650 files changed, 7335 insertions, 4016 deletions
diff --git a/Documentation/ABI/testing/sysfs-block-rssd b/Documentation/ABI/testing/sysfs-block-rssd
index 679ce3543122..beef30c046b0 100644
--- a/Documentation/ABI/testing/sysfs-block-rssd
+++ b/Documentation/ABI/testing/sysfs-block-rssd
@@ -1,26 +1,5 @@
-What:           /sys/block/rssd*/registers
-Date:           March 2012
-KernelVersion:  3.3
-Contact:        Asai Thambi S P <asamymuthupa@micron.com>
-Description:    This is a read-only file. Dumps below driver information and
-                hardware registers.
-                    - S ACTive
-                    - Command Issue
-                    - Completed
-                    - PORT IRQ STAT
-                    - HOST IRQ STAT
-                    - Allocated
-                    - Commands in Q
 What:           /sys/block/rssd*/status
 Date:           April 2012
 KernelVersion:  3.4
 Contact:        Asai Thambi S P <asamymuthupa@micron.com>
 Description:    This is a read-only file. Indicates the status of the device.
-What:           /sys/block/rssd*/flags
-Date:           May 2012
-KernelVersion:  3.5
-Contact:        Asai Thambi S P <asamymuthupa@micron.com>
-Description:    This is a read-only file. Dumps the flags in port and driver
-                data structure
diff --git a/Documentation/ABI/testing/sysfs-class-mtd b/Documentation/ABI/testing/sysfs-class-mtd
index db1ad7e34fc3..938ef71e2035 100644
--- a/Documentation/ABI/testing/sysfs-class-mtd
+++ b/Documentation/ABI/testing/sysfs-class-mtd
@@ -142,13 +142,14 @@ KernelVersion:	3.4
 Contact:        linux-mtd@lists.infradead.org
 Description:
                This allows the user to examine and adjust the criteria by which
-                mtd returns -EUCLEAN from mtd_read().  If the maximum number of
+                mtd returns -EUCLEAN from mtd_read() and mtd_read_oob().  If the
-                bit errors that were corrected on any single region comprising
+                maximum number of bit errors that were corrected on any single
-                an ecc step (as reported by the driver) equals or exceeds this
+                region comprising an ecc step (as reported by the driver) equals
-                value, -EUCLEAN is returned.  Otherwise, absent an error, 0 is
+                or exceeds this value, -EUCLEAN is returned.  Otherwise, absent
-                returned.  Higher layers (e.g., UBI) use this return code as an
+                an error, 0 is returned.  Higher layers (e.g., UBI) use this
-                indication that an erase block may be degrading and should be
+                return code as an indication that an erase block may be
-                scrutinized as a candidate for being marked as bad.
+                degrading and should be scrutinized as a candidate for being
+                marked as bad.
                The initial value may be specified by the flash device driver.
                If not, then the default value is ecc_strength.
@@ -167,7 +168,7 @@ Description:
                block degradation, but high enough to avoid the consequences of
                a persistent return value of -EUCLEAN on devices where sticky
                bitflips occur.  Note that if bitflip_threshold exceeds
-                ecc_strength, -EUCLEAN is never returned by mtd_read().
+                ecc_strength, -EUCLEAN is never returned by the read operations.
                Conversely, if bitflip_threshold is zero, -EUCLEAN is always
                returned, absent a hard error.
diff --git a/Documentation/ABI/testing/sysfs-driver-hid-lenovo-tpkbd b/Documentation/ABI/testing/sysfs-driver-hid-lenovo-tpkbd
new file mode 100644
index 000000000000..57b92cbdceae
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-driver-hid-lenovo-tpkbd
@@ -0,0 +1,38 @@
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/press_to_select
+Date:           July 2011
+Contact:        linux-input@vger.kernel.org
+Description:    This controls if mouse clicks should be generated if the trackpoint is quickly pressed. How fast this press has to be
+                is being controlled by press_speed.
+                Values are 0 or 1.
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/dragging
+Date:           July 2011
+Contact:        linux-input@vger.kernel.org
+Description:    If this setting is enabled, it is possible to do dragging by pressing the trackpoint. This requires press_to_select to be enabled.
+                Values are 0 or 1.
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/release_to_select
+Date:           July 2011
+Contact:        linux-input@vger.kernel.org
+Description:    For details regarding this setting please refer to http://www.pc.ibm.com/ww/healthycomputing/trkpntb.html
+                Values are 0 or 1.
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/select_right
+Date:           July 2011
+Contact:        linux-input@vger.kernel.org
+Description:    This setting controls if the mouse click events generated by pressing the trackpoint (if press_to_select is enabled) generate
+                a left or right mouse button click.
+                Values are 0 or 1.
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/sensitivity
+Date:           July 2011
+Contact:        linux-input@vger.kernel.org
+Description:    This file contains the trackpoint sensitivity.
+                Values are decimal integers from 1 (lowest sensitivity) to 255 (highest sensitivity).
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/press_speed
+Date:           July 2011
+Contact:        linux-input@vger.kernel.org
+Description:    This setting controls how fast the trackpoint needs to be pressed to generate a mouse click if press_to_select is enabled.
+                Values are decimal integers from 1 (slowest) to 255 (fastest).
diff --git a/Documentation/ABI/testing/sysfs-driver-hid-roccat-savu b/Documentation/ABI/testing/sysfs-driver-hid-roccat-savu
new file mode 100644
index 000000000000..b42922cf6b1f
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-driver-hid-roccat-savu
@@ -0,0 +1,77 @@
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/savu/roccatsavu<minor>/buttons
+Date:           Mai 2012
+Contact:        Stefan Achatz <erazor_de@users.sourceforge.net>
+Description:    The mouse can store 5 profiles which can be switched by the
+                press of a button. A profile is split into general settings and
+                button settings. buttons holds informations about button layout.
+                When written, this file lets one write the respective profile
+                buttons to the mouse. The data has to be 47 bytes long.
+                The mouse will reject invalid data.
+                Which profile to write is determined by the profile number
+                contained in the data.
+                Before reading this file, control has to be written to select
+                which profile to read.
+Users:          http://roccat.sourceforge.net
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/savu/roccatsavu<minor>/control
+Date:           Mai 2012
+Contact:        Stefan Achatz <erazor_de@users.sourceforge.net>
+Description:    When written, this file lets one select which data from which
+                profile will be read next. The data has to be 3 bytes long.
+                This file is writeonly.
+Users:          http://roccat.sourceforge.net
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/savu/roccatsavu<minor>/general
+Date:           Mai 2012
+Contact:        Stefan Achatz <erazor_de@users.sourceforge.net>
+Description:    The mouse can store 5 profiles which can be switched by the
+                press of a button. A profile is split into general settings and
+                button settings. profile holds informations like resolution, sensitivity
+                and light effects.
+                When written, this file lets one write the respective profile
+                settings back to the mouse. The data has to be 43 bytes long.
+                The mouse will reject invalid data.
+                Which profile to write is determined by the profile number
+                contained in the data.
+                This file is writeonly.
+Users:          http://roccat.sourceforge.net
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/savu/roccatsavu<minor>/info
+Date:           Mai 2012
+Contact:        Stefan Achatz <erazor_de@users.sourceforge.net>
+Description:    When read, this file returns general data like firmware version.
+                The data is 8 bytes long.
+                This file is readonly.
+Users:          http://roccat.sourceforge.net
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/savu/roccatsavu<minor>/macro
+Date:           Mai 2012
+Contact:        Stefan Achatz <erazor_de@users.sourceforge.net>
+Description:    When written, this file lets one store macros with max 500
+                keystrokes for a specific button for a specific profile.
+                Button and profile numbers are included in written data.
+                The data has to be 2083 bytes long.
+                Before reading this file, control has to be written to select
+                which profile and key to read.
+Users:          http://roccat.sourceforge.net
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/savu/roccatsavu<minor>/profile
+Date:           Mai 2012
+Contact:        Stefan Achatz <erazor_de@users.sourceforge.net>
+Description:    The mouse can store 5 profiles which can be switched by the
+                press of a button. profile holds number of actual profile.
+                This value is persistent, so its value determines the profile
+                that's active when the mouse is powered on next time.
+                When written, the mouse activates the set profile immediately.
+                The data has to be 3 bytes long.
+                The mouse will reject invalid data.
+Users:          http://roccat.sourceforge.net
+What:           /sys/bus/usb/devices/<busnum>-<devnum>:<config num>.<interface num>/<hid-bus>:<vendor-id>:<product-id>.<num>/savu/roccatsavu<minor>/sensor
+Date:           July 2012
+Contact:        Stefan Achatz <erazor_de@users.sourceforge.net>
+Description:    The mouse has a Avago ADNS-3090 sensor.
+                This file allows reading and writing of the mouse sensors registers.
+                The data has to be 4 bytes long.
+Users:          http://roccat.sourceforge.net
diff --git a/Documentation/DocBook/media/v4l/controls.xml b/Documentation/DocBook/media/v4l/controls.xml
index 676bc46f9c52..cda0dfb6769a 100644
--- a/Documentation/DocBook/media/v4l/controls.xml
+++ b/Documentation/DocBook/media/v4l/controls.xml
@@ -3988,7 +3988,7 @@ interface and may change in the future.</para>
            from RGB to Y'CbCr color space.
            </entry>
          </row>
-          <row id = "v4l2-jpeg-chroma-subsampling">
+          <row>
            <entrytbl spanname="descr" cols="2">
              <tbody valign="top">
                <row>
diff --git a/Documentation/DocBook/media/v4l/vidioc-g-ext-ctrls.xml b/Documentation/DocBook/media/v4l/vidioc-g-ext-ctrls.xml
index e3d5afcdafbb..0a4b90fcf2da 100644
--- a/Documentation/DocBook/media/v4l/vidioc-g-ext-ctrls.xml
+++ b/Documentation/DocBook/media/v4l/vidioc-g-ext-ctrls.xml
@@ -284,13 +284,6 @@ These controls are described in <xref
            processing controls. These controls are described in <xref
            linkend="image-process-controls" />.</entry>
          </row>
-          <row>
-            <entry><constant>V4L2_CTRL_CLASS_JPEG</constant></entry>
-            <entry>0x9d0000</entry>
-            <entry>The class containing JPEG compression controls.
-These controls are described in <xref
-                linkend="jpeg-controls" />.</entry>
-          </row>
        </tbody>
      </tgroup>
    </table>
diff --git a/Documentation/device-mapper/verity.txt b/Documentation/device-mapper/verity.txt
index 32e48797a14f..9884681535ee 100644
--- a/Documentation/device-mapper/verity.txt
+++ b/Documentation/device-mapper/verity.txt
@@ -7,39 +7,39 @@ This target is read-only.
 Construction Parameters
 =======================
-    <version> <dev> <hash_dev> <hash_start>
+    <version> <dev> <hash_dev>
    <data_block_size> <hash_block_size>
    <num_data_blocks> <hash_start_block>
    <algorithm> <digest> <salt>
 <version>
-    This is the version number of the on-disk format.
+    This is the type of the on-disk hash format.
    0 is the original format used in the Chromium OS.
-        The salt is appended when hashing, digests are stored continuously and
+      The salt is appended when hashing, digests are stored continuously and
-        the rest of the block is padded with zeros.
+      the rest of the block is padded with zeros.
    1 is the current format that should be used for new devices.
-        The salt is prepended when hashing and each digest is
+      The salt is prepended when hashing and each digest is
-        padded with zeros to the power of two.
+      padded with zeros to the power of two.
 <dev>
-    This is the device containing the data the integrity of which needs to be
+    This is the device containing data, the integrity of which needs to be
    checked.  It may be specified as a path, like /dev/sdaX, or a device number,
    <major>:<minor>.
 <hash_dev>
-    This is the device that that supplies the hash tree data.  It may be
+    This is the device that supplies the hash tree data.  It may be
    specified similarly to the device path and may be the same device.  If the
-    same device is used, the hash_start should be outside of the dm-verity
+    same device is used, the hash_start should be outside the configured
-    configured device size.
+    dm-verity device.
 <data_block_size>
-    The block size on a data device.  Each block corresponds to one digest on
+    The block size on a data device in bytes.
-    the hash device.
+    Each block corresponds to one digest on the hash device.
 <hash_block_size>
-    The size of a hash block.
+    The size of a hash block in bytes.
 <num_data_blocks>
    The number of data blocks on the data device.  Additional blocks are
@@ -65,7 +65,7 @@ Construction Parameters
 Theory of operation
 ===================
-dm-verity is meant to be setup as part of a verified boot path.  This
+dm-verity is meant to be set up as part of a verified boot path.  This
 may be anything ranging from a boot using tboot or trustedgrub to just
 booting from a known-good device (like a USB drive or CD).
@@ -73,20 +73,20 @@ When a dm-verity device is configured, it is expected that the caller
 has been authenticated in some way (cryptographic signatures, etc).
 After instantiation, all hashes will be verified on-demand during
 disk access.  If they cannot be verified up to the root node of the
-tree, the root hash, then the I/O will fail.  This should identify
+tree, the root hash, then the I/O will fail.  This should detect
 tampering with any data on the device and the hash data.
 Cryptographic hashes are used to assert the integrity of the device on a
-per-block basis.  This allows for a lightweight hash computation on first read
+per-block basis. This allows for a lightweight hash computation on first read
-into the page cache.  Block hashes are stored linearly-aligned to the nearest
+into the page cache. Block hashes are stored linearly, aligned to the nearest
-block the size of a page.
+block size.
 Hash Tree
 ---------
 Each node in the tree is a cryptographic hash.  If it is a leaf node, the hash
-is of some block data on disk.  If it is an intermediary node, then the hash is
+of some data block on disk is calculated. If it is an intermediary node,
-of a number of child nodes.
+the hash of a number of child nodes is calculated.
 Each entry in the tree is a collection of neighboring nodes that fit in one
 block.  The number is determined based on block_size and the size of the
@@ -110,63 +110,23 @@ alg = sha256, num_blocks = 32768, block_size = 4096
 On-disk format
 ==============
-Below is the recommended on-disk format. The verity kernel code does not
+The verity kernel code does not read the verity metadata on-disk header.
-read the on-disk header. It only reads the hash blocks which directly
+It only reads the hash blocks which directly follow the header.
-follow the header. It is expected that a user-space tool will verify the
+It is expected that a user-space tool will verify the integrity of the
-integrity of the verity_header and then call dmsetup with the correct
+verity header.
-parameters. Alternatively, the header can be omitted and the dmsetup
-parameters can be passed via the kernel command-line in a rooted chain
-of trust where the command-line is verified.
-The on-disk format is especially useful in cases where the hash blocks
+Alternatively, the header can be omitted and the dmsetup parameters can
-are on a separate partition. The magic number allows easy identification
+be passed via the kernel command-line in a rooted chain of trust where
-of the partition contents. Alternatively, the hash blocks can be stored
+the command-line is verified.
-in the same partition as the data to be verified. In such a configuration
-the filesystem on the partition would be sized a little smaller than
-the full-partition, leaving room for the hash blocks.
-struct superblock {
-        uint8_t signature[8]
-                "verity\0\0";
-        uint8_t version;
-                1 - current format
-        uint8_t data_block_bits;
-                log2(data block size)
-        uint8_t hash_block_bits;
-                log2(hash block size)
-        uint8_t pad1[1];
-                zero padding
-        uint16_t salt_size;
-                big-endian salt size
-        uint8_t pad2[2];
-                zero padding
-        uint32_t data_blocks_hi;
-                big-endian high 32 bits of the 64-bit number of data blocks
-        uint32_t data_blocks_lo;
-                big-endian low 32 bits of the 64-bit number of data blocks
-        uint8_t algorithm[16];
-                cryptographic algorithm
-        uint8_t salt[384];
-                salt (the salt size is specified above)
-        uint8_t pad3[88];
-                zero padding to 512-byte boundary
-}
 Directly following the header (and with sector number padded to the next hash
 block boundary) are the hash blocks which are stored a depth at a time
 (starting from the root), sorted in order of increasing index.
+The full specification of kernel parameters and on-disk metadata format
+is available at the cryptsetup project's wiki page
+  http://code.google.com/p/cryptsetup/wiki/DMVerity
 Status
 ======
 V (for Valid) is returned if every check performed so far was valid.
@@ -174,21 +134,22 @@ If any check failed, C (for Corruption) is returned.
 Example
 =======
+Set up a device:
-Setup a device:
+  # dmsetup create vroot --readonly --table \
-  dmsetup create vroot --table \
+    "0 2097152 verity 1 /dev/sda1 /dev/sda2 4096 4096 262144 1 sha256 "\
-    "0 2097152 "\
-    "verity 1 /dev/sda1 /dev/sda2 4096 4096 2097152 1 "\
    "4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076 "\
    "1234000000000000000000000000000000000000000000000000000000000000"
 A command line tool veritysetup is available to compute or verify
-the hash tree or activate the kernel driver.  This is available from
+the hash tree or activate the kernel device. This is available from
-the LVM2 upstream repository and may be supplied as a package called
+the cryptsetup upstream repository http://code.google.com/p/cryptsetup/
-device-mapper-verity-tools:
+(as a libcryptsetup extension).
-    git://sources.redhat.com/git/lvm2
-    http://sourceware.org/git/?p=lvm2.git
+Create hash on the device:
-    http://sourceware.org/cgi-bin/cvsweb.cgi/LVM2/verity?cvsroot=lvm2
+  # veritysetup format /dev/sda1 /dev/sda2
+  ...
-veritysetup -a vroot /dev/sda1 /dev/sda2 \
+  Root hash: 4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076
-        4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076
+Activate the device:
+  # veritysetup create vroot /dev/sda1 /dev/sda2 \
+    4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076
diff --git a/Documentation/devicetree/bindings/input/fsl-mma8450.txt b/Documentation/devicetree/bindings/input/fsl-mma8450.txt
index a00c94ccbdee..0b96e5737d3a 100644
--- a/Documentation/devicetree/bindings/input/fsl-mma8450.txt
+++ b/Documentation/devicetree/bindings/input/fsl-mma8450.txt
@@ -2,6 +2,7 @@
 Required properties:
 - compatible : "fsl,mma8450".
+- reg: the I2C address of MMA8450
 Example:
diff --git a/Documentation/devicetree/bindings/mfd/mc13xxx.txt b/Documentation/devicetree/bindings/mfd/mc13xxx.txt
index 19f6af47a792..baf07987ae68 100644
--- a/Documentation/devicetree/bindings/mfd/mc13xxx.txt
+++ b/Documentation/devicetree/bindings/mfd/mc13xxx.txt
@@ -46,8 +46,8 @@ Examples:
 ecspi@70010000 { /* ECSPI1 */
        fsl,spi-num-chipselects = <2>;
-        cs-gpios = <&gpio3 24 0>, /* GPIO4_24 */
+        cs-gpios = <&gpio4 24 0>, /* GPIO4_24 */
-                   <&gpio3 25 0>; /* GPIO4_25 */
+                   <&gpio4 25 0>; /* GPIO4_25 */
        status = "okay";
        pmic: mc13892@0 {
diff --git a/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt b/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt
index c7e404b3ef05..fea541ee8b34 100644
--- a/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt
+++ b/Documentation/devicetree/bindings/mmc/fsl-imx-esdhc.txt
@@ -29,6 +29,6 @@ esdhc@70008000 {
        compatible = "fsl,imx51-esdhc";
        reg = <0x70008000 0x4000>;
        interrupts = <2>;
-        cd-gpios = <&gpio0 6 0>; /* GPIO1_6 */
+        cd-gpios = <&gpio1 6 0>; /* GPIO1_6 */
-        wp-gpios = <&gpio0 5 0>; /* GPIO1_5 */
+        wp-gpios = <&gpio1 5 0>; /* GPIO1_5 */
 };
diff --git a/Documentation/devicetree/bindings/net/fsl-fec.txt b/Documentation/devicetree/bindings/net/fsl-fec.txt
index 7ab9e1a2d8be..4616fc28ee86 100644
--- a/Documentation/devicetree/bindings/net/fsl-fec.txt
+++ b/Documentation/devicetree/bindings/net/fsl-fec.txt
@@ -19,6 +19,6 @@ ethernet@83fec000 {
        reg = <0x83fec000 0x4000>;
        interrupts = <87>;
        phy-mode = "mii";
-        phy-reset-gpios = <&gpio1 14 0>; /* GPIO2_14 */
+        phy-reset-gpios = <&gpio2 14 0>; /* GPIO2_14 */
        local-mac-address = [00 04 9F 01 1B B9];
 };
diff --git a/Documentation/devicetree/bindings/pinctrl/fsl,imx6q-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/fsl,imx6q-pinctrl.txt
index 82b43f915857..a4119f6422d9 100644
--- a/Documentation/devicetree/bindings/pinctrl/fsl,imx6q-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/fsl,imx6q-pinctrl.txt
@@ -1626,3 +1626,5 @@ MX6Q_PAD_SD2_DAT3__PCIE_CTRL_MUX_11		1587
 MX6Q_PAD_SD2_DAT3__GPIO_1_12                    1588
 MX6Q_PAD_SD2_DAT3__SJC_DONE                     1589
 MX6Q_PAD_SD2_DAT3__ANATOP_TESTO_3               1590
+MX6Q_PAD_ENET_RX_ER__ANATOP_USBOTG_ID           1591
+MX6Q_PAD_GPIO_1__ANATOP_USBOTG_ID               1592
diff --git a/Documentation/devicetree/bindings/spi/fsl-imx-cspi.txt b/Documentation/devicetree/bindings/spi/fsl-imx-cspi.txt
index 9841057d112b..4256a6df9b79 100644
--- a/Documentation/devicetree/bindings/spi/fsl-imx-cspi.txt
+++ b/Documentation/devicetree/bindings/spi/fsl-imx-cspi.txt
@@ -17,6 +17,6 @@ ecspi@70010000 {
        reg = <0x70010000 0x4000>;
        interrupts = <36>;
        fsl,spi-num-chipselects = <2>;
-        cs-gpios = <&gpio3 24 0>, /* GPIO4_24 */
+        cs-gpios = <&gpio3 24 0>, /* GPIO3_24 */
-                   <&gpio3 25 0>; /* GPIO4_25 */
+                   <&gpio3 25 0>; /* GPIO3_25 */
 };
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index 6eab91747a86..db4d3af3643c 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -3,6 +3,7 @@ Device tree binding vendor prefix registry.  Keep list in alphabetical order.
 This isn't an exhaustive list, but you should add new prefixes to it before
 using them to avoid name-space collisions.
+ad      Avionic Design GmbH
 adi     Analog Devices, Inc.
 amcc    Applied Micro Circuits Corporation (APM, formally AMCC)
 apm     Applied Micro Circuits Corporation (APM)
diff --git a/Documentation/kdump/kdump.txt b/Documentation/kdump/kdump.txt
index 506c7390c2b9..13f1aa09b938 100644
--- a/Documentation/kdump/kdump.txt
+++ b/Documentation/kdump/kdump.txt
@@ -86,7 +86,7 @@ There is also a gitweb interface available at
 http://www.kernel.org/git/?p=utils/kernel/kexec/kexec-tools.git
 More information about kexec-tools can be found at
-http://www.kernel.org/pub/linux/utils/kernel/kexec/README.html
+http://horms.net/projects/kexec/
 3) Unpack the tarball with the tar command, as follows:
diff --git a/Documentation/prctl/no_new_privs.txt b/Documentation/prctl/no_new_privs.txt
new file mode 100644
index 000000000000..f7be84fba910
--- /dev/null
+++ b/Documentation/prctl/no_new_privs.txt
@@ -0,0 +1,57 @@
+The execve system call can grant a newly-started program privileges that
+its parent did not have.  The most obvious examples are setuid/setgid
+programs and file capabilities.  To prevent the parent program from
+gaining these privileges as well, the kernel and user code must be
+careful to prevent the parent from doing anything that could subvert the
+child.  For example:
+ - The dynamic loader handles LD_* environment variables differently if
+   a program is setuid.
+ - chroot is disallowed to unprivileged processes, since it would allow
+   /etc/passwd to be replaced from the point of view of a process that
+   inherited chroot.
+ - The exec code has special handling for ptrace.
+These are all ad-hoc fixes.  The no_new_privs bit (since Linux 3.5) is a
+new, generic mechanism to make it safe for a process to modify its
+execution environment in a manner that persists across execve.  Any task
+can set no_new_privs.  Once the bit is set, it is inherited across fork,
+clone, and execve and cannot be unset.  With no_new_privs set, execve
+promises not to grant the privilege to do anything that could not have
+been done without the execve call.  For example, the setuid and setgid
+bits will no longer change the uid or gid; file capabilities will not
+add to the permitted set, and LSMs will not relax constraints after
+execve.
+To set no_new_privs, use prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0).
+Be careful, though: LSMs might also not tighten constraints on exec
+in no_new_privs mode.  (This means that setting up a general-purpose
+service launcher to set no_new_privs before execing daemons may
+interfere with LSM-based sandboxing.)
+Note that no_new_privs does not prevent privilege changes that do not
+involve execve.  An appropriately privileged task can still call
+setuid(2) and receive SCM_RIGHTS datagrams.
+There are two main use cases for no_new_privs so far:
+ - Filters installed for the seccomp mode 2 sandbox persist across
+   execve and can change the behavior of newly-executed programs.
+   Unprivileged users are therefore only allowed to install such filters
+   if no_new_privs is set.
+ - By itself, no_new_privs can be used to reduce the attack surface
+   available to an unprivileged user.  If everything running with a
+   given uid has no_new_privs set, then that uid will be unable to
+   escalate its privileges by directly attacking setuid, setgid, and
+   fcap-using binaries; it will need to compromise something without the
+   no_new_privs bit set first.
+In the future, other potentially dangerous kernel features could become
+available to unprivileged tasks if no_new_privs is set.  In principle,
+several options to unshare(2) and clone(2) would be safe when
+no_new_privs is set, and no_new_privs + chroot is considerable less
+dangerous than chroot by itself.
diff --git a/Documentation/stable_kernel_rules.txt b/Documentation/stable_kernel_rules.txt
index f0ab5cf28fca..4a7b54bd37e8 100644
--- a/Documentation/stable_kernel_rules.txt
+++ b/Documentation/stable_kernel_rules.txt
@@ -12,6 +12,12 @@ Rules on what kind of patches are accepted, and which ones are not, into the
   marked CONFIG_BROKEN), an oops, a hang, data corruption, a real
   security issue, or some "oh, that's not good" issue.  In short, something
   critical.
+ - Serious issues as reported by a user of a distribution kernel may also
+   be considered if they fix a notable performance or interactivity issue.
+   As these fixes are not as obvious and have a higher risk of a subtle
+   regression they should only be submitted by a distribution kernel
+   maintainer and include an addendum linking to a bugzilla entry if it
+   exists and additional information on the user-visible impact.
 - New device IDs and quirks are also accepted.
 - No "theoretical race condition" issues, unless an explanation of how the
   race can be exploited is also provided.
diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
index 930126698a0f..2c9948379469 100644
--- a/Documentation/virtual/kvm/api.txt
+++ b/Documentation/virtual/kvm/api.txt
@@ -1930,6 +1930,23 @@ The "pte_enc" field provides a value that can OR'ed into the hash
 PTE's RPN field (ie, it needs to be shifted left by 12 to OR it
 into the hash PTE second double word).
+4.75 KVM_IRQFD
+Capability: KVM_CAP_IRQFD
+Architectures: x86
+Type: vm ioctl
+Parameters: struct kvm_irqfd (in)
+Returns: 0 on success, -1 on error
+Allows setting an eventfd to directly trigger a guest interrupt.
+kvm_irqfd.fd specifies the file descriptor to use as the eventfd and
+kvm_irqfd.gsi specifies the irqchip pin toggled by this event.  When
+an event is tiggered on the eventfd, an interrupt is injected into
+the guest using the specified gsi pin.  The irqfd is removed using
+the KVM_IRQFD_FLAG_DEASSIGN flag, specifying both kvm_irqfd.fd
+and kvm_irqfd.gsi.
 5. The kvm_run structure
 ------------------------
diff --git a/MAINTAINERS b/MAINTAINERS
index eb22272b2116..c82c343168e8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3433,13 +3433,14 @@ S:	Supported
 F:      drivers/idle/i7300_idle.c
 IEEE 802.15.4 SUBSYSTEM
+M:      Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
 M:      Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
-M:      Sergey Lapin <slapin@ossfans.org>
 L:      linux-zigbee-devel@lists.sourceforge.net (moderated for non-subscribers)
 W:      http://apps.sourceforge.net/trac/linux-zigbee
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/lowpan/lowpan.git
 S:      Maintained
 F:      net/ieee802154/
+F:      net/mac802154/
 F:      drivers/ieee802154/
 IIO SUBSYSTEM AND DRIVERS
@@ -4654,8 +4655,8 @@ L:	netfilter@vger.kernel.org
 L:      coreteam@netfilter.org
 W:      http://www.netfilter.org/
 W:      http://www.iptables.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-2.6.git
+T:      git git://1984.lsi.us.es/nf
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next-2.6.git
+T:      git git://1984.lsi.us.es/nf-next
 S:      Supported
 F:      include/linux/netfilter*
 F:      include/linux/netfilter/
@@ -4857,6 +4858,7 @@ M:	Kevin Hilman <khilman@ti.com>
 L:      linux-omap@vger.kernel.org
 S:      Maintained
 F:      arch/arm/*omap*/*pm*
+F:      drivers/cpufreq/omap-cpufreq.c
 OMAP POWERDOMAIN/CLOCKDOMAIN SOC ADAPTATION LAYER SUPPORT
 M:      Rajendra Nayak <rnayak@ti.com>
@@ -5909,7 +5911,7 @@ M:	Ingo Molnar <mingo@redhat.com>
 M:      Peter Zijlstra <peterz@infradead.org>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git sched/core
 S:      Maintained
-F:      kernel/sched*
+F:      kernel/sched/
 F:      include/linux/sched.h
 SCORE ARCHITECTURE
diff --git a/Makefile b/Makefile
index 3fdfde2c1b7d..aa8e315f26ef 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 5
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc7
 NAME = Saber-toothed Squirrel
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/spear13xx.dtsi b/arch/arm/boot/dts/spear13xx.dtsi
index 10dcec7e7321..f7b84aced654 100644
--- a/arch/arm/boot/dts/spear13xx.dtsi
+++ b/arch/arm/boot/dts/spear13xx.dtsi
@@ -43,8 +43,8 @@
        pmu {
                compatible = "arm,cortex-a9-pmu";
-                interrupts = <0 8 0x04
+                interrupts = <0 6 0x04
-                              0 9 0x04>;
+                              0 7 0x04>;
        };
        L2: l2-cache {
@@ -119,8 +119,8 @@
                gmac0: eth@e2000000 {
                        compatible = "st,spear600-gmac";
                        reg = <0xe2000000 0x8000>;
-                        interrupts = <0 23 0x4
+                        interrupts = <0 33 0x4
-                                      0 24 0x4>;
+                                      0 34 0x4>;
                        interrupt-names = "macirq", "eth_wake_irq";
                        status = "disabled";
                };
@@ -202,6 +202,7 @@
                        kbd@e0300000 {
                                compatible = "st,spear300-kbd";
                                reg = <0xe0300000 0x1000>;
+                                interrupts = <0 52 0x4>;
                                status = "disabled";
                        };
@@ -224,7 +225,7 @@
                        serial@e0000000 {
                                compatible = "arm,pl011", "arm,primecell";
                                reg = <0xe0000000 0x1000>;
-                                interrupts = <0 36 0x4>;
+                                interrupts = <0 35 0x4>;
                                status = "disabled";
                        };
diff --git a/arch/arm/boot/dts/spear320-evb.dts b/arch/arm/boot/dts/spear320-evb.dts
index c13fd1f3b09f..e4e912f95024 100644
--- a/arch/arm/boot/dts/spear320-evb.dts
+++ b/arch/arm/boot/dts/spear320-evb.dts
@@ -15,8 +15,8 @@
 /include/ "spear320.dtsi"
 / {
-        model = "ST SPEAr300 Evaluation Board";
+        model = "ST SPEAr320 Evaluation Board";
-        compatible = "st,spear300-evb", "st,spear300";
+        compatible = "st,spear320-evb", "st,spear320";
        #address-cells = <1>;
        #size-cells = <1>;
@@ -26,7 +26,7 @@
        ahb {
                pinmux@b3000000 {
-                        st,pinmux-mode = <3>;
+                        st,pinmux-mode = <4>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&state_default>;
diff --git a/arch/arm/boot/dts/spear600.dtsi b/arch/arm/boot/dts/spear600.dtsi
index 089f0a42c50e..a3c36e47d7ef 100644
--- a/arch/arm/boot/dts/spear600.dtsi
+++ b/arch/arm/boot/dts/spear600.dtsi
@@ -181,6 +181,7 @@
                        timer@f0000000 {
                                compatible = "st,spear-timer";
                                reg = <0xf0000000 0x400>;
+                                interrupt-parent = <&vic0>;
                                interrupts = <16>;
                        };
                };
diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index 9854ff4279e0..11828e632532 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -176,7 +176,6 @@ CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_DEVICEFS=y
 CONFIG_USB_SUSPEND=y
 CONFIG_USB_MON=y
-CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_WDM=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_LIBUSUAL=y
diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
index 68374ba6a943..c79f61faa3a5 100644
--- a/arch/arm/include/asm/atomic.h
+++ b/arch/arm/include/asm/atomic.h
@@ -243,7 +243,7 @@ typedef struct {
 #define ATOMIC64_INIT(i) { (i) }
-static inline u64 atomic64_read(atomic64_t *v)
+static inline u64 atomic64_read(const atomic64_t *v)
 {
        u64 result;
diff --git a/arch/arm/include/asm/domain.h b/arch/arm/include/asm/domain.h
index 3d2220498abc..6ddbe446425e 100644
--- a/arch/arm/include/asm/domain.h
+++ b/arch/arm/include/asm/domain.h
@@ -60,13 +60,13 @@
 #ifndef __ASSEMBLY__
 #ifdef CONFIG_CPU_USE_DOMAINS
-#define set_domain(x)                                   \
+static inline void set_domain(unsigned val)
-        do {                                            \
+{
-        __asm__ __volatile__(                           \
+        asm volatile(
-        "mcr    p15, 0, %0, c3, c0      @ set domain"   \
+        "mcr    p15, 0, %0, c3, c0      @ set domain"
-          : : "r" (x));                                 \
+          : : "r" (val));
-        isb();                                          \
+        isb();
-        } while (0)
+}
 #define modify_domain(dom,type)                                 \
        do {                                                    \
@@ -78,8 +78,8 @@
        } while (0)
 #else
-#define set_domain(x)           do { } while (0)
+static inline void set_domain(unsigned val) { }
-#define modify_domain(dom,type) do { } while (0)
+static inline void modify_domain(unsigned dom, unsigned type)   { }
 #endif
 /*
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index b79f8e97f775..af7b0bda3355 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -148,7 +148,6 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
 #define TIF_NOTIFY_RESUME       2       /* callback before returning to user */
 #define TIF_SYSCALL_TRACE       8
 #define TIF_SYSCALL_AUDIT       9
-#define TIF_SYSCALL_RESTARTSYS  10
 #define TIF_POLLING_NRFLAG      16
 #define TIF_USING_IWMMXT        17
 #define TIF_MEMDIE              18      /* is terminating due to OOM killer */
@@ -164,11 +163,9 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
 #define _TIF_POLLING_NRFLAG     (1 << TIF_POLLING_NRFLAG)
 #define _TIF_USING_IWMMXT       (1 << TIF_USING_IWMMXT)
 #define _TIF_SECCOMP            (1 << TIF_SECCOMP)
-#define _TIF_SYSCALL_RESTARTSYS (1 << TIF_SYSCALL_RESTARTSYS)
 /* Checks for any syscall work in entry-common.S */
-#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
+#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT)
-                           _TIF_SYSCALL_RESTARTSYS)
 /*
 * Change these and you break ASM code in entry-common.S
diff --git a/arch/arm/kernel/kprobes-test-arm.c b/arch/arm/kernel/kprobes-test-arm.c
index ba32b393b3f0..38c1a3b103a0 100644
--- a/arch/arm/kernel/kprobes-test-arm.c
+++ b/arch/arm/kernel/kprobes-test-arm.c
@@ -187,8 +187,8 @@ void kprobe_arm_test_cases(void)
        TEST_BF_R ("mov pc, r",0,2f,"")
        TEST_BF_RR("mov pc, r",0,2f,", asl r",1,0,"")
        TEST_BB(   "sub pc, pc, #1b-2b+8")
-#if __LINUX_ARM_ARCH__ >= 6
+#if __LINUX_ARM_ARCH__ == 6 && !defined(CONFIG_CPU_V7)
-        TEST_BB(   "sub pc, pc, #1b-2b+8-2") /* UNPREDICTABLE before ARMv6 */
+        TEST_BB(   "sub pc, pc, #1b-2b+8-2") /* UNPREDICTABLE before and after ARMv6 */
 #endif
        TEST_BB_R( "sub pc, pc, r",14, 1f-2f+8,"")
        TEST_BB_R( "rsb pc, r",14,1f-2f+8,", pc")
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 186c8cb982c5..a02eada3aa5d 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -503,7 +503,7 @@ __hw_perf_event_init(struct perf_event *event)
             event_requires_mode_exclusion(&event->attr)) {
                pr_debug("ARM performance counters do not support "
                         "mode exclusion\n");
-                return -EPERM;
+                return -EOPNOTSUPP;
        }
        /*
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 5700a7ae7f0b..14e38261cd31 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -25,7 +25,6 @@
 #include <linux/regset.h>
 #include <linux/audit.h>
 #include <linux/tracehook.h>
-#include <linux/unistd.h>
 #include <asm/pgtable.h>
 #include <asm/traps.h>
@@ -918,8 +917,6 @@ asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
                audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0,
                                    regs->ARM_r1, regs->ARM_r2, regs->ARM_r3);
-        if (why == 0 && test_and_clear_thread_flag(TIF_SYSCALL_RESTARTSYS))
-                scno = __NR_restart_syscall - __NR_SYSCALL_BASE;
        if (!test_thread_flag(TIF_SYSCALL_TRACE))
                return scno;
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index fd2392a17ac1..536c5d6b340b 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -27,6 +27,7 @@
 */
 #define SWI_SYS_SIGRETURN       (0xef000000|(__NR_sigreturn)|(__NR_OABI_SYSCALL_BASE))
 #define SWI_SYS_RT_SIGRETURN    (0xef000000|(__NR_rt_sigreturn)|(__NR_OABI_SYSCALL_BASE))
+#define SWI_SYS_RESTART         (0xef000000|__NR_restart_syscall|__NR_OABI_SYSCALL_BASE)
 /*
 * With EABI, the syscall number has to be loaded into r7.
@@ -47,6 +48,18 @@ const unsigned long sigreturn_codes[7] = {
 };
 /*
+ * Either we support OABI only, or we have EABI with the OABI
+ * compat layer enabled.  In the later case we don't know if
+ * user space is EABI or not, and if not we must not clobber r7.
+ * Always using the OABI syscall solves that issue and works for
+ * all those cases.
+ */
+const unsigned long syscall_restart_code[2] = {
+        SWI_SYS_RESTART,        /* swi  __NR_restart_syscall */
+        0xe49df004,             /* ldr  pc, [sp], #4 */
+};
+/*
 * atomically swap in the new signal mask, and wait for a signal.
 */
 asmlinkage int sys_sigsuspend(int restart, unsigned long oldmask, old_sigset_t mask)
@@ -592,10 +605,12 @@ static void do_signal(struct pt_regs *regs, int syscall)
                case -ERESTARTNOHAND:
                case -ERESTARTSYS:
                case -ERESTARTNOINTR:
-                case -ERESTART_RESTARTBLOCK:
                        regs->ARM_r0 = regs->ARM_ORIG_r0;
                        regs->ARM_pc = restart_addr;
                        break;
+                case -ERESTART_RESTARTBLOCK:
+                        regs->ARM_r0 = -EINTR;
+                        break;
                }
        }
@@ -611,14 +626,12 @@ static void do_signal(struct pt_regs *regs, int syscall)
                 * debugger has chosen to restart at a different PC.
                 */
                if (regs->ARM_pc == restart_addr) {
-                        if (retval == -ERESTARTNOHAND ||
+                        if (retval == -ERESTARTNOHAND
-                            retval == -ERESTART_RESTARTBLOCK
                            || (retval == -ERESTARTSYS
                                && !(ka.sa.sa_flags & SA_RESTART))) {
                                regs->ARM_r0 = -EINTR;
                                regs->ARM_pc = continue_addr;
                        }
-                        clear_thread_flag(TIF_SYSCALL_RESTARTSYS);
                }
                handle_signal(signr, &ka, &info, regs);
@@ -632,8 +645,29 @@ static void do_signal(struct pt_regs *regs, int syscall)
                 * ignore the restart.
                 */
                if (retval == -ERESTART_RESTARTBLOCK
-                    && regs->ARM_pc == restart_addr)
+                    && regs->ARM_pc == continue_addr) {
-                        set_thread_flag(TIF_SYSCALL_RESTARTSYS);
+                        if (thumb_mode(regs)) {
+                                regs->ARM_r7 = __NR_restart_syscall - __NR_SYSCALL_BASE;
+                                regs->ARM_pc -= 2;
+                        } else {
+#if defined(CONFIG_AEABI) && !defined(CONFIG_OABI_COMPAT)
+                                regs->ARM_r7 = __NR_restart_syscall;
+                                regs->ARM_pc -= 4;
+#else
+                                u32 __user *usp;
+                                regs->ARM_sp -= 4;
+                                usp = (u32 __user *)regs->ARM_sp;
+                                if (put_user(regs->ARM_pc, usp) == 0) {
+                                        regs->ARM_pc = KERN_RESTART_CODE;
+                                } else {
+                                        regs->ARM_sp += 4;
+                                        force_sigsegv(0, current);
+                                }
+#endif
+                        }
+                }
        }
        restore_saved_sigmask();
diff --git a/arch/arm/kernel/signal.h b/arch/arm/kernel/signal.h
index 5ff067b7c752..6fcfe8398aa4 100644
--- a/arch/arm/kernel/signal.h
+++ b/arch/arm/kernel/signal.h
@@ -8,5 +8,7 @@
 * published by the Free Software Foundation.
 */
 #define KERN_SIGRETURN_CODE     (CONFIG_VECTORS_BASE + 0x00000500)
+#define KERN_RESTART_CODE       (KERN_SIGRETURN_CODE + sizeof(sigreturn_codes))
 extern const unsigned long sigreturn_codes[7];
+extern const unsigned long syscall_restart_code[2];
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 4928d89758f4..3647170e9a16 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -820,6 +820,8 @@ void __init early_trap_init(void *vectors_base)
         */
        memcpy((void *)(vectors + KERN_SIGRETURN_CODE - CONFIG_VECTORS_BASE),
               sigreturn_codes, sizeof(sigreturn_codes));
+        memcpy((void *)(vectors + KERN_RESTART_CODE - CONFIG_VECTORS_BASE),
+               syscall_restart_code, sizeof(syscall_restart_code));
        flush_icache_range(vectors, vectors + PAGE_SIZE);
        modify_domain(DOMAIN_USER, DOMAIN_CLIENT);
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index 43a31fb06318..36ff15bbfdd4 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -183,7 +183,9 @@ SECTIONS
        }
 #endif
+#ifdef CONFIG_SMP
        PERCPU_SECTION(L1_CACHE_BYTES)
+#endif
 #ifdef CONFIG_XIP_KERNEL
        __data_loc = ALIGN(4);          /* location in binary */
diff --git a/arch/arm/mach-dove/include/mach/bridge-regs.h b/arch/arm/mach-dove/include/mach/bridge-regs.h
index 226949dc4ac0..f953bb54aa9d 100644
--- a/arch/arm/mach-dove/include/mach/bridge-regs.h
+++ b/arch/arm/mach-dove/include/mach/bridge-regs.h
@@ -50,5 +50,6 @@
 #define POWER_MANAGEMENT        (BRIDGE_VIRT_BASE | 0x011c)
 #define TIMER_VIRT_BASE         (BRIDGE_VIRT_BASE | 0x0300)
+#define TIMER_PHYS_BASE         (BRIDGE_PHYS_BASE | 0x0300)
 #endif
diff --git a/arch/arm/mach-dove/include/mach/dove.h b/arch/arm/mach-dove/include/mach/dove.h
index ad1165d488c1..d52b0ef313b7 100644
--- a/arch/arm/mach-dove/include/mach/dove.h
+++ b/arch/arm/mach-dove/include/mach/dove.h
@@ -78,6 +78,7 @@
 /* North-South Bridge */
 #define BRIDGE_VIRT_BASE        (DOVE_SB_REGS_VIRT_BASE | 0x20000)
+#define BRIDGE_PHYS_BASE        (DOVE_SB_REGS_PHYS_BASE | 0x20000)
 /* Cryptographic Engine */
 #define DOVE_CRYPT_PHYS_BASE    (DOVE_SB_REGS_PHYS_BASE | 0x30000)
diff --git a/arch/arm/mach-exynos/Kconfig b/arch/arm/mach-exynos/Kconfig
index 573be57d3d28..6f6d13f91e4c 100644
--- a/arch/arm/mach-exynos/Kconfig
+++ b/arch/arm/mach-exynos/Kconfig
@@ -212,7 +212,7 @@ config MACH_SMDKV310
        select EXYNOS_DEV_SYSMMU
        select EXYNOS4_DEV_AHCI
        select SAMSUNG_DEV_KEYPAD
-        select EXYNOS4_DEV_DMA
+        select EXYNOS_DEV_DMA
        select SAMSUNG_DEV_PWM
        select EXYNOS4_DEV_USB_OHCI
        select EXYNOS4_SETUP_FIMD0
@@ -264,7 +264,7 @@ config MACH_UNIVERSAL_C210
        select S5P_DEV_ONENAND
        select S5P_DEV_TV
        select EXYNOS_DEV_SYSMMU
-        select EXYNOS4_DEV_DMA
+        select EXYNOS_DEV_DMA
        select EXYNOS_DEV_DRM
        select EXYNOS4_SETUP_FIMD0
        select EXYNOS4_SETUP_I2C1
@@ -303,7 +303,7 @@ config MACH_NURI
        select S5P_DEV_MFC
        select S5P_DEV_USB_EHCI
        select S5P_SETUP_MIPIPHY
-        select EXYNOS4_DEV_DMA
+        select EXYNOS_DEV_DMA
        select EXYNOS_DEV_DRM
        select EXYNOS4_SETUP_FIMC
        select EXYNOS4_SETUP_FIMD0
@@ -341,7 +341,7 @@ config MACH_ORIGEN
        select SAMSUNG_DEV_PWM
        select EXYNOS_DEV_DRM
        select EXYNOS_DEV_SYSMMU
-        select EXYNOS4_DEV_DMA
+        select EXYNOS_DEV_DMA
        select EXYNOS4_DEV_USB_OHCI
        select EXYNOS4_SETUP_FIMD0
        select EXYNOS4_SETUP_SDHCI
diff --git a/arch/arm/mach-exynos/pm_domains.c b/arch/arm/mach-exynos/pm_domains.c
index e9fafcf163de..373c3c00d24c 100644
--- a/arch/arm/mach-exynos/pm_domains.c
+++ b/arch/arm/mach-exynos/pm_domains.c
@@ -119,7 +119,9 @@ static __init void exynos_pm_add_dev_to_genpd(struct platform_device *pdev,
                                                struct exynos_pm_domain *pd)
 {
        if (pdev->dev.bus) {
-                if (pm_genpd_add_device(&pd->pd, &pdev->dev))
+                if (!pm_genpd_add_device(&pd->pd, &pdev->dev))
+                        pm_genpd_dev_need_restore(&pdev->dev, true);
+                else
                        pr_info("%s: error in adding %s device to %s power"
                                "domain\n", __func__, dev_name(&pdev->dev),
                                pd->name);
@@ -151,9 +153,12 @@ static __init int exynos4_pm_init_power_domain(void)
        if (of_have_populated_dt())
                return exynos_pm_dt_parse_domains();
-        for (idx = 0; idx < ARRAY_SIZE(exynos4_pm_domains); idx++)
+        for (idx = 0; idx < ARRAY_SIZE(exynos4_pm_domains); idx++) {
-                pm_genpd_init(&exynos4_pm_domains[idx]->pd, NULL,
+                struct exynos_pm_domain *pd = exynos4_pm_domains[idx];
-                                exynos4_pm_domains[idx]->is_off);
+                int on = __raw_readl(pd->base + 0x4) & S5P_INT_LOCAL_PWR_EN;
+                pm_genpd_init(&pd->pd, NULL, !on);
+        }
 #ifdef CONFIG_S5P_DEV_FIMD0
        exynos_pm_add_dev_to_genpd(&s5p_device_fimd0, &exynos4_pd_lcd0);
diff --git a/arch/arm/mach-imx/clk-imx35.c b/arch/arm/mach-imx/clk-imx35.c
index 920a8cc42726..c6422fb10bae 100644
--- a/arch/arm/mach-imx/clk-imx35.c
+++ b/arch/arm/mach-imx/clk-imx35.c
@@ -201,7 +201,6 @@ int __init mx35_clocks_init()
                        pr_err("i.MX35 clk %d: register failed with %ld\n",
                                i, PTR_ERR(clk[i]));
        clk_register_clkdev(clk[pata_gate], NULL, "pata_imx");
        clk_register_clkdev(clk[can1_gate], NULL, "flexcan.0");
        clk_register_clkdev(clk[can2_gate], NULL, "flexcan.1");
@@ -264,6 +263,14 @@ int __init mx35_clocks_init()
        clk_prepare_enable(clk[iim_gate]);
        clk_prepare_enable(clk[emi_gate]);
+        /*
+         * SCC is needed to boot via mmc after a watchdog reset. The clock code
+         * before conversion to common clk also enabled UART1 (which isn't
+         * handled here and not needed for mmc) and IIM (which is enabled
+         * unconditionally above).
+         */
+        clk_prepare_enable(clk[scc_gate]);
        imx_print_silicon_rev("i.MX35", mx35_revision());
 #ifdef CONFIG_MXC_USE_EPIT
diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
index 17dc66a085a5..e1a17ac7b3b4 100644
--- a/arch/arm/mach-imx/clk-imx6q.c
+++ b/arch/arm/mach-imx/clk-imx6q.c
@@ -152,13 +152,14 @@ enum mx6q_clks {
        ssi2, ssi3, uart_ipg, uart_serial, usboh3, usdhc1, usdhc2, usdhc3,
        usdhc4, vdo_axi, vpu_axi, cko1, pll1_sys, pll2_bus, pll3_usb_otg,
        pll4_audio, pll5_video, pll6_mlb, pll7_usb_host, pll8_enet, ssi1_ipg,
-        ssi2_ipg, ssi3_ipg, clk_max
+        ssi2_ipg, ssi3_ipg, rom,
+        clk_max
 };
 static struct clk *clk[clk_max];
 static enum mx6q_clks const clks_init_on[] __initconst = {
-        mmdc_ch0_axi, mmdc_ch1_axi,
+        mmdc_ch0_axi, rom,
 };
 int __init mx6q_clocks_init(void)
@@ -364,6 +365,7 @@ int __init mx6q_clocks_init(void)
        clk[gpmi_bch]     = imx_clk_gate2("gpmi_bch",      "usdhc4",            base + 0x78, 26);
        clk[gpmi_io]      = imx_clk_gate2("gpmi_io",       "enfc",              base + 0x78, 28);
        clk[gpmi_apb]     = imx_clk_gate2("gpmi_apb",      "usdhc3",            base + 0x78, 30);
+        clk[rom]          = imx_clk_gate2("rom",           "ahb",               base + 0x7c, 0);
        clk[sata]         = imx_clk_gate2("sata",          "ipg",               base + 0x7c, 4);
        clk[sdma]         = imx_clk_gate2("sdma",          "ahb",               base + 0x7c, 6);
        clk[spba]         = imx_clk_gate2("spba",          "ipg",               base + 0x7c, 12);
diff --git a/arch/arm/mach-imx/mach-imx27_visstrim_m10.c b/arch/arm/mach-imx/mach-imx27_visstrim_m10.c
index f76edb96a48a..ba09552fe5fe 100644
--- a/arch/arm/mach-imx/mach-imx27_visstrim_m10.c
+++ b/arch/arm/mach-imx/mach-imx27_visstrim_m10.c
@@ -38,7 +38,7 @@
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/time.h>
-#include <asm/system.h>
+#include <asm/system_info.h>
 #include <mach/common.h>
 #include <mach/iomux-mx27.h>
diff --git a/arch/arm/mach-mmp/include/mach/gpio-pxa.h b/arch/arm/mach-mmp/include/mach/gpio-pxa.h
deleted file mode 100644
index 0e135a599f3e..000000000000
--- a/arch/arm/mach-mmp/include/mach/gpio-pxa.h
+++ /dev/null
@@ -1,29 +0,0 @@
-#ifndef __ASM_MACH_GPIO_PXA_H
-#define __ASM_MACH_GPIO_PXA_H
-#include <mach/addr-map.h>
-#include <mach/cputype.h>
-#include <mach/irqs.h>
-#define GPIO_REGS_VIRT  (APB_VIRT_BASE + 0x19000)
-#define BANK_OFF(n)     (((n) < 3) ? (n) << 2 : 0x100 + (((n) - 3) << 2))
-#define GPIO_REG(x)     (*(volatile u32 *)(GPIO_REGS_VIRT + (x)))
-#define gpio_to_bank(gpio)      ((gpio) >> 5)
-/* NOTE: these macros are defined here to make optimization of
- * gpio_{get,set}_value() to work when 'gpio' is a constant.
- * Usage of these macros otherwise is no longer recommended,
- * use generic GPIO API whenever possible.
- */
-#define GPIO_bit(gpio)  (1 << ((gpio) & 0x1f))
-#define GPLR(x)         GPIO_REG(BANK_OFF(gpio_to_bank(x)) + 0x00)
-#define GPDR(x)         GPIO_REG(BANK_OFF(gpio_to_bank(x)) + 0x0c)
-#define GPSR(x)         GPIO_REG(BANK_OFF(gpio_to_bank(x)) + 0x18)
-#define GPCR(x)         GPIO_REG(BANK_OFF(gpio_to_bank(x)) + 0x24)
-#include <plat/gpio-pxa.h>
-#endif /* __ASM_MACH_GPIO_PXA_H */
diff --git a/arch/arm/mach-mv78xx0/include/mach/bridge-regs.h b/arch/arm/mach-mv78xx0/include/mach/bridge-regs.h
index c64dbb96dbad..eb187e0e059b 100644
--- a/arch/arm/mach-mv78xx0/include/mach/bridge-regs.h
+++ b/arch/arm/mach-mv78xx0/include/mach/bridge-regs.h
@@ -31,5 +31,6 @@
 #define IRQ_MASK_HIGH_OFF       0x0014
 #define TIMER_VIRT_BASE         (BRIDGE_VIRT_BASE | 0x0300)
+#define TIMER_PHYS_BASE         (BRIDGE_PHYS_BASE | 0x0300)
 #endif
diff --git a/arch/arm/mach-mv78xx0/include/mach/mv78xx0.h b/arch/arm/mach-mv78xx0/include/mach/mv78xx0.h
index 3674497162e3..e807c4c52a0b 100644
--- a/arch/arm/mach-mv78xx0/include/mach/mv78xx0.h
+++ b/arch/arm/mach-mv78xx0/include/mach/mv78xx0.h
@@ -42,6 +42,7 @@
 #define MV78XX0_CORE0_REGS_PHYS_BASE    0xf1020000
 #define MV78XX0_CORE1_REGS_PHYS_BASE    0xf1024000
 #define MV78XX0_CORE_REGS_VIRT_BASE     0xfe400000
+#define MV78XX0_CORE_REGS_PHYS_BASE     0xfe400000
 #define MV78XX0_CORE_REGS_SIZE          SZ_16K
 #define MV78XX0_PCIE_IO_PHYS_BASE(i)    (0xf0800000 + ((i) << 20))
@@ -59,6 +60,7 @@
 * Core-specific peripheral registers.
 */
 #define BRIDGE_VIRT_BASE        (MV78XX0_CORE_REGS_VIRT_BASE)
+#define BRIDGE_PHYS_BASE        (MV78XX0_CORE_REGS_PHYS_BASE)
 /*
 * Register Map
diff --git a/arch/arm/mach-mxs/mach-apx4devkit.c b/arch/arm/mach-mxs/mach-apx4devkit.c
index 5e90b9dcdef8..f5f061757deb 100644
--- a/arch/arm/mach-mxs/mach-apx4devkit.c
+++ b/arch/arm/mach-mxs/mach-apx4devkit.c
@@ -205,6 +205,16 @@ static int apx4devkit_phy_fixup(struct phy_device *phy)
        return 0;
 }
+static void __init apx4devkit_fec_phy_clk_enable(void)
+{
+        struct clk *clk;
+        /* Enable fec phy clock */
+        clk = clk_get_sys("enet_out", NULL);
+        if (!IS_ERR(clk))
+                clk_prepare_enable(clk);
+}
 static void __init apx4devkit_init(void)
 {
        mx28_soc_init();
@@ -225,6 +235,7 @@ static void __init apx4devkit_init(void)
        phy_register_fixup_for_uid(PHY_ID_KS8051, MICREL_PHY_ID_MASK,
                        apx4devkit_phy_fixup);
+        apx4devkit_fec_phy_clk_enable();
        mx28_add_fec(0, &mx28_fec_pdata);
        mx28_add_mxs_mmc(0, &apx4devkit_mmc_pdata);
diff --git a/arch/arm/mach-omap2/board-flash.c b/arch/arm/mach-omap2/board-flash.c
index 70a81f900bb5..53c39d239d6e 100644
--- a/arch/arm/mach-omap2/board-flash.c
+++ b/arch/arm/mach-omap2/board-flash.c
@@ -97,11 +97,6 @@ __init board_onenand_init(struct mtd_partition *onenand_parts,
        gpmc_onenand_init(&board_onenand_data);
 }
-#else
-void
-__init board_onenand_init(struct mtd_partition *nor_parts, u8 nr_parts, u8 cs)
-{
-}
 #endif /* CONFIG_MTD_ONENAND_OMAP2 || CONFIG_MTD_ONENAND_OMAP2_MODULE */
 #if defined(CONFIG_MTD_NAND_OMAP2) || \
diff --git a/arch/arm/mach-omap2/board-overo.c b/arch/arm/mach-omap2/board-overo.c
index 8fa2fc3a4c3c..779734d8ba37 100644
--- a/arch/arm/mach-omap2/board-overo.c
+++ b/arch/arm/mach-omap2/board-overo.c
@@ -494,8 +494,8 @@ static void __init overo_init(void)
        regulator_register_fixed(0, dummy_supplies, ARRAY_SIZE(dummy_supplies));
        omap3_mux_init(board_mux, OMAP_PACKAGE_CBB);
-        omap_hsmmc_init(mmc);
        overo_i2c_init();
+        omap_hsmmc_init(mmc);
        omap_display_init(&overo_dss_data);
        omap_serial_init();
        omap_sdrc_init(mt46h32m32lf6_sdrc_params,
diff --git a/arch/arm/mach-omap2/clock44xx_data.c b/arch/arm/mach-omap2/clock44xx_data.c
index e2b701e164f6..ba6f9a0a43e9 100644
--- a/arch/arm/mach-omap2/clock44xx_data.c
+++ b/arch/arm/mach-omap2/clock44xx_data.c
@@ -3417,9 +3417,12 @@ int __init omap4xxx_clk_init(void)
        if (cpu_is_omap443x()) {
                cpu_mask = RATE_IN_4430;
                cpu_clkflg = CK_443X;
-        } else if (cpu_is_omap446x()) {
+        } else if (cpu_is_omap446x() || cpu_is_omap447x()) {
                cpu_mask = RATE_IN_4460 | RATE_IN_4430;
                cpu_clkflg = CK_446X | CK_443X;
+                if (cpu_is_omap447x())
+                        pr_warn("WARNING: OMAP4470 clock data incomplete!\n");
        } else {
                return 0;
        }
diff --git a/arch/arm/mach-omap2/clockdomain.h b/arch/arm/mach-omap2/clockdomain.h
index f7b58609bad8..6227e9505c2d 100644
--- a/arch/arm/mach-omap2/clockdomain.h
+++ b/arch/arm/mach-omap2/clockdomain.h
@@ -31,12 +31,16 @@
 *
 * CLKDM_NO_AUTODEPS: Prevent "autodeps" from being added/removed from this
 *     clockdomain.  (Currently, this applies to OMAP3 clockdomains only.)
+ * CLKDM_ACTIVE_WITH_MPU: The PRCM guarantees that this clockdomain is
+ *     active whenever the MPU is active.  True for interconnects and
+ *     the WKUP clockdomains.
 */
 #define CLKDM_CAN_FORCE_SLEEP                   (1 << 0)
 #define CLKDM_CAN_FORCE_WAKEUP                  (1 << 1)
 #define CLKDM_CAN_ENABLE_AUTO                   (1 << 2)
 #define CLKDM_CAN_DISABLE_AUTO                  (1 << 3)
 #define CLKDM_NO_AUTODEPS                       (1 << 4)
+#define CLKDM_ACTIVE_WITH_MPU                   (1 << 5)
 #define CLKDM_CAN_HWSUP         (CLKDM_CAN_ENABLE_AUTO | CLKDM_CAN_DISABLE_AUTO)
 #define CLKDM_CAN_SWSUP         (CLKDM_CAN_FORCE_SLEEP | CLKDM_CAN_FORCE_WAKEUP)
diff --git a/arch/arm/mach-omap2/clockdomains2xxx_3xxx_data.c b/arch/arm/mach-omap2/clockdomains2xxx_3xxx_data.c
index 839145e1cfbe..4972219653ce 100644
--- a/arch/arm/mach-omap2/clockdomains2xxx_3xxx_data.c
+++ b/arch/arm/mach-omap2/clockdomains2xxx_3xxx_data.c
@@ -88,4 +88,5 @@ struct clockdomain wkup_common_clkdm = {
        .name           = "wkup_clkdm",
        .pwrdm          = { .name = "wkup_pwrdm" },
        .dep_bit        = OMAP_EN_WKUP_SHIFT,
+        .flags          = CLKDM_ACTIVE_WITH_MPU,
 };
diff --git a/arch/arm/mach-omap2/clockdomains44xx_data.c b/arch/arm/mach-omap2/clockdomains44xx_data.c
index c53425847493..7f2133abe7d3 100644
--- a/arch/arm/mach-omap2/clockdomains44xx_data.c
+++ b/arch/arm/mach-omap2/clockdomains44xx_data.c
@@ -381,7 +381,7 @@ static struct clockdomain l4_wkup_44xx_clkdm = {
        .cm_inst          = OMAP4430_PRM_WKUP_CM_INST,
        .clkdm_offs       = OMAP4430_PRM_WKUP_CM_WKUP_CDOFFS,
        .dep_bit          = OMAP4430_L4WKUP_STATDEP_SHIFT,
-        .flags            = CLKDM_CAN_HWSUP,
+        .flags            = CLKDM_CAN_HWSUP | CLKDM_ACTIVE_WITH_MPU,
 };
 static struct clockdomain emu_sys_44xx_clkdm = {
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 773193670ea2..2d710f50fca2 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1124,15 +1124,18 @@ static struct omap_hwmod_addr_space * __init _find_mpu_rt_addr_space(struct omap
 * _enable_sysc - try to bring a module out of idle via OCP_SYSCONFIG
 * @oh: struct omap_hwmod *
 *
- * If module is marked as SWSUP_SIDLE, force the module out of slave
+ * Ensure that the OCP_SYSCONFIG register for the IP block represented
- * idle; otherwise, configure it for smart-idle.  If module is marked
+ * by @oh is set to indicate to the PRCM that the IP block is active.
- * as SWSUP_MSUSPEND, force the module out of master standby;
+ * Usually this means placing the module into smart-idle mode and
- * otherwise, configure it for smart-standby.  No return value.
+ * smart-standby, but if there is a bug in the automatic idle handling
+ * for the IP block, it may need to be placed into the force-idle or
+ * no-idle variants of these modes.  No return value.
 */
 static void _enable_sysc(struct omap_hwmod *oh)
 {
        u8 idlemode, sf;
        u32 v;
+        bool clkdm_act;
        if (!oh->class->sysc)
                return;
@@ -1141,8 +1144,16 @@ static void _enable_sysc(struct omap_hwmod *oh)
        sf = oh->class->sysc->sysc_flags;
        if (sf & SYSC_HAS_SIDLEMODE) {
-                idlemode = (oh->flags & HWMOD_SWSUP_SIDLE) ?
+                clkdm_act = ((oh->clkdm &&
-                        HWMOD_IDLEMODE_NO : HWMOD_IDLEMODE_SMART;
+                              oh->clkdm->flags & CLKDM_ACTIVE_WITH_MPU) ||
+                             (oh->_clk && oh->_clk->clkdm &&
+                              oh->_clk->clkdm->flags & CLKDM_ACTIVE_WITH_MPU));
+                if (clkdm_act && !(oh->class->sysc->idlemodes &
+                                   (SIDLE_SMART | SIDLE_SMART_WKUP)))
+                        idlemode = HWMOD_IDLEMODE_FORCE;
+                else
+                        idlemode = (oh->flags & HWMOD_SWSUP_SIDLE) ?
+                                HWMOD_IDLEMODE_NO : HWMOD_IDLEMODE_SMART;
                _set_slave_idlemode(oh, idlemode, &v);
        }
@@ -1208,8 +1219,13 @@ static void _idle_sysc(struct omap_hwmod *oh)
        sf = oh->class->sysc->sysc_flags;
        if (sf & SYSC_HAS_SIDLEMODE) {
-                idlemode = (oh->flags & HWMOD_SWSUP_SIDLE) ?
+                /* XXX What about HWMOD_IDLEMODE_SMART_WKUP? */
-                        HWMOD_IDLEMODE_FORCE : HWMOD_IDLEMODE_SMART;
+                if (oh->flags & HWMOD_SWSUP_SIDLE ||
+                    !(oh->class->sysc->idlemodes &
+                      (SIDLE_SMART | SIDLE_SMART_WKUP)))
+                        idlemode = HWMOD_IDLEMODE_FORCE;
+                else
+                        idlemode = HWMOD_IDLEMODE_SMART;
                _set_slave_idlemode(oh, idlemode, &v);
        }
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index f30e861ce6d9..b7bcba5221ba 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -1928,7 +1928,7 @@ static struct omap_hwmod_dma_info omap44xx_mcbsp1_sdma_reqs[] = {
 static struct omap_hwmod_opt_clk mcbsp1_opt_clks[] = {
        { .role = "pad_fck", .clk = "pad_clks_ck" },
-        { .role = "prcm_clk", .clk = "mcbsp1_sync_mux_ck" },
+        { .role = "prcm_fck", .clk = "mcbsp1_sync_mux_ck" },
 };
 static struct omap_hwmod omap44xx_mcbsp1_hwmod = {
@@ -1963,7 +1963,7 @@ static struct omap_hwmod_dma_info omap44xx_mcbsp2_sdma_reqs[] = {
 static struct omap_hwmod_opt_clk mcbsp2_opt_clks[] = {
        { .role = "pad_fck", .clk = "pad_clks_ck" },
-        { .role = "prcm_clk", .clk = "mcbsp2_sync_mux_ck" },
+        { .role = "prcm_fck", .clk = "mcbsp2_sync_mux_ck" },
 };
 static struct omap_hwmod omap44xx_mcbsp2_hwmod = {
@@ -1998,7 +1998,7 @@ static struct omap_hwmod_dma_info omap44xx_mcbsp3_sdma_reqs[] = {
 static struct omap_hwmod_opt_clk mcbsp3_opt_clks[] = {
        { .role = "pad_fck", .clk = "pad_clks_ck" },
-        { .role = "prcm_clk", .clk = "mcbsp3_sync_mux_ck" },
+        { .role = "prcm_fck", .clk = "mcbsp3_sync_mux_ck" },
 };
 static struct omap_hwmod omap44xx_mcbsp3_hwmod = {
@@ -2033,7 +2033,7 @@ static struct omap_hwmod_dma_info omap44xx_mcbsp4_sdma_reqs[] = {
 static struct omap_hwmod_opt_clk mcbsp4_opt_clks[] = {
        { .role = "pad_fck", .clk = "pad_clks_ck" },
-        { .role = "prcm_clk", .clk = "mcbsp4_sync_mux_ck" },
+        { .role = "prcm_fck", .clk = "mcbsp4_sync_mux_ck" },
 };
 static struct omap_hwmod omap44xx_mcbsp4_hwmod = {
@@ -3864,7 +3864,7 @@ static struct omap_hwmod_ocp_if omap44xx_l4_cfg__l3_main_2 = {
 };
 /* usb_host_fs -> l3_main_2 */
-static struct omap_hwmod_ocp_if omap44xx_usb_host_fs__l3_main_2 = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_usb_host_fs__l3_main_2 = {
        .master         = &omap44xx_usb_host_fs_hwmod,
        .slave          = &omap44xx_l3_main_2_hwmod,
        .clk            = "l3_div_ck",
@@ -3922,7 +3922,7 @@ static struct omap_hwmod_ocp_if omap44xx_l4_cfg__l3_main_3 = {
 };
 /* aess -> l4_abe */
-static struct omap_hwmod_ocp_if omap44xx_aess__l4_abe = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_aess__l4_abe = {
        .master         = &omap44xx_aess_hwmod,
        .slave          = &omap44xx_l4_abe_hwmod,
        .clk            = "ocp_abe_iclk",
@@ -4013,7 +4013,7 @@ static struct omap_hwmod_addr_space omap44xx_aess_addrs[] = {
 };
 /* l4_abe -> aess */
-static struct omap_hwmod_ocp_if omap44xx_l4_abe__aess = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_l4_abe__aess = {
        .master         = &omap44xx_l4_abe_hwmod,
        .slave          = &omap44xx_aess_hwmod,
        .clk            = "ocp_abe_iclk",
@@ -4031,7 +4031,7 @@ static struct omap_hwmod_addr_space omap44xx_aess_dma_addrs[] = {
 };
 /* l4_abe -> aess (dma) */
-static struct omap_hwmod_ocp_if omap44xx_l4_abe__aess_dma = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_l4_abe__aess_dma = {
        .master         = &omap44xx_l4_abe_hwmod,
        .slave          = &omap44xx_aess_hwmod,
        .clk            = "ocp_abe_iclk",
@@ -5857,7 +5857,7 @@ static struct omap_hwmod_addr_space omap44xx_usb_host_fs_addrs[] = {
 };
 /* l4_cfg -> usb_host_fs */
-static struct omap_hwmod_ocp_if omap44xx_l4_cfg__usb_host_fs = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_l4_cfg__usb_host_fs = {
        .master         = &omap44xx_l4_cfg_hwmod,
        .slave          = &omap44xx_usb_host_fs_hwmod,
        .clk            = "l4_div_ck",
@@ -6014,13 +6014,13 @@ static struct omap_hwmod_ocp_if *omap44xx_hwmod_ocp_ifs[] __initdata = {
        &omap44xx_iva__l3_main_2,
        &omap44xx_l3_main_1__l3_main_2,
        &omap44xx_l4_cfg__l3_main_2,
-        &omap44xx_usb_host_fs__l3_main_2,
+        /* &omap44xx_usb_host_fs__l3_main_2, */
        &omap44xx_usb_host_hs__l3_main_2,
        &omap44xx_usb_otg_hs__l3_main_2,
        &omap44xx_l3_main_1__l3_main_3,
        &omap44xx_l3_main_2__l3_main_3,
        &omap44xx_l4_cfg__l3_main_3,
-        &omap44xx_aess__l4_abe,
+        /* &omap44xx_aess__l4_abe, */
        &omap44xx_dsp__l4_abe,
        &omap44xx_l3_main_1__l4_abe,
        &omap44xx_mpu__l4_abe,
@@ -6029,8 +6029,8 @@ static struct omap_hwmod_ocp_if *omap44xx_hwmod_ocp_ifs[] __initdata = {
        &omap44xx_l4_cfg__l4_wkup,
        &omap44xx_mpu__mpu_private,
        &omap44xx_l4_cfg__ocp_wp_noc,
-        &omap44xx_l4_abe__aess,
+        /* &omap44xx_l4_abe__aess, */
-        &omap44xx_l4_abe__aess_dma,
+        /* &omap44xx_l4_abe__aess_dma, */
        &omap44xx_l3_main_2__c2c,
        &omap44xx_l4_wkup__counter_32k,
        &omap44xx_l4_cfg__ctrl_module_core,
@@ -6136,7 +6136,7 @@ static struct omap_hwmod_ocp_if *omap44xx_hwmod_ocp_ifs[] __initdata = {
        &omap44xx_l4_per__uart2,
        &omap44xx_l4_per__uart3,
        &omap44xx_l4_per__uart4,
-        &omap44xx_l4_cfg__usb_host_fs,
+        /* &omap44xx_l4_cfg__usb_host_fs, */
        &omap44xx_l4_cfg__usb_host_hs,
        &omap44xx_l4_cfg__usb_otg_hs,
        &omap44xx_l4_cfg__usb_tll_hs,
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index 119d5a910f3a..43a979075338 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -32,6 +32,7 @@
 #include "twl-common.h"
 #include "pm.h"
 #include "voltage.h"
+#include "mux.h"
 static struct i2c_board_info __initdata pmic_i2c_board_info = {
        .addr           = 0x48,
@@ -77,6 +78,7 @@ void __init omap4_pmic_init(const char *pmic_type,
                    struct twl6040_platform_data *twl6040_data, int twl6040_irq)
 {
        /* PMIC part*/
+        omap_mux_init_signal("sys_nirq1", OMAP_PIN_INPUT_PULLUP | OMAP_PIN_OFF_WAKEUPENABLE);
        strncpy(omap4_i2c1_board_info[0].type, pmic_type,
                sizeof(omap4_i2c1_board_info[0].type));
        omap4_i2c1_board_info[0].irq = OMAP44XX_IRQ_SYS_1N;
diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c
index d09da6a746b8..d3de84b0dcbe 100644
--- a/arch/arm/mach-pxa/hx4700.c
+++ b/arch/arm/mach-pxa/hx4700.c
@@ -127,7 +127,11 @@ static unsigned long hx4700_pin_config[] __initdata = {
        GPIO19_SSP2_SCLK,
        GPIO86_SSP2_RXD,
        GPIO87_SSP2_TXD,
-        GPIO88_GPIO,
+        GPIO88_GPIO | MFP_LPM_DRIVE_HIGH,       /* TSC2046_CS */
+        /* BQ24022 Regulator */
+        GPIO72_GPIO | MFP_LPM_KEEP_OUTPUT,      /* BQ24022_nCHARGE_EN */
+        GPIO96_GPIO | MFP_LPM_KEEP_OUTPUT,      /* BQ24022_ISET2 */
        /* HX4700 specific input GPIOs */
        GPIO12_GPIO | WAKEUP_ON_EDGE_RISE,      /* ASIC3_IRQ */
@@ -135,6 +139,10 @@ static unsigned long hx4700_pin_config[] __initdata = {
        GPIO14_GPIO,    /* nWLAN_IRQ */
        /* HX4700 specific output GPIOs */
+        GPIO61_GPIO | MFP_LPM_DRIVE_HIGH,       /* W3220_nRESET */
+        GPIO71_GPIO | MFP_LPM_DRIVE_HIGH,       /* ASIC3_nRESET */
+        GPIO81_GPIO | MFP_LPM_DRIVE_HIGH,       /* CPU_GP_nRESET */
+        GPIO116_GPIO | MFP_LPM_DRIVE_HIGH,      /* CPU_HW_nRESET */
        GPIO102_GPIO | MFP_LPM_DRIVE_LOW,       /* SYNAPTICS_POWER_ON */
        GPIO10_GPIO,    /* GSM_IRQ */
@@ -872,14 +880,19 @@ static struct gpio global_gpios[] = {
        { GPIO110_HX4700_LCD_LVDD_3V3_ON, GPIOF_OUT_INIT_HIGH, "LCD_LVDD" },
        { GPIO111_HX4700_LCD_AVDD_3V3_ON, GPIOF_OUT_INIT_HIGH, "LCD_AVDD" },
        { GPIO32_HX4700_RS232_ON,         GPIOF_OUT_INIT_HIGH, "RS232_ON" },
+        { GPIO61_HX4700_W3220_nRESET,     GPIOF_OUT_INIT_HIGH, "W3220_nRESET" },
        { GPIO71_HX4700_ASIC3_nRESET,     GPIOF_OUT_INIT_HIGH, "ASIC3_nRESET" },
+        { GPIO81_HX4700_CPU_GP_nRESET,    GPIOF_OUT_INIT_HIGH, "CPU_GP_nRESET" },
        { GPIO82_HX4700_EUART_RESET,      GPIOF_OUT_INIT_HIGH, "EUART_RESET" },
+        { GPIO116_HX4700_CPU_HW_nRESET,   GPIOF_OUT_INIT_HIGH, "CPU_HW_nRESET" },
 };
 static void __init hx4700_init(void)
 {
        int ret;
+        PCFR = PCFR_GPR_EN | PCFR_OPDE;
        pxa2xx_mfp_config(ARRAY_AND_SIZE(hx4700_pin_config));
        gpio_set_wake(GPIO12_HX4700_ASIC3_IRQ, 1);
        ret = gpio_request_array(ARRAY_AND_SIZE(global_gpios));
diff --git a/arch/arm/mach-s3c24xx/clock-s3c2440.c b/arch/arm/mach-s3c24xx/clock-s3c2440.c
index 414364eb426c..cb2883d553b5 100644
--- a/arch/arm/mach-s3c24xx/clock-s3c2440.c
+++ b/arch/arm/mach-s3c24xx/clock-s3c2440.c
@@ -106,7 +106,7 @@ static struct clk s3c2440_clk_cam_upll = {
 static struct clk s3c2440_clk_ac97 = {
        .name           = "ac97",
        .enable         = s3c2410_clkcon_enable,
-        .ctrlbit        = S3C2440_CLKCON_CAMERA,
+        .ctrlbit        = S3C2440_CLKCON_AC97,
 };
 static unsigned long  s3c2440_fclk_n_getrate(struct clk *clk)
diff --git a/arch/arm/mach-shmobile/board-armadillo800eva.c b/arch/arm/mach-shmobile/board-armadillo800eva.c
index 9e37026ef9dd..9bd135531d76 100644
--- a/arch/arm/mach-shmobile/board-armadillo800eva.c
+++ b/arch/arm/mach-shmobile/board-armadillo800eva.c
@@ -779,6 +779,7 @@ DT_MACHINE_START(ARMADILLO800EVA_DT, "armadillo800eva")
        .init_irq       = r8a7740_init_irq,
        .handle_irq     = shmobile_handle_irq_intc,
        .init_machine   = eva_init,
+        .init_late      = shmobile_init_late,
        .timer          = &shmobile_timer,
        .dt_compat      = eva_boards_compat_dt,
 MACHINE_END
diff --git a/arch/arm/mach-shmobile/board-kzm9d.c b/arch/arm/mach-shmobile/board-kzm9d.c
index 7bc5e7d39f9b..6a33cf393428 100644
--- a/arch/arm/mach-shmobile/board-kzm9d.c
+++ b/arch/arm/mach-shmobile/board-kzm9d.c
@@ -80,6 +80,7 @@ DT_MACHINE_START(KZM9D_DT, "kzm9d")
        .init_irq       = emev2_init_irq,
        .handle_irq     = gic_handle_irq,
        .init_machine   = kzm9d_add_standard_devices,
+        .init_late      = shmobile_init_late,
        .timer          = &shmobile_timer,
        .dt_compat      = kzm9d_boards_compat_dt,
 MACHINE_END
diff --git a/arch/arm/mach-shmobile/board-kzm9g.c b/arch/arm/mach-shmobile/board-kzm9g.c
index d8e33b682832..c0ae815e7beb 100644
--- a/arch/arm/mach-shmobile/board-kzm9g.c
+++ b/arch/arm/mach-shmobile/board-kzm9g.c
@@ -455,6 +455,7 @@ DT_MACHINE_START(KZM9G_DT, "kzm9g")
        .init_irq       = sh73a0_init_irq,
        .handle_irq     = gic_handle_irq,
        .init_machine   = kzm_init,
+        .init_late      = shmobile_init_late,
        .timer          = &shmobile_timer,
        .dt_compat      = kzm9g_boards_compat_dt,
 MACHINE_END
diff --git a/arch/arm/mach-shmobile/board-mackerel.c b/arch/arm/mach-shmobile/board-mackerel.c
index b577f7c44678..150122a44630 100644
--- a/arch/arm/mach-shmobile/board-mackerel.c
+++ b/arch/arm/mach-shmobile/board-mackerel.c
@@ -1512,6 +1512,9 @@ static void __init mackerel_init(void)
        gpio_request(GPIO_FN_SDHID0_1, NULL);
        gpio_request(GPIO_FN_SDHID0_0, NULL);
+        /* SDHI0 PORT172 card-detect IRQ26 */
+        gpio_request(GPIO_FN_IRQ26_172, NULL);
 #if !defined(CONFIG_MMC_SH_MMCIF) && !defined(CONFIG_MMC_SH_MMCIF_MODULE)
        /* enable SDHI1 */
        gpio_request(GPIO_FN_SDHICMD1, NULL);
diff --git a/arch/arm/mach-shmobile/clock-sh73a0.c b/arch/arm/mach-shmobile/clock-sh73a0.c
index 472d1f5361e5..3946c4ba2aa8 100644
--- a/arch/arm/mach-shmobile/clock-sh73a0.c
+++ b/arch/arm/mach-shmobile/clock-sh73a0.c
@@ -475,9 +475,9 @@ static struct clk *late_main_clks[] = {
 enum { MSTP001,
        MSTP129, MSTP128, MSTP127, MSTP126, MSTP125, MSTP118, MSTP116, MSTP100,
-        MSTP219,
+        MSTP219, MSTP218,
        MSTP207, MSTP206, MSTP204, MSTP203, MSTP202, MSTP201, MSTP200,
-        MSTP331, MSTP329, MSTP325, MSTP323, MSTP318,
+        MSTP331, MSTP329, MSTP325, MSTP323,
        MSTP314, MSTP313, MSTP312, MSTP311,
        MSTP303, MSTP302, MSTP301, MSTP300,
        MSTP411, MSTP410, MSTP403,
@@ -497,6 +497,7 @@ static struct clk mstp_clks[MSTP_NR] = {
        [MSTP116] = MSTP(&div4_clks[DIV4_HP], SMSTPCR1, 16, 0), /* IIC0 */
        [MSTP100] = MSTP(&div4_clks[DIV4_B], SMSTPCR1, 0, 0), /* LCDC0 */
        [MSTP219] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 19, 0), /* SCIFA7 */
+        [MSTP218] = MSTP(&div4_clks[DIV4_HP], SMSTPCR2, 18, 0), /* SY-DMAC */
        [MSTP207] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 7, 0), /* SCIFA5 */
        [MSTP206] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 6, 0), /* SCIFB */
        [MSTP204] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR2, 4, 0), /* SCIFA0 */
@@ -508,7 +509,6 @@ static struct clk mstp_clks[MSTP_NR] = {
        [MSTP329] = MSTP(&r_clk, SMSTPCR3, 29, 0), /* CMT10 */
        [MSTP325] = MSTP(&div6_clks[DIV6_SUB], SMSTPCR3, 25, 0), /* IrDA */
        [MSTP323] = MSTP(&div4_clks[DIV4_HP], SMSTPCR3, 23, 0), /* IIC1 */
-        [MSTP318] = MSTP(&div4_clks[DIV4_HP], SMSTPCR3, 18, 0), /* SY-DMAC */
        [MSTP314] = MSTP(&div6_clks[DIV6_SDHI0], SMSTPCR3, 14, 0), /* SDHI0 */
        [MSTP313] = MSTP(&div6_clks[DIV6_SDHI1], SMSTPCR3, 13, 0), /* SDHI1 */
        [MSTP312] = MSTP(&div4_clks[DIV4_HP], SMSTPCR3, 12, 0), /* MMCIF0 */
@@ -552,6 +552,7 @@ static struct clk_lookup lookups[] = {
        CLKDEV_DEV_ID("i2c-sh_mobile.0", &mstp_clks[MSTP116]), /* I2C0 */
        CLKDEV_DEV_ID("sh_mobile_lcdc_fb.0", &mstp_clks[MSTP100]), /* LCDC0 */
        CLKDEV_DEV_ID("sh-sci.7", &mstp_clks[MSTP219]), /* SCIFA7 */
+        CLKDEV_DEV_ID("sh-dma-engine.0", &mstp_clks[MSTP218]), /* SY-DMAC */
        CLKDEV_DEV_ID("sh-sci.5", &mstp_clks[MSTP207]), /* SCIFA5 */
        CLKDEV_DEV_ID("sh-sci.8", &mstp_clks[MSTP206]), /* SCIFB */
        CLKDEV_DEV_ID("sh-sci.0", &mstp_clks[MSTP204]), /* SCIFA0 */
@@ -563,7 +564,6 @@ static struct clk_lookup lookups[] = {
        CLKDEV_DEV_ID("sh_cmt.10", &mstp_clks[MSTP329]), /* CMT10 */
        CLKDEV_DEV_ID("sh_irda.0", &mstp_clks[MSTP325]), /* IrDA */
        CLKDEV_DEV_ID("i2c-sh_mobile.1", &mstp_clks[MSTP323]), /* I2C1 */
-        CLKDEV_DEV_ID("sh-dma-engine.0", &mstp_clks[MSTP318]), /* SY-DMAC */
        CLKDEV_DEV_ID("sh_mobile_sdhi.0", &mstp_clks[MSTP314]), /* SDHI0 */
        CLKDEV_DEV_ID("sh_mobile_sdhi.1", &mstp_clks[MSTP313]), /* SDHI1 */
        CLKDEV_DEV_ID("sh_mmcif.0", &mstp_clks[MSTP312]), /* MMCIF0 */
diff --git a/arch/arm/mach-shmobile/intc-r8a7779.c b/arch/arm/mach-shmobile/intc-r8a7779.c
index 550b23df4fd4..f04fad4ec4fb 100644
--- a/arch/arm/mach-shmobile/intc-r8a7779.c
+++ b/arch/arm/mach-shmobile/intc-r8a7779.c
@@ -35,6 +35,9 @@
 #define INT2SMSKCR3 0xfe7822ac
 #define INT2SMSKCR4 0xfe7822b0
+#define INT2NTSR0 0xfe700060
+#define INT2NTSR1 0xfe700064
 static int r8a7779_set_wake(struct irq_data *data, unsigned int on)
 {
        return 0; /* always allow wakeup */
@@ -49,6 +52,10 @@ void __init r8a7779_init_irq(void)
        gic_init(0, 29, gic_dist_base, gic_cpu_base);
        gic_arch_extn.irq_set_wake = r8a7779_set_wake;
+        /* route all interrupts to ARM */
+        __raw_writel(0xffffffff, INT2NTSR0);
+        __raw_writel(0x3fffffff, INT2NTSR1);
        /* unmask all known interrupts in INTCS2 */
        __raw_writel(0xfffffff0, INT2SMSKCR0);
        __raw_writel(0xfff7ffff, INT2SMSKCR1);
diff --git a/arch/arm/mach-shmobile/platsmp.c b/arch/arm/mach-shmobile/platsmp.c
index bacdd667e3b1..fde0d23121dc 100644
--- a/arch/arm/mach-shmobile/platsmp.c
+++ b/arch/arm/mach-shmobile/platsmp.c
@@ -22,10 +22,20 @@
 #include <mach/common.h>
 #include <mach/emev2.h>
+#ifdef CONFIG_ARCH_SH73A0
 #define is_sh73a0() (machine_is_ag5evm() || machine_is_kota2() || \
                        of_machine_is_compatible("renesas,sh73a0"))
+#else
+#define is_sh73a0() (0)
+#endif
 #define is_r8a7779() machine_is_marzen()
+#ifdef CONFIG_ARCH_EMEV2
 #define is_emev2() of_machine_is_compatible("renesas,emev2")
+#else
+#define is_emev2() (0)
+#endif
 static unsigned int __init shmobile_smp_get_core_count(void)
 {
diff --git a/arch/arm/mach-shmobile/setup-sh7372.c b/arch/arm/mach-shmobile/setup-sh7372.c
index 6a4bd582c028..fafce9ce8218 100644
--- a/arch/arm/mach-shmobile/setup-sh7372.c
+++ b/arch/arm/mach-shmobile/setup-sh7372.c
@@ -484,7 +484,7 @@ static const struct sh_dmae_slave_config sh7372_dmae_slaves[] = {
        },
 };
-#define SH7372_CHCLR 0x220
+#define SH7372_CHCLR (0x220 - 0x20)
 static const struct sh_dmae_channel sh7372_dmae_channels[] = {
        {
diff --git a/arch/arm/mach-spear3xx/spear3xx.c b/arch/arm/mach-spear3xx/spear3xx.c
index 0f41bd1c47c3..66db5f13af84 100644
--- a/arch/arm/mach-spear3xx/spear3xx.c
+++ b/arch/arm/mach-spear3xx/spear3xx.c
@@ -87,7 +87,7 @@ void __init spear3xx_map_io(void)
 static void __init spear3xx_timer_init(void)
 {
-        char pclk_name[] = "pll3_48m_clk";
+        char pclk_name[] = "pll3_clk";
        struct clk *gpt_clk, *pclk;
        spear3xx_clk_init();
diff --git a/arch/arm/mach-spear6xx/spear6xx.c b/arch/arm/mach-spear6xx/spear6xx.c
index 2e2e3596583e..9af67d003c62 100644
--- a/arch/arm/mach-spear6xx/spear6xx.c
+++ b/arch/arm/mach-spear6xx/spear6xx.c
@@ -423,7 +423,7 @@ void __init spear6xx_map_io(void)
 static void __init spear6xx_timer_init(void)
 {
-        char pclk_name[] = "pll3_48m_clk";
+        char pclk_name[] = "pll3_clk";
        struct clk *gpt_clk, *pclk;
        spear6xx_clk_init();
diff --git a/arch/arm/mach-ux500/board-mop500.c b/arch/arm/mach-ux500/board-mop500.c
index 1509a3cb5833..4fd93f5c49ec 100644
--- a/arch/arm/mach-ux500/board-mop500.c
+++ b/arch/arm/mach-ux500/board-mop500.c
@@ -625,11 +625,6 @@ static struct platform_device *snowball_platform_devs[] __initdata = {
        &ab8500_device,
 };
-static struct platform_device *snowball_of_platform_devs[] __initdata = {
-        &snowball_led_dev,
-        &snowball_key_dev,
-};
 static void __init mop500_init_machine(void)
 {
        struct device *parent = NULL;
@@ -769,6 +764,11 @@ MACHINE_END
 #ifdef CONFIG_MACH_UX500_DT
+static struct platform_device *snowball_of_platform_devs[] __initdata = {
+        &snowball_led_dev,
+        &snowball_key_dev,
+};
 struct of_dev_auxdata u8500_auxdata_lookup[] __initdata = {
        /* Requires DMA and call-back bindings. */
        OF_DEV_AUXDATA("arm,pl011", 0x80120000, "uart0", &uart0_plat),
@@ -786,6 +786,8 @@ struct of_dev_auxdata u8500_auxdata_lookup[] __initdata = {
        OF_DEV_AUXDATA("st,nomadik-gpio", 0x8011e000, "gpio.6", NULL),
        OF_DEV_AUXDATA("st,nomadik-gpio", 0x8011e080, "gpio.7", NULL),
        OF_DEV_AUXDATA("st,nomadik-gpio", 0xa03fe000, "gpio.8", NULL),
+        /* Requires device name bindings. */
+        OF_DEV_AUXDATA("stericsson,nmk_pinctrl", 0, "pinctrl-db8500", NULL),
        {},
 };
diff --git a/arch/arm/mach-ux500/timer.c b/arch/arm/mach-ux500/timer.c
index 741e71feca78..66e7f00884ab 100644
--- a/arch/arm/mach-ux500/timer.c
+++ b/arch/arm/mach-ux500/timer.c
@@ -63,8 +63,10 @@ static void __init ux500_timer_init(void)
        /* TODO: Once MTU has been DT:ed place code above into else. */
        if (of_have_populated_dt()) {
+#ifdef CONFIG_OF
                np = of_find_matching_node(NULL, prcmu_timer_of_match);
                if (!np)
+#endif
                        goto dt_fail;
                tmp_base = of_iomap(np, 0);
diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
index bec933b04ef0..e95bf84cc837 100644
--- a/arch/arm/mach-versatile/pci.c
+++ b/arch/arm/mach-versatile/pci.c
@@ -339,7 +339,6 @@ void __init pci_versatile_preinit(void)
 static int __init versatile_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
 {
        int irq;
-        int devslot = PCI_SLOT(dev->devfn);
        /* slot,  pin,  irq
         *  24     1     27
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 4044abcf6f9d..655878bcc96d 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1091,7 +1091,7 @@ error:
        while (--i)
                if (pages[i])
                        __free_pages(pages[i], 0);
-        if (array_size < PAGE_SIZE)
+        if (array_size <= PAGE_SIZE)
                kfree(pages);
        else
                vfree(pages);
@@ -1106,7 +1106,7 @@ static int __iommu_free_buffer(struct device *dev, struct page **pages, size_t s
        for (i = 0; i < count; i++)
                if (pages[i])
                        __free_pages(pages[i], 0);
-        if (array_size < PAGE_SIZE)
+        if (array_size <= PAGE_SIZE)
                kfree(pages);
        else
                vfree(pages);
diff --git a/arch/arm/mm/mm.h b/arch/arm/mm/mm.h
index c471436c7952..2e8a1efdf7b8 100644
--- a/arch/arm/mm/mm.h
+++ b/arch/arm/mm/mm.h
@@ -64,7 +64,7 @@ extern void __flush_dcache_page(struct address_space *mapping, struct page *page
 #ifdef CONFIG_ZONE_DMA
 extern phys_addr_t arm_dma_limit;
 #else
-#define arm_dma_limit ((u32)~0)
+#define arm_dma_limit ((phys_addr_t)~0)
 #endif
 extern phys_addr_t arm_lowmem_limit;
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index e5dad60b558b..cf4528d51774 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -791,6 +791,79 @@ void __init iotable_init(struct map_desc *io_desc, int nr)
        }
 }
+#ifndef CONFIG_ARM_LPAE
+/*
+ * The Linux PMD is made of two consecutive section entries covering 2MB
+ * (see definition in include/asm/pgtable-2level.h).  However a call to
+ * create_mapping() may optimize static mappings by using individual
+ * 1MB section mappings.  This leaves the actual PMD potentially half
+ * initialized if the top or bottom section entry isn't used, leaving it
+ * open to problems if a subsequent ioremap() or vmalloc() tries to use
+ * the virtual space left free by that unused section entry.
