setup_zfcpdump(console_devno);
diff --git a/arch/sh/boards/board-ap325rxa.c b/arch/sh/boards/board-ap325rxa.c
index 7ffd1b4315bd..b9c88cc519e2 100644
--- a/arch/sh/boards/board-ap325rxa.c
+++ b/arch/sh/boards/board-ap325rxa.c
@@ -547,7 +547,7 @@ static int __init ap325rxa_devices_setup(void)
         return platform_add_devices(ap325rxa_devices,
                                 ARRAY_SIZE(ap325rxa_devices));
 }
-device_initcall(ap325rxa_devices_setup);
+arch_initcall(ap325rxa_devices_setup);
 
 /* Return the board specific boot mode pin configuration */
 static int ap325rxa_mode_pins(void)
diff --git a/arch/sh/boards/mach-migor/setup.c b/arch/sh/boards/mach-migor/setup.c
index f70f4644deb4..f9b2e4df35b9 100644
--- a/arch/sh/boards/mach-migor/setup.c
+++ b/arch/sh/boards/mach-migor/setup.c
@@ -608,7 +608,7 @@ static int __init migor_devices_setup(void)
 
         return platform_add_devices(migor_devices, ARRAY_SIZE(migor_devices));
 }
-__initcall(migor_devices_setup);
+arch_initcall(migor_devices_setup);
 
 /* Return the board specific boot mode pin configuration */
 static int migor_mode_pins(void)
diff --git a/arch/sh/boards/mach-se/7724/setup.c b/arch/sh/boards/mach-se/7724/setup.c
index 8fed45a2fb85..15456a0773bf 100644
--- a/arch/sh/boards/mach-se/7724/setup.c
+++ b/arch/sh/boards/mach-se/7724/setup.c
@@ -238,7 +238,7 @@ static struct platform_device ceu1_device = {
         },
 };
 
-/* KEYSC */
+/* KEYSC in SoC (Needs SW33-2 set to ON) */
 static struct sh_keysc_info keysc_info = {
         .mode = SH_KEYSC_MODE_1,
         .scan_timing = 10,
@@ -255,12 +255,13 @@ static struct sh_keysc_info keysc_info = {
 
 static struct resource keysc_resources[] = {
         [0] = {
-                .start  = 0x1a204000,
-                .end    = 0x1a20400f,
+                .name   = "KEYSC",
+                .start  = 0x044b0000,
+                .end    = 0x044b000f,
                 .flags  = IORESOURCE_MEM,
         },
         [1] = {
-                .start  = IRQ0_KEY,
+                .start  = 79,
                 .flags  = IORESOURCE_IRQ,
         },
 };
diff --git a/arch/sh/kernel/cpu/sh2/setup-sh7619.c b/arch/sh/kernel/cpu/sh2/setup-sh7619.c
index 13798733f2db..8555c05e8667 100644
--- a/arch/sh/kernel/cpu/sh2/setup-sh7619.c
+++ b/arch/sh/kernel/cpu/sh2/setup-sh7619.c
@@ -187,7 +187,7 @@ static int __init sh7619_devices_setup(void)
         return platform_add_devices(sh7619_devices,
                                     ARRAY_SIZE(sh7619_devices));
 }
-__initcall(sh7619_devices_setup);
+arch_initcall(sh7619_devices_setup);
 
 void __init plat_irq_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh2a/setup-mxg.c b/arch/sh/kernel/cpu/sh2a/setup-mxg.c
index 869c2da4820b..b67376445315 100644
--- a/arch/sh/kernel/cpu/sh2a/setup-mxg.c
+++ b/arch/sh/kernel/cpu/sh2a/setup-mxg.c
@@ -238,7 +238,7 @@ static int __init mxg_devices_setup(void)
         return platform_add_devices(mxg_devices,
                                     ARRAY_SIZE(mxg_devices));
 }
-__initcall(mxg_devices_setup);
+arch_initcall(mxg_devices_setup);
 
 void __init plat_irq_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh2a/setup-sh7201.c b/arch/sh/kernel/cpu/sh2a/setup-sh7201.c
index d8febe128066..fbde5b75deb9 100644
--- a/arch/sh/kernel/cpu/sh2a/setup-sh7201.c
+++ b/arch/sh/kernel/cpu/sh2a/setup-sh7201.c
@@ -357,7 +357,7 @@ static int __init sh7201_devices_setup(void)
         return platform_add_devices(sh7201_devices,
                                     ARRAY_SIZE(sh7201_devices));
 }
-__initcall(sh7201_devices_setup);
+arch_initcall(sh7201_devices_setup);
 
 void __init plat_irq_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh2a/setup-sh7203.c b/arch/sh/kernel/cpu/sh2a/setup-sh7203.c
index 62e3039d2398..d3fd536c9a84 100644
--- a/arch/sh/kernel/cpu/sh2a/setup-sh7203.c
+++ b/arch/sh/kernel/cpu/sh2a/setup-sh7203.c
@@ -367,7 +367,7 @@ static int __init sh7203_devices_setup(void)
         return platform_add_devices(sh7203_devices,
                                     ARRAY_SIZE(sh7203_devices));
 }
-__initcall(sh7203_devices_setup);
+arch_initcall(sh7203_devices_setup);
 
 void __init plat_irq_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh2a/setup-sh7206.c b/arch/sh/kernel/cpu/sh2a/setup-sh7206.c
index 3e6f3d7a58be..a9ccc5e8d9e9 100644
--- a/arch/sh/kernel/cpu/sh2a/setup-sh7206.c
+++ b/arch/sh/kernel/cpu/sh2a/setup-sh7206.c
@@ -338,7 +338,7 @@ static int __init sh7206_devices_setup(void)
         return platform_add_devices(sh7206_devices,
                                     ARRAY_SIZE(sh7206_devices));
 }
-__initcall(sh7206_devices_setup);
+arch_initcall(sh7206_devices_setup);
 
 void __init plat_irq_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh3/setup-sh7705.c b/arch/sh/kernel/cpu/sh3/setup-sh7705.c
index 88f742fed9ed..c23105983878 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh7705.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh7705.c
@@ -222,7 +222,7 @@ static int __init sh7705_devices_setup(void)
         return platform_add_devices(sh7705_devices,
                                     ARRAY_SIZE(sh7705_devices));
 }
-__initcall(sh7705_devices_setup);
+arch_initcall(sh7705_devices_setup);
 
 static struct platform_device *sh7705_early_devices[] __initdata = {
         &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh3/setup-sh770x.c b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
index c56306798584..347ab35d0697 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c
@@ -250,7 +250,7 @@ static int __init sh770x_devices_setup(void)
         return platform_add_devices(sh770x_devices,
                 ARRAY_SIZE(sh770x_devices));
 }
-__initcall(sh770x_devices_setup);
+arch_initcall(sh770x_devices_setup);
 
 static struct platform_device *sh770x_early_devices[] __initdata = {
         &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh3/setup-sh7710.c b/arch/sh/kernel/cpu/sh3/setup-sh7710.c
index efa76c8148f4..717e90ae1097 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh7710.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh7710.c
@@ -226,7 +226,7 @@ static int __init sh7710_devices_setup(void)
         return platform_add_devices(sh7710_devices,
                                     ARRAY_SIZE(sh7710_devices));
 }
-__initcall(sh7710_devices_setup);
+arch_initcall(sh7710_devices_setup);
 
 static struct platform_device *sh7710_early_devices[] __initdata = {
         &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh3/setup-sh7720.c b/arch/sh/kernel/cpu/sh3/setup-sh7720.c
index 5b2107798edb..74d8baaf8e96 100644
--- a/arch/sh/kernel/cpu/sh3/setup-sh7720.c
+++ b/arch/sh/kernel/cpu/sh3/setup-sh7720.c
@@ -388,7 +388,7 @@ static int __init sh7720_devices_setup(void)
         return platform_add_devices(sh7720_devices,
                                     ARRAY_SIZE(sh7720_devices));
 }
-__initcall(sh7720_devices_setup);
+arch_initcall(sh7720_devices_setup);
 
 static struct platform_device *sh7720_early_devices[] __initdata = {
         &cmt0_device,
diff --git a/arch/sh/kernel/cpu/sh4/setup-sh4-202.c b/arch/sh/kernel/cpu/sh4/setup-sh4-202.c
index 6d088d123591..de4827df19aa 100644
--- a/arch/sh/kernel/cpu/sh4/setup-sh4-202.c
+++ b/arch/sh/kernel/cpu/sh4/setup-sh4-202.c
@@ -138,7 +138,7 @@ static int __init sh4202_devices_setup(void)
         return platform_add_devices(sh4202_devices,
                                     ARRAY_SIZE(sh4202_devices));
 }
-__initcall(sh4202_devices_setup);
+arch_initcall(sh4202_devices_setup);
 
 static struct platform_device *sh4202_early_devices[] __initdata = {
         &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4/setup-sh7750.c b/arch/sh/kernel/cpu/sh4/setup-sh7750.c
index 851672d15cf4..1b8b122e8f3d 100644
--- a/arch/sh/kernel/cpu/sh4/setup-sh7750.c
+++ b/arch/sh/kernel/cpu/sh4/setup-sh7750.c
@@ -239,7 +239,7 @@ static int __init sh7750_devices_setup(void)
         return platform_add_devices(sh7750_devices,
                                     ARRAY_SIZE(sh7750_devices));
 }
-__initcall(sh7750_devices_setup);
+arch_initcall(sh7750_devices_setup);
 
 static struct platform_device *sh7750_early_devices[] __initdata = {
         &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4/setup-sh7760.c b/arch/sh/kernel/cpu/sh4/setup-sh7760.c
index 5b822519bd90..7fbb7be9284c 100644
--- a/arch/sh/kernel/cpu/sh4/setup-sh7760.c
+++ b/arch/sh/kernel/cpu/sh4/setup-sh7760.c
@@ -265,7 +265,7 @@ static int __init sh7760_devices_setup(void)
         return platform_add_devices(sh7760_devices,
                                     ARRAY_SIZE(sh7760_devices));
 }
-__initcall(sh7760_devices_setup);
+arch_initcall(sh7760_devices_setup);
 
 static struct platform_device *sh7760_early_devices[] __initdata = {
         &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7343.c b/arch/sh/kernel/cpu/sh4a/setup-sh7343.c
index 6307e087c864..ac4d5672ec1a 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7343.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7343.c
@@ -325,7 +325,7 @@ static int __init sh7343_devices_setup(void)
         return platform_add_devices(sh7343_devices,
                                     ARRAY_SIZE(sh7343_devices));
 }
-__initcall(sh7343_devices_setup);
+arch_initcall(sh7343_devices_setup);
 
 static struct platform_device *sh7343_early_devices[] __initdata = {
         &cmt_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7366.c b/arch/sh/kernel/cpu/sh4a/setup-sh7366.c
index c18f7d09281b..1a956b1beccc 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7366.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7366.c
@@ -318,7 +318,7 @@ static int __init sh7366_devices_setup(void)
         return platform_add_devices(sh7366_devices,
                                     ARRAY_SIZE(sh7366_devices));
 }
-__initcall(sh7366_devices_setup);
+arch_initcall(sh7366_devices_setup);
 
 static struct platform_device *sh7366_early_devices[] __initdata = {
         &cmt_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7722.c b/arch/sh/kernel/cpu/sh4a/setup-sh7722.c
index ea524a2da3e4..cda76ebf87c3 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7722.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7722.c
@@ -359,7 +359,7 @@ static int __init sh7722_devices_setup(void)
         return platform_add_devices(sh7722_devices,
                                     ARRAY_SIZE(sh7722_devices));
 }
-__initcall(sh7722_devices_setup);
+arch_initcall(sh7722_devices_setup);
 
 static struct platform_device *sh7722_early_devices[] __initdata = {
         &cmt_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7723.c b/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
index e1bb80b2a27b..b45dace9539f 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7723.c
@@ -473,7 +473,7 @@ static int __init sh7723_devices_setup(void)
         return platform_add_devices(sh7723_devices,
                                     ARRAY_SIZE(sh7723_devices));
 }
-__initcall(sh7723_devices_setup);
+arch_initcall(sh7723_devices_setup);
 
 static struct platform_device *sh7723_early_devices[] __initdata = {
         &cmt_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7724.c b/arch/sh/kernel/cpu/sh4a/setup-sh7724.c
index e5ac9eb11c63..a04edaab9a29 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7724.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7724.c
@@ -508,7 +508,7 @@ static int __init sh7724_devices_setup(void)
         return platform_add_devices(sh7724_devices,
                                     ARRAY_SIZE(sh7724_devices));
 }
-device_initcall(sh7724_devices_setup);
+arch_initcall(sh7724_devices_setup);
 
 static struct platform_device *sh7724_early_devices[] __initdata = {
         &cmt_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7763.c b/arch/sh/kernel/cpu/sh4a/setup-sh7763.c
index f1e0c0d36da7..4659fff6b842 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7763.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7763.c
@@ -314,7 +314,7 @@ static int __init sh7763_devices_setup(void)
         return platform_add_devices(sh7763_devices,
                                     ARRAY_SIZE(sh7763_devices));
 }
-__initcall(sh7763_devices_setup);
+arch_initcall(sh7763_devices_setup);
 
 static struct platform_device *sh7763_early_devices[] __initdata = {
         &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7770.c b/arch/sh/kernel/cpu/sh4a/setup-sh7770.c
index 1e86209db284..eead08d89d32 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7770.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7770.c
@@ -368,7 +368,7 @@ static int __init sh7770_devices_setup(void)
         return platform_add_devices(sh7770_devices,
                                     ARRAY_SIZE(sh7770_devices));
 }
-__initcall(sh7770_devices_setup);
+arch_initcall(sh7770_devices_setup);
 
 static struct platform_device *sh7770_early_devices[] __initdata = {
         &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7780.c b/arch/sh/kernel/cpu/sh4a/setup-sh7780.c
index 715e05b431e5..2c901f446959 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7780.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7780.c
@@ -256,7 +256,7 @@ static int __init sh7780_devices_setup(void)
         return platform_add_devices(sh7780_devices,
                                     ARRAY_SIZE(sh7780_devices));
 }
-__initcall(sh7780_devices_setup);
+arch_initcall(sh7780_devices_setup);
 
 static struct platform_device *sh7780_early_devices[] __initdata = {
         &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7785.c b/arch/sh/kernel/cpu/sh4a/setup-sh7785.c
index af561402570b..7f6c718b6c36 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7785.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7785.c
@@ -263,7 +263,7 @@ static int __init sh7785_devices_setup(void)
         return platform_add_devices(sh7785_devices,
                                     ARRAY_SIZE(sh7785_devices));
 }
-__initcall(sh7785_devices_setup);
+arch_initcall(sh7785_devices_setup);
 
 static struct platform_device *sh7785_early_devices[] __initdata = {
         &tmu0_device,
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7786.c b/arch/sh/kernel/cpu/sh4a/setup-sh7786.c
index b70049470a0b..0104a8ec5369 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7786.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7786.c
@@ -547,7 +547,7 @@ static int __init sh7786_devices_setup(void)
         return platform_add_devices(sh7786_devices,
                                     ARRAY_SIZE(sh7786_devices));
 }
-device_initcall(sh7786_devices_setup);
+arch_initcall(sh7786_devices_setup);
 
 void __init plat_early_device_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh4a/setup-shx3.c b/arch/sh/kernel/cpu/sh4a/setup-shx3.c
index 53c65fd9ccef..07f078961c71 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-shx3.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-shx3.c
@@ -256,7 +256,7 @@ static int __init shx3_devices_setup(void)
         return platform_add_devices(shx3_devices,
                                     ARRAY_SIZE(shx3_devices));
 }
-__initcall(shx3_devices_setup);
+arch_initcall(shx3_devices_setup);
 
 void __init plat_early_device_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/sh5/setup-sh5.c b/arch/sh/kernel/cpu/sh5/setup-sh5.c
index f5ff1ac57fc2..6a0f82f70032 100644
--- a/arch/sh/kernel/cpu/sh5/setup-sh5.c
+++ b/arch/sh/kernel/cpu/sh5/setup-sh5.c
@@ -186,7 +186,7 @@ static int __init sh5_devices_setup(void)
         return platform_add_devices(sh5_devices,
                                     ARRAY_SIZE(sh5_devices));
 }
-__initcall(sh5_devices_setup);
+arch_initcall(sh5_devices_setup);
 
 void __init plat_early_device_setup(void)
 {
diff --git a/arch/sh/kernel/cpu/shmobile/sleep.S b/arch/sh/kernel/cpu/shmobile/sleep.S
index 5d888ef53d82..baf2d7d46b05 100644
--- a/arch/sh/kernel/cpu/shmobile/sleep.S
+++ b/arch/sh/kernel/cpu/shmobile/sleep.S
@@ -26,8 +26,30 @@ ENTRY(sh_mobile_standby)
 
         tst     #SUSP_SH_SF, r0
         bt      skip_set_sf
+#ifdef CONFIG_CPU_SUBTYPE_SH7724
+        /* DBSC: put memory in self-refresh mode */
 
-        /* SDRAM: disable power down and put in self-refresh mode */
+        mov.l   dben_reg, r4
+        mov.l   dben_data0, r1
+        mov.l   r1, @r4
+
+        mov.l   dbrfpdn0_reg, r4
+        mov.l   dbrfpdn0_data0, r1
+        mov.l   r1, @r4
+
+        mov.l   dbcmdcnt_reg, r4
+        mov.l   dbcmdcnt_data0, r1
+        mov.l   r1, @r4
+
+        mov.l   dbcmdcnt_reg, r4
+        mov.l   dbcmdcnt_data1, r1
+        mov.l   r1, @r4
+
+        mov.l   dbrfpdn0_reg, r4
+        mov.l   dbrfpdn0_data1, r1
+        mov.l   r1, @r4
+#else
+        /* SBSC: disable power down and put in self-refresh mode */
         mov.l   1f, r4
         mov.l   2f, r1
         mov.l   @r4, r2
@@ -35,6 +57,7 @@ ENTRY(sh_mobile_standby)
         mov.l   3f, r3
         and     r3, r2
         mov.l   r2, @r4
+#endif
 
 skip_set_sf:
         tst     #SUSP_SH_SLEEP, r0
@@ -84,7 +107,36 @@ done_sleep:
         tst     #SUSP_SH_SF, r0
         bt      skip_restore_sf
 
-        /* SDRAM: set auto-refresh mode */
+#ifdef CONFIG_CPU_SUBTYPE_SH7724
+        /* DBSC: put memory in auto-refresh mode */
+
+        mov.l   dbrfpdn0_reg, r4
+        mov.l   dbrfpdn0_data0, r1
+        mov.l   r1, @r4
+
+        /* sleep 140 ns */
+        nop
+        nop
+        nop
+        nop
+
+        mov.l   dbcmdcnt_reg, r4
+        mov.l   dbcmdcnt_data0, r1
+        mov.l   r1, @r4
+
+        mov.l   dbcmdcnt_reg, r4
+        mov.l   dbcmdcnt_data1, r1
+        mov.l   r1, @r4
+
+        mov.l   dben_reg, r4
+        mov.l   dben_data1, r1
+        mov.l   r1, @r4
+
+        mov.l   dbrfpdn0_reg, r4
+        mov.l   dbrfpdn0_data2, r1
+        mov.l   r1, @r4
+#else
+        /* SBSC: set auto-refresh mode */
         mov.l   1f, r4
         mov.l   @r4, r2
         mov.l   4f, r3
@@ -98,15 +150,29 @@ done_sleep:
         add     r4, r3
         or      r2, r3
         mov.l   r3, @r1
+#endif
 skip_restore_sf:
         rts
          nop
 
         .balign 4
+#ifdef CONFIG_CPU_SUBTYPE_SH7724
+dben_reg:       .long   0xfd000010 /* DBEN */
+dben_data0:     .long   0
+dben_data1:     .long   1
+dbrfpdn0_reg:   .long   0xfd000040 /* DBRFPDN0 */
+dbrfpdn0_data0: .long   0
+dbrfpdn0_data1: .long   1
+dbrfpdn0_data2: .long   0x00010000
+dbcmdcnt_reg:   .long   0xfd000014 /* DBCMDCNT */
+dbcmdcnt_data0: .long   2
+dbcmdcnt_data1: .long   4
+#else
 1:      .long   0xfe400008 /* SDCR0 */
 2:      .long   0x00000400
 3:      .long   0xffff7fff
 4:      .long   0xfffffbff
+#endif
 5:      .long   0xa4150020 /* STBCR */
 6:      .long   0xfe40001c /* RTCOR */
 7:      .long   0xfe400018 /* RTCNT */
diff --git a/arch/sparc/configs/sparc32_defconfig b/arch/sparc/configs/sparc32_defconfig
index 8bcd27af724b..a0f62a808edb 100644
--- a/arch/sparc/configs/sparc32_defconfig
+++ b/arch/sparc/configs/sparc32_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.30-rc2
-# Fri Apr 17 04:04:46 2009
+# Linux kernel version: 2.6.31-rc1
+# Tue Aug 18 23:45:52 2009
 #
 # CONFIG_64BIT is not set
 CONFIG_SPARC=y
@@ -17,6 +17,7 @@ CONFIG_GENERIC_ISA_DMA=y
 CONFIG_ARCH_NO_VIRT_TO_BUS=y
 CONFIG_OF=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_CONSTRUCTORS=y
 
 #
 # General setup
@@ -74,7 +75,6 @@ CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
-# CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
@@ -87,8 +87,13 @@ CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
 CONFIG_AIO=y
+
+#
+# Performance Counters
+#
 CONFIG_VM_EVENT_COUNTERS=y
 CONFIG_PCI_QUIRKS=y
+# CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_COMPAT_BRK=y
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
@@ -97,6 +102,10 @@ CONFIG_SLAB=y
 # CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
 CONFIG_HAVE_ARCH_TRACEHOOK=y
+
+#
+# GCOV-based kernel profiling
+#
 # CONFIG_SLOW_WORK is not set
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
@@ -109,7 +118,7 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_BLOCK=y
-# CONFIG_LBD is not set
+CONFIG_LBDAF=y
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
 
@@ -154,9 +163,9 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
-CONFIG_UNEVICTABLE_LRU=y
 CONFIG_HAVE_MLOCK=y
 CONFIG_HAVE_MLOCKED_PAGE_BIT=y
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 CONFIG_SUN_PM=y
 # CONFIG_SPARC_LED is not set
 CONFIG_SERIAL_CONSOLE=y
@@ -264,6 +273,7 @@ CONFIG_IPV6_TUNNEL=m
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_PHONET is not set
+# CONFIG_IEEE802154 is not set
 # CONFIG_NET_SCHED is not set
 # CONFIG_DCB is not set
 
@@ -281,7 +291,11 @@ CONFIG_WIRELESS=y
 CONFIG_WIRELESS_OLD_REGULATORY=y
 # CONFIG_WIRELESS_EXT is not set
 # CONFIG_LIB80211 is not set
-# CONFIG_MAC80211 is not set
+
+#
+# CFG80211 needs to be enabled for MAC80211
+#
+CONFIG_MAC80211_DEFAULT_PS_VALUE=0
 # CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
@@ -335,6 +349,7 @@ CONFIG_MISC_DEVICES=y
 # EEPROM support
 #
 # CONFIG_EEPROM_93CX6 is not set
+# CONFIG_CB710_CORE is not set
 CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
 
@@ -358,10 +373,6 @@ CONFIG_BLK_DEV_SR=m
 # CONFIG_BLK_DEV_SR_VENDOR is not set
 CONFIG_CHR_DEV_SG=m
 # CONFIG_CHR_DEV_SCH is not set
-
-#
-# Some SCSI devices (e.g. CD jukebox) support multiple LUNs
-#
 # CONFIG_SCSI_MULTI_LUN is not set
 # CONFIG_SCSI_CONSTANTS is not set
 # CONFIG_SCSI_LOGGING is not set
@@ -379,6 +390,7 @@ CONFIG_SCSI_SPI_ATTRS=y
 CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_ISCSI_TCP is not set
 # CONFIG_SCSI_CXGB3_ISCSI is not set
+# CONFIG_SCSI_BNX2_ISCSI is not set
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
 # CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
@@ -387,6 +399,7 @@ CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_SCSI_AIC7XXX_OLD is not set
 # CONFIG_SCSI_AIC79XX is not set
 # CONFIG_SCSI_AIC94XX is not set
+# CONFIG_SCSI_MVSAS is not set
 # CONFIG_SCSI_ARCMSR is not set
 # CONFIG_MEGARAID_NEWGEN is not set
 # CONFIG_MEGARAID_LEGACY is not set
@@ -401,7 +414,6 @@ CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_SCSI_IPS is not set
 # CONFIG_SCSI_INITIO is not set
 # CONFIG_SCSI_INIA100 is not set
-# CONFIG_SCSI_MVSAS is not set
 # CONFIG_SCSI_STEX is not set
 # CONFIG_SCSI_SYM53C8XX_2 is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
@@ -426,13 +438,16 @@ CONFIG_SCSI_SUNESP=y
 #
 
 #
-# Enable only one of the two stacks, unless you know what you are doing
+# You can enable one or both FireWire driver stacks.
+#
+
+#
+# See the help texts for more information.
 #
 # CONFIG_FIREWIRE is not set
 # CONFIG_IEEE1394 is not set
 # CONFIG_I2O is not set
 CONFIG_NETDEVICES=y
-CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 # CONFIG_MACVLAN is not set
@@ -463,6 +478,7 @@ CONFIG_SUNQE=m
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 # CONFIG_NET_PCI is not set
 # CONFIG_B44 is not set
+# CONFIG_KS8842 is not set
 # CONFIG_ATL2 is not set
 CONFIG_NETDEV_1000=y
 # CONFIG_ACENIC is not set
@@ -482,6 +498,7 @@ CONFIG_NETDEV_1000=y
 # CONFIG_VIA_VELOCITY is not set
 # CONFIG_TIGON3 is not set
 # CONFIG_BNX2 is not set
+# CONFIG_CNIC is not set
 # CONFIG_QLA3XXX is not set
 # CONFIG_ATL1 is not set
 # CONFIG_ATL1E is not set
@@ -629,6 +646,11 @@ CONFIG_HW_RANDOM=m
 CONFIG_DEVPORT=y
 # CONFIG_I2C is not set
 # CONFIG_SPI is not set
+
+#
+# PPS support
+#
+# CONFIG_PPS is not set
 CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 # CONFIG_GPIOLIB is not set
 # CONFIG_W1 is not set
@@ -668,22 +690,7 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_HTC_PASIC3 is not set
 # CONFIG_MFD_TMIO is not set
 # CONFIG_REGULATOR is not set
-
-#
-# Multimedia devices
-#
-
-#
-# Multimedia core support
-#
-# CONFIG_VIDEO_DEV is not set
-# CONFIG_DVB_CORE is not set
-# CONFIG_VIDEO_MEDIA is not set
-
-#
-# Multimedia drivers
-#
-# CONFIG_DAB is not set
+# CONFIG_MEDIA_SUPPORT is not set
 
 #
 # Graphics support
@@ -776,6 +783,10 @@ CONFIG_RTC_DRV_M48T59=y
 # CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
+
+#
+# TI VLYNQ
+#
 # CONFIG_STAGING is not set
 
 #
@@ -799,10 +810,12 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
-CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_BTRFS_FS is not set
+CONFIG_FILE_LOCKING=y
+CONFIG_FSNOTIFY=y
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
@@ -985,6 +998,7 @@ CONFIG_KGDB=y
 CONFIG_KGDB_SERIAL_CONSOLE=y
 CONFIG_KGDB_TESTS=y
 # CONFIG_KGDB_TESTS_ON_BOOT is not set
+# CONFIG_KMEMCHECK is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
 # CONFIG_STACK_DEBUG is not set
 
diff --git a/arch/sparc/configs/sparc64_defconfig b/arch/sparc/configs/sparc64_defconfig
index 0123a4c596ce..fdddf7a6f725 100644
--- a/arch/sparc/configs/sparc64_defconfig
+++ b/arch/sparc/configs/sparc64_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.30
-# Tue Jun 16 04:59:36 2009
+# Linux kernel version: 2.6.31-rc1
+# Tue Aug 18 23:56:02 2009
 #
 CONFIG_64BIT=y
 CONFIG_SPARC=y
@@ -26,6 +26,7 @@ CONFIG_ARCH_NO_VIRT_TO_BUS=y
 CONFIG_OF=y
 CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_CONSTRUCTORS=y
 
 #
 # General setup
@@ -119,6 +120,11 @@ CONFIG_HAVE_KPROBES=y
 CONFIG_HAVE_KRETPROBES=y
 CONFIG_HAVE_ARCH_TRACEHOOK=y
 CONFIG_USE_GENERIC_SMP_HELPERS=y
+
+#
+# GCOV-based kernel profiling
+#
+# CONFIG_GCOV_KERNEL is not set
 # CONFIG_SLOW_WORK is not set
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
@@ -204,7 +210,6 @@ CONFIG_MIGRATION=y
 CONFIG_PHYS_ADDR_T_64BIT=y
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_NR_QUICK=1
-CONFIG_UNEVICTABLE_LRU=y
 CONFIG_HAVE_MLOCK=y
 CONFIG_HAVE_MLOCKED_PAGE_BIT=y
 CONFIG_DEFAULT_MMAP_MIN_ADDR=8192
@@ -410,6 +415,7 @@ CONFIG_MISC_DEVICES=y
 #
 # CONFIG_EEPROM_AT24 is not set
 # CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_MAX6875 is not set
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_CB710_CORE is not set
 CONFIG_HAVE_IDE=y
@@ -562,6 +568,7 @@ CONFIG_BLK_DEV_DM=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
+# CONFIG_DM_LOG_USERSPACE is not set
 CONFIG_DM_ZERO=m
 # CONFIG_DM_MULTIPATH is not set
 # CONFIG_DM_DELAY is not set
@@ -573,7 +580,11 @@ CONFIG_DM_ZERO=m
 #
 
 #
-# Enable only one of the two stacks, unless you know what you are doing
+# You can enable one or both FireWire driver stacks.
+#
+
+#
+# See the help texts for more information.
 #
 # CONFIG_FIREWIRE is not set
 # CONFIG_IEEE1394 is not set
@@ -667,6 +678,7 @@ CONFIG_E1000E=m
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=m
 CONFIG_BNX2=m
+# CONFIG_CNIC is not set
 # CONFIG_QLA3XXX is not set
 # CONFIG_ATL1 is not set
 # CONFIG_ATL1E is not set
@@ -773,6 +785,7 @@ CONFIG_MOUSE_SERIAL=y
 # CONFIG_MOUSE_APPLETOUCH is not set
 # CONFIG_MOUSE_BCM5974 is not set
 # CONFIG_MOUSE_VSXXXAA is not set
+# CONFIG_MOUSE_SYNAPTICS_I2C is not set
 # CONFIG_INPUT_JOYSTICK is not set
 # CONFIG_INPUT_TABLET is not set
 # CONFIG_INPUT_TOUCHSCREEN is not set
@@ -870,6 +883,7 @@ CONFIG_I2C_ALGOBIT=y
 #
 # I2C system bus drivers (mostly embedded / system-on-chip)
 #
+# CONFIG_I2C_DESIGNWARE is not set
 # CONFIG_I2C_OCORES is not set
 # CONFIG_I2C_SIMTEC is not set
 
@@ -898,13 +912,17 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
-# CONFIG_SENSORS_MAX6875 is not set
 # CONFIG_SENSORS_TSL2550 is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
 # CONFIG_I2C_DEBUG_CHIP is not set
 # CONFIG_SPI is not set
+
+#
+# PPS support
+#
+# CONFIG_PPS is not set
 CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 # CONFIG_GPIOLIB is not set
 # CONFIG_W1 is not set
@@ -959,6 +977,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_ADS7828 is not set
 # CONFIG_SENSORS_THMC50 is not set
+# CONFIG_SENSORS_TMP401 is not set
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_VT1211 is not set
 # CONFIG_SENSORS_VT8231 is not set
@@ -994,23 +1013,9 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
 # CONFIG_MFD_PCF50633 is not set
+# CONFIG_AB3100_CORE is not set
 # CONFIG_REGULATOR is not set
-
-#
-# Multimedia devices
-#
-
-#
-# Multimedia core support
-#
-# CONFIG_VIDEO_DEV is not set
-# CONFIG_DVB_CORE is not set
-# CONFIG_VIDEO_MEDIA is not set
-
-#
-# Multimedia drivers
-#
-# CONFIG_DAB is not set
+# CONFIG_MEDIA_SUPPORT is not set
 
 #
 # Graphics support
@@ -1284,7 +1289,6 @@ CONFIG_USB=y
 #
 # Miscellaneous USB options
 #
-CONFIG_USB_DEVICEFS=y
 # CONFIG_USB_DEVICE_CLASS is not set
 # CONFIG_USB_DYNAMIC_MINORS is not set
 # CONFIG_USB_OTG is not set
@@ -1296,6 +1300,7 @@ CONFIG_USB_DEVICEFS=y
 # USB Host Controller Drivers
 #
 # CONFIG_USB_C67X00_HCD is not set
+# CONFIG_USB_XHCI_HCD is not set
 CONFIG_USB_EHCI_HCD=m
 # CONFIG_USB_EHCI_ROOT_HUB_TT is not set
 # CONFIG_USB_EHCI_TT_NEWSCHED is not set
@@ -1374,7 +1379,6 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_LD is not set
 # CONFIG_USB_TRANCEVIBRATOR is not set
 # CONFIG_USB_IOWARRIOR is not set
-# CONFIG_USB_TEST is not set
 # CONFIG_USB_ISIGHTFW is not set
 # CONFIG_USB_VST is not set
 # CONFIG_USB_GADGET is not set
@@ -1420,6 +1424,7 @@ CONFIG_RTC_INTF_DEV=y
 # CONFIG_RTC_DRV_S35390A is not set
 # CONFIG_RTC_DRV_FM3130 is not set
 # CONFIG_RTC_DRV_RX8581 is not set
+# CONFIG_RTC_DRV_RX8025 is not set
 
 #
 # SPI RTC drivers
@@ -1448,6 +1453,10 @@ CONFIG_RTC_DRV_STARFIRE=y
 # CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
+
+#
+# TI VLYNQ
+#
 # CONFIG_STAGING is not set
 
 #
@@ -1480,11 +1489,11 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
-CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_BTRFS_FS is not set
+CONFIG_FILE_LOCKING=y
 CONFIG_FSNOTIFY=y
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
@@ -1560,7 +1569,7 @@ CONFIG_NETWORK_FILESYSTEMS=y
 # CONFIG_PARTITION_ADVANCED is not set
 CONFIG_MSDOS_PARTITION=y
 CONFIG_SUN_PARTITION=y
-CONFIG_NLS=m
+CONFIG_NLS=y
 CONFIG_NLS_DEFAULT="iso8859-1"
 # CONFIG_NLS_CODEPAGE_437 is not set
 # CONFIG_NLS_CODEPAGE_737 is not set
diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
index b049abf9902f..0ff92fa22064 100644
--- a/arch/sparc/include/asm/pgtable_64.h
+++ b/arch/sparc/include/asm/pgtable_64.h
@@ -726,11 +726,17 @@ extern unsigned long pte_file(pte_t);
 extern pte_t pgoff_to_pte(unsigned long);
 #define PTE_FILE_MAX_BITS       (64UL - PAGE_SHIFT - 1UL)
 
-extern unsigned long *sparc64_valid_addr_bitmap;
+extern unsigned long sparc64_valid_addr_bitmap[];
 
 /* Needs to be defined here and not in linux/mm.h, as it is arch dependent */
-#define kern_addr_valid(addr)   \
-        (test_bit(__pa((unsigned long)(addr))>>22, sparc64_valid_addr_bitmap))
+static inline bool kern_addr_valid(unsigned long addr)
+{
+        unsigned long paddr = __pa(addr);
+
+        if ((paddr >> 41UL) != 0UL)
+                return false;
+        return test_bit(paddr >> 22, sparc64_valid_addr_bitmap);
+}
 
 extern int page_in_phys_avail(unsigned long paddr);
 
diff --git a/arch/sparc/kernel/ktlb.S b/arch/sparc/kernel/ktlb.S
index cef8defcd7a9..3ea6e8cde8c5 100644
--- a/arch/sparc/kernel/ktlb.S
+++ b/arch/sparc/kernel/ktlb.S
@@ -151,12 +151,46 @@ kvmap_dtlb_4v:
          * Must preserve %g1 and %g6 (TAG).
          */
 kvmap_dtlb_tsb4m_miss:
-        sethi           %hi(kpte_linear_bitmap), %g2
-        or              %g2, %lo(kpte_linear_bitmap), %g2
+        /* Clear the PAGE_OFFSET top virtual bits, shift
+         * down to get PFN, and make sure PFN is in range.
+         */
+        sllx            %g4, 21, %g5
 
-        /* Clear the PAGE_OFFSET top virtual bits, then shift
-         * down to get a 256MB physical address index.
+        /* Check to see if we know about valid memory at the 4MB
+         * chunk this physical address will reside within.
          */
+        srlx            %g5, 21 + 41, %g2
+        brnz,pn         %g2, kvmap_dtlb_longpath
+         nop
+
+        /* This unconditional branch and delay-slot nop gets patched
+         * by the sethi sequence once the bitmap is properly setup.
+         */
+        .globl          valid_addr_bitmap_insn
+valid_addr_bitmap_insn:
+        ba,pt           %xcc, 2f
+         nop
+        .subsection     2
+        .globl          valid_addr_bitmap_patch
+valid_addr_bitmap_patch:
+        sethi           %hi(sparc64_valid_addr_bitmap), %g7
+        or              %g7, %lo(sparc64_valid_addr_bitmap), %g7
+        .previous
+
+        srlx            %g5, 21 + 22, %g2
+        srlx            %g2, 6, %g5
+        and             %g2, 63, %g2
+        sllx            %g5, 3, %g5
+        ldx             [%g7 + %g5], %g5
+        mov             1, %g7
+        sllx            %g7, %g2, %g7
+        andcc           %g5, %g7, %g0
+        be,pn           %xcc, kvmap_dtlb_longpath
+
+2:       sethi          %hi(kpte_linear_bitmap), %g2
+        or              %g2, %lo(kpte_linear_bitmap), %g2
+
+        /* Get the 256MB physical address index. */
         sllx            %g4, 21, %g5
         mov             1, %g7
         srlx            %g5, 21 + 28, %g5
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index fa44eaf8d897..3691907a43b4 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -1499,7 +1499,7 @@ void __init setup_per_cpu_areas(void)
         dyn_size = pcpur_size - static_size - PERCPU_MODULE_RESERVE;
 
 
-        ptrs_size = PFN_ALIGN(num_possible_cpus() * sizeof(pcpur_ptrs[0]));
+        ptrs_size = PFN_ALIGN(nr_cpu_ids * sizeof(pcpur_ptrs[0]));
         pcpur_ptrs = alloc_bootmem(ptrs_size);
 
         for_each_possible_cpu(cpu) {
@@ -1514,7 +1514,7 @@ void __init setup_per_cpu_areas(void)
 
         /* allocate address and map */
         vm.flags = VM_ALLOC;
-        vm.size = num_possible_cpus() * PCPU_CHUNK_SIZE;
+        vm.size = nr_cpu_ids * PCPU_CHUNK_SIZE;
         vm_area_register_early(&vm, PCPU_CHUNK_SIZE);
 
         for_each_possible_cpu(cpu) {
diff --git a/arch/sparc/kernel/sun4d_smp.c b/arch/sparc/kernel/sun4d_smp.c
index 54fb02468f0d..68791cad7b74 100644
--- a/arch/sparc/kernel/sun4d_smp.c
+++ b/arch/sparc/kernel/sun4d_smp.c
@@ -162,9 +162,6 @@ extern void cpu_panic(void);
  */
  
 extern struct linux_prom_registers smp_penguin_ctable;
-extern unsigned long trapbase_cpu1[];
-extern unsigned long trapbase_cpu2[];
-extern unsigned long trapbase_cpu3[];
 
 void __init smp4d_boot_cpus(void)
 {
@@ -235,25 +232,6 @@ void __init smp4d_smp_done(void)
         *prev = first;
         local_flush_cache_all();
 
-        /* Free unneeded trap tables */
-        ClearPageReserved(virt_to_page(trapbase_cpu1));
-        init_page_count(virt_to_page(trapbase_cpu1));
-        free_page((unsigned long)trapbase_cpu1);
-        totalram_pages++;
-        num_physpages++;
-
-        ClearPageReserved(virt_to_page(trapbase_cpu2));
-        init_page_count(virt_to_page(trapbase_cpu2));
-        free_page((unsigned long)trapbase_cpu2);
-        totalram_pages++;
-        num_physpages++;
-
-        ClearPageReserved(virt_to_page(trapbase_cpu3));
-        init_page_count(virt_to_page(trapbase_cpu3));
-        free_page((unsigned long)trapbase_cpu3);
-        totalram_pages++;
-        num_physpages++;
-
         /* Ok, they are spinning and ready to go. */
         smp_processors_ready = 1;
         sun4d_distribute_irqs();
diff --git a/arch/sparc/kernel/sun4m_smp.c b/arch/sparc/kernel/sun4m_smp.c
index 960b113d0006..762d6eedd944 100644
--- a/arch/sparc/kernel/sun4m_smp.c
+++ b/arch/sparc/kernel/sun4m_smp.c
@@ -121,9 +121,6 @@ void __cpuinit smp4m_callin(void)
  */
  
 extern struct linux_prom_registers smp_penguin_ctable;
-extern unsigned long trapbase_cpu1[];
-extern unsigned long trapbase_cpu2[];
-extern unsigned long trapbase_cpu3[];
 
 void __init smp4m_boot_cpus(void)
 {
@@ -193,29 +190,6 @@ void __init smp4m_smp_done(void)
         *prev = first;
         local_flush_cache_all();
 
-        /* Free unneeded trap tables */
-        if (!cpu_isset(1, cpu_present_map)) {
-                ClearPageReserved(virt_to_page(trapbase_cpu1));
-                init_page_count(virt_to_page(trapbase_cpu1));
-                free_page((unsigned long)trapbase_cpu1);
-                totalram_pages++;
-                num_physpages++;
-        }
-        if (!cpu_isset(2, cpu_present_map)) {
-                ClearPageReserved(virt_to_page(trapbase_cpu2));
-                init_page_count(virt_to_page(trapbase_cpu2));
-                free_page((unsigned long)trapbase_cpu2);
-                totalram_pages++;
-                num_physpages++;
-        }
-        if (!cpu_isset(3, cpu_present_map)) {
-                ClearPageReserved(virt_to_page(trapbase_cpu3));
-                init_page_count(virt_to_page(trapbase_cpu3));
-                free_page((unsigned long)trapbase_cpu3);
-                totalram_pages++;
-                num_physpages++;
-        }
-
         /* Ok, they are spinning and ready to go. */
 }
 
diff --git a/arch/sparc/kernel/sys32.S b/arch/sparc/kernel/sys32.S
index f061c4dda9ef..aed94869ad6a 100644
--- a/arch/sparc/kernel/sys32.S
+++ b/arch/sparc/kernel/sys32.S
@@ -134,10 +134,12 @@ SIGN1(sys32_getpeername, sys_getpeername, %o0)
 SIGN1(sys32_getsockname, sys_getsockname, %o0)
 SIGN2(sys32_ioprio_get, sys_ioprio_get, %o0, %o1)
 SIGN3(sys32_ioprio_set, sys_ioprio_set, %o0, %o1, %o2)
-SIGN2(sys32_splice, sys_splice, %o0, %o1)
+SIGN2(sys32_splice, sys_splice, %o0, %o2)
 SIGN2(sys32_sync_file_range, compat_sync_file_range, %o0, %o5)
 SIGN2(sys32_tee, sys_tee, %o0, %o1)
 SIGN1(sys32_vmsplice, compat_sys_vmsplice, %o0)
+SIGN1(sys32_truncate, sys_truncate, %o1)
+SIGN1(sys32_ftruncate, sys_ftruncate, %o1)
 
         .globl          sys32_mmap2
 sys32_mmap2:
diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
index 6b3ee88e253c..2ee7250ba7ae 100644
--- a/arch/sparc/kernel/systbls_64.S
+++ b/arch/sparc/kernel/systbls_64.S
@@ -43,8 +43,8 @@ sys_call_table32:
 /*110*/ .word sys_setresgid, sys_getresgid, sys_setregid, sys_nis_syscall, sys_nis_syscall
         .word sys32_getgroups, compat_sys_gettimeofday, sys32_getrusage, sys_nis_syscall, sys_getcwd
 /*120*/ .word compat_sys_readv, compat_sys_writev, compat_sys_settimeofday, sys_fchown16, sys_fchmod
-        .word sys_nis_syscall, sys_setreuid16, sys_setregid16, sys_rename, sys_truncate
-/*130*/ .word sys_ftruncate, sys_flock, compat_sys_lstat64, sys_nis_syscall, sys_nis_syscall
+        .word sys_nis_syscall, sys_setreuid16, sys_setregid16, sys_rename, sys32_truncate
+/*130*/ .word sys32_ftruncate, sys_flock, compat_sys_lstat64, sys_nis_syscall, sys_nis_syscall
         .word sys_nis_syscall, sys32_mkdir, sys_rmdir, compat_sys_utimes, compat_sys_stat64
 /*140*/ .word sys32_sendfile64, sys_nis_syscall, sys32_futex, sys_gettid, compat_sys_getrlimit
         .word compat_sys_setrlimit, sys_pivot_root, sys32_prctl, sys_pciconfig_read, sys_pciconfig_write
diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
index a5e30c642ee3..b99f81c4906f 100644
--- a/arch/sparc/mm/fault_32.c
+++ b/arch/sparc/mm/fault_32.c
@@ -319,9 +319,10 @@ no_context:
  */
 out_of_memory:
         up_read(&mm->mmap_sem);
-        printk("VM: killing process %s\n", tsk->comm);
-        if (from_user)
-                do_group_exit(SIGKILL);
+        if (from_user) {
+                pagefault_out_of_memory();
+                return;
+        }
         goto no_context;
 
 do_sigbus:
diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
index e5620b27c8bf..43b0da96a4fb 100644
--- a/arch/sparc/mm/fault_64.c
+++ b/arch/sparc/mm/fault_64.c
@@ -447,9 +447,10 @@ handle_kernel_fault:
 out_of_memory:
         insn = get_fault_insn(regs, insn);
         up_read(&mm->mmap_sem);
-        printk("VM: killing process %s\n", current->comm);
-        if (!(regs->tstate & TSTATE_PRIV))
-                do_group_exit(SIGKILL);
+        if (!(regs->tstate & TSTATE_PRIV)) {
+                pagefault_out_of_memory();
+                return;
+        }
         goto handle_kernel_fault;
 
 intr_or_no_mm:
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index ed6be6ba2f4e..a70a5e1904d9 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -145,7 +145,8 @@ static void __init read_obp_memory(const char *property,
              cmp_p64, NULL);
 }
 
-unsigned long *sparc64_valid_addr_bitmap __read_mostly;
+unsigned long sparc64_valid_addr_bitmap[VALID_ADDR_BITMAP_BYTES /
+                                        sizeof(unsigned long)];
 EXPORT_SYMBOL(sparc64_valid_addr_bitmap);
 
 /* Kernel physical address base and size in bytes.  */
@@ -1874,7 +1875,7 @@ static int pavail_rescan_ents __initdata;
  * memory list again, and make sure it provides at least as much
  * memory as 'pavail' does.
  */
-static void __init setup_valid_addr_bitmap_from_pavail(void)
+static void __init setup_valid_addr_bitmap_from_pavail(unsigned long *bitmap)
 {
         int i;
 
@@ -1897,8 +1898,7 @@ static void __init setup_valid_addr_bitmap_from_pavail(void)
 
                                 if (new_start <= old_start &&
                                     new_end >= (old_start + PAGE_SIZE)) {
-                                        set_bit(old_start >> 22,
-                                                sparc64_valid_addr_bitmap);
+                                        set_bit(old_start >> 22, bitmap);
                                         goto do_next_page;
                                 }
                         }
@@ -1919,20 +1919,21 @@ static void __init setup_valid_addr_bitmap_from_pavail(void)
         }
 }
 
+static void __init patch_tlb_miss_handler_bitmap(void)
+{
+        extern unsigned int valid_addr_bitmap_insn[];
+        extern unsigned int valid_addr_bitmap_patch[];
+
+        valid_addr_bitmap_insn[1] = valid_addr_bitmap_patch[1];
+        mb();
+        valid_addr_bitmap_insn[0] = valid_addr_bitmap_patch[0];
+        flushi(&valid_addr_bitmap_insn[0]);
+}
+
 void __init mem_init(void)
 {
         unsigned long codepages, datapages, initpages;
         unsigned long addr, last;
-        int i;
-
-        i = last_valid_pfn >> ((22 - PAGE_SHIFT) + 6);
-        i += 1;
-        sparc64_valid_addr_bitmap = (unsigned long *) alloc_bootmem(i << 3);
-        if (sparc64_valid_addr_bitmap == NULL) {
-                prom_printf("mem_init: Cannot alloc valid_addr_bitmap.\n");
-                prom_halt();
-        }
-        memset(sparc64_valid_addr_bitmap, 0, i << 3);
 
         addr = PAGE_OFFSET + kern_base;
         last = PAGE_ALIGN(kern_size) + addr;
@@ -1941,15 +1942,19 @@ void __init mem_init(void)
                 addr += PAGE_SIZE;
         }
 
-        setup_valid_addr_bitmap_from_pavail();
+        setup_valid_addr_bitmap_from_pavail(sparc64_valid_addr_bitmap);
+        patch_tlb_miss_handler_bitmap();
 
         high_memory = __va(last_valid_pfn << PAGE_SHIFT);
 
 #ifdef CONFIG_NEED_MULTIPLE_NODES
-        for_each_online_node(i) {
-                if (NODE_DATA(i)->node_spanned_pages != 0) {
-                        totalram_pages +=
-                                free_all_bootmem_node(NODE_DATA(i));
+        {
+                int i;
+                for_each_online_node(i) {
+                        if (NODE_DATA(i)->node_spanned_pages != 0) {
+                                totalram_pages +=
+                                        free_all_bootmem_node(NODE_DATA(i));
+                        }
                 }
         }
 #else
diff --git a/arch/sparc/mm/init_64.h b/arch/sparc/mm/init_64.h
index 16063870a489..c2f772dbd556 100644
--- a/arch/sparc/mm/init_64.h
+++ b/arch/sparc/mm/init_64.h
@@ -5,10 +5,13 @@
  * marked non-static so that assembler code can get at them.
  */
 
-#define MAX_PHYS_ADDRESS        (1UL << 42UL)
-#define KPTE_BITMAP_CHUNK_SZ    (256UL * 1024UL * 1024UL)
+#define MAX_PHYS_ADDRESS        (1UL << 41UL)
+#define KPTE_BITMAP_CHUNK_SZ            (256UL * 1024UL * 1024UL)
 #define KPTE_BITMAP_BYTES       \
         ((MAX_PHYS_ADDRESS / KPTE_BITMAP_CHUNK_SZ) / 8)
+#define VALID_ADDR_BITMAP_CHUNK_SZ      (4UL * 1024UL * 1024UL)
+#define VALID_ADDR_BITMAP_BYTES \
+        ((MAX_PHYS_ADDRESS / VALID_ADDR_BITMAP_CHUNK_SZ) / 8)
 
 extern unsigned long kern_linear_pte_xor[2];
 extern unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 738bdc6b0f8b..13ffa5df37d7 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -24,6 +24,7 @@ config X86
         select HAVE_UNSTABLE_SCHED_CLOCK
         select HAVE_IDE
         select HAVE_OPROFILE
+        select HAVE_PERF_COUNTERS if (!M386 && !M486)
         select HAVE_IOREMAP_PROT
         select HAVE_KPROBES
         select ARCH_WANT_OPTIONAL_GPIOLIB
@@ -742,7 +743,6 @@ config X86_UP_IOAPIC
 config X86_LOCAL_APIC
         def_bool y
         depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_APIC
-        select HAVE_PERF_COUNTERS if (!M386 && !M486)
 
 config X86_IO_APIC
         def_bool y
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index e2ff504b4ddc..f8ed0658404c 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -4,7 +4,7 @@
 # create a compressed vmlinux image from the original vmlinux
 #
 
-targets := vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma head_$(BITS).o misc.o piggy.o
+targets := vmlinux.lds vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma head_$(BITS).o misc.o piggy.o
 
 KBUILD_CFLAGS := -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2
 KBUILD_CFLAGS += -fno-strict-aliasing -fPIC
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 3cc06e3fceb8..16748077559a 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -2,6 +2,7 @@
 #define _ASM_X86_PGTABLE_H
 
 #include <asm/page.h>
+#include <asm/e820.h>
 
 #include <asm/pgtable_types.h>
 
@@ -269,10 +270,17 @@ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
 
 #define canon_pgprot(p) __pgprot(massage_pgprot(p))
 
-static inline int is_new_memtype_allowed(unsigned long flags,
-                                                unsigned long new_flags)
+static inline int is_new_memtype_allowed(u64 paddr, unsigned long size,
+                                         unsigned long flags,
+                                         unsigned long new_flags)
 {
         /*
+         * PAT type is always WB for ISA. So no need to check.
+         */
+        if (is_ISA_range(paddr, paddr + size - 1))
+                return 1;
+
+        /*
          * Certain new memtypes are not allowed with certain
          * requested memtype:
          * - request is uncached, return cannot be write-back
diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
index bddd44f2f0ab..80e2984f521c 100644
--- a/arch/x86/include/asm/uv/uv_bau.h
+++ b/arch/x86/include/asm/uv/uv_bau.h
@@ -133,7 +133,7 @@ struct bau_msg_payload {
  * see table 4.2.3.0.1 in broacast_assist spec.
  */
 struct bau_msg_header {
-        unsigned int dest_subnodeid:6;  /* must be zero */
+        unsigned int dest_subnodeid:6;  /* must be 0x10, for the LB */
         /* bits 5:0 */
         unsigned int base_dest_nodeid:15; /* nasid>>1 (pnode) of */
         /* bits 20:6 */                   /* first bit in node_map */
diff --git a/arch/x86/kernel/apic/ipi.c b/arch/x86/kernel/apic/ipi.c
index dbf5445727a9..6ef00ba4c886 100644
--- a/arch/x86/kernel/apic/ipi.c
+++ b/arch/x86/kernel/apic/ipi.c
@@ -106,6 +106,9 @@ void default_send_IPI_mask_logical(const struct cpumask *cpumask, int vector)
         unsigned long mask = cpumask_bits(cpumask)[0];
         unsigned long flags;
 
+        if (WARN_ONCE(!mask, "empty IPI mask"))
+                return;
+
         local_irq_save(flags);
         WARN_ON(mask & ~cpumask_bits(cpu_online_mask)[0]);
         __default_send_IPI_dest_field(mask, vector, apic->dest_logical);
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 832e908adcb5..601159374e87 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -46,7 +46,7 @@ static int early_get_nodeid(void)
         return node_id.s.node_id;
 }
 
-static int uv_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
+static int __init uv_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
 {
         if (!strcmp(oem_id, "SGI")) {
                 if (!strcmp(oem_table_id, "UVL"))
@@ -253,7 +253,7 @@ static void uv_send_IPI_self(int vector)
         apic_write(APIC_SELF_IPI, vector);
 }
 
-struct apic apic_x2apic_uv_x = {
+struct apic __refdata apic_x2apic_uv_x = {
 
         .name                           = "UV large system",
         .probe                          = NULL,
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index 3efcb2b96a15..c1f253dac155 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -7,6 +7,10 @@ ifdef CONFIG_FUNCTION_TRACER
 CFLAGS_REMOVE_common.o = -pg
 endif
 
+# Make sure load_percpu_segment has no stackprotector
+nostackp := $(call cc-option, -fno-stack-protector)
+CFLAGS_common.o         := $(nostackp)
+
 obj-y                   := intel_cacheinfo.o addon_cpuid_features.o
 obj-y                   += proc.o capflags.o powerflags.o common.o
 obj-y                   += vmware.o hypervisor.o
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index e2485b03f1cf..63fddcd082cd 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -400,6 +400,13 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
                 level = cpuid_eax(1);
                 if((level >= 0x0f48 && level < 0x0f50) || level >= 0x0f58)
                         set_cpu_cap(c, X86_FEATURE_REP_GOOD);
+
+                /*
+                 * Some BIOSes incorrectly force this feature, but only K8
+                 * revision D (model = 0x14) and later actually support it.
+                 */
+                if (c->x86_model < 0x14)
+                        clear_cpu_cap(c, X86_FEATURE_LAHF_LM);
         }
         if (c->x86 == 0x10 || c->x86 == 0x11)
                 set_cpu_cap(c, X86_FEATURE_REP_GOOD);
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index f1961c07af9a..5ce60a88027b 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -59,7 +59,30 @@ void __init setup_cpu_local_masks(void)
         alloc_bootmem_cpumask_var(&cpu_sibling_setup_mask);
 }
 
-static const struct cpu_dev *this_cpu __cpuinitdata;
+static void __cpuinit default_init(struct cpuinfo_x86 *c)
+{
+#ifdef CONFIG_X86_64
+        display_cacheinfo(c);
+#else
+        /* Not much we can do here... */
+        /* Check if at least it has cpuid */
+        if (c->cpuid_level == -1) {
+                /* No cpuid. It must be an ancient CPU */
+                if (c->x86 == 4)
+                        strcpy(c->x86_model_id, "486");
+                else if (c->x86 == 3)
+                        strcpy(c->x86_model_id, "386");
+        }
+#endif
+}
+
+static const struct cpu_dev __cpuinitconst default_cpu = {
+        .c_init         = default_init,
+        .c_vendor       = "Unknown",
+        .c_x86_vendor   = X86_VENDOR_UNKNOWN,
+};
+
+static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
 
 DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
 #ifdef CONFIG_X86_64
@@ -332,29 +355,6 @@ void switch_to_new_gdt(int cpu)
 
 static const struct cpu_dev *__cpuinitdata cpu_devs[X86_VENDOR_NUM] = {};
 
-static void __cpuinit default_init(struct cpuinfo_x86 *c)
-{
-#ifdef CONFIG_X86_64
-        display_cacheinfo(c);
-#else
-        /* Not much we can do here... */
-        /* Check if at least it has cpuid */
-        if (c->cpuid_level == -1) {
-                /* No cpuid. It must be an ancient CPU */
-                if (c->x86 == 4)
-                        strcpy(c->x86_model_id, "486");
-                else if (c->x86 == 3)
-                        strcpy(c->x86_model_id, "386");
-        }
-#endif
-}
-
-static const struct cpu_dev __cpuinitconst default_cpu = {
-        .c_init = default_init,
-        .c_vendor = "Unknown",
-        .c_x86_vendor = X86_VENDOR_UNKNOWN,
-};
-
 static void __cpuinit get_model_name(struct cpuinfo_x86 *c)
 {
         unsigned int *v;
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 1cfb623ce11c..01213048f62f 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1226,8 +1226,13 @@ static void mce_init(void)
 }
 
 /* Add per CPU specific workarounds here */
-static void mce_cpu_quirks(struct cpuinfo_x86 *c)
+static int mce_cpu_quirks(struct cpuinfo_x86 *c)
 {
+        if (c->x86_vendor == X86_VENDOR_UNKNOWN) {
+                pr_info("MCE: unknown CPU type - not enabling MCE support.\n");
+                return -EOPNOTSUPP;
+        }
+
         /* This should be disabled by the BIOS, but isn't always */
         if (c->x86_vendor == X86_VENDOR_AMD) {
                 if (c->x86 == 15 && banks > 4) {
@@ -1273,11 +1278,20 @@ static void mce_cpu_quirks(struct cpuinfo_x86 *c)
                 if ((c->x86 > 6 || (c->x86 == 6 && c->x86_model >= 0xe)) &&
                         monarch_timeout < 0)
                         monarch_timeout = USEC_PER_SEC;
+
+                /*
+                 * There are also broken BIOSes on some Pentium M and
+                 * earlier systems:
+                 */
+                if (c->x86 == 6 && c->x86_model <= 13 && mce_bootlog < 0)
+                        mce_bootlog = 0;
         }
         if (monarch_timeout < 0)
                 monarch_timeout = 0;
         if (mce_bootlog != 0)
                 mce_panic_timeout = 30;
+
+        return 0;
 }
 
 static void __cpuinit mce_ancient_init(struct cpuinfo_x86 *c)
@@ -1338,11 +1352,10 @@ void __cpuinit mcheck_init(struct cpuinfo_x86 *c)
         if (!mce_available(c))
                 return;
 
-        if (mce_cap_init() < 0) {
+        if (mce_cap_init() < 0 || mce_cpu_quirks(c) < 0) {
                 mce_disabled = 1;
                 return;
         }
-        mce_cpu_quirks(c);
 
         machine_check_vector = do_machine_check;
 
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index bff8dd191dd5..5957a93e5173 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -36,6 +36,7 @@
 
 static DEFINE_PER_CPU(__u64, next_check) = INITIAL_JIFFIES;
 static DEFINE_PER_CPU(unsigned long, thermal_throttle_count);
+static DEFINE_PER_CPU(bool, thermal_throttle_active);
 
 static atomic_t therm_throt_en          = ATOMIC_INIT(0);
 
@@ -96,27 +97,33 @@ static int therm_throt_process(int curr)
 {
         unsigned int cpu = smp_processor_id();
         __u64 tmp_jiffs = get_jiffies_64();
+        bool was_throttled = __get_cpu_var(thermal_throttle_active);
+        bool is_throttled = __get_cpu_var(thermal_throttle_active) = curr;
 
-        if (curr)
+        if (is_throttled)
                 __get_cpu_var(thermal_throttle_count)++;
 
-        if (time_before64(tmp_jiffs, __get_cpu_var(next_check)))
+        if (!(was_throttled ^ is_throttled) &&
+            time_before64(tmp_jiffs, __get_cpu_var(next_check)))
                 return 0;
 
         __get_cpu_var(next_check) = tmp_jiffs + CHECK_INTERVAL;
 
         /* if we just entered the thermal event */
-        if (curr) {
+        if (is_throttled) {
                 printk(KERN_CRIT "CPU%d: Temperature above threshold, "
-                       "cpu clock throttled (total events = %lu)\n", cpu,
-                       __get_cpu_var(thermal_throttle_count));
+                       "cpu clock throttled (total events = %lu)\n",
+                       cpu, __get_cpu_var(thermal_throttle_count));
 
                 add_taint(TAINT_MACHINE_CHECK);
-        } else {
-                printk(KERN_CRIT "CPU%d: Temperature/speed normal\n", cpu);
+                return 1;
+        }
+        if (was_throttled) {
+                printk(KERN_INFO "CPU%d: Temperature/speed normal\n", cpu);
+                return 1;
         }
 
-        return 1;
+        return 0;
 }
 
 #ifdef CONFIG_SYSFS
diff --git a/arch/x86/kernel/cpu/perf_counter.c b/arch/x86/kernel/cpu/perf_counter.c
index a7aa8f900954..900332b800f8 100644
--- a/arch/x86/kernel/cpu/perf_counter.c
+++ b/arch/x86/kernel/cpu/perf_counter.c
@@ -55,6 +55,7 @@ struct x86_pmu {
         int             num_counters_fixed;
         int             counter_bits;
         u64             counter_mask;
+        int             apic;
         u64             max_period;
         u64             intel_ctrl;
 };
@@ -72,8 +73,8 @@ static const u64 p6_perfmon_event_map[] =
 {
   [PERF_COUNT_HW_CPU_CYCLES]            = 0x0079,
   [PERF_COUNT_HW_INSTRUCTIONS]          = 0x00c0,
-  [PERF_COUNT_HW_CACHE_REFERENCES]      = 0x0000,
-  [PERF_COUNT_HW_CACHE_MISSES]          = 0x0000,
+  [PERF_COUNT_HW_CACHE_REFERENCES]      = 0x0f2e,
+  [PERF_COUNT_HW_CACHE_MISSES]          = 0x012e,
   [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]   = 0x00c4,
   [PERF_COUNT_HW_BRANCH_MISSES]         = 0x00c5,
   [PERF_COUNT_HW_BUS_CYCLES]            = 0x0062,
@@ -613,6 +614,7 @@ static DEFINE_MUTEX(pmc_reserve_mutex);
 
 static bool reserve_pmc_hardware(void)
 {
+#ifdef CONFIG_X86_LOCAL_APIC
         int i;
 
         if (nmi_watchdog == NMI_LOCAL_APIC)
@@ -627,9 +629,11 @@ static bool reserve_pmc_hardware(void)
                 if (!reserve_evntsel_nmi(x86_pmu.eventsel + i))
                         goto eventsel_fail;
         }
+#endif
 
         return true;
 
+#ifdef CONFIG_X86_LOCAL_APIC
 eventsel_fail:
         for (i--; i >= 0; i--)
                 release_evntsel_nmi(x86_pmu.eventsel + i);
@@ -644,10 +648,12 @@ perfctr_fail:
                 enable_lapic_nmi_watchdog();
 
         return false;
+#endif
 }
 
 static void release_pmc_hardware(void)
 {
+#ifdef CONFIG_X86_LOCAL_APIC
         int i;
 
         for (i = 0; i < x86_pmu.num_counters; i++) {
@@ -657,6 +663,7 @@ static void release_pmc_hardware(void)
 
         if (nmi_watchdog == NMI_LOCAL_APIC)
                 enable_lapic_nmi_watchdog();
+#endif
 }
 
 static void hw_perf_counter_destroy(struct perf_counter *counter)
@@ -748,6 +755,15 @@ static int __hw_perf_counter_init(struct perf_counter *counter)
                 hwc->sample_period = x86_pmu.max_period;
                 hwc->last_period = hwc->sample_period;
                 atomic64_set(&hwc->period_left, hwc->sample_period);
+        } else {
+                /*
+                 * If we have a PMU initialized but no APIC
+                 * interrupts, we cannot sample hardware
+                 * counters (user-space has to fall back and
+                 * sample via a hrtimer based software counter):
+                 */
+                if (!x86_pmu.apic)
+                        return -EOPNOTSUPP;
         }
 
         counter->destroy = hw_perf_counter_destroy;
@@ -1449,18 +1465,22 @@ void smp_perf_pending_interrupt(struct pt_regs *regs)
 
 void set_perf_counter_pending(void)
 {
+#ifdef CONFIG_X86_LOCAL_APIC
         apic->send_IPI_self(LOCAL_PENDING_VECTOR);
+#endif
 }
 
 void perf_counters_lapic_init(void)
 {
-        if (!x86_pmu_initialized())
+#ifdef CONFIG_X86_LOCAL_APIC
+        if (!x86_pmu.apic || !x86_pmu_initialized())
                 return;
 
         /*
          * Always use NMI for PMU
          */
         apic_write(APIC_LVTPC, APIC_DM_NMI);
+#endif
 }
 
 static int __kprobes
@@ -1484,7 +1504,9 @@ perf_counter_nmi_handler(struct notifier_block *self,
 
         regs = args->regs;
 
+#ifdef CONFIG_X86_LOCAL_APIC
         apic_write(APIC_LVTPC, APIC_DM_NMI);
+#endif
         /*
          * Can't rely on the handled return value to say it was our NMI, two
          * counters could trigger 'simultaneously' raising two back-to-back NMIs.
@@ -1515,6 +1537,7 @@ static struct x86_pmu p6_pmu = {
         .event_map              = p6_pmu_event_map,
         .raw_event              = p6_pmu_raw_event,
         .max_events             = ARRAY_SIZE(p6_perfmon_event_map),
+        .apic                   = 1,
         .max_period             = (1ULL << 31) - 1,
         .version                = 0,
         .num_counters           = 2,
@@ -1541,6 +1564,7 @@ static struct x86_pmu intel_pmu = {
         .event_map              = intel_pmu_event_map,
         .raw_event              = intel_pmu_raw_event,
         .max_events             = ARRAY_SIZE(intel_perfmon_event_map),
+        .apic                   = 1,
         /*
          * Intel PMCs cannot be accessed sanely above 32 bit width,
          * so we install an artificial 1<<31 period regardless of
@@ -1564,6 +1588,7 @@ static struct x86_pmu amd_pmu = {
         .num_counters           = 4,
         .counter_bits           = 48,
         .counter_mask           = (1ULL << 48) - 1,
+        .apic                   = 1,
         /* use highest bit to detect overflow */
         .max_period             = (1ULL << 47) - 1,
 };
@@ -1589,13 +1614,14 @@ static int p6_pmu_init(void)
                 return -ENODEV;
         }
 
+        x86_pmu = p6_pmu;
+
         if (!cpu_has_apic) {
-                pr_info("no Local APIC, try rebooting with lapic");
-                return -ENODEV;
+                pr_info("no APIC, boot with the \"lapic\" boot parameter to force-enable it.\n");
+                pr_info("no hardware sampling interrupt available.\n");
+                x86_pmu.apic = 0;
         }
 
-        x86_pmu                         = p6_pmu;
-
         return 0;
 }
 
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 0d98a01cbdb2..cc827ac9e8d3 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -261,9 +261,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
  * which will be freed later
  */
 
-#ifndef CONFIG_HOTPLUG_CPU
-.section .init.text,"ax",@progbits
-#endif
+__CPUINIT
 
 #ifdef CONFIG_SMP
 ENTRY(startup_32_smp)
@@ -602,11 +600,7 @@ ignore_int:
 #endif
         iret
 
-#ifndef CONFIG_HOTPLUG_CPU
-        __CPUINITDATA
-#else
         __REFDATA
-#endif
 .align 4
 ENTRY(initial_code)
         .long i386_start_kernel
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 994dd6a4a2a0..071166a4ba83 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -519,16 +519,12 @@ static void c1e_idle(void)
                 if (!cpumask_test_cpu(cpu, c1e_mask)) {
                         cpumask_set_cpu(cpu, c1e_mask);
                         /*
-                         * Force broadcast so ACPI can not interfere. Needs
-                         * to run with interrupts enabled as it uses
-                         * smp_function_call.
+                         * Force broadcast so ACPI can not interfere.
                          */
-                        local_irq_enable();
                         clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_FORCE,
                                            &cpu);
                         printk(KERN_INFO "Switch to broadcast mode on CPU%d\n",
                                cpu);
-                        local_irq_disable();
                 }
                 clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu);
 
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 9eb897603705..a06e8d101844 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -418,20 +418,20 @@ static int __init set_pci_reboot(const struct dmi_system_id *d)
 }
 
 static struct dmi_system_id __initdata pci_reboot_dmi_table[] = {
-        {       /* Handle problems with rebooting on Apple MacBook5,2 */
+        {       /* Handle problems with rebooting on Apple MacBook5 */
                 .callback = set_pci_reboot,
-                .ident = "Apple MacBook",
+                .ident = "Apple MacBook5",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "MacBook5,2"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MacBook5"),
                 },
         },
-        {       /* Handle problems with rebooting on Apple MacBookPro5,1 */
+        {       /* Handle problems with rebooting on Apple MacBookPro5 */
                 .callback = set_pci_reboot,
-                .ident = "Apple MacBookPro5,1",
+                .ident = "Apple MacBookPro5",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5,1"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro5"),
                 },
         },
         { }
diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
index 29a3eef7cf4a..07d81916f212 100644
--- a/arch/x86/kernel/setup_percpu.c
+++ b/arch/x86/kernel/setup_percpu.c
@@ -165,7 +165,7 @@ static ssize_t __init setup_pcpu_lpage(size_t static_size, bool chosen)
 
         if (!chosen) {
                 size_t vm_size = VMALLOC_END - VMALLOC_START;
-                size_t tot_size = num_possible_cpus() * PMD_SIZE;
+                size_t tot_size = nr_cpu_ids * PMD_SIZE;
 
                 /* on non-NUMA, embedding is better */
                 if (!pcpu_need_numa())
@@ -199,7 +199,7 @@ static ssize_t __init setup_pcpu_lpage(size_t static_size, bool chosen)
         dyn_size = pcpul_size - static_size - PERCPU_FIRST_CHUNK_RESERVE;
 
         /* allocate pointer array and alloc large pages */
-        map_size = PFN_ALIGN(num_possible_cpus() * sizeof(pcpul_map[0]));
+        map_size = PFN_ALIGN(nr_cpu_ids * sizeof(pcpul_map[0]));
         pcpul_map = alloc_bootmem(map_size);
 
         for_each_possible_cpu(cpu) {
@@ -228,7 +228,7 @@ static ssize_t __init setup_pcpu_lpage(size_t static_size, bool chosen)
 
         /* allocate address and map */
         pcpul_vm.flags = VM_ALLOC;
-        pcpul_vm.size = num_possible_cpus() * PMD_SIZE;
+        pcpul_vm.size = nr_cpu_ids * PMD_SIZE;
         vm_area_register_early(&pcpul_vm, PMD_SIZE);
 
         for_each_possible_cpu(cpu) {
@@ -250,8 +250,8 @@ static ssize_t __init setup_pcpu_lpage(size_t static_size, bool chosen)
                                      PMD_SIZE, pcpul_vm.addr, NULL);
 
         /* sort pcpul_map array for pcpu_lpage_remapped() */
-        for (i = 0; i < num_possible_cpus() - 1; i++)
-                for (j = i + 1; j < num_possible_cpus(); j++)
+        for (i = 0; i < nr_cpu_ids - 1; i++)
+                for (j = i + 1; j < nr_cpu_ids; j++)
                         if (pcpul_map[i].ptr > pcpul_map[j].ptr) {
                                 struct pcpul_ent tmp = pcpul_map[i];
                                 pcpul_map[i] = pcpul_map[j];
@@ -288,7 +288,7 @@ void *pcpu_lpage_remapped(void *kaddr)
 {
         void *pmd_addr = (void *)((unsigned long)kaddr & PMD_MASK);
         unsigned long offset = (unsigned long)kaddr & ~PMD_MASK;
-        int left = 0, right = num_possible_cpus() - 1;
+        int left = 0, right = nr_cpu_ids - 1;
         int pos;
 
         /* pcpul in use at all? */
@@ -377,7 +377,7 @@ static ssize_t __init setup_pcpu_4k(size_t static_size)
         pcpu4k_nr_static_pages = PFN_UP(static_size);
 
         /* unaligned allocations can't be freed, round up to page size */
-        pages_size = PFN_ALIGN(pcpu4k_nr_static_pages * num_possible_cpus()
+        pages_size = PFN_ALIGN(pcpu4k_nr_static_pages * nr_cpu_ids
                                * sizeof(pcpu4k_pages[0]));
         pcpu4k_pages = alloc_bootmem(pages_size);
 
diff --git a/arch/x86/kernel/tlb_uv.c b/arch/x86/kernel/tlb_uv.c
index 8ccabb8a2f6a..77b9689f8edb 100644
--- a/arch/x86/kernel/tlb_uv.c
+++ b/arch/x86/kernel/tlb_uv.c
@@ -744,6 +744,7 @@ uv_activation_descriptor_init(int node, int pnode)
                  * note that base_dest_nodeid is actually a nasid.
                  */
                 ad2->header.base_dest_nodeid = uv_partition_base_pnode << 1;
+                ad2->header.dest_subnodeid = 0x10; /* the LB */
                 ad2->header.command = UV_NET_ENDPOINT_INTD;
                 ad2->header.int_both = 1;
                 /*
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 6e1a368d21d4..71f4368b357e 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -275,15 +275,20 @@ static unsigned long pit_calibrate_tsc(u32 latch, unsigned long ms, int loopmin)
  * use the TSC value at the transitions to calculate a pretty
  * good value for the TSC frequencty.
  */
+static inline int pit_verify_msb(unsigned char val)
+{
+        /* Ignore LSB */
+        inb(0x42);
+        return inb(0x42) == val;
+}
+
 static inline int pit_expect_msb(unsigned char val, u64 *tscp, unsigned long *deltap)
 {
         int count;
         u64 tsc = 0;
 
         for (count = 0; count < 50000; count++) {
-                /* Ignore LSB */
-                inb(0x42);
-                if (inb(0x42) != val)
+                if (!pit_verify_msb(val))
                         break;
                 tsc = get_cycles();
         }
@@ -336,8 +341,7 @@ static unsigned long quick_pit_calibrate(void)
          * to do that is to just read back the 16-bit counter
          * once from the PIT.
          */
-        inb(0x42);
-        inb(0x42);
+        pit_verify_msb(0);
 
         if (pit_expect_msb(0xff, &tsc, &d1)) {
                 for (i = 1; i <= MAX_QUICK_PIT_ITERATIONS; i++) {
@@ -348,8 +352,19 @@ static unsigned long quick_pit_calibrate(void)
                          * Iterate until the error is less than 500 ppm
                          */
                         delta -= tsc;
-                        if (d1+d2 < delta >> 11)
-                                goto success;
+                        if (d1+d2 >= delta >> 11)
+                                continue;
+
+                        /*
+                         * Check the PIT one more time to verify that
+                         * all TSC reads were stable wrt the PIT.
+                         *
+                         * This also guarantees serialization of the
+                         * last cycle read ('d2') in pit_expect_msb.
+                         */
+                        if (!pit_verify_msb(0xfe - i))
+                                break;
+                        goto success;
                 }
         }
         printk("Fast TSC calibration failed\n");
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 78d185d797de..9fc178255c04 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -46,11 +46,10 @@ PHDRS {
         data PT_LOAD FLAGS(7);          /* RWE */
 #ifdef CONFIG_X86_64
         user PT_LOAD FLAGS(7);          /* RWE */
-        data.init PT_LOAD FLAGS(7);     /* RWE */
 #ifdef CONFIG_SMP
         percpu PT_LOAD FLAGS(7);        /* RWE */
 #endif
-        data.init2 PT_LOAD FLAGS(7);    /* RWE */
+        init PT_LOAD FLAGS(7);          /* RWE */
 #endif
         note PT_NOTE FLAGS(0);          /* ___ */
 }
@@ -103,65 +102,43 @@ SECTIONS
                 __stop___ex_table = .;
         } :text = 0x9090
 
-        RODATA
+        RO_DATA(PAGE_SIZE)
 
         /* Data */
-        . = ALIGN(PAGE_SIZE);
         .data : AT(ADDR(.data) - LOAD_OFFSET) {
                 /* Start of data section */
                 _sdata = .;
-                DATA_DATA
-                CONSTRUCTORS
-        } :data
+
+                /* init_task */
+                INIT_TASK_DATA(THREAD_SIZE)
 
 #ifdef CONFIG_X86_32
-        /* 32 bit has nosave before _edata */
-        . = ALIGN(PAGE_SIZE);
-        .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
-                __nosave_begin = .;
-                *(.data.nosave)
-                . = ALIGN(PAGE_SIZE);
-                __nosave_end = .;
-        }
+                /* 32 bit has nosave before _edata */
+                NOSAVE_DATA
 #endif
 
-        . = ALIGN(PAGE_SIZE);
-        .data.page_aligned : AT(ADDR(.data.page_aligned) - LOAD_OFFSET) {
-                *(.data.page_aligned)
+                PAGE_ALIGNED_DATA(PAGE_SIZE)
                 *(.data.idt)
-        }
 
-#ifdef CONFIG_X86_32
-        . = ALIGN(32);
-#else
-        . = ALIGN(PAGE_SIZE);
-        . = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
-#endif
-        .data.cacheline_aligned :
-                AT(ADDR(.data.cacheline_aligned) - LOAD_OFFSET) {
-                *(.data.cacheline_aligned)
-        }
+                CACHELINE_ALIGNED_DATA(CONFIG_X86_L1_CACHE_BYTES)
 
-        /* rarely changed data like cpu maps */
-#ifdef CONFIG_X86_32
-        . = ALIGN(32);
-#else
-        . = ALIGN(CONFIG_X86_INTERNODE_CACHE_BYTES);
-#endif
-        .data.read_mostly : AT(ADDR(.data.read_mostly) - LOAD_OFFSET) {
-                *(.data.read_mostly)
+                DATA_DATA
+                CONSTRUCTORS
+
+                /* rarely changed data like cpu maps */
+                READ_MOSTLY_DATA(CONFIG_X86_INTERNODE_CACHE_BYTES)
 
                 /* End of data section */
                 _edata = .;
-        }
+        } :data
 
 #ifdef CONFIG_X86_64
 
 #define VSYSCALL_ADDR (-10*1024*1024)
-#define VSYSCALL_PHYS_ADDR ((LOADADDR(.data.read_mostly) + \
-                            SIZEOF(.data.read_mostly) + 4095) & ~(4095))
-#define VSYSCALL_VIRT_ADDR ((ADDR(.data.read_mostly) + \
-                            SIZEOF(.data.read_mostly) + 4095) & ~(4095))
+#define VSYSCALL_PHYS_ADDR ((LOADADDR(.data) + SIZEOF(.data) + \
+                            PAGE_SIZE - 1) & ~(PAGE_SIZE - 1))
+#define VSYSCALL_VIRT_ADDR ((ADDR(.data) + SIZEOF(.data) + \
+                            PAGE_SIZE - 1) & ~(PAGE_SIZE - 1))
 
 #define VLOAD_OFFSET (VSYSCALL_ADDR - VSYSCALL_PHYS_ADDR)
 #define VLOAD(x) (ADDR(x) - VLOAD_OFFSET)
@@ -227,35 +204,29 @@ SECTIONS
 
 #endif /* CONFIG_X86_64 */
 
-        /* init_task */
-        . = ALIGN(THREAD_SIZE);
-        .data.init_task : AT(ADDR(.data.init_task) - LOAD_OFFSET) {
-                *(.data.init_task)
+        /* Init code and data - will be freed after init */
+        . = ALIGN(PAGE_SIZE);
+        .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
+                __init_begin = .; /* paired with __init_end */
         }
-#ifdef CONFIG_X86_64
-         :data.init
-#endif
 
+#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
         /*
-         * smp_locks might be freed after init
-         * start/end must be page aligned
+         * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
+         * output PHDR, so the next output section - .init.text - should
+         * start another segment - init.
          */
-        . = ALIGN(PAGE_SIZE);
-        .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
-                __smp_locks = .;
-                *(.smp_locks)
-                __smp_locks_end = .;
-                . = ALIGN(PAGE_SIZE);
-        }
+        PERCPU_VADDR(0, :percpu)
+#endif
 
-        /* Init code and data - will be freed after init */
-        . = ALIGN(PAGE_SIZE);
         .init.text : AT(ADDR(.init.text) - LOAD_OFFSET) {
-                __init_begin = .; /* paired with __init_end */
                 _sinittext = .;
                 INIT_TEXT
                 _einittext = .;
         }
+#ifdef CONFIG_X86_64
+        :init
+#endif
 
         .init.data : AT(ADDR(.init.data) - LOAD_OFFSET) {
                 INIT_DATA
@@ -326,17 +297,7 @@ SECTIONS
         }
 #endif
 
-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
-        /*
-         * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
-         * output PHDR, so the next output section - __data_nosave - should
-         * start another section data.init2.  Also, pda should be at the head of
-         * percpu area.  Preallocate it and define the percpu offset symbol
-         * so that it can be accessed as a percpu variable.
-         */
-        . = ALIGN(PAGE_SIZE);
-        PERCPU_VADDR(0, :percpu)
-#else
+#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
         PERCPU(PAGE_SIZE)
 #endif
 
@@ -347,15 +308,22 @@ SECTIONS
                 __init_end = .;
         }
 
+        /*
+         * smp_locks might be freed after init
+         * start/end must be page aligned
+         */
+        . = ALIGN(PAGE_SIZE);
+        .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
+                __smp_locks = .;
+                *(.smp_locks)
+                __smp_locks_end = .;
+                . = ALIGN(PAGE_SIZE);
+        }
+
 #ifdef CONFIG_X86_64
         .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
-                . = ALIGN(PAGE_SIZE);
-                __nosave_begin = .;
-                *(.data.nosave)
-                . = ALIGN(PAGE_SIZE);
-                __nosave_end = .;
-        } :data.init2
-        /* use another section data.init2, see PERCPU_VADDR() above */
+                NOSAVE_DATA
+        }
 #endif
 
         /* BSS */
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 6176fe8f29e0..ea56b8cbb6a6 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -796,7 +796,7 @@ int __init reserve_bootmem_generic(unsigned long phys, unsigned long len,
                 return ret;
 
 #else
-        reserve_bootmem(phys, len, BOOTMEM_DEFAULT);
+        reserve_bootmem(phys, len, flags);
 #endif
 
         if (phys+len <= MAX_DMA_PFN*PAGE_SIZE) {
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index e6718bb28065..352aa9e927e2 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -623,7 +623,8 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
                 return ret;
 
         if (flags != want_flags) {
-                if (strict_prot || !is_new_memtype_allowed(want_flags, flags)) {
+                if (strict_prot ||
+                    !is_new_memtype_allowed(paddr, size, want_flags, flags)) {
                         free_memtype(paddr, paddr + size);
                         printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
                                 " for %Lx-%Lx, got %s\n",
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 821e97017e95..c814e144a3f0 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -183,18 +183,17 @@ static void flush_tlb_others_ipi(const struct cpumask *cpumask,
 
         f->flush_mm = mm;
         f->flush_va = va;
-        cpumask_andnot(to_cpumask(f->flush_cpumask),
-                       cpumask, cpumask_of(smp_processor_id()));
-
-        /*
-         * We have to send the IPI only to
-         * CPUs affected.
-         */
-        apic->send_IPI_mask(to_cpumask(f->flush_cpumask),
-                      INVALIDATE_TLB_VECTOR_START + sender);
+        if (cpumask_andnot(to_cpumask(f->flush_cpumask), cpumask, cpumask_of(smp_processor_id()))) {
+                /*
+                 * We have to send the IPI only to
+                 * CPUs affected.
+                 */
+                apic->send_IPI_mask(to_cpumask(f->flush_cpumask),
+                              INVALIDATE_TLB_VECTOR_START + sender);
 
-        while (!cpumask_empty(to_cpumask(f->flush_cpumask)))
-                cpu_relax();
+                while (!cpumask_empty(to_cpumask(f->flush_cpumask)))
+                        cpu_relax();
+        }
 
         f->flush_mm = NULL;
         f->flush_va = 0;
diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile
index 172438f86a02..7410640db173 100644
--- a/arch/x86/xen/Makefile
+++ b/arch/x86/xen/Makefile
@@ -5,6 +5,10 @@ CFLAGS_REMOVE_time.o = -pg
 CFLAGS_REMOVE_irq.o = -pg
 endif
 
+# Make sure early boot has no stackprotector
+nostackp := $(call cc-option, -fno-stack-protector)
+CFLAGS_enlighten.o              := $(nostackp)
+
 obj-y           := enlighten.o setup.o multicalls.o mmu.o irq.o \
                         time.o xen-asm.o xen-asm_$(BITS).o \
                         grant-table.o suspend.o
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 0a1700a2be9c..e90540a46a0b 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -974,10 +974,6 @@ asmlinkage void __init xen_start_kernel(void)
 
         xen_domain_type = XEN_PV_DOMAIN;
 
-        BUG_ON(memcmp(xen_start_info->magic, "xen-3", 5) != 0);
-
-        xen_setup_features();
-
         /* Install Xen paravirt ops */
         pv_info = xen_info;
         pv_init_ops = xen_init_ops;
@@ -986,8 +982,15 @@ asmlinkage void __init xen_start_kernel(void)
         pv_apic_ops = xen_apic_ops;
         pv_mmu_ops = xen_mmu_ops;
 
-        xen_init_irq_ops();
+#ifdef CONFIG_X86_64
+        /*
+         * Setup percpu state.  We only need to do this for 64-bit
+         * because 32-bit already has %fs set properly.
+         */
+        load_percpu_segment(0);
+#endif
 
+        xen_init_irq_ops();
         xen_init_cpuid_mask();
 
 #ifdef CONFIG_X86_LOCAL_APIC
@@ -997,6 +1000,8 @@ asmlinkage void __init xen_start_kernel(void)
         set_xen_basic_apic_ops();
 #endif
 
+        xen_setup_features();
+
         if (xen_feature(XENFEAT_mmu_pt_update_preserve_ad)) {
                 pv_mmu_ops.ptep_modify_prot_start = xen_ptep_modify_prot_start;
                 pv_mmu_ops.ptep_modify_prot_commit = xen_ptep_modify_prot_commit;
@@ -1004,13 +1009,6 @@ asmlinkage void __init xen_start_kernel(void)
 
         machine_ops = xen_machine_ops;
 
-#ifdef CONFIG_X86_64
-        /*
-         * Setup percpu state.  We only need to do this for 64-bit
-         * because 32-bit already has %fs set properly.
-         */
-        load_percpu_segment(0);
-#endif
         /*
          * The only reliable way to retain the initial address of the
          * percpu gdt_page is to remember it here, so we can go and
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 84e0f3c07442..2cc4b3033872 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -1151,6 +1151,9 @@ static int __init acpi_processor_init(void)
 {
         int result = 0;
 
+        if (acpi_disabled)
+                return 0;
+
         memset(&errata, 0, sizeof(errata));
 
 #ifdef CONFIG_SMP
@@ -1197,6 +1200,9 @@ out_proc:
 
 static void __exit acpi_processor_exit(void)
 {
+        if (acpi_disabled)
+                return;
+
         acpi_processor_ppc_exit();
 
         acpi_thermal_cpufreq_exit();
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 0efa59e7e3af..66393d5c4c7c 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -162,8 +162,9 @@ static void lapic_timer_check_state(int state, struct acpi_processor *pr,
                 pr->power.timer_broadcast_on_state = state;
 }
 
-static void lapic_timer_propagate_broadcast(struct acpi_processor *pr)
+static void lapic_timer_propagate_broadcast(void *arg)
 {
+        struct acpi_processor *pr = (struct acpi_processor *) arg;
         unsigned long reason;
 
         reason = pr->power.timer_broadcast_on_state < INT_MAX ?
@@ -635,7 +636,8 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
                 working++;
         }
 
-        lapic_timer_propagate_broadcast(pr);
+        smp_call_function_single(pr->id, lapic_timer_propagate_broadcast,
+                                 pr, 1);
 
         return (working);
 }
diff --git a/drivers/acpi/processor_thermal.c b/drivers/acpi/processor_thermal.c
index 39838c666032..31adda1099e0 100644
--- a/drivers/acpi/processor_thermal.c
+++ b/drivers/acpi/processor_thermal.c
@@ -66,7 +66,7 @@ static int acpi_processor_apply_limit(struct acpi_processor *pr)
                 if (pr->limit.thermal.tx > tx)
                         tx = pr->limit.thermal.tx;
 
-                result = acpi_processor_set_throttling(pr, tx);
+                result = acpi_processor_set_throttling(pr, tx, false);
                 if (result)
                         goto end;
         }
@@ -421,12 +421,12 @@ processor_set_cur_state(struct thermal_cooling_device *cdev,
 
         if (state <= max_pstate) {
                 if (pr->flags.throttling && pr->throttling.state)
-                        result = acpi_processor_set_throttling(pr, 0);
+                        result = acpi_processor_set_throttling(pr, 0, false);
                 cpufreq_set_cur_state(pr->id, state);
         } else {
                 cpufreq_set_cur_state(pr->id, max_pstate);
                 result = acpi_processor_set_throttling(pr,
-                                state - max_pstate);
+                                state - max_pstate, false);
         }
         return result;
 }
diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
index 227543789ba9..ae39797aab55 100644
--- a/drivers/acpi/processor_throttling.c
+++ b/drivers/acpi/processor_throttling.c
@@ -62,7 +62,8 @@ struct throttling_tstate {
 #define THROTTLING_POSTCHANGE      (2)
 
 static int acpi_processor_get_throttling(struct acpi_processor *pr);
-int acpi_processor_set_throttling(struct acpi_processor *pr, int state);
+int acpi_processor_set_throttling(struct acpi_processor *pr,
+                                                int state, bool force);
 
 static int acpi_processor_update_tsd_coord(void)
 {
@@ -361,7 +362,7 @@ int acpi_processor_tstate_has_changed(struct acpi_processor *pr)
                  */
                 target_state = throttling_limit;
         }
-        return acpi_processor_set_throttling(pr, target_state);
+        return acpi_processor_set_throttling(pr, target_state, false);
 }
 
 /*
@@ -839,10 +840,10 @@ static int acpi_processor_get_throttling_ptc(struct acpi_processor *pr)
         if (ret >= 0) {
                 state = acpi_get_throttling_state(pr, value);
                 if (state == -1) {
-                        ACPI_WARNING((AE_INFO,
-                                "Invalid throttling state, reset"));
+                        ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+                                "Invalid throttling state, reset\n"));
                         state = 0;
-                        ret = acpi_processor_set_throttling(pr, state);
+                        ret = acpi_processor_set_throttling(pr, state, true);
                         if (ret)
                                 return ret;
                 }
@@ -915,7 +916,7 @@ static int acpi_processor_get_fadt_info(struct acpi_processor *pr)
 }
 
 static int acpi_processor_set_throttling_fadt(struct acpi_processor *pr,
-                                              int state)
+                                              int state, bool force)
 {
         u32 value = 0;
         u32 duty_mask = 0;
@@ -930,7 +931,7 @@ static int acpi_processor_set_throttling_fadt(struct acpi_processor *pr,
         if (!pr->flags.throttling)
                 return -ENODEV;
 
-        if (state == pr->throttling.state)
+        if (!force && (state == pr->throttling.state))
                 return 0;
 
         if (state < pr->throttling_platform_limit)
@@ -988,7 +989,7 @@ static int acpi_processor_set_throttling_fadt(struct acpi_processor *pr,
 }
 
 static int acpi_processor_set_throttling_ptc(struct acpi_processor *pr,
-                                             int state)
+                                             int state, bool force)
 {
         int ret;
         acpi_integer value;
@@ -1002,7 +1003,7 @@ static int acpi_processor_set_throttling_ptc(struct acpi_processor *pr,
         if (!pr->flags.throttling)
                 return -ENODEV;
 
-        if (state == pr->throttling.state)
+        if (!force && (state == pr->throttling.state))
                 return 0;
 
         if (state < pr->throttling_platform_limit)
@@ -1018,7 +1019,8 @@ static int acpi_processor_set_throttling_ptc(struct acpi_processor *pr,
         return 0;
 }
 
-int acpi_processor_set_throttling(struct acpi_processor *pr, int state)
+int acpi_processor_set_throttling(struct acpi_processor *pr,
+                                                int state, bool force)
 {
         cpumask_var_t saved_mask;
         int ret = 0;
@@ -1070,7 +1072,7 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, int state)
                 /* FIXME: use work_on_cpu() */
                 set_cpus_allowed_ptr(current, cpumask_of(pr->id));
                 ret = p_throttling->acpi_processor_set_throttling(pr,
-                                                t_state.target_state);
+                                                t_state.target_state, force);
         } else {
                 /*
                  * When the T-state coordination is SW_ALL or HW_ALL,
@@ -1103,7 +1105,7 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, int state)
                         set_cpus_allowed_ptr(current, cpumask_of(i));
                         ret = match_pr->throttling.
                                 acpi_processor_set_throttling(
-                                match_pr, t_state.target_state);
+                                match_pr, t_state.target_state, force);
                 }
         }
         /*
@@ -1201,7 +1203,7 @@ int acpi_processor_get_throttling_info(struct acpi_processor *pr)
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                   "Disabling throttling (was T%d)\n",
                                   pr->throttling.state));
-                result = acpi_processor_set_throttling(pr, 0);
+                result = acpi_processor_set_throttling(pr, 0, false);
                 if (result)
                         goto end;
         }
@@ -1307,7 +1309,7 @@ static ssize_t acpi_processor_write_throttling(struct file *file,
         if (strcmp(tmpbuf, charp) != 0)
                 return -EINVAL;
 
-        result = acpi_processor_set_throttling(pr, state_val);
+        result = acpi_processor_set_throttling(pr, state_val, false);
         if (result)
                 return result;
 
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 958c1fa41900..fe3eba5d6b3e 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -219,6 +219,8 @@ enum {
         AHCI_HFLAG_SECT255              = (1 << 8), /* max 255 sectors */
         AHCI_HFLAG_YES_NCQ              = (1 << 9), /* force NCQ cap on */
         AHCI_HFLAG_NO_SUSPEND           = (1 << 10), /* don't suspend */
+        AHCI_HFLAG_SRST_TOUT_IS_OFFLINE = (1 << 11), /* treat SRST timeout as
+                                                        link offline */
 
         /* ap->flags bits */
 
@@ -1663,6 +1665,7 @@ static int ahci_do_softreset(struct ata_link *link, unsigned int *class,
                              int (*check_ready)(struct ata_link *link))
 {
         struct ata_port *ap = link->ap;
+        struct ahci_host_priv *hpriv = ap->host->private_data;
         const char *reason = NULL;
         unsigned long now, msecs;
         struct ata_taskfile tf;
@@ -1701,12 +1704,21 @@ static int ahci_do_softreset(struct ata_link *link, unsigned int *class,
 
         /* wait for link to become ready */
         rc = ata_wait_after_reset(link, deadline, check_ready);
-        /* link occupied, -ENODEV too is an error */
-        if (rc) {
+        if (rc == -EBUSY && hpriv->flags & AHCI_HFLAG_SRST_TOUT_IS_OFFLINE) {
+                /*
+                 * Workaround for cases where link online status can't
+                 * be trusted.  Treat device readiness timeout as link
+                 * offline.
+                 */
+                ata_link_printk(link, KERN_INFO,
+                                "device not ready, treating as offline\n");
+                *class = ATA_DEV_NONE;
+        } else if (rc) {
+                /* link occupied, -ENODEV too is an error */
                 reason = "device not ready";
                 goto fail;
-        }
-        *class = ahci_dev_classify(ap);
+        } else
+                *class = ahci_dev_classify(ap);
 
         DPRINTK("EXIT, class=%u\n", *class);
         return 0;
@@ -1773,7 +1785,8 @@ static int ahci_sb600_softreset(struct ata_link *link, unsigned int *class,
                 irq_sts = readl(port_mmio + PORT_IRQ_STAT);
                 if (irq_sts & PORT_IRQ_BAD_PMP) {
                         ata_link_printk(link, KERN_WARNING,
-                                        "failed due to HW bug, retry pmp=0\n");
+                                        "applying SB600 PMP SRST workaround "
+                                        "and retrying\n");
                         rc = ahci_do_softreset(link, class, 0, deadline,
                                                ahci_check_ready);
                 }
@@ -2726,6 +2739,56 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
         return !ver || strcmp(ver, dmi->driver_data) < 0;
 }
 
+static bool ahci_broken_online(struct pci_dev *pdev)
+{
+#define ENCODE_BUSDEVFN(bus, slot, func)                        \
+        (void *)(unsigned long)(((bus) << 8) | PCI_DEVFN((slot), (func)))
+        static const struct dmi_system_id sysids[] = {
+                /*
+                 * There are several gigabyte boards which use
+                 * SIMG5723s configured as hardware RAID.  Certain
+                 * 5723 firmware revisions shipped there keep the link
+                 * online but fail to answer properly to SRST or
+                 * IDENTIFY when no device is attached downstream
+                 * causing libata to retry quite a few times leading
+                 * to excessive detection delay.
+                 *
+                 * As these firmwares respond to the second reset try
+                 * with invalid device signature, considering unknown
+                 * sig as offline works around the problem acceptably.
+                 */
+                {
+                        .ident = "EP45-DQ6",
+                        .matches = {
+                                DMI_MATCH(DMI_BOARD_VENDOR,
+                                          "Gigabyte Technology Co., Ltd."),
+                                DMI_MATCH(DMI_BOARD_NAME, "EP45-DQ6"),
+                        },
+                        .driver_data = ENCODE_BUSDEVFN(0x0a, 0x00, 0),
+                },
+                {
+                        .ident = "EP45-DS5",
+                        .matches = {
+                                DMI_MATCH(DMI_BOARD_VENDOR,
+                                          "Gigabyte Technology Co., Ltd."),
+                                DMI_MATCH(DMI_BOARD_NAME, "EP45-DS5"),
+                        },
+                        .driver_data = ENCODE_BUSDEVFN(0x03, 0x00, 0),
+                },
+                { }     /* terminate list */
+        };
+#undef ENCODE_BUSDEVFN
+        const struct dmi_system_id *dmi = dmi_first_match(sysids);
+        unsigned int val;
+
+        if (!dmi)
+                return false;
+
+        val = (unsigned long)dmi->driver_data;
+
+        return pdev->bus->number == (val >> 8) && pdev->devfn == (val & 0xff);
+}
+
 static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         static int printed_version;
@@ -2841,6 +2904,12 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                            "BIOS update required for suspend/resume\n");
         }
 
+        if (ahci_broken_online(pdev)) {
+                hpriv->flags |= AHCI_HFLAG_SRST_TOUT_IS_OFFLINE;
+                dev_info(&pdev->dev,
+                         "online status unreliable, applying workaround\n");
+        }
+
         /* CAP.NP sometimes indicate the index of the last enabled
          * port, at other times, that of the last possible port, so
          * determining the maximum port number requires looking at
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 8ac98ff16d7d..072ba5ea138f 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4302,6 +4302,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "WDC WD2500JD-00HBB0", "WD-WMAL71490727", ATA_HORKAGE_BROKEN_HPA },
         { "MAXTOR 6L080L4",     "A93.0500",     ATA_HORKAGE_BROKEN_HPA },
 
+        /* this one allows HPA unlocking but fails IOs on the area */
+        { "OCZ-VERTEX",             "1.30",     ATA_HORKAGE_BROKEN_HPA },
+
         /* Devices which report 1 sector over size HPA */
         { "ST340823A",          NULL,           ATA_HORKAGE_HPA_SIZE, },
         { "ST320413A",          NULL,           ATA_HORKAGE_HPA_SIZE, },
diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
index 5702affcb325..41c94b1ae493 100644
--- a/drivers/ata/pata_at91.c
+++ b/drivers/ata/pata_at91.c
@@ -250,7 +250,7 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
                 ata_port_desc(ap, "no IRQ, using PIO polling");
         }
 
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = devm_kzalloc(dev, sizeof(*info), GFP_KERNEL);
 
         if (!info) {
                 dev_err(dev, "failed to allocate memory for private data\n");
@@ -275,7 +275,7 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
         if (!info->ide_addr) {
                 dev_err(dev, "failed to map IO base\n");
                 ret = -ENOMEM;
-                goto err_ide_ioremap;
+                goto err_put;
         }
 
         info->alt_addr = devm_ioremap(dev,
@@ -284,7 +284,7 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
         if (!info->alt_addr) {
                 dev_err(dev, "failed to map CTL base\n");
                 ret = -ENOMEM;
-                goto err_alt_ioremap;
+                goto err_put;
         }
 
         ap->ioaddr.cmd_addr = info->ide_addr;
@@ -303,13 +303,8 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
                         irq ? ata_sff_interrupt : NULL,
                         irq_flags, &pata_at91_sht);
 
-err_alt_ioremap:
-        devm_iounmap(dev, info->ide_addr);
-
-err_ide_ioremap:
+err_put:
         clk_put(info->mck);
-        kfree(info);
-
         return ret;
 }
 
@@ -317,7 +312,6 @@ static int __devexit pata_at91_remove(struct platform_device *pdev)
 {
         struct ata_host *host = dev_get_drvdata(&pdev->dev);
         struct at91_ide_info *info;
-        struct device *dev = &pdev->dev;
 
         if (!host)
                 return 0;
@@ -328,11 +322,8 @@ static int __devexit pata_at91_remove(struct platform_device *pdev)
         if (!info)
                 return 0;
 
-        devm_iounmap(dev, info->ide_addr);
-        devm_iounmap(dev, info->alt_addr);
         clk_put(info->mck);
 
-        kfree(info);
         return 0;
 }
 
diff --git a/drivers/ata/pata_atiixp.c b/drivers/ata/pata_atiixp.c
index bec0b8ade66d..45915566e4e9 100644
--- a/drivers/ata/pata_atiixp.c
+++ b/drivers/ata/pata_atiixp.c
@@ -1,6 +1,7 @@
 /*
  * pata_atiixp.c        - ATI PATA for new ATA layer
  *                        (C) 2005 Red Hat Inc
+ *                        (C) 2009 Bartlomiej Zolnierkiewicz
  *
  * Based on
  *
@@ -61,20 +62,19 @@ static void atiixp_set_pio_timing(struct ata_port *ap, struct ata_device *adev,
 
         struct pci_dev *pdev = to_pci_dev(ap->host->dev);
         int dn = 2 * ap->port_no + adev->devno;
-
-        /* Check this is correct - the order is odd in both drivers */
         int timing_shift = (16 * ap->port_no) + 8 * (adev->devno ^ 1);
-        u16 pio_mode_data, pio_timing_data;
+        u32 pio_timing_data;
+        u16 pio_mode_data;
 
         pci_read_config_word(pdev, ATIIXP_IDE_PIO_MODE, &pio_mode_data);
         pio_mode_data &= ~(0x7 << (4 * dn));
         pio_mode_data |= pio << (4 * dn);
         pci_write_config_word(pdev, ATIIXP_IDE_PIO_MODE, pio_mode_data);
 
-        pci_read_config_word(pdev, ATIIXP_IDE_PIO_TIMING, &pio_timing_data);
+        pci_read_config_dword(pdev, ATIIXP_IDE_PIO_TIMING, &pio_timing_data);
         pio_timing_data &= ~(0xFF << timing_shift);
         pio_timing_data |= (pio_timings[pio] << timing_shift);
-        pci_write_config_word(pdev, ATIIXP_IDE_PIO_TIMING, pio_timing_data);
+        pci_write_config_dword(pdev, ATIIXP_IDE_PIO_TIMING, pio_timing_data);
 }
 
 /**
@@ -119,16 +119,17 @@ static void atiixp_set_dmamode(struct ata_port *ap, struct ata_device *adev)
                 udma_mode_data |= dma << (4 * dn);
                 pci_write_config_word(pdev, ATIIXP_IDE_UDMA_MODE, udma_mode_data);
         } else {
-                u16 mwdma_timing_data;
-                /* Check this is correct - the order is odd in both drivers */
                 int timing_shift = (16 * ap->port_no) + 8 * (adev->devno ^ 1);
+                u32 mwdma_timing_data;
 
                 dma -= XFER_MW_DMA_0;
 
-                pci_read_config_word(pdev, ATIIXP_IDE_MWDMA_TIMING, &mwdma_timing_data);
+                pci_read_config_dword(pdev, ATIIXP_IDE_MWDMA_TIMING,
+                                      &mwdma_timing_data);
                 mwdma_timing_data &= ~(0xFF << timing_shift);
                 mwdma_timing_data |= (mwdma_timings[dma] << timing_shift);
-                pci_write_config_word(pdev, ATIIXP_IDE_MWDMA_TIMING, mwdma_timing_data);
+                pci_write_config_dword(pdev, ATIIXP_IDE_MWDMA_TIMING,
+                                       mwdma_timing_data);
         }
         /*
          *      We must now look at the PIO mode situation. We may need to
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index b2d11f300c39..86a40582999c 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -602,6 +602,7 @@ MODULE_VERSION(DRV_VERSION);
 
 static int adma_enabled;
 static int swncq_enabled = 1;
+static int msi_enabled;
 
 static void nv_adma_register_mode(struct ata_port *ap)
 {
@@ -2459,6 +2460,11 @@ static int nv_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         } else if (type == SWNCQ)
                 nv_swncq_host_init(host);
 
+        if (msi_enabled) {
+                dev_printk(KERN_NOTICE, &pdev->dev, "Using MSI\n");
+                pci_enable_msi(pdev);
+        }
+
         pci_set_master(pdev);
         return ata_host_activate(host, pdev->irq, ipriv->irq_handler,
                                  IRQF_SHARED, ipriv->sht);
@@ -2558,4 +2564,6 @@ module_param_named(adma, adma_enabled, bool, 0444);
 MODULE_PARM_DESC(adma, "Enable use of ADMA (Default: false)");
 module_param_named(swncq, swncq_enabled, bool, 0444);
 MODULE_PARM_DESC(swncq, "Enable use of SWNCQ (Default: true)");
+module_param_named(msi, msi_enabled, bool, 0444);
+MODULE_PARM_DESC(msi, "Enable use of MSI (Default: false)");
 
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 81cb01bfc356..456594bd97bc 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -483,9 +483,6 @@ int platform_driver_register(struct platform_driver *drv)
                 drv->driver.remove = platform_drv_remove;
         if (drv->shutdown)
                 drv->driver.shutdown = platform_drv_shutdown;
-        if (drv->suspend || drv->resume)
-                pr_warning("Platform driver '%s' needs updating - please use "
-                        "dev_pm_ops\n", drv->driver.name);
 
         return driver_register(&drv->driver);
 }
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 6e6942c45f5b..d083c73d784a 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -144,6 +144,8 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf,
 
 static int pty_write_room(struct tty_struct *tty)
 {
+        if (tty->stopped)
+                return 0;
         return pty_space(tty->link);
 }
 
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index 1733d3439ad2..e48af9f79219 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -508,8 +508,9 @@ static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
  *      be obtained while the delayed work queue halt ensures that no more
  *      data is fed to the ldisc.
  *
- *      In order to wait for any existing references to complete see
- *      tty_ldisc_wait_idle.
+ *      You need to do a 'flush_scheduled_work()' (outside the ldisc_mutex)
+ *      in order to make sure any currently executing ldisc work is also
+ *      flushed.
  */
 
 static int tty_ldisc_halt(struct tty_struct *tty)
@@ -753,11 +754,14 @@ void tty_ldisc_hangup(struct tty_struct *tty)
          * N_TTY.
          */
         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
+                /* Make sure the old ldisc is quiescent */
+                tty_ldisc_halt(tty);
+                flush_scheduled_work();
+
                 /* Avoid racing set_ldisc or tty_ldisc_release */
                 mutex_lock(&tty->ldisc_mutex);
                 if (tty->ldisc) {       /* Not yet closed */
                         /* Switch back to N_TTY */
-                        tty_ldisc_halt(tty);
                         tty_ldisc_reinit(tty);
                         /* At this point we have a closed ldisc and we want to
                            reopen it. We could defer this to the next open but
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index 2964f5f4a7ef..6b3e0c2f33e2 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -40,6 +40,7 @@ struct sh_cmt_priv {
         struct platform_device *pdev;
 
         unsigned long flags;
+        unsigned long flags_suspend;
         unsigned long match_value;
         unsigned long next_match_value;
         unsigned long max_match_value;
@@ -667,11 +668,38 @@ static int __devexit sh_cmt_remove(struct platform_device *pdev)
         return -EBUSY; /* cannot unregister clockevent and clocksource */
 }
 
+static int sh_cmt_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct sh_cmt_priv *p = platform_get_drvdata(pdev);
+
+        /* save flag state and stop CMT channel */
+        p->flags_suspend = p->flags;
+        sh_cmt_stop(p, p->flags);
+        return 0;
+}
+
+static int sh_cmt_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct sh_cmt_priv *p = platform_get_drvdata(pdev);
+
+        /* start CMT channel from saved state */
+        sh_cmt_start(p, p->flags_suspend);
+        return 0;
+}
+
+static struct dev_pm_ops sh_cmt_dev_pm_ops = {
+        .suspend = sh_cmt_suspend,
+        .resume = sh_cmt_resume,
+};
+
 static struct platform_driver sh_cmt_device_driver = {
         .probe          = sh_cmt_probe,
         .remove         = __devexit_p(sh_cmt_remove),
         .driver         = {
                 .name   = "sh_cmt",
+                .pm     = &sh_cmt_dev_pm_ops,
         }
 };
 
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 33be210d6723..2f631c75f704 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -258,31 +258,6 @@ void *drm_mode_object_find(struct drm_device *dev, uint32_t id, uint32_t type)
 EXPORT_SYMBOL(drm_mode_object_find);
 
 /**
- * drm_crtc_from_fb - find the CRTC structure associated with an fb
- * @dev: DRM device
- * @fb: framebuffer in question
- *
- * LOCKING:
- * Caller must hold mode_config lock.
- *
- * Find CRTC in the mode_config structure that matches @fb.
- *
- * RETURNS:
- * Pointer to the CRTC or NULL if it wasn't found.
- */
-struct drm_crtc *drm_crtc_from_fb(struct drm_device *dev,
-                                  struct drm_framebuffer *fb)
-{
-        struct drm_crtc *crtc;
-
-        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc->fb == fb)
-                        return crtc;
-        }
-        return NULL;
-}
-
-/**
  * drm_framebuffer_init - initialize a framebuffer
  * @dev: DRM device
  *
@@ -328,11 +303,20 @@ void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
 {
         struct drm_device *dev = fb->dev;
         struct drm_crtc *crtc;
+        struct drm_mode_set set;
+        int ret;
 
         /* remove from any CRTC */
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc->fb == fb)
-                        crtc->fb = NULL;
+                if (crtc->fb == fb) {
+                        /* should turn off the crtc */
+                        memset(&set, 0, sizeof(struct drm_mode_set));
+                        set.crtc = crtc;
+                        set.fb = NULL;
+                        ret = crtc->funcs->set_config(&set);
+                        if (ret)
+                                DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
+                }
         }
 
         drm_mode_object_put(dev, &fb->base);
@@ -1511,7 +1495,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
         set.mode = mode;
         set.connectors = connector_set;
         set.num_connectors = crtc_req->count_connectors;
-        set.fb =fb;
+        set.fb = fb;
         ret = crtc->funcs->set_config(&set);
 
 out:
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 80cc6d06d61b..7f2728bbc16c 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -502,12 +502,40 @@ static int add_detailed_info(struct drm_connector *connector,
                 struct detailed_non_pixel *data = &timing->data.other_data;
                 struct drm_display_mode *newmode;
 
-                /* EDID up to and including 1.2 may put monitor info here */
-                if (edid->version == 1 && edid->revision < 3)
-                        continue;
-
-                /* Detailed mode timing */
-                if (timing->pixel_clock) {
+                /* X server check is version 1.1 or higher */
+                if (edid->version == 1 && edid->revision >= 1 &&
+                    !timing->pixel_clock) {
+                        /* Other timing or info */
+                        switch (data->type) {
+                        case EDID_DETAIL_MONITOR_SERIAL:
+                                break;
+                        case EDID_DETAIL_MONITOR_STRING:
+                                break;
+                        case EDID_DETAIL_MONITOR_RANGE:
+                                /* Get monitor range data */
+                                break;
+                        case EDID_DETAIL_MONITOR_NAME:
+                                break;
+                        case EDID_DETAIL_MONITOR_CPDATA:
+                                break;
+                        case EDID_DETAIL_STD_MODES:
+                                /* Five modes per detailed section */
+                                for (j = 0; j < 5; i++) {
+                                        struct std_timing *std;
+                                        struct drm_display_mode *newmode;
+
+                                        std = &data->data.timings[j];
+                                        newmode = drm_mode_std(dev, std);
+                                        if (newmode) {
+                                                drm_mode_probed_add(connector, newmode);
+                                                modes++;
+                                        }
+                                }
+                                break;
+                        default:
+                                break;
+                        }
+                } else {
                         newmode = drm_mode_detailed(dev, edid, timing, quirks);
                         if (!newmode)
                                 continue;
@@ -518,38 +546,6 @@ static int add_detailed_info(struct drm_connector *connector,
                         drm_mode_probed_add(connector, newmode);
 
                         modes++;
-                        continue;
-                }
-
-                /* Other timing or info */
-                switch (data->type) {
-                case EDID_DETAIL_MONITOR_SERIAL:
-                        break;
-                case EDID_DETAIL_MONITOR_STRING:
-                        break;
-                case EDID_DETAIL_MONITOR_RANGE:
-                        /* Get monitor range data */
-                        break;
-                case EDID_DETAIL_MONITOR_NAME:
-                        break;
-                case EDID_DETAIL_MONITOR_CPDATA:
-                        break;
-                case EDID_DETAIL_STD_MODES:
-                        /* Five modes per detailed section */
-                        for (j = 0; j < 5; i++) {
-                                struct std_timing *std;
-                                struct drm_display_mode *newmode;
-
-                                std = &data->data.timings[j];
-                                newmode = drm_mode_std(dev, std);
-                                if (newmode) {
-                                        drm_mode_probed_add(connector, newmode);
-                                        modes++;
-                                }
-                        }
-                        break;
-                default:
-                        break;
                 }
         }
 
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 85ec31b3ff00..f7a615b80c70 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -22,44 +22,50 @@
 #define to_drm_minor(d) container_of(d, struct drm_minor, kdev)
 #define to_drm_connector(d) container_of(d, struct drm_connector, kdev)
 
+static struct device_type drm_sysfs_device_minor = {
+        .name = "drm_minor"
+};
+
 /**
- * drm_sysfs_suspend - DRM class suspend hook
+ * drm_class_suspend - DRM class suspend hook
  * @dev: Linux device to suspend
  * @state: power state to enter
  *
  * Just figures out what the actual struct drm_device associated with
  * @dev is and calls its suspend hook, if present.
  */
-static int drm_sysfs_suspend(struct device *dev, pm_message_t state)
+static int drm_class_suspend(struct device *dev, pm_message_t state)
 {
-        struct drm_minor *drm_minor = to_drm_minor(dev);
-        struct drm_device *drm_dev = drm_minor->dev;
-
-        if (drm_minor->type == DRM_MINOR_LEGACY &&
-            !drm_core_check_feature(drm_dev, DRIVER_MODESET) &&
-            drm_dev->driver->suspend)
-                return drm_dev->driver->suspend(drm_dev, state);
-
+        if (dev->type == &drm_sysfs_device_minor) {
+                struct drm_minor *drm_minor = to_drm_minor(dev);
+                struct drm_device *drm_dev = drm_minor->dev;
+
+                if (drm_minor->type == DRM_MINOR_LEGACY &&
+                    !drm_core_check_feature(drm_dev, DRIVER_MODESET) &&
+                    drm_dev->driver->suspend)
+                        return drm_dev->driver->suspend(drm_dev, state);
+        }
         return 0;
 }
 
 /**
- * drm_sysfs_resume - DRM class resume hook
+ * drm_class_resume - DRM class resume hook
  * @dev: Linux device to resume
  *
  * Just figures out what the actual struct drm_device associated with
  * @dev is and calls its resume hook, if present.
  */
-static int drm_sysfs_resume(struct device *dev)
+static int drm_class_resume(struct device *dev)
 {
-        struct drm_minor *drm_minor = to_drm_minor(dev);
-        struct drm_device *drm_dev = drm_minor->dev;
-
-        if (drm_minor->type == DRM_MINOR_LEGACY &&
-            !drm_core_check_feature(drm_dev, DRIVER_MODESET) &&
-            drm_dev->driver->resume)
-                return drm_dev->driver->resume(drm_dev);
-
+        if (dev->type == &drm_sysfs_device_minor) {
+                struct drm_minor *drm_minor = to_drm_minor(dev);
+                struct drm_device *drm_dev = drm_minor->dev;
+
+                if (drm_minor->type == DRM_MINOR_LEGACY &&
+                    !drm_core_check_feature(drm_dev, DRIVER_MODESET) &&
+                    drm_dev->driver->resume)
+                        return drm_dev->driver->resume(drm_dev);
+        }
         return 0;
 }
 
@@ -99,8 +105,8 @@ struct class *drm_sysfs_create(struct module *owner, char *name)
                 goto err_out;
         }
 
-        class->suspend = drm_sysfs_suspend;
-        class->resume = drm_sysfs_resume;
+        class->suspend = drm_class_suspend;
+        class->resume = drm_class_resume;
 
         err = class_create_file(class, &class_attr_version);
         if (err)
@@ -480,6 +486,7 @@ int drm_sysfs_device_add(struct drm_minor *minor)
         minor->kdev.class = drm_class;
         minor->kdev.release = drm_sysfs_device_release;
         minor->kdev.devt = minor->device;
+        minor->kdev.type = &drm_sysfs_device_minor;
         if (minor->type == DRM_MINOR_CONTROL)
                 minor_str = "controlD%d";
         else if (minor->type == DRM_MINOR_RENDER)
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index f1ba8ff41130..68e728e8be4d 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -254,6 +254,72 @@ void r100_mc_fini(struct radeon_device *rdev)
 
 
 /*
+ * Interrupts
+ */
+int r100_irq_set(struct radeon_device *rdev)
+{
+        uint32_t tmp = 0;
+
+        if (rdev->irq.sw_int) {
+                tmp |= RADEON_SW_INT_ENABLE;
+        }
+        if (rdev->irq.crtc_vblank_int[0]) {
+                tmp |= RADEON_CRTC_VBLANK_MASK;
+        }
+        if (rdev->irq.crtc_vblank_int[1]) {
+                tmp |= RADEON_CRTC2_VBLANK_MASK;
+        }
+        WREG32(RADEON_GEN_INT_CNTL, tmp);
+        return 0;
+}
+
+static inline uint32_t r100_irq_ack(struct radeon_device *rdev)
+{
+        uint32_t irqs = RREG32(RADEON_GEN_INT_STATUS);
+        uint32_t irq_mask = RADEON_SW_INT_TEST | RADEON_CRTC_VBLANK_STAT |
+                RADEON_CRTC2_VBLANK_STAT;
+
+        if (irqs) {
+                WREG32(RADEON_GEN_INT_STATUS, irqs);
+        }
+        return irqs & irq_mask;
+}
+
+int r100_irq_process(struct radeon_device *rdev)
+{
+        uint32_t status;
+
+        status = r100_irq_ack(rdev);
+        if (!status) {
+                return IRQ_NONE;
+        }
+        while (status) {
+                /* SW interrupt */
+                if (status & RADEON_SW_INT_TEST) {
+                        radeon_fence_process(rdev);
+                }
+                /* Vertical blank interrupts */
+                if (status & RADEON_CRTC_VBLANK_STAT) {
+                        drm_handle_vblank(rdev->ddev, 0);
+                }
+                if (status & RADEON_CRTC2_VBLANK_STAT) {
+                        drm_handle_vblank(rdev->ddev, 1);
+                }
+                status = r100_irq_ack(rdev);
+        }
+        return IRQ_HANDLED;
+}
+
+u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc)
+{
+        if (crtc == 0)
+                return RREG32(RADEON_CRTC_CRNT_FRAME);
+        else
+                return RREG32(RADEON_CRTC2_CRNT_FRAME);
+}
+
+
+/*
  * Fence emission
  */
 void r100_fence_ring_emit(struct radeon_device *rdev,
@@ -1025,6 +1091,16 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                         tmp |= tile_flags;
                         ib[idx] = tmp;
                         break;
+                case RADEON_RB3D_ZPASS_ADDR:
+                        r = r100_cs_packet_next_reloc(p, &reloc);
+                        if (r) {
+                                DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
+                                          idx, reg);
+                                r100_cs_dump_packet(p, pkt);
+                                return r;
+                        }
+                        ib[idx] = ib_chunk->kdata[idx] + ((u32)reloc->lobj.gpu_offset);
+                        break;
                 default:
                         /* FIXME: we don't want to allow anyothers packet */
                         break;
@@ -1556,26 +1632,6 @@ void r100_pll_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
         r100_pll_errata_after_data(rdev);
 }
 
-uint32_t r100_mm_rreg(struct radeon_device *rdev, uint32_t reg)
-{
-        if (reg < 0x10000)
-                return readl(((void __iomem *)rdev->rmmio) + reg);
-        else {
-                writel(reg, ((void __iomem *)rdev->rmmio) + RADEON_MM_INDEX);
-                return readl(((void __iomem *)rdev->rmmio) + RADEON_MM_DATA);
-        }
-}
-
-void r100_mm_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
-{
-        if (reg < 0x10000)
-                writel(v, ((void __iomem *)rdev->rmmio) + reg);
-        else {
-                writel(reg, ((void __iomem *)rdev->rmmio) + RADEON_MM_INDEX);
-                writel(v, ((void __iomem *)rdev->rmmio) + RADEON_MM_DATA);
-        }
-}
-
 int r100_init(struct radeon_device *rdev)
 {
         return 0;
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 9c8d41534a5d..053f4ec397f7 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -83,8 +83,8 @@ void rv370_pcie_gart_tlb_flush(struct radeon_device *rdev)
                 WREG32_PCIE(RADEON_PCIE_TX_GART_CNTL, tmp | RADEON_PCIE_TX_GART_INVALIDATE_TLB);
                 (void)RREG32_PCIE(RADEON_PCIE_TX_GART_CNTL);
                 WREG32_PCIE(RADEON_PCIE_TX_GART_CNTL, tmp);
-                mb();
         }
+        mb();
 }
 
 int rv370_pcie_gart_enable(struct radeon_device *rdev)
@@ -448,6 +448,7 @@ void r300_gpu_init(struct radeon_device *rdev)
                 /* rv350,rv370,rv380 */
                 rdev->num_gb_pipes = 1;
         }
+        rdev->num_z_pipes = 1;
         gb_tile_config = (R300_ENABLE_TILING | R300_TILE_SIZE_16);
         switch (rdev->num_gb_pipes) {
         case 2:
@@ -486,7 +487,8 @@ void r300_gpu_init(struct radeon_device *rdev)
                 printk(KERN_WARNING "Failed to wait MC idle while "
                        "programming pipes. Bad things might happen.\n");
         }
-        DRM_INFO("radeon: %d pipes initialized.\n", rdev->num_gb_pipes);
+        DRM_INFO("radeon: %d quad pipes, %d Z pipes initialized.\n",
+                 rdev->num_gb_pipes, rdev->num_z_pipes);
 }
 
 int r300_ga_reset(struct radeon_device *rdev)
@@ -593,27 +595,6 @@ void r300_vram_info(struct radeon_device *rdev)
 
 
 /*
- * Indirect registers accessor
- */
-uint32_t rv370_pcie_rreg(struct radeon_device *rdev, uint32_t reg)
-{
-        uint32_t r;
-
-        WREG8(RADEON_PCIE_INDEX, ((reg) & 0xff));
-        (void)RREG32(RADEON_PCIE_INDEX);
-        r = RREG32(RADEON_PCIE_DATA);
-        return r;
-}
-
-void rv370_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
-{
-        WREG8(RADEON_PCIE_INDEX, ((reg) & 0xff));
-        (void)RREG32(RADEON_PCIE_INDEX);
-        WREG32(RADEON_PCIE_DATA, (v));
-        (void)RREG32(RADEON_PCIE_DATA);
-}
-
-/*
  * PCIE Lanes
  */
 
@@ -1403,6 +1384,21 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 tmp = (ib_chunk->kdata[idx] >> 22) & 0xF;
                 track->textures[i].txdepth = tmp;
                 break;
+        case R300_ZB_ZPASS_ADDR:
+                r = r100_cs_packet_next_reloc(p, &reloc);
+                if (r) {
+                        DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
+                                        idx, reg);
+                        r100_cs_dump_packet(p, pkt);
+                        return r;
+                }
+                ib[idx] = ib_chunk->kdata[idx] + ((u32)reloc->lobj.gpu_offset);
+                break;
+        case 0x4be8:
+                /* valid register only on RV530 */
+                if (p->rdev->family == CHIP_RV530)
+                        break;
+                /* fallthrough do not move */
         default:
                 printk(KERN_ERR "Forbidden register 0x%04X in cs at %d\n",
                        reg, idx);
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index dea497a979f2..97426a6f370f 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -165,7 +165,18 @@ void r420_pipes_init(struct radeon_device *rdev)
                 printk(KERN_WARNING "Failed to wait GUI idle while "
                        "programming pipes. Bad things might happen.\n");
         }
-        DRM_INFO("radeon: %d pipes initialized.\n", rdev->num_gb_pipes);
+
+        if (rdev->family == CHIP_RV530) {
+                tmp = RREG32(RV530_GB_PIPE_SELECT2);
+                if ((tmp & 3) == 3)
+                        rdev->num_z_pipes = 2;
+                else
+                        rdev->num_z_pipes = 1;
+        } else
+                rdev->num_z_pipes = 1;
+
+        DRM_INFO("radeon: %d quad pipes, %d z pipes initialized.\n",
+                 rdev->num_gb_pipes, rdev->num_z_pipes);
 }
 
 void r420_gpu_init(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r500_reg.h b/drivers/gpu/drm/radeon/r500_reg.h
index 036691b38cb7..e1d5e0331e19 100644
--- a/drivers/gpu/drm/radeon/r500_reg.h
+++ b/drivers/gpu/drm/radeon/r500_reg.h
@@ -350,6 +350,7 @@
 #define AVIVO_D1CRTC_BLANK_CONTROL                              0x6084
 #define AVIVO_D1CRTC_INTERLACE_CONTROL                          0x6088
 #define AVIVO_D1CRTC_INTERLACE_STATUS                           0x608c
+#define AVIVO_D1CRTC_FRAME_COUNT                                0x60a4
 #define AVIVO_D1CRTC_STEREO_CONTROL                             0x60c4
 
 /* master controls */
@@ -438,14 +439,15 @@
 #       define AVIVO_DC_LB_DISP1_END_ADR_SHIFT  4
 #       define AVIVO_DC_LB_DISP1_END_ADR_MASK   0x7ff
 
-#define R500_DxMODE_INT_MASK 0x6540
-#define R500_D1MODE_INT_MASK (1<<0)
-#define R500_D2MODE_INT_MASK (1<<8)
-
 #define AVIVO_D1MODE_DATA_FORMAT                0x6528
 #       define AVIVO_D1MODE_INTERLEAVE_EN       (1 << 0)
 #define AVIVO_D1MODE_DESKTOP_HEIGHT             0x652C
+#define AVIVO_D1MODE_VBLANK_STATUS              0x6534
+#       define AVIVO_VBLANK_ACK                 (1 << 4)
 #define AVIVO_D1MODE_VLINE_START_END            0x6538
+#define AVIVO_DxMODE_INT_MASK                   0x6540
+#       define AVIVO_D1MODE_INT_MASK            (1 << 0)
+#       define AVIVO_D2MODE_INT_MASK            (1 << 8)
 #define AVIVO_D1MODE_VIEWPORT_START             0x6580
 #define AVIVO_D1MODE_VIEWPORT_SIZE              0x6584
 #define AVIVO_D1MODE_EXT_OVERSCAN_LEFT_RIGHT    0x6588
@@ -475,6 +477,7 @@
 #define AVIVO_D2CRTC_BLANK_CONTROL                              0x6884
 #define AVIVO_D2CRTC_INTERLACE_CONTROL                          0x6888
 #define AVIVO_D2CRTC_INTERLACE_STATUS                           0x688c
+#define AVIVO_D2CRTC_FRAME_COUNT                                0x68a4
 #define AVIVO_D2CRTC_STEREO_CONTROL                             0x68c4
 
 #define AVIVO_D2GRPH_ENABLE                                     0x6900
@@ -497,6 +500,7 @@
 #define AVIVO_D2CUR_SIZE                        0x6c10
 #define AVIVO_D2CUR_POSITION                    0x6c14
 
+#define AVIVO_D2MODE_VBLANK_STATUS              0x6d34
 #define AVIVO_D2MODE_VLINE_START_END            0x6d38
 #define AVIVO_D2MODE_VIEWPORT_START             0x6d80
 #define AVIVO_D2MODE_VIEWPORT_SIZE              0x6d84
@@ -748,4 +752,8 @@
 #       define AVIVO_I2C_EN                                                     (1 << 0)
 #       define AVIVO_I2C_RESET                                          (1 << 8)
 
+#define AVIVO_DISP_INTERRUPT_STATUS                             0x7edc
+#       define AVIVO_D1_VBLANK_INTERRUPT                        (1 << 4)
+#       define AVIVO_D2_VBLANK_INTERRUPT                        (1 << 5)
+
 #endif
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index 09fb0b6ec7dd..ebd6b0f7bdff 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -177,7 +177,6 @@ void r520_gpu_init(struct radeon_device *rdev)
          */
         /* workaround for RV530 */
         if (rdev->family == CHIP_RV530) {
-                WREG32(0x4124, 1);
                 WREG32(0x4128, 0xFF);
         }
         r420_pipes_init(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index b1d945b8ed6c..b519fb2fecbb 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -242,6 +242,7 @@ int radeon_object_pin(struct radeon_object *robj, uint32_t domain,
                       uint64_t *gpu_addr);
 void radeon_object_unpin(struct radeon_object *robj);
 int radeon_object_wait(struct radeon_object *robj);
+int radeon_object_busy_domain(struct radeon_object *robj, uint32_t *cur_placement);
 int radeon_object_evict_vram(struct radeon_device *rdev);
 int radeon_object_mmap(struct radeon_object *robj, uint64_t *offset);
 void radeon_object_force_delete(struct radeon_device *rdev);
@@ -574,6 +575,7 @@ struct radeon_asic {
         void (*ring_start)(struct radeon_device *rdev);
         int (*irq_set)(struct radeon_device *rdev);
         int (*irq_process)(struct radeon_device *rdev);
+        u32 (*get_vblank_counter)(struct radeon_device *rdev, int crtc);
         void (*fence_ring_emit)(struct radeon_device *rdev, struct radeon_fence *fence);
         int (*cs_parse)(struct radeon_cs_parser *p);
         int (*copy_blit)(struct radeon_device *rdev,
@@ -653,6 +655,7 @@ struct radeon_device {
         int                             usec_timeout;
         enum radeon_pll_errata          pll_errata;
         int                             num_gb_pipes;
+        int                             num_z_pipes;
         int                             disp_priority;
         /* BIOS */
         uint8_t                         *bios;
@@ -666,14 +669,11 @@ struct radeon_device {
         resource_size_t                 rmmio_base;
         resource_size_t                 rmmio_size;
         void                            *rmmio;
-        radeon_rreg_t                   mm_rreg;
-        radeon_wreg_t                   mm_wreg;
         radeon_rreg_t                   mc_rreg;
         radeon_wreg_t                   mc_wreg;
         radeon_rreg_t                   pll_rreg;
         radeon_wreg_t                   pll_wreg;
-        radeon_rreg_t                   pcie_rreg;
-        radeon_wreg_t                   pcie_wreg;
+        uint32_t                        pcie_reg_mask;
         radeon_rreg_t                   pciep_rreg;
         radeon_wreg_t                   pciep_wreg;
         struct radeon_clock             clock;
@@ -705,22 +705,42 @@ int radeon_device_init(struct radeon_device *rdev,
 void radeon_device_fini(struct radeon_device *rdev);
 int radeon_gpu_wait_for_idle(struct radeon_device *rdev);
 
+static inline uint32_t r100_mm_rreg(struct radeon_device *rdev, uint32_t reg)
+{
+        if (reg < 0x10000)
+                return readl(((void __iomem *)rdev->rmmio) + reg);
+        else {
+                writel(reg, ((void __iomem *)rdev->rmmio) + RADEON_MM_INDEX);
+                return readl(((void __iomem *)rdev->rmmio) + RADEON_MM_DATA);
+        }
+}
+
+static inline void r100_mm_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
+{
+        if (reg < 0x10000)
+                writel(v, ((void __iomem *)rdev->rmmio) + reg);
+        else {
+                writel(reg, ((void __iomem *)rdev->rmmio) + RADEON_MM_INDEX);
+                writel(v, ((void __iomem *)rdev->rmmio) + RADEON_MM_DATA);
+        }
+}
+
 
 /*
  * Registers read & write functions.
  */
 #define RREG8(reg) readb(((void __iomem *)rdev->rmmio) + (reg))
 #define WREG8(reg, v) writeb(v, ((void __iomem *)rdev->rmmio) + (reg))
-#define RREG32(reg) rdev->mm_rreg(rdev, (reg))
-#define WREG32(reg, v) rdev->mm_wreg(rdev, (reg), (v))
+#define RREG32(reg) r100_mm_rreg(rdev, (reg))
+#define WREG32(reg, v) r100_mm_wreg(rdev, (reg), (v))
 #define REG_SET(FIELD, v) (((v) << FIELD##_SHIFT) & FIELD##_MASK)
 #define REG_GET(FIELD, v) (((v) << FIELD##_SHIFT) & FIELD##_MASK)
 #define RREG32_PLL(reg) rdev->pll_rreg(rdev, (reg))
 #define WREG32_PLL(reg, v) rdev->pll_wreg(rdev, (reg), (v))
 #define RREG32_MC(reg) rdev->mc_rreg(rdev, (reg))
 #define WREG32_MC(reg, v) rdev->mc_wreg(rdev, (reg), (v))
-#define RREG32_PCIE(reg) rdev->pcie_rreg(rdev, (reg))
-#define WREG32_PCIE(reg, v) rdev->pcie_wreg(rdev, (reg), (v))
+#define RREG32_PCIE(reg) rv370_pcie_rreg(rdev, (reg))
+#define WREG32_PCIE(reg, v) rv370_pcie_wreg(rdev, (reg), (v))
 #define WREG32_P(reg, val, mask)                                \
         do {                                                    \
                 uint32_t tmp_ = RREG32(reg);                    \
@@ -736,6 +756,24 @@ int radeon_gpu_wait_for_idle(struct radeon_device *rdev);
                 WREG32_PLL(reg, tmp_);                          \
         } while (0)
 
+/*
+ * Indirect registers accessor
+ */
+static inline uint32_t rv370_pcie_rreg(struct radeon_device *rdev, uint32_t reg)
+{
+        uint32_t r;
+
+        WREG32(RADEON_PCIE_INDEX, ((reg) & rdev->pcie_reg_mask));
+        r = RREG32(RADEON_PCIE_DATA);
+        return r;
+}
+
+static inline void rv370_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
+{
+        WREG32(RADEON_PCIE_INDEX, ((reg) & rdev->pcie_reg_mask));
+        WREG32(RADEON_PCIE_DATA, (v));
+}
+
 void r100_pll_errata_after_index(struct radeon_device *rdev);
 
 
@@ -862,6 +900,7 @@ static inline void radeon_ring_write(struct radeon_device *rdev, uint32_t v)
 #define radeon_ring_start(rdev) (rdev)->asic->ring_start((rdev))
 #define radeon_irq_set(rdev) (rdev)->asic->irq_set((rdev))
 #define radeon_irq_process(rdev) (rdev)->asic->irq_process((rdev))
+#define radeon_get_vblank_counter(rdev, crtc) (rdev)->asic->get_vblank_counter((rdev), (crtc))
 #define radeon_fence_ring_emit(rdev, fence) (rdev)->asic->fence_ring_emit((rdev), (fence))
 #define radeon_copy_blit(rdev, s, d, np, f) (rdev)->asic->copy_blit((rdev), (s), (d), (np), (f))
 #define radeon_copy_dma(rdev, s, d, np, f) (rdev)->asic->copy_dma((rdev), (s), (d), (np), (f))
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index 9a75876e0c3b..7ca6c13569b5 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -49,6 +49,7 @@ void r100_vram_info(struct radeon_device *rdev);
 int r100_gpu_reset(struct radeon_device *rdev);
 int r100_mc_init(struct radeon_device *rdev);
 void r100_mc_fini(struct radeon_device *rdev);
+u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc);
 int r100_wb_init(struct radeon_device *rdev);
 void r100_wb_fini(struct radeon_device *rdev);
 int r100_gart_enable(struct radeon_device *rdev);
@@ -96,6 +97,7 @@ static struct radeon_asic r100_asic = {
         .ring_start = &r100_ring_start,
         .irq_set = &r100_irq_set,
         .irq_process = &r100_irq_process,
+        .get_vblank_counter = &r100_get_vblank_counter,
         .fence_ring_emit = &r100_fence_ring_emit,
         .cs_parse = &r100_cs_parse,
         .copy_blit = &r100_copy_blit,
@@ -156,6 +158,7 @@ static struct radeon_asic r300_asic = {
         .ring_start = &r300_ring_start,
         .irq_set = &r100_irq_set,
         .irq_process = &r100_irq_process,
+        .get_vblank_counter = &r100_get_vblank_counter,
         .fence_ring_emit = &r300_fence_ring_emit,
         .cs_parse = &r300_cs_parse,
         .copy_blit = &r100_copy_blit,
@@ -196,6 +199,7 @@ static struct radeon_asic r420_asic = {
         .ring_start = &r300_ring_start,
         .irq_set = &r100_irq_set,
         .irq_process = &r100_irq_process,
+        .get_vblank_counter = &r100_get_vblank_counter,
         .fence_ring_emit = &r300_fence_ring_emit,
         .cs_parse = &r300_cs_parse,
         .copy_blit = &r100_copy_blit,
@@ -243,6 +247,7 @@ static struct radeon_asic rs400_asic = {
         .ring_start = &r300_ring_start,
         .irq_set = &r100_irq_set,
         .irq_process = &r100_irq_process,
+        .get_vblank_counter = &r100_get_vblank_counter,
         .fence_ring_emit = &r300_fence_ring_emit,
         .cs_parse = &r300_cs_parse,
         .copy_blit = &r100_copy_blit,
@@ -266,6 +271,8 @@ void rs600_vram_info(struct radeon_device *rdev);
 int rs600_mc_init(struct radeon_device *rdev);
 void rs600_mc_fini(struct radeon_device *rdev);
 int rs600_irq_set(struct radeon_device *rdev);
+int rs600_irq_process(struct radeon_device *rdev);
+u32 rs600_get_vblank_counter(struct radeon_device *rdev, int crtc);
 int rs600_gart_enable(struct radeon_device *rdev);
 void rs600_gart_disable(struct radeon_device *rdev);
 void rs600_gart_tlb_flush(struct radeon_device *rdev);
@@ -291,7 +298,8 @@ static struct radeon_asic rs600_asic = {
         .cp_disable = &r100_cp_disable,
         .ring_start = &r300_ring_start,
         .irq_set = &rs600_irq_set,
-        .irq_process = &r100_irq_process,
+        .irq_process = &rs600_irq_process,
+        .get_vblank_counter = &rs600_get_vblank_counter,
         .fence_ring_emit = &r300_fence_ring_emit,
         .cs_parse = &r300_cs_parse,
         .copy_blit = &r100_copy_blit,
@@ -308,6 +316,7 @@ static struct radeon_asic rs600_asic = {
 /*
  * rs690,rs740
  */
+int rs690_init(struct radeon_device *rdev);
 void rs690_errata(struct radeon_device *rdev);
 void rs690_vram_info(struct radeon_device *rdev);
 int rs690_mc_init(struct radeon_device *rdev);
@@ -316,7 +325,7 @@ uint32_t rs690_mc_rreg(struct radeon_device *rdev, uint32_t reg);
 void rs690_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 void rs690_bandwidth_update(struct radeon_device *rdev);
 static struct radeon_asic rs690_asic = {
-        .init = &r300_init,
+        .init = &rs690_init,
         .errata = &rs690_errata,
         .vram_info = &rs690_vram_info,
         .gpu_reset = &r300_gpu_reset,
@@ -333,7 +342,8 @@ static struct radeon_asic rs690_asic = {
         .cp_disable = &r100_cp_disable,
         .ring_start = &r300_ring_start,
         .irq_set = &rs600_irq_set,
-        .irq_process = &r100_irq_process,
+        .irq_process = &rs600_irq_process,
+        .get_vblank_counter = &rs600_get_vblank_counter,
         .fence_ring_emit = &r300_fence_ring_emit,
         .cs_parse = &r300_cs_parse,
         .copy_blit = &r100_copy_blit,
@@ -381,8 +391,9 @@ static struct radeon_asic rv515_asic = {
         .cp_fini = &r100_cp_fini,
         .cp_disable = &r100_cp_disable,
         .ring_start = &rv515_ring_start,
-        .irq_set = &r100_irq_set,
-        .irq_process = &r100_irq_process,
+        .irq_set = &rs600_irq_set,
+        .irq_process = &rs600_irq_process,
+        .get_vblank_counter = &rs600_get_vblank_counter,
         .fence_ring_emit = &r300_fence_ring_emit,
         .cs_parse = &r300_cs_parse,
         .copy_blit = &r100_copy_blit,
@@ -423,8 +434,9 @@ static struct radeon_asic r520_asic = {
         .cp_fini = &r100_cp_fini,
         .cp_disable = &r100_cp_disable,
         .ring_start = &rv515_ring_start,
-        .irq_set = &r100_irq_set,
-        .irq_process = &r100_irq_process,
+        .irq_set = &rs600_irq_set,
+        .irq_process = &rs600_irq_process,
+        .get_vblank_counter = &rs600_get_vblank_counter,
         .fence_ring_emit = &r300_fence_ring_emit,
         .cs_parse = &r300_cs_parse,
         .copy_blit = &r100_copy_blit,
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index afc4db280b94..2a027e00762a 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -685,23 +685,15 @@ static const uint32_t default_tvdac_adj[CHIP_LAST] = {
         0x00780000,             /* rs480 */
 };
 
-static struct radeon_encoder_tv_dac
-    *radeon_legacy_get_tv_dac_info_from_table(struct radeon_device *rdev)
+static void radeon_legacy_get_tv_dac_info_from_table(struct radeon_device *rdev,
+                                                     struct radeon_encoder_tv_dac *tv_dac)
 {
-        struct radeon_encoder_tv_dac *tv_dac = NULL;
-
-        tv_dac = kzalloc(sizeof(struct radeon_encoder_tv_dac), GFP_KERNEL);
-
-        if (!tv_dac)
-                return NULL;
-
         tv_dac->ps2_tvdac_adj = default_tvdac_adj[rdev->family];
         if ((rdev->flags & RADEON_IS_MOBILITY) && (rdev->family == CHIP_RV250))
                 tv_dac->ps2_tvdac_adj = 0x00880000;
         tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj;
         tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj;
-
-        return tv_dac;
+        return;
 }
 
 struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
@@ -713,19 +705,18 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
         uint16_t dac_info;
         uint8_t rev, bg, dac;
         struct radeon_encoder_tv_dac *tv_dac = NULL;
+        int found = 0;
+
+        tv_dac = kzalloc(sizeof(struct radeon_encoder_tv_dac), GFP_KERNEL);
+        if (!tv_dac)
+                return NULL;
 
         if (rdev->bios == NULL)
-                return radeon_legacy_get_tv_dac_info_from_table(rdev);
+                goto out;
 
         /* first check TV table */
         dac_info = combios_get_table_offset(dev, COMBIOS_TV_INFO_TABLE);
         if (dac_info) {
-                tv_dac =
-                    kzalloc(sizeof(struct radeon_encoder_tv_dac), GFP_KERNEL);
-
-                if (!tv_dac)
-                        return NULL;
-
                 rev = RBIOS8(dac_info + 0x3);
                 if (rev > 4) {
                         bg = RBIOS8(dac_info + 0xc) & 0xf;
@@ -739,6 +730,7 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
                         bg = RBIOS8(dac_info + 0x10) & 0xf;
                         dac = RBIOS8(dac_info + 0x11) & 0xf;
                         tv_dac->ntsc_tvdac_adj = (bg << 16) | (dac << 20);
+                        found = 1;
                 } else if (rev > 1) {
                         bg = RBIOS8(dac_info + 0xc) & 0xf;
                         dac = (RBIOS8(dac_info + 0xc) >> 4) & 0xf;
@@ -751,22 +743,15 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
                         bg = RBIOS8(dac_info + 0xe) & 0xf;
                         dac = (RBIOS8(dac_info + 0xe) >> 4) & 0xf;
                         tv_dac->ntsc_tvdac_adj = (bg << 16) | (dac << 20);
+                        found = 1;
                 }
-
                 tv_dac->tv_std = radeon_combios_get_tv_info(encoder);
-
-        } else {
+        }
+        if (!found) {
                 /* then check CRT table */
                 dac_info =
                     combios_get_table_offset(dev, COMBIOS_CRT_INFO_TABLE);
                 if (dac_info) {
-                        tv_dac =
-                            kzalloc(sizeof(struct radeon_encoder_tv_dac),
-                                    GFP_KERNEL);
-
-                        if (!tv_dac)
-                                return NULL;
-
                         rev = RBIOS8(dac_info) & 0x3;
                         if (rev < 2) {
                                 bg = RBIOS8(dac_info + 0x3) & 0xf;
@@ -775,6 +760,7 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
                                     (bg << 16) | (dac << 20);
                                 tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj;
                                 tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj;
+                                found = 1;
                         } else {
                                 bg = RBIOS8(dac_info + 0x4) & 0xf;
                                 dac = RBIOS8(dac_info + 0x5) & 0xf;
@@ -782,13 +768,17 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
                                     (bg << 16) | (dac << 20);
                                 tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj;
                                 tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj;
+                                found = 1;
                         }
                 } else {
                         DRM_INFO("No TV DAC info found in BIOS\n");
-                        return radeon_legacy_get_tv_dac_info_from_table(rdev);
                 }
         }
 
+out:
+        if (!found) /* fallback to defaults */
+                radeon_legacy_get_tv_dac_info_from_table(rdev, tv_dac);
+
         return tv_dac;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index d8356827ef17..7a52c461145c 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -406,6 +406,15 @@ static void radeon_init_pipes(drm_radeon_private_t *dev_priv)
 {
         uint32_t gb_tile_config, gb_pipe_sel = 0;
 
+        if ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV530) {
+                uint32_t z_pipe_sel = RADEON_READ(RV530_GB_PIPE_SELECT2);
+                if ((z_pipe_sel & 3) == 3)
+                        dev_priv->num_z_pipes = 2;
+                else
+                        dev_priv->num_z_pipes = 1;
+        } else
+                dev_priv->num_z_pipes = 1;
+
         /* RS4xx/RS6xx/R4xx/R5xx */
         if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R420) {
                 gb_pipe_sel = RADEON_READ(R400_GB_PIPE_SELECT);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 9ff6dcb97f9d..7693f7c67bd3 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -225,25 +225,18 @@ void radeon_invalid_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 
 void radeon_register_accessor_init(struct radeon_device *rdev)
 {
-        rdev->mm_rreg = &r100_mm_rreg;
-        rdev->mm_wreg = &r100_mm_wreg;
         rdev->mc_rreg = &radeon_invalid_rreg;
         rdev->mc_wreg = &radeon_invalid_wreg;
         rdev->pll_rreg = &radeon_invalid_rreg;
         rdev->pll_wreg = &radeon_invalid_wreg;
-        rdev->pcie_rreg = &radeon_invalid_rreg;
-        rdev->pcie_wreg = &radeon_invalid_wreg;
         rdev->pciep_rreg = &radeon_invalid_rreg;
         rdev->pciep_wreg = &radeon_invalid_wreg;
 
         /* Don't change order as we are overridding accessor. */
         if (rdev->family < CHIP_RV515) {
-                rdev->pcie_rreg = &rv370_pcie_rreg;
-                rdev->pcie_wreg = &rv370_pcie_wreg;
-        }
-        if (rdev->family >= CHIP_RV515) {
-                rdev->pcie_rreg = &rv515_pcie_rreg;
-                rdev->pcie_wreg = &rv515_pcie_wreg;
+                rdev->pcie_reg_mask = 0xff;
+        } else {
+                rdev->pcie_reg_mask = 0x7ff;
         }
         /* FIXME: not sure here */
         if (rdev->family <= CHIP_R580) {
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 3933f8216a34..6fa32dac4e97 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -100,9 +100,10 @@
  * 1.28- Add support for VBL on CRTC2
  * 1.29- R500 3D cmd buffer support
  * 1.30- Add support for occlusion queries
+ * 1.31- Add support for num Z pipes from GET_PARAM
  */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            30
+#define DRIVER_MINOR            31
 #define DRIVER_PATCHLEVEL       0
 
 /*
@@ -329,6 +330,7 @@ typedef struct drm_radeon_private {
         resource_size_t fb_aper_offset;
 
         int num_gb_pipes;
+        int num_z_pipes;
         int track_flush;
         drm_local_map_t *mmio;
 
@@ -689,6 +691,7 @@ extern void r600_page_table_cleanup(struct drm_device *dev, struct drm_ati_pciga
 
 /* pipe config regs */
 #define R400_GB_PIPE_SELECT             0x402c
+#define RV530_GB_PIPE_SELECT2           0x4124
 #define R500_DYN_SCLK_PWMEM_PIPE        0x000d /* PLL */
 #define R300_GB_TILE_CONFIG             0x4018
 #       define R300_ENABLE_TILING       (1 << 0)
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index 3206c0ad7b6c..ec383edf5f38 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -574,6 +574,8 @@ int radeonfb_create(struct radeon_device *rdev,
                 goto out_unref;
         }
 