+ *
+ * Let's avoid the issue by inserting dummy vm entries covering the unused
+ * PMD halves once the static mappings are in place.
+ */
+static void __init pmd_empty_section_gap(unsigned long addr)
+{
+        struct vm_struct *vm;
+        vm = early_alloc_aligned(sizeof(*vm), __alignof__(*vm));
+        vm->addr = (void *)addr;
+        vm->size = SECTION_SIZE;
+        vm->flags = VM_IOREMAP | VM_ARM_STATIC_MAPPING;
+        vm->caller = pmd_empty_section_gap;
+        vm_area_add_early(vm);
+}
+static void __init fill_pmd_gaps(void)
+{
+        struct vm_struct *vm;
+        unsigned long addr, next = 0;
+        pmd_t *pmd;
+        /* we're still single threaded hence no lock needed here */
+        for (vm = vmlist; vm; vm = vm->next) {
+                if (!(vm->flags & VM_ARM_STATIC_MAPPING))
+                        continue;
+                addr = (unsigned long)vm->addr;
+                if (addr < next)
+                        continue;
+                /*
+                 * Check if this vm starts on an odd section boundary.
+                 * If so and the first section entry for this PMD is free
+                 * then we block the corresponding virtual address.
+                 */
+                if ((addr & ~PMD_MASK) == SECTION_SIZE) {
+                        pmd = pmd_off_k(addr);
+                        if (pmd_none(*pmd))
+                                pmd_empty_section_gap(addr & PMD_MASK);
+                }
+                /*
+                 * Then check if this vm ends on an odd section boundary.
+                 * If so and the second section entry for this PMD is empty
+                 * then we block the corresponding virtual address.
+                 */
+                addr += vm->size;
+                if ((addr & ~PMD_MASK) == SECTION_SIZE) {
+                        pmd = pmd_off_k(addr) + 1;
+                        if (pmd_none(*pmd))
+                                pmd_empty_section_gap(addr);
+                }
+                /* no need to look at any vm entry until we hit the next PMD */
+                next = (addr + PMD_SIZE - 1) & PMD_MASK;
+        }
+}
+#else
+#define fill_pmd_gaps() do { } while (0)
+#endif
 static void * __initdata vmalloc_min =
        (void *)(VMALLOC_END - (240 << 20) - VMALLOC_OFFSET);
@@ -1072,6 +1145,7 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
         */
        if (mdesc->map_io)
                mdesc->map_io();
+        fill_pmd_gaps();
        /*
         * Finally flush the caches and tlb to ensure that we're in a
diff --git a/arch/arm/plat-samsung/adc.c b/arch/arm/plat-samsung/adc.c
index 33ecd0c9f0c3..b1e05ccff3ac 100644
--- a/arch/arm/plat-samsung/adc.c
+++ b/arch/arm/plat-samsung/adc.c
@@ -157,11 +157,13 @@ int s3c_adc_start(struct s3c_adc_client *client,
                return -EINVAL;
        }
-        if (client->is_ts && adc->ts_pend)
-                return -EAGAIN;
        spin_lock_irqsave(&adc->lock, flags);
+        if (client->is_ts && adc->ts_pend) {
+                spin_unlock_irqrestore(&adc->lock, flags);
+                return -EAGAIN;
+        }
        client->channel = channel;
        client->nr_samples = nr_samples;
diff --git a/arch/arm/plat-samsung/devs.c b/arch/arm/plat-samsung/devs.c
index 1d214cb9d770..6303974c2ee0 100644
--- a/arch/arm/plat-samsung/devs.c
+++ b/arch/arm/plat-samsung/devs.c
@@ -126,7 +126,8 @@ struct platform_device s3c_device_adc = {
 #ifdef CONFIG_CPU_S3C2440
 static struct resource s3c_camif_resource[] = {
        [0] = DEFINE_RES_MEM(S3C2440_PA_CAMIF, S3C2440_SZ_CAMIF),
-        [1] = DEFINE_RES_IRQ(IRQ_CAM),
+        [1] = DEFINE_RES_IRQ(IRQ_S3C2440_CAM_C),
+        [2] = DEFINE_RES_IRQ(IRQ_S3C2440_CAM_P),
 };
 struct platform_device s3c_device_camif = {
diff --git a/arch/arm/plat-samsung/include/plat/map-s3c.h b/arch/arm/plat-samsung/include/plat/map-s3c.h
index 7d048759b772..c0c70a895ca8 100644
--- a/arch/arm/plat-samsung/include/plat/map-s3c.h
+++ b/arch/arm/plat-samsung/include/plat/map-s3c.h
@@ -22,7 +22,7 @@
 #define S3C24XX_VA_WATCHDOG     S3C_VA_WATCHDOG
 #define S3C2412_VA_SSMC         S3C_ADDR_CPU(0x00000000)
-#define S3C2412_VA_EBI          S3C_ADDR_CPU(0x00010000)
+#define S3C2412_VA_EBI          S3C_ADDR_CPU(0x00100000)
 #define S3C2410_PA_UART         (0x50000000)
 #define S3C24XX_PA_UART         S3C2410_PA_UART
diff --git a/arch/arm/plat-samsung/include/plat/watchdog-reset.h b/arch/arm/plat-samsung/include/plat/watchdog-reset.h
index f19aff19205c..bc4db9b04e36 100644
--- a/arch/arm/plat-samsung/include/plat/watchdog-reset.h
+++ b/arch/arm/plat-samsung/include/plat/watchdog-reset.h
@@ -25,7 +25,7 @@ static inline void arch_wdt_reset(void)
        __raw_writel(0, S3C2410_WTCON);   /* disable watchdog, to be safe  */
-        if (s3c2410_wdtclk)
+        if (!IS_ERR(s3c2410_wdtclk))
                clk_enable(s3c2410_wdtclk);
        /* put initial values into count and data */
diff --git a/arch/arm/plat-samsung/s5p-clock.c b/arch/arm/plat-samsung/s5p-clock.c
index 031a61899bef..48a159911037 100644
--- a/arch/arm/plat-samsung/s5p-clock.c
+++ b/arch/arm/plat-samsung/s5p-clock.c
@@ -37,6 +37,7 @@ struct clk clk_ext_xtal_mux = {
 struct clk clk_xusbxti = {
        .name           = "xusbxti",
        .id             = -1,
+        .rate           = 24000000,
 };
 struct clk s5p_clk_27m = {
diff --git a/arch/h8300/include/asm/pgtable.h b/arch/h8300/include/asm/pgtable.h
index a09230a08e02..62ef17676b40 100644
--- a/arch/h8300/include/asm/pgtable.h
+++ b/arch/h8300/include/asm/pgtable.h
@@ -70,4 +70,7 @@ extern int is_in_rom(unsigned long);
 #define VMALLOC_END     0xffffffff
 #define arch_enter_lazy_cpu_mode()    do {} while (0)
+#include <asm-generic/pgtable.h>
 #endif /* _H8300_PGTABLE_H */
diff --git a/arch/h8300/include/asm/uaccess.h b/arch/h8300/include/asm/uaccess.h
index 356068cd0879..8725d1ad4272 100644
--- a/arch/h8300/include/asm/uaccess.h
+++ b/arch/h8300/include/asm/uaccess.h
@@ -100,7 +100,6 @@ extern int __put_user_bad(void);
        break;                                                  \
    default:                                                    \
        __gu_err = __get_user_bad();                            \
-        __gu_val = 0;                                           \
        break;                                                  \
    }                                                           \
    (x) = __gu_val;                                             \
@@ -159,4 +158,6 @@ clear_user(void *to, unsigned long n)
        return 0;
 }
+#define __clear_user    clear_user
 #endif /* _H8300_UACCESS_H */
diff --git a/arch/h8300/kernel/signal.c b/arch/h8300/kernel/signal.c
index fca10378701b..5adaadaf9218 100644
--- a/arch/h8300/kernel/signal.c
+++ b/arch/h8300/kernel/signal.c
@@ -447,7 +447,7 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
 * want to handle. Thus you cannot kill init even with a SIGKILL even by
 * mistake.
 */
-statis void do_signal(struct pt_regs *regs)
+static void do_signal(struct pt_regs *regs)
 {
        siginfo_t info;
        int signr;
diff --git a/arch/h8300/kernel/time.c b/arch/h8300/kernel/time.c
index 32263a138aa6..e0f74191d553 100644
--- a/arch/h8300/kernel/time.c
+++ b/arch/h8300/kernel/time.c
@@ -27,6 +27,7 @@
 #include <linux/profile.h>
 #include <asm/io.h>
+#include <asm/irq_regs.h>
 #include <asm/timer.h>
 #define TICK_SIZE (tick_nsec / 1000)
diff --git a/arch/m32r/boot/compressed/Makefile b/arch/m32r/boot/compressed/Makefile
index 177716b1d613..01729c2979ba 100644
--- a/arch/m32r/boot/compressed/Makefile
+++ b/arch/m32r/boot/compressed/Makefile
@@ -43,9 +43,9 @@ endif
 OBJCOPYFLAGS += -R .empty_zero_page
-suffix_$(CONFIG_KERNEL_GZIP)    = gz
+suffix-$(CONFIG_KERNEL_GZIP)    = gz
-suffix_$(CONFIG_KERNEL_BZIP2)   = bz2
+suffix-$(CONFIG_KERNEL_BZIP2)   = bz2
-suffix_$(CONFIG_KERNEL_LZMA)    = lzma
+suffix-$(CONFIG_KERNEL_LZMA)    = lzma
 $(obj)/piggy.o: $(obj)/vmlinux.scr $(obj)/vmlinux.bin.$(suffix-y) FORCE
        $(call if_changed,ld)
diff --git a/arch/m32r/boot/compressed/misc.c b/arch/m32r/boot/compressed/misc.c
index 370d60881977..28a09529f206 100644
--- a/arch/m32r/boot/compressed/misc.c
+++ b/arch/m32r/boot/compressed/misc.c
@@ -28,7 +28,7 @@ static unsigned long free_mem_ptr;
 static unsigned long free_mem_end_ptr;
 #ifdef CONFIG_KERNEL_BZIP2
-static void *memset(void *s, int c, size_t n)
+void *memset(void *s, int c, size_t n)
 {
        char *ss = s;
@@ -39,6 +39,16 @@ static void *memset(void *s, int c, size_t n)
 #endif
 #ifdef CONFIG_KERNEL_GZIP
+void *memcpy(void *dest, const void *src, size_t n)
+{
+        char *d = dest;
+        const char *s = src;
+        while (n--)
+                *d++ = *s++;
+        return dest;
+}
 #define BOOT_HEAP_SIZE             0x10000
 #include "../../../../lib/decompress_inflate.c"
 #endif
diff --git a/arch/m32r/include/asm/ptrace.h b/arch/m32r/include/asm/ptrace.h
index 527527584dd0..4313aa62b51b 100644
--- a/arch/m32r/include/asm/ptrace.h
+++ b/arch/m32r/include/asm/ptrace.h
@@ -113,9 +113,6 @@ struct pt_regs {
 #define PTRACE_OLDSETOPTIONS    21
-/* options set using PTRACE_SETOPTIONS */
-#define PTRACE_O_TRACESYSGOOD   0x00000001
 #ifdef __KERNEL__
 #include <asm/m32r.h>           /* M32R_PSW_BSM, M32R_PSW_BPM */
diff --git a/arch/m32r/kernel/ptrace.c b/arch/m32r/kernel/ptrace.c
index 4c03361537aa..51f5e9aa4901 100644
--- a/arch/m32r/kernel/ptrace.c
+++ b/arch/m32r/kernel/ptrace.c
@@ -591,17 +591,16 @@ void user_enable_single_step(struct task_struct *child)
        if (access_process_vm(child, pc&~3, &insn, sizeof(insn), 0)
            != sizeof(insn))
-                return -EIO;
+                return;
        compute_next_pc(insn, pc, &next_pc, child);
        if (next_pc & 0x80000000)
-                return -EIO;
+                return;
        if (embed_debug_trap(child, next_pc))
-                return -EIO;
+                return;
        invalidate_cache();
-        return 0;
 }
 void user_disable_single_step(struct task_struct *child)
diff --git a/arch/m32r/kernel/signal.c b/arch/m32r/kernel/signal.c
index f3fb2c029cfc..d0f60b97bbc5 100644
--- a/arch/m32r/kernel/signal.c
+++ b/arch/m32r/kernel/signal.c
@@ -286,7 +286,7 @@ handle_signal(unsigned long sig, struct k_sigaction *ka, siginfo_t *info,
                        case -ERESTARTNOINTR:
                                regs->r0 = regs->orig_r0;
                                if (prev_insn(regs) < 0)
-                                        return -EFAULT;
+                                        return;
                }
        }
diff --git a/arch/m68k/platform/coldfire/clk.c b/arch/m68k/platform/coldfire/clk.c
index 9f1260c5e2ad..44da406897e5 100644
--- a/arch/m68k/platform/coldfire/clk.c
+++ b/arch/m68k/platform/coldfire/clk.c
@@ -42,4 +42,11 @@ unsigned long clk_get_rate(struct clk *clk)
        return MCF_CLK;
 }
 EXPORT_SYMBOL(clk_get_rate);
+struct clk *devm_clk_get(struct device *dev, const char *id)
+{
+        return NULL;
+}
+EXPORT_SYMBOL(devm_clk_get);
 /***************************************************************************/
diff --git a/arch/mips/include/asm/bitops.h b/arch/mips/include/asm/bitops.h
index 2e1ad4c652b7..82ad35ce2b45 100644
--- a/arch/mips/include/asm/bitops.h
+++ b/arch/mips/include/asm/bitops.h
@@ -17,7 +17,6 @@
 #include <linux/irqflags.h>
 #include <linux/types.h>
 #include <asm/barrier.h>
-#include <asm/bug.h>
 #include <asm/byteorder.h>              /* sigh ... */
 #include <asm/cpu-features.h>
 #include <asm/sgidefs.h>
diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
index a58f22998a86..29d9c23c20c7 100644
--- a/arch/mips/include/asm/io.h
+++ b/arch/mips/include/asm/io.h
@@ -17,6 +17,7 @@
 #include <linux/types.h>
 #include <asm/addrspace.h>
+#include <asm/bug.h>
 #include <asm/byteorder.h>
 #include <asm/cpu.h>
 #include <asm/cpu-features.h>
diff --git a/arch/mips/pci/pci-lantiq.c b/arch/mips/pci/pci-lantiq.c
index ea453532a33c..075d87acd12a 100644
--- a/arch/mips/pci/pci-lantiq.c
+++ b/arch/mips/pci/pci-lantiq.c
@@ -129,7 +129,7 @@ static int __devinit ltq_pci_startup(struct platform_device *pdev)
        /* setup reset gpio used by pci */
        reset_gpio = of_get_named_gpio(node, "gpio-reset", 0);
-        if (reset_gpio > 0)
+        if (gpio_is_valid(reset_gpio))
                devm_gpio_request(&pdev->dev, reset_gpio, "pci-reset");
        /* enable auto-switching between PCI and EBU */
@@ -192,7 +192,7 @@ static int __devinit ltq_pci_startup(struct platform_device *pdev)
        ltq_ebu_w32(ltq_ebu_r32(LTQ_EBU_PCC_IEN) | 0x10, LTQ_EBU_PCC_IEN);
        /* toggle reset pin */
-        if (reset_gpio > 0) {
+        if (gpio_is_valid(reset_gpio)) {
                __gpio_set_value(reset_gpio, 0);
                wmb();
                mdelay(1);
diff --git a/arch/mn10300/include/asm/ptrace.h b/arch/mn10300/include/asm/ptrace.h
index 55b79ef10028..44251b974f1d 100644
--- a/arch/mn10300/include/asm/ptrace.h
+++ b/arch/mn10300/include/asm/ptrace.h
@@ -81,9 +81,6 @@ struct pt_regs {
 #define PTRACE_GETFPREGS          14
 #define PTRACE_SETFPREGS          15
-/* options set using PTRACE_SETOPTIONS */
-#define PTRACE_O_TRACESYSGOOD     0x00000001
 #ifdef __KERNEL__
 #define user_mode(regs)                 (((regs)->epsw & EPSW_nSL) == EPSW_nSL)
diff --git a/arch/mn10300/include/asm/thread_info.h b/arch/mn10300/include/asm/thread_info.h
index 08251d6f6b11..ac519bbd42ff 100644
--- a/arch/mn10300/include/asm/thread_info.h
+++ b/arch/mn10300/include/asm/thread_info.h
@@ -123,7 +123,7 @@ static inline unsigned long current_stack_pointer(void)
 }
 #ifndef CONFIG_KGDB
-void arch_release_thread_info(struct thread_info *ti)
+void arch_release_thread_info(struct thread_info *ti);
 #endif
 #define get_thread_info(ti)     get_task_struct((ti)->task)
 #define put_thread_info(ti)     put_task_struct((ti)->task)
diff --git a/arch/mn10300/include/asm/timex.h b/arch/mn10300/include/asm/timex.h
index bd4e90dfe6c2..f8e66425cbf8 100644
--- a/arch/mn10300/include/asm/timex.h
+++ b/arch/mn10300/include/asm/timex.h
@@ -11,7 +11,6 @@
 #ifndef _ASM_TIMEX_H
 #define _ASM_TIMEX_H
-#include <asm/hardirq.h>
 #include <unit/timex.h>
 #define TICK_SIZE (tick_nsec / 1000)
@@ -30,16 +29,6 @@ static inline cycles_t get_cycles(void)
 extern int init_clockevents(void);
 extern int init_clocksource(void);
-static inline void setup_jiffies_interrupt(int irq,
-                                           struct irqaction *action)
-{
-        u16 tmp;
-        setup_irq(irq, action);
-        set_intr_level(irq, NUM2GxICR_LEVEL(CONFIG_TIMER_IRQ_LEVEL));
-        GxICR(irq) |= GxICR_ENABLE | GxICR_DETECT | GxICR_REQUEST;
-        tmp = GxICR(irq);
-}
 #endif /* __KERNEL__ */
 #endif /* _ASM_TIMEX_H */
diff --git a/arch/mn10300/kernel/cevt-mn10300.c b/arch/mn10300/kernel/cevt-mn10300.c
index 69cae0260786..ccce35e3e179 100644
--- a/arch/mn10300/kernel/cevt-mn10300.c
+++ b/arch/mn10300/kernel/cevt-mn10300.c
@@ -70,6 +70,16 @@ static void event_handler(struct clock_event_device *dev)
 {
 }
+static inline void setup_jiffies_interrupt(int irq,
+                                           struct irqaction *action)
+{
+        u16 tmp;
+        setup_irq(irq, action);
+        set_intr_level(irq, NUM2GxICR_LEVEL(CONFIG_TIMER_IRQ_LEVEL));
+        GxICR(irq) |= GxICR_ENABLE | GxICR_DETECT | GxICR_REQUEST;
+        tmp = GxICR(irq);
+}
 int __init init_clockevents(void)
 {
        struct clock_event_device *cd;
diff --git a/arch/mn10300/kernel/internal.h b/arch/mn10300/kernel/internal.h
index a5ac755dd69f..2df440105a80 100644
--- a/arch/mn10300/kernel/internal.h
+++ b/arch/mn10300/kernel/internal.h
@@ -9,6 +9,8 @@
 * 2 of the Licence, or (at your option) any later version.
 */
+#include <linux/irqreturn.h>
 struct clocksource;
 struct clock_event_device;
diff --git a/arch/mn10300/kernel/irq.c b/arch/mn10300/kernel/irq.c
index 2381df83bd00..35932a8de8b8 100644
--- a/arch/mn10300/kernel/irq.c
+++ b/arch/mn10300/kernel/irq.c
@@ -170,9 +170,9 @@ mn10300_cpupic_setaffinity(struct irq_data *d, const struct cpumask *mask,
        case SC1TXIRQ:
 #ifdef CONFIG_MN10300_TTYSM1_TIMER12
        case TM12IRQ:
-#elif CONFIG_MN10300_TTYSM1_TIMER9
+#elif defined(CONFIG_MN10300_TTYSM1_TIMER9)
        case TM9IRQ:
-#elif CONFIG_MN10300_TTYSM1_TIMER3
+#elif defined(CONFIG_MN10300_TTYSM1_TIMER3)
        case TM3IRQ:
 #endif /* CONFIG_MN10300_TTYSM1_TIMER12 */
 #endif /* CONFIG_MN10300_TTYSM1 */
diff --git a/arch/mn10300/kernel/signal.c b/arch/mn10300/kernel/signal.c
index 6ab0bee2a54f..4d584ae29ae1 100644
--- a/arch/mn10300/kernel/signal.c
+++ b/arch/mn10300/kernel/signal.c
@@ -459,10 +459,11 @@ static int handle_signal(int sig,
        else
                ret = setup_frame(sig, ka, oldset, regs);
        if (ret)
-                return;
+                return ret;
        signal_delivered(sig, info, ka, regs,
-                                 test_thread_flag(TIF_SINGLESTEP));
+                         test_thread_flag(TIF_SINGLESTEP));
+        return 0;
 }
 /*
diff --git a/arch/mn10300/kernel/traps.c b/arch/mn10300/kernel/traps.c
index 94a9c6d53e1b..b900e5afa0ae 100644
--- a/arch/mn10300/kernel/traps.c
+++ b/arch/mn10300/kernel/traps.c
@@ -26,6 +26,7 @@
 #include <linux/kdebug.h>
 #include <linux/bug.h>
 #include <linux/irq.h>
+#include <linux/export.h>
 #include <asm/processor.h>
 #include <linux/uaccess.h>
 #include <asm/io.h>
diff --git a/arch/mn10300/mm/dma-alloc.c b/arch/mn10300/mm/dma-alloc.c
index 159acb02cfd4..e244ebe637e1 100644
--- a/arch/mn10300/mm/dma-alloc.c
+++ b/arch/mn10300/mm/dma-alloc.c
@@ -15,6 +15,7 @@
 #include <linux/string.h>
 #include <linux/pci.h>
 #include <linux/gfp.h>
+#include <linux/export.h>
 #include <asm/io.h>
 static unsigned long pci_sram_allocated = 0xbc000000;
diff --git a/arch/mn10300/unit-asb2303/include/unit/timex.h b/arch/mn10300/unit-asb2303/include/unit/timex.h
index cc18fe7d8b90..c37f9832cf17 100644
--- a/arch/mn10300/unit-asb2303/include/unit/timex.h
+++ b/arch/mn10300/unit-asb2303/include/unit/timex.h
@@ -11,10 +11,6 @@
 #ifndef _ASM_UNIT_TIMEX_H
 #define _ASM_UNIT_TIMEX_H
-#ifndef __ASSEMBLY__
-#include <linux/irq.h>
-#endif /* __ASSEMBLY__ */
 #include <asm/timer-regs.h>
 #include <unit/clock.h>
 #include <asm/param.h>
diff --git a/arch/mn10300/unit-asb2303/smc91111.c b/arch/mn10300/unit-asb2303/smc91111.c
index 43c246439413..53677694b165 100644
--- a/arch/mn10300/unit-asb2303/smc91111.c
+++ b/arch/mn10300/unit-asb2303/smc91111.c
@@ -15,6 +15,7 @@
 #include <linux/platform_device.h>
 #include <asm/io.h>
+#include <asm/irq.h>
 #include <asm/timex.h>
 #include <asm/processor.h>
 #include <asm/intctl-regs.h>
diff --git a/arch/mn10300/unit-asb2305/include/unit/timex.h b/arch/mn10300/unit-asb2305/include/unit/timex.h
index 758af30d1a16..4cefc224f448 100644
--- a/arch/mn10300/unit-asb2305/include/unit/timex.h
+++ b/arch/mn10300/unit-asb2305/include/unit/timex.h
@@ -11,10 +11,6 @@
 #ifndef _ASM_UNIT_TIMEX_H
 #define _ASM_UNIT_TIMEX_H
-#ifndef __ASSEMBLY__
-#include <linux/irq.h>
-#endif /* __ASSEMBLY__ */
 #include <asm/timer-regs.h>
 #include <unit/clock.h>
 #include <asm/param.h>
diff --git a/arch/mn10300/unit-asb2305/unit-init.c b/arch/mn10300/unit-asb2305/unit-init.c
index e1becd6b7571..bc4adfaf815c 100644
--- a/arch/mn10300/unit-asb2305/unit-init.c
+++ b/arch/mn10300/unit-asb2305/unit-init.c
@@ -13,6 +13,7 @@
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <asm/io.h>
+#include <asm/irq.h>
 #include <asm/setup.h>
 #include <asm/processor.h>
 #include <asm/intctl-regs.h>
diff --git a/arch/mn10300/unit-asb2364/include/unit/timex.h b/arch/mn10300/unit-asb2364/include/unit/timex.h
index ddb7ed010706..42f32db75087 100644
--- a/arch/mn10300/unit-asb2364/include/unit/timex.h
+++ b/arch/mn10300/unit-asb2364/include/unit/timex.h
@@ -11,10 +11,6 @@
 #ifndef _ASM_UNIT_TIMEX_H
 #define _ASM_UNIT_TIMEX_H
-#ifndef __ASSEMBLY__
-#include <linux/irq.h>
-#endif /* __ASSEMBLY__ */
 #include <asm/timer-regs.h>
 #include <unit/clock.h>
 #include <asm/param.h>
diff --git a/arch/powerpc/include/asm/hw_irq.h b/arch/powerpc/include/asm/hw_irq.h
index 32b394f3b854..0554ab062bdc 100644
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -86,8 +86,8 @@ static inline bool arch_irqs_disabled(void)
 }
 #ifdef CONFIG_PPC_BOOK3E
-#define __hard_irq_enable()     asm volatile("wrteei 1" : : : "memory");
+#define __hard_irq_enable()     asm volatile("wrteei 1" : : : "memory")
-#define __hard_irq_disable()    asm volatile("wrteei 0" : : : "memory");
+#define __hard_irq_disable()    asm volatile("wrteei 0" : : : "memory")
 #else
 #define __hard_irq_enable()     __mtmsrd(local_paca->kernel_msr | MSR_EE, 1)
 #define __hard_irq_disable()    __mtmsrd(local_paca->kernel_msr, 1)
@@ -103,6 +103,11 @@ static inline void hard_irq_disable(void)
 /* include/linux/interrupt.h needs hard_irq_disable to be a macro */
 #define hard_irq_disable        hard_irq_disable
+static inline bool lazy_irq_pending(void)
+{
+        return !!(get_paca()->irq_happened & ~PACA_IRQ_HARD_DIS);
+}
 /*
 * This is called by asynchronous interrupts to conditionally
 * re-enable hard interrupts when soft-disabled after having
@@ -120,6 +125,8 @@ static inline bool arch_irq_disabled_regs(struct pt_regs *regs)
        return !regs->softe;
 }
+extern bool prep_irq_for_idle(void);
 #else /* CONFIG_PPC64 */
 #define SET_MSR_EE(x)   mtmsr(x)
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index ed1718feb9d9..5971c85df136 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -558,27 +558,54 @@ _GLOBAL(ret_from_except_lite)
        mtmsrd  r10,1             /* Update machine state */
 #endif /* CONFIG_PPC_BOOK3E */
-#ifdef CONFIG_PREEMPT
        clrrdi  r9,r1,THREAD_SHIFT      /* current_thread_info() */
-        li      r0,_TIF_NEED_RESCHED    /* bits to check */
        ld      r3,_MSR(r1)
        ld      r4,TI_FLAGS(r9)
-        /* Move MSR_PR bit in r3 to _TIF_SIGPENDING position in r0 */
-        rlwimi  r0,r3,32+TIF_SIGPENDING-MSR_PR_LG,_TIF_SIGPENDING
-        and.    r0,r4,r0        /* check NEED_RESCHED and maybe SIGPENDING */
-        bne     do_work
-#else /* !CONFIG_PREEMPT */
-        ld      r3,_MSR(r1)     /* Returning to user mode? */
        andi.   r3,r3,MSR_PR
-        beq     restore         /* if not, just restore regs and return */
+        beq     resume_kernel
        /* Check current_thread_info()->flags */
+        andi.   r0,r4,_TIF_USER_WORK_MASK
+        beq     restore
+        andi.   r0,r4,_TIF_NEED_RESCHED
+        beq     1f
+        bl      .restore_interrupts
+        bl      .schedule
+        b       .ret_from_except_lite
+1:      bl      .save_nvgprs
+        bl      .restore_interrupts
+        addi    r3,r1,STACK_FRAME_OVERHEAD
+        bl      .do_notify_resume
+        b       .ret_from_except
+resume_kernel:
+#ifdef CONFIG_PREEMPT
+        /* Check if we need to preempt */
+        andi.   r0,r4,_TIF_NEED_RESCHED
+        beq+    restore
+        /* Check that preempt_count() == 0 and interrupts are enabled */
+        lwz     r8,TI_PREEMPT(r9)
+        cmpwi   cr1,r8,0
+        ld      r0,SOFTE(r1)
+        cmpdi   r0,0
+        crandc  eq,cr1*4+eq,eq
+        bne     restore
+        /*
+         * Here we are preempting the current task. We want to make
+         * sure we are soft-disabled first
+         */
+        SOFT_DISABLE_INTS(r3,r4)
+1:      bl      .preempt_schedule_irq
+        /* Re-test flags and eventually loop */
        clrrdi  r9,r1,THREAD_SHIFT
        ld      r4,TI_FLAGS(r9)
-        andi.   r0,r4,_TIF_USER_WORK_MASK
+        andi.   r0,r4,_TIF_NEED_RESCHED
-        bne     do_work
+        bne     1b
-#endif /* !CONFIG_PREEMPT */
+#endif /* CONFIG_PREEMPT */
        .globl  fast_exc_return_irq
 fast_exc_return_irq:
@@ -759,50 +786,6 @@ restore_check_irq_replay:
 #endif /* CONFIG_PPC_BOOK3E */
 1:      b       .ret_from_except /* What else to do here ? */
 
-3:
-do_work:
-#ifdef CONFIG_PREEMPT
-        andi.   r0,r3,MSR_PR    /* Returning to user mode? */
-        bne     user_work
-        /* Check that preempt_count() == 0 and interrupts are enabled */
-        lwz     r8,TI_PREEMPT(r9)
-        cmpwi   cr1,r8,0
-        ld      r0,SOFTE(r1)
-        cmpdi   r0,0
-        crandc  eq,cr1*4+eq,eq
-        bne     restore
-        /*
-         * Here we are preempting the current task. We want to make
-         * sure we are soft-disabled first
-         */
-        SOFT_DISABLE_INTS(r3,r4)
-1:      bl      .preempt_schedule_irq
-        /* Re-test flags and eventually loop */
-        clrrdi  r9,r1,THREAD_SHIFT
-        ld      r4,TI_FLAGS(r9)
-        andi.   r0,r4,_TIF_NEED_RESCHED
-        bne     1b
-        b       restore
-user_work:
-#endif /* CONFIG_PREEMPT */
-        andi.   r0,r4,_TIF_NEED_RESCHED
-        beq     1f
-        bl      .restore_interrupts
-        bl      .schedule
-        b       .ret_from_except_lite
-1:      bl      .save_nvgprs
-        bl      .restore_interrupts
-        addi    r3,r1,STACK_FRAME_OVERHEAD
-        bl      .do_notify_resume
-        b       .ret_from_except
 unrecov_restore:
        addi    r3,r1,STACK_FRAME_OVERHEAD
        bl      .unrecoverable_exception
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 7835a5e1ea5f..1f017bb7a7ce 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -229,7 +229,7 @@ notrace void arch_local_irq_restore(unsigned long en)
         */
        if (unlikely(irq_happened != PACA_IRQ_HARD_DIS))
                __hard_irq_disable();
-#ifdef CONFIG_TRACE_IRQFLAG
+#ifdef CONFIG_TRACE_IRQFLAGS
        else {
                /*
                 * We should already be hard disabled here. We had bugs
@@ -277,7 +277,7 @@ EXPORT_SYMBOL(arch_local_irq_restore);
 * NOTE: This is called with interrupts hard disabled but not marked
 * as such in paca->irq_happened, so we need to resync this.
 */
-void restore_interrupts(void)
+void notrace restore_interrupts(void)
 {
        if (irqs_disabled()) {
                local_paca->irq_happened |= PACA_IRQ_HARD_DIS;
@@ -286,6 +286,52 @@ void restore_interrupts(void)
                __hard_irq_enable();
 }
+/*
+ * This is a helper to use when about to go into idle low-power
+ * when the latter has the side effect of re-enabling interrupts
+ * (such as calling H_CEDE under pHyp).
+ *
+ * You call this function with interrupts soft-disabled (this is
+ * already the case when ppc_md.power_save is called). The function
+ * will return whether to enter power save or just return.
+ *
+ * In the former case, it will have notified lockdep of interrupts
+ * being re-enabled and generally sanitized the lazy irq state,
+ * and in the latter case it will leave with interrupts hard
+ * disabled and marked as such, so the local_irq_enable() call
+ * in cpu_idle() will properly re-enable everything.
+ */
+bool prep_irq_for_idle(void)
+{
+        /*
+         * First we need to hard disable to ensure no interrupt
+         * occurs before we effectively enter the low power state
+         */
+        hard_irq_disable();
+        /*
+         * If anything happened while we were soft-disabled,
+         * we return now and do not enter the low power state.
+         */
+        if (lazy_irq_pending())
+                return false;
+        /* Tell lockdep we are about to re-enable */
+        trace_hardirqs_on();
+        /*
+         * Mark interrupts as soft-enabled and clear the
+         * PACA_IRQ_HARD_DIS from the pending mask since we
+         * are about to hard enable as well as a side effect
+         * of entering the low power state.
+         */
+        local_paca->irq_happened &= ~PACA_IRQ_HARD_DIS;
+        local_paca->soft_enabled = 1;
+        /* Tell the caller to enter the low power state */
+        return true;
+}
 #endif /* CONFIG_PPC64 */
 int arch_show_interrupts(struct seq_file *p, int prec)
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 1b488e5305c5..0794a3017b1b 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -1312,7 +1312,7 @@ static struct opal_secondary_data {
 extern char opal_secondary_entry;
-static void prom_query_opal(void)
+static void __init prom_query_opal(void)
 {
        long rc;
@@ -1436,7 +1436,7 @@ static void __init prom_opal_hold_cpus(void)
        prom_debug("prom_opal_hold_cpus: end...\n");
 }
-static void prom_opal_takeover(void)
+static void __init prom_opal_takeover(void)
 {
        struct opal_secondary_data *data = &RELOC(opal_secondary_data);
        struct opal_takeover_args *args = &data->args;
diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index a84aafce2a12..a1044f43becd 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -810,7 +810,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_201)
        lwz     r3,VCORE_NAPPING_THREADS(r5)
        lwz     r4,VCPU_PTID(r9)
        li      r0,1
-        sldi    r0,r0,r4
+        sld     r0,r0,r4
        andc.   r3,r3,r0                /* no sense IPI'ing ourselves */
        beq     43f
        mulli   r4,r4,PACA_SIZE         /* get paca for thread 0 */
diff --git a/arch/powerpc/kvm/book3s_pr_papr.c b/arch/powerpc/kvm/book3s_pr_papr.c
index 3ff9013d6e79..ee02b30878ed 100644
--- a/arch/powerpc/kvm/book3s_pr_papr.c
+++ b/arch/powerpc/kvm/book3s_pr_papr.c
@@ -241,6 +241,7 @@ int kvmppc_h_pr(struct kvm_vcpu *vcpu, unsigned long cmd)
        case H_PUT_TCE:
                return kvmppc_h_pr_put_tce(vcpu);
        case H_CEDE:
+                vcpu->arch.shared->msr |= MSR_EE;
                kvm_vcpu_block(vcpu);
                clear_bit(KVM_REQ_UNHALT, &vcpu->requests);
                vcpu->stat.halt_wakeup++;
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index b6edbb3b4a54..1e95556dc692 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -635,11 +635,11 @@ static inline int __init read_usm_ranges(const u32 **usm)
 */
 static void __init parse_drconf_memory(struct device_node *memory)
 {
-        const u32 *dm, *usm;
+        const u32 *uninitialized_var(dm), *usm;
        unsigned int n, rc, ranges, is_kexec_kdump = 0;
        unsigned long lmb_size, base, size, sz;
        int nid;
-        struct assoc_arrays aa;
+        struct assoc_arrays aa = { .arrays = NULL };
        n = of_get_drconf_memory(memory, &dm);
        if (!n)
diff --git a/arch/powerpc/net/bpf_jit_64.S b/arch/powerpc/net/bpf_jit_64.S
index 55ba3855a97f..7d3a3b5619a2 100644
--- a/arch/powerpc/net/bpf_jit_64.S
+++ b/arch/powerpc/net/bpf_jit_64.S
@@ -105,6 +105,7 @@ sk_load_byte_msh_positive_offset:
        mr      r4, r_addr;                                     \
        li      r6, SIZE;                                       \
        bl      skb_copy_bits;                                  \
+        nop;                                                    \
        /* R3 = 0 on success */                                 \
        addi    r1, r1, BPF_PPC_SLOWPATH_FRAME;                 \
        ld      r0, 16(r1);                                     \
@@ -156,6 +157,7 @@ bpf_slow_path_byte_msh:
        mr      r4, r_addr;                                     \
        li      r5, SIZE;                                       \
        bl      bpf_internal_load_pointer_neg_helper;           \
+        nop;                                                    \
        /* R3 != 0 on success */                                \
        addi    r1, r1, BPF_PPC_SLOWPATH_FRAME;                 \
        ld      r0, 16(r1);                                     \
diff --git a/arch/powerpc/platforms/cell/pervasive.c b/arch/powerpc/platforms/cell/pervasive.c
index efdacc829576..d17e98bc0c10 100644
--- a/arch/powerpc/platforms/cell/pervasive.c
+++ b/arch/powerpc/platforms/cell/pervasive.c
@@ -42,11 +42,9 @@ static void cbe_power_save(void)
 {
        unsigned long ctrl, thread_switch_control;
-        /*
+        /* Ensure our interrupt state is properly tracked */
-         * We need to hard disable interrupts, the local_irq_enable() done by
+        if (!prep_irq_for_idle())
-         * our caller upon return will hard re-enable.
+                return;
-         */
-        hard_irq_disable();
        ctrl = mfspr(SPRN_CTRLF);
@@ -81,6 +79,9 @@ static void cbe_power_save(void)
         */
        ctrl &= ~(CTRL_RUNLATCH | CTRL_TE);
        mtspr(SPRN_CTRLT, ctrl);
+        /* Re-enable interrupts in MSR */
+        __hard_irq_enable();
 }
 static int cbe_system_reset_exception(struct pt_regs *regs)
diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
index 0915b1ad66ce..2d311c0caf8e 100644
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -106,7 +106,7 @@ static int tce_build_pSeries(struct iommu_table *tbl, long index,
                tcep++;
        }
-        if (tbl->it_type == TCE_PCI_SWINV_CREATE)
+        if (tbl->it_type & TCE_PCI_SWINV_CREATE)
                tce_invalidate_pSeries_sw(tbl, tces, tcep - 1);
        return 0;
 }
@@ -121,7 +121,7 @@ static void tce_free_pSeries(struct iommu_table *tbl, long index, long npages)
        while (npages--)
                *(tcep++) = 0;
-        if (tbl->it_type == TCE_PCI_SWINV_FREE)
+        if (tbl->it_type & TCE_PCI_SWINV_FREE)
                tce_invalidate_pSeries_sw(tbl, tces, tcep - 1);
 }
diff --git a/arch/powerpc/platforms/pseries/processor_idle.c b/arch/powerpc/platforms/pseries/processor_idle.c
index 41a34bc4a9a2..c71be66bd5dc 100644
--- a/arch/powerpc/platforms/pseries/processor_idle.c
+++ b/arch/powerpc/platforms/pseries/processor_idle.c
@@ -99,15 +99,18 @@ out:
 static void check_and_cede_processor(void)
 {
        /*
-         * Interrupts are soft-disabled at this point,
+         * Ensure our interrupt state is properly tracked,
-         * but not hard disabled. So an interrupt might have
+         * also checks if no interrupt has occurred while we
-         * occurred before entering NAP, and would be potentially
+         * were soft-disabled
-         * lost (edge events, decrementer events, etc...) unless
-         * we first hard disable then check.
         */
-        hard_irq_disable();
+        if (prep_irq_for_idle()) {
-        if (get_paca()->irq_happened == 0)
                cede_processor();
+#ifdef CONFIG_TRACE_IRQFLAGS
+                /* Ensure that H_CEDE returns with IRQs on */
+                if (WARN_ON(!(mfmsr() & MSR_EE)))
+                        __hard_irq_enable();
+#endif
+        }
 }
 static int dedicated_cede_loop(struct cpuidle_device *dev,
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index 0f3ab06d2222..eab3492a45c5 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -971,7 +971,7 @@ static int cpu_cmd(void)
                /* print cpus waiting or in xmon */
                printf("cpus stopped:");
                count = 0;
-                for (cpu = 0; cpu < NR_CPUS; ++cpu) {
+                for_each_possible_cpu(cpu) {
                        if (cpumask_test_cpu(cpu, &cpus_in_xmon)) {
                                if (count == 0)
                                        printf(" %x", cpu);
diff --git a/arch/sh/boards/mach-kfr2r09/setup.c b/arch/sh/boards/mach-kfr2r09/setup.c
index 158c9176e42a..43a179ce9afc 100644
--- a/arch/sh/boards/mach-kfr2r09/setup.c
+++ b/arch/sh/boards/mach-kfr2r09/setup.c
@@ -201,8 +201,8 @@ static struct resource kfr2r09_usb0_gadget_resources[] = {
                .flags  = IORESOURCE_MEM,
        },
        [1] = {
-                .start  = evtirq(0xa20),
+                .start  = evt2irq(0xa20),
-                .end    = evtirq(0xa20),
+                .end    = evt2irq(0xa20),
                .flags  = IORESOURCE_IRQ | IRQF_TRIGGER_LOW,
        },
 };
diff --git a/arch/sh/drivers/pci/pcie-sh7786.c b/arch/sh/drivers/pci/pcie-sh7786.c
index c045142f7338..9e702f2f8045 100644
--- a/arch/sh/drivers/pci/pcie-sh7786.c
+++ b/arch/sh/drivers/pci/pcie-sh7786.c
@@ -239,7 +239,7 @@ static int __init pcie_clk_init(struct sh7786_pcie_port *port)
        clk->enable_reg = (void __iomem *)(chan->reg_base + SH4A_PCIEPHYCTLR);
        clk->enable_bit = BITS_CKE;
-        ret = sh_clk_mstp32_register(clk, 1);
+        ret = sh_clk_mstp_register(clk, 1);
        if (unlikely(ret < 0))
                goto err_phy;
diff --git a/arch/sh/include/asm/io_noioport.h b/arch/sh/include/asm/io_noioport.h
index e136d28d1d2e..4d48f1436a63 100644
--- a/arch/sh/include/asm/io_noioport.h
+++ b/arch/sh/include/asm/io_noioport.h
@@ -19,9 +19,20 @@ static inline u32 inl(unsigned long addr)
        return -1;
 }
-#define outb(x, y)      BUG()
+static inline void outb(unsigned char x, unsigned long port)
-#define outw(x, y)      BUG()
+{
-#define outl(x, y)      BUG()
+        BUG();
+}
+static inline void outw(unsigned short x, unsigned long port)
+{
+        BUG();
+}
+static inline void outl(unsigned int x, unsigned long port)
+{
+        BUG();
+}
 #define inb_p(addr)     inb(addr)
 #define inw_p(addr)     inw(addr)
diff --git a/arch/sh/kernel/cpu/sh3/serial-sh7720.c b/arch/sh/kernel/cpu/sh3/serial-sh7720.c
index 8832c526cdf9..c4a0336660dd 100644
--- a/arch/sh/kernel/cpu/sh3/serial-sh7720.c
+++ b/arch/sh/kernel/cpu/sh3/serial-sh7720.c
@@ -2,7 +2,7 @@
 #include <linux/serial_core.h>
 #include <linux/io.h>
 #include <cpu/serial.h>
-#include <asm/gpio.h>
+#include <cpu/gpio.h>
 static void sh7720_sci_init_pins(struct uart_port *port, unsigned int cflag)
 {
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7343.c b/arch/sh/kernel/cpu/sh4a/clock-sh7343.c
index ea01a72f1b94..53638e231cd0 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7343.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7343.c
@@ -283,7 +283,7 @@ int __init arch_clk_init(void)
                ret = sh_clk_div6_register(div6_clks, DIV6_NR);
        if (!ret)
-                ret = sh_clk_mstp32_register(mstp_clks, MSTP_NR);
+                ret = sh_clk_mstp_register(mstp_clks, MSTP_NR);
        return ret;
 }
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7366.c b/arch/sh/kernel/cpu/sh4a/clock-sh7366.c
index 7ac07b4f75de..22e485d1990b 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7366.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7366.c
@@ -276,7 +276,7 @@ int __init arch_clk_init(void)
                ret = sh_clk_div6_register(div6_clks, DIV6_NR);
        if (!ret)
-                ret = sh_clk_mstp32_register(mstp_clks, MSTP_NR);
+                ret = sh_clk_mstp_register(mstp_clks, MSTP_NR);
        return ret;
 }
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7722.c b/arch/sh/kernel/cpu/sh4a/clock-sh7722.c
index 8e1f97010c0d..c4cb740e4d10 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7722.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7722.c
@@ -261,7 +261,7 @@ int __init arch_clk_init(void)
                ret = sh_clk_div6_register(div6_clks, DIV6_NR);
        if (!ret)
-                ret = sh_clk_mstp32_register(mstp_clks, HWBLK_NR);
+                ret = sh_clk_mstp_register(mstp_clks, HWBLK_NR);
        return ret;
 }
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7723.c b/arch/sh/kernel/cpu/sh4a/clock-sh7723.c
index 35f75cf0c7e5..37c41c7747a3 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7723.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7723.c
@@ -311,7 +311,7 @@ int __init arch_clk_init(void)
                ret = sh_clk_div6_register(div6_clks, DIV6_NR);
        if (!ret)
-                ret = sh_clk_mstp32_register(mstp_clks, HWBLK_NR);
+                ret = sh_clk_mstp_register(mstp_clks, HWBLK_NR);
        return ret;
 }
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7724.c b/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
index 2a87901673fe..c87e78f73234 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
@@ -375,7 +375,7 @@ int __init arch_clk_init(void)
                ret = sh_clk_div6_reparent_register(div6_clks, DIV6_NR);
        if (!ret)
-                ret = sh_clk_mstp32_register(mstp_clks, HWBLK_NR);
+                ret = sh_clk_mstp_register(mstp_clks, HWBLK_NR);
        return ret;
 }
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7734.c b/arch/sh/kernel/cpu/sh4a/clock-sh7734.c
index 1697642c1f73..deb683abacf0 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7734.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7734.c
@@ -260,7 +260,7 @@ int __init arch_clk_init(void)
                        &div4_table);
        if (!ret)
-                ret = sh_clk_mstp32_register(mstp_clks, MSTP_NR);
+                ret = sh_clk_mstp_register(mstp_clks, MSTP_NR);
        return ret;
 }
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7757.c b/arch/sh/kernel/cpu/sh4a/clock-sh7757.c
index 04ab5aeaf920..e84a43229b9c 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7757.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7757.c
@@ -148,7 +148,7 @@ int __init arch_clk_init(void)
                ret = sh_clk_div4_register(div4_clks, ARRAY_SIZE(div4_clks),
                                           &div4_table);
        if (!ret)
-                ret = sh_clk_mstp32_register(mstp_clks, MSTP_NR);
+                ret = sh_clk_mstp_register(mstp_clks, MSTP_NR);
        return ret;
 }
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7785.c b/arch/sh/kernel/cpu/sh4a/clock-sh7785.c
index ab1c58f2d101..1c83788db76a 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7785.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7785.c
@@ -175,7 +175,7 @@ int __init arch_clk_init(void)
                ret = sh_clk_div4_register(div4_clks, ARRAY_SIZE(div4_clks),
                                           &div4_table);
        if (!ret)
-                ret = sh_clk_mstp32_register(mstp_clks, MSTP_NR);
+                ret = sh_clk_mstp_register(mstp_clks, MSTP_NR);
        return ret;
 }
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7786.c b/arch/sh/kernel/cpu/sh4a/clock-sh7786.c
index 491709483e10..8bba6f159023 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7786.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7786.c
@@ -194,7 +194,7 @@ int __init arch_clk_init(void)
                ret = sh_clk_div4_register(div4_clks, ARRAY_SIZE(div4_clks),
                                           &div4_table);
        if (!ret)
-                ret = sh_clk_mstp32_register(mstp_clks, MSTP_NR);
+                ret = sh_clk_mstp_register(mstp_clks, MSTP_NR);
        return ret;
 }
diff --git a/arch/sh/kernel/cpu/sh4a/clock-shx3.c b/arch/sh/kernel/cpu/sh4a/clock-shx3.c
index 0f11b392bf46..a9422dab0ce7 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-shx3.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-shx3.c
@@ -149,7 +149,7 @@ int __init arch_clk_init(void)
                ret = sh_clk_div4_register(div4_clks, ARRAY_SIZE(div4_clks),
                                           &div4_table);
        if (!ret)
-                ret = sh_clk_mstp32_register(mstp_clks, MSTP_NR);
+                ret = sh_clk_mstp_register(mstp_clks, MSTP_NR);
        return ret;
 }
diff --git a/arch/tile/kernel/backtrace.c b/arch/tile/kernel/backtrace.c
index 9092ce8aa6b4..f8b74ca83b92 100644
--- a/arch/tile/kernel/backtrace.c
+++ b/arch/tile/kernel/backtrace.c
@@ -14,6 +14,7 @@
 #include <linux/kernel.h>
 #include <linux/string.h>
+#include <asm/byteorder.h>
 #include <asm/backtrace.h>
 #include <asm/tile-desc.h>
 #include <arch/abi.h>
@@ -336,8 +337,12 @@ static void find_caller_pc_and_caller_sp(CallerLocation *location,
                                bytes_to_prefetch / sizeof(tile_bundle_bits);
                }
-                /* Decode the next bundle. */
+                /*
-                bundle.bits = prefetched_bundles[next_bundle++];
+                 * Decode the next bundle.
+                 * TILE always stores instruction bundles in little-endian
+                 * mode, even when the chip is running in big-endian mode.
+                 */
+                bundle.bits = le64_to_cpu(prefetched_bundles[next_bundle++]);
                bundle.num_insns =
                        parse_insn_tile(bundle.bits, pc, bundle.insns);
                num_info_ops = bt_get_info_ops(&bundle, info_operands);
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index 88e466b159dc..43b39d61b538 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -705,7 +705,6 @@ static void stack_proc(void *arg)
        struct task_struct *from = current, *to = arg;
        to->thread.saved_task = from;
-        rcu_switch_from(from);
        switch_to(from, to, from);
 }
diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
index daeca56211e3..673ac9b63d6b 100644
--- a/arch/x86/ia32/ia32_signal.c
+++ b/arch/x86/ia32/ia32_signal.c
@@ -38,7 +38,7 @@
 int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
 {
        int err = 0;
-        bool ia32 = is_ia32_task();
+        bool ia32 = test_thread_flag(TIF_IA32);
        if (!access_ok(VERIFY_WRITE, to, sizeof(compat_siginfo_t)))
                return -EFAULT;
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 340ee49961a6..f91e80f4f180 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -176,7 +176,7 @@
 #define X86_FEATURE_XSAVEOPT    (7*32+ 4) /* Optimized Xsave */
 #define X86_FEATURE_PLN         (7*32+ 5) /* Intel Power Limit Notification */
 #define X86_FEATURE_PTS         (7*32+ 6) /* Intel Package Thermal Status */
-#define X86_FEATURE_DTS         (7*32+ 7) /* Digital Thermal Sensor */
+#define X86_FEATURE_DTHERM      (7*32+ 7) /* Digital Thermal Sensor */
 #define X86_FEATURE_HW_PSTATE   (7*32+ 8) /* AMD HW-PState */
 /* Virtualization flags: Linux defined, word 8 */
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 8afb69319815..b2297e58c6ed 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -422,12 +422,14 @@ acpi_parse_int_src_ovr(struct acpi_subtable_header * header,
                return 0;
        }
-        if (intsrc->source_irq == 0 && intsrc->global_irq == 2) {
+        if (intsrc->source_irq == 0) {
                if (acpi_skip_timer_override) {
-                        printk(PREFIX "BIOS IRQ0 pin2 override ignored.\n");
+                        printk(PREFIX "BIOS IRQ0 override ignored.\n");
                        return 0;
                }
-                if (acpi_fix_pin2_polarity && (intsrc->inti_flags & ACPI_MADT_POLARITY_MASK)) {
+                if ((intsrc->global_irq == 2) && acpi_fix_pin2_polarity
+                        && (intsrc->inti_flags & ACPI_MADT_POLARITY_MASK)) {
                        intsrc->inti_flags &= ~ACPI_MADT_POLARITY_MASK;
                        printk(PREFIX "BIOS IRQ0 pin2 override: forcing polarity to high active.\n");
                }
@@ -1334,17 +1336,12 @@ static int __init dmi_disable_acpi(const struct dmi_system_id *d)
 }
 /*
- * Force ignoring BIOS IRQ0 pin2 override
+ * Force ignoring BIOS IRQ0 override
 */
 static int __init dmi_ignore_irq0_timer_override(const struct dmi_system_id *d)
 {
-        /*
-         * The ati_ixp4x0_rev() early PCI quirk should have set
-         * the acpi_skip_timer_override flag already:
-         */
        if (!acpi_skip_timer_override) {
-                WARN(1, KERN_ERR "ati_ixp4x0 quirk not complete.\n");
+                pr_notice("%s detected: Ignoring BIOS IRQ0 override\n",
-                pr_notice("%s detected: Ignoring BIOS IRQ0 pin2 override\n",
                        d->ident);
                acpi_skip_timer_override = 1;
        }
@@ -1438,7 +1435,7 @@ static struct dmi_system_id __initdata acpi_dmi_table_late[] = {
         * is enabled.  This input is incorrectly designated the
         * ISA IRQ 0 via an interrupt source override even though
         * it is wired to the output of the master 8259A and INTIN0
-         * is not connected at all.  Force ignoring BIOS IRQ0 pin2
+         * is not connected at all.  Force ignoring BIOS IRQ0
         * override in that cases.
         */
        {
@@ -1473,6 +1470,14 @@ static struct dmi_system_id __initdata acpi_dmi_table_late[] = {
                     DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"),
                     },
         },
+        {
+         .callback = dmi_ignore_irq0_timer_override,
+         .ident = "FUJITSU SIEMENS",
+         .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "AMILO PRO V2030"),
+                     },
+         },
        {}
 };
diff --git a/arch/x86/kernel/cpu/mkcapflags.pl b/arch/x86/kernel/cpu/mkcapflags.pl
index dfea390e1608..c7b3fe2d72e0 100644
--- a/arch/x86/kernel/cpu/mkcapflags.pl
+++ b/arch/x86/kernel/cpu/mkcapflags.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/perl
+#!/usr/bin/perl -w
 #
 # Generate the x86_cap_flags[] array from include/asm-x86/cpufeature.h
 #
@@ -11,22 +11,35 @@ open(OUT, "> $out\0") or die "$0: cannot create: $out: $!\n";
 print OUT "#include <asm/cpufeature.h>\n\n";
 print OUT "const char * const x86_cap_flags[NCAPINTS*32] = {\n";
+%features = ();
+$err = 0;
 while (defined($line = <IN>)) {
        if ($line =~ /^\s*\#\s*define\s+(X86_FEATURE_(\S+))\s+(.*)$/) {
                $macro = $1;
-                $feature = $2;
+                $feature = "\L$2";
                $tail = $3;
                if ($tail =~ /\/\*\s*\"([^"]*)\".*\*\//) {
-                        $feature = $1;
+                        $feature = "\L$1";
                }
-                if ($feature ne '') {
+                next if ($feature eq '');
-                        printf OUT "\t%-32s = \"%s\",\n",
-                                "[$macro]", "\L$feature";
+                if ($features{$feature}++) {
+                        print STDERR "$in: duplicate feature name: $feature\n";
+                        $err++;
                }
+                printf OUT "\t%-32s = \"%s\",\n", "[$macro]", $feature;
        }
 }
 print OUT "};\n";
 close(IN);
 close(OUT);
+if ($err) {
+        unlink($out);
+        exit(1);
+}
+exit(0);
diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
index addf9e82a7f2..ee8e9abc859f 100644
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -31,7 +31,7 @@ void __cpuinit init_scattered_cpuid_features(struct cpuinfo_x86 *c)
        const struct cpuid_bit *cb;
        static const struct cpuid_bit __cpuinitconst cpuid_bits[] = {
-                { X86_FEATURE_DTS,              CR_EAX, 0, 0x00000006, 0 },
+                { X86_FEATURE_DTHERM,           CR_EAX, 0, 0x00000006, 0 },
                { X86_FEATURE_IDA,              CR_EAX, 1, 0x00000006, 0 },
                { X86_FEATURE_ARAT,             CR_EAX, 2, 0x00000006, 0 },
                { X86_FEATURE_PLN,              CR_EAX, 4, 0x00000006, 0 },
diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index 8bfb6146f753..3f61904365cf 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -444,12 +444,12 @@ void kgdb_roundup_cpus(unsigned long flags)
 /**
 *      kgdb_arch_handle_exception - Handle architecture specific GDB packets.
- *      @vector: The error vector of the exception that happened.
+ *      @e_vector: The error vector of the exception that happened.
 *      @signo: The signal number of the exception that happened.
 *      @err_code: The error code of the exception that happened.
- *      @remcom_in_buffer: The buffer of the packet we have read.
+ *      @remcomInBuffer: The buffer of the packet we have read.
- *      @remcom_out_buffer: The buffer of %BUFMAX bytes to write a packet into.
+ *      @remcomOutBuffer: The buffer of %BUFMAX bytes to write a packet into.
- *      @regs: The &struct pt_regs of the current process.
+ *      @linux_regs: The &struct pt_regs of the current process.
 *
 *      This function MUST handle the 'c' and 's' command packets,
 *      as well packets to set / remove a hardware breakpoint, if used.
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 25b48edb847c..5de92f1abd76 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -451,6 +451,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"),
                },
        },
+        {       /* Handle problems with rebooting on the Precision M6600. */
+                .callback = set_pci_reboot,
+                .ident = "Dell OptiPlex 990",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Precision M6600"),
+                },
+        },
        { }
 };
diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
index 7515cf0e1805..5db36caf4289 100644
--- a/arch/x86/kernel/vsyscall_64.c
+++ b/arch/x86/kernel/vsyscall_64.c
@@ -139,6 +139,19 @@ static int addr_to_vsyscall_nr(unsigned long addr)
        return nr;
 }
+#ifdef CONFIG_SECCOMP
+static int vsyscall_seccomp(struct task_struct *tsk, int syscall_nr)
+{
+        if (!seccomp_mode(&tsk->seccomp))
+                return 0;
+        task_pt_regs(tsk)->orig_ax = syscall_nr;
+        task_pt_regs(tsk)->ax = syscall_nr;
+        return __secure_computing(syscall_nr);
+}
+#else
+#define vsyscall_seccomp(_tsk, _nr) 0
+#endif
 static bool write_ok_or_segv(unsigned long ptr, size_t size)
 {
        /*
@@ -174,6 +187,7 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
        int vsyscall_nr;
        int prev_sig_on_uaccess_error;
        long ret;
+        int skip;
        /*
         * No point in checking CS -- the only way to get here is a user mode
@@ -205,9 +219,6 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
        }
        tsk = current;
-        if (seccomp_mode(&tsk->seccomp))
-                do_exit(SIGKILL);
        /*
         * With a real vsyscall, page faults cause SIGSEGV.  We want to
         * preserve that behavior to make writing exploits harder.
@@ -222,8 +233,13 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
         * address 0".
         */
        ret = -EFAULT;
+        skip = 0;
        switch (vsyscall_nr) {
        case 0:
+                skip = vsyscall_seccomp(tsk, __NR_gettimeofday);
+                if (skip)
+                        break;
                if (!write_ok_or_segv(regs->di, sizeof(struct timeval)) ||
                    !write_ok_or_segv(regs->si, sizeof(struct timezone)))
                        break;
@@ -234,6 +250,10 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
                break;
        case 1:
+                skip = vsyscall_seccomp(tsk, __NR_time);
+                if (skip)
+                        break;
                if (!write_ok_or_segv(regs->di, sizeof(time_t)))
                        break;
@@ -241,6 +261,10 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
                break;
        case 2:
+                skip = vsyscall_seccomp(tsk, __NR_getcpu);
+                if (skip)
+                        break;
                if (!write_ok_or_segv(regs->di, sizeof(unsigned)) ||
                    !write_ok_or_segv(regs->si, sizeof(unsigned)))
                        break;
@@ -253,6 +277,12 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
        current_thread_info()->sig_on_uaccess_error = prev_sig_on_uaccess_error;
+        if (skip) {
+                if ((long)regs->ax <= 0L) /* seccomp errno emulation */
+                        goto do_ret;
+                goto done; /* seccomp trace/trap */
+        }
        if (ret == -EFAULT) {
                /* Bad news -- userspace fed a bad pointer to a vsyscall. */
                warn_bad_vsyscall(KERN_INFO, regs,
@@ -271,10 +301,11 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
        regs->ax = ret;
+do_ret:
        /* Emulate a ret instruction. */
        regs->ip = caller;
        regs->sp += 8;
+done:
        return true;
 sigsegv:
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index be3cea4407ff..57e168e27b5b 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3934,6 +3934,9 @@ static void kvm_mmu_remove_some_alloc_mmu_pages(struct kvm *kvm,
 {
        struct kvm_mmu_page *page;
+        if (list_empty(&kvm->arch.active_mmu_pages))
+                return;
        page = container_of(kvm->arch.active_mmu_pages.prev,
                            struct kvm_mmu_page, link);
        kvm_mmu_prepare_zap_page(kvm, page, invalid_list);
diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
index 459b58a8a15c..25b7ae8d058a 100644
--- a/arch/x86/lib/csum-wrappers_64.c
+++ b/arch/x86/lib/csum-wrappers_64.c
@@ -115,7 +115,7 @@ EXPORT_SYMBOL(csum_partial_copy_to_user);
 * @src: source address
 * @dst: destination address
 * @len: number of bytes to be copied.
- * @isum: initial sum that is added into the result (32bit unfolded)
+ * @sum: initial sum that is added into the result (32bit unfolded)
 *
 * Returns an 32bit unfolded checksum of the buffer.
 */
diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
index 9b306e550e3f..2c8d6a3d250a 100644
--- a/arch/xtensa/kernel/process.c
+++ b/arch/xtensa/kernel/process.c
@@ -277,7 +277,7 @@ void xtensa_elf_core_copy_regs (xtensa_gregset_t *elfregs, struct pt_regs *regs)
        /* Don't leak any random bits. */
-        memset(elfregs, 0, sizeof (elfregs));
+        memset(elfregs, 0, sizeof(*elfregs));
        /* Note:  PS.EXCM is not set while user task is running; its
         * being set in regs->ps is for exception handling convenience.
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 02cf6335e9bd..e7dee617358e 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -125,12 +125,8 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct request_queue *q)
                blkg->pd[i] = pd;
                pd->blkg = blkg;
-        }
-        /* invoke per-policy init */
-        for (i = 0; i < BLKCG_MAX_POLS; i++) {
-                struct blkcg_policy *pol = blkcg_policy[i];
+                /* invoke per-policy init */
                if (blkcg_policy_enabled(blkg->q, pol))
                        pol->pd_init_fn(blkg);
        }
@@ -245,10 +241,9 @@ EXPORT_SYMBOL_GPL(blkg_lookup_create);
 static void blkg_destroy(struct blkcg_gq *blkg)
 {
-        struct request_queue *q = blkg->q;
        struct blkcg *blkcg = blkg->blkcg;
-        lockdep_assert_held(q->queue_lock);
+        lockdep_assert_held(blkg->q->queue_lock);
        lockdep_assert_held(&blkcg->lock);
        /* Something wrong if we are trying to remove same group twice */
diff --git a/block/blk-core.c b/block/blk-core.c
index 3c923a7aeb56..93eb3e4f88ce 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -361,9 +361,10 @@ EXPORT_SYMBOL(blk_put_queue);
 */
 void blk_drain_queue(struct request_queue *q, bool drain_all)
 {
+        int i;
        while (true) {
                bool drain = false;
-                int i;
                spin_lock_irq(q->queue_lock);
@@ -408,6 +409,18 @@ void blk_drain_queue(struct request_queue *q, bool drain_all)
                        break;
                msleep(10);
        }
+        /*
+         * With queue marked dead, any woken up waiter will fail the
+         * allocation path, so the wakeup chaining is lost and we're
+         * left with hung waiters. We need to wake up those waiters.
+         */
+        if (q->request_fn) {
+                spin_lock_irq(q->queue_lock);
+                for (i = 0; i < ARRAY_SIZE(q->rq.wait); i++)
+                        wake_up_all(&q->rq.wait[i]);
+                spin_unlock_irq(q->queue_lock);
+        }
 }
 /**
@@ -467,7 +480,6 @@ void blk_cleanup_queue(struct request_queue *q)
        /* mark @q DEAD, no new request or merges will be allowed afterwards */
        mutex_lock(&q->sysfs_lock);
        queue_flag_set_unlocked(QUEUE_FLAG_DEAD, q);
        spin_lock_irq(lock);
        /*
@@ -485,10 +497,6 @@ void blk_cleanup_queue(struct request_queue *q)
        queue_flag_set(QUEUE_FLAG_NOMERGES, q);
        queue_flag_set(QUEUE_FLAG_NOXMERGES, q);
        queue_flag_set(QUEUE_FLAG_DEAD, q);
-        if (q->queue_lock != &q->__queue_lock)
-                q->queue_lock = &q->__queue_lock;
        spin_unlock_irq(lock);
        mutex_unlock(&q->sysfs_lock);
@@ -499,6 +507,11 @@ void blk_cleanup_queue(struct request_queue *q)
        del_timer_sync(&q->backing_dev_info.laptop_mode_wb_timer);
        blk_sync_queue(q);
+        spin_lock_irq(lock);
+        if (q->queue_lock != &q->__queue_lock)
+                q->queue_lock = &q->__queue_lock;
+        spin_unlock_irq(lock);
        /* @q is and will stay empty, shutdown and put */
        blk_put_queue(q);
 }
diff --git a/block/blk-timeout.c b/block/blk-timeout.c
index 780354888958..6e4744cbfb56 100644
--- a/block/blk-timeout.c
+++ b/block/blk-timeout.c
@@ -197,44 +197,3 @@ void blk_add_timer(struct request *req)
                mod_timer(&q->timeout, expiry);
 }
-/**
- * blk_abort_queue -- Abort all request on given queue
- * @queue:      pointer to queue
- *
- */
-void blk_abort_queue(struct request_queue *q)
-{
-        unsigned long flags;
-        struct request *rq, *tmp;
-        LIST_HEAD(list);
-        /*
-         * Not a request based block device, nothing to abort
-         */
-        if (!q->request_fn)
-                return;
-        spin_lock_irqsave(q->queue_lock, flags);
-        elv_abort_queue(q);
-        /*
-         * Splice entries to local list, to avoid deadlocking if entries
-         * get readded to the timeout list by error handling
-         */
-        list_splice_init(&q->timeout_list, &list);
-        list_for_each_entry_safe(rq, tmp, &list, timeout_list)
-                blk_abort_request(rq);
-        /*
-         * Occasionally, blk_abort_request() will return without
-         * deleting the element from the list. Make sure we add those back
-         * instead of leaving them on the local stack list.
-         */
-        list_splice(&list, &q->timeout_list);
-        spin_unlock_irqrestore(q->queue_lock, flags);
-}
-EXPORT_SYMBOL_GPL(blk_abort_queue);
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 673c977cc2bf..fb52df9744f5 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -17,8 +17,6 @@
 #include "blk.h"
 #include "blk-cgroup.h"
-static struct blkcg_policy blkcg_policy_cfq __maybe_unused;
 /*
 * tunables
 */
@@ -418,11 +416,6 @@ static inline struct cfq_group *pd_to_cfqg(struct blkg_policy_data *pd)
        return pd ? container_of(pd, struct cfq_group, pd) : NULL;
 }
-static inline struct cfq_group *blkg_to_cfqg(struct blkcg_gq *blkg)
-{
-        return pd_to_cfqg(blkg_to_pd(blkg, &blkcg_policy_cfq));
-}
 static inline struct blkcg_gq *cfqg_to_blkg(struct cfq_group *cfqg)
 {
        return pd_to_blkg(&cfqg->pd);
@@ -572,6 +565,13 @@ static inline void cfqg_stats_update_avg_queue_size(struct cfq_group *cfqg) { }
 #ifdef CONFIG_CFQ_GROUP_IOSCHED
+static struct blkcg_policy blkcg_policy_cfq;
+static inline struct cfq_group *blkg_to_cfqg(struct blkcg_gq *blkg)
+{
+        return pd_to_cfqg(blkg_to_pd(blkg, &blkcg_policy_cfq));
+}
 static inline void cfqg_get(struct cfq_group *cfqg)
 {
        return blkg_get(cfqg_to_blkg(cfqg));
@@ -3951,10 +3951,11 @@ static void cfq_exit_queue(struct elevator_queue *e)
        cfq_shutdown_timer_wq(cfqd);
-#ifndef CONFIG_CFQ_GROUP_IOSCHED
+#ifdef CONFIG_CFQ_GROUP_IOSCHED
+        blkcg_deactivate_policy(q, &blkcg_policy_cfq);
+#else
        kfree(cfqd->root_group);
 #endif
-        blkcg_deactivate_policy(q, &blkcg_policy_cfq);
        kfree(cfqd);
 }
@@ -4194,14 +4195,15 @@ static int __init cfq_init(void)
 #ifdef CONFIG_CFQ_GROUP_IOSCHED
        if (!cfq_group_idle)
                cfq_group_idle = 1;
-#else
-                cfq_group_idle = 0;
-#endif
        ret = blkcg_policy_register(&blkcg_policy_cfq);
        if (ret)
                return ret;
+#else
+        cfq_group_idle = 0;
+#endif
+        ret = -ENOMEM;
        cfq_pool = KMEM_CACHE(cfq_queue, 0);
        if (!cfq_pool)
                goto err_pol_unreg;
@@ -4215,13 +4217,17 @@ static int __init cfq_init(void)
 err_free_pool:
        kmem_cache_destroy(cfq_pool);
 err_pol_unreg:
+#ifdef CONFIG_CFQ_GROUP_IOSCHED
        blkcg_policy_unregister(&blkcg_policy_cfq);
+#endif
        return ret;
 }
 static void __exit cfq_exit(void)
 {
+#ifdef CONFIG_CFQ_GROUP_IOSCHED
        blkcg_policy_unregister(&blkcg_policy_cfq);
+#endif
        elv_unregister(&iosched_cfq);
        kmem_cache_destroy(cfq_pool);
 }
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index 260fa80ef575..9a87daa6f4fb 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -721,11 +721,14 @@ int scsi_verify_blk_ioctl(struct block_device *bd, unsigned int cmd)
                break;
        }
+        if (capable(CAP_SYS_RAWIO))
+                return 0;
        /* In particular, rule out all resets and host-specific ioctls.  */
        printk_ratelimited(KERN_WARNING
                           "%s: sending ioctl %x to a partition!\n", current->comm, cmd);
-        return capable(CAP_SYS_RAWIO) ? 0 : -ENOIOCTLCMD;
+        return -ENOIOCTLCMD;
 }
 EXPORT_SYMBOL(scsi_verify_blk_ioctl);
diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index a43fa1a57d57..1502c50273b5 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -36,6 +36,7 @@
 #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
 #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
 static DEFINE_MUTEX(isolated_cpus_lock);
+static DEFINE_MUTEX(round_robin_lock);
 static unsigned long power_saving_mwait_eax;
@@ -107,7 +108,7 @@ static void round_robin_cpu(unsigned int tsk_index)
        if (!alloc_cpumask_var(&tmp, GFP_KERNEL))
                return;
-        mutex_lock(&isolated_cpus_lock);
+        mutex_lock(&round_robin_lock);
        cpumask_clear(tmp);
        for_each_cpu(cpu, pad_busy_cpus)
                cpumask_or(tmp, tmp, topology_thread_cpumask(cpu));
@@ -116,7 +117,7 @@ static void round_robin_cpu(unsigned int tsk_index)
        if (cpumask_empty(tmp))
                cpumask_andnot(tmp, cpu_online_mask, pad_busy_cpus);
        if (cpumask_empty(tmp)) {
-                mutex_unlock(&isolated_cpus_lock);
+                mutex_unlock(&round_robin_lock);
                return;
        }
        for_each_cpu(cpu, tmp) {
@@ -131,7 +132,7 @@ static void round_robin_cpu(unsigned int tsk_index)
        tsk_in_cpu[tsk_index] = preferred_cpu;
        cpumask_set_cpu(preferred_cpu, pad_busy_cpus);
        cpu_weight[preferred_cpu]++;
-        mutex_unlock(&isolated_cpus_lock);
+        mutex_unlock(&round_robin_lock);
        set_cpus_allowed_ptr(current, cpumask_of(preferred_cpu));
 }
diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c
index 0ed85cac3231..615996a36bed 100644
--- a/drivers/acpi/acpica/hwsleep.c
+++ b/drivers/acpi/acpica/hwsleep.c
@@ -95,18 +95,6 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state, u8 flags)
                return_ACPI_STATUS(status);
        }
-        if (sleep_state != ACPI_STATE_S5) {
-                /*
-                 * Disable BM arbitration. This feature is contained within an
-                 * optional register (PM2 Control), so ignore a BAD_ADDRESS
-                 * exception.
-                 */
-                status = acpi_write_bit_register(ACPI_BITREG_ARB_DISABLE, 1);
-                if (ACPI_FAILURE(status) && (status != AE_BAD_ADDRESS)) {
-                        return_ACPI_STATUS(status);
-                }
-        }
        /*
         * 1) Disable/Clear all GPEs
         * 2) Enable all wakeup GPEs
@@ -364,16 +352,6 @@ acpi_status acpi_hw_legacy_wake(u8 sleep_state, u8 flags)
                                    [ACPI_EVENT_POWER_BUTTON].
                                    status_register_id, ACPI_CLEAR_STATUS);
-        /*
-         * Enable BM arbitration. This feature is contained within an
-         * optional register (PM2 Control), so ignore a BAD_ADDRESS
-         * exception.
-         */
-        status = acpi_write_bit_register(ACPI_BITREG_ARB_DISABLE, 0);
-        if (ACPI_FAILURE(status) && (status != AE_BAD_ADDRESS)) {
-                return_ACPI_STATUS(status);
-        }
        acpi_hw_execute_sleep_method(METHOD_PATHNAME__SST, ACPI_SST_WORKING);
        return_ACPI_STATUS(status);
 }
diff --git a/drivers/acpi/acpica/nspredef.c b/drivers/acpi/acpica/nspredef.c
index 23ce09686418..fe6626035495 100644
--- a/drivers/acpi/acpica/nspredef.c
+++ b/drivers/acpi/acpica/nspredef.c
@@ -638,7 +638,7 @@ acpi_ns_check_package(struct acpi_predefined_data *data,
                        /* Create the new outer package and populate it */
                        status =
-                            acpi_ns_wrap_with_package(data, *elements,
+                            acpi_ns_wrap_with_package(data, return_object,
                                                      return_object_ptr);
                        if (ACPI_FAILURE(status)) {
                                return (status);
diff --git a/drivers/acpi/apei/apei-base.c b/drivers/acpi/apei/apei-base.c
index 5577762daee1..6686b1eaf13e 100644
--- a/drivers/acpi/apei/apei-base.c
+++ b/drivers/acpi/apei/apei-base.c
@@ -243,7 +243,7 @@ static int pre_map_gar_callback(struct apei_exec_context *ctx,
        u8 ins = entry->instruction;
        if (ctx->ins_table[ins].flags & APEI_EXEC_INS_ACCESS_REGISTER)
-                return acpi_os_map_generic_address(&entry->register_region);
+                return apei_map_generic_address(&entry->register_region);
        return 0;
 }
@@ -276,7 +276,7 @@ static int post_unmap_gar_callback(struct apei_exec_context *ctx,
        u8 ins = entry->instruction;
        if (ctx->ins_table[ins].flags & APEI_EXEC_INS_ACCESS_REGISTER)
-                acpi_os_unmap_generic_address(&entry->register_region);
+                apei_unmap_generic_address(&entry->register_region);
        return 0;
 }
@@ -606,6 +606,19 @@ static int apei_check_gar(struct acpi_generic_address *reg, u64 *paddr,
        return 0;
 }
+int apei_map_generic_address(struct acpi_generic_address *reg)
+{
+        int rc;
+        u32 access_bit_width;
+        u64 address;
+        rc = apei_check_gar(reg, &address, &access_bit_width);
+        if (rc)
+                return rc;
+        return acpi_os_map_generic_address(reg);
+}
+EXPORT_SYMBOL_GPL(apei_map_generic_address);
 /* read GAR in interrupt (including NMI) or process context */
 int apei_read(u64 *val, struct acpi_generic_address *reg)
 {
diff --git a/drivers/acpi/apei/apei-internal.h b/drivers/acpi/apei/apei-internal.h
index cca240a33038..f220d642136e 100644
--- a/drivers/acpi/apei/apei-internal.h
+++ b/drivers/acpi/apei/apei-internal.h
@@ -7,6 +7,8 @@
 #define APEI_INTERNAL_H
 #include <linux/cper.h>
+#include <linux/acpi.h>
+#include <linux/acpi_io.h>
 struct apei_exec_context;
@@ -68,6 +70,13 @@ static inline int apei_exec_run_optional(struct apei_exec_context *ctx, u8 actio
 /* IP has been set in instruction function */
 #define APEI_EXEC_SET_IP        1
+int apei_map_generic_address(struct acpi_generic_address *reg);
+static inline void apei_unmap_generic_address(struct acpi_generic_address *reg)
+{
+        acpi_os_unmap_generic_address(reg);
+}
 int apei_read(u64 *val, struct acpi_generic_address *reg);
 int apei_write(u64 val, struct acpi_generic_address *reg);
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 9b3cac0abecc..1599566ed1fe 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -301,7 +301,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic)
        if (!ghes)
                return ERR_PTR(-ENOMEM);
        ghes->generic = generic;
-        rc = acpi_os_map_generic_address(&generic->error_status_address);
+        rc = apei_map_generic_address(&generic->error_status_address);
        if (rc)
                goto err_free;
        error_block_length = generic->error_block_length;
@@ -321,7 +321,7 @@ static struct ghes *ghes_new(struct acpi_hest_generic *generic)
        return ghes;
 err_unmap:
-        acpi_os_unmap_generic_address(&generic->error_status_address);
+        apei_unmap_generic_address(&generic->error_status_address);
 err_free:
        kfree(ghes);
        return ERR_PTR(rc);
@@ -330,7 +330,7 @@ err_free:
 static void ghes_fini(struct ghes *ghes)
 {
        kfree(ghes->estatus);
-        acpi_os_unmap_generic_address(&ghes->generic->error_status_address);
+        apei_unmap_generic_address(&ghes->generic->error_status_address);
 }
 enum {
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index c850de4c9a14..eff722278ff5 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -189,10 +189,12 @@ int acpi_get_cpuid(acpi_handle handle, int type, u32 acpi_id)
                 *     Processor (CPU3, 0x03, 0x00000410, 0x06) {}
                 * }
                 *
-                 * Ignores apic_id and always return 0 for CPU0's handle.
+                 * Ignores apic_id and always returns 0 for the processor
+                 * handle with acpi id 0 if nr_cpu_ids is 1.
+                 * This should be the case if SMP tables are not found.
                 * Return -1 for other CPU's handle.
                 */
-                if (acpi_id == 0)
+                if (nr_cpu_ids <= 1 && acpi_id == 0)
                        return acpi_id;
                else
                        return apic_id;
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index f3decb30223f..47a8caa89dbe 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -224,6 +224,7 @@ static void lapic_timer_state_broadcast(struct acpi_processor *pr,
 /*
 * Suspend / resume control
 */
+static int acpi_idle_suspend;
 static u32 saved_bm_rld;
 static void acpi_idle_bm_rld_save(void)
@@ -242,13 +243,21 @@ static void acpi_idle_bm_rld_restore(void)
 int acpi_processor_suspend(struct acpi_device * device, pm_message_t state)
 {
+        if (acpi_idle_suspend == 1)
+                return 0;
        acpi_idle_bm_rld_save();
+        acpi_idle_suspend = 1;
        return 0;
 }
 int acpi_processor_resume(struct acpi_device * device)
 {
+        if (acpi_idle_suspend == 0)
+                return 0;
        acpi_idle_bm_rld_restore();
+        acpi_idle_suspend = 0;
        return 0;
 }
@@ -754,6 +763,12 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
        local_irq_disable();
+        if (acpi_idle_suspend) {
+                local_irq_enable();
+                cpu_relax();
+                return -EBUSY;
+        }
        lapic_timer_state_broadcast(pr, cx, 1);
        kt1 = ktime_get_real();
        acpi_idle_do_entry(cx);
@@ -823,6 +838,12 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
        local_irq_disable();
+        if (acpi_idle_suspend) {
+                local_irq_enable();
+                cpu_relax();
+                return -EBUSY;
+        }
        if (cx->entry_method != ACPI_CSTATE_FFH) {
                current_thread_info()->status &= ~TS_POLLING;
                /*
@@ -907,14 +928,21 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
                                                drv, drv->safe_state_index);
                } else {
                        local_irq_disable();
-                        acpi_safe_halt();
+                        if (!acpi_idle_suspend)
+                                acpi_safe_halt();
                        local_irq_enable();
-                        return -EINVAL;
+                        return -EBUSY;
                }
        }
        local_irq_disable();
+        if (acpi_idle_suspend) {
+                local_irq_enable();
+                cpu_relax();
+                return -EBUSY;
+        }
        if (cx->entry_method != ACPI_CSTATE_FFH) {
                current_thread_info()->status &= ~TS_POLLING;
                /*
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index 9f66181c814e..240a24400976 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -173,7 +173,7 @@ static int param_set_trace_state(const char *val, struct kernel_param *kp)
 {
        int result = 0;
-        if (!strncmp(val, "enable", strlen("enable") - 1)) {
+        if (!strncmp(val, "enable", strlen("enable"))) {
                result = acpi_debug_trace(trace_method_name, trace_debug_level,
                                          trace_debug_layer, 0);
                if (result)
@@ -181,7 +181,7 @@ static int param_set_trace_state(const char *val, struct kernel_param *kp)
                goto exit;
        }
-        if (!strncmp(val, "disable", strlen("disable") - 1)) {
+        if (!strncmp(val, "disable", strlen("disable"))) {
                int name = 0;
                result = acpi_debug_trace((char *)&name, trace_debug_level,
                                          trace_debug_layer, 0);
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index a576575617d7..1e0a9e17c31d 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -558,6 +558,8 @@ acpi_video_bus_DOS(struct acpi_video_bus *video, int bios_flag, int lcd_flag)
        union acpi_object arg0 = { ACPI_TYPE_INTEGER };
        struct acpi_object_list args = { 1, &arg0 };
+        if (!video->cap._DOS)
+                return 0;
        if (bios_flag < 0 || bios_flag > 3 || lcd_flag < 0 || lcd_flag > 1)
                return -EINVAL;
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index dcb8a6e48692..4b01ab3d2c24 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -24,6 +24,7 @@
 #include <linux/wait.h>
 #include <linux/async.h>
 #include <linux/pm_runtime.h>
+#include <scsi/scsi_scan.h>
 #include "base.h"
 #include "power/power.h"
@@ -332,6 +333,7 @@ void wait_for_device_probe(void)
        /* wait for the known devices to complete their probing */
        wait_event(probe_waitqueue, atomic_read(&probe_count) == 0);
        async_synchronize_full();
+        scsi_complete_async_scans();
 }
 EXPORT_SYMBOL_GPL(wait_for_device_probe);
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index e0fb5b0435a3..9cb845e49334 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1031,7 +1031,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
        dpm_wait_for_children(dev, async);
        if (async_error)
-                return 0;
+                goto Complete;
        pm_runtime_get_noresume(dev);
        if (pm_runtime_barrier(dev) && device_may_wakeup(dev))
@@ -1040,7 +1040,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
        if (pm_wakeup_pending()) {
                pm_runtime_put_sync(dev);
                async_error = -EBUSY;
-                return 0;
+                goto Complete;
        }
        device_lock(dev);
@@ -1097,6 +1097,8 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
        }
        device_unlock(dev);
+ Complete:
        complete_all(&dev->power.completion);
        if (error) {
diff --git a/drivers/block/drbd/drbd_bitmap.c b/drivers/block/drbd/drbd_bitmap.c
index b5c5ff53cb57..fcb956bb4b4c 100644
--- a/drivers/block/drbd/drbd_bitmap.c
+++ b/drivers/block/drbd/drbd_bitmap.c
@@ -1475,10 +1475,17 @@ void _drbd_bm_set_bits(struct drbd_conf *mdev, const unsigned long s, const unsi
                first_word = 0;
                spin_lock_irq(&b->bm_lock);
        }
        /* last page (respectively only page, for first page == last page) */
        last_word = MLPP(el >> LN2_BPL);
-        bm_set_full_words_within_one_page(mdev->bitmap, last_page, first_word, last_word);
+        /* consider bitmap->bm_bits = 32768, bitmap->bm_number_of_pages = 1. (or multiples).
+         * ==> e = 32767, el = 32768, last_page = 2,
+         * and now last_word = 0.
+         * We do not want to touch last_page in this case,
+         * as we did not allocate it, it is not present in bitmap->bm_pages.
+         */
+        if (last_word)
+                bm_set_full_words_within_one_page(mdev->bitmap, last_page, first_word, last_word);
        /* possibly trailing bits.
         * example: (e & 63) == 63, el will be e+1.
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index 9c5c84946b05..8e93a6ac9bb6 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -472,12 +472,17 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
                req->rq_state |= RQ_LOCAL_COMPLETED;
                req->rq_state &= ~RQ_LOCAL_PENDING;
-                D_ASSERT(!(req->rq_state & RQ_NET_MASK));
+                if (req->rq_state & RQ_LOCAL_ABORTED) {
+                        _req_may_be_done(req, m);
+                        break;
+                }
                __drbd_chk_io_error(mdev, false);
        goto_queue_for_net_read:
+                D_ASSERT(!(req->rq_state & RQ_NET_MASK));
                /* no point in retrying if there is no good remote data,
                 * or we have no connection. */
                if (mdev->state.pdsk != D_UP_TO_DATE) {
@@ -765,6 +770,40 @@ static int drbd_may_do_local_read(struct drbd_conf *mdev, sector_t sector, int s
        return 0 == drbd_bm_count_bits(mdev, sbnr, ebnr);
 }
+static void maybe_pull_ahead(struct drbd_conf *mdev)
+{
+        int congested = 0;
+        /* If I don't even have good local storage, we can not reasonably try
+         * to pull ahead of the peer. We also need the local reference to make
+         * sure mdev->act_log is there.
+         * Note: caller has to make sure that net_conf is there.
+         */
+        if (!get_ldev_if_state(mdev, D_UP_TO_DATE))
+                return;
+        if (mdev->net_conf->cong_fill &&
+            atomic_read(&mdev->ap_in_flight) >= mdev->net_conf->cong_fill) {
+                dev_info(DEV, "Congestion-fill threshold reached\n");
+                congested = 1;
+        }
+        if (mdev->act_log->used >= mdev->net_conf->cong_extents) {
+                dev_info(DEV, "Congestion-extents threshold reached\n");
+                congested = 1;
+        }
+        if (congested) {
+                queue_barrier(mdev); /* last barrier, after mirrored writes */
+                if (mdev->net_conf->on_congestion == OC_PULL_AHEAD)
+                        _drbd_set_state(_NS(mdev, conn, C_AHEAD), 0, NULL);
+                else  /*mdev->net_conf->on_congestion == OC_DISCONNECT */
+                        _drbd_set_state(_NS(mdev, conn, C_DISCONNECTING), 0, NULL);
+        }
+        put_ldev(mdev);
+}
 static int drbd_make_request_common(struct drbd_conf *mdev, struct bio *bio, unsigned long start_time)
 {
        const int rw = bio_rw(bio);
@@ -972,29 +1011,8 @@ allocate_barrier:
                _req_mod(req, queue_for_send_oos);
        if (remote &&
-            mdev->net_conf->on_congestion != OC_BLOCK && mdev->agreed_pro_version >= 96) {
+            mdev->net_conf->on_congestion != OC_BLOCK && mdev->agreed_pro_version >= 96)
-                int congested = 0;
+                maybe_pull_ahead(mdev);
-                if (mdev->net_conf->cong_fill &&
-                    atomic_read(&mdev->ap_in_flight) >= mdev->net_conf->cong_fill) {
-                        dev_info(DEV, "Congestion-fill threshold reached\n");
-                        congested = 1;
-                }
-                if (mdev->act_log->used >= mdev->net_conf->cong_extents) {
-                        dev_info(DEV, "Congestion-extents threshold reached\n");
-                        congested = 1;
-                }
-                if (congested) {
-                        queue_barrier(mdev); /* last barrier, after mirrored writes */
-                        if (mdev->net_conf->on_congestion == OC_PULL_AHEAD)
-                                _drbd_set_state(_NS(mdev, conn, C_AHEAD), 0, NULL);
-                        else  /*mdev->net_conf->on_congestion == OC_DISCONNECT */
-                                _drbd_set_state(_NS(mdev, conn, C_DISCONNECTING), 0, NULL);
-                }
-        }
        spin_unlock_irq(&mdev->req_lock);
        kfree(b); /* if someone else has beaten us to it... */
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index cce7df367b79..553f43a90953 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -671,6 +671,7 @@ static void __reschedule_timeout(int drive, const char *message)
        if (drive == current_reqD)
                drive = current_drive;
+        __cancel_delayed_work(&fd_timeout);
        if (drive < 0 || drive >= N_DRIVE) {
                delay = 20UL * HZ;
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index bbca966f8f66..3bba65510d23 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1597,14 +1597,12 @@ static int loop_add(struct loop_device **l, int i)
        struct gendisk *disk;
        int err;
+        err = -ENOMEM;
        lo = kzalloc(sizeof(*lo), GFP_KERNEL);
-        if (!lo) {
+        if (!lo)
-                err = -ENOMEM;
                goto out;
-        }
-        err = idr_pre_get(&loop_index_idr, GFP_KERNEL);
+        if (!idr_pre_get(&loop_index_idr, GFP_KERNEL))
-        if (err < 0)
                goto out_free_dev;
        if (i >= 0) {
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 264bc77dcb91..a8fddeb3d638 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -37,6 +37,7 @@
 #include <linux/kthread.h>
 #include <../drivers/ata/ahci.h>
 #include <linux/export.h>
+#include <linux/debugfs.h>
 #include "mtip32xx.h"
 #define HW_CMD_SLOT_SZ          (MTIP_MAX_COMMAND_SLOTS * 32)
@@ -85,6 +86,7 @@ static int instance;
 * allocated in mtip_init().
 */
 static int mtip_major;
+static struct dentry *dfs_parent;
 static DEFINE_SPINLOCK(rssd_index_lock);
 static DEFINE_IDA(rssd_index_ida);
@@ -2546,7 +2548,7 @@ static struct scatterlist *mtip_hw_get_scatterlist(struct driver_data *dd,
 }
 /*
- * Sysfs register/status dump.
+ * Sysfs status dump.
 *
 * @dev  Pointer to the device structure, passed by the kernrel.
 * @attr Pointer to the device_attribute structure passed by the kernel.
@@ -2555,45 +2557,68 @@ static struct scatterlist *mtip_hw_get_scatterlist(struct driver_data *dd,
 * return value
 *      The size, in bytes, of the data copied into buf.
 */
-static ssize_t mtip_hw_show_registers(struct device *dev,
+static ssize_t mtip_hw_show_status(struct device *dev,
                                struct device_attribute *attr,
                                char *buf)
 {
-        u32 group_allocated;
        struct driver_data *dd = dev_to_disk(dev)->private_data;
        int size = 0;
+        if (test_bit(MTIP_DDF_OVER_TEMP_BIT, &dd->dd_flag))
+                size += sprintf(buf, "%s", "thermal_shutdown\n");
+        else if (test_bit(MTIP_DDF_WRITE_PROTECT_BIT, &dd->dd_flag))
+                size += sprintf(buf, "%s", "write_protect\n");
+        else
+                size += sprintf(buf, "%s", "online\n");
+        return size;
+}
+static DEVICE_ATTR(status, S_IRUGO, mtip_hw_show_status, NULL);
+static ssize_t mtip_hw_read_registers(struct file *f, char __user *ubuf,
+                                  size_t len, loff_t *offset)
+{
+        struct driver_data *dd =  (struct driver_data *)f->private_data;
+        char buf[MTIP_DFS_MAX_BUF_SIZE];
+        u32 group_allocated;
+        int size = *offset;
        int n;
-        size += sprintf(&buf[size], "Hardware\n--------\n");
+        if (!len || size)
-        size += sprintf(&buf[size], "S ACTive      : [ 0x");
+                return 0;
+        if (size < 0)
+                return -EINVAL;
+        size += sprintf(&buf[size], "H/ S ACTive      : [ 0x");
        for (n = dd->slot_groups-1; n >= 0; n--)
                size += sprintf(&buf[size], "%08X ",
                                         readl(dd->port->s_active[n]));
        size += sprintf(&buf[size], "]\n");
-        size += sprintf(&buf[size], "Command Issue : [ 0x");
+        size += sprintf(&buf[size], "H/ Command Issue : [ 0x");
        for (n = dd->slot_groups-1; n >= 0; n--)
                size += sprintf(&buf[size], "%08X ",
                                        readl(dd->port->cmd_issue[n]));
        size += sprintf(&buf[size], "]\n");
-        size += sprintf(&buf[size], "Completed     : [ 0x");
+        size += sprintf(&buf[size], "H/ Completed     : [ 0x");
        for (n = dd->slot_groups-1; n >= 0; n--)
                size += sprintf(&buf[size], "%08X ",
                                readl(dd->port->completed[n]));
        size += sprintf(&buf[size], "]\n");
-        size += sprintf(&buf[size], "PORT IRQ STAT : [ 0x%08X ]\n",
+        size += sprintf(&buf[size], "H/ PORT IRQ STAT : [ 0x%08X ]\n",
                                readl(dd->port->mmio + PORT_IRQ_STAT));
-        size += sprintf(&buf[size], "HOST IRQ STAT : [ 0x%08X ]\n",
+        size += sprintf(&buf[size], "H/ HOST IRQ STAT : [ 0x%08X ]\n",
                                readl(dd->mmio + HOST_IRQ_STAT));
        size += sprintf(&buf[size], "\n");
-        size += sprintf(&buf[size], "Local\n-----\n");
+        size += sprintf(&buf[size], "L/ Allocated     : [ 0x");
-        size += sprintf(&buf[size], "Allocated    : [ 0x");
        for (n = dd->slot_groups-1; n >= 0; n--) {
                if (sizeof(long) > sizeof(u32))
@@ -2605,7 +2630,7 @@ static ssize_t mtip_hw_show_registers(struct device *dev,
        }
        size += sprintf(&buf[size], "]\n");
-        size += sprintf(&buf[size], "Commands in Q: [ 0x");
+        size += sprintf(&buf[size], "L/ Commands in Q : [ 0x");
        for (n = dd->slot_groups-1; n >= 0; n--) {
                if (sizeof(long) > sizeof(u32))
@@ -2617,44 +2642,53 @@ static ssize_t mtip_hw_show_registers(struct device *dev,
        }
        size += sprintf(&buf[size], "]\n");
-        return size;
+        *offset = size <= len ? size : len;
+        size = copy_to_user(ubuf, buf, *offset);
+        if (size)
+                return -EFAULT;
+        return *offset;
 }
-static ssize_t mtip_hw_show_status(struct device *dev,
+static ssize_t mtip_hw_read_flags(struct file *f, char __user *ubuf,
-                                struct device_attribute *attr,
+                                  size_t len, loff_t *offset)
-                                char *buf)
 {
-        struct driver_data *dd = dev_to_disk(dev)->private_data;
+        struct driver_data *dd =  (struct driver_data *)f->private_data;
-        int size = 0;
+        char buf[MTIP_DFS_MAX_BUF_SIZE];
+        int size = *offset;
-        if (test_bit(MTIP_DDF_OVER_TEMP_BIT, &dd->dd_flag))
+        if (!len || size)
-                size += sprintf(buf, "%s", "thermal_shutdown\n");
+                return 0;
-        else if (test_bit(MTIP_DDF_WRITE_PROTECT_BIT, &dd->dd_flag))
-                size += sprintf(buf, "%s", "write_protect\n");
-        else
-                size += sprintf(buf, "%s", "online\n");
-        return size;
-}
-static ssize_t mtip_hw_show_flags(struct device *dev,
+        if (size < 0)
-                                struct device_attribute *attr,
+                return -EINVAL;
-                                char *buf)
-{
-        struct driver_data *dd = dev_to_disk(dev)->private_data;
-        int size = 0;
-        size += sprintf(&buf[size], "Flag in port struct : [ %08lX ]\n",
+        size += sprintf(&buf[size], "Flag-port : [ %08lX ]\n",
                                                        dd->port->flags);
-        size += sprintf(&buf[size], "Flag in dd struct   : [ %08lX ]\n",
+        size += sprintf(&buf[size], "Flag-dd   : [ %08lX ]\n",
                                                        dd->dd_flag);
-        return size;
+        *offset = size <= len ? size : len;
+        size = copy_to_user(ubuf, buf, *offset);
+        if (size)
+                return -EFAULT;
+        return *offset;
 }
-static DEVICE_ATTR(registers, S_IRUGO, mtip_hw_show_registers, NULL);
+static const struct file_operations mtip_regs_fops = {
-static DEVICE_ATTR(status, S_IRUGO, mtip_hw_show_status, NULL);
+        .owner  = THIS_MODULE,
-static DEVICE_ATTR(flags, S_IRUGO, mtip_hw_show_flags, NULL);
+        .open   = simple_open,
+        .read   = mtip_hw_read_registers,
+        .llseek = no_llseek,
+};
+static const struct file_operations mtip_flags_fops = {
+        .owner  = THIS_MODULE,
+        .open   = simple_open,
+        .read   = mtip_hw_read_flags,
+        .llseek = no_llseek,
+};
 /*
 * Create the sysfs related attributes.
@@ -2671,15 +2705,9 @@ static int mtip_hw_sysfs_init(struct driver_data *dd, struct kobject *kobj)
        if (!kobj || !dd)
                return -EINVAL;
-        if (sysfs_create_file(kobj, &dev_attr_registers.attr))
-                dev_warn(&dd->pdev->dev,
-                        "Error creating 'registers' sysfs entry\n");
        if (sysfs_create_file(kobj, &dev_attr_status.attr))
                dev_warn(&dd->pdev->dev,
                        "Error creating 'status' sysfs entry\n");
-        if (sysfs_create_file(kobj, &dev_attr_flags.attr))
-                dev_warn(&dd->pdev->dev,
-                        "Error creating 'flags' sysfs entry\n");
        return 0;
 }
@@ -2698,13 +2726,39 @@ static int mtip_hw_sysfs_exit(struct driver_data *dd, struct kobject *kobj)
        if (!kobj || !dd)
                return -EINVAL;
-        sysfs_remove_file(kobj, &dev_attr_registers.attr);
        sysfs_remove_file(kobj, &dev_attr_status.attr);
-        sysfs_remove_file(kobj, &dev_attr_flags.attr);
        return 0;
 }
+static int mtip_hw_debugfs_init(struct driver_data *dd)
+{
+        if (!dfs_parent)
+                return -1;
+        dd->dfs_node = debugfs_create_dir(dd->disk->disk_name, dfs_parent);
+        if (IS_ERR_OR_NULL(dd->dfs_node)) {
+                dev_warn(&dd->pdev->dev,
+                        "Error creating node %s under debugfs\n",
+                                                dd->disk->disk_name);
+                dd->dfs_node = NULL;
+                return -1;
+        }
+        debugfs_create_file("flags", S_IRUGO, dd->dfs_node, dd,
+                                                        &mtip_flags_fops);
+        debugfs_create_file("registers", S_IRUGO, dd->dfs_node, dd,
+                                                        &mtip_regs_fops);
+        return 0;
+}
+static void mtip_hw_debugfs_exit(struct driver_data *dd)
+{
+        debugfs_remove_recursive(dd->dfs_node);
+}
 /*
 * Perform any init/resume time hardware setup
 *
@@ -3730,6 +3784,7 @@ skip_create_disk:
                mtip_hw_sysfs_init(dd, kobj);
                kobject_put(kobj);
        }
+        mtip_hw_debugfs_init(dd);
        if (dd->mtip_svc_handler) {
                set_bit(MTIP_DDF_INIT_DONE_BIT, &dd->dd_flag);
@@ -3755,6 +3810,8 @@ start_service_thread:
        return rv;
 kthread_run_error:
+        mtip_hw_debugfs_exit(dd);
        /* Delete our gendisk. This also removes the device from /dev */
        del_gendisk(dd->disk);
@@ -3805,6 +3862,7 @@ static int mtip_block_remove(struct driver_data *dd)
                        kobject_put(kobj);
                }
        }
+        mtip_hw_debugfs_exit(dd);
        /*
         * Delete our gendisk structure. This also removes the device
@@ -4152,10 +4210,20 @@ static int __init mtip_init(void)
        }
        mtip_major = error;
+        if (!dfs_parent) {
+                dfs_parent = debugfs_create_dir("rssd", NULL);
+                if (IS_ERR_OR_NULL(dfs_parent)) {
+                        printk(KERN_WARNING "Error creating debugfs parent\n");
+                        dfs_parent = NULL;
+                }
+        }
        /* Register our PCI operations. */
        error = pci_register_driver(&mtip_pci_driver);
-        if (error)
+        if (error) {
+                debugfs_remove(dfs_parent);
                unregister_blkdev(mtip_major, MTIP_DRV_NAME);
+        }
        return error;
 }
@@ -4172,6 +4240,8 @@ static int __init mtip_init(void)
 */
 static void __exit mtip_exit(void)
 {
+        debugfs_remove_recursive(dfs_parent);
        /* Release the allocated major block device number. */
        unregister_blkdev(mtip_major, MTIP_DRV_NAME);
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index b2c88da26b2a..f51fc23d17bb 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -26,7 +26,6 @@
 #include <linux/ata.h>
 #include <linux/interrupt.h>
 #include <linux/genhd.h>
-#include <linux/version.h>
 /* Offset of Subsystem Device ID in pci confoguration space */
 #define PCI_SUBSYSTEM_DEVICEID  0x2E
@@ -111,6 +110,8 @@
 #define dbg_printk(format, arg...)
 #endif
+#define MTIP_DFS_MAX_BUF_SIZE 1024
 #define __force_bit2int (unsigned int __force)
 enum {
@@ -447,6 +448,8 @@ struct driver_data {
        unsigned long dd_flag; /* NOTE: use atomic bit operations on this */
        struct task_struct *mtip_svc_handler; /* task_struct of svc thd */
+        struct dentry *dfs_node;
 };
 #endif
diff --git a/drivers/block/umem.c b/drivers/block/umem.c
index aa2712060bfb..9a72277a31df 100644
--- a/drivers/block/umem.c
+++ b/drivers/block/umem.c
@@ -513,6 +513,44 @@ static void process_page(unsigned long data)
        }
 }
+struct mm_plug_cb {
+        struct blk_plug_cb cb;
+        struct cardinfo *card;
+};
+static void mm_unplug(struct blk_plug_cb *cb)
+{
+        struct mm_plug_cb *mmcb = container_of(cb, struct mm_plug_cb, cb);
+        spin_lock_irq(&mmcb->card->lock);
+        activate(mmcb->card);
+        spin_unlock_irq(&mmcb->card->lock);
+        kfree(mmcb);
+}
+static int mm_check_plugged(struct cardinfo *card)
+{
+        struct blk_plug *plug = current->plug;
+        struct mm_plug_cb *mmcb;
+        if (!plug)
+                return 0;
+        list_for_each_entry(mmcb, &plug->cb_list, cb.list) {
+                if (mmcb->cb.callback == mm_unplug && mmcb->card == card)
+                        return 1;
+        }
+        /* Not currently on the callback list */
+        mmcb = kmalloc(sizeof(*mmcb), GFP_ATOMIC);
+        if (!mmcb)
+                return 0;
+        mmcb->card = card;
+        mmcb->cb.callback = mm_unplug;
+        list_add(&mmcb->cb.list, &plug->cb_list);
+        return 1;
+}
 static void mm_make_request(struct request_queue *q, struct bio *bio)
 {
        struct cardinfo *card = q->queuedata;
@@ -523,6 +561,8 @@ static void mm_make_request(struct request_queue *q, struct bio *bio)
        *card->biotail = bio;
        bio->bi_next = NULL;
        card->biotail = &bio->bi_next;
+        if (bio->bi_rw & REQ_SYNC || !mm_check_plugged(card))
+                activate(card);
        spin_unlock_irq(&card->lock);
        return;
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index 773cf27dc23f..9ad3b5ec1dc1 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -257,6 +257,7 @@ static inline void blkif_get_x86_32_req(struct blkif_request *dst,
                break;
        case BLKIF_OP_DISCARD:
                dst->u.discard.flag = src->u.discard.flag;
+                dst->u.discard.id = src->u.discard.id;
                dst->u.discard.sector_number = src->u.discard.sector_number;
                dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
                break;
@@ -287,6 +288,7 @@ static inline void blkif_get_x86_64_req(struct blkif_request *dst,
                break;
        case BLKIF_OP_DISCARD:
                dst->u.discard.flag = src->u.discard.flag;
+                dst->u.discard.id = src->u.discard.id;
                dst->u.discard.sector_number = src->u.discard.sector_number;
                dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
                break;
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 60eed4bdd2e4..e4fb3374dcd2 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -141,14 +141,36 @@ static int get_id_from_freelist(struct blkfront_info *info)
        return free;
 }
-static void add_id_to_freelist(struct blkfront_info *info,
+static int add_id_to_freelist(struct blkfront_info *info,
                               unsigned long id)
 {
+        if (info->shadow[id].req.u.rw.id != id)
+                return -EINVAL;
+        if (info->shadow[id].request == NULL)
+                return -EINVAL;
        info->shadow[id].req.u.rw.id  = info->shadow_free;
        info->shadow[id].request = NULL;
        info->shadow_free = id;
+        return 0;
 }
+static const char *op_name(int op)
+{
+        static const char *const names[] = {
+                [BLKIF_OP_READ] = "read",
+                [BLKIF_OP_WRITE] = "write",
+                [BLKIF_OP_WRITE_BARRIER] = "barrier",
+                [BLKIF_OP_FLUSH_DISKCACHE] = "flush",
+                [BLKIF_OP_DISCARD] = "discard" };
+        if (op < 0 || op >= ARRAY_SIZE(names))
+                return "unknown";
+        if (!names[op])
+                return "reserved";
+        return names[op];
+}
 static int xlbd_reserve_minors(unsigned int minor, unsigned int nr)
 {
        unsigned int end = minor + nr;
@@ -746,20 +768,36 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
                bret = RING_GET_RESPONSE(&info->ring, i);
                id   = bret->id;
+                /*
+                 * The backend has messed up and given us an id that we would
+                 * never have given to it (we stamp it up to BLK_RING_SIZE -
+                 * look in get_id_from_freelist.
+                 */
+                if (id >= BLK_RING_SIZE) {
+                        WARN(1, "%s: response to %s has incorrect id (%ld)\n",
+                             info->gd->disk_name, op_name(bret->operation), id);
+                        /* We can't safely get the 'struct request' as
+                         * the id is busted. */
+                        continue;
+                }
                req  = info->shadow[id].request;
                if (bret->operation != BLKIF_OP_DISCARD)
                        blkif_completion(&info->shadow[id]);
-                add_id_to_freelist(info, id);
+                if (add_id_to_freelist(info, id)) {
+                        WARN(1, "%s: response to %s (id %ld) couldn't be recycled!\n",
+                             info->gd->disk_name, op_name(bret->operation), id);
+                        continue;
+                }
                error = (bret->status == BLKIF_RSP_OKAY) ? 0 : -EIO;
                switch (bret->operation) {
                case BLKIF_OP_DISCARD:
                        if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) {
                                struct request_queue *rq = info->rq;
-                                printk(KERN_WARNING "blkfront: %s: discard op failed\n",
+                                printk(KERN_WARNING "blkfront: %s: %s op failed\n",
-                                           info->gd->disk_name);
+                                           info->gd->disk_name, op_name(bret->operation));
                                error = -EOPNOTSUPP;
                                info->feature_discard = 0;
                                info->feature_secdiscard = 0;
@@ -771,18 +809,14 @@ static irqreturn_t blkif_interrupt(int irq, void *dev_id)
                case BLKIF_OP_FLUSH_DISKCACHE:
                case BLKIF_OP_WRITE_BARRIER:
                        if (unlikely(bret->status == BLKIF_RSP_EOPNOTSUPP)) {
-                                printk(KERN_WARNING "blkfront: %s: write %s op failed\n",
+                                printk(KERN_WARNING "blkfront: %s: %s op failed\n",
-                                       info->flush_op == BLKIF_OP_WRITE_BARRIER ?
+                                       info->gd->disk_name, op_name(bret->operation));
-                                       "barrier" :  "flush disk cache",
-                                       info->gd->disk_name);
                                error = -EOPNOTSUPP;
                        }
                        if (unlikely(bret->status == BLKIF_RSP_ERROR &&
                                     info->shadow[id].req.u.rw.nr_segments == 0)) {
-                                printk(KERN_WARNING "blkfront: %s: empty write %s op failed\n",
+                                printk(KERN_WARNING "blkfront: %s: empty %s op failed\n",
-                                       info->flush_op == BLKIF_OP_WRITE_BARRIER ?
+                                       info->gd->disk_name, op_name(bret->operation));
-                                       "barrier" :  "flush disk cache",
-                                       info->gd->disk_name);
                                error = -EOPNOTSUPP;
                        }
                        if (unlikely(error)) {
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index ad591bd240ec..10308cd8a7ed 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -63,6 +63,7 @@ static struct usb_device_id ath3k_table[] = {
        /* Atheros AR3011 with sflash firmware*/
        { USB_DEVICE(0x0CF3, 0x3002) },
+        { USB_DEVICE(0x0CF3, 0xE019) },
        { USB_DEVICE(0x13d3, 0x3304) },
        { USB_DEVICE(0x0930, 0x0215) },
        { USB_DEVICE(0x0489, 0xE03D) },
@@ -77,6 +78,7 @@ static struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x04CA, 0x3005) },
        { USB_DEVICE(0x13d3, 0x3362) },
        { USB_DEVICE(0x0CF3, 0xE004) },
+        { USB_DEVICE(0x0930, 0x0219) },
        /* Atheros AR5BBU12 with sflash firmware */
        { USB_DEVICE(0x0489, 0xE02C) },
@@ -101,6 +103,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
        /* Atheros AR5BBU22 with sflash firmware */
        { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btmrvl_drv.h b/drivers/bluetooth/btmrvl_drv.h
index 94f2d65131c4..27068d149380 100644
--- a/drivers/bluetooth/btmrvl_drv.h
+++ b/drivers/bluetooth/btmrvl_drv.h
@@ -136,7 +136,7 @@ int btmrvl_remove_card(struct btmrvl_private *priv);
 void btmrvl_interrupt(struct btmrvl_private *priv);
-void btmrvl_check_evtpkt(struct btmrvl_private *priv, struct sk_buff *skb);
+bool btmrvl_check_evtpkt(struct btmrvl_private *priv, struct sk_buff *skb);
 int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb);
 int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, int subcmd);
diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index 681ca9d18e12..dc304def8400 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -44,23 +44,33 @@ void btmrvl_interrupt(struct btmrvl_private *priv)
 }
 EXPORT_SYMBOL_GPL(btmrvl_interrupt);
-void btmrvl_check_evtpkt(struct btmrvl_private *priv, struct sk_buff *skb)
+bool btmrvl_check_evtpkt(struct btmrvl_private *priv, struct sk_buff *skb)
 {
        struct hci_event_hdr *hdr = (void *) skb->data;
        struct hci_ev_cmd_complete *ec;
-        u16 opcode, ocf;
+        u16 opcode, ocf, ogf;
        if (hdr->evt == HCI_EV_CMD_COMPLETE) {
                ec = (void *) (skb->data + HCI_EVENT_HDR_SIZE);
                opcode = __le16_to_cpu(ec->opcode);
                ocf = hci_opcode_ocf(opcode);
+                ogf = hci_opcode_ogf(opcode);
                if (ocf == BT_CMD_MODULE_CFG_REQ &&
                                        priv->btmrvl_dev.sendcmdflag) {
                        priv->btmrvl_dev.sendcmdflag = false;
                        priv->adapter->cmd_complete = true;
                        wake_up_interruptible(&priv->adapter->cmd_wait_q);
                }
+                if (ogf == OGF) {
+                        BT_DBG("vendor event skipped: ogf 0x%4.4x", ogf);
+                        kfree_skb(skb);
+                        return false;
+                }
        }
+        return true;
 }
 EXPORT_SYMBOL_GPL(btmrvl_check_evtpkt);
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index a853244e7fd7..0cd61d9f07cd 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -562,10 +562,12 @@ static int btmrvl_sdio_card_to_host(struct btmrvl_private *priv)
                skb_put(skb, buf_len);
                skb_pull(skb, SDIO_HEADER_LEN);
-                if (type == HCI_EVENT_PKT)
+                if (type == HCI_EVENT_PKT) {
-                        btmrvl_check_evtpkt(priv, skb);
+                        if (btmrvl_check_evtpkt(priv, skb))
+                                hci_recv_frame(skb);
+                } else
+                        hci_recv_frame(skb);
-                hci_recv_frame(skb);
                hdev->stat.byte_rx += buf_len;
                break;
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index c9463af8e564..83ebb241bfcc 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -125,6 +125,7 @@ static struct usb_device_id blacklist_table[] = {
        /* Atheros 3011 with sflash firmware */
        { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
+        { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
        { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
        { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
        { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
@@ -139,6 +140,7 @@ static struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
        /* Atheros AR5BBU12 with sflash firmware */
        { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 687b00d67c8a..9a1eb0cfa95f 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -850,18 +850,21 @@ static void clk_change_rate(struct clk *clk)
 {
        struct clk *child;
        unsigned long old_rate;
+        unsigned long best_parent_rate = 0;
        struct hlist_node *tmp;
        old_rate = clk->rate;
+        if (clk->parent)
+                best_parent_rate = clk->parent->rate;
        if (clk->ops->set_rate)
-                clk->ops->set_rate(clk->hw, clk->new_rate, clk->parent->rate);
+                clk->ops->set_rate(clk->hw, clk->new_rate, best_parent_rate);
        if (clk->ops->recalc_rate)
-                clk->rate = clk->ops->recalc_rate(clk->hw,
+                clk->rate = clk->ops->recalc_rate(clk->hw, best_parent_rate);
-                                clk->parent->rate);
        else
-                clk->rate = clk->parent->rate;
+                clk->rate = best_parent_rate;
        if (clk->notifier_count && old_rate != clk->rate)
                __clk_notify(clk, POST_RATE_CHANGE, old_rate, clk->rate);
@@ -999,7 +1002,7 @@ static struct clk *__clk_init_parent(struct clk *clk)
        if (!clk->parents)
                clk->parents =
-                        kmalloc((sizeof(struct clk*) * clk->num_parents),
+                        kzalloc((sizeof(struct clk*) * clk->num_parents),
                                        GFP_KERNEL);
        if (!clk->parents)
@@ -1064,21 +1067,24 @@ static int __clk_set_parent(struct clk *clk, struct clk *parent)
        old_parent = clk->parent;
-        /* find index of new parent clock using cached parent ptrs */
+        if (!clk->parents)
-        for (i = 0; i < clk->num_parents; i++)
+                clk->parents = kzalloc((sizeof(struct clk*) * clk->num_parents),
-                if (clk->parents[i] == parent)
+                                                                GFP_KERNEL);
-                        break;
        /*
-         * find index of new parent clock using string name comparison
+         * find index of new parent clock using cached parent ptrs,
-         * also try to cache the parent to avoid future calls to __clk_lookup
+         * or if not yet cached, use string name comparison and cache
+         * them now to avoid future calls to __clk_lookup.
         */
-        if (i == clk->num_parents)
+        for (i = 0; i < clk->num_parents; i++) {
-                for (i = 0; i < clk->num_parents; i++)
+                if (clk->parents && clk->parents[i] == parent)
-                        if (!strcmp(clk->parent_names[i], parent->name)) {
+                        break;
+                else if (!strcmp(clk->parent_names[i], parent->name)) {
+                        if (clk->parents)
                                clk->parents[i] = __clk_lookup(parent->name);
-                                break;
+                        break;
-                        }
+                }
+        }
        if (i == clk->num_parents) {
                pr_debug("%s: clock %s is not a possible parent of clock %s\n",
diff --git a/drivers/clk/mxs/clk-imx23.c b/drivers/clk/mxs/clk-imx23.c
index f7be225f544c..db2391c054ee 100644
--- a/drivers/clk/mxs/clk-imx23.c
+++ b/drivers/clk/mxs/clk-imx23.c
@@ -71,7 +71,7 @@ static void __init clk_misc_init(void)
        __mxs_setl(30 << BP_FRAC_IOFRAC, FRAC);
 }
-static struct clk_lookup uart_lookups[] __initdata = {
+static struct clk_lookup uart_lookups[] = {
        { .dev_id = "duart", },
        { .dev_id = "mxs-auart.0", },
        { .dev_id = "mxs-auart.1", },
@@ -80,31 +80,31 @@ static struct clk_lookup uart_lookups[] __initdata = {
        { .dev_id = "80070000.serial", },
 };
-static struct clk_lookup hbus_lookups[] __initdata = {
+static struct clk_lookup hbus_lookups[] = {
        { .dev_id = "imx23-dma-apbh", },
        { .dev_id = "80004000.dma-apbh", },
 };
-static struct clk_lookup xbus_lookups[] __initdata = {
+static struct clk_lookup xbus_lookups[] = {
        { .dev_id = "duart", .con_id = "apb_pclk"},
        { .dev_id = "80070000.serial", .con_id = "apb_pclk"},
        { .dev_id = "imx23-dma-apbx", },
        { .dev_id = "80024000.dma-apbx", },
 };
-static struct clk_lookup ssp_lookups[] __initdata = {
+static struct clk_lookup ssp_lookups[] = {
        { .dev_id = "imx23-mmc.0", },
        { .dev_id = "imx23-mmc.1", },
        { .dev_id = "80010000.ssp", },
        { .dev_id = "80034000.ssp", },
 };
-static struct clk_lookup lcdif_lookups[] __initdata = {
+static struct clk_lookup lcdif_lookups[] = {
        { .dev_id = "imx23-fb", },
        { .dev_id = "80030000.lcdif", },
 };
-static struct clk_lookup gpmi_lookups[] __initdata = {
+static struct clk_lookup gpmi_lookups[] = {
        { .dev_id = "imx23-gpmi-nand", },
        { .dev_id = "8000c000.gpmi", },
 };
diff --git a/drivers/clk/mxs/clk-imx28.c b/drivers/clk/mxs/clk-imx28.c
index 2826a2606a29..7fad6c8c13d2 100644
--- a/drivers/clk/mxs/clk-imx28.c
+++ b/drivers/clk/mxs/clk-imx28.c
@@ -120,7 +120,7 @@ static void __init clk_misc_init(void)
        writel_relaxed(val, FRAC0);
 }
-static struct clk_lookup uart_lookups[] __initdata = {
+static struct clk_lookup uart_lookups[] = {
        { .dev_id = "duart", },
        { .dev_id = "mxs-auart.0", },
        { .dev_id = "mxs-auart.1", },
@@ -135,71 +135,71 @@ static struct clk_lookup uart_lookups[] __initdata = {
        { .dev_id = "80074000.serial", },
 };
-static struct clk_lookup hbus_lookups[] __initdata = {
+static struct clk_lookup hbus_lookups[] = {
        { .dev_id = "imx28-dma-apbh", },
        { .dev_id = "80004000.dma-apbh", },
 };
-static struct clk_lookup xbus_lookups[] __initdata = {
+static struct clk_lookup xbus_lookups[] = {
        { .dev_id = "duart", .con_id = "apb_pclk"},
        { .dev_id = "80074000.serial", .con_id = "apb_pclk"},
        { .dev_id = "imx28-dma-apbx", },
        { .dev_id = "80024000.dma-apbx", },
 };
-static struct clk_lookup ssp0_lookups[] __initdata = {
+static struct clk_lookup ssp0_lookups[] = {
        { .dev_id = "imx28-mmc.0", },
        { .dev_id = "80010000.ssp", },
 };
-static struct clk_lookup ssp1_lookups[] __initdata = {
+static struct clk_lookup ssp1_lookups[] = {
        { .dev_id = "imx28-mmc.1", },
        { .dev_id = "80012000.ssp", },
 };
-static struct clk_lookup ssp2_lookups[] __initdata = {
+static struct clk_lookup ssp2_lookups[] = {
        { .dev_id = "imx28-mmc.2", },
        { .dev_id = "80014000.ssp", },
 };
-static struct clk_lookup ssp3_lookups[] __initdata = {
+static struct clk_lookup ssp3_lookups[] = {
        { .dev_id = "imx28-mmc.3", },
        { .dev_id = "80016000.ssp", },
 };
-static struct clk_lookup lcdif_lookups[] __initdata = {
+static struct clk_lookup lcdif_lookups[] = {
        { .dev_id = "imx28-fb", },
        { .dev_id = "80030000.lcdif", },
 };
-static struct clk_lookup gpmi_lookups[] __initdata = {
+static struct clk_lookup gpmi_lookups[] = {
        { .dev_id = "imx28-gpmi-nand", },
        { .dev_id = "8000c000.gpmi", },
 };
-static struct clk_lookup fec_lookups[] __initdata = {
+static struct clk_lookup fec_lookups[] = {
        { .dev_id = "imx28-fec.0", },
        { .dev_id = "imx28-fec.1", },
        { .dev_id = "800f0000.ethernet", },
        { .dev_id = "800f4000.ethernet", },
 };
-static struct clk_lookup can0_lookups[] __initdata = {
+static struct clk_lookup can0_lookups[] = {
        { .dev_id = "flexcan.0", },
        { .dev_id = "80032000.can", },
 };
-static struct clk_lookup can1_lookups[] __initdata = {
+static struct clk_lookup can1_lookups[] = {
        { .dev_id = "flexcan.1", },
        { .dev_id = "80034000.can", },
 };
-static struct clk_lookup saif0_lookups[] __initdata = {
+static struct clk_lookup saif0_lookups[] = {
        { .dev_id = "mxs-saif.0", },
        { .dev_id = "80042000.saif", },
 };
-static struct clk_lookup saif1_lookups[] __initdata = {
+static struct clk_lookup saif1_lookups[] = {
        { .dev_id = "mxs-saif.1", },
        { .dev_id = "80046000.saif", },
 };
@@ -245,8 +245,8 @@ int __init mx28_clocks_init(void)
        clks[pll2] = mxs_clk_pll("pll2", "ref_xtal", PLL2CTRL0, 23, 50000000);
        clks[ref_cpu] = mxs_clk_ref("ref_cpu", "pll0", FRAC0, 0);
        clks[ref_emi] = mxs_clk_ref("ref_emi", "pll0", FRAC0, 1);
-        clks[ref_io0] = mxs_clk_ref("ref_io0", "pll0", FRAC0, 2);
+        clks[ref_io1] = mxs_clk_ref("ref_io1", "pll0", FRAC0, 2);
-        clks[ref_io1] = mxs_clk_ref("ref_io1", "pll0", FRAC0, 3);
+        clks[ref_io0] = mxs_clk_ref("ref_io0", "pll0", FRAC0, 3);
        clks[ref_pix] = mxs_clk_ref("ref_pix", "pll0", FRAC1, 0);
        clks[ref_hsadc] = mxs_clk_ref("ref_hsadc", "pll0", FRAC1, 1);
        clks[ref_gpmi] = mxs_clk_ref("ref_gpmi", "pll0", FRAC1, 2);
diff --git a/drivers/clk/spear/spear1310_clock.c b/drivers/clk/spear/spear1310_clock.c
index 8f05652d53e6..0fcec2aae19c 100644
--- a/drivers/clk/spear/spear1310_clock.c
+++ b/drivers/clk/spear/spear1310_clock.c
@@ -345,31 +345,30 @@ static struct frac_rate_tbl gen_rtbl[] = {
 /* clock parents */
 static const char *vco_parents[] = { "osc_24m_clk", "osc_25m_clk", };
 static const char *gpt_parents[] = { "osc_24m_clk", "apb_clk", };
-static const char *uart0_parents[] = { "pll5_clk", "uart_synth_gate_clk", };
+static const char *uart0_parents[] = { "pll5_clk", "uart_syn_gclk", };
-static const char *c3_parents[] = { "pll5_clk", "c3_synth_gate_clk", };
+static const char *c3_parents[] = { "pll5_clk", "c3_syn_gclk", };
-static const char *gmac_phy_input_parents[] = { "gmii_125m_pad_clk", "pll2_clk",
+static const char *gmac_phy_input_parents[] = { "gmii_pad_clk", "pll2_clk",
        "osc_25m_clk", };
-static const char *gmac_phy_parents[] = { "gmac_phy_input_mux_clk",
+static const char *gmac_phy_parents[] = { "phy_input_mclk", "phy_syn_gclk", };
-        "gmac_phy_synth_gate_clk", };
 static const char *clcd_synth_parents[] = { "vco1div4_clk", "pll2_clk", };
-static const char *clcd_pixel_parents[] = { "pll5_clk", "clcd_synth_clk", };
+static const char *clcd_pixel_parents[] = { "pll5_clk", "clcd_syn_clk", };
 static const char *i2s_src_parents[] = { "vco1div2_clk", "none", "pll3_clk",
        "i2s_src_pad_clk", };
-static const char *i2s_ref_parents[] = { "i2s_src_mux_clk", "i2s_prs1_clk", };
+static const char *i2s_ref_parents[] = { "i2s_src_mclk", "i2s_prs1_clk", };
 static const char *gen_synth0_1_parents[] = { "vco1div4_clk", "vco3div2_clk",
        "pll3_clk", };
 static const char *gen_synth2_3_parents[] = { "vco1div4_clk", "vco3div2_clk",
        "pll2_clk", };
 static const char *rmii_phy_parents[] = { "ras_tx50_clk", "none",
-        "ras_pll2_clk", "ras_synth0_clk", };
+        "ras_pll2_clk", "ras_syn0_clk", };
 static const char *smii_rgmii_phy_parents[] = { "none", "ras_tx125_clk",
-        "ras_pll2_clk", "ras_synth0_clk", };
+        "ras_pll2_clk", "ras_syn0_clk", };
-static const char *uart_parents[] = { "ras_apb_clk", "gen_synth3_clk", };
+static const char *uart_parents[] = { "ras_apb_clk", "gen_syn3_clk", };
-static const char *i2c_parents[] = { "ras_apb_clk", "gen_synth1_clk", };
+static const char *i2c_parents[] = { "ras_apb_clk", "gen_syn1_clk", };
-static const char *ssp1_parents[] = { "ras_apb_clk", "gen_synth1_clk",
+static const char *ssp1_parents[] = { "ras_apb_clk", "gen_syn1_clk",
        "ras_plclk0_clk", };
-static const char *pci_parents[] = { "ras_pll3_clk", "gen_synth2_clk", };
+static const char *pci_parents[] = { "ras_pll3_clk", "gen_syn2_clk", };
-static const char *tdm_parents[] = { "ras_pll3_clk", "gen_synth1_clk", };
+static const char *tdm_parents[] = { "ras_pll3_clk", "gen_syn1_clk", };
 void __init spear1310_clk_init(void)
 {
@@ -390,9 +389,9 @@ void __init spear1310_clk_init(void)
                        25000000);
        clk_register_clkdev(clk, "osc_25m_clk", NULL);
-        clk = clk_register_fixed_rate(NULL, "gmii_125m_pad_clk", NULL,
+        clk = clk_register_fixed_rate(NULL, "gmii_pad_clk", NULL, CLK_IS_ROOT,
-                        CLK_IS_ROOT, 125000000);
+                        125000000);
-        clk_register_clkdev(clk, "gmii_125m_pad_clk", NULL);
+        clk_register_clkdev(clk, "gmii_pad_clk", NULL);
        clk = clk_register_fixed_rate(NULL, "i2s_src_pad_clk", NULL,
                        CLK_IS_ROOT, 12288000);
@@ -406,34 +405,34 @@ void __init spear1310_clk_init(void)
        /* clock derived from 24 or 25 MHz osc clk */
        /* vco-pll */
-        clk = clk_register_mux(NULL, "vco1_mux_clk", vco_parents,
+        clk = clk_register_mux(NULL, "vco1_mclk", vco_parents,
                        ARRAY_SIZE(vco_parents), 0, SPEAR1310_PLL_CFG,
                        SPEAR1310_PLL1_CLK_SHIFT, SPEAR1310_PLL_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "vco1_mux_clk", NULL);
+        clk_register_clkdev(clk, "vco1_mclk", NULL);
-        clk = clk_register_vco_pll("vco1_clk", "pll1_clk", NULL, "vco1_mux_clk",
+        clk = clk_register_vco_pll("vco1_clk", "pll1_clk", NULL, "vco1_mclk",
                        0, SPEAR1310_PLL1_CTR, SPEAR1310_PLL1_FRQ, pll_rtbl,
                        ARRAY_SIZE(pll_rtbl), &_lock, &clk1, NULL);
        clk_register_clkdev(clk, "vco1_clk", NULL);
        clk_register_clkdev(clk1, "pll1_clk", NULL);
-        clk = clk_register_mux(NULL, "vco2_mux_clk", vco_parents,
+        clk = clk_register_mux(NULL, "vco2_mclk", vco_parents,
                        ARRAY_SIZE(vco_parents), 0, SPEAR1310_PLL_CFG,
                        SPEAR1310_PLL2_CLK_SHIFT, SPEAR1310_PLL_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "vco2_mux_clk", NULL);
+        clk_register_clkdev(clk, "vco2_mclk", NULL);
-        clk = clk_register_vco_pll("vco2_clk", "pll2_clk", NULL, "vco2_mux_clk",
+        clk = clk_register_vco_pll("vco2_clk", "pll2_clk", NULL, "vco2_mclk",
                        0, SPEAR1310_PLL2_CTR, SPEAR1310_PLL2_FRQ, pll_rtbl,
                        ARRAY_SIZE(pll_rtbl), &_lock, &clk1, NULL);
        clk_register_clkdev(clk, "vco2_clk", NULL);
        clk_register_clkdev(clk1, "pll2_clk", NULL);
-        clk = clk_register_mux(NULL, "vco3_mux_clk", vco_parents,
+        clk = clk_register_mux(NULL, "vco3_mclk", vco_parents,
                        ARRAY_SIZE(vco_parents), 0, SPEAR1310_PLL_CFG,
                        SPEAR1310_PLL3_CLK_SHIFT, SPEAR1310_PLL_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "vco3_mux_clk", NULL);
+        clk_register_clkdev(clk, "vco3_mclk", NULL);
-        clk = clk_register_vco_pll("vco3_clk", "pll3_clk", NULL, "vco3_mux_clk",
+        clk = clk_register_vco_pll("vco3_clk", "pll3_clk", NULL, "vco3_mclk",
                        0, SPEAR1310_PLL3_CTR, SPEAR1310_PLL3_FRQ, pll_rtbl,
                        ARRAY_SIZE(pll_rtbl), &_lock, &clk1, NULL);
        clk_register_clkdev(clk, "vco3_clk", NULL);
@@ -473,7 +472,7 @@ void __init spear1310_clk_init(void)
        /* peripherals */
        clk_register_fixed_factor(NULL, "thermal_clk", "osc_24m_clk", 0, 1,
                        128);
-        clk = clk_register_gate(NULL, "thermal_gate_clk", "thermal_clk", 0,
+        clk = clk_register_gate(NULL, "thermal_gclk", "thermal_clk", 0,
                        SPEAR1310_PERIP2_CLK_ENB, SPEAR1310_THSENS_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "spear_thermal");
@@ -500,177 +499,176 @@ void __init spear1310_clk_init(void)
        clk_register_clkdev(clk, "apb_clk", NULL);
        /* gpt clocks */
-        clk = clk_register_mux(NULL, "gpt0_mux_clk", gpt_parents,
+        clk = clk_register_mux(NULL, "gpt0_mclk", gpt_parents,
                        ARRAY_SIZE(gpt_parents), 0, SPEAR1310_PERIP_CLK_CFG,
                        SPEAR1310_GPT0_CLK_SHIFT, SPEAR1310_GPT_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "gpt0_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt0_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt0_clk", "gpt0_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt0_clk", "gpt0_mclk", 0,
                        SPEAR1310_PERIP1_CLK_ENB, SPEAR1310_GPT0_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "gpt0");
-        clk = clk_register_mux(NULL, "gpt1_mux_clk", gpt_parents,
+        clk = clk_register_mux(NULL, "gpt1_mclk", gpt_parents,
                        ARRAY_SIZE(gpt_parents), 0, SPEAR1310_PERIP_CLK_CFG,
                        SPEAR1310_GPT1_CLK_SHIFT, SPEAR1310_GPT_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "gpt1_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt1_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt1_clk", "gpt1_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt1_clk", "gpt1_mclk", 0,
                        SPEAR1310_PERIP1_CLK_ENB, SPEAR1310_GPT1_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "gpt1");
-        clk = clk_register_mux(NULL, "gpt2_mux_clk", gpt_parents,
+        clk = clk_register_mux(NULL, "gpt2_mclk", gpt_parents,
                        ARRAY_SIZE(gpt_parents), 0, SPEAR1310_PERIP_CLK_CFG,
                        SPEAR1310_GPT2_CLK_SHIFT, SPEAR1310_GPT_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "gpt2_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt2_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt2_clk", "gpt2_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt2_clk", "gpt2_mclk", 0,
                        SPEAR1310_PERIP2_CLK_ENB, SPEAR1310_GPT2_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "gpt2");
-        clk = clk_register_mux(NULL, "gpt3_mux_clk", gpt_parents,
+        clk = clk_register_mux(NULL, "gpt3_mclk", gpt_parents,
                        ARRAY_SIZE(gpt_parents), 0, SPEAR1310_PERIP_CLK_CFG,
                        SPEAR1310_GPT3_CLK_SHIFT, SPEAR1310_GPT_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "gpt3_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt3_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt3_clk", "gpt3_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt3_clk", "gpt3_mclk", 0,
                        SPEAR1310_PERIP2_CLK_ENB, SPEAR1310_GPT3_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "gpt3");
        /* others */
-        clk = clk_register_aux("uart_synth_clk", "uart_synth_gate_clk",
+        clk = clk_register_aux("uart_syn_clk", "uart_syn_gclk", "vco1div2_clk",
-                        "vco1div2_clk", 0, SPEAR1310_UART_CLK_SYNT, NULL,
+                        0, SPEAR1310_UART_CLK_SYNT, NULL, aux_rtbl,
-                        aux_rtbl, ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
+                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "uart_synth_clk", NULL);
+        clk_register_clkdev(clk, "uart_syn_clk", NULL);
-        clk_register_clkdev(clk1, "uart_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "uart_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "uart0_mux_clk", uart0_parents,
+        clk = clk_register_mux(NULL, "uart0_mclk", uart0_parents,
                        ARRAY_SIZE(uart0_parents), 0, SPEAR1310_PERIP_CLK_CFG,
                        SPEAR1310_UART_CLK_SHIFT, SPEAR1310_UART_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "uart0_mux_clk", NULL);
+        clk_register_clkdev(clk, "uart0_mclk", NULL);
-        clk = clk_register_gate(NULL, "uart0_clk", "uart0_mux_clk", 0,
+        clk = clk_register_gate(NULL, "uart0_clk", "uart0_mclk", 0,
                        SPEAR1310_PERIP1_CLK_ENB, SPEAR1310_UART_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "e0000000.serial");
-        clk = clk_register_aux("sdhci_synth_clk", "sdhci_synth_gate_clk",
+        clk = clk_register_aux("sdhci_syn_clk", "sdhci_syn_gclk",
                        "vco1div2_clk", 0, SPEAR1310_SDHCI_CLK_SYNT, NULL,
                        aux_rtbl, ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "sdhci_synth_clk", NULL);
+        clk_register_clkdev(clk, "sdhci_syn_clk", NULL);
-        clk_register_clkdev(clk1, "sdhci_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "sdhci_syn_gclk", NULL);
-        clk = clk_register_gate(NULL, "sdhci_clk", "sdhci_synth_gate_clk", 0,
+        clk = clk_register_gate(NULL, "sdhci_clk", "sdhci_syn_gclk", 0,
                        SPEAR1310_PERIP1_CLK_ENB, SPEAR1310_SDHCI_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "b3000000.sdhci");
-        clk = clk_register_aux("cfxd_synth_clk", "cfxd_synth_gate_clk",
+        clk = clk_register_aux("cfxd_syn_clk", "cfxd_syn_gclk", "vco1div2_clk",
-                        "vco1div2_clk", 0, SPEAR1310_CFXD_CLK_SYNT, NULL,
+                        0, SPEAR1310_CFXD_CLK_SYNT, NULL, aux_rtbl,
-                        aux_rtbl, ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
+                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "cfxd_synth_clk", NULL);
+        clk_register_clkdev(clk, "cfxd_syn_clk", NULL);
-        clk_register_clkdev(clk1, "cfxd_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "cfxd_syn_gclk", NULL);
-        clk = clk_register_gate(NULL, "cfxd_clk", "cfxd_synth_gate_clk", 0,
+        clk = clk_register_gate(NULL, "cfxd_clk", "cfxd_syn_gclk", 0,
                        SPEAR1310_PERIP1_CLK_ENB, SPEAR1310_CFXD_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "b2800000.cf");
        clk_register_clkdev(clk, NULL, "arasan_xd");
-        clk = clk_register_aux("c3_synth_clk", "c3_synth_gate_clk",
+        clk = clk_register_aux("c3_syn_clk", "c3_syn_gclk", "vco1div2_clk",
-                        "vco1div2_clk", 0, SPEAR1310_C3_CLK_SYNT, NULL,
+                        0, SPEAR1310_C3_CLK_SYNT, NULL, aux_rtbl,
-                        aux_rtbl, ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
+                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "c3_synth_clk", NULL);
+        clk_register_clkdev(clk, "c3_syn_clk", NULL);
-        clk_register_clkdev(clk1, "c3_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "c3_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "c3_mux_clk", c3_parents,
+        clk = clk_register_mux(NULL, "c3_mclk", c3_parents,
                        ARRAY_SIZE(c3_parents), 0, SPEAR1310_PERIP_CLK_CFG,
                        SPEAR1310_C3_CLK_SHIFT, SPEAR1310_C3_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "c3_mux_clk", NULL);
+        clk_register_clkdev(clk, "c3_mclk", NULL);
-        clk = clk_register_gate(NULL, "c3_clk", "c3_mux_clk", 0,
+        clk = clk_register_gate(NULL, "c3_clk", "c3_mclk", 0,
                        SPEAR1310_PERIP1_CLK_ENB, SPEAR1310_C3_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "c3");
        /* gmac */
-        clk = clk_register_mux(NULL, "gmac_phy_input_mux_clk",
+        clk = clk_register_mux(NULL, "phy_input_mclk", gmac_phy_input_parents,
-                        gmac_phy_input_parents,
                        ARRAY_SIZE(gmac_phy_input_parents), 0,
                        SPEAR1310_GMAC_CLK_CFG,
                        SPEAR1310_GMAC_PHY_INPUT_CLK_SHIFT,
                        SPEAR1310_GMAC_PHY_INPUT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "gmac_phy_input_mux_clk", NULL);
+        clk_register_clkdev(clk, "phy_input_mclk", NULL);
-        clk = clk_register_aux("gmac_phy_synth_clk", "gmac_phy_synth_gate_clk",
+        clk = clk_register_aux("phy_syn_clk", "phy_syn_gclk", "phy_input_mclk",
-                        "gmac_phy_input_mux_clk", 0, SPEAR1310_GMAC_CLK_SYNT,
+                        0, SPEAR1310_GMAC_CLK_SYNT, NULL, gmac_rtbl,
-                        NULL, gmac_rtbl, ARRAY_SIZE(gmac_rtbl), &_lock, &clk1);
+                        ARRAY_SIZE(gmac_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "gmac_phy_synth_clk", NULL);
+        clk_register_clkdev(clk, "phy_syn_clk", NULL);
-        clk_register_clkdev(clk1, "gmac_phy_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "phy_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "gmac_phy_mux_clk", gmac_phy_parents,
+        clk = clk_register_mux(NULL, "phy_mclk", gmac_phy_parents,
                        ARRAY_SIZE(gmac_phy_parents), 0,
                        SPEAR1310_PERIP_CLK_CFG, SPEAR1310_GMAC_PHY_CLK_SHIFT,
                        SPEAR1310_GMAC_PHY_CLK_MASK, 0, &_lock);
        clk_register_clkdev(clk, NULL, "stmmacphy.0");
        /* clcd */
-        clk = clk_register_mux(NULL, "clcd_synth_mux_clk", clcd_synth_parents,
+        clk = clk_register_mux(NULL, "clcd_syn_mclk", clcd_synth_parents,
                        ARRAY_SIZE(clcd_synth_parents), 0,
                        SPEAR1310_CLCD_CLK_SYNT, SPEAR1310_CLCD_SYNT_CLK_SHIFT,
                        SPEAR1310_CLCD_SYNT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "clcd_synth_mux_clk", NULL);
+        clk_register_clkdev(clk, "clcd_syn_mclk", NULL);
-        clk = clk_register_frac("clcd_synth_clk", "clcd_synth_mux_clk", 0,
+        clk = clk_register_frac("clcd_syn_clk", "clcd_syn_mclk", 0,
                        SPEAR1310_CLCD_CLK_SYNT, clcd_rtbl,
                        ARRAY_SIZE(clcd_rtbl), &_lock);
-        clk_register_clkdev(clk, "clcd_synth_clk", NULL);
+        clk_register_clkdev(clk, "clcd_syn_clk", NULL);
-        clk = clk_register_mux(NULL, "clcd_pixel_mux_clk", clcd_pixel_parents,
+        clk = clk_register_mux(NULL, "clcd_pixel_mclk", clcd_pixel_parents,
                        ARRAY_SIZE(clcd_pixel_parents), 0,
                        SPEAR1310_PERIP_CLK_CFG, SPEAR1310_CLCD_CLK_SHIFT,
                        SPEAR1310_CLCD_CLK_MASK, 0, &_lock);
        clk_register_clkdev(clk, "clcd_pixel_clk", NULL);
-        clk = clk_register_gate(NULL, "clcd_clk", "clcd_pixel_mux_clk", 0,
+        clk = clk_register_gate(NULL, "clcd_clk", "clcd_pixel_mclk", 0,
                        SPEAR1310_PERIP1_CLK_ENB, SPEAR1310_CLCD_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, "clcd_clk", NULL);
        /* i2s */
-        clk = clk_register_mux(NULL, "i2s_src_mux_clk", i2s_src_parents,
+        clk = clk_register_mux(NULL, "i2s_src_mclk", i2s_src_parents,
                        ARRAY_SIZE(i2s_src_parents), 0, SPEAR1310_I2S_CLK_CFG,
                        SPEAR1310_I2S_SRC_CLK_SHIFT, SPEAR1310_I2S_SRC_CLK_MASK,
                        0, &_lock);
        clk_register_clkdev(clk, "i2s_src_clk", NULL);
-        clk = clk_register_aux("i2s_prs1_clk", NULL, "i2s_src_mux_clk", 0,
+        clk = clk_register_aux("i2s_prs1_clk", NULL, "i2s_src_mclk", 0,
                        SPEAR1310_I2S_CLK_CFG, &i2s_prs1_masks, i2s_prs1_rtbl,
                        ARRAY_SIZE(i2s_prs1_rtbl), &_lock, NULL);
        clk_register_clkdev(clk, "i2s_prs1_clk", NULL);
-        clk = clk_register_mux(NULL, "i2s_ref_mux_clk", i2s_ref_parents,
+        clk = clk_register_mux(NULL, "i2s_ref_mclk", i2s_ref_parents,
                        ARRAY_SIZE(i2s_ref_parents), 0, SPEAR1310_I2S_CLK_CFG,
                        SPEAR1310_I2S_REF_SHIFT, SPEAR1310_I2S_REF_SEL_MASK, 0,
                        &_lock);
        clk_register_clkdev(clk, "i2s_ref_clk", NULL);
-        clk = clk_register_gate(NULL, "i2s_ref_pad_clk", "i2s_ref_mux_clk", 0,
+        clk = clk_register_gate(NULL, "i2s_ref_pad_clk", "i2s_ref_mclk", 0,
                        SPEAR1310_PERIP2_CLK_ENB, SPEAR1310_I2S_REF_PAD_CLK_ENB,
                        0, &_lock);
        clk_register_clkdev(clk, "i2s_ref_pad_clk", NULL);
-        clk = clk_register_aux("i2s_sclk_clk", "i2s_sclk_gate_clk",
+        clk = clk_register_aux("i2s_sclk_clk", "i2s_sclk_gclk",
                        "i2s_ref_pad_clk", 0, SPEAR1310_I2S_CLK_CFG,
                        &i2s_sclk_masks, i2s_sclk_rtbl,
                        ARRAY_SIZE(i2s_sclk_rtbl), &_lock, &clk1);
        clk_register_clkdev(clk, "i2s_sclk_clk", NULL);
-        clk_register_clkdev(clk1, "i2s_sclk_gate_clk", NULL);
+        clk_register_clkdev(clk1, "i2s_sclk_gclk", NULL);
        /* clock derived from ahb clk */
        clk = clk_register_gate(NULL, "i2c0_clk", "ahb_clk", 0,
@@ -747,13 +745,13 @@ void __init spear1310_clk_init(void)
                        &_lock);
        clk_register_clkdev(clk, "sysram1_clk", NULL);
-        clk = clk_register_aux("adc_synth_clk", "adc_synth_gate_clk", "ahb_clk",
+        clk = clk_register_aux("adc_syn_clk", "adc_syn_gclk", "ahb_clk",
                        0, SPEAR1310_ADC_CLK_SYNT, NULL, adc_rtbl,
                        ARRAY_SIZE(adc_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "adc_synth_clk", NULL);
+        clk_register_clkdev(clk, "adc_syn_clk", NULL);
-        clk_register_clkdev(clk1, "adc_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "adc_syn_gclk", NULL);
-        clk = clk_register_gate(NULL, "adc_clk", "adc_synth_gate_clk", 0,
+        clk = clk_register_gate(NULL, "adc_clk", "adc_syn_gclk", 0,
                        SPEAR1310_PERIP1_CLK_ENB, SPEAR1310_ADC_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "adc_clk");
@@ -790,37 +788,37 @@ void __init spear1310_clk_init(void)