+        memset_io(fbptr, 0, aligned_size);
+
         strcpy(info->fix.id, "radeondrmfb");
         info->fix.type = FB_TYPE_PACKED_PIXELS;
         info->fix.visual = FB_VISUAL_TRUECOLOR;
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index cded5180c752..d880edf254db 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -262,8 +262,34 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
 int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
                           struct drm_file *filp)
 {
-        /* FIXME: implement */
-        return 0;
+        struct drm_radeon_gem_busy *args = data;
+        struct drm_gem_object *gobj;
+        struct radeon_object *robj;
+        int r;
+        uint32_t cur_placement;
+
+        gobj = drm_gem_object_lookup(dev, filp, args->handle);
+        if (gobj == NULL) {
+                return -EINVAL;
+        }
+        robj = gobj->driver_private;
+        r = radeon_object_busy_domain(robj, &cur_placement);
+        switch (cur_placement) {
+        case TTM_PL_VRAM:
+                args->domain = RADEON_GEM_DOMAIN_VRAM;
+                break;
+        case TTM_PL_TT:
+                args->domain = RADEON_GEM_DOMAIN_GTT;
+                break;
+        case TTM_PL_SYSTEM:
+                args->domain = RADEON_GEM_DOMAIN_CPU;
+        default:
+                break;
+        }
+        mutex_lock(&dev->struct_mutex);
+        drm_gem_object_unreference(gobj);
+        mutex_unlock(&dev->struct_mutex);
+        return r;
 }
 
 int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
index 491d569deb0e..9805e4b6ca1b 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -32,60 +32,6 @@
 #include "radeon.h"
 #include "atom.h"
 
-static inline uint32_t r100_irq_ack(struct radeon_device *rdev)
-{
-        uint32_t irqs = RREG32(RADEON_GEN_INT_STATUS);
-        uint32_t irq_mask = RADEON_SW_INT_TEST;
-
-        if (irqs) {
-                WREG32(RADEON_GEN_INT_STATUS, irqs);
-        }
-        return irqs & irq_mask;
-}
-
-int r100_irq_set(struct radeon_device *rdev)
-{
-        uint32_t tmp = 0;
-
-        if (rdev->irq.sw_int) {
-                tmp |= RADEON_SW_INT_ENABLE;
-        }
-        /* Todo go through CRTC and enable vblank int or not */
-        WREG32(RADEON_GEN_INT_CNTL, tmp);
-        return 0;
-}
-
-int r100_irq_process(struct radeon_device *rdev)
-{
-        uint32_t status;
-
-        status = r100_irq_ack(rdev);
-        if (!status) {
-                return IRQ_NONE;
-        }
-        while (status) {
-                /* SW interrupt */
-                if (status & RADEON_SW_INT_TEST) {
-                        radeon_fence_process(rdev);
-                }
-                status = r100_irq_ack(rdev);
-        }
-        return IRQ_HANDLED;
-}
-
-int rs600_irq_set(struct radeon_device *rdev)
-{
-        uint32_t tmp = 0;
-
-        if (rdev->irq.sw_int) {
-                tmp |= RADEON_SW_INT_ENABLE;
-        }
-        WREG32(RADEON_GEN_INT_CNTL, tmp);
-        /* Todo go through CRTC and enable vblank int or not */
-        WREG32(R500_DxMODE_INT_MASK, 0);
-        return 0;
-}
-
 irqreturn_t radeon_driver_irq_handler_kms(DRM_IRQ_ARGS)
 {
         struct drm_device *dev = (struct drm_device *) arg;
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 3357110e30ce..dce09ada32bc 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -95,6 +95,9 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
         case RADEON_INFO_NUM_GB_PIPES:
                 value = rdev->num_gb_pipes;
                 break;
+        case RADEON_INFO_NUM_Z_PIPES:
+                value = rdev->num_z_pipes;
+                break;
         default:
                 DRM_DEBUG("Invalid request %d\n", info->request);
                 return -EINVAL;
@@ -141,19 +144,42 @@ void radeon_driver_preclose_kms(struct drm_device *dev,
  */
 u32 radeon_get_vblank_counter_kms(struct drm_device *dev, int crtc)
 {
-        /* FIXME: implement */
-        return 0;
+        struct radeon_device *rdev = dev->dev_private;
+
+        if (crtc < 0 || crtc > 1) {
+                DRM_ERROR("Invalid crtc %d\n", crtc);
+                return -EINVAL;
+        }
+
+        return radeon_get_vblank_counter(rdev, crtc);
 }
 
 int radeon_enable_vblank_kms(struct drm_device *dev, int crtc)
 {
-        /* FIXME: implement */
-        return 0;
+        struct radeon_device *rdev = dev->dev_private;
+
+        if (crtc < 0 || crtc > 1) {
+                DRM_ERROR("Invalid crtc %d\n", crtc);
+                return -EINVAL;
+        }
+
+        rdev->irq.crtc_vblank_int[crtc] = true;
+
+        return radeon_irq_set(rdev);
 }
 
 void radeon_disable_vblank_kms(struct drm_device *dev, int crtc)
 {
-        /* FIXME: implement */
+        struct radeon_device *rdev = dev->dev_private;
+
+        if (crtc < 0 || crtc > 1) {
+                DRM_ERROR("Invalid crtc %d\n", crtc);
+                return;
+        }
+
+        rdev->irq.crtc_vblank_int[crtc] = false;
+
+        radeon_irq_set(rdev);
 }
 
 
@@ -295,5 +321,6 @@ struct drm_ioctl_desc radeon_ioctls_kms[] = {
         DRM_IOCTL_DEF(DRM_RADEON_INFO, radeon_info_ioctl, DRM_AUTH),
         DRM_IOCTL_DEF(DRM_RADEON_GEM_SET_TILING, radeon_gem_set_tiling_ioctl, DRM_AUTH),
         DRM_IOCTL_DEF(DRM_RADEON_GEM_GET_TILING, radeon_gem_get_tiling_ioctl, DRM_AUTH),
+        DRM_IOCTL_DEF(DRM_RADEON_GEM_BUSY, radeon_gem_busy_ioctl, DRM_AUTH),
 };
 int radeon_max_kms_ioctl = DRM_ARRAY_SIZE(radeon_ioctls_kms);
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
index 7d06dc98a42a..0da72f18fd3a 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
@@ -310,10 +310,13 @@ void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
                                                                          RADEON_CRTC_DISP_REQ_EN_B));
                         WREG32_P(RADEON_CRTC_EXT_CNTL, 0, ~mask);
                 }
+                drm_vblank_post_modeset(dev, radeon_crtc->crtc_id);
+                radeon_crtc_load_lut(crtc);
                 break;
         case DRM_MODE_DPMS_STANDBY:
         case DRM_MODE_DPMS_SUSPEND:
         case DRM_MODE_DPMS_OFF:
+                drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
                 if (radeon_crtc->crtc_id)
                         WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~mask);
                 else {
@@ -323,10 +326,6 @@ void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
                 }
                 break;
         }
-
-        if (mode != DRM_MODE_DPMS_OFF) {
-                radeon_crtc_load_lut(crtc);
-        }
 }
 
 /* properly set crtc bpp when using atombios */
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 34d0f58eb944..9322675ef6d0 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -1066,6 +1066,7 @@ radeon_add_legacy_encoder(struct drm_device *dev, uint32_t encoder_id, uint32_t
 
         switch (radeon_encoder->encoder_id) {
         case ENCODER_OBJECT_ID_INTERNAL_LVDS:
+                encoder->possible_crtcs = 0x1;
                 drm_encoder_init(dev, encoder, &radeon_legacy_lvds_enc_funcs, DRM_MODE_ENCODER_LVDS);
                 drm_encoder_helper_add(encoder, &radeon_legacy_lvds_helper_funcs);
                 if (rdev->is_atom_bios)
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index e98cae3bf4a6..b85fb83d7ae8 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -316,6 +316,25 @@ int radeon_object_wait(struct radeon_object *robj)
         return r;
 }
 
+int radeon_object_busy_domain(struct radeon_object *robj, uint32_t *cur_placement)
+{
+        int r = 0;
+
+        r = radeon_object_reserve(robj, true);
+        if (unlikely(r != 0)) {
+                DRM_ERROR("radeon: failed to reserve object for waiting.\n");
+                return r;
+        }
+        spin_lock(&robj->tobj.lock);
+        *cur_placement = robj->tobj.mem.mem_type;
+        if (robj->tobj.sync_obj) {
+                r = ttm_bo_wait(&robj->tobj, true, true, true);
+        }
+        spin_unlock(&robj->tobj.lock);
+        radeon_object_unreserve(robj);
+        return r;
+}
+
 int radeon_object_evict_vram(struct radeon_device *rdev)
 {
         if (rdev->flags & RADEON_IS_IGP) {
diff --git a/drivers/gpu/drm/radeon/radeon_reg.h b/drivers/gpu/drm/radeon/radeon_reg.h
index e1b618574461..4df43f62c678 100644
--- a/drivers/gpu/drm/radeon/radeon_reg.h
+++ b/drivers/gpu/drm/radeon/radeon_reg.h
@@ -982,12 +982,15 @@
 #       define RS400_TMDS2_PLLRST           (1 << 1)
 
 #define RADEON_GEN_INT_CNTL                 0x0040
+#       define RADEON_CRTC_VBLANK_MASK          (1 << 0)
+#       define RADEON_CRTC2_VBLANK_MASK         (1 << 9)
 #       define RADEON_SW_INT_ENABLE             (1 << 25)
 #define RADEON_GEN_INT_STATUS               0x0044
-#       define RADEON_VSYNC_INT_AK          (1 <<  2)
-#       define RADEON_VSYNC_INT             (1 <<  2)
-#       define RADEON_VSYNC2_INT_AK         (1 <<  6)
-#       define RADEON_VSYNC2_INT            (1 <<  6)
+#       define AVIVO_DISPLAY_INT_STATUS         (1 << 0)
+#       define RADEON_CRTC_VBLANK_STAT          (1 << 0)
+#       define RADEON_CRTC_VBLANK_STAT_ACK      (1 << 0)
+#       define RADEON_CRTC2_VBLANK_STAT         (1 << 9)
+#       define RADEON_CRTC2_VBLANK_STAT_ACK     (1 << 9)
 #       define RADEON_SW_INT_FIRE               (1 << 26)
 #       define RADEON_SW_INT_TEST               (1 << 25)
 #       define RADEON_SW_INT_TEST_ACK           (1 << 25)
@@ -2334,6 +2337,9 @@
 #       define RADEON_RE_WIDTH_SHIFT        0
 #       define RADEON_RE_HEIGHT_SHIFT       16
 
+#define RADEON_RB3D_ZPASS_DATA 0x3290
+#define RADEON_RB3D_ZPASS_ADDR 0x3294
+
 #define RADEON_SE_CNTL                      0x1c4c
 #       define RADEON_FFACE_CULL_CW          (0 <<  0)
 #       define RADEON_FFACE_CULL_CCW         (1 <<  0)
@@ -3568,4 +3574,6 @@
 #define RADEON_SCRATCH_REG4             0x15f0
 #define RADEON_SCRATCH_REG5             0x15f4
 
+#define RV530_GB_PIPE_SELECT2           0x4124
+
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
index 46645f3e0328..2882f40d5ec5 100644
--- a/drivers/gpu/drm/radeon/radeon_state.c
+++ b/drivers/gpu/drm/radeon/radeon_state.c
@@ -3081,6 +3081,9 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
         case RADEON_PARAM_NUM_GB_PIPES:
                 value = dev_priv->num_gb_pipes;
                 break;
+        case RADEON_PARAM_NUM_Z_PIPES:
+                value = dev_priv->num_z_pipes;
+                break;
         default:
                 DRM_DEBUG("Invalid parameter %d\n", param->param);
                 return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index bbea6dee4a94..7e8ce983a908 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -240,6 +240,88 @@ void rs600_mc_fini(struct radeon_device *rdev)
 
 
 /*
+ * Interrupts
+ */
+int rs600_irq_set(struct radeon_device *rdev)
+{
+        uint32_t tmp = 0;
+        uint32_t mode_int = 0;
+
+        if (rdev->irq.sw_int) {
+                tmp |= RADEON_SW_INT_ENABLE;
+        }
+        if (rdev->irq.crtc_vblank_int[0]) {
+                tmp |= AVIVO_DISPLAY_INT_STATUS;
+                mode_int |= AVIVO_D1MODE_INT_MASK;
+        }
+        if (rdev->irq.crtc_vblank_int[1]) {
+                tmp |= AVIVO_DISPLAY_INT_STATUS;
+                mode_int |= AVIVO_D2MODE_INT_MASK;
+        }
+        WREG32(RADEON_GEN_INT_CNTL, tmp);
+        WREG32(AVIVO_DxMODE_INT_MASK, mode_int);
+        return 0;
+}
+
+static inline uint32_t rs600_irq_ack(struct radeon_device *rdev, u32 *r500_disp_int)
+{
+        uint32_t irqs = RREG32(RADEON_GEN_INT_STATUS);
+        uint32_t irq_mask = RADEON_SW_INT_TEST;
+
+        if (irqs & AVIVO_DISPLAY_INT_STATUS) {
+                *r500_disp_int = RREG32(AVIVO_DISP_INTERRUPT_STATUS);
+                if (*r500_disp_int & AVIVO_D1_VBLANK_INTERRUPT) {
+                        WREG32(AVIVO_D1MODE_VBLANK_STATUS, AVIVO_VBLANK_ACK);
+                }
+                if (*r500_disp_int & AVIVO_D2_VBLANK_INTERRUPT) {
+                        WREG32(AVIVO_D2MODE_VBLANK_STATUS, AVIVO_VBLANK_ACK);
+                }
+        } else {
+                *r500_disp_int = 0;
+        }
+
+        if (irqs) {
+                WREG32(RADEON_GEN_INT_STATUS, irqs);
+        }
+        return irqs & irq_mask;
+}
+
+int rs600_irq_process(struct radeon_device *rdev)
+{
+        uint32_t status;
+        uint32_t r500_disp_int;
+
+        status = rs600_irq_ack(rdev, &r500_disp_int);
+        if (!status && !r500_disp_int) {
+                return IRQ_NONE;
+        }
+        while (status || r500_disp_int) {
+                /* SW interrupt */
+                if (status & RADEON_SW_INT_TEST) {
+                        radeon_fence_process(rdev);
+                }
+                /* Vertical blank interrupts */
+                if (r500_disp_int & AVIVO_D1_VBLANK_INTERRUPT) {
+                        drm_handle_vblank(rdev->ddev, 0);
+                }
+                if (r500_disp_int & AVIVO_D2_VBLANK_INTERRUPT) {
+                        drm_handle_vblank(rdev->ddev, 1);
+                }
+                status = rs600_irq_ack(rdev, &r500_disp_int);
+        }
+        return IRQ_HANDLED;
+}
+
+u32 rs600_get_vblank_counter(struct radeon_device *rdev, int crtc)
+{
+        if (crtc == 0)
+                return RREG32(AVIVO_D1CRTC_FRAME_COUNT);
+        else
+                return RREG32(AVIVO_D2CRTC_FRAME_COUNT);
+}
+
+
+/*
  * Global GPU functions
  */
 void rs600_disable_vga(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 839595b00728..bc6b7c5339bc 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -652,3 +652,68 @@ void rs690_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
         WREG32(RS690_MC_DATA, v);
         WREG32(RS690_MC_INDEX, RS690_MC_INDEX_WR_ACK);
 }
+
+static const unsigned rs690_reg_safe_bm[219] = {
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0x17FF1FFF,0xFFFFFFFC,0xFFFFFFFF,0xFF30FFBF,
+        0xFFFFFFF8,0xC3E6FFFF,0xFFFFF6DF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFF03F,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFEFCE,0xF00EBFFF,0x007C0000,
+        0xF0000078,0xFF000009,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFF7FF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFC78,0xFFFFFFFF,0xFFFFFFFE,0xFFFFFFFF,
+        0x38FF8F50,0xFFF88082,0xF000000C,0xFAE009FF,
+        0x0000FFFF,0xFFFFFFFF,0xFFFFFFFF,0x00000000,
+        0x00000000,0x0000C100,0x00000000,0x00000000,
+        0x00000000,0x00000000,0x00000000,0x00000000,
+        0x00000000,0xFFFF0000,0xFFFFFFFF,0xFF80FFFF,
+        0x00000000,0x00000000,0x00000000,0x00000000,
+        0x0003FC01,0xFFFFFFF8,0xFE800B19,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+};
+
+int rs690_init(struct radeon_device *rdev)
+{
+        rdev->config.r300.reg_safe_bm = rs690_reg_safe_bm;
+        rdev->config.r300.reg_safe_bm_size = ARRAY_SIZE(rs690_reg_safe_bm);
+        return 0;
+}
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index fd8f3ca716ea..31a7f668ae5a 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -400,25 +400,6 @@ void rv515_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
         WREG32(MC_IND_INDEX, 0);
 }
 
-uint32_t rv515_pcie_rreg(struct radeon_device *rdev, uint32_t reg)
-{
-        uint32_t r;
-
-        WREG32(PCIE_INDEX, ((reg) & 0x7ff));
-        (void)RREG32(PCIE_INDEX);
-        r = RREG32(PCIE_DATA);
-        return r;
-}
-
-void rv515_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
-{
-        WREG32(PCIE_INDEX, ((reg) & 0x7ff));
-        (void)RREG32(PCIE_INDEX);
-        WREG32(PCIE_DATA, (v));
-        (void)RREG32(PCIE_DATA);
-}
-
-
 /*
  * Debugfs info
  */
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index d258b02aef44..827da0858136 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -674,7 +674,14 @@ omap_i2c_isr(int this_irq, void *dev_id)
 
                 err = 0;
 complete:
-                omap_i2c_write_reg(dev, OMAP_I2C_STAT_REG, stat);
+                /*
+                 * Ack the stat in one go, but [R/X]DR and [R/X]RDY should be
+                 * acked after the data operation is complete.
+                 * Ref: TRM SWPU114Q Figure 18-31
+                 */
+                omap_i2c_write_reg(dev, OMAP_I2C_STAT_REG, stat &
+                                ~(OMAP_I2C_STAT_RRDY | OMAP_I2C_STAT_RDR |
+                                OMAP_I2C_STAT_XRDY | OMAP_I2C_STAT_XDR));
 
                 if (stat & OMAP_I2C_STAT_NACK) {
                         err |= OMAP_I2C_STAT_NACK;
@@ -687,6 +694,9 @@ complete:
                 }
                 if (stat & (OMAP_I2C_STAT_ARDY | OMAP_I2C_STAT_NACK |
                                         OMAP_I2C_STAT_AL)) {
+                        omap_i2c_ack_stat(dev, stat &
+                                (OMAP_I2C_STAT_RRDY | OMAP_I2C_STAT_RDR |
+                                OMAP_I2C_STAT_XRDY | OMAP_I2C_STAT_XDR));
                         omap_i2c_complete_cmd(dev, err);
                         return IRQ_HANDLED;
                 }
@@ -774,7 +784,7 @@ complete:
                                  * memory to the I2C interface.
                                  */
 
-                                if (cpu_is_omap34xx()) {
+                                if (dev->rev <= OMAP_I2C_REV_ON_3430) {
                                                 while (!(stat & OMAP_I2C_STAT_XUDF)) {
                                                         if (stat & (OMAP_I2C_STAT_NACK | OMAP_I2C_STAT_AL)) {
                                                                 omap_i2c_ack_stat(dev, stat & (OMAP_I2C_STAT_XRDY | OMAP_I2C_STAT_XDR));
diff --git a/drivers/i2c/busses/i2c-stu300.c b/drivers/i2c/busses/i2c-stu300.c
index 182e711318ba..d2728a28a8db 100644
--- a/drivers/i2c/busses/i2c-stu300.c
+++ b/drivers/i2c/busses/i2c-stu300.c
@@ -117,7 +117,8 @@ enum stu300_error {
         STU300_ERROR_NONE = 0,
         STU300_ERROR_ACKNOWLEDGE_FAILURE,
         STU300_ERROR_BUS_ERROR,
-        STU300_ERROR_ARBITRATION_LOST
+        STU300_ERROR_ARBITRATION_LOST,
+        STU300_ERROR_UNKNOWN
 };
 
 /* timeout waiting for the controller to respond */
@@ -127,7 +128,7 @@ enum stu300_error {
  * The number of address send athemps tried before giving up.
  * If the first one failes it seems like 5 to 8 attempts are required.
  */
-#define NUM_ADDR_RESEND_ATTEMPTS 10
+#define NUM_ADDR_RESEND_ATTEMPTS 12
 
 /* I2C clock speed, in Hz 0-400kHz*/
 static unsigned int scl_frequency = 100000;
@@ -149,6 +150,7 @@ module_param(scl_frequency, uint,  0644);
  * @msg_index: index of current message
  * @msg_len: length of current message
  */
+
 struct stu300_dev {
         struct platform_device  *pdev;
         struct i2c_adapter      adapter;
@@ -188,6 +190,27 @@ static inline u32 stu300_r8(void __iomem *address)
         return readl(address) & 0x000000FFU;
 }
 
+static void stu300_irq_enable(struct stu300_dev *dev)
+{
+        u32 val;
+        val = stu300_r8(dev->virtbase + I2C_CR);
+        val |= I2C_CR_INTERRUPT_ENABLE;
+        /* Twice paranoia (possible HW glitch) */
+        stu300_wr8(val, dev->virtbase + I2C_CR);
+        stu300_wr8(val, dev->virtbase + I2C_CR);
+}
+
+static void stu300_irq_disable(struct stu300_dev *dev)
+{
+        u32 val;
+        val = stu300_r8(dev->virtbase + I2C_CR);
+        val &= ~I2C_CR_INTERRUPT_ENABLE;
+        /* Twice paranoia (possible HW glitch) */
+        stu300_wr8(val, dev->virtbase + I2C_CR);
+        stu300_wr8(val, dev->virtbase + I2C_CR);
+}
+
+
 /*
  * Tells whether a certain event or events occurred in
  * response to a command. The events represent states in
@@ -196,9 +219,10 @@ static inline u32 stu300_r8(void __iomem *address)
  * documentation and can only be treated as abstract state
  * machine states.
  *
- * @ret 0 = event has not occurred, any other value means
- * the event occurred.
+ * @ret 0 = event has not occurred or unknown error, any
+ * other value means the correct event occurred or an error.
  */
+
 static int stu300_event_occurred(struct stu300_dev *dev,
                                    enum stu300_event mr_event) {
         u32 status1;
@@ -206,11 +230,28 @@ static int stu300_event_occurred(struct stu300_dev *dev,
 
         /* What event happened? */
         status1 = stu300_r8(dev->virtbase + I2C_SR1);
+
         if (!(status1 & I2C_SR1_EVF_IND))
                 /* No event at all */
                 return 0;
+
         status2 = stu300_r8(dev->virtbase + I2C_SR2);
 
+        /* Block any multiple interrupts */
+        stu300_irq_disable(dev);
+
+        /* Check for errors first */
+        if (status2 & I2C_SR2_AF_IND) {
+                dev->cmd_err = STU300_ERROR_ACKNOWLEDGE_FAILURE;
+                return 1;
+        } else if (status2 & I2C_SR2_BERR_IND) {
+                dev->cmd_err = STU300_ERROR_BUS_ERROR;
+                return 1;
+        } else if (status2 & I2C_SR2_ARLO_IND) {
+                dev->cmd_err = STU300_ERROR_ARBITRATION_LOST;
+                return 1;
+        }
+
         switch (mr_event) {
         case STU300_EVENT_1:
                 if (status1 & I2C_SR1_ADSL_IND)
@@ -221,10 +262,6 @@ static int stu300_event_occurred(struct stu300_dev *dev,
         case STU300_EVENT_7:
         case STU300_EVENT_8:
                 if (status1 & I2C_SR1_BTF_IND) {
-                        if (status2 & I2C_SR2_AF_IND)
-                                dev->cmd_err = STU300_ERROR_ACKNOWLEDGE_FAILURE;
-                        else if (status2 & I2C_SR2_BERR_IND)
-                                dev->cmd_err = STU300_ERROR_BUS_ERROR;
                         return 1;
                 }
                 break;
@@ -240,8 +277,6 @@ static int stu300_event_occurred(struct stu300_dev *dev,
         case STU300_EVENT_6:
                 if (status2 & I2C_SR2_ENDAD_IND) {
                         /* First check for any errors */
-                        if (status2 & I2C_SR2_AF_IND)
-                                dev->cmd_err = STU300_ERROR_ACKNOWLEDGE_FAILURE;
                         return 1;
                 }
                 break;
@@ -252,8 +287,15 @@ static int stu300_event_occurred(struct stu300_dev *dev,
         default:
                 break;
         }
-        if (status2 & I2C_SR2_ARLO_IND)
-                dev->cmd_err = STU300_ERROR_ARBITRATION_LOST;
+        /* If we get here, we're on thin ice.
+         * Here we are in a status where we have
+         * gotten a response that does not match
+         * what we requested.
+         */
+        dev->cmd_err = STU300_ERROR_UNKNOWN;
+        dev_err(&dev->pdev->dev,
+                "Unhandled interrupt! %d sr1: 0x%x sr2: 0x%x\n",
+                mr_event, status1, status2);
         return 0;
 }
 
@@ -262,21 +304,20 @@ static irqreturn_t stu300_irh(int irq, void *data)
         struct stu300_dev *dev = data;
         int res;
 
+        /* Just make sure that the block is clocked */
+        clk_enable(dev->clk);
+
         /* See if this was what we were waiting for */
         spin_lock(&dev->cmd_issue_lock);
-        if (dev->cmd_event != STU300_EVENT_NONE) {
-                res = stu300_event_occurred(dev, dev->cmd_event);
-                if (res || dev->cmd_err != STU300_ERROR_NONE) {
-                        u32 val;
-
-                        complete(&dev->cmd_complete);
-                        /* Block any multiple interrupts */
-                        val = stu300_r8(dev->virtbase + I2C_CR);
-                        val &= ~I2C_CR_INTERRUPT_ENABLE;
-                        stu300_wr8(val, dev->virtbase + I2C_CR);
-                }
-        }
+
+        res = stu300_event_occurred(dev, dev->cmd_event);
+        if (res || dev->cmd_err != STU300_ERROR_NONE)
+                complete(&dev->cmd_complete);
+
         spin_unlock(&dev->cmd_issue_lock);
+
+        clk_disable(dev->clk);
+
         return IRQ_HANDLED;
 }
 
@@ -308,7 +349,6 @@ static int stu300_start_and_await_event(struct stu300_dev *dev,
         stu300_wr8(cr_value, dev->virtbase + I2C_CR);
         ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
                                                         STU300_TIMEOUT);
-
         if (ret < 0) {
                 dev_err(&dev->pdev->dev,
                        "wait_for_completion_interruptible_timeout() "
@@ -342,7 +382,6 @@ static int stu300_await_event(struct stu300_dev *dev,
                                 enum stu300_event mr_event)
 {
         int ret;
-        u32 val;
 
         if (unlikely(irqs_disabled())) {
                 /* TODO: implement polling for this case if need be. */
@@ -354,36 +393,18 @@ static int stu300_await_event(struct stu300_dev *dev,
         /* Is it already here? */
         spin_lock_irq(&dev->cmd_issue_lock);
         dev->cmd_err = STU300_ERROR_NONE;
-        if (stu300_event_occurred(dev, mr_event)) {
-                spin_unlock_irq(&dev->cmd_issue_lock);
-                goto exit_await_check_err;
-        }
-        init_completion(&dev->cmd_complete);
-        dev->cmd_err = STU300_ERROR_NONE;
         dev->cmd_event = mr_event;
 
-        /* Turn on the I2C interrupt for current operation */
-        val = stu300_r8(dev->virtbase + I2C_CR);
-        val |= I2C_CR_INTERRUPT_ENABLE;
-        stu300_wr8(val, dev->virtbase + I2C_CR);
-
-        /* Twice paranoia (possible HW glitch) */
-        stu300_wr8(val, dev->virtbase + I2C_CR);
+        init_completion(&dev->cmd_complete);
 
-        /* Check again: is it already here? */
-        if (unlikely(stu300_event_occurred(dev, mr_event))) {
-                /* Disable IRQ again. */
-                val &= ~I2C_CR_INTERRUPT_ENABLE;
-                stu300_wr8(val, dev->virtbase + I2C_CR);
-                spin_unlock_irq(&dev->cmd_issue_lock);
-                goto exit_await_check_err;
-        }
+        /* Turn on the I2C interrupt for current operation */
+        stu300_irq_enable(dev);
 
         /* Unlock the command block and wait for the event to occur */
         spin_unlock_irq(&dev->cmd_issue_lock);
+
         ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
                                                         STU300_TIMEOUT);
-
         if (ret < 0) {
                 dev_err(&dev->pdev->dev,
                        "wait_for_completion_interruptible_timeout()"
@@ -401,7 +422,6 @@ static int stu300_await_event(struct stu300_dev *dev,
                 return -ETIMEDOUT;
         }
 
- exit_await_check_err:
         if (dev->cmd_err != STU300_ERROR_NONE) {
                 if (mr_event != STU300_EVENT_6) {
                         dev_err(&dev->pdev->dev, "controller "
@@ -457,18 +477,19 @@ struct stu300_clkset {
 };
 
 static const struct stu300_clkset stu300_clktable[] = {
-        { 0, 0xFFU },
-        { 2500000, I2C_OAR2_FR_25_10MHZ },
-        { 10000000, I2C_OAR2_FR_10_1667MHZ },
-        { 16670000, I2C_OAR2_FR_1667_2667MHZ },
-        { 26670000, I2C_OAR2_FR_2667_40MHZ },
-        { 40000000, I2C_OAR2_FR_40_5333MHZ },
-        { 53330000, I2C_OAR2_FR_5333_66MHZ },
-        { 66000000, I2C_OAR2_FR_66_80MHZ },
-        { 80000000, I2C_OAR2_FR_80_100MHZ },
+        { 0,         0xFFU },
+        { 2500000,   I2C_OAR2_FR_25_10MHZ },
+        { 10000000,  I2C_OAR2_FR_10_1667MHZ },
+        { 16670000,  I2C_OAR2_FR_1667_2667MHZ },
+        { 26670000,  I2C_OAR2_FR_2667_40MHZ },
+        { 40000000,  I2C_OAR2_FR_40_5333MHZ },
+        { 53330000,  I2C_OAR2_FR_5333_66MHZ },
+        { 66000000,  I2C_OAR2_FR_66_80MHZ },
+        { 80000000,  I2C_OAR2_FR_80_100MHZ },
         { 100000000, 0xFFU },
 };
 
+
 static int stu300_set_clk(struct stu300_dev *dev, unsigned long clkrate)
 {
 
@@ -494,10 +515,10 @@ static int stu300_set_clk(struct stu300_dev *dev, unsigned long clkrate)
 
         if (dev->speed > 100000)
                 /* Fast Mode I2C */
-                val = ((clkrate/dev->speed)-9)/3;
+                val = ((clkrate/dev->speed) - 9)/3 + 1;
         else
                 /* Standard Mode I2C */
-                val = ((clkrate/dev->speed)-7)/2;
+                val = ((clkrate/dev->speed) - 7)/2 + 1;
 
         /* According to spec the divider must be > 2 */
         if (val < 0x002) {
@@ -557,6 +578,7 @@ static int stu300_init_hw(struct stu300_dev *dev)
          */
         clkrate = clk_get_rate(dev->clk);
         ret = stu300_set_clk(dev, clkrate);
+
         if (ret)
                 return ret;
         /*
@@ -641,7 +663,6 @@ static int stu300_xfer_msg(struct i2c_adapter *adap,
         int attempts = 0;
         struct stu300_dev *dev = i2c_get_adapdata(adap);
 
-
         clk_enable(dev->clk);
 
         /* Remove this if (0) to trace each and every message. */
@@ -715,14 +736,15 @@ static int stu300_xfer_msg(struct i2c_adapter *adap,
 
         if (attempts < NUM_ADDR_RESEND_ATTEMPTS && attempts > 0) {
                 dev_dbg(&dev->pdev->dev, "managed to get address "
-                       "through after %d attempts\n", attempts);
+                        "through after %d attempts\n", attempts);
         } else if (attempts == NUM_ADDR_RESEND_ATTEMPTS) {
                 dev_dbg(&dev->pdev->dev, "I give up, tried %d times "
-                       "to resend address.\n",
-                       NUM_ADDR_RESEND_ATTEMPTS);
+                        "to resend address.\n",
+                        NUM_ADDR_RESEND_ATTEMPTS);
                 goto exit_disable;
         }
 
+
         if (msg->flags & I2C_M_RD) {
                 /* READ: we read the actual bytes one at a time */
                 for (i = 0; i < msg->len; i++) {
@@ -804,8 +826,10 @@ static int stu300_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
 {
         int ret = -1;
         int i;
+
         struct stu300_dev *dev = i2c_get_adapdata(adap);
         dev->msg_len = num;
+
         for (i = 0; i < num; i++) {
                 /*
                  * Another driver appears to send stop for each message,
@@ -817,6 +841,7 @@ static int stu300_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
                 dev->msg_index = i;
 
                 ret = stu300_xfer_msg(adap, &msgs[i], (i == (num - 1)));
+
                 if (ret != 0) {
                         num = ret;
                         break;
@@ -845,6 +870,7 @@ stu300_probe(struct platform_device *pdev)
         struct resource *res;
         int bus_nr;
         int ret = 0;
+        char clk_name[] = "I2C0";
 
         dev = kzalloc(sizeof(struct stu300_dev), GFP_KERNEL);
         if (!dev) {
@@ -854,7 +880,8 @@ stu300_probe(struct platform_device *pdev)
         }
 
         bus_nr = pdev->id;
-        dev->clk = clk_get(&pdev->dev, NULL);
+        clk_name[3] += (char)bus_nr;
+        dev->clk = clk_get(&pdev->dev, clk_name);
         if (IS_ERR(dev->clk)) {
                 ret = PTR_ERR(dev->clk);
                 dev_err(&pdev->dev, "could not retrieve i2c bus clock\n");
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 4cfd084fa897..9a1d55b74d7a 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -456,8 +456,11 @@ static int joydev_ioctl_common(struct joydev *joydev,
                                 unsigned int cmd, void __user *argp)
 {
         struct input_dev *dev = joydev->handle.dev;
+        size_t len;
         int i, j;
+        const char *name;
 
+        /* Process fixed-sized commands. */
         switch (cmd) {
 
         case JS_SET_CAL:
@@ -499,9 +502,22 @@ static int joydev_ioctl_common(struct joydev *joydev,
                 return copy_to_user(argp, joydev->corr,
                         sizeof(joydev->corr[0]) * joydev->nabs) ? -EFAULT : 0;
 
-        case JSIOCSAXMAP:
-                if (copy_from_user(joydev->abspam, argp,
-                                   sizeof(__u8) * (ABS_MAX + 1)))
+        }
+
+        /*
+         * Process variable-sized commands (the axis and button map commands
+         * are considered variable-sized to decouple them from the values of
+         * ABS_MAX and KEY_MAX).
+         */
+        switch (cmd & ~IOCSIZE_MASK) {
+
+        case (JSIOCSAXMAP & ~IOCSIZE_MASK):
+                len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam));
+                /*
+                 * FIXME: we should not copy into our axis map before
+                 * validating the data.
+                 */
+                if (copy_from_user(joydev->abspam, argp, len))
                         return -EFAULT;
 
                 for (i = 0; i < joydev->nabs; i++) {
@@ -511,13 +527,17 @@ static int joydev_ioctl_common(struct joydev *joydev,
                 }
                 return 0;
 
-        case JSIOCGAXMAP:
-                return copy_to_user(argp, joydev->abspam,
-                        sizeof(__u8) * (ABS_MAX + 1)) ? -EFAULT : 0;
-
-        case JSIOCSBTNMAP:
-                if (copy_from_user(joydev->keypam, argp,
-                                   sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)))
+        case (JSIOCGAXMAP & ~IOCSIZE_MASK):
+                len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam));
+                return copy_to_user(argp, joydev->abspam, len) ? -EFAULT : 0;
+
+        case (JSIOCSBTNMAP & ~IOCSIZE_MASK):
+                len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam));
+                /*
+                 * FIXME: we should not copy into our keymap before
+                 * validating the data.
+                 */
+                if (copy_from_user(joydev->keypam, argp, len))
                         return -EFAULT;
 
                 for (i = 0; i < joydev->nkey; i++) {
@@ -529,25 +549,19 @@ static int joydev_ioctl_common(struct joydev *joydev,
 
                 return 0;
 
-        case JSIOCGBTNMAP:
-                return copy_to_user(argp, joydev->keypam,
-                        sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)) ? -EFAULT : 0;
+        case (JSIOCGBTNMAP & ~IOCSIZE_MASK):
+                len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam));
+                return copy_to_user(argp, joydev->keypam, len) ? -EFAULT : 0;
 
-        default:
-                if ((cmd & ~IOCSIZE_MASK) == JSIOCGNAME(0)) {
-                        int len;
-                        const char *name = dev->name;
-
-                        if (!name)
-                                return 0;
-                        len = strlen(name) + 1;
-                        if (len > _IOC_SIZE(cmd))
-                                len = _IOC_SIZE(cmd);
-                        if (copy_to_user(argp, name, len))
-                                return -EFAULT;
-                        return len;
-                }
+        case JSIOCGNAME(0):
+                name = dev->name;
+                if (!name)
+                        return 0;
+
+                len = min_t(size_t, _IOC_SIZE(cmd), strlen(name) + 1);
+                return copy_to_user(argp, name, len) ? -EFAULT : len;
         }
+
         return -EINVAL;
 }
 
diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index baabf8302645..f6c688cae334 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -74,6 +74,7 @@ static struct iforce_device iforce_device[] = {
         { 0x05ef, 0x8884, "AVB Mag Turbo Force",                        btn_avb_wheel, abs_wheel, ff_iforce },
         { 0x05ef, 0x8888, "AVB Top Shot Force Feedback Racing Wheel",   btn_avb_tw, abs_wheel, ff_iforce }, //?
         { 0x061c, 0xc0a4, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce }, //?
+        { 0x061c, 0xc084, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce },
         { 0x06f8, 0x0001, "Guillemot Race Leader Force Feedback",       btn_wheel, abs_wheel, ff_iforce }, //?
         { 0x06f8, 0x0004, "Guillemot Force Feedback Racing Wheel",      btn_wheel, abs_wheel, ff_iforce }, //?
         { 0x06f8, 0x0004, "Gullemot Jet Leader 3D",                     btn_joystick, abs_joystick, ff_iforce }, //?
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index f83185aeb511..9f289d8f52c6 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -223,6 +223,7 @@ static struct usb_device_id iforce_usb_ids [] = {
         { USB_DEVICE(0x05ef, 0x8884) },         /* AVB Mag Turbo Force */
         { USB_DEVICE(0x05ef, 0x8888) },         /* AVB Top Shot FFB Racing Wheel */
         { USB_DEVICE(0x061c, 0xc0a4) },         /* ACT LABS Force RS */
+        { USB_DEVICE(0x061c, 0xc084) },         /* ACT LABS Force RS */
         { USB_DEVICE(0x06f8, 0x0001) },         /* Guillemot Race Leader Force Feedback */
         { USB_DEVICE(0x06f8, 0x0004) },         /* Guillemot Force Feedback Racing Wheel */
         { USB_DEVICE(0x06f8, 0xa302) },         /* Guillemot Jet Leader 3D */
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index a9d5031b855e..ea30c983a33e 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -388,6 +388,32 @@ static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hi
         return result;
 }
 
+static int wacom_query_tablet_data(struct usb_interface *intf)
+{
+        unsigned char *rep_data;
+        int limit = 0;
+        int error;
+
+        rep_data = kmalloc(2, GFP_KERNEL);
+        if (!rep_data)
+                return -ENOMEM;
+
+        do {
+                rep_data[0] = 2;
+                rep_data[1] = 2;
+                error = usb_set_report(intf, WAC_HID_FEATURE_REPORT,
+                                        2, rep_data, 2);
+                if (error >= 0)
+                        error = usb_get_report(intf,
+                                                WAC_HID_FEATURE_REPORT, 2,
+                                                rep_data, 2);
+        } while ((error < 0 || rep_data[1] != 2) && limit++ < 5);
+
+        kfree(rep_data);
+
+        return error < 0 ? error : 0;
+}
+
 static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
         struct usb_device *dev = interface_to_usbdev(intf);
@@ -398,7 +424,6 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
         struct wacom_features *features;
         struct input_dev *input_dev;
         int error = -ENOMEM;
-        char rep_data[2], limit = 0;
         struct hid_descriptor *hid_desc;
 
         wacom = kzalloc(sizeof(struct wacom), GFP_KERNEL);
@@ -489,20 +514,10 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
 
         /*
          * Ask the tablet to report tablet data if it is not a Tablet PC.
-         * Repeat until it succeeds
+         * Note that if query fails it is not a hard failure.
          */
-        if (wacom_wac->features->type != TABLETPC) {
-                do {
-                        rep_data[0] = 2;
-                        rep_data[1] = 2;
-                        error = usb_set_report(intf, WAC_HID_FEATURE_REPORT,
-                                                2, rep_data, 2);
-                        if (error >= 0)
-                                error = usb_get_report(intf,
-                                                WAC_HID_FEATURE_REPORT, 2,
-                                                rep_data, 2);
-                } while ((error < 0 || rep_data[1] != 2) && limit++ < 5);
-        }
+        if (wacom_wac->features->type != TABLETPC)
+                wacom_query_tablet_data(intf);
 
         usb_set_intfdata(intf, wacom);
         return 0;
diff --git a/drivers/input/touchscreen/ucb1400_ts.c b/drivers/input/touchscreen/ucb1400_ts.c
index 6954f5500108..3a7a58222f83 100644
--- a/drivers/input/touchscreen/ucb1400_ts.c
+++ b/drivers/input/touchscreen/ucb1400_ts.c
@@ -170,11 +170,11 @@ static void ucb1400_handle_pending_irq(struct ucb1400_ts *ucb)
         ucb1400_reg_write(ucb->ac97, UCB_IE_CLEAR, isr);
         ucb1400_reg_write(ucb->ac97, UCB_IE_CLEAR, 0);
 
-        if (isr & UCB_IE_TSPX) {
+        if (isr & UCB_IE_TSPX)
                 ucb1400_ts_irq_disable(ucb->ac97);
-                enable_irq(ucb->irq);
-        } else
-                printk(KERN_ERR "ucb1400: unexpected IE_STATUS = %#x\n", isr);
+        else
+                dev_dbg(&ucb->ts_idev->dev, "ucb1400: unexpected IE_STATUS = %#x\n", isr);
+        enable_irq(ucb->irq);
 }
 
 static int ucb1400_ts_thread(void *_ucb)
@@ -345,6 +345,7 @@ static int ucb1400_ts_detect_irq(struct ucb1400_ts *ucb)
 static int ucb1400_ts_probe(struct platform_device *dev)
 {
         int error, x_res, y_res;
+        u16 fcsr;
         struct ucb1400_ts *ucb = dev->dev.platform_data;
 
         ucb->ts_idev = input_allocate_device();
@@ -382,6 +383,14 @@ static int ucb1400_ts_probe(struct platform_device *dev)
         ucb->ts_idev->evbit[0]          = BIT_MASK(EV_ABS) | BIT_MASK(EV_KEY);
         ucb->ts_idev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
 
+        /*
+         * Enable ADC filter to prevent horrible jitter on Colibri.
+         * This also further reduces jitter on boards where ADCSYNC
+         * pin is connected.
+         */
+        fcsr = ucb1400_reg_read(ucb->ac97, UCB_FCSR);
+        ucb1400_reg_write(ucb->ac97, UCB_FCSR, fcsr | UCB_FCSR_AVE);
+
         ucb1400_adc_enable(ucb->ac97);
         x_res = ucb1400_ts_read_xres(ucb);
         y_res = ucb1400_ts_read_yres(ucb);
diff --git a/drivers/leds/ledtrig-gpio.c b/drivers/leds/ledtrig-gpio.c
index a247ae63374f..1bc5db4ece0d 100644
--- a/drivers/leds/ledtrig-gpio.c
+++ b/drivers/leds/ledtrig-gpio.c
@@ -117,6 +117,9 @@ static ssize_t gpio_trig_inverted_store(struct device *dev,
 
         gpio_data->inverted = !!inverted;
 
+        /* After inverting, we need to update the LED. */
+        schedule_work(&gpio_data->work);
+
         return n;
 }
 static DEVICE_ATTR(inverted, 0644, gpio_trig_inverted_show,
@@ -146,20 +149,26 @@ static ssize_t gpio_trig_gpio_store(struct device *dev,
                 return -EINVAL;
         }
 
+        if (gpio_data->gpio == gpio)
+                return n;
+
         if (!gpio) {
-                free_irq(gpio_to_irq(gpio_data->gpio), led);
+                if (gpio_data->gpio != 0)
+                        free_irq(gpio_to_irq(gpio_data->gpio), led);
+                gpio_data->gpio = 0;
                 return n;
         }
 
-        if (gpio_data->gpio > 0 && gpio_data->gpio != gpio)
-                free_irq(gpio_to_irq(gpio_data->gpio), led);
-
-        gpio_data->gpio = gpio;
         ret = request_irq(gpio_to_irq(gpio), gpio_trig_irq,
                         IRQF_SHARED | IRQF_TRIGGER_RISING
                         | IRQF_TRIGGER_FALLING, "ledtrig-gpio", led);
-        if (ret)
+        if (ret) {
                 dev_err(dev, "request_irq failed with error %d\n", ret);
+        } else {
+                if (gpio_data->gpio != 0)
+                        free_irq(gpio_to_irq(gpio_data->gpio), led);
+                gpio_data->gpio = gpio;
+        }
 
         return ret ? ret : n;
 }
@@ -211,7 +220,8 @@ static void gpio_trig_deactivate(struct led_classdev *led)
                 device_remove_file(led->dev, &dev_attr_inverted);
                 device_remove_file(led->dev, &dev_attr_desired_brightness);
                 flush_work(&gpio_data->work);
-                free_irq(gpio_to_irq(gpio_data->gpio),led);
+                if (gpio_data->gpio != 0)
+                        free_irq(gpio_to_irq(gpio_data->gpio), led);
                 kfree(gpio_data);
         }
 }
diff --git a/drivers/macintosh/via-maciisi.c b/drivers/macintosh/via-maciisi.c
index 4d686c0bdea0..9ab5b0c34f0d 100644
--- a/drivers/macintosh/via-maciisi.c
+++ b/drivers/macintosh/via-maciisi.c
@@ -288,7 +288,7 @@ static void maciisi_sync(struct adb_request *req)
         }
         /* This could be BAD... when the ADB controller doesn't respond
          * for this long, it's probably not coming back :-( */
-        if(count >= 50) /* Hopefully shouldn't happen */
+        if (count > 50) /* Hopefully shouldn't happen */
                 printk(KERN_ERR "maciisi_send_request: poll timed out!\n");
 }
 
diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
index 0ca1ee768a1f..8ce74d95ae4d 100644
--- a/drivers/md/dm-log-userspace-transfer.c
+++ b/drivers/md/dm-log-userspace-transfer.c
@@ -108,7 +108,7 @@ static int fill_pkg(struct cn_msg *msg, struct dm_ulog_request *tfr)
                                 *(pkg->data_size) = 0;
                 } else if (tfr->data_size > *(pkg->data_size)) {
                         DMERR("Insufficient space to receive package [%u] "
-                              "(%u vs %lu)", tfr->request_type,
+                              "(%u vs %zu)", tfr->request_type,
                               tfr->data_size, *(pkg->data_size));
 
                         *(pkg->data_size) = 0;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 5b98bea4ff9b..9dd872000cec 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -359,6 +359,7 @@ static mddev_t * mddev_find(dev_t unit)
         else
                 new->md_minor = MINOR(unit) >> MdpMinorShift;
 
+        mutex_init(&new->open_mutex);
         mutex_init(&new->reconfig_mutex);
         INIT_LIST_HEAD(&new->disks);
         INIT_LIST_HEAD(&new->all_mddevs);
@@ -1974,17 +1975,14 @@ repeat:
                 /* otherwise we have to go forward and ... */
                 mddev->events ++;
                 if (!mddev->in_sync || mddev->recovery_cp != MaxSector) { /* not clean */
-                        /* .. if the array isn't clean, insist on an odd 'events' */
-                        if ((mddev->events&1)==0) {
-                                mddev->events++;
+                        /* .. if the array isn't clean, an 'even' event must also go
+                         * to spares. */
+                        if ((mddev->events&1)==0)
                                 nospares = 0;
-                        }
                 } else {
-                        /* otherwise insist on an even 'events' (for clean states) */
-                        if ((mddev->events&1)) {
-                                mddev->events++;
+                        /* otherwise an 'odd' event must go to spares */
+                        if ((mddev->events&1))
                                 nospares = 0;
-                        }
                 }
         }
 
@@ -3601,6 +3599,7 @@ max_sync_store(mddev_t *mddev, const char *buf, size_t len)
                 if (max < mddev->resync_min)
                         return -EINVAL;
                 if (max < mddev->resync_max &&
+                    mddev->ro == 0 &&
                     test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
                         return -EBUSY;
 
@@ -4304,12 +4303,11 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
         struct gendisk *disk = mddev->gendisk;
         mdk_rdev_t *rdev;
 
+        mutex_lock(&mddev->open_mutex);
         if (atomic_read(&mddev->openers) > is_open) {
                 printk("md: %s still in use.\n",mdname(mddev));
-                return -EBUSY;
-        }
-
-        if (mddev->pers) {
+                err = -EBUSY;
+        } else if (mddev->pers) {
 
                 if (mddev->sync_thread) {
                         set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
@@ -4366,8 +4364,12 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                 if (mode == 1)
                         set_disk_ro(disk, 1);
                 clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                err = 0;
         }
-
+out:
+        mutex_unlock(&mddev->open_mutex);
+        if (err)
+                return err;
         /*
          * Free resources if final stop
          */
@@ -4433,7 +4435,6 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
         blk_integrity_unregister(disk);
         md_new_event(mddev);
         sysfs_notify_dirent(mddev->sysfs_state);
-out:
         return err;
 }
 
@@ -5518,12 +5519,12 @@ static int md_open(struct block_device *bdev, fmode_t mode)
         }
         BUG_ON(mddev != bdev->bd_disk->private_data);
 
-        if ((err = mutex_lock_interruptible_nested(&mddev->reconfig_mutex, 1)))
+        if ((err = mutex_lock_interruptible(&mddev->open_mutex)))
                 goto out;
 
         err = 0;
         atomic_inc(&mddev->openers);
-        mddev_unlock(mddev);
+        mutex_unlock(&mddev->open_mutex);
 
         check_disk_change(bdev);
  out:
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 78f03168baf9..f8fc188bc762 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -223,6 +223,16 @@ struct mddev_s
                                                             * so we don't loop trying */
 
         int                             in_sync;        /* know to not need resync */
+        /* 'open_mutex' avoids races between 'md_open' and 'do_md_stop', so
+         * that we are never stopping an array while it is open.
+         * 'reconfig_mutex' protects all other reconfiguration.
+         * These locks are separate due to conflicting interactions
+         * with bdev->bd_mutex.
+         * Lock ordering is:
+         *  reconfig_mutex -> bd_mutex : e.g. do_md_run -> revalidate_disk
+         *  bd_mutex -> open_mutex:  e.g. __blkdev_get -> md_open
+         */
+        struct mutex                    open_mutex;
         struct mutex                    reconfig_mutex;
         atomic_t                        active;         /* general refcount */
         atomic_t                        openers;        /* number of active opens */
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 2b521ee67dfa..b8a2c5dc67ba 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3785,7 +3785,7 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
                     conf->reshape_progress < raid5_size(mddev, 0, 0)) {
                         sector_nr = raid5_size(mddev, 0, 0)
                                 - conf->reshape_progress;
-                } else if (mddev->delta_disks > 0 &&
+                } else if (mddev->delta_disks >= 0 &&
                            conf->reshape_progress > 0)
                         sector_nr = conf->reshape_progress;
                 sector_div(sector_nr, new_data_disks);
@@ -4509,7 +4509,26 @@ static int run(mddev_t *mddev)
                            (old_disks-max_degraded));
                 /* here_old is the first stripe that we might need to read
                  * from */
-                if (here_new >= here_old) {
+                if (mddev->delta_disks == 0) {
+                        /* We cannot be sure it is safe to start an in-place
+                         * reshape.  It is only safe if user-space if monitoring
+                         * and taking constant backups.
+                         * mdadm always starts a situation like this in
+                         * readonly mode so it can take control before
+                         * allowing any writes.  So just check for that.
+                         */
+                        if ((here_new * mddev->new_chunk_sectors != 
+                             here_old * mddev->chunk_sectors) ||
+                            mddev->ro == 0) {
+                                printk(KERN_ERR "raid5: in-place reshape must be started"
+                                       " in read-only mode - aborting\n");
+                                return -EINVAL;
+                        }
+                } else if (mddev->delta_disks < 0
+                    ? (here_new * mddev->new_chunk_sectors <=
+                       here_old * mddev->chunk_sectors)
+                    : (here_new * mddev->new_chunk_sectors >=
+                       here_old * mddev->chunk_sectors)) {
                         /* Reading from the same stripe as writing to - bad */
                         printk(KERN_ERR "raid5: reshape_position too early for "
                                "auto-recovery - aborting.\n");
@@ -5078,8 +5097,15 @@ static void raid5_finish_reshape(mddev_t *mddev)
                                         mddev->degraded--;
                         for (d = conf->raid_disks ;
                              d < conf->raid_disks - mddev->delta_disks;
-                             d++)
-                                raid5_remove_disk(mddev, d);
+                             d++) {
+                                mdk_rdev_t *rdev = conf->disks[d].rdev;
+                                if (rdev && raid5_remove_disk(mddev, d) == 0) {
+                                        char nm[20];
+                                        sprintf(nm, "rd%d", rdev->raid_disk);
+                                        sysfs_remove_link(&mddev->kobj, nm);
+                                        rdev->raid_disk = -1;
+                                }
+                        }
                 }
                 mddev->layout = conf->algorithm;
                 mddev->chunk_sectors = conf->chunk_sectors;
diff --git a/drivers/media/common/tuners/qt1010.c b/drivers/media/common/tuners/qt1010.c
index 825aa1412e6f..9f5dba244cb8 100644
--- a/drivers/media/common/tuners/qt1010.c
+++ b/drivers/media/common/tuners/qt1010.c
@@ -64,24 +64,22 @@ static int qt1010_writereg(struct qt1010_priv *priv, u8 reg, u8 val)
 /* dump all registers */
 static void qt1010_dump_regs(struct qt1010_priv *priv)
 {
-        char buf[52], buf2[4];
         u8 reg, val;
 
         for (reg = 0; ; reg++) {
                 if (reg % 16 == 0) {
                         if (reg)
-                                printk("%s\n", buf);
-                        sprintf(buf, "%02x: ", reg);
+                                printk(KERN_CONT "\n");
+                        printk(KERN_DEBUG "%02x:", reg);
                 }
                 if (qt1010_readreg(priv, reg, &val) == 0)
-                        sprintf(buf2, "%02x ", val);
+                        printk(KERN_CONT " %02x", val);
                 else
-                        strcpy(buf2, "-- ");
-                strcat(buf, buf2);
+                        printk(KERN_CONT " --");
                 if (reg == 0x2f)
                         break;
         }
-        printk("%s\n", buf);
+        printk(KERN_CONT "\n");
 }
 
 static int qt1010_set_params(struct dvb_frontend *fe,
diff --git a/drivers/media/common/tuners/tuner-xc2028.c b/drivers/media/common/tuners/tuner-xc2028.c
index aa20ce8cc668..f270e605da83 100644
--- a/drivers/media/common/tuners/tuner-xc2028.c
+++ b/drivers/media/common/tuners/tuner-xc2028.c
@@ -1119,8 +1119,8 @@ static int xc2028_sleep(struct dvb_frontend *fe)
         struct xc2028_data *priv = fe->tuner_priv;
         int rc = 0;
 
-        /* Avoid firmware reload on slow devices */
-        if (no_poweroff)
+        /* Avoid firmware reload on slow devices or if PM disabled */
+        if (no_poweroff || priv->ctrl.disable_power_mgmt)
                 return 0;
 
         tuner_dbg("Putting xc2028/3028 into poweroff mode.\n");
diff --git a/drivers/media/common/tuners/tuner-xc2028.h b/drivers/media/common/tuners/tuner-xc2028.h
index 19de7928a74e..a90c35d50add 100644
--- a/drivers/media/common/tuners/tuner-xc2028.h
+++ b/drivers/media/common/tuners/tuner-xc2028.h
@@ -38,6 +38,7 @@ struct xc2028_ctrl {
         unsigned int            input1:1;
         unsigned int            vhfbw7:1;
         unsigned int            uhfbw8:1;
+        unsigned int            disable_power_mgmt:1;
         unsigned int            demod;
         enum firmware_type      type:2;
 };
diff --git a/drivers/media/dvb/dvb-usb/af9015.c b/drivers/media/dvb/dvb-usb/af9015.c
index 4cb31e7c13c2..26690dfb3260 100644
--- a/drivers/media/dvb/dvb-usb/af9015.c
+++ b/drivers/media/dvb/dvb-usb/af9015.c
@@ -81,7 +81,6 @@ static int af9015_rw_udev(struct usb_device *udev, struct req_t *req)
 
         switch (req->cmd) {
         case GET_CONFIG:
-        case BOOT:
         case READ_MEMORY:
         case RECONNECT_USB:
         case GET_IR_CODE:
@@ -100,6 +99,7 @@ static int af9015_rw_udev(struct usb_device *udev, struct req_t *req)
         case WRITE_VIRTUAL_MEMORY:
         case COPY_FIRMWARE:
         case DOWNLOAD_FIRMWARE:
+        case BOOT:
                 break;
         default:
                 err("unknown command:%d", req->cmd);
diff --git a/drivers/media/dvb/frontends/cx22700.c b/drivers/media/dvb/frontends/cx22700.c
index ace5cb17165d..fbd838eca268 100644
--- a/drivers/media/dvb/frontends/cx22700.c
+++ b/drivers/media/dvb/frontends/cx22700.c
@@ -380,7 +380,7 @@ struct dvb_frontend* cx22700_attach(const struct cx22700_config* config,
         struct cx22700_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct cx22700_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct cx22700_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/cx22702.c b/drivers/media/dvb/frontends/cx22702.c
index 5d1abe34bddb..00b5c7e91d5d 100644
--- a/drivers/media/dvb/frontends/cx22702.c
+++ b/drivers/media/dvb/frontends/cx22702.c
@@ -580,7 +580,7 @@ struct dvb_frontend *cx22702_attach(const struct cx22702_config *config,
         struct cx22702_state *state = NULL;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct cx22702_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct cx22702_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/cx24110.c b/drivers/media/dvb/frontends/cx24110.c
index 87ae29db024f..ffbcfabd83f0 100644
--- a/drivers/media/dvb/frontends/cx24110.c
+++ b/drivers/media/dvb/frontends/cx24110.c
@@ -598,7 +598,7 @@ struct dvb_frontend* cx24110_attach(const struct cx24110_config* config,
         int ret;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct cx24110_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct cx24110_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/dvb_dummy_fe.c b/drivers/media/dvb/frontends/dvb_dummy_fe.c
index db8a937cc630..a7fc7e53a551 100644
--- a/drivers/media/dvb/frontends/dvb_dummy_fe.c
+++ b/drivers/media/dvb/frontends/dvb_dummy_fe.c
@@ -117,7 +117,7 @@ struct dvb_frontend* dvb_dummy_fe_ofdm_attach(void)
         struct dvb_dummy_fe_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* create dvb_frontend */
@@ -137,7 +137,7 @@ struct dvb_frontend *dvb_dummy_fe_qpsk_attach(void)
         struct dvb_dummy_fe_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* create dvb_frontend */
@@ -157,7 +157,7 @@ struct dvb_frontend *dvb_dummy_fe_qam_attach(void)
         struct dvb_dummy_fe_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* create dvb_frontend */
diff --git a/drivers/media/dvb/frontends/l64781.c b/drivers/media/dvb/frontends/l64781.c
index e1e70e9e0cb9..3051b64aa17c 100644
--- a/drivers/media/dvb/frontends/l64781.c
+++ b/drivers/media/dvb/frontends/l64781.c
@@ -501,7 +501,7 @@ struct dvb_frontend* l64781_attach(const struct l64781_config* config,
                            { .addr = config->demod_address, .flags = I2C_M_RD, .buf = b1, .len = 1 } };
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct l64781_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct l64781_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/lgs8gl5.c b/drivers/media/dvb/frontends/lgs8gl5.c
index 855852fddf22..bb37ed289a05 100644
--- a/drivers/media/dvb/frontends/lgs8gl5.c
+++ b/drivers/media/dvb/frontends/lgs8gl5.c
@@ -387,7 +387,7 @@ lgs8gl5_attach(const struct lgs8gl5_config *config, struct i2c_adapter *i2c)
         dprintk("%s\n", __func__);
 
         /* Allocate memory for the internal state */
-        state = kmalloc(sizeof(struct lgs8gl5_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct lgs8gl5_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/mt312.c b/drivers/media/dvb/frontends/mt312.c
index a621f727935f..f69daaac78c9 100644
--- a/drivers/media/dvb/frontends/mt312.c
+++ b/drivers/media/dvb/frontends/mt312.c
@@ -782,7 +782,7 @@ struct dvb_frontend *mt312_attach(const struct mt312_config *config,
         struct mt312_state *state = NULL;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct mt312_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct mt312_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/nxt6000.c b/drivers/media/dvb/frontends/nxt6000.c
index 0eef22dbf8a0..a763ec756f7f 100644
--- a/drivers/media/dvb/frontends/nxt6000.c
+++ b/drivers/media/dvb/frontends/nxt6000.c
@@ -545,7 +545,7 @@ struct dvb_frontend* nxt6000_attach(const struct nxt6000_config* config,
         struct nxt6000_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct nxt6000_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct nxt6000_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/or51132.c b/drivers/media/dvb/frontends/or51132.c
index 8133ea3cddd7..38e67accb8c3 100644
--- a/drivers/media/dvb/frontends/or51132.c
+++ b/drivers/media/dvb/frontends/or51132.c
@@ -562,7 +562,7 @@ struct dvb_frontend* or51132_attach(const struct or51132_config* config,
         struct or51132_state* state = NULL;
 
         /* Allocate memory for the internal state */
-        state = kmalloc(sizeof(struct or51132_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct or51132_state), GFP_KERNEL);
         if (state == NULL)
                 return NULL;
 
diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
index 16cf2fdd5d7d..c709ce6771c8 100644
--- a/drivers/media/dvb/frontends/or51211.c
+++ b/drivers/media/dvb/frontends/or51211.c
@@ -527,7 +527,7 @@ struct dvb_frontend* or51211_attach(const struct or51211_config* config,
         struct or51211_state* state = NULL;
 
         /* Allocate memory for the internal state */
-        state = kmalloc(sizeof(struct or51211_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct or51211_state), GFP_KERNEL);
         if (state == NULL)
                 return NULL;
 
diff --git a/drivers/media/dvb/frontends/s5h1409.c b/drivers/media/dvb/frontends/s5h1409.c
index 3e08d985d6e5..fb3011518427 100644
--- a/drivers/media/dvb/frontends/s5h1409.c
+++ b/drivers/media/dvb/frontends/s5h1409.c
@@ -796,7 +796,7 @@ struct dvb_frontend *s5h1409_attach(const struct s5h1409_config *config,
         u16 reg;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct s5h1409_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct s5h1409_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/s5h1411.c b/drivers/media/dvb/frontends/s5h1411.c
index 66e2dd6d6fe4..d8adf1e32019 100644
--- a/drivers/media/dvb/frontends/s5h1411.c
+++ b/drivers/media/dvb/frontends/s5h1411.c
@@ -844,7 +844,7 @@ struct dvb_frontend *s5h1411_attach(const struct s5h1411_config *config,
         u16 reg;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct s5h1411_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct s5h1411_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/si21xx.c b/drivers/media/dvb/frontends/si21xx.c
index 0bd16af8a6cd..9552a22ccffb 100644
--- a/drivers/media/dvb/frontends/si21xx.c
+++ b/drivers/media/dvb/frontends/si21xx.c
@@ -928,7 +928,7 @@ struct dvb_frontend *si21xx_attach(const struct si21xx_config *config,
         dprintk("%s\n", __func__);
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct si21xx_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct si21xx_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/sp8870.c b/drivers/media/dvb/frontends/sp8870.c
index 1c9a9b4051b9..b85eb60a893e 100644
--- a/drivers/media/dvb/frontends/sp8870.c
+++ b/drivers/media/dvb/frontends/sp8870.c
@@ -557,7 +557,7 @@ struct dvb_frontend* sp8870_attach(const struct sp8870_config* config,
         struct sp8870_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct sp8870_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct sp8870_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/sp887x.c b/drivers/media/dvb/frontends/sp887x.c
index 559509ab4dab..4a7c3d842608 100644
--- a/drivers/media/dvb/frontends/sp887x.c
+++ b/drivers/media/dvb/frontends/sp887x.c
@@ -557,7 +557,7 @@ struct dvb_frontend* sp887x_attach(const struct sp887x_config* config,
         struct sp887x_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct sp887x_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct sp887x_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/stv0288.c b/drivers/media/dvb/frontends/stv0288.c
index ff1194de34c0..2930a5d6768a 100644
--- a/drivers/media/dvb/frontends/stv0288.c
+++ b/drivers/media/dvb/frontends/stv0288.c
@@ -570,7 +570,7 @@ struct dvb_frontend *stv0288_attach(const struct stv0288_config *config,
         int id;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct stv0288_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct stv0288_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/stv0297.c b/drivers/media/dvb/frontends/stv0297.c
index 62caf802ed99..4fd7479bb62b 100644
--- a/drivers/media/dvb/frontends/stv0297.c
+++ b/drivers/media/dvb/frontends/stv0297.c
@@ -663,7 +663,7 @@ struct dvb_frontend *stv0297_attach(const struct stv0297_config *config,
         struct stv0297_state *state = NULL;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct stv0297_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct stv0297_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/stv0299.c b/drivers/media/dvb/frontends/stv0299.c
index 6c1cb1973c6e..968874469726 100644
--- a/drivers/media/dvb/frontends/stv0299.c
+++ b/drivers/media/dvb/frontends/stv0299.c
@@ -667,7 +667,7 @@ struct dvb_frontend* stv0299_attach(const struct stv0299_config* config,
         int id;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct stv0299_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct stv0299_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/tda10021.c b/drivers/media/dvb/frontends/tda10021.c
index f648fdb64bb7..f5d7b3277a2f 100644
--- a/drivers/media/dvb/frontends/tda10021.c
+++ b/drivers/media/dvb/frontends/tda10021.c
@@ -413,7 +413,7 @@ struct dvb_frontend* tda10021_attach(const struct tda1002x_config* config,
         u8 id;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10021_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10021_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/tda10048.c b/drivers/media/dvb/frontends/tda10048.c
index cc8862ce4aae..4e2a7c8b2f62 100644
--- a/drivers/media/dvb/frontends/tda10048.c
+++ b/drivers/media/dvb/frontends/tda10048.c
@@ -1095,7 +1095,7 @@ struct dvb_frontend *tda10048_attach(const struct tda10048_config *config,
         dprintk(1, "%s()\n", __func__);
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10048_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10048_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/tda1004x.c b/drivers/media/dvb/frontends/tda1004x.c
index 4981cef8b444..f2a8abe0a243 100644
--- a/drivers/media/dvb/frontends/tda1004x.c
+++ b/drivers/media/dvb/frontends/tda1004x.c
@@ -1269,7 +1269,7 @@ struct dvb_frontend* tda10045_attach(const struct tda1004x_config* config,
         int id;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
         if (!state) {
                 printk(KERN_ERR "Can't alocate memory for tda10045 state\n");
                 return NULL;
@@ -1339,7 +1339,7 @@ struct dvb_frontend* tda10046_attach(const struct tda1004x_config* config,
         int id;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
         if (!state) {
                 printk(KERN_ERR "Can't alocate memory for tda10046 state\n");
                 return NULL;
diff --git a/drivers/media/dvb/frontends/tda10086.c b/drivers/media/dvb/frontends/tda10086.c
index a17ce3c4ad86..f2c8faac6f36 100644
--- a/drivers/media/dvb/frontends/tda10086.c
+++ b/drivers/media/dvb/frontends/tda10086.c
@@ -745,7 +745,7 @@ struct dvb_frontend* tda10086_attach(const struct tda10086_config* config,
         dprintk ("%s\n", __func__);
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10086_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10086_state), GFP_KERNEL);
         if (!state)
                 return NULL;
 
diff --git a/drivers/media/dvb/frontends/tda8083.c b/drivers/media/dvb/frontends/tda8083.c
index 5b843b2e67e8..9369f7442f27 100644
--- a/drivers/media/dvb/frontends/tda8083.c
+++ b/drivers/media/dvb/frontends/tda8083.c
@@ -417,7 +417,7 @@ struct dvb_frontend* tda8083_attach(const struct tda8083_config* config,
         struct tda8083_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda8083_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda8083_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/ves1820.c b/drivers/media/dvb/frontends/ves1820.c
index a184597f1d9b..6e78e4865515 100644
--- a/drivers/media/dvb/frontends/ves1820.c
+++ b/drivers/media/dvb/frontends/ves1820.c
@@ -374,7 +374,7 @@ struct dvb_frontend* ves1820_attach(const struct ves1820_config* config,
         struct ves1820_state* state = NULL;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct ves1820_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct ves1820_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
 
diff --git a/drivers/media/dvb/frontends/ves1x93.c b/drivers/media/dvb/frontends/ves1x93.c
index bd558960bd87..8d7854c2fb0c 100644
--- a/drivers/media/dvb/frontends/ves1x93.c
+++ b/drivers/media/dvb/frontends/ves1x93.c
@@ -456,7 +456,7 @@ struct dvb_frontend* ves1x93_attach(const struct ves1x93_config* config,
         u8 identity;
 
         /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct ves1x93_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct ves1x93_state), GFP_KERNEL);
         if (state == NULL) goto error;
 
         /* setup the state */
diff --git a/drivers/media/dvb/frontends/zl10353.c b/drivers/media/dvb/frontends/zl10353.c
index 148b6f7f6cb2..66f5c1fb3074 100644
--- a/drivers/media/dvb/frontends/zl10353.c
+++ b/drivers/media/dvb/frontends/zl10353.c
@@ -98,7 +98,6 @@ static int zl10353_read_register(struct zl10353_state *state, u8 reg)
 static void zl10353_dump_regs(struct dvb_frontend *fe)
 {
         struct zl10353_state *state = fe->demodulator_priv;
-        char buf[52], buf2[4];
         int ret;
         u8 reg;
 
@@ -106,19 +105,18 @@ static void zl10353_dump_regs(struct dvb_frontend *fe)
         for (reg = 0; ; reg++) {
                 if (reg % 16 == 0) {
                         if (reg)
-                                printk(KERN_DEBUG "%s\n", buf);
-                        sprintf(buf, "%02x: ", reg);
+                                printk(KERN_CONT "\n");
+                        printk(KERN_DEBUG "%02x:", reg);
                 }
                 ret = zl10353_read_register(state, reg);
                 if (ret >= 0)
-                        sprintf(buf2, "%02x ", (u8)ret);
+                        printk(KERN_CONT " %02x", (u8)ret);
                 else
-                        strcpy(buf2, "-- ");
-                strcat(buf, buf2);
+                        printk(KERN_CONT " --");
                 if (reg == 0xff)
                         break;
         }
-        printk(KERN_DEBUG "%s\n", buf);
+        printk(KERN_CONT "\n");
 }
 
 static void zl10353_calc_nominal_rate(struct dvb_frontend *fe,
diff --git a/drivers/media/dvb/siano/Kconfig b/drivers/media/dvb/siano/Kconfig
index dd863f261672..88847d1dcbb5 100644
--- a/drivers/media/dvb/siano/Kconfig
+++ b/drivers/media/dvb/siano/Kconfig
@@ -4,7 +4,7 @@
 
 config DVB_SIANO_SMS1XXX
         tristate "Siano SMS1XXX USB dongle support"
-        depends on DVB_CORE && USB
+        depends on DVB_CORE && USB && INPUT
         ---help---
           Choose Y here if you have a USB dongle with a SMS1XXX chipset.
 
diff --git a/drivers/media/dvb/siano/sms-cards.c b/drivers/media/dvb/siano/sms-cards.c
index d8b15d583bde..0420e2885e75 100644
--- a/drivers/media/dvb/siano/sms-cards.c
+++ b/drivers/media/dvb/siano/sms-cards.c
@@ -116,99 +116,21 @@ static inline void sms_gpio_assign_11xx_default_led_config(
 
 int sms_board_event(struct smscore_device_t *coredev,
                 enum SMS_BOARD_EVENTS gevent) {
-        int board_id = smscore_get_board_id(coredev);
-        struct sms_board *board = sms_get_board(board_id);
         struct smscore_gpio_config MyGpioConfig;
 
         sms_gpio_assign_11xx_default_led_config(&MyGpioConfig);
 
         switch (gevent) {
         case BOARD_EVENT_POWER_INIT: /* including hotplug */
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        /* set I/O and turn off all LEDs */
-                        smscore_gpio_configure(coredev,
-                                        board->board_cfg.leds_power,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.leds_power, 0);
-                        smscore_gpio_configure(coredev, board->board_cfg.led0,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.led0, 0);
-                        smscore_gpio_configure(coredev, board->board_cfg.led1,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        /* set I/O and turn off LNA */
-                        smscore_gpio_configure(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        0);
-                        break;
-                }
                 break; /* BOARD_EVENT_BIND */
 
         case BOARD_EVENT_POWER_SUSPEND:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.leds_power, 0);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led0, 0);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        0);
-                        break;
-                }
                 break; /* BOARD_EVENT_POWER_SUSPEND */
 
         case BOARD_EVENT_POWER_RESUME:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.leds_power, 1);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led0, 1);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        1);
-                        break;
-                }
                 break; /* BOARD_EVENT_POWER_RESUME */
 
         case BOARD_EVENT_BIND:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                board->board_cfg.leds_power, 1);
-                        smscore_gpio_set_level(coredev,
-                                board->board_cfg.led0, 1);
-                        smscore_gpio_set_level(coredev,
-                                board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        1);
-                        break;
-                }
                 break; /* BOARD_EVENT_BIND */
 
         case BOARD_EVENT_SCAN_PROG:
@@ -218,20 +140,8 @@ int sms_board_event(struct smscore_device_t *coredev,
         case BOARD_EVENT_EMERGENCY_WARNING_SIGNAL:
                 break; /* BOARD_EVENT_EMERGENCY_WARNING_SIGNAL */
         case BOARD_EVENT_FE_LOCK:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                        board->board_cfg.led1, 1);
-                        break;
-                }
                 break; /* BOARD_EVENT_FE_LOCK */
         case BOARD_EVENT_FE_UNLOCK:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                }
                 break; /* BOARD_EVENT_FE_UNLOCK */
         case BOARD_EVENT_DEMOD_LOCK:
                 break; /* BOARD_EVENT_DEMOD_LOCK */
@@ -248,20 +158,8 @@ int sms_board_event(struct smscore_device_t *coredev,
         case BOARD_EVENT_RECEPTION_LOST_0:
                 break; /* BOARD_EVENT_RECEPTION_LOST_0 */
         case BOARD_EVENT_MULTIPLEX_OK:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 1);
-                        break;
-                }
                 break; /* BOARD_EVENT_MULTIPLEX_OK */
         case BOARD_EVENT_MULTIPLEX_ERRORS:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                }
                 break; /* BOARD_EVENT_MULTIPLEX_ERRORS */
 
         default:
diff --git a/drivers/media/dvb/siano/smscoreapi.c b/drivers/media/dvb/siano/smscoreapi.c
index a246903c3341..bd9ab9d0d12a 100644
--- a/drivers/media/dvb/siano/smscoreapi.c
+++ b/drivers/media/dvb/siano/smscoreapi.c
@@ -816,7 +816,7 @@ int smscore_set_device_mode(struct smscore_device_t *coredev, int mode)
 
         sms_debug("set device mode to %d", mode);
         if (coredev->device_flags & SMS_DEVICE_FAMILY2) {
-                if (mode < DEVICE_MODE_DVBT || mode > DEVICE_MODE_RAW_TUNER) {
+                if (mode < DEVICE_MODE_DVBT || mode >= DEVICE_MODE_RAW_TUNER) {
                         sms_err("invalid mode specified %d", mode);
                         return -EINVAL;
                 }
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index 84b6fc15519d..dcf9fa9264bb 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -920,6 +920,8 @@ source "drivers/media/video/pwc/Kconfig"
 config USB_ZR364XX
         tristate "USB ZR364XX Camera support"
         depends on VIDEO_V4L2
+        select VIDEOBUF_GEN
+        select VIDEOBUF_VMALLOC
         ---help---
           Say Y here if you want to connect this type of camera to your
           computer's USB port.
diff --git a/drivers/media/video/bw-qcam.c b/drivers/media/video/bw-qcam.c
index 10dbd4a11b30..9e39bc5f7b00 100644
--- a/drivers/media/video/bw-qcam.c
+++ b/drivers/media/video/bw-qcam.c
@@ -992,7 +992,7 @@ static int accept_bwqcam(struct parport *port)
 
         if (parport[0] && strncmp(parport[0], "auto", 4) != 0) {
                 /* user gave parport parameters */
-                for(n=0; parport[n] && n<MAX_CAMS; n++){
+                for (n = 0; n < MAX_CAMS && parport[n]; n++) {
                         char *ep;
                         unsigned long r;
                         r = simple_strtoul(parport[n], &ep, 0);
diff --git a/drivers/media/video/cx18/cx18-controls.c b/drivers/media/video/cx18/cx18-controls.c
index 5136df198338..93f0dae01350 100644
--- a/drivers/media/video/cx18/cx18-controls.c
+++ b/drivers/media/video/cx18/cx18-controls.c
@@ -20,6 +20,7 @@
  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  *  02111-1307  USA
  */
+#include <linux/kernel.h>
 