        clk_register_clkdev(clk, NULL, "e0300000.kbd");
        /* RAS clks */
-        clk = clk_register_mux(NULL, "gen_synth0_1_mux_clk",
+        clk = clk_register_mux(NULL, "gen_syn0_1_mclk", gen_synth0_1_parents,
-                        gen_synth0_1_parents, ARRAY_SIZE(gen_synth0_1_parents),
+                        ARRAY_SIZE(gen_synth0_1_parents), 0, SPEAR1310_PLL_CFG,
-                        0, SPEAR1310_PLL_CFG, SPEAR1310_RAS_SYNT0_1_CLK_SHIFT,
+                        SPEAR1310_RAS_SYNT0_1_CLK_SHIFT,
                        SPEAR1310_RAS_SYNT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "gen_synth0_1_clk", NULL);
+        clk_register_clkdev(clk, "gen_syn0_1_clk", NULL);
-        clk = clk_register_mux(NULL, "gen_synth2_3_mux_clk",
+        clk = clk_register_mux(NULL, "gen_syn2_3_mclk", gen_synth2_3_parents,
-                        gen_synth2_3_parents, ARRAY_SIZE(gen_synth2_3_parents),
+                        ARRAY_SIZE(gen_synth2_3_parents), 0, SPEAR1310_PLL_CFG,
-                        0, SPEAR1310_PLL_CFG, SPEAR1310_RAS_SYNT2_3_CLK_SHIFT,
+                        SPEAR1310_RAS_SYNT2_3_CLK_SHIFT,
                        SPEAR1310_RAS_SYNT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "gen_synth2_3_clk", NULL);
+        clk_register_clkdev(clk, "gen_syn2_3_clk", NULL);
-        clk = clk_register_frac("gen_synth0_clk", "gen_synth0_1_clk", 0,
+        clk = clk_register_frac("gen_syn0_clk", "gen_syn0_1_clk", 0,
                        SPEAR1310_RAS_CLK_SYNT0, gen_rtbl, ARRAY_SIZE(gen_rtbl),
                        &_lock);
-        clk_register_clkdev(clk, "gen_synth0_clk", NULL);
+        clk_register_clkdev(clk, "gen_syn0_clk", NULL);
-        clk = clk_register_frac("gen_synth1_clk", "gen_synth0_1_clk", 0,
+        clk = clk_register_frac("gen_syn1_clk", "gen_syn0_1_clk", 0,
                        SPEAR1310_RAS_CLK_SYNT1, gen_rtbl, ARRAY_SIZE(gen_rtbl),
                        &_lock);
-        clk_register_clkdev(clk, "gen_synth1_clk", NULL);
+        clk_register_clkdev(clk, "gen_syn1_clk", NULL);
-        clk = clk_register_frac("gen_synth2_clk", "gen_synth2_3_clk", 0,
+        clk = clk_register_frac("gen_syn2_clk", "gen_syn2_3_clk", 0,
                        SPEAR1310_RAS_CLK_SYNT2, gen_rtbl, ARRAY_SIZE(gen_rtbl),
                        &_lock);
-        clk_register_clkdev(clk, "gen_synth2_clk", NULL);
+        clk_register_clkdev(clk, "gen_syn2_clk", NULL);
-        clk = clk_register_frac("gen_synth3_clk", "gen_synth2_3_clk", 0,
+        clk = clk_register_frac("gen_syn3_clk", "gen_syn2_3_clk", 0,
                        SPEAR1310_RAS_CLK_SYNT3, gen_rtbl, ARRAY_SIZE(gen_rtbl),
                        &_lock);
-        clk_register_clkdev(clk, "gen_synth3_clk", NULL);
+        clk_register_clkdev(clk, "gen_syn3_clk", NULL);
        clk = clk_register_gate(NULL, "ras_osc_24m_clk", "osc_24m_clk", 0,
                        SPEAR1310_RAS_CLK_ENB, SPEAR1310_OSC_24M_CLK_ENB, 0,
@@ -847,7 +845,7 @@ void __init spear1310_clk_init(void)
                        &_lock);
        clk_register_clkdev(clk, "ras_pll3_clk", NULL);
-        clk = clk_register_gate(NULL, "ras_tx125_clk", "gmii_125m_pad_clk", 0,
+        clk = clk_register_gate(NULL, "ras_tx125_clk", "gmii_pad_clk", 0,
                        SPEAR1310_RAS_CLK_ENB, SPEAR1310_C125M_PAD_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, "ras_tx125_clk", NULL);
@@ -912,7 +910,7 @@ void __init spear1310_clk_init(void)
                        &_lock);
        clk_register_clkdev(clk, NULL, "5c700000.eth");
-        clk = clk_register_mux(NULL, "smii_rgmii_phy_mux_clk",
+        clk = clk_register_mux(NULL, "smii_rgmii_phy_mclk",
                        smii_rgmii_phy_parents,
                        ARRAY_SIZE(smii_rgmii_phy_parents), 0,
                        SPEAR1310_RAS_CTRL_REG1,
@@ -922,184 +920,184 @@ void __init spear1310_clk_init(void)
        clk_register_clkdev(clk, NULL, "stmmacphy.2");
        clk_register_clkdev(clk, NULL, "stmmacphy.4");
-        clk = clk_register_mux(NULL, "rmii_phy_mux_clk", rmii_phy_parents,
+        clk = clk_register_mux(NULL, "rmii_phy_mclk", rmii_phy_parents,
                        ARRAY_SIZE(rmii_phy_parents), 0,
                        SPEAR1310_RAS_CTRL_REG1, SPEAR1310_RMII_PHY_CLK_SHIFT,
                        SPEAR1310_PHY_CLK_MASK, 0, &_lock);
        clk_register_clkdev(clk, NULL, "stmmacphy.3");
-        clk = clk_register_mux(NULL, "uart1_mux_clk", uart_parents,
+        clk = clk_register_mux(NULL, "uart1_mclk", uart_parents,
                        ARRAY_SIZE(uart_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_UART1_CLK_SHIFT, SPEAR1310_RAS_UART_CLK_MASK,
                        0, &_lock);
-        clk_register_clkdev(clk, "uart1_mux_clk", NULL);
+        clk_register_clkdev(clk, "uart1_mclk", NULL);
-        clk = clk_register_gate(NULL, "uart1_clk", "uart1_mux_clk", 0,
+        clk = clk_register_gate(NULL, "uart1_clk", "uart1_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_UART1_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5c800000.serial");
-        clk = clk_register_mux(NULL, "uart2_mux_clk", uart_parents,
+        clk = clk_register_mux(NULL, "uart2_mclk", uart_parents,
                        ARRAY_SIZE(uart_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_UART2_CLK_SHIFT, SPEAR1310_RAS_UART_CLK_MASK,
                        0, &_lock);
-        clk_register_clkdev(clk, "uart2_mux_clk", NULL);
+        clk_register_clkdev(clk, "uart2_mclk", NULL);
-        clk = clk_register_gate(NULL, "uart2_clk", "uart2_mux_clk", 0,
+        clk = clk_register_gate(NULL, "uart2_clk", "uart2_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_UART2_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5c900000.serial");
-        clk = clk_register_mux(NULL, "uart3_mux_clk", uart_parents,
+        clk = clk_register_mux(NULL, "uart3_mclk", uart_parents,
                        ARRAY_SIZE(uart_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_UART3_CLK_SHIFT, SPEAR1310_RAS_UART_CLK_MASK,
                        0, &_lock);
-        clk_register_clkdev(clk, "uart3_mux_clk", NULL);
+        clk_register_clkdev(clk, "uart3_mclk", NULL);
-        clk = clk_register_gate(NULL, "uart3_clk", "uart3_mux_clk", 0,
+        clk = clk_register_gate(NULL, "uart3_clk", "uart3_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_UART3_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5ca00000.serial");
-        clk = clk_register_mux(NULL, "uart4_mux_clk", uart_parents,
+        clk = clk_register_mux(NULL, "uart4_mclk", uart_parents,
                        ARRAY_SIZE(uart_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_UART4_CLK_SHIFT, SPEAR1310_RAS_UART_CLK_MASK,
                        0, &_lock);
-        clk_register_clkdev(clk, "uart4_mux_clk", NULL);
+        clk_register_clkdev(clk, "uart4_mclk", NULL);
-        clk = clk_register_gate(NULL, "uart4_clk", "uart4_mux_clk", 0,
+        clk = clk_register_gate(NULL, "uart4_clk", "uart4_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_UART4_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5cb00000.serial");
-        clk = clk_register_mux(NULL, "uart5_mux_clk", uart_parents,
+        clk = clk_register_mux(NULL, "uart5_mclk", uart_parents,
                        ARRAY_SIZE(uart_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_UART5_CLK_SHIFT, SPEAR1310_RAS_UART_CLK_MASK,
                        0, &_lock);
-        clk_register_clkdev(clk, "uart5_mux_clk", NULL);
+        clk_register_clkdev(clk, "uart5_mclk", NULL);
-        clk = clk_register_gate(NULL, "uart5_clk", "uart5_mux_clk", 0,
+        clk = clk_register_gate(NULL, "uart5_clk", "uart5_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_UART5_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5cc00000.serial");
-        clk = clk_register_mux(NULL, "i2c1_mux_clk", i2c_parents,
+        clk = clk_register_mux(NULL, "i2c1_mclk", i2c_parents,
                        ARRAY_SIZE(i2c_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_I2C1_CLK_SHIFT, SPEAR1310_I2C_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "i2c1_mux_clk", NULL);
+        clk_register_clkdev(clk, "i2c1_mclk", NULL);
-        clk = clk_register_gate(NULL, "i2c1_clk", "i2c1_mux_clk", 0,
+        clk = clk_register_gate(NULL, "i2c1_clk", "i2c1_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_I2C1_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5cd00000.i2c");
-        clk = clk_register_mux(NULL, "i2c2_mux_clk", i2c_parents,
+        clk = clk_register_mux(NULL, "i2c2_mclk", i2c_parents,
                        ARRAY_SIZE(i2c_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_I2C2_CLK_SHIFT, SPEAR1310_I2C_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "i2c2_mux_clk", NULL);
+        clk_register_clkdev(clk, "i2c2_mclk", NULL);
-        clk = clk_register_gate(NULL, "i2c2_clk", "i2c2_mux_clk", 0,
+        clk = clk_register_gate(NULL, "i2c2_clk", "i2c2_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_I2C2_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5ce00000.i2c");
-        clk = clk_register_mux(NULL, "i2c3_mux_clk", i2c_parents,
+        clk = clk_register_mux(NULL, "i2c3_mclk", i2c_parents,
                        ARRAY_SIZE(i2c_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_I2C3_CLK_SHIFT, SPEAR1310_I2C_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "i2c3_mux_clk", NULL);
+        clk_register_clkdev(clk, "i2c3_mclk", NULL);
-        clk = clk_register_gate(NULL, "i2c3_clk", "i2c3_mux_clk", 0,
+        clk = clk_register_gate(NULL, "i2c3_clk", "i2c3_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_I2C3_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5cf00000.i2c");
-        clk = clk_register_mux(NULL, "i2c4_mux_clk", i2c_parents,
+        clk = clk_register_mux(NULL, "i2c4_mclk", i2c_parents,
                        ARRAY_SIZE(i2c_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_I2C4_CLK_SHIFT, SPEAR1310_I2C_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "i2c4_mux_clk", NULL);
+        clk_register_clkdev(clk, "i2c4_mclk", NULL);
-        clk = clk_register_gate(NULL, "i2c4_clk", "i2c4_mux_clk", 0,
+        clk = clk_register_gate(NULL, "i2c4_clk", "i2c4_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_I2C4_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5d000000.i2c");
-        clk = clk_register_mux(NULL, "i2c5_mux_clk", i2c_parents,
+        clk = clk_register_mux(NULL, "i2c5_mclk", i2c_parents,
                        ARRAY_SIZE(i2c_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_I2C5_CLK_SHIFT, SPEAR1310_I2C_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "i2c5_mux_clk", NULL);
+        clk_register_clkdev(clk, "i2c5_mclk", NULL);
-        clk = clk_register_gate(NULL, "i2c5_clk", "i2c5_mux_clk", 0,
+        clk = clk_register_gate(NULL, "i2c5_clk", "i2c5_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_I2C5_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5d100000.i2c");
-        clk = clk_register_mux(NULL, "i2c6_mux_clk", i2c_parents,
+        clk = clk_register_mux(NULL, "i2c6_mclk", i2c_parents,
                        ARRAY_SIZE(i2c_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_I2C6_CLK_SHIFT, SPEAR1310_I2C_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "i2c6_mux_clk", NULL);
+        clk_register_clkdev(clk, "i2c6_mclk", NULL);
-        clk = clk_register_gate(NULL, "i2c6_clk", "i2c6_mux_clk", 0,
+        clk = clk_register_gate(NULL, "i2c6_clk", "i2c6_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_I2C6_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5d200000.i2c");
-        clk = clk_register_mux(NULL, "i2c7_mux_clk", i2c_parents,
+        clk = clk_register_mux(NULL, "i2c7_mclk", i2c_parents,
                        ARRAY_SIZE(i2c_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_I2C7_CLK_SHIFT, SPEAR1310_I2C_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "i2c7_mux_clk", NULL);
+        clk_register_clkdev(clk, "i2c7_mclk", NULL);
-        clk = clk_register_gate(NULL, "i2c7_clk", "i2c7_mux_clk", 0,
+        clk = clk_register_gate(NULL, "i2c7_clk", "i2c7_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_I2C7_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5d300000.i2c");
-        clk = clk_register_mux(NULL, "ssp1_mux_clk", ssp1_parents,
+        clk = clk_register_mux(NULL, "ssp1_mclk", ssp1_parents,
                        ARRAY_SIZE(ssp1_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_SSP1_CLK_SHIFT, SPEAR1310_SSP1_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "ssp1_mux_clk", NULL);
+        clk_register_clkdev(clk, "ssp1_mclk", NULL);
-        clk = clk_register_gate(NULL, "ssp1_clk", "ssp1_mux_clk", 0,
+        clk = clk_register_gate(NULL, "ssp1_clk", "ssp1_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_SSP1_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "5d400000.spi");
-        clk = clk_register_mux(NULL, "pci_mux_clk", pci_parents,
+        clk = clk_register_mux(NULL, "pci_mclk", pci_parents,
                        ARRAY_SIZE(pci_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_PCI_CLK_SHIFT, SPEAR1310_PCI_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "pci_mux_clk", NULL);
+        clk_register_clkdev(clk, "pci_mclk", NULL);
-        clk = clk_register_gate(NULL, "pci_clk", "pci_mux_clk", 0,
+        clk = clk_register_gate(NULL, "pci_clk", "pci_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_PCI_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "pci");
-        clk = clk_register_mux(NULL, "tdm1_mux_clk", tdm_parents,
+        clk = clk_register_mux(NULL, "tdm1_mclk", tdm_parents,
                        ARRAY_SIZE(tdm_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_TDM1_CLK_SHIFT, SPEAR1310_TDM_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "tdm1_mux_clk", NULL);
+        clk_register_clkdev(clk, "tdm1_mclk", NULL);
-        clk = clk_register_gate(NULL, "tdm1_clk", "tdm1_mux_clk", 0,
+        clk = clk_register_gate(NULL, "tdm1_clk", "tdm1_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_TDM1_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "tdm_hdlc.0");
-        clk = clk_register_mux(NULL, "tdm2_mux_clk", tdm_parents,
+        clk = clk_register_mux(NULL, "tdm2_mclk", tdm_parents,
                        ARRAY_SIZE(tdm_parents), 0, SPEAR1310_RAS_CTRL_REG0,
                        SPEAR1310_TDM2_CLK_SHIFT, SPEAR1310_TDM_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "tdm2_mux_clk", NULL);
+        clk_register_clkdev(clk, "tdm2_mclk", NULL);
-        clk = clk_register_gate(NULL, "tdm2_clk", "tdm2_mux_clk", 0,
+        clk = clk_register_gate(NULL, "tdm2_clk", "tdm2_mclk", 0,
                        SPEAR1310_RAS_SW_CLK_CTRL, SPEAR1310_TDM2_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "tdm_hdlc.1");
diff --git a/drivers/clk/spear/spear1340_clock.c b/drivers/clk/spear/spear1340_clock.c
index e3ea72162236..2352cee7f645 100644
--- a/drivers/clk/spear/spear1340_clock.c
+++ b/drivers/clk/spear/spear1340_clock.c
@@ -369,27 +369,25 @@ static struct frac_rate_tbl gen_rtbl[] = {
 /* clock parents */
 static const char *vco_parents[] = { "osc_24m_clk", "osc_25m_clk", };
-static const char *sys_parents[] = { "none", "pll1_clk", "none", "none",
+static const char *sys_parents[] = { "pll1_clk", "pll1_clk", "pll1_clk",
-        "sys_synth_clk", "none", "pll2_clk", "pll3_clk", };
+        "pll1_clk", "sys_synth_clk", "sys_synth_clk", "pll2_clk", "pll3_clk", };
-static const char *ahb_parents[] = { "cpu_div3_clk", "amba_synth_clk", };
+static const char *ahb_parents[] = { "cpu_div3_clk", "amba_syn_clk", };
 static const char *gpt_parents[] = { "osc_24m_clk", "apb_clk", };
 static const char *uart0_parents[] = { "pll5_clk", "osc_24m_clk",
-        "uart0_synth_gate_clk", };
+        "uart0_syn_gclk", };
 static const char *uart1_parents[] = { "pll5_clk", "osc_24m_clk",
-        "uart1_synth_gate_clk", };
+        "uart1_syn_gclk", };
-static const char *c3_parents[] = { "pll5_clk", "c3_synth_gate_clk", };
+static const char *c3_parents[] = { "pll5_clk", "c3_syn_gclk", };
-static const char *gmac_phy_input_parents[] = { "gmii_125m_pad_clk", "pll2_clk",
+static const char *gmac_phy_input_parents[] = { "gmii_pad_clk", "pll2_clk",
        "osc_25m_clk", };
-static const char *gmac_phy_parents[] = { "gmac_phy_input_mux_clk",
+static const char *gmac_phy_parents[] = { "phy_input_mclk", "phy_syn_gclk", };
-        "gmac_phy_synth_gate_clk", };
 static const char *clcd_synth_parents[] = { "vco1div4_clk", "pll2_clk", };
-static const char *clcd_pixel_parents[] = { "pll5_clk", "clcd_synth_clk", };
+static const char *clcd_pixel_parents[] = { "pll5_clk", "clcd_syn_clk", };
 static const char *i2s_src_parents[] = { "vco1div2_clk", "pll2_clk", "pll3_clk",
        "i2s_src_pad_clk", };
-static const char *i2s_ref_parents[] = { "i2s_src_mux_clk", "i2s_prs1_clk", };
+static const char *i2s_ref_parents[] = { "i2s_src_mclk", "i2s_prs1_clk", };
-static const char *spdif_out_parents[] = { "i2s_src_pad_clk", "gen_synth2_clk",
+static const char *spdif_out_parents[] = { "i2s_src_pad_clk", "gen_syn2_clk", };
-};
+static const char *spdif_in_parents[] = { "pll2_clk", "gen_syn3_clk", };
-static const char *spdif_in_parents[] = { "pll2_clk", "gen_synth3_clk", };
 static const char *gen_synth0_1_parents[] = { "vco1div4_clk", "vco3div2_clk",
        "pll3_clk", };
@@ -415,9 +413,9 @@ void __init spear1340_clk_init(void)
                        25000000);
        clk_register_clkdev(clk, "osc_25m_clk", NULL);
-        clk = clk_register_fixed_rate(NULL, "gmii_125m_pad_clk", NULL,
+        clk = clk_register_fixed_rate(NULL, "gmii_pad_clk", NULL, CLK_IS_ROOT,
-                        CLK_IS_ROOT, 125000000);
+                        125000000);
-        clk_register_clkdev(clk, "gmii_125m_pad_clk", NULL);
+        clk_register_clkdev(clk, "gmii_pad_clk", NULL);
        clk = clk_register_fixed_rate(NULL, "i2s_src_pad_clk", NULL,
                        CLK_IS_ROOT, 12288000);
@@ -431,35 +429,35 @@ void __init spear1340_clk_init(void)
        /* clock derived from 24 or 25 MHz osc clk */
        /* vco-pll */
-        clk = clk_register_mux(NULL, "vco1_mux_clk", vco_parents,
+        clk = clk_register_mux(NULL, "vco1_mclk", vco_parents,
                        ARRAY_SIZE(vco_parents), 0, SPEAR1340_PLL_CFG,
                        SPEAR1340_PLL1_CLK_SHIFT, SPEAR1340_PLL_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "vco1_mux_clk", NULL);
+        clk_register_clkdev(clk, "vco1_mclk", NULL);
-        clk = clk_register_vco_pll("vco1_clk", "pll1_clk", NULL, "vco1_mux_clk",
+        clk = clk_register_vco_pll("vco1_clk", "pll1_clk", NULL, "vco1_mclk", 0,
-                        0, SPEAR1340_PLL1_CTR, SPEAR1340_PLL1_FRQ, pll_rtbl,
+                        SPEAR1340_PLL1_CTR, SPEAR1340_PLL1_FRQ, pll_rtbl,
                        ARRAY_SIZE(pll_rtbl), &_lock, &clk1, NULL);
        clk_register_clkdev(clk, "vco1_clk", NULL);
        clk_register_clkdev(clk1, "pll1_clk", NULL);
-        clk = clk_register_mux(NULL, "vco2_mux_clk", vco_parents,
+        clk = clk_register_mux(NULL, "vco2_mclk", vco_parents,
                        ARRAY_SIZE(vco_parents), 0, SPEAR1340_PLL_CFG,
                        SPEAR1340_PLL2_CLK_SHIFT, SPEAR1340_PLL_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "vco2_mux_clk", NULL);
+        clk_register_clkdev(clk, "vco2_mclk", NULL);
-        clk = clk_register_vco_pll("vco2_clk", "pll2_clk", NULL, "vco2_mux_clk",
+        clk = clk_register_vco_pll("vco2_clk", "pll2_clk", NULL, "vco2_mclk", 0,
-                        0, SPEAR1340_PLL2_CTR, SPEAR1340_PLL2_FRQ, pll_rtbl,
+                        SPEAR1340_PLL2_CTR, SPEAR1340_PLL2_FRQ, pll_rtbl,
                        ARRAY_SIZE(pll_rtbl), &_lock, &clk1, NULL);
        clk_register_clkdev(clk, "vco2_clk", NULL);
        clk_register_clkdev(clk1, "pll2_clk", NULL);
-        clk = clk_register_mux(NULL, "vco3_mux_clk", vco_parents,
+        clk = clk_register_mux(NULL, "vco3_mclk", vco_parents,
                        ARRAY_SIZE(vco_parents), 0, SPEAR1340_PLL_CFG,
                        SPEAR1340_PLL3_CLK_SHIFT, SPEAR1340_PLL_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "vco3_mux_clk", NULL);
+        clk_register_clkdev(clk, "vco3_mclk", NULL);
-        clk = clk_register_vco_pll("vco3_clk", "pll3_clk", NULL, "vco3_mux_clk",
+        clk = clk_register_vco_pll("vco3_clk", "pll3_clk", NULL, "vco3_mclk", 0,
-                        0, SPEAR1340_PLL3_CTR, SPEAR1340_PLL3_FRQ, pll_rtbl,
+                        SPEAR1340_PLL3_CTR, SPEAR1340_PLL3_FRQ, pll_rtbl,
                        ARRAY_SIZE(pll_rtbl), &_lock, &clk1, NULL);
        clk_register_clkdev(clk, "vco3_clk", NULL);
        clk_register_clkdev(clk1, "pll3_clk", NULL);
@@ -498,7 +496,7 @@ void __init spear1340_clk_init(void)
        /* peripherals */
        clk_register_fixed_factor(NULL, "thermal_clk", "osc_24m_clk", 0, 1,
                        128);
-        clk = clk_register_gate(NULL, "thermal_gate_clk", "thermal_clk", 0,
+        clk = clk_register_gate(NULL, "thermal_gclk", "thermal_clk", 0,
                        SPEAR1340_PERIP2_CLK_ENB, SPEAR1340_THSENS_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "spear_thermal");
@@ -509,23 +507,23 @@ void __init spear1340_clk_init(void)
        clk_register_clkdev(clk, "ddr_clk", NULL);
        /* clock derived from pll1 clk */
-        clk = clk_register_frac("sys_synth_clk", "vco1div2_clk", 0,
+        clk = clk_register_frac("sys_syn_clk", "vco1div2_clk", 0,
                        SPEAR1340_SYS_CLK_SYNT, sys_synth_rtbl,
                        ARRAY_SIZE(sys_synth_rtbl), &_lock);
-        clk_register_clkdev(clk, "sys_synth_clk", NULL);
+        clk_register_clkdev(clk, "sys_syn_clk", NULL);
-        clk = clk_register_frac("amba_synth_clk", "vco1div2_clk", 0,
+        clk = clk_register_frac("amba_syn_clk", "vco1div2_clk", 0,
                        SPEAR1340_AMBA_CLK_SYNT, amba_synth_rtbl,
                        ARRAY_SIZE(amba_synth_rtbl), &_lock);
-        clk_register_clkdev(clk, "amba_synth_clk", NULL);
+        clk_register_clkdev(clk, "amba_syn_clk", NULL);
-        clk = clk_register_mux(NULL, "sys_mux_clk", sys_parents,
+        clk = clk_register_mux(NULL, "sys_mclk", sys_parents,
                        ARRAY_SIZE(sys_parents), 0, SPEAR1340_SYS_CLK_CTRL,
                        SPEAR1340_SCLK_SRC_SEL_SHIFT,
                        SPEAR1340_SCLK_SRC_SEL_MASK, 0, &_lock);
        clk_register_clkdev(clk, "sys_clk", NULL);
-        clk = clk_register_fixed_factor(NULL, "cpu_clk", "sys_mux_clk", 0, 1,
+        clk = clk_register_fixed_factor(NULL, "cpu_clk", "sys_mclk", 0, 1,
                        2);
        clk_register_clkdev(clk, "cpu_clk", NULL);
@@ -548,194 +546,193 @@ void __init spear1340_clk_init(void)
        clk_register_clkdev(clk, "apb_clk", NULL);
        /* gpt clocks */
-        clk = clk_register_mux(NULL, "gpt0_mux_clk", gpt_parents,
+        clk = clk_register_mux(NULL, "gpt0_mclk", gpt_parents,
                        ARRAY_SIZE(gpt_parents), 0, SPEAR1340_PERIP_CLK_CFG,
                        SPEAR1340_GPT0_CLK_SHIFT, SPEAR1340_GPT_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "gpt0_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt0_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt0_clk", "gpt0_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt0_clk", "gpt0_mclk", 0,
                        SPEAR1340_PERIP1_CLK_ENB, SPEAR1340_GPT0_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "gpt0");
-        clk = clk_register_mux(NULL, "gpt1_mux_clk", gpt_parents,
+        clk = clk_register_mux(NULL, "gpt1_mclk", gpt_parents,
                        ARRAY_SIZE(gpt_parents), 0, SPEAR1340_PERIP_CLK_CFG,
                        SPEAR1340_GPT1_CLK_SHIFT, SPEAR1340_GPT_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "gpt1_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt1_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt1_clk", "gpt1_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt1_clk", "gpt1_mclk", 0,
                        SPEAR1340_PERIP1_CLK_ENB, SPEAR1340_GPT1_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "gpt1");
-        clk = clk_register_mux(NULL, "gpt2_mux_clk", gpt_parents,
+        clk = clk_register_mux(NULL, "gpt2_mclk", gpt_parents,
                        ARRAY_SIZE(gpt_parents), 0, SPEAR1340_PERIP_CLK_CFG,
                        SPEAR1340_GPT2_CLK_SHIFT, SPEAR1340_GPT_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "gpt2_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt2_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt2_clk", "gpt2_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt2_clk", "gpt2_mclk", 0,
                        SPEAR1340_PERIP2_CLK_ENB, SPEAR1340_GPT2_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "gpt2");
-        clk = clk_register_mux(NULL, "gpt3_mux_clk", gpt_parents,
+        clk = clk_register_mux(NULL, "gpt3_mclk", gpt_parents,
                        ARRAY_SIZE(gpt_parents), 0, SPEAR1340_PERIP_CLK_CFG,
                        SPEAR1340_GPT3_CLK_SHIFT, SPEAR1340_GPT_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "gpt3_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt3_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt3_clk", "gpt3_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt3_clk", "gpt3_mclk", 0,
                        SPEAR1340_PERIP2_CLK_ENB, SPEAR1340_GPT3_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "gpt3");
        /* others */
-        clk = clk_register_aux("uart0_synth_clk", "uart0_synth_gate_clk",
+        clk = clk_register_aux("uart0_syn_clk", "uart0_syn_gclk",
                        "vco1div2_clk", 0, SPEAR1340_UART0_CLK_SYNT, NULL,
                        aux_rtbl, ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "uart0_synth_clk", NULL);
+        clk_register_clkdev(clk, "uart0_syn_clk", NULL);
-        clk_register_clkdev(clk1, "uart0_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "uart0_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "uart0_mux_clk", uart0_parents,
+        clk = clk_register_mux(NULL, "uart0_mclk", uart0_parents,
                        ARRAY_SIZE(uart0_parents), 0, SPEAR1340_PERIP_CLK_CFG,
                        SPEAR1340_UART0_CLK_SHIFT, SPEAR1340_UART_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "uart0_mux_clk", NULL);
+        clk_register_clkdev(clk, "uart0_mclk", NULL);
-        clk = clk_register_gate(NULL, "uart0_clk", "uart0_mux_clk", 0,
+        clk = clk_register_gate(NULL, "uart0_clk", "uart0_mclk", 0,
                        SPEAR1340_PERIP1_CLK_ENB, SPEAR1340_UART0_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "e0000000.serial");
-        clk = clk_register_aux("uart1_synth_clk", "uart1_synth_gate_clk",
+        clk = clk_register_aux("uart1_syn_clk", "uart1_syn_gclk",
                        "vco1div2_clk", 0, SPEAR1340_UART1_CLK_SYNT, NULL,
                        aux_rtbl, ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "uart1_synth_clk", NULL);
+        clk_register_clkdev(clk, "uart1_syn_clk", NULL);
-        clk_register_clkdev(clk1, "uart1_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "uart1_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "uart1_mux_clk", uart1_parents,
+        clk = clk_register_mux(NULL, "uart1_mclk", uart1_parents,
                        ARRAY_SIZE(uart1_parents), 0, SPEAR1340_PERIP_CLK_CFG,
                        SPEAR1340_UART1_CLK_SHIFT, SPEAR1340_UART_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "uart1_mux_clk", NULL);
+        clk_register_clkdev(clk, "uart1_mclk", NULL);
-        clk = clk_register_gate(NULL, "uart1_clk", "uart1_mux_clk", 0,
+        clk = clk_register_gate(NULL, "uart1_clk", "uart1_mclk", 0,
-                        SPEAR1340_PERIP1_CLK_ENB, SPEAR1340_UART1_CLK_ENB, 0,
+                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_UART1_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "b4100000.serial");
-        clk = clk_register_aux("sdhci_synth_clk", "sdhci_synth_gate_clk",
+        clk = clk_register_aux("sdhci_syn_clk", "sdhci_syn_gclk",
                        "vco1div2_clk", 0, SPEAR1340_SDHCI_CLK_SYNT, NULL,
                        aux_rtbl, ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "sdhci_synth_clk", NULL);
+        clk_register_clkdev(clk, "sdhci_syn_clk", NULL);
-        clk_register_clkdev(clk1, "sdhci_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "sdhci_syn_gclk", NULL);
-        clk = clk_register_gate(NULL, "sdhci_clk", "sdhci_synth_gate_clk", 0,
+        clk = clk_register_gate(NULL, "sdhci_clk", "sdhci_syn_gclk", 0,
                        SPEAR1340_PERIP1_CLK_ENB, SPEAR1340_SDHCI_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "b3000000.sdhci");
-        clk = clk_register_aux("cfxd_synth_clk", "cfxd_synth_gate_clk",
+        clk = clk_register_aux("cfxd_syn_clk", "cfxd_syn_gclk", "vco1div2_clk",
-                        "vco1div2_clk", 0, SPEAR1340_CFXD_CLK_SYNT, NULL,
+                        0, SPEAR1340_CFXD_CLK_SYNT, NULL, aux_rtbl,
-                        aux_rtbl, ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
+                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "cfxd_synth_clk", NULL);
+        clk_register_clkdev(clk, "cfxd_syn_clk", NULL);
-        clk_register_clkdev(clk1, "cfxd_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "cfxd_syn_gclk", NULL);
-        clk = clk_register_gate(NULL, "cfxd_clk", "cfxd_synth_gate_clk", 0,
+        clk = clk_register_gate(NULL, "cfxd_clk", "cfxd_syn_gclk", 0,
                        SPEAR1340_PERIP1_CLK_ENB, SPEAR1340_CFXD_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "b2800000.cf");
        clk_register_clkdev(clk, NULL, "arasan_xd");
-        clk = clk_register_aux("c3_synth_clk", "c3_synth_gate_clk",
+        clk = clk_register_aux("c3_syn_clk", "c3_syn_gclk", "vco1div2_clk", 0,
-                        "vco1div2_clk", 0, SPEAR1340_C3_CLK_SYNT, NULL,
+                        SPEAR1340_C3_CLK_SYNT, NULL, aux_rtbl,
-                        aux_rtbl, ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
+                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "c3_synth_clk", NULL);
+        clk_register_clkdev(clk, "c3_syn_clk", NULL);
-        clk_register_clkdev(clk1, "c3_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "c3_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "c3_mux_clk", c3_parents,
+        clk = clk_register_mux(NULL, "c3_mclk", c3_parents,
                        ARRAY_SIZE(c3_parents), 0, SPEAR1340_PERIP_CLK_CFG,
                        SPEAR1340_C3_CLK_SHIFT, SPEAR1340_C3_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "c3_mux_clk", NULL);
+        clk_register_clkdev(clk, "c3_mclk", NULL);
-        clk = clk_register_gate(NULL, "c3_clk", "c3_mux_clk", 0,
+        clk = clk_register_gate(NULL, "c3_clk", "c3_mclk", 0,
                        SPEAR1340_PERIP1_CLK_ENB, SPEAR1340_C3_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "c3");
        /* gmac */
-        clk = clk_register_mux(NULL, "gmac_phy_input_mux_clk",
+        clk = clk_register_mux(NULL, "phy_input_mclk", gmac_phy_input_parents,
-                        gmac_phy_input_parents,
                        ARRAY_SIZE(gmac_phy_input_parents), 0,
                        SPEAR1340_GMAC_CLK_CFG,
                        SPEAR1340_GMAC_PHY_INPUT_CLK_SHIFT,
                        SPEAR1340_GMAC_PHY_INPUT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "gmac_phy_input_mux_clk", NULL);
+        clk_register_clkdev(clk, "phy_input_mclk", NULL);
-        clk = clk_register_aux("gmac_phy_synth_clk", "gmac_phy_synth_gate_clk",
+        clk = clk_register_aux("phy_syn_clk", "phy_syn_gclk", "phy_input_mclk",
-                        "gmac_phy_input_mux_clk", 0, SPEAR1340_GMAC_CLK_SYNT,
+                        0, SPEAR1340_GMAC_CLK_SYNT, NULL, gmac_rtbl,
-                        NULL, gmac_rtbl, ARRAY_SIZE(gmac_rtbl), &_lock, &clk1);
+                        ARRAY_SIZE(gmac_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "gmac_phy_synth_clk", NULL);
+        clk_register_clkdev(clk, "phy_syn_clk", NULL);
-        clk_register_clkdev(clk1, "gmac_phy_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "phy_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "gmac_phy_mux_clk", gmac_phy_parents,
+        clk = clk_register_mux(NULL, "phy_mclk", gmac_phy_parents,
                        ARRAY_SIZE(gmac_phy_parents), 0,
                        SPEAR1340_PERIP_CLK_CFG, SPEAR1340_GMAC_PHY_CLK_SHIFT,
                        SPEAR1340_GMAC_PHY_CLK_MASK, 0, &_lock);
        clk_register_clkdev(clk, NULL, "stmmacphy.0");
        /* clcd */
-        clk = clk_register_mux(NULL, "clcd_synth_mux_clk", clcd_synth_parents,
+        clk = clk_register_mux(NULL, "clcd_syn_mclk", clcd_synth_parents,
                        ARRAY_SIZE(clcd_synth_parents), 0,
                        SPEAR1340_CLCD_CLK_SYNT, SPEAR1340_CLCD_SYNT_CLK_SHIFT,
                        SPEAR1340_CLCD_SYNT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "clcd_synth_mux_clk", NULL);
+        clk_register_clkdev(clk, "clcd_syn_mclk", NULL);
-        clk = clk_register_frac("clcd_synth_clk", "clcd_synth_mux_clk", 0,
+        clk = clk_register_frac("clcd_syn_clk", "clcd_syn_mclk", 0,
                        SPEAR1340_CLCD_CLK_SYNT, clcd_rtbl,
                        ARRAY_SIZE(clcd_rtbl), &_lock);
-        clk_register_clkdev(clk, "clcd_synth_clk", NULL);
+        clk_register_clkdev(clk, "clcd_syn_clk", NULL);
-        clk = clk_register_mux(NULL, "clcd_pixel_mux_clk", clcd_pixel_parents,
+        clk = clk_register_mux(NULL, "clcd_pixel_mclk", clcd_pixel_parents,
                        ARRAY_SIZE(clcd_pixel_parents), 0,
                        SPEAR1340_PERIP_CLK_CFG, SPEAR1340_CLCD_CLK_SHIFT,
                        SPEAR1340_CLCD_CLK_MASK, 0, &_lock);
        clk_register_clkdev(clk, "clcd_pixel_clk", NULL);
-        clk = clk_register_gate(NULL, "clcd_clk", "clcd_pixel_mux_clk", 0,
+        clk = clk_register_gate(NULL, "clcd_clk", "clcd_pixel_mclk", 0,
                        SPEAR1340_PERIP1_CLK_ENB, SPEAR1340_CLCD_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, "clcd_clk", NULL);
        /* i2s */
-        clk = clk_register_mux(NULL, "i2s_src_mux_clk", i2s_src_parents,
+        clk = clk_register_mux(NULL, "i2s_src_mclk", i2s_src_parents,
                        ARRAY_SIZE(i2s_src_parents), 0, SPEAR1340_I2S_CLK_CFG,
                        SPEAR1340_I2S_SRC_CLK_SHIFT, SPEAR1340_I2S_SRC_CLK_MASK,
                        0, &_lock);
        clk_register_clkdev(clk, "i2s_src_clk", NULL);
-        clk = clk_register_aux("i2s_prs1_clk", NULL, "i2s_src_mux_clk", 0,
+        clk = clk_register_aux("i2s_prs1_clk", NULL, "i2s_src_mclk", 0,
                        SPEAR1340_I2S_CLK_CFG, &i2s_prs1_masks, i2s_prs1_rtbl,
                        ARRAY_SIZE(i2s_prs1_rtbl), &_lock, NULL);
        clk_register_clkdev(clk, "i2s_prs1_clk", NULL);
-        clk = clk_register_mux(NULL, "i2s_ref_mux_clk", i2s_ref_parents,
+        clk = clk_register_mux(NULL, "i2s_ref_mclk", i2s_ref_parents,
                        ARRAY_SIZE(i2s_ref_parents), 0, SPEAR1340_I2S_CLK_CFG,
                        SPEAR1340_I2S_REF_SHIFT, SPEAR1340_I2S_REF_SEL_MASK, 0,
                        &_lock);
        clk_register_clkdev(clk, "i2s_ref_clk", NULL);
-        clk = clk_register_gate(NULL, "i2s_ref_pad_clk", "i2s_ref_mux_clk", 0,
+        clk = clk_register_gate(NULL, "i2s_ref_pad_clk", "i2s_ref_mclk", 0,
                        SPEAR1340_PERIP2_CLK_ENB, SPEAR1340_I2S_REF_PAD_CLK_ENB,
                        0, &_lock);
        clk_register_clkdev(clk, "i2s_ref_pad_clk", NULL);
-        clk = clk_register_aux("i2s_sclk_clk", "i2s_sclk_gate_clk",
+        clk = clk_register_aux("i2s_sclk_clk", "i2s_sclk_gclk", "i2s_ref_mclk",
-                        "i2s_ref_mux_clk", 0, SPEAR1340_I2S_CLK_CFG,
+                        0, SPEAR1340_I2S_CLK_CFG, &i2s_sclk_masks,
-                        &i2s_sclk_masks, i2s_sclk_rtbl,
+                        i2s_sclk_rtbl, ARRAY_SIZE(i2s_sclk_rtbl), &_lock,
-                        ARRAY_SIZE(i2s_sclk_rtbl), &_lock, &clk1);
+                        &clk1);
        clk_register_clkdev(clk, "i2s_sclk_clk", NULL);
-        clk_register_clkdev(clk1, "i2s_sclk_gate_clk", NULL);
+        clk_register_clkdev(clk1, "i2s_sclk_gclk", NULL);
        /* clock derived from ahb clk */
        clk = clk_register_gate(NULL, "i2c0_clk", "ahb_clk", 0,
@@ -744,7 +741,7 @@ void __init spear1340_clk_init(void)
        clk_register_clkdev(clk, NULL, "e0280000.i2c");
        clk = clk_register_gate(NULL, "i2c1_clk", "ahb_clk", 0,
-                        SPEAR1340_PERIP1_CLK_ENB, SPEAR1340_I2C1_CLK_ENB, 0,
+                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_I2C1_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "b4000000.i2c");
@@ -800,13 +797,13 @@ void __init spear1340_clk_init(void)
                        &_lock);
        clk_register_clkdev(clk, "sysram1_clk", NULL);
-        clk = clk_register_aux("adc_synth_clk", "adc_synth_gate_clk", "ahb_clk",
+        clk = clk_register_aux("adc_syn_clk", "adc_syn_gclk", "ahb_clk",
                        0, SPEAR1340_ADC_CLK_SYNT, NULL, adc_rtbl,
                        ARRAY_SIZE(adc_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "adc_synth_clk", NULL);
+        clk_register_clkdev(clk, "adc_syn_clk", NULL);
-        clk_register_clkdev(clk1, "adc_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "adc_syn_gclk", NULL);
-        clk = clk_register_gate(NULL, "adc_clk", "adc_synth_gate_clk", 0,
+        clk = clk_register_gate(NULL, "adc_clk", "adc_syn_gclk", 0,
                        SPEAR1340_PERIP1_CLK_ENB, SPEAR1340_ADC_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "adc_clk");
@@ -843,39 +840,39 @@ void __init spear1340_clk_init(void)
        clk_register_clkdev(clk, NULL, "e0300000.kbd");
        /* RAS clks */
-        clk = clk_register_mux(NULL, "gen_synth0_1_mux_clk",
+        clk = clk_register_mux(NULL, "gen_syn0_1_mclk", gen_synth0_1_parents,
-                        gen_synth0_1_parents, ARRAY_SIZE(gen_synth0_1_parents),
+                        ARRAY_SIZE(gen_synth0_1_parents), 0, SPEAR1340_PLL_CFG,
-                        0, SPEAR1340_PLL_CFG, SPEAR1340_GEN_SYNT0_1_CLK_SHIFT,
+                        SPEAR1340_GEN_SYNT0_1_CLK_SHIFT,
                        SPEAR1340_GEN_SYNT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "gen_synth0_1_clk", NULL);
+        clk_register_clkdev(clk, "gen_syn0_1_clk", NULL);
-        clk = clk_register_mux(NULL, "gen_synth2_3_mux_clk",
+        clk = clk_register_mux(NULL, "gen_syn2_3_mclk", gen_synth2_3_parents,
-                        gen_synth2_3_parents, ARRAY_SIZE(gen_synth2_3_parents),
+                        ARRAY_SIZE(gen_synth2_3_parents), 0, SPEAR1340_PLL_CFG,
-                        0, SPEAR1340_PLL_CFG, SPEAR1340_GEN_SYNT2_3_CLK_SHIFT,
+                        SPEAR1340_GEN_SYNT2_3_CLK_SHIFT,
                        SPEAR1340_GEN_SYNT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "gen_synth2_3_clk", NULL);
+        clk_register_clkdev(clk, "gen_syn2_3_clk", NULL);
-        clk = clk_register_frac("gen_synth0_clk", "gen_synth0_1_clk", 0,
+        clk = clk_register_frac("gen_syn0_clk", "gen_syn0_1_clk", 0,
                        SPEAR1340_GEN_CLK_SYNT0, gen_rtbl, ARRAY_SIZE(gen_rtbl),
                        &_lock);
-        clk_register_clkdev(clk, "gen_synth0_clk", NULL);
+        clk_register_clkdev(clk, "gen_syn0_clk", NULL);
-        clk = clk_register_frac("gen_synth1_clk", "gen_synth0_1_clk", 0,
+        clk = clk_register_frac("gen_syn1_clk", "gen_syn0_1_clk", 0,
                        SPEAR1340_GEN_CLK_SYNT1, gen_rtbl, ARRAY_SIZE(gen_rtbl),
                        &_lock);
-        clk_register_clkdev(clk, "gen_synth1_clk", NULL);
+        clk_register_clkdev(clk, "gen_syn1_clk", NULL);
-        clk = clk_register_frac("gen_synth2_clk", "gen_synth2_3_clk", 0,
+        clk = clk_register_frac("gen_syn2_clk", "gen_syn2_3_clk", 0,
                        SPEAR1340_GEN_CLK_SYNT2, gen_rtbl, ARRAY_SIZE(gen_rtbl),
                        &_lock);
-        clk_register_clkdev(clk, "gen_synth2_clk", NULL);
+        clk_register_clkdev(clk, "gen_syn2_clk", NULL);
-        clk = clk_register_frac("gen_synth3_clk", "gen_synth2_3_clk", 0,
+        clk = clk_register_frac("gen_syn3_clk", "gen_syn2_3_clk", 0,
                        SPEAR1340_GEN_CLK_SYNT3, gen_rtbl, ARRAY_SIZE(gen_rtbl),
                        &_lock);
-        clk_register_clkdev(clk, "gen_synth3_clk", NULL);
+        clk_register_clkdev(clk, "gen_syn3_clk", NULL);
-        clk = clk_register_gate(NULL, "mali_clk", "gen_synth3_clk", 0,
+        clk = clk_register_gate(NULL, "mali_clk", "gen_syn3_clk", 0,
                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_MALI_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "mali");
@@ -890,74 +887,74 @@ void __init spear1340_clk_init(void)
                        &_lock);
        clk_register_clkdev(clk, NULL, "spear_cec.1");
-        clk = clk_register_mux(NULL, "spdif_out_mux_clk", spdif_out_parents,
+        clk = clk_register_mux(NULL, "spdif_out_mclk", spdif_out_parents,
                        ARRAY_SIZE(spdif_out_parents), 0,
                        SPEAR1340_PERIP_CLK_CFG, SPEAR1340_SPDIF_OUT_CLK_SHIFT,
                        SPEAR1340_SPDIF_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "spdif_out_mux_clk", NULL);
+        clk_register_clkdev(clk, "spdif_out_mclk", NULL);
-        clk = clk_register_gate(NULL, "spdif_out_clk", "spdif_out_mux_clk", 0,
+        clk = clk_register_gate(NULL, "spdif_out_clk", "spdif_out_mclk", 0,
                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_SPDIF_OUT_CLK_ENB,
                        0, &_lock);
        clk_register_clkdev(clk, NULL, "spdif-out");
-        clk = clk_register_mux(NULL, "spdif_in_mux_clk", spdif_in_parents,
+        clk = clk_register_mux(NULL, "spdif_in_mclk", spdif_in_parents,
                        ARRAY_SIZE(spdif_in_parents), 0,
                        SPEAR1340_PERIP_CLK_CFG, SPEAR1340_SPDIF_IN_CLK_SHIFT,
                        SPEAR1340_SPDIF_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "spdif_in_mux_clk", NULL);
+        clk_register_clkdev(clk, "spdif_in_mclk", NULL);
-        clk = clk_register_gate(NULL, "spdif_in_clk", "spdif_in_mux_clk", 0,
+        clk = clk_register_gate(NULL, "spdif_in_clk", "spdif_in_mclk", 0,
                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_SPDIF_IN_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "spdif-in");
-        clk = clk_register_gate(NULL, "acp_clk", "acp_mux_clk", 0,
+        clk = clk_register_gate(NULL, "acp_clk", "acp_mclk", 0,
                        SPEAR1340_PERIP2_CLK_ENB, SPEAR1340_ACP_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "acp_clk");
-        clk = clk_register_gate(NULL, "plgpio_clk", "plgpio_mux_clk", 0,
+        clk = clk_register_gate(NULL, "plgpio_clk", "plgpio_mclk", 0,
                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_PLGPIO_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "plgpio");
-        clk = clk_register_gate(NULL, "video_dec_clk", "video_dec_mux_clk", 0,
+        clk = clk_register_gate(NULL, "video_dec_clk", "video_dec_mclk", 0,
                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_VIDEO_DEC_CLK_ENB,
                        0, &_lock);
        clk_register_clkdev(clk, NULL, "video_dec");
-        clk = clk_register_gate(NULL, "video_enc_clk", "video_enc_mux_clk", 0,
+        clk = clk_register_gate(NULL, "video_enc_clk", "video_enc_mclk", 0,
                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_VIDEO_ENC_CLK_ENB,
                        0, &_lock);
        clk_register_clkdev(clk, NULL, "video_enc");
-        clk = clk_register_gate(NULL, "video_in_clk", "video_in_mux_clk", 0,
+        clk = clk_register_gate(NULL, "video_in_clk", "video_in_mclk", 0,
                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_VIDEO_IN_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "spear_vip");
-        clk = clk_register_gate(NULL, "cam0_clk", "cam0_mux_clk", 0,
+        clk = clk_register_gate(NULL, "cam0_clk", "cam0_mclk", 0,
                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_CAM0_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "spear_camif.0");
-        clk = clk_register_gate(NULL, "cam1_clk", "cam1_mux_clk", 0,
+        clk = clk_register_gate(NULL, "cam1_clk", "cam1_mclk", 0,
                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_CAM1_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "spear_camif.1");
-        clk = clk_register_gate(NULL, "cam2_clk", "cam2_mux_clk", 0,
+        clk = clk_register_gate(NULL, "cam2_clk", "cam2_mclk", 0,
                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_CAM2_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "spear_camif.2");
-        clk = clk_register_gate(NULL, "cam3_clk", "cam3_mux_clk", 0,
+        clk = clk_register_gate(NULL, "cam3_clk", "cam3_mclk", 0,
                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_CAM3_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "spear_camif.3");
-        clk = clk_register_gate(NULL, "pwm_clk", "pwm_mux_clk", 0,
+        clk = clk_register_gate(NULL, "pwm_clk", "pwm_mclk", 0,
                        SPEAR1340_PERIP3_CLK_ENB, SPEAR1340_PWM_CLK_ENB, 0,
                        &_lock);
        clk_register_clkdev(clk, NULL, "pwm");
diff --git a/drivers/clk/spear/spear3xx_clock.c b/drivers/clk/spear/spear3xx_clock.c
index 01dd6daff2a1..c3157454bb3f 100644
--- a/drivers/clk/spear/spear3xx_clock.c
+++ b/drivers/clk/spear/spear3xx_clock.c
@@ -122,12 +122,12 @@ static struct gpt_rate_tbl gpt_rtbl[] = {
 };
 /* clock parents */
-static const char *uart0_parents[] = { "pll3_48m_clk", "uart_synth_gate_clk", };
+static const char *uart0_parents[] = { "pll3_clk", "uart_syn_gclk", };
-static const char *firda_parents[] = { "pll3_48m_clk", "firda_synth_gate_clk",
+static const char *firda_parents[] = { "pll3_clk", "firda_syn_gclk",
 };
-static const char *gpt0_parents[] = { "pll3_48m_clk", "gpt0_synth_clk", };
+static const char *gpt0_parents[] = { "pll3_clk", "gpt0_syn_clk", };
-static const char *gpt1_parents[] = { "pll3_48m_clk", "gpt1_synth_clk", };
+static const char *gpt1_parents[] = { "pll3_clk", "gpt1_syn_clk", };
-static const char *gpt2_parents[] = { "pll3_48m_clk", "gpt2_synth_clk", };
+static const char *gpt2_parents[] = { "pll3_clk", "gpt2_syn_clk", };
 static const char *gen2_3_parents[] = { "pll1_clk", "pll2_clk", };
 static const char *ddr_parents[] = { "ahb_clk", "ahbmult2_clk", "none",
        "pll2_clk", };
@@ -137,7 +137,7 @@ static void __init spear300_clk_init(void)
 {
        struct clk *clk;
-        clk = clk_register_fixed_factor(NULL, "clcd_clk", "ras_pll3_48m_clk", 0,
+        clk = clk_register_fixed_factor(NULL, "clcd_clk", "ras_pll3_clk", 0,
                        1, 1);
        clk_register_clkdev(clk, NULL, "60000000.clcd");
@@ -219,15 +219,11 @@ static void __init spear310_clk_init(void)
        #define SPEAR320_UARTX_PCLK_VAL_SYNTH1          0x0
        #define SPEAR320_UARTX_PCLK_VAL_APB             0x1
-static const char *i2s_ref_parents[] = { "ras_pll2_clk",
+static const char *i2s_ref_parents[] = { "ras_pll2_clk", "ras_syn2_gclk", };
-        "ras_gen2_synth_gate_clk", };
+static const char *sdhci_parents[] = { "ras_pll3_clk", "ras_syn3_gclk", };
-static const char *sdhci_parents[] = { "ras_pll3_48m_clk",
-        "ras_gen3_synth_gate_clk",
-};
 static const char *smii0_parents[] = { "smii_125m_pad", "ras_pll2_clk",
-        "ras_gen0_synth_gate_clk", };
+        "ras_syn0_gclk", };
-static const char *uartx_parents[] = { "ras_gen1_synth_gate_clk", "ras_apb_clk",
+static const char *uartx_parents[] = { "ras_syn1_gclk", "ras_apb_clk", };
-};
 static void __init spear320_clk_init(void)
 {
@@ -237,7 +233,7 @@ static void __init spear320_clk_init(void)
                        CLK_IS_ROOT, 125000000);
        clk_register_clkdev(clk, "smii_125m_pad", NULL);
-        clk = clk_register_fixed_factor(NULL, "clcd_clk", "ras_pll3_48m_clk", 0,
+        clk = clk_register_fixed_factor(NULL, "clcd_clk", "ras_pll3_clk", 0,
                        1, 1);
        clk_register_clkdev(clk, NULL, "90000000.clcd");
@@ -363,9 +359,9 @@ void __init spear3xx_clk_init(void)
        clk_register_clkdev(clk, NULL, "fc900000.rtc");
        /* clock derived from 24 MHz osc clk */
-        clk = clk_register_fixed_rate(NULL, "pll3_48m_clk", "osc_24m_clk", 0,
+        clk = clk_register_fixed_rate(NULL, "pll3_clk", "osc_24m_clk", 0,
                        48000000);
-        clk_register_clkdev(clk, "pll3_48m_clk", NULL);
+        clk_register_clkdev(clk, "pll3_clk", NULL);
        clk = clk_register_fixed_factor(NULL, "wdt_clk", "osc_24m_clk", 0, 1,
                        1);
@@ -392,98 +388,98 @@ void __init spear3xx_clk_init(void)
                        HCLK_RATIO_MASK, 0, &_lock);
        clk_register_clkdev(clk, "ahb_clk", NULL);
-        clk = clk_register_aux("uart_synth_clk", "uart_synth_gate_clk",
+        clk = clk_register_aux("uart_syn_clk", "uart_syn_gclk", "pll1_clk", 0,
-                        "pll1_clk", 0, UART_CLK_SYNT, NULL, aux_rtbl,
+                        UART_CLK_SYNT, NULL, aux_rtbl, ARRAY_SIZE(aux_rtbl),
-                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
+                        &_lock, &clk1);
-        clk_register_clkdev(clk, "uart_synth_clk", NULL);
+        clk_register_clkdev(clk, "uart_syn_clk", NULL);
-        clk_register_clkdev(clk1, "uart_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "uart_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "uart0_mux_clk", uart0_parents,
+        clk = clk_register_mux(NULL, "uart0_mclk", uart0_parents,
                        ARRAY_SIZE(uart0_parents), 0, PERIP_CLK_CFG,
                        UART_CLK_SHIFT, UART_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "uart0_mux_clk", NULL);
+        clk_register_clkdev(clk, "uart0_mclk", NULL);
-        clk = clk_register_gate(NULL, "uart0", "uart0_mux_clk", 0,
+        clk = clk_register_gate(NULL, "uart0", "uart0_mclk", 0, PERIP1_CLK_ENB,
-                        PERIP1_CLK_ENB, UART_CLK_ENB, 0, &_lock);
+                        UART_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "d0000000.serial");
-        clk = clk_register_aux("firda_synth_clk", "firda_synth_gate_clk",
+        clk = clk_register_aux("firda_syn_clk", "firda_syn_gclk", "pll1_clk", 0,
-                        "pll1_clk", 0, FIRDA_CLK_SYNT, NULL, aux_rtbl,
+                        FIRDA_CLK_SYNT, NULL, aux_rtbl, ARRAY_SIZE(aux_rtbl),
-                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
+                        &_lock, &clk1);
-        clk_register_clkdev(clk, "firda_synth_clk", NULL);
+        clk_register_clkdev(clk, "firda_syn_clk", NULL);
-        clk_register_clkdev(clk1, "firda_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "firda_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "firda_mux_clk", firda_parents,
+        clk = clk_register_mux(NULL, "firda_mclk", firda_parents,
                        ARRAY_SIZE(firda_parents), 0, PERIP_CLK_CFG,
                        FIRDA_CLK_SHIFT, FIRDA_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "firda_mux_clk", NULL);
+        clk_register_clkdev(clk, "firda_mclk", NULL);
-        clk = clk_register_gate(NULL, "firda_clk", "firda_mux_clk", 0,
+        clk = clk_register_gate(NULL, "firda_clk", "firda_mclk", 0,
                        PERIP1_CLK_ENB, FIRDA_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "firda");
        /* gpt clocks */
-        clk_register_gpt("gpt0_synth_clk", "pll1_clk", 0, PRSC0_CLK_CFG,
+        clk_register_gpt("gpt0_syn_clk", "pll1_clk", 0, PRSC0_CLK_CFG, gpt_rtbl,
-                        gpt_rtbl, ARRAY_SIZE(gpt_rtbl), &_lock);
+                        ARRAY_SIZE(gpt_rtbl), &_lock);
        clk = clk_register_mux(NULL, "gpt0_clk", gpt0_parents,
                        ARRAY_SIZE(gpt0_parents), 0, PERIP_CLK_CFG,
                        GPT0_CLK_SHIFT, GPT_CLK_MASK, 0, &_lock);
        clk_register_clkdev(clk, NULL, "gpt0");
-        clk_register_gpt("gpt1_synth_clk", "pll1_clk", 0, PRSC1_CLK_CFG,
+        clk_register_gpt("gpt1_syn_clk", "pll1_clk", 0, PRSC1_CLK_CFG, gpt_rtbl,
-                        gpt_rtbl, ARRAY_SIZE(gpt_rtbl), &_lock);
+                        ARRAY_SIZE(gpt_rtbl), &_lock);
-        clk = clk_register_mux(NULL, "gpt1_mux_clk", gpt1_parents,
+        clk = clk_register_mux(NULL, "gpt1_mclk", gpt1_parents,
                        ARRAY_SIZE(gpt1_parents), 0, PERIP_CLK_CFG,
                        GPT1_CLK_SHIFT, GPT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "gpt1_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt1_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt1_clk", "gpt1_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt1_clk", "gpt1_mclk", 0,
                        PERIP1_CLK_ENB, GPT1_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "gpt1");
-        clk_register_gpt("gpt2_synth_clk", "pll1_clk", 0, PRSC2_CLK_CFG,
+        clk_register_gpt("gpt2_syn_clk", "pll1_clk", 0, PRSC2_CLK_CFG, gpt_rtbl,
-                        gpt_rtbl, ARRAY_SIZE(gpt_rtbl), &_lock);
+                        ARRAY_SIZE(gpt_rtbl), &_lock);
-        clk = clk_register_mux(NULL, "gpt2_mux_clk", gpt2_parents,
+        clk = clk_register_mux(NULL, "gpt2_mclk", gpt2_parents,
                        ARRAY_SIZE(gpt2_parents), 0, PERIP_CLK_CFG,
                        GPT2_CLK_SHIFT, GPT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "gpt2_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt2_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt2_clk", "gpt2_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt2_clk", "gpt2_mclk", 0,
                        PERIP1_CLK_ENB, GPT2_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "gpt2");
        /* general synths clocks */
-        clk = clk_register_aux("gen0_synth_clk", "gen0_synth_gate_clk",
+        clk = clk_register_aux("gen0_syn_clk", "gen0_syn_gclk", "pll1_clk",
-                        "pll1_clk", 0, GEN0_CLK_SYNT, NULL, aux_rtbl,
+                        0, GEN0_CLK_SYNT, NULL, aux_rtbl, ARRAY_SIZE(aux_rtbl),
-                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
+                        &_lock, &clk1);
-        clk_register_clkdev(clk, "gen0_synth_clk", NULL);
+        clk_register_clkdev(clk, "gen0_syn_clk", NULL);
-        clk_register_clkdev(clk1, "gen0_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "gen0_syn_gclk", NULL);
-        clk = clk_register_aux("gen1_synth_clk", "gen1_synth_gate_clk",
+        clk = clk_register_aux("gen1_syn_clk", "gen1_syn_gclk", "pll1_clk",
-                        "pll1_clk", 0, GEN1_CLK_SYNT, NULL, aux_rtbl,
+                        0, GEN1_CLK_SYNT, NULL, aux_rtbl, ARRAY_SIZE(aux_rtbl),
-                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
+                        &_lock, &clk1);
-        clk_register_clkdev(clk, "gen1_synth_clk", NULL);
+        clk_register_clkdev(clk, "gen1_syn_clk", NULL);
-        clk_register_clkdev(clk1, "gen1_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "gen1_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "gen2_3_parent_clk", gen2_3_parents,
+        clk = clk_register_mux(NULL, "gen2_3_par_clk", gen2_3_parents,
                        ARRAY_SIZE(gen2_3_parents), 0, CORE_CLK_CFG,
                        GEN_SYNTH2_3_CLK_SHIFT, GEN_SYNTH2_3_CLK_MASK, 0,
                        &_lock);
-        clk_register_clkdev(clk, "gen2_3_parent_clk", NULL);
+        clk_register_clkdev(clk, "gen2_3_par_clk", NULL);
-        clk = clk_register_aux("gen2_synth_clk", "gen2_synth_gate_clk",
+        clk = clk_register_aux("gen2_syn_clk", "gen2_syn_gclk",
-                        "gen2_3_parent_clk", 0, GEN2_CLK_SYNT, NULL, aux_rtbl,
+                        "gen2_3_par_clk", 0, GEN2_CLK_SYNT, NULL, aux_rtbl,
                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "gen2_synth_clk", NULL);
+        clk_register_clkdev(clk, "gen2_syn_clk", NULL);
-        clk_register_clkdev(clk1, "gen2_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "gen2_syn_gclk", NULL);
-        clk = clk_register_aux("gen3_synth_clk", "gen3_synth_gate_clk",
+        clk = clk_register_aux("gen3_syn_clk", "gen3_syn_gclk",
-                        "gen2_3_parent_clk", 0, GEN3_CLK_SYNT, NULL, aux_rtbl,
+                        "gen2_3_par_clk", 0, GEN3_CLK_SYNT, NULL, aux_rtbl,
                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
-        clk_register_clkdev(clk, "gen3_synth_clk", NULL);
+        clk_register_clkdev(clk, "gen3_syn_clk", NULL);
-        clk_register_clkdev(clk1, "gen3_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "gen3_syn_gclk", NULL);
        /* clock derived from pll3 clk */
-        clk = clk_register_gate(NULL, "usbh_clk", "pll3_48m_clk", 0,
+        clk = clk_register_gate(NULL, "usbh_clk", "pll3_clk", 0, PERIP1_CLK_ENB,
-                        PERIP1_CLK_ENB, USBH_CLK_ENB, 0, &_lock);
+                        USBH_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, "usbh_clk", NULL);
        clk = clk_register_fixed_factor(NULL, "usbh.0_clk", "usbh_clk", 0, 1,
@@ -494,8 +490,8 @@ void __init spear3xx_clk_init(void)
                        1);
        clk_register_clkdev(clk, "usbh.1_clk", NULL);
-        clk = clk_register_gate(NULL, "usbd_clk", "pll3_48m_clk", 0,
+        clk = clk_register_gate(NULL, "usbd_clk", "pll3_clk", 0, PERIP1_CLK_ENB,
-                        PERIP1_CLK_ENB, USBD_CLK_ENB, 0, &_lock);
+                        USBD_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "designware_udc");
        /* clock derived from ahb clk */
@@ -579,29 +575,25 @@ void __init spear3xx_clk_init(void)
                        RAS_CLK_ENB, RAS_PLL2_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, "ras_pll2_clk", NULL);
-        clk = clk_register_gate(NULL, "ras_pll3_48m_clk", "pll3_48m_clk", 0,
+        clk = clk_register_gate(NULL, "ras_pll3_clk", "pll3_clk", 0,
                        RAS_CLK_ENB, RAS_48M_CLK_ENB, 0, &_lock);
-        clk_register_clkdev(clk, "ras_pll3_48m_clk", NULL);
+        clk_register_clkdev(clk, "ras_pll3_clk", NULL);
-        clk = clk_register_gate(NULL, "ras_gen0_synth_gate_clk",
+        clk = clk_register_gate(NULL, "ras_syn0_gclk", "gen0_syn_gclk", 0,
-                        "gen0_synth_gate_clk", 0, RAS_CLK_ENB,
+                        RAS_CLK_ENB, RAS_SYNT0_CLK_ENB, 0, &_lock);
-                        RAS_SYNT0_CLK_ENB, 0, &_lock);
+        clk_register_clkdev(clk, "ras_syn0_gclk", NULL);
-        clk_register_clkdev(clk, "ras_gen0_synth_gate_clk", NULL);
+        clk = clk_register_gate(NULL, "ras_syn1_gclk", "gen1_syn_gclk", 0,
-        clk = clk_register_gate(NULL, "ras_gen1_synth_gate_clk",
+                        RAS_CLK_ENB, RAS_SYNT1_CLK_ENB, 0, &_lock);
-                        "gen1_synth_gate_clk", 0, RAS_CLK_ENB,
+        clk_register_clkdev(clk, "ras_syn1_gclk", NULL);
-                        RAS_SYNT1_CLK_ENB, 0, &_lock);
-        clk_register_clkdev(clk, "ras_gen1_synth_gate_clk", NULL);
+        clk = clk_register_gate(NULL, "ras_syn2_gclk", "gen2_syn_gclk", 0,
+                        RAS_CLK_ENB, RAS_SYNT2_CLK_ENB, 0, &_lock);
-        clk = clk_register_gate(NULL, "ras_gen2_synth_gate_clk",
+        clk_register_clkdev(clk, "ras_syn2_gclk", NULL);
-                        "gen2_synth_gate_clk", 0, RAS_CLK_ENB,
-                        RAS_SYNT2_CLK_ENB, 0, &_lock);
+        clk = clk_register_gate(NULL, "ras_syn3_gclk", "gen3_syn_gclk", 0,
-        clk_register_clkdev(clk, "ras_gen2_synth_gate_clk", NULL);
+                        RAS_CLK_ENB, RAS_SYNT3_CLK_ENB, 0, &_lock);
+        clk_register_clkdev(clk, "ras_syn3_gclk", NULL);
-        clk = clk_register_gate(NULL, "ras_gen3_synth_gate_clk",
-                        "gen3_synth_gate_clk", 0, RAS_CLK_ENB,
-                        RAS_SYNT3_CLK_ENB, 0, &_lock);
-        clk_register_clkdev(clk, "ras_gen3_synth_gate_clk", NULL);
        if (of_machine_is_compatible("st,spear300"))
                spear300_clk_init();
diff --git a/drivers/clk/spear/spear6xx_clock.c b/drivers/clk/spear/spear6xx_clock.c
index 554d64b062a1..a98d0866f541 100644
--- a/drivers/clk/spear/spear6xx_clock.c
+++ b/drivers/clk/spear/spear6xx_clock.c
@@ -97,13 +97,12 @@ static struct aux_rate_tbl aux_rtbl[] = {
        {.xscale = 1, .yscale = 2, .eq = 1}, /* 166 MHz */
 };
-static const char *clcd_parents[] = { "pll3_48m_clk", "clcd_synth_gate_clk", };
+static const char *clcd_parents[] = { "pll3_clk", "clcd_syn_gclk", };
-static const char *firda_parents[] = { "pll3_48m_clk", "firda_synth_gate_clk",
+static const char *firda_parents[] = { "pll3_clk", "firda_syn_gclk", };
-};
+static const char *uart_parents[] = { "pll3_clk", "uart_syn_gclk", };
-static const char *uart_parents[] = { "pll3_48m_clk", "uart_synth_gate_clk", };
+static const char *gpt0_1_parents[] = { "pll3_clk", "gpt0_1_syn_clk", };
-static const char *gpt0_1_parents[] = { "pll3_48m_clk", "gpt0_1_synth_clk", };
+static const char *gpt2_parents[] = { "pll3_clk", "gpt2_syn_clk", };
-static const char *gpt2_parents[] = { "pll3_48m_clk", "gpt2_synth_clk", };
+static const char *gpt3_parents[] = { "pll3_clk", "gpt3_syn_clk", };
-static const char *gpt3_parents[] = { "pll3_48m_clk", "gpt3_synth_clk", };
 static const char *ddr_parents[] = { "ahb_clk", "ahbmult2_clk", "none",
        "pll2_clk", };
@@ -136,9 +135,9 @@ void __init spear6xx_clk_init(void)
        clk_register_clkdev(clk, NULL, "rtc-spear");
        /* clock derived from 30 MHz osc clk */
-        clk = clk_register_fixed_rate(NULL, "pll3_48m_clk", "osc_24m_clk", 0,
+        clk = clk_register_fixed_rate(NULL, "pll3_clk", "osc_24m_clk", 0,
                        48000000);
-        clk_register_clkdev(clk, "pll3_48m_clk", NULL);
+        clk_register_clkdev(clk, "pll3_clk", NULL);
        clk = clk_register_vco_pll("vco1_clk", "pll1_clk", NULL, "osc_30m_clk",
                        0, PLL1_CTR, PLL1_FRQ, pll_rtbl, ARRAY_SIZE(pll_rtbl),
@@ -146,9 +145,9 @@ void __init spear6xx_clk_init(void)
        clk_register_clkdev(clk, "vco1_clk", NULL);
        clk_register_clkdev(clk1, "pll1_clk", NULL);
-        clk = clk_register_vco_pll("vco2_clk", "pll2_clk", NULL,
+        clk = clk_register_vco_pll("vco2_clk", "pll2_clk", NULL, "osc_30m_clk",
-                        "osc_30m_clk", 0, PLL2_CTR, PLL2_FRQ, pll_rtbl,
+                        0, PLL2_CTR, PLL2_FRQ, pll_rtbl, ARRAY_SIZE(pll_rtbl),
-                        ARRAY_SIZE(pll_rtbl), &_lock, &clk1, NULL);
+                        &_lock, &clk1, NULL);
        clk_register_clkdev(clk, "vco2_clk", NULL);
        clk_register_clkdev(clk1, "pll2_clk", NULL);
@@ -165,111 +164,111 @@ void __init spear6xx_clk_init(void)
                        HCLK_RATIO_MASK, 0, &_lock);
        clk_register_clkdev(clk, "ahb_clk", NULL);
-        clk = clk_register_aux("uart_synth_clk", "uart_synth_gate_clk",
+        clk = clk_register_aux("uart_syn_clk", "uart_syn_gclk", "pll1_clk", 0,
-                        "pll1_clk", 0, UART_CLK_SYNT, NULL, aux_rtbl,
+                        UART_CLK_SYNT, NULL, aux_rtbl, ARRAY_SIZE(aux_rtbl),
-                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
+                        &_lock, &clk1);
-        clk_register_clkdev(clk, "uart_synth_clk", NULL);
+        clk_register_clkdev(clk, "uart_syn_clk", NULL);
-        clk_register_clkdev(clk1, "uart_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "uart_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "uart_mux_clk", uart_parents,
+        clk = clk_register_mux(NULL, "uart_mclk", uart_parents,
                        ARRAY_SIZE(uart_parents), 0, PERIP_CLK_CFG,
                        UART_CLK_SHIFT, UART_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "uart_mux_clk", NULL);
+        clk_register_clkdev(clk, "uart_mclk", NULL);
-        clk = clk_register_gate(NULL, "uart0", "uart_mux_clk", 0,
+        clk = clk_register_gate(NULL, "uart0", "uart_mclk", 0, PERIP1_CLK_ENB,
-                        PERIP1_CLK_ENB, UART0_CLK_ENB, 0, &_lock);
+                        UART0_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "d0000000.serial");
-        clk = clk_register_gate(NULL, "uart1", "uart_mux_clk", 0,
+        clk = clk_register_gate(NULL, "uart1", "uart_mclk", 0, PERIP1_CLK_ENB,
-                        PERIP1_CLK_ENB, UART1_CLK_ENB, 0, &_lock);
+                        UART1_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "d0080000.serial");
-        clk = clk_register_aux("firda_synth_clk", "firda_synth_gate_clk",
+        clk = clk_register_aux("firda_syn_clk", "firda_syn_gclk", "pll1_clk",
-                        "pll1_clk", 0, FIRDA_CLK_SYNT, NULL, aux_rtbl,
+                        0, FIRDA_CLK_SYNT, NULL, aux_rtbl, ARRAY_SIZE(aux_rtbl),
-                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
+                        &_lock, &clk1);
-        clk_register_clkdev(clk, "firda_synth_clk", NULL);
+        clk_register_clkdev(clk, "firda_syn_clk", NULL);
-        clk_register_clkdev(clk1, "firda_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "firda_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "firda_mux_clk", firda_parents,
+        clk = clk_register_mux(NULL, "firda_mclk", firda_parents,
                        ARRAY_SIZE(firda_parents), 0, PERIP_CLK_CFG,
                        FIRDA_CLK_SHIFT, FIRDA_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "firda_mux_clk", NULL);
+        clk_register_clkdev(clk, "firda_mclk", NULL);
-        clk = clk_register_gate(NULL, "firda_clk", "firda_mux_clk", 0,
+        clk = clk_register_gate(NULL, "firda_clk", "firda_mclk", 0,
                        PERIP1_CLK_ENB, FIRDA_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "firda");
-        clk = clk_register_aux("clcd_synth_clk", "clcd_synth_gate_clk",
+        clk = clk_register_aux("clcd_syn_clk", "clcd_syn_gclk", "pll1_clk",
-                        "pll1_clk", 0, CLCD_CLK_SYNT, NULL, aux_rtbl,
+                        0, CLCD_CLK_SYNT, NULL, aux_rtbl, ARRAY_SIZE(aux_rtbl),
-                        ARRAY_SIZE(aux_rtbl), &_lock, &clk1);
+                        &_lock, &clk1);
-        clk_register_clkdev(clk, "clcd_synth_clk", NULL);
+        clk_register_clkdev(clk, "clcd_syn_clk", NULL);
-        clk_register_clkdev(clk1, "clcd_synth_gate_clk", NULL);
+        clk_register_clkdev(clk1, "clcd_syn_gclk", NULL);
-        clk = clk_register_mux(NULL, "clcd_mux_clk", clcd_parents,
+        clk = clk_register_mux(NULL, "clcd_mclk", clcd_parents,
                        ARRAY_SIZE(clcd_parents), 0, PERIP_CLK_CFG,
                        CLCD_CLK_SHIFT, CLCD_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "clcd_mux_clk", NULL);
+        clk_register_clkdev(clk, "clcd_mclk", NULL);
-        clk = clk_register_gate(NULL, "clcd_clk", "clcd_mux_clk", 0,
+        clk = clk_register_gate(NULL, "clcd_clk", "clcd_mclk", 0,
                        PERIP1_CLK_ENB, CLCD_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "clcd");
        /* gpt clocks */
-        clk = clk_register_gpt("gpt0_1_synth_clk", "pll1_clk", 0, PRSC0_CLK_CFG,
+        clk = clk_register_gpt("gpt0_1_syn_clk", "pll1_clk", 0, PRSC0_CLK_CFG,
                        gpt_rtbl, ARRAY_SIZE(gpt_rtbl), &_lock);
-        clk_register_clkdev(clk, "gpt0_1_synth_clk", NULL);
+        clk_register_clkdev(clk, "gpt0_1_syn_clk", NULL);
-        clk = clk_register_mux(NULL, "gpt0_mux_clk", gpt0_1_parents,
+        clk = clk_register_mux(NULL, "gpt0_mclk", gpt0_1_parents,
                        ARRAY_SIZE(gpt0_1_parents), 0, PERIP_CLK_CFG,
                        GPT0_CLK_SHIFT, GPT_CLK_MASK, 0, &_lock);
        clk_register_clkdev(clk, NULL, "gpt0");
-        clk = clk_register_mux(NULL, "gpt1_mux_clk", gpt0_1_parents,
+        clk = clk_register_mux(NULL, "gpt1_mclk", gpt0_1_parents,
                        ARRAY_SIZE(gpt0_1_parents), 0, PERIP_CLK_CFG,
                        GPT1_CLK_SHIFT, GPT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "gpt1_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt1_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt1_clk", "gpt1_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt1_clk", "gpt1_mclk", 0,
                        PERIP1_CLK_ENB, GPT1_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "gpt1");
-        clk = clk_register_gpt("gpt2_synth_clk", "pll1_clk", 0, PRSC1_CLK_CFG,
+        clk = clk_register_gpt("gpt2_syn_clk", "pll1_clk", 0, PRSC1_CLK_CFG,
                        gpt_rtbl, ARRAY_SIZE(gpt_rtbl), &_lock);
-        clk_register_clkdev(clk, "gpt2_synth_clk", NULL);
+        clk_register_clkdev(clk, "gpt2_syn_clk", NULL);
-        clk = clk_register_mux(NULL, "gpt2_mux_clk", gpt2_parents,
+        clk = clk_register_mux(NULL, "gpt2_mclk", gpt2_parents,
                        ARRAY_SIZE(gpt2_parents), 0, PERIP_CLK_CFG,
                        GPT2_CLK_SHIFT, GPT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "gpt2_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt2_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt2_clk", "gpt2_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt2_clk", "gpt2_mclk", 0,
                        PERIP1_CLK_ENB, GPT2_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "gpt2");
-        clk = clk_register_gpt("gpt3_synth_clk", "pll1_clk", 0, PRSC2_CLK_CFG,
+        clk = clk_register_gpt("gpt3_syn_clk", "pll1_clk", 0, PRSC2_CLK_CFG,
                        gpt_rtbl, ARRAY_SIZE(gpt_rtbl), &_lock);
-        clk_register_clkdev(clk, "gpt3_synth_clk", NULL);
+        clk_register_clkdev(clk, "gpt3_syn_clk", NULL);
-        clk = clk_register_mux(NULL, "gpt3_mux_clk", gpt3_parents,
+        clk = clk_register_mux(NULL, "gpt3_mclk", gpt3_parents,
                        ARRAY_SIZE(gpt3_parents), 0, PERIP_CLK_CFG,
                        GPT3_CLK_SHIFT, GPT_CLK_MASK, 0, &_lock);
-        clk_register_clkdev(clk, "gpt3_mux_clk", NULL);
+        clk_register_clkdev(clk, "gpt3_mclk", NULL);
-        clk = clk_register_gate(NULL, "gpt3_clk", "gpt3_mux_clk", 0,
+        clk = clk_register_gate(NULL, "gpt3_clk", "gpt3_mclk", 0,
                        PERIP1_CLK_ENB, GPT3_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "gpt3");
        /* clock derived from pll3 clk */
-        clk = clk_register_gate(NULL, "usbh0_clk", "pll3_48m_clk", 0,
+        clk = clk_register_gate(NULL, "usbh0_clk", "pll3_clk", 0,
                        PERIP1_CLK_ENB, USBH0_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "usbh.0_clk");
-        clk = clk_register_gate(NULL, "usbh1_clk", "pll3_48m_clk", 0,
+        clk = clk_register_gate(NULL, "usbh1_clk", "pll3_clk", 0,
                        PERIP1_CLK_ENB, USBH1_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "usbh.1_clk");
-        clk = clk_register_gate(NULL, "usbd_clk", "pll3_48m_clk", 0,
+        clk = clk_register_gate(NULL, "usbd_clk", "pll3_clk", 0, PERIP1_CLK_ENB,
-                        PERIP1_CLK_ENB, USBD_CLK_ENB, 0, &_lock);
+                        USBD_CLK_ENB, 0, &_lock);
        clk_register_clkdev(clk, NULL, "designware_udc");
        /* clock derived from ahb clk */
@@ -278,9 +277,8 @@ void __init spear6xx_clk_init(void)
        clk_register_clkdev(clk, "ahbmult2_clk", NULL);
        clk = clk_register_mux(NULL, "ddr_clk", ddr_parents,
-                        ARRAY_SIZE(ddr_parents),
+                        ARRAY_SIZE(ddr_parents), 0, PLL_CLK_CFG, MCTR_CLK_SHIFT,
-                        0, PLL_CLK_CFG, MCTR_CLK_SHIFT, MCTR_CLK_MASK, 0,
+                        MCTR_CLK_MASK, 0, &_lock);
-                        &_lock);
        clk_register_clkdev(clk, "ddr_clk", NULL);
        clk = clk_register_divider(NULL, "apb_clk", "ahb_clk",
@@ -298,7 +296,7 @@ void __init spear6xx_clk_init(void)
        clk = clk_register_gate(NULL, "gmac_clk", "ahb_clk", 0, PERIP1_CLK_ENB,
                        GMAC_CLK_ENB, 0, &_lock);
-        clk_register_clkdev(clk, NULL, "gmac");
+        clk_register_clkdev(clk, NULL, "e0800000.ethernet");
        clk = clk_register_gate(NULL, "i2c_clk", "ahb_clk", 0, PERIP1_CLK_ENB,
                        I2C_CLK_ENB, 0, &_lock);
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index c4067d0141f7..542f0c04b695 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -136,7 +136,7 @@ config GPIO_MPC8XXX
 config GPIO_MSM_V1
        tristate "Qualcomm MSM GPIO v1"
-        depends on GPIOLIB && ARCH_MSM
+        depends on GPIOLIB && ARCH_MSM && (ARCH_MSM7X00A || ARCH_MSM7X30 || ARCH_QSD8X50)
        help
          Say yes here to support the GPIO interface on ARM v6 based
          Qualcomm MSM chips.  Most of the pins on the MSM can be
diff --git a/drivers/gpio/devres.c b/drivers/gpio/devres.c
index 9e9947cb86a3..1077754f8289 100644
--- a/drivers/gpio/devres.c
+++ b/drivers/gpio/devres.c
@@ -98,6 +98,7 @@ int devm_gpio_request_one(struct device *dev, unsigned gpio,
        return 0;
 }
+EXPORT_SYMBOL(devm_gpio_request_one);
 /**
 *      devm_gpio_free - free an interrupt
diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c
index c337143b18f8..c89c4c1e668d 100644
--- a/drivers/gpio/gpio-mxc.c
+++ b/drivers/gpio/gpio-mxc.c
@@ -398,10 +398,12 @@ static int __devinit mxc_gpio_probe(struct platform_device *pdev)
        writel(~0, port->base + GPIO_ISR);
        if (mxc_gpio_hwtype == IMX21_GPIO) {
-                /* setup one handler for all GPIO interrupts */
+                /*
-                if (pdev->id == 0)
+                 * Setup one handler for all GPIO interrupts. Actually setting
-                        irq_set_chained_handler(port->irq,
+                 * the handler is needed only once, but doing it for every port
-                                                mx2_gpio_irq_handler);
+                 * is more robust and easier.
+                 */
+                irq_set_chained_handler(port->irq, mx2_gpio_irq_handler);
        } else {
                /* setup one handler for each entry */
                irq_set_chained_handler(port->irq, mx3_gpio_irq_handler);
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index c4ed1722734c..4fbc208c32cf 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -174,12 +174,22 @@ static inline void _gpio_dbck_enable(struct gpio_bank *bank)
        if (bank->dbck_enable_mask && !bank->dbck_enabled) {
                clk_enable(bank->dbck);
                bank->dbck_enabled = true;
+                __raw_writel(bank->dbck_enable_mask,
+                             bank->base + bank->regs->debounce_en);
        }
 }
 static inline void _gpio_dbck_disable(struct gpio_bank *bank)
 {
        if (bank->dbck_enable_mask && bank->dbck_enabled) {
+                /*
+                 * Disable debounce before cutting it's clock. If debounce is
+                 * enabled but the clock is not, GPIO module seems to be unable
+                 * to detect events and generate interrupts at least on OMAP3.
+                 */
+                __raw_writel(0, bank->base + bank->regs->debounce_en);
                clk_disable(bank->dbck);
                bank->dbck_enabled = false;
        }
@@ -1081,7 +1091,6 @@ static int __devinit omap_gpio_probe(struct platform_device *pdev)
        bank->is_mpuio = pdata->is_mpuio;
        bank->non_wakeup_gpios = pdata->non_wakeup_gpios;
        bank->loses_context = pdata->loses_context;
-        bank->get_context_loss_count = pdata->get_context_loss_count;
        bank->regs = pdata->regs;
 #ifdef CONFIG_OF_GPIO
        bank->chip.of_node = of_node_get(node);
@@ -1135,6 +1144,9 @@ static int __devinit omap_gpio_probe(struct platform_device *pdev)
        omap_gpio_chip_init(bank);
        omap_gpio_show_rev(bank);
+        if (bank->loses_context)
+                bank->get_context_loss_count = pdata->get_context_loss_count;
        pm_runtime_put(bank->dev);
        list_add_tail(&bank->node, &omap_gpio_list);
diff --git a/drivers/gpio/gpio-sta2x11.c b/drivers/gpio/gpio-sta2x11.c
index 38416be8ba11..6064fb376e11 100644
--- a/drivers/gpio/gpio-sta2x11.c
+++ b/drivers/gpio/gpio-sta2x11.c
@@ -383,8 +383,9 @@ static int __devinit gsta_probe(struct platform_device *dev)
        }
        spin_lock_init(&chip->lock);
        gsta_gpio_setup(chip);
-        for (i = 0; i < GSTA_NR_GPIO; i++)
+        if (gpio_pdata)
-                gsta_set_config(chip, i, gpio_pdata->pinconfig[i]);
+                for (i = 0; i < GSTA_NR_GPIO; i++)
+                        gsta_set_config(chip, i, gpio_pdata->pinconfig[i]);
        /* 384 was used in previous code: be compatible for other drivers */
        err = irq_alloc_descs(-1, 384, GSTA_NR_GPIO, NUMA_NO_NODE);
diff --git a/drivers/gpio/gpio-tps65910.c b/drivers/gpio/gpio-tps65910.c
index c1ad2884f2ed..11f29c82253c 100644
--- a/drivers/gpio/gpio-tps65910.c
+++ b/drivers/gpio/gpio-tps65910.c
@@ -149,6 +149,9 @@ static int __devinit tps65910_gpio_probe(struct platform_device *pdev)
        tps65910_gpio->gpio_chip.set    = tps65910_gpio_set;
        tps65910_gpio->gpio_chip.get    = tps65910_gpio_get;
        tps65910_gpio->gpio_chip.dev = &pdev->dev;
+#ifdef CONFIG_OF_GPIO
+        tps65910_gpio->gpio_chip.of_node = tps65910->dev->of_node;
+#endif
        if (pdata && pdata->gpio_base)
                tps65910_gpio->gpio_chip.base = pdata->gpio_base;
        else
diff --git a/drivers/gpio/gpio-wm8994.c b/drivers/gpio/gpio-wm8994.c
index 92ea5350dfe9..aa61ad2fcaaa 100644
--- a/drivers/gpio/gpio-wm8994.c
+++ b/drivers/gpio/gpio-wm8994.c
@@ -89,8 +89,11 @@ static int wm8994_gpio_direction_out(struct gpio_chip *chip,
        struct wm8994_gpio *wm8994_gpio = to_wm8994_gpio(chip);
        struct wm8994 *wm8994 = wm8994_gpio->wm8994;
+        if (value)
+                value = WM8994_GPN_LVL;
        return wm8994_set_bits(wm8994, WM8994_GPIO_1 + offset,
-                               WM8994_GPN_DIR, 0);
+                               WM8994_GPN_DIR | WM8994_GPN_LVL, value);
 }
 static void wm8994_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 5873e481e5d2..a8743c399e83 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1039,6 +1039,24 @@ mode_in_range(const struct drm_display_mode *mode, struct edid *edid,
        return true;
 }
+static bool valid_inferred_mode(const struct drm_connector *connector,
+                                const struct drm_display_mode *mode)
+{
+        struct drm_display_mode *m;
+        bool ok = false;
+        list_for_each_entry(m, &connector->probed_modes, head) {
+                if (mode->hdisplay == m->hdisplay &&
+                    mode->vdisplay == m->vdisplay &&
+                    drm_mode_vrefresh(mode) == drm_mode_vrefresh(m))
+                        return false; /* duplicated */
+                if (mode->hdisplay <= m->hdisplay &&
+                    mode->vdisplay <= m->vdisplay)
+                        ok = true;
+        }
+        return ok;
+}
 static int
 drm_dmt_modes_for_range(struct drm_connector *connector, struct edid *edid,
                        struct detailed_timing *timing)
@@ -1048,7 +1066,8 @@ drm_dmt_modes_for_range(struct drm_connector *connector, struct edid *edid,
        struct drm_device *dev = connector->dev;
        for (i = 0; i < drm_num_dmt_modes; i++) {
-                if (mode_in_range(drm_dmt_modes + i, edid, timing)) {
+                if (mode_in_range(drm_dmt_modes + i, edid, timing) &&
+                    valid_inferred_mode(connector, drm_dmt_modes + i)) {
                        newmode = drm_mode_duplicate(dev, &drm_dmt_modes[i]);
                        if (newmode) {
                                drm_mode_probed_add(connector, newmode);
@@ -1088,7 +1107,8 @@ drm_gtf_modes_for_range(struct drm_connector *connector, struct edid *edid,
                        return modes;
                fixup_mode_1366x768(newmode);
-                if (!mode_in_range(newmode, edid, timing)) {
+                if (!mode_in_range(newmode, edid, timing) ||
+                    !valid_inferred_mode(connector, newmode)) {
                        drm_mode_destroy(dev, newmode);
                        continue;
                }
@@ -1116,7 +1136,8 @@ drm_cvt_modes_for_range(struct drm_connector *connector, struct edid *edid,
                        return modes;
                fixup_mode_1366x768(newmode);
-                if (!mode_in_range(newmode, edid, timing)) {
+                if (!mode_in_range(newmode, edid, timing) ||
+                    !valid_inferred_mode(connector, newmode)) {
                        drm_mode_destroy(dev, newmode);
                        continue;
                }
diff --git a/drivers/gpu/drm/gma500/cdv_device.c b/drivers/gpu/drm/gma500/cdv_device.c
index 9764045428ce..b7e7b49d8f62 100644
--- a/drivers/gpu/drm/gma500/cdv_device.c
+++ b/drivers/gpu/drm/gma500/cdv_device.c
@@ -78,21 +78,6 @@ static int cdv_backlight_combination_mode(struct drm_device *dev)
        return REG_READ(BLC_PWM_CTL2) & PWM_LEGACY_MODE;
 }
-static int cdv_get_brightness(struct backlight_device *bd)
-{
-        struct drm_device *dev = bl_get_data(bd);
-        u32 val = REG_READ(BLC_PWM_CTL) & BACKLIGHT_DUTY_CYCLE_MASK;
-        if (cdv_backlight_combination_mode(dev)) {
-                u8 lbpc;
-                val &= ~1;
-                pci_read_config_byte(dev->pdev, 0xF4, &lbpc);
-                val *= lbpc;
-        }
-        return val;
-}
 static u32 cdv_get_max_backlight(struct drm_device *dev)
 {
        u32 max = REG_READ(BLC_PWM_CTL);
@@ -110,6 +95,22 @@ static u32 cdv_get_max_backlight(struct drm_device *dev)
        return max;
 }
+static int cdv_get_brightness(struct backlight_device *bd)
+{
+        struct drm_device *dev = bl_get_data(bd);
+        u32 val = REG_READ(BLC_PWM_CTL) & BACKLIGHT_DUTY_CYCLE_MASK;
+        if (cdv_backlight_combination_mode(dev)) {
+                u8 lbpc;
+                val &= ~1;
+                pci_read_config_byte(dev->pdev, 0xF4, &lbpc);
+                val *= lbpc;
+        }
+        return (val * 100)/cdv_get_max_backlight(dev);
+}
 static int cdv_set_brightness(struct backlight_device *bd)
 {
        struct drm_device *dev = bl_get_data(bd);
@@ -120,6 +121,9 @@ static int cdv_set_brightness(struct backlight_device *bd)
        if (level < 1)
                level = 1;
+        level *= cdv_get_max_backlight(dev);
+        level /= 100;
        if (cdv_backlight_combination_mode(dev)) {
                u32 max = cdv_get_max_backlight(dev);
                u8 lbpc;
@@ -157,7 +161,6 @@ static int cdv_backlight_init(struct drm_device *dev)
        cdv_backlight_device->props.brightness =
                        cdv_get_brightness(cdv_backlight_device);
-        cdv_backlight_device->props.max_brightness = cdv_get_max_backlight(dev);
        backlight_update_status(cdv_backlight_device);
        dev_priv->backlight_device = cdv_backlight_device;
        return 0;
diff --git a/drivers/gpu/drm/gma500/opregion.c b/drivers/gpu/drm/gma500/opregion.c
index 4f186eca3a30..c430bd424681 100644
--- a/drivers/gpu/drm/gma500/opregion.c
+++ b/drivers/gpu/drm/gma500/opregion.c
@@ -144,6 +144,8 @@ struct opregion_asle {
 #define ASLE_CBLV_VALID         (1<<31)
+static struct psb_intel_opregion *system_opregion;
 static u32 asle_set_backlight(struct drm_device *dev, u32 bclp)
 {
        struct drm_psb_private *dev_priv = dev->dev_private;
@@ -205,7 +207,7 @@ void psb_intel_opregion_enable_asle(struct drm_device *dev)
        struct drm_psb_private *dev_priv = dev->dev_private;
        struct opregion_asle *asle = dev_priv->opregion.asle;
-        if (asle) {
+        if (asle && system_opregion ) {
                /* Don't do this on Medfield or other non PC like devices, they
                   use the bit for something different altogether */
                psb_enable_pipestat(dev_priv, 0, PIPE_LEGACY_BLC_EVENT_ENABLE);
@@ -221,7 +223,6 @@ void psb_intel_opregion_enable_asle(struct drm_device *dev)
 #define ACPI_EV_LID            (1<<1)
 #define ACPI_EV_DOCK           (1<<2)
-static struct psb_intel_opregion *system_opregion;
 static int psb_intel_opregion_video_event(struct notifier_block *nb,
                                          unsigned long val, void *data)
@@ -266,9 +267,6 @@ void psb_intel_opregion_init(struct drm_device *dev)
                system_opregion = opregion;
                register_acpi_notifier(&psb_intel_opregion_notifier);
        }
-        if (opregion->asle)
-                psb_intel_opregion_enable_asle(dev);
 }
 void psb_intel_opregion_fini(struct drm_device *dev)
diff --git a/drivers/gpu/drm/gma500/opregion.h b/drivers/gpu/drm/gma500/opregion.h
index 72dc6b921265..4a90f8b0e16c 100644
--- a/drivers/gpu/drm/gma500/opregion.h
+++ b/drivers/gpu/drm/gma500/opregion.h
@@ -27,6 +27,7 @@ extern void psb_intel_opregion_asle_intr(struct drm_device *dev);
 extern void psb_intel_opregion_init(struct drm_device *dev);
 extern void psb_intel_opregion_fini(struct drm_device *dev);
 extern int psb_intel_opregion_setup(struct drm_device *dev);
+extern void psb_intel_opregion_enable_asle(struct drm_device *dev);
 #else
@@ -46,4 +47,8 @@ extern inline int psb_intel_opregion_setup(struct drm_device *dev)
 {
        return 0;
 }
+extern inline void psb_intel_opregion_enable_asle(struct drm_device *dev)
+{
+}
 #endif
diff --git a/drivers/gpu/drm/gma500/psb_device.c b/drivers/gpu/drm/gma500/psb_device.c
index eff039bf92d4..5971bc82b765 100644
--- a/drivers/gpu/drm/gma500/psb_device.c
+++ b/drivers/gpu/drm/gma500/psb_device.c
@@ -144,6 +144,10 @@ static int psb_backlight_init(struct drm_device *dev)
        psb_backlight_device->props.max_brightness = 100;
        backlight_update_status(psb_backlight_device);
        dev_priv->backlight_device = psb_backlight_device;
+        /* This must occur after the backlight is properly initialised */
+        psb_lid_timer_init(dev_priv);
        return 0;
 }
@@ -354,13 +358,6 @@ static int psb_chip_setup(struct drm_device *dev)
        return 0;
 }
-/* Not exactly an erratum more an irritation */
-static void psb_chip_errata(struct drm_device *dev)
-{
-        struct drm_psb_private *dev_priv = dev->dev_private;
-        psb_lid_timer_init(dev_priv);
-}
 static void psb_chip_teardown(struct drm_device *dev)
 {
        struct drm_psb_private *dev_priv = dev->dev_private;
@@ -379,7 +376,6 @@ const struct psb_ops psb_chip_ops = {
        .sgx_offset = PSB_SGX_OFFSET,
        .chip_setup = psb_chip_setup,
        .chip_teardown = psb_chip_teardown,
-        .errata = psb_chip_errata,
        .crtc_helper = &psb_intel_helper_funcs,
        .crtc_funcs = &psb_intel_crtc_funcs,
diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
index caba6e08693c..a8858a907f47 100644
--- a/drivers/gpu/drm/gma500/psb_drv.c
+++ b/drivers/gpu/drm/gma500/psb_drv.c
@@ -374,6 +374,7 @@ static int psb_driver_load(struct drm_device *dev, unsigned long chipset)
        if (ret)
                return ret;
+        psb_intel_opregion_enable_asle(dev);
 #if 0
        /*enable runtime pm at last*/
        pm_runtime_enable(&dev->pdev->dev);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index f94792626b94..36822b924eb1 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1401,6 +1401,27 @@ i915_mtrr_setup(struct drm_i915_private *dev_priv, unsigned long base,
        }
 }
+static void i915_kick_out_firmware_fb(struct drm_i915_private *dev_priv)
+{
+        struct apertures_struct *ap;
+        struct pci_dev *pdev = dev_priv->dev->pdev;
+        bool primary;
+        ap = alloc_apertures(1);
+        if (!ap)
+                return;
+        ap->ranges[0].base = dev_priv->dev->agp->base;
+        ap->ranges[0].size =
+                dev_priv->mm.gtt->gtt_mappable_entries << PAGE_SHIFT;
+        primary =
+                pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW;
+        remove_conflicting_framebuffers(ap, "inteldrmfb", primary);
+        kfree(ap);
+}
 /**
 * i915_driver_load - setup chip and create an initial config
 * @dev: DRM device
@@ -1446,6 +1467,15 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                goto free_priv;
        }
+        dev_priv->mm.gtt = intel_gtt_get();
+        if (!dev_priv->mm.gtt) {
+                DRM_ERROR("Failed to initialize GTT\n");
+                ret = -ENODEV;
+                goto put_bridge;
+        }
+        i915_kick_out_firmware_fb(dev_priv);
        pci_set_master(dev->pdev);
        /* overlay on gen2 is broken and can't address above 1G */
@@ -1471,13 +1501,6 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                goto put_bridge;
        }
-        dev_priv->mm.gtt = intel_gtt_get();
-        if (!dev_priv->mm.gtt) {
-                DRM_ERROR("Failed to initialize GTT\n");
-                ret = -ENODEV;
-                goto out_rmmap;
-        }
        aperture_size = dev_priv->mm.gtt->gtt_mappable_entries << PAGE_SHIFT;
        dev_priv->mm.gtt_mapping =
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index b1fe0edda955..ed3224c37423 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -412,7 +412,6 @@ static void gen6_queue_rps_work(struct drm_i915_private *dev_priv,
         */
        spin_lock_irqsave(&dev_priv->rps_lock, flags);
-        WARN(dev_priv->pm_iir & pm_iir, "Missed a PM interrupt\n");
        dev_priv->pm_iir |= pm_iir;
        I915_WRITE(GEN6_PMIMR, dev_priv->pm_iir);
        POSTING_READ(GEN6_PMIMR);
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 0ede02a99d91..a748e5cabe14 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -740,8 +740,11 @@ static void i915_restore_display(struct drm_device *dev)
        if (HAS_PCH_SPLIT(dev)) {
                I915_WRITE(BLC_PWM_PCH_CTL1, dev_priv->saveBLC_PWM_CTL);
                I915_WRITE(BLC_PWM_PCH_CTL2, dev_priv->saveBLC_PWM_CTL2);
-                I915_WRITE(BLC_PWM_CPU_CTL, dev_priv->saveBLC_CPU_PWM_CTL);
+                /* NOTE: BLC_PWM_CPU_CTL must be written after BLC_PWM_CPU_CTL2;
+                 * otherwise we get blank eDP screen after S3 on some machines
+                 */
                I915_WRITE(BLC_PWM_CPU_CTL2, dev_priv->saveBLC_CPU_PWM_CTL2);
+                I915_WRITE(BLC_PWM_CPU_CTL, dev_priv->saveBLC_CPU_PWM_CTL);
                I915_WRITE(PCH_PP_ON_DELAYS, dev_priv->savePP_ON_DELAYS);
                I915_WRITE(PCH_PP_OFF_DELAYS, dev_priv->savePP_OFF_DELAYS);
                I915_WRITE(PCH_PP_DIVISOR, dev_priv->savePP_DIVISOR);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index a7c727d0c105..a8538ac0299d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -6921,19 +6921,6 @@ static void i915_disable_vga(struct drm_device *dev)
        POSTING_READ(vga_reg);
 }
-static void ivb_pch_pwm_override(struct drm_device *dev)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        /*
-         * IVB has CPU eDP backlight regs too, set things up to let the
-         * PCH regs control the backlight
-         */
-        I915_WRITE(BLC_PWM_CPU_CTL2, PWM_ENABLE);
-        I915_WRITE(BLC_PWM_CPU_CTL, 0);
-        I915_WRITE(BLC_PWM_PCH_CTL1, PWM_ENABLE | (1<<30));
-}
 void intel_modeset_init_hw(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -6950,9 +6937,6 @@ void intel_modeset_init_hw(struct drm_device *dev)
                gen6_enable_rps(dev_priv);
                gen6_update_ring_freq(dev_priv);
        }
-        if (IS_IVYBRIDGE(dev))
-                ivb_pch_pwm_override(dev);
 }
 void intel_modeset_init(struct drm_device *dev)
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 153b9a15469b..1074bc5dd418 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -467,7 +467,7 @@ int nouveau_fbcon_init(struct drm_device *dev)
        nfbdev->helper.funcs = &nouveau_fbcon_helper_funcs;
        ret = drm_fb_helper_init(dev, &nfbdev->helper,
-                                 nv_two_heads(dev) ? 2 : 1, 4);
+                                 dev->mode_config.num_crtc, 4);
        if (ret) {
                kfree(nfbdev);
                return ret;
diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c
index a89240e5fb29..a25cf2cb931f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_prime.c
+++ b/drivers/gpu/drm/nouveau/nouveau_prime.c
@@ -1,3 +1,26 @@
+/*
+ * Copyright 2011 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Dave Airlie
+ */
 #include "drmP.h"
 #include "drm.h"
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 59d44937dd9f..84b648a7ddd8 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -289,8 +289,9 @@ int radeon_vm_manager_init(struct radeon_device *rdev)
        rdev->vm_manager.enabled = false;
        /* mark first vm as always in use, it's the system one */
+        /* allocate enough for 2 full VM pts */
        r = radeon_sa_bo_manager_init(rdev, &rdev->vm_manager.sa_manager,
-                                      rdev->vm_manager.max_pfn * 8,
+                                      rdev->vm_manager.max_pfn * 8 * 2,
                                      RADEON_GEM_DOMAIN_VRAM);
        if (r) {
                dev_err(rdev->dev, "failed to allocate vm bo (%dKB)\n",
@@ -633,7 +634,15 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
        mutex_init(&vm->mutex);
        INIT_LIST_HEAD(&vm->list);
        INIT_LIST_HEAD(&vm->va);
-        vm->last_pfn = 0;
+        /* SI requires equal sized PTs for all VMs, so always set
+         * last_pfn to max_pfn.  cayman allows variable sized
+         * pts so we can grow then as needed.  Once we switch
+         * to two level pts we can unify this again.
+         */
+        if (rdev->family >= CHIP_TAHITI)
+                vm->last_pfn = rdev->vm_manager.max_pfn;
+        else
+                vm->last_pfn = 0;
        /* map the ib pool buffer at 0 in virtual address space, set
         * read only
         */
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index f28bd4b7ef98..21ec9f5653ce 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -292,6 +292,7 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
 int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
                          struct drm_file *filp)
 {
+        struct radeon_device *rdev = dev->dev_private;
        struct drm_radeon_gem_busy *args = data;
        struct drm_gem_object *gobj;
        struct radeon_bo *robj;
@@ -317,13 +318,14 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
                break;
        }
        drm_gem_object_unreference_unlocked(gobj);
-        r = radeon_gem_handle_lockup(robj->rdev, r);
+        r = radeon_gem_handle_lockup(rdev, r);
        return r;
 }
 int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
                              struct drm_file *filp)
 {
+        struct radeon_device *rdev = dev->dev_private;
        struct drm_radeon_gem_wait_idle *args = data;
        struct drm_gem_object *gobj;
        struct radeon_bo *robj;
@@ -336,10 +338,10 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
        robj = gem_to_radeon_bo(gobj);
        r = radeon_bo_wait(robj, NULL, false);
        /* callback hw specific functions if any */
-        if (robj->rdev->asic->ioctl_wait_idle)
+        if (rdev->asic->ioctl_wait_idle)
-                robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
+                robj->rdev->asic->ioctl_wait_idle(rdev, robj);
        drm_gem_object_unreference_unlocked(gobj);
-        r = radeon_gem_handle_lockup(robj->rdev, r);
+        r = radeon_gem_handle_lockup(rdev, r);
        return r;
 }
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index c7b61f16ecfd..0b0279291a73 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2365,12 +2365,12 @@ int si_pcie_gart_enable(struct radeon_device *rdev)
        WREG32(0x15DC, 0);
        /* empty context1-15 */
-        /* FIXME start with 1G, once using 2 level pt switch to full
+        /* FIXME start with 4G, once using 2 level pt switch to full
         * vm size space
         */
        /* set vm size, must be a multiple of 4 */
        WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
-        WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, (1 << 30) / RADEON_GPU_PAGE_SIZE);
+        WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
        for (i = 1; i < 16; i++) {
                if (i < 8)
                        WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index a8d5f09428c7..4c2d836a0893 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -61,7 +61,7 @@ static int udl_parse_vendor_descriptor(struct drm_device *dev,
                        u8 length;
                        u16 key;
-                        key = *((u16 *) desc);
+                        key = le16_to_cpu(*((u16 *) desc));
                        desc += sizeof(u16);
                        length = *desc;
                        desc++;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index bef04c192768..00445bc3019c 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -193,10 +193,12 @@ config HID_EZKEY
        Support for Ezkey BTC 8193 keyboard.
 config HID_HOLTEK
-        tristate "Holtek On Line Grip based game controller support"
+        tristate "Holtek HID devices"
        depends on USB_HID
        ---help---
-          Say Y here if you have a Holtek On Line Grip based game controller.
+        Support for Holtek based devices:
+          - Holtek On Line Grip based game controller
+          - Trust GXT 18 Gaming Keyboard
 config HOLTEK_FF
        bool "Holtek On Line Grip force feedback support"
@@ -261,6 +263,19 @@ config HID_LCPOWER
        ---help---
        Support for LC-Power RC1000MCE RF remote control.
+config HID_LENOVO_TPKBD
+        tristate "Lenovo ThinkPad USB Keyboard with TrackPoint"
+        depends on USB_HID
+        select NEW_LEDS
+        select LEDS_CLASS
+        ---help---
+        Support for the Lenovo ThinkPad USB Keyboard with TrackPoint.
+        Say Y here if you have a Lenovo ThinkPad USB Keyboard with TrackPoint
+        and would like to use device-specific features like changing the
+        sensitivity of the trackpoint, using the microphone mute button or
+        controlling the mute and microphone mute LEDs.
 config HID_LOGITECH
        tristate "Logitech devices" if EXPERT
        depends on USB_HID
@@ -386,6 +401,7 @@ config HID_MULTITOUCH
          - Unitec Panels
          - XAT optical touch panels
          - Xiroku optical touch panels
+          - Zytronic touch panels
          If unsure, say N.
diff --git a/drivers/hid/Makefile b/drivers/hid/Makefile
index ca6cc9f0485c..02fa93896951 100644
--- a/drivers/hid/Makefile
+++ b/drivers/hid/Makefile
@@ -48,12 +48,14 @@ obj-$(CONFIG_HID_EMS_FF)	+= hid-emsff.o
 obj-$(CONFIG_HID_ELECOM)        += hid-elecom.o
 obj-$(CONFIG_HID_EZKEY)         += hid-ezkey.o
 obj-$(CONFIG_HID_GYRATION)      += hid-gyration.o
+obj-$(CONFIG_HID_HOLTEK)        += hid-holtek-kbd.o
 obj-$(CONFIG_HID_HOLTEK)        += hid-holtekff.o
 obj-$(CONFIG_HID_HYPERV_MOUSE)  += hid-hyperv.o
 obj-$(CONFIG_HID_KENSINGTON)    += hid-kensington.o
 obj-$(CONFIG_HID_KEYTOUCH)      += hid-keytouch.o
 obj-$(CONFIG_HID_KYE)           += hid-kye.o
 obj-$(CONFIG_HID_LCPOWER)       += hid-lcpower.o
+obj-$(CONFIG_HID_LENOVO_TPKBD)  += hid-lenovo-tpkbd.o
 obj-$(CONFIG_HID_LOGITECH)      += hid-logitech.o
 obj-$(CONFIG_HID_LOGITECH_DJ)   += hid-logitech-dj.o
 obj-$(CONFIG_HID_MAGICMOUSE)    += hid-magicmouse.o
@@ -69,7 +71,8 @@ obj-$(CONFIG_HID_PICOLCD)	+= hid-picolcd.o
 obj-$(CONFIG_HID_PRIMAX)        += hid-primax.o
 obj-$(CONFIG_HID_ROCCAT)        += hid-roccat.o hid-roccat-common.o \
        hid-roccat-arvo.o hid-roccat-isku.o hid-roccat-kone.o \
-        hid-roccat-koneplus.o hid-roccat-kovaplus.o hid-roccat-pyra.o
+        hid-roccat-koneplus.o hid-roccat-kovaplus.o hid-roccat-pyra.o \
+        hid-roccat-savu.o
 obj-$(CONFIG_HID_SAITEK)        += hid-saitek.o
 obj-$(CONFIG_HID_SAMSUNG)       += hid-samsung.o
 obj-$(CONFIG_HID_SMARTJOYPLUS)  += hid-sjoy.o
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index fa10f847f7db..585344b6d338 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -517,6 +517,12 @@ static const struct hid_device_id apple_devices[] = {
                .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5A_JIS),
                .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_ISO),
+                .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_JIS),
+                .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI),
                .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO),
diff --git a/drivers/hid/hid-chicony.c b/drivers/hid/hid-chicony.c
index b99af346fdff..a2abb8e15727 100644
--- a/drivers/hid/hid-chicony.c
+++ b/drivers/hid/hid-chicony.c
@@ -60,6 +60,7 @@ static int ch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 static const struct hid_device_id ch_devices[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
        { }
 };
 MODULE_DEVICE_TABLE(hid, ch_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 6ac0286b5375..500844f04f93 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1194,8 +1194,10 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,
                        goto out;
        }
-        for (a = 0; a < report->maxfield; a++)
+        if (hid->claimed != HID_CLAIMED_HIDRAW) {
-                hid_input_field(hid, report->field[a], cdata, interrupt);
+                for (a = 0; a < report->maxfield; a++)
+                        hid_input_field(hid, report->field[a], cdata, interrupt);
+        }
        if (hid->claimed & HID_CLAIMED_INPUT)
                hidinput_report_event(hid, report);
@@ -1243,6 +1245,10 @@ int hid_input_report(struct hid_device *hid, int type, u8 *data, int size, int i
                goto unlock;
        }
+        /* Avoid unnecessary overhead if debugfs is disabled */
+        if (list_empty(&hid->debug_list))
+                goto nomem;
        buf = kmalloc(sizeof(char) * HID_DEBUG_BUFSIZE, GFP_ATOMIC);
        if (!buf)
@@ -1373,8 +1379,10 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask)
        if ((connect_mask & HID_CONNECT_HIDRAW) && !hidraw_connect(hdev))
                hdev->claimed |= HID_CLAIMED_HIDRAW;
-        if (!hdev->claimed) {
+        /* Drivers with the ->raw_event callback set are not required to connect
-                hid_err(hdev, "claimed by neither input, hiddev nor hidraw\n");
+         * to any other listener. */
+        if (!hdev->claimed && !hdev->driver->raw_event) {
+                hid_err(hdev, "device has no listeners, quitting\n");
                return -ENODEV;
        }
@@ -1503,6 +1511,9 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING6A_ANSI) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING6A_ISO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING6A_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_JIS) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
@@ -1518,10 +1529,12 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_2) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_3) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_4) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE) },
        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0006) },
        { HID_USB_DEVICE(USB_VENDOR_ID_DRAGONRISE, 0x0011) },
@@ -1536,6 +1549,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_2) },
        { HID_USB_DEVICE(USB_VENDOR_ID_GYRATION, USB_DEVICE_ID_GYRATION_REMOTE_3) },
        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK, USB_DEVICE_ID_HOLTEK_ON_LINE_GRIP) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
        { HID_USB_DEVICE(USB_VENDOR_ID_KEYTOUCH, USB_DEVICE_ID_KEYTOUCH_IEC) },
        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_ERGO_525V) },
@@ -1544,6 +1558,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LCPOWER, USB_DEVICE_ID_LCPOWER_LC1000 ) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPKBD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_MX3000_RECEIVER) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_S510_RECEIVER_2) },
@@ -1617,6 +1632,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_KOVAPLUS) },
        { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_PYRA_WIRED) },
        { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_PYRA_WIRELESS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_SAVU) },
        { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_PS1000) },
        { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) },
        { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE) },
@@ -1995,6 +2011,7 @@ static const struct hid_device_id hid_ignore_list[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MCT) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_HYBRID) },
        { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_HEATCONTROL) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_BEATPAD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_MCC, USB_DEVICE_ID_MCC_PMD1024LS) },
        { HID_USB_DEVICE(USB_VENDOR_ID_MCC, USB_DEVICE_ID_MCC_PMD1208LS) },
        { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICKIT1) },
@@ -2089,6 +2106,9 @@ static const struct hid_device_id hid_mouse_ignore_list[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING6A_ANSI) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING6A_ISO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING6A_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING7_JIS) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
        { }
diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c
index 2f0be4c66af7..9e43aaca9774 100644
--- a/drivers/hid/hid-cypress.c
+++ b/drivers/hid/hid-cypress.c
@@ -129,6 +129,8 @@ static const struct hid_device_id cp_devices[] = {
                .driver_data = CP_RDESC_SWAPPED_MIN_MAX },
        { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_3),
                .driver_data = CP_RDESC_SWAPPED_MIN_MAX },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_4),
+                .driver_data = CP_RDESC_SWAPPED_MIN_MAX },
        { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE),
                .driver_data = CP_2WHEEL_MOUSE_HACK },
        { }
diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c
new file mode 100644
index 000000000000..e0a5d1739fc3
--- /dev/null
+++ b/drivers/hid/hid-holtek-kbd.c
@@ -0,0 +1,183 @@
+/*
+ * HID driver for Holtek keyboard
+ * Copyright (c) 2012 Tom Harwood
+*/
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+#include <linux/device.h>
+#include <linux/hid.h>
+#include <linux/module.h>
+#include <linux/usb.h>
+#include "hid-ids.h"
+#include "usbhid/usbhid.h"
+/* Holtek based keyboards (USB ID 04d9:a055) have the following issues:
+ * - The report descriptor specifies an excessively large number of consumer
+ *   usages (2^15), which is more than HID_MAX_USAGES. This prevents proper
+ *   parsing of the report descriptor.
+ * - The report descriptor reports on caps/scroll/num lock key presses, but
+ *   doesn't have an LED output usage block.
+ *
+ * The replacement descriptor below fixes the number of consumer usages,
+ * and provides an LED output usage block. LED output events are redirected
+ * to the boot interface.
+ */
+static __u8 holtek_kbd_rdesc_fixed[] = {
+        /* Original report descriptor, with reduced number of consumer usages */
+        0x05, 0x01,         /*  Usage Page (Desktop),                         */
+        0x09, 0x80,         /*  Usage (Sys Control),                          */
+        0xA1, 0x01,         /*  Collection (Application),                     */
+        0x85, 0x01,         /*      Report ID (1),                            */
+        0x19, 0x81,         /*      Usage Minimum (Sys Power Down),           */
+        0x29, 0x83,         /*      Usage Maximum (Sys Wake Up),              */
+        0x15, 0x00,         /*      Logical Minimum (0),                      */
+        0x25, 0x01,         /*      Logical Maximum (1),                      */
+        0x95, 0x03,         /*      Report Count (3),                         */
+        0x75, 0x01,         /*      Report Size (1),                          */
+        0x81, 0x02,         /*      Input (Variable),                         */
+        0x95, 0x01,         /*      Report Count (1),                         */
+        0x75, 0x05,         /*      Report Size (5),                          */
+        0x81, 0x01,         /*      Input (Constant),                         */
+        0xC0,               /*  End Collection,                               */
+        0x05, 0x0C,         /*  Usage Page (Consumer),                        */
+        0x09, 0x01,         /*  Usage (Consumer Control),                     */
+        0xA1, 0x01,         /*  Collection (Application),                     */
+        0x85, 0x02,         /*      Report ID (2),                            */
+        0x19, 0x00,         /*      Usage Minimum (00h),                      */
+        0x2A, 0xFF, 0x2F,   /*      Usage Maximum (0x2FFF), previously 0x7FFF */
+        0x15, 0x00,         /*      Logical Minimum (0),                      */
+        0x26, 0xFF, 0x2F,   /*      Logical Maximum (0x2FFF),previously 0x7FFF*/
+        0x95, 0x01,         /*      Report Count (1),                         */
+        0x75, 0x10,         /*      Report Size (16),                         */
+        0x81, 0x00,         /*      Input,                                    */
+        0xC0,               /*  End Collection,                               */
+        0x05, 0x01,         /*  Usage Page (Desktop),                         */
+        0x09, 0x06,         /*  Usage (Keyboard),                             */
+        0xA1, 0x01,         /*  Collection (Application),                     */
+        0x85, 0x03,         /*      Report ID (3),                            */
+        0x95, 0x38,         /*      Report Count (56),                        */
+        0x75, 0x01,         /*      Report Size (1),                          */
+        0x15, 0x00,         /*      Logical Minimum (0),                      */
+        0x25, 0x01,         /*      Logical Maximum (1),                      */
+        0x05, 0x07,         /*      Usage Page (Keyboard),                    */
+        0x19, 0xE0,         /*      Usage Minimum (KB Leftcontrol),           */
+        0x29, 0xE7,         /*      Usage Maximum (KB Right GUI),             */
+        0x19, 0x00,         /*      Usage Minimum (None),                     */
+        0x29, 0x2F,         /*      Usage Maximum (KB Lboxbracket And Lbrace),*/
+        0x81, 0x02,         /*      Input (Variable),                         */
+        0xC0,               /*  End Collection,                               */
+        0x05, 0x01,         /*  Usage Page (Desktop),                         */
+        0x09, 0x06,         /*  Usage (Keyboard),                             */
+        0xA1, 0x01,         /*  Collection (Application),                     */
+        0x85, 0x04,         /*      Report ID (4),                            */
+        0x95, 0x38,         /*      Report Count (56),                        */
+        0x75, 0x01,         /*      Report Size (1),                          */
+        0x15, 0x00,         /*      Logical Minimum (0),                      */
+        0x25, 0x01,         /*      Logical Maximum (1),                      */
+        0x05, 0x07,         /*      Usage Page (Keyboard),                    */
+        0x19, 0x30,         /*      Usage Minimum (KB Rboxbracket And Rbrace),*/
+        0x29, 0x67,         /*      Usage Maximum (KP Equals),                */
+        0x81, 0x02,         /*      Input (Variable),                         */
+        0xC0,               /*  End Collection                                */
+        /* LED usage for the boot protocol interface */
+        0x05, 0x01,         /*  Usage Page (Desktop),                         */
+        0x09, 0x06,         /*  Usage (Keyboard),                             */
+        0xA1, 0x01,         /*  Collection (Application),                     */
+        0x05, 0x08,         /*      Usage Page (LED),                         */
+        0x19, 0x01,         /*      Usage Minimum (01h),                      */
+        0x29, 0x03,         /*      Usage Maximum (03h),                      */
+        0x15, 0x00,         /*      Logical Minimum (0),                      */
+        0x25, 0x01,         /*      Logical Maximum (1),                      */
+        0x75, 0x01,         /*      Report Size (1),                          */
+        0x95, 0x03,         /*      Report Count (3),                         */
+        0x91, 0x02,         /*      Output (Variable),                        */
+        0x95, 0x05,         /*      Report Count (5),                         */
+        0x91, 0x01,         /*      Output (Constant),                        */
+        0xC0,               /*  End Collection                                */
+};
+static __u8 *holtek_kbd_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+                unsigned int *rsize)
+{
+        struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+        if (intf->cur_altsetting->desc.bInterfaceNumber == 1) {
+                rdesc = holtek_kbd_rdesc_fixed;
+                *rsize = sizeof(holtek_kbd_rdesc_fixed);
+        }
+        return rdesc;
+}
+static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
+                unsigned int code,
+                int value)
+{
+        struct hid_device *hid = input_get_drvdata(dev);
+        struct usb_device *usb_dev = hid_to_usb_dev(hid);
+        /* Locate the boot interface, to receive the LED change events */
+        struct usb_interface *boot_interface = usb_ifnum_to_if(usb_dev, 0);
+        struct hid_device *boot_hid = usb_get_intfdata(boot_interface);
+        struct hid_input *boot_hid_input = list_first_entry(&boot_hid->inputs,
+                struct hid_input, list);
+        return boot_hid_input->input->event(boot_hid_input->input, type, code,
+                        value);
+}
+static int holtek_kbd_probe(struct hid_device *hdev,
+                const struct hid_device_id *id)
+{
+        struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+        int ret = hid_parse(hdev);
+        if (!ret)
+                ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
+        if (!ret && intf->cur_altsetting->desc.bInterfaceNumber == 1) {
+                struct hid_input *hidinput;
+                list_for_each_entry(hidinput, &hdev->inputs, list) {
+                        hidinput->input->event = holtek_kbd_input_event;
+                }
+        }
+        return ret;
+}
+static const struct hid_device_id holtek_kbd_devices[] = {
+        { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT,
+                        USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD) },
+        { }
+};
+MODULE_DEVICE_TABLE(hid, holtek_kbd_devices);
+static struct hid_driver holtek_kbd_driver = {
+        .name = "holtek_kbd",
+        .id_table = holtek_kbd_devices,
+        .report_fixup = holtek_kbd_report_fixup,
+        .probe = holtek_kbd_probe
+};
+static int __init holtek_kbd_init(void)
+{
+        return hid_register_driver(&holtek_kbd_driver);
+}
+static void __exit holtek_kbd_exit(void)
+{
+        hid_unregister_driver(&holtek_kbd_driver);
+}
+module_exit(holtek_kbd_exit);
+module_init(holtek_kbd_init);
+MODULE_LICENSE("GPL");
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index d1cdd2d28409..41c34f21bd00 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -125,6 +125,9 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING6_ANSI    0x024c
 #define USB_DEVICE_ID_APPLE_WELLSPRING6_ISO     0x024d
 #define USB_DEVICE_ID_APPLE_WELLSPRING6_JIS     0x024e
+#define USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI    0x0262
+#define USB_DEVICE_ID_APPLE_WELLSPRING7_ISO     0x0263
+#define USB_DEVICE_ID_APPLE_WELLSPRING7_JIS     0x0264
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI  0x0239
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO   0x023a
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS   0x023b
@@ -205,6 +208,7 @@
 #define USB_DEVICE_ID_CHICONY_MULTI_TOUCH       0xb19d
 #define USB_DEVICE_ID_CHICONY_WIRELESS  0x0618
 #define USB_DEVICE_ID_CHICONY_WIRELESS2 0x1123
+#define USB_DEVICE_ID_CHICONY_AK1D      0x1125
 #define USB_VENDOR_ID_CHUNGHWAT         0x2247
 #define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH      0x0001
@@ -234,6 +238,7 @@
 #define USB_DEVICE_ID_CYPRESS_BARCODE_1 0xde61
 #define USB_DEVICE_ID_CYPRESS_BARCODE_2 0xde64
 #define USB_DEVICE_ID_CYPRESS_BARCODE_3 0xbca1
+#define USB_DEVICE_ID_CYPRESS_BARCODE_4 0xed81
 #define USB_DEVICE_ID_CYPRESS_TRUETOUCH 0xc001
 #define USB_VENDOR_ID_DEALEXTREAME      0x10c5
@@ -407,6 +412,9 @@
 #define USB_VENDOR_ID_HOLTEK            0x1241
 #define USB_DEVICE_ID_HOLTEK_ON_LINE_GRIP       0x5015
+#define USB_VENDOR_ID_HOLTEK_ALT                0x04d9
+#define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD       0xa055
 #define USB_VENDOR_ID_IMATION           0x0718
 #define USB_DEVICE_ID_DISC_STAKKA       0xd000
@@ -476,6 +484,9 @@
 #define USB_DEVICE_ID_LD_HYBRID         0x2090
 #define USB_DEVICE_ID_LD_HEATCONTROL    0x20A0
+#define USB_VENDOR_ID_LENOVO            0x17ef
+#define USB_DEVICE_ID_LENOVO_TPKBD      0x6009
 #define USB_VENDOR_ID_LG                0x1fd2
 #define USB_DEVICE_ID_LG_MULTITOUCH     0x0064
@@ -518,6 +529,9 @@
 #define USB_DEVICE_ID_CRYSTALTOUCH      0x0006
 #define USB_DEVICE_ID_CRYSTALTOUCH_DUAL 0x0007
+#define USB_VENDOR_ID_MADCATZ           0x0738
+#define USB_DEVICE_ID_MADCATZ_BEATPAD   0x4540
 #define USB_VENDOR_ID_MCC               0x09db
 #define USB_DEVICE_ID_MCC_PMD1024LS     0x0076
 #define USB_DEVICE_ID_MCC_PMD1208LS     0x007a
@@ -567,6 +581,9 @@
 #define USB_VENDOR_ID_NINTENDO          0x057e
 #define USB_DEVICE_ID_NINTENDO_WIIMOTE  0x0306
+#define USB_VENDOR_ID_NOVATEK           0x0603
+#define USB_DEVICE_ID_NOVATEK_PCT       0x0600
 #define USB_VENDOR_ID_NTRIG             0x1b96
 #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN   0x0001
 #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1   0x0003
@@ -644,6 +661,7 @@
 #define USB_DEVICE_ID_ROCCAT_KOVAPLUS   0x2d50
 #define USB_DEVICE_ID_ROCCAT_PYRA_WIRED 0x2c24
 #define USB_DEVICE_ID_ROCCAT_PYRA_WIRELESS      0x2cf6
+#define USB_DEVICE_ID_ROCCAT_SAVU       0x2d5a
 #define USB_VENDOR_ID_SAITEK            0x06a3
 #define USB_DEVICE_ID_SAITEK_RUMBLEPAD  0xff17
@@ -653,6 +671,9 @@
 #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
 #define USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE        0x0600
+#define USB_VENDOR_ID_SENNHEISER        0x1395
+#define USB_DEVICE_ID_SENNHEISER_BTD500USB      0x002c
 #define USB_VENDOR_ID_SIGMA_MICRO       0x1c4f
 #define USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD      0x0002
@@ -802,6 +823,9 @@
 #define USB_VENDOR_ID_ZYDACRON  0x13EC
 #define USB_DEVICE_ID_ZYDACRON_REMOTE_CONTROL   0x0006
+#define USB_VENDOR_ID_ZYTRONIC          0x14c8
+#define USB_DEVICE_ID_ZYTRONIC_ZXY100   0x0005
 #define USB_VENDOR_ID_PRIMAX    0x0461
 #define USB_DEVICE_ID_PRIMAX_KEYBOARD   0x4e05
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 132b0019365e..811bfad64609 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -301,6 +301,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
                               USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI),
          HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
+        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE,
+                USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI),
+          HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE },
        {}
 };
@@ -834,6 +837,15 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                }
                break;
+        case HID_UP_HPVENDOR2:
+                set_bit(EV_REP, input->evbit);
+                switch (usage->hid & HID_USAGE) {
+                case 0x003: map_key_clear(KEY_BRIGHTNESSDOWN);  break;
+                case 0x004: map_key_clear(KEY_BRIGHTNESSUP);    break;
+                default:    goto ignore;
+                }
+                break;
        case HID_UP_MSVENDOR:
                goto ignore;
diff --git a/drivers/hid/hid-lenovo-tpkbd.c b/drivers/hid/hid-lenovo-tpkbd.c
new file mode 100644
index 000000000000..77d2df04c97b
--- /dev/null
+++ b/drivers/hid/hid-lenovo-tpkbd.c
@@ -0,0 +1,564 @@
+/*
+ *  HID driver for Lenovo ThinkPad USB Keyboard with TrackPoint
+ *
+ *  Copyright (c) 2012 Bernhard Seibold
+ */
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+#include <linux/module.h>
+#include <linux/sysfs.h>
+#include <linux/device.h>
+#include <linux/usb.h>
+#include <linux/hid.h>
+#include <linux/input.h>
+#include <linux/leds.h>
+#include "usbhid/usbhid.h"
+#include "hid-ids.h"
+/* This is only used for the trackpoint part of the driver, hence _tp */
+struct tpkbd_data_pointer {
+        int led_state;
+        struct led_classdev led_mute;
+        struct led_classdev led_micmute;
+        int press_to_select;
+        int dragging;
+        int release_to_select;
+        int select_right;
+        int sensitivity;
+        int press_speed;
+};
+#define map_key_clear(c) hid_map_usage_clear(hi, usage, bit, max, EV_KEY, (c))
+static int tpkbd_input_mapping(struct hid_device *hdev,
+                struct hid_input *hi, struct hid_field *field,
+                struct hid_usage *usage, unsigned long **bit, int *max)
+{
+        struct usbhid_device *uhdev;
+        uhdev = (struct usbhid_device *) hdev->driver_data;
+        if (uhdev->ifnum == 1 && usage->hid == (HID_UP_BUTTON | 0x0010)) {
+                map_key_clear(KEY_MICMUTE);
+                return 1;
+        }
+        return 0;
+}
+#undef map_key_clear
+static int tpkbd_features_set(struct hid_device *hdev)
+{
+        struct hid_report *report;
+        struct tpkbd_data_pointer *data_pointer;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        report = hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[4];
+        report->field[0]->value[0]  = data_pointer->press_to_select   ? 0x01 : 0x02;
+        report->field[0]->value[0] |= data_pointer->dragging          ? 0x04 : 0x08;
+        report->field[0]->value[0] |= data_pointer->release_to_select ? 0x10 : 0x20;
+        report->field[0]->value[0] |= data_pointer->select_right      ? 0x80 : 0x40;
+        report->field[1]->value[0] = 0x03; // unknown setting, imitate windows driver
+        report->field[2]->value[0] = data_pointer->sensitivity;
+        report->field[3]->value[0] = data_pointer->press_speed;
+        usbhid_submit_report(hdev, report, USB_DIR_OUT);
+        return 0;
+}
+static ssize_t pointer_press_to_select_show(struct device *dev,
+                struct device_attribute *attr,
+                char *buf)
+{
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        hdev = container_of(dev, struct hid_device, dev);
+        if (hdev == NULL)
+                return -ENODEV;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        return snprintf(buf, PAGE_SIZE, "%u\n", data_pointer->press_to_select);
+}
+static ssize_t pointer_press_to_select_store(struct device *dev,
+                struct device_attribute *attr,
+                const char *buf,
+                size_t count)
+{
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        int value;
+        hdev = container_of(dev, struct hid_device, dev);
+        if (hdev == NULL)
+                return -ENODEV;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        if (kstrtoint(buf, 10, &value))
+                return -EINVAL;
+        if (value < 0 || value > 1)
+                return -EINVAL;
+        data_pointer->press_to_select = value;
+        tpkbd_features_set(hdev);
+        return count;
+}
+static ssize_t pointer_dragging_show(struct device *dev,
+                struct device_attribute *attr,
+                char *buf)
+{
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        hdev = container_of(dev, struct hid_device, dev);
+        if (hdev == NULL)
+                return -ENODEV;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        return snprintf(buf, PAGE_SIZE, "%u\n", data_pointer->dragging);
+}
+static ssize_t pointer_dragging_store(struct device *dev,
+                struct device_attribute *attr,
+                const char *buf,
+                size_t count)
+{
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        int value;
+        hdev = container_of(dev, struct hid_device, dev);
+        if (hdev == NULL)
+                return -ENODEV;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        if (kstrtoint(buf, 10, &value))
+                return -EINVAL;
+        if (value < 0 || value > 1)
+                return -EINVAL;
+        data_pointer->dragging = value;
+        tpkbd_features_set(hdev);
+        return count;
+}
+static ssize_t pointer_release_to_select_show(struct device *dev,
+                struct device_attribute *attr,
+                char *buf)
+{
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        hdev = container_of(dev, struct hid_device, dev);
+        if (hdev == NULL)
+                return -ENODEV;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        return snprintf(buf, PAGE_SIZE, "%u\n", data_pointer->release_to_select);
+}
+static ssize_t pointer_release_to_select_store(struct device *dev,
+                struct device_attribute *attr,
+                const char *buf,
+                size_t count)
+{
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        int value;
+        hdev = container_of(dev, struct hid_device, dev);
+        if (hdev == NULL)
+                return -ENODEV;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        if (kstrtoint(buf, 10, &value))
+                return -EINVAL;
+        if (value < 0 || value > 1)
+                return -EINVAL;
+        data_pointer->release_to_select = value;
+        tpkbd_features_set(hdev);
+        return count;
+}
+static ssize_t pointer_select_right_show(struct device *dev,
+                struct device_attribute *attr,
+                char *buf)
+{
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        hdev = container_of(dev, struct hid_device, dev);
+        if (hdev == NULL)
+                return -ENODEV;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        return snprintf(buf, PAGE_SIZE, "%u\n", data_pointer->select_right);
+}
+static ssize_t pointer_select_right_store(struct device *dev,
+                struct device_attribute *attr,
+                const char *buf,
+                size_t count)
+{
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        int value;
+        hdev = container_of(dev, struct hid_device, dev);
+        if (hdev == NULL)
+                return -ENODEV;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        if (kstrtoint(buf, 10, &value))
+                return -EINVAL;
+        if (value < 0 || value > 1)
+                return -EINVAL;
+        data_pointer->select_right = value;
+        tpkbd_features_set(hdev);
+        return count;
+}
+static ssize_t pointer_sensitivity_show(struct device *dev,
+                struct device_attribute *attr,
+                char *buf)
+{
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        hdev = container_of(dev, struct hid_device, dev);
+        if (hdev == NULL)
+                return -ENODEV;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        return snprintf(buf, PAGE_SIZE, "%u\n",
+                data_pointer->sensitivity);
+}
+static ssize_t pointer_sensitivity_store(struct device *dev,
+                struct device_attribute *attr,
+                const char *buf,
+                size_t count)
+{
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        int value;
+        hdev = container_of(dev, struct hid_device, dev);
+        if (hdev == NULL)
+                return -ENODEV;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        if (kstrtoint(buf, 10, &value) || value < 1 || value > 255)
+                return -EINVAL;
+        data_pointer->sensitivity = value;
+        tpkbd_features_set(hdev);
+        return count;
+}
+static ssize_t pointer_press_speed_show(struct device *dev,
+                struct device_attribute *attr,
+                char *buf)
+{
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        hdev = container_of(dev, struct hid_device, dev);
+        if (hdev == NULL)
+                return -ENODEV;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        return snprintf(buf, PAGE_SIZE, "%u\n",
+                data_pointer->press_speed);
+}
+static ssize_t pointer_press_speed_store(struct device *dev,
+                struct device_attribute *attr,
+                const char *buf,
+                size_t count)
+{
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        int value;
+        hdev = container_of(dev, struct hid_device, dev);
+        if (hdev == NULL)
+                return -ENODEV;
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        if (kstrtoint(buf, 10, &value) || value < 1 || value > 255)
+                return -EINVAL;
+        data_pointer->press_speed = value;
+        tpkbd_features_set(hdev);
+        return count;
+}
+static struct device_attribute dev_attr_pointer_press_to_select =
+        __ATTR(press_to_select, S_IWUSR | S_IRUGO,
+                        pointer_press_to_select_show,
+                        pointer_press_to_select_store);
+static struct device_attribute dev_attr_pointer_dragging =
+        __ATTR(dragging, S_IWUSR | S_IRUGO,
+                        pointer_dragging_show,
+                        pointer_dragging_store);
+static struct device_attribute dev_attr_pointer_release_to_select =
+        __ATTR(release_to_select, S_IWUSR | S_IRUGO,
+                        pointer_release_to_select_show,
+                        pointer_release_to_select_store);
+static struct device_attribute dev_attr_pointer_select_right =
+        __ATTR(select_right, S_IWUSR | S_IRUGO,
+                        pointer_select_right_show,
+                        pointer_select_right_store);
+static struct device_attribute dev_attr_pointer_sensitivity =
+        __ATTR(sensitivity, S_IWUSR | S_IRUGO,
+                        pointer_sensitivity_show,
+                        pointer_sensitivity_store);
+static struct device_attribute dev_attr_pointer_press_speed =
+        __ATTR(press_speed, S_IWUSR | S_IRUGO,
+                        pointer_press_speed_show,
+                        pointer_press_speed_store);
+static struct attribute *tpkbd_attributes_pointer[] = {
+        &dev_attr_pointer_press_to_select.attr,
+        &dev_attr_pointer_dragging.attr,
+        &dev_attr_pointer_release_to_select.attr,
+        &dev_attr_pointer_select_right.attr,
+        &dev_attr_pointer_sensitivity.attr,
+        &dev_attr_pointer_press_speed.attr,
+        NULL
+};
+static const struct attribute_group tpkbd_attr_group_pointer = {
+        .attrs = tpkbd_attributes_pointer,
+};
+static enum led_brightness tpkbd_led_brightness_get(
+                        struct led_classdev *led_cdev)
+{
+        struct device *dev;
+        struct hid_device *hdev;
+        struct tpkbd_data_pointer *data_pointer;
+        int led_nr = 0;
+        dev = led_cdev->dev->parent;
+        hdev = container_of(dev, struct hid_device, dev);
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        if (led_cdev == &data_pointer->led_micmute)
+                led_nr = 1;
+        return data_pointer->led_state & (1 << led_nr)
+                                ? LED_FULL
+                                : LED_OFF;
+}
+static void tpkbd_led_brightness_set(struct led_classdev *led_cdev,
+                        enum led_brightness value)
+{
+        struct device *dev;
+        struct hid_device *hdev;
+        struct hid_report *report;
+        struct tpkbd_data_pointer *data_pointer;
+        int led_nr = 0;
+        dev = led_cdev->dev->parent;
+        hdev = container_of(dev, struct hid_device, dev);
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        if (led_cdev == &data_pointer->led_micmute)
+                led_nr = 1;
+        if (value == LED_OFF)
+                data_pointer->led_state &= ~(1 << led_nr);
+        else
+                data_pointer->led_state |= 1 << led_nr;
+        report = hdev->report_enum[HID_OUTPUT_REPORT].report_id_hash[3];
+        report->field[0]->value[0] = (data_pointer->led_state >> 0) & 1;
+        report->field[0]->value[1] = (data_pointer->led_state >> 1) & 1;
+        usbhid_submit_report(hdev, report, USB_DIR_OUT);
+}
+static int tpkbd_probe_tp(struct hid_device *hdev)
+{
+        struct device *dev = &hdev->dev;
+        struct tpkbd_data_pointer *data_pointer;
+        size_t name_sz = strlen(dev_name(dev)) + 16;
+        char *name_mute, *name_micmute;
+        int ret;
+        if (sysfs_create_group(&hdev->dev.kobj,
+                                &tpkbd_attr_group_pointer)) {
+                hid_warn(hdev, "Could not create sysfs group\n");
+        }
+        data_pointer = kzalloc(sizeof(struct tpkbd_data_pointer), GFP_KERNEL);
+        if (data_pointer == NULL) {
+                hid_err(hdev, "Could not allocate memory for driver data\n");
+                return -ENOMEM;
+        }
+        // set same default values as windows driver
+        data_pointer->sensitivity = 0xa0;
+        data_pointer->press_speed = 0x38;
+        name_mute = kzalloc(name_sz, GFP_KERNEL);
+        if (name_mute == NULL) {
+                hid_err(hdev, "Could not allocate memory for led data\n");
+                ret = -ENOMEM;
+                goto err;
+        }
+        snprintf(name_mute, name_sz, "%s:amber:mute", dev_name(dev));
+        name_micmute = kzalloc(name_sz, GFP_KERNEL);
+        if (name_micmute == NULL) {
+                hid_err(hdev, "Could not allocate memory for led data\n");
+                ret = -ENOMEM;
+                goto err2;
+        }
+        snprintf(name_micmute, name_sz, "%s:amber:micmute", dev_name(dev));
+        hid_set_drvdata(hdev, data_pointer);
+        data_pointer->led_mute.name = name_mute;
+        data_pointer->led_mute.brightness_get = tpkbd_led_brightness_get;
+        data_pointer->led_mute.brightness_set = tpkbd_led_brightness_set;
+        data_pointer->led_mute.dev = dev;
+        led_classdev_register(dev, &data_pointer->led_mute);
+        data_pointer->led_micmute.name = name_micmute;
+        data_pointer->led_micmute.brightness_get = tpkbd_led_brightness_get;
+        data_pointer->led_micmute.brightness_set = tpkbd_led_brightness_set;
+        data_pointer->led_micmute.dev = dev;
+        led_classdev_register(dev, &data_pointer->led_micmute);
+        tpkbd_features_set(hdev);
+        return 0;
+err2:
+        kfree(name_mute);
+err:
+        kfree(data_pointer);
+        return ret;
+}
+static int tpkbd_probe(struct hid_device *hdev,
+                const struct hid_device_id *id)
+{
+        int ret;
+        struct usbhid_device *uhdev;
+        ret = hid_parse(hdev);
+        if (ret) {
+                hid_err(hdev, "hid_parse failed\n");
+                goto err_free;
+        }
+        ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
+        if (ret) {
+                hid_err(hdev, "hid_hw_start failed\n");
+                goto err_free;
+        }
+        uhdev = (struct usbhid_device *) hdev->driver_data;
+        if (uhdev->ifnum == 1)
+                return tpkbd_probe_tp(hdev);
+        return 0;
+err_free:
+        return ret;
+}
+static void tpkbd_remove_tp(struct hid_device *hdev)
+{
+        struct tpkbd_data_pointer *data_pointer;
+        sysfs_remove_group(&hdev->dev.kobj,
+                        &tpkbd_attr_group_pointer);
+        data_pointer = (struct tpkbd_data_pointer *) hid_get_drvdata(hdev);
+        led_classdev_unregister(&data_pointer->led_micmute);
+        led_classdev_unregister(&data_pointer->led_mute);
+        hid_set_drvdata(hdev, NULL);
+        kfree(data_pointer);
+}
+static void tpkbd_remove(struct hid_device *hdev)
+{
+        struct usbhid_device *uhdev;
+        uhdev = (struct usbhid_device *) hdev->driver_data;
+        if (uhdev->ifnum == 1)
+                tpkbd_remove_tp(hdev);
+        hid_hw_stop(hdev);
+}
+static const struct hid_device_id tpkbd_devices[] = {
+        { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPKBD) },
+        { }
+};
+MODULE_DEVICE_TABLE(hid, tpkbd_devices);
+static struct hid_driver tpkbd_driver = {
+        .name = "lenovo_tpkbd",
+        .id_table = tpkbd_devices,
+        .input_mapping = tpkbd_input_mapping,
+        .probe = tpkbd_probe,
+        .remove = tpkbd_remove,
+};
+static int __init tpkbd_init(void)
+{
+        return hid_register_driver(&tpkbd_driver);
+}
+static void __exit tpkbd_exit(void)
+{
+        hid_unregister_driver(&tpkbd_driver);
+}
+module_init(tpkbd_init);
+module_exit(tpkbd_exit);
+MODULE_LICENSE("GPL");
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 6e3332a99976..59c8b5c1d2de 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -83,6 +83,7 @@ struct mt_device {
        unsigned last_field_index;      /* last field index of the report */
        unsigned last_slot_field;       /* the last field of a slot */
        __s8 inputmode;         /* InputMode HID feature, -1 if non-existent */
+        __s8 inputmode_index;   /* InputMode HID feature index in the report */
        __s8 maxcontact_report_id;      /* Maximum Contact Number HID feature,
                                   -1 if non-existent */
        __u8 num_received;      /* how many contacts we received */
@@ -260,10 +261,20 @@ static void mt_feature_mapping(struct hid_device *hdev,
                struct hid_field *field, struct hid_usage *usage)
 {
        struct mt_device *td = hid_get_drvdata(hdev);
+        int i;
        switch (usage->hid) {
        case HID_DG_INPUTMODE:
                td->inputmode = field->report->id;
+                td->inputmode_index = 0; /* has to be updated below */
+                for (i=0; i < field->maxusage; i++) {
+                        if (field->usage[i].hid == usage->hid) {
+                                td->inputmode_index = i;
+                                break;
+                        }
+                }
                break;
        case HID_DG_CONTACTMAX:
                td->maxcontact_report_id = field->report->id;
@@ -618,7 +629,7 @@ static void mt_set_input_mode(struct hid_device *hdev)
        re = &(hdev->report_enum[HID_FEATURE_REPORT]);
        r = re->report_id_hash[td->inputmode];
        if (r) {
-                r->field[0]->value[0] = 0x02;
+                r->field[0]->value[td->inputmode_index] = 0x02;
                usbhid_submit_report(hdev, r, USB_DIR_OUT);
        }
 }
@@ -951,6 +962,11 @@ static const struct hid_device_id mt_devices[] = {
                MT_USB_DEVICE(USB_VENDOR_ID_PANASONIC,
                        USB_DEVICE_ID_PANABOARD_UBT880) },
+        /* Novatek Panel */
+        { .driver_data = MT_CLS_DEFAULT,
+                MT_USB_DEVICE(USB_VENDOR_ID_NOVATEK,
+                        USB_DEVICE_ID_NOVATEK_PCT) },
        /* PenMount panels */
        { .driver_data = MT_CLS_CONFIDENCE,
                MT_USB_DEVICE(USB_VENDOR_ID_PENMOUNT,
@@ -1048,6 +1064,11 @@ static const struct hid_device_id mt_devices[] = {
                MT_USB_DEVICE(USB_VENDOR_ID_XIROKU,
                        USB_DEVICE_ID_XIROKU_CSR2) },
+        /* Zytronic panels */
+        { .driver_data = MT_CLS_SERIAL,
+                MT_USB_DEVICE(USB_VENDOR_ID_ZYTRONIC,
+                        USB_DEVICE_ID_ZYTRONIC_ZXY100) },
        /* Generic MT device */
        { HID_DEVICE(HID_BUS_ANY, HID_GROUP_MULTITOUCH, HID_ANY_ID, HID_ANY_ID) },
        { }
diff --git a/drivers/hid/hid-picolcd.c b/drivers/hid/hid-picolcd.c
index 45c3433f7986..27c8ebdfad01 100644
--- a/drivers/hid/hid-picolcd.c
+++ b/drivers/hid/hid-picolcd.c
@@ -1846,7 +1846,7 @@ static void picolcd_debug_out_report(struct picolcd_data *data,
 #define BUFF_SZ 256
        /* Avoid unnecessary overhead if debugfs is disabled */
-        if (!hdev->debug_events)
+        if (list_empty(&hdev->debug_list))
                return;
        buff = kmalloc(BUFF_SZ, GFP_ATOMIC);
@@ -2613,11 +2613,7 @@ static int picolcd_probe(struct hid_device *hdev,
                goto err_cleanup_data;
        }
-        /* We don't use hidinput but hid_hw_start() fails if nothing is
-         * claimed. So spoof claimed input. */
-        hdev->claimed = HID_CLAIMED_INPUT;
        error = hid_hw_start(hdev, 0);
-        hdev->claimed = 0;
        if (error) {
                hid_err(hdev, "hardware start failed\n");
                goto err_cleanup_data;
diff --git a/drivers/hid/hid-roccat-arvo.c b/drivers/hid/hid-roccat-arvo.c
index 093bfad00b02..327f9b8ed1f4 100644
--- a/drivers/hid/hid-roccat-arvo.c
+++ b/drivers/hid/hid-roccat-arvo.c
@@ -39,7 +39,7 @@ static ssize_t arvo_sysfs_show_mode_key(struct device *dev,
        int retval;
        mutex_lock(&arvo->arvo_lock);
-        retval = roccat_common_receive(usb_dev, ARVO_COMMAND_MODE_KEY,
+        retval = roccat_common2_receive(usb_dev, ARVO_COMMAND_MODE_KEY,
                        &temp_buf, sizeof(struct arvo_mode_key));
        mutex_unlock(&arvo->arvo_lock);
        if (retval)
@@ -67,7 +67,7 @@ static ssize_t arvo_sysfs_set_mode_key(struct device *dev,
        temp_buf.state = state;
        mutex_lock(&arvo->arvo_lock);
-        retval = roccat_common_send(usb_dev, ARVO_COMMAND_MODE_KEY,
+        retval = roccat_common2_send(usb_dev, ARVO_COMMAND_MODE_KEY,
                        &temp_buf, sizeof(struct arvo_mode_key));
        mutex_unlock(&arvo->arvo_lock);
        if (retval)
@@ -87,7 +87,7 @@ static ssize_t arvo_sysfs_show_key_mask(struct device *dev,
        int retval;
        mutex_lock(&arvo->arvo_lock);
-        retval = roccat_common_receive(usb_dev, ARVO_COMMAND_KEY_MASK,
+        retval = roccat_common2_receive(usb_dev, ARVO_COMMAND_KEY_MASK,
                        &temp_buf, sizeof(struct arvo_key_mask));
        mutex_unlock(&arvo->arvo_lock);
        if (retval)
@@ -115,7 +115,7 @@ static ssize_t arvo_sysfs_set_key_mask(struct device *dev,
        temp_buf.key_mask = key_mask;
        mutex_lock(&arvo->arvo_lock);
-        retval = roccat_common_send(usb_dev, ARVO_COMMAND_KEY_MASK,
+        retval = roccat_common2_send(usb_dev, ARVO_COMMAND_KEY_MASK,
                        &temp_buf, sizeof(struct arvo_key_mask));
        mutex_unlock(&arvo->arvo_lock);
        if (retval)
@@ -130,7 +130,7 @@ static int arvo_get_actual_profile(struct usb_device *usb_dev)
        struct arvo_actual_profile temp_buf;
        int retval;
-        retval = roccat_common_receive(usb_dev, ARVO_COMMAND_ACTUAL_PROFILE,
+        retval = roccat_common2_receive(usb_dev, ARVO_COMMAND_ACTUAL_PROFILE,
                        &temp_buf, sizeof(struct arvo_actual_profile));
        if (retval)
@@ -170,7 +170,7 @@ static ssize_t arvo_sysfs_set_actual_profile(struct device *dev,
        temp_buf.actual_profile = profile;
        mutex_lock(&arvo->arvo_lock);
-        retval = roccat_common_send(usb_dev, ARVO_COMMAND_ACTUAL_PROFILE,
+        retval = roccat_common2_send(usb_dev, ARVO_COMMAND_ACTUAL_PROFILE,
                        &temp_buf, sizeof(struct arvo_actual_profile));
        if (!retval) {
                arvo->actual_profile = profile;
@@ -194,7 +194,7 @@ static ssize_t arvo_sysfs_write(struct file *fp,
                return -EINVAL;
        mutex_lock(&arvo->arvo_lock);
-        retval = roccat_common_send(usb_dev, command, buf, real_size);
+        retval = roccat_common2_send(usb_dev, command, buf, real_size);
        mutex_unlock(&arvo->arvo_lock);
        return (retval ? retval : real_size);
@@ -217,7 +217,7 @@ static ssize_t arvo_sysfs_read(struct file *fp,
                return -EINVAL;
        mutex_lock(&arvo->arvo_lock);
-        retval = roccat_common_receive(usb_dev, command, buf, real_size);
+        retval = roccat_common2_receive(usb_dev, command, buf, real_size);
        mutex_unlock(&arvo->arvo_lock);
        return (retval ? retval : real_size);
diff --git a/drivers/hid/hid-roccat-common.c b/drivers/hid/hid-roccat-common.c
index a6d93992c75a..74f704032627 100644
--- a/drivers/hid/hid-roccat-common.c
+++ b/drivers/hid/hid-roccat-common.c
@@ -16,12 +16,12 @@
 #include <linux/module.h>
 #include "hid-roccat-common.h"
-static inline uint16_t roccat_common_feature_report(uint8_t report_id)
+static inline uint16_t roccat_common2_feature_report(uint8_t report_id)
 {
        return 0x300 | report_id;
 }
-int roccat_common_receive(struct usb_device *usb_dev, uint report_id,
+int roccat_common2_receive(struct usb_device *usb_dev, uint report_id,
                void *data, uint size)
 {
        char *buf;
@@ -34,16 +34,16 @@ int roccat_common_receive(struct usb_device *usb_dev, uint report_id,
        len = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
                        HID_REQ_GET_REPORT,
                        USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN,
-                        roccat_common_feature_report(report_id),
+                        roccat_common2_feature_report(report_id),
                        0, buf, size, USB_CTRL_SET_TIMEOUT);
        memcpy(data, buf, size);
        kfree(buf);
        return ((len < 0) ? len : ((len != size) ? -EIO : 0));
 }
-EXPORT_SYMBOL_GPL(roccat_common_receive);
+EXPORT_SYMBOL_GPL(roccat_common2_receive);
-int roccat_common_send(struct usb_device *usb_dev, uint report_id,
+int roccat_common2_send(struct usb_device *usb_dev, uint report_id,
                void const *data, uint size)
 {
        char *buf;
@@ -56,13 +56,71 @@ int roccat_common_send(struct usb_device *usb_dev, uint report_id,
        len = usb_control_msg(usb_dev, usb_sndctrlpipe(usb_dev, 0),
                        HID_REQ_SET_REPORT,
                        USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_OUT,
-                        roccat_common_feature_report(report_id),
+                        roccat_common2_feature_report(report_id),
                        0, buf, size, USB_CTRL_SET_TIMEOUT);
        kfree(buf);
        return ((len < 0) ? len : ((len != size) ? -EIO : 0));
 }
-EXPORT_SYMBOL_GPL(roccat_common_send);
+EXPORT_SYMBOL_GPL(roccat_common2_send);
+enum roccat_common2_control_states {
+        ROCCAT_COMMON_CONTROL_STATUS_OVERLOAD = 0,
+        ROCCAT_COMMON_CONTROL_STATUS_OK = 1,
+        ROCCAT_COMMON_CONTROL_STATUS_INVALID = 2,
+        ROCCAT_COMMON_CONTROL_STATUS_WAIT = 3,
+};
+static int roccat_common2_receive_control_status(struct usb_device *usb_dev)
+{
+        int retval;
+        struct roccat_common2_control control;
+        do {
+                msleep(50);
+                retval = roccat_common2_receive(usb_dev,
+                                ROCCAT_COMMON_COMMAND_CONTROL,
+                                &control, sizeof(struct roccat_common2_control));
+                if (retval)
+                        return retval;
+                switch (control.value) {
+                case ROCCAT_COMMON_CONTROL_STATUS_OK:
+                        return 0;
+                case ROCCAT_COMMON_CONTROL_STATUS_WAIT:
+                        msleep(500);
+                        continue;
+                case ROCCAT_COMMON_CONTROL_STATUS_INVALID:
+                case ROCCAT_COMMON_CONTROL_STATUS_OVERLOAD:
+                        /* seems to be critical - replug necessary */
+                        return -EINVAL;
+                default:
+                        dev_err(&usb_dev->dev,
+                                        "roccat_common2_receive_control_status: "
+                                        "unknown response value 0x%x\n",
+                                        control.value);
+                        return -EINVAL;
+                }
+        } while (1);
+}
+int roccat_common2_send_with_status(struct usb_device *usb_dev,
+                uint command, void const *buf, uint size)
+{
+        int retval;
+        retval = roccat_common2_send(usb_dev, command, buf, size);
+        if (retval)
+                return retval;
+        msleep(100);
+        return roccat_common2_receive_control_status(usb_dev);
+}
+EXPORT_SYMBOL_GPL(roccat_common2_send_with_status);
 MODULE_AUTHOR("Stefan Achatz");
 MODULE_DESCRIPTION("USB Roccat common driver");
diff --git a/drivers/hid/hid-roccat-common.h b/drivers/hid/hid-roccat-common.h
index 9a5bc61f9699..a97746a63b70 100644
--- a/drivers/hid/hid-roccat-common.h
+++ b/drivers/hid/hid-roccat-common.h
@@ -15,9 +15,21 @@
 #include <linux/usb.h>
 #include <linux/types.h>
-int roccat_common_receive(struct usb_device *usb_dev, uint report_id,
+enum roccat_common2_commands {
+        ROCCAT_COMMON_COMMAND_CONTROL = 0x4,
+};
+struct roccat_common2_control {
+        uint8_t command;
+        uint8_t value;
+        uint8_t request; /* always 0 on requesting write check */
+} __packed;
+int roccat_common2_receive(struct usb_device *usb_dev, uint report_id,
                void *data, uint size);
-int roccat_common_send(struct usb_device *usb_dev, uint report_id,
+int roccat_common2_send(struct usb_device *usb_dev, uint report_id,
                void const *data, uint size);
+int roccat_common2_send_with_status(struct usb_device *usb_dev,
+                uint command, void const *buf, uint size);
 #endif
diff --git a/drivers/hid/hid-roccat-isku.c b/drivers/hid/hid-roccat-isku.c
index 0e4a0ab47142..5669916c2943 100644
--- a/drivers/hid/hid-roccat-isku.c
+++ b/drivers/hid/hid-roccat-isku.c
@@ -36,51 +36,7 @@ static void isku_profile_activated(struct isku_device *isku, uint new_profile)
 static int isku_receive(struct usb_device *usb_dev, uint command,
                void *buf, uint size)
 {
-        return roccat_common_receive(usb_dev, command, buf, size);
+        return roccat_common2_receive(usb_dev, command, buf, size);
-}
-static int isku_receive_control_status(struct usb_device *usb_dev)
-{
-        int retval;
-        struct isku_control control;
-        do {
-                msleep(50);
-                retval = isku_receive(usb_dev, ISKU_COMMAND_CONTROL,
-                                &control, sizeof(struct isku_control));
-                if (retval)
-                        return retval;
-                switch (control.value) {
-                case ISKU_CONTROL_VALUE_STATUS_OK:
-                        return 0;
-                case ISKU_CONTROL_VALUE_STATUS_WAIT:
-                        continue;
-                case ISKU_CONTROL_VALUE_STATUS_INVALID:
-                /* seems to be critical - replug necessary */
-                case ISKU_CONTROL_VALUE_STATUS_OVERLOAD:
-                        return -EINVAL;
-                default:
-                        hid_err(usb_dev, "isku_receive_control_status: "
-                                        "unknown response value 0x%x\n",
-                                        control.value);
-                        return -EINVAL;
-                }
-        } while (1);
-}
-static int isku_send(struct usb_device *usb_dev, uint command,
-                void const *buf, uint size)
-{
-        int retval;
-        retval = roccat_common_send(usb_dev, command, buf, size);
-        if (retval)
-                return retval;
-        return isku_receive_control_status(usb_dev);
 }
 static int isku_get_actual_profile(struct usb_device *usb_dev)
@@ -100,7 +56,8 @@ static int isku_set_actual_profile(struct usb_device *usb_dev, int new_profile)
        buf.command = ISKU_COMMAND_ACTUAL_PROFILE;
        buf.size = sizeof(struct isku_actual_profile);
        buf.actual_profile = new_profile;
-        return isku_send(usb_dev, ISKU_COMMAND_ACTUAL_PROFILE, &buf,
+        return roccat_common2_send_with_status(usb_dev,
+                        ISKU_COMMAND_ACTUAL_PROFILE, &buf,
                        sizeof(struct isku_actual_profile));
 }
@@ -197,7 +154,8 @@ static ssize_t isku_sysfs_write(struct file *fp, struct kobject *kobj,
                return -EINVAL;
        mutex_lock(&isku->isku_lock);
-        retval = isku_send(usb_dev, command, (void *)buf, real_size);
+        retval = roccat_common2_send_with_status(usb_dev, command,
+                        (void *)buf, real_size);
        mutex_unlock(&isku->isku_lock);
        return retval ? retval : real_size;
diff --git a/drivers/hid/hid-roccat-isku.h b/drivers/hid/hid-roccat-isku.h
index 075f6efaec58..605b3ce21638 100644
--- a/drivers/hid/hid-roccat-isku.h
+++ b/drivers/hid/hid-roccat-isku.h
@@ -25,13 +25,6 @@ struct isku_control {
        uint8_t request;
 } __packed;
-enum isku_control_values {
-        ISKU_CONTROL_VALUE_STATUS_OVERLOAD = 0,
-        ISKU_CONTROL_VALUE_STATUS_OK = 1,
-        ISKU_CONTROL_VALUE_STATUS_INVALID = 2,
-        ISKU_CONTROL_VALUE_STATUS_WAIT = 3,
-};
 struct isku_actual_profile {
        uint8_t command; /* ISKU_COMMAND_ACTUAL_PROFILE */
        uint8_t size; /* always 3 */
diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
index 40090d602158..9ce2d0b615a4 100644
--- a/drivers/hid/hid-roccat-kone.c
+++ b/drivers/hid/hid-roccat-kone.c
@@ -138,7 +138,7 @@ static int kone_check_write(struct usb_device *usb_dev)
                return 0;
        /* unknown answer */
-        hid_err(usb_dev, "got retval %d when checking write\n", data);
+        dev_err(&usb_dev->dev, "got retval %d when checking write\n", data);
        return -EIO;
 }
@@ -503,7 +503,7 @@ static ssize_t kone_sysfs_set_tcu(struct device *dev,
                retval = kone_set_settings(usb_dev, &kone->settings);
                if (retval) {
-                        hid_err(usb_dev, "couldn't set tcu state\n");
+                        dev_err(&usb_dev->dev, "couldn't set tcu state\n");
                        /*
                         * try to reread valid settings into buffer overwriting
                         * first error code
@@ -519,7 +519,7 @@ static ssize_t kone_sysfs_set_tcu(struct device *dev,
        retval = size;
 exit_no_settings:
-        hid_err(usb_dev, "couldn't read settings\n");
+        dev_err(&usb_dev->dev, "couldn't read settings\n");
 exit_unlock:
        mutex_unlock(&kone->kone_lock);
        return retval;
diff --git a/drivers/hid/hid-roccat-koneplus.c b/drivers/hid/hid-roccat-koneplus.c
index 59e47770fa10..f5602fec4865 100644
--- a/drivers/hid/hid-roccat-koneplus.c
+++ b/drivers/hid/hid-roccat-koneplus.c
@@ -39,88 +39,26 @@ static void koneplus_profile_activated(struct koneplus_device *koneplus,
 static int koneplus_send_control(struct usb_device *usb_dev, uint value,
                enum koneplus_control_requests request)
 {
-        struct koneplus_control control;
+        struct roccat_common2_control control;
        if ((request == KONEPLUS_CONTROL_REQUEST_PROFILE_SETTINGS ||
                        request == KONEPLUS_CONTROL_REQUEST_PROFILE_BUTTONS) &&
                        value > 4)
                return -EINVAL;
-        control.command = KONEPLUS_COMMAND_CONTROL;
+        control.command = ROCCAT_COMMON_COMMAND_CONTROL;
        control.value = value;
        control.request = request;
-        return roccat_common_send(usb_dev, KONEPLUS_COMMAND_CONTROL,
+        return roccat_common2_send_with_status(usb_dev,
-                        &control, sizeof(struct koneplus_control));
+                        ROCCAT_COMMON_COMMAND_CONTROL,
-}
+                        &control, sizeof(struct roccat_common2_control));
-static int koneplus_receive_control_status(struct usb_device *usb_dev)
-{
-        int retval;
-        struct koneplus_control control;
-        do {
-                retval = roccat_common_receive(usb_dev, KONEPLUS_COMMAND_CONTROL,
-                                &control, sizeof(struct koneplus_control));
-                /* check if we get a completely wrong answer */
-                if (retval)
-                        return retval;
-                if (control.value == KONEPLUS_CONTROL_REQUEST_STATUS_OK)
-                        return 0;
-                /* indicates that hardware needs some more time to complete action */
-                if (control.value == KONEPLUS_CONTROL_REQUEST_STATUS_WAIT) {
-                        msleep(500); /* windows driver uses 1000 */
-                        continue;
-                }
-                /* seems to be critical - replug necessary */
-                if (control.value == KONEPLUS_CONTROL_REQUEST_STATUS_OVERLOAD)
-                        return -EINVAL;
-                hid_err(usb_dev, "koneplus_receive_control_status: "
-                                "unknown response value 0x%x\n", control.value);
-                return -EINVAL;
-        } while (1);
-}
-static int koneplus_send(struct usb_device *usb_dev, uint command,
-                void const *buf, uint size)
-{
-        int retval;
-        retval = roccat_common_send(usb_dev, command, buf, size);
-        if (retval)
-                return retval;
-        return koneplus_receive_control_status(usb_dev);
-}
-static int koneplus_select_profile(struct usb_device *usb_dev, uint number,
-                enum koneplus_control_requests request)
-{
-        int retval;
-        retval = koneplus_send_control(usb_dev, number, request);
-        if (retval)
-                return retval;
-        /* allow time to settle things - windows driver uses 500 */
-        msleep(100);
-        retval = koneplus_receive_control_status(usb_dev);
-        if (retval)
-                return retval;
-        return 0;
 }
 static int koneplus_get_info(struct usb_device *usb_dev,
                struct koneplus_info *buf)
 {
-        return roccat_common_receive(usb_dev, KONEPLUS_COMMAND_INFO,
+        return roccat_common2_receive(usb_dev, KONEPLUS_COMMAND_INFO,
                        buf, sizeof(struct koneplus_info));
 }
@@ -129,19 +67,20 @@ static int koneplus_get_profile_settings(struct usb_device *usb_dev,
 {
        int retval;
-        retval = koneplus_select_profile(usb_dev, number,
+        retval = koneplus_send_control(usb_dev, number,
                        KONEPLUS_CONTROL_REQUEST_PROFILE_SETTINGS);
        if (retval)
                return retval;
-        return roccat_common_receive(usb_dev, KONEPLUS_COMMAND_PROFILE_SETTINGS,
+        return roccat_common2_receive(usb_dev, KONEPLUS_COMMAND_PROFILE_SETTINGS,
                        buf, sizeof(struct koneplus_profile_settings));
 }
 static int koneplus_set_profile_settings(struct usb_device *usb_dev,
                struct koneplus_profile_settings const *settings)
 {
-        return koneplus_send(usb_dev, KONEPLUS_COMMAND_PROFILE_SETTINGS,
+        return roccat_common2_send_with_status(usb_dev,
+                        KONEPLUS_COMMAND_PROFILE_SETTINGS,
                        settings, sizeof(struct koneplus_profile_settings));
 }
@@ -150,19 +89,20 @@ static int koneplus_get_profile_buttons(struct usb_device *usb_dev,
 {
        int retval;
-        retval = koneplus_select_profile(usb_dev, number,
+        retval = koneplus_send_control(usb_dev, number,
                        KONEPLUS_CONTROL_REQUEST_PROFILE_BUTTONS);
        if (retval)
                return retval;
-        return roccat_common_receive(usb_dev, KONEPLUS_COMMAND_PROFILE_BUTTONS,
+        return roccat_common2_receive(usb_dev, KONEPLUS_COMMAND_PROFILE_BUTTONS,
                        buf, sizeof(struct koneplus_profile_buttons));
 }
 static int koneplus_set_profile_buttons(struct usb_device *usb_dev,
                struct koneplus_profile_buttons const *buttons)
 {
-        return koneplus_send(usb_dev, KONEPLUS_COMMAND_PROFILE_BUTTONS,
+        return roccat_common2_send_with_status(usb_dev,
+                        KONEPLUS_COMMAND_PROFILE_BUTTONS,
                        buttons, sizeof(struct koneplus_profile_buttons));
 }
@@ -172,7 +112,7 @@ static int koneplus_get_actual_profile(struct usb_device *usb_dev)
        struct koneplus_actual_profile buf;
        int retval;
-        retval = roccat_common_receive(usb_dev, KONEPLUS_COMMAND_ACTUAL_PROFILE,
+        retval = roccat_common2_receive(usb_dev, KONEPLUS_COMMAND_ACTUAL_PROFILE,
                        &buf, sizeof(struct koneplus_actual_profile));
        return retval ? retval : buf.actual_profile;
@@ -187,7 +127,8 @@ static int koneplus_set_actual_profile(struct usb_device *usb_dev,
        buf.size = sizeof(struct koneplus_actual_profile);
        buf.actual_profile = new_profile;
-        return koneplus_send(usb_dev, KONEPLUS_COMMAND_ACTUAL_PROFILE,
+        return roccat_common2_send_with_status(usb_dev,
+                        KONEPLUS_COMMAND_ACTUAL_PROFILE,
                        &buf, sizeof(struct koneplus_actual_profile));
 }
@@ -208,7 +149,7 @@ static ssize_t koneplus_sysfs_read(struct file *fp, struct kobject *kobj,
                return -EINVAL;
        mutex_lock(&koneplus->koneplus_lock);
-        retval = roccat_common_receive(usb_dev, command, buf, real_size);
+        retval = roccat_common2_receive(usb_dev, command, buf, real_size);
        mutex_unlock(&koneplus->koneplus_lock);
        if (retval)
@@ -231,7 +172,8 @@ static ssize_t koneplus_sysfs_write(struct file *fp, struct kobject *kobj,
                return -EINVAL;
        mutex_lock(&koneplus->koneplus_lock);
-        retval = koneplus_send(usb_dev, command, buf, real_size);
+        retval = roccat_common2_send_with_status(usb_dev, command,
+                        buf, real_size);
        mutex_unlock(&koneplus->koneplus_lock);
        if (retval)
diff --git a/drivers/hid/hid-roccat-koneplus.h b/drivers/hid/hid-roccat-koneplus.h
index c03332a4fa9a..7074b2a4b94b 100644
--- a/drivers/hid/hid-roccat-koneplus.h
+++ b/drivers/hid/hid-roccat-koneplus.h
@@ -20,32 +20,11 @@ struct koneplus_talk {
        uint8_t data[14];
 } __packed;
-/*
- * case 1: writes request 80 and reads value 1
- *
- */
-struct koneplus_control {
-        uint8_t command; /* KONEPLUS_COMMAND_CONTROL */
-        /*
-         * value is profile number in range 0-4 for requesting settings and buttons
-         * 1 if status ok for requesting status
-         */
-        uint8_t value;
-        uint8_t request;
-} __attribute__ ((__packed__));
 enum koneplus_control_requests {
-        KONEPLUS_CONTROL_REQUEST_STATUS = 0x00,
        KONEPLUS_CONTROL_REQUEST_PROFILE_SETTINGS = 0x80,
        KONEPLUS_CONTROL_REQUEST_PROFILE_BUTTONS = 0x90,
 };
-enum koneplus_control_values {
-        KONEPLUS_CONTROL_REQUEST_STATUS_OVERLOAD = 0,
-        KONEPLUS_CONTROL_REQUEST_STATUS_OK = 1,
-        KONEPLUS_CONTROL_REQUEST_STATUS_WAIT = 3,
-};
 struct koneplus_actual_profile {
        uint8_t command; /* KONEPLUS_COMMAND_ACTUAL_PROFILE */
        uint8_t size; /* always 3 */
@@ -137,7 +116,6 @@ struct koneplus_tcu_image {
 } __attribute__ ((__packed__));
 enum koneplus_commands {
-        KONEPLUS_COMMAND_CONTROL = 0x4,
        KONEPLUS_COMMAND_ACTUAL_PROFILE = 0x5,
        KONEPLUS_COMMAND_PROFILE_SETTINGS = 0x6,
        KONEPLUS_COMMAND_PROFILE_BUTTONS = 0x7,
diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
index 112d934132c8..ca6527ac655d 100644
--- a/drivers/hid/hid-roccat-kovaplus.c
+++ b/drivers/hid/hid-roccat-kovaplus.c
@@ -47,69 +47,23 @@ static int kovaplus_send_control(struct usb_device *usb_dev, uint value,
                enum kovaplus_control_requests request)
 {
        int retval;
-        struct kovaplus_control control;
+        struct roccat_common2_control control;
        if ((request == KOVAPLUS_CONTROL_REQUEST_PROFILE_SETTINGS ||
                        request == KOVAPLUS_CONTROL_REQUEST_PROFILE_BUTTONS) &&
                        value > 4)
                return -EINVAL;
-        control.command = KOVAPLUS_COMMAND_CONTROL;
+        control.command = ROCCAT_COMMON_COMMAND_CONTROL;
        control.value = value;
        control.request = request;
-        retval = roccat_common_send(usb_dev, KOVAPLUS_COMMAND_CONTROL,
+        retval = roccat_common2_send(usb_dev, ROCCAT_COMMON_COMMAND_CONTROL,
-                        &control, sizeof(struct kovaplus_control));
+                        &control, sizeof(struct roccat_common2_control));
        return retval;
 }
-static int kovaplus_receive_control_status(struct usb_device *usb_dev)
-{
-        int retval;
-        struct kovaplus_control control;
-        do {
-                retval = roccat_common_receive(usb_dev, KOVAPLUS_COMMAND_CONTROL,
-                                &control, sizeof(struct kovaplus_control));
-                /* check if we get a completely wrong answer */
-                if (retval)
-                        return retval;
-                if (control.value == KOVAPLUS_CONTROL_REQUEST_STATUS_OK)
-                        return 0;
-                /* indicates that hardware needs some more time to complete action */
-                if (control.value == KOVAPLUS_CONTROL_REQUEST_STATUS_WAIT) {
-                        msleep(500); /* windows driver uses 1000 */
-                        continue;
-                }
-                /* seems to be critical - replug necessary */
-                if (control.value == KOVAPLUS_CONTROL_REQUEST_STATUS_OVERLOAD)
-                        return -EINVAL;
-                hid_err(usb_dev, "roccat_common_receive_control_status: "
-                                "unknown response value 0x%x\n", control.value);
-                return -EINVAL;
-        } while (1);
-}
-static int kovaplus_send(struct usb_device *usb_dev, uint command,
-                void const *buf, uint size)
-{
-        int retval;
-        retval = roccat_common_send(usb_dev, command, buf, size);
-        if (retval)
-                return retval;
-        msleep(100);
-        return kovaplus_receive_control_status(usb_dev);
-}
 static int kovaplus_select_profile(struct usb_device *usb_dev, uint number,
                enum kovaplus_control_requests request)
 {
@@ -119,7 +73,7 @@ static int kovaplus_select_profile(struct usb_device *usb_dev, uint number,
 static int kovaplus_get_info(struct usb_device *usb_dev,
                struct kovaplus_info *buf)
 {
-        return roccat_common_receive(usb_dev, KOVAPLUS_COMMAND_INFO,
+        return roccat_common2_receive(usb_dev, KOVAPLUS_COMMAND_INFO,
                        buf, sizeof(struct kovaplus_info));
 }
@@ -133,14 +87,15 @@ static int kovaplus_get_profile_settings(struct usb_device *usb_dev,
        if (retval)
                return retval;
-        return roccat_common_receive(usb_dev, KOVAPLUS_COMMAND_PROFILE_SETTINGS,
+        return roccat_common2_receive(usb_dev, KOVAPLUS_COMMAND_PROFILE_SETTINGS,
                        buf, sizeof(struct kovaplus_profile_settings));
 }
 static int kovaplus_set_profile_settings(struct usb_device *usb_dev,
                struct kovaplus_profile_settings const *settings)
 {
-        return kovaplus_send(usb_dev, KOVAPLUS_COMMAND_PROFILE_SETTINGS,
+        return roccat_common2_send_with_status(usb_dev,
+                        KOVAPLUS_COMMAND_PROFILE_SETTINGS,
                        settings, sizeof(struct kovaplus_profile_settings));
 }
@@ -154,14 +109,15 @@ static int kovaplus_get_profile_buttons(struct usb_device *usb_dev,
        if (retval)
                return retval;
-        return roccat_common_receive(usb_dev, KOVAPLUS_COMMAND_PROFILE_BUTTONS,
+        return roccat_common2_receive(usb_dev, KOVAPLUS_COMMAND_PROFILE_BUTTONS,
                        buf, sizeof(struct kovaplus_profile_buttons));
 }
 static int kovaplus_set_profile_buttons(struct usb_device *usb_dev,
                struct kovaplus_profile_buttons const *buttons)
 {
-        return kovaplus_send(usb_dev, KOVAPLUS_COMMAND_PROFILE_BUTTONS,
+        return roccat_common2_send_with_status(usb_dev,
+                        KOVAPLUS_COMMAND_PROFILE_BUTTONS,
                        buttons, sizeof(struct kovaplus_profile_buttons));
 }
@@ -171,7 +127,7 @@ static int kovaplus_get_actual_profile(struct usb_device *usb_dev)
        struct kovaplus_actual_profile buf;
        int retval;
-        retval = roccat_common_receive(usb_dev, KOVAPLUS_COMMAND_ACTUAL_PROFILE,
+        retval = roccat_common2_receive(usb_dev, KOVAPLUS_COMMAND_ACTUAL_PROFILE,
                        &buf, sizeof(struct kovaplus_actual_profile));
        return retval ? retval : buf.actual_profile;
@@ -186,7 +142,8 @@ static int kovaplus_set_actual_profile(struct usb_device *usb_dev,
        buf.size = sizeof(struct kovaplus_actual_profile);
        buf.actual_profile = new_profile;
-        return kovaplus_send(usb_dev, KOVAPLUS_COMMAND_ACTUAL_PROFILE,
+        return roccat_common2_send_with_status(usb_dev,
+                        KOVAPLUS_COMMAND_ACTUAL_PROFILE,
                        &buf, sizeof(struct kovaplus_actual_profile));
 }
diff --git a/drivers/hid/hid-roccat-kovaplus.h b/drivers/hid/hid-roccat-kovaplus.h
index fb2aed44a8e0..f82daa1cdcb9 100644
--- a/drivers/hid/hid-roccat-kovaplus.h
+++ b/drivers/hid/hid-roccat-kovaplus.h
@@ -14,27 +14,13 @@
 #include <linux/types.h>
-struct kovaplus_control {
-        uint8_t command; /* KOVAPLUS_COMMAND_CONTROL */
-        uint8_t value;
-        uint8_t request;
-} __packed;
 enum kovaplus_control_requests {
-        /* read after write; value = 1 */
-        KOVAPLUS_CONTROL_REQUEST_STATUS = 0x0,
        /* write; value = profile number range 0-4 */
        KOVAPLUS_CONTROL_REQUEST_PROFILE_SETTINGS = 0x10,
        /* write; value = profile number range 0-4 */
        KOVAPLUS_CONTROL_REQUEST_PROFILE_BUTTONS = 0x20,
 };
-enum kovaplus_control_values {
-        KOVAPLUS_CONTROL_REQUEST_STATUS_OVERLOAD = 0, /* supposed */
-        KOVAPLUS_CONTROL_REQUEST_STATUS_OK = 1,
-        KOVAPLUS_CONTROL_REQUEST_STATUS_WAIT = 3, /* supposed */
-};
 struct kovaplus_actual_profile {
        uint8_t command; /* KOVAPLUS_COMMAND_ACTUAL_PROFILE */
        uint8_t size; /* always 3 */
@@ -75,7 +61,6 @@ struct kovaplus_a {
 } __packed;
 enum kovaplus_commands {
-        KOVAPLUS_COMMAND_CONTROL = 0x4,
        KOVAPLUS_COMMAND_ACTUAL_PROFILE = 0x5,
        KOVAPLUS_COMMAND_PROFILE_SETTINGS = 0x6,
        KOVAPLUS_COMMAND_PROFILE_BUTTONS = 0x7,
diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c
index df05c1b1064f..1317c177a3e2 100644
--- a/drivers/hid/hid-roccat-pyra.c
+++ b/drivers/hid/hid-roccat-pyra.c
@@ -42,43 +42,19 @@ static void profile_activated(struct pyra_device *pyra,
 static int pyra_send_control(struct usb_device *usb_dev, int value,
                enum pyra_control_requests request)
 {
-        struct pyra_control control;
+        struct roccat_common2_control control;
        if ((request == PYRA_CONTROL_REQUEST_PROFILE_SETTINGS ||
                        request == PYRA_CONTROL_REQUEST_PROFILE_BUTTONS) &&
                        (value < 0 || value > 4))
                return -EINVAL;
-        control.command = PYRA_COMMAND_CONTROL;
+        control.command = ROCCAT_COMMON_COMMAND_CONTROL;
        control.value = value;
        control.request = request;
-        return roccat_common_send(usb_dev, PYRA_COMMAND_CONTROL,
+        return roccat_common2_send(usb_dev, ROCCAT_COMMON_COMMAND_CONTROL,
-                        &control, sizeof(struct pyra_control));
+                        &control, sizeof(struct roccat_common2_control));
-}
-static int pyra_receive_control_status(struct usb_device *usb_dev)
-{
-        int retval;
-        struct pyra_control control;
-        do {
-                msleep(10);
-                retval = roccat_common_receive(usb_dev, PYRA_COMMAND_CONTROL,
-                                &control, sizeof(struct pyra_control));
-                /* requested too early, try again */
-        } while (retval == -EPROTO);
-        if (!retval && control.command == PYRA_COMMAND_CONTROL &&
-                        control.request == PYRA_CONTROL_REQUEST_STATUS &&
-                        control.value == 1)
-                return 0;
-        else {
-                hid_err(usb_dev, "receive control status: unknown response 0x%x 0x%x\n",
-                        control.request, control.value);
-                return retval ? retval : -EINVAL;
-        }
 }
 static int pyra_get_profile_settings(struct usb_device *usb_dev,
@@ -89,7 +65,7 @@ static int pyra_get_profile_settings(struct usb_device *usb_dev,
                        PYRA_CONTROL_REQUEST_PROFILE_SETTINGS);
        if (retval)
                return retval;
-        return roccat_common_receive(usb_dev, PYRA_COMMAND_PROFILE_SETTINGS,
+        return roccat_common2_receive(usb_dev, PYRA_COMMAND_PROFILE_SETTINGS,
                        buf, sizeof(struct pyra_profile_settings));
 }
@@ -101,51 +77,44 @@ static int pyra_get_profile_buttons(struct usb_device *usb_dev,
                        PYRA_CONTROL_REQUEST_PROFILE_BUTTONS);
        if (retval)
                return retval;
-        return roccat_common_receive(usb_dev, PYRA_COMMAND_PROFILE_BUTTONS,
+        return roccat_common2_receive(usb_dev, PYRA_COMMAND_PROFILE_BUTTONS,
                        buf, sizeof(struct pyra_profile_buttons));
 }
 static int pyra_get_settings(struct usb_device *usb_dev,
                struct pyra_settings *buf)
 {
-        return roccat_common_receive(usb_dev, PYRA_COMMAND_SETTINGS,
+        return roccat_common2_receive(usb_dev, PYRA_COMMAND_SETTINGS,
                        buf, sizeof(struct pyra_settings));
 }
 static int pyra_get_info(struct usb_device *usb_dev, struct pyra_info *buf)
 {
-        return roccat_common_receive(usb_dev, PYRA_COMMAND_INFO,
+        return roccat_common2_receive(usb_dev, PYRA_COMMAND_INFO,
                        buf, sizeof(struct pyra_info));
 }
-static int pyra_send(struct usb_device *usb_dev, uint command,
-                void const *buf, uint size)
-{
-        int retval;
-        retval = roccat_common_send(usb_dev, command, buf, size);
-        if (retval)
-                return retval;
-        return pyra_receive_control_status(usb_dev);
-}
 static int pyra_set_profile_settings(struct usb_device *usb_dev,
                struct pyra_profile_settings const *settings)
 {
-        return pyra_send(usb_dev, PYRA_COMMAND_PROFILE_SETTINGS, settings,
+        return roccat_common2_send_with_status(usb_dev,
+                        PYRA_COMMAND_PROFILE_SETTINGS, settings,
                        sizeof(struct pyra_profile_settings));
 }
 static int pyra_set_profile_buttons(struct usb_device *usb_dev,
                struct pyra_profile_buttons const *buttons)
 {
-        return pyra_send(usb_dev, PYRA_COMMAND_PROFILE_BUTTONS, buttons,
+        return roccat_common2_send_with_status(usb_dev,
+                        PYRA_COMMAND_PROFILE_BUTTONS, buttons,
                        sizeof(struct pyra_profile_buttons));
 }
 static int pyra_set_settings(struct usb_device *usb_dev,
                struct pyra_settings const *settings)
 {
-        return pyra_send(usb_dev, PYRA_COMMAND_SETTINGS, settings,
+        return roccat_common2_send_with_status(usb_dev,
+                        PYRA_COMMAND_SETTINGS, settings,
                        sizeof(struct pyra_settings));
 }
diff --git a/drivers/hid/hid-roccat-pyra.h b/drivers/hid/hid-roccat-pyra.h
index 0442d7fa2dcf..eada7830fa99 100644
--- a/drivers/hid/hid-roccat-pyra.h
+++ b/drivers/hid/hid-roccat-pyra.h
@@ -20,18 +20,7 @@ struct pyra_b {
        uint8_t unknown; /* 1 */
 } __attribute__ ((__packed__));
-struct pyra_control {
-        uint8_t command; /* PYRA_COMMAND_CONTROL */
-        /*
-         * value is profile number for request_settings and request_buttons
-         * 1 if status ok for request_status
-         */
-        uint8_t value; /* Range 0-4 */
-        uint8_t request;
-} __attribute__ ((__packed__));
 enum pyra_control_requests {
-        PYRA_CONTROL_REQUEST_STATUS = 0x00,
        PYRA_CONTROL_REQUEST_PROFILE_SETTINGS = 0x10,
        PYRA_CONTROL_REQUEST_PROFILE_BUTTONS = 0x20
 };
@@ -75,7 +64,6 @@ struct pyra_info {
 } __attribute__ ((__packed__));
 enum pyra_commands {
-        PYRA_COMMAND_CONTROL = 0x4,
        PYRA_COMMAND_SETTINGS = 0x5,
        PYRA_COMMAND_PROFILE_SETTINGS = 0x6,
        PYRA_COMMAND_PROFILE_BUTTONS = 0x7,
diff --git a/drivers/hid/hid-roccat-savu.c b/drivers/hid/hid-roccat-savu.c
new file mode 100644
index 000000000000..014afba407e0
--- /dev/null
+++ b/drivers/hid/hid-roccat-savu.c
@@ -0,0 +1,316 @@
+/*
+ * Roccat Savu driver for Linux
+ *
+ * Copyright (c) 2012 Stefan Achatz <erazor_de@users.sourceforge.net>
+ */
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+/* Roccat Savu is a gamer mouse with macro keys that can be configured in
+ * 5 profiles.