 #include "cx18-driver.h"
 #include "cx18-cards.h"
@@ -317,7 +318,7 @@ int cx18_s_ext_ctrls(struct file *file, void *fh, struct v4l2_ext_controls *c)
                 idx = p.audio_properties & 0x03;
                 /* The audio clock of the digitizer must match the codec sample
                    rate otherwise you get some very strange effects. */
-                if (idx < sizeof(freqs))
+                if (idx < ARRAY_SIZE(freqs))
                         cx18_call_all(cx, audio, s_clock_freq, freqs[idx]);
                 return err;
         }
diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c
index e0cf21e0b1bf..1a1048b18f70 100644
--- a/drivers/media/video/cx23885/cx23885-417.c
+++ b/drivers/media/video/cx23885/cx23885-417.c
@@ -1715,6 +1715,8 @@ static struct video_device cx23885_mpeg_template = {
         .fops          = &mpeg_fops,
         .ioctl_ops     = &mpeg_ioctl_ops,
         .minor         = -1,
+        .tvnorms       = CX23885_NORMS,
+        .current_norm  = V4L2_STD_NTSC_M,
 };
 
 void cx23885_417_unregister(struct cx23885_dev *dev)
diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
index a5cc1c1fc2d6..39465301ec94 100644
--- a/drivers/media/video/cx88/cx88-cards.c
+++ b/drivers/media/video/cx88/cx88-cards.c
@@ -3003,6 +3003,14 @@ void cx88_setup_xc3028(struct cx88_core *core, struct xc2028_ctrl *ctl)
         case CX88_BOARD_DVICO_FUSIONHDTV_5_PCI_NANO:
                 ctl->demod = XC3028_FE_OREN538;
                 break;
+        case CX88_BOARD_GENIATECH_X8000_MT:
+                /* FIXME: For this board, the xc3028 never recovers after being
+                   powered down (the reset GPIO probably is not set properly).
+                   We don't have access to the hardware so we cannot determine
+                   which GPIO is used for xc3028, so just disable power xc3028
+                   power management for now */
+                ctl->disable_power_mgmt = 1;
+                break;
         case CX88_BOARD_WINFAST_TV2000_XP_GLOBAL:
         case CX88_BOARD_PROLINK_PV_GLOBAL_XTREME:
         case CX88_BOARD_PROLINK_PV_8000GT:
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index c44e87600219..e237b507659b 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -501,6 +501,7 @@ static struct zl10353_config cx88_pinnacle_hybrid_pctv = {
 static struct zl10353_config cx88_geniatech_x8000_mt = {
        .demod_address = (0x1e >> 1),
        .no_tuner = 1,
+       .disable_i2c_gate_ctrl = 1,
 };
 
 static struct s5h1411_config dvico_fusionhdtv7_config = {
diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c
index da4e3912cd37..7172dcf2a4fa 100644
--- a/drivers/media/video/cx88/cx88-mpeg.c
+++ b/drivers/media/video/cx88/cx88-mpeg.c
@@ -116,6 +116,10 @@ static int cx8802_start_dma(struct cx8802_dev    *dev,
                         udelay(100);
                         break;
                 case CX88_BOARD_HAUPPAUGE_HVR1300:
+                        /* Enable MPEG parallel IO and video signal pins */
+                        cx_write(MO_PINMUX_IO, 0x88);
+                        cx_write(TS_SOP_STAT, 0);
+                        cx_write(TS_VALERR_CNTRL, 0);
                         break;
                 case CX88_BOARD_PINNACLE_PCTV_HD_800i:
                         /* Enable MPEG parallel IO and video signal pins */
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index 320f1f60276e..ed281f565945 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -218,7 +218,7 @@ static struct em28xx_reg_seq silvercrest_reg_seq[] = {
 struct em28xx_board em28xx_boards[] = {
         [EM2750_BOARD_UNKNOWN] = {
                 .name          = "EM2710/EM2750/EM2751 webcam grabber",
-                .xclk          = EM28XX_XCLK_FREQUENCY_48MHZ,
+                .xclk          = EM28XX_XCLK_FREQUENCY_20MHZ,
                 .tuner_type    = TUNER_ABSENT,
                 .is_webcam     = 1,
                 .input         = { {
@@ -622,22 +622,27 @@ struct em28xx_board em28xx_boards[] = {
         },
         [EM2861_BOARD_PLEXTOR_PX_TV100U] = {
                 .name         = "Plextor ConvertX PX-TV100U",
-                .valid        = EM28XX_BOARD_NOT_VALIDATED,
                 .tuner_type   = TUNER_TNF_5335MF,
+                .xclk         = EM28XX_XCLK_I2S_MSB_TIMING |
+                                EM28XX_XCLK_FREQUENCY_12MHZ,
                 .tda9887_conf = TDA9887_PRESENT,
                 .decoder      = EM28XX_TVP5150,
+                .has_msp34xx  = 1,
                 .input        = { {
                         .type     = EM28XX_VMUX_TELEVISION,
                         .vmux     = TVP5150_COMPOSITE0,
                         .amux     = EM28XX_AMUX_LINE_IN,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                 }, {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = TVP5150_COMPOSITE1,
                         .amux     = EM28XX_AMUX_LINE_IN,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                 }, {
                         .type     = EM28XX_VMUX_SVIDEO,
                         .vmux     = TVP5150_SVIDEO,
                         .amux     = EM28XX_AMUX_LINE_IN,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                 } },
         },
 
@@ -1544,6 +1549,8 @@ struct usb_device_id em28xx_id_table[] = {
                         .driver_info = EM2750_BOARD_UNKNOWN },
         { USB_DEVICE(0xeb1a, 0x2800),
                         .driver_info = EM2800_BOARD_UNKNOWN },
+        { USB_DEVICE(0xeb1a, 0x2710),
+                        .driver_info = EM2820_BOARD_UNKNOWN },
         { USB_DEVICE(0xeb1a, 0x2820),
                         .driver_info = EM2820_BOARD_UNKNOWN },
         { USB_DEVICE(0xeb1a, 0x2821),
@@ -1761,6 +1768,7 @@ static int em28xx_hint_sensor(struct em28xx *dev)
         __be16 version_be;
         u16 version;
 
+        /* Micron sensor detection */
         dev->i2c_client.addr = 0xba >> 1;
         cmd = 0;
         i2c_master_send(&dev->i2c_client, &cmd, 1);
@@ -1769,15 +1777,27 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                 return -EINVAL;
 
         version = be16_to_cpu(version_be);
-
         switch (version) {
-        case 0x8243:            /* mt9v011 640x480 1.3 Mpix sensor */
+        case 0x8232:            /* mt9v011 640x480 1.3 Mpix sensor */
+        case 0x8243:            /* mt9v011 rev B 640x480 1.3 Mpix sensor */
                 dev->model = EM2820_BOARD_SILVERCREST_WEBCAM;
+                em28xx_set_model(dev);
+
                 sensor_name = "mt9v011";
                 dev->em28xx_sensor = EM28XX_MT9V011;
                 dev->sensor_xres = 640;
                 dev->sensor_yres = 480;
-                dev->sensor_xtal = 6300000;
+                /*
+                 * FIXME: mt9v011 uses I2S speed as xtal clk - at least with
+                 * the Silvercrest cam I have here for testing - for higher
+                 * resolutions, a high clock cause horizontal artifacts, so we
+                 * need to use a lower xclk frequency.
+                 * Yet, it would be possible to adjust xclk depending on the
+                 * desired resolution, since this affects directly the
+                 * frame rate.
+                 */
+                dev->board.xclk = EM28XX_XCLK_FREQUENCY_4_3MHZ;
+                dev->sensor_xtal = 4300000;
 
                 /* probably means GRGB 16 bit bayer */
                 dev->vinmode = 0x0d;
@@ -1786,6 +1806,8 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                 break;
         case 0x8431:
                 dev->model = EM2750_BOARD_UNKNOWN;
+                em28xx_set_model(dev);
+
                 sensor_name = "mt9m001";
                 dev->em28xx_sensor = EM28XX_MT9M001;
                 em28xx_initialize_mt9m001(dev);
@@ -1802,6 +1824,9 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                 return -EINVAL;
         }
 
+        /* Setup webcam defaults */
+        em28xx_pre_card_setup(dev);
+
         em28xx_errdev("Sensor is %s, using model %s entry.\n",
                       sensor_name, em28xx_boards[dev->model].name);
 
@@ -1813,60 +1838,6 @@ static int em28xx_hint_sensor(struct em28xx *dev)
  */
 void em28xx_pre_card_setup(struct em28xx *dev)
 {
-        int rc;
-
-        em28xx_set_model(dev);
-
-        em28xx_info("Identified as %s (card=%d)\n",
-                    dev->board.name, dev->model);
-
-        /* Set the default GPO/GPIO for legacy devices */
-        dev->reg_gpo_num = EM2880_R04_GPO;
-        dev->reg_gpio_num = EM28XX_R08_GPIO;
-
-        dev->wait_after_write = 5;
-
-        /* Based on the Chip ID, set the device configuration */
-        rc = em28xx_read_reg(dev, EM28XX_R0A_CHIPID);
-        if (rc > 0) {
-                dev->chip_id = rc;
-
-                switch (dev->chip_id) {
-                case CHIP_ID_EM2750:
-                        em28xx_info("chip ID is em2750\n");
-                        break;
-                case CHIP_ID_EM2820:
-                        em28xx_info("chip ID is em2710 or em2820\n");
-                        break;
-                case CHIP_ID_EM2840:
-                        em28xx_info("chip ID is em2840\n");
-                        break;
-                case CHIP_ID_EM2860:
-                        em28xx_info("chip ID is em2860\n");
-                        break;
-                case CHIP_ID_EM2870:
-                        em28xx_info("chip ID is em2870\n");
-                        dev->wait_after_write = 0;
-                        break;
-                case CHIP_ID_EM2874:
-                        em28xx_info("chip ID is em2874\n");
-                        dev->reg_gpio_num = EM2874_R80_GPIO;
-                        dev->wait_after_write = 0;
-                        break;
-                case CHIP_ID_EM2883:
-                        em28xx_info("chip ID is em2882/em2883\n");
-                        dev->wait_after_write = 0;
-                        break;
-                default:
-                        em28xx_info("em28xx chip ID = %d\n", dev->chip_id);
-                }
-        }
-
-        /* Prepopulate cached GPO register content */
-        rc = em28xx_read_reg(dev, dev->reg_gpo_num);
-        if (rc >= 0)
-                dev->reg_gpo = rc;
-
         /* Set the initial XCLK and I2C clock values based on the board
            definition */
         em28xx_write_reg(dev, EM28XX_R0F_XCLK, dev->board.xclk & 0x7f);
@@ -1876,9 +1847,8 @@ void em28xx_pre_card_setup(struct em28xx *dev)
         /* request some modules */
         switch (dev->model) {
         case EM2861_BOARD_PLEXTOR_PX_TV100U:
-                /* FIXME guess */
-                /* Turn on analog audio output */
-                em28xx_write_reg(dev, EM28XX_R08_GPIO, 0xfd);
+                /* Sets the msp34xx I2S speed */
+                dev->i2s_speed = 2048000;
                 break;
         case EM2861_BOARD_KWORLD_PVRTV_300U:
         case EM2880_BOARD_KWORLD_DVB_305U:
@@ -2216,7 +2186,20 @@ void em28xx_register_i2c_ir(struct em28xx *dev)
 
 void em28xx_card_setup(struct em28xx *dev)
 {
-        em28xx_set_model(dev);
+        /*
+         * If the device can be a webcam, seek for a sensor.
+         * If sensor is not found, then it isn't a webcam.
+         */
+        if (dev->board.is_webcam) {
+                if (em28xx_hint_sensor(dev) < 0)
+                        dev->board.is_webcam = 0;
+                else
+                        dev->progressive = 1;
+        } else
+                em28xx_set_model(dev);
+
+        em28xx_info("Identified as %s (card=%d)\n",
+                    dev->board.name, dev->model);
 
         dev->tuner_type = em28xx_boards[dev->model].tuner_type;
         if (em28xx_boards[dev->model].tuner_addr)
@@ -2290,10 +2273,6 @@ void em28xx_card_setup(struct em28xx *dev)
                 em28xx_gpio_set(dev, dev->board.tuner_gpio);
                 em28xx_set_mode(dev, EM28XX_ANALOG_MODE);
                 break;
-        case EM2820_BOARD_SILVERCREST_WEBCAM:
-                /* FIXME: need to document the registers bellow */
-                em28xx_write_reg(dev, 0x0d, 0x42);
-                em28xx_write_reg(dev, 0x13, 0x08);
         }
 
         if (dev->board.has_snapshot_button)
@@ -2433,7 +2412,7 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
                            int minor)
 {
         struct em28xx *dev = *devhandle;
-        int retval = -ENOMEM;
+        int retval;
         int errCode;
 
         dev->udev = udev;
@@ -2450,6 +2429,58 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
         dev->em28xx_read_reg_req = em28xx_read_reg_req;
         dev->board.is_em2800 = em28xx_boards[dev->model].is_em2800;
 
+        em28xx_set_model(dev);
+
+        /* Set the default GPO/GPIO for legacy devices */
+        dev->reg_gpo_num = EM2880_R04_GPO;
+        dev->reg_gpio_num = EM28XX_R08_GPIO;
+
+        dev->wait_after_write = 5;
+
+        /* Based on the Chip ID, set the device configuration */
+        retval = em28xx_read_reg(dev, EM28XX_R0A_CHIPID);
+        if (retval > 0) {
+                dev->chip_id = retval;
+
+                switch (dev->chip_id) {
+                case CHIP_ID_EM2710:
+                        em28xx_info("chip ID is em2710\n");
+                        break;
+                case CHIP_ID_EM2750:
+                        em28xx_info("chip ID is em2750\n");
+                        break;
+                case CHIP_ID_EM2820:
+                        em28xx_info("chip ID is em2820 (or em2710)\n");
+                        break;
+                case CHIP_ID_EM2840:
+                        em28xx_info("chip ID is em2840\n");
+                        break;
+                case CHIP_ID_EM2860:
+                        em28xx_info("chip ID is em2860\n");
+                        break;
+                case CHIP_ID_EM2870:
+                        em28xx_info("chip ID is em2870\n");
+                        dev->wait_after_write = 0;
+                        break;
+                case CHIP_ID_EM2874:
+                        em28xx_info("chip ID is em2874\n");
+                        dev->reg_gpio_num = EM2874_R80_GPIO;
+                        dev->wait_after_write = 0;
+                        break;
+                case CHIP_ID_EM2883:
+                        em28xx_info("chip ID is em2882/em2883\n");
+                        dev->wait_after_write = 0;
+                        break;
+                default:
+                        em28xx_info("em28xx chip ID = %d\n", dev->chip_id);
+                }
+        }
+
+        /* Prepopulate cached GPO register content */
+        retval = em28xx_read_reg(dev, dev->reg_gpo_num);
+        if (retval >= 0)
+                dev->reg_gpo = retval;
+
         em28xx_pre_card_setup(dev);
 
         if (!dev->board.is_em2800) {
@@ -2484,14 +2515,6 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
         dev->vinmode = 0x10;
         dev->vinctl  = 0x11;
 
-        /*
-         * If the device can be a webcam, seek for a sensor.
-         * If sensor is not found, then it isn't a webcam.
-         */
-        if (dev->board.is_webcam)
-                if (em28xx_hint_sensor(dev) < 0)
-                        dev->board.is_webcam = 0;
-
         /* Do board specific init and eeprom reading */
         em28xx_card_setup(dev);
 
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index 5b78e199abd1..98e140b5d95e 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -632,6 +632,9 @@ int em28xx_capture_start(struct em28xx *dev, int start)
                 return rc;
         }
 
+        if (dev->board.is_webcam)
+                rc = em28xx_write_reg(dev, 0x13, 0x0c);
+
         /* enable video capture */
         rc = em28xx_write_reg(dev, 0x48, 0x00);
 
@@ -720,7 +723,10 @@ int em28xx_resolution_set(struct em28xx *dev)
 {
         int width, height;
         width = norm_maxw(dev);
-        height = norm_maxh(dev) >> 1;
+        height = norm_maxh(dev);
+
+        if (!dev->progressive)
+                height >>= norm_maxh(dev);
 
         em28xx_set_outfmt(dev);
 
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index cf0ac7f2a30d..d603575431b4 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -478,7 +478,6 @@ static int dvb_init(struct em28xx *dev)
                 }
                 break;
         case EM2880_BOARD_KWORLD_DVB_310U:
-        case EM2880_BOARD_EMPIRE_DUAL_TV:
                 dvb->frontend = dvb_attach(zl10353_attach,
                                            &em28xx_zl10353_with_xc3028,
                                            &dev->i2c_adap);
@@ -488,6 +487,7 @@ static int dvb_init(struct em28xx *dev)
                 }
                 break;
         case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900:
+        case EM2880_BOARD_EMPIRE_DUAL_TV:
                 dvb->frontend = dvb_attach(zl10353_attach,
                                            &em28xx_zl10353_xc3028_no_i2c_gate,
                                            &dev->i2c_adap);
diff --git a/drivers/media/video/em28xx/em28xx-reg.h b/drivers/media/video/em28xx/em28xx-reg.h
index a2676d63cfd0..6bf84bd787df 100644
--- a/drivers/media/video/em28xx/em28xx-reg.h
+++ b/drivers/media/video/em28xx/em28xx-reg.h
@@ -176,7 +176,8 @@
 
 /* FIXME: Need to be populated with the other chip ID's */
 enum em28xx_chip_id {
-        CHIP_ID_EM2820 = 18,    /* Also used by em2710 */
+        CHIP_ID_EM2710 = 17,
+        CHIP_ID_EM2820 = 18,    /* Also used by some em2710 */
         CHIP_ID_EM2840 = 20,
         CHIP_ID_EM2750 = 33,
         CHIP_ID_EM2860 = 34,
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index ff37b4c15f44..ab079d9256c4 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -194,15 +194,24 @@ static void em28xx_copy_video(struct em28xx *dev,
         startread = p;
         remain = len;
 
-        /* Interlaces frame */
-        if (buf->top_field)
+        if (dev->progressive)
                 fieldstart = outp;
-        else
-                fieldstart = outp + bytesperline;
+        else {
+                /* Interlaces two half frames */
+                if (buf->top_field)
+                        fieldstart = outp;
+                else
+                        fieldstart = outp + bytesperline;
+        }
 
         linesdone = dma_q->pos / bytesperline;
         currlinedone = dma_q->pos % bytesperline;
-        offset = linesdone * bytesperline * 2 + currlinedone;
+
+        if (dev->progressive)
+                offset = linesdone * bytesperline + currlinedone;
+        else
+                offset = linesdone * bytesperline * 2 + currlinedone;
+
         startwrite = fieldstart + offset;
         lencopy = bytesperline - currlinedone;
         lencopy = lencopy > remain ? remain : lencopy;
@@ -376,7 +385,7 @@ static inline int em28xx_isoc_copy(struct em28xx *dev, struct urb *urb)
                         em28xx_isocdbg("Video frame %d, length=%i, %s\n", p[2],
                                        len, (p[2] & 1) ? "odd" : "even");
 
-                        if (!(p[2] & 1)) {
+                        if (dev->progressive || !(p[2] & 1)) {
                                 if (buf != NULL)
                                         buffer_filled(dev, dma_q, buf);
                                 get_next_buf(dma_q, &buf);
@@ -689,7 +698,10 @@ static int vidioc_g_fmt_vid_cap(struct file *file, void *priv,
         f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
 
         /* FIXME: TOP? NONE? BOTTOM? ALTENATE? */
-        f->fmt.pix.field = dev->interlaced ?
+        if (dev->progressive)
+                f->fmt.pix.field = V4L2_FIELD_NONE;
+        else
+                f->fmt.pix.field = dev->interlaced ?
                            V4L2_FIELD_INTERLACED : V4L2_FIELD_TOP;
 
         mutex_unlock(&dev->lock);
@@ -753,7 +765,11 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
         f->fmt.pix.bytesperline = (dev->width * fmt->depth + 7) >> 3;
         f->fmt.pix.sizeimage = f->fmt.pix.bytesperline * height;
         f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
-        f->fmt.pix.field = V4L2_FIELD_INTERLACED;
+        if (dev->progressive)
+                f->fmt.pix.field = V4L2_FIELD_NONE;
+        else
+                f->fmt.pix.field = dev->interlaced ?
+                           V4L2_FIELD_INTERLACED : V4L2_FIELD_TOP;
 
         return 0;
 }
@@ -846,6 +862,41 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id *norm)
         return 0;
 }
 
+static int vidioc_g_parm(struct file *file, void *priv,
+                         struct v4l2_streamparm *p)
+{
+        struct em28xx_fh   *fh  = priv;
+        struct em28xx      *dev = fh->dev;
+        int rc = 0;
+
+        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+
+        if (dev->board.is_webcam)
+                rc = v4l2_device_call_until_err(&dev->v4l2_dev, 0,
+                                                video, g_parm, p);
+        else
+                v4l2_video_std_frame_period(dev->norm,
+                                                 &p->parm.capture.timeperframe);
+
+        return rc;
+}
+
+static int vidioc_s_parm(struct file *file, void *priv,
+                         struct v4l2_streamparm *p)
+{
+        struct em28xx_fh   *fh  = priv;
+        struct em28xx      *dev = fh->dev;
+
+        if (!dev->board.is_webcam)
+                return -EINVAL;
+
+        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+
+        return v4l2_device_call_until_err(&dev->v4l2_dev, 0, video, s_parm, p);
+}
+
 static const char *iname[] = {
         [EM28XX_VMUX_COMPOSITE1] = "Composite1",
         [EM28XX_VMUX_COMPOSITE2] = "Composite2",
@@ -1624,6 +1675,7 @@ static int em28xx_v4l2_open(struct file *filp)
         struct em28xx *dev;
         enum v4l2_buf_type fh_type;
         struct em28xx_fh *fh;
+        enum v4l2_field field;
 
         dev = em28xx_get_device(minor, &fh_type, &radio);
 
@@ -1665,8 +1717,13 @@ static int em28xx_v4l2_open(struct file *filp)
 
         dev->users++;
 
+        if (dev->progressive)
+                field = V4L2_FIELD_NONE;
+        else
+                field = V4L2_FIELD_INTERLACED;
+
         videobuf_queue_vmalloc_init(&fh->vb_vidq, &em28xx_video_qops,
-                        NULL, &dev->slock, fh->type, V4L2_FIELD_INTERLACED,
+                        NULL, &dev->slock, fh->type, field,
                         sizeof(struct em28xx_buffer), fh);
 
         mutex_unlock(&dev->lock);
@@ -1885,6 +1942,8 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
         .vidioc_qbuf                = vidioc_qbuf,
         .vidioc_dqbuf               = vidioc_dqbuf,
         .vidioc_s_std               = vidioc_s_std,
+        .vidioc_g_parm              = vidioc_g_parm,
+        .vidioc_s_parm              = vidioc_s_parm,
         .vidioc_enum_input          = vidioc_enum_input,
         .vidioc_g_input             = vidioc_g_input,
         .vidioc_s_input             = vidioc_s_input,
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 45bd513f62dc..8c2dc38bca9f 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -484,6 +484,9 @@ struct em28xx {
         int sensor_xres, sensor_yres;
         int sensor_xtal;
 
+        /* Allows progressive (e. g. non-interlaced) mode */
+        int progressive;
+
         /* Vinmode/Vinctl used at the driver */
         int vinmode, vinctl;
 
diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
index ccd47f57f42c..d678765cbba2 100644
--- a/drivers/media/video/hdpvr/hdpvr-video.c
+++ b/drivers/media/video/hdpvr/hdpvr-video.c
@@ -1220,6 +1220,8 @@ static const struct video_device hdpvr_video_template = {
                 V4L2_STD_PAL_G | V4L2_STD_PAL_H | V4L2_STD_PAL_I |
                 V4L2_STD_PAL_D | V4L2_STD_PAL_M | V4L2_STD_PAL_N |
                 V4L2_STD_PAL_60,
+        .current_norm           = V4L2_STD_NTSC | V4L2_STD_PAL_M |
+                V4L2_STD_PAL_60,
 };
 
 int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent,
diff --git a/drivers/media/video/ivtv/ivtv-controls.c b/drivers/media/video/ivtv/ivtv-controls.c
index a3b77ed3f089..4a9c8ce0ecb3 100644
--- a/drivers/media/video/ivtv/ivtv-controls.c
+++ b/drivers/media/video/ivtv/ivtv-controls.c
@@ -17,6 +17,7 @@
     along with this program; if not, write to the Free Software
     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
+#include <linux/kernel.h>
 
 #include "ivtv-driver.h"
 #include "ivtv-cards.h"
@@ -281,7 +282,7 @@ int ivtv_s_ext_ctrls(struct file *file, void *fh, struct v4l2_ext_controls *c)
                 idx = p.audio_properties & 0x03;
                 /* The audio clock of the digitizer must match the codec sample
                    rate otherwise you get some very strange effects. */
-                if (idx < sizeof(freqs))
+                if (idx < ARRAY_SIZE(freqs))
                         ivtv_call_all(itv, audio, s_clock_freq, freqs[idx]);
                 return err;
         }
diff --git a/drivers/media/video/mt9v011.c b/drivers/media/video/mt9v011.c
index b2260de645f0..cc85f77a5706 100644
--- a/drivers/media/video/mt9v011.c
+++ b/drivers/media/video/mt9v011.c
@@ -52,13 +52,34 @@ static struct v4l2_queryctrl mt9v011_qctrl[] = {
                 .step = 1,
                 .default_value = 0,
                 .flags = 0,
-        },
+        }, {
+                .id      = V4L2_CID_HFLIP,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Mirror",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+                .default_value = 0,
+                .flags = 0,
+        }, {
+                .id      = V4L2_CID_VFLIP,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Vflip",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+                .default_value = 0,
+                .flags = 0,
+        }, {
+        }
 };
 
 struct mt9v011 {
         struct v4l2_subdev sd;
         unsigned width, height;
         unsigned xtal;
+        unsigned hflip:1;
+        unsigned vflip:1;
 
         u16 global_gain, red_bal, blue_bal;
 };
@@ -131,7 +152,6 @@ static const struct i2c_reg_value mt9v011_init_default[] = {
 
                 { R0A_MT9V011_CLK_SPEED, 0x0000 },
                 { R1E_MT9V011_DIGITAL_ZOOM,  0x0000 },
-                { R20_MT9V011_READ_MODE, 0x1000 },
 
                 { R07_MT9V011_OUT_CTRL, 0x0002 },       /* chip enable */
 };
@@ -156,7 +176,7 @@ static void set_balance(struct v4l2_subdev *sd)
         mt9v011_write(sd, R2D_MT9V011_RED_GAIN, red_gain);
 }
 
-static void calc_fps(struct v4l2_subdev *sd)
+static void calc_fps(struct v4l2_subdev *sd, u32 *numerator, u32 *denominator)
 {
         struct mt9v011 *core = to_mt9v011(sd);
         unsigned height, width, hblank, vblank, speed;
@@ -179,6 +199,51 @@ static void calc_fps(struct v4l2_subdev *sd)
 
         v4l2_dbg(1, debug, sd, "Programmed to %u.%03u fps (%d pixel clcks)\n",
                 tmp / 1000, tmp % 1000, t_time);
+
+        if (numerator && denominator) {
+                *numerator = 1000;
+                *denominator = (u32)frames_per_ms;
+        }
+}
+
+static u16 calc_speed(struct v4l2_subdev *sd, u32 numerator, u32 denominator)
+{
+        struct mt9v011 *core = to_mt9v011(sd);
+        unsigned height, width, hblank, vblank;
+        unsigned row_time, line_time;
+        u64 t_time, speed;
+
+        /* Avoid bogus calculus */
+        if (!numerator || !denominator)
+                return 0;
+
+        height = mt9v011_read(sd, R03_MT9V011_HEIGHT);
+        width = mt9v011_read(sd, R04_MT9V011_WIDTH);
+        hblank = mt9v011_read(sd, R05_MT9V011_HBLANK);
+        vblank = mt9v011_read(sd, R06_MT9V011_VBLANK);
+
+        row_time = width + 113 + hblank;
+        line_time = height + vblank + 1;
+
+        t_time = core->xtal * ((u64)numerator);
+        /* round to the closest value */
+        t_time += denominator / 2;
+        do_div(t_time, denominator);
+
+        speed = t_time;
+        do_div(speed, row_time * line_time);
+
+        /* Avoid having a negative value for speed */
+        if (speed < 2)
+                speed = 0;
+        else
+                speed -= 2;
+
+        /* Avoid speed overflow */
+        if (speed > 15)
+                return 15;
+
+        return (u16)speed;
 }
 
 static void set_res(struct v4l2_subdev *sd)
@@ -207,9 +272,23 @@ static void set_res(struct v4l2_subdev *sd)
         mt9v011_write(sd, R03_MT9V011_HEIGHT, core->height);
         mt9v011_write(sd, R06_MT9V011_VBLANK, 508 - core->height);
 
-        calc_fps(sd);
+        calc_fps(sd, NULL, NULL);
 };
 
+static void set_read_mode(struct v4l2_subdev *sd)
+{
+        struct mt9v011 *core = to_mt9v011(sd);
+        unsigned mode = 0x1000;
+
+        if (core->hflip)
+                mode |= 0x4000;
+
+        if (core->vflip)
+                mode |= 0x8000;
+
+        mt9v011_write(sd, R20_MT9V011_READ_MODE, mode);
+}
+
 static int mt9v011_reset(struct v4l2_subdev *sd, u32 val)
 {
         int i;
@@ -220,6 +299,7 @@ static int mt9v011_reset(struct v4l2_subdev *sd, u32 val)
 
         set_balance(sd);
         set_res(sd);
+        set_read_mode(sd);
 
         return 0;
 };
@@ -240,6 +320,12 @@ static int mt9v011_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
         case V4L2_CID_BLUE_BALANCE:
                 ctrl->value = core->blue_bal;
                 return 0;
+        case V4L2_CID_HFLIP:
+                ctrl->value = core->hflip ? 1 : 0;
+                return 0;
+        case V4L2_CID_VFLIP:
+                ctrl->value = core->vflip ? 1 : 0;
+                return 0;
         }
         return -EINVAL;
 }
@@ -288,6 +374,14 @@ static int mt9v011_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
         case V4L2_CID_BLUE_BALANCE:
                 core->blue_bal = ctrl->value;
                 break;
+        case V4L2_CID_HFLIP:
+                core->hflip = ctrl->value;
+                set_read_mode(sd);
+                return 0;
+        case V4L2_CID_VFLIP:
+                core->vflip = ctrl->value;
+                set_read_mode(sd);
+                return 0;
         default:
                 return -EINVAL;
         }
@@ -322,6 +416,44 @@ static int mt9v011_try_fmt(struct v4l2_subdev *sd, struct v4l2_format *fmt)
         return 0;
 }
 
+static int mt9v011_g_parm(struct v4l2_subdev *sd, struct v4l2_streamparm *parms)
+{
+        struct v4l2_captureparm *cp = &parms->parm.capture;
+
+        if (parms->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+
+        memset(cp, 0, sizeof(struct v4l2_captureparm));
+        cp->capability = V4L2_CAP_TIMEPERFRAME;
+        calc_fps(sd,
+                 &cp->timeperframe.numerator,
+                 &cp->timeperframe.denominator);
+
+        return 0;
+}
+
+static int mt9v011_s_parm(struct v4l2_subdev *sd, struct v4l2_streamparm *parms)
+{
+        struct v4l2_captureparm *cp = &parms->parm.capture;
+        struct v4l2_fract *tpf = &cp->timeperframe;
+        u16 speed;
+
+        if (parms->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        if (cp->extendedmode != 0)
+                return -EINVAL;
+
+        speed = calc_speed(sd, tpf->numerator, tpf->denominator);
+
+        mt9v011_write(sd, R0A_MT9V011_CLK_SPEED, speed);
+        v4l2_dbg(1, debug, sd, "Setting speed to %d\n", speed);
+
+        /* Recalculate and update fps info */
+        calc_fps(sd, &tpf->numerator, &tpf->denominator);
+
+        return 0;
+}
+
 static int mt9v011_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *fmt)
 {
         struct v4l2_pix_format *pix = &fmt->fmt.pix;
@@ -393,10 +525,13 @@ static int mt9v011_s_register(struct v4l2_subdev *sd,
 static int mt9v011_g_chip_ident(struct v4l2_subdev *sd,
                                 struct v4l2_dbg_chip_ident *chip)
 {
+        u16 version;
         struct i2c_client *client = v4l2_get_subdevdata(sd);
 
+        version = mt9v011_read(sd, R00_MT9V011_CHIP_VERSION);
+
         return v4l2_chip_ident_i2c_client(client, chip, V4L2_IDENT_MT9V011,
-                                          MT9V011_VERSION);
+                                          version);
 }
 
 static const struct v4l2_subdev_core_ops mt9v011_core_ops = {
@@ -416,6 +551,8 @@ static const struct v4l2_subdev_video_ops mt9v011_video_ops = {
         .enum_fmt = mt9v011_enum_fmt,
         .try_fmt = mt9v011_try_fmt,
         .s_fmt = mt9v011_s_fmt,
+        .g_parm = mt9v011_g_parm,
+        .s_parm = mt9v011_s_parm,
 };
 
 static const struct v4l2_subdev_ops mt9v011_ops = {
@@ -449,8 +586,9 @@ static int mt9v011_probe(struct i2c_client *c,
 
         /* Check if the sensor is really a MT9V011 */
         version = mt9v011_read(sd, R00_MT9V011_CHIP_VERSION);
-        if (version != MT9V011_VERSION) {
-                v4l2_info(sd, "*** unknown micron chip detected (0x%04x.\n",
+        if ((version != MT9V011_VERSION) &&
+            (version != MT9V011_REV_B_VERSION)) {
+                v4l2_info(sd, "*** unknown micron chip detected (0x%04x).\n",
                           version);
                 kfree(core);
                 return -EINVAL;
@@ -461,8 +599,8 @@ static int mt9v011_probe(struct i2c_client *c,
         core->height = 480;
         core->xtal = 27000000;  /* Hz */
 
-        v4l_info(c, "chip found @ 0x%02x (%s)\n",
-                 c->addr << 1, c->adapter->name);
+        v4l_info(c, "chip found @ 0x%02x (%s - chip version 0x%04x)\n",
+                 c->addr << 1, c->adapter->name, version);
 
         return 0;
 }
diff --git a/drivers/media/video/mt9v011.h b/drivers/media/video/mt9v011.h
index 9e443ee30558..3350fd6083c3 100644
--- a/drivers/media/video/mt9v011.h
+++ b/drivers/media/video/mt9v011.h
@@ -30,6 +30,7 @@
 #define R35_MT9V011_GLOBAL_GAIN         0x35
 #define RF1_MT9V011_CHIP_ENABLE         0xf1
 
-#define MT9V011_VERSION                 0x8243
+#define MT9V011_VERSION                 0x8232
+#define MT9V011_REV_B_VERSION           0x8243
 
 #endif
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c
index 2d075205bdfe..736c31d23194 100644
--- a/drivers/media/video/mx1_camera.c
+++ b/drivers/media/video/mx1_camera.c
@@ -234,6 +234,7 @@ static int mx1_camera_setup_dma(struct mx1_camera_dev *pcdev)
         return ret;
 }
 
+/* Called under spinlock_irqsave(&pcdev->lock, ...) */
 static void mx1_videobuf_queue(struct videobuf_queue *vq,
                                                 struct videobuf_buffer *vb)
 {
@@ -241,13 +242,10 @@ static void mx1_videobuf_queue(struct videobuf_queue *vq,
         struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
         struct mx1_camera_dev *pcdev = ici->priv;
         struct mx1_buffer *buf = container_of(vb, struct mx1_buffer, vb);
-        unsigned long flags;
 
         dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
                 vb, vb->baddr, vb->bsize);
 
-        spin_lock_irqsave(&pcdev->lock, flags);
-
         list_add_tail(&vb->queue, &pcdev->capture);
 
         vb->state = VIDEOBUF_ACTIVE;
@@ -264,8 +262,6 @@ static void mx1_videobuf_queue(struct videobuf_queue *vq,
                         __raw_writel(temp, pcdev->base + CSICR1);
                 }
         }
-
-        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 
 static void mx1_videobuf_release(struct videobuf_queue *vq,
diff --git a/drivers/media/video/mx3_camera.c b/drivers/media/video/mx3_camera.c
index e605c076ed89..9770cb7932ca 100644
--- a/drivers/media/video/mx3_camera.c
+++ b/drivers/media/video/mx3_camera.c
@@ -332,7 +332,10 @@ static enum pixel_fmt fourcc_to_ipu_pix(__u32 fourcc)
         }
 }
 
-/* Called with .vb_lock held */
+/*
+ * Called with .vb_lock mutex held and
+ * under spinlock_irqsave(&mx3_cam->lock, ...)
+ */
 static void mx3_videobuf_queue(struct videobuf_queue *vq,
                                struct videobuf_buffer *vb)
 {
@@ -346,7 +349,8 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
         struct idmac_video_param *video = &ichan->params.video;
         const struct soc_camera_data_format *data_fmt = icd->current_fmt;
         dma_cookie_t cookie;
-        unsigned long flags;
+
+        BUG_ON(!irqs_disabled());
 
         /* This is the configuration of one sg-element */
         video->out_pixel_fmt    = fourcc_to_ipu_pix(data_fmt->fourcc);
@@ -359,8 +363,6 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
         memset((void *)vb->baddr, 0xaa, vb->bsize);
 #endif
 
-        spin_lock_irqsave(&mx3_cam->lock, flags);
-
         list_add_tail(&vb->queue, &mx3_cam->capture);
 
         if (!mx3_cam->active) {
@@ -370,24 +372,23 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
                 vb->state = VIDEOBUF_QUEUED;
         }
 
-        spin_unlock_irqrestore(&mx3_cam->lock, flags);
+        spin_unlock_irq(&mx3_cam->lock);
 
         cookie = txd->tx_submit(txd);
         dev_dbg(&icd->dev, "Submitted cookie %d DMA 0x%08x\n", cookie, sg_dma_address(&buf->sg));
+
+        spin_lock_irq(&mx3_cam->lock);
+
         if (cookie >= 0)
                 return;
 
         /* Submit error */
         vb->state = VIDEOBUF_PREPARED;
 
-        spin_lock_irqsave(&mx3_cam->lock, flags);
-
         list_del_init(&vb->queue);
 
         if (mx3_cam->active == buf)
                 mx3_cam->active = NULL;
-
-        spin_unlock_irqrestore(&mx3_cam->lock, flags);
 }
 
 /* Called with .vb_lock held */
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c
index 46e0d8ad880f..016bb45ba0c3 100644
--- a/drivers/media/video/pxa_camera.c
+++ b/drivers/media/video/pxa_camera.c
@@ -612,6 +612,7 @@ static void pxa_camera_stop_capture(struct pxa_camera_dev *pcdev)
         dev_dbg(pcdev->soc_host.dev, "%s\n", __func__);
 }
 
+/* Called under spinlock_irqsave(&pcdev->lock, ...) */
 static void pxa_videobuf_queue(struct videobuf_queue *vq,
                                struct videobuf_buffer *vb)
 {
@@ -619,13 +620,10 @@ static void pxa_videobuf_queue(struct videobuf_queue *vq,
         struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
         struct pxa_camera_dev *pcdev = ici->priv;
         struct pxa_buffer *buf = container_of(vb, struct pxa_buffer, vb);
-        unsigned long flags;
 
         dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d active=%p\n", __func__,
                 vb, vb->baddr, vb->bsize, pcdev->active);
 
-        spin_lock_irqsave(&pcdev->lock, flags);
-
         list_add_tail(&vb->queue, &pcdev->capture);
 
         vb->state = VIDEOBUF_ACTIVE;
@@ -633,8 +631,6 @@ static void pxa_videobuf_queue(struct videobuf_queue *vq,
 
         if (!pcdev->active)
                 pxa_camera_start_capture(pcdev);
-
-        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 
 static void pxa_videobuf_release(struct videobuf_queue *vq,
@@ -1579,6 +1575,7 @@ static int __devinit pxa_camera_probe(struct platform_device *pdev)
                 pcdev->mclk = 20000000;
         }
 
+        pcdev->soc_host.dev = &pdev->dev;
         pcdev->mclk_divisor = mclk_get_divisor(pcdev);
 
         INIT_LIST_HEAD(&pcdev->capture);
@@ -1644,7 +1641,6 @@ static int __devinit pxa_camera_probe(struct platform_device *pdev)
         pcdev->soc_host.drv_name        = PXA_CAM_DRV_NAME;
         pcdev->soc_host.ops             = &pxa_soc_camera_host_ops;
         pcdev->soc_host.priv            = pcdev;
-        pcdev->soc_host.dev             = &pdev->dev;
         pcdev->soc_host.nr              = pdev->id;
 
         err = soc_camera_host_register(&pcdev->soc_host);
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index 06861b782b95..6eebe3ef97d3 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -3331,8 +3331,8 @@ struct saa7134_board saa7134_boards[] = {
                         .gpio = 0x0200100,
                 },
         },
-        [SAA7134_BOARD_HAUPPAUGE_HVR1120] = {
-                .name           = "Hauppauge WinTV-HVR1120 ATSC/QAM-Hybrid",
+        [SAA7134_BOARD_HAUPPAUGE_HVR1150] = {
+                .name           = "Hauppauge WinTV-HVR1150 ATSC/QAM-Hybrid",
                 .audio_clock    = 0x00187de7,
                 .tuner_type     = TUNER_PHILIPS_TDA8290,
                 .radio_type     = UNSET,
@@ -3363,8 +3363,8 @@ struct saa7134_board saa7134_boards[] = {
                         .gpio = 0x0800100, /* GPIO 23 HI for FM */
                 },
         },
-        [SAA7134_BOARD_HAUPPAUGE_HVR1110R3] = {
-                .name           = "Hauppauge WinTV-HVR1110r3 DVB-T/Hybrid",
+        [SAA7134_BOARD_HAUPPAUGE_HVR1120] = {
+                .name           = "Hauppauge WinTV-HVR1120 DVB-T/Hybrid",
                 .audio_clock    = 0x00187de7,
                 .tuner_type     = TUNER_PHILIPS_TDA8290,
                 .radio_type     = UNSET,
@@ -5862,31 +5862,31 @@ struct pci_device_id saa7134_pci_tbl[] = {
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                 .subvendor    = 0x0070,
                 .subdevice    = 0x6706,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1150,
         },{
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                 .subvendor    = 0x0070,
                 .subdevice    = 0x6707,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1110R3,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
         },{
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                 .subvendor    = 0x0070,
                 .subdevice    = 0x6708,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1150,
         },{
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                 .subvendor    = 0x0070,
                 .subdevice    = 0x6709,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1110R3,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
         },{
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                 .subvendor    = 0x0070,
                 .subdevice    = 0x670a,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1110R3,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
         },{
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
@@ -6363,8 +6363,8 @@ static int saa7134_tda8290_18271_callback(struct saa7134_dev *dev,
         switch (command) {
         case TDA18271_CALLBACK_CMD_AGC_ENABLE: /* 0 */
                 switch (dev->board) {
+                case SAA7134_BOARD_HAUPPAUGE_HVR1150:
                 case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-                case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                         ret = saa7134_tda18271_hvr11x0_toggle_agc(dev, arg);
                         break;
                 default:
@@ -6384,8 +6384,8 @@ static int saa7134_tda8290_callback(struct saa7134_dev *dev,
         int ret;
 
         switch (dev->board) {
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
         case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                 /* tda8290 + tda18271 */
                 ret = saa7134_tda8290_18271_callback(dev, command, arg);
                 break;
@@ -6427,7 +6427,7 @@ static void hauppauge_eeprom(struct saa7134_dev *dev, u8 *eeprom_data)
         switch (tv.model) {
         case 67019: /* WinTV-HVR1110 (Retail, IR Blaster, hybrid, FM, SVid/Comp, 3.5mm audio in) */
         case 67109: /* WinTV-HVR1000 (Retail, IR Receive, analog, no FM, SVid/Comp, 3.5mm audio in) */
-        case 67201: /* WinTV-HVR1120 (Retail, IR Receive, hybrid, FM, SVid/Comp, 3.5mm audio in) */
+        case 67201: /* WinTV-HVR1150 (Retail, IR Receive, hybrid, FM, SVid/Comp, 3.5mm audio in) */
         case 67301: /* WinTV-HVR1000 (Retail, IR Receive, analog, no FM, SVid/Comp, 3.5mm audio in) */
         case 67209: /* WinTV-HVR1110 (Retail, IR Receive, hybrid, FM, SVid/Comp, 3.5mm audio in) */
         case 67559: /* WinTV-HVR1110 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
@@ -6435,7 +6435,7 @@ static void hauppauge_eeprom(struct saa7134_dev *dev, u8 *eeprom_data)
         case 67579: /* WinTV-HVR1110 (OEM, no IR, hybrid, no FM) */
         case 67589: /* WinTV-HVR1110 (OEM, no IR, hybrid, no FM, SVid/Comp, RCA aud) */
         case 67599: /* WinTV-HVR1110 (OEM, no IR, hybrid, no FM, SVid/Comp, RCA aud) */
-        case 67651: /* WinTV-HVR1120 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
+        case 67651: /* WinTV-HVR1150 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
         case 67659: /* WinTV-HVR1110 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
                 break;
         default:
@@ -6625,8 +6625,8 @@ int saa7134_board_init1(struct saa7134_dev *dev)
 
                 saa_writeb (SAA7134_PRODUCTION_TEST_MODE, 0x00);
                 break;
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
         case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                 /* GPIO 26 high for digital, low for analog */
                 saa7134_set_gpio(dev, 26, 0);
                 msleep(1);
@@ -6891,8 +6891,8 @@ int saa7134_board_init2(struct saa7134_dev *dev)
                        dev->name, saa7134_boards[dev->board].name);
                }
                break;
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
         case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                 hauppauge_eeprom(dev, dev->eedata+0x80);
                 break;
         case SAA7134_BOARD_HAUPPAUGE_HVR1110:
diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
index 31930f26ffc7..98f3efd1e944 100644
--- a/drivers/media/video/saa7134/saa7134-dvb.c
+++ b/drivers/media/video/saa7134/saa7134-dvb.c
@@ -1119,7 +1119,7 @@ static int dvb_init(struct saa7134_dev *dev)
                                          &tda827x_cfg_2) < 0)
                         goto dettach_frontend;
                 break;
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
+        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
                 fe0->dvb.frontend = dvb_attach(tda10048_attach,
                                                &hcw_tda10048_config,
                                                &dev->i2c_adap);
@@ -1147,7 +1147,7 @@ static int dvb_init(struct saa7134_dev *dev)
                                          &tda827x_cfg_1) < 0)
                         goto dettach_frontend;
                 break;
-        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
                 fe0->dvb.frontend = dvb_attach(lgdt3305_attach,
                                                &hcw_lgdt3305_config,
                                                &dev->i2c_adap);
diff --git a/drivers/media/video/saa7134/saa7134.h b/drivers/media/video/saa7134/saa7134.h
index 82268848f26a..fb564f14887c 100644
--- a/drivers/media/video/saa7134/saa7134.h
+++ b/drivers/media/video/saa7134/saa7134.h
@@ -278,8 +278,8 @@ struct saa7134_format {
 #define SAA7134_BOARD_ASUSTeK_TIGER         152
 #define SAA7134_BOARD_KWORLD_PLUS_TV_ANALOG 153
 #define SAA7134_BOARD_AVERMEDIA_GO_007_FM_PLUS 154
-#define SAA7134_BOARD_HAUPPAUGE_HVR1120     155
-#define SAA7134_BOARD_HAUPPAUGE_HVR1110R3   156
+#define SAA7134_BOARD_HAUPPAUGE_HVR1150     155
+#define SAA7134_BOARD_HAUPPAUGE_HVR1120   156
 #define SAA7134_BOARD_AVERMEDIA_STUDIO_507UA 157
 #define SAA7134_BOARD_AVERMEDIA_CARDBUS_501 158
 #define SAA7134_BOARD_BEHOLD_505RDS         159
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 0db88a53d92c..e86878deea71 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -282,27 +282,24 @@ out:
         return ret;
 }
 
+/* Called under spinlock_irqsave(&pcdev->lock, ...) */
 static void sh_mobile_ceu_videobuf_queue(struct videobuf_queue *vq,
                                          struct videobuf_buffer *vb)
 {
         struct soc_camera_device *icd = vq->priv_data;
         struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
         struct sh_mobile_ceu_dev *pcdev = ici->priv;
-        unsigned long flags;
 
         dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %zd\n", __func__,
                 vb, vb->baddr, vb->bsize);
 
         vb->state = VIDEOBUF_QUEUED;
-        spin_lock_irqsave(&pcdev->lock, flags);
         list_add_tail(&vb->queue, &pcdev->capture);
 
         if (!pcdev->active) {
                 pcdev->active = vb;
                 sh_mobile_ceu_capture(pcdev);
         }
-
-        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 
 static void sh_mobile_ceu_videobuf_release(struct videobuf_queue *vq,
diff --git a/drivers/media/video/stk-webcam.c b/drivers/media/video/stk-webcam.c
index 4d6785e63455..b154bd961e3b 100644
--- a/drivers/media/video/stk-webcam.c
+++ b/drivers/media/video/stk-webcam.c
@@ -1050,8 +1050,8 @@ static int stk_setup_format(struct stk_camera *dev)
                 depth = 1;
         else
                 depth = 2;
-        while (stk_sizes[i].m != dev->vsettings.mode
-                        && i < ARRAY_SIZE(stk_sizes))
+        while (i < ARRAY_SIZE(stk_sizes) &&
+                        stk_sizes[i].m != dev->vsettings.mode)
                 i++;
         if (i == ARRAY_SIZE(stk_sizes)) {
                 STK_ERROR("Something is broken in %s\n", __func__);
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 89927b7aec28..04b47832fa0a 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1845,11 +1845,29 @@ static struct usb_device_id uvc_ids[] = {
           .bInterfaceSubClass   = 1,
           .bInterfaceProtocol   = 0,
           .driver_info          = UVC_QUIRK_STREAM_NO_FID },
-        /* ViMicro */
-        { .match_flags          = USB_DEVICE_ID_MATCH_VENDOR
+        /* ViMicro Vega */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x0ac8,
+          .idProduct            = 0x332d,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_FIX_BANDWIDTH },
+        /* ViMicro - Minoru3D */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x0ac8,
+          .idProduct            = 0x3410,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_FIX_BANDWIDTH },
+        /* ViMicro Venus - Minoru3D */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                 | USB_DEVICE_ID_MATCH_INT_INFO,
           .idVendor             = 0x0ac8,
-          .idProduct            = 0x0000,
+          .idProduct            = 0x3420,
           .bInterfaceClass      = USB_CLASS_VIDEO,
           .bInterfaceSubClass   = 1,
           .bInterfaceProtocol   = 0,
diff --git a/drivers/media/video/uvc/uvc_status.c b/drivers/media/video/uvc/uvc_status.c
index f152a9903862..1ca6dff73612 100644
--- a/drivers/media/video/uvc/uvc_status.c
+++ b/drivers/media/video/uvc/uvc_status.c
@@ -145,8 +145,8 @@ static void uvc_status_complete(struct urb *urb)
                         break;
 
                 default:
-                        uvc_printk(KERN_INFO, "unknown event type %u.\n",
-                                dev->status[0]);
+                        uvc_trace(UVC_TRACE_STATUS, "Unknown status event "
+                                "type %u.\n", dev->status[0]);
                         break;
                 }
         }
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
index be64a502ea27..f2afc4e08379 100644
--- a/drivers/media/video/v4l2-ioctl.c
+++ b/drivers/media/video/v4l2-ioctl.c
@@ -1081,8 +1081,10 @@ static long __video_do_ioctl(struct file *file,
                 /* Calls the specific handler */
                 if (ops->vidioc_g_std)
                         ret = ops->vidioc_g_std(file, fh, id);
-                else
+                else if (vfd->current_norm)
                         *id = vfd->current_norm;
+                else
+                        ret = -EINVAL;
 
                 if (!ret)
                         dbgarg(cmd, "std=0x%08Lx\n", (long long unsigned)*id);
@@ -1553,12 +1555,19 @@ static long __video_do_ioctl(struct file *file,
                                 break;
                         ret = ops->vidioc_g_parm(file, fh, p);
                 } else {
+                        v4l2_std_id std = vfd->current_norm;
+
                         if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
                                 return -EINVAL;
 
-                        v4l2_video_std_frame_period(vfd->current_norm,
-                                                    &p->parm.capture.timeperframe);
                         ret = 0;
+                        if (ops->vidioc_g_std)
+                                ret = ops->vidioc_g_std(file, fh, &std);
+                        else if (std == 0)
+                                ret = -EINVAL;
+                        if (ret == 0)
+                                v4l2_video_std_frame_period(std,
+                                                    &p->parm.capture.timeperframe);
                 }
 
                 dbgarg(cmd, "type=%d\n", p->type);
diff --git a/drivers/mtd/maps/sbc8240.c b/drivers/mtd/maps/sbc8240.c
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/drivers/mtd/maps/sbc8240.c
+++ /dev/null
diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
index 7ad972229db4..0d9d4bc9c762 100644
--- a/drivers/mtd/nand/orion_nand.c
+++ b/drivers/mtd/nand/orion_nand.c
@@ -61,7 +61,7 @@ static void orion_nand_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
         buf64 = (uint64_t *)buf;
         while (i < len/8) {
                 uint64_t x;
-                asm ("ldrd\t%0, [%1]" : "=r" (x) : "r" (io_base));
+                asm volatile ("ldrd\t%0, [%1]" : "=&r" (x) : "r" (io_base));
                 buf64[i++] = x;
         }
         i *= 8;
diff --git a/drivers/pci/hotplug/sgi_hotplug.c b/drivers/pci/hotplug/sgi_hotplug.c
index a4494d78e7c2..8aebe1e9d3d6 100644
--- a/drivers/pci/hotplug/sgi_hotplug.c
+++ b/drivers/pci/hotplug/sgi_hotplug.c
@@ -90,11 +90,10 @@ static struct hotplug_slot_ops sn_hotplug_slot_ops = {
 
 static DEFINE_MUTEX(sn_hotplug_mutex);
 
-static ssize_t path_show (struct hotplug_slot *bss_hotplug_slot,
-                          char *buf)
+static ssize_t path_show(struct pci_slot *pci_slot, char *buf)
 {
         int retval = -ENOENT;
-        struct slot *slot = bss_hotplug_slot->private;
+        struct slot *slot = pci_slot->hotplug->private;
 
         if (!slot)
                 return retval;
@@ -103,7 +102,7 @@ static ssize_t path_show (struct hotplug_slot *bss_hotplug_slot,
         return retval;
 }
 
-static struct hotplug_slot_attribute sn_slot_path_attr = __ATTR_RO(path);
+static struct pci_slot_attribute sn_slot_path_attr = __ATTR_RO(path);
 
 static int sn_pci_slot_valid(struct pci_bus *pci_bus, int device)
 {
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index d76c4c85367e..f99bc7f089f1 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -508,7 +508,7 @@ static int pci_restore_standard_config(struct pci_dev *pci_dev)
                         return error;
         }
 
-        return pci_dev->state_saved ? pci_restore_state(pci_dev) : 0;
+        return pci_restore_state(pci_dev);
 }
 
 static void pci_pm_default_resume_noirq(struct pci_dev *pci_dev)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index dbd0f947f497..7b70312181d7 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -846,6 +846,8 @@ pci_restore_state(struct pci_dev *dev)
         int i;
         u32 val;
 
+        if (!dev->state_saved)
+                return 0;
         /* PCI Express register must be restored first */
         pci_restore_pcie_state(dev);
 
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 043b208d971d..f215a5919192 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -270,7 +270,7 @@ u32 method_id, const struct acpi_buffer *in, struct acpi_buffer *out)
         acpi_status status;
         struct acpi_object_list input;
         union acpi_object params[3];
-        char method[4] = "WM";
+        char method[5] = "WM";
 
         if (!find_guid(guid_string, &wblock))
                 return AE_ERROR;
@@ -328,8 +328,8 @@ struct acpi_buffer *out)
         acpi_status status, wc_status = AE_ERROR;
         struct acpi_object_list input, wc_input;
         union acpi_object wc_params[1], wq_params[1];
-        char method[4];
-        char wc_method[4] = "WC";
+        char method[5];
+        char wc_method[5] = "WC";
 
         if (!guid_string || !out)
                 return AE_BAD_PARAMETER;
@@ -410,7 +410,7 @@ const struct acpi_buffer *in)
         acpi_handle handle;
         struct acpi_object_list input;
         union acpi_object params[2];
-        char method[4] = "WS";
+        char method[5] = "WS";
 
         if (!guid_string || !in)
                 return AE_BAD_DATA;
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index ac8cc8cea1e3..fea17e7805e9 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -244,7 +244,7 @@ int pps_register_cdev(struct pps_device *pps)
         }
         pps->dev = device_create(pps_class, pps->info.dev, pps->devno, NULL,
                                                         "pps%d", pps->id);
-        if (err)
+        if (IS_ERR(pps->dev))
                 goto del_cdev;
         dev_set_drvdata(pps->dev, pps);
 
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 749836668655..3f62dd50bbbe 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2135,9 +2135,9 @@ static int dasd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
         struct dasd_device *base;
 
         block = bdev->bd_disk->private_data;
-        base = block->base;
         if (!block)
                 return -ENODEV;
+        base = block->base;
 
         if (!base->discipline ||
             !base->discipline->fill_geometry)
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 3c57c1a18bb8..d593bc76afe3 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -772,10 +772,8 @@ static struct ccw_device * io_subchannel_create_ccwdev(struct subchannel *sch)
         cdev = io_subchannel_allocate_dev(sch);
         if (!IS_ERR(cdev)) {
                 ret = io_subchannel_initialize_dev(sch, cdev);
-                if (ret) {
-                        kfree(cdev);
+                if (ret)
                         cdev = ERR_PTR(ret);
-                }
         }
         return cdev;
 }
diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
index 15dab96d05e3..7c815d3327f7 100644
--- a/drivers/sbus/char/bbc_envctrl.c
+++ b/drivers/sbus/char/bbc_envctrl.c
@@ -537,8 +537,12 @@ int bbc_envctrl_init(struct bbc_i2c_bus *bp)
         }
         if (temp_index != 0 && fan_index != 0) {
                 kenvctrld_task = kthread_run(kenvctrld, NULL, "kenvctrld");
-                if (IS_ERR(kenvctrld_task))
-                        return PTR_ERR(kenvctrld_task);
+                if (IS_ERR(kenvctrld_task)) {
+                        int err = PTR_ERR(kenvctrld_task);
+
+                        kenvctrld_task = NULL;
+                        return err;
+                }
         }
 
         return 0;
@@ -561,7 +565,8 @@ void bbc_envctrl_cleanup(struct bbc_i2c_bus *bp)
         struct bbc_cpu_temperature *tp, *tpos;
         struct bbc_fan_control *fp, *fpos;
 
-        kthread_stop(kenvctrld_task);
+        if (kenvctrld_task)
+                kthread_stop(kenvctrld_task);
 
         list_for_each_entry_safe(tp, tpos, &bp->temps, bp_list) {
                 list_del(&tp->bp_list);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index f3da592f7bcc..35a13867495e 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -119,6 +119,64 @@ _base_fault_reset_work(struct work_struct *work)
         spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 }
 
+/**
+ * mpt2sas_base_start_watchdog - start the fault_reset_work_q
+ * @ioc: pointer to scsi command object
+ * Context: sleep.
+ *
+ * Return nothing.
+ */
+void
+mpt2sas_base_start_watchdog(struct MPT2SAS_ADAPTER *ioc)
+{
+        unsigned long    flags;
+
+        if (ioc->fault_reset_work_q)
+                return;
+
+        /* initialize fault polling */
+        INIT_DELAYED_WORK(&ioc->fault_reset_work, _base_fault_reset_work);
+        snprintf(ioc->fault_reset_work_q_name,
+            sizeof(ioc->fault_reset_work_q_name), "poll_%d_status", ioc->id);
+        ioc->fault_reset_work_q =
+                create_singlethread_workqueue(ioc->fault_reset_work_q_name);
+        if (!ioc->fault_reset_work_q) {
+                printk(MPT2SAS_ERR_FMT "%s: failed (line=%d)\n",
+                    ioc->name, __func__, __LINE__);
+                        return;
+        }
+        spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+        if (ioc->fault_reset_work_q)
+                queue_delayed_work(ioc->fault_reset_work_q,
+                    &ioc->fault_reset_work,
+                    msecs_to_jiffies(FAULT_POLLING_INTERVAL));
+        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+}
+
+/**
+ * mpt2sas_base_stop_watchdog - stop the fault_reset_work_q
+ * @ioc: pointer to scsi command object
+ * Context: sleep.
+ *
+ * Return nothing.
+ */
+void
+mpt2sas_base_stop_watchdog(struct MPT2SAS_ADAPTER *ioc)
+{
+        unsigned long    flags;
+        struct workqueue_struct *wq;
+
+        spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+        wq = ioc->fault_reset_work_q;
+        ioc->fault_reset_work_q = NULL;
+        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+        if (wq) {
+                if (!cancel_delayed_work(&ioc->fault_reset_work))
+                        flush_workqueue(wq);
+                destroy_workqueue(wq);
+        }
+}
+
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
 /**
  * _base_sas_ioc_info - verbose translation of the ioc status
@@ -440,6 +498,10 @@ _base_sas_log_info(struct MPT2SAS_ADAPTER *ioc , u32 log_info)
         if (sas_loginfo.dw.bus_type != 3 /*SAS*/)
                 return;
 
+        /* each nexus loss loginfo */
+        if (log_info == 0x31170000)
+                return;
+
         /* eat the loginfos associated with task aborts */
         if (ioc->ignore_loginfos && (log_info == 30050000 || log_info ==
             0x31140000 || log_info == 0x31130000))
@@ -1109,7 +1171,6 @@ mpt2sas_base_map_resources(struct MPT2SAS_ADAPTER *ioc)
                 }
         }
 
-        pci_set_drvdata(pdev, ioc->shost);
         _base_mask_interrupts(ioc);
         r = _base_enable_msix(ioc);
         if (r)
@@ -1132,7 +1193,6 @@ mpt2sas_base_map_resources(struct MPT2SAS_ADAPTER *ioc)
         ioc->pci_irq = -1;
         pci_release_selected_regions(ioc->pdev, ioc->bars);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         return r;
 }
 
@@ -3191,7 +3251,6 @@ mpt2sas_base_free_resources(struct MPT2SAS_ADAPTER *ioc)
         ioc->chip_phys = 0;
         pci_release_selected_regions(ioc->pdev, ioc->bars);
         pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
         return;
 }
 
@@ -3205,7 +3264,6 @@ int
 mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
 {
         int r, i;
-        unsigned long    flags;
 
         dinitprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s\n", ioc->name,
             __func__));
@@ -3214,6 +3272,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
         if (r)
                 return r;
 
+        pci_set_drvdata(ioc->pdev, ioc->shost);
         r = _base_make_ioc_ready(ioc, CAN_SLEEP, SOFT_RESET);
         if (r)
                 goto out_free_resources;
@@ -3288,23 +3347,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
         if (r)
                 goto out_free_resources;
 
-        /* initialize fault polling */
-        INIT_DELAYED_WORK(&ioc->fault_reset_work, _base_fault_reset_work);
-        snprintf(ioc->fault_reset_work_q_name,
-            sizeof(ioc->fault_reset_work_q_name), "poll_%d_status", ioc->id);
-        ioc->fault_reset_work_q =
-                create_singlethread_workqueue(ioc->fault_reset_work_q_name);
-        if (!ioc->fault_reset_work_q) {
-                printk(MPT2SAS_ERR_FMT "%s: failed (line=%d)\n",
-                    ioc->name, __func__, __LINE__);
-                        goto out_free_resources;
-        }
-        spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-        if (ioc->fault_reset_work_q)
-                queue_delayed_work(ioc->fault_reset_work_q,
-                    &ioc->fault_reset_work,
-                    msecs_to_jiffies(FAULT_POLLING_INTERVAL));
-        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+        mpt2sas_base_start_watchdog(ioc);
         return 0;
 
  out_free_resources:
@@ -3312,6 +3355,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
         ioc->remove_host = 1;
         mpt2sas_base_free_resources(ioc);
         _base_release_memory_pools(ioc);
+        pci_set_drvdata(ioc->pdev, NULL);
         kfree(ioc->tm_cmds.reply);
         kfree(ioc->transport_cmds.reply);
         kfree(ioc->config_cmds.reply);
@@ -3337,22 +3381,14 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
 void
 mpt2sas_base_detach(struct MPT2SAS_ADAPTER *ioc)
 {
-        unsigned long    flags;
-        struct workqueue_struct *wq;
 
         dexitprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s\n", ioc->name,
             __func__));
 
-        spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-        wq = ioc->fault_reset_work_q;
-        ioc->fault_reset_work_q = NULL;
-        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
-        if (!cancel_delayed_work(&ioc->fault_reset_work))
-                flush_workqueue(wq);
-        destroy_workqueue(wq);
-
+        mpt2sas_base_stop_watchdog(ioc);
         mpt2sas_base_free_resources(ioc);
         _base_release_memory_pools(ioc);
+        pci_set_drvdata(ioc->pdev, NULL);
         kfree(ioc->pfacts);
         kfree(ioc->ctl_cmds.reply);
         kfree(ioc->base_cmds.reply);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.h b/drivers/scsi/mpt2sas/mpt2sas_base.h
index 286c185fa9e4..acdcff150a35 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
@@ -69,10 +69,10 @@
 #define MPT2SAS_DRIVER_NAME             "mpt2sas"
 #define MPT2SAS_AUTHOR  "LSI Corporation <DL-MPTFusionLinux@lsi.com>"
 #define MPT2SAS_DESCRIPTION     "LSI MPT Fusion SAS 2.0 Device Driver"
-#define MPT2SAS_DRIVER_VERSION          "01.100.03.00"
+#define MPT2SAS_DRIVER_VERSION          "01.100.04.00"
 #define MPT2SAS_MAJOR_VERSION           01
 #define MPT2SAS_MINOR_VERSION           100
-#define MPT2SAS_BUILD_VERSION           03
+#define MPT2SAS_BUILD_VERSION           04
 #define MPT2SAS_RELEASE_VERSION         00
 
 /*
@@ -673,6 +673,8 @@ typedef void (*MPT_CALLBACK)(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 VF_ID,
 
 /* base shared API */
 extern struct list_head mpt2sas_ioc_list;
+void mpt2sas_base_start_watchdog(struct MPT2SAS_ADAPTER *ioc);
+void mpt2sas_base_stop_watchdog(struct MPT2SAS_ADAPTER *ioc);
 
 int mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc);
 void mpt2sas_base_detach(struct MPT2SAS_ADAPTER *ioc);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_config.c b/drivers/scsi/mpt2sas/mpt2sas_config.c
index 58cfb97846f7..6ddee161beb3 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_config.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_config.c
@@ -236,17 +236,25 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
         Mpi2ConfigRequest_t *config_request;
         int r;
         u8 retry_count;
-        u8 issue_reset;
+        u8 issue_host_reset = 0;
         u16 wait_state_count;
 
+        mutex_lock(&ioc->config_cmds.mutex);
         if (ioc->config_cmds.status != MPT2_CMD_NOT_USED) {
                 printk(MPT2SAS_ERR_FMT "%s: config_cmd in use\n",
                     ioc->name, __func__);
+                mutex_unlock(&ioc->config_cmds.mutex);
                 return -EAGAIN;
         }
         retry_count = 0;
 
  retry_config:
+        if (retry_count) {
+                if (retry_count > 2) /* attempt only 2 retries */
+                        return -EFAULT;
+                printk(MPT2SAS_INFO_FMT "%s: attempting retry (%d)\n",
+                    ioc->name, __func__, retry_count);
+        }
         wait_state_count = 0;
         ioc_state = mpt2sas_base_get_iocstate(ioc, 1);
         while (ioc_state != MPI2_IOC_STATE_OPERATIONAL) {
@@ -254,8 +262,8 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
                         printk(MPT2SAS_ERR_FMT
                             "%s: failed due to ioc not operational\n",
                             ioc->name, __func__);
-                        ioc->config_cmds.status = MPT2_CMD_NOT_USED;
-                        return -EFAULT;
+                        r = -EFAULT;
+                        goto out;
                 }
                 ssleep(1);
                 ioc_state = mpt2sas_base_get_iocstate(ioc, 1);
@@ -271,8 +279,8 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
         if (!smid) {
                 printk(MPT2SAS_ERR_FMT "%s: failed obtaining a smid\n",
                     ioc->name, __func__);
-                ioc->config_cmds.status = MPT2_CMD_NOT_USED;
-                return -EAGAIN;
+                r = -EAGAIN;
+                goto out;
         }
 
         r = 0;
@@ -292,9 +300,15 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
                     ioc->name, __func__);
                 _debug_dump_mf(mpi_request,
                     sizeof(Mpi2ConfigRequest_t)/4);
-                if (!(ioc->config_cmds.status & MPT2_CMD_RESET))
-                        issue_reset = 1;
-                goto issue_host_reset;
+                retry_count++;
+                if (ioc->config_cmds.smid == smid)
+                        mpt2sas_base_free_smid(ioc, smid);
+                if ((ioc->shost_recovery) ||
+                    (ioc->config_cmds.status & MPT2_CMD_RESET))
+                        goto retry_config;
+                issue_host_reset = 1;
+                r = -EFAULT;
+                goto out;
         }
         if (ioc->config_cmds.status & MPT2_CMD_REPLY_VALID)
                 memcpy(mpi_reply, ioc->config_cmds.reply,
@@ -302,21 +316,13 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
         if (retry_count)
                 printk(MPT2SAS_INFO_FMT "%s: retry completed!!\n",
                     ioc->name, __func__);
+out:
         ioc->config_cmds.status = MPT2_CMD_NOT_USED;
-        return r;
-
- issue_host_reset:
-        if (issue_reset)
+        mutex_unlock(&ioc->config_cmds.mutex);
+        if (issue_host_reset)
                 mpt2sas_base_hard_reset_handler(ioc, CAN_SLEEP,
                     FORCE_BIG_HAMMER);
-        ioc->config_cmds.status = MPT2_CMD_NOT_USED;
-        if (!retry_count) {
-                printk(MPT2SAS_INFO_FMT "%s: attempting retry\n",
-                    ioc->name, __func__);
-                retry_count++;
-                goto retry_config;
-        }
-        return -EFAULT;
+        return r;
 }
 
 /**
@@ -375,7 +381,6 @@ mpt2sas_config_get_manufacturing_pg0(struct MPT2SAS_ADAPTER *ioc,
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2ManufacturingPage0_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -417,7 +422,6 @@ mpt2sas_config_get_manufacturing_pg0(struct MPT2SAS_ADAPTER *ioc,
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -438,7 +442,6 @@ mpt2sas_config_get_bios_pg2(struct MPT2SAS_ADAPTER *ioc,
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2BiosPage2_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -480,7 +483,6 @@ mpt2sas_config_get_bios_pg2(struct MPT2SAS_ADAPTER *ioc,
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -501,7 +503,6 @@ mpt2sas_config_get_bios_pg3(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2BiosPage3_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -543,7 +544,6 @@ mpt2sas_config_get_bios_pg3(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -564,7 +564,6 @@ mpt2sas_config_get_iounit_pg0(struct MPT2SAS_ADAPTER *ioc,
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2IOUnitPage0_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -606,7 +605,6 @@ mpt2sas_config_get_iounit_pg0(struct MPT2SAS_ADAPTER *ioc,
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -627,7 +625,6 @@ mpt2sas_config_get_iounit_pg1(struct MPT2SAS_ADAPTER *ioc,
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2IOUnitPage1_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -669,7 +666,6 @@ mpt2sas_config_get_iounit_pg1(struct MPT2SAS_ADAPTER *ioc,
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -690,7 +686,6 @@ mpt2sas_config_set_iounit_pg1(struct MPT2SAS_ADAPTER *ioc,
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
         mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_HEADER;
@@ -732,7 +727,6 @@ mpt2sas_config_set_iounit_pg1(struct MPT2SAS_ADAPTER *ioc,
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -753,7 +747,6 @@ mpt2sas_config_get_ioc_pg8(struct MPT2SAS_ADAPTER *ioc,
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2IOCPage8_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -795,7 +788,6 @@ mpt2sas_config_get_ioc_pg8(struct MPT2SAS_ADAPTER *ioc,
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -818,7 +810,6 @@ mpt2sas_config_get_sas_device_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2SasDevicePage0_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -863,7 +854,6 @@ mpt2sas_config_get_sas_device_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -886,7 +876,6 @@ mpt2sas_config_get_sas_device_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2SasDevicePage1_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -931,7 +920,6 @@ mpt2sas_config_get_sas_device_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -953,7 +941,6 @@ mpt2sas_config_get_number_hba_phys(struct MPT2SAS_ADAPTER *ioc, u8 *num_phys)
         Mpi2ConfigReply_t mpi_reply;
         Mpi2SasIOUnitPage0_t config_page;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
         mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_HEADER;
@@ -1002,7 +989,6 @@ mpt2sas_config_get_number_hba_phys(struct MPT2SAS_ADAPTER *ioc, u8 *num_phys)
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -1026,8 +1012,6 @@ mpt2sas_config_get_sas_iounit_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
         Mpi2ConfigRequest_t mpi_request;
         int r;
         struct config_request mem;
-
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sz);
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1070,7 +1054,6 @@ mpt2sas_config_get_sas_iounit_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -1095,7 +1078,6 @@ mpt2sas_config_get_sas_iounit_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sz);
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1138,7 +1120,6 @@ mpt2sas_config_get_sas_iounit_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -1161,7 +1142,6 @@ mpt2sas_config_get_expander_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2ExpanderPage0_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1206,7 +1186,6 @@ mpt2sas_config_get_expander_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -1230,7 +1209,6 @@ mpt2sas_config_get_expander_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2ExpanderPage1_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1277,7 +1255,6 @@ mpt2sas_config_get_expander_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -1300,7 +1277,6 @@ mpt2sas_config_get_enclosure_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2SasEnclosurePage0_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1345,7 +1321,6 @@ mpt2sas_config_get_enclosure_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -1367,7 +1342,6 @@ mpt2sas_config_get_phy_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2SasPhyPage0_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1413,7 +1387,6 @@ mpt2sas_config_get_phy_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -1435,7 +1408,6 @@ mpt2sas_config_get_phy_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2SasPhyPage1_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1481,7 +1453,6 @@ mpt2sas_config_get_phy_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -1505,7 +1476,6 @@ mpt2sas_config_get_raid_volume_pg1(struct MPT2SAS_ADAPTER *ioc,
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(config_page, 0, sizeof(Mpi2RaidVolPage1_t));
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1548,7 +1518,6 @@ mpt2sas_config_get_raid_volume_pg1(struct MPT2SAS_ADAPTER *ioc,
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -1572,7 +1541,6 @@ mpt2sas_config_get_number_pds(struct MPT2SAS_ADAPTER *ioc, u16 handle,
         struct config_request mem;
         u16 ioc_status;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         *num_pds = 0;
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1620,7 +1588,6 @@ mpt2sas_config_get_number_pds(struct MPT2SAS_ADAPTER *ioc, u16 handle,
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -1645,7 +1612,6 @@ mpt2sas_config_get_raid_volume_pg0(struct MPT2SAS_ADAPTER *ioc,
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         memset(config_page, 0, sz);
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1687,7 +1653,6 @@ mpt2sas_config_get_raid_volume_pg0(struct MPT2SAS_ADAPTER *ioc,
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -1711,7 +1676,6 @@ mpt2sas_config_get_phys_disk_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
         int r;
         struct config_request mem;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         memset(config_page, 0, sizeof(Mpi2RaidPhysDiskPage0_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1754,7 +1718,6 @@ mpt2sas_config_get_phys_disk_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
@@ -1778,7 +1741,6 @@ mpt2sas_config_get_volume_handle(struct MPT2SAS_ADAPTER *ioc, u16 pd_handle,
         struct config_request mem;
         u16 ioc_status;
 