+ */
+#include <linux/device.h>
+#include <linux/input.h>
+#include <linux/hid.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/hid-roccat.h>
+#include "hid-ids.h"
+#include "hid-roccat-common.h"
+#include "hid-roccat-savu.h"
+static struct class *savu_class;
+static ssize_t savu_sysfs_read(struct file *fp, struct kobject *kobj,
+                char *buf, loff_t off, size_t count,
+                size_t real_size, uint command)
+{
+        struct device *dev =
+                        container_of(kobj, struct device, kobj)->parent->parent;
+        struct savu_device *savu = hid_get_drvdata(dev_get_drvdata(dev));
+        struct usb_device *usb_dev = interface_to_usbdev(to_usb_interface(dev));
+        int retval;
+        if (off >= real_size)
+                return 0;
+        if (off != 0 || count != real_size)
+                return -EINVAL;
+        mutex_lock(&savu->savu_lock);
+        retval = roccat_common2_receive(usb_dev, command, buf, real_size);
+        mutex_unlock(&savu->savu_lock);
+        return retval ? retval : real_size;
+}
+static ssize_t savu_sysfs_write(struct file *fp, struct kobject *kobj,
+                void const *buf, loff_t off, size_t count,
+                size_t real_size, uint command)
+{
+        struct device *dev =
+                        container_of(kobj, struct device, kobj)->parent->parent;
+        struct savu_device *savu = hid_get_drvdata(dev_get_drvdata(dev));
+        struct usb_device *usb_dev = interface_to_usbdev(to_usb_interface(dev));
+        int retval;
+        if (off != 0 || count != real_size)
+                return -EINVAL;
+        mutex_lock(&savu->savu_lock);
+        retval = roccat_common2_send_with_status(usb_dev, command,
+                        (void *)buf, real_size);
+        mutex_unlock(&savu->savu_lock);
+        return retval ? retval : real_size;
+}
+#define SAVU_SYSFS_W(thingy, THINGY) \
+static ssize_t savu_sysfs_write_ ## thingy(struct file *fp, \
+                struct kobject *kobj, struct bin_attribute *attr, char *buf, \
+                loff_t off, size_t count) \
+{ \
+        return savu_sysfs_write(fp, kobj, buf, off, count, \
+                        SAVU_SIZE_ ## THINGY, SAVU_COMMAND_ ## THINGY); \
+}
+#define SAVU_SYSFS_R(thingy, THINGY) \
+static ssize_t savu_sysfs_read_ ## thingy(struct file *fp, \
+                struct kobject *kobj, struct bin_attribute *attr, char *buf, \
+                loff_t off, size_t count) \
+{ \
+        return savu_sysfs_read(fp, kobj, buf, off, count, \
+                        SAVU_SIZE_ ## THINGY, SAVU_COMMAND_ ## THINGY); \
+}
+#define SAVU_SYSFS_RW(thingy, THINGY) \
+SAVU_SYSFS_W(thingy, THINGY) \
+SAVU_SYSFS_R(thingy, THINGY)
+#define SAVU_BIN_ATTRIBUTE_RW(thingy, THINGY) \
+{ \
+        .attr = { .name = #thingy, .mode = 0660 }, \
+        .size = SAVU_SIZE_ ## THINGY, \
+        .read = savu_sysfs_read_ ## thingy, \
+        .write = savu_sysfs_write_ ## thingy \
+}
+#define SAVU_BIN_ATTRIBUTE_R(thingy, THINGY) \
+{ \
+        .attr = { .name = #thingy, .mode = 0440 }, \
+        .size = SAVU_SIZE_ ## THINGY, \
+        .read = savu_sysfs_read_ ## thingy, \
+}
+#define SAVU_BIN_ATTRIBUTE_W(thingy, THINGY) \
+{ \
+        .attr = { .name = #thingy, .mode = 0220 }, \
+        .size = SAVU_SIZE_ ## THINGY, \
+        .write = savu_sysfs_write_ ## thingy \
+}
+SAVU_SYSFS_W(control, CONTROL)
+SAVU_SYSFS_RW(profile, PROFILE)
+SAVU_SYSFS_RW(general, GENERAL)
+SAVU_SYSFS_RW(buttons, BUTTONS)
+SAVU_SYSFS_RW(macro, MACRO)
+SAVU_SYSFS_R(info, INFO)
+SAVU_SYSFS_RW(sensor, SENSOR)
+static struct bin_attribute savu_bin_attributes[] = {
+        SAVU_BIN_ATTRIBUTE_W(control, CONTROL),
+        SAVU_BIN_ATTRIBUTE_RW(profile, PROFILE),
+        SAVU_BIN_ATTRIBUTE_RW(general, GENERAL),
+        SAVU_BIN_ATTRIBUTE_RW(buttons, BUTTONS),
+        SAVU_BIN_ATTRIBUTE_RW(macro, MACRO),
+        SAVU_BIN_ATTRIBUTE_R(info, INFO),
+        SAVU_BIN_ATTRIBUTE_RW(sensor, SENSOR),
+        __ATTR_NULL
+};
+static int savu_init_savu_device_struct(struct usb_device *usb_dev,
+                struct savu_device *savu)
+{
+        mutex_init(&savu->savu_lock);
+        return 0;
+}
+static int savu_init_specials(struct hid_device *hdev)
+{
+        struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+        struct usb_device *usb_dev = interface_to_usbdev(intf);
+        struct savu_device *savu;
+        int retval;
+        if (intf->cur_altsetting->desc.bInterfaceProtocol
+                        != USB_INTERFACE_PROTOCOL_MOUSE) {
+                hid_set_drvdata(hdev, NULL);
+                return 0;
+        }
+        savu = kzalloc(sizeof(*savu), GFP_KERNEL);
+        if (!savu) {
+                hid_err(hdev, "can't alloc device descriptor\n");
+                return -ENOMEM;
+        }
+        hid_set_drvdata(hdev, savu);
+        retval = savu_init_savu_device_struct(usb_dev, savu);
+        if (retval) {
+                hid_err(hdev, "couldn't init struct savu_device\n");
+                goto exit_free;
+        }
+        retval = roccat_connect(savu_class, hdev,
+                        sizeof(struct savu_roccat_report));
+        if (retval < 0) {
+                hid_err(hdev, "couldn't init char dev\n");
+        } else {
+                savu->chrdev_minor = retval;
+                savu->roccat_claimed = 1;
+        }
+        return 0;
+exit_free:
+        kfree(savu);
+        return retval;
+}
+static void savu_remove_specials(struct hid_device *hdev)
+{
+        struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+        struct savu_device *savu;
+        if (intf->cur_altsetting->desc.bInterfaceProtocol
+                        != USB_INTERFACE_PROTOCOL_MOUSE)
+                return;
+        savu = hid_get_drvdata(hdev);
+        if (savu->roccat_claimed)
+                roccat_disconnect(savu->chrdev_minor);
+        kfree(savu);
+}
+static int savu_probe(struct hid_device *hdev,
+                const struct hid_device_id *id)
+{
+        int retval;
+        retval = hid_parse(hdev);
+        if (retval) {
+                hid_err(hdev, "parse failed\n");
+                goto exit;
+        }
+        retval = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
+        if (retval) {
+                hid_err(hdev, "hw start failed\n");
+                goto exit;
+        }
+        retval = savu_init_specials(hdev);
+        if (retval) {
+                hid_err(hdev, "couldn't install mouse\n");
+                goto exit_stop;
+        }
+        return 0;
+exit_stop:
+        hid_hw_stop(hdev);
+exit:
+        return retval;
+}
+static void savu_remove(struct hid_device *hdev)
+{
+        savu_remove_specials(hdev);
+        hid_hw_stop(hdev);
+}
+static void savu_report_to_chrdev(struct savu_device const *savu,
+                u8 const *data)
+{
+        struct savu_roccat_report roccat_report;
+        struct savu_mouse_report_special const *special_report;
+        if (data[0] != SAVU_MOUSE_REPORT_NUMBER_SPECIAL)
+                return;
+        special_report = (struct savu_mouse_report_special const *)data;
+        roccat_report.type = special_report->type;
+        roccat_report.data[0] = special_report->data[0];
+        roccat_report.data[1] = special_report->data[1];
+        roccat_report_event(savu->chrdev_minor,
+                        (uint8_t const *)&roccat_report);
+}
+static int savu_raw_event(struct hid_device *hdev,
+                struct hid_report *report, u8 *data, int size)
+{
+        struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+        struct savu_device *savu = hid_get_drvdata(hdev);
+        if (intf->cur_altsetting->desc.bInterfaceProtocol
+                        != USB_INTERFACE_PROTOCOL_MOUSE)
+                return 0;
+        if (savu == NULL)
+                return 0;
+        if (savu->roccat_claimed)
+                savu_report_to_chrdev(savu, data);
+        return 0;
+}
+static const struct hid_device_id savu_devices[] = {
+        { HID_USB_DEVICE(USB_VENDOR_ID_ROCCAT, USB_DEVICE_ID_ROCCAT_SAVU) },
+        { }
+};
+MODULE_DEVICE_TABLE(hid, savu_devices);
+static struct hid_driver savu_driver = {
+                .name = "savu",
+                .id_table = savu_devices,
+                .probe = savu_probe,
+                .remove = savu_remove,
+                .raw_event = savu_raw_event
+};
+static int __init savu_init(void)
+{
+        int retval;
+        savu_class = class_create(THIS_MODULE, "savu");
+        if (IS_ERR(savu_class))
+                return PTR_ERR(savu_class);
+        savu_class->dev_bin_attrs = savu_bin_attributes;
+        retval = hid_register_driver(&savu_driver);
+        if (retval)
+                class_destroy(savu_class);
+        return retval;
+}
+static void __exit savu_exit(void)
+{
+        hid_unregister_driver(&savu_driver);
+        class_destroy(savu_class);
+}
+module_init(savu_init);
+module_exit(savu_exit);
+MODULE_AUTHOR("Stefan Achatz");
+MODULE_DESCRIPTION("USB Roccat Savu driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/hid/hid-roccat-savu.h b/drivers/hid/hid-roccat-savu.h
new file mode 100644
index 000000000000..9120ba72087f
--- /dev/null
+++ b/drivers/hid/hid-roccat-savu.h
@@ -0,0 +1,87 @@
+#ifndef __HID_ROCCAT_SAVU_H
+#define __HID_ROCCAT_SAVU_H
+/*
+ * Copyright (c) 2012 Stefan Achatz <erazor_de@users.sourceforge.net>
+ */
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+#include <linux/types.h>
+enum {
+        SAVU_SIZE_CONTROL = 0x03,
+        SAVU_SIZE_PROFILE = 0x03,
+        SAVU_SIZE_GENERAL = 0x10,
+        SAVU_SIZE_BUTTONS = 0x2f,
+        SAVU_SIZE_MACRO = 0x0823,
+        SAVU_SIZE_INFO = 0x08,
+        SAVU_SIZE_SENSOR = 0x04,
+};
+enum savu_control_requests {
+        SAVU_CONTROL_REQUEST_GENERAL = 0x80,
+        SAVU_CONTROL_REQUEST_BUTTONS = 0x90,
+};
+enum savu_commands {
+        SAVU_COMMAND_CONTROL = 0x4,
+        SAVU_COMMAND_PROFILE = 0x5,
+        SAVU_COMMAND_GENERAL = 0x6,
+        SAVU_COMMAND_BUTTONS = 0x7,
+        SAVU_COMMAND_MACRO = 0x8,
+        SAVU_COMMAND_INFO = 0x9,
+        SAVU_COMMAND_SENSOR = 0xc,
+};
+struct savu_mouse_report_special {
+        uint8_t report_number; /* always 3 */
+        uint8_t zero;
+        uint8_t type;
+        uint8_t data[2];
+} __packed;
+enum {
+        SAVU_MOUSE_REPORT_NUMBER_SPECIAL = 3,
+};
+enum savu_mouse_report_button_types {
+        /* data1 = new profile range 1-5 */
+        SAVU_MOUSE_REPORT_BUTTON_TYPE_PROFILE = 0x20,
+        /* data1 = button number range 1-24; data2 = action */
+        SAVU_MOUSE_REPORT_BUTTON_TYPE_QUICKLAUNCH = 0x60,
+        /* data1 = button number range 1-24; data2 = action */
+        SAVU_MOUSE_REPORT_BUTTON_TYPE_TIMER = 0x80,
+        /* data1 = setting number range 1-5 */
+        SAVU_MOUSE_REPORT_BUTTON_TYPE_CPI = 0xb0,
+        /* data1 and data2 = range 0x1-0xb */
+        SAVU_MOUSE_REPORT_BUTTON_TYPE_SENSITIVITY = 0xc0,
+        /* data1 = 22 = next track...
+         * data2 = action
+         */
+        SAVU_MOUSE_REPORT_BUTTON_TYPE_MULTIMEDIA = 0xf0,
+};
+struct savu_roccat_report {
+        uint8_t type;
+        uint8_t data[2];
+} __packed;
+struct savu_device {
+        int roccat_claimed;
+        int chrdev_minor;
+        struct mutex savu_lock;
+};
+#endif
diff --git a/drivers/hid/hid-wiimote-ext.c b/drivers/hid/hid-wiimote-ext.c
index aa958706c0e5..0a1805c9b0e5 100644
--- a/drivers/hid/hid-wiimote-ext.c
+++ b/drivers/hid/hid-wiimote-ext.c
@@ -77,7 +77,7 @@ static __u16 wiiext_keymap[] = {
        BTN_TR,         /* WIIEXT_KEY_RT */
 };
-/* diable all extensions */
+/* disable all extensions */
 static void ext_disable(struct wiimote_ext *ext)
 {
        unsigned long flags;
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 36fa77b40ffb..3b6f7bf5a77e 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -96,6 +96,7 @@ static ssize_t hidraw_read(struct file *file, char __user *buffer, size_t count,
                }
                kfree(list->buffer[list->tail].value);
+                list->buffer[list->tail].value = NULL;
                list->tail = (list->tail + 1) & (HIDRAW_BUFFER_SIZE - 1);
        }
 out:
@@ -300,6 +301,7 @@ static int hidraw_release(struct inode * inode, struct file * file)
        struct hidraw *dev;
        struct hidraw_list *list = file->private_data;
        int ret;
+        int i;
        mutex_lock(&minors_lock);
        if (!hidraw_table[minor]) {
@@ -317,6 +319,9 @@ static int hidraw_release(struct inode * inode, struct file * file)
                        kfree(list->hidraw);
                }
        }
+        for (i = 0; i < HIDRAW_BUFFER_SIZE; ++i)
+                kfree(list->buffer[i].value);
        kfree(list);
        ret = 0;
 unlock:
@@ -446,12 +451,17 @@ int hidraw_report_event(struct hid_device *hid, u8 *data, int len)
        int ret = 0;
        list_for_each_entry(list, &dev->list, node) {
+                int new_head = (list->head + 1) & (HIDRAW_BUFFER_SIZE - 1);
+                if (new_head == list->tail)
+                        continue;
                if (!(list->buffer[list->head].value = kmemdup(data, len, GFP_ATOMIC))) {
                        ret = -ENOMEM;
                        break;
                }
                list->buffer[list->head].len = len;
-                list->head = (list->head + 1) & (HIDRAW_BUFFER_SIZE - 1);
+                list->head = new_head;
                kill_fasync(&list->fasync, SIGIO, POLL_IN);
        }
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 482f936fc29b..dedd8e4e5c6d 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -84,7 +84,7 @@ static int hid_start_in(struct hid_device *hid)
        spin_lock_irqsave(&usbhid->lock, flags);
        if (hid->open > 0 &&
                        !test_bit(HID_DISCONNECTED, &usbhid->iofl) &&
-                        !test_bit(HID_REPORTED_IDLE, &usbhid->iofl) &&
+                        !test_bit(HID_SUSPENDED, &usbhid->iofl) &&
                        !test_and_set_bit(HID_IN_RUNNING, &usbhid->iofl)) {
                rc = usb_submit_urb(usbhid->urbin, GFP_ATOMIC);
                if (rc != 0) {
@@ -207,15 +207,27 @@ static int usbhid_restart_out_queue(struct usbhid_device *usbhid)
        int kicked;
        int r;
-        if (!hid)
+        if (!hid || test_bit(HID_RESET_PENDING, &usbhid->iofl) ||
+                        test_bit(HID_SUSPENDED, &usbhid->iofl))
                return 0;
        if ((kicked = (usbhid->outhead != usbhid->outtail))) {
                hid_dbg(hid, "Kicking head %d tail %d", usbhid->outhead, usbhid->outtail);
+                /* Try to wake up from autosuspend... */
                r = usb_autopm_get_interface_async(usbhid->intf);
                if (r < 0)
                        return r;
+                /*
+                 * If still suspended, don't submit.  Submission will
+                 * occur if/when resume drains the queue.
+                 */
+                if (test_bit(HID_SUSPENDED, &usbhid->iofl)) {
+                        usb_autopm_put_interface_no_suspend(usbhid->intf);
+                        return r;
+                }
                /* Asynchronously flush queue. */
                set_bit(HID_OUT_RUNNING, &usbhid->iofl);
                if (hid_submit_out(hid)) {
@@ -234,15 +246,27 @@ static int usbhid_restart_ctrl_queue(struct usbhid_device *usbhid)
        int r;
        WARN_ON(hid == NULL);
-        if (!hid)
+        if (!hid || test_bit(HID_RESET_PENDING, &usbhid->iofl) ||
+                        test_bit(HID_SUSPENDED, &usbhid->iofl))
                return 0;
        if ((kicked = (usbhid->ctrlhead != usbhid->ctrltail))) {
                hid_dbg(hid, "Kicking head %d tail %d", usbhid->ctrlhead, usbhid->ctrltail);
+                /* Try to wake up from autosuspend... */
                r = usb_autopm_get_interface_async(usbhid->intf);
                if (r < 0)
                        return r;
+                /*
+                 * If still suspended, don't submit.  Submission will
+                 * occur if/when resume drains the queue.
+                 */
+                if (test_bit(HID_SUSPENDED, &usbhid->iofl)) {
+                        usb_autopm_put_interface_no_suspend(usbhid->intf);
+                        return r;
+                }
                /* Asynchronously flush queue. */
                set_bit(HID_CTRL_RUNNING, &usbhid->iofl);
                if (hid_submit_ctrl(hid)) {
@@ -331,9 +355,12 @@ static int hid_submit_out(struct hid_device *hid)
        usbhid->urbout->transfer_buffer_length = ((report->size - 1) >> 3) +
                                                 1 + (report->id > 0);
        usbhid->urbout->dev = hid_to_usb_dev(hid);
-        memcpy(usbhid->outbuf, raw_report,
+        if (raw_report) {
-               usbhid->urbout->transfer_buffer_length);
+                memcpy(usbhid->outbuf, raw_report,
-        kfree(raw_report);
+                                usbhid->urbout->transfer_buffer_length);
+                kfree(raw_report);
+                usbhid->out[usbhid->outtail].raw_report = NULL;
+        }
        dbg_hid("submitting out urb\n");
@@ -362,8 +389,11 @@ static int hid_submit_ctrl(struct hid_device *hid)
        if (dir == USB_DIR_OUT) {
                usbhid->urbctrl->pipe = usb_sndctrlpipe(hid_to_usb_dev(hid), 0);
                usbhid->urbctrl->transfer_buffer_length = len;
-                memcpy(usbhid->ctrlbuf, raw_report, len);
+                if (raw_report) {
-                kfree(raw_report);
+                        memcpy(usbhid->ctrlbuf, raw_report, len);
+                        kfree(raw_report);
+                        usbhid->ctrl[usbhid->ctrltail].raw_report = NULL;
+                }
        } else {
                int maxpacket, padlen;
@@ -407,16 +437,6 @@ static int hid_submit_ctrl(struct hid_device *hid)
 * Output interrupt completion handler.
 */
-static int irq_out_pump_restart(struct hid_device *hid)
-{
-        struct usbhid_device *usbhid = hid->driver_data;
-        if (usbhid->outhead != usbhid->outtail)
-                return hid_submit_out(hid);
-        else
-                return -1;
-}
 static void hid_irq_out(struct urb *urb)
 {
        struct hid_device *hid = urb->context;
@@ -441,15 +461,17 @@ static void hid_irq_out(struct urb *urb)
        spin_lock_irqsave(&usbhid->lock, flags);
-        if (unplug)
+        if (unplug) {
                usbhid->outtail = usbhid->outhead;
-        else
+        } else {
                usbhid->outtail = (usbhid->outtail + 1) & (HID_OUTPUT_FIFO_SIZE - 1);
-        if (!irq_out_pump_restart(hid)) {
+                if (usbhid->outhead != usbhid->outtail &&
-                /* Successfully submitted next urb in queue */
+                                hid_submit_out(hid) == 0) {
-                spin_unlock_irqrestore(&usbhid->lock, flags);
+                        /* Successfully submitted next urb in queue */
-                return;
+                        spin_unlock_irqrestore(&usbhid->lock, flags);
+                        return;
+                }
        }
        clear_bit(HID_OUT_RUNNING, &usbhid->iofl);
@@ -461,15 +483,6 @@ static void hid_irq_out(struct urb *urb)
 /*
 * Control pipe completion handler.
 */
-static int ctrl_pump_restart(struct hid_device *hid)
-{
-        struct usbhid_device *usbhid = hid->driver_data;
-        if (usbhid->ctrlhead != usbhid->ctrltail)
-                return hid_submit_ctrl(hid);
-        else
-                return -1;
-}
 static void hid_ctrl(struct urb *urb)
 {
@@ -498,15 +511,17 @@ static void hid_ctrl(struct urb *urb)
                hid_warn(urb->dev, "ctrl urb status %d received\n", status);
        }
-        if (unplug)
+        if (unplug) {
                usbhid->ctrltail = usbhid->ctrlhead;
-        else
+        } else {
                usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);
-        if (!ctrl_pump_restart(hid)) {
+                if (usbhid->ctrlhead != usbhid->ctrltail &&
-                /* Successfully submitted next urb in queue */
+                                hid_submit_ctrl(hid) == 0) {
-                spin_unlock(&usbhid->lock);
+                        /* Successfully submitted next urb in queue */
-                return;
+                        spin_unlock(&usbhid->lock);
+                        return;
+                }
        }
        clear_bit(HID_CTRL_RUNNING, &usbhid->iofl);
@@ -540,49 +555,36 @@ static void __usbhid_submit_report(struct hid_device *hid, struct hid_report *re
                usbhid->out[usbhid->outhead].report = report;
                usbhid->outhead = head;
-                /* Try to awake from autosuspend... */
+                /* If the queue isn't running, restart it */
-                if (usb_autopm_get_interface_async(usbhid->intf) < 0)
+                if (!test_bit(HID_OUT_RUNNING, &usbhid->iofl)) {
-                        return;
+                        usbhid_restart_out_queue(usbhid);
-                /*
+                /* Otherwise see if an earlier request has timed out */
-                 * But if still suspended, leave urb enqueued, don't submit.
+                } else if (time_after(jiffies, usbhid->last_out + HZ * 5)) {
-                 * Submission will occur if/when resume() drains the queue.
-                 */
+                        /* Prevent autosuspend following the unlink */
-                if (test_bit(HID_REPORTED_IDLE, &usbhid->iofl))
+                        usb_autopm_get_interface_no_resume(usbhid->intf);
-                        return;
-                if (!test_and_set_bit(HID_OUT_RUNNING, &usbhid->iofl)) {
-                        if (hid_submit_out(hid)) {
-                                clear_bit(HID_OUT_RUNNING, &usbhid->iofl);
-                                usb_autopm_put_interface_async(usbhid->intf);
-                        }
-                        wake_up(&usbhid->wait);
-                } else {
                        /*
-                         * the queue is known to run
+                         * Prevent resubmission in case the URB completes
-                         * but an earlier request may be stuck
+                         * before we can unlink it.  We don't want to cancel
-                         * we may need to time out
+                         * the wrong transfer!
-                         * no race because the URB is blocked under
-                         * spinlock
                         */
-                        if (time_after(jiffies, usbhid->last_out + HZ * 5)) {
+                        usb_block_urb(usbhid->urbout);
-                                usb_block_urb(usbhid->urbout);
-                                /* drop lock to not deadlock if the callback is called */
-                                spin_unlock(&usbhid->lock);
-                                usb_unlink_urb(usbhid->urbout);
-                                spin_lock(&usbhid->lock);
-                                usb_unblock_urb(usbhid->urbout);
-                                /*
-                                 * if the unlinking has already completed
-                                 * the pump will have been stopped
-                                 * it must be restarted now
-                                 */
-                                if (!test_bit(HID_OUT_RUNNING, &usbhid->iofl))
-                                        if (!irq_out_pump_restart(hid))
-                                                set_bit(HID_OUT_RUNNING, &usbhid->iofl);
+                        /* Drop lock to avoid deadlock if the callback runs */
+                        spin_unlock(&usbhid->lock);
-                        }
+                        usb_unlink_urb(usbhid->urbout);
+                        spin_lock(&usbhid->lock);
+                        usb_unblock_urb(usbhid->urbout);
+                        /* Unlink might have stopped the queue */
+                        if (!test_bit(HID_OUT_RUNNING, &usbhid->iofl))
+                                usbhid_restart_out_queue(usbhid);
+                        /* Now we can allow autosuspend again */
+                        usb_autopm_put_interface_async(usbhid->intf);
                }
                return;
        }
@@ -604,47 +606,36 @@ static void __usbhid_submit_report(struct hid_device *hid, struct hid_report *re
        usbhid->ctrl[usbhid->ctrlhead].dir = dir;
        usbhid->ctrlhead = head;
-        /* Try to awake from autosuspend... */
+        /* If the queue isn't running, restart it */
-        if (usb_autopm_get_interface_async(usbhid->intf) < 0)
+        if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) {
-                return;
+                usbhid_restart_ctrl_queue(usbhid);
-        /*
+        /* Otherwise see if an earlier request has timed out */
-         * If already suspended, leave urb enqueued, but don't submit.
+        } else if (time_after(jiffies, usbhid->last_ctrl + HZ * 5)) {
-         * Submission will occur if/when resume() drains the queue.
-         */
+                /* Prevent autosuspend following the unlink */
-        if (test_bit(HID_REPORTED_IDLE, &usbhid->iofl))
+                usb_autopm_get_interface_no_resume(usbhid->intf);
-                return;
-        if (!test_and_set_bit(HID_CTRL_RUNNING, &usbhid->iofl)) {
-                if (hid_submit_ctrl(hid)) {
-                        clear_bit(HID_CTRL_RUNNING, &usbhid->iofl);
-                        usb_autopm_put_interface_async(usbhid->intf);
-                }
-                wake_up(&usbhid->wait);
-        } else {
                /*
-                 * the queue is known to run
+                 * Prevent resubmission in case the URB completes
-                 * but an earlier request may be stuck
+                 * before we can unlink it.  We don't want to cancel
-                 * we may need to time out
+                 * the wrong transfer!
-                 * no race because the URB is blocked under
-                 * spinlock
                 */
-                if (time_after(jiffies, usbhid->last_ctrl + HZ * 5)) {
+                usb_block_urb(usbhid->urbctrl);
-                        usb_block_urb(usbhid->urbctrl);
-                        /* drop lock to not deadlock if the callback is called */
+                /* Drop lock to avoid deadlock if the callback runs */
-                        spin_unlock(&usbhid->lock);
+                spin_unlock(&usbhid->lock);
-                        usb_unlink_urb(usbhid->urbctrl);
-                        spin_lock(&usbhid->lock);
+                usb_unlink_urb(usbhid->urbctrl);
-                        usb_unblock_urb(usbhid->urbctrl);
+                spin_lock(&usbhid->lock);
-                        /*
+                usb_unblock_urb(usbhid->urbctrl);
-                         * if the unlinking has already completed
-                         * the pump will have been stopped
+                /* Unlink might have stopped the queue */
-                         * it must be restarted now
+                if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
-                         */
+                        usbhid_restart_ctrl_queue(usbhid);
-                        if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
-                                if (!ctrl_pump_restart(hid))
+                /* Now we can allow autosuspend again */
-                                        set_bit(HID_CTRL_RUNNING, &usbhid->iofl);
+                usb_autopm_put_interface_async(usbhid->intf);
-                }
        }
 }
@@ -1002,9 +993,10 @@ static int usbhid_output_raw_report(struct hid_device *hid, __u8 *buf, size_t co
 static void usbhid_restart_queues(struct usbhid_device *usbhid)
 {
-        if (usbhid->urbout)
+        if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl))
                usbhid_restart_out_queue(usbhid);
-        usbhid_restart_ctrl_queue(usbhid);
+        if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
+                usbhid_restart_ctrl_queue(usbhid);
 }
 static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid)
@@ -1471,11 +1463,38 @@ void usbhid_put_power(struct hid_device *hid)
 #ifdef CONFIG_PM
+static int hid_resume_common(struct hid_device *hid, bool driver_suspended)
+{
+        struct usbhid_device *usbhid = hid->driver_data;
+        int status;
+        spin_lock_irq(&usbhid->lock);
+        clear_bit(HID_SUSPENDED, &usbhid->iofl);
+        usbhid_mark_busy(usbhid);
+        if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) ||
+                        test_bit(HID_RESET_PENDING, &usbhid->iofl))
+                schedule_work(&usbhid->reset_work);
+        usbhid->retry_delay = 0;
+        usbhid_restart_queues(usbhid);
+        spin_unlock_irq(&usbhid->lock);
+        status = hid_start_in(hid);
+        if (status < 0)
+                hid_io_error(hid);
+        if (driver_suspended && hid->driver && hid->driver->resume)
+                status = hid->driver->resume(hid);
+        return status;
+}
 static int hid_suspend(struct usb_interface *intf, pm_message_t message)
 {
        struct hid_device *hid = usb_get_intfdata(intf);
        struct usbhid_device *usbhid = hid->driver_data;
        int status;
+        bool driver_suspended = false;
        if (PMSG_IS_AUTO(message)) {
                spin_lock_irq(&usbhid->lock);   /* Sync with error handler */
@@ -1486,13 +1505,14 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message)
                    && !test_bit(HID_KEYS_PRESSED, &usbhid->iofl)
                    && (!usbhid->ledcount || ignoreled))
                {
-                        set_bit(HID_REPORTED_IDLE, &usbhid->iofl);
+                        set_bit(HID_SUSPENDED, &usbhid->iofl);
                        spin_unlock_irq(&usbhid->lock);
                        if (hid->driver && hid->driver->suspend) {
                                status = hid->driver->suspend(hid, message);
                                if (status < 0)
-                                        return status;
+                                        goto failed;
                        }
+                        driver_suspended = true;
                } else {
                        usbhid_mark_busy(usbhid);
                        spin_unlock_irq(&usbhid->lock);
@@ -1505,11 +1525,14 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message)
                        if (status < 0)
                                return status;
                }
+                driver_suspended = true;
                spin_lock_irq(&usbhid->lock);
-                set_bit(HID_REPORTED_IDLE, &usbhid->iofl);
+                set_bit(HID_SUSPENDED, &usbhid->iofl);
                spin_unlock_irq(&usbhid->lock);
-                if (usbhid_wait_io(hid) < 0)
+                if (usbhid_wait_io(hid) < 0) {
-                        return -EIO;
+                        status = -EIO;
+                        goto failed;
+                }
        }
        hid_cancel_delayed_stuff(usbhid);
@@ -1517,14 +1540,15 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message)
        if (PMSG_IS_AUTO(message) && test_bit(HID_KEYS_PRESSED, &usbhid->iofl)) {
                /* lost race against keypresses */
-                status = hid_start_in(hid);
+                status = -EBUSY;
-                if (status < 0)
+                goto failed;
-                        hid_io_error(hid);
-                usbhid_mark_busy(usbhid);
-                return -EBUSY;
        }
        dev_dbg(&intf->dev, "suspend\n");
        return 0;
+ failed:
+        hid_resume_common(hid, driver_suspended);
+        return status;
 }
 static int hid_resume(struct usb_interface *intf)
@@ -1536,23 +1560,7 @@ static int hid_resume(struct usb_interface *intf)
        if (!test_bit(HID_STARTED, &usbhid->iofl))
                return 0;
-        clear_bit(HID_REPORTED_IDLE, &usbhid->iofl);
+        status = hid_resume_common(hid, true);
-        usbhid_mark_busy(usbhid);
-        if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) ||
-            test_bit(HID_RESET_PENDING, &usbhid->iofl))
-                schedule_work(&usbhid->reset_work);
-        usbhid->retry_delay = 0;
-        status = hid_start_in(hid);
-        if (status < 0)
-                hid_io_error(hid);
-        usbhid_restart_queues(usbhid);
-        if (status >= 0 && hid->driver && hid->driver->resume) {
-                int ret = hid->driver->resume(hid);
-                if (ret < 0)
-                        status = ret;
-        }
        dev_dbg(&intf->dev, "resume status %d\n", status);
        return 0;
 }
@@ -1563,7 +1571,7 @@ static int hid_reset_resume(struct usb_interface *intf)
        struct usbhid_device *usbhid = hid->driver_data;
        int status;
-        clear_bit(HID_REPORTED_IDLE, &usbhid->iofl);
+        clear_bit(HID_SUSPENDED, &usbhid->iofl);
        status = hid_post_reset(intf);
        if (status >= 0 && hid->driver && hid->driver->reset_resume) {
                int ret = hid->driver->reset_resume(hid);
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 0597ee604f6e..903eef3d3e10 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -76,6 +76,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_PIXART_IMAGING_INC_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_1, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_2, HID_QUIRK_NOGET },
diff --git a/drivers/hid/usbhid/usbhid.h b/drivers/hid/usbhid/usbhid.h
index 1883d7b94870..bd87a61e5303 100644
--- a/drivers/hid/usbhid/usbhid.h
+++ b/drivers/hid/usbhid/usbhid.h
@@ -53,7 +53,6 @@ struct usb_interface *usbhid_find_interface(int minor);
 #define HID_CLEAR_HALT          6
 #define HID_DISCONNECTED        7
 #define HID_STARTED             8
-#define HID_REPORTED_IDLE       9
 #define HID_KEYS_PRESSED        10
 #define HID_NO_BANDWIDTH        11
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 70d62f5bc909..2cde9ecf7731 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -8,7 +8,7 @@
 *
 * Based on hdaps.c driver:
 * Copyright (C) 2005 Robert Love <rml@novell.com>
- * Copyright (C) 2005 Jesper Juhl <jesper.juhl@gmail.com>
+ * Copyright (C) 2005 Jesper Juhl <jj@chaosbits.net>
 *
 * Fan control based on smcFanControl:
 * Copyright (C) 2006 Hendrik Holtmann <holtmann@mac.com>
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 7f1feb2f467a..637c51c11b44 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -693,7 +693,7 @@ static void __cpuinit get_core_online(unsigned int cpu)
         * sensors. We check this bit only, all the early CPUs
         * without thermal sensors will be filtered out.
         */
-        if (!cpu_has(c, X86_FEATURE_DTS))
+        if (!cpu_has(c, X86_FEATURE_DTHERM))
                return;
        if (!pdev) {
@@ -794,7 +794,7 @@ static struct notifier_block coretemp_cpu_notifier __refdata = {
 };
 static const struct x86_cpu_id coretemp_ids[] = {
-        { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_DTS },
+        { X86_VENDOR_INTEL, X86_FAMILY_ANY, X86_MODEL_ANY, X86_FEATURE_DTHERM },
        {}
 };
 MODULE_DEVICE_TABLE(x86cpu, coretemp_ids);
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index e7701d99f8e8..f1de3979181f 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -2341,7 +2341,7 @@ static void __devinit it87_init_device(struct platform_device *pdev)
        /* Start monitoring */
        it87_write_value(data, IT87_REG_CONFIG,
-                         (it87_read_value(data, IT87_REG_CONFIG) & 0x36)
+                         (it87_read_value(data, IT87_REG_CONFIG) & 0x3e)
                         | (update_vbat ? 0x41 : 0x01));
 }
diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c
index a9bfd6736d9a..e72ba5d2a824 100644
--- a/drivers/hwmon/jc42.c
+++ b/drivers/hwmon/jc42.c
@@ -590,6 +590,6 @@ abort:
 module_i2c_driver(jc42_driver);
-MODULE_AUTHOR("Guenter Roeck <guenter.roeck@ericsson.com>");
+MODULE_AUTHOR("Guenter Roeck <linux@roeck-us.net>");
 MODULE_DESCRIPTION("JC42 driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/hwmon/lineage-pem.c b/drivers/hwmon/lineage-pem.c
index d264937c7f5e..bd75d2415432 100644
--- a/drivers/hwmon/lineage-pem.c
+++ b/drivers/hwmon/lineage-pem.c
@@ -567,6 +567,6 @@ static struct i2c_driver pem_driver = {
 module_i2c_driver(pem_driver);
-MODULE_AUTHOR("Guenter Roeck <guenter.roeck@ericsson.com>");
+MODULE_AUTHOR("Guenter Roeck <linux@roeck-us.net>");
 MODULE_DESCRIPTION("Lineage CPL PEM hardware monitoring driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/hwmon/ltc4261.c b/drivers/hwmon/ltc4261.c
index 069b7d34d8f9..77476a575c4e 100644
--- a/drivers/hwmon/ltc4261.c
+++ b/drivers/hwmon/ltc4261.c
@@ -292,6 +292,6 @@ static struct i2c_driver ltc4261_driver = {
 module_i2c_driver(ltc4261_driver);
-MODULE_AUTHOR("Guenter Roeck <guenter.roeck@ericsson.com>");
+MODULE_AUTHOR("Guenter Roeck <linux@roeck-us.net>");
 MODULE_DESCRIPTION("LTC4261 driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/hwmon/max16065.c b/drivers/hwmon/max16065.c
index 822261be84dd..019427d7a5fd 100644
--- a/drivers/hwmon/max16065.c
+++ b/drivers/hwmon/max16065.c
@@ -692,6 +692,6 @@ static struct i2c_driver max16065_driver = {
 module_i2c_driver(max16065_driver);
-MODULE_AUTHOR("Guenter Roeck <guenter.roeck@ericsson.com>");
+MODULE_AUTHOR("Guenter Roeck <linux@roeck-us.net>");
 MODULE_DESCRIPTION("MAX16065 driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
index 61c9cf15fa52..1201a15784c3 100644
--- a/drivers/hwspinlock/hwspinlock_core.c
+++ b/drivers/hwspinlock/hwspinlock_core.c
@@ -345,7 +345,7 @@ int hwspin_lock_register(struct hwspinlock_device *bank, struct device *dev,
                spin_lock_init(&hwlock->lock);
                hwlock->bank = bank;
-                ret = hwspin_lock_register_single(hwlock, i);
+                ret = hwspin_lock_register_single(hwlock, base_id + i);
                if (ret)
                        goto reg_failed;
        }
@@ -354,7 +354,7 @@ int hwspin_lock_register(struct hwspinlock_device *bank, struct device *dev,
 reg_failed:
        while (--i >= 0)
-                hwspin_lock_unregister_single(i);
+                hwspin_lock_unregister_single(base_id + i);
        return ret;
 }
 EXPORT_SYMBOL_GPL(hwspin_lock_register);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 5c1bc995e560..f10221f40803 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -123,7 +123,7 @@ static void ipoib_ud_skb_put_frags(struct ipoib_dev_priv *priv,
                skb_frag_size_set(frag, size);
                skb->data_len += size;
-                skb->truesize += size;
+                skb->truesize += PAGE_SIZE;
        } else
                skb_put(skb, length);
@@ -156,14 +156,18 @@ static struct sk_buff *ipoib_alloc_rx_skb(struct net_device *dev, int id)
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct sk_buff *skb;
        int buf_size;
+        int tailroom;
        u64 *mapping;
-        if (ipoib_ud_need_sg(priv->max_ib_mtu))
+        if (ipoib_ud_need_sg(priv->max_ib_mtu)) {
                buf_size = IPOIB_UD_HEAD_SIZE;
-        else
+                tailroom = 128; /* reserve some tailroom for IP/TCP headers */
+        } else {
                buf_size = IPOIB_UD_BUF_SIZE(priv->max_ib_mtu);
+                tailroom = 0;
+        }
-        skb = dev_alloc_skb(buf_size + 4);
+        skb = dev_alloc_skb(buf_size + tailroom + 4);
        if (unlikely(!skb))
                return NULL;
diff --git a/drivers/input/joystick/as5011.c b/drivers/input/joystick/as5011.c
index 57d19d4e0a2d..c96653b58867 100644
--- a/drivers/input/joystick/as5011.c
+++ b/drivers/input/joystick/as5011.c
@@ -282,7 +282,8 @@ static int __devinit as5011_probe(struct i2c_client *client,
        error = request_threaded_irq(as5011->button_irq,
                                     NULL, as5011_button_interrupt,
-                                     IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
+                                     IRQF_TRIGGER_RISING |
+                                        IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                     "as5011_button", as5011);
        if (error < 0) {
                dev_err(&client->dev,
@@ -296,7 +297,7 @@ static int __devinit as5011_probe(struct i2c_client *client,
        error = request_threaded_irq(as5011->axis_irq, NULL,
                                     as5011_axis_interrupt,
-                                     plat_data->axis_irqflags,
+                                     plat_data->axis_irqflags | IRQF_ONESHOT,
                                     "as5011_joystick", as5011);
        if (error) {
                dev_err(&client->dev,
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index ee16fb67b7ae..83811e45d633 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -142,6 +142,7 @@ static const struct xpad_device {
        { 0x0c12, 0x880a, "Pelican Eclipse PL-2023", 0, XTYPE_XBOX },
        { 0x0c12, 0x8810, "Zeroplus Xbox Controller", 0, XTYPE_XBOX },
        { 0x0c12, 0x9902, "HAMA VibraX - *FAULTY HARDWARE*", 0, XTYPE_XBOX },
+        { 0x0d2f, 0x0002, "Andamiro Pump It Up pad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
        { 0x0e4c, 0x1097, "Radica Gamester Controller", 0, XTYPE_XBOX },
        { 0x0e4c, 0x2390, "Radica Games Jtech Controller", 0, XTYPE_XBOX },
        { 0x0e6f, 0x0003, "Logic3 Freebird wireless Controller", 0, XTYPE_XBOX },
@@ -164,6 +165,7 @@ static const struct xpad_device {
        { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
        { 0x0f0d, 0x0016, "Hori Real Arcade Pro.EX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
        { 0x0f0d, 0x000d, "Hori Fighting Stick EX2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+        { 0x1689, 0xfd00, "Razer Onza Tournament Edition", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
        { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX },
        { 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN }
 };
@@ -238,12 +240,14 @@ static struct usb_device_id xpad_table [] = {
        XPAD_XBOX360_VENDOR(0x045e),            /* Microsoft X-Box 360 controllers */
        XPAD_XBOX360_VENDOR(0x046d),            /* Logitech X-Box 360 style controllers */
        XPAD_XBOX360_VENDOR(0x0738),            /* Mad Catz X-Box 360 controllers */
+        { USB_DEVICE(0x0738, 0x4540) },         /* Mad Catz Beat Pad */
        XPAD_XBOX360_VENDOR(0x0e6f),            /* 0x0e6f X-Box 360 controllers */
        XPAD_XBOX360_VENDOR(0x12ab),            /* X-Box 360 dance pads */
        XPAD_XBOX360_VENDOR(0x1430),            /* RedOctane X-Box 360 controllers */
        XPAD_XBOX360_VENDOR(0x146b),            /* BigBen Interactive Controllers */
        XPAD_XBOX360_VENDOR(0x1bad),            /* Harminix Rock Band Guitar and Drums */
-        XPAD_XBOX360_VENDOR(0x0f0d),            /* Hori Controllers */
+        XPAD_XBOX360_VENDOR(0x0f0d),            /* Hori Controllers */
+        XPAD_XBOX360_VENDOR(0x1689),            /* Razer Onza */
        { }
 };
diff --git a/drivers/input/keyboard/mcs_touchkey.c b/drivers/input/keyboard/mcs_touchkey.c
index 64a0ca4c92f3..0d77f6c84950 100644
--- a/drivers/input/keyboard/mcs_touchkey.c
+++ b/drivers/input/keyboard/mcs_touchkey.c
@@ -178,7 +178,8 @@ static int __devinit mcs_touchkey_probe(struct i2c_client *client,
        }
        error = request_threaded_irq(client->irq, NULL, mcs_touchkey_interrupt,
-                        IRQF_TRIGGER_FALLING, client->dev.driver->name, data);
+                                     IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+                                     client->dev.driver->name, data);
        if (error) {
                dev_err(&client->dev, "Failed to register interrupt\n");
                goto err_free_mem;
diff --git a/drivers/input/keyboard/mpr121_touchkey.c b/drivers/input/keyboard/mpr121_touchkey.c
index caa218a51b5a..7613f1cac951 100644
--- a/drivers/input/keyboard/mpr121_touchkey.c
+++ b/drivers/input/keyboard/mpr121_touchkey.c
@@ -248,7 +248,7 @@ static int __devinit mpr_touchkey_probe(struct i2c_client *client,
        error = request_threaded_irq(client->irq, NULL,
                                     mpr_touchkey_interrupt,
-                                     IRQF_TRIGGER_FALLING,
+                                     IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                     client->dev.driver->name, mpr121);
        if (error) {
                dev_err(&client->dev, "Failed to register interrupt\n");
diff --git a/drivers/input/keyboard/qt1070.c b/drivers/input/keyboard/qt1070.c
index 0b7b2f891752..ca68f2992d72 100644
--- a/drivers/input/keyboard/qt1070.c
+++ b/drivers/input/keyboard/qt1070.c
@@ -201,7 +201,8 @@ static int __devinit qt1070_probe(struct i2c_client *client,
        msleep(QT1070_RESET_TIME);
        err = request_threaded_irq(client->irq, NULL, qt1070_interrupt,
-                IRQF_TRIGGER_NONE, client->dev.driver->name, data);
+                                   IRQF_TRIGGER_NONE | IRQF_ONESHOT,
+                                   client->dev.driver->name, data);
        if (err) {
                dev_err(&client->dev, "fail to request irq\n");
                goto err_free_mem;
diff --git a/drivers/input/keyboard/tca6416-keypad.c b/drivers/input/keyboard/tca6416-keypad.c
index 3afea3f89718..c355cdde8d22 100644
--- a/drivers/input/keyboard/tca6416-keypad.c
+++ b/drivers/input/keyboard/tca6416-keypad.c
@@ -278,7 +278,8 @@ static int __devinit tca6416_keypad_probe(struct i2c_client *client,
                error = request_threaded_irq(chip->irqnum, NULL,
                                             tca6416_keys_isr,
-                                             IRQF_TRIGGER_FALLING,
+                                             IRQF_TRIGGER_FALLING |
+                                                IRQF_ONESHOT,
                                             "tca6416-keypad", chip);
                if (error) {
                        dev_dbg(&client->dev,
diff --git a/drivers/input/keyboard/tca8418_keypad.c b/drivers/input/keyboard/tca8418_keypad.c
index 5f87b28b3192..893869b29ed9 100644
--- a/drivers/input/keyboard/tca8418_keypad.c
+++ b/drivers/input/keyboard/tca8418_keypad.c
@@ -360,7 +360,7 @@ static int __devinit tca8418_keypad_probe(struct i2c_client *client,
                client->irq = gpio_to_irq(client->irq);
        error = request_threaded_irq(client->irq, NULL, tca8418_irq_handler,
-                                     IRQF_TRIGGER_FALLING,
+                                     IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                     client->name, keypad_data);
        if (error) {
                dev_dbg(&client->dev,
diff --git a/drivers/input/keyboard/tnetv107x-keypad.c b/drivers/input/keyboard/tnetv107x-keypad.c
index a4a445fb7020..4c34f21fbe2d 100644
--- a/drivers/input/keyboard/tnetv107x-keypad.c
+++ b/drivers/input/keyboard/tnetv107x-keypad.c
@@ -227,15 +227,15 @@ static int __devinit keypad_probe(struct platform_device *pdev)
                goto error_clk;
        }
-        error = request_threaded_irq(kp->irq_press, NULL, keypad_irq, 0,
+        error = request_threaded_irq(kp->irq_press, NULL, keypad_irq,
-                                     dev_name(dev), kp);
+                                     IRQF_ONESHOT, dev_name(dev), kp);
        if (error < 0) {
                dev_err(kp->dev, "Could not allocate keypad press key irq\n");
                goto error_irq_press;
        }
-        error = request_threaded_irq(kp->irq_release, NULL, keypad_irq, 0,
+        error = request_threaded_irq(kp->irq_release, NULL, keypad_irq,
-                                     dev_name(dev), kp);
+                                     IRQF_ONESHOT, dev_name(dev), kp);
        if (error < 0) {
                dev_err(kp->dev, "Could not allocate keypad release key irq\n");
                goto error_irq_release;
diff --git a/drivers/input/misc/ad714x.c b/drivers/input/misc/ad714x.c
index 0ac75bbad4d6..2e5d5e1de647 100644
--- a/drivers/input/misc/ad714x.c
+++ b/drivers/input/misc/ad714x.c
@@ -972,6 +972,7 @@ struct ad714x_chip *ad714x_probe(struct device *dev, u16 bus_type, int irq,
        struct ad714x_platform_data *plat_data = dev->platform_data;
        struct ad714x_chip *ad714x;
        void *drv_mem;
+        unsigned long irqflags;
        struct ad714x_button_drv *bt_drv;
        struct ad714x_slider_drv *sd_drv;
@@ -1162,10 +1163,11 @@ struct ad714x_chip *ad714x_probe(struct device *dev, u16 bus_type, int irq,
                alloc_idx++;
        }
+        irqflags = plat_data->irqflags ?: IRQF_TRIGGER_FALLING;
+        irqflags |= IRQF_ONESHOT;
        error = request_threaded_irq(ad714x->irq, NULL, ad714x_interrupt_thread,
-                                plat_data->irqflags ?
+                                     irqflags, "ad714x_captouch", ad714x);
-                                        plat_data->irqflags : IRQF_TRIGGER_FALLING,
-                                "ad714x_captouch", ad714x);
        if (error) {
                dev_err(dev, "can't allocate irq %d\n", ad714x->irq);
                goto err_unreg_dev;
diff --git a/drivers/input/misc/dm355evm_keys.c b/drivers/input/misc/dm355evm_keys.c
index 35083c6836c3..c1313d8535c3 100644
--- a/drivers/input/misc/dm355evm_keys.c
+++ b/drivers/input/misc/dm355evm_keys.c
@@ -213,7 +213,8 @@ static int __devinit dm355evm_keys_probe(struct platform_device *pdev)
        /* REVISIT:  flush the event queue? */
        status = request_threaded_irq(keys->irq, NULL, dm355evm_keys_irq,
-                        IRQF_TRIGGER_FALLING, dev_name(&pdev->dev), keys);
+                                      IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+                                      dev_name(&pdev->dev), keys);
        if (status < 0)
                goto fail2;
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index 2cf681d98c0d..d528c23e194f 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -79,6 +79,10 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING5A_ANSI   0x0252
 #define USB_DEVICE_ID_APPLE_WELLSPRING5A_ISO    0x0253
 #define USB_DEVICE_ID_APPLE_WELLSPRING5A_JIS    0x0254
+/* MacbookPro10,1 (unibody, June 2012) */
+#define USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI    0x0262
+#define USB_DEVICE_ID_APPLE_WELLSPRING7_ISO     0x0263
+#define USB_DEVICE_ID_APPLE_WELLSPRING7_JIS     0x0264
 #define BCM5974_DEVICE(prod) {                                  \
        .match_flags = (USB_DEVICE_ID_MATCH_DEVICE |            \
@@ -128,6 +132,10 @@ static const struct usb_device_id bcm5974_table[] = {
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5A_ANSI),
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5A_ISO),
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5A_JIS),
+        /* MacbookPro10,1 */
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7_ISO),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING7_JIS),
        /* Terminating entry */
        {}
 };
@@ -354,6 +362,18 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                { DIM_X, DIM_X / SN_COORD, -4620, 5140 },
                { DIM_Y, DIM_Y / SN_COORD, -150, 6600 }
        },
+        {
+                USB_DEVICE_ID_APPLE_WELLSPRING7_ANSI,
+                USB_DEVICE_ID_APPLE_WELLSPRING7_ISO,
+                USB_DEVICE_ID_APPLE_WELLSPRING7_JIS,
+                HAS_INTEGRATED_BUTTON,
+                0x84, sizeof(struct bt_data),
+                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
+                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
+                { DIM_X, DIM_X / SN_COORD, -4750, 5280 },
+                { DIM_Y, DIM_Y / SN_COORD, -150, 6730 }
+        },
        {}
 };
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index cad5602d3ce4..8b31473a81fe 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -216,7 +216,7 @@ static void wacom_retrieve_report_data(struct usb_interface *intf,
                rep_data[0] = 12;
                result = wacom_get_report(intf, WAC_HID_FEATURE_REPORT,
-                                          rep_data[0], &rep_data, 2,
+                                          rep_data[0], rep_data, 2,
                                          WAC_MSG_RETRIES);
                if (result >= 0 && rep_data[1] > 2)
@@ -401,7 +401,9 @@ static int wacom_parse_hid(struct usb_interface *intf,
                                break;
                        case HID_USAGE_CONTACTMAX:
-                                wacom_retrieve_report_data(intf, features);
+                                /* leave touch_max as is if predefined */
+                                if (!features->touch_max)
+                                        wacom_retrieve_report_data(intf, features);
                                i++;
                                break;
                        }
diff --git a/drivers/input/touchscreen/ad7879.c b/drivers/input/touchscreen/ad7879.c
index e2482b40da51..bd4eb4277697 100644
--- a/drivers/input/touchscreen/ad7879.c
+++ b/drivers/input/touchscreen/ad7879.c
@@ -597,7 +597,7 @@ struct ad7879 *ad7879_probe(struct device *dev, u8 devid, unsigned int irq,
                        AD7879_TMR(ts->pen_down_acc_interval);
        err = request_threaded_irq(ts->irq, NULL, ad7879_irq,
-                                   IRQF_TRIGGER_FALLING,
+                                   IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                   dev_name(dev), ts);
        if (err) {
                dev_err(dev, "irq %d busy?\n", ts->irq);
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 42e645062c20..25fd0561a17d 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -1149,7 +1149,8 @@ static int __devinit mxt_probe(struct i2c_client *client,
                goto err_free_object;
        error = request_threaded_irq(client->irq, NULL, mxt_interrupt,
-                        pdata->irqflags, client->dev.driver->name, data);
+                                     pdata->irqflags | IRQF_ONESHOT,
+                                     client->dev.driver->name, data);
        if (error) {
                dev_err(&client->dev, "Failed to register interrupt\n");
                goto err_free_object;
diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
index f2d03c06c2da..5c487d23f11c 100644
--- a/drivers/input/touchscreen/bu21013_ts.c
+++ b/drivers/input/touchscreen/bu21013_ts.c
@@ -509,7 +509,8 @@ static int __devinit bu21013_probe(struct i2c_client *client,
        input_set_drvdata(in_dev, bu21013_data);
        error = request_threaded_irq(pdata->irq, NULL, bu21013_gpio_irq,
-                                     IRQF_TRIGGER_FALLING | IRQF_SHARED,
+                                     IRQF_TRIGGER_FALLING | IRQF_SHARED |
+                                        IRQF_ONESHOT,
                                     DRIVER_TP, bu21013_data);
        if (error) {
                dev_err(&client->dev, "request irq %d failed\n", pdata->irq);
diff --git a/drivers/input/touchscreen/cy8ctmg110_ts.c b/drivers/input/touchscreen/cy8ctmg110_ts.c
index 237753ad1031..464f1bf4b61d 100644
--- a/drivers/input/touchscreen/cy8ctmg110_ts.c
+++ b/drivers/input/touchscreen/cy8ctmg110_ts.c
@@ -251,7 +251,8 @@ static int __devinit cy8ctmg110_probe(struct i2c_client *client,
        }
        err = request_threaded_irq(client->irq, NULL, cy8ctmg110_irq_thread,
-                                   IRQF_TRIGGER_RISING, "touch_reset_key", ts);
+                                   IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+                                   "touch_reset_key", ts);
        if (err < 0) {
                dev_err(&client->dev,
                        "irq %d busy? error %d\n", client->irq, err);
diff --git a/drivers/input/touchscreen/intel-mid-touch.c b/drivers/input/touchscreen/intel-mid-touch.c
index 3cd7a837f82b..cf299377fc49 100644
--- a/drivers/input/touchscreen/intel-mid-touch.c
+++ b/drivers/input/touchscreen/intel-mid-touch.c
@@ -620,7 +620,7 @@ static int __devinit mrstouch_probe(struct platform_device *pdev)
                             MRST_PRESSURE_MIN, MRST_PRESSURE_MAX, 0, 0);
        err = request_threaded_irq(tsdev->irq, NULL, mrstouch_pendet_irq,
-                                   0, "mrstouch", tsdev);
+                                   IRQF_ONESHOT, "mrstouch", tsdev);
        if (err) {
                dev_err(tsdev->dev, "unable to allocate irq\n");
                goto err_free_mem;
diff --git a/drivers/input/touchscreen/pixcir_i2c_ts.c b/drivers/input/touchscreen/pixcir_i2c_ts.c
index 72f6ba3a4709..953b4c105cad 100644
--- a/drivers/input/touchscreen/pixcir_i2c_ts.c
+++ b/drivers/input/touchscreen/pixcir_i2c_ts.c
@@ -165,7 +165,7 @@ static int __devinit pixcir_i2c_ts_probe(struct i2c_client *client,
        input_set_drvdata(input, tsdata);
        error = request_threaded_irq(client->irq, NULL, pixcir_ts_isr,
-                                     IRQF_TRIGGER_FALLING,
+                                     IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
                                     client->name, tsdata);
        if (error) {
                dev_err(&client->dev, "Unable to request touchscreen IRQ.\n");
diff --git a/drivers/input/touchscreen/tnetv107x-ts.c b/drivers/input/touchscreen/tnetv107x-ts.c
index 7e7488097359..368d2c6cf780 100644
--- a/drivers/input/touchscreen/tnetv107x-ts.c
+++ b/drivers/input/touchscreen/tnetv107x-ts.c
@@ -297,7 +297,7 @@ static int __devinit tsc_probe(struct platform_device *pdev)
                goto error_clk;
        }
-        error = request_threaded_irq(ts->tsc_irq, NULL, tsc_irq, 0,
+        error = request_threaded_irq(ts->tsc_irq, NULL, tsc_irq, IRQF_ONESHOT,
                                     dev_name(dev), ts);
        if (error < 0) {
                dev_err(ts->dev, "Could not allocate ts irq\n");
diff --git a/drivers/input/touchscreen/tsc2005.c b/drivers/input/touchscreen/tsc2005.c
index b6adeaee9cc5..5ce3fa8ce646 100644
--- a/drivers/input/touchscreen/tsc2005.c
+++ b/drivers/input/touchscreen/tsc2005.c
@@ -650,7 +650,8 @@ static int __devinit tsc2005_probe(struct spi_device *spi)
        tsc2005_stop_scan(ts);
        error = request_threaded_irq(spi->irq, NULL, tsc2005_irq_thread,
-                                     IRQF_TRIGGER_RISING, "tsc2005", ts);
+                                     IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+                                     "tsc2005", ts);
        if (error) {
                dev_err(&spi->dev, "Failed to request irq, err: %d\n", error);
                goto err_free_mem;
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index a2e418cba0ff..625626391f2d 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -83,6 +83,8 @@ static struct iommu_ops amd_iommu_ops;
 static ATOMIC_NOTIFIER_HEAD(ppr_notifier);
 int amd_iommu_max_glx_val = -1;
+static struct dma_map_ops amd_iommu_dma_ops;
 /*
 * general struct to manage commands send to an IOMMU
 */
@@ -402,7 +404,7 @@ static void amd_iommu_stats_init(void)
                return;
        de_fflush  = debugfs_create_bool("fullflush", 0444, stats_dir,
-                                         (u32 *)&amd_iommu_unmap_flush);
+                                         &amd_iommu_unmap_flush);
        amd_iommu_stats_add(&compl_wait);
        amd_iommu_stats_add(&cnt_map_single);
@@ -2267,6 +2269,13 @@ static int device_change_notifier(struct notifier_block *nb,
                list_add_tail(&dma_domain->list, &iommu_pd_list);
                spin_unlock_irqrestore(&iommu_pd_list_lock, flags);
+                dev_data = get_dev_data(dev);
+                if (!dev_data->passthrough)
+                        dev->archdata.dma_ops = &amd_iommu_dma_ops;
+                else
+                        dev->archdata.dma_ops = &nommu_dma_ops;
                break;
        case BUS_NOTIFY_DEL_DEVICE:
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 542024ba6dba..a33612f3206f 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -129,7 +129,7 @@ u16 amd_iommu_last_bdf;			/* largest PCI device id we have
                                           to handle */
 LIST_HEAD(amd_iommu_unity_map);         /* a list of required unity mappings
                                           we find in ACPI */
-bool amd_iommu_unmap_flush;             /* if true, flush on every unmap */
+u32 amd_iommu_unmap_flush;              /* if true, flush on every unmap */
 LIST_HEAD(amd_iommu_list);              /* list of all AMD IOMMUs in the
                                           system */
@@ -1641,6 +1641,8 @@ static int __init amd_iommu_init(void)
        amd_iommu_init_api();
+        x86_platform.iommu_shutdown = disable_iommus;
        if (iommu_pass_through)
                goto out;
@@ -1649,8 +1651,6 @@ static int __init amd_iommu_init(void)
        else
                printk(KERN_INFO "AMD-Vi: Lazy IO/TLB flushing enabled\n");
-        x86_platform.iommu_shutdown = disable_iommus;
 out:
        return ret;
diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
index 24355559a2ad..c1b1d489817e 100644
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -652,7 +652,7 @@ extern unsigned long *amd_iommu_pd_alloc_bitmap;
 * If true, the addresses will be flushed on unmap time, not when
 * they are reused
 */
-extern bool amd_iommu_unmap_flush;
+extern u32 amd_iommu_unmap_flush;
 /* Smallest number of PASIDs supported by any IOMMU in the system */
 extern u32 amd_iommu_max_pasids;
diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
index ecd679043d77..3f3d09d560ea 100644
--- a/drivers/iommu/tegra-smmu.c
+++ b/drivers/iommu/tegra-smmu.c
@@ -550,13 +550,13 @@ static int alloc_pdir(struct smmu_as *as)
                return 0;
        as->pte_count = devm_kzalloc(smmu->dev,
-                     sizeof(as->pte_count[0]) * SMMU_PDIR_COUNT, GFP_KERNEL);
+                     sizeof(as->pte_count[0]) * SMMU_PDIR_COUNT, GFP_ATOMIC);
        if (!as->pte_count) {
                dev_err(smmu->dev,
                        "failed to allocate smmu_device PTE cunters\n");
                return -ENOMEM;
        }
-        as->pdir_page = alloc_page(GFP_KERNEL | __GFP_DMA);
+        as->pdir_page = alloc_page(GFP_ATOMIC | __GFP_DMA);
        if (!as->pdir_page) {
                dev_err(smmu->dev,
                        "failed to allocate smmu_device page directory\n");
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index 1a0ae4445ff2..5f21f629b7ae 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -135,8 +135,8 @@ send_layer2(struct mISDNstack *st, struct sk_buff *skb)
                        skb = NULL;
                else if (*debug & DEBUG_SEND_ERR)
                        printk(KERN_DEBUG
-                               "%s ch%d mgr prim(%x) addr(%x) err %d\n",
+                               "%s mgr prim(%x) err %d\n",
-                               __func__, ch->nr, hh->prim, ch->addr, ret);
+                               __func__, hh->prim, ret);
        }
 out:
        mutex_unlock(&st->lmutex);
diff --git a/drivers/leds/ledtrig-heartbeat.c b/drivers/leds/ledtrig-heartbeat.c
index 41dc76db4311..a019fbb70880 100644
--- a/drivers/leds/ledtrig-heartbeat.c
+++ b/drivers/leds/ledtrig-heartbeat.c
@@ -21,6 +21,8 @@
 #include <linux/reboot.h>
 #include "leds.h"
+static int panic_heartbeats;
 struct heartbeat_trig_data {
        unsigned int phase;
        unsigned int period;
@@ -34,6 +36,11 @@ static void led_heartbeat_function(unsigned long data)
        unsigned long brightness = LED_OFF;
        unsigned long delay = 0;
+        if (unlikely(panic_heartbeats)) {
+                led_set_brightness(led_cdev, LED_OFF);
+                return;
+        }
        /* acts like an actual heart beat -- ie thump-thump-pause... */
        switch (heartbeat_data->phase) {
        case 0:
@@ -111,12 +118,19 @@ static int heartbeat_reboot_notifier(struct notifier_block *nb,
        return NOTIFY_DONE;
 }
+static int heartbeat_panic_notifier(struct notifier_block *nb,
+                                     unsigned long code, void *unused)
+{
+        panic_heartbeats = 1;
+        return NOTIFY_DONE;
+}
 static struct notifier_block heartbeat_reboot_nb = {
        .notifier_call = heartbeat_reboot_notifier,
 };
 static struct notifier_block heartbeat_panic_nb = {
-        .notifier_call = heartbeat_reboot_notifier,
+        .notifier_call = heartbeat_panic_notifier,
 };
 static int __init heartbeat_trig_init(void)
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 37fdaf81bd1f..ce59824fb414 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2292,6 +2292,13 @@ static int process_reserve_metadata_snap_mesg(unsigned argc, char **argv, struct
        if (r)
                return r;
+        r = dm_pool_commit_metadata(pool->pmd);
+        if (r) {
+                DMERR("%s: dm_pool_commit_metadata() failed, error = %d",
+                      __func__, r);
+                return r;
+        }
        r = dm_pool_reserve_metadata_snap(pool->pmd);
        if (r)
                DMWARN("reserve_metadata_snap message failed.");
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 1c2f9048e1ae..a4c219e3c859 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5784,8 +5784,7 @@ static int add_new_disk(struct mddev * mddev, mdu_disk_info_t *info)
                        super_types[mddev->major_version].
                                validate_super(mddev, rdev);
                if ((info->state & (1<<MD_DISK_SYNC)) &&
-                    (!test_bit(In_sync, &rdev->flags) ||
+                     rdev->raid_disk != info->raid_disk) {
-                     rdev->raid_disk != info->raid_disk)) {
                        /* This was a hot-add request, but events doesn't
                         * match, so reject it.
                         */
@@ -6751,7 +6750,7 @@ struct md_thread *md_register_thread(void (*run) (struct mddev *), struct mddev
        thread->tsk = kthread_run(md_thread, thread,
                                  "%s_%s",
                                  mdname(thread->mddev),
-                                  name ?: mddev->pers->name);
+                                  name);
        if (IS_ERR(thread->tsk)) {
                kfree(thread);
                return NULL;
@@ -7298,6 +7297,7 @@ void md_do_sync(struct mddev *mddev)
        int skipped = 0;
        struct md_rdev *rdev;
        char *desc;
+        struct blk_plug plug;
        /* just incase thread restarts... */
        if (test_bit(MD_RECOVERY_DONE, &mddev->recovery))
@@ -7447,6 +7447,7 @@ void md_do_sync(struct mddev *mddev)
        }
        mddev->curr_resync_completed = j;
+        blk_start_plug(&plug);
        while (j < max_sectors) {
                sector_t sectors;
@@ -7552,6 +7553,7 @@ void md_do_sync(struct mddev *mddev)
         * this also signals 'finished resyncing' to md_stop
         */
 out:
+        blk_finish_plug(&plug);
        wait_event(mddev->recovery_wait, !atomic_read(&mddev->recovery_active));
        /* tell personality that we are finished */
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index 9339e67fcc79..61a1833ebaf3 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -474,7 +474,8 @@ static int multipath_run (struct mddev *mddev)
        }
        {
-                mddev->thread = md_register_thread(multipathd, mddev, NULL);
+                mddev->thread = md_register_thread(multipathd, mddev,
+                                                   "multipath");
                if (!mddev->thread) {
                        printk(KERN_ERR "multipath: couldn't allocate thread"
                                " for %s\n", mdname(mddev));
diff --git a/drivers/md/persistent-data/dm-space-map-checker.c b/drivers/md/persistent-data/dm-space-map-checker.c
index 50ed53bf4aa2..fc90c11620ad 100644
--- a/drivers/md/persistent-data/dm-space-map-checker.c
+++ b/drivers/md/persistent-data/dm-space-map-checker.c
@@ -8,6 +8,7 @@
 #include <linux/device-mapper.h>
 #include <linux/export.h>
+#include <linux/vmalloc.h>
 #ifdef CONFIG_DM_DEBUG_SPACE_MAPS
@@ -89,13 +90,23 @@ static int ca_create(struct count_array *ca, struct dm_space_map *sm)
        ca->nr = nr_blocks;
        ca->nr_free = nr_blocks;
-        ca->counts = kzalloc(sizeof(*ca->counts) * nr_blocks, GFP_KERNEL);
-        if (!ca->counts)
+        if (!nr_blocks)
-                return -ENOMEM;
+                ca->counts = NULL;
+        else {
+                ca->counts = vzalloc(sizeof(*ca->counts) * nr_blocks);
+                if (!ca->counts)
+                        return -ENOMEM;
+        }
        return 0;
 }
+static void ca_destroy(struct count_array *ca)
+{
+        vfree(ca->counts);
+}
 static int ca_load(struct count_array *ca, struct dm_space_map *sm)
 {
        int r;
@@ -126,12 +137,14 @@ static int ca_load(struct count_array *ca, struct dm_space_map *sm)
 static int ca_extend(struct count_array *ca, dm_block_t extra_blocks)
 {
        dm_block_t nr_blocks = ca->nr + extra_blocks;
-        uint32_t *counts = kzalloc(sizeof(*counts) * nr_blocks, GFP_KERNEL);
+        uint32_t *counts = vzalloc(sizeof(*counts) * nr_blocks);
        if (!counts)
                return -ENOMEM;
-        memcpy(counts, ca->counts, sizeof(*counts) * ca->nr);
+        if (ca->counts) {
-        kfree(ca->counts);
+                memcpy(counts, ca->counts, sizeof(*counts) * ca->nr);
+                ca_destroy(ca);
+        }
        ca->nr = nr_blocks;
        ca->nr_free += extra_blocks;
        ca->counts = counts;
@@ -151,11 +164,6 @@ static int ca_commit(struct count_array *old, struct count_array *new)
        return 0;
 }
-static void ca_destroy(struct count_array *ca)
-{
-        kfree(ca->counts);
-}
 /*----------------------------------------------------------------*/
 struct sm_checker {
@@ -343,25 +351,25 @@ struct dm_space_map *dm_sm_checker_create(struct dm_space_map *sm)
        int r;
        struct sm_checker *smc;
-        if (!sm)
+        if (IS_ERR_OR_NULL(sm))
-                return NULL;
+                return ERR_PTR(-EINVAL);
        smc = kmalloc(sizeof(*smc), GFP_KERNEL);
        if (!smc)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        memcpy(&smc->sm, &ops_, sizeof(smc->sm));
        r = ca_create(&smc->old_counts, sm);
        if (r) {
                kfree(smc);
-                return NULL;
+                return ERR_PTR(r);
        }
        r = ca_create(&smc->counts, sm);
        if (r) {
                ca_destroy(&smc->old_counts);
                kfree(smc);
-                return NULL;
+                return ERR_PTR(r);
        }
        smc->real_sm = sm;
@@ -371,7 +379,7 @@ struct dm_space_map *dm_sm_checker_create(struct dm_space_map *sm)
                ca_destroy(&smc->counts);
                ca_destroy(&smc->old_counts);
                kfree(smc);
-                return NULL;
+                return ERR_PTR(r);
        }
        r = ca_commit(&smc->old_counts, &smc->counts);
@@ -379,7 +387,7 @@ struct dm_space_map *dm_sm_checker_create(struct dm_space_map *sm)
                ca_destroy(&smc->counts);
                ca_destroy(&smc->old_counts);
                kfree(smc);
-                return NULL;
+                return ERR_PTR(r);
        }
        return &smc->sm;
@@ -391,25 +399,25 @@ struct dm_space_map *dm_sm_checker_create_fresh(struct dm_space_map *sm)
        int r;
        struct sm_checker *smc;
-        if (!sm)
+        if (IS_ERR_OR_NULL(sm))
-                return NULL;
+                return ERR_PTR(-EINVAL);
        smc = kmalloc(sizeof(*smc), GFP_KERNEL);
        if (!smc)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
        memcpy(&smc->sm, &ops_, sizeof(smc->sm));
        r = ca_create(&smc->old_counts, sm);
        if (r) {
                kfree(smc);
-                return NULL;
+                return ERR_PTR(r);
        }
        r = ca_create(&smc->counts, sm);
        if (r) {
                ca_destroy(&smc->old_counts);
                kfree(smc);
-                return NULL;
+                return ERR_PTR(r);
        }
        smc->real_sm = sm;
diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
index fc469ba9f627..3d0ed5332883 100644
--- a/drivers/md/persistent-data/dm-space-map-disk.c
+++ b/drivers/md/persistent-data/dm-space-map-disk.c
@@ -290,7 +290,16 @@ struct dm_space_map *dm_sm_disk_create(struct dm_transaction_manager *tm,
                                       dm_block_t nr_blocks)
 {
        struct dm_space_map *sm = dm_sm_disk_create_real(tm, nr_blocks);
-        return dm_sm_checker_create_fresh(sm);
+        struct dm_space_map *smc;
+        if (IS_ERR_OR_NULL(sm))
+                return sm;
+        smc = dm_sm_checker_create_fresh(sm);
+        if (IS_ERR(smc))
+                dm_sm_destroy(sm);
+        return smc;
 }
 EXPORT_SYMBOL_GPL(dm_sm_disk_create);
diff --git a/drivers/md/persistent-data/dm-transaction-manager.c b/drivers/md/persistent-data/dm-transaction-manager.c
index 400fe144c0cd..e5604b32d91f 100644
--- a/drivers/md/persistent-data/dm-transaction-manager.c
+++ b/drivers/md/persistent-data/dm-transaction-manager.c
@@ -138,6 +138,9 @@ EXPORT_SYMBOL_GPL(dm_tm_create_non_blocking_clone);
 void dm_tm_destroy(struct dm_transaction_manager *tm)
 {
+        if (!tm->is_clone)
+                wipe_shadow_table(tm);
        kfree(tm);
 }
 EXPORT_SYMBOL_GPL(dm_tm_destroy);
@@ -344,8 +347,10 @@ static int dm_tm_create_internal(struct dm_block_manager *bm,
                }
                *sm = dm_sm_checker_create(inner);
-                if (!*sm)
+                if (IS_ERR(*sm)) {
+                        r = PTR_ERR(*sm);
                        goto bad2;
+                }
        } else {
                r = dm_bm_write_lock(dm_tm_get_bm(*tm), sb_location,
@@ -364,8 +369,10 @@ static int dm_tm_create_internal(struct dm_block_manager *bm,
                }
                *sm = dm_sm_checker_create(inner);
-                if (!*sm)
+                if (IS_ERR(*sm)) {
+                        r = PTR_ERR(*sm);
                        goto bad2;
+                }
        }
        return 0;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index a9c7981ddd24..240ff3125040 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -517,8 +517,8 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
                int bad_sectors;
                int disk = start_disk + i;
-                if (disk >= conf->raid_disks)
+                if (disk >= conf->raid_disks * 2)
-                        disk -= conf->raid_disks;
+                        disk -= conf->raid_disks * 2;
                rdev = rcu_dereference(conf->mirrors[disk].rdev);
                if (r1_bio->bios[disk] == IO_BLOCKED
@@ -883,7 +883,6 @@ static void make_request(struct mddev *mddev, struct bio * bio)
        const unsigned long do_sync = (bio->bi_rw & REQ_SYNC);
        const unsigned long do_flush_fua = (bio->bi_rw & (REQ_FLUSH | REQ_FUA));
        struct md_rdev *blocked_rdev;
-        int plugged;
        int first_clone;
        int sectors_handled;
        int max_sectors;
@@ -1034,7 +1033,6 @@ read_again:
         * the bad blocks.  Each set of writes gets it's own r1bio
         * with a set of bios attached.
         */
-        plugged = mddev_check_plugged(mddev);
        disks = conf->raid_disks * 2;
 retry_write:
@@ -1191,6 +1189,8 @@ read_again:
                bio_list_add(&conf->pending_bio_list, mbio);
                conf->pending_count++;
                spin_unlock_irqrestore(&conf->device_lock, flags);
+                if (!mddev_check_plugged(mddev))
+                        md_wakeup_thread(mddev->thread);
        }
        /* Mustn't call r1_bio_write_done before this next test,
         * as it could result in the bio being freed.
@@ -1213,9 +1213,6 @@ read_again:
        /* In case raid1d snuck in to freeze_array */
        wake_up(&conf->wait_barrier);
-        if (do_sync || !bitmap || !plugged)
-                md_wakeup_thread(mddev->thread);
 }
 static void status(struct seq_file *seq, struct mddev *mddev)
@@ -2488,9 +2485,10 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr, int *skipp
         */
        if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
                atomic_set(&r1_bio->remaining, read_targets);
-                for (i = 0; i < conf->raid_disks * 2; i++) {
+                for (i = 0; i < conf->raid_disks * 2 && read_targets; i++) {
                        bio = r1_bio->bios[i];
                        if (bio->bi_end_io == end_sync_read) {
+                                read_targets--;
                                md_sync_acct(bio->bi_bdev, nr_sectors);
                                generic_make_request(bio);
                        }
@@ -2621,7 +2619,7 @@ static struct r1conf *setup_conf(struct mddev *mddev)
                goto abort;
        }
        err = -ENOMEM;
-        conf->thread = md_register_thread(raid1d, mddev, NULL);
+        conf->thread = md_register_thread(raid1d, mddev, "raid1");
        if (!conf->thread) {
                printk(KERN_ERR
                       "md/raid1:%s: couldn't allocate thread\n",
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 99ae6068e456..8da6282254c3 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1039,7 +1039,6 @@ static void make_request(struct mddev *mddev, struct bio * bio)
        const unsigned long do_fua = (bio->bi_rw & REQ_FUA);
        unsigned long flags;
        struct md_rdev *blocked_rdev;
-        int plugged;
        int sectors_handled;
        int max_sectors;
        int sectors;
@@ -1239,7 +1238,6 @@ read_again:
         * of r10_bios is recored in bio->bi_phys_segments just as with
         * the read case.
         */
-        plugged = mddev_check_plugged(mddev);
        r10_bio->read_slot = -1; /* make sure repl_bio gets freed */
        raid10_find_phys(conf, r10_bio);
@@ -1396,6 +1394,8 @@ retry_write:
                bio_list_add(&conf->pending_bio_list, mbio);
                conf->pending_count++;
                spin_unlock_irqrestore(&conf->device_lock, flags);
+                if (!mddev_check_plugged(mddev))
+                        md_wakeup_thread(mddev->thread);
                if (!r10_bio->devs[i].repl_bio)
                        continue;
@@ -1423,6 +1423,8 @@ retry_write:
                bio_list_add(&conf->pending_bio_list, mbio);
                conf->pending_count++;
                spin_unlock_irqrestore(&conf->device_lock, flags);
+                if (!mddev_check_plugged(mddev))
+                        md_wakeup_thread(mddev->thread);
        }
        /* Don't remove the bias on 'remaining' (one_write_done) until
@@ -1448,9 +1450,6 @@ retry_write:
        /* In case raid10d snuck in to freeze_array */
        wake_up(&conf->wait_barrier);
-        if (do_sync || !mddev->bitmap || !plugged)
-                md_wakeup_thread(mddev->thread);
 }
 static void status(struct seq_file *seq, struct mddev *mddev)
@@ -2310,7 +2309,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                        if (r10_sync_page_io(rdev,
                                             r10_bio->devs[sl].addr +
                                             sect,
-                                             s<<9, conf->tmppage, WRITE)
+                                             s, conf->tmppage, WRITE)
                            == 0) {
                                /* Well, this device is dead */
                                printk(KERN_NOTICE
@@ -2349,7 +2348,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                        switch (r10_sync_page_io(rdev,
                                             r10_bio->devs[sl].addr +
                                             sect,
-                                             s<<9, conf->tmppage,
+                                             s, conf->tmppage,
                                                 READ)) {
                        case 0:
                                /* Well, this device is dead */
@@ -2512,7 +2511,7 @@ read_more:
        slot = r10_bio->read_slot;
        printk_ratelimited(
                KERN_ERR
-                "md/raid10:%s: %s: redirecting"
+                "md/raid10:%s: %s: redirecting "
                "sector %llu to another mirror\n",
                mdname(mddev),
                bdevname(rdev->bdev, b),
@@ -2661,7 +2660,8 @@ static void raid10d(struct mddev *mddev)
        blk_start_plug(&plug);
        for (;;) {
-                flush_pending_writes(conf);
+                if (atomic_read(&mddev->plug_cnt) == 0)
+                        flush_pending_writes(conf);
                spin_lock_irqsave(&conf->device_lock, flags);
                if (list_empty(head)) {
@@ -2890,6 +2890,12 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
                        /* want to reconstruct this device */
                        rb2 = r10_bio;
                        sect = raid10_find_virt(conf, sector_nr, i);
+                        if (sect >= mddev->resync_max_sectors) {
+                                /* last stripe is not complete - don't
+                                 * try to recover this sector.
+                                 */
+                                continue;
+                        }
                        /* Unless we are doing a full sync, or a replacement
                         * we only need to recover the block if it is set in
                         * the bitmap
@@ -3421,7 +3427,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
        spin_lock_init(&conf->resync_lock);
        init_waitqueue_head(&conf->wait_barrier);
-        conf->thread = md_register_thread(raid10d, mddev, NULL);
+        conf->thread = md_register_thread(raid10d, mddev, "raid10");
        if (!conf->thread)
                goto out;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index d26767246d26..04348d76bb30 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -196,12 +196,14 @@ static void __release_stripe(struct r5conf *conf, struct stripe_head *sh)
                BUG_ON(!list_empty(&sh->lru));
                BUG_ON(atomic_read(&conf->active_stripes)==0);
                if (test_bit(STRIPE_HANDLE, &sh->state)) {
-                        if (test_bit(STRIPE_DELAYED, &sh->state))
+                        if (test_bit(STRIPE_DELAYED, &sh->state) &&
+                            !test_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
                                list_add_tail(&sh->lru, &conf->delayed_list);
                        else if (test_bit(STRIPE_BIT_DELAY, &sh->state) &&
                                   sh->bm_seq - conf->seq_write > 0)
                                list_add_tail(&sh->lru, &conf->bitmap_list);
                        else {
+                                clear_bit(STRIPE_DELAYED, &sh->state);
                                clear_bit(STRIPE_BIT_DELAY, &sh->state);
                                list_add_tail(&sh->lru, &conf->handle_list);
                        }
@@ -606,6 +608,12 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
                                         * a chance*/
                                        md_check_recovery(conf->mddev);
                                }
+                                /*
+                                 * Because md_wait_for_blocked_rdev
+                                 * will dec nr_pending, we must
+                                 * increment it first.
+                                 */
+                                atomic_inc(&rdev->nr_pending);
                                md_wait_for_blocked_rdev(rdev, conf->mddev);
                        } else {
                                /* Acknowledged bad block - skip the write */
@@ -1737,6 +1745,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
        } else {
                const char *bdn = bdevname(rdev->bdev, b);
                int retry = 0;
+                int set_bad = 0;
                clear_bit(R5_UPTODATE, &sh->dev[i].flags);
                atomic_inc(&rdev->read_errors);
@@ -1748,7 +1757,8 @@ static void raid5_end_read_request(struct bio * bi, int error)
                                mdname(conf->mddev),
                                (unsigned long long)s,
                                bdn);
-                else if (conf->mddev->degraded >= conf->max_degraded)
+                else if (conf->mddev->degraded >= conf->max_degraded) {
+                        set_bad = 1;
                        printk_ratelimited(
                                KERN_WARNING
                                "md/raid:%s: read error not correctable "
@@ -1756,8 +1766,9 @@ static void raid5_end_read_request(struct bio * bi, int error)
                                mdname(conf->mddev),
                                (unsigned long long)s,
                                bdn);
-                else if (test_bit(R5_ReWrite, &sh->dev[i].flags))
+                } else if (test_bit(R5_ReWrite, &sh->dev[i].flags)) {
                        /* Oh, no!!! */
+                        set_bad = 1;
                        printk_ratelimited(
                                KERN_WARNING
                                "md/raid:%s: read error NOT corrected!! "
@@ -1765,7 +1776,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
                                mdname(conf->mddev),
                                (unsigned long long)s,
                                bdn);
-                else if (atomic_read(&rdev->read_errors)
+                } else if (atomic_read(&rdev->read_errors)
                         > conf->max_nr_stripes)
                        printk(KERN_WARNING
                               "md/raid:%s: Too many read errors, failing device %s.\n",
@@ -1777,7 +1788,11 @@ static void raid5_end_read_request(struct bio * bi, int error)
                else {
                        clear_bit(R5_ReadError, &sh->dev[i].flags);
                        clear_bit(R5_ReWrite, &sh->dev[i].flags);
-                        md_error(conf->mddev, rdev);
+                        if (!(set_bad
+                              && test_bit(In_sync, &rdev->flags)
+                              && rdev_set_badblocks(
+                                      rdev, sh->sector, STRIPE_SECTORS, 0)))
+                                md_error(conf->mddev, rdev);
                }
        }
        rdev_dec_pending(rdev, conf->mddev);
@@ -3582,8 +3597,18 @@ static void handle_stripe(struct stripe_head *sh)
 finish:
        /* wait for this device to become unblocked */
-        if (conf->mddev->external && unlikely(s.blocked_rdev))
+        if (unlikely(s.blocked_rdev)) {
-                md_wait_for_blocked_rdev(s.blocked_rdev, conf->mddev);
+                if (conf->mddev->external)
+                        md_wait_for_blocked_rdev(s.blocked_rdev,
+                                                 conf->mddev);
+                else
+                        /* Internal metadata will immediately
+                         * be written by raid5d, so we don't
+                         * need to wait here.
+                         */
+                        rdev_dec_pending(s.blocked_rdev,
+                                         conf->mddev);
+        }
        if (s.handle_bad_blocks)
                for (i = disks; i--; ) {
@@ -3881,8 +3906,6 @@ static int chunk_aligned_read(struct mddev *mddev, struct bio * raid_bio)
                raid_bio->bi_next = (void*)rdev;
                align_bi->bi_bdev =  rdev->bdev;
                align_bi->bi_flags &= ~(1 << BIO_SEG_VALID);
-                /* No reshape active, so we can trust rdev->data_offset */
-                align_bi->bi_sector += rdev->data_offset;
                if (!bio_fits_rdev(align_bi) ||
                    is_badblock(rdev, align_bi->bi_sector, align_bi->bi_size>>9,
@@ -3893,6 +3916,9 @@ static int chunk_aligned_read(struct mddev *mddev, struct bio * raid_bio)
                        return 0;
                }
+                /* No reshape active, so we can trust rdev->data_offset */
+                align_bi->bi_sector += rdev->data_offset;
                spin_lock_irq(&conf->device_lock);
                wait_event_lock_irq(conf->wait_for_stripe,
                                    conf->quiesce == 0,
@@ -3971,7 +3997,6 @@ static void make_request(struct mddev *mddev, struct bio * bi)
        struct stripe_head *sh;
        const int rw = bio_data_dir(bi);
        int remaining;
-        int plugged;
        if (unlikely(bi->bi_rw & REQ_FLUSH)) {
                md_flush_request(mddev, bi);
@@ -3990,7 +4015,6 @@ static void make_request(struct mddev *mddev, struct bio * bi)
        bi->bi_next = NULL;
        bi->bi_phys_segments = 1;       /* over-loaded to count active stripes */
-        plugged = mddev_check_plugged(mddev);
        for (;logical_sector < last_sector; logical_sector += STRIPE_SECTORS) {
                DEFINE_WAIT(w);
                int previous;
@@ -4092,6 +4116,7 @@ static void make_request(struct mddev *mddev, struct bio * bi)
                        if ((bi->bi_rw & REQ_SYNC) &&
                            !test_and_set_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
                                atomic_inc(&conf->preread_active_stripes);
+                        mddev_check_plugged(mddev);
                        release_stripe(sh);
                } else {
                        /* cannot get stripe for read-ahead, just give-up */
@@ -4099,10 +4124,7 @@ static void make_request(struct mddev *mddev, struct bio * bi)
                        finish_wait(&conf->wait_for_overlap, &w);
                        break;
                }
-                        
        }
-        if (!plugged)
-                md_wakeup_thread(mddev->thread);
        spin_lock_irq(&conf->device_lock);
        remaining = raid5_dec_bi_phys_segments(bi);
@@ -4823,6 +4845,7 @@ static struct r5conf *setup_conf(struct mddev *mddev)
        int raid_disk, memory, max_disks;
        struct md_rdev *rdev;
        struct disk_info *disk;
+        char pers_name[6];
        if (mddev->new_level != 5
            && mddev->new_level != 4
@@ -4946,7 +4969,8 @@ static struct r5conf *setup_conf(struct mddev *mddev)
                printk(KERN_INFO "md/raid:%s: allocated %dkB\n",
                       mdname(mddev), memory);
-        conf->thread = md_register_thread(raid5d, mddev, NULL);
+        sprintf(pers_name, "raid%d", mddev->new_level);
+        conf->thread = md_register_thread(raid5d, mddev, pers_name);
        if (!conf->thread) {
                printk(KERN_ERR
                       "md/raid:%s: couldn't allocate thread.\n",
@@ -5465,10 +5489,9 @@ static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
        if (rdev->saved_raid_disk >= 0 &&
            rdev->saved_raid_disk >= first &&
            conf->disks[rdev->saved_raid_disk].rdev == NULL)
-                disk = rdev->saved_raid_disk;
+                first = rdev->saved_raid_disk;
-        else
-                disk = first;
+        for (disk = first; disk <= last; disk++) {
-        for ( ; disk <= last ; disk++) {
                p = conf->disks + disk;
                if (p->rdev == NULL) {
                        clear_bit(In_sync, &rdev->flags);
@@ -5477,8 +5500,11 @@ static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
                        if (rdev->saved_raid_disk != disk)
                                conf->fullsync = 1;
                        rcu_assign_pointer(p->rdev, rdev);
-                        break;
+                        goto out;
                }
+        }
+        for (disk = first; disk <= last; disk++) {
+                p = conf->disks + disk;
                if (test_bit(WantReplacement, &p->rdev->flags) &&
                    p->replacement == NULL) {
                        clear_bit(In_sync, &rdev->flags);
@@ -5490,6 +5516,7 @@ static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
                        break;
                }
        }
+out:
        print_raid5_conf(conf);
        return err;
 }
diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
index 00a67326c193..39eab73b01ae 100644
--- a/drivers/media/dvb/dvb-core/dvbdev.c
+++ b/drivers/media/dvb/dvb-core/dvbdev.c
@@ -243,6 +243,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
        if (minor == MAX_DVB_MINORS) {
                kfree(dvbdevfops);
                kfree(dvbdev);
+                up_write(&minor_rwsem);
                mutex_unlock(&dvbdev_register_lock);
                return -EINVAL;
        }
diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
index 342c2c8c1ddf..54ee34872d14 100644
--- a/drivers/media/rc/winbond-cir.c
+++ b/drivers/media/rc/winbond-cir.c
@@ -232,7 +232,7 @@ MODULE_PARM_DESC(invert, "Invert the signal from the IR receiver");
 static bool txandrx; /* default = 0 */
 module_param(txandrx, bool, 0444);
-MODULE_PARM_DESC(invert, "Allow simultaneous TX and RX");
+MODULE_PARM_DESC(txandrx, "Allow simultaneous TX and RX");
 static unsigned int wake_sc = 0x800F040C;
 module_param(wake_sc, uint, 0644);
@@ -1032,6 +1032,8 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
        data->dev->tx_ir = wbcir_tx;
        data->dev->priv = data;
        data->dev->dev.parent = &device->dev;
+        data->dev->timeout = MS_TO_NS(100);
+        data->dev->allowed_protos = RC_TYPE_ALL;
        if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
                dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
diff --git a/drivers/media/video/cx231xx/cx231xx-audio.c b/drivers/media/video/cx231xx/cx231xx-audio.c
index 068f78dc5d13..b4c99c7270cf 100644
--- a/drivers/media/video/cx231xx/cx231xx-audio.c
+++ b/drivers/media/video/cx231xx/cx231xx-audio.c
@@ -307,7 +307,7 @@ static int cx231xx_init_audio_isoc(struct cx231xx *dev)
                urb->context = dev;
                urb->pipe = usb_rcvisocpipe(dev->udev,
                                                dev->adev.end_point_addr);
-                urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
+                urb->transfer_flags = URB_ISO_ASAP;
                urb->transfer_buffer = dev->adev.transfer_buffer[i];
                urb->interval = 1;
                urb->complete = cx231xx_audio_isocirq;
@@ -368,7 +368,7 @@ static int cx231xx_init_audio_bulk(struct cx231xx *dev)
                urb->context = dev;
                urb->pipe = usb_rcvbulkpipe(dev->udev,
                                                dev->adev.end_point_addr);
-                urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
+                urb->transfer_flags = 0;
                urb->transfer_buffer = dev->adev.transfer_buffer[i];
                urb->complete = cx231xx_audio_bulkirq;
                urb->transfer_buffer_length = sb_size;
diff --git a/drivers/media/video/cx231xx/cx231xx-vbi.c b/drivers/media/video/cx231xx/cx231xx-vbi.c
index 3d15314e1f88..ac7db52f404f 100644
--- a/drivers/media/video/cx231xx/cx231xx-vbi.c
+++ b/drivers/media/video/cx231xx/cx231xx-vbi.c
@@ -448,7 +448,7 @@ int cx231xx_init_vbi_isoc(struct cx231xx *dev, int max_packets,
                        return -ENOMEM;
                }
                dev->vbi_mode.bulk_ctl.urb[i] = urb;
-                urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
+                urb->transfer_flags = 0;
                dev->vbi_mode.bulk_ctl.transfer_buffer[i] =
                    kzalloc(sb_size, GFP_KERNEL);
diff --git a/drivers/media/video/cx23885/cx23885-cards.c b/drivers/media/video/cx23885/cx23885-cards.c
index 13739e002a63..080e11157e5f 100644
--- a/drivers/media/video/cx23885/cx23885-cards.c
+++ b/drivers/media/video/cx23885/cx23885-cards.c
@@ -127,22 +127,37 @@ struct cx23885_board cx23885_boards[] = {
        },
        [CX23885_BOARD_HAUPPAUGE_HVR1250] = {
                .name           = "Hauppauge WinTV-HVR1250",
+                .porta          = CX23885_ANALOG_VIDEO,
                .portc          = CX23885_MPEG_DVB,
+#ifdef MT2131_NO_ANALOG_SUPPORT_YET
+                .tuner_type     = TUNER_PHILIPS_TDA8290,
+                .tuner_addr     = 0x42, /* 0x84 >> 1 */
+                .tuner_bus      = 1,
+#endif
+                .force_bff      = 1,
                .input          = {{
+#ifdef MT2131_NO_ANALOG_SUPPORT_YET
                        .type   = CX23885_VMUX_TELEVISION,
-                        .vmux   = 0,
+                        .vmux   =       CX25840_VIN7_CH3 |
+                                        CX25840_VIN5_CH2 |
+                                        CX25840_VIN2_CH1,
+                        .amux   = CX25840_AUDIO8,
                        .gpio0  = 0xff00,
                }, {
-                        .type   = CX23885_VMUX_DEBUG,
+#endif
-                        .vmux   = 0,
-                        .gpio0  = 0xff01,
-                }, {
                        .type   = CX23885_VMUX_COMPOSITE1,
-                        .vmux   = 1,
+                        .vmux   =       CX25840_VIN7_CH3 |
+                                        CX25840_VIN4_CH2 |
+                                        CX25840_VIN6_CH1,
+                        .amux   = CX25840_AUDIO7,
                        .gpio0  = 0xff02,
                }, {
                        .type   = CX23885_VMUX_SVIDEO,
-                        .vmux   = 2,
+                        .vmux   =       CX25840_VIN7_CH3 |
+                                        CX25840_VIN4_CH2 |
+                                        CX25840_VIN8_CH1 |
+                                        CX25840_SVIDEO_ON,
+                        .amux   = CX25840_AUDIO7,
                        .gpio0  = 0xff02,
                } },
        },
@@ -267,7 +282,55 @@ struct cx23885_board cx23885_boards[] = {
        },
        [CX23885_BOARD_HAUPPAUGE_HVR1255] = {
                .name           = "Hauppauge WinTV-HVR1255",
+                .porta          = CX23885_ANALOG_VIDEO,
+                .portc          = CX23885_MPEG_DVB,
+                .tuner_type     = TUNER_ABSENT,
+                .tuner_addr     = 0x42, /* 0x84 >> 1 */
+                .force_bff      = 1,
+                .input          = {{
+                        .type   = CX23885_VMUX_TELEVISION,
+                        .vmux   =       CX25840_VIN7_CH3 |
+                                        CX25840_VIN5_CH2 |
+                                        CX25840_VIN2_CH1 |
+                                        CX25840_DIF_ON,
+                        .amux   = CX25840_AUDIO8,
+                }, {
+                        .type   = CX23885_VMUX_COMPOSITE1,
+                        .vmux   =       CX25840_VIN7_CH3 |
+                                        CX25840_VIN4_CH2 |
+                                        CX25840_VIN6_CH1,
+                        .amux   = CX25840_AUDIO7,
+                }, {
+                        .type   = CX23885_VMUX_SVIDEO,
+                        .vmux   =       CX25840_VIN7_CH3 |
+                                        CX25840_VIN4_CH2 |
+                                        CX25840_VIN8_CH1 |
+                                        CX25840_SVIDEO_ON,
+                        .amux   = CX25840_AUDIO7,
+                } },
+        },
+        [CX23885_BOARD_HAUPPAUGE_HVR1255_22111] = {
+                .name           = "Hauppauge WinTV-HVR1255",
+                .porta          = CX23885_ANALOG_VIDEO,
                .portc          = CX23885_MPEG_DVB,
+                .tuner_type     = TUNER_ABSENT,
+                .tuner_addr     = 0x42, /* 0x84 >> 1 */
+                .force_bff      = 1,
+                .input          = {{
+                        .type   = CX23885_VMUX_TELEVISION,
+                        .vmux   =       CX25840_VIN7_CH3 |
+                                        CX25840_VIN5_CH2 |
+                                        CX25840_VIN2_CH1 |
+                                        CX25840_DIF_ON,
+                        .amux   = CX25840_AUDIO8,
+                }, {
+                        .type   = CX23885_VMUX_SVIDEO,
+                        .vmux   =       CX25840_VIN7_CH3 |
+                                        CX25840_VIN4_CH2 |
+                                        CX25840_VIN8_CH1 |
+                                        CX25840_SVIDEO_ON,
+                        .amux   = CX25840_AUDIO7,
+                } },
        },
        [CX23885_BOARD_HAUPPAUGE_HVR1210] = {
                .name           = "Hauppauge WinTV-HVR1210",
@@ -624,7 +687,7 @@ struct cx23885_subid cx23885_subids[] = {
        }, {
                .subvendor = 0x0070,
                .subdevice = 0x2259,
-                .card      = CX23885_BOARD_HAUPPAUGE_HVR1255,
+                .card      = CX23885_BOARD_HAUPPAUGE_HVR1255_22111,
        }, {
                .subvendor = 0x0070,
                .subdevice = 0x2291,
@@ -900,7 +963,7 @@ int cx23885_tuner_callback(void *priv, int component, int command, int arg)
        struct cx23885_dev *dev = port->dev;
        u32 bitmask = 0;
-        if (command == XC2028_RESET_CLK)
+        if ((command == XC2028_RESET_CLK) || (command == XC2028_I2C_FLUSH))
                return 0;
        if (command != 0) {
@@ -1130,6 +1193,7 @@ void cx23885_gpio_setup(struct cx23885_dev *dev)
        case CX23885_BOARD_HAUPPAUGE_HVR1270:
        case CX23885_BOARD_HAUPPAUGE_HVR1275:
        case CX23885_BOARD_HAUPPAUGE_HVR1255:
+        case CX23885_BOARD_HAUPPAUGE_HVR1255_22111:
        case CX23885_BOARD_HAUPPAUGE_HVR1210:
                /* GPIO-5 RF Control: 0 = RF1 Terrestrial, 1 = RF2 Cable */
                /* GPIO-6 I2C Gate which can isolate the demod from the bus */
@@ -1267,6 +1331,7 @@ int cx23885_ir_init(struct cx23885_dev *dev)
        case CX23885_BOARD_HAUPPAUGE_HVR1400:
        case CX23885_BOARD_HAUPPAUGE_HVR1275:
        case CX23885_BOARD_HAUPPAUGE_HVR1255:
+        case CX23885_BOARD_HAUPPAUGE_HVR1255_22111:
        case CX23885_BOARD_HAUPPAUGE_HVR1210:
                /* FIXME: Implement me */
                break;
@@ -1424,6 +1489,7 @@ void cx23885_card_setup(struct cx23885_dev *dev)
        case CX23885_BOARD_HAUPPAUGE_HVR1270:
        case CX23885_BOARD_HAUPPAUGE_HVR1275:
        case CX23885_BOARD_HAUPPAUGE_HVR1255:
+        case CX23885_BOARD_HAUPPAUGE_HVR1255_22111:
        case CX23885_BOARD_HAUPPAUGE_HVR1210:
        case CX23885_BOARD_HAUPPAUGE_HVR1850:
        case CX23885_BOARD_HAUPPAUGE_HVR1290:
@@ -1511,6 +1577,7 @@ void cx23885_card_setup(struct cx23885_dev *dev)
        case CX23885_BOARD_HAUPPAUGE_HVR1270:
        case CX23885_BOARD_HAUPPAUGE_HVR1275:
        case CX23885_BOARD_HAUPPAUGE_HVR1255:
+        case CX23885_BOARD_HAUPPAUGE_HVR1255_22111:
        case CX23885_BOARD_HAUPPAUGE_HVR1210:
        case CX23885_BOARD_COMPRO_VIDEOMATE_E800:
        case CX23885_BOARD_HAUPPAUGE_HVR1290:
@@ -1526,10 +1593,10 @@ void cx23885_card_setup(struct cx23885_dev *dev)
         */
        switch (dev->board) {
        case CX23885_BOARD_TEVII_S470:
-        case CX23885_BOARD_HAUPPAUGE_HVR1250:
                /* Currently only enabled for the integrated IR controller */
                if (!enable_885_ir)
                        break;
+        case CX23885_BOARD_HAUPPAUGE_HVR1250:
        case CX23885_BOARD_HAUPPAUGE_HVR1800:
        case CX23885_BOARD_HAUPPAUGE_HVR1800lp:
        case CX23885_BOARD_HAUPPAUGE_HVR1700:
@@ -1539,6 +1606,8 @@ void cx23885_card_setup(struct cx23885_dev *dev)
        case CX23885_BOARD_NETUP_DUAL_DVBS2_CI:
        case CX23885_BOARD_NETUP_DUAL_DVB_T_C_CI_RF:
        case CX23885_BOARD_COMPRO_VIDEOMATE_E800:
+        case CX23885_BOARD_HAUPPAUGE_HVR1255:
+        case CX23885_BOARD_HAUPPAUGE_HVR1255_22111:
        case CX23885_BOARD_HAUPPAUGE_HVR1270:
        case CX23885_BOARD_HAUPPAUGE_HVR1850:
        case CX23885_BOARD_MYGICA_X8506:
diff --git a/drivers/media/video/cx23885/cx23885-dvb.c b/drivers/media/video/cx23885/cx23885-dvb.c
index a80a92c47455..cd542684ba02 100644
--- a/drivers/media/video/cx23885/cx23885-dvb.c
+++ b/drivers/media/video/cx23885/cx23885-dvb.c
@@ -712,6 +712,7 @@ static int dvb_register(struct cx23885_tsport *port)
                }
                break;
        case CX23885_BOARD_HAUPPAUGE_HVR1255:
+        case CX23885_BOARD_HAUPPAUGE_HVR1255_22111:
                i2c_bus = &dev->i2c_bus[0];
                fe0->dvb.frontend = dvb_attach(s5h1411_attach,
                                               &hcw_s5h1411_config,
@@ -721,6 +722,11 @@ static int dvb_register(struct cx23885_tsport *port)
                                   0x60, &dev->i2c_bus[1].i2c_adap,
                                   &hauppauge_tda18271_config);
                }
+                tda18271_attach(&dev->ts1.analog_fe,
+                        0x60, &dev->i2c_bus[1].i2c_adap,
+                        &hauppauge_tda18271_config);
                break;
        case CX23885_BOARD_HAUPPAUGE_HVR1800:
                i2c_bus = &dev->i2c_bus[0];
diff --git a/drivers/media/video/cx23885/cx23885-video.c b/drivers/media/video/cx23885/cx23885-video.c
index c654bdc7ccb2..22f8e7fbd665 100644
--- a/drivers/media/video/cx23885/cx23885-video.c
+++ b/drivers/media/video/cx23885/cx23885-video.c
@@ -505,6 +505,9 @@ static int cx23885_video_mux(struct cx23885_dev *dev, unsigned int input)
        if ((dev->board == CX23885_BOARD_HAUPPAUGE_HVR1800) ||
                (dev->board == CX23885_BOARD_MPX885) ||
+                (dev->board == CX23885_BOARD_HAUPPAUGE_HVR1250) ||
+                (dev->board == CX23885_BOARD_HAUPPAUGE_HVR1255) ||
+                (dev->board == CX23885_BOARD_HAUPPAUGE_HVR1255_22111) ||
                (dev->board == CX23885_BOARD_HAUPPAUGE_HVR1850)) {
                /* Configure audio routing */
                v4l2_subdev_call(dev->sd_cx25840, audio, s_routing,
@@ -1578,7 +1581,9 @@ static int cx23885_set_freq_via_ops(struct cx23885_dev *dev,
        fe = vfe->dvb.frontend;
-        if (dev->board == CX23885_BOARD_HAUPPAUGE_HVR1850)
+        if ((dev->board == CX23885_BOARD_HAUPPAUGE_HVR1850) ||
+            (dev->board == CX23885_BOARD_HAUPPAUGE_HVR1255) ||
+            (dev->board == CX23885_BOARD_HAUPPAUGE_HVR1255_22111))
                fe = &dev->ts1.analog_fe;
        if (fe && fe->ops.tuner_ops.set_analog_params) {
@@ -1608,6 +1613,8 @@ int cx23885_set_frequency(struct file *file, void *priv,
        int ret;
        switch (dev->board) {
+        case CX23885_BOARD_HAUPPAUGE_HVR1255:
+        case CX23885_BOARD_HAUPPAUGE_HVR1255_22111:
        case CX23885_BOARD_HAUPPAUGE_HVR1850:
                ret = cx23885_set_freq_via_ops(dev, f);
                break;
diff --git a/drivers/media/video/cx23885/cx23885.h b/drivers/media/video/cx23885/cx23885.h
index d884784a1c85..13c37ec07ae7 100644
--- a/drivers/media/video/cx23885/cx23885.h
+++ b/drivers/media/video/cx23885/cx23885.h
@@ -90,6 +90,7 @@
 #define CX23885_BOARD_MYGICA_X8507             33
 #define CX23885_BOARD_TERRATEC_CINERGY_T_PCIE_DUAL 34
 #define CX23885_BOARD_TEVII_S471               35
+#define CX23885_BOARD_HAUPPAUGE_HVR1255_22111  36
 #define GPIO_0 0x00000001
 #define GPIO_1 0x00000002
diff --git a/drivers/media/video/cx25821/cx25821-core.c b/drivers/media/video/cx25821/cx25821-core.c
index 83c1aa6b2e6c..f11f6f07e915 100644
--- a/drivers/media/video/cx25821/cx25821-core.c
+++ b/drivers/media/video/cx25821/cx25821-core.c
@@ -904,9 +904,6 @@ static int cx25821_dev_setup(struct cx25821_dev *dev)
        list_add_tail(&dev->devlist, &cx25821_devlist);
        mutex_unlock(&cx25821_devlist_mutex);
-        strcpy(cx25821_boards[UNKNOWN_BOARD].name, "unknown");
-        strcpy(cx25821_boards[CX25821_BOARD].name, "cx25821");
        if (dev->pci->device != 0x8210) {
                pr_info("%s(): Exiting. Incorrect Hardware device = 0x%02x\n",
                        __func__, dev->pci->device);
diff --git a/drivers/media/video/cx25821/cx25821.h b/drivers/media/video/cx25821/cx25821.h
index b9aa801b00a7..029f2934a6d8 100644
--- a/drivers/media/video/cx25821/cx25821.h
+++ b/drivers/media/video/cx25821/cx25821.h
@@ -187,7 +187,7 @@ enum port {
 };
 struct cx25821_board {
-        char *name;
+        const char *name;
        enum port porta;
        enum port portb;
        enum port portc;
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index fc1ff69cffd0..d8eac3e30a7e 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -84,7 +84,7 @@ MODULE_PARM_DESC(debug, "Debugging messages [0=Off (default) 1=On]");
 /* ----------------------------------------------------------------------- */
-static void cx23885_std_setup(struct i2c_client *client);
+static void cx23888_std_setup(struct i2c_client *client);
 int cx25840_write(struct i2c_client *client, u16 addr, u8 value)
 {
@@ -638,10 +638,13 @@ static void cx23885_initialize(struct i2c_client *client)
        finish_wait(&state->fw_wait, &wait);
        destroy_workqueue(q);
-        /* Call the cx23885 specific std setup func, we no longer rely on
+        /* Call the cx23888 specific std setup func, we no longer rely on
         * the generic cx24840 func.
         */
-        cx23885_std_setup(client);
+        if (is_cx23888(state))
+                cx23888_std_setup(client);
+        else
+                cx25840_std_setup(client);
        /* (re)set input */
        set_input(client, state->vid_input, state->aud_input);
@@ -1103,9 +1106,23 @@ static int set_input(struct i2c_client *client, enum cx25840_video_input vid_inp
                        cx25840_write4(client, 0x410, 0xffff0dbf);
                        cx25840_write4(client, 0x414, 0x00137d03);
-                        cx25840_write4(client, 0x418, 0x01008080);
+                        /* on the 887, 0x418 is HSCALE_CTRL, on the 888 it is 
+                           CHROMA_CTRL */
+                        if (is_cx23888(state))
+                                cx25840_write4(client, 0x418, 0x01008080);
+                        else
+                                cx25840_write4(client, 0x418, 0x01000000);
                        cx25840_write4(client, 0x41c, 0x00000000);
-                        cx25840_write4(client, 0x420, 0x001c3e0f);
+                        /* on the 887, 0x420 is CHROMA_CTRL, on the 888 it is 
+                           CRUSH_CTRL */
+                        if (is_cx23888(state))
+                                cx25840_write4(client, 0x420, 0x001c3e0f);
+                        else
+                                cx25840_write4(client, 0x420, 0x001c8282);
                        cx25840_write4(client, 0x42c, 0x42600000);
                        cx25840_write4(client, 0x430, 0x0000039b);
                        cx25840_write4(client, 0x438, 0x00000000);
@@ -1233,7 +1250,7 @@ static int set_input(struct i2c_client *client, enum cx25840_video_input vid_inp
                cx25840_write4(client, 0x8d0, 0x1f063870);
        }
-        if (is_cx2388x(state)) {
+        if (is_cx23888(state)) {
                /* HVR1850 */
                /* AUD_IO_CTRL - I2S Input, Parallel1*/
                /*  - Channel 1 src - Parallel1 (Merlin out) */
@@ -1298,8 +1315,8 @@ static int set_v4lstd(struct i2c_client *client)
        }
        cx25840_and_or(client, 0x400, ~0xf, fmt);
        cx25840_and_or(client, 0x403, ~0x3, pal_m);
-        if (is_cx2388x(state))
+        if (is_cx23888(state))
-                cx23885_std_setup(client);
+                cx23888_std_setup(client);
        else
                cx25840_std_setup(client);
        if (!is_cx2583x(state))
@@ -1312,6 +1329,7 @@ static int set_v4lstd(struct i2c_client *client)
 static int cx25840_s_ctrl(struct v4l2_ctrl *ctrl)
 {
        struct v4l2_subdev *sd = to_sd(ctrl);
+        struct cx25840_state *state = to_state(sd);
        struct i2c_client *client = v4l2_get_subdevdata(sd);
        switch (ctrl->id) {
@@ -1324,12 +1342,20 @@ static int cx25840_s_ctrl(struct v4l2_ctrl *ctrl)
                break;
        case V4L2_CID_SATURATION:
-                cx25840_write(client, 0x420, ctrl->val << 1);
+                if (is_cx23888(state)) {
-                cx25840_write(client, 0x421, ctrl->val << 1);
+                        cx25840_write(client, 0x418, ctrl->val << 1);
+                        cx25840_write(client, 0x419, ctrl->val << 1);
+                } else {
+                        cx25840_write(client, 0x420, ctrl->val << 1);
+                        cx25840_write(client, 0x421, ctrl->val << 1);
+                }
                break;
        case V4L2_CID_HUE:
-                cx25840_write(client, 0x422, ctrl->val);
+                if (is_cx23888(state))
+                        cx25840_write(client, 0x41a, ctrl->val);
+                else
+                        cx25840_write(client, 0x422, ctrl->val);
                break;
        default:
@@ -1354,11 +1380,21 @@ static int cx25840_s_mbus_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt
        fmt->field = V4L2_FIELD_INTERLACED;
        fmt->colorspace = V4L2_COLORSPACE_SMPTE170M;
-        Vsrc = (cx25840_read(client, 0x476) & 0x3f) << 4;
+        if (is_cx23888(state)) {
-        Vsrc |= (cx25840_read(client, 0x475) & 0xf0) >> 4;
+                Vsrc = (cx25840_read(client, 0x42a) & 0x3f) << 4;
+                Vsrc |= (cx25840_read(client, 0x429) & 0xf0) >> 4;
+        } else {
+                Vsrc = (cx25840_read(client, 0x476) & 0x3f) << 4;
+                Vsrc |= (cx25840_read(client, 0x475) & 0xf0) >> 4;
+        }
-        Hsrc = (cx25840_read(client, 0x472) & 0x3f) << 4;
+        if (is_cx23888(state)) {
-        Hsrc |= (cx25840_read(client, 0x471) & 0xf0) >> 4;
+                Hsrc = (cx25840_read(client, 0x426) & 0x3f) << 4;
+                Hsrc |= (cx25840_read(client, 0x425) & 0xf0) >> 4;
+        } else {
+                Hsrc = (cx25840_read(client, 0x472) & 0x3f) << 4;
+                Hsrc |= (cx25840_read(client, 0x471) & 0xf0) >> 4;
+        }
        Vlines = fmt->height + (is_50Hz ? 4 : 7);
@@ -1782,8 +1818,8 @@ static int cx25840_s_video_routing(struct v4l2_subdev *sd,
        struct cx25840_state *state = to_state(sd);
        struct i2c_client *client = v4l2_get_subdevdata(sd);
-        if (is_cx2388x(state))
+        if (is_cx23888(state))
-                cx23885_std_setup(client);
+                cx23888_std_setup(client);
        return set_input(client, input, state->aud_input);
 }
@@ -1794,8 +1830,8 @@ static int cx25840_s_audio_routing(struct v4l2_subdev *sd,
        struct cx25840_state *state = to_state(sd);
        struct i2c_client *client = v4l2_get_subdevdata(sd);
-        if (is_cx2388x(state))
+        if (is_cx23888(state))
-                cx23885_std_setup(client);
+                cx23888_std_setup(client);
        return set_input(client, state->vid_input, input);
 }
@@ -4939,7 +4975,7 @@ void cx23885_dif_setup(struct i2c_client *client, u32 ifHz)
        }
 }
-static void cx23885_std_setup(struct i2c_client *client)
+static void cx23888_std_setup(struct i2c_client *client)
 {
        struct cx25840_state *state = to_state(i2c_get_clientdata(client));
        v4l2_std_id std = state->std;
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index 92da7c28b6f0..862c6575c557 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -2893,7 +2893,7 @@ static void request_module_async(struct work_struct *work)
        if (dev->board.has_dvb)
                request_module("em28xx-dvb");
-        if (dev->board.has_ir_i2c && !disable_ir)
+        if (dev->board.ir_codes && !disable_ir)
                request_module("em28xx-rc");
 }
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
index 6c31e46a1fd2..b9c6f17eabb2 100644
--- a/drivers/media/video/gspca/sn9c20x.c
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -2070,10 +2070,13 @@ static int sd_start(struct gspca_dev *gspca_dev)
        set_gamma(gspca_dev, v4l2_ctrl_g_ctrl(sd->gamma));
        set_redblue(gspca_dev, v4l2_ctrl_g_ctrl(sd->blue),
                        v4l2_ctrl_g_ctrl(sd->red));
-        set_gain(gspca_dev, v4l2_ctrl_g_ctrl(sd->gain));
+        if (sd->gain)
-        set_exposure(gspca_dev, v4l2_ctrl_g_ctrl(sd->exposure));
+                set_gain(gspca_dev, v4l2_ctrl_g_ctrl(sd->gain));
-        set_hvflip(gspca_dev, v4l2_ctrl_g_ctrl(sd->hflip),
+        if (sd->exposure)
-                        v4l2_ctrl_g_ctrl(sd->vflip));
+                set_exposure(gspca_dev, v4l2_ctrl_g_ctrl(sd->exposure));
+        if (sd->hflip)
+                set_hvflip(gspca_dev, v4l2_ctrl_g_ctrl(sd->hflip),
+                                v4l2_ctrl_g_ctrl(sd->vflip));
        reg_w1(gspca_dev, 0x1007, 0x20);
        reg_w1(gspca_dev, 0x1061, 0x03);
@@ -2176,7 +2179,7 @@ static void sd_dqcallback(struct gspca_dev *gspca_dev)
        struct sd *sd = (struct sd *) gspca_dev;
        int avg_lum;
-        if (!v4l2_ctrl_g_ctrl(sd->autogain))
+        if (sd->autogain == NULL || !v4l2_ctrl_g_ctrl(sd->autogain))
                return;
        avg_lum = atomic_read(&sd->avg_lum);
diff --git a/drivers/media/video/mx2_camera.c b/drivers/media/video/mx2_camera.c
index 41f9a254b245..637bde8aca28 100644
--- a/drivers/media/video/mx2_camera.c
+++ b/drivers/media/video/mx2_camera.c
@@ -83,6 +83,7 @@
 #define CSICR1_INV_DATA         (1 << 3)
 #define CSICR1_INV_PCLK         (1 << 2)
 #define CSICR1_REDGE            (1 << 1)
+#define CSICR1_FMT_MASK         (CSICR1_PACK_DIR | CSICR1_SWAP16_EN)
 #define SHIFT_STATFF_LEVEL      22
 #define SHIFT_RXFF_LEVEL        19
@@ -230,6 +231,7 @@ struct mx2_prp_cfg {
        u32 src_pixel;
        u32 ch1_pixel;
        u32 irq_flags;
+        u32 csicr1;
 };
 /* prp resizing parameters */
@@ -330,6 +332,7 @@ static struct mx2_fmt_cfg mx27_emma_prp_table[] = {
                        .ch1_pixel      = 0x2ca00565, /* RGB565 */
                        .irq_flags      = PRP_INTR_RDERR | PRP_INTR_CH1WERR |
                                                PRP_INTR_CH1FC | PRP_INTR_LBOVF,
+                        .csicr1         = 0,
                }
        },
        {
@@ -343,6 +346,21 @@ static struct mx2_fmt_cfg mx27_emma_prp_table[] = {
                        .irq_flags      = PRP_INTR_RDERR | PRP_INTR_CH2WERR |
                                        PRP_INTR_CH2FC | PRP_INTR_LBOVF |
                                        PRP_INTR_CH2OVF,
+                        .csicr1         = CSICR1_PACK_DIR,
+                }
+        },
+        {
+                .in_fmt         = V4L2_MBUS_FMT_UYVY8_2X8,
+                .out_fmt        = V4L2_PIX_FMT_YUV420,
+                .cfg            = {
+                        .channel        = 2,
+                        .in_fmt         = PRP_CNTL_DATA_IN_YUV422,
+                        .out_fmt        = PRP_CNTL_CH2_OUT_YUV420,
+                        .src_pixel      = 0x22000888, /* YUV422 (YUYV) */
+                        .irq_flags      = PRP_INTR_RDERR | PRP_INTR_CH2WERR |
+                                        PRP_INTR_CH2FC | PRP_INTR_LBOVF |
+                                        PRP_INTR_CH2OVF,
+                        .csicr1         = CSICR1_SWAP16_EN,
                }
        },
 };
@@ -1015,14 +1033,14 @@ static int mx2_camera_set_bus_param(struct soc_camera_device *icd)
                return ret;
        }
+        csicr1 = (csicr1 & ~CSICR1_FMT_MASK) | pcdev->emma_prp->cfg.csicr1;
        if (common_flags & V4L2_MBUS_PCLK_SAMPLE_RISING)
                csicr1 |= CSICR1_REDGE;
        if (common_flags & V4L2_MBUS_VSYNC_ACTIVE_HIGH)
                csicr1 |= CSICR1_SOF_POL;
        if (common_flags & V4L2_MBUS_HSYNC_ACTIVE_HIGH)
                csicr1 |= CSICR1_HSYNC_POL;
-        if (pcdev->platform_flags & MX2_CAMERA_SWAP16)
-                csicr1 |= CSICR1_SWAP16_EN;
        if (pcdev->platform_flags & MX2_CAMERA_EXT_VSYNC)
                csicr1 |= CSICR1_EXT_VSYNC;
        if (pcdev->platform_flags & MX2_CAMERA_CCIR)
@@ -1033,8 +1051,6 @@ static int mx2_camera_set_bus_param(struct soc_camera_device *icd)
                csicr1 |= CSICR1_GCLK_MODE;
        if (pcdev->platform_flags & MX2_CAMERA_INV_DATA)
                csicr1 |= CSICR1_INV_DATA;
-        if (pcdev->platform_flags & MX2_CAMERA_PACK_DIR_MSB)
-                csicr1 |= CSICR1_PACK_DIR;
        pcdev->csicr1 = csicr1;
@@ -1109,7 +1125,8 @@ static int mx2_camera_get_formats(struct soc_camera_device *icd,
                return 0;
        }
-        if (code == V4L2_MBUS_FMT_YUYV8_2X8) {
+        if (code == V4L2_MBUS_FMT_YUYV8_2X8 ||
+            code == V4L2_MBUS_FMT_UYVY8_2X8) {
                formats++;
                if (xlate) {
                        /*
diff --git a/drivers/media/video/omap3isp/isppreview.c b/drivers/media/video/omap3isp/isppreview.c
index 8a4935ecc655..dd91da26f1b0 100644
--- a/drivers/media/video/omap3isp/isppreview.c
+++ b/drivers/media/video/omap3isp/isppreview.c
@@ -888,12 +888,12 @@ static const struct preview_update update_attrs[] = {
                preview_config_contrast,
                NULL,
                offsetof(struct prev_params, contrast),
-                0, true,
+                0, 0, true,
        }, /* OMAP3ISP_PREV_BRIGHTNESS */ {
                preview_config_brightness,
                NULL,
                offsetof(struct prev_params, brightness),
-                0, true,
+                0, 0, true,
        },
 };
@@ -1102,7 +1102,7 @@ static void preview_config_input_size(struct isp_prev_device *prev, u32 active)
        unsigned int elv = prev->crop.top + prev->crop.height - 1;
        u32 features;
-        if (format->code == V4L2_MBUS_FMT_Y10_1X10) {
+        if (format->code != V4L2_MBUS_FMT_Y10_1X10) {
                sph -= 2;
                eph += 2;
                slv -= 2;
diff --git a/drivers/media/video/pms.c b/drivers/media/video/pms.c
index c370c2d87c17..b4c679b3fb0f 100644
--- a/drivers/media/video/pms.c
+++ b/drivers/media/video/pms.c
@@ -26,6 +26,7 @@
 #include <linux/fs.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/slab.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/mutex.h>
diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
index 354574591908..725812aa0c30 100644
--- a/drivers/media/video/s5p-fimc/fimc-capture.c
+++ b/drivers/media/video/s5p-fimc/fimc-capture.c
@@ -350,7 +350,8 @@ static int queue_setup(struct vb2_queue *vq, const struct v4l2_format *pfmt,
                if (pixm)
                        sizes[i] = max(size, pixm->plane_fmt[i].sizeimage);
                else
-                        sizes[i] = size;
+                        sizes[i] = max_t(u32, size, frame->payload[i]);
                allocators[i] = ctx->fimc_dev->alloc_ctx;
        }
@@ -479,37 +480,39 @@ static int fimc_capture_set_default_format(struct fimc_dev *fimc);
 static int fimc_capture_open(struct file *file)
 {
        struct fimc_dev *fimc = video_drvdata(file);
-        int ret = v4l2_fh_open(file);
+        int ret;
-        if (ret)
-                return ret;
        dbg("pid: %d, state: 0x%lx", task_pid_nr(current), fimc->state);
-        /* Return if the corresponding video mem2mem node is already opened. */
        if (fimc_m2m_active(fimc))
                return -EBUSY;
        set_bit(ST_CAPT_BUSY, &fimc->state);
-        pm_runtime_get_sync(&fimc->pdev->dev);
+        ret = pm_runtime_get_sync(&fimc->pdev->dev);
+        if (ret < 0)
+                return ret;
-        if (++fimc->vid_cap.refcnt == 1) {
+        ret = v4l2_fh_open(file);
-                ret = fimc_pipeline_initialize(&fimc->pipeline,
+        if (ret)
-                               &fimc->vid_cap.vfd->entity, true);
+                return ret;
-                if (ret < 0) {
-                        dev_err(&fimc->pdev->dev,
-                                "Video pipeline initialization failed\n");
-                        pm_runtime_put_sync(&fimc->pdev->dev);
-                        fimc->vid_cap.refcnt--;
-                        v4l2_fh_release(file);
-                        clear_bit(ST_CAPT_BUSY, &fimc->state);
-                        return ret;
-                }
-                ret = fimc_capture_ctrls_create(fimc);
-                if (!ret && !fimc->vid_cap.user_subdev_api)
+        if (++fimc->vid_cap.refcnt != 1)
-                        ret = fimc_capture_set_default_format(fimc);
+                return 0;
+        ret = fimc_pipeline_initialize(&fimc->pipeline,
+                                       &fimc->vid_cap.vfd->entity, true);
+        if (ret < 0) {
+                clear_bit(ST_CAPT_BUSY, &fimc->state);
+                pm_runtime_put_sync(&fimc->pdev->dev);
+                fimc->vid_cap.refcnt--;
+                v4l2_fh_release(file);
+                return ret;
        }
+        ret = fimc_capture_ctrls_create(fimc);
+        if (!ret && !fimc->vid_cap.user_subdev_api)
+                ret = fimc_capture_set_default_format(fimc);
        return ret;
 }
@@ -818,9 +821,6 @@ static int fimc_cap_g_fmt_mplane(struct file *file, void *fh,
        struct fimc_dev *fimc = video_drvdata(file);
        struct fimc_ctx *ctx = fimc->vid_cap.ctx;
-        if (f->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)
-                return -EINVAL;
        return fimc_fill_format(&ctx->d_frame, f);
 }
@@ -833,9 +833,6 @@ static int fimc_cap_try_fmt_mplane(struct file *file, void *fh,
        struct v4l2_mbus_framefmt mf;
        struct fimc_fmt *ffmt = NULL;
-        if (f->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)
-                return -EINVAL;
        if (pix->pixelformat == V4L2_PIX_FMT_JPEG) {
                fimc_capture_try_format(ctx, &pix->width, &pix->height,
                                        NULL, &pix->pixelformat,
@@ -887,8 +884,6 @@ static int fimc_capture_set_format(struct fimc_dev *fimc, struct v4l2_format *f)
        struct fimc_fmt *s_fmt = NULL;
        int ret, i;
-        if (f->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)
-                return -EINVAL;
        if (vb2_is_busy(&fimc->vid_cap.vbq))
                return -EBUSY;
@@ -924,10 +919,10 @@ static int fimc_capture_set_format(struct fimc_dev *fimc, struct v4l2_format *f)
                pix->width  = mf->width;
                pix->height = mf->height;
        }
        fimc_adjust_mplane_format(ff->fmt, pix->width, pix->height, pix);
        for (i = 0; i < ff->fmt->colplanes; i++)
-                ff->payload[i] =
+                ff->payload[i] = pix->plane_fmt[i].sizeimage;
-                        (pix->width * pix->height * ff->fmt->depth[i]) / 8;
        set_frame_bounds(ff, pix->width, pix->height);
        /* Reset the composition rectangle if not yet configured */
@@ -1045,18 +1040,22 @@ static int fimc_cap_streamon(struct file *file, void *priv,
 {
        struct fimc_dev *fimc = video_drvdata(file);
        struct fimc_pipeline *p = &fimc->pipeline;
+        struct v4l2_subdev *sd = p->subdevs[IDX_SENSOR];
        int ret;
        if (fimc_capture_active(fimc))
                return -EBUSY;
-        media_entity_pipeline_start(&p->subdevs[IDX_SENSOR]->entity,
+        ret = media_entity_pipeline_start(&sd->entity, p->m_pipeline);
-                                    p->m_pipeline);
+        if (ret < 0)
+                return ret;
        if (fimc->vid_cap.user_subdev_api) {
                ret = fimc_pipeline_validate(fimc);
-                if (ret)
+                if (ret < 0) {
+                        media_entity_pipeline_stop(&sd->entity);
                        return ret;
+                }
        }
        return vb2_streamon(&fimc->vid_cap.vbq, type);
 }
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index 92fc5a20fb76..a4646ca1d56f 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -153,7 +153,7 @@ static struct fimc_fmt fimc_formats[] = {
                .colplanes      = 2,
                .flags          = FMT_FLAGS_M2M,
        }, {
-                .name           = "YUV 4:2:0 non-contiguous 2-planar, Y/CbCr",
+                .name           = "YUV 4:2:0 non-contig. 2p, Y/CbCr",
                .fourcc         = V4L2_PIX_FMT_NV12M,
                .color          = FIMC_FMT_YCBCR420,
                .depth          = { 8, 4 },
@@ -161,7 +161,7 @@ static struct fimc_fmt fimc_formats[] = {
                .colplanes      = 2,
                .flags          = FMT_FLAGS_M2M,
        }, {
-                .name           = "YUV 4:2:0 non-contiguous 3-planar, Y/Cb/Cr",
+                .name           = "YUV 4:2:0 non-contig. 3p, Y/Cb/Cr",
                .fourcc         = V4L2_PIX_FMT_YUV420M,
                .color          = FIMC_FMT_YCBCR420,
                .depth          = { 8, 2, 2 },
@@ -169,7 +169,7 @@ static struct fimc_fmt fimc_formats[] = {
                .colplanes      = 3,
                .flags          = FMT_FLAGS_M2M,
        }, {
-                .name           = "YUV 4:2:0 non-contiguous 2-planar, Y/CbCr, tiled",
+                .name           = "YUV 4:2:0 non-contig. 2p, tiled",
                .fourcc         = V4L2_PIX_FMT_NV12MT,
                .color          = FIMC_FMT_YCBCR420,
                .depth          = { 8, 4 },
@@ -641,7 +641,7 @@ void fimc_ctrls_activate(struct fimc_ctx *ctx, bool active)
        if (!ctrls->ready)
                return;
-        mutex_lock(&ctrls->handler.lock);
+        mutex_lock(ctrls->handler.lock);
        v4l2_ctrl_activate(ctrls->rotate, active);
        v4l2_ctrl_activate(ctrls->hflip, active);
        v4l2_ctrl_activate(ctrls->vflip, active);
@@ -660,7 +660,7 @@ void fimc_ctrls_activate(struct fimc_ctx *ctx, bool active)
                ctx->hflip    = 0;
                ctx->vflip    = 0;
        }
-        mutex_unlock(&ctrls->handler.lock);
+        mutex_unlock(ctrls->handler.lock);
 }
 /* Update maximum value of the alpha color control */
@@ -741,8 +741,8 @@ void fimc_adjust_mplane_format(struct fimc_fmt *fmt, u32 width, u32 height,
        pix->width = width;
        for (i = 0; i < pix->num_planes; ++i) {
-                u32 bpl = pix->plane_fmt[i].bytesperline;
+                struct v4l2_plane_pix_format *plane_fmt = &pix->plane_fmt[i];
-                u32 *sizeimage = &pix->plane_fmt[i].sizeimage;
+                u32 bpl = plane_fmt->bytesperline;
                if (fmt->colplanes > 1 && (bpl == 0 || bpl < pix->width))
                        bpl = pix->width; /* Planar */
@@ -754,8 +754,9 @@ void fimc_adjust_mplane_format(struct fimc_fmt *fmt, u32 width, u32 height,
                if (i == 0) /* Same bytesperline for each plane. */
                        bytesperline = bpl;
-                pix->plane_fmt[i].bytesperline = bytesperline;
+                plane_fmt->bytesperline = bytesperline;
-                *sizeimage = (pix->width * pix->height * fmt->depth[i]) / 8;
+                plane_fmt->sizeimage = max((pix->width * pix->height *
+                                   fmt->depth[i]) / 8, plane_fmt->sizeimage);
        }
 }
diff --git a/drivers/media/video/s5p-fimc/fimc-lite.c b/drivers/media/video/s5p-fimc/fimc-lite.c
index 400d701aef04..74ff310db30c 100644
--- a/drivers/media/video/s5p-fimc/fimc-lite.c
+++ b/drivers/media/video/s5p-fimc/fimc-lite.c
@@ -451,34 +451,44 @@ static void fimc_lite_clear_event_counters(struct fimc_lite *fimc)
 static int fimc_lite_open(struct file *file)
 {
        struct fimc_lite *fimc = video_drvdata(file);
-        int ret = v4l2_fh_open(file);
+        int ret;
-        if (ret)
+        if (mutex_lock_interruptible(&fimc->lock))
-                return ret;
+                return -ERESTARTSYS;
        set_bit(ST_FLITE_IN_USE, &fimc->state);
-        pm_runtime_get_sync(&fimc->pdev->dev);
+        ret = pm_runtime_get_sync(&fimc->pdev->dev);
+        if (ret < 0)
+                goto done;
-        if (++fimc->ref_count != 1 || fimc->out_path != FIMC_IO_DMA)
+        ret = v4l2_fh_open(file);
-                return ret;
+        if (ret < 0)
+                goto done;
-        ret = fimc_pipeline_initialize(&fimc->pipeline, &fimc->vfd->entity,
+        if (++fimc->ref_count == 1 && fimc->out_path == FIMC_IO_DMA) {
-                                       true);
+                ret = fimc_pipeline_initialize(&fimc->pipeline,
-        if (ret < 0) {
+                                               &fimc->vfd->entity, true);
-                v4l2_err(fimc->vfd, "Video pipeline initialization failed\n");
+                if (ret < 0) {
-                pm_runtime_put_sync(&fimc->pdev->dev);
+                        pm_runtime_put_sync(&fimc->pdev->dev);
-                fimc->ref_count--;
+                        fimc->ref_count--;
-                v4l2_fh_release(file);
+                        v4l2_fh_release(file);
-                clear_bit(ST_FLITE_IN_USE, &fimc->state);
+                        clear_bit(ST_FLITE_IN_USE, &fimc->state);
-        }
+                }
-        fimc_lite_clear_event_counters(fimc);
+                fimc_lite_clear_event_counters(fimc);
+        }
+done:
+        mutex_unlock(&fimc->lock);
        return ret;
 }
 static int fimc_lite_close(struct file *file)
 {
        struct fimc_lite *fimc = video_drvdata(file);
+        int ret;
+        if (mutex_lock_interruptible(&fimc->lock))
+                return -ERESTARTSYS;
        if (--fimc->ref_count == 0 && fimc->out_path == FIMC_IO_DMA) {
                clear_bit(ST_FLITE_IN_USE, &fimc->state);
@@ -492,20 +502,39 @@ static int fimc_lite_close(struct file *file)
        if (fimc->ref_count == 0)
                vb2_queue_release(&fimc->vb_queue);
-        return v4l2_fh_release(file);
+        ret = v4l2_fh_release(file);
+        mutex_unlock(&fimc->lock);
+        return ret;
 }
 static unsigned int fimc_lite_poll(struct file *file,
                                   struct poll_table_struct *wait)
 {
        struct fimc_lite *fimc = video_drvdata(file);
-        return vb2_poll(&fimc->vb_queue, file, wait);
+        int ret;
+        if (mutex_lock_interruptible(&fimc->lock))
+                return POLL_ERR;
+        ret = vb2_poll(&fimc->vb_queue, file, wait);
+        mutex_unlock(&fimc->lock);
+        return ret;
 }
 static int fimc_lite_mmap(struct file *file, struct vm_area_struct *vma)
 {
        struct fimc_lite *fimc = video_drvdata(file);
-        return vb2_mmap(&fimc->vb_queue, vma);
+        int ret;
+        if (mutex_lock_interruptible(&fimc->lock))
+                return -ERESTARTSYS;
+        ret = vb2_mmap(&fimc->vb_queue, vma);
+        mutex_unlock(&fimc->lock);
+        return ret;
 }
 static const struct v4l2_file_operations fimc_lite_fops = {
@@ -762,7 +791,9 @@ static int fimc_lite_streamon(struct file *file, void *priv,
        if (fimc_lite_active(fimc))
                return -EBUSY;
-        media_entity_pipeline_start(&sensor->entity, p->m_pipeline);
+        ret = media_entity_pipeline_start(&sensor->entity, p->m_pipeline);
+        if (ret < 0)
+                return ret;
        ret = fimc_pipeline_validate(fimc);
        if (ret) {
@@ -1508,7 +1539,7 @@ static int fimc_lite_suspend(struct device *dev)
                return 0;
        ret = fimc_lite_stop_capture(fimc, suspend);
-        if (ret)
+        if (ret < 0 || !fimc_lite_active(fimc))
                return ret;
        return fimc_pipeline_shutdown(&fimc->pipeline);
diff --git a/drivers/media/video/s5p-fimc/fimc-mdevice.c b/drivers/media/video/s5p-fimc/fimc-mdevice.c
index 6753c45631b8..52cef4865423 100644
--- a/drivers/media/video/s5p-fimc/fimc-mdevice.c
+++ b/drivers/media/video/s5p-fimc/fimc-mdevice.c
@@ -193,9 +193,13 @@ int __fimc_pipeline_shutdown(struct fimc_pipeline *p)
 int fimc_pipeline_shutdown(struct fimc_pipeline *p)
 {
-        struct media_entity *me = &p->subdevs[IDX_SENSOR]->entity;
+        struct media_entity *me;
        int ret;
+        if (!p || !p->subdevs[IDX_SENSOR])
+                return -EINVAL;
+        me = &p->subdevs[IDX_SENSOR]->entity;
        mutex_lock(&me->parent->graph_mutex);
        ret = __fimc_pipeline_shutdown(p);
        mutex_unlock(&me->parent->graph_mutex);
@@ -498,12 +502,12 @@ static void fimc_md_unregister_entities(struct fimc_md *fmd)
 * @source: the source entity to create links to all fimc entities from
 * @sensor: sensor subdev linked to FIMC[fimc_id] entity, may be null
 * @pad: the source entity pad index
- * @fimc_id: index of the fimc device for which link should be enabled
+ * @link_mask: bitmask of the fimc devices for which link should be enabled
 */
 static int __fimc_md_create_fimc_sink_links(struct fimc_md *fmd,
                                            struct media_entity *source,
                                            struct v4l2_subdev *sensor,
-                                            int pad, int fimc_id)
+                                            int pad, int link_mask)
 {
        struct fimc_sensor_info *s_info;
        struct media_entity *sink;
@@ -520,7 +524,7 @@ static int __fimc_md_create_fimc_sink_links(struct fimc_md *fmd,
                if (!fmd->fimc[i]->variant->has_cam_if)
                        continue;
-                flags = (i == fimc_id) ? MEDIA_LNK_FL_ENABLED : 0;
+                flags = ((1 << i) & link_mask) ? MEDIA_LNK_FL_ENABLED : 0;
                sink = &fmd->fimc[i]->vid_cap.subdev.entity;
                ret = media_entity_create_link(source, pad, sink,
@@ -552,7 +556,10 @@ static int __fimc_md_create_fimc_sink_links(struct fimc_md *fmd,
                if (!fmd->fimc_lite[i])
                        continue;
-                flags = (i == fimc_id) ? MEDIA_LNK_FL_ENABLED : 0;
+                if (link_mask & (1 << (i + FIMC_MAX_DEVS)))
+                        flags = MEDIA_LNK_FL_ENABLED;
+                else
+                        flags = 0;
                sink = &fmd->fimc_lite[i]->subdev.entity;
                ret = media_entity_create_link(source, pad, sink,
@@ -614,9 +621,8 @@ static int fimc_md_create_links(struct fimc_md *fmd)
        struct s5p_fimc_isp_info *pdata;
        struct fimc_sensor_info *s_info;
        struct media_entity *source, *sink;
-        int i, pad, fimc_id = 0;
+        int i, pad, fimc_id = 0, ret = 0;
-        int ret = 0;
+        u32 flags, link_mask = 0;
-        u32 flags;
        for (i = 0; i < fmd->num_sensors; i++) {
                if (fmd->sensor[i].subdev == NULL)
@@ -668,19 +674,20 @@ static int fimc_md_create_links(struct fimc_md *fmd)
                if (source == NULL)
                        continue;
+                link_mask = 1 << fimc_id++;
                ret = __fimc_md_create_fimc_sink_links(fmd, source, sensor,
-                                                       pad, fimc_id++);
+                                                       pad, link_mask);
        }
-        fimc_id = 0;
        for (i = 0; i < ARRAY_SIZE(fmd->csis); i++) {
                if (fmd->csis[i].sd == NULL)
                        continue;
                source = &fmd->csis[i].sd->entity;
                pad = CSIS_PAD_SOURCE;
+                link_mask = 1 << fimc_id++;
                ret = __fimc_md_create_fimc_sink_links(fmd, source, NULL,
-                                                       pad, fimc_id++);
+                                                       pad, link_mask);
        }
        /* Create immutable links between each FIMC's subdev and video node */
@@ -734,8 +741,8 @@ static void fimc_md_put_clocks(struct fimc_md *fmd)
 }
 static int __fimc_md_set_camclk(struct fimc_md *fmd,
-                                         struct fimc_sensor_info *s_info,
+                                struct fimc_sensor_info *s_info,
-                                         bool on)
+                                bool on)
 {
        struct s5p_fimc_isp_info *pdata = s_info->pdata;
        struct fimc_camclk_info *camclk;
@@ -744,12 +751,10 @@ static int __fimc_md_set_camclk(struct fimc_md *fmd,
        if (WARN_ON(pdata->clk_id >= FIMC_MAX_CAMCLKS) || fmd == NULL)
                return -EINVAL;
-        if (s_info->clk_on == on)
-                return 0;
        camclk = &fmd->camclk[pdata->clk_id];
-        dbg("camclk %d, f: %lu, clk: %p, on: %d",
+        dbg("camclk %d, f: %lu, use_count: %d, on: %d",
-            pdata->clk_id, pdata->clk_frequency, camclk, on);
+            pdata->clk_id, pdata->clk_frequency, camclk->use_count, on);
        if (on) {
                if (camclk->use_count > 0 &&
@@ -760,11 +765,9 @@ static int __fimc_md_set_camclk(struct fimc_md *fmd,
                        clk_set_rate(camclk->clock, pdata->clk_frequency);
                        camclk->frequency = pdata->clk_frequency;
                        ret = clk_enable(camclk->clock);
+                        dbg("Enabled camclk %d: f: %lu", pdata->clk_id,
+                            clk_get_rate(camclk->clock));
                }
-                s_info->clk_on = 1;
-                dbg("Enabled camclk %d: f: %lu", pdata->clk_id,
-                    clk_get_rate(camclk->clock));
                return ret;
        }
@@ -773,7 +776,6 @@ static int __fimc_md_set_camclk(struct fimc_md *fmd,
        if (--camclk->use_count == 0) {
                clk_disable(camclk->clock);
-                s_info->clk_on = 0;
                dbg("Disabled camclk %d", pdata->clk_id);
        }
        return ret;
@@ -789,8 +791,6 @@ static int __fimc_md_set_camclk(struct fimc_md *fmd,
 * devices to which sensors can be attached, either directly or through
 * the MIPI CSI receiver. The clock is allowed here to be used by
 * multiple sensors concurrently if they use same frequency.