-        mutex_lock(&ioc->config_cmds.mutex);
         *volume_handle = 0;
         memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
         mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1842,7 +1804,6 @@ mpt2sas_config_get_volume_handle(struct MPT2SAS_ADAPTER *ioc, u16 pd_handle,
                 _config_free_config_dma_memory(ioc, &mem);
 
  out:
-        mutex_unlock(&ioc->config_cmds.mutex);
         return r;
 }
 
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index 2a01a5f2a84d..2e9a4445596f 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -2767,6 +2767,10 @@ _scsih_scsi_ioc_info(struct MPT2SAS_ADAPTER *ioc, struct scsi_cmnd *scmd,
         char *desc_ioc_state = NULL;
         char *desc_scsi_status = NULL;
         char *desc_scsi_state = ioc->tmp_string;
+        u32 log_info = le32_to_cpu(mpi_reply->IOCLogInfo);
+
+        if (log_info == 0x31170000)
+                return;
 
         switch (ioc_status) {
         case MPI2_IOCSTATUS_SUCCESS:
@@ -3426,7 +3430,7 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
         __le64 sas_address;
         int i;
         unsigned long flags;
-        struct _sas_port *mpt2sas_port;
+        struct _sas_port *mpt2sas_port = NULL;
         int rc = 0;
 
         if (!handle)
@@ -3518,12 +3522,20 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
                     &expander_pg1, i, handle))) {
                         printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
                             ioc->name, __FILE__, __LINE__, __func__);
-                        continue;
+                        rc = -1;
+                        goto out_fail;
                 }
                 sas_expander->phy[i].handle = handle;
                 sas_expander->phy[i].phy_id = i;
-                mpt2sas_transport_add_expander_phy(ioc, &sas_expander->phy[i],
-                    expander_pg1, sas_expander->parent_dev);
+
+                if ((mpt2sas_transport_add_expander_phy(ioc,
+                    &sas_expander->phy[i], expander_pg1,
+                    sas_expander->parent_dev))) {
+                        printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                            ioc->name, __FILE__, __LINE__, __func__);
+                        rc = -1;
+                        goto out_fail;
+                }
         }
 
         if (sas_expander->enclosure_handle) {
@@ -3540,8 +3552,9 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 
  out_fail:
 
-        if (sas_expander)
-                kfree(sas_expander->phy);
+        if (mpt2sas_port)
+                mpt2sas_transport_port_remove(ioc, sas_expander->sas_address,
+                    sas_expander->parent_handle);
         kfree(sas_expander);
         return rc;
 }
@@ -3663,12 +3676,11 @@ _scsih_add_device(struct MPT2SAS_ADAPTER *ioc, u16 handle, u8 phy_num, u8 is_pd)
         sas_device->hidden_raid_component = is_pd;
 
         /* get enclosure_logical_id */
-        if (!(mpt2sas_config_get_enclosure_pg0(ioc, &mpi_reply, &enclosure_pg0,
-           MPI2_SAS_ENCLOS_PGAD_FORM_HANDLE,
-           sas_device->enclosure_handle))) {
+        if (sas_device->enclosure_handle && !(mpt2sas_config_get_enclosure_pg0(
+           ioc, &mpi_reply, &enclosure_pg0, MPI2_SAS_ENCLOS_PGAD_FORM_HANDLE,
+           sas_device->enclosure_handle)))
                 sas_device->enclosure_logical_id =
                     le64_to_cpu(enclosure_pg0.EnclosureLogicalID);
-        }
 
         /* get device name */
         sas_device->device_name = le64_to_cpu(sas_device_pg0.DeviceName);
@@ -4250,12 +4262,6 @@ _scsih_sas_volume_add(struct MPT2SAS_ADAPTER *ioc,
         u16 handle = le16_to_cpu(element->VolDevHandle);
         int rc;
 
-#if 0 /* RAID_HACKS */
-        if (le32_to_cpu(event_data->Flags) &
-            MPI2_EVENT_IR_CHANGE_FLAGS_FOREIGN_CONFIG)
-                return;
-#endif
-
         mpt2sas_config_get_volume_wwid(ioc, handle, &wwid);
         if (!wwid) {
                 printk(MPT2SAS_ERR_FMT
@@ -4310,12 +4316,6 @@ _scsih_sas_volume_delete(struct MPT2SAS_ADAPTER *ioc,
         unsigned long flags;
         struct MPT2SAS_TARGET *sas_target_priv_data;
 
-#if 0 /* RAID_HACKS */
-        if (le32_to_cpu(event_data->Flags) &
-            MPI2_EVENT_IR_CHANGE_FLAGS_FOREIGN_CONFIG)
-                return;
-#endif
-
         spin_lock_irqsave(&ioc->raid_device_lock, flags);
         raid_device = _scsih_raid_device_find_by_handle(ioc, handle);
         spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
@@ -4428,14 +4428,38 @@ _scsih_sas_pd_add(struct MPT2SAS_ADAPTER *ioc,
         struct _sas_device *sas_device;
         unsigned long flags;
         u16 handle = le16_to_cpu(element->PhysDiskDevHandle);
+        Mpi2ConfigReply_t mpi_reply;
+        Mpi2SasDevicePage0_t sas_device_pg0;
+        u32 ioc_status;
 
         spin_lock_irqsave(&ioc->sas_device_lock, flags);
         sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-        if (sas_device)
+        if (sas_device) {
                 sas_device->hidden_raid_component = 1;
-        else
-                _scsih_add_device(ioc, handle, 0, 1);
+                return;
+        }
+
+        if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0,
+            MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) {
+                printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                    ioc->name, __FILE__, __LINE__, __func__);
+                return;
+        }
+
+        ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+            MPI2_IOCSTATUS_MASK;
+        if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+                printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                    ioc->name, __FILE__, __LINE__, __func__);
+                return;
+        }
+
+        _scsih_link_change(ioc,
+            le16_to_cpu(sas_device_pg0.ParentDevHandle),
+            handle, sas_device_pg0.PhyNum, MPI2_SAS_NEG_LINK_RATE_1_5);
+
+        _scsih_add_device(ioc, handle, 0, 1);
 }
 
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
@@ -4535,12 +4559,15 @@ _scsih_sas_ir_config_change_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
 {
         Mpi2EventIrConfigElement_t *element;
         int i;
+        u8 foreign_config;
 
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
         if (ioc->logging_level & MPT_DEBUG_EVENT_WORK_TASK)
                 _scsih_sas_ir_config_change_event_debug(ioc, event_data);
 
 #endif
+        foreign_config = (le32_to_cpu(event_data->Flags) &
+            MPI2_EVENT_IR_CHANGE_FLAGS_FOREIGN_CONFIG) ? 1 : 0;
 
         element = (Mpi2EventIrConfigElement_t *)&event_data->ConfigElement[0];
         for (i = 0; i < event_data->NumElements; i++, element++) {
@@ -4548,11 +4575,13 @@ _scsih_sas_ir_config_change_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
                 switch (element->ReasonCode) {
                 case MPI2_EVENT_IR_CHANGE_RC_VOLUME_CREATED:
                 case MPI2_EVENT_IR_CHANGE_RC_ADDED:
-                        _scsih_sas_volume_add(ioc, element);
+                        if (!foreign_config)
+                                _scsih_sas_volume_add(ioc, element);
                         break;
                 case MPI2_EVENT_IR_CHANGE_RC_VOLUME_DELETED:
                 case MPI2_EVENT_IR_CHANGE_RC_REMOVED:
-                        _scsih_sas_volume_delete(ioc, element);
+                        if (!foreign_config)
+                                _scsih_sas_volume_delete(ioc, element);
                         break;
                 case MPI2_EVENT_IR_CHANGE_RC_PD_CREATED:
                         _scsih_sas_pd_hide(ioc, element);
@@ -4671,6 +4700,9 @@ _scsih_sas_ir_physical_disk_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
         u32 state;
         struct _sas_device *sas_device;
         unsigned long flags;
+        Mpi2ConfigReply_t mpi_reply;
+        Mpi2SasDevicePage0_t sas_device_pg0;
+        u32 ioc_status;
 
         if (event_data->ReasonCode != MPI2_EVENT_IR_PHYSDISK_RC_STATE_CHANGED)
                 return;
@@ -4687,22 +4719,40 @@ _scsih_sas_ir_physical_disk_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
         spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
 
         switch (state) {
-#if 0
-        case MPI2_RAID_PD_STATE_OFFLINE:
-                if (sas_device)
-                        _scsih_remove_device(ioc, handle);
-                break;
-#endif
         case MPI2_RAID_PD_STATE_ONLINE:
         case MPI2_RAID_PD_STATE_DEGRADED:
         case MPI2_RAID_PD_STATE_REBUILDING:
         case MPI2_RAID_PD_STATE_OPTIMAL:
-                if (sas_device)
+                if (sas_device) {
                         sas_device->hidden_raid_component = 1;
-                else
-                        _scsih_add_device(ioc, handle, 0, 1);
+                        return;
+                }
+
+                if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply,
+                    &sas_device_pg0, MPI2_SAS_DEVICE_PGAD_FORM_HANDLE,
+                    handle))) {
+                        printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                            ioc->name, __FILE__, __LINE__, __func__);
+                        return;
+                }
+
+                ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+                    MPI2_IOCSTATUS_MASK;
+                if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+                        printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                            ioc->name, __FILE__, __LINE__, __func__);
+                        return;
+                }
+
+                _scsih_link_change(ioc,
+                    le16_to_cpu(sas_device_pg0.ParentDevHandle),
+                    handle, sas_device_pg0.PhyNum, MPI2_SAS_NEG_LINK_RATE_1_5);
+
+                _scsih_add_device(ioc, handle, 0, 1);
+
                 break;
 
+        case MPI2_RAID_PD_STATE_OFFLINE:
         case MPI2_RAID_PD_STATE_NOT_CONFIGURED:
         case MPI2_RAID_PD_STATE_NOT_COMPATIBLE:
         case MPI2_RAID_PD_STATE_HOT_SPARE:
@@ -5774,6 +5824,7 @@ _scsih_suspend(struct pci_dev *pdev, pm_message_t state)
         struct MPT2SAS_ADAPTER *ioc = shost_priv(shost);
         u32 device_state;
 
+        mpt2sas_base_stop_watchdog(ioc);
         flush_scheduled_work();
         scsi_block_requests(shost);
         device_state = pci_choose_state(pdev, state);
@@ -5816,6 +5867,7 @@ _scsih_resume(struct pci_dev *pdev)
 
         mpt2sas_base_hard_reset_handler(ioc, CAN_SLEEP, SOFT_RESET);
         scsi_unblock_requests(shost);
+        mpt2sas_base_start_watchdog(ioc);
         return 0;
 }
 #endif /* CONFIG_PM */
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 037c1e0b7c4c..6553833c12db 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -527,7 +527,7 @@ config SERIAL_S3C24A0
 
 config SERIAL_S3C6400
         tristate "Samsung S3C6400/S3C6410 Serial port support"
-        depends on SERIAL_SAMSUNG && (CPU_S3C600 || CPU_S3C6410)
+        depends on SERIAL_SAMSUNG && (CPU_S3C6400 || CPU_S3C6410)
         default y
         help
           Serial port support for the Samsung S3C6400 and S3C6410
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index e0d44af4745a..3f3119d760db 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -111,29 +111,32 @@ static int s3c24xx_spi_setupxfer(struct spi_device *spi,
         unsigned int bpw;
         unsigned int hz;
         unsigned int div;
+        unsigned long clk;
 
         bpw = t ? t->bits_per_word : spi->bits_per_word;
         hz  = t ? t->speed_hz : spi->max_speed_hz;
 
+        if (!bpw)
+                bpw = 8;
+
+        if (!hz)
+                hz = spi->max_speed_hz;
+
         if (bpw != 8) {
                 dev_err(&spi->dev, "invalid bits-per-word (%d)\n", bpw);
                 return -EINVAL;
         }
 
-        div = clk_get_rate(hw->clk) / hz;
-
-        /* is clk = pclk / (2 * (pre+1)), or is it
-         *    clk = (pclk * 2) / ( pre + 1) */
-
-        div /= 2;
-
-        if (div > 0)
-                div -= 1;
+        clk = clk_get_rate(hw->clk);
+        div = DIV_ROUND_UP(clk, hz * 2) - 1;
 
         if (div > 255)
                 div = 255;
 
-        dev_dbg(&spi->dev, "setting pre-scaler to %d (hz %d)\n", div, hz);
+        dev_dbg(&spi->dev, "setting pre-scaler to %d (wanted %d, got %ld)\n",
+                div, hz, clk / (2 * (div + 1)));
+
+
         writeb(div, hw->regs + S3C2410_SPPRE);
 
         spin_lock(&hw->bitbang.lock);
diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
index 0a69672097a8..4e83c297ec9e 100644
--- a/drivers/thermal/thermal_sys.c
+++ b/drivers/thermal/thermal_sys.c
@@ -953,7 +953,12 @@ void thermal_zone_device_update(struct thermal_zone_device *tz)
 
         mutex_lock(&tz->lock);
 
-        tz->ops->get_temp(tz, &temp);
+        if (tz->ops->get_temp(tz, &temp)) {
+                /* get_temp failed - retry it later */
+                printk(KERN_WARNING PREFIX "failed to read out thermal zone "
+                       "%d\n", tz->id);
+                goto leave;
+        }
 
         for (count = 0; count < tz->trips; count++) {
                 tz->ops->get_trip_type(tz, count, &trip_type);
@@ -1005,6 +1010,8 @@ void thermal_zone_device_update(struct thermal_zone_device *tz)
                                             THERMAL_TRIPS_NONE);
 
         tz->last_temperature = temp;
+
+      leave:
         if (tz->passive)
                 thermal_zone_device_set_polling(tz, tz->passive_delay);
         else if (tz->polling_delay)
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 8f24564f77b0..07f22b625632 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -481,6 +481,9 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
         /* tell the board code to enable the panel */
         for (k = 0; k < ARRAY_SIZE(priv->ch); k++) {
                 ch = &priv->ch[k];
+                if (!ch->enabled)
+                        continue;
+
                 board_cfg = &ch->cfg.board_cfg;
                 if (board_cfg->display_on)
                         board_cfg->display_on(board_cfg->board_data);
@@ -498,6 +501,8 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
         /* clean up deferred io and ask board code to disable panel */
         for (k = 0; k < ARRAY_SIZE(priv->ch); k++) {
                 ch = &priv->ch[k];
+                if (!ch->enabled)
+                        continue;
 
                 /* deferred io mode:
                  * flush frame, and wait for frame end interrupt
diff --git a/drivers/watchdog/ar7_wdt.c b/drivers/watchdog/ar7_wdt.c
index 3fe9742c23ca..2f8643efe92c 100644
--- a/drivers/watchdog/ar7_wdt.c
+++ b/drivers/watchdog/ar7_wdt.c
@@ -37,7 +37,7 @@
 #include <linux/uaccess.h>
 
 #include <asm/addrspace.h>
-#include <asm/ar7/ar7.h>
+#include <asm/mach-ar7/ar7.h>
 
 #define DRVNAME "ar7_wdt"
 #define LONGNAME "TI AR7 Watchdog Timer"
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 272b9b2bea86..59cba180fe83 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3099,8 +3099,12 @@ static void inode_tree_add(struct inode *inode)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
         struct btrfs_inode *entry;
-        struct rb_node **p = &root->inode_tree.rb_node;
-        struct rb_node *parent = NULL;
+        struct rb_node **p;
+        struct rb_node *parent;
+
+again:
+        p = &root->inode_tree.rb_node;
+        parent = NULL;
 
         spin_lock(&root->inode_lock);
         while (*p) {
@@ -3108,13 +3112,16 @@ static void inode_tree_add(struct inode *inode)
                 entry = rb_entry(parent, struct btrfs_inode, rb_node);
 
                 if (inode->i_ino < entry->vfs_inode.i_ino)
-                        p = &(*p)->rb_left;
+                        p = &parent->rb_left;
                 else if (inode->i_ino > entry->vfs_inode.i_ino)
-                        p = &(*p)->rb_right;
+                        p = &parent->rb_right;
                 else {
                         WARN_ON(!(entry->vfs_inode.i_state &
                                   (I_WILL_FREE | I_FREEING | I_CLEAR)));
-                        break;
+                        rb_erase(parent, &root->inode_tree);
+                        RB_CLEAR_NODE(parent);
+                        spin_unlock(&root->inode_lock);
+                        goto again;
                 }
         }
         rb_link_node(&BTRFS_I(inode)->rb_node, parent, p);
@@ -3126,12 +3133,12 @@ static void inode_tree_del(struct inode *inode)
 {
         struct btrfs_root *root = BTRFS_I(inode)->root;
 
+        spin_lock(&root->inode_lock);
         if (!RB_EMPTY_NODE(&BTRFS_I(inode)->rb_node)) {
-                spin_lock(&root->inode_lock);
                 rb_erase(&BTRFS_I(inode)->rb_node, &root->inode_tree);
-                spin_unlock(&root->inode_lock);
                 RB_CLEAR_NODE(&BTRFS_I(inode)->rb_node);
         }
+        spin_unlock(&root->inode_lock);
 }
 
 static noinline void init_btrfs_i(struct inode *inode)
diff --git a/fs/buffer.c b/fs/buffer.c
index a3ef091a45bd..28f320fac4d4 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1165,8 +1165,11 @@ void mark_buffer_dirty(struct buffer_head *bh)
 
         if (!test_set_buffer_dirty(bh)) {
                 struct page *page = bh->b_page;
-                if (!TestSetPageDirty(page))
-                        __set_page_dirty(page, page_mapping(page), 0);
+                if (!TestSetPageDirty(page)) {
+                        struct address_space *mapping = page_mapping(page);
+                        if (mapping)
+                                __set_page_dirty(page, mapping, 0);
+                }
         }
 }
 
diff --git a/fs/exec.c b/fs/exec.c
index 4a8849e45b21..fb4f3cdda78c 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -678,8 +678,8 @@ exit:
 }
 EXPORT_SYMBOL(open_exec);
 
-int kernel_read(struct file *file, unsigned long offset,
-        char *addr, unsigned long count)
+int kernel_read(struct file *file, loff_t offset,
+                char *addr, unsigned long count)
 {
         mm_segment_t old_fs;
         loff_t pos = offset;
diff --git a/fs/ext3/Kconfig b/fs/ext3/Kconfig
index fb3c1a21b135..522b15498f45 100644
--- a/fs/ext3/Kconfig
+++ b/fs/ext3/Kconfig
@@ -29,23 +29,25 @@ config EXT3_FS
           module will be called ext3.
 
 config EXT3_DEFAULTS_TO_ORDERED
-        bool "Default to 'data=ordered' in ext3 (legacy option)"
+        bool "Default to 'data=ordered' in ext3"
         depends on EXT3_FS
         help
-          If a filesystem does not explicitly specify a data ordering
-          mode, and the journal capability allowed it, ext3 used to
-          historically default to 'data=ordered'.
-
-          That was a rather unfortunate choice, because it leads to all
-          kinds of latency problems, and the 'data=writeback' mode is more
-          appropriate these days.
-
-          You should probably always answer 'n' here, and if you really
-          want to use 'data=ordered' mode, set it in the filesystem itself
-          with 'tune2fs -o journal_data_ordered'.
-
-          But if you really want to enable the legacy default, you can do
-          so by answering 'y' to this question.
+          The journal mode options for ext3 have different tradeoffs
+          between when data is guaranteed to be on disk and
+          performance.  The use of "data=writeback" can cause
+          unwritten data to appear in files after an system crash or
+          power failure, which can be a security issue.  However,
+          "data=ordered" mode can also result in major performance
+          problems, including seconds-long delays before an fsync()
+          call returns.  For details, see:
+
+          http://ext4.wiki.kernel.org/index.php/Ext3_data_mode_tradeoffs
+
+          If you have been historically happy with ext3's performance,
+          data=ordered mode will be a safe choice and you should
+          answer 'y' here.  If you understand the reliability and data
+          privacy issues of data=writeback and are willing to make
+          that trade off, answer 'n'.
 
 config EXT3_FS_XATTR
         bool "Ext3 extended attributes"
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 524b349c6299..a8d80a7f1105 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -543,6 +543,19 @@ static inline void ext3_show_quota_options(struct seq_file *seq, struct super_bl
 #endif
 }
 
+static char *data_mode_string(unsigned long mode)
+{
+        switch (mode) {
+        case EXT3_MOUNT_JOURNAL_DATA:
+                return "journal";
+        case EXT3_MOUNT_ORDERED_DATA:
+                return "ordered";
+        case EXT3_MOUNT_WRITEBACK_DATA:
+                return "writeback";
+        }
+        return "unknown";
+}
+
 /*
  * Show an option if
  *  - it's set to a non-default value OR
@@ -616,13 +629,8 @@ static int ext3_show_options(struct seq_file *seq, struct vfsmount *vfs)
         if (test_opt(sb, NOBH))
                 seq_puts(seq, ",nobh");
 
-        if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_JOURNAL_DATA)
-                seq_puts(seq, ",data=journal");
-        else if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_ORDERED_DATA)
-                seq_puts(seq, ",data=ordered");
-        else if (test_opt(sb, DATA_FLAGS) == EXT3_MOUNT_WRITEBACK_DATA)
-                seq_puts(seq, ",data=writeback");
-
+        seq_printf(seq, ",data=%s", data_mode_string(sbi->s_mount_opt &
+                                                     EXT3_MOUNT_DATA_FLAGS));
         if (test_opt(sb, DATA_ERR_ABORT))
                 seq_puts(seq, ",data_err=abort");
 
@@ -1024,12 +1032,18 @@ static int parse_options (char *options, struct super_block *sb,
                 datacheck:
                         if (is_remount) {
                                 if ((sbi->s_mount_opt & EXT3_MOUNT_DATA_FLAGS)
-                                                != data_opt) {
-                                        printk(KERN_ERR
-                                                "EXT3-fs: cannot change data "
-                                                "mode on remount\n");
-                                        return 0;
-                                }
+                                                == data_opt)
+                                        break;
+                                printk(KERN_ERR
+                                        "EXT3-fs (device %s): Cannot change "
+                                        "data mode on remount. The filesystem "
+                                        "is mounted in data=%s mode and you "
+                                        "try to remount it in data=%s mode.\n",
+                                        sb->s_id,
+                                        data_mode_string(sbi->s_mount_opt &
+                                                        EXT3_MOUNT_DATA_FLAGS),
+                                        data_mode_string(data_opt));
+                                return 0;
                         } else {
                                 sbi->s_mount_opt &= ~EXT3_MOUNT_DATA_FLAGS;
                                 sbi->s_mount_opt |= data_opt;
diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
index 23419dc3027b..a7cbfbd340c7 100644
--- a/fs/gfs2/sys.c
+++ b/fs/gfs2/sys.c
@@ -386,16 +386,16 @@ static ssize_t jid_show(struct gfs2_sbd *sdp, char *buf)
 #define GDLM_ATTR(_name,_mode,_show,_store) \
 static struct gfs2_attr gdlm_attr_##_name = __ATTR(_name,_mode,_show,_store)
 
-GDLM_ATTR(proto_name,     0444, proto_name_show,        NULL);
-GDLM_ATTR(block,          0644, block_show,             block_store);
-GDLM_ATTR(withdraw,       0644, withdraw_show,          withdraw_store);
-GDLM_ATTR(id,             0444, lkid_show,              NULL);
-GDLM_ATTR(jid,            0444, jid_show,               NULL);
-GDLM_ATTR(first,          0444, lkfirst_show,           NULL);
-GDLM_ATTR(first_done,     0444, first_done_show,        NULL);
-GDLM_ATTR(recover,        0200, NULL,                   recover_store);
-GDLM_ATTR(recover_done,   0444, recover_done_show,      NULL);
-GDLM_ATTR(recover_status, 0444, recover_status_show,    NULL);
+GDLM_ATTR(proto_name,           0444, proto_name_show,          NULL);
+GDLM_ATTR(block,                0644, block_show,               block_store);
+GDLM_ATTR(withdraw,             0644, withdraw_show,            withdraw_store);
+GDLM_ATTR(id,                   0444, lkid_show,                NULL);
+GDLM_ATTR(jid,                  0444, jid_show,                 NULL);
+GDLM_ATTR(first,                0444, lkfirst_show,             NULL);
+GDLM_ATTR(first_done,           0444, first_done_show,          NULL);
+GDLM_ATTR(recover,              0600, NULL,                     recover_store);
+GDLM_ATTR(recover_done,         0444, recover_done_show,        NULL);
+GDLM_ATTR(recover_status,       0444, recover_status_show,      NULL);
 
 static struct attribute *lock_module_attrs[] = {
         &gdlm_attr_proto_name.attr,
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 941c8425c10b..cb88dac8ccaa 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -935,26 +935,28 @@ static int can_do_hugetlb_shm(void)
         return capable(CAP_IPC_LOCK) || in_group_p(sysctl_hugetlb_shm_group);
 }
 
-struct file *hugetlb_file_setup(const char *name, size_t size, int acctflag)
+struct file *hugetlb_file_setup(const char *name, size_t size, int acctflag,
+                                                struct user_struct **user)
 {
         int error = -ENOMEM;
-        int unlock_shm = 0;
         struct file *file;
         struct inode *inode;
         struct dentry *dentry, *root;
         struct qstr quick_string;
-        struct user_struct *user = current_user();
 
+        *user = NULL;
         if (!hugetlbfs_vfsmount)
                 return ERR_PTR(-ENOENT);
 
         if (!can_do_hugetlb_shm()) {
-                if (user_shm_lock(size, user)) {
-                        unlock_shm = 1;
+                *user = current_user();
+                if (user_shm_lock(size, *user)) {
                         WARN_ONCE(1,
                           "Using mlock ulimits for SHM_HUGETLB deprecated\n");
-                } else
+                } else {
+                        *user = NULL;
                         return ERR_PTR(-EPERM);
+                }
         }
 
         root = hugetlbfs_vfsmount->mnt_root;
@@ -996,8 +998,10 @@ out_inode:
 out_dentry:
         dput(dentry);
 out_shm_unlock:
-        if (unlock_shm)
-                user_shm_unlock(size, user);
+        if (*user) {
+                user_shm_unlock(size, *user);
+                *user = NULL;
+        }
         return ERR_PTR(error);
 }
 
diff --git a/fs/libfs.c b/fs/libfs.c
index ddfa89948c3f..dcec3d3ea64f 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -217,7 +217,7 @@ int get_sb_pseudo(struct file_system_type *fs_type, char *name,
                 return PTR_ERR(s);
 
         s->s_flags = MS_NOUSER;
-        s->s_maxbytes = ~0ULL;
+        s->s_maxbytes = MAX_LFS_FILESIZE;
         s->s_blocksize = PAGE_SIZE;
         s->s_blocksize_bits = PAGE_SHIFT;
         s->s_magic = magic;
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 489fc01a3204..e4e089a8f294 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -255,7 +255,7 @@ static void nfs_direct_read_release(void *calldata)
 
         if (put_dreq(dreq))
                 nfs_direct_complete(dreq);
-        nfs_readdata_release(calldata);
+        nfs_readdata_free(data);
 }
 
 static const struct rpc_call_ops nfs_read_direct_ops = {
@@ -314,14 +314,14 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
                                         data->npages, 1, 0, data->pagevec, NULL);
                 up_read(&current->mm->mmap_sem);
                 if (result < 0) {
-                        nfs_readdata_release(data);
+                        nfs_readdata_free(data);
                         break;
                 }
                 if ((unsigned)result < data->npages) {
                         bytes = result * PAGE_SIZE;
                         if (bytes <= pgbase) {
                                 nfs_direct_release_pages(data->pagevec, result);
-                                nfs_readdata_release(data);
+                                nfs_readdata_free(data);
                                 break;
                         }
                         bytes -= pgbase;
@@ -334,7 +334,7 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
                 data->inode = inode;
                 data->cred = msg.rpc_cred;
                 data->args.fh = NFS_FH(inode);
-                data->args.context = get_nfs_open_context(ctx);
+                data->args.context = ctx;
                 data->args.offset = pos;
                 data->args.pgbase = pgbase;
                 data->args.pages = data->pagevec;
@@ -441,7 +441,7 @@ static void nfs_direct_free_writedata(struct nfs_direct_req *dreq)
                 struct nfs_write_data *data = list_entry(dreq->rewrite_list.next, struct nfs_write_data, pages);
                 list_del(&data->pages);
                 nfs_direct_release_pages(data->pagevec, data->npages);
-                nfs_writedata_release(data);
+                nfs_writedata_free(data);
         }
 }
 
@@ -534,7 +534,7 @@ static void nfs_direct_commit_release(void *calldata)
 
         dprintk("NFS: %5u commit returned %d\n", data->task.tk_pid, status);
         nfs_direct_write_complete(dreq, data->inode);
-        nfs_commitdata_release(calldata);
+        nfs_commit_free(data);
 }
 
 static const struct rpc_call_ops nfs_commit_direct_ops = {
@@ -570,7 +570,7 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq)
         data->args.fh = NFS_FH(data->inode);
         data->args.offset = 0;
         data->args.count = 0;
-        data->args.context = get_nfs_open_context(dreq->ctx);
+        data->args.context = dreq->ctx;
         data->res.count = 0;
         data->res.fattr = &data->fattr;
         data->res.verf = &data->verf;
@@ -734,14 +734,14 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
                                         data->npages, 0, 0, data->pagevec, NULL);
                 up_read(&current->mm->mmap_sem);
                 if (result < 0) {
-                        nfs_writedata_release(data);
+                        nfs_writedata_free(data);
                         break;
                 }
                 if ((unsigned)result < data->npages) {
                         bytes = result * PAGE_SIZE;
                         if (bytes <= pgbase) {
                                 nfs_direct_release_pages(data->pagevec, result);
-                                nfs_writedata_release(data);
+                                nfs_writedata_free(data);
                                 break;
                         }
                         bytes -= pgbase;
@@ -756,7 +756,7 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
                 data->inode = inode;
                 data->cred = msg.rpc_cred;
                 data->args.fh = NFS_FH(inode);
-                data->args.context = get_nfs_open_context(ctx);
+                data->args.context = ctx;
                 data->args.offset = pos;
                 data->args.pgbase = pgbase;
                 data->args.pages = data->pagevec;
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 65ca8c18476f..1434080aefeb 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1250,8 +1250,8 @@ static void nfs4_state_manager(struct nfs_client *clp)
                                 continue;
                 }
                 /* Initialize or reset the session */
-                if (nfs4_has_session(clp) &&
-                   test_and_clear_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state)) {
+                if (test_and_clear_bit(NFS4CLNT_SESSION_SETUP, &clp->cl_state)
+                   && nfs4_has_session(clp)) {
                         if (clp->cl_cons_state == NFS_CS_SESSION_INITING)
                                 status = nfs4_initialize_session(clp);
                         else
diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index 73ea5e8d66ce..12c9e66d3f1d 100644
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -60,17 +60,15 @@ struct nfs_read_data *nfs_readdata_alloc(unsigned int pagecount)
         return p;
 }
 
-static void nfs_readdata_free(struct nfs_read_data *p)
+void nfs_readdata_free(struct nfs_read_data *p)
 {
         if (p && (p->pagevec != &p->page_array[0]))
                 kfree(p->pagevec);
         mempool_free(p, nfs_rdata_mempool);
 }
 
-void nfs_readdata_release(void *data)
+static void nfs_readdata_release(struct nfs_read_data *rdata)
 {
-        struct nfs_read_data *rdata = data;
-
         put_nfs_open_context(rdata->args.context);
         nfs_readdata_free(rdata);
 }
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 0a0a2ff767c3..a34fae21fe10 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -87,17 +87,15 @@ struct nfs_write_data *nfs_writedata_alloc(unsigned int pagecount)
         return p;
 }
 
-static void nfs_writedata_free(struct nfs_write_data *p)
+void nfs_writedata_free(struct nfs_write_data *p)
 {
         if (p && (p->pagevec != &p->page_array[0]))
                 kfree(p->pagevec);
         mempool_free(p, nfs_wdata_mempool);
 }
 
-void nfs_writedata_release(void *data)
+static void nfs_writedata_release(struct nfs_write_data *wdata)
 {
-        struct nfs_write_data *wdata = data;
-
         put_nfs_open_context(wdata->args.context);
         nfs_writedata_free(wdata);
 }
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index 8e2ec43b18f4..151964f0de4c 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -416,8 +416,10 @@ int nilfs_attach_checkpoint(struct nilfs_sb_info *sbi, __u64 cno)
         if (unlikely(err))
                 goto failed;
 
+        down_read(&nilfs->ns_segctor_sem);
         err = nilfs_cpfile_get_checkpoint(nilfs->ns_cpfile, cno, 0, &raw_cp,
                                           &bh_cp);
+        up_read(&nilfs->ns_segctor_sem);
         if (unlikely(err)) {
                 if (err == -ENOENT || err == -EINVAL) {
                         printk(KERN_ERR
diff --git a/fs/nilfs2/the_nilfs.h b/fs/nilfs2/the_nilfs.h
index e8adbffc626f..1b9caafb8662 100644
--- a/fs/nilfs2/the_nilfs.h
+++ b/fs/nilfs2/the_nilfs.h
@@ -253,7 +253,7 @@ nilfs_detach_writer(struct the_nilfs *nilfs, struct nilfs_sb_info *sbi)
 
 static inline void nilfs_put_sbinfo(struct nilfs_sb_info *sbi)
 {
-        if (!atomic_dec_and_test(&sbi->s_count))
+        if (atomic_dec_and_test(&sbi->s_count))
                 kfree(sbi);
 }
 
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index 47cd258fd24d..5dcbafe72d71 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -62,13 +62,14 @@ static int inotify_handle_event(struct fsnotify_group *group, struct fsnotify_ev
         event_priv->wd = wd;
 
         ret = fsnotify_add_notify_event(group, event, fsn_event_priv);
-        /* EEXIST is not an error */
-        if (ret == -EEXIST)
-                ret = 0;
-
-        /* did event_priv get attached? */
-        if (list_empty(&fsn_event_priv->event_list))
+        if (ret) {
                 inotify_free_event_priv(fsn_event_priv);
+                /* EEXIST says we tail matched, EOVERFLOW isn't something
+                 * to report up the stack. */
+                if ((ret == -EEXIST) ||
+                    (ret == -EOVERFLOW))
+                        ret = 0;
+        }
 
         /*
          * If we hold the entry until after the event is on the queue
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index f30d9bbc2e1b..dc32ed8323ba 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -386,6 +386,7 @@ void inotify_ignored_and_remove_idr(struct fsnotify_mark_entry *entry,
         struct fsnotify_event *ignored_event;
         struct inotify_event_private_data *event_priv;
         struct fsnotify_event_private_data *fsn_event_priv;
+        int ret;
 
         ignored_event = fsnotify_create_event(NULL, FS_IN_IGNORED, NULL,
                                               FSNOTIFY_EVENT_NONE, NULL, 0,
@@ -404,10 +405,8 @@ void inotify_ignored_and_remove_idr(struct fsnotify_mark_entry *entry,
         fsn_event_priv->group = group;
         event_priv->wd = ientry->wd;
 
-        fsnotify_add_notify_event(group, ignored_event, fsn_event_priv);
-
-        /* did the private data get added? */
-        if (list_empty(&fsn_event_priv->event_list))
+        ret = fsnotify_add_notify_event(group, ignored_event, fsn_event_priv);
+        if (ret)
                 inotify_free_event_priv(fsn_event_priv);
 
 skip_send_ignore:
@@ -568,7 +567,7 @@ static struct fsnotify_group *inotify_new_group(struct user_struct *user, unsign
 
         spin_lock_init(&group->inotify_data.idr_lock);
         idr_init(&group->inotify_data.idr);
-        group->inotify_data.last_wd = 0;
+        group->inotify_data.last_wd = 1;
         group->inotify_data.user = user;
         group->inotify_data.fa = NULL;
 
diff --git a/fs/notify/notification.c b/fs/notify/notification.c
index 521368574e97..3816d5750dd5 100644
--- a/fs/notify/notification.c
+++ b/fs/notify/notification.c
@@ -153,6 +153,10 @@ static bool event_compare(struct fsnotify_event *old, struct fsnotify_event *new
                                 return true;
                         break;
                 case (FSNOTIFY_EVENT_NONE):
+                        if (old->mask & FS_Q_OVERFLOW)
+                                return true;
+                        else if (old->mask & FS_IN_IGNORED)
+                                return false;
                         return false;
                 };
         }
@@ -171,9 +175,7 @@ int fsnotify_add_notify_event(struct fsnotify_group *group, struct fsnotify_even
         struct list_head *list = &group->notification_list;
         struct fsnotify_event_holder *last_holder;
         struct fsnotify_event *last_event;
-
-        /* easy to tell if priv was attached to the event */
-        INIT_LIST_HEAD(&priv->event_list);
+        int ret = 0;
 
         /*
          * There is one fsnotify_event_holder embedded inside each fsnotify_event.
@@ -194,6 +196,7 @@ alloc_holder:
 
         if (group->q_len >= group->max_events) {
                 event = &q_overflow_event;
+                ret = -EOVERFLOW;
                 /* sorry, no private data on the overflow event */
                 priv = NULL;
         }
@@ -235,7 +238,7 @@ alloc_holder:
         mutex_unlock(&group->notification_mutex);
 
         wake_up(&group->notification_waitq);
-        return 0;
+        return ret;
 }
 
 /*
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 9edcde4974aa..ab513ddaeff2 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -1914,7 +1914,8 @@ static void ocfs2_adjust_adjacent_records(struct ocfs2_extent_rec *left_rec,
          * immediately to their right.
          */
         left_clusters = le32_to_cpu(right_child_el->l_recs[0].e_cpos);
-        if (ocfs2_is_empty_extent(&right_child_el->l_recs[0])) {
+        if (!ocfs2_rec_clusters(right_child_el, &right_child_el->l_recs[0])) {
+                BUG_ON(right_child_el->l_tree_depth);
                 BUG_ON(le16_to_cpu(right_child_el->l_next_free_rec) <= 1);
                 left_clusters = le32_to_cpu(right_child_el->l_recs[1].e_cpos);
         }
@@ -2476,15 +2477,37 @@ out_ret_path:
         return ret;
 }
 
-static void ocfs2_update_edge_lengths(struct inode *inode, handle_t *handle,
-                                      struct ocfs2_path *path)
+static int ocfs2_update_edge_lengths(struct inode *inode, handle_t *handle,
+                                     int subtree_index, struct ocfs2_path *path)
 {
-        int i, idx;
+        int i, idx, ret;
         struct ocfs2_extent_rec *rec;
         struct ocfs2_extent_list *el;
         struct ocfs2_extent_block *eb;
         u32 range;
 
+        /*
+         * In normal tree rotation process, we will never touch the
+         * tree branch above subtree_index and ocfs2_extend_rotate_transaction
+         * doesn't reserve the credits for them either.
+         *
+         * But we do have a special case here which will update the rightmost
+         * records for all the bh in the path.
+         * So we have to allocate extra credits and access them.
+         */
+        ret = ocfs2_extend_trans(handle,
+                                 handle->h_buffer_credits + subtree_index);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
+
+        ret = ocfs2_journal_access_path(inode, handle, path);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
+
         /* Path should always be rightmost. */
         eb = (struct ocfs2_extent_block *)path_leaf_bh(path)->b_data;
         BUG_ON(eb->h_next_leaf_blk != 0ULL);
@@ -2505,6 +2528,8 @@ static void ocfs2_update_edge_lengths(struct inode *inode, handle_t *handle,
 
                 ocfs2_journal_dirty(handle, path->p_node[i].bh);
         }
+out:
+        return ret;
 }
 
 static void ocfs2_unlink_path(struct inode *inode, handle_t *handle,
@@ -2717,7 +2742,12 @@ static int ocfs2_rotate_subtree_left(struct inode *inode, handle_t *handle,
         if (del_right_subtree) {
                 ocfs2_unlink_subtree(inode, handle, left_path, right_path,
                                      subtree_index, dealloc);
-                ocfs2_update_edge_lengths(inode, handle, left_path);
+                ret = ocfs2_update_edge_lengths(inode, handle, subtree_index,
+                                                left_path);
+                if (ret) {
+                        mlog_errno(ret);
+                        goto out;
+                }
 
                 eb = (struct ocfs2_extent_block *)path_leaf_bh(left_path)->b_data;
                 ocfs2_et_set_last_eb_blk(et, le64_to_cpu(eb->h_blkno));
@@ -3034,7 +3064,12 @@ static int ocfs2_remove_rightmost_path(struct inode *inode, handle_t *handle,
 
                 ocfs2_unlink_subtree(inode, handle, left_path, path,
                                      subtree_index, dealloc);
-                ocfs2_update_edge_lengths(inode, handle, left_path);
+                ret = ocfs2_update_edge_lengths(inode, handle, subtree_index,
+                                                left_path);
+                if (ret) {
+                        mlog_errno(ret);
+                        goto out;
+                }
 
                 eb = (struct ocfs2_extent_block *)path_leaf_bh(left_path)->b_data;
                 ocfs2_et_set_last_eb_blk(et, le64_to_cpu(eb->h_blkno));
@@ -6816,7 +6851,7 @@ static int ocfs2_do_truncate(struct ocfs2_super *osb,
         }
         status = 0;
 bail:
-
+        brelse(last_eb_bh);
         mlog_exit(status);
         return status;
 }
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index b2c52b3a1484..b401654011a2 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -193,6 +193,7 @@ static int ocfs2_get_block(struct inode *inode, sector_t iblock,
                              (unsigned long long)OCFS2_I(inode)->ip_blkno);
                         mlog(ML_ERROR, "Size %llu, clusters %u\n", (unsigned long long)i_size_read(inode), OCFS2_I(inode)->ip_clusters);
                         dump_stack();
+                        goto bail;
                 }
 
                 past_eof = ocfs2_blocks_for_bytes(inode->i_sb, i_size_read(inode));
@@ -894,18 +895,17 @@ struct ocfs2_write_cluster_desc {
          */
         unsigned        c_new;
         unsigned        c_unwritten;
+        unsigned        c_needs_zero;
 };
 
-static inline int ocfs2_should_zero_cluster(struct ocfs2_write_cluster_desc *d)
-{
-        return d->c_new || d->c_unwritten;
-}
-
 struct ocfs2_write_ctxt {
         /* Logical cluster position / len of write */
         u32                             w_cpos;
         u32                             w_clen;
 
+        /* First cluster allocated in a nonsparse extend */
+        u32                             w_first_new_cpos;
+
         struct ocfs2_write_cluster_desc w_desc[OCFS2_MAX_CLUSTERS_PER_PAGE];
 
         /*
@@ -983,6 +983,7 @@ static int ocfs2_alloc_write_ctxt(struct ocfs2_write_ctxt **wcp,
                 return -ENOMEM;
 
         wc->w_cpos = pos >> osb->s_clustersize_bits;
+        wc->w_first_new_cpos = UINT_MAX;
         cend = (pos + len - 1) >> osb->s_clustersize_bits;
         wc->w_clen = cend - wc->w_cpos + 1;
         get_bh(di_bh);
@@ -1217,20 +1218,18 @@ out:
  */
 static int ocfs2_write_cluster(struct address_space *mapping,
                                u32 phys, unsigned int unwritten,
+                               unsigned int should_zero,
                                struct ocfs2_alloc_context *data_ac,
                                struct ocfs2_alloc_context *meta_ac,
                                struct ocfs2_write_ctxt *wc, u32 cpos,
                                loff_t user_pos, unsigned user_len)
 {
-        int ret, i, new, should_zero = 0;
+        int ret, i, new;
         u64 v_blkno, p_blkno;
         struct inode *inode = mapping->host;
         struct ocfs2_extent_tree et;
 
         new = phys == 0 ? 1 : 0;
-        if (new || unwritten)
-                should_zero = 1;
-
         if (new) {
                 u32 tmp_pos;
 
@@ -1301,7 +1300,7 @@ static int ocfs2_write_cluster(struct address_space *mapping,
                 if (tmpret) {
                         mlog_errno(tmpret);
                         if (ret == 0)
-                                tmpret = ret;
+                                ret = tmpret;
                 }
         }
 
@@ -1341,7 +1340,9 @@ static int ocfs2_write_cluster_by_desc(struct address_space *mapping,
                         local_len = osb->s_clustersize - cluster_off;
 
                 ret = ocfs2_write_cluster(mapping, desc->c_phys,
-                                          desc->c_unwritten, data_ac, meta_ac,
+                                          desc->c_unwritten,
+                                          desc->c_needs_zero,
+                                          data_ac, meta_ac,
                                           wc, desc->c_cpos, pos, local_len);
                 if (ret) {
                         mlog_errno(ret);
@@ -1391,14 +1392,14 @@ static void ocfs2_set_target_boundaries(struct ocfs2_super *osb,
                  * newly allocated cluster.
                  */
                 desc = &wc->w_desc[0];
-                if (ocfs2_should_zero_cluster(desc))
+                if (desc->c_needs_zero)
                         ocfs2_figure_cluster_boundaries(osb,
                                                         desc->c_cpos,
                                                         &wc->w_target_from,
                                                         NULL);
 
                 desc = &wc->w_desc[wc->w_clen - 1];
-                if (ocfs2_should_zero_cluster(desc))
+                if (desc->c_needs_zero)
                         ocfs2_figure_cluster_boundaries(osb,
                                                         desc->c_cpos,
                                                         NULL,
@@ -1466,13 +1467,28 @@ static int ocfs2_populate_write_desc(struct inode *inode,
                         phys++;
                 }
 
+                /*
+                 * If w_first_new_cpos is < UINT_MAX, we have a non-sparse
+                 * file that got extended.  w_first_new_cpos tells us
+                 * where the newly allocated clusters are so we can
+                 * zero them.
+                 */
+                if (desc->c_cpos >= wc->w_first_new_cpos) {
+                        BUG_ON(phys == 0);
+                        desc->c_needs_zero = 1;
+                }
+
                 desc->c_phys = phys;
                 if (phys == 0) {
                         desc->c_new = 1;
+                        desc->c_needs_zero = 1;
                         *clusters_to_alloc = *clusters_to_alloc + 1;
                 }
-                if (ext_flags & OCFS2_EXT_UNWRITTEN)
+
+                if (ext_flags & OCFS2_EXT_UNWRITTEN) {
                         desc->c_unwritten = 1;
+                        desc->c_needs_zero = 1;
+                }
 
                 num_clusters--;
         }
@@ -1632,10 +1648,13 @@ static int ocfs2_expand_nonsparse_inode(struct inode *inode, loff_t pos,
         if (newsize <= i_size_read(inode))
                 return 0;
 
-        ret = ocfs2_extend_no_holes(inode, newsize, newsize - len);
+        ret = ocfs2_extend_no_holes(inode, newsize, pos);
         if (ret)
                 mlog_errno(ret);
 
+        wc->w_first_new_cpos =
+                ocfs2_clusters_for_bytes(inode->i_sb, i_size_read(inode));
+
         return ret;
 }
 
@@ -1644,7 +1663,7 @@ int ocfs2_write_begin_nolock(struct address_space *mapping,
                              struct page **pagep, void **fsdata,
                              struct buffer_head *di_bh, struct page *mmap_page)
 {
-        int ret, credits = OCFS2_INODE_UPDATE_CREDITS;
+        int ret, cluster_of_pages, credits = OCFS2_INODE_UPDATE_CREDITS;
         unsigned int clusters_to_alloc, extents_to_split;
         struct ocfs2_write_ctxt *wc;
         struct inode *inode = mapping->host;
@@ -1722,8 +1741,19 @@ int ocfs2_write_begin_nolock(struct address_space *mapping,
 
         }
 
-        ocfs2_set_target_boundaries(osb, wc, pos, len,
-                                    clusters_to_alloc + extents_to_split);
+        /*
+         * We have to zero sparse allocated clusters, unwritten extent clusters,
+         * and non-sparse clusters we just extended.  For non-sparse writes,
+         * we know zeros will only be needed in the first and/or last cluster.
+         */
+        if (clusters_to_alloc || extents_to_split ||
+            wc->w_desc[0].c_needs_zero ||
+            wc->w_desc[wc->w_clen - 1].c_needs_zero)
+                cluster_of_pages = 1;
+        else
+                cluster_of_pages = 0;
+
+        ocfs2_set_target_boundaries(osb, wc, pos, len, cluster_of_pages);
 
         handle = ocfs2_start_trans(osb, credits);
         if (IS_ERR(handle)) {
@@ -1756,8 +1786,7 @@ int ocfs2_write_begin_nolock(struct address_space *mapping,
          * extent.
          */
         ret = ocfs2_grab_pages_for_write(mapping, wc, wc->w_cpos, pos,
-                                         clusters_to_alloc + extents_to_split,
-                                         mmap_page);
+                                         cluster_of_pages, mmap_page);
         if (ret) {
                 mlog_errno(ret);
                 goto out_quota;
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index b574431a031d..2f28b7de2c8d 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -310,22 +310,19 @@ out_attach:
         return ret;
 }
 
-static DEFINE_SPINLOCK(dentry_list_lock);
+DEFINE_SPINLOCK(dentry_list_lock);
 
 /* We limit the number of dentry locks to drop in one go. We have
  * this limit so that we don't starve other users of ocfs2_wq. */
 #define DL_INODE_DROP_COUNT 64
 
 /* Drop inode references from dentry locks */
-void ocfs2_drop_dl_inodes(struct work_struct *work)
+static void __ocfs2_drop_dl_inodes(struct ocfs2_super *osb, int drop_count)
 {
-        struct ocfs2_super *osb = container_of(work, struct ocfs2_super,
-                                               dentry_lock_work);
         struct ocfs2_dentry_lock *dl;
-        int drop_count = DL_INODE_DROP_COUNT;
 
         spin_lock(&dentry_list_lock);
-        while (osb->dentry_lock_list && drop_count--) {
+        while (osb->dentry_lock_list && (drop_count < 0 || drop_count--)) {
                 dl = osb->dentry_lock_list;
                 osb->dentry_lock_list = dl->dl_next;
                 spin_unlock(&dentry_list_lock);
@@ -333,11 +330,32 @@ void ocfs2_drop_dl_inodes(struct work_struct *work)
                 kfree(dl);
                 spin_lock(&dentry_list_lock);
         }
-        if (osb->dentry_lock_list)
+        spin_unlock(&dentry_list_lock);
+}
+
+void ocfs2_drop_dl_inodes(struct work_struct *work)
+{
+        struct ocfs2_super *osb = container_of(work, struct ocfs2_super,
+                                               dentry_lock_work);
+
+        __ocfs2_drop_dl_inodes(osb, DL_INODE_DROP_COUNT);
+        /*
+         * Don't queue dropping if umount is in progress. We flush the
+         * list in ocfs2_dismount_volume
+         */
+        spin_lock(&dentry_list_lock);
+        if (osb->dentry_lock_list &&
+            !ocfs2_test_osb_flag(osb, OCFS2_OSB_DROP_DENTRY_LOCK_IMMED))
                 queue_work(ocfs2_wq, &osb->dentry_lock_work);
         spin_unlock(&dentry_list_lock);
 }
 
+/* Flush the whole work queue */
+void ocfs2_drop_all_dl_inodes(struct ocfs2_super *osb)
+{
+        __ocfs2_drop_dl_inodes(osb, -1);
+}
+
 /*
  * ocfs2_dentry_iput() and friends.
  *
@@ -368,7 +386,8 @@ static void ocfs2_drop_dentry_lock(struct ocfs2_super *osb,
         /* We leave dropping of inode reference to ocfs2_wq as that can
          * possibly lead to inode deletion which gets tricky */
         spin_lock(&dentry_list_lock);
-        if (!osb->dentry_lock_list)
+        if (!osb->dentry_lock_list &&
+            !ocfs2_test_osb_flag(osb, OCFS2_OSB_DROP_DENTRY_LOCK_IMMED))
                 queue_work(ocfs2_wq, &osb->dentry_lock_work);
         dl->dl_next = osb->dentry_lock_list;
         osb->dentry_lock_list = dl;
diff --git a/fs/ocfs2/dcache.h b/fs/ocfs2/dcache.h
index faa12e75f98d..f5dd1789acf1 100644
--- a/fs/ocfs2/dcache.h
+++ b/fs/ocfs2/dcache.h
@@ -49,10 +49,13 @@ struct ocfs2_dentry_lock {
 int ocfs2_dentry_attach_lock(struct dentry *dentry, struct inode *inode,
                              u64 parent_blkno);
 
+extern spinlock_t dentry_list_lock;
+
 void ocfs2_dentry_lock_put(struct ocfs2_super *osb,
                            struct ocfs2_dentry_lock *dl);
 
 void ocfs2_drop_dl_inodes(struct work_struct *work);
+void ocfs2_drop_all_dl_inodes(struct ocfs2_super *osb);
 
 struct dentry *ocfs2_find_local_alias(struct inode *inode, u64 parent_blkno,
                                       int skip_unhashed);
diff --git a/fs/ocfs2/dlm/dlmast.c b/fs/ocfs2/dlm/dlmast.c
index d07ddbe4b283..81eff8e58322 100644
--- a/fs/ocfs2/dlm/dlmast.c
+++ b/fs/ocfs2/dlm/dlmast.c
@@ -103,7 +103,6 @@ static void __dlm_queue_ast(struct dlm_ctxt *dlm, struct dlm_lock *lock)
                      lock->ast_pending, lock->ml.type);
                 BUG();
         }
-        BUG_ON(!list_empty(&lock->ast_list));
         if (lock->ast_pending)
                 mlog(0, "lock has an ast getting flushed right now\n");
 
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index bcb9260c3735..43e6e3280569 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1118,7 +1118,7 @@ static int dlm_send_mig_lockres_msg(struct dlm_ctxt *dlm,
 
         mlog(0, "%s:%.*s: sending mig lockres (%s) to %u\n",
              dlm->name, res->lockname.len, res->lockname.name,
-             orig_flags & DLM_MRES_MIGRATION ? "migrate" : "recovery",
+             orig_flags & DLM_MRES_MIGRATION ? "migration" : "recovery",
              send_to);
 
         /* send it */
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index fcf879ed6930..756f5b0998e0 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -122,7 +122,7 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
          * that still has AST's pending... */
         in_use = !list_empty(&lock->ast_list);
         spin_unlock(&dlm->ast_lock);
-        if (in_use) {
+        if (in_use && !(flags & LKM_CANCEL)) {
                mlog(ML_ERROR, "lockres %.*s: Someone is calling dlmunlock "
                     "while waiting for an ast!", res->lockname.len,
                     res->lockname.name);
@@ -131,7 +131,7 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
 
         spin_lock(&res->spinlock);
         if (res->state & DLM_LOCK_RES_IN_PROGRESS) {
-                if (master_node) {
+                if (master_node && !(flags & LKM_CANCEL)) {
                         mlog(ML_ERROR, "lockres in progress!\n");
                         spin_unlock(&res->spinlock);
                         return DLM_FORWARD;
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 62442e413a00..aa501d3f93f1 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1851,6 +1851,7 @@ relock:
                 if (ret)
                         goto out_dio;
 
+                count = ocount;
                 ret = generic_write_checks(file, ppos, &count,
                                            S_ISBLK(inode->i_mode));
                 if (ret)
@@ -1918,8 +1919,10 @@ out_sems:
 
         mutex_unlock(&inode->i_mutex);
 
+        if (written)
+                ret = written;
         mlog_exit(ret);
-        return written ? written : ret;
+        return ret;
 }
 
 static int ocfs2_splice_to_file(struct pipe_inode_info *pipe,
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index f033760ecbea..c48b93ac6b65 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -1954,10 +1954,16 @@ void ocfs2_orphan_scan_init(struct ocfs2_super *osb)
         os->os_osb = osb;
         os->os_count = 0;
         os->os_seqno = 0;
-        os->os_scantime = CURRENT_TIME;
         mutex_init(&os->os_lock);
         INIT_DELAYED_WORK(&os->os_orphan_scan_work, ocfs2_orphan_scan_work);
+}
 
+void ocfs2_orphan_scan_start(struct ocfs2_super *osb)
+{
+        struct ocfs2_orphan_scan *os;
+
+        os = &osb->osb_orphan_scan;
+        os->os_scantime = CURRENT_TIME;
         if (ocfs2_is_hard_readonly(osb) || ocfs2_mount_local(osb))
                 atomic_set(&os->os_state, ORPHAN_SCAN_INACTIVE);
         else {
diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
index 5432c7f79cc6..2c3222aec622 100644
--- a/fs/ocfs2/journal.h
+++ b/fs/ocfs2/journal.h
@@ -145,6 +145,7 @@ static inline void ocfs2_inode_set_new(struct ocfs2_super *osb,
 
 /* Exported only for the journal struct init code in super.c. Do not call. */
 void ocfs2_orphan_scan_init(struct ocfs2_super *osb);
+void ocfs2_orphan_scan_start(struct ocfs2_super *osb);
 void ocfs2_orphan_scan_stop(struct ocfs2_super *osb);
 void ocfs2_orphan_scan_exit(struct ocfs2_super *osb);
 
@@ -329,20 +330,27 @@ int                  ocfs2_journal_dirty(handle_t *handle,
 /* extended attribute block update */
 #define OCFS2_XATTR_BLOCK_UPDATE_CREDITS 1
 
+/* Update of a single quota block */
+#define OCFS2_QUOTA_BLOCK_UPDATE_CREDITS 1
+
 /* global quotafile inode update, data block */
-#define OCFS2_QINFO_WRITE_CREDITS (OCFS2_INODE_UPDATE_CREDITS + 1)
+#define OCFS2_QINFO_WRITE_CREDITS (OCFS2_INODE_UPDATE_CREDITS + \
+                                   OCFS2_QUOTA_BLOCK_UPDATE_CREDITS)
 
+#define OCFS2_LOCAL_QINFO_WRITE_CREDITS OCFS2_QUOTA_BLOCK_UPDATE_CREDITS
 /*
  * The two writes below can accidentally see global info dirty due
  * to set_info() quotactl so make them prepared for the writes.
  */
 /* quota data block, global info */
 /* Write to local quota file */
-#define OCFS2_QWRITE_CREDITS (OCFS2_QINFO_WRITE_CREDITS + 1)
+#define OCFS2_QWRITE_CREDITS (OCFS2_QINFO_WRITE_CREDITS + \
+                              OCFS2_QUOTA_BLOCK_UPDATE_CREDITS)
 
 /* global quota data block, local quota data block, global quota inode,
  * global quota info */
-#define OCFS2_QSYNC_CREDITS (OCFS2_INODE_UPDATE_CREDITS + 3)
+#define OCFS2_QSYNC_CREDITS (OCFS2_QINFO_WRITE_CREDITS + \
+                             2 * OCFS2_QUOTA_BLOCK_UPDATE_CREDITS)
 
 static inline int ocfs2_quota_trans_credits(struct super_block *sb)
 {
@@ -355,11 +363,6 @@ static inline int ocfs2_quota_trans_credits(struct super_block *sb)
         return credits;
 }
 
-/* Number of credits needed for removing quota structure from file */
-int ocfs2_calc_qdel_credits(struct super_block *sb, int type);
-/* Number of credits needed for initialization of new quota structure */
-int ocfs2_calc_qinit_credits(struct super_block *sb, int type);
-
 /* group extend. inode update and last group update. */
 #define OCFS2_GROUP_EXTEND_CREDITS      (OCFS2_INODE_UPDATE_CREDITS + 1)
 
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index c9345ebb8493..39e1d5a39505 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -224,10 +224,12 @@ enum ocfs2_mount_options
         OCFS2_MOUNT_GRPQUOTA = 1 << 10, /* We support group quotas */
 };
 
-#define OCFS2_OSB_SOFT_RO       0x0001
-#define OCFS2_OSB_HARD_RO       0x0002
-#define OCFS2_OSB_ERROR_FS      0x0004
-#define OCFS2_DEFAULT_ATIME_QUANTUM     60
+#define OCFS2_OSB_SOFT_RO                       0x0001
+#define OCFS2_OSB_HARD_RO                       0x0002
+#define OCFS2_OSB_ERROR_FS                      0x0004
+#define OCFS2_OSB_DROP_DENTRY_LOCK_IMMED        0x0008
+
+#define OCFS2_DEFAULT_ATIME_QUANTUM             60
 
 struct ocfs2_journal;
 struct ocfs2_slot_info;
@@ -490,6 +492,18 @@ static inline void ocfs2_set_osb_flag(struct ocfs2_super *osb,
         spin_unlock(&osb->osb_lock);
 }
 
+
+static inline unsigned long  ocfs2_test_osb_flag(struct ocfs2_super *osb,
+                                                 unsigned long flag)
+{
+        unsigned long ret;
+
+        spin_lock(&osb->osb_lock);
+        ret = osb->osb_flags & flag;
+        spin_unlock(&osb->osb_lock);
+        return ret;
+}
+
 static inline void ocfs2_set_ro_flag(struct ocfs2_super *osb,
                                      int hard)
 {
diff --git a/fs/ocfs2/ocfs2_lockid.h b/fs/ocfs2/ocfs2_lockid.h
index fcdba091af3d..c212cf5a2bdf 100644
--- a/fs/ocfs2/ocfs2_lockid.h
+++ b/fs/ocfs2/ocfs2_lockid.h
@@ -108,6 +108,7 @@ static char *ocfs2_lock_type_strings[] = {
         [OCFS2_LOCK_TYPE_OPEN] = "Open",
         [OCFS2_LOCK_TYPE_FLOCK] = "Flock",
         [OCFS2_LOCK_TYPE_QINFO] = "Quota",
+        [OCFS2_LOCK_TYPE_NFS_SYNC] = "NFSSync",
         [OCFS2_LOCK_TYPE_ORPHAN_SCAN] = "OrphanScan",
 };
 
diff --git a/fs/ocfs2/quota.h b/fs/ocfs2/quota.h
index 7365e2e08706..3fb96fcd4c81 100644
--- a/fs/ocfs2/quota.h
+++ b/fs/ocfs2/quota.h
@@ -50,7 +50,6 @@ struct ocfs2_mem_dqinfo {
         unsigned int dqi_chunks;        /* Number of chunks in local quota file */
         unsigned int dqi_blocks;        /* Number of blocks allocated for local quota file */
         unsigned int dqi_syncms;        /* How often should we sync with other nodes */
-        unsigned int dqi_syncjiff;      /* Precomputed dqi_syncms in jiffies */
         struct list_head dqi_chunk;     /* List of chunks */
         struct inode *dqi_gqinode;      /* Global quota file inode */
         struct ocfs2_lock_res dqi_gqlock;       /* Lock protecting quota information structure */
diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index edfa60cd155c..44f2a5e1d042 100644
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -23,6 +23,7 @@
 #include "sysfile.h"
 #include "dlmglue.h"
 #include "uptodate.h"
+#include "super.h"
 #include "quota.h"
 
 static struct workqueue_struct *ocfs2_quota_wq = NULL;
@@ -69,6 +70,7 @@ static void ocfs2_global_mem2diskdqb(void *dp, struct dquot *dquot)
         d->dqb_curspace = cpu_to_le64(m->dqb_curspace);
         d->dqb_btime = cpu_to_le64(m->dqb_btime);
         d->dqb_itime = cpu_to_le64(m->dqb_itime);
+        d->dqb_pad1 = d->dqb_pad2 = 0;
 }
 
 static int ocfs2_global_is_id(void *dp, struct dquot *dquot)
@@ -113,6 +115,15 @@ int ocfs2_read_quota_block(struct inode *inode, u64 v_block,
         int rc = 0;
         struct buffer_head *tmp = *bh;
 
+        if (i_size_read(inode) >> inode->i_sb->s_blocksize_bits <= v_block) {
+                ocfs2_error(inode->i_sb,
+                            "Quota file %llu is probably corrupted! Requested "
+                            "to read block %Lu but file has size only %Lu\n",
+                            (unsigned long long)OCFS2_I(inode)->ip_blkno,
+                            (unsigned long long)v_block,
+                            (unsigned long long)i_size_read(inode));
+                return -EIO;
+        }
         rc = ocfs2_read_virt_blocks(inode, v_block, 1, &tmp, 0,
                                     ocfs2_validate_quota_block);
         if (rc)
@@ -211,14 +222,13 @@ ssize_t ocfs2_quota_write(struct super_block *sb, int type,
 
         mutex_lock_nested(&gqinode->i_mutex, I_MUTEX_QUOTA);
         if (gqinode->i_size < off + len) {
-                down_write(&OCFS2_I(gqinode)->ip_alloc_sem);
-                err = ocfs2_extend_no_holes(gqinode, off + len, off);
-                up_write(&OCFS2_I(gqinode)->ip_alloc_sem);
-                if (err < 0)
-                        goto out;
+                loff_t rounded_end =
+                                ocfs2_align_bytes_to_blocks(sb, off + len);
+
+                /* Space is already allocated in ocfs2_global_read_dquot() */
                 err = ocfs2_simple_size_update(gqinode,
                                                oinfo->dqi_gqi_bh,
-                                               off + len);
+                                               rounded_end);
                 if (err < 0)
                         goto out;
                 new = 1;
@@ -234,7 +244,7 @@ ssize_t ocfs2_quota_write(struct super_block *sb, int type,
         }
         if (err) {
                 mlog_errno(err);
-                return err;
+                goto out;
         }
         lock_buffer(bh);
         if (new)
@@ -342,7 +352,6 @@ int ocfs2_global_read_info(struct super_block *sb, int type)
         info->dqi_bgrace = le32_to_cpu(dinfo.dqi_bgrace);
         info->dqi_igrace = le32_to_cpu(dinfo.dqi_igrace);
         oinfo->dqi_syncms = le32_to_cpu(dinfo.dqi_syncms);
-        oinfo->dqi_syncjiff = msecs_to_jiffies(oinfo->dqi_syncms);
         oinfo->dqi_gi.dqi_blocks = le32_to_cpu(dinfo.dqi_blocks);
         oinfo->dqi_gi.dqi_free_blk = le32_to_cpu(dinfo.dqi_free_blk);
         oinfo->dqi_gi.dqi_free_entry = le32_to_cpu(dinfo.dqi_free_entry);
@@ -352,7 +361,7 @@ int ocfs2_global_read_info(struct super_block *sb, int type)
         oinfo->dqi_gi.dqi_qtree_depth = qtree_depth(&oinfo->dqi_gi);
         INIT_DELAYED_WORK(&oinfo->dqi_sync_work, qsync_work_fn);
         queue_delayed_work(ocfs2_quota_wq, &oinfo->dqi_sync_work,
-                           oinfo->dqi_syncjiff);
+                           msecs_to_jiffies(oinfo->dqi_syncms));
 
 out_err:
         mlog_exit(status);
@@ -402,13 +411,36 @@ int ocfs2_global_write_info(struct super_block *sb, int type)
         return err;
 }
 
+static int ocfs2_global_qinit_alloc(struct super_block *sb, int type)
+{
+        struct ocfs2_mem_dqinfo *oinfo = sb_dqinfo(sb, type)->dqi_priv;
+
+        /*
+         * We may need to allocate tree blocks and a leaf block but not the
+         * root block
+         */
+        return oinfo->dqi_gi.dqi_qtree_depth;
+}
+
+static int ocfs2_calc_global_qinit_credits(struct super_block *sb, int type)
+{
+        /* We modify all the allocated blocks, tree root, and info block */
+        return (ocfs2_global_qinit_alloc(sb, type) + 2) *
+                        OCFS2_QUOTA_BLOCK_UPDATE_CREDITS;
+}
+
 /* Read in information from global quota file and acquire a reference to it.
  * dquot_acquire() has already started the transaction and locked quota file */
 int ocfs2_global_read_dquot(struct dquot *dquot)
 {
         int err, err2, ex = 0;
-        struct ocfs2_mem_dqinfo *info =
-                        sb_dqinfo(dquot->dq_sb, dquot->dq_type)->dqi_priv;
+        struct super_block *sb = dquot->dq_sb;
+        int type = dquot->dq_type;
+        struct ocfs2_mem_dqinfo *info = sb_dqinfo(sb, type)->dqi_priv;
+        struct ocfs2_super *osb = OCFS2_SB(sb);
+        struct inode *gqinode = info->dqi_gqinode;
+        int need_alloc = ocfs2_global_qinit_alloc(sb, type);
+        handle_t *handle = NULL;
 
         err = ocfs2_qinfo_lock(info, 0);
         if (err < 0)
@@ -419,14 +451,33 @@ int ocfs2_global_read_dquot(struct dquot *dquot)
         OCFS2_DQUOT(dquot)->dq_use_count++;
         OCFS2_DQUOT(dquot)->dq_origspace = dquot->dq_dqb.dqb_curspace;
         OCFS2_DQUOT(dquot)->dq_originodes = dquot->dq_dqb.dqb_curinodes;
+        ocfs2_qinfo_unlock(info, 0);
+
         if (!dquot->dq_off) {   /* No real quota entry? */
-                /* Upgrade to exclusive lock for allocation */
-                ocfs2_qinfo_unlock(info, 0);
-                err = ocfs2_qinfo_lock(info, 1);
-                if (err < 0)
-                        goto out_qlock;
                 ex = 1;
+                /*
+                 * Add blocks to quota file before we start a transaction since
+                 * locking allocators ranks above a transaction start
+                 */
+                WARN_ON(journal_current_handle());
+                down_write(&OCFS2_I(gqinode)->ip_alloc_sem);
+                err = ocfs2_extend_no_holes(gqinode,
+                        gqinode->i_size + (need_alloc << sb->s_blocksize_bits),
+                        gqinode->i_size);
+                up_write(&OCFS2_I(gqinode)->ip_alloc_sem);
+                if (err < 0)
+                        goto out;
         }
+
+        handle = ocfs2_start_trans(osb,
+                                   ocfs2_calc_global_qinit_credits(sb, type));
+        if (IS_ERR(handle)) {
+                err = PTR_ERR(handle);
+                goto out;
+        }
+        err = ocfs2_qinfo_lock(info, ex);
+        if (err < 0)
+                goto out_trans;
         err = qtree_write_dquot(&info->dqi_gi, dquot);
         if (ex && info_dirty(sb_dqinfo(dquot->dq_sb, dquot->dq_type))) {
                 err2 = __ocfs2_global_write_info(dquot->dq_sb, dquot->dq_type);
@@ -438,6 +489,9 @@ out_qlock:
                 ocfs2_qinfo_unlock(info, 1);
         else
                 ocfs2_qinfo_unlock(info, 0);
+out_trans:
+        if (handle)
+                ocfs2_commit_trans(osb, handle);
 out:
         if (err < 0)
                 mlog_errno(err);
@@ -607,7 +661,7 @@ static void qsync_work_fn(struct work_struct *work)
 
         dquot_scan_active(sb, ocfs2_sync_dquot_helper, oinfo->dqi_type);
         queue_delayed_work(ocfs2_quota_wq, &oinfo->dqi_sync_work,
-                           oinfo->dqi_syncjiff);
+                           msecs_to_jiffies(oinfo->dqi_syncms));
 }
 
 /*
@@ -635,20 +689,18 @@ out:
         return status;
 }
 
-int ocfs2_calc_qdel_credits(struct super_block *sb, int type)
+static int ocfs2_calc_qdel_credits(struct super_block *sb, int type)
 {
-        struct ocfs2_mem_dqinfo *oinfo;
-        int features[MAXQUOTAS] = { OCFS2_FEATURE_RO_COMPAT_USRQUOTA,
-                                    OCFS2_FEATURE_RO_COMPAT_GRPQUOTA };
-
-        if (!OCFS2_HAS_RO_COMPAT_FEATURE(sb, features[type]))
-                return 0;
-
-        oinfo = sb_dqinfo(sb, type)->dqi_priv;
-        /* We modify tree, leaf block, global info, local chunk header,
-         * global and local inode */
-        return oinfo->dqi_gi.dqi_qtree_depth + 2 + 1 +
-               2 * OCFS2_INODE_UPDATE_CREDITS;
+        struct ocfs2_mem_dqinfo *oinfo = sb_dqinfo(sb, type)->dqi_priv;
+        /*
+         * We modify tree, leaf block, global info, local chunk header,
+         * global and local inode; OCFS2_QINFO_WRITE_CREDITS already
+         * accounts for inode update
+         */
+        return (oinfo->dqi_gi.dqi_qtree_depth + 2) *
+               OCFS2_QUOTA_BLOCK_UPDATE_CREDITS +
+               OCFS2_QINFO_WRITE_CREDITS +
+               OCFS2_INODE_UPDATE_CREDITS;
 }
 
 static int ocfs2_release_dquot(struct dquot *dquot)
@@ -680,33 +732,10 @@ out:
         return status;
 }
 
-int ocfs2_calc_qinit_credits(struct super_block *sb, int type)
-{
-        struct ocfs2_mem_dqinfo *oinfo;
-        int features[MAXQUOTAS] = { OCFS2_FEATURE_RO_COMPAT_USRQUOTA,
-                                    OCFS2_FEATURE_RO_COMPAT_GRPQUOTA };
-        struct ocfs2_dinode *lfe, *gfe;
-
-        if (!OCFS2_HAS_RO_COMPAT_FEATURE(sb, features[type]))
-                return 0;
-
-        oinfo = sb_dqinfo(sb, type)->dqi_priv;
-        gfe = (struct ocfs2_dinode *)oinfo->dqi_gqi_bh->b_data;
-        lfe = (struct ocfs2_dinode *)oinfo->dqi_lqi_bh->b_data;
-        /* We can extend local file + global file. In local file we
-         * can modify info, chunk header block and dquot block. In
-         * global file we can modify info, tree and leaf block */
-        return ocfs2_calc_extend_credits(sb, &lfe->id2.i_list, 0) +
-               ocfs2_calc_extend_credits(sb, &gfe->id2.i_list, 0) +
-               3 + oinfo->dqi_gi.dqi_qtree_depth + 2;
-}
-
 static int ocfs2_acquire_dquot(struct dquot *dquot)
 {
-        handle_t *handle;
         struct ocfs2_mem_dqinfo *oinfo =
                         sb_dqinfo(dquot->dq_sb, dquot->dq_type)->dqi_priv;
-        struct ocfs2_super *osb = OCFS2_SB(dquot->dq_sb);
         int status = 0;
 
         mlog_entry("id=%u, type=%d", dquot->dq_id, dquot->dq_type);
@@ -715,16 +744,7 @@ static int ocfs2_acquire_dquot(struct dquot *dquot)
         status = ocfs2_lock_global_qf(oinfo, 1);
         if (status < 0)
                 goto out;
-        handle = ocfs2_start_trans(osb,
-                ocfs2_calc_qinit_credits(dquot->dq_sb, dquot->dq_type));
-        if (IS_ERR(handle)) {
-                status = PTR_ERR(handle);
-                mlog_errno(status);
-                goto out_ilock;
-        }
         status = dquot_acquire(dquot);
-        ocfs2_commit_trans(osb, handle);
-out_ilock:
         ocfs2_unlock_global_qf(oinfo, 1);
 out:
         mlog_exit(status);
diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
index 5a460fa82553..bdb09cb6e1fe 100644
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -20,6 +20,7 @@
 #include "sysfile.h"
 #include "dlmglue.h"
 #include "quota.h"
+#include "uptodate.h"
 
 /* Number of local quota structures per block */
 static inline unsigned int ol_quota_entries_per_block(struct super_block *sb)
@@ -100,7 +101,8 @@ static int ocfs2_modify_bh(struct inode *inode, struct buffer_head *bh,
         handle_t *handle;
         int status;
 
-        handle = ocfs2_start_trans(OCFS2_SB(sb), 1);
+        handle = ocfs2_start_trans(OCFS2_SB(sb),
+                                   OCFS2_QUOTA_BLOCK_UPDATE_CREDITS);
         if (IS_ERR(handle)) {
                 status = PTR_ERR(handle);
                 mlog_errno(status);
@@ -610,7 +612,8 @@ int ocfs2_finish_quota_recovery(struct ocfs2_super *osb,
                         goto out_bh;
                 /* Mark quota file as clean if we are recovering quota file of
                  * some other node. */
-                handle = ocfs2_start_trans(osb, 1);
+                handle = ocfs2_start_trans(osb,
+                                           OCFS2_LOCAL_QINFO_WRITE_CREDITS);
                 if (IS_ERR(handle)) {
                         status = PTR_ERR(handle);
                         mlog_errno(status);
@@ -940,7 +943,7 @@ static struct ocfs2_quota_chunk *ocfs2_local_quota_add_chunk(
         struct ocfs2_local_disk_chunk *dchunk;
         int status;
         handle_t *handle;
-        struct buffer_head *bh = NULL;
+        struct buffer_head *bh = NULL, *dbh = NULL;
         u64 p_blkno;
 
         /* We are protected by dqio_sem so no locking needed */
@@ -964,32 +967,35 @@ static struct ocfs2_quota_chunk *ocfs2_local_quota_add_chunk(
                 mlog_errno(status);
                 goto out;
         }
+        /* Local quota info and two new blocks we initialize */
+        handle = ocfs2_start_trans(OCFS2_SB(sb),
+                        OCFS2_LOCAL_QINFO_WRITE_CREDITS +
+                        2 * OCFS2_QUOTA_BLOCK_UPDATE_CREDITS);
+        if (IS_ERR(handle)) {
+                status = PTR_ERR(handle);
+                mlog_errno(status);
+                goto out;
+        }
 
+        /* Initialize chunk header */
         down_read(&OCFS2_I(lqinode)->ip_alloc_sem);
         status = ocfs2_extent_map_get_blocks(lqinode, oinfo->dqi_blocks,
                                              &p_blkno, NULL, NULL);
         up_read(&OCFS2_I(lqinode)->ip_alloc_sem);
         if (status < 0) {
                 mlog_errno(status);
-                goto out;
+                goto out_trans;
         }
         bh = sb_getblk(sb, p_blkno);
         if (!bh) {
                 status = -ENOMEM;
                 mlog_errno(status);
-                goto out;
+                goto out_trans;
         }
         dchunk = (struct ocfs2_local_disk_chunk *)bh->b_data;
-
-        handle = ocfs2_start_trans(OCFS2_SB(sb), 2);
-        if (IS_ERR(handle)) {
-                status = PTR_ERR(handle);
-                mlog_errno(status);
-                goto out;
-        }
-
+        ocfs2_set_new_buffer_uptodate(lqinode, bh);
         status = ocfs2_journal_access_dq(handle, lqinode, bh,
-                                         OCFS2_JOURNAL_ACCESS_WRITE);
+                                         OCFS2_JOURNAL_ACCESS_CREATE);
         if (status < 0) {
                 mlog_errno(status);
                 goto out_trans;
@@ -999,7 +1005,6 @@ static struct ocfs2_quota_chunk *ocfs2_local_quota_add_chunk(
         memset(dchunk->dqc_bitmap, 0,
                sb->s_blocksize - sizeof(struct ocfs2_local_disk_chunk) -
                OCFS2_QBLK_RESERVED_SPACE);
-        set_buffer_uptodate(bh);
         unlock_buffer(bh);
         status = ocfs2_journal_dirty(handle, bh);
         if (status < 0) {
@@ -1007,6 +1012,38 @@ static struct ocfs2_quota_chunk *ocfs2_local_quota_add_chunk(
                 goto out_trans;
         }
 
+        /* Initialize new block with structures */
+        down_read(&OCFS2_I(lqinode)->ip_alloc_sem);
+        status = ocfs2_extent_map_get_blocks(lqinode, oinfo->dqi_blocks + 1,
+                                             &p_blkno, NULL, NULL);
+        up_read(&OCFS2_I(lqinode)->ip_alloc_sem);
+        if (status < 0) {
+                mlog_errno(status);
+                goto out_trans;
+        }
+        dbh = sb_getblk(sb, p_blkno);
+        if (!dbh) {
+                status = -ENOMEM;
+                mlog_errno(status);
+                goto out_trans;
+        }
+        ocfs2_set_new_buffer_uptodate(lqinode, dbh);
+        status = ocfs2_journal_access_dq(handle, lqinode, dbh,
+                                         OCFS2_JOURNAL_ACCESS_CREATE);
+        if (status < 0) {
+                mlog_errno(status);
+                goto out_trans;
+        }
+        lock_buffer(dbh);
+        memset(dbh->b_data, 0, sb->s_blocksize - OCFS2_QBLK_RESERVED_SPACE);
+        unlock_buffer(dbh);
+        status = ocfs2_journal_dirty(handle, dbh);
+        if (status < 0) {
+                mlog_errno(status);
+                goto out_trans;
+        }
+
+        /* Update local quotafile info */
         oinfo->dqi_blocks += 2;
         oinfo->dqi_chunks++;
         status = ocfs2_local_write_info(sb, type);
@@ -1031,6 +1068,7 @@ out_trans:
         ocfs2_commit_trans(OCFS2_SB(sb), handle);
 out:
         brelse(bh);
+        brelse(dbh);
         kmem_cache_free(ocfs2_qf_chunk_cachep, chunk);
         return ERR_PTR(status);
 }
@@ -1048,6 +1086,8 @@ static struct ocfs2_quota_chunk *ocfs2_extend_local_quota_file(
         struct ocfs2_local_disk_chunk *dchunk;
         int epb = ol_quota_entries_per_block(sb);
         unsigned int chunk_blocks;
+        struct buffer_head *bh;
+        u64 p_blkno;
         int status;
         handle_t *handle;
 
@@ -1075,12 +1115,49 @@ static struct ocfs2_quota_chunk *ocfs2_extend_local_quota_file(
                 mlog_errno(status);
                 goto out;
         }
-        handle = ocfs2_start_trans(OCFS2_SB(sb), 2);
+
+        /* Get buffer from the just added block */
+        down_read(&OCFS2_I(lqinode)->ip_alloc_sem);
+        status = ocfs2_extent_map_get_blocks(lqinode, oinfo->dqi_blocks,
+                                             &p_blkno, NULL, NULL);
+        up_read(&OCFS2_I(lqinode)->ip_alloc_sem);
+        if (status < 0) {
+                mlog_errno(status);
+                goto out;
+        }
+        bh = sb_getblk(sb, p_blkno);
+        if (!bh) {
+                status = -ENOMEM;
+                mlog_errno(status);
+                goto out;
+        }
+        ocfs2_set_new_buffer_uptodate(lqinode, bh);
+
+        /* Local quota info, chunk header and the new block we initialize */
+        handle = ocfs2_start_trans(OCFS2_SB(sb),
+                        OCFS2_LOCAL_QINFO_WRITE_CREDITS +
+                        2 * OCFS2_QUOTA_BLOCK_UPDATE_CREDITS);
         if (IS_ERR(handle)) {
                 status = PTR_ERR(handle);
                 mlog_errno(status);
                 goto out;
         }
+        /* Zero created block */
+        status = ocfs2_journal_access_dq(handle, lqinode, bh,
+                                 OCFS2_JOURNAL_ACCESS_CREATE);
+        if (status < 0) {
+                mlog_errno(status);
+                goto out_trans;
+        }
+        lock_buffer(bh);
+        memset(bh->b_data, 0, sb->s_blocksize);
+        unlock_buffer(bh);
+        status = ocfs2_journal_dirty(handle, bh);
+        if (status < 0) {
+                mlog_errno(status);
+                goto out_trans;
+        }
+        /* Update chunk header */
         status = ocfs2_journal_access_dq(handle, lqinode, chunk->qc_headerbh,
                                  OCFS2_JOURNAL_ACCESS_WRITE);
         if (status < 0) {
@@ -1097,6 +1174,7 @@ static struct ocfs2_quota_chunk *ocfs2_extend_local_quota_file(
                 mlog_errno(status);
                 goto out_trans;
         }
+        /* Update file header */
         oinfo->dqi_blocks++;
         status = ocfs2_local_write_info(sb, type);
         if (status < 0) {
diff --git a/fs/ocfs2/stack_o2cb.c b/fs/ocfs2/stack_o2cb.c
index 3f661376a2de..e49c41050264 100644
--- a/fs/ocfs2/stack_o2cb.c
+++ b/fs/ocfs2/stack_o2cb.c
@@ -17,6 +17,7 @@
  * General Public License for more details.
  */
 
+#include <linux/kernel.h>
 #include <linux/crc32.h>
 #include <linux/module.h>
 
@@ -153,7 +154,7 @@ static int status_map[] = {
 
 static int dlm_status_to_errno(enum dlm_status status)
 {
-        BUG_ON(status > (sizeof(status_map) / sizeof(status_map[0])));
+        BUG_ON(status < 0 || status >= ARRAY_SIZE(status_map));
 
         return status_map[status];
 }
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 7efb349fb9bd..a3f8871d21fd 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -777,6 +777,7 @@ static int ocfs2_sb_probe(struct super_block *sb,
                 }
                 di = (struct ocfs2_dinode *) (*bh)->b_data;
                 memset(stats, 0, sizeof(struct ocfs2_blockcheck_stats));
+                spin_lock_init(&stats->b_lock);
                 status = ocfs2_verify_volume(di, *bh, blksize, stats);
                 if (status >= 0)
                         goto bail;
@@ -1182,7 +1183,7 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent)
         wake_up(&osb->osb_mount_event);
 
         /* Start this when the mount is almost sure of being successful */
-        ocfs2_orphan_scan_init(osb);
+        ocfs2_orphan_scan_start(osb);
 
         mlog_exit(status);
         return status;
@@ -1213,14 +1214,31 @@ static int ocfs2_get_sb(struct file_system_type *fs_type,
                            mnt);
 }
 
+static void ocfs2_kill_sb(struct super_block *sb)
+{
+        struct ocfs2_super *osb = OCFS2_SB(sb);
+
+        /* Failed mount? */
+        if (!osb || atomic_read(&osb->vol_state) == VOLUME_DISABLED)
+                goto out;
+
+        /* Prevent further queueing of inode drop events */
+        spin_lock(&dentry_list_lock);
+        ocfs2_set_osb_flag(osb, OCFS2_OSB_DROP_DENTRY_LOCK_IMMED);
+        spin_unlock(&dentry_list_lock);
+        /* Wait for work to finish and/or remove it */
+        cancel_work_sync(&osb->dentry_lock_work);
+out:
+        kill_block_super(sb);
+}
+
 static struct file_system_type ocfs2_fs_type = {
         .owner          = THIS_MODULE,
         .name           = "ocfs2",
         .get_sb         = ocfs2_get_sb, /* is this called when we mount
                                         * the fs? */
-        .kill_sb        = kill_block_super, /* set to the generic one
-                                             * right now, but do we
-                                             * need to change that? */
+        .kill_sb        = ocfs2_kill_sb,
+
         .fs_flags       = FS_REQUIRES_DEV|FS_RENAME_DOES_D_MOVE,
         .next           = NULL
 };
@@ -1819,6 +1837,12 @@ static void ocfs2_dismount_volume(struct super_block *sb, int mnt_err)
 
         debugfs_remove(osb->osb_ctxt);
 
+        /*
+         * Flush inode dropping work queue so that deletes are
+         * performed while the filesystem is still working
+         */
+        ocfs2_drop_all_dl_inodes(osb);
+
         /* Orphan scan should be stopped as early as possible */
         ocfs2_orphan_scan_stop(osb);
 
@@ -1981,6 +2005,8 @@ static int ocfs2_initialize_super(struct super_block *sb,
         snprintf(osb->dev_str, sizeof(osb->dev_str), "%u,%u",
                  MAJOR(osb->sb->s_dev), MINOR(osb->sb->s_dev));
 
+        ocfs2_orphan_scan_init(osb);
+
         status = ocfs2_recovery_init(osb);
         if (status) {
                 mlog(ML_ERROR, "Unable to initialize recovery state\n");
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index ba320e250747..d1a27cda984f 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -1052,7 +1052,8 @@ static int ocfs2_xattr_block_get(struct inode *inode,
         struct ocfs2_xattr_block *xb;
         struct ocfs2_xattr_value_root *xv;
         size_t size;
-        int ret = -ENODATA, name_offset, name_len, block_off, i;
+        int ret = -ENODATA, name_offset, name_len, i;
+        int uninitialized_var(block_off);
 
         xs->bucket = ocfs2_xattr_bucket_new(inode);
         if (!xs->bucket) {
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 3ce5ae9e3d2d..6f742f6658a9 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -234,23 +234,20 @@ static int check_mem_permission(struct task_struct *task)
 
 struct mm_struct *mm_for_maps(struct task_struct *task)
 {
-        struct mm_struct *mm = get_task_mm(task);
-        if (!mm)
+        struct mm_struct *mm;
+
+        if (mutex_lock_killable(&task->cred_guard_mutex))
                 return NULL;
-        down_read(&mm->mmap_sem);
-        task_lock(task);
-        if (task->mm != mm)
-                goto out;
-        if (task->mm != current->mm &&
-            __ptrace_may_access(task, PTRACE_MODE_READ) < 0)
-                goto out;
-        task_unlock(task);
+
+        mm = get_task_mm(task);
+        if (mm && mm != current->mm &&
+                        !ptrace_may_access(task, PTRACE_MODE_READ)) {
+                mmput(mm);
+                mm = NULL;
+        }
+        mutex_unlock(&task->cred_guard_mutex);
+
         return mm;
-out:
-        task_unlock(task);
-        up_read(&mm->mmap_sem);
-        mmput(mm);
-        return NULL;
 }
 
 static int proc_pid_cmdline(struct task_struct *task, char * buffer)
@@ -1006,12 +1003,7 @@ static ssize_t oom_adjust_read(struct file *file, char __user *buf,
 
         if (!task)
                 return -ESRCH;
-        task_lock(task);
-        if (task->mm)
-                oom_adjust = task->mm->oom_adj;
-        else
-                oom_adjust = OOM_DISABLE;
-        task_unlock(task);
+        oom_adjust = task->oomkilladj;
         put_task_struct(task);
 
         len = snprintf(buffer, sizeof(buffer), "%i\n", oom_adjust);
@@ -1040,19 +1032,11 @@ static ssize_t oom_adjust_write(struct file *file, const char __user *buf,
         task = get_proc_task(file->f_path.dentry->d_inode);
         if (!task)
                 return -ESRCH;
-        task_lock(task);
-        if (!task->mm) {
-                task_unlock(task);
-                put_task_struct(task);
-                return -EINVAL;
-        }
-        if (oom_adjust < task->mm->oom_adj && !capable(CAP_SYS_RESOURCE)) {
-                task_unlock(task);
+        if (oom_adjust < task->oomkilladj && !capable(CAP_SYS_RESOURCE)) {
                 put_task_struct(task);
                 return -EACCES;
         }
-        task->mm->oom_adj = oom_adjust;
-        task_unlock(task);
+        task->oomkilladj = oom_adjust;
         put_task_struct(task);
         if (end - buffer == 0)
                 return -EIO;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 6f61b7cc32e0..9bd8be1d235c 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -119,6 +119,7 @@ static void *m_start(struct seq_file *m, loff_t *pos)
         mm = mm_for_maps(priv->task);
         if (!mm)
                 return NULL;
+        down_read(&mm->mmap_sem);
 
         tail_vma = get_gate_vma(priv->task);
         priv->tail_vma = tail_vma;
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index 64a72e2e7650..8f5c05d3dbd3 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -189,6 +189,7 @@ static void *m_start(struct seq_file *m, loff_t *pos)
                 priv->task = NULL;
                 return NULL;
         }
+        down_read(&mm->mmap_sem);
 
         /* start from the Nth VMA */
         for (p = rb_first(&mm->mm_rb); p; p = rb_next(p))
diff --git a/fs/select.c b/fs/select.c
index d870237e42c7..8084834e123e 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -110,6 +110,7 @@ void poll_initwait(struct poll_wqueues *pwq)
 {
         init_poll_funcptr(&pwq->pt, __pollwait);
         pwq->polling_task = current;
+        pwq->triggered = 0;
         pwq->error = 0;
         pwq->table = NULL;
         pwq->inline_index = 0;
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index 0c93c7ef3d18..965df1227d64 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -770,7 +770,7 @@ xfs_buf_associate_memory(
         bp->b_pages = NULL;
         bp->b_addr = mem;
 
-        rval = _xfs_buf_get_pages(bp, page_count, 0);
+        rval = _xfs_buf_get_pages(bp, page_count, XBF_DONT_BLOCK);
         if (rval)
                 return rval;
 
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index b619d6b8ca43..98ef624d9baf 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -708,6 +708,16 @@ xfs_reclaim_inode(
         return 0;
 }
 
+void
+__xfs_inode_set_reclaim_tag(
+        struct xfs_perag        *pag,
+        struct xfs_inode        *ip)
+{
+        radix_tree_tag_set(&pag->pag_ici_root,
+                           XFS_INO_TO_AGINO(ip->i_mount, ip->i_ino),
+                           XFS_ICI_RECLAIM_TAG);
+}
+
 /*
  * We set the inode flag atomically with the radix tree tag.
  * Once we get tag lookups on the radix tree, this inode flag
@@ -722,8 +732,7 @@ xfs_inode_set_reclaim_tag(
 
         read_lock(&pag->pag_ici_lock);
         spin_lock(&ip->i_flags_lock);
-        radix_tree_tag_set(&pag->pag_ici_root,
-                        XFS_INO_TO_AGINO(mp, ip->i_ino), XFS_ICI_RECLAIM_TAG);
+        __xfs_inode_set_reclaim_tag(pag, ip);
         __xfs_iflags_set(ip, XFS_IRECLAIMABLE);
         spin_unlock(&ip->i_flags_lock);
         read_unlock(&pag->pag_ici_lock);
diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/linux-2.6/xfs_sync.h
index 2a10301c99c7..59120602588a 100644
--- a/fs/xfs/linux-2.6/xfs_sync.h
+++ b/fs/xfs/linux-2.6/xfs_sync.h
@@ -48,6 +48,7 @@ int xfs_reclaim_inode(struct xfs_inode *ip, int locked, int sync_mode);
 int xfs_reclaim_inodes(struct xfs_mount *mp, int mode);
 
 void xfs_inode_set_reclaim_tag(struct xfs_inode *ip);
+void __xfs_inode_set_reclaim_tag(struct xfs_perag *pag, struct xfs_inode *ip);
 void xfs_inode_clear_reclaim_tag(struct xfs_inode *ip);
 void __xfs_inode_clear_reclaim_tag(struct xfs_mount *mp, struct xfs_perag *pag,
                                 struct xfs_inode *ip);
diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c
index db15feb906ff..4ece1906bd41 100644
--- a/fs/xfs/xfs_attr.c
+++ b/fs/xfs/xfs_attr.c
@@ -2010,7 +2010,9 @@ xfs_attr_rmtval_get(xfs_da_args_t *args)
                         dblkno = XFS_FSB_TO_DADDR(mp, map[i].br_startblock);
                         blkcnt = XFS_FSB_TO_BB(mp, map[i].br_blockcount);
                         error = xfs_read_buf(mp, mp->m_ddev_targp, dblkno,
-                                             blkcnt, XFS_BUF_LOCK, &bp);
+                                             blkcnt,
+                                             XFS_BUF_LOCK | XBF_DONT_BLOCK,
+                                             &bp);
                         if (error)
                                 return(error);
 
@@ -2141,8 +2143,8 @@ xfs_attr_rmtval_set(xfs_da_args_t *args)
                 dblkno = XFS_FSB_TO_DADDR(mp, map.br_startblock),
                 blkcnt = XFS_FSB_TO_BB(mp, map.br_blockcount);
 
-                bp = xfs_buf_get_flags(mp->m_ddev_targp, dblkno,
-                                                        blkcnt, XFS_BUF_LOCK);
+                bp = xfs_buf_get_flags(mp->m_ddev_targp, dblkno, blkcnt,
+                                       XFS_BUF_LOCK | XBF_DONT_BLOCK);
                 ASSERT(bp);
                 ASSERT(!XFS_BUF_GETERROR(bp));
 
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 7928b9983c1d..8ee5b5a76a2a 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -6009,7 +6009,7 @@ xfs_getbmap(
          */
         error = ENOMEM;
         subnex = 16;
-        map = kmem_alloc(subnex * sizeof(*map), KM_MAYFAIL);
+        map = kmem_alloc(subnex * sizeof(*map), KM_MAYFAIL | KM_NOFS);
         if (!map)
                 goto out_unlock_ilock;
 
diff --git a/fs/xfs/xfs_btree.c b/fs/xfs/xfs_btree.c
index e9df99574829..26717388acf5 100644
--- a/fs/xfs/xfs_btree.c
+++ b/fs/xfs/xfs_btree.c
@@ -120,8 +120,8 @@ xfs_btree_check_sblock(
                         XFS_RANDOM_BTREE_CHECK_SBLOCK))) {
                 if (bp)
                         xfs_buftrace("SBTREE ERROR", bp);
-                XFS_ERROR_REPORT("xfs_btree_check_sblock", XFS_ERRLEVEL_LOW,
-                                 cur->bc_mp);
+                XFS_CORRUPTION_ERROR("xfs_btree_check_sblock",
+                        XFS_ERRLEVEL_LOW, cur->bc_mp, block);
                 return XFS_ERROR(EFSCORRUPTED);
         }
         return 0;
diff --git a/fs/xfs/xfs_da_btree.c b/fs/xfs/xfs_da_btree.c
index 9ff6e57a5075..2847bbc1c534 100644
--- a/fs/xfs/xfs_da_btree.c
+++ b/fs/xfs/xfs_da_btree.c
@@ -2201,7 +2201,7 @@ kmem_zone_t *xfs_dabuf_zone;		/* dabuf zone */
 xfs_da_state_t *
 xfs_da_state_alloc(void)
 {
-        return kmem_zone_zalloc(xfs_da_state_zone, KM_SLEEP);
+        return kmem_zone_zalloc(xfs_da_state_zone, KM_NOFS);
 }
 
 /*
@@ -2261,9 +2261,9 @@ xfs_da_buf_make(int nbuf, xfs_buf_t **bps, inst_t *ra)
         int             off;
 
         if (nbuf == 1)
-                dabuf = kmem_zone_alloc(xfs_dabuf_zone, KM_SLEEP);
+                dabuf = kmem_zone_alloc(xfs_dabuf_zone, KM_NOFS);
         else
-                dabuf = kmem_alloc(XFS_DA_BUF_SIZE(nbuf), KM_SLEEP);
+                dabuf = kmem_alloc(XFS_DA_BUF_SIZE(nbuf), KM_NOFS);
         dabuf->dirty = 0;
 #ifdef XFS_DABUF_DEBUG
         dabuf->ra = ra;
diff --git a/fs/xfs/xfs_dir2.c b/fs/xfs/xfs_dir2.c
index c657bec6d951..bb1d58eb3982 100644
--- a/fs/xfs/xfs_dir2.c
+++ b/fs/xfs/xfs_dir2.c
@@ -256,7 +256,7 @@ xfs_dir_cilookup_result(
                                         !(args->op_flags & XFS_DA_OP_CILOOKUP))
                 return EEXIST;
 
-        args->value = kmem_alloc(len, KM_MAYFAIL);
+        args->value = kmem_alloc(len, KM_NOFS | KM_MAYFAIL);
         if (!args->value)
                 return ENOMEM;
 
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index cbd451bb4848..2d0b3e1da9e6 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -167,17 +167,25 @@ xfs_growfs_data_private(
         new = nb - mp->m_sb.sb_dblocks;
         oagcount = mp->m_sb.sb_agcount;
         if (nagcount > oagcount) {
+                void *new_perag, *old_perag;
+
                 xfs_filestream_flush(mp);
+
+                new_perag = kmem_zalloc(sizeof(xfs_perag_t) * nagcount,
+                                        KM_MAYFAIL);
+                if (!new_perag)
+                        return XFS_ERROR(ENOMEM);
+
                 down_write(&mp->m_peraglock);
-                mp->m_perag = kmem_realloc(mp->m_perag,
-                        sizeof(xfs_perag_t) * nagcount,
-                        sizeof(xfs_perag_t) * oagcount,
-                        KM_SLEEP);
-                memset(&mp->m_perag[oagcount], 0,
-                        (nagcount - oagcount) * sizeof(xfs_perag_t));
+                memcpy(new_perag, mp->m_perag, sizeof(xfs_perag_t) * oagcount);
+                old_perag = mp->m_perag;
+                mp->m_perag = new_perag;
+
                 mp->m_flags |= XFS_MOUNT_32BITINODES;
                 nagimax = xfs_initialize_perag(mp, nagcount);
                 up_write(&mp->m_peraglock);
+
+                kmem_free(old_perag);
         }
         tp = xfs_trans_alloc(mp, XFS_TRANS_GROWFS);
         tp->t_flags |= XFS_TRANS_RESERVE;
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index 34ec86923f7e..ecbf8b4d2e2e 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -191,80 +191,82 @@ xfs_iget_cache_hit(
         int                     flags,
         int                     lock_flags) __releases(pag->pag_ici_lock)
 {
+        struct inode            *inode = VFS_I(ip);
         struct xfs_mount        *mp = ip->i_mount;
-        int                     error = EAGAIN;
+        int                     error;
+
+        spin_lock(&ip->i_flags_lock);
 
         /*
-         * If INEW is set this inode is being set up
-         * If IRECLAIM is set this inode is being torn down
-         * Pause and try again.
+         * If we are racing with another cache hit that is currently
+         * instantiating this inode or currently recycling it out of
+         * reclaimabe state, wait for the initialisation to complete
+         * before continuing.
+         *
+         * XXX(hch): eventually we should do something equivalent to
+         *           wait_on_inode to wait for these flags to be cleared
+         *           instead of polling for it.
          */
-        if (xfs_iflags_test(ip, (XFS_INEW|XFS_IRECLAIM))) {
+        if (ip->i_flags & (XFS_INEW|XFS_IRECLAIM)) {
                 XFS_STATS_INC(xs_ig_frecycle);
+                error = EAGAIN;
                 goto out_error;
         }
 
-        /* If IRECLAIMABLE is set, we've torn down the vfs inode part */
-        if (xfs_iflags_test(ip, XFS_IRECLAIMABLE)) {
-
-                /*
-                 * If lookup is racing with unlink, then we should return an
-                 * error immediately so we don't remove it from the reclaim
-                 * list and potentially leak the inode.
-                 */
-                if ((ip->i_d.di_mode == 0) && !(flags & XFS_IGET_CREATE)) {
-                        error = ENOENT;
-                        goto out_error;
-                }
+        /*
+         * If lookup is racing with unlink return an error immediately.
+         */
+        if (ip->i_d.di_mode == 0 && !(flags & XFS_IGET_CREATE)) {
+                error = ENOENT;
+                goto out_error;
+        }
 
+        /*
+         * If IRECLAIMABLE is set, we've torn down the VFS inode already.
+         * Need to carefully get it back into useable state.
+         */
+        if (ip->i_flags & XFS_IRECLAIMABLE) {
                 xfs_itrace_exit_tag(ip, "xfs_iget.alloc");
 
                 /*
-                 * We need to re-initialise the VFS inode as it has been
-                 * 'freed' by the VFS. Do this here so we can deal with
-                 * errors cleanly, then tag it so it can be set up correctly
-                 * later.
+                 * We need to set XFS_INEW atomically with clearing the
+                 * reclaimable tag so that we do have an indicator of the
+                 * inode still being initialized.
                  */
-                if (inode_init_always(mp->m_super, VFS_I(ip))) {
-                        error = ENOMEM;
-                        goto out_error;
-                }
+                ip->i_flags |= XFS_INEW;
+                ip->i_flags &= ~XFS_IRECLAIMABLE;
+                __xfs_inode_clear_reclaim_tag(mp, pag, ip);
 
-                /*
-                 * We must set the XFS_INEW flag before clearing the
-                 * XFS_IRECLAIMABLE flag so that if a racing lookup does
-                 * not find the XFS_IRECLAIMABLE above but has the igrab()
-                 * below succeed we can safely check XFS_INEW to detect
-                 * that this inode is still being initialised.
-                 */
-                xfs_iflags_set(ip, XFS_INEW);
-                xfs_iflags_clear(ip, XFS_IRECLAIMABLE);
+                spin_unlock(&ip->i_flags_lock);
+                read_unlock(&pag->pag_ici_lock);
 
-                /* clear the radix tree reclaim flag as well. */
-                __xfs_inode_clear_reclaim_tag(mp, pag, ip);
-        } else if (!igrab(VFS_I(ip))) {
+                error = -inode_init_always(mp->m_super, inode);
+                if (error) {
+                        /*
+                         * Re-initializing the inode failed, and we are in deep
+                         * trouble.  Try to re-add it to the reclaim list.
+                         */
+                        read_lock(&pag->pag_ici_lock);
+                        spin_lock(&ip->i_flags_lock);
+
+                        ip->i_flags &= ~XFS_INEW;
+                        ip->i_flags |= XFS_IRECLAIMABLE;
+                        __xfs_inode_set_reclaim_tag(pag, ip);
+                        goto out_error;
+                }
+                inode->i_state = I_LOCK|I_NEW;
+        } else {
                 /* If the VFS inode is being torn down, pause and try again. */
-                XFS_STATS_INC(xs_ig_frecycle);
-                goto out_error;
-        } else if (xfs_iflags_test(ip, XFS_INEW)) {
-                /*
-                 * We are racing with another cache hit that is
-                 * currently recycling this inode out of the XFS_IRECLAIMABLE
-                 * state. Wait for the initialisation to complete before
-                 * continuing.
-                 */
-                wait_on_inode(VFS_I(ip));
-        }
+                if (!igrab(inode)) {
+                        error = EAGAIN;
+                        goto out_error;
+                }
 
-        if (ip->i_d.di_mode == 0 && !(flags & XFS_IGET_CREATE)) {
-                error = ENOENT;
-                iput(VFS_I(ip));
-                goto out_error;
+                /* We've got a live one. */
+                spin_unlock(&ip->i_flags_lock);
+                read_unlock(&pag->pag_ici_lock);
         }
 
-        /* We've got a live one. */
-        read_unlock(&pag->pag_ici_lock);
-
         if (lock_flags != 0)
                 xfs_ilock(ip, lock_flags);
 
@@ -274,6 +276,7 @@ xfs_iget_cache_hit(
         return 0;
 
 out_error:
+        spin_unlock(&ip->i_flags_lock);
         read_unlock(&pag->pag_ici_lock);
         return error;
 }
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 1f22d65fed0a..da428b3fe0f5 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -343,6 +343,16 @@ xfs_iformat(
                 return XFS_ERROR(EFSCORRUPTED);
         }
 
+        if (unlikely((ip->i_d.di_flags & XFS_DIFLAG_REALTIME) &&
+                     !ip->i_mount->m_rtdev_targp)) {
+                xfs_fs_repair_cmn_err(CE_WARN, ip->i_mount,
+                        "corrupt dinode %Lu, has realtime flag set.",
+                        ip->i_ino);
+                XFS_CORRUPTION_ERROR("xfs_iformat(realtime)",
+                                     XFS_ERRLEVEL_LOW, ip->i_mount, dip);
+                return XFS_ERROR(EFSCORRUPTED);
+        }
+
         switch (ip->i_d.di_mode & S_IFMT) {
         case S_IFIFO:
         case S_IFCHR:
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 3750f04ede0b..9dbdff3ea484 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -3180,7 +3180,7 @@ try_again:
 STATIC void
 xlog_state_want_sync(xlog_t *log, xlog_in_core_t *iclog)
 {
-        ASSERT(spin_is_locked(&log->l_icloglock));
+        assert_spin_locked(&log->l_icloglock);
 
         if (iclog->ic_state == XLOG_STATE_ACTIVE) {
                 xlog_state_switch_iclogs(log, iclog, 0);
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index c4eca5ed5dab..492d75bae2bf 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -538,7 +538,9 @@ xfs_readlink_bmap(
                 d = XFS_FSB_TO_DADDR(mp, mval[n].br_startblock);
                 byte_cnt = XFS_FSB_TO_B(mp, mval[n].br_blockcount);
 
-                bp = xfs_buf_read(mp->m_ddev_targp, d, BTOBB(byte_cnt), 0);
+                bp = xfs_buf_read_flags(mp->m_ddev_targp, d, BTOBB(byte_cnt),
+                                        XBF_LOCK | XBF_MAPPED |
+                                        XBF_DONT_BLOCK);
                 error = XFS_BUF_GETERROR(bp);
                 if (error) {
                         xfs_ioerror_alert("xfs_readlink",
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index baf1e0a9a7ee..740ac3ad8fd0 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -174,7 +174,7 @@ struct acpi_processor_throttling {
         cpumask_var_t shared_cpu_map;
         int (*acpi_processor_get_throttling) (struct acpi_processor * pr);
         int (*acpi_processor_set_throttling) (struct acpi_processor * pr,
-                                              int state);
+                                              int state, bool force);
 
         u32 address;
         u8 duty_offset;
@@ -321,7 +321,8 @@ static inline int acpi_processor_ppc_has_changed(struct acpi_processor *pr)
 /* in processor_throttling.c */
 int acpi_processor_tstate_has_changed(struct acpi_processor *pr);
 int acpi_processor_get_throttling_info(struct acpi_processor *pr);
-extern int acpi_processor_set_throttling(struct acpi_processor *pr, int state);
+extern int acpi_processor_set_throttling(struct acpi_processor *pr,
+                                         int state, bool force);
 extern const struct file_operations acpi_processor_throttling_fops;
 extern void acpi_processor_throttling_init(void);
 /* in processor_idle.c */
diff --git a/include/drm/radeon_drm.h b/include/drm/radeon_drm.h
index af4b4826997e..2ba61e18fc8b 100644
--- a/include/drm/radeon_drm.h
+++ b/include/drm/radeon_drm.h
@@ -508,6 +508,7 @@ typedef struct {
 #define DRM_RADEON_INFO                 0x27
 #define DRM_RADEON_GEM_SET_TILING       0x28
 #define DRM_RADEON_GEM_GET_TILING       0x29
+#define DRM_RADEON_GEM_BUSY             0x2a
 
 #define DRM_IOCTL_RADEON_CP_INIT    DRM_IOW( DRM_COMMAND_BASE + DRM_RADEON_CP_INIT, drm_radeon_init_t)
 #define DRM_IOCTL_RADEON_CP_START   DRM_IO(  DRM_COMMAND_BASE + DRM_RADEON_CP_START)
@@ -548,6 +549,7 @@ typedef struct {
 #define DRM_IOCTL_RADEON_INFO           DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_INFO, struct drm_radeon_info)
 #define DRM_IOCTL_RADEON_SET_TILING     DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_SET_TILING, struct drm_radeon_gem_set_tiling)
 #define DRM_IOCTL_RADEON_GET_TILING     DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_GET_TILING, struct drm_radeon_gem_get_tiling)
+#define DRM_IOCTL_RADEON_GEM_BUSY       DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_BUSY, struct drm_radeon_gem_busy)
 
 typedef struct drm_radeon_init {
         enum {
@@ -707,6 +709,7 @@ typedef struct drm_radeon_indirect {
 #define RADEON_PARAM_FB_LOCATION           14   /* FB location */
 #define RADEON_PARAM_NUM_GB_PIPES          15   /* num GB pipes */
 #define RADEON_PARAM_DEVICE_ID             16
+#define RADEON_PARAM_NUM_Z_PIPES           17   /* num Z pipes */
 
 typedef struct drm_radeon_getparam {
         int param;
@@ -838,7 +841,7 @@ struct drm_radeon_gem_wait_idle {
 
 struct drm_radeon_gem_busy {
         uint32_t        handle;
-        uint32_t        busy;
+        uint32_t        domain;
 };
 
 struct drm_radeon_gem_pread {
@@ -895,6 +898,7 @@ struct drm_radeon_cs {
 
 #define RADEON_INFO_DEVICE_ID           0x00
 #define RADEON_INFO_NUM_GB_PIPES        0x01
+#define RADEON_INFO_NUM_Z_PIPES         0x02
 
 struct drm_radeon_info {
         uint32_t                request;
diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
index 2878811c6134..756d78b8c1c5 100644
--- a/include/linux/bitmap.h
+++ b/include/linux/bitmap.h
@@ -94,13 +94,13 @@ extern void __bitmap_shift_right(unsigned long *dst,
                         const unsigned long *src, int shift, int bits);
 extern void __bitmap_shift_left(unsigned long *dst,
                         const unsigned long *src, int shift, int bits);
-extern void __bitmap_and(unsigned long *dst, const unsigned long *bitmap1,
+extern int __bitmap_and(unsigned long *dst, const unsigned long *bitmap1,
                         const unsigned long *bitmap2, int bits);
 extern void __bitmap_or(unsigned long *dst, const unsigned long *bitmap1,
                         const unsigned long *bitmap2, int bits);
 extern void __bitmap_xor(unsigned long *dst, const unsigned long *bitmap1,
                         const unsigned long *bitmap2, int bits);
-extern void __bitmap_andnot(unsigned long *dst, const unsigned long *bitmap1,
+extern int __bitmap_andnot(unsigned long *dst, const unsigned long *bitmap1,
                         const unsigned long *bitmap2, int bits);
 extern int __bitmap_intersects(const unsigned long *bitmap1,
                         const unsigned long *bitmap2, int bits);
@@ -171,13 +171,12 @@ static inline void bitmap_copy(unsigned long *dst, const unsigned long *src,
         }
 }
 
-static inline void bitmap_and(unsigned long *dst, const unsigned long *src1,
+static inline int bitmap_and(unsigned long *dst, const unsigned long *src1,
                         const unsigned long *src2, int nbits)
 {
         if (small_const_nbits(nbits))
-                *dst = *src1 & *src2;
-        else
-                __bitmap_and(dst, src1, src2, nbits);
+                return (*dst = *src1 & *src2) != 0;
+        return __bitmap_and(dst, src1, src2, nbits);
 }
 
 static inline void bitmap_or(unsigned long *dst, const unsigned long *src1,
@@ -198,13 +197,12 @@ static inline void bitmap_xor(unsigned long *dst, const unsigned long *src1,
                 __bitmap_xor(dst, src1, src2, nbits);
 }
 
-static inline void bitmap_andnot(unsigned long *dst, const unsigned long *src1,
+static inline int bitmap_andnot(unsigned long *dst, const unsigned long *src1,
                         const unsigned long *src2, int nbits)
 {
         if (small_const_nbits(nbits))
-                *dst = *src1 & ~(*src2);
-        else
-                __bitmap_andnot(dst, src1, src2, nbits);
+                return (*dst = *src1 & ~(*src2)) != 0;
+        return __bitmap_andnot(dst, src1, src2, nbits);
 }
 
 static inline void bitmap_complement(unsigned long *dst, const unsigned long *src,
diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
index c5ac87ca7bc6..796df12091b7 100644
--- a/include/linux/cpumask.h
+++ b/include/linux/cpumask.h
@@ -43,10 +43,10 @@
  * int cpu_isset(cpu, mask)             true iff bit 'cpu' set in mask
  * int cpu_test_and_set(cpu, mask)      test and set bit 'cpu' in mask
  *
- * void cpus_and(dst, src1, src2)       dst = src1 & src2  [intersection]
+ * int cpus_and(dst, src1, src2)        dst = src1 & src2  [intersection]
  * void cpus_or(dst, src1, src2)        dst = src1 | src2  [union]
  * void cpus_xor(dst, src1, src2)       dst = src1 ^ src2
- * void cpus_andnot(dst, src1, src2)    dst = src1 & ~src2
+ * int cpus_andnot(dst, src1, src2)     dst = src1 & ~src2
  * void cpus_complement(dst, src)       dst = ~src
  *
  * int cpus_equal(mask1, mask2)         Does mask1 == mask2?
@@ -179,10 +179,10 @@ static inline int __cpu_test_and_set(int cpu, cpumask_t *addr)
 }
 
 #define cpus_and(dst, src1, src2) __cpus_and(&(dst), &(src1), &(src2), NR_CPUS)
-static inline void __cpus_and(cpumask_t *dstp, const cpumask_t *src1p,
+static inline int __cpus_and(cpumask_t *dstp, const cpumask_t *src1p,
                                         const cpumask_t *src2p, int nbits)
 {
-        bitmap_and(dstp->bits, src1p->bits, src2p->bits, nbits);
+        return bitmap_and(dstp->bits, src1p->bits, src2p->bits, nbits);
 }
 
 #define cpus_or(dst, src1, src2) __cpus_or(&(dst), &(src1), &(src2), NR_CPUS)
@@ -201,10 +201,10 @@ static inline void __cpus_xor(cpumask_t *dstp, const cpumask_t *src1p,
 
 #define cpus_andnot(dst, src1, src2) \
                                 __cpus_andnot(&(dst), &(src1), &(src2), NR_CPUS)
-static inline void __cpus_andnot(cpumask_t *dstp, const cpumask_t *src1p,
+static inline int __cpus_andnot(cpumask_t *dstp, const cpumask_t *src1p,
                                         const cpumask_t *src2p, int nbits)
 {
-        bitmap_andnot(dstp->bits, src1p->bits, src2p->bits, nbits);
+        return bitmap_andnot(dstp->bits, src1p->bits, src2p->bits, nbits);
 }
 
 #define cpus_complement(dst, src) __cpus_complement(&(dst), &(src), NR_CPUS)
@@ -738,11 +738,11 @@ static inline void cpumask_clear(struct cpumask *dstp)
  * @src1p: the first input
  * @src2p: the second input
  */
-static inline void cpumask_and(struct cpumask *dstp,
+static inline int cpumask_and(struct cpumask *dstp,
                                const struct cpumask *src1p,
                                const struct cpumask *src2p)
 {
-        bitmap_and(cpumask_bits(dstp), cpumask_bits(src1p),
+        return bitmap_and(cpumask_bits(dstp), cpumask_bits(src1p),
                                        cpumask_bits(src2p), nr_cpumask_bits);
 }
 
@@ -779,11 +779,11 @@ static inline void cpumask_xor(struct cpumask *dstp,
  * @src1p: the first input
  * @src2p: the second input
  */
-static inline void cpumask_andnot(struct cpumask *dstp,
+static inline int cpumask_andnot(struct cpumask *dstp,
                                   const struct cpumask *src1p,
                                   const struct cpumask *src2p)
 {
-        bitmap_andnot(cpumask_bits(dstp), cpumask_bits(src1p),
+        return bitmap_andnot(cpumask_bits(dstp), cpumask_bits(src1p),
                                           cpumask_bits(src2p), nr_cpumask_bits);
 }
 
diff --git a/include/linux/flex_array.h b/include/linux/flex_array.h
index 23c1ec79a31b..45ff18491514 100644
--- a/include/linux/flex_array.h
+++ b/include/linux/flex_array.h
@@ -21,7 +21,7 @@ struct flex_array {
                 struct {
                         int element_size;
                         int total_nr_elements;
-                        struct flex_array_part *parts[0];
+                        struct flex_array_part *parts[];
                 };
                 /*
                  * This little trick makes sure that
@@ -36,12 +36,14 @@ struct flex_array {
         .total_nr_elements = (total),   \
 } } }
 
-struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags);
-int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags);
+struct flex_array *flex_array_alloc(int element_size, unsigned int total,
+                gfp_t flags);
+int flex_array_prealloc(struct flex_array *fa, unsigned int start,
+                unsigned int end, gfp_t flags);
 void flex_array_free(struct flex_array *fa);
 void flex_array_free_parts(struct flex_array *fa);
-int flex_array_put(struct flex_array *fa, int element_nr, void *src,
+int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,
                 gfp_t flags);
-void *flex_array_get(struct flex_array *fa, int element_nr);
+void *flex_array_get(struct flex_array *fa, unsigned int element_nr);
 
 #endif /* _FLEX_ARRAY_H */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 67888a9e0655..73e9b643e455 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2123,7 +2123,7 @@ extern struct file *do_filp_open(int dfd, const char *pathname,
                 int open_flag, int mode, int acc_mode);
 extern int may_open(struct path *, int, int);
 
-extern int kernel_read(struct file *, unsigned long, char *, unsigned long);
+extern int kernel_read(struct file *, loff_t, char *, unsigned long);
 extern struct file * open_exec(const char *);
  
 /* fs/dcache.c -- generic fs support functions */
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 2723513a5651..5cbc620bdfe0 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -10,6 +10,7 @@
 #include <asm/tlbflush.h>
 
 struct ctl_table;
+struct user_struct;
 
 int PageHuge(struct page *page);
 
@@ -146,7 +147,8 @@ static inline struct hugetlbfs_sb_info *HUGETLBFS_SB(struct super_block *sb)
 
 extern const struct file_operations hugetlbfs_file_operations;
 extern struct vm_operations_struct hugetlb_vm_ops;
-struct file *hugetlb_file_setup(const char *name, size_t, int);
+struct file *hugetlb_file_setup(const char *name, size_t size, int acct,
+                                                struct user_struct **user);
 int hugetlb_get_quota(struct address_space *mapping, long delta);
 void hugetlb_put_quota(struct address_space *mapping, long delta);
 
@@ -168,7 +170,7 @@ static inline void set_file_hugepages(struct file *file)
 
 #define is_file_hugepages(file)                 0
 #define set_file_hugepages(file)                BUG()
-#define hugetlb_file_setup(name,size,acctflag)  ERR_PTR(-ENOSYS)
+#define hugetlb_file_setup(name,size,acct,user) ERR_PTR(-ENOSYS)
 
 #endif /* !CONFIG_HUGETLBFS */
 
diff --git a/include/linux/mm.h b/include/linux/mm.h
index ba3a7cb1eaa0..9a72cc78e6b8 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -34,8 +34,6 @@ extern int sysctl_legacy_va_layout;
 #define sysctl_legacy_va_layout 0
 #endif
 
-extern unsigned long mmap_min_addr;
-
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/processor.h>
@@ -575,19 +573,6 @@ static inline void set_page_links(struct page *page, enum zone_type zone,
 }
 
 /*
- * If a hint addr is less than mmap_min_addr change hint to be as
- * low as possible but still greater than mmap_min_addr
- */
-static inline unsigned long round_hint_to_min(unsigned long hint)
-{
-        hint &= PAGE_MASK;
-        if (((void *)hint != NULL) &&
-            (hint < mmap_min_addr))
-                return PAGE_ALIGN(mmap_min_addr);
-        return hint;
-}
-
-/*
  * Some inline functions in vmstat.h depend on page_zone()
  */
 #include <linux/vmstat.h>
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 7acc8439d9b3..0042090a4d70 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -240,8 +240,6 @@ struct mm_struct {
 
         unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */
 
-        s8 oom_adj;     /* OOM kill score adjustment (bit shift) */
-
         cpumask_t cpu_vm_mask;
 
         /* Architecture-specific MM context */
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index fdffb413b192..f6b90240dd41 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -473,7 +473,6 @@ extern int  nfs_writepages(struct address_space *, struct writeback_control *);
 extern int  nfs_flush_incompatible(struct file *file, struct page *page);
 extern int  nfs_updatepage(struct file *, struct page *, unsigned int, unsigned int);
 extern int nfs_writeback_done(struct rpc_task *, struct nfs_write_data *);
-extern void nfs_writedata_release(void *);
 
 /*
  * Try to write back everything synchronously (but check the
@@ -488,7 +487,6 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page);
 extern int  nfs_commit_inode(struct inode *, int);
 extern struct nfs_write_data *nfs_commitdata_alloc(void);
 extern void nfs_commit_free(struct nfs_write_data *wdata);
-extern void nfs_commitdata_release(void *wdata);
 #else
 static inline int
 nfs_commit_inode(struct inode *inode, int how)
@@ -507,6 +505,7 @@ nfs_have_writebacks(struct inode *inode)
  * Allocate nfs_write_data structures
  */
 extern struct nfs_write_data *nfs_writedata_alloc(unsigned int npages);
+extern void nfs_writedata_free(struct nfs_write_data *);
 
 /*
  * linux/fs/nfs/read.c
@@ -515,7 +514,6 @@ extern int  nfs_readpage(struct file *, struct page *);
 extern int  nfs_readpages(struct file *, struct address_space *,
                 struct list_head *, unsigned);
 extern int  nfs_readpage_result(struct rpc_task *, struct nfs_read_data *);
-extern void nfs_readdata_release(void *data);
 extern int  nfs_readpage_async(struct nfs_open_context *, struct inode *,
                                struct page *);
 
@@ -523,6 +521,7 @@ extern int  nfs_readpage_async(struct nfs_open_context *, struct inode *,
  * Allocate nfs_read_data structures
  */
 extern struct nfs_read_data *nfs_readdata_alloc(unsigned int npages);
+extern void nfs_readdata_free(struct nfs_read_data *);
 
 /*
  * linux/fs/nfs3proc.c
diff --git a/include/linux/perf_counter.h b/include/linux/perf_counter.h
index a67dd5c5b6d3..b53f7006cc4e 100644
--- a/include/linux/perf_counter.h
+++ b/include/linux/perf_counter.h
@@ -115,28 +115,44 @@ enum perf_counter_sample_format {
         PERF_SAMPLE_TID                         = 1U << 1,
         PERF_SAMPLE_TIME                        = 1U << 2,
         PERF_SAMPLE_ADDR                        = 1U << 3,
-        PERF_SAMPLE_GROUP                       = 1U << 4,
+        PERF_SAMPLE_READ                        = 1U << 4,
         PERF_SAMPLE_CALLCHAIN                   = 1U << 5,
         PERF_SAMPLE_ID                          = 1U << 6,
         PERF_SAMPLE_CPU                         = 1U << 7,
         PERF_SAMPLE_PERIOD                      = 1U << 8,
         PERF_SAMPLE_STREAM_ID                   = 1U << 9,
-        PERF_SAMPLE_TP_RECORD                   = 1U << 10,
+        PERF_SAMPLE_RAW                         = 1U << 10,
 
         PERF_SAMPLE_MAX = 1U << 11,             /* non-ABI */
 };
 
 /*
- * Bits that can be set in attr.read_format to request that
- * reads on the counter should return the indicated quantities,
- * in increasing order of bit value, after the counter value.
+ * The format of the data returned by read() on a perf counter fd,
+ * as specified by attr.read_format:
+ *
+ * struct read_format {
+ *      { u64           value;
+ *        { u64         time_enabled; } && PERF_FORMAT_ENABLED
+ *        { u64         time_running; } && PERF_FORMAT_RUNNING
+ *        { u64         id;           } && PERF_FORMAT_ID
+ *      } && !PERF_FORMAT_GROUP
+ *
+ *      { u64           nr;
+ *        { u64         time_enabled; } && PERF_FORMAT_ENABLED
+ *        { u64         time_running; } && PERF_FORMAT_RUNNING
+ *        { u64         value;
+ *          { u64       id;           } && PERF_FORMAT_ID
+ *        }             cntr[nr];
+ *      } && PERF_FORMAT_GROUP
+ * };
  */
 enum perf_counter_read_format {
         PERF_FORMAT_TOTAL_TIME_ENABLED          = 1U << 0,
         PERF_FORMAT_TOTAL_TIME_RUNNING          = 1U << 1,
         PERF_FORMAT_ID                          = 1U << 2,
+        PERF_FORMAT_GROUP                       = 1U << 3,
 
-        PERF_FORMAT_MAX = 1U << 3,              /* non-ABI */
+        PERF_FORMAT_MAX = 1U << 4,              /* non-ABI */
 };
 
 #define PERF_ATTR_SIZE_VER0     64      /* sizeof first published struct */
@@ -343,10 +359,8 @@ enum perf_event_type {
          * struct {
          *      struct perf_event_header        header;
          *      u32                             pid, tid;
-         *      u64                             value;
-         *      { u64           time_enabled;   } && PERF_FORMAT_ENABLED
-         *      { u64           time_running;   } && PERF_FORMAT_RUNNING
-         *      { u64           parent_id;      } && PERF_FORMAT_ID
+         *
+         *      struct read_format              values;
          * };
          */
         PERF_EVENT_READ                 = 8,
@@ -364,11 +378,24 @@ enum perf_event_type {
          *      { u32                   cpu, res; } && PERF_SAMPLE_CPU
          *      { u64                   period;   } && PERF_SAMPLE_PERIOD
          *
-         *      { u64                   nr;
-         *        { u64 id, val; }      cnt[nr];  } && PERF_SAMPLE_GROUP
+         *      { struct read_format    values;   } && PERF_SAMPLE_READ
          *
          *      { u64                   nr,
          *        u64                   ips[nr];  } && PERF_SAMPLE_CALLCHAIN
+         *
+         *      #
+         *      # The RAW record below is opaque data wrt the ABI
+         *      #
+         *      # That is, the ABI doesn't make any promises wrt to
+         *      # the stability of its content, it may vary depending
+         *      # on event, hardware, kernel version and phase of
+         *      # the moon.
+         *      #
+         *      # In other words, PERF_SAMPLE_RAW contents are not an ABI.
+         *      #
+         *
+         *      { u32                   size;
+         *        char                  data[size];}&& PERF_SAMPLE_RAW
          * };
          */
         PERF_EVENT_SAMPLE               = 9,
@@ -414,9 +441,9 @@ struct perf_callchain_entry {
         __u64                           ip[PERF_MAX_STACK_DEPTH];
 };
 
-struct perf_tracepoint_record {
-        int                             size;
-        char                            *record;
+struct perf_raw_record {
+        u32                             size;
+        void                            *data;
 };
 
 struct task_struct;
@@ -687,11 +714,13 @@ struct perf_sample_data {
         struct pt_regs                  *regs;
         u64                             addr;
         u64                             period;
-        void                            *private;
+        struct perf_raw_record          *raw;
 };
 
 extern int perf_counter_overflow(struct perf_counter *counter, int nmi,
                                  struct perf_sample_data *data);
+extern void perf_counter_output(struct perf_counter *counter, int nmi,
+                                struct perf_sample_data *data);
 
 /*
  * Return 1 for a software counter, 0 for a hardware counter
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 3ab08e4bb6b8..0f1ea4a66957 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1198,6 +1198,7 @@ struct task_struct {
          * a short time
          */
         unsigned char fpu_counter;
+        s8 oomkilladj; /* OOM kill score adjustment (bit shift). */
 #ifdef CONFIG_BLK_DEV_IO_TRACE
         unsigned int btrace_seq;
 #endif
diff --git a/include/linux/security.h b/include/linux/security.h
index 5eff459b3833..1f16eea2017b 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -28,6 +28,7 @@
 #include <linux/resource.h>
 #include <linux/sem.h>
 #include <linux/shm.h>
+#include <linux/mm.h> /* PAGE_ALIGN */
 #include <linux/msg.h>
 #include <linux/sched.h>
 #include <linux/key.h>
@@ -66,6 +67,9 @@ extern int cap_inode_setxattr(struct dentry *dentry, const char *name,
 extern int cap_inode_removexattr(struct dentry *dentry, const char *name);
 extern int cap_inode_need_killpriv(struct dentry *dentry);
 extern int cap_inode_killpriv(struct dentry *dentry);
+extern int cap_file_mmap(struct file *file, unsigned long reqprot,
+                         unsigned long prot, unsigned long flags,
+                         unsigned long addr, unsigned long addr_only);
 extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
 extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                           unsigned long arg4, unsigned long arg5);
@@ -92,6 +96,7 @@ extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);
 extern int cap_netlink_recv(struct sk_buff *skb, int cap);
 
 extern unsigned long mmap_min_addr;
+extern unsigned long dac_mmap_min_addr;
 /*
  * Values used in the task_security_ops calls
  */
@@ -116,6 +121,21 @@ struct request_sock;
 #define LSM_UNSAFE_PTRACE       2
 #define LSM_UNSAFE_PTRACE_CAP   4
 
+/*
+ * If a hint addr is less than mmap_min_addr change hint to be as
+ * low as possible but still greater than mmap_min_addr
+ */
+static inline unsigned long round_hint_to_min(unsigned long hint)
+{
+        hint &= PAGE_MASK;
+        if (((void *)hint != NULL) &&
+            (hint < mmap_min_addr))
+                return PAGE_ALIGN(mmap_min_addr);
+        return hint;
+}
+extern int mmap_min_addr_handler(struct ctl_table *table, int write, struct file *filp,
+                                 void __user *buffer, size_t *lenp, loff_t *ppos);
+
 #ifdef CONFIG_SECURITY
 
 struct security_mnt_opts {
@@ -2197,9 +2217,7 @@ static inline int security_file_mmap(struct file *file, unsigned long reqprot,
                                      unsigned long addr,
                                      unsigned long addr_only)
 {
-        if ((addr < mmap_min_addr) && !capable(CAP_SYS_RAWIO))
-                return -EACCES;
-        return 0;
+        return cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
 }
 
 static inline int security_file_mprotect(struct vm_area_struct *vma,
diff --git a/include/linux/ucb1400.h b/include/linux/ucb1400.h
index ed889f4168f3..ae779bb8cc0f 100644
--- a/include/linux/ucb1400.h
+++ b/include/linux/ucb1400.h
@@ -73,6 +73,10 @@
 
 #define UCB_ADC_DATA            0x68
 #define UCB_ADC_DAT_VALID       (1 << 15)
+
+#define UCB_FCSR                0x6c
+#define UCB_FCSR_AVE            (1 << 12)
+
 #define UCB_ADC_DAT_MASK        0x3ff
 
 #define UCB_ID                  0x7e
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 6788e1a4d4ca..cf3c2f5dba51 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -77,7 +77,14 @@ struct task_struct;
 #define __WAIT_BIT_KEY_INITIALIZER(word, bit)                           \
         { .flags = word, .bit_nr = bit, }
 
-extern void init_waitqueue_head(wait_queue_head_t *q);
+extern void __init_waitqueue_head(wait_queue_head_t *q, struct lock_class_key *);
+
+#define init_waitqueue_head(q)                          \
+        do {                                            \
+                static struct lock_class_key __key;     \
+                                                        \
+                __init_waitqueue_head((q), &__key);     \
+        } while (0)
 
 #ifdef CONFIG_LOCKDEP
 # define __WAIT_QUEUE_HEAD_INIT_ONSTACK(name) \
diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
index 7fb16d90e7b1..f64fbaae781a 100644
--- a/include/trace/ftrace.h
+++ b/include/trace/ftrace.h
@@ -637,12 +637,20 @@ __attribute__((section("_ftrace_events"))) event_##call = {		\
  *      pc = preempt_count();
  *
  *      __data_size = ftrace_get_offsets_<call>(&__data_offsets, args);
- *      __entry_size = __data_size + sizeof(*entry);
+ *
+ *      // Below we want to get the aligned size by taking into account
+ *      // the u32 field that will later store the buffer size
+ *      __entry_size = ALIGN(__data_size + sizeof(*entry) + sizeof(u32),
+ *                           sizeof(u64));
+ *      __entry_size -= sizeof(u32);
  *
  *      do {
  *              char raw_data[__entry_size]; <- allocate our sample in the stack
  *              struct trace_entry *ent;
  *
+ *              zero dead bytes from alignment to avoid stack leak to userspace:
+ *
+ *              *(u64 *)(&raw_data[__entry_size - sizeof(u64)]) = 0ULL;
  *              entry = (struct ftrace_raw_<call> *)raw_data;
  *              ent = &entry->ent;
  *              tracing_generic_entry_update(ent, irq_flags, pc);
@@ -685,12 +693,15 @@ static void ftrace_profile_##call(proto)				\
         pc = preempt_count();                                           \
                                                                         \
         __data_size = ftrace_get_offsets_##call(&__data_offsets, args); \
-        __entry_size = ALIGN(__data_size + sizeof(*entry), sizeof(u64));\
+        __entry_size = ALIGN(__data_size + sizeof(*entry) + sizeof(u32),\
+                             sizeof(u64));                              \
+        __entry_size -= sizeof(u32);                                    \
                                                                         \
         do {                                                            \
                 char raw_data[__entry_size];                            \
                 struct trace_entry *ent;                                \
                                                                         \
+                *(u64 *)(&raw_data[__entry_size - sizeof(u64)]) = 0ULL; \
                 entry = (struct ftrace_raw_##call *)raw_data;           \
                 ent = &entry->ent;                                      \
                 tracing_generic_entry_update(ent, irq_flags, pc);       \
diff --git a/init/main.c b/init/main.c
index 2c5ade79eb81..11f4f145be3f 100644
--- a/init/main.c
+++ b/init/main.c
@@ -584,8 +584,8 @@ asmlinkage void __init start_kernel(void)
         setup_arch(&command_line);
         mm_init_owner(&init_mm, &init_task);
         setup_command_line(command_line);
-        setup_per_cpu_areas();
         setup_nr_cpu_ids();
+        setup_per_cpu_areas();
         smp_prepare_boot_cpu(); /* arch-specific boot-cpu hooks */
 
         build_all_zonelists();
@@ -733,13 +733,14 @@ static void __init do_ctors(void)
 int initcall_debug;
 core_param(initcall_debug, initcall_debug, bool, 0644);
 
+static char msgbuf[64];
+static struct boot_trace_call call;
+static struct boot_trace_ret ret;
+
 int do_one_initcall(initcall_t fn)
 {
         int count = preempt_count();
         ktime_t calltime, delta, rettime;
-        char msgbuf[64];
-        struct boot_trace_call call;
-        struct boot_trace_ret ret;
 
         if (initcall_debug) {
                 call.caller = task_pid_nr(current);
diff --git a/ipc/shm.c b/ipc/shm.c
index 15dd238e5338..1bc4701ef4f0 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -174,7 +174,7 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
         shm_unlock(shp);
         if (!is_file_hugepages(shp->shm_file))
                 shmem_lock(shp->shm_file, 0, shp->mlock_user);
-        else
+        else if (shp->mlock_user)
                 user_shm_unlock(shp->shm_file->f_path.dentry->d_inode->i_size,
                                                 shp->mlock_user);
         fput (shp->shm_file);
@@ -369,8 +369,8 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
                 /* hugetlb_file_setup applies strict accounting */
                 if (shmflg & SHM_NORESERVE)
                         acctflag = VM_NORESERVE;
-                file = hugetlb_file_setup(name, size, acctflag);
-                shp->mlock_user = current_user();
+                file = hugetlb_file_setup(name, size, acctflag,
+                                                        &shp->mlock_user);
         } else {
                 /*
                  * Do not allow no accounting for OVERCOMMIT_NEVER, even
@@ -410,6 +410,8 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
         return error;
 
 no_id:
+        if (shp->mlock_user)    /* shmflg & SHM_HUGETLB case */
+                user_shm_unlock(size, shp->mlock_user);
         fput(file);
 no_file:
         security_shm_free(shp);
diff --git a/kernel/fork.c b/kernel/fork.c
index 021e1138556e..e6c04d462ab2 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -426,7 +426,6 @@ static struct mm_struct * mm_init(struct mm_struct * mm, struct task_struct *p)
         init_rwsem(&mm->mmap_sem);
         INIT_LIST_HEAD(&mm->mmlist);
         mm->flags = (current->mm) ? current->mm->flags : default_dump_filter;
-        mm->oom_adj = (current->mm) ? current->mm->oom_adj : 0;
         mm->core_state = NULL;
         mm->nr_ptes = 0;
         set_mm_counter(mm, file_rss, 0);
@@ -816,11 +815,8 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
 {
         struct signal_struct *sig;
 
-        if (clone_flags & CLONE_THREAD) {
-                atomic_inc(&current->signal->count);
-                atomic_inc(&current->signal->live);
+        if (clone_flags & CLONE_THREAD)
                 return 0;
-        }
 
         sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
         tsk->signal = sig;
@@ -878,16 +874,6 @@ void __cleanup_signal(struct signal_struct *sig)
         kmem_cache_free(signal_cachep, sig);
 }
 
-static void cleanup_signal(struct task_struct *tsk)
-{
-        struct signal_struct *sig = tsk->signal;
-
-        atomic_dec(&sig->live);
-
-        if (atomic_dec_and_test(&sig->count))
-                __cleanup_signal(sig);
-}
-
 static void copy_flags(unsigned long clone_flags, struct task_struct *p)
 {
         unsigned long new_flags = p->flags;
@@ -1240,6 +1226,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         }
 
         if (clone_flags & CLONE_THREAD) {
+                atomic_inc(&current->signal->count);
+                atomic_inc(&current->signal->live);
                 p->group_leader = current->group_leader;
                 list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group);
         }
@@ -1283,7 +1271,8 @@ bad_fork_cleanup_mm:
         if (p->mm)
                 mmput(p->mm);
 bad_fork_cleanup_signal:
-        cleanup_signal(p);
+        if (!(clone_flags & CLONE_THREAD))
+                __cleanup_signal(p->signal);
 bad_fork_cleanup_sighand:
         __cleanup_sighand(p->sighand);
 bad_fork_cleanup_fs:
diff --git a/kernel/futex.c b/kernel/futex.c
index 0672ff88f159..e18cfbdc7190 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1010,15 +1010,19 @@ void requeue_futex(struct futex_q *q, struct futex_hash_bucket *hb1,
  * requeue_pi_wake_futex() - Wake a task that acquired the lock during requeue
  * q:   the futex_q
  * key: the key of the requeue target futex
+ * hb:  the hash_bucket of the requeue target futex
  *
  * During futex_requeue, with requeue_pi=1, it is possible to acquire the
  * target futex if it is uncontended or via a lock steal.  Set the futex_q key
  * to the requeue target futex so the waiter can detect the wakeup on the right
  * futex, but remove it from the hb and NULL the rt_waiter so it can detect
- * atomic lock acquisition.  Must be called with the q->lock_ptr held.
+ * atomic lock acquisition.  Set the q->lock_ptr to the requeue target hb->lock
+ * to protect access to the pi_state to fixup the owner later.  Must be called
+ * with both q->lock_ptr and hb->lock held.
  */
 static inline
-void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key)
+void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
+                           struct futex_hash_bucket *hb)
 {
         drop_futex_key_refs(&q->key);
         get_futex_key_refs(key);
@@ -1030,6 +1034,11 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key)
         WARN_ON(!q->rt_waiter);
         q->rt_waiter = NULL;
 
+        q->lock_ptr = &hb->lock;
+#ifdef CONFIG_DEBUG_PI_LIST
+        q->list.plist.lock = &hb->lock;
+#endif
+
         wake_up_state(q->task, TASK_NORMAL);
 }
 
@@ -1088,7 +1097,7 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
         ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
                                    set_waiters);
         if (ret == 1)
-                requeue_pi_wake_futex(top_waiter, key2);
+                requeue_pi_wake_futex(top_waiter, key2, hb2);
 
         return ret;
 }
@@ -1247,8 +1256,15 @@ retry_private:
                 if (!match_futex(&this->key, &key1))
                         continue;
 
-                WARN_ON(!requeue_pi && this->rt_waiter);
-                WARN_ON(requeue_pi && !this->rt_waiter);
+                /*
+                 * FUTEX_WAIT_REQEUE_PI and FUTEX_CMP_REQUEUE_PI should always
+                 * be paired with each other and no other futex ops.
+                 */
+                if ((requeue_pi && !this->rt_waiter) ||
+                    (!requeue_pi && this->rt_waiter)) {
+                        ret = -EINVAL;
+                        break;
+                }
 
                 /*
                  * Wake nr_wake waiters.  For requeue_pi, if we acquired the
@@ -1273,7 +1289,7 @@ retry_private:
                                                         this->task, 1);
                         if (ret == 1) {
                                 /* We got the lock. */
-                                requeue_pi_wake_futex(this, &key2);
+                                requeue_pi_wake_futex(this, &key2, hb2);
                                 continue;
                         } else if (ret) {
                                 /* -EDEADLK */
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index d607a5b9ee29..235716556bf1 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -180,7 +180,8 @@ asmlinkage long compat_sys_futex(u32 __user *uaddr, int op, u32 val,
         int cmd = op & FUTEX_CMD_MASK;
 
         if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI ||
-                      cmd == FUTEX_WAIT_BITSET)) {
+                      cmd == FUTEX_WAIT_BITSET ||
+                      cmd == FUTEX_WAIT_REQUEUE_PI)) {
                 if (get_compat_timespec(&ts, utime))
                         return -EFAULT;
                 if (!timespec_valid(&ts))
@@ -191,7 +192,8 @@ asmlinkage long compat_sys_futex(u32 __user *uaddr, int op, u32 val,
                         t = ktime_add_safe(ktime_get(), t);
                 tp = &t;
         }
-        if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE)
+        if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE ||
+            cmd == FUTEX_CMP_REQUEUE_PI || cmd == FUTEX_WAKE_OP)
                 val2 = (int) (unsigned long) utime;
 
         return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 61c679db4687..0ec9ed831737 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -607,7 +607,6 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                  */
                 get_task_struct(t);
                 new->thread = t;
-                wake_up_process(t);
         }
 
         /*
@@ -690,6 +689,7 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                                 (int)(new->flags & IRQF_TRIGGER_MASK));
         }
 
+        new->irq = irq;
         *old_ptr = new;
 
         /* Reset broken irq detection when installing new handler */
@@ -707,7 +707,13 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 
         spin_unlock_irqrestore(&desc->lock, flags);
 
-        new->irq = irq;
+        /*
+         * Strictly no need to wake it up, but hung_task complains
+         * when no hard interrupt wakes the thread up.
+         */
+        if (new->thread)
+                wake_up_process(new->thread);
+
         register_irq_proc(irq, desc);
         new->dir = NULL;
         register_handler_proc(irq, new);
@@ -761,7 +767,6 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
 {
         struct irq_desc *desc = irq_to_desc(irq);
         struct irqaction *action, **action_ptr;
-        struct task_struct *irqthread;
         unsigned long flags;
 
         WARN(in_interrupt(), "Trying to free IRQ %d from IRQ context!\n", irq);
@@ -809,9 +814,6 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
                         desc->chip->disable(irq);
         }
 
-        irqthread = action->thread;
-        action->thread = NULL;
-
         spin_unlock_irqrestore(&desc->lock, flags);
 
         unregister_handler_proc(irq, action);
@@ -819,12 +821,6 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
         /* Make sure it's not being used on another CPU: */
         synchronize_irq(irq);
 
-        if (irqthread) {
-                if (!test_bit(IRQTF_DIED, &action->thread_flags))
-                        kthread_stop(irqthread);
-                put_task_struct(irqthread);
-        }
-
 #ifdef CONFIG_DEBUG_SHIRQ
         /*
          * It's a shared IRQ -- the driver ought to be prepared for an IRQ
@@ -840,6 +836,13 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
                 local_irq_restore(flags);
         }
 #endif
+
+        if (action->thread) {
+                if (!test_bit(IRQTF_DIED, &action->thread_flags))
+                        kthread_stop(action->thread);
+                put_task_struct(action->thread);
+        }
+
         return action;
 }
 
diff --git a/kernel/irq/numa_migrate.c b/kernel/irq/numa_migrate.c
index 2f69bee57bf2..3fd30197da2e 100644
--- a/kernel/irq/numa_migrate.c
+++ b/kernel/irq/numa_migrate.c
@@ -107,8 +107,8 @@ out_unlock:
 
 struct irq_desc *move_irq_desc(struct irq_desc *desc, int node)
 {
-        /* those all static, do move them */
-        if (desc->irq < NR_IRQS_LEGACY)
+        /* those static or target node is -1, do not move them */
+        if (desc->irq < NR_IRQS_LEGACY || node == -1)
                 return desc;
 
         if (desc->node != node)
diff --git a/kernel/perf_counter.c b/kernel/perf_counter.c
index 868102172aa4..f274e1959885 100644
--- a/kernel/perf_counter.c
+++ b/kernel/perf_counter.c
@@ -88,6 +88,7 @@ void __weak hw_perf_disable(void)		{ barrier(); }
 void __weak hw_perf_enable(void)                { barrier(); }
 
 void __weak hw_perf_counter_setup(int cpu)      { barrier(); }
+void __weak hw_perf_counter_setup_online(int cpu)       { barrier(); }
 
 int __weak
 hw_perf_group_sched_in(struct perf_counter *group_leader,
@@ -306,6 +307,10 @@ counter_sched_out(struct perf_counter *counter,
                 return;
 
         counter->state = PERF_COUNTER_STATE_INACTIVE;
+        if (counter->pending_disable) {
+                counter->pending_disable = 0;
+                counter->state = PERF_COUNTER_STATE_OFF;
+        }
         counter->tstamp_stopped = ctx->time;
         counter->pmu->disable(counter);
         counter->oncpu = -1;
@@ -1498,10 +1503,21 @@ static void perf_counter_enable_on_exec(struct task_struct *task)
  */
 static void __perf_counter_read(void *info)
 {
+        struct perf_cpu_context *cpuctx = &__get_cpu_var(perf_cpu_context);
         struct perf_counter *counter = info;
         struct perf_counter_context *ctx = counter->ctx;
         unsigned long flags;
 
+        /*
+         * If this is a task context, we need to check whether it is
+         * the current task context of this cpu.  If not it has been
+         * scheduled out before the smp call arrived.  In that case
+         * counter->count would have been updated to a recent sample
+         * when the counter was scheduled out.
+         */
+        if (ctx->task && cpuctx->task_ctx != ctx)
+                return;
+
         local_irq_save(flags);
         if (ctx->is_active)
                 update_context_time(ctx);
@@ -1691,7 +1707,32 @@ static int perf_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static u64 perf_counter_read_tree(struct perf_counter *counter)
+static int perf_counter_read_size(struct perf_counter *counter)
+{
+        int entry = sizeof(u64); /* value */
+        int size = 0;
+        int nr = 1;
+
+        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
+                size += sizeof(u64);
+
+        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
+                size += sizeof(u64);
+
+        if (counter->attr.read_format & PERF_FORMAT_ID)
+                entry += sizeof(u64);
+
+        if (counter->attr.read_format & PERF_FORMAT_GROUP) {
+                nr += counter->group_leader->nr_siblings;
+                size += sizeof(u64);
+        }
+
+        size += entry * nr;
+
+        return size;
+}
+
+static u64 perf_counter_read_value(struct perf_counter *counter)
 {
         struct perf_counter *child;
         u64 total = 0;
@@ -1703,14 +1744,96 @@ static u64 perf_counter_read_tree(struct perf_counter *counter)
         return total;
 }
 
+static int perf_counter_read_entry(struct perf_counter *counter,
+                                   u64 read_format, char __user *buf)
+{
+        int n = 0, count = 0;
+        u64 values[2];
+
+        values[n++] = perf_counter_read_value(counter);
+        if (read_format & PERF_FORMAT_ID)
+                values[n++] = primary_counter_id(counter);
+
+        count = n * sizeof(u64);
+
+        if (copy_to_user(buf, values, count))
+                return -EFAULT;
+
+        return count;
+}
+
+static int perf_counter_read_group(struct perf_counter *counter,
+                                   u64 read_format, char __user *buf)
+{
+        struct perf_counter *leader = counter->group_leader, *sub;
+        int n = 0, size = 0, err = -EFAULT;
+        u64 values[3];
+
+        values[n++] = 1 + leader->nr_siblings;
+        if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
+                values[n++] = leader->total_time_enabled +
+                        atomic64_read(&leader->child_total_time_enabled);
+        }
+        if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
+                values[n++] = leader->total_time_running +
+                        atomic64_read(&leader->child_total_time_running);
+        }
+
+        size = n * sizeof(u64);
+
+        if (copy_to_user(buf, values, size))
+                return -EFAULT;
+
+        err = perf_counter_read_entry(leader, read_format, buf + size);
+        if (err < 0)
+                return err;
+
+        size += err;
+
+        list_for_each_entry(sub, &leader->sibling_list, list_entry) {
+                err = perf_counter_read_entry(sub, read_format,
+                                buf + size);
+                if (err < 0)
+                        return err;
+
+                size += err;
+        }
+
+        return size;
+}
+
+static int perf_counter_read_one(struct perf_counter *counter,
+                                 u64 read_format, char __user *buf)
+{
+        u64 values[4];
+        int n = 0;
+
+        values[n++] = perf_counter_read_value(counter);
+        if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
+                values[n++] = counter->total_time_enabled +
+                        atomic64_read(&counter->child_total_time_enabled);
+        }
+        if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
+                values[n++] = counter->total_time_running +
+                        atomic64_read(&counter->child_total_time_running);
+        }
+        if (read_format & PERF_FORMAT_ID)
+                values[n++] = primary_counter_id(counter);
+
+        if (copy_to_user(buf, values, n * sizeof(u64)))
+                return -EFAULT;
+
+        return n * sizeof(u64);
+}
+
 /*
  * Read the performance counter - simple non blocking version for now
  */
 static ssize_t
 perf_read_hw(struct perf_counter *counter, char __user *buf, size_t count)
 {
-        u64 values[4];
-        int n;
+        u64 read_format = counter->attr.read_format;
+        int ret;
 
         /*
          * Return end-of-file for a read on a counter that is in
@@ -1720,28 +1843,18 @@ perf_read_hw(struct perf_counter *counter, char __user *buf, size_t count)
         if (counter->state == PERF_COUNTER_STATE_ERROR)
                 return 0;
 
+        if (count < perf_counter_read_size(counter))
+                return -ENOSPC;
+
         WARN_ON_ONCE(counter->ctx->parent_ctx);
         mutex_lock(&counter->child_mutex);
-        values[0] = perf_counter_read_tree(counter);
-        n = 1;
-        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
-                values[n++] = counter->total_time_enabled +
-                        atomic64_read(&counter->child_total_time_enabled);
-        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
-                values[n++] = counter->total_time_running +
-                        atomic64_read(&counter->child_total_time_running);
-        if (counter->attr.read_format & PERF_FORMAT_ID)
-                values[n++] = primary_counter_id(counter);
+        if (read_format & PERF_FORMAT_GROUP)
+                ret = perf_counter_read_group(counter, read_format, buf);
+        else
+                ret = perf_counter_read_one(counter, read_format, buf);
         mutex_unlock(&counter->child_mutex);
 
-        if (count < n * sizeof(u64))
-                return -EINVAL;
-        count = n * sizeof(u64);
-
-        if (copy_to_user(buf, values, count))
-                return -EFAULT;
-
-        return count;
+        return ret;
 }
 
 static ssize_t
@@ -1906,6 +2019,10 @@ int perf_counter_task_disable(void)
         return 0;
 }
 
+#ifndef PERF_COUNTER_INDEX_OFFSET
+# define PERF_COUNTER_INDEX_OFFSET 0
+#endif
+
 static int perf_counter_index(struct perf_counter *counter)
 {
         if (counter->state != PERF_COUNTER_STATE_ACTIVE)
@@ -2245,7 +2362,7 @@ static void perf_pending_counter(struct perf_pending_entry *entry)
 
         if (counter->pending_disable) {
                 counter->pending_disable = 0;
-                perf_counter_disable(counter);
+                __perf_counter_disable(counter);
         }
 
         if (counter->pending_wakeup) {
@@ -2630,7 +2747,80 @@ static u32 perf_counter_tid(struct perf_counter *counter, struct task_struct *p)
         return task_pid_nr_ns(p, counter->ns);
 }
 
-static void perf_counter_output(struct perf_counter *counter, int nmi,
+static void perf_output_read_one(struct perf_output_handle *handle,
+                                 struct perf_counter *counter)
+{
+        u64 read_format = counter->attr.read_format;
+        u64 values[4];
+        int n = 0;
+
+        values[n++] = atomic64_read(&counter->count);
+        if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
+                values[n++] = counter->total_time_enabled +
+                        atomic64_read(&counter->child_total_time_enabled);
+        }
+        if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
+                values[n++] = counter->total_time_running +
+                        atomic64_read(&counter->child_total_time_running);
+        }
+        if (read_format & PERF_FORMAT_ID)
+                values[n++] = primary_counter_id(counter);
+
+        perf_output_copy(handle, values, n * sizeof(u64));
+}
+
+/*
+ * XXX PERF_FORMAT_GROUP vs inherited counters seems difficult.
+ */
+static void perf_output_read_group(struct perf_output_handle *handle,
+                            struct perf_counter *counter)
+{
+        struct perf_counter *leader = counter->group_leader, *sub;
+        u64 read_format = counter->attr.read_format;
+        u64 values[5];
+        int n = 0;
+
+        values[n++] = 1 + leader->nr_siblings;
+
+        if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
+                values[n++] = leader->total_time_enabled;
+
+        if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
+                values[n++] = leader->total_time_running;
+
+        if (leader != counter)
+                leader->pmu->read(leader);
+
+        values[n++] = atomic64_read(&leader->count);
+        if (read_format & PERF_FORMAT_ID)
+                values[n++] = primary_counter_id(leader);
+
+        perf_output_copy(handle, values, n * sizeof(u64));
+
+        list_for_each_entry(sub, &leader->sibling_list, list_entry) {
+                n = 0;
+
+                if (sub != counter)
+                        sub->pmu->read(sub);
+
+                values[n++] = atomic64_read(&sub->count);
+                if (read_format & PERF_FORMAT_ID)
+                        values[n++] = primary_counter_id(sub);
+
+                perf_output_copy(handle, values, n * sizeof(u64));
+        }
+}
+
+static void perf_output_read(struct perf_output_handle *handle,
+                             struct perf_counter *counter)
+{
+        if (counter->attr.read_format & PERF_FORMAT_GROUP)
+                perf_output_read_group(handle, counter);
+        else
+                perf_output_read_one(handle, counter);
+}
+
+void perf_counter_output(struct perf_counter *counter, int nmi,
                                 struct perf_sample_data *data)
 {
         int ret;
@@ -2641,12 +2831,7 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
         struct {
                 u32 pid, tid;
         } tid_entry;
-        struct {
-                u64 id;
-                u64 counter;
-        } group_entry;
         struct perf_callchain_entry *callchain = NULL;
-        struct perf_tracepoint_record *tp;
         int callchain_size = 0;
         u64 time;
         struct {
@@ -2700,10 +2885,8 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
         if (sample_type & PERF_SAMPLE_PERIOD)
                 header.size += sizeof(u64);
 
-        if (sample_type & PERF_SAMPLE_GROUP) {
-                header.size += sizeof(u64) +
-                        counter->nr_siblings * sizeof(group_entry);
-        }
+        if (sample_type & PERF_SAMPLE_READ)
+                header.size += perf_counter_read_size(counter);
 
         if (sample_type & PERF_SAMPLE_CALLCHAIN) {
                 callchain = perf_callchain(data->regs);
@@ -2715,9 +2898,16 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
                         header.size += sizeof(u64);
         }
 
-        if (sample_type & PERF_SAMPLE_TP_RECORD) {
-                tp = data->private;
-                header.size += tp->size;
+        if (sample_type & PERF_SAMPLE_RAW) {
+                int size = sizeof(u32);
+
+                if (data->raw)
+                        size += data->raw->size;
+                else
+                        size += sizeof(u32);
+
+                WARN_ON_ONCE(size & (sizeof(u64)-1));
+                header.size += size;
         }
 
         ret = perf_output_begin(&handle, counter, header.size, nmi, 1);
@@ -2753,26 +2943,8 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
         if (sample_type & PERF_SAMPLE_PERIOD)
                 perf_output_put(&handle, data->period);
 
-        /*
-         * XXX PERF_SAMPLE_GROUP vs inherited counters seems difficult.
-         */
-        if (sample_type & PERF_SAMPLE_GROUP) {
-                struct perf_counter *leader, *sub;
-                u64 nr = counter->nr_siblings;
-
-                perf_output_put(&handle, nr);
-
-                leader = counter->group_leader;
-                list_for_each_entry(sub, &leader->sibling_list, list_entry) {
-                        if (sub != counter)
-                                sub->pmu->read(sub);
-
-                        group_entry.id = primary_counter_id(sub);
-                        group_entry.counter = atomic64_read(&sub->count);
-
-                        perf_output_put(&handle, group_entry);
-                }
-        }
+        if (sample_type & PERF_SAMPLE_READ)
+                perf_output_read(&handle, counter);
 
         if (sample_type & PERF_SAMPLE_CALLCHAIN) {
                 if (callchain)
@@ -2783,8 +2955,21 @@ static void perf_counter_output(struct perf_counter *counter, int nmi,
                 }
         }
 
-        if (sample_type & PERF_SAMPLE_TP_RECORD)
-                perf_output_copy(&handle, tp->record, tp->size);
+        if (sample_type & PERF_SAMPLE_RAW) {
+                if (data->raw) {
+                        perf_output_put(&handle, data->raw->size);
+                        perf_output_copy(&handle, data->raw->data, data->raw->size);
+                } else {
+                        struct {
+                                u32     size;
+                                u32     data;
+                        } raw = {
+                                .size = sizeof(u32),
+                                .data = 0,
+                        };
+                        perf_output_put(&handle, raw);
+                }
+        }
 
         perf_output_end(&handle);
 }
@@ -2798,8 +2983,6 @@ struct perf_read_event {
 
         u32                             pid;
         u32                             tid;
-        u64                             value;
-        u64                             format[3];
 };
 
 static void
@@ -2811,34 +2994,20 @@ perf_counter_read_event(struct perf_counter *counter,
                 .header = {
                         .type = PERF_EVENT_READ,
                         .misc = 0,
-                        .size = sizeof(event) - sizeof(event.format),
+                        .size = sizeof(event) + perf_counter_read_size(counter),
                 },
                 .pid = perf_counter_pid(counter, task),
                 .tid = perf_counter_tid(counter, task),
-                .value = atomic64_read(&counter->count),
         };
-        int ret, i = 0;
-
-        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
-                event.header.size += sizeof(u64);
-                event.format[i++] = counter->total_time_enabled;
-        }
-
-        if (counter->attr.read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
-                event.header.size += sizeof(u64);
-                event.format[i++] = counter->total_time_running;
-        }
-
-        if (counter->attr.read_format & PERF_FORMAT_ID) {
-                event.header.size += sizeof(u64);
-                event.format[i++] = primary_counter_id(counter);
-        }
+        int ret;
 
         ret = perf_output_begin(&handle, counter, event.header.size, 0, 0);
         if (ret)
                 return;
 
-        perf_output_copy(&handle, &event, event.header.size);
+        perf_output_put(&handle, event);
+        perf_output_read(&handle, counter);
+
         perf_output_end(&handle);
 }
 
@@ -2849,7 +3018,8 @@ perf_counter_read_event(struct perf_counter *counter,
  */
 
 struct perf_task_event {
-        struct task_struct      *task;
+        struct task_struct              *task;
+        struct perf_counter_context     *task_ctx;
 
         struct {
                 struct perf_event_header        header;
@@ -2873,10 +3043,10 @@ static void perf_counter_task_output(struct perf_counter *counter,
                 return;
 
         task_event->event.pid = perf_counter_pid(counter, task);
-        task_event->event.ppid = perf_counter_pid(counter, task->real_parent);
+        task_event->event.ppid = perf_counter_pid(counter, current);
 
         task_event->event.tid = perf_counter_tid(counter, task);
-        task_event->event.ptid = perf_counter_tid(counter, task->real_parent);
+        task_event->event.ptid = perf_counter_tid(counter, current);
 
         perf_output_put(&handle, task_event->event);
         perf_output_end(&handle);
@@ -2909,24 +3079,23 @@ static void perf_counter_task_ctx(struct perf_counter_context *ctx,
 static void perf_counter_task_event(struct perf_task_event *task_event)
 {
         struct perf_cpu_context *cpuctx;
-        struct perf_counter_context *ctx;
+        struct perf_counter_context *ctx = task_event->task_ctx;
 
         cpuctx = &get_cpu_var(perf_cpu_context);
         perf_counter_task_ctx(&cpuctx->ctx, task_event);
         put_cpu_var(perf_cpu_context);
 
         rcu_read_lock();
-        /*
-         * doesn't really matter which of the child contexts the
-         * events ends up in.
-         */
-        ctx = rcu_dereference(current->perf_counter_ctxp);
+        if (!ctx)
+                ctx = rcu_dereference(task_event->task->perf_counter_ctxp);
         if (ctx)
                 perf_counter_task_ctx(ctx, task_event);
         rcu_read_unlock();
 }
 
-static void perf_counter_task(struct task_struct *task, int new)
+static void perf_counter_task(struct task_struct *task,
+                              struct perf_counter_context *task_ctx,
+                              int new)
 {
         struct perf_task_event task_event;
 
@@ -2936,8 +3105,9 @@ static void perf_counter_task(struct task_struct *task, int new)
                 return;
 
         task_event = (struct perf_task_event){
-                .task   = task,
-                .event  = {
+                .task     = task,
+                .task_ctx = task_ctx,
+                .event    = {
                         .header = {
                                 .type = new ? PERF_EVENT_FORK : PERF_EVENT_EXIT,
                                 .misc = 0,
@@ -2955,7 +3125,7 @@ static void perf_counter_task(struct task_struct *task, int new)
 
 void perf_counter_fork(struct task_struct *task)
 {
-        perf_counter_task(task, 1);
+        perf_counter_task(task, NULL, 1);
 }
 
 /*
@@ -3344,125 +3514,111 @@ int perf_counter_overflow(struct perf_counter *counter, int nmi,
  * Generic software counter infrastructure
  */
 
-static void perf_swcounter_update(struct perf_counter *counter)
+/*
+ * We directly increment counter->count and keep a second value in
+ * counter->hw.period_left to count intervals. This period counter
+ * is kept in the range [-sample_period, 0] so that we can use the
+ * sign as trigger.
+ */
+
+static u64 perf_swcounter_set_period(struct perf_counter *counter)
 {
         struct hw_perf_counter *hwc = &counter->hw;
-        u64 prev, now;
-        s64 delta;
+        u64 period = hwc->last_period;
+        u64 nr, offset;
+        s64 old, val;
+
+        hwc->last_period = hwc->sample_period;
 
 again:
-        prev = atomic64_read(&hwc->prev_count);
-        now = atomic64_read(&hwc->count);
-        if (atomic64_cmpxchg(&hwc->prev_count, prev, now) != prev)
-                goto again;
+        old = val = atomic64_read(&hwc->period_left);
+        if (val < 0)
+                return 0;
 
-        delta = now - prev;
+        nr = div64_u64(period + val, period);
+        offset = nr * period;
+        val -= offset;
+        if (atomic64_cmpxchg(&hwc->period_left, old, val) != old)
+                goto again;
 
-        atomic64_add(delta, &counter->count);
-        atomic64_sub(delta, &hwc->period_left);
+        return nr;
 }
 
-static void perf_swcounter_set_period(struct perf_counter *counter)
+static void perf_swcounter_overflow(struct perf_counter *counter,
+                                    int nmi, struct perf_sample_data *data)
 {
         struct hw_perf_counter *hwc = &counter->hw;
-        s64 left = atomic64_read(&hwc->period_left);
-        s64 period = hwc->sample_period;
+        u64 overflow;
 
-        if (unlikely(left <= -period)) {
-                left = period;
-                atomic64_set(&hwc->period_left, left);
-                hwc->last_period = period;
-        }
+        data->period = counter->hw.last_period;
+        overflow = perf_swcounter_set_period(counter);
 
-        if (unlikely(left <= 0)) {
-                left += period;
-                atomic64_add(period, &hwc->period_left);
-                hwc->last_period = period;
-        }
+        if (hwc->interrupts == MAX_INTERRUPTS)
+                return;
 
-        atomic64_set(&hwc->prev_count, -left);
-        atomic64_set(&hwc->count, -left);
+        for (; overflow; overflow--) {
+                if (perf_counter_overflow(counter, nmi, data)) {
+                        /*
+                         * We inhibit the overflow from happening when
+                         * hwc->interrupts == MAX_INTERRUPTS.
+                         */
+                        break;
+                }
+        }
 }
 
-static enum hrtimer_restart perf_swcounter_hrtimer(struct hrtimer *hrtimer)
+static void perf_swcounter_unthrottle(struct perf_counter *counter)
 {
-        enum hrtimer_restart ret = HRTIMER_RESTART;
-        struct perf_sample_data data;
-        struct perf_counter *counter;
-        u64 period;
-
-        counter = container_of(hrtimer, struct perf_counter, hw.hrtimer);
-        counter->pmu->read(counter);
-
-        data.addr = 0;
-        data.regs = get_irq_regs();
         /*
-         * In case we exclude kernel IPs or are somehow not in interrupt
-         * context, provide the next best thing, the user IP.
+         * Nothing to do, we already reset hwc->interrupts.
          */
-        if ((counter->attr.exclude_kernel || !data.regs) &&
-                        !counter->attr.exclude_user)
-                data.regs = task_pt_regs(current);
+}
 
-        if (data.regs) {
-                if (perf_counter_overflow(counter, 0, &data))
-                        ret = HRTIMER_NORESTART;
-        }
+static void perf_swcounter_add(struct perf_counter *counter, u64 nr,
+                               int nmi, struct perf_sample_data *data)
+{
+        struct hw_perf_counter *hwc = &counter->hw;
 
-        period = max_t(u64, 10000, counter->hw.sample_period);
-        hrtimer_forward_now(hrtimer, ns_to_ktime(period));
+        atomic64_add(nr, &counter->count);
 
-        return ret;
-}
+        if (!hwc->sample_period)
+                return;
 
-static void perf_swcounter_overflow(struct perf_counter *counter,
-                                    int nmi, struct perf_sample_data *data)
-{
-        data->period = counter->hw.last_period;
+        if (!data->regs)
+                return;
 
-        perf_swcounter_update(counter);
-        perf_swcounter_set_period(counter);
-        if (perf_counter_overflow(counter, nmi, data))
-                /* soft-disable the counter */
-                ;
+        if (!atomic64_add_negative(nr, &hwc->period_left))
+                perf_swcounter_overflow(counter, nmi, data);
 }
 
 static int perf_swcounter_is_counting(struct perf_counter *counter)
 {
-        struct perf_counter_context *ctx;
-        unsigned long flags;
-        int count;
-
+        /*
+         * The counter is active, we're good!
+         */
         if (counter->state == PERF_COUNTER_STATE_ACTIVE)
                 return 1;
 
+        /*
+         * The counter is off/error, not counting.
+         */
         if (counter->state != PERF_COUNTER_STATE_INACTIVE)
                 return 0;
 
         /*
-         * If the counter is inactive, it could be just because
-         * its task is scheduled out, or because it's in a group
-         * which could not go on the PMU.  We want to count in
-         * the first case but not the second.  If the context is
-         * currently active then an inactive software counter must
-         * be the second case.  If it's not currently active then
-         * we need to know whether the counter was active when the
-         * context was last active, which we can determine by
-         * comparing counter->tstamp_stopped with ctx->time.
-         *
-         * We are within an RCU read-side critical section,
-         * which protects the existence of *ctx.
+         * The counter is inactive, if the context is active
+         * we're part of a group that didn't make it on the 'pmu',
+         * not counting.
          */
-        ctx = counter->ctx;
-        spin_lock_irqsave(&ctx->lock, flags);
-        count = 1;
-        /* Re-check state now we have the lock */
-        if (counter->state < PERF_COUNTER_STATE_INACTIVE ||
-            counter->ctx->is_active ||
-            counter->tstamp_stopped < ctx->time)
-                count = 0;
-        spin_unlock_irqrestore(&ctx->lock, flags);
-        return count;
+        if (counter->ctx->is_active)
+                return 0;
+
+        /*
+         * We're inactive and the context is too, this means the
+         * task is scheduled out, we're counting events that happen
+         * to us, like migration events.
+         */
+        return 1;
 }
 
 static int perf_swcounter_match(struct perf_counter *counter,
@@ -3488,15 +3644,6 @@ static int perf_swcounter_match(struct perf_counter *counter,
         return 1;
 }
 
-static void perf_swcounter_add(struct perf_counter *counter, u64 nr,
-                               int nmi, struct perf_sample_data *data)
-{
-        int neg = atomic64_add_negative(nr, &counter->hw.count);
-
-        if (counter->hw.sample_period && !neg && data->regs)
-                perf_swcounter_overflow(counter, nmi, data);
-}
-
 static void perf_swcounter_ctx_event(struct perf_counter_context *ctx,
                                      enum perf_type_id type,
                                      u32 event, u64 nr, int nmi,
@@ -3575,27 +3722,66 @@ void __perf_swcounter_event(u32 event, u64 nr, int nmi,
 
 static void perf_swcounter_read(struct perf_counter *counter)
 {
-        perf_swcounter_update(counter);
 }
 
 static int perf_swcounter_enable(struct perf_counter *counter)
 {
-        perf_swcounter_set_period(counter);
+        struct hw_perf_counter *hwc = &counter->hw;
+
+        if (hwc->sample_period) {
+                hwc->last_period = hwc->sample_period;
+                perf_swcounter_set_period(counter);
+        }
         return 0;
 }
 
 static void perf_swcounter_disable(struct perf_counter *counter)
 {
-        perf_swcounter_update(counter);
 }
 
 static const struct pmu perf_ops_generic = {
         .enable         = perf_swcounter_enable,
         .disable        = perf_swcounter_disable,
         .read           = perf_swcounter_read,
+        .unthrottle     = perf_swcounter_unthrottle,
 };
 
 /*
+ * hrtimer based swcounter callback
+ */
+
+static enum hrtimer_restart perf_swcounter_hrtimer(struct hrtimer *hrtimer)
+{
+        enum hrtimer_restart ret = HRTIMER_RESTART;
+        struct perf_sample_data data;
+        struct perf_counter *counter;
+        u64 period;
+
+        counter = container_of(hrtimer, struct perf_counter, hw.hrtimer);
+        counter->pmu->read(counter);
+
+        data.addr = 0;
+        data.regs = get_irq_regs();
+        /*
+         * In case we exclude kernel IPs or are somehow not in interrupt
+         * context, provide the next best thing, the user IP.
+         */
+        if ((counter->attr.exclude_kernel || !data.regs) &&
+                        !counter->attr.exclude_user)
+                data.regs = task_pt_regs(current);
+
+        if (data.regs) {
+                if (perf_counter_overflow(counter, 0, &data))
+                        ret = HRTIMER_NORESTART;
+        }
+
+        period = max_t(u64, 10000, counter->hw.sample_period);
+        hrtimer_forward_now(hrtimer, ns_to_ktime(period));
+
+        return ret;
+}
+
+/*
  * Software counter: cpu wall time clock
  */
 
@@ -3715,15 +3901,15 @@ static const struct pmu perf_ops_task_clock = {
 void perf_tpcounter_event(int event_id, u64 addr, u64 count, void *record,
                           int entry_size)
 {
-        struct perf_tracepoint_record tp = {
+        struct perf_raw_record raw = {
                 .size = entry_size,
-                .record = record,
+                .data = record,
         };
 
         struct perf_sample_data data = {
                 .regs = get_irq_regs(),
                 .addr = addr,
-                .private = &tp,
+                .raw = &raw,
         };
 
         if (!data.regs)
@@ -3743,6 +3929,14 @@ static void tp_perf_counter_destroy(struct perf_counter *counter)
 
 static const struct pmu *tp_perf_counter_init(struct perf_counter *counter)
 {
+        /*
+         * Raw tracepoint data is a severe data leak, only allow root to
+         * have these.
+         */
+        if ((counter->attr.sample_type & PERF_SAMPLE_RAW) &&
+                        !capable(CAP_SYS_ADMIN))
+                return ERR_PTR(-EPERM);
+
         if (ftrace_profile_enable(counter->attr.config))
                 return NULL;
 
@@ -3876,9 +4070,9 @@ perf_counter_alloc(struct perf_counter_attr *attr,
         atomic64_set(&hwc->period_left, hwc->sample_period);
 
         /*
-         * we currently do not support PERF_SAMPLE_GROUP on inherited counters
+         * we currently do not support PERF_FORMAT_GROUP on inherited counters
          */
-        if (attr->inherit && (attr->sample_type & PERF_SAMPLE_GROUP))
+        if (attr->inherit && (attr->read_format & PERF_FORMAT_GROUP))
                 goto done;
 
         switch (attr->type) {
@@ -4285,7 +4479,7 @@ void perf_counter_exit_task(struct task_struct *child)
         unsigned long flags;
 
         if (likely(!child->perf_counter_ctxp)) {
-                perf_counter_task(child, 0);
+                perf_counter_task(child, NULL, 0);
                 return;
         }
 
@@ -4305,6 +4499,7 @@ void perf_counter_exit_task(struct task_struct *child)
          * incremented the context's refcount before we do put_ctx below.
          */
         spin_lock(&child_ctx->lock);
+        child->perf_counter_ctxp = NULL;
         /*
          * If this context is a clone; unclone it so it can't get
          * swapped to another process while we're removing all
@@ -4318,9 +4513,7 @@ void perf_counter_exit_task(struct task_struct *child)
          * won't get any samples after PERF_EVENT_EXIT. We can however still
          * get a few PERF_EVENT_READ events.
          */
-        perf_counter_task(child, 0);
-
-        child->perf_counter_ctxp = NULL;
+        perf_counter_task(child, child_ctx, 0);
 
         /*
          * We can recurse on the same lock type through:
@@ -4541,6 +4734,11 @@ perf_cpu_notify(struct notifier_block *self, unsigned long action, void *hcpu)
                 perf_counter_init_cpu(cpu);
                 break;
 
+        case CPU_ONLINE:
+        case CPU_ONLINE_FROZEN:
+                hw_perf_counter_setup_online(cpu);
+                break;
+
         case CPU_DOWN_PREPARE:
         case CPU_DOWN_PREPARE_FROZEN:
                 perf_counter_exit_cpu(cpu);
@@ -4565,6 +4763,8 @@ void __init perf_counter_init(void)
 {
         perf_cpu_notify(&perf_cpu_nb, (unsigned long)CPU_UP_PREPARE,
                         (void *)(long)smp_processor_id());
+        perf_cpu_notify(&perf_cpu_nb, (unsigned long)CPU_ONLINE,
+                        (void *)(long)smp_processor_id());
         register_cpu_notifier(&perf_cpu_nb);
 }
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 98e02328c67d..58be76017fd0 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -49,6 +49,7 @@
 #include <linux/acpi.h>
 #include <linux/reboot.h>
 #include <linux/ftrace.h>
+#include <linux/security.h>
 #include <linux/slow-work.h>
 #include <linux/perf_counter.h>
 
@@ -1306,10 +1307,10 @@ static struct ctl_table vm_table[] = {
         {
                 .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "mmap_min_addr",
-                .data           = &mmap_min_addr,
-                .maxlen         = sizeof(unsigned long),
+                .data           = &dac_mmap_min_addr,
+                .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
-                .proc_handler   = &proc_doulongvec_minmax,
+                .proc_handler   = &mmap_min_addr_handler,
         },
 #ifdef CONFIG_NUMA
         {
diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
index a6dcd67b041d..620b58abdc32 100644
--- a/kernel/time/clockevents.c
+++ b/kernel/time/clockevents.c
@@ -137,11 +137,12 @@ int clockevents_program_event(struct clock_event_device *dev, ktime_t expires,
  */
 int clockevents_register_notifier(struct notifier_block *nb)
 {
+        unsigned long flags;
         int ret;
 
-        spin_lock(&clockevents_lock);
+        spin_lock_irqsave(&clockevents_lock, flags);
         ret = raw_notifier_chain_register(&clockevents_chain, nb);
-        spin_unlock(&clockevents_lock);
+        spin_unlock_irqrestore(&clockevents_lock, flags);
 
         return ret;
 }
@@ -178,16 +179,18 @@ static void clockevents_notify_released(void)
  */
 void clockevents_register_device(struct clock_event_device *dev)
 {
+        unsigned long flags;
+
         BUG_ON(dev->mode != CLOCK_EVT_MODE_UNUSED);
         BUG_ON(!dev->cpumask);
 
-        spin_lock(&clockevents_lock);
+        spin_lock_irqsave(&clockevents_lock, flags);
 
         list_add(&dev->list, &clockevent_devices);
         clockevents_do_notify(CLOCK_EVT_NOTIFY_ADD, dev);
         clockevents_notify_released();
 
-        spin_unlock(&clockevents_lock);
+        spin_unlock_irqrestore(&clockevents_lock, flags);
 }
 EXPORT_SYMBOL_GPL(clockevents_register_device);
 
@@ -235,8 +238,9 @@ void clockevents_exchange_device(struct clock_event_device *old,
 void clockevents_notify(unsigned long reason, void *arg)
 {
         struct list_head *node, *tmp;
+        unsigned long flags;
 
-        spin_lock(&clockevents_lock);
+        spin_lock_irqsave(&clockevents_lock, flags);
         clockevents_do_notify(reason, arg);
 
         switch (reason) {
@@ -251,7 +255,7 @@ void clockevents_notify(unsigned long reason, void *arg)
         default:
                 break;
         }
-        spin_unlock(&clockevents_lock);
+        spin_unlock_irqrestore(&clockevents_lock, flags);
 }
 EXPORT_SYMBOL_GPL(clockevents_notify);
 #endif
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 877dbedc3118..c2ec25087a35 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -205,11 +205,11 @@ static void tick_handle_periodic_broadcast(struct clock_event_device *dev)
  * Powerstate information: The system enters/leaves a state, where
  * affected devices might stop
  */
-static void tick_do_broadcast_on_off(void *why)
+static void tick_do_broadcast_on_off(unsigned long *reason)
 {
         struct clock_event_device *bc, *dev;
         struct tick_device *td;
-        unsigned long flags, *reason = why;
+        unsigned long flags;
         int cpu, bc_stopped;
 
         spin_lock_irqsave(&tick_broadcast_lock, flags);
@@ -276,8 +276,7 @@ void tick_broadcast_on_off(unsigned long reason, int *oncpu)
                 printk(KERN_ERR "tick-broadcast: ignoring broadcast for "
                        "offline CPU #%d\n", *oncpu);
         else
-                smp_call_function_single(*oncpu, tick_do_broadcast_on_off,
-                                         &reason, 1);
+                tick_do_broadcast_on_off(&reason);
 }
 
 /*
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index a999b92a1277..fddd69d16e03 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -286,7 +286,7 @@ static int __init init_timer_list_procfs(void)
 {
         struct proc_dir_entry *pe;
 
-        pe = proc_create("timer_list", 0644, NULL, &timer_list_fops);
+        pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
         if (!pe)
                 return -ENOMEM;
         return 0;
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 1090b0aed9ba..7a34cb563fec 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -267,8 +267,8 @@ static void blk_trace_free(struct blk_trace *bt)
 {
         debugfs_remove(bt->msg_file);
         debugfs_remove(bt->dropped_file);
-        debugfs_remove(bt->dir);
         relay_close(bt->rchan);
+        debugfs_remove(bt->dir);
         free_percpu(bt->sequence);
         free_percpu(bt->msg_data);
         kfree(bt);
@@ -378,18 +378,8 @@ static int blk_subbuf_start_callback(struct rchan_buf *buf, void *subbuf,
 
 static int blk_remove_buf_file_callback(struct dentry *dentry)
 {
-        struct dentry *parent = dentry->d_parent;
         debugfs_remove(dentry);
 
-        /*
-        * this will fail for all but the last file, but that is ok. what we
-        * care about is the top level buts->name directory going away, when
-        * the last trace file is gone. Then we don't have to rmdir() that
-        * manually on trace stop, so it nicely solves the issue with
-        * force killing of running traces.
-        */
-
-        debugfs_remove(parent);
         return 0;
 }
 
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 1e1d23c26308..25edd5cc5935 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -2278,7 +2278,11 @@ ftrace_regex_write(struct file *file, const char __user *ubuf,
         read++;
         cnt--;
 
-        if (!(iter->flags & ~FTRACE_ITER_CONT)) {
+        /*
+         * If the parser haven't finished with the last write,
+         * continue reading the user input without skipping spaces.
+         */
+        if (!(iter->flags & FTRACE_ITER_CONT)) {
                 /* skip white space */
                 while (cnt && isspace(ch)) {
                         ret = get_user(ch, ubuf++);
@@ -2288,8 +2292,9 @@ ftrace_regex_write(struct file *file, const char __user *ubuf,
                         cnt--;
                 }
 
+                /* only spaces were written */
                 if (isspace(ch)) {
-                        file->f_pos += read;
+                        *ppos += read;
                         ret = read;
                         goto out;
                 }
@@ -2319,12 +2324,12 @@ ftrace_regex_write(struct file *file, const char __user *ubuf,
                 if (ret)
                         goto out;
                 iter->buffer_idx = 0;
-        } else
+        } else {
                 iter->flags |= FTRACE_ITER_CONT;
+                iter->buffer[iter->buffer_idx++] = ch;
+        }
 
-
-        file->f_pos += read;
-
+        *ppos += read;
         ret = read;
  out:
         mutex_unlock(&ftrace_regex_lock);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c22b40f8f576..8c358395d338 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3896,17 +3896,9 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt,
         if (ret < 0)
                 return ret;
 
-        switch (val) {
-        case 0:
-                trace_flags &= ~(1 << index);
-                break;
-        case 1:
-                trace_flags |= 1 << index;
-                break;
-
-        default:
+        if (val != 0 && val != 1)
                 return -EINVAL;
-        }
+        set_tracer_flags(1 << index, val);
 
         *ppos += cnt;
 
diff --git a/kernel/wait.c b/kernel/wait.c
index ea7c3b4275cf..c4bd3d825f35 100644
--- a/kernel/wait.c
+++ b/kernel/wait.c
@@ -10,13 +10,14 @@
 #include <linux/wait.h>
 #include <linux/hash.h>
 
-void init_waitqueue_head(wait_queue_head_t *q)
+void __init_waitqueue_head(wait_queue_head_t *q, struct lock_class_key *key)
 {
         spin_lock_init(&q->lock);
+        lockdep_set_class(&q->lock, key);
         INIT_LIST_HEAD(&q->task_list);
 }
 
-EXPORT_SYMBOL(init_waitqueue_head);
+EXPORT_SYMBOL(__init_waitqueue_head);
 
 void add_wait_queue(wait_queue_head_t *q, wait_queue_t *wait)
 {
diff --git a/lib/bitmap.c b/lib/bitmap.c
index 35a1f7ff4149..702565821c99 100644
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -179,14 +179,16 @@ void __bitmap_shift_left(unsigned long *dst,
 }
 EXPORT_SYMBOL(__bitmap_shift_left);
 
-void __bitmap_and(unsigned long *dst, const unsigned long *bitmap1,
+int __bitmap_and(unsigned long *dst, const unsigned long *bitmap1,
                                 const unsigned long *bitmap2, int bits)
 {
         int k;
         int nr = BITS_TO_LONGS(bits);
+        unsigned long result = 0;
 
         for (k = 0; k < nr; k++)
-                dst[k] = bitmap1[k] & bitmap2[k];
+                result |= (dst[k] = bitmap1[k] & bitmap2[k]);
+        return result != 0;
 }
 EXPORT_SYMBOL(__bitmap_and);
 
@@ -212,14 +214,16 @@ void __bitmap_xor(unsigned long *dst, const unsigned long *bitmap1,
 }
 EXPORT_SYMBOL(__bitmap_xor);
 
-void __bitmap_andnot(unsigned long *dst, const unsigned long *bitmap1,
+int __bitmap_andnot(unsigned long *dst, const unsigned long *bitmap1,
                                 const unsigned long *bitmap2, int bits)
 {
         int k;
         int nr = BITS_TO_LONGS(bits);
+        unsigned long result = 0;
 
         for (k = 0; k < nr; k++)
-                dst[k] = bitmap1[k] & ~bitmap2[k];
+                result |= (dst[k] = bitmap1[k] & ~bitmap2[k]);
+        return result != 0;
 }
 EXPORT_SYMBOL(__bitmap_andnot);
 
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 65b0d99b6d0a..58a9f9fc609a 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -156,9 +156,13 @@ static bool driver_filter(struct device *dev)
                 return true;
 
         /* driver filter on and initialized */
-        if (current_driver && dev->driver == current_driver)
+        if (current_driver && dev && dev->driver == current_driver)
                 return true;
 
+        /* driver filter on, but we can't filter on a NULL device... */
+        if (!dev)
+                return false;
+
         if (current_driver || !current_driver_name[0])
                 return false;
 
@@ -183,17 +187,17 @@ static bool driver_filter(struct device *dev)
         return ret;
 }
 
-#define err_printk(dev, entry, format, arg...) do {             \
-                error_count += 1;                               \
-                if (driver_filter(dev) &&                       \
-                    (show_all_errors || show_num_errors > 0)) { \
-                        WARN(1, "%s %s: " format,               \
-                             dev_driver_string(dev),            \
-                             dev_name(dev) , ## arg);           \
-                        dump_entry_trace(entry);                \
-                }                                               \
-                if (!show_all_errors && show_num_errors > 0)    \
-                        show_num_errors -= 1;                   \
+#define err_printk(dev, entry, format, arg...) do {                     \
+                error_count += 1;                                       \
+                if (driver_filter(dev) &&                               \
+                    (show_all_errors || show_num_errors > 0)) {         \
+                        WARN(1, "%s %s: " format,                       \
+                             dev ? dev_driver_string(dev) : "NULL",     \
+                             dev ? dev_name(dev) : "NULL", ## arg);     \
+                        dump_entry_trace(entry);                        \
+                }                                                       \
+                if (!show_all_errors && show_num_errors > 0)            \
+                        show_num_errors -= 1;                           \
         } while (0);
 
 /*
diff --git a/lib/flex_array.c b/lib/flex_array.c
index 08f1636d296a..7baed2fc3bc8 100644
--- a/lib/flex_array.c
+++ b/lib/flex_array.c
@@ -99,7 +99,8 @@ static inline int elements_fit_in_base(struct flex_array *fa)
  * capacity in the base structure.  Also note that no effort is made
  * to efficiently pack objects across page boundaries.
  */
-struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags)
+struct flex_array *flex_array_alloc(int element_size, unsigned int total,
+                                        gfp_t flags)
 {
         struct flex_array *ret;
         int max_size = nr_base_part_ptrs() * __elements_per_part(element_size);
@@ -115,16 +116,14 @@ struct flex_array *flex_array_alloc(int element_size, int total, gfp_t flags)
         return ret;
 }
 
-static int fa_element_to_part_nr(struct flex_array *fa, int element_nr)
+static int fa_element_to_part_nr(struct flex_array *fa,
+                                        unsigned int element_nr)
 {
         return element_nr / __elements_per_part(fa->element_size);
 }
 
 /**
  * flex_array_free_parts - just free the second-level pages
- * @src:        address of data to copy into the array
- * @element_nr: index of the position in which to insert
- *              the new element.
  *
  * This is to be used in cases where the base 'struct flex_array'
  * has been statically allocated and should not be free.
@@ -146,14 +145,12 @@ void flex_array_free(struct flex_array *fa)
         kfree(fa);
 }
 
-static int fa_index_inside_part(struct flex_array *fa, int element_nr)
+static unsigned int index_inside_part(struct flex_array *fa,
+                                        unsigned int element_nr)
 {
-        return element_nr % __elements_per_part(fa->element_size);
-}
+        unsigned int part_offset;
 
-static int index_inside_part(struct flex_array *fa, int element_nr)
-{
-        int part_offset = fa_index_inside_part(fa, element_nr);
+        part_offset = element_nr % __elements_per_part(fa->element_size);
         return part_offset * fa->element_size;
 }
 
@@ -188,7 +185,8 @@ __fa_get_part(struct flex_array *fa, int part_nr, gfp_t flags)
  *
  * Locking must be provided by the caller.
  */
-int flex_array_put(struct flex_array *fa, int element_nr, void *src, gfp_t flags)
+int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,
+                        gfp_t flags)
 {
         int part_nr = fa_element_to_part_nr(fa, element_nr);
         struct flex_array_part *part;
@@ -198,10 +196,11 @@ int flex_array_put(struct flex_array *fa, int element_nr, void *src, gfp_t flags
                 return -ENOSPC;
         if (elements_fit_in_base(fa))
                 part = (struct flex_array_part *)&fa->parts[0];
-        else
+        else {
                 part = __fa_get_part(fa, part_nr, flags);
-        if (!part)
-                return -ENOMEM;
+                if (!part)
+                        return -ENOMEM;
+        }
         dst = &part->elements[index_inside_part(fa, element_nr)];
         memcpy(dst, src, fa->element_size);
         return 0;
@@ -219,7 +218,8 @@ int flex_array_put(struct flex_array *fa, int element_nr, void *src, gfp_t flags
  *
  * Locking must be provided by the caller.
  */
-int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags)
+int flex_array_prealloc(struct flex_array *fa, unsigned int start,
+                        unsigned int end, gfp_t flags)
 {
         int start_part;
         int end_part;
@@ -250,18 +250,19 @@ int flex_array_prealloc(struct flex_array *fa, int start, int end, gfp_t flags)
  *
  * Locking must be provided by the caller.
  */
-void *flex_array_get(struct flex_array *fa, int element_nr)
+void *flex_array_get(struct flex_array *fa, unsigned int element_nr)
 {
         int part_nr = fa_element_to_part_nr(fa, element_nr);
         struct flex_array_part *part;
 
         if (element_nr >= fa->total_nr_elements)
                 return NULL;
-        if (!fa->parts[part_nr])
-                return NULL;
         if (elements_fit_in_base(fa))
                 part = (struct flex_array_part *)&fa->parts[0];
-        else
+        else {
                 part = fa->parts[part_nr];
+                if (!part)
+                        return NULL;
+        }
         return &part->elements[index_inside_part(fa, element_nr)];
 }
diff --git a/mm/Kconfig b/mm/Kconfig
index c948d4ca8bde..fe5f674d7a7d 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -225,9 +225,9 @@ config DEFAULT_MMAP_MIN_ADDR
           For most ia64, ppc64 and x86 users with lots of address space
           a value of 65536 is reasonable and should cause no problems.
           On arm and other archs it should not be higher than 32768.
-          Programs which use vm86 functionality would either need additional
-          permissions from either the LSM or the capabilities module or have
-          this protection disabled.
+          Programs which use vm86 functionality or have some need to map
+          this low address space will need CAP_SYS_RAWIO or disable this
+          protection by setting the value to 0.
 
           This value can be changed after boot using the
           /proc/sys/vm/mmap_min_addr tunable.
diff --git a/mm/mempool.c b/mm/mempool.c
index a46eb1b4bb66..32e75d400503 100644
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -303,14 +303,14 @@ EXPORT_SYMBOL(mempool_free_slab);
  */
 void *mempool_kmalloc(gfp_t gfp_mask, void *pool_data)
 {
-        size_t size = (size_t)(long)pool_data;
+        size_t size = (size_t)pool_data;
         return kmalloc(size, gfp_mask);
 }
 EXPORT_SYMBOL(mempool_kmalloc);
 
 void *mempool_kzalloc(gfp_t gfp_mask, void *pool_data)
 {
-        size_t size = (size_t) pool_data;
+        size_t size = (size_t)pool_data;
         return kzalloc(size, gfp_mask);
 }
 EXPORT_SYMBOL(mempool_kzalloc);
diff --git a/mm/mmap.c b/mm/mmap.c
index 34579b23ebd5..8101de490c73 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -88,9 +88,6 @@ int sysctl_overcommit_ratio = 50;	/* default is 50% */
 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
 struct percpu_counter vm_committed_as;
 
-/* amount of vm to protect from userspace access */
-unsigned long mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
-
 /*
  * Check that a process has enough memory to allocate a new virtual
  * mapping. 0 means there is enough memory for the allocation to
diff --git a/mm/nommu.c b/mm/nommu.c
index 53cab10fece4..4bde489ec431 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -69,9 +69,6 @@ int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
 int heap_stack_gap = 0;
 
-/* amount of vm to protect from userspace access */
-unsigned long mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
-
 atomic_long_t mmap_pages_allocated;
 
 EXPORT_SYMBOL(mem_map);
@@ -922,6 +919,10 @@ static int validate_mmap_request(struct file *file,
                 if (!file->f_op->read)
                         capabilities &= ~BDI_CAP_MAP_COPY;
 
+                /* The file shall have been opened with read permission. */
+                if (!(file->f_mode & FMODE_READ))
+                        return -EACCES;
+
                 if (flags & MAP_SHARED) {
                         /* do checks for writing, appending and locking */
                         if ((prot & PROT_WRITE) &&
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 175a67a78a99..a7b2460e922b 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -58,7 +58,6 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
         unsigned long points, cpu_time, run_time;
         struct mm_struct *mm;
         struct task_struct *child;
-        int oom_adj;
 
         task_lock(p);
         mm = p->mm;
@@ -66,11 +65,6 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
                 task_unlock(p);
                 return 0;
         }
-        oom_adj = mm->oom_adj;
-        if (oom_adj == OOM_DISABLE) {
-                task_unlock(p);
-                return 0;
-        }
 
         /*
          * The memory size of the process is the basis for the badness.
@@ -154,15 +148,15 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
                 points /= 8;
 
         /*
-         * Adjust the score by oom_adj.
+         * Adjust the score by oomkilladj.
          */
-        if (oom_adj) {
-                if (oom_adj > 0) {
+        if (p->oomkilladj) {
+                if (p->oomkilladj > 0) {
                         if (!points)
                                 points = 1;
-                        points <<= oom_adj;
+                        points <<= p->oomkilladj;
                 } else
-                        points >>= -(oom_adj);
+                        points >>= -(p->oomkilladj);
         }
 
 #ifdef DEBUG
@@ -257,8 +251,11 @@ static struct task_struct *select_bad_process(unsigned long *ppoints,
                         *ppoints = ULONG_MAX;
                 }
 
+                if (p->oomkilladj == OOM_DISABLE)
+                        continue;
+
                 points = badness(p, uptime.tv_sec);
-                if (points > *ppoints) {
+                if (points > *ppoints || !chosen) {
                         chosen = p;
                         *ppoints = points;
                 }
@@ -307,7 +304,8 @@ static void dump_tasks(const struct mem_cgroup *mem)
                 }
                 printk(KERN_INFO "[%5d] %5d %5d %8lu %8lu %3d     %3d %s\n",
                        p->pid, __task_cred(p)->uid, p->tgid, mm->total_vm,
-                       get_mm_rss(mm), (int)task_cpu(p), mm->oom_adj, p->comm);
+                       get_mm_rss(mm), (int)task_cpu(p), p->oomkilladj,
+                       p->comm);
                 task_unlock(p);
         } while_each_thread(g, p);
 }
@@ -325,8 +323,11 @@ static void __oom_kill_task(struct task_struct *p, int verbose)
                 return;
         }
 
-        if (!p->mm)
+        if (!p->mm) {
+                WARN_ON(1);
+                printk(KERN_WARNING "tried to kill an mm-less task!\n");
                 return;
+        }
 
         if (verbose)
                 printk(KERN_ERR "Killed process %d (%s)\n",
@@ -348,13 +349,28 @@ static int oom_kill_task(struct task_struct *p)
         struct mm_struct *mm;
         struct task_struct *g, *q;
 
-        task_lock(p);
         mm = p->mm;
-        if (!mm || mm->oom_adj == OOM_DISABLE) {
-                task_unlock(p);
+
+        /* WARNING: mm may not be dereferenced since we did not obtain its
+         * value from get_task_mm(p).  This is OK since all we need to do is
+         * compare mm to q->mm below.
+         *
+         * Furthermore, even if mm contains a non-NULL value, p->mm may
+         * change to NULL at any time since we do not hold task_lock(p).
+         * However, this is of no concern to us.
+         */
+
+        if (mm == NULL)
                 return 1;
-        }
-        task_unlock(p);
+
+        /*
+         * Don't kill the process if any threads are set to OOM_DISABLE
+         */
+        do_each_thread(g, q) {
+                if (q->mm == mm && q->oomkilladj == OOM_DISABLE)
+                        return 1;
+        } while_each_thread(g, q);
+
         __oom_kill_task(p, 1);
 
         /*
@@ -377,11 +393,10 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
         struct task_struct *c;
 
         if (printk_ratelimit()) {
-                task_lock(current);
                 printk(KERN_WARNING "%s invoked oom-killer: "
-                        "gfp_mask=0x%x, order=%d, oom_adj=%d\n",
-                        current->comm, gfp_mask, order,
-                        current->mm ? current->mm->oom_adj : OOM_DISABLE);
+                        "gfp_mask=0x%x, order=%d, oomkilladj=%d\n",
+                        current->comm, gfp_mask, order, current->oomkilladj);
+                task_lock(current);
                 cpuset_print_task_mems_allowed(current);
                 task_unlock(current);
                 dump_stack();
@@ -394,9 +409,8 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
         /*
          * If the task is already exiting, don't alarm the sysadmin or kill
          * its children or threads, just set TIF_MEMDIE so it can die quickly
-         * if its mm is still attached.
          */
-        if (p->mm && (p->flags & PF_EXITING)) {
+        if (p->flags & PF_EXITING) {
                 __oom_kill_task(p, 0);
                 return 0;
         }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d052abbe3063..5cc986eb9f6f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2544,7 +2544,6 @@ static void build_zonelists(pg_data_t *pgdat)
         prev_node = local_node;
         nodes_clear(used_mask);
 
-        memset(node_load, 0, sizeof(node_load));
         memset(node_order, 0, sizeof(node_order));
         j = 0;
 
@@ -2653,6 +2652,9 @@ static int __build_all_zonelists(void *dummy)
 {
         int nid;
 
+#ifdef CONFIG_NUMA
+        memset(node_load, 0, sizeof(node_load));
+#endif
         for_each_online_node(nid) {
                 pg_data_t *pgdat = NODE_DATA(nid);
 
diff --git a/mm/percpu.c b/mm/percpu.c
index b70f2acd8853..5fe37842e0ea 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -8,12 +8,12 @@
  *
  * This is percpu allocator which can handle both static and dynamic
  * areas.  Percpu areas are allocated in chunks in vmalloc area.  Each
- * chunk is consisted of num_possible_cpus() units and the first chunk
- * is used for static percpu variables in the kernel image (special
- * boot time alloc/init handling necessary as these areas need to be
- * brought up before allocation services are running).  Unit grows as
- * necessary and all units grow or shrink in unison.  When a chunk is
- * filled up, another chunk is allocated.  ie. in vmalloc area
+ * chunk is consisted of nr_cpu_ids units and the first chunk is used
+ * for static percpu variables in the kernel image (special boot time
+ * alloc/init handling necessary as these areas need to be brought up
+ * before allocation services are running).  Unit grows as necessary
+ * and all units grow or shrink in unison.  When a chunk is filled up,
+ * another chunk is allocated.  ie. in vmalloc area
  *
  *  c0                           c1                         c2
  *  -------------------          -------------------        ------------
@@ -558,7 +558,7 @@ static void pcpu_free_area(struct pcpu_chunk *chunk, int freeme)
 static void pcpu_unmap(struct pcpu_chunk *chunk, int page_start, int page_end,
                        bool flush_tlb)
 {
-        unsigned int last = num_possible_cpus() - 1;
+        unsigned int last = nr_cpu_ids - 1;
         unsigned int cpu;
 
         /* unmap must not be done on immutable chunk */
@@ -643,7 +643,7 @@ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, int off, int size,
  */
 static int pcpu_map(struct pcpu_chunk *chunk, int page_start, int page_end)
 {
-        unsigned int last = num_possible_cpus() - 1;
+        unsigned int last = nr_cpu_ids - 1;
         unsigned int cpu;
         int err;
 
@@ -749,7 +749,7 @@ static struct pcpu_chunk *alloc_pcpu_chunk(void)
         chunk->map[chunk->map_used++] = pcpu_unit_size;
         chunk->page = chunk->page_ar;
 
-        chunk->vm = get_vm_area(pcpu_chunk_size, GFP_KERNEL);
+        chunk->vm = get_vm_area(pcpu_chunk_size, VM_ALLOC);
         if (!chunk->vm) {
                 free_pcpu_chunk(chunk);
                 return NULL;
@@ -1067,9 +1067,9 @@ size_t __init pcpu_setup_first_chunk(pcpu_get_page_fn_t get_page_fn,
                                         PFN_UP(size_sum));
 
         pcpu_unit_size = pcpu_unit_pages << PAGE_SHIFT;
-        pcpu_chunk_size = num_possible_cpus() * pcpu_unit_size;
+        pcpu_chunk_size = nr_cpu_ids * pcpu_unit_size;
         pcpu_chunk_struct_size = sizeof(struct pcpu_chunk)
-                + num_possible_cpus() * pcpu_unit_pages * sizeof(struct page *);
+                + nr_cpu_ids * pcpu_unit_pages * sizeof(struct page *);
 
         if (dyn_size < 0)
                 dyn_size = pcpu_unit_size - static_size - reserved_size;
@@ -1248,7 +1248,7 @@ ssize_t __init pcpu_embed_first_chunk(size_t static_size, size_t reserved_size,
         } else
                 pcpue_unit_size = max_t(size_t, pcpue_size, PCPU_MIN_UNIT_SIZE);
 
-        chunk_size = pcpue_unit_size * num_possible_cpus();
+        chunk_size = pcpue_unit_size * nr_cpu_ids;
 
         pcpue_ptr = __alloc_bootmem_nopanic(chunk_size, PAGE_SIZE,
                                             __pa(MAX_DMA_ADDRESS));
@@ -1259,12 +1259,15 @@ ssize_t __init pcpu_embed_first_chunk(size_t static_size, size_t reserved_size,
         }
 
         /* return the leftover and copy */
-        for_each_possible_cpu(cpu) {
+        for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
                 void *ptr = pcpue_ptr + cpu * pcpue_unit_size;
 
-                free_bootmem(__pa(ptr + pcpue_size),
-                             pcpue_unit_size - pcpue_size);
-                memcpy(ptr, __per_cpu_load, static_size);
+                if (cpu_possible(cpu)) {
+                        free_bootmem(__pa(ptr + pcpue_size),
+                                     pcpue_unit_size - pcpue_size);
+                        memcpy(ptr, __per_cpu_load, static_size);
+                } else
+                        free_bootmem(__pa(ptr), pcpue_unit_size);
         }
 
         /* we're ready, commit */
diff --git a/mm/rmap.c b/mm/rmap.c
index 836c6c63e1f2..0895b5c7cbff 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -358,6 +358,7 @@ static int page_referenced_one(struct page *page,
          */
         if (vma->vm_flags & VM_LOCKED) {
                 *mapcount = 1;  /* break early from loop */
+                *vm_flags |= VM_LOCKED;
                 goto out_unmap;
         }
 
diff --git a/mm/vmscan.c b/mm/vmscan.c
index dea7abd31098..94e86dd6954c 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -630,9 +630,14 @@ static unsigned long shrink_page_list(struct list_head *page_list,
 
                 referenced = page_referenced(page, 1,
                                                 sc->mem_cgroup, &vm_flags);
-                /* In active use or really unfreeable?  Activate it. */
+                /*
+                 * In active use or really unfreeable?  Activate it.
+                 * If page which have PG_mlocked lost isoltation race,
+                 * try_to_unmap moves it to unevictable list
+                 */
                 if (sc->order <= PAGE_ALLOC_COSTLY_ORDER &&
-                                        referenced && page_mapping_inuse(page))
+                                        referenced && page_mapping_inuse(page)
+                                        && !(vm_flags & VM_LOCKED))
                         goto activate_locked;
 
                 /*
diff --git a/net/socket.c b/net/socket.c
index 791d71a36a93..6d4716559047 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -736,7 +736,7 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
         if (more)
                 flags |= MSG_MORE;
 
-        return sock->ops->sendpage(sock, page, offset, size, flags);
+        return kernel_sendpage(sock, page, offset, size, flags);
 }
 
 static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
diff --git a/security/Kconfig b/security/Kconfig
index d23c839038f0..4c865345caa0 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -113,6 +113,22 @@ config SECURITY_ROOTPLUG
 
           If you are unsure how to answer this question, answer N.
 
+config LSM_MMAP_MIN_ADDR
+        int "Low address space for LSM to protect from user allocation"
+        depends on SECURITY && SECURITY_SELINUX
+        default 65536
+        help
+          This is the portion of low virtual memory which should be protected
+          from userspace allocation.  Keeping a user from writing to low pages
+          can help reduce the impact of kernel NULL pointer bugs.
+
+          For most ia64, ppc64 and x86 users with lots of address space
+          a value of 65536 is reasonable and should cause no problems.
+          On arm and other archs it should not be higher than 32768.
+          Programs which use vm86 functionality or have some need to map
+          this low address space will need the permission specific to the
+          systems running LSM.
+
 source security/selinux/Kconfig
 source security/smack/Kconfig
 source security/tomoyo/Kconfig
diff --git a/security/Makefile b/security/Makefile
index c67557cdaa85..b56e7f9ecbc2 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -8,7 +8,7 @@ subdir-$(CONFIG_SECURITY_SMACK)		+= smack
 subdir-$(CONFIG_SECURITY_TOMOYO)        += tomoyo
 
 # always enable default capabilities
-obj-y           += commoncap.o
+obj-y           += commoncap.o min_addr.o
 
 # Object file lists
 obj-$(CONFIG_SECURITY)                  += security.o capability.o
diff --git a/security/capability.c b/security/capability.c
index 21b6cead6a8e..88f752e8152c 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -330,15 +330,6 @@ static int cap_file_ioctl(struct file *file, unsigned int command,
         return 0;
 }
 
-static int cap_file_mmap(struct file *file, unsigned long reqprot,
-                         unsigned long prot, unsigned long flags,
-                         unsigned long addr, unsigned long addr_only)
-{
-        if ((addr < mmap_min_addr) && !capable(CAP_SYS_RAWIO))
-                return -EACCES;
-        return 0;
-}
-
 static int cap_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
                              unsigned long prot)
 {
diff --git a/security/commoncap.c b/security/commoncap.c
index 48b7e0228fa3..e3097c0a1311 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -984,3 +984,33 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
                 cap_sys_admin = 1;
         return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
+
+/*
+ * cap_file_mmap - check if able to map given addr
+ * @file: unused
+ * @reqprot: unused
+ * @prot: unused
+ * @flags: unused
+ * @addr: address attempting to be mapped
+ * @addr_only: unused
+ *
+ * If the process is attempting to map memory below mmap_min_addr they need
+ * CAP_SYS_RAWIO.  The other parameters to this function are unused by the
+ * capability security module.  Returns 0 if this mapping should be allowed
+ * -EPERM if not.
+ */
+int cap_file_mmap(struct file *file, unsigned long reqprot,
+                  unsigned long prot, unsigned long flags,
+                  unsigned long addr, unsigned long addr_only)
+{
+        int ret = 0;
+
+        if (addr < dac_mmap_min_addr) {
+                ret = cap_capable(current, current_cred(), CAP_SYS_RAWIO,
+                                  SECURITY_CAP_AUDIT);
+                /* set PF_SUPERPRIV if it turns out we allow the low mmap */
+                if (ret == 0)
+                        current->flags |= PF_SUPERPRIV;
+        }
+        return ret;
+}
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index 63003a63aaee..46642a19bc78 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -45,9 +45,9 @@ int ima_calc_hash(struct file *file, char *digest)
 {
         struct hash_desc desc;
         struct scatterlist sg[1];
-        loff_t i_size;
+        loff_t i_size, offset = 0;
         char *rbuf;
-        int rc, offset = 0;
+        int rc;
 
         rc = init_desc(&desc);
         if (rc != 0)
@@ -67,6 +67,8 @@ int ima_calc_hash(struct file *file, char *digest)
                         rc = rbuf_len;
                         break;
                 }
+                if (rbuf_len == 0)
+                        break;
                 offset += rbuf_len;
                 sg_init_one(sg, rbuf, rbuf_len);
 
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 101c512564ec..4732f5e5d127 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -262,6 +262,8 @@ void ima_counts_put(struct path *path, int mask)
         else if (mask & (MAY_READ | MAY_EXEC))
                 iint->readcount--;
         mutex_unlock(&iint->mutex);
+
+        kref_put(&iint->refcount, iint_free);
 }
 
 /*
@@ -291,6 +293,8 @@ void ima_counts_get(struct file *file)
         if (file->f_mode & FMODE_WRITE)
                 iint->writecount++;
         mutex_unlock(&iint->mutex);
+
+        kref_put(&iint->refcount, iint_free);
 }
 EXPORT_SYMBOL_GPL(ima_counts_get);
 
diff --git a/security/min_addr.c b/security/min_addr.c
new file mode 100644
index 000000000000..14cc7b3b8d03
--- /dev/null
+++ b/security/min_addr.c
@@ -0,0 +1,49 @@
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/security.h>
+#include <linux/sysctl.h>
+
+/* amount of vm to protect from userspace access by both DAC and the LSM*/
+unsigned long mmap_min_addr;
+/* amount of vm to protect from userspace using CAP_SYS_RAWIO (DAC) */
+unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
+/* amount of vm to protect from userspace using the LSM = CONFIG_LSM_MMAP_MIN_ADDR */
+
+/*
+ * Update mmap_min_addr = max(dac_mmap_min_addr, CONFIG_LSM_MMAP_MIN_ADDR)
+ */
+static void update_mmap_min_addr(void)
+{
+#ifdef CONFIG_LSM_MMAP_MIN_ADDR
+        if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
+                mmap_min_addr = dac_mmap_min_addr;
+        else
+                mmap_min_addr = CONFIG_LSM_MMAP_MIN_ADDR;
+#else
+        mmap_min_addr = dac_mmap_min_addr;
+#endif
+}
+
+/*
+ * sysctl handler which just sets dac_mmap_min_addr = the new value and then
+ * calls update_mmap_min_addr() so non MAP_FIXED hints get rounded properly
+ */
+int mmap_min_addr_handler(struct ctl_table *table, int write, struct file *filp,
+                          void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        int ret;
+
+        ret = proc_doulongvec_minmax(table, write, filp, buffer, lenp, ppos);
+
+        update_mmap_min_addr();
+
+        return ret;
+}
+
+int __init init_mmap_min_addr(void)
+{
+        update_mmap_min_addr();
+
+        return 0;
+}
+pure_initcall(init_mmap_min_addr);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 15c2a08a66f1..8d8b69c5664e 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1285,6 +1285,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
                                            context, len);
                 if (rc == -ERANGE) {
+                        kfree(context);
+
                         /* Need a larger buffer.  Query for the right size. */
                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
                                                    NULL, 0);
@@ -1292,7 +1294,6 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
                                 dput(dentry);
                                 goto out_unlock;
                         }
-                        kfree(context);
                         len = rc;
                         context = kmalloc(len+1, GFP_NOFS);
                         if (!context) {
@@ -3029,9 +3030,21 @@ static int selinux_file_mmap(struct file *file, unsigned long reqprot,
         int rc = 0;
         u32 sid = current_sid();
 
-        if (addr < mmap_min_addr)
+        /*
+         * notice that we are intentionally putting the SELinux check before
+         * the secondary cap_file_mmap check.  This is such a likely attempt
+         * at bad behaviour/exploit that we always want to get the AVC, even
+         * if DAC would have also denied the operation.
+         */
+        if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
                                   MEMPROTECT__MMAP_ZERO, NULL);
+                if (rc)
+                        return rc;
+        }
+
+        /* do DAC check on address space usage */
+        rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
         if (rc || addr_only)
                 return rc;
 
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 72cfd47af6b8..9db60d831bb2 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -943,47 +943,24 @@ static int snd_interval_ratden(struct snd_interval *i,
 int snd_interval_list(struct snd_interval *i, unsigned int count, unsigned int *list, unsigned int mask)
 {
         unsigned int k;
-        int changed = 0;
+        struct snd_interval list_range;
 
         if (!count) {
                 i->empty = 1;
                 return -EINVAL;
         }
+        snd_interval_any(&list_range);
+        list_range.min = UINT_MAX;
+        list_range.max = 0;
         for (k = 0; k < count; k++) {
                 if (mask && !(mask & (1 << k)))
                         continue;
-                if (i->min == list[k] && !i->openmin)
-                        goto _l1;
-                if (i->min < list[k]) {
-                        i->min = list[k];
-                        i->openmin = 0;
-                        changed = 1;
-                        goto _l1;
-                }
-        }
-        i->empty = 1;
-        return -EINVAL;
- _l1:
-        for (k = count; k-- > 0;) {
-                if (mask && !(mask & (1 << k)))
+                if (!snd_interval_test(i, list[k]))
                         continue;
-                if (i->max == list[k] && !i->openmax)
-                        goto _l2;
-                if (i->max > list[k]) {
-                        i->max = list[k];
-                        i->openmax = 0;
-                        changed = 1;
-                        goto _l2;
-                }
+                list_range.min = min(list_range.min, list[k]);
+                list_range.max = max(list_range.max, list[k]);
         }
-        i->empty = 1;
-        return -EINVAL;
- _l2:
-        if (snd_interval_checkempty(i)) {
-                i->empty = 1;
-                return -EINVAL;
-        }
-        return changed;
+        return snd_interval_refine(i, &list_range);
 }
 
 EXPORT_SYMBOL(snd_interval_list);
diff --git a/sound/pci/ali5451/ali5451.c b/sound/pci/ali5451/ali5451.c
index c551006e2920..76d76c08339b 100644
--- a/sound/pci/ali5451/ali5451.c
+++ b/sound/pci/ali5451/ali5451.c
@@ -310,12 +310,16 @@ static int snd_ali_codec_ready(struct snd_ali *codec,
         unsigned int res;
         
         end_time = jiffies + msecs_to_jiffies(250);
-        do {
+
+        for (;;) {
                 res = snd_ali_5451_peek(codec,port);
                 if (!(res & 0x8000))
                         return 0;
+                if (!time_after_eq(end_time, jiffies))
+                        break;
                 schedule_timeout_uninterruptible(1);
-        } while (time_after_eq(end_time, jiffies));
+        }
+
         snd_ali_5451_poke(codec, port, res & ~0x8000);
         snd_printdd("ali_codec_ready: codec is not ready.\n ");
         return -EIO;
@@ -327,15 +331,17 @@ static int snd_ali_stimer_ready(struct snd_ali *codec)
         unsigned long dwChk1,dwChk2;
         
         dwChk1 = snd_ali_5451_peek(codec, ALI_STIMER);
-        dwChk2 = snd_ali_5451_peek(codec, ALI_STIMER);
-
         end_time = jiffies + msecs_to_jiffies(250);
-        do {
+
+        for (;;) {
                 dwChk2 = snd_ali_5451_peek(codec, ALI_STIMER);
                 if (dwChk2 != dwChk1)
                         return 0;
+                if (!time_after_eq(end_time, jiffies))
+                        break;
                 schedule_timeout_uninterruptible(1);
-        } while (time_after_eq(end_time, jiffies));
+        }
+
         snd_printk(KERN_ERR "ali_stimer_read: stimer is not ready.\n");
         return -EIO;
 }
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index 3da85caf8af1..403588c6e3f6 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -3835,9 +3835,11 @@ static struct hda_verb ad1884a_laptop_verbs[] = {
         /* Port-F (int speaker) mixer - route only from analog mixer */
         {0x0b, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
         {0x0b, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(1)},
-        /* Port-F pin */
-        {0x16, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
+        /* Port-F (int speaker) pin */
+        {0x16, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
         {0x16, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE},
+        /* required for compaq 6530s/6531s speaker output */
+        {0x1c, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
         /* Port-C pin - internal mic-in */
         {0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF80},
         {0x14, AC_VERB_SET_AMP_GAIN_MUTE, 0x7002}, /* raise mic as default */
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 51c44fdbc0f0..6f683e451f2b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -12521,8 +12521,6 @@ static struct snd_pci_quirk alc268_cfg_tbl[] = {
                            ALC268_TOSHIBA),
         SND_PCI_QUIRK(0x1043, 0x1205, "ASUS W7J", ALC268_3ST),
         SND_PCI_QUIRK(0x1170, 0x0040, "ZEPTO", ALC268_ZEPTO),
-        SND_PCI_QUIRK_MASK(0x1179, 0xff00, 0xff00, "TOSHIBA A/Lx05",
-                           ALC268_TOSHIBA),
         SND_PCI_QUIRK(0x14c0, 0x0025, "COMPAL IFL90/JFL-92", ALC268_TOSHIBA),
         SND_PCI_QUIRK(0x152d, 0x0763, "Diverse (CPR2000)", ALC268_ACER),
         SND_PCI_QUIRK(0x152d, 0x0771, "Quanta IL1", ALC267_QUANTA_IL1),
@@ -12530,6 +12528,15 @@ static struct snd_pci_quirk alc268_cfg_tbl[] = {
         {}
 };
 
+/* Toshiba laptops have no unique PCI SSID but only codec SSID */
+static struct snd_pci_quirk alc268_ssid_cfg_tbl[] = {
+        SND_PCI_QUIRK(0x1179, 0xff0a, "TOSHIBA X-200", ALC268_AUTO),
+        SND_PCI_QUIRK(0x1179, 0xff0e, "TOSHIBA X-200 HDMI", ALC268_AUTO),
+        SND_PCI_QUIRK_MASK(0x1179, 0xff00, 0xff00, "TOSHIBA A/Lx05",
+                           ALC268_TOSHIBA),
+        {}
+};
+
 static struct alc_config_preset alc268_presets[] = {
         [ALC267_QUANTA_IL1] = {
                 .mixers = { alc267_quanta_il1_mixer, alc268_beep_mixer },
@@ -12696,6 +12703,10 @@ static int patch_alc268(struct hda_codec *codec)
                                                   alc268_models,
                                                   alc268_cfg_tbl);
 
+        if (board_config < 0 || board_config >= ALC268_MODEL_LAST)
+                board_config = snd_hda_check_board_codec_sid_config(codec,
+                        ALC882_MODEL_LAST, alc268_models, alc268_ssid_cfg_tbl);
+
         if (board_config < 0 || board_config >= ALC268_MODEL_LAST) {
                 printk(KERN_INFO "hda_codec: Unknown model for %s, "
                        "trying auto-probe from BIOS...\n", codec->chip_name);
@@ -13563,6 +13574,8 @@ static int patch_alc269(struct hda_codec *codec)
                 set_capture_mixer(spec);
         set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT);
 
+        spec->vmaster_nid = 0x02;
+
         codec->patch_ops = alc_patch_ops;
         if (board_config == ALC269_AUTO)
                 spec->init_hook = alc269_auto_init;
@@ -15577,9 +15590,12 @@ static int patch_alc861vd(struct hda_codec *codec)
         spec->stream_digital_playback = &alc861vd_pcm_digital_playback;
         spec->stream_digital_capture = &alc861vd_pcm_digital_capture;
 
-        spec->adc_nids = alc861vd_adc_nids;
-        spec->num_adc_nids = ARRAY_SIZE(alc861vd_adc_nids);
-        spec->capsrc_nids = alc861vd_capsrc_nids;
+        if (!spec->adc_nids) {
+                spec->adc_nids = alc861vd_adc_nids;
+                spec->num_adc_nids = ARRAY_SIZE(alc861vd_adc_nids);
+        }
+        if (!spec->capsrc_nids)
+                spec->capsrc_nids = alc861vd_capsrc_nids;
 
         set_capture_mixer(spec);
         set_beep_amp(spec, 0x0b, 0x05, HDA_INPUT);
@@ -17496,9 +17512,12 @@ static int patch_alc662(struct hda_codec *codec)
         spec->stream_digital_playback = &alc662_pcm_digital_playback;
         spec->stream_digital_capture = &alc662_pcm_digital_capture;
 
-        spec->adc_nids = alc662_adc_nids;
-        spec->num_adc_nids = ARRAY_SIZE(alc662_adc_nids);
-        spec->capsrc_nids = alc662_capsrc_nids;
+        if (!spec->adc_nids) {
+                spec->adc_nids = alc662_adc_nids;
+                spec->num_adc_nids = ARRAY_SIZE(alc662_adc_nids);
+        }
+        if (!spec->capsrc_nids)
+                spec->capsrc_nids = alc662_capsrc_nids;
 
         if (!spec->cap_mixer)
                 set_capture_mixer(spec);
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 456ef6ac12e4..6990cfcb6a38 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -76,6 +76,7 @@ enum {
         STAC_92HD73XX_AUTO,
         STAC_92HD73XX_NO_JD, /* no jack-detection */
         STAC_92HD73XX_REF,
+        STAC_92HD73XX_INTEL,
         STAC_DELL_M6_AMIC,
         STAC_DELL_M6_DMIC,
         STAC_DELL_M6_BOTH,
@@ -1777,6 +1778,7 @@ static const char *stac92hd73xx_models[STAC_92HD73XX_MODELS] = {
         [STAC_92HD73XX_AUTO] = "auto",
         [STAC_92HD73XX_NO_JD] = "no-jd",
         [STAC_92HD73XX_REF] = "ref",
+        [STAC_92HD73XX_INTEL] = "intel",
         [STAC_DELL_M6_AMIC] = "dell-m6-amic",
         [STAC_DELL_M6_DMIC] = "dell-m6-dmic",
         [STAC_DELL_M6_BOTH] = "dell-m6",
@@ -1789,6 +1791,10 @@ static struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = {
                                 "DFI LanParty", STAC_92HD73XX_REF),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DFI, 0x3101,
                                 "DFI LanParty", STAC_92HD73XX_REF),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x5002,
+                                "Intel DG45ID", STAC_92HD73XX_INTEL),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x5003,
+                                "Intel DG45FC", STAC_92HD73XX_INTEL),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0254,
                                 "Dell Studio 1535", STAC_DELL_M6_DMIC),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0255,
diff --git a/sound/pci/vx222/vx222_ops.c b/sound/pci/vx222/vx222_ops.c
index 6416d3f0c7be..a69e774d0b13 100644
--- a/sound/pci/vx222/vx222_ops.c
+++ b/sound/pci/vx222/vx222_ops.c
@@ -885,10 +885,10 @@ static int vx_input_level_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem
         struct vx_core *_chip = snd_kcontrol_chip(kcontrol);
         struct snd_vx222 *chip = (struct snd_vx222 *)_chip;
         if (ucontrol->value.integer.value[0] < 0 ||
-            ucontrol->value.integer.value[0] < MIC_LEVEL_MAX)
+            ucontrol->value.integer.value[0] > MIC_LEVEL_MAX)
                 return -EINVAL;
         if (ucontrol->value.integer.value[1] < 0 ||
-            ucontrol->value.integer.value[1] < MIC_LEVEL_MAX)
+            ucontrol->value.integer.value[1] > MIC_LEVEL_MAX)
                 return -EINVAL;
         mutex_lock(&_chip->mixer_mutex);
         if (chip->input_level[0] != ucontrol->value.integer.value[0] ||
diff --git a/sound/soc/fsl/efika-audio-fabric.c b/sound/soc/fsl/efika-audio-fabric.c
index 85b0e7569504..3326e2a1e863 100644
--- a/sound/soc/fsl/efika-audio-fabric.c
+++ b/sound/soc/fsl/efika-audio-fabric.c
@@ -30,6 +30,8 @@
 #include "mpc5200_psc_ac97.h"
 #include "../codecs/stac9766.h"
 
+#define DRV_NAME "efika-audio-fabric"
+
 static struct snd_soc_device device;
 static struct snd_soc_card card;
 
diff --git a/sound/soc/fsl/pcm030-audio-fabric.c b/sound/soc/fsl/pcm030-audio-fabric.c
index 8766f7a3893d..b928ef7d28eb 100644
--- a/sound/soc/fsl/pcm030-audio-fabric.c
+++ b/sound/soc/fsl/pcm030-audio-fabric.c
@@ -30,6 +30,8 @@
 #include "mpc5200_psc_ac97.h"
 #include "../codecs/wm9712.h"
 
+#define DRV_NAME "pcm030-audio-fabric"
+
 static struct snd_soc_device device;
 static struct snd_soc_card card;
 
diff --git a/tools/perf/Documentation/Makefile b/tools/perf/Documentation/Makefile
index 5457192e1b41..bdd3b7ecad0a 100644
--- a/tools/perf/Documentation/Makefile
+++ b/tools/perf/Documentation/Makefile
@@ -35,7 +35,7 @@ man7dir=$(mandir)/man7
 # DESTDIR=
 
 ASCIIDOC=asciidoc
-ASCIIDOC_EXTRA =
+ASCIIDOC_EXTRA = --unsafe
 MANPAGE_XSL = manpage-normal.xsl
 XMLTO_EXTRA =
 INSTALL?=install
diff --git a/tools/perf/Documentation/examples.txt b/tools/perf/Documentation/examples.txt
new file mode 100644
index 000000000000..8eb6c489fb15
--- /dev/null
+++ b/tools/perf/Documentation/examples.txt
@@ -0,0 +1,225 @@
+
+                ------------------------------
+                ****** perf by examples ******
+                ------------------------------
+
+[ From an e-mail by Ingo Molnar, http://lkml.org/lkml/2009/8/4/346 ]
+
+
+First, discovery/enumeration of available counters can be done via
+'perf list':
+
+titan:~> perf list
+  [...]
+  kmem:kmalloc                             [Tracepoint event]
+  kmem:kmem_cache_alloc                    [Tracepoint event]
+  kmem:kmalloc_node                        [Tracepoint event]
+  kmem:kmem_cache_alloc_node               [Tracepoint event]
+  kmem:kfree                               [Tracepoint event]
+  kmem:kmem_cache_free                     [Tracepoint event]
+  kmem:mm_page_free_direct                 [Tracepoint event]
+  kmem:mm_pagevec_free                     [Tracepoint event]
+  kmem:mm_page_alloc                       [Tracepoint event]
+  kmem:mm_page_alloc_zone_locked           [Tracepoint event]
+  kmem:mm_page_pcpu_drain                  [Tracepoint event]
+  kmem:mm_page_alloc_extfrag               [Tracepoint event]
+
+Then any (or all) of the above event sources can be activated and
+measured. For example the page alloc/free properties of a 'hackbench
+run' are:
+
+ titan:~> perf stat -e kmem:mm_page_pcpu_drain -e kmem:mm_page_alloc
+ -e kmem:mm_pagevec_free -e kmem:mm_page_free_direct ./hackbench 10
+ Time: 0.575
+
+ Performance counter stats for './hackbench 10':
+
+          13857  kmem:mm_page_pcpu_drain
+          27576  kmem:mm_page_alloc
+           6025  kmem:mm_pagevec_free
+          20934  kmem:mm_page_free_direct
+
+    0.613972165  seconds time elapsed
+
+You can observe the statistical properties as well, by using the
+'repeat the workload N times' feature of perf stat:
+
+ titan:~> perf stat --repeat 5 -e kmem:mm_page_pcpu_drain -e
+   kmem:mm_page_alloc -e kmem:mm_pagevec_free -e
+   kmem:mm_page_free_direct ./hackbench 10
+ Time: 0.627
+ Time: 0.644
+ Time: 0.564
+ Time: 0.559
+ Time: 0.626
+
+ Performance counter stats for './hackbench 10' (5 runs):
+
+          12920  kmem:mm_page_pcpu_drain    ( +-   3.359% )
+          25035  kmem:mm_page_alloc         ( +-   3.783% )
+           6104  kmem:mm_pagevec_free       ( +-   0.934% )
+          18376  kmem:mm_page_free_direct   ( +-   4.941% )
+
+    0.643954516  seconds time elapsed   ( +-   2.363% )
+
+Furthermore, these tracepoints can be used to sample the workload as
+well. For example the page allocations done by a 'git gc' can be
+captured the following way:
+
+ titan:~/git> perf record -f -e kmem:mm_page_alloc -c 1 ./git gc
+ Counting objects: 1148, done.
+ Delta compression using up to 2 threads.
+ Compressing objects: 100% (450/450), done.
+ Writing objects: 100% (1148/1148), done.
+ Total 1148 (delta 690), reused 1148 (delta 690)
+ [ perf record: Captured and wrote 0.267 MB perf.data (~11679 samples) ]
+
+To check which functions generated page allocations:
+
+ titan:~/git> perf report
+ # Samples: 10646
+ #
+ # Overhead          Command               Shared Object
+ # ........  ...............  ..........................
+ #
+    23.57%       git-repack  /lib64/libc-2.5.so
+    21.81%              git  /lib64/libc-2.5.so
+    14.59%              git  ./git
+    11.79%       git-repack  ./git
+     7.12%              git  /lib64/ld-2.5.so
+     3.16%       git-repack  /lib64/libpthread-2.5.so
+     2.09%       git-repack  /bin/bash
+     1.97%               rm  /lib64/libc-2.5.so
+     1.39%               mv  /lib64/ld-2.5.so
+     1.37%               mv  /lib64/libc-2.5.so
+     1.12%       git-repack  /lib64/ld-2.5.so
+     0.95%               rm  /lib64/ld-2.5.so
+     0.90%  git-update-serv  /lib64/libc-2.5.so
+     0.73%  git-update-serv  /lib64/ld-2.5.so
+     0.68%             perf  /lib64/libpthread-2.5.so
+     0.64%       git-repack  /usr/lib64/libz.so.1.2.3
+
+Or to see it on a more finegrained level:
+
+titan:~/git> perf report --sort comm,dso,symbol
+# Samples: 10646
+#
+# Overhead          Command               Shared Object  Symbol
+# ........  ...............  ..........................  ......
+#
+     9.35%       git-repack  ./git                       [.] insert_obj_hash
+     9.12%              git  ./git                       [.] insert_obj_hash
+     7.31%              git  /lib64/libc-2.5.so          [.] memcpy
+     6.34%       git-repack  /lib64/libc-2.5.so          [.] _int_malloc
+     6.24%       git-repack  /lib64/libc-2.5.so          [.] memcpy
+     5.82%       git-repack  /lib64/libc-2.5.so          [.] __GI___fork
+     5.47%              git  /lib64/libc-2.5.so          [.] _int_malloc
+     2.99%              git  /lib64/libc-2.5.so          [.] memset
+
+Furthermore, call-graph sampling can be done too, of page
+allocations - to see precisely what kind of page allocations there
+are:
+
+ titan:~/git> perf record -f -g -e kmem:mm_page_alloc -c 1 ./git gc
+ Counting objects: 1148, done.
+ Delta compression using up to 2 threads.
+ Compressing objects: 100% (450/450), done.
+ Writing objects: 100% (1148/1148), done.
+ Total 1148 (delta 690), reused 1148 (delta 690)
+ [ perf record: Captured and wrote 0.963 MB perf.data (~42069 samples) ]
+
+ titan:~/git> perf report -g
+ # Samples: 10686
+ #
+ # Overhead          Command               Shared Object
+ # ........  ...............  ..........................
+ #
+    23.25%       git-repack  /lib64/libc-2.5.so
+                |
+                |--50.00%-- _int_free
+                |
+                |--37.50%-- __GI___fork
+                |          make_child
+                |
+                |--12.50%-- ptmalloc_unlock_all2
+                |          make_child
+                |
+                 --6.25%-- __GI_strcpy
+    21.61%              git  /lib64/libc-2.5.so
+                |
+                |--30.00%-- __GI_read
+                |          |
+                |           --83.33%-- git_config_from_file
+                |                     git_config
+                |                     |
+   [...]
+
+Or you can observe the whole system's page allocations for 10
+seconds:
+
+titan:~/git> perf stat -a -e kmem:mm_page_pcpu_drain -e
+kmem:mm_page_alloc -e kmem:mm_pagevec_free -e
+kmem:mm_page_free_direct sleep 10
+
+ Performance counter stats for 'sleep 10':
+
+         171585  kmem:mm_page_pcpu_drain
+         322114  kmem:mm_page_alloc
+          73623  kmem:mm_pagevec_free
+         254115  kmem:mm_page_free_direct
+
+   10.000591410  seconds time elapsed
+
+Or observe how fluctuating the page allocations are, via statistical
+analysis done over ten 1-second intervals:
+
+ titan:~/git> perf stat --repeat 10 -a -e kmem:mm_page_pcpu_drain -e
+   kmem:mm_page_alloc -e kmem:mm_pagevec_free -e
+   kmem:mm_page_free_direct sleep 1
+
+ Performance counter stats for 'sleep 1' (10 runs):
+
+          17254  kmem:mm_page_pcpu_drain    ( +-   3.709% )
+          34394  kmem:mm_page_alloc         ( +-   4.617% )
+           7509  kmem:mm_pagevec_free       ( +-   4.820% )
+          25653  kmem:mm_page_free_direct   ( +-   3.672% )
+
+    1.058135029  seconds time elapsed   ( +-   3.089% )
+
+Or you can annotate the recorded 'git gc' run on a per symbol basis
+and check which instructions/source-code generated page allocations:
+
+ titan:~/git> perf annotate __GI___fork
+ ------------------------------------------------
+  Percent |      Source code & Disassembly of libc-2.5.so
+ ------------------------------------------------
+          :
+          :
+          :      Disassembly of section .plt:
+          :      Disassembly of section .text:
+          :
+          :      00000031a2e95560 <__fork>:
+ [...]
+     0.00 :        31a2e95602:   b8 38 00 00 00          mov    $0x38,%eax
+     0.00 :        31a2e95607:   0f 05                   syscall
+    83.42 :        31a2e95609:   48 3d 00 f0 ff ff       cmp    $0xfffffffffffff000,%rax
+     0.00 :        31a2e9560f:   0f 87 4d 01 00 00       ja     31a2e95762 <__fork+0x202>
+     0.00 :        31a2e95615:   85 c0                   test   %eax,%eax
+
+( this shows that 83.42% of __GI___fork's page allocations come from
+  the 0x38 system call it performs. )
+
+etc. etc. - a lot more is possible. I could list a dozen of
+other different usecases straight away - neither of which is
+possible via /proc/vmstat.
+
+/proc/vmstat is not in the same league really, in terms of
+expressive power of system analysis and performance
+analysis.
+
+All that the above results needed were those new tracepoints
+in include/tracing/events/kmem.h.
+
+        Ingo
+
+
diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
index 0d74346d21ab..484080dd5b6f 100644
--- a/tools/perf/Documentation/perf-stat.txt
+++ b/tools/perf/Documentation/perf-stat.txt
@@ -40,7 +40,7 @@ OPTIONS
 -a::
         system-wide collection
 
--S::
+-c::
         scale counter values
 
 EXAMPLES
diff --git a/tools/perf/Documentation/perf-top.txt b/tools/perf/Documentation/perf-top.txt
index 539d01289725..4a7d558dc309 100644
--- a/tools/perf/Documentation/perf-top.txt
+++ b/tools/perf/Documentation/perf-top.txt
@@ -3,36 +3,122 @@ perf-top(1)
 
 NAME
 ----
-perf-top - Run a command and profile it
+perf-top - System profiling tool.
 
 SYNOPSIS
 --------
 [verse]
-'perf top' [-e <EVENT> | --event=EVENT] [-l] [-a] <command>
+'perf top' [-e <EVENT> | --event=EVENT] [<options>]
 
 DESCRIPTION
 -----------
-This command runs a command and gathers a performance counter profile
-from it.
+This command generates and displays a performance counter profile in realtime.
 
 
 OPTIONS
 -------
-<command>...::
-        Any command you can specify in a shell.
+-a::
+--all-cpus::
+        System-wide collection.  (default)
+
+-c <count>::
+--count=<count>::
+        Event period to sample.
+
+-C <cpu>::
+--CPU=<cpu>::
+        CPU to profile.
+
+-d <seconds>::
+--delay=<seconds>::
+        Number of seconds to delay between refreshes.
 
--e::
---event=::
+-e <event>::
+--event=<event>::
         Select the PMU event. Selection can be a symbolic event name
         (use 'perf list' to list all events) or a raw PMU
         event (eventsel+umask) in the form of rNNN where NNN is a
-         hexadecimal event descriptor.
+        hexadecimal event descriptor.
 
--a::
-        system-wide collection
+-E <entries>::
+--entries=<entries>::
+        Display this many functions.
+
+-f <count>::
+--count-filter=<count>::
+        Only display functions with more events than this.
+
+-F <freq>::
+--freq=<freq>::
+        Profile at this frequency.
+
+-i::
+--inherit::
+        Child tasks inherit counters, only makes sens with -p option.
+
+-k <path>::
+--vmlinux=<path>::
+        Path to vmlinux.  Required for annotation functionality.
+
+-m <pages>::
+--mmap-pages=<pages>::
+        Number of mmapped data pages.
+
+-p <pid>::
+--pid=<pid>::
+        Profile events on existing pid.
+
+-r <priority>::
+--realtime=<priority>::
+        Collect data with this RT SCHED_FIFO priority.
+
+-s <symbol>::
+--sym-annotate=<symbol>::
+        Annotate this symbol.  Requires -k option.
+
+-v::
+--verbose::
+        Be more verbose (show counter open errors, etc).
+
+-z::
+--zero::
+        Zero history across display updates.
+
+INTERACTIVE PROMPTING KEYS
+--------------------------
+
+[d]::
+        Display refresh delay.
+
+[e]::
+        Number of entries to display.
+
+[E]::
+        Event to display when multiple counters are active.
+
+[f]::
+        Profile display filter (>= hit count).
+
+[F]::
+        Annotation display filter (>= % of total).
+
+[s]::
+        Annotate symbol.
+
+[S]::
+        Stop annotation, return to full profile display.
+
+[w]::
+        Toggle between weighted sum and individual count[E]r profile.
+
+[z]::
+        Toggle event count zeroing across display updates.
+
+[qQ]::
+        Quit.
+
+Pressing any unmapped key displays a menu, and prompts for input.
 
--l::
-        scale counter values
 
 SEE ALSO
 --------
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 1916e44b9bb0..c045b4271e57 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -382,18 +382,29 @@ endif
 ifdef NO_DEMANGLE
         BASIC_CFLAGS += -DNO_DEMANGLE
 else
-
         has_bfd := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd > /dev/null 2>&1 && echo y")
 
-        has_bfd_iberty := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd -liberty > /dev/null 2>&1 && echo y")
-
         ifeq ($(has_bfd),y)
                 EXTLIBS += -lbfd
-        else ifeq ($(has_bfd_iberty),y)
-                EXTLIBS += -lbfd -liberty
         else
-                msg := $(warning No bfd.h/libbfd found, install binutils-dev[el] to gain symbol demangling)
-                BASIC_CFLAGS += -DNO_DEMANGLE
+                has_bfd_iberty := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd -liberty > /dev/null 2>&1 && echo y")
+                ifeq ($(has_bfd_iberty),y)
+                        EXTLIBS += -lbfd -liberty
+                else
+                        has_bfd_iberty_z := $(shell sh -c "(echo '\#include <bfd.h>'; echo 'int main(void) { bfd_demangle(0, 0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -lbfd -liberty -lz > /dev/null 2>&1 && echo y")
+                        ifeq ($(has_bfd_iberty_z),y)
+                                EXTLIBS += -lbfd -liberty -lz
+                        else
+                                has_cplus_demangle := $(shell sh -c "(echo 'extern char *cplus_demangle(const char *, int);'; echo 'int main(void) { cplus_demangle(0, 0); return 0; }') | $(CC) -x c - $(ALL_CFLAGS) -o /dev/null $(ALL_LDFLAGS) -liberty > /dev/null 2>&1 && echo y")
+                                ifeq ($(has_cplus_demangle),y)
+                                        EXTLIBS += -liberty
+                                        BASIC_CFLAGS += -DHAVE_CPLUS_DEMANGLE
+                                else
+                                        msg := $(warning No bfd.h/libbfd found, install binutils-dev[el] to gain symbol demangling)
+                                        BASIC_CFLAGS += -DNO_DEMANGLE
+                                endif
+                        endif
+                endif
         endif
 endif
 
diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index 1dba568e1941..5e17de984dc8 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -31,6 +31,7 @@ static char		*vmlinux = "vmlinux";
 static char             default_sort_order[] = "comm,symbol";
 static char             *sort_order = default_sort_order;
 
+static int              force;
 static int              input;
 static int              show_mask = SHOW_KERNEL | SHOW_USER | SHOW_HV;
 
@@ -980,6 +981,13 @@ process_fork_event(event_t *event, unsigned long offset, unsigned long head)
                 (void *)(long)(event->header.size),
                 event->fork.pid, event->fork.ppid);
 
+        /*
+         * A thread clone will have the same PID for both
+         * parent and child.
+         */
+        if (thread == parent)
+                return 0;
+
         if (!thread || !parent || thread__fork(thread, parent)) {
                 dprintf("problem processing PERF_EVENT_FORK, skipping event.\n");
                 return -1;
@@ -1327,6 +1335,11 @@ static int __cmd_annotate(void)
                 exit(-1);
         }
 
+        if (!force && (stat.st_uid != geteuid())) {
+                fprintf(stderr, "file: %s not owned by current user\n", input_name);
+                exit(-1);
+        }
+
         if (!stat.st_size) {
                 fprintf(stderr, "zero-sized file, nothing to do!\n");
                 exit(0);
@@ -1432,6 +1445,7 @@ static const struct option options[] = {
                     "input file name"),
         OPT_STRING('s', "symbol", &sym_hist_filter, "symbol",
                     "symbol to annotate"),
+        OPT_BOOLEAN('f', "force", &force, "don't complain, do it"),
         OPT_BOOLEAN('v', "verbose", &verbose,
                     "be more verbose (show symbol address, etc)"),
         OPT_BOOLEAN('D', "dump-raw-trace", &dump_trace,
diff --git a/tools/perf/builtin-list.c b/tools/perf/builtin-list.c
index f990fa8a35c9..d88c6961274c 100644
--- a/tools/perf/builtin-list.c
+++ b/tools/perf/builtin-list.c
@@ -10,11 +10,12 @@
 
 #include "perf.h"
 
-#include "util/parse-options.h"
 #include "util/parse-events.h"
+#include "util/cache.h"
 
 int cmd_list(int argc __used, const char **argv __used, const char *prefix __used)
 {
+        setup_pager();
         print_events();
         return 0;
 }
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 90c98082af10..89a5ddcd1ded 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -34,7 +34,9 @@ static int			output;
 static const char               *output_name                    = "perf.data";
 static int                      group                           = 0;
 static unsigned int             realtime_prio                   = 0;
+static int                      raw_samples                     = 0;
 static int                      system_wide                     = 0;
+static int                      profile_cpu                     = -1;
 static pid_t                    target_pid                      = -1;
 static int                      inherit                         = 1;
 static int                      force                           = 0;
@@ -203,46 +205,48 @@ static void sig_atexit(void)
         kill(getpid(), signr);
 }
 
-static void pid_synthesize_comm_event(pid_t pid, int full)
+static pid_t pid_synthesize_comm_event(pid_t pid, int full)
 {
         struct comm_event comm_ev;
         char filename[PATH_MAX];
         char bf[BUFSIZ];
-        int fd;
-        size_t size;
-        char *field, *sep;
+        FILE *fp;
+        size_t size = 0;
         DIR *tasks;
         struct dirent dirent, *next;
+        pid_t tgid = 0;
 
-        snprintf(filename, sizeof(filename), "/proc/%d/stat", pid);
+        snprintf(filename, sizeof(filename), "/proc/%d/status", pid);
 
-        fd = open(filename, O_RDONLY);
-        if (fd < 0) {
+        fp = fopen(filename, "r");
+        if (fp == NULL) {
                 /*
                  * We raced with a task exiting - just return:
                  */
                 if (verbose)
                         fprintf(stderr, "couldn't open %s\n", filename);
-                return;
-        }
-        if (read(fd, bf, sizeof(bf)) < 0) {
-                fprintf(stderr, "couldn't read %s\n", filename);
-                exit(EXIT_FAILURE);
+                return 0;
         }
-        close(fd);
 
-        /* 9027 (cat) R 6747 9027 6747 34816 9027 ... */
         memset(&comm_ev, 0, sizeof(comm_ev));
-        field = strchr(bf, '(');
-        if (field == NULL)
-                goto out_failure;
-        sep = strchr(++field, ')');
-        if (sep == NULL)
-                goto out_failure;
-        size = sep - field;
-        memcpy(comm_ev.comm, field, size++);
-
-        comm_ev.pid = pid;
+        while (!comm_ev.comm[0] || !comm_ev.pid) {
+                if (fgets(bf, sizeof(bf), fp) == NULL)
+                        goto out_failure;
+
+                if (memcmp(bf, "Name:", 5) == 0) {
+                        char *name = bf + 5;
+                        while (*name && isspace(*name))
+                                ++name;
+                        size = strlen(name) - 1;
+                        memcpy(comm_ev.comm, name, size++);
+                } else if (memcmp(bf, "Tgid:", 5) == 0) {
+                        char *tgids = bf + 5;
+                        while (*tgids && isspace(*tgids))
+                                ++tgids;
+                        tgid = comm_ev.pid = atoi(tgids);
+                }
+        }
+
         comm_ev.header.type = PERF_EVENT_COMM;
         size = ALIGN(size, sizeof(u64));
         comm_ev.header.size = sizeof(comm_ev) - (sizeof(comm_ev.comm) - size);
@@ -251,7 +255,7 @@ static void pid_synthesize_comm_event(pid_t pid, int full)
                 comm_ev.tid = pid;
 
                 write_output(&comm_ev, comm_ev.header.size);
-                return;
+                goto out_fclose;
         }
 
         snprintf(filename, sizeof(filename), "/proc/%d/task", pid);
@@ -268,7 +272,10 @@ static void pid_synthesize_comm_event(pid_t pid, int full)
                 write_output(&comm_ev, comm_ev.header.size);
         }
         closedir(tasks);
-        return;
+
+out_fclose:
+        fclose(fp);
+        return tgid;
 
 out_failure:
         fprintf(stderr, "couldn't get COMM and pgid, malformed %s\n",
@@ -276,7 +283,7 @@ out_failure:
         exit(EXIT_FAILURE);
 }
 
-static void pid_synthesize_mmap_samples(pid_t pid)
+static void pid_synthesize_mmap_samples(pid_t pid, pid_t tgid)
 {
         char filename[PATH_MAX];
         FILE *fp;
@@ -328,7 +335,7 @@ static void pid_synthesize_mmap_samples(pid_t pid)
                         mmap_ev.len -= mmap_ev.start;
                         mmap_ev.header.size = (sizeof(mmap_ev) -
                                                (sizeof(mmap_ev.filename) - size));
-                        mmap_ev.pid = pid;
+                        mmap_ev.pid = tgid;
                         mmap_ev.tid = pid;
 
                         write_output(&mmap_ev, mmap_ev.header.size);
@@ -347,14 +354,14 @@ static void synthesize_all(void)
 
         while (!readdir_r(proc, &dirent, &next) && next) {
                 char *end;
-                pid_t pid;
+                pid_t pid, tgid;
 
                 pid = strtol(dirent.d_name, &end, 10);
                 if (*end) /* only interested in proper numerical dirents */
                         continue;
 
-                pid_synthesize_comm_event(pid, 1);
-                pid_synthesize_mmap_samples(pid);
+                tgid = pid_synthesize_comm_event(pid, 1);
+                pid_synthesize_mmap_samples(pid, tgid);
         }
 
         closedir(proc);
@@ -392,7 +399,7 @@ static void create_counter(int counter, int cpu, pid_t pid)
                                   PERF_FORMAT_TOTAL_TIME_RUNNING |
                                   PERF_FORMAT_ID;
 
-        attr->sample_type       = PERF_SAMPLE_IP | PERF_SAMPLE_TID;
+        attr->sample_type       |= PERF_SAMPLE_IP | PERF_SAMPLE_TID;
 
         if (freq) {
                 attr->sample_type       |= PERF_SAMPLE_PERIOD;
@@ -412,6 +419,8 @@ static void create_counter(int counter, int cpu, pid_t pid)
         if (call_graph)
                 attr->sample_type       |= PERF_SAMPLE_CALLCHAIN;
 
+        if (raw_samples)
+                attr->sample_type       |= PERF_SAMPLE_RAW;
 
         attr->mmap              = track;
         attr->comm              = track;
@@ -426,6 +435,8 @@ try_again:
 
                 if (err == EPERM)
                         die("Permission error - are you root?\n");
+                else if (err ==  ENODEV && profile_cpu != -1)
+                        die("No such device - did you specify an out-of-range profile CPU?\n");
 
                 /*
                  * If it's cycles then fall back to hrtimer
@@ -525,10 +536,14 @@ static int __cmd_record(int argc, const char **argv)
         signal(SIGCHLD, sig_handler);
         signal(SIGINT, sig_handler);
 
-        if (!stat(output_name, &st) && !force && !append_file) {
-                fprintf(stderr, "Error, output file %s exists, use -A to append or -f to overwrite.\n",
-                                output_name);
-                exit(-1);
+        if (!stat(output_name, &st) && st.st_size) {
+                if (!force && !append_file) {
+                        fprintf(stderr, "Error, output file %s exists, use -A to append or -f to overwrite.\n",
+                                        output_name);
+                        exit(-1);
+                }
+        } else {
+                append_file = 0;
         }
 
         flags = O_CREAT|O_RDWR;
@@ -555,16 +570,22 @@ static int __cmd_record(int argc, const char **argv)
                 if (pid == -1)
                         pid = getpid();
 
-                open_counters(-1, pid);
-        } else for (i = 0; i < nr_cpus; i++)
-                open_counters(i, target_pid);
+                open_counters(profile_cpu, pid);
+        } else {
+                if (profile_cpu != -1) {
+                        open_counters(profile_cpu, target_pid);
+                } else {
+                        for (i = 0; i < nr_cpus; i++)
+                                open_counters(i, target_pid);
+                }
+        }
 
         if (file_new)
                 perf_header__write(header, output);
 
         if (!system_wide) {
-                pid_synthesize_comm_event(pid, 0);
-                pid_synthesize_mmap_samples(pid);
+                pid_t tgid = pid_synthesize_comm_event(pid, 0);
+                pid_synthesize_mmap_samples(pid, tgid);
         } else
                 synthesize_all();
 
@@ -632,10 +653,14 @@ static const struct option options[] = {
                     "record events on existing pid"),
         OPT_INTEGER('r', "realtime", &realtime_prio,
                     "collect data with this RT SCHED_FIFO priority"),
+        OPT_BOOLEAN('R', "raw-samples", &raw_samples,
+                    "collect raw sample records from all opened counters"),
         OPT_BOOLEAN('a', "all-cpus", &system_wide,
                             "system-wide collection from all CPUs"),
         OPT_BOOLEAN('A', "append", &append_file,
                             "append to the output file to do incremental profiling"),
+        OPT_INTEGER('C', "profile_cpu", &profile_cpu,
+                            "CPU to profile on"),
         OPT_BOOLEAN('f', "force", &force,
                         "overwrite existing data file"),
         OPT_LONG('c', "count", &default_interval,
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 8cb58d68a006..8b2ec882e6e0 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -38,6 +38,7 @@ static char		*dso_list_str, *comm_list_str, *sym_list_str,
 static struct strlist   *dso_list, *comm_list, *sym_list;
 static char             *field_sep;
 
+static int              force;
 static int              input;
 static int              show_mask = SHOW_KERNEL | SHOW_USER | SHOW_HV;
 
@@ -68,7 +69,7 @@ static int		callchain;
 
 static
 struct callchain_param  callchain_param = {
-        .mode   = CHAIN_GRAPH_ABS,
+        .mode   = CHAIN_GRAPH_REL,
         .min_percent = 0.5
 };
 
@@ -112,7 +113,9 @@ struct read_event {
         struct perf_event_header header;
         u32 pid,tid;
         u64 value;
-        u64 format[3];
+        u64 time_enabled;
+        u64 time_running;
+        u64 id;
 };
 
 typedef union event_union {
@@ -698,7 +701,8 @@ sort__sym_print(FILE *fp, struct hist_entry *self, unsigned int width __used)
         size_t ret = 0;
 
         if (verbose)
-                ret += repsep_fprintf(fp, "%#018llx  ", (u64)self->ip);
+                ret += repsep_fprintf(fp, "%#018llx %c ", (u64)self->ip,
+                                      dso__symtab_origin(self->dso));
 
         ret += repsep_fprintf(fp, "[%c] ", self->level);
         if (self->sym) {
@@ -888,6 +892,21 @@ ipchain__fprintf_graph(FILE *fp, struct callchain_list *chain, int depth,
         return ret;
 }
 
+static struct symbol *rem_sq_bracket;
+static struct callchain_list rem_hits;
+
+static void init_rem_hits(void)
+{
+        rem_sq_bracket = malloc(sizeof(*rem_sq_bracket) + 6);
+        if (!rem_sq_bracket) {
+                fprintf(stderr, "Not enough memory to display remaining hits\n");
+                return;
+        }
+
+        strcpy(rem_sq_bracket->name, "[...]");
+        rem_hits.sym = rem_sq_bracket;
+}
+
 static size_t
 callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
                         u64 total_samples, int depth, int depth_mask)
@@ -897,25 +916,34 @@ callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
         struct callchain_list *chain;
         int new_depth_mask = depth_mask;
         u64 new_total;
+        u64 remaining;
         size_t ret = 0;
         int i;
 
         if (callchain_param.mode == CHAIN_GRAPH_REL)
-                new_total = self->cumul_hit;
+                new_total = self->children_hit;
         else
                 new_total = total_samples;
 
+        remaining = new_total;
+
         node = rb_first(&self->rb_root);
         while (node) {
+                u64 cumul;
+
                 child = rb_entry(node, struct callchain_node, rb_node);
+                cumul = cumul_hits(child);
+                remaining -= cumul;
 
                 /*
                  * The depth mask manages the output of pipes that show
                  * the depth. We don't want to keep the pipes of the current
-                 * level for the last child of this depth
+                 * level for the last child of this depth.
+                 * Except if we have remaining filtered hits. They will
+                 * supersede the last child
                  */
                 next = rb_next(node);
-                if (!next)
+                if (!next && (callchain_param.mode != CHAIN_GRAPH_REL || !remaining))
                         new_depth_mask &= ~(1 << (depth - 1));
 
                 /*
@@ -930,7 +958,7 @@ callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
                         ret += ipchain__fprintf_graph(fp, chain, depth,
                                                       new_depth_mask, i++,
                                                       new_total,
-                                                      child->cumul_hit);
+                                                      cumul);
                 }
                 ret += callchain__fprintf_graph(fp, child, new_total,
                                                 depth + 1,
@@ -938,6 +966,19 @@ callchain__fprintf_graph(FILE *fp, struct callchain_node *self,
                 node = next;
         }
 
+        if (callchain_param.mode == CHAIN_GRAPH_REL &&
+                remaining && remaining != new_total) {
+
+                if (!rem_sq_bracket)
+                        return ret;
+
+                new_depth_mask &= ~(1 << (depth - 1));
+
+                ret += ipchain__fprintf_graph(fp, &rem_hits, depth,
+                                              new_depth_mask, 0, new_total,
+                                              remaining);
+        }
+
         return ret;
 }
 
@@ -1358,6 +1399,8 @@ static size_t output__fprintf(FILE *fp, u64 total_samples)
         unsigned int width;
         char *col_width = col_width_list_str;
 
+        init_rem_hits();
+
         fprintf(fp, "# Samples: %Ld\n", (u64)total_samples);
         fprintf(fp, "#\n");
 
@@ -1429,6 +1472,8 @@ print_entries:
         }
         fprintf(fp, "\n");
 
+        free(rem_sq_bracket);
+
         return ret;
 }
 
@@ -1482,11 +1527,11 @@ process_sample_event(event_t *event, unsigned long offset, unsigned long head)
                 more_data += sizeof(u64);
         }
 
-        dprintf("%p [%p]: PERF_EVENT_SAMPLE (IP, %d): %d: %p period: %Ld\n",
+        dprintf("%p [%p]: PERF_EVENT_SAMPLE (IP, %d): %d/%d: %p period: %Ld\n",
                 (void *)(offset + head),
                 (void *)(long)(event->header.size),
                 event->header.misc,
-                event->ip.pid,
+                event->ip.pid, event->ip.tid,
                 (void *)(long)ip,
                 (long long)period);
 
@@ -1546,10 +1591,11 @@ process_sample_event(event_t *event, unsigned long offset, unsigned long head)
         if (show & show_mask) {
                 struct symbol *sym = resolve_symbol(thread, &map, &dso, &ip);
 
-                if (dso_list && dso && dso->name && !strlist__has_entry(dso_list, dso->name))
+                if (dso_list && (!dso || !dso->name ||
+                                 !strlist__has_entry(dso_list, dso->name)))
                         return 0;
 
-                if (sym_list && sym && !strlist__has_entry(sym_list, sym->name))
+                if (sym_list && (!sym || !strlist__has_entry(sym_list, sym->name)))
                         return 0;
 
                 if (hist_entry__add(thread, map, dso, sym, ip, chain, level, period)) {
@@ -1568,10 +1614,11 @@ process_mmap_event(event_t *event, unsigned long offset, unsigned long head)
         struct thread *thread = threads__findnew(event->mmap.pid);
         struct map *map = map__new(&event->mmap);
 
-        dprintf("%p [%p]: PERF_EVENT_MMAP %d: [%p(%p) @ %p]: %s\n",
+        dprintf("%p [%p]: PERF_EVENT_MMAP %d/%d: [%p(%p) @ %p]: %s\n",
                 (void *)(offset + head),
                 (void *)(long)(event->header.size),
                 event->mmap.pid,
+                event->mmap.tid,
                 (void *)(long)event->mmap.start,
                 (void *)(long)event->mmap.len,
                 (void *)(long)event->mmap.pgoff,
@@ -1690,14 +1737,37 @@ static void trace_event(event_t *event)
         dprintf(".\n");
 }
 
+static struct perf_header       *header;
+
+static struct perf_counter_attr *perf_header__find_attr(u64 id)
+{
+        int i;
+
+        for (i = 0; i < header->attrs; i++) {
+                struct perf_header_attr *attr = header->attr[i];
+                int j;
+
+                for (j = 0; j < attr->ids; j++) {
+                        if (attr->id[j] == id)
+                                return &attr->attr;
+                }
+        }
+
+        return NULL;
+}
+
 static int
 process_read_event(event_t *event, unsigned long offset, unsigned long head)
 {
-        dprintf("%p [%p]: PERF_EVENT_READ: %d %d %Lu\n",
+        struct perf_counter_attr *attr = perf_header__find_attr(event->read.id);
+
+        dprintf("%p [%p]: PERF_EVENT_READ: %d %d %s %Lu\n",
                         (void *)(offset + head),
                         (void *)(long)(event->header.size),
                         event->read.pid,
                         event->read.tid,
+                        attr ? __event_name(attr->type, attr->config)
+                             : "FAIL",
                         event->read.value);
 
         return 0;
@@ -1743,8 +1813,6 @@ process_event(event_t *event, unsigned long offset, unsigned long head)
         return 0;
 }
 
-static struct perf_header       *header;
-
 static u64 perf_header__sample_type(void)
 {
         u64 sample_type = 0;
@@ -1789,6 +1857,11 @@ static int __cmd_report(void)
                 exit(-1);
         }
 
+        if (!force && (stat.st_uid != geteuid())) {
+                fprintf(stderr, "file: %s not owned by current user\n", input_name);
+                exit(-1);
+        }
+
         if (!stat.st_size) {
                 fprintf(stderr, "zero-sized file, nothing to do!\n");
                 exit(0);
@@ -1812,6 +1885,13 @@ static int __cmd_report(void)
                                         " -g?\n");
                         exit(-1);
                 }
+        } else if (callchain_param.mode != CHAIN_NONE && !callchain) {
+                        callchain = 1;
+                        if (register_callchain_param(&callchain_param) < 0) {
+                                fprintf(stderr, "Can't register callchain"
+                                                " params\n");
+                                exit(-1);
+                        }
         }
 
         if (load_kernel() < 0) {
@@ -1950,6 +2030,13 @@ parse_callchain_opt(const struct option *opt __used, const char *arg,
         else if (!strncmp(tok, "fractal", strlen(arg)))
                 callchain_param.mode = CHAIN_GRAPH_REL;
 
+        else if (!strncmp(tok, "none", strlen(arg))) {
+                callchain_param.mode = CHAIN_NONE;
+                callchain = 0;
+
+                return 0;
+        }
+
         else
                 return -1;
 
@@ -1983,6 +2070,7 @@ static const struct option options[] = {
         OPT_BOOLEAN('D', "dump-raw-trace", &dump_trace,
                     "dump raw trace in ASCII"),
         OPT_STRING('k', "vmlinux", &vmlinux, "file", "vmlinux pathname"),
+        OPT_BOOLEAN('f', "force", &force, "don't complain, do it"),
         OPT_BOOLEAN('m', "modules", &modules,
                     "load module symbols - WARNING: use only with -k and LIVE kernel"),
         OPT_BOOLEAN('n', "show-nr-samples", &show_nr_samples,
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index f9510eeeb6c7..b4b06c7903e1 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -496,7 +496,7 @@ static const struct option options[] = {
                     "stat events on existing pid"),
         OPT_BOOLEAN('a', "all-cpus", &system_wide,
                     "system-wide collection from all CPUs"),
-        OPT_BOOLEAN('S', "scale", &scale,
+        OPT_BOOLEAN('c', "scale", &scale,
                     "scale/normalize counters"),
         OPT_BOOLEAN('v', "verbose", &verbose,
                     "be more verbose (show counter open errors, etc)"),
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index f139f1ab9333..7de28ce9ca26 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -31,6 +31,8 @@
 #include <fcntl.h>
 
 #include <stdio.h>
+#include <termios.h>
+#include <unistd.h>
 
 #include <errno.h>
 #include <time.h>
@@ -54,7 +56,7 @@ static int			system_wide			=  0;
 
 static int                      default_interval                = 100000;
 
-static u64                      count_filter                    =  5;
+static int                      count_filter                    =  5;
 static int                      print_entries                   = 15;
 
 static int                      target_pid                      = -1;
@@ -69,15 +71,28 @@ static int			freq				=  0;
 static int                      verbose                         =  0;
 static char                     *vmlinux                        =  NULL;
 
-static char                     *sym_filter;
-static unsigned long            filter_start;
-static unsigned long            filter_end;
-
 static int                      delay_secs                      =  2;
 static int                      zero;
 static int                      dump_symtab;
 
 /*
+ * Source
+ */
+
+struct source_line {
+        u64                     eip;
+        unsigned long           count[MAX_COUNTERS];
+        char                    *line;
+        struct source_line      *next;
+};
+
+static char                     *sym_filter                     =  NULL;
+struct sym_entry                *sym_filter_entry               =  NULL;
+static int                      sym_pcnt_filter                 =  5;
+static int                      sym_counter                     =  0;
+static int                      display_weighted                = -1;
+
+/*
  * Symbols
  */
 
@@ -91,9 +106,237 @@ struct sym_entry {
         unsigned long           snap_count;
         double                  weight;
         int                     skip;
+        struct source_line      *source;
+        struct source_line      *lines;
+        struct source_line      **lines_tail;
+        pthread_mutex_t         source_lock;
 };
 
-struct sym_entry                *sym_filter_entry;
+/*
+ * Source functions
+ */
+
+static void parse_source(struct sym_entry *syme)
+{
+        struct symbol *sym;
+        struct module *module;
+        struct section *section = NULL;
+        FILE *file;
+        char command[PATH_MAX*2], *path = vmlinux;
+        u64 start, end, len;
+
+        if (!syme)
+                return;
+
+        if (syme->lines) {
+                pthread_mutex_lock(&syme->source_lock);
+                goto out_assign;
+        }
+
+        sym = (struct symbol *)(syme + 1);
+        module = sym->module;
+
+        if (module)
+                path = module->path;
+        if (!path)
+                return;
+
+        start = sym->obj_start;
+        if (!start)
+                start = sym->start;
+
+        if (module) {
+                section = module->sections->find_section(module->sections, ".text");
+                if (section)
+                        start -= section->vma;
+        }
+
+        end = start + sym->end - sym->start + 1;
+        len = sym->end - sym->start;
+
+        sprintf(command, "objdump --start-address=0x%016Lx --stop-address=0x%016Lx -dS %s", start, end, path);
+
+        file = popen(command, "r");
+        if (!file)
+                return;
+
+        pthread_mutex_lock(&syme->source_lock);
+        syme->lines_tail = &syme->lines;
+        while (!feof(file)) {
+                struct source_line *src;
+                size_t dummy = 0;
+                char *c;
+
+                src = malloc(sizeof(struct source_line));
+                assert(src != NULL);
+                memset(src, 0, sizeof(struct source_line));
+
+                if (getline(&src->line, &dummy, file) < 0)
+                        break;
+                if (!src->line)
+                        break;
+
+                c = strchr(src->line, '\n');
+                if (c)
+                        *c = 0;
+
+                src->next = NULL;
+                *syme->lines_tail = src;
+                syme->lines_tail = &src->next;
+
+                if (strlen(src->line)>8 && src->line[8] == ':') {
+                        src->eip = strtoull(src->line, NULL, 16);
+                        if (section)
+                                src->eip += section->vma;
+                }
+                if (strlen(src->line)>8 && src->line[16] == ':') {
+                        src->eip = strtoull(src->line, NULL, 16);
+                        if (section)
+                                src->eip += section->vma;
+                }
+        }
+        pclose(file);
+out_assign:
+        sym_filter_entry = syme;
+        pthread_mutex_unlock(&syme->source_lock);
+}
+
+static void __zero_source_counters(struct sym_entry *syme)
+{
+        int i;
+        struct source_line *line;
+
+        line = syme->lines;
+        while (line) {
+                for (i = 0; i < nr_counters; i++)
+                        line->count[i] = 0;
+                line = line->next;
+        }
+}
+
+static void record_precise_ip(struct sym_entry *syme, int counter, u64 ip)
+{
+        struct source_line *line;
+
+        if (syme != sym_filter_entry)
+                return;
+
+        if (pthread_mutex_trylock(&syme->source_lock))
+                return;
+
+        if (!syme->source)
+                goto out_unlock;
+
+        for (line = syme->lines; line; line = line->next) {
+                if (line->eip == ip) {
+                        line->count[counter]++;
+                        break;
+                }
+                if (line->eip > ip)
+                        break;
+        }
+out_unlock:
+        pthread_mutex_unlock(&syme->source_lock);
+}
+
+static void lookup_sym_source(struct sym_entry *syme)
+{
+        struct symbol *symbol = (struct symbol *)(syme + 1);
+        struct source_line *line;
+        char pattern[PATH_MAX];
+        char *idx;
+
+        sprintf(pattern, "<%s>:", symbol->name);
+
+        if (symbol->module) {
+                idx = strstr(pattern, "\t");
+                if (idx)
+                        *idx = 0;
+        }
+
+        pthread_mutex_lock(&syme->source_lock);
+        for (line = syme->lines; line; line = line->next) {
+                if (strstr(line->line, pattern)) {
+                        syme->source = line;
+                        break;
+                }
+        }
+        pthread_mutex_unlock(&syme->source_lock);
+}
+
+static void show_lines(struct source_line *queue, int count, int total)
+{
+        int i;
+        struct source_line *line;
+
+        line = queue;
+        for (i = 0; i < count; i++) {
+                float pcnt = 100.0*(float)line->count[sym_counter]/(float)total;
+
+                printf("%8li %4.1f%%\t%s\n", line->count[sym_counter], pcnt, line->line);
+                line = line->next;
+        }
+}
+
+#define TRACE_COUNT     3
+
+static void show_details(struct sym_entry *syme)
+{
+        struct symbol *symbol;
+        struct source_line *line;
+        struct source_line *line_queue = NULL;
+        int displayed = 0;
+        int line_queue_count = 0, total = 0, more = 0;
+
+        if (!syme)
+                return;
+
+        if (!syme->source)
+                lookup_sym_source(syme);
+
+        if (!syme->source)
+                return;
+
+        symbol = (struct symbol *)(syme + 1);
+        printf("Showing %s for %s\n", event_name(sym_counter), symbol->name);
+        printf("  Events  Pcnt (>=%d%%)\n", sym_pcnt_filter);
+
+        pthread_mutex_lock(&syme->source_lock);
+        line = syme->source;
+        while (line) {
+                total += line->count[sym_counter];
+                line = line->next;
+        }
+
+        line = syme->source;
+        while (line) {
+                float pcnt = 0.0;
+
+                if (!line_queue_count)
+                        line_queue = line;
+                line_queue_count++;
+
+                if (line->count[sym_counter])
+                        pcnt = 100.0 * line->count[sym_counter] / (float)total;
+                if (pcnt >= (float)sym_pcnt_filter) {
+                        if (displayed <= print_entries)
+                                show_lines(line_queue, line_queue_count, total);
+                        else more++;
+                        displayed += line_queue_count;
+                        line_queue_count = 0;
+                        line_queue = NULL;
+                } else if (line_queue_count > TRACE_COUNT) {
+                        line_queue = line_queue->next;
+                        line_queue_count--;
+                }
+
+                line->count[sym_counter] = zero ? 0 : line->count[sym_counter] * 7 / 8;
+                line = line->next;
+        }
+        pthread_mutex_unlock(&syme->source_lock);
+        if (more)
+                printf("%d lines not displayed, maybe increase display entries [e]\n", more);
+}
 
 struct dso                      *kernel_dso;
 
@@ -112,6 +355,9 @@ static double sym_weight(const struct sym_entry *sym)
         double weight = sym->snap_count;
         int counter;
 
+        if (!display_weighted)
+                return weight;
+
         for (counter = 1; counter < nr_counters-1; counter++)
                 weight *= sym->count[counter];
 
@@ -159,7 +405,7 @@ static void rb_insert_active_sym(struct rb_root *tree, struct sym_entry *se)
 static void print_sym_table(void)
 {
         int printed = 0, j;
-        int counter;
+        int counter, snap = !display_weighted ? sym_counter : 0;
         float samples_per_sec = samples/delay_secs;
         float ksamples_per_sec = (samples-userspace_samples)/delay_secs;
         float sum_ksamples = 0.0;
@@ -175,7 +421,7 @@ static void print_sym_table(void)
         pthread_mutex_unlock(&active_symbols_lock);
 
         list_for_each_entry_safe_from(syme, n, &active_symbols, node) {
-                syme->snap_count = syme->count[0];
+                syme->snap_count = syme->count[snap];
                 if (syme->snap_count != 0) {
                         syme->weight = sym_weight(syme);
                         rb_insert_active_sym(&tmp, syme);
@@ -195,7 +441,7 @@ static void print_sym_table(void)
                 samples_per_sec,
                 100.0 - (100.0*((samples_per_sec-ksamples_per_sec)/samples_per_sec)));
 
-        if (nr_counters == 1) {
+        if (nr_counters == 1 || !display_weighted) {
                 printf("%Ld", (u64)attrs[0].sample_period);
                 if (freq)
                         printf("Hz ");
@@ -203,7 +449,9 @@ static void print_sym_table(void)
                         printf(" ");
         }
 
-        for (counter = 0; counter < nr_counters; counter++) {
+        if (!display_weighted)
+                printf("%s", event_name(sym_counter));
+        else for (counter = 0; counter < nr_counters; counter++) {
                 if (counter)
                         printf("/");
 
@@ -228,6 +476,11 @@ static void print_sym_table(void)
 
         printf("------------------------------------------------------------------------------\n\n");
 
+        if (sym_filter_entry) {
+                show_details(sym_filter_entry);
+                return;
+        }
+
         if (nr_counters == 1)
                 printf("             samples    pcnt");
         else
@@ -242,13 +495,13 @@ static void print_sym_table(void)
                 struct symbol *sym = (struct symbol *)(syme + 1);
                 double pcnt;
 
-                if (++printed > print_entries || syme->snap_count < count_filter)
+                if (++printed > print_entries || (int)syme->snap_count < count_filter)
                         continue;
 
                 pcnt = 100.0 - (100.0 * ((sum_ksamples - syme->snap_count) /
                                          sum_ksamples));
 
-                if (nr_counters == 1)
+                if (nr_counters == 1 || !display_weighted)
                         printf("%20.2f - ", syme->weight);
                 else
                         printf("%9.1f %10ld - ", syme->weight, syme->snap_count);
@@ -261,19 +514,250 @@ static void print_sym_table(void)
         }
 }
 
+static void prompt_integer(int *target, const char *msg)
+{
+        char *buf = malloc(0), *p;
+        size_t dummy = 0;
+        int tmp;
+
+        fprintf(stdout, "\n%s: ", msg);
+        if (getline(&buf, &dummy, stdin) < 0)
+                return;
+
+        p = strchr(buf, '\n');
+        if (p)
+                *p = 0;
+
+        p = buf;
+        while(*p) {
+                if (!isdigit(*p))
+                        goto out_free;
+                p++;
+        }
+        tmp = strtoul(buf, NULL, 10);
+        *target = tmp;
+out_free:
+        free(buf);
+}
+
+static void prompt_percent(int *target, const char *msg)
+{
+        int tmp = 0;
+
+        prompt_integer(&tmp, msg);
+        if (tmp >= 0 && tmp <= 100)
+                *target = tmp;
+}
+
+static void prompt_symbol(struct sym_entry **target, const char *msg)
+{
+        char *buf = malloc(0), *p;
+        struct sym_entry *syme = *target, *n, *found = NULL;
+        size_t dummy = 0;
+
+        /* zero counters of active symbol */
+        if (syme) {
+                pthread_mutex_lock(&syme->source_lock);
+                __zero_source_counters(syme);
+                *target = NULL;
+                pthread_mutex_unlock(&syme->source_lock);
+        }
+
+        fprintf(stdout, "\n%s: ", msg);
+        if (getline(&buf, &dummy, stdin) < 0)
+                goto out_free;
+
+        p = strchr(buf, '\n');
+        if (p)
+                *p = 0;
+
+        pthread_mutex_lock(&active_symbols_lock);
+        syme = list_entry(active_symbols.next, struct sym_entry, node);
+        pthread_mutex_unlock(&active_symbols_lock);
+
+        list_for_each_entry_safe_from(syme, n, &active_symbols, node) {
+                struct symbol *sym = (struct symbol *)(syme + 1);
+
+                if (!strcmp(buf, sym->name)) {
+                        found = syme;
+                        break;
+                }
+        }
+
+        if (!found) {
+                fprintf(stderr, "Sorry, %s is not active.\n", sym_filter);
+                sleep(1);
+                return;
+        } else
+                parse_source(found);
+
+out_free:
+        free(buf);
+}
+
+static void print_mapped_keys(void)
+{
+        char *name = NULL;
+
+        if (sym_filter_entry) {
+                struct symbol *sym = (struct symbol *)(sym_filter_entry+1);
+                name = sym->name;
+        }
+
+        fprintf(stdout, "\nMapped keys:\n");
+        fprintf(stdout, "\t[d]     display refresh delay.             \t(%d)\n", delay_secs);
+        fprintf(stdout, "\t[e]     display entries (lines).           \t(%d)\n", print_entries);
+
+        if (nr_counters > 1)
+                fprintf(stdout, "\t[E]     active event counter.              \t(%s)\n", event_name(sym_counter));
+
+        fprintf(stdout, "\t[f]     profile display filter (count).    \t(%d)\n", count_filter);
+
+        if (vmlinux) {
+                fprintf(stdout, "\t[F]     annotate display filter (percent). \t(%d%%)\n", sym_pcnt_filter);
+                fprintf(stdout, "\t[s]     annotate symbol.                   \t(%s)\n", name?: "NULL");
+                fprintf(stdout, "\t[S]     stop annotation.\n");
+        }
+
+        if (nr_counters > 1)
+                fprintf(stdout, "\t[w]     toggle display weighted/count[E]r. \t(%d)\n", display_weighted ? 1 : 0);
+
+        fprintf(stdout, "\t[z]     toggle sample zeroing.             \t(%d)\n", zero ? 1 : 0);
+        fprintf(stdout, "\t[qQ]    quit.\n");
+}
+
+static int key_mapped(int c)
+{
+        switch (c) {
+                case 'd':
+                case 'e':
+                case 'f':
+                case 'z':
+                case 'q':
+                case 'Q':
+                        return 1;
+                case 'E':
+                case 'w':
+                        return nr_counters > 1 ? 1 : 0;
+                case 'F':
+                case 's':
+                case 'S':
+                        return vmlinux ? 1 : 0;
+        }
+
+        return 0;
+}
+
+static void handle_keypress(int c)
+{
+        if (!key_mapped(c)) {
+                struct pollfd stdin_poll = { .fd = 0, .events = POLLIN };
+                struct termios tc, save;
+
+                print_mapped_keys();
+                fprintf(stdout, "\nEnter selection, or unmapped key to continue: ");
+                fflush(stdout);
+
+                tcgetattr(0, &save);
+                tc = save;
+                tc.c_lflag &= ~(ICANON | ECHO);
+                tc.c_cc[VMIN] = 0;
+                tc.c_cc[VTIME] = 0;
+                tcsetattr(0, TCSANOW, &tc);
+
+                poll(&stdin_poll, 1, -1);
+                c = getc(stdin);
+
+                tcsetattr(0, TCSAFLUSH, &save);
+                if (!key_mapped(c))
+                        return;
+        }
+
+        switch (c) {
+                case 'd':
+                        prompt_integer(&delay_secs, "Enter display delay");
+                        break;
+                case 'e':
+                        prompt_integer(&print_entries, "Enter display entries (lines)");
+                        break;
+                case 'E':
+                        if (nr_counters > 1) {
+                                int i;
+
+                                fprintf(stderr, "\nAvailable events:");
+                                for (i = 0; i < nr_counters; i++)
+                                        fprintf(stderr, "\n\t%d %s", i, event_name(i));
+
+                                prompt_integer(&sym_counter, "Enter details event counter");
+
+                                if (sym_counter >= nr_counters) {
+                                        fprintf(stderr, "Sorry, no such event, using %s.\n", event_name(0));
+                                        sym_counter = 0;
+                                        sleep(1);
+                                }
+                        } else sym_counter = 0;
+                        break;
+                case 'f':
+                        prompt_integer(&count_filter, "Enter display event count filter");
+                        break;
+                case 'F':
+                        prompt_percent(&sym_pcnt_filter, "Enter details display event filter (percent)");
+                        break;
+                case 'q':
+                case 'Q':
+                        printf("exiting.\n");
+                        exit(0);
+                case 's':
+                        prompt_symbol(&sym_filter_entry, "Enter details symbol");
+                        break;
+                case 'S':
+                        if (!sym_filter_entry)
+                                break;
+                        else {
+                                struct sym_entry *syme = sym_filter_entry;
+
+                                pthread_mutex_lock(&syme->source_lock);
+                                sym_filter_entry = NULL;
+                                __zero_source_counters(syme);
+                                pthread_mutex_unlock(&syme->source_lock);
+                        }
+                        break;
+                case 'w':
+                        display_weighted = ~display_weighted;
+                        break;
+                case 'z':
+                        zero = ~zero;
+                        break;
+        }
+}
+
 static void *display_thread(void *arg __used)
 {
         struct pollfd stdin_poll = { .fd = 0, .events = POLLIN };
-        int delay_msecs = delay_secs * 1000;
+        struct termios tc, save;
+        int delay_msecs, c;
+
+        tcgetattr(0, &save);
+        tc = save;
+        tc.c_lflag &= ~(ICANON | ECHO);
+        tc.c_cc[VMIN] = 0;
+        tc.c_cc[VTIME] = 0;
 
-        printf("PerfTop refresh period: %d seconds\n", delay_secs);
+repeat:
+        delay_msecs = delay_secs * 1000;
+        tcsetattr(0, TCSANOW, &tc);
+        /* trash return*/
+        getc(stdin);
 
         do {
                 print_sym_table();
         } while (!poll(&stdin_poll, 1, delay_msecs) == 1);
 
-        printf("key pressed - exiting.\n");
-        exit(0);
+        c = getc(stdin);
+        tcsetattr(0, TCSAFLUSH, &save);
+
+        handle_keypress(c);
+        goto repeat;
 
         return NULL;
 }
@@ -293,7 +777,6 @@ static const char *skip_symbols[] = {
 
 static int symbol_filter(struct dso *self, struct symbol *sym)
 {
-        static int filter_match;
         struct sym_entry *syme;
         const char *name = sym->name;
         int i;
@@ -315,6 +798,10 @@ static int symbol_filter(struct dso *self, struct symbol *sym)
                 return 1;
 
         syme = dso__sym_priv(self, sym);
+        pthread_mutex_init(&syme->source_lock, NULL);
+        if (!sym_filter_entry && sym_filter && !strcmp(name, sym_filter))
+                sym_filter_entry = syme;
+
         for (i = 0; skip_symbols[i]; i++) {
                 if (!strcmp(skip_symbols[i], name)) {
                         syme->skip = 1;
@@ -322,29 +809,6 @@ static int symbol_filter(struct dso *self, struct symbol *sym)
                 }
         }
 
-        if (filter_match == 1) {
-                filter_end = sym->start;
-                filter_match = -1;
-                if (filter_end - filter_start > 10000) {
-                        fprintf(stderr,
-                                "hm, too large filter symbol <%s> - skipping.\n",
-                                sym_filter);
-                        fprintf(stderr, "symbol filter start: %016lx\n",
-                                filter_start);
-                        fprintf(stderr, "                end: %016lx\n",
-                                filter_end);
-                        filter_end = filter_start = 0;
-                        sym_filter = NULL;
-                        sleep(1);
-                }
-        }
-
-        if (filter_match == 0 && sym_filter && !strcmp(name, sym_filter)) {
-                filter_match = 1;
-                filter_start = sym->start;
-        }
-
-
         return 0;
 }
 
@@ -380,8 +844,6 @@ out_delete_dso:
         return -1;
 }
 
-#define TRACE_COUNT     3
-
 /*
  * Binary search in the histogram table and record the hit:
  */
@@ -394,6 +856,7 @@ static void record_ip(u64 ip, int counter)
 
                 if (!syme->skip) {
                         syme->count[counter]++;
+                        record_precise_ip(syme, counter, ip);
                         pthread_mutex_lock(&active_symbols_lock);
                         if (list_empty(&syme->node) || !syme->node.next)
                                 __list_insert_active_sym(syme);
@@ -690,8 +1153,8 @@ static const struct option options[] = {
                             "put the counters into a counter group"),
         OPT_BOOLEAN('i', "inherit", &inherit,
                     "child tasks inherit counters"),
-        OPT_STRING('s', "sym-filter", &sym_filter, "pattern",
-                    "only display symbols matchig this pattern"),
+        OPT_STRING('s', "sym-annotate", &sym_filter, "symbol name",
+                    "symbol to annotate - requires -k option"),
         OPT_BOOLEAN('z', "zero", &zero,
                     "zero history across updates"),
         OPT_INTEGER('F', "freq", &freq,
@@ -734,6 +1197,7 @@ int cmd_top(int argc, const char **argv, const char *prefix __used)
                 delay_secs = 1;
 
         parse_symbols();
+        parse_source(sym_filter_entry);
 
         /*
          * Fill in the ones not specifically initialized via -c:
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index 9d3c8141b8c1..011473411642 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -13,6 +13,7 @@
 #include <stdio.h>
 #include <stdbool.h>
 #include <errno.h>
+#include <math.h>
 
 #include "callchain.h"
 
@@ -26,10 +27,14 @@ rb_insert_callchain(struct rb_root *root, struct callchain_node *chain,
         struct rb_node **p = &root->rb_node;
         struct rb_node *parent = NULL;
         struct callchain_node *rnode;
+        u64 chain_cumul = cumul_hits(chain);
 
         while (*p) {
+                u64 rnode_cumul;
+
                 parent = *p;
                 rnode = rb_entry(parent, struct callchain_node, rb_node);
+                rnode_cumul = cumul_hits(rnode);
 
                 switch (mode) {
                 case CHAIN_FLAT:
@@ -40,7 +45,7 @@ rb_insert_callchain(struct rb_root *root, struct callchain_node *chain,
                         break;
                 case CHAIN_GRAPH_ABS: /* Falldown */
                 case CHAIN_GRAPH_REL:
-                        if (rnode->cumul_hit < chain->cumul_hit)
+                        if (rnode_cumul < chain_cumul)
                                 p = &(*p)->rb_left;
                         else
                                 p = &(*p)->rb_right;
@@ -87,7 +92,7 @@ static void __sort_chain_graph_abs(struct callchain_node *node,
 
         chain_for_each_child(child, node) {
                 __sort_chain_graph_abs(child, min_hit);
-                if (child->cumul_hit >= min_hit)
+                if (cumul_hits(child) >= min_hit)
                         rb_insert_callchain(&node->rb_root, child,
                                             CHAIN_GRAPH_ABS);
         }
@@ -108,11 +113,11 @@ static void __sort_chain_graph_rel(struct callchain_node *node,
         u64 min_hit;
 
         node->rb_root = RB_ROOT;
-        min_hit = node->cumul_hit * min_percent / 100.0;
+        min_hit = ceil(node->children_hit * min_percent);
 
         chain_for_each_child(child, node) {
                 __sort_chain_graph_rel(child, min_percent);
-                if (child->cumul_hit >= min_hit)
+                if (cumul_hits(child) >= min_hit)
                         rb_insert_callchain(&node->rb_root, child,
                                             CHAIN_GRAPH_REL);
         }
@@ -122,7 +127,7 @@ static void
 sort_chain_graph_rel(struct rb_root *rb_root, struct callchain_node *chain_root,
                      u64 min_hit __used, struct callchain_param *param)
 {
-        __sort_chain_graph_rel(chain_root, param->min_percent);
+        __sort_chain_graph_rel(chain_root, param->min_percent / 100.0);
         rb_root->rb_node = chain_root->rb_root.rb_node;
 }
 
@@ -211,7 +216,8 @@ add_child(struct callchain_node *parent, struct ip_callchain *chain,
         new = create_child(parent, false);
         fill_node(new, chain, start, syms);
 
-        new->cumul_hit = new->hit = 1;
+        new->children_hit = 0;
+        new->hit = 1;
 }
 
 /*
@@ -241,7 +247,8 @@ split_add_child(struct callchain_node *parent, struct ip_callchain *chain,
 
         /* split the hits */
         new->hit = parent->hit;
-        new->cumul_hit = parent->cumul_hit;
+        new->children_hit = parent->children_hit;
+        parent->children_hit = cumul_hits(new);
         new->val_nr = parent->val_nr - idx_local;
         parent->val_nr = idx_local;
 
@@ -249,6 +256,7 @@ split_add_child(struct callchain_node *parent, struct ip_callchain *chain,
         if (idx_total < chain->nr) {
                 parent->hit = 0;
                 add_child(parent, chain, idx_total, syms);
+                parent->children_hit++;
         } else {
                 parent->hit = 1;
         }
@@ -269,13 +277,13 @@ __append_chain_children(struct callchain_node *root, struct ip_callchain *chain,
                 unsigned int ret = __append_chain(rnode, chain, start, syms);
 
                 if (!ret)
-                        goto cumul;
+                        goto inc_children_hit;
         }
         /* nothing in children, add to the current node */
         add_child(root, chain, start, syms);
 
-cumul:
-        root->cumul_hit++;
+inc_children_hit:
+        root->children_hit++;
 }
 
 static int
@@ -317,8 +325,6 @@ __append_chain(struct callchain_node *root, struct ip_callchain *chain,
         /* we match 100% of the path, increment the hit */
         if (i - start == root->val_nr && i == chain->nr) {
                 root->hit++;
-                root->cumul_hit++;
-
                 return 0;
         }
 
@@ -331,5 +337,7 @@ __append_chain(struct callchain_node *root, struct ip_callchain *chain,
 void append_chain(struct callchain_node *root, struct ip_callchain *chain,
                   struct symbol **syms)
 {
+        if (!chain->nr)
+                return;
         __append_chain_children(root, chain, syms, 0);
 }
diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
index 7812122bea1d..a926ae4f5a16 100644
--- a/tools/perf/util/callchain.h
+++ b/tools/perf/util/callchain.h
@@ -7,6 +7,7 @@
 #include "symbol.h"
 
 enum chain_mode {
+        CHAIN_NONE,
         CHAIN_FLAT,
         CHAIN_GRAPH_ABS,
         CHAIN_GRAPH_REL
@@ -21,7 +22,7 @@ struct callchain_node {
         struct rb_root          rb_root; /* sorted tree of children */
         unsigned int            val_nr;
         u64                     hit;
-        u64                     cumul_hit; /* hit + hits of children */
+        u64                     children_hit;
 };
 
 struct callchain_param;
@@ -48,6 +49,11 @@ static inline void callchain_init(struct callchain_node *node)
         INIT_LIST_HEAD(&node->val);
 }
 
+static inline u64 cumul_hits(struct callchain_node *node)
+{
+        return node->hit + node->children_hit;
+}
+
 int register_callchain_param(struct callchain_param *param);
 void append_chain(struct callchain_node *root, struct ip_callchain *chain,
                   struct symbol **syms);
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 450384b3bbe5..b92a457ca32e 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -185,6 +185,8 @@ static void do_read(int fd, void *buf, size_t size)
 
                 if (ret < 0)
                         die("failed to read");
+                if (ret == 0)
+                        die("failed to read: missing data");
 
                 size -= ret;
                 buf += ret;
@@ -213,9 +215,10 @@ struct perf_header *perf_header__read(int fd)
 
         for (i = 0; i < nr_attrs; i++) {
                 struct perf_header_attr *attr;
-                off_t tmp = lseek(fd, 0, SEEK_CUR);
+                off_t tmp;
 
                 do_read(fd, &f_attr, sizeof(f_attr));
+                tmp = lseek(fd, 0, SEEK_CUR);
 
                 attr = perf_header_attr__new(&f_attr.attr);
 
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 7bdad8df22a6..044178408783 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -121,13 +121,29 @@ static unsigned long hw_cache_stat[C(MAX)] = {
            (strcmp(sys_dirent.d_name, ".")) &&                                 \
            (strcmp(sys_dirent.d_name, "..")))
 
+static int tp_event_has_id(struct dirent *sys_dir, struct dirent *evt_dir)
+{
+        char evt_path[MAXPATHLEN];
+        int fd;
+
+        snprintf(evt_path, MAXPATHLEN, "%s/%s/%s/id", debugfs_path,
+                        sys_dir->d_name, evt_dir->d_name);
+        fd = open(evt_path, O_RDONLY);
+        if (fd < 0)
+                return -EINVAL;
+        close(fd);
+
+        return 0;
+}
+
 #define for_each_event(sys_dirent, evt_dir, evt_dirent, evt_next, file, st)    \
         while (!readdir_r(evt_dir, &evt_dirent, &evt_next) && evt_next)        \
         if (snprintf(file, MAXPATHLEN, "%s/%s/%s", debugfs_path,               \
                      sys_dirent.d_name, evt_dirent.d_name) &&                  \
            (!stat(file, &st)) && (S_ISDIR(st.st_mode)) &&                      \
            (strcmp(evt_dirent.d_name, ".")) &&                                 \
-           (strcmp(evt_dirent.d_name, "..")))
+           (strcmp(evt_dirent.d_name, "..")) &&                                \
+           (!tp_event_has_id(&sys_dirent, &evt_dirent)))
 
 #define MAX_EVENT_LENGTH 30
 
@@ -223,9 +239,15 @@ char *event_name(int counter)
 {
         u64 config = attrs[counter].config;
         int type = attrs[counter].type;
+
+        return __event_name(type, config);
+}
+
+char *__event_name(int type, u64 config)
+{
         static char buf[32];
 
-        if (attrs[counter].type == PERF_TYPE_RAW) {
+        if (type == PERF_TYPE_RAW) {
                 sprintf(buf, "raw 0x%llx", config);
                 return buf;
         }
@@ -357,6 +379,7 @@ static int parse_tracepoint_event(const char **strp,
                                     struct perf_counter_attr *attr)
 {
         const char *evt_name;
+        char *flags;
         char sys_name[MAX_EVENT_LENGTH];
         char id_buf[4];
         int fd;
@@ -378,6 +401,15 @@ static int parse_tracepoint_event(const char **strp,
         strncpy(sys_name, *strp, sys_length);
         sys_name[sys_length] = '\0';
         evt_name = evt_name + 1;
+
+        flags = strchr(evt_name, ':');
+        if (flags) {
+                *flags = '\0';
+                flags++;
+                if (!strncmp(flags, "record", strlen(flags)))
+                        attr->sample_type |= PERF_SAMPLE_RAW;
+        }
+
         evt_length = strlen(evt_name);
         if (evt_length >= MAX_EVENT_LENGTH)
                 return 0;
diff --git a/tools/perf/util/parse-events.h b/tools/perf/util/parse-events.h
index 1ea5d09b6eb1..192a962e3a0f 100644
--- a/tools/perf/util/parse-events.h
+++ b/tools/perf/util/parse-events.h
@@ -10,6 +10,7 @@ extern int			nr_counters;
 extern struct perf_counter_attr attrs[MAX_COUNTERS];
 
 extern char *event_name(int ctr);
+extern char *__event_name(int type, u64 config);
 
 extern int parse_events(const struct option *opt, const char *str, int unset);
 
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 16ddca202948..5c0f42e6b33b 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -7,22 +7,17 @@
 #include <gelf.h>
 #include <elf.h>
 
-#ifndef NO_DEMANGLE
-#include <bfd.h>
-#else
-static inline
-char *bfd_demangle(void __used *v, const char __used *c, int __used i)
-{
-        return NULL;
-}
-#endif
-
 const char *sym_hist_filter;
 
-#ifndef DMGL_PARAMS
-#define DMGL_PARAMS      (1 << 0)       /* Include function args */
-#define DMGL_ANSI        (1 << 1)       /* Include const, volatile, etc */
-#endif
+enum dso_origin {
+        DSO__ORIG_KERNEL = 0,
+        DSO__ORIG_JAVA_JIT,
+        DSO__ORIG_FEDORA,
+        DSO__ORIG_UBUNTU,
+        DSO__ORIG_BUILDID,
+        DSO__ORIG_DSO,
+        DSO__ORIG_NOT_FOUND,
+};
 
 static struct symbol *symbol__new(u64 start, u64 len,
                                   const char *name, unsigned int priv_size,
@@ -81,6 +76,7 @@ struct dso *dso__new(const char *name, unsigned int sym_priv_size)
                 self->sym_priv_size = sym_priv_size;
                 self->find_symbol = dso__find_symbol;
                 self->slen_calculated = 0;
+                self->origin = DSO__ORIG_NOT_FOUND;
         }
 
         return self;
@@ -710,7 +706,7 @@ static char *dso__read_build_id(struct dso *self, int verbose)
                 ++raw;
                 bid += 2;
         }
-        if (verbose)
+        if (verbose >= 2)
                 printf("%s(%s): %s\n", __func__, self->name, build_id);
 out_elf_end:
         elf_end(elf);
@@ -720,11 +716,26 @@ out:
         return build_id;
 }
 
+char dso__symtab_origin(const struct dso *self)
+{
+        static const char origin[] = {
+                [DSO__ORIG_KERNEL] =   'k',
+                [DSO__ORIG_JAVA_JIT] = 'j',
+                [DSO__ORIG_FEDORA] =   'f',
+                [DSO__ORIG_UBUNTU] =   'u',
+                [DSO__ORIG_BUILDID] =  'b',
+                [DSO__ORIG_DSO] =      'd',
+        };
+
+        if (self == NULL || self->origin == DSO__ORIG_NOT_FOUND)
+                return '!';
+        return origin[self->origin];
+}
+
 int dso__load(struct dso *self, symbol_filter_t filter, int verbose)
 {
         int size = PATH_MAX;
         char *name = malloc(size), *build_id = NULL;
-        int variant = 0;
         int ret = -1;
         int fd;
 
@@ -733,19 +744,26 @@ int dso__load(struct dso *self, symbol_filter_t filter, int verbose)
 
         self->adjust_symbols = 0;
 
-        if (strncmp(self->name, "/tmp/perf-", 10) == 0)
-                return dso__load_perf_map(self, filter, verbose);
+        if (strncmp(self->name, "/tmp/perf-", 10) == 0) {
+                ret = dso__load_perf_map(self, filter, verbose);
+                self->origin = ret > 0 ? DSO__ORIG_JAVA_JIT :
+                                         DSO__ORIG_NOT_FOUND;
+                return ret;
+        }
+
+        self->origin = DSO__ORIG_FEDORA - 1;
 
 more:
         do {
-                switch (variant) {
-                case 0: /* Fedora */
+                self->origin++;
+                switch (self->origin) {
+                case DSO__ORIG_FEDORA:
                         snprintf(name, size, "/usr/lib/debug%s.debug", self->name);
                         break;
-                case 1: /* Ubuntu */
+                case DSO__ORIG_UBUNTU:
                         snprintf(name, size, "/usr/lib/debug%s", self->name);
                         break;
-                case 2:
+                case DSO__ORIG_BUILDID:
                         build_id = dso__read_build_id(self, verbose);
                         if (build_id != NULL) {
                                 snprintf(name, size,
@@ -754,16 +772,15 @@ more:
                                 free(build_id);
                                 break;
                         }
-                        variant++;
+                        self->origin++;
                         /* Fall thru */
-                case 3: /* Sane people */
+                case DSO__ORIG_DSO:
                         snprintf(name, size, "%s", self->name);
                         break;
 
                 default:
                         goto out;
                 }
-                variant++;
 
                 fd = open(name, O_RDONLY);
         } while (fd < 0);
@@ -784,6 +801,8 @@ more:
         }
 out:
         free(name);
+        if (ret < 0 && strstr(self->name, " (deleted)") != NULL)
+                return 0;
         return ret;
 }
 
@@ -899,6 +918,9 @@ int dso__load_kernel(struct dso *self, const char *vmlinux,
         if (err <= 0)
                 err = dso__load_kallsyms(self, filter, verbose);
 
+        if (err > 0)
+                self->origin = DSO__ORIG_KERNEL;
+
         return err;
 }
 
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 2f92b21c712d..b53bf0125c1b 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -7,6 +7,30 @@
 #include <linux/rbtree.h>
 #include "module.h"
 
+#ifdef HAVE_CPLUS_DEMANGLE
+extern char *cplus_demangle(const char *, int);
+
+static inline char *bfd_demangle(void __used *v, const char *c, int i)
+{
+        return cplus_demangle(c, i);
+}
+#else
+#ifdef NO_DEMANGLE
+static inline char *bfd_demangle(void __used *v, const char __used *c,
+                                 int __used i)
+{
+        return NULL;
+}
+#else
+#include <bfd.h>
+#endif
+#endif
+
+#ifndef DMGL_PARAMS
+#define DMGL_PARAMS      (1 << 0)       /* Include function args */
+#define DMGL_ANSI        (1 << 1)       /* Include const, volatile, etc */
+#endif
+
 struct symbol {
         struct rb_node  rb_node;
         u64             start;
@@ -26,6 +50,7 @@ struct dso {
         unsigned int     sym_priv_size;
         unsigned char    adjust_symbols;
         unsigned char    slen_calculated;
+        unsigned char    origin;
         char             name[0];
 };
 
@@ -49,6 +74,7 @@ int dso__load_modules(struct dso *self, symbol_filter_t filter, int verbose);
 int dso__load(struct dso *self, symbol_filter_t filter, int verbose);
 
 size_t dso__fprintf(struct dso *self, FILE *fp);
+char dso__symtab_origin(const struct dso *self);
 
 void symbol__init(void);
 #endif /* _PERF_SYMBOL_ */