- * The per sensor subdev clk_on attribute helps to synchronize accesses
- * to the sclk_cam clocks from the video and media device nodes.
 * This function should only be called when the graph mutex is held.
 */
 int fimc_md_set_camclk(struct v4l2_subdev *sd, bool on)
diff --git a/drivers/media/video/s5p-fimc/fimc-mdevice.h b/drivers/media/video/s5p-fimc/fimc-mdevice.h
index 3b8a3492a176..1f5dbaff5442 100644
--- a/drivers/media/video/s5p-fimc/fimc-mdevice.h
+++ b/drivers/media/video/s5p-fimc/fimc-mdevice.h
@@ -47,7 +47,6 @@ struct fimc_camclk_info {
 * @pdata: sensor's atrributes passed as media device's platform data
 * @subdev: image sensor v4l2 subdev
 * @host: fimc device the sensor is currently linked to
- * @clk_on: sclk_cam clock's state associated with this subdev
 *
 * This data structure applies to image sensor and the writeback subdevs.
 */
@@ -55,7 +54,6 @@ struct fimc_sensor_info {
        struct s5p_fimc_isp_info *pdata;
        struct v4l2_subdev *subdev;
        struct fimc_dev *host;
-        bool clk_on;
 };
 /**
diff --git a/drivers/media/video/s5p-mfc/s5p_mfc_dec.c b/drivers/media/video/s5p-mfc/s5p_mfc_dec.c
index 4dd32fc8fd82..feea867f318c 100644
--- a/drivers/media/video/s5p-mfc/s5p_mfc_dec.c
+++ b/drivers/media/video/s5p-mfc/s5p_mfc_dec.c
@@ -996,6 +996,7 @@ int s5p_mfc_dec_ctrls_setup(struct s5p_mfc_ctx *ctx)
        for (i = 0; i < NUM_CTRLS; i++) {
                if (IS_MFC51_PRIV(controls[i].id)) {
+                        memset(&cfg, 0, sizeof(struct v4l2_ctrl_config));
                        cfg.ops = &s5p_mfc_dec_ctrl_ops;
                        cfg.id = controls[i].id;
                        cfg.min = controls[i].minimum;
diff --git a/drivers/media/video/s5p-mfc/s5p_mfc_enc.c b/drivers/media/video/s5p-mfc/s5p_mfc_enc.c
index 03d83340e7fb..158b78989b89 100644
--- a/drivers/media/video/s5p-mfc/s5p_mfc_enc.c
+++ b/drivers/media/video/s5p-mfc/s5p_mfc_enc.c
@@ -1773,6 +1773,7 @@ int s5p_mfc_enc_ctrls_setup(struct s5p_mfc_ctx *ctx)
        }
        for (i = 0; i < NUM_CTRLS; i++) {
                if (IS_MFC51_PRIV(controls[i].id)) {
+                        memset(&cfg, 0, sizeof(struct v4l2_ctrl_config));
                        cfg.ops = &s5p_mfc_enc_ctrl_ops;
                        cfg.id = controls[i].id;
                        cfg.min = controls[i].minimum;
diff --git a/drivers/media/video/smiapp/smiapp-core.c b/drivers/media/video/smiapp/smiapp-core.c
index e8c93c89265a..9cf5bda35fbe 100644
--- a/drivers/media/video/smiapp/smiapp-core.c
+++ b/drivers/media/video/smiapp/smiapp-core.c
@@ -31,6 +31,7 @@
 #include <linux/device.h>
 #include <linux/gpio.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/regulator/consumer.h>
 #include <linux/slab.h>
 #include <linux/v4l2-mediabus.h>
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 83dbb2ddff10..0cbada18f6f5 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -681,6 +681,7 @@ static void determine_valid_ioctls(struct video_device *vdev)
        SET_VALID_IOCTL(ops, VIDIOC_G_DV_TIMINGS, vidioc_g_dv_timings);
        SET_VALID_IOCTL(ops, VIDIOC_ENUM_DV_TIMINGS, vidioc_enum_dv_timings);
        SET_VALID_IOCTL(ops, VIDIOC_QUERY_DV_TIMINGS, vidioc_query_dv_timings);
+        SET_VALID_IOCTL(ops, VIDIOC_DV_TIMINGS_CAP, vidioc_dv_timings_cap);
        /* yes, really vidioc_subscribe_event */
        SET_VALID_IOCTL(ops, VIDIOC_DQEVENT, vidioc_subscribe_event);
        SET_VALID_IOCTL(ops, VIDIOC_SUBSCRIBE_EVENT, vidioc_subscribe_event);
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index e129c820df7d..92144ed1ad46 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -286,6 +286,7 @@ config TWL6040_CORE
        depends on I2C=y && GENERIC_HARDIRQS
        select MFD_CORE
        select REGMAP_I2C
+        select IRQ_DOMAIN
        default n
        help
          Say yes here if you want support for Texas Instruments TWL6040 audio
diff --git a/drivers/mfd/ab5500-core.h b/drivers/mfd/ab5500-core.h
deleted file mode 100644
index 63b30b17e4f3..000000000000
--- a/drivers/mfd/ab5500-core.h
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright (C) 2011 ST-Ericsson
- * License terms: GNU General Public License (GPL) version 2
- * Shared definitions and data structures for the AB5500 MFD driver
- */
-/* Read/write operation values. */
-#define AB5500_PERM_RD (0x01)
-#define AB5500_PERM_WR (0x02)
-/* Read/write permissions. */
-#define AB5500_PERM_RO (AB5500_PERM_RD)
-#define AB5500_PERM_RW (AB5500_PERM_RD | AB5500_PERM_WR)
-#define AB5500_MASK_BASE (0x60)
-#define AB5500_MASK_END (0x79)
-#define AB5500_CHIP_ID (0x20)
-/**
- * struct ab5500_reg_range
- * @first: the first address of the range
- * @last: the last address of the range
- * @perm: access permissions for the range
- */
-struct ab5500_reg_range {
-        u8 first;
-        u8 last;
-        u8 perm;
-};
-/**
- * struct ab5500_i2c_ranges
- * @count: the number of ranges in the list
- * @range: the list of register ranges
- */
-struct ab5500_i2c_ranges {
-        u8 nranges;
-        u8 bankid;
-        const struct ab5500_reg_range *range;
-};
-/**
- * struct ab5500_i2c_banks
- * @count: the number of ranges in the list
- * @range: the list of register ranges
- */
-struct ab5500_i2c_banks {
-        u8 nbanks;
-        const struct ab5500_i2c_ranges *bank;
-};
-/**
- * struct ab5500_bank
- * @slave_addr: I2C slave_addr found in AB5500 specification
- * @name: Documentation name of the bank. For reference
- */
-struct ab5500_bank {
-        u8 slave_addr;
-        const char *name;
-};
-static const struct ab5500_bank bankinfo[AB5500_NUM_BANKS] = {
-        [AB5500_BANK_VIT_IO_I2C_CLK_TST_OTP] = {
-                AB5500_ADDR_VIT_IO_I2C_CLK_TST_OTP, "VIT_IO_I2C_CLK_TST_OTP"},
-        [AB5500_BANK_VDDDIG_IO_I2C_CLK_TST] = {
-                AB5500_ADDR_VDDDIG_IO_I2C_CLK_TST, "VDDDIG_IO_I2C_CLK_TST"},
-        [AB5500_BANK_VDENC] = {AB5500_ADDR_VDENC, "VDENC"},
-        [AB5500_BANK_SIM_USBSIM] = {AB5500_ADDR_SIM_USBSIM, "SIM_USBSIM"},
-        [AB5500_BANK_LED] = {AB5500_ADDR_LED, "LED"},
-        [AB5500_BANK_ADC] = {AB5500_ADDR_ADC, "ADC"},
-        [AB5500_BANK_RTC] = {AB5500_ADDR_RTC, "RTC"},
-        [AB5500_BANK_STARTUP] = {AB5500_ADDR_STARTUP, "STARTUP"},
-        [AB5500_BANK_DBI_ECI] = {AB5500_ADDR_DBI_ECI, "DBI-ECI"},
-        [AB5500_BANK_CHG] = {AB5500_ADDR_CHG, "CHG"},
-        [AB5500_BANK_FG_BATTCOM_ACC] = {
-                AB5500_ADDR_FG_BATTCOM_ACC, "FG_BATCOM_ACC"},
-        [AB5500_BANK_USB] = {AB5500_ADDR_USB, "USB"},
-        [AB5500_BANK_IT] = {AB5500_ADDR_IT, "IT"},
-        [AB5500_BANK_VIBRA] = {AB5500_ADDR_VIBRA, "VIBRA"},
-        [AB5500_BANK_AUDIO_HEADSETUSB] = {
-                AB5500_ADDR_AUDIO_HEADSETUSB, "AUDIO_HEADSETUSB"},
-};
-int ab5500_get_register_interruptible_raw(struct ab5500 *ab, u8 bank, u8 reg,
-        u8 *value);
-int ab5500_mask_and_set_register_interruptible_raw(struct ab5500 *ab, u8 bank,
-        u8 reg, u8 bitmask, u8 bitvalues);
diff --git a/drivers/mfd/mc13xxx-spi.c b/drivers/mfd/mc13xxx-spi.c
index 3fcdab3eb8eb..03df422feb76 100644
--- a/drivers/mfd/mc13xxx-spi.c
+++ b/drivers/mfd/mc13xxx-spi.c
@@ -49,10 +49,72 @@ static struct regmap_config mc13xxx_regmap_spi_config = {
        .reg_bits = 7,
        .pad_bits = 1,
        .val_bits = 24,
+        .write_flag_mask = 0x80,
        .max_register = MC13XXX_NUMREGS,
        .cache_type = REGCACHE_NONE,
+        .use_single_rw = 1,
+};
+static int mc13xxx_spi_read(void *context, const void *reg, size_t reg_size,
+                                void *val, size_t val_size)
+{
+        unsigned char w[4] = { *((unsigned char *) reg), 0, 0, 0};
+        unsigned char r[4];
+        unsigned char *p = val;
+        struct device *dev = context;
+        struct spi_device *spi = to_spi_device(dev);
+        struct spi_transfer t = {
+                .tx_buf = w,
+                .rx_buf = r,
+                .len = 4,
+        };
+        struct spi_message m;
+        int ret;
+        if (val_size != 3 || reg_size != 1)
+                return -ENOTSUPP;
+        spi_message_init(&m);
+        spi_message_add_tail(&t, &m);
+        ret = spi_sync(spi, &m);
+        memcpy(p, &r[1], 3);
+        return ret;
+}
+static int mc13xxx_spi_write(void *context, const void *data, size_t count)
+{
+        struct device *dev = context;
+        struct spi_device *spi = to_spi_device(dev);
+        if (count != 4)
+                return -ENOTSUPP;
+        return spi_write(spi, data, count);
+}
+/*
+ * We cannot use regmap-spi generic bus implementation here.
+ * The MC13783 chip will get corrupted if CS signal is deasserted
+ * and on i.Mx31 SoC (the target SoC for MC13783 PMIC) the SPI controller
+ * has the following errata (DSPhl22960):
+ * "The CSPI negates SS when the FIFO becomes empty with
+ * SSCTL= 0. Software cannot guarantee that the FIFO will not
+ * drain because of higher priority interrupts and the
+ * non-realtime characteristics of the operating system. As a
+ * result, the SS will negate before all of the data has been
+ * transferred to/from the peripheral."
+ * We workaround this by accessing the SPI controller with a
+ * single transfert.
+ */
+static struct regmap_bus regmap_mc13xxx_bus = {
+        .write = mc13xxx_spi_write,
+        .read = mc13xxx_spi_read,
 };
 static int mc13xxx_spi_probe(struct spi_device *spi)
@@ -73,12 +135,13 @@ static int mc13xxx_spi_probe(struct spi_device *spi)
        dev_set_drvdata(&spi->dev, mc13xxx);
        spi->mode = SPI_MODE_0 | SPI_CS_HIGH;
-        spi->bits_per_word = 32;
        mc13xxx->dev = &spi->dev;
        mutex_init(&mc13xxx->lock);
-        mc13xxx->regmap = regmap_init_spi(spi, &mc13xxx_regmap_spi_config);
+        mc13xxx->regmap = regmap_init(&spi->dev, &regmap_mc13xxx_bus, &spi->dev,
+                                        &mc13xxx_regmap_spi_config);
        if (IS_ERR(mc13xxx->regmap)) {
                ret = PTR_ERR(mc13xxx->regmap);
                dev_err(mc13xxx->dev, "Failed to initialize register map: %d\n",
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index 7e96bb229724..41088ecbb2a9 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -25,6 +25,7 @@
 #include <linux/clk.h>
 #include <linux/dma-mapping.h>
 #include <linux/spinlock.h>
+#include <linux/gpio.h>
 #include <plat/cpu.h>
 #include <plat/usb.h>
 #include <linux/pm_runtime.h>
@@ -500,8 +501,21 @@ static void omap_usbhs_init(struct device *dev)
        dev_dbg(dev, "starting TI HSUSB Controller\n");
        pm_runtime_get_sync(dev);
-        spin_lock_irqsave(&omap->lock, flags);
+        if (pdata->ehci_data->phy_reset) {
+                if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[0]))
+                        gpio_request_one(pdata->ehci_data->reset_gpio_port[0],
+                                         GPIOF_OUT_INIT_LOW, "USB1 PHY reset");
+                if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[1]))
+                        gpio_request_one(pdata->ehci_data->reset_gpio_port[1],
+                                         GPIOF_OUT_INIT_LOW, "USB2 PHY reset");
+                /* Hold the PHY in RESET for enough time till DIR is high */
+                udelay(10);
+        }
+        spin_lock_irqsave(&omap->lock, flags);
        omap->usbhs_rev = usbhs_read(omap->uhh_base, OMAP_UHH_REVISION);
        dev_dbg(dev, "OMAP UHH_REVISION 0x%x\n", omap->usbhs_rev);
@@ -581,9 +595,39 @@ static void omap_usbhs_init(struct device *dev)
        }
        spin_unlock_irqrestore(&omap->lock, flags);
+        if (pdata->ehci_data->phy_reset) {
+                /* Hold the PHY in RESET for enough time till
+                 * PHY is settled and ready
+                 */
+                udelay(10);
+                if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[0]))
+                        gpio_set_value_cansleep
+                                (pdata->ehci_data->reset_gpio_port[0], 1);
+                if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[1]))
+                        gpio_set_value_cansleep
+                                (pdata->ehci_data->reset_gpio_port[1], 1);
+        }
        pm_runtime_put_sync(dev);
 }
+static void omap_usbhs_deinit(struct device *dev)
+{
+        struct usbhs_hcd_omap           *omap = dev_get_drvdata(dev);
+        struct usbhs_omap_platform_data *pdata = &omap->platdata;
+        if (pdata->ehci_data->phy_reset) {
+                if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[0]))
+                        gpio_free(pdata->ehci_data->reset_gpio_port[0]);
+                if (gpio_is_valid(pdata->ehci_data->reset_gpio_port[1]))
+                        gpio_free(pdata->ehci_data->reset_gpio_port[1]);
+        }
+}
 /**
 * usbhs_omap_probe - initialize TI-based HCDs
@@ -767,6 +811,7 @@ static int __devinit usbhs_omap_probe(struct platform_device *pdev)
        goto end_probe;
 err_alloc:
+        omap_usbhs_deinit(&pdev->dev);
        iounmap(omap->tll_base);
 err_tll:
@@ -818,6 +863,7 @@ static int __devexit usbhs_omap_remove(struct platform_device *pdev)
 {
        struct usbhs_hcd_omap *omap = platform_get_drvdata(pdev);
+        omap_usbhs_deinit(&pdev->dev);
        iounmap(omap->tll_base);
        iounmap(omap->uhh_base);
        clk_put(omap->init_60m_fclk);
diff --git a/drivers/mfd/palmas.c b/drivers/mfd/palmas.c
index 00c0aba7eba0..c4a69f193a1d 100644
--- a/drivers/mfd/palmas.c
+++ b/drivers/mfd/palmas.c
@@ -356,7 +356,14 @@ static int __devinit palmas_i2c_probe(struct i2c_client *i2c,
                }
        }
-        ret = regmap_add_irq_chip(palmas->regmap[1], palmas->irq,
+        /* Change IRQ into clear on read mode for efficiency */
+        slave = PALMAS_BASE_TO_SLAVE(PALMAS_INTERRUPT_BASE);
+        addr = PALMAS_BASE_TO_REG(PALMAS_INTERRUPT_BASE, PALMAS_INT_CTRL);
+        reg = PALMAS_INT_CTRL_INT_CLEAR;
+        regmap_write(palmas->regmap[slave], addr, reg);
+        ret = regmap_add_irq_chip(palmas->regmap[slave], palmas->irq,
                        IRQF_ONESHOT | IRQF_TRIGGER_LOW, -1, &palmas_irq_chip,
                        &palmas->irq_data);
        if (ret < 0)
@@ -441,6 +448,9 @@ static int __devinit palmas_i2c_probe(struct i2c_client *i2c,
                goto err;
        }
+        children[PALMAS_PMIC_ID].platform_data = pdata->pmic_pdata;
+        children[PALMAS_PMIC_ID].pdata_size = sizeof(*pdata->pmic_pdata);
        ret = mfd_add_devices(palmas->dev, -1,
                              children, ARRAY_SIZE(palmas_children),
                              NULL, regmap_irq_chip_get_base(palmas->irq_data));
@@ -472,6 +482,7 @@ static const struct i2c_device_id palmas_i2c_id[] = {
        { "twl6035", },
        { "twl6037", },
        { "tps65913", },
+        { /* end */ }
 };
 MODULE_DEVICE_TABLE(i2c, palmas_i2c_id);
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 7de13891e49e..783fcd7365bc 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -1147,7 +1147,7 @@ static int mei_pci_resume(struct device *device)
                err = request_threaded_irq(pdev->irq,
                        NULL,
                        mei_interrupt_thread_handler,
-                        0, mei_driver_name, dev);
+                        IRQF_ONESHOT, mei_driver_name, dev);
        else
                err = request_threaded_irq(pdev->irq,
                        mei_interrupt_quick_handler,
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index 17bbacb1b4b1..87b251ab6ec5 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -452,9 +452,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
                if (msg->activate_gru_mq_desc_gpa !=
                    part_uv->activate_gru_mq_desc_gpa) {
-                        spin_lock_irqsave(&part_uv->flags_lock, irq_flags);
+                        spin_lock(&part_uv->flags_lock);
                        part_uv->flags &= ~XPC_P_CACHED_ACTIVATE_GRU_MQ_DESC_UV;
-                        spin_unlock_irqrestore(&part_uv->flags_lock, irq_flags);
+                        spin_unlock(&part_uv->flags_lock);
                        part_uv->activate_gru_mq_desc_gpa =
                            msg->activate_gru_mq_desc_gpa;
                }
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index dd2d374dcc7a..276d21ce6bc1 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -554,7 +554,6 @@ static u32 mmc_sd_num_wr_blocks(struct mmc_card *card)
        struct mmc_request mrq = {NULL};
        struct mmc_command cmd = {0};
        struct mmc_data data = {0};
-        unsigned int timeout_us;
        struct scatterlist sg;
@@ -574,23 +573,12 @@ static u32 mmc_sd_num_wr_blocks(struct mmc_card *card)
        cmd.arg = 0;
        cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;
-        data.timeout_ns = card->csd.tacc_ns * 100;
-        data.timeout_clks = card->csd.tacc_clks * 100;
-        timeout_us = data.timeout_ns / 1000;
-        timeout_us += data.timeout_clks * 1000 /
-                (card->host->ios.clock / 1000);
-        if (timeout_us > 100000) {
-                data.timeout_ns = 100000000;
-                data.timeout_clks = 0;
-        }
        data.blksz = 4;
        data.blocks = 1;
        data.flags = MMC_DATA_READ;
        data.sg = &sg;
        data.sg_len = 1;
+        mmc_set_data_timeout(&data, card);
        mrq.cmd = &cmd;
        mrq.data = &data;
diff --git a/drivers/mmc/core/cd-gpio.c b/drivers/mmc/core/cd-gpio.c
index f13e38deceac..8f5dc08d6598 100644
--- a/drivers/mmc/core/cd-gpio.c
+++ b/drivers/mmc/core/cd-gpio.c
@@ -50,8 +50,8 @@ int mmc_cd_gpio_request(struct mmc_host *host, unsigned int gpio)
                goto egpioreq;
        ret = request_threaded_irq(irq, NULL, mmc_cd_gpio_irqt,
-                                   IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
+                                   IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING |
-                                   cd->label, host);
+                                   IRQF_ONESHOT, cd->label, host);
        if (ret < 0)
                goto eirqreq;
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 258b203397aa..4f4489aa6bae 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -717,10 +717,6 @@ static int mmc_select_powerclass(struct mmc_card *card,
                                 card->ext_csd.generic_cmd6_time);
        }
-        if (err)
-                pr_err("%s: power class selection for ext_csd_bus_width %d"
-                       " failed\n", mmc_hostname(card->host), bus_width);
        return err;
 }
@@ -1104,7 +1100,9 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                                EXT_CSD_BUS_WIDTH_8 : EXT_CSD_BUS_WIDTH_4;
                err = mmc_select_powerclass(card, ext_csd_bits, ext_csd);
                if (err)
-                        goto err;
+                        pr_warning("%s: power class selection to bus width %d"
+                                   " failed\n", mmc_hostname(card->host),
+                                   1 << bus_width);
        }
        /*
@@ -1136,7 +1134,10 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                        err = mmc_select_powerclass(card, ext_csd_bits[idx][0],
                                                    ext_csd);
                        if (err)
-                                goto err;
+                                pr_warning("%s: power class selection to "
+                                           "bus width %d failed\n",
+                                           mmc_hostname(card->host),
+                                           1 << bus_width);
                        err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
                                         EXT_CSD_BUS_WIDTH,
@@ -1164,7 +1165,10 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                        err = mmc_select_powerclass(card, ext_csd_bits[idx][1],
                                                    ext_csd);
                        if (err)
-                                goto err;
+                                pr_warning("%s: power class selection to "
+                                           "bus width %d ddr %d failed\n",
+                                           mmc_hostname(card->host),
+                                           1 << bus_width, ddr);
                        err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
                                         EXT_CSD_BUS_WIDTH,
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 9a7a60aeb19e..389a3eedfc24 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -85,7 +85,6 @@
 #define BRR_ENABLE              (1 << 5)
 #define DTO_ENABLE              (1 << 20)
 #define INIT_STREAM             (1 << 1)
-#define ACEN_ACMD12             (1 << 2)
 #define DP_SELECT               (1 << 21)
 #define DDIR                    (1 << 4)
 #define DMA_EN                  0x1
@@ -117,7 +116,6 @@
 #define OMAP_MMC_MAX_CLOCK      52000000
 #define DRIVER_NAME             "omap_hsmmc"
-#define AUTO_CMD12              (1 << 0)        /* Auto CMD12 support */
 /*
 * One controller can have multiple slots, like on some omap boards using
 * omap.c controller driver. Luckily this is not currently done on any known
@@ -177,7 +175,6 @@ struct omap_hsmmc_host {
        int                     reqs_blocked;
        int                     use_reg;
        int                     req_in_progress;
-        unsigned int            flags;
        struct omap_hsmmc_next  next_data;
        struct  omap_mmc_platform_data  *pdata;
@@ -773,8 +770,6 @@ omap_hsmmc_start_command(struct omap_hsmmc_host *host, struct mmc_command *cmd,
                cmdtype = 0x3;
        cmdreg = (cmd->opcode << 24) | (resptype << 16) | (cmdtype << 22);
-        if ((host->flags & AUTO_CMD12) && mmc_op_multi(cmd->opcode))
-                cmdreg |= ACEN_ACMD12;
        if (data) {
                cmdreg |= DP_SELECT | MSBS | BCE;
@@ -847,14 +842,11 @@ omap_hsmmc_xfer_done(struct omap_hsmmc_host *host, struct mmc_data *data)
        else
                data->bytes_xfered = 0;
-        if (data->stop && ((!(host->flags & AUTO_CMD12)) || data->error)) {
+        if (!data->stop) {
-                omap_hsmmc_start_command(host, data->stop, NULL);
-        } else {
-                if (data->stop)
-                        data->stop->resp[0] = OMAP_HSMMC_READ(host->base,
-                                                        RSP76);
                omap_hsmmc_request_done(host, data->mrq);
+                return;
        }
+        omap_hsmmc_start_command(host, data->stop, NULL);
 }
 /*
@@ -1859,7 +1851,6 @@ static int __devinit omap_hsmmc_probe(struct platform_device *pdev)
        host->mapbase   = res->start + pdata->reg_offset;
        host->base      = ioremap(host->mapbase, SZ_4K);
        host->power_mode = MMC_POWER_OFF;
-        host->flags     = AUTO_CMD12;
        host->next_data.cookie = 1;
        platform_set_drvdata(pdev, host);
diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c
index 41371ba1a811..f3f6cfedd69e 100644
--- a/drivers/mtd/nand/cafe_nand.c
+++ b/drivers/mtd/nand/cafe_nand.c
@@ -102,7 +102,7 @@ static const char *part_probes[] = { "cmdlinepart", "RedBoot", NULL };
 static int cafe_device_ready(struct mtd_info *mtd)
 {
        struct cafe_priv *cafe = mtd->priv;
-        int result = !!(cafe_readl(cafe, NAND_STATUS) | 0x40000000);
+        int result = !!(cafe_readl(cafe, NAND_STATUS) & 0x40000000);
        uint32_t irqs = cafe_readl(cafe, NAND_IRQ);
        cafe_writel(cafe, irqs, NAND_IRQ);
diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
index a05b7b444d4f..a6cad5caba78 100644
--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
@@ -920,12 +920,12 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip,
                 */
                memset(chip->oob_poi, ~0, mtd->oobsize);
                chip->oob_poi[0] = ((uint8_t *) auxiliary_virt)[0];
-                read_page_swap_end(this, buf, mtd->writesize,
-                                this->payload_virt, this->payload_phys,
-                                nfc_geo->payload_size,
-                                payload_virt, payload_phys);
        }
+        read_page_swap_end(this, buf, mtd->writesize,
+                        this->payload_virt, this->payload_phys,
+                        nfc_geo->payload_size,
+                        payload_virt, payload_phys);
 exit_nfc:
        return ret;
 }
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index c58e6a93f445..6acc790c2fbb 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -273,6 +273,26 @@ static struct nand_ecclayout nandv2_hw_eccoob_4k = {
 static const char *part_probes[] = { "RedBoot", "cmdlinepart", "ofpart", NULL };
+static void memcpy32_fromio(void *trg, const void __iomem  *src, size_t size)
+{
+        int i;
+        u32 *t = trg;
+        const __iomem u32 *s = src;
+        for (i = 0; i < (size >> 2); i++)
+                *t++ = __raw_readl(s++);
+}
+static void memcpy32_toio(void __iomem *trg, const void *src, int size)
+{
+        int i;
+        u32 __iomem *t = trg;
+        const u32 *s = src;
+        for (i = 0; i < (size >> 2); i++)
+                __raw_writel(*s++, t++);
+}
 static int check_int_v3(struct mxc_nand_host *host)
 {
        uint32_t tmp;
@@ -519,7 +539,7 @@ static void send_read_id_v3(struct mxc_nand_host *host)
        wait_op_done(host, true);
-        memcpy_fromio(host->data_buf, host->main_area0, 16);
+        memcpy32_fromio(host->data_buf, host->main_area0, 16);
 }
 /* Request the NANDFC to perform a read of the NAND device ID. */
@@ -535,7 +555,7 @@ static void send_read_id_v1_v2(struct mxc_nand_host *host)
        /* Wait for operation to complete */
        wait_op_done(host, true);
-        memcpy_fromio(host->data_buf, host->main_area0, 16);
+        memcpy32_fromio(host->data_buf, host->main_area0, 16);
        if (this->options & NAND_BUSWIDTH_16) {
                /* compress the ID info */
@@ -797,16 +817,16 @@ static void copy_spare(struct mtd_info *mtd, bool bfrom)
        if (bfrom) {
                for (i = 0; i < n - 1; i++)
-                        memcpy_fromio(d + i * j, s + i * t, j);
+                        memcpy32_fromio(d + i * j, s + i * t, j);
                /* the last section */
-                memcpy_fromio(d + i * j, s + i * t, mtd->oobsize - i * j);
+                memcpy32_fromio(d + i * j, s + i * t, mtd->oobsize - i * j);
        } else {
                for (i = 0; i < n - 1; i++)
-                        memcpy_toio(&s[i * t], &d[i * j], j);
+                        memcpy32_toio(&s[i * t], &d[i * j], j);
                /* the last section */
-                memcpy_toio(&s[i * t], &d[i * j], mtd->oobsize - i * j);
+                memcpy32_toio(&s[i * t], &d[i * j], mtd->oobsize - i * j);
        }
 }
@@ -1070,7 +1090,8 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
                host->devtype_data->send_page(mtd, NFC_OUTPUT);
-                memcpy_fromio(host->data_buf, host->main_area0, mtd->writesize);
+                memcpy32_fromio(host->data_buf, host->main_area0,
+                                mtd->writesize);
                copy_spare(mtd, true);
                break;
@@ -1086,7 +1107,7 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
                break;
        case NAND_CMD_PAGEPROG:
-                memcpy_toio(host->main_area0, host->data_buf, mtd->writesize);
+                memcpy32_toio(host->main_area0, host->data_buf, mtd->writesize);
                copy_spare(mtd, false);
                host->devtype_data->send_page(mtd, NFC_INPUT);
                host->devtype_data->send_cmd(host, command, true);
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index d47586cf64ce..a11253a0fcab 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -3501,6 +3501,13 @@ int nand_scan_tail(struct mtd_info *mtd)
        /* propagate ecc info to mtd_info */
        mtd->ecclayout = chip->ecc.layout;
        mtd->ecc_strength = chip->ecc.strength;
+        /*
+         * Initialize bitflip_threshold to its default prior scan_bbt() call.
+         * scan_bbt() might invoke mtd_read(), thus bitflip_threshold must be
+         * properly set.
+         */
+        if (!mtd->bitflip_threshold)
+                mtd->bitflip_threshold = mtd->ecc_strength;
        /* Check, if we should skip the bad block table scan */
        if (chip->options & NAND_SKIP_BBTSCAN)
diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index 6cc8fbfabb8e..cf0cd3146817 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -28,7 +28,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/vmalloc.h>
-#include <asm/div64.h>
+#include <linux/math64.h>
 #include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/string.h>
@@ -546,12 +546,6 @@ static char *get_partition_name(int i)
        return kstrdup(buf, GFP_KERNEL);
 }
-static uint64_t divide(uint64_t n, uint32_t d)
-{
-        do_div(n, d);
-        return n;
-}
 /*
 * Initialize the nandsim structure.
 *
@@ -580,7 +574,7 @@ static int init_nandsim(struct mtd_info *mtd)
        ns->geom.oobsz    = mtd->oobsize;
        ns->geom.secsz    = mtd->erasesize;
        ns->geom.pgszoob  = ns->geom.pgsz + ns->geom.oobsz;
-        ns->geom.pgnum    = divide(ns->geom.totsz, ns->geom.pgsz);
+        ns->geom.pgnum    = div_u64(ns->geom.totsz, ns->geom.pgsz);
        ns->geom.totszoob = ns->geom.totsz + (uint64_t)ns->geom.pgnum * ns->geom.oobsz;
        ns->geom.secshift = ffs(ns->geom.secsz) - 1;
        ns->geom.pgshift  = chip->page_shift;
@@ -921,7 +915,7 @@ static int setup_wear_reporting(struct mtd_info *mtd)
        if (!rptwear)
                return 0;
-        wear_eb_count = divide(mtd->size, mtd->erasesize);
+        wear_eb_count = div_u64(mtd->size, mtd->erasesize);
        mem = wear_eb_count * sizeof(unsigned long);
        if (mem / sizeof(unsigned long) != wear_eb_count) {
                NS_ERR("Too many erase blocks for wear reporting\n");
diff --git a/drivers/mtd/ubi/debug.c b/drivers/mtd/ubi/debug.c
index 09d4f8d9d592..7c1380305219 100644
--- a/drivers/mtd/ubi/debug.c
+++ b/drivers/mtd/ubi/debug.c
@@ -264,7 +264,7 @@ static struct dentry *dfs_rootdir;
 */
 int ubi_debugfs_init(void)
 {
-        if (!IS_ENABLED(DEBUG_FS))
+        if (!IS_ENABLED(CONFIG_DEBUG_FS))
                return 0;
        dfs_rootdir = debugfs_create_dir("ubi", NULL);
@@ -284,7 +284,7 @@ int ubi_debugfs_init(void)
 */
 void ubi_debugfs_exit(void)
 {
-        if (IS_ENABLED(DEBUG_FS))
+        if (IS_ENABLED(CONFIG_DEBUG_FS))
                debugfs_remove(dfs_rootdir);
 }
@@ -407,7 +407,7 @@ int ubi_debugfs_init_dev(struct ubi_device *ubi)
        struct dentry *dent;
        struct ubi_debug_info *d = ubi->dbg;
-        if (!IS_ENABLED(DEBUG_FS))
+        if (!IS_ENABLED(CONFIG_DEBUG_FS))
                return 0;
        n = snprintf(d->dfs_dir_name, UBI_DFS_DIR_LEN + 1, UBI_DFS_DIR_NAME,
@@ -477,6 +477,6 @@ out:
 */
 void ubi_debugfs_exit_dev(struct ubi_device *ubi)
 {
-        if (IS_ENABLED(DEBUG_FS))
+        if (IS_ENABLED(CONFIG_DEBUG_FS))
                debugfs_remove_recursive(ubi->dbg->dfs_dir);
 }
diff --git a/drivers/net/bonding/bond_debugfs.c b/drivers/net/bonding/bond_debugfs.c
index 3680aa251dea..2cf084eb9d52 100644
--- a/drivers/net/bonding/bond_debugfs.c
+++ b/drivers/net/bonding/bond_debugfs.c
@@ -6,7 +6,7 @@
 #include "bonding.h"
 #include "bond_alb.h"
-#ifdef CONFIG_DEBUG_FS
+#if defined(CONFIG_DEBUG_FS) && !defined(CONFIG_NET_NS)
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b9c2ae62166d..2ee76993f052 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3227,6 +3227,12 @@ static int bond_master_netdev_event(unsigned long event,
        switch (event) {
        case NETDEV_CHANGENAME:
                return bond_event_changename(event_bond);
+        case NETDEV_UNREGISTER:
+                bond_remove_proc_entry(event_bond);
+                break;
+        case NETDEV_REGISTER:
+                bond_create_proc_entry(event_bond);
+                break;
        default:
                break;
        }
@@ -4411,8 +4417,6 @@ static void bond_uninit(struct net_device *bond_dev)
        bond_work_cancel_all(bond);
-        bond_remove_proc_entry(bond);
        bond_debug_unregister(bond);
        __hw_addr_flush(&bond->mc_list);
@@ -4814,7 +4818,6 @@ static int bond_init(struct net_device *bond_dev)
        bond_set_lockdep_class(bond_dev);
-        bond_create_proc_entry(bond);
        list_add_tail(&bond->bond_list, &bn->dev_list);
        bond_prepare_sysfs_group(bond);
diff --git a/drivers/net/bonding/bond_procfs.c b/drivers/net/bonding/bond_procfs.c
index ad284baafe87..3cea38d37344 100644
--- a/drivers/net/bonding/bond_procfs.c
+++ b/drivers/net/bonding/bond_procfs.c
@@ -150,14 +150,25 @@ static void bond_info_show_master(struct seq_file *seq)
        }
 }
+static const char *bond_slave_link_status(s8 link)
+{
+        static const char * const status[] = {
+                [BOND_LINK_UP] = "up",
+                [BOND_LINK_FAIL] = "going down",
+                [BOND_LINK_DOWN] = "down",
+                [BOND_LINK_BACK] = "going back",
+        };
+        return status[link];
+}
 static void bond_info_show_slave(struct seq_file *seq,
                                 const struct slave *slave)
 {
        struct bonding *bond = seq->private;
        seq_printf(seq, "\nSlave Interface: %s\n", slave->dev->name);
-        seq_printf(seq, "MII Status: %s\n",
+        seq_printf(seq, "MII Status: %s\n", bond_slave_link_status(slave->link));
-                   (slave->link == BOND_LINK_UP) ?  "up" : "down");
        if (slave->speed == SPEED_UNKNOWN)
                seq_printf(seq, "Speed: %s\n", "Unknown");
        else
diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
index 1520814c77c7..4a27adb7ae67 100644
--- a/drivers/net/caif/caif_hsi.c
+++ b/drivers/net/caif/caif_hsi.c
@@ -693,8 +693,6 @@ static void cfhsi_rx_done(struct cfhsi *cfhsi)
                         */
                        memcpy(rx_buf, (u8 *)piggy_desc,
                                        CFHSI_DESC_SHORT_SZ);
-                        /* Mark no embedded frame here */
-                        piggy_desc->offset = 0;
                        if (desc_pld_len == -EPROTO)
                                goto out_of_sync;
                }
@@ -737,6 +735,8 @@ static void cfhsi_rx_done(struct cfhsi *cfhsi)
                        /* Extract any payload in piggyback descriptor. */
                        if (cfhsi_rx_desc(piggy_desc, cfhsi) < 0)
                                goto out_of_sync;
+                        /* Mark no embedded frame after extracting it */
+                        piggy_desc->offset = 0;
                }
        }
@@ -1178,6 +1178,7 @@ int cfhsi_probe(struct platform_device *pdev)
                dev_err(&ndev->dev, "%s: Registration error: %d.\n",
                        __func__, res);
                free_netdev(ndev);
+                return -ENODEV;
        }
        /* Add CAIF HSI device to list. */
        spin_lock(&cfhsi_list_lock);
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 8dc84d66eea1..86cd532c78f9 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -590,8 +590,8 @@ static void c_can_chip_config(struct net_device *dev)
        priv->write_reg(priv, &priv->regs->control,
                        CONTROL_ENABLE_AR);
-        if (priv->can.ctrlmode & (CAN_CTRLMODE_LISTENONLY &
+        if ((priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) &&
-                                        CAN_CTRLMODE_LOOPBACK)) {
+            (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK)) {
                /* loopback + silent mode : useful for hot self-test */
                priv->write_reg(priv, &priv->regs->control, CONTROL_EIE |
                                CONTROL_SIE | CONTROL_IE | CONTROL_TEST);
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 38c0690df5c8..81d474102378 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -939,12 +939,12 @@ static int __devinit flexcan_probe(struct platform_device *pdev)
                return PTR_ERR(pinctrl);
        if (pdev->dev.of_node) {
-                const u32 *clock_freq_p;
+                const __be32 *clock_freq_p;
                clock_freq_p = of_get_property(pdev->dev.of_node,
                                                "clock-frequency", NULL);
                if (clock_freq_p)
-                        clock_freq = *clock_freq_p;
+                        clock_freq = be32_to_cpup(clock_freq_p);
        }
        if (!clock_freq) {
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 9cc15701101b..1f78b63d5efe 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -261,7 +261,6 @@ static void atl1c_check_link_status(struct atl1c_adapter *adapter)
        if ((phy_data & BMSR_LSTATUS) == 0) {
                /* link down */
                netif_carrier_off(netdev);
-                netif_stop_queue(netdev);
                hw->hibernate = true;
                if (atl1c_reset_mac(hw) != 0)
                        if (netif_msg_hw(adapter))
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 46b8b7d81633..d09c6b583d17 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -656,7 +656,7 @@ static int b44_alloc_rx_skb(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
                        dma_unmap_single(bp->sdev->dma_dev, mapping,
                                             RX_PKT_BUF_SZ, DMA_FROM_DEVICE);
                dev_kfree_skb_any(skb);
-                skb = __netdev_alloc_skb(bp->dev, RX_PKT_BUF_SZ, GFP_ATOMIC|GFP_DMA);
+                skb = alloc_skb(RX_PKT_BUF_SZ, GFP_ATOMIC | GFP_DMA);
                if (skb == NULL)
                        return -ENOMEM;
                mapping = dma_map_single(bp->sdev->dma_dev, skb->data,
@@ -967,7 +967,7 @@ static netdev_tx_t b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
                        dma_unmap_single(bp->sdev->dma_dev, mapping, len,
                                             DMA_TO_DEVICE);
-                bounce_skb = __netdev_alloc_skb(dev, len, GFP_ATOMIC | GFP_DMA);
+                bounce_skb = alloc_skb(len, GFP_ATOMIC | GFP_DMA);
                if (!bounce_skb)
                        goto err_out;
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index ac7b74488531..1fa4927a45b1 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -5372,7 +5372,7 @@ bnx2_free_tx_skbs(struct bnx2 *bp)
                        int k, last;
                        if (skb == NULL) {
-                                j++;
+                                j = NEXT_TX_BD(j);
                                continue;
                        }
@@ -5384,8 +5384,8 @@ bnx2_free_tx_skbs(struct bnx2 *bp)
                        tx_buf->skb = NULL;
                        last = tx_buf->nr_frags;
-                        j++;
+                        j = NEXT_TX_BD(j);
-                        for (k = 0; k < last; k++, j++) {
+                        for (k = 0; k < last; k++, j = NEXT_TX_BD(j)) {
                                tx_buf = &txr->tx_buf_ring[TX_RING_IDX(j)];
                                dma_unmap_page(&bp->pdev->dev,
                                        dma_unmap_addr(tx_buf, mapping),
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index cbc56f274e0c..8098eea9704d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -190,7 +190,7 @@ int bnx2x_tx_int(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata)
                if ((netif_tx_queue_stopped(txq)) &&
                    (bp->state == BNX2X_STATE_OPEN) &&
-                    (bnx2x_tx_avail(bp, txdata) >= MAX_SKB_FRAGS + 3))
+                    (bnx2x_tx_avail(bp, txdata) >= MAX_SKB_FRAGS + 4))
                        netif_tx_wake_queue(txq);
                __netif_tx_unlock(txq);
@@ -2516,8 +2516,6 @@ int bnx2x_poll(struct napi_struct *napi, int budget)
 /* we split the first BD into headers and data BDs
 * to ease the pain of our fellow microcode engineers
 * we use one mapping for both BDs
- * So far this has only been observed to happen
- * in Other Operating Systems(TM)
 */
 static noinline u16 bnx2x_tx_split(struct bnx2x *bp,
                                   struct bnx2x_fp_txdata *txdata,
@@ -3171,7 +3169,7 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
        txdata->tx_bd_prod += nbd;
-        if (unlikely(bnx2x_tx_avail(bp, txdata) < MAX_SKB_FRAGS + 3)) {
+        if (unlikely(bnx2x_tx_avail(bp, txdata) < MAX_SKB_FRAGS + 4)) {
                netif_tx_stop_queue(txq);
                /* paired memory barrier is in bnx2x_tx_int(), we have to keep
@@ -3180,7 +3178,7 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                smp_mb();
                fp->eth_q_stats.driver_xoff++;
-                if (bnx2x_tx_avail(bp, txdata) >= MAX_SKB_FRAGS + 3)
+                if (bnx2x_tx_avail(bp, txdata) >= MAX_SKB_FRAGS + 4)
                        netif_tx_wake_queue(txq);
        }
        txdata->tx_pkt++;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index a3fb7215cd89..6e7d5c0843b4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -40,6 +40,7 @@
 #define I2C_BSC0                        0
 #define I2C_BSC1                        1
 #define I2C_WA_RETRY_CNT                3
+#define I2C_WA_PWR_ITER                 (I2C_WA_RETRY_CNT - 1)
 #define MCPR_IMC_COMMAND_READ_OP        1
 #define MCPR_IMC_COMMAND_WRITE_OP       2
@@ -7659,6 +7660,28 @@ static int bnx2x_8726_read_sfp_module_eeprom(struct bnx2x_phy *phy,
        return -EINVAL;
 }
+static void bnx2x_warpcore_power_module(struct link_params *params,
+                                        struct bnx2x_phy *phy,
+                                        u8 power)
+{
+        u32 pin_cfg;
+        struct bnx2x *bp = params->bp;
+        pin_cfg = (REG_RD(bp, params->shmem_base +
+                          offsetof(struct shmem_region,
+                        dev_info.port_hw_config[params->port].e3_sfp_ctrl)) &
+                        PORT_HW_CFG_E3_PWR_DIS_MASK) >>
+                        PORT_HW_CFG_E3_PWR_DIS_SHIFT;
+        if (pin_cfg == PIN_CFG_NA)
+                return;
+        DP(NETIF_MSG_LINK, "Setting SFP+ module power to %d using pin cfg %d\n",
+                       power, pin_cfg);
+        /* Low ==> corresponding SFP+ module is powered
+         * high ==> the SFP+ module is powered down
+         */
+        bnx2x_set_cfg_pin(bp, pin_cfg, power ^ 1);
+}
 static int bnx2x_warpcore_read_sfp_module_eeprom(struct bnx2x_phy *phy,
                                                 struct link_params *params,
                                                 u16 addr, u8 byte_cnt,
@@ -7678,6 +7701,12 @@ static int bnx2x_warpcore_read_sfp_module_eeprom(struct bnx2x_phy *phy,
        /* 4 byte aligned address */
        addr32 = addr & (~0x3);
        do {
+                if (cnt == I2C_WA_PWR_ITER) {
+                        bnx2x_warpcore_power_module(params, phy, 0);
+                        /* Note that 100us are not enough here */
+                        usleep_range(1000,1000);
+                        bnx2x_warpcore_power_module(params, phy, 1);
+                }
                rc = bnx2x_bsc_read(params, phy, 0xa0, addr32, 0, byte_cnt,
                                    data_array);
        } while ((rc != 0) && (++cnt < I2C_WA_RETRY_CNT));
@@ -8200,29 +8229,6 @@ static void bnx2x_set_sfp_module_fault_led(struct link_params *params,
                bnx2x_set_e1e2_module_fault_led(params, gpio_mode);
 }
-static void bnx2x_warpcore_power_module(struct link_params *params,
-                                        struct bnx2x_phy *phy,
-                                        u8 power)
-{
-        u32 pin_cfg;
-        struct bnx2x *bp = params->bp;
-        pin_cfg = (REG_RD(bp, params->shmem_base +
-                          offsetof(struct shmem_region,
-                        dev_info.port_hw_config[params->port].e3_sfp_ctrl)) &
-                        PORT_HW_CFG_E3_PWR_DIS_MASK) >>
-                        PORT_HW_CFG_E3_PWR_DIS_SHIFT;
-        if (pin_cfg == PIN_CFG_NA)
-                return;
-        DP(NETIF_MSG_LINK, "Setting SFP+ module power to %d using pin cfg %d\n",
-                       power, pin_cfg);
-        /* Low ==> corresponding SFP+ module is powered
-         * high ==> the SFP+ module is powered down
-         */
-        bnx2x_set_cfg_pin(bp, pin_cfg, power ^ 1);
-}
 static void bnx2x_warpcore_hw_reset(struct bnx2x_phy *phy,
                                    struct link_params *params)
 {
@@ -9748,7 +9754,7 @@ static int bnx2x_848x3_config_init(struct bnx2x_phy *phy,
        msleep(1);
-        if (!(CHIP_IS_E1(bp)))
+        if (!(CHIP_IS_E1x(bp)))
                port = BP_PATH(bp);
        else
                port = params->port;
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index c95e7b5e2b85..2c89d17cbb29 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -534,7 +534,8 @@ int cnic_unregister_driver(int ulp_type)
        }
        if (atomic_read(&ulp_ops->ref_count) != 0)
-                netdev_warn(dev->netdev, "Failed waiting for ref count to go to zero\n");
+                pr_warn("%s: Failed waiting for ref count to go to zero\n",
+                        __func__);
        return 0;
 out_unlock:
@@ -1053,12 +1054,13 @@ static int cnic_init_uio(struct cnic_dev *dev)
        uinfo = &udev->cnic_uinfo;
-        uinfo->mem[0].addr = dev->netdev->base_addr;
+        uinfo->mem[0].addr = pci_resource_start(dev->pcidev, 0);
        uinfo->mem[0].internal_addr = dev->regview;
-        uinfo->mem[0].size = dev->netdev->mem_end - dev->netdev->mem_start;
        uinfo->mem[0].memtype = UIO_MEM_PHYS;
        if (test_bit(CNIC_F_BNX2_CLASS, &dev->flags)) {
+                uinfo->mem[0].size = MB_GET_CID_ADDR(TX_TSS_CID +
+                                                     TX_MAX_TSS_RINGS + 1);
                uinfo->mem[1].addr = (unsigned long) cp->status_blk.gen &
                                        PAGE_MASK;
                if (cp->ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX)
@@ -1068,6 +1070,8 @@ static int cnic_init_uio(struct cnic_dev *dev)
                uinfo->name = "bnx2_cnic";
        } else if (test_bit(CNIC_F_BNX2X_CLASS, &dev->flags)) {
+                uinfo->mem[0].size = pci_resource_len(dev->pcidev, 0);
                uinfo->mem[1].addr = (unsigned long) cp->bnx2x_def_status_blk &
                        PAGE_MASK;
                uinfo->mem[1].size = sizeof(*cp->bnx2x_def_status_blk);
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 8d06ea381741..921c2082af4c 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -122,15 +122,15 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
                        goto done;
                if (compl_status == MCC_STATUS_UNAUTHORIZED_REQUEST) {
-                        dev_warn(&adapter->pdev->dev, "This domain(VM) is not "
+                        dev_warn(&adapter->pdev->dev,
-                                "permitted to execute this cmd (opcode %d)\n",
+                                 "opcode %d-%d is not permitted\n",
-                                opcode);
+                                 opcode, subsystem);
                } else {
                        extd_status = (compl->status >> CQE_STATUS_EXTD_SHIFT) &
                                        CQE_STATUS_EXTD_MASK;
-                        dev_err(&adapter->pdev->dev, "Cmd (opcode %d) failed:"
+                        dev_err(&adapter->pdev->dev,
-                                "status %d, extd-status %d\n",
+                                "opcode %d-%d failed:status %d-%d\n",
-                                opcode, compl_status, extd_status);
+                                opcode, subsystem, compl_status, extd_status);
                }
        }
 done:
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index 9625bf420c16..b3f3fc3d1323 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -1566,7 +1566,7 @@ struct be_hw_stats_v1 {
        u32 rsvd0[BE_TXP_SW_SZ];
        struct be_erx_stats_v1 erx;
        struct be_pmem_stats pmem;
-        u32 rsvd1[3];
+        u32 rsvd1[18];
 };
 struct be_cmd_req_get_stats_v1 {
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index fdb50cec6b51..501dfa9c88ec 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3237,7 +3237,7 @@ static void be_netdev_init(struct net_device *netdev)
        netdev->flags |= IFF_MULTICAST;
-        netif_set_gso_max_size(netdev, 65535);
+        netif_set_gso_max_size(netdev, 65535 - ETH_HLEN);
        netdev->netdev_ops = &be_netdev_ops;
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 0741aded9eb0..ab1d80ff0791 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1804,18 +1804,16 @@ void gfar_configure_coalescing(struct gfar_private *priv,
        if (priv->mode == MQ_MG_MODE) {
                baddr = &regs->txic0;
                for_each_set_bit(i, &tx_mask, priv->num_tx_queues) {
-                        if (likely(priv->tx_queue[i]->txcoalescing)) {
+                        gfar_write(baddr + i, 0);
-                                gfar_write(baddr + i, 0);
+                        if (likely(priv->tx_queue[i]->txcoalescing))
                                gfar_write(baddr + i, priv->tx_queue[i]->txic);
-                        }
                }
                baddr = &regs->rxic0;
                for_each_set_bit(i, &rx_mask, priv->num_rx_queues) {
-                        if (likely(priv->rx_queue[i]->rxcoalescing)) {
+                        gfar_write(baddr + i, 0);
-                                gfar_write(baddr + i, 0);
+                        if (likely(priv->rx_queue[i]->rxcoalescing))
                                gfar_write(baddr + i, priv->rx_queue[i]->rxic);
-                        }
                }
        }
 }
@@ -2065,10 +2063,9 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
                        return NETDEV_TX_OK;
                }
-                /* Steal sock reference for processing TX time stamps */
+                if (skb->sk)
-                swap(skb_new->sk, skb->sk);
+                        skb_set_owner_w(skb_new, skb->sk);
-                swap(skb_new->destructor, skb->destructor);
+                consume_skb(skb);
-                kfree_skb(skb);
                skb = skb_new;
        }
diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig
index 79b07ec6726f..0cafe4fe9406 100644
--- a/drivers/net/ethernet/intel/Kconfig
+++ b/drivers/net/ethernet/intel/Kconfig
@@ -122,8 +122,10 @@ config IGB_DCA
 config IGB_PTP
        bool "PTP Hardware Clock (PHC)"
-        default y
+        default n
-        depends on IGB && PTP_1588_CLOCK
+        depends on IGB && EXPERIMENTAL
+        select PPS
+        select PTP_1588_CLOCK
        ---help---
          Say Y here if you want to use PTP Hardware Clock (PHC) in the
          driver.  Only the basic clock operations have been implemented.
@@ -223,7 +225,9 @@ config IXGBE_DCB
 config IXGBE_PTP
        bool "PTP Clock Support"
        default n
-        depends on IXGBE && PTP_1588_CLOCK
+        depends on IXGBE && EXPERIMENTAL
+        select PPS
+        select PTP_1588_CLOCK
        ---help---
          Say Y here if you want support for 1588 Timestamping with a
          PHC device, using the PTP 1588 Clock support. This is
diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
index 36db4df09aed..1f063dcd8f85 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -1572,6 +1572,9 @@ static s32 e1000_check_for_serdes_link_82571(struct e1000_hw *hw)
        ctrl = er32(CTRL);
        status = er32(STATUS);
        rxcw = er32(RXCW);
+        /* SYNCH bit and IV bit are sticky */
+        udelay(10);
+        rxcw = er32(RXCW);
        if ((rxcw & E1000_RXCW_SYNCH) && !(rxcw & E1000_RXCW_IV)) {
diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
index 351a4097b2ba..76edbc1be33b 100644
--- a/drivers/net/ethernet/intel/e1000e/defines.h
+++ b/drivers/net/ethernet/intel/e1000e/defines.h
@@ -103,6 +103,7 @@
 #define E1000_RXD_ERR_SEQ       0x04    /* Sequence Error */
 #define E1000_RXD_ERR_CXE       0x10    /* Carrier Extension Error */
 #define E1000_RXD_ERR_TCPE      0x20    /* TCP/UDP Checksum Error */
+#define E1000_RXD_ERR_IPE       0x40    /* IP Checksum Error */
 #define E1000_RXD_ERR_RXE       0x80    /* Rx Data Error */
 #define E1000_RXD_SPC_VLAN_MASK 0x0FFF  /* VLAN ID is in lower 12 bits */
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 238ab2f8a5e7..e3a7b07df629 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -325,24 +325,46 @@ static inline void __ew32flash(struct e1000_hw *hw, unsigned long reg, u32 val)
 **/
 static bool e1000_phy_is_accessible_pchlan(struct e1000_hw *hw)
 {
-        u16 phy_reg;
+        u16 phy_reg = 0;
-        u32 phy_id;
+        u32 phy_id = 0;
+        s32 ret_val;
+        u16 retry_count;
+        for (retry_count = 0; retry_count < 2; retry_count++) {
+                ret_val = e1e_rphy_locked(hw, PHY_ID1, &phy_reg);
+                if (ret_val || (phy_reg == 0xFFFF))
+                        continue;
+                phy_id = (u32)(phy_reg << 16);
-        e1e_rphy_locked(hw, PHY_ID1, &phy_reg);
+                ret_val = e1e_rphy_locked(hw, PHY_ID2, &phy_reg);
-        phy_id = (u32)(phy_reg << 16);
+                if (ret_val || (phy_reg == 0xFFFF)) {
-        e1e_rphy_locked(hw, PHY_ID2, &phy_reg);
+                        phy_id = 0;
-        phy_id |= (u32)(phy_reg & PHY_REVISION_MASK);
+                        continue;
+                }
+                phy_id |= (u32)(phy_reg & PHY_REVISION_MASK);
+                break;
+        }
        if (hw->phy.id) {
                if (hw->phy.id == phy_id)
                        return true;
-        } else {
+        } else if (phy_id) {
-                if ((phy_id != 0) && (phy_id != PHY_REVISION_MASK))
+                hw->phy.id = phy_id;
-                        hw->phy.id = phy_id;
+                hw->phy.revision = (u32)(phy_reg & ~PHY_REVISION_MASK);
                return true;
        }
-        return false;
+        /*
+         * In case the PHY needs to be in mdio slow mode,
+         * set slow mode and try to get the PHY id again.
+         */
+        hw->phy.ops.release(hw);
+        ret_val = e1000_set_mdio_slow_mode_hv(hw);
+        if (!ret_val)
+                ret_val = e1000e_get_phy_id(hw);
+        hw->phy.ops.acquire(hw);
+        return !ret_val;
 }
 /**
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 31d37a2b5ba8..623e30b9964d 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -496,7 +496,7 @@ static void e1000_receive_skb(struct e1000_adapter *adapter,
 * @sk_buff: socket buffer with received data
 **/
 static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
-                              __le16 csum, struct sk_buff *skb)
+                              struct sk_buff *skb)
 {
        u16 status = (u16)status_err;
        u8 errors = (u8)(status_err >> 24);
@@ -511,8 +511,8 @@ static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
        if (status & E1000_RXD_STAT_IXSM)
                return;
-        /* TCP/UDP checksum error bit is set */
+        /* TCP/UDP checksum error bit or IP checksum error bit is set */
-        if (errors & E1000_RXD_ERR_TCPE) {
+        if (errors & (E1000_RXD_ERR_TCPE | E1000_RXD_ERR_IPE)) {
                /* let the stack verify checksum errors */
                adapter->hw_csum_err++;
                return;
@@ -523,19 +523,7 @@ static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
                return;
        /* It must be a TCP or UDP packet with a valid checksum */
-        if (status & E1000_RXD_STAT_TCPCS) {
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
-                /* TCP checksum is good */
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-        } else {
-                /*
-                 * IP fragment with UDP payload
-                 * Hardware complements the payload checksum, so we undo it
-                 * and then put the value in host order for further stack use.
-                 */
-                __sum16 sum = (__force __sum16)swab16((__force u16)csum);
-                skb->csum = csum_unfold(~sum);
-                skb->ip_summed = CHECKSUM_COMPLETE;
-        }
        adapter->hw_csum_good++;
 }
@@ -954,8 +942,7 @@ static bool e1000_clean_rx_irq(struct e1000_ring *rx_ring, int *work_done,
                skb_put(skb, length);
                /* Receive Checksum Offload */
-                e1000_rx_checksum(adapter, staterr,
+                e1000_rx_checksum(adapter, staterr, skb);
-                                  rx_desc->wb.lower.hi_dword.csum_ip.csum, skb);
                e1000_rx_hash(netdev, rx_desc->wb.lower.hi_dword.rss, skb);
@@ -1341,8 +1328,7 @@ copydone:
                total_rx_bytes += skb->len;
                total_rx_packets++;
-                e1000_rx_checksum(adapter, staterr,
+                e1000_rx_checksum(adapter, staterr, skb);
-                                  rx_desc->wb.lower.hi_dword.csum_ip.csum, skb);
                e1000_rx_hash(netdev, rx_desc->wb.lower.hi_dword.rss, skb);
@@ -1512,9 +1498,8 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_ring *rx_ring, int *work_done,
                        }
                }
-                /* Receive Checksum Offload XXX recompute due to CRC strip? */
+                /* Receive Checksum Offload */
-                e1000_rx_checksum(adapter, staterr,
+                e1000_rx_checksum(adapter, staterr, skb);
-                                  rx_desc->wb.lower.hi_dword.csum_ip.csum, skb);
                e1000_rx_hash(netdev, rx_desc->wb.lower.hi_dword.rss, skb);
@@ -3098,19 +3083,10 @@ static void e1000_configure_rx(struct e1000_adapter *adapter)
        /* Enable Receive Checksum Offload for TCP and UDP */
        rxcsum = er32(RXCSUM);
-        if (adapter->netdev->features & NETIF_F_RXCSUM) {
+        if (adapter->netdev->features & NETIF_F_RXCSUM)
                rxcsum |= E1000_RXCSUM_TUOFL;
+        else
-                /*
-                 * IPv4 payload checksum for UDP fragments must be
-                 * used in conjunction with packet-split.
-                 */
-                if (adapter->rx_ps_pages)
-                        rxcsum |= E1000_RXCSUM_IPPCSE;
-        } else {
                rxcsum &= ~E1000_RXCSUM_TUOFL;
-                /* no need to clear IPPCSE as it defaults to 0 */
-        }
        ew32(RXCSUM, rxcsum);
        if (adapter->hw.mac.type == e1000_pch2lan) {
@@ -5241,22 +5217,10 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
        int max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN;
        /* Jumbo frame support */
-        if (max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) {
+        if ((max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) &&
-                if (!(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) {
+            !(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) {
-                        e_err("Jumbo Frames not supported.\n");
+                e_err("Jumbo Frames not supported.\n");
-                        return -EINVAL;
+                return -EINVAL;
-                }
-                /*
-                 * IP payload checksum (enabled with jumbos/packet-split when
-                 * Rx checksum is enabled) and generation of RSS hash is
-                 * mutually exclusive in the hardware.
-                 */
-                if ((netdev->features & NETIF_F_RXCSUM) &&
-                    (netdev->features & NETIF_F_RXHASH)) {
-                        e_err("Jumbo frames cannot be enabled when both receive checksum offload and receive hashing are enabled.  Disable one of the receive offload features before enabling jumbos.\n");
-                        return -EINVAL;
-                }
        }
        /* Supported frame sizes */
@@ -6030,17 +5994,6 @@ static int e1000_set_features(struct net_device *netdev,
                         NETIF_F_RXALL)))
                return 0;
-        /*
-         * IP payload checksum (enabled with jumbos/packet-split when Rx
-         * checksum is enabled) and generation of RSS hash is mutually
-         * exclusive in the hardware.
-         */
-        if (adapter->rx_ps_pages &&
-            (features & NETIF_F_RXCSUM) && (features & NETIF_F_RXHASH)) {
-                e_err("Enabling both receive checksum offload and receive hashing is not possible with jumbo frames.  Disable jumbos or enable only one of the receive offload features.\n");
-                return -EINVAL;
-        }
        if (changed & NETIF_F_RXFCS) {
                if (features & NETIF_F_RXFCS) {
                        adapter->flags2 &= ~FLAG2_CRC_STRIPPING;
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index e65083958421..5e84eaac48c1 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -206,8 +206,6 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
                mac->rar_entry_count = E1000_RAR_ENTRIES_82580;
                break;
        case e1000_i350:
-        case e1000_i210:
-        case e1000_i211:
                mac->rar_entry_count = E1000_RAR_ENTRIES_I350;
                break;
        default:
diff --git a/drivers/net/ethernet/intel/igbvf/ethtool.c b/drivers/net/ethernet/intel/igbvf/ethtool.c
index 8ce67064b9c5..90eef07943f4 100644
--- a/drivers/net/ethernet/intel/igbvf/ethtool.c
+++ b/drivers/net/ethernet/intel/igbvf/ethtool.c
@@ -357,21 +357,28 @@ static int igbvf_set_coalesce(struct net_device *netdev,
        struct igbvf_adapter *adapter = netdev_priv(netdev);
        struct e1000_hw *hw = &adapter->hw;
-        if ((ec->rx_coalesce_usecs > IGBVF_MAX_ITR_USECS) ||
+        if ((ec->rx_coalesce_usecs >= IGBVF_MIN_ITR_USECS) &&
-            ((ec->rx_coalesce_usecs > 3) &&
+             (ec->rx_coalesce_usecs <= IGBVF_MAX_ITR_USECS)) {
-             (ec->rx_coalesce_usecs < IGBVF_MIN_ITR_USECS)) ||
+                adapter->current_itr = ec->rx_coalesce_usecs << 2;
-            (ec->rx_coalesce_usecs == 2))
+                adapter->requested_itr = 1000000000 /
-                return -EINVAL;
+                                        (adapter->current_itr * 256);
+        } else if ((ec->rx_coalesce_usecs == 3) ||
-        /* convert to rate of irq's per second */
+                   (ec->rx_coalesce_usecs == 2)) {
-        if (ec->rx_coalesce_usecs && ec->rx_coalesce_usecs <= 3) {
                adapter->current_itr = IGBVF_START_ITR;
                adapter->requested_itr = ec->rx_coalesce_usecs;
-        } else {
+        } else if (ec->rx_coalesce_usecs == 0) {
-                adapter->current_itr = ec->rx_coalesce_usecs << 2;
+                /*
+                 * The user's desire is to turn off interrupt throttling
+                 * altogether, but due to HW limitations, we can't do that.
+                 * Instead we set a very small value in EITR, which would
+                 * allow ~967k interrupts per second, but allow the adapter's
+                 * internal clocking to still function properly.
+                 */
+                adapter->current_itr = 4;
                adapter->requested_itr = 1000000000 /
                                        (adapter->current_itr * 256);
-        }
+        } else
+                return -EINVAL;
        writel(adapter->current_itr,
               hw->hw_addr + adapter->rx_ring->itr_register);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
index 3ef3c5284e52..7af291e236bf 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
@@ -196,7 +196,7 @@ enum ixgbe_ring_state_t {
        __IXGBE_HANG_CHECK_ARMED,
        __IXGBE_RX_RSC_ENABLED,
        __IXGBE_RX_CSUM_UDP_ZERO_ERR,
-        __IXGBE_RX_FCOE_BUFSZ,
+        __IXGBE_RX_FCOE,
 };
 #define check_for_tx_hang(ring) \
@@ -290,7 +290,7 @@ struct ixgbe_ring_feature {
 #if defined(IXGBE_FCOE) && (PAGE_SIZE < 8192)
 static inline unsigned int ixgbe_rx_pg_order(struct ixgbe_ring *ring)
 {
-        return test_bit(__IXGBE_RX_FCOE_BUFSZ, &ring->state) ? 1 : 0;
+        return test_bit(__IXGBE_RX_FCOE, &ring->state) ? 1 : 0;
 }
 #else
 #define ixgbe_rx_pg_order(_ring) 0
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
index af1a5314b494..c377706e81a8 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
@@ -634,7 +634,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter,
                        f = &adapter->ring_feature[RING_F_FCOE];
                        if ((rxr_idx >= f->mask) &&
                            (rxr_idx < f->mask + f->indices))
-                                set_bit(__IXGBE_RX_FCOE_BUFSZ, &ring->state);
+                                set_bit(__IXGBE_RX_FCOE, &ring->state);
                }
 #endif /* IXGBE_FCOE */
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 17ad6a3c1be1..e242104ab471 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1058,17 +1058,17 @@ static inline void ixgbe_rx_hash(struct ixgbe_ring *ring,
 #ifdef IXGBE_FCOE
 /**
 * ixgbe_rx_is_fcoe - check the rx desc for incoming pkt type
- * @adapter: address of board private structure
+ * @ring: structure containing ring specific data
 * @rx_desc: advanced rx descriptor
 *
 * Returns : true if it is FCoE pkt
 */
-static inline bool ixgbe_rx_is_fcoe(struct ixgbe_adapter *adapter,
+static inline bool ixgbe_rx_is_fcoe(struct ixgbe_ring *ring,
                                    union ixgbe_adv_rx_desc *rx_desc)
 {
        __le16 pkt_info = rx_desc->wb.lower.lo_dword.hs_rss.pkt_info;
-        return (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
+        return test_bit(__IXGBE_RX_FCOE, &ring->state) &&
               ((pkt_info & cpu_to_le16(IXGBE_RXDADV_PKTTYPE_ETQF_MASK)) ==
                (cpu_to_le16(IXGBE_ETQF_FILTER_FCOE <<
                             IXGBE_RXDADV_PKTTYPE_ETQF_SHIFT)));
@@ -1148,7 +1148,7 @@ static bool ixgbe_alloc_mapped_page(struct ixgbe_ring *rx_ring,
        /* alloc new page for storage */
        if (likely(!page)) {
-                page = alloc_pages(GFP_ATOMIC | __GFP_COLD,
+                page = alloc_pages(GFP_ATOMIC | __GFP_COLD | __GFP_COMP,
                                   ixgbe_rx_pg_order(rx_ring));
                if (unlikely(!page)) {
                        rx_ring->rx_stats.alloc_rx_page_failed++;
@@ -1549,6 +1549,12 @@ static bool ixgbe_cleanup_headers(struct ixgbe_ring *rx_ring,
                skb->truesize -= ixgbe_rx_bufsz(rx_ring);
        }
+#ifdef IXGBE_FCOE
+        /* do not attempt to pad FCoE Frames as this will disrupt DDP */
+        if (ixgbe_rx_is_fcoe(rx_ring, rx_desc))
+                return false;
+#endif
        /* if skb_pad returns an error the skb was freed */
        if (unlikely(skb->len < 60)) {
                int pad_len = 60 - skb->len;
@@ -1775,7 +1781,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 #ifdef IXGBE_FCOE
                /* if ddp, not passing to ULD unless for FCP_RSP or error */
-                if (ixgbe_rx_is_fcoe(adapter, rx_desc)) {
+                if (ixgbe_rx_is_fcoe(rx_ring, rx_desc)) {
                        ddp_bytes = ixgbe_fcoe_ddp(adapter, rx_desc, skb);
                        if (!ddp_bytes) {
                                dev_kfree_skb_any(skb);
@@ -6641,6 +6647,11 @@ int ixgbe_setup_tc(struct net_device *dev, u8 tc)
                return -EINVAL;
        }
+        if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED) {
+                e_err(drv, "Enable failed, SR-IOV enabled\n");
+                return -EINVAL;
+        }
        /* Hardware supports up to 8 traffic classes */
        if (tc > adapter->dcb_cfg.num_tcs.pg_tcs ||
            (hw->mac.type == ixgbe_mac_82598EB &&
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
index ddc6a4d19302..dcebd128becf 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
@@ -708,6 +708,7 @@ void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter)
 {
        struct ixgbe_hw *hw = &adapter->hw;
        u32 incval = 0;
+        u32 timinca = 0;
        u32 shift = 0;
        u32 cycle_speed;
        unsigned long flags;
@@ -730,8 +731,16 @@ void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter)
                break;
        }
-        /* Bail if the cycle speed didn't change */
+        /*
-        if (adapter->cycle_speed == cycle_speed)
+         * grab the current TIMINCA value from the register so that it can be
+         * double checked. If the register value has been cleared, it must be
+         * reset to the correct value for generating a cyclecounter. If
+         * TIMINCA is zero, the SYSTIME registers do not increment at all.
+         */
+        timinca = IXGBE_READ_REG(hw, IXGBE_TIMINCA);
+        /* Bail if the cycle speed didn't change and TIMINCA is non-zero */
+        if (adapter->cycle_speed == cycle_speed && timinca)
                return;
        /* disable the SDP clock out */
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index f69ec4288b10..41e32257a4e8 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -201,6 +201,9 @@ static bool ixgbevf_clean_tx_irq(struct ixgbevf_adapter *adapter,
        unsigned int i, eop, count = 0;
        unsigned int total_bytes = 0, total_packets = 0;
+        if (test_bit(__IXGBEVF_DOWN, &adapter->state))
+                return true;
        i = tx_ring->next_to_clean;
        eop = tx_ring->tx_buffer_info[i].next_to_watch;
        eop_desc = IXGBE_TX_DESC_ADV(*tx_ring, eop);
@@ -969,8 +972,6 @@ static irqreturn_t ixgbevf_msix_clean_tx(int irq, void *data)
        r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues);
        for (i = 0; i < q_vector->txr_count; i++) {
                tx_ring = &(adapter->tx_ring[r_idx]);
-                tx_ring->total_bytes = 0;
-                tx_ring->total_packets = 0;
                ixgbevf_clean_tx_irq(adapter, tx_ring);
                r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues,
                                      r_idx + 1);
@@ -994,16 +995,6 @@ static irqreturn_t ixgbevf_msix_clean_rx(int irq, void *data)
        struct ixgbe_hw *hw = &adapter->hw;
        struct ixgbevf_ring  *rx_ring;
        int r_idx;
-        int i;
-        r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
-        for (i = 0; i < q_vector->rxr_count; i++) {
-                rx_ring = &(adapter->rx_ring[r_idx]);
-                rx_ring->total_bytes = 0;
-                rx_ring->total_packets = 0;
-                r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues,
-                                      r_idx + 1);
-        }
        if (!q_vector->rxr_count)
                return IRQ_HANDLED;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 926d8aac941c..073b85b45fc5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -929,15 +929,20 @@ void mlx4_en_free_resources(struct mlx4_en_priv *priv)
                if (priv->rx_cq[i].buf)
                        mlx4_en_destroy_cq(priv, &priv->rx_cq[i]);
        }
+        if (priv->base_tx_qpn) {
+                mlx4_qp_release_range(priv->mdev->dev, priv->base_tx_qpn, priv->tx_ring_num);
+                priv->base_tx_qpn = 0;
+        }
 }
 int mlx4_en_alloc_resources(struct mlx4_en_priv *priv)
 {
        struct mlx4_en_port_profile *prof = priv->prof;
        int i;
-        int base_tx_qpn, err;
+        int err;
-        err = mlx4_qp_reserve_range(priv->mdev->dev, priv->tx_ring_num, 256, &base_tx_qpn);
+        err = mlx4_qp_reserve_range(priv->mdev->dev, priv->tx_ring_num, 256, &priv->base_tx_qpn);
        if (err) {
                en_err(priv, "failed reserving range for TX rings\n");
                return err;
@@ -949,7 +954,7 @@ int mlx4_en_alloc_resources(struct mlx4_en_priv *priv)
                                      prof->tx_ring_size, i, TX))
                        goto err;
-                if (mlx4_en_create_tx_ring(priv, &priv->tx_ring[i], base_tx_qpn + i,
+                if (mlx4_en_create_tx_ring(priv, &priv->tx_ring[i], priv->base_tx_qpn + i,
                                           prof->tx_ring_size, TXBB_SIZE))
                        goto err;
        }
@@ -969,7 +974,6 @@ int mlx4_en_alloc_resources(struct mlx4_en_priv *priv)
 err:
        en_err(priv, "Failed to allocate NIC resources\n");
-        mlx4_qp_release_range(priv->mdev->dev, base_tx_qpn, priv->tx_ring_num);
        return -ENOMEM;
 }
@@ -1204,9 +1208,11 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
        en_warn(priv, "Using %d RX rings\n", prof->rx_ring_num);
        /* Configure port */
+        mlx4_en_calc_rx_buf(dev);
        err = mlx4_SET_PORT_general(mdev->dev, priv->port,
-                                    MLX4_EN_MIN_MTU,
+                                    priv->rx_skb_size + ETH_FCS_LEN,
-                                    0, 0, 0, 0);
+                                    prof->tx_pause, prof->tx_ppp,
+                                    prof->rx_pause, prof->rx_ppp);
        if (err) {
                en_err(priv, "Failed setting port general configurations "
                       "for port %d, with error %d\n", priv->port, err);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index ee6f4fe00837..a0313de122de 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1975,6 +1975,8 @@ slave_start:
        if (err == -EBUSY && (dev->flags & MLX4_FLAG_MSI_X) &&
            !mlx4_is_mfunc(dev)) {
                dev->flags &= ~MLX4_FLAG_MSI_X;
+                dev->caps.num_comp_vectors = 1;
+                dev->caps.comp_pool        = 0;
                pci_disable_msix(pdev);
                err = mlx4_setup_hca(dev);
        }
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 6ae350921b1a..225c20d47900 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -495,6 +495,7 @@ struct mlx4_en_priv {
        int vids[128];
        bool wol;
        struct device *ddev;
+        int base_tx_qpn;
 #ifdef CONFIG_MLX4_EN_DCB
        struct ieee_ets ets;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 46e77a2c5121..ad98f4d7919d 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -479,7 +479,7 @@ qlcnic_init_pci_info(struct qlcnic_adapter *adapter)
        for (i = 0; i < QLCNIC_MAX_PCI_FUNC; i++) {
                pfn = pci_info[i].id;
-                if (pfn > QLCNIC_MAX_PCI_FUNC) {
+                if (pfn >= QLCNIC_MAX_PCI_FUNC) {
                        ret = QL_STATUS_INVALID_PARAM;
                        goto err_eswitch;
                }
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 7260aa79466a..d7a04e091101 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3894,6 +3894,7 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
        case RTL_GIGA_MAC_VER_22:
        case RTL_GIGA_MAC_VER_23:
        case RTL_GIGA_MAC_VER_24:
+        case RTL_GIGA_MAC_VER_34:
                RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
                break;
        default:
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 667169b82526..79bf09b41971 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1011,7 +1011,7 @@ static int sh_eth_txfree(struct net_device *ndev)
 }
 /* Packet receive function */
-static int sh_eth_rx(struct net_device *ndev)
+static int sh_eth_rx(struct net_device *ndev, u32 intr_status)
 {
        struct sh_eth_private *mdp = netdev_priv(ndev);
        struct sh_eth_rxdesc *rxdesc;
@@ -1102,9 +1102,11 @@ static int sh_eth_rx(struct net_device *ndev)
        /* Restart Rx engine if stopped. */
        /* If we don't need to check status, don't. -KDU */
        if (!(sh_eth_read(ndev, EDRRR) & EDRRR_R)) {
-                /* fix the values for the next receiving */
+                /* fix the values for the next receiving if RDE is set */
-                mdp->cur_rx = mdp->dirty_rx = (sh_eth_read(ndev, RDFAR) -
+                if (intr_status & EESR_RDE)
-                                               sh_eth_read(ndev, RDLAR)) >> 4;
+                        mdp->cur_rx = mdp->dirty_rx =
+                                (sh_eth_read(ndev, RDFAR) -
+                                 sh_eth_read(ndev, RDLAR)) >> 4;
                sh_eth_write(ndev, EDRRR_R, EDRRR);
        }
@@ -1273,7 +1275,7 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
                        EESR_RTSF | /* short frame recv */
                        EESR_PRE  | /* PHY-LSI recv error */
                        EESR_CERF)){ /* recv frame CRC error */
-                sh_eth_rx(ndev);
+                sh_eth_rx(ndev, intr_status);
        }
        /* Tx Check */
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index fb8377da1687..4b785e10f2ed 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -51,7 +51,7 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
                desc->des3 = desc->des2 + BUF_SIZE_4KiB;
                priv->hw->desc->prepare_tx_desc(desc, 1, bmax,
                                                csum);
+                wmb();
                entry = (++priv->cur_tx) % txsize;
                desc = priv->dma_tx + entry;
@@ -59,6 +59,7 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
                                            len, DMA_TO_DEVICE);
                desc->des3 = desc->des2 + BUF_SIZE_4KiB;
                priv->hw->desc->prepare_tx_desc(desc, 0, len, csum);
+                wmb();
                priv->hw->desc->set_tx_owner(desc);
                priv->tx_skbuff[entry] = NULL;
        } else {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 51b3b68528ee..ea3003edde18 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1212,6 +1212,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                priv->hw->desc->prepare_tx_desc(desc, 0, len, csum_insertion);
                wmb();
                priv->hw->desc->set_tx_owner(desc);
+                wmb();
        }
        /* Interrupt on completition only for the latest segment */
@@ -1227,6 +1228,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
        /* To avoid raise condition */
        priv->hw->desc->set_tx_owner(first);
+        wmb();
        priv->cur_tx++;
@@ -1290,6 +1292,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv)
                }
                wmb();
                priv->hw->desc->set_rx_owner(p + entry);
+                wmb();
        }
 }
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index d614c374ed9d..3b5c4571b55e 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -15,6 +15,7 @@
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
 #include <linux/device.h>
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/dma-mapping.h>
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 39ea0674dcde..5c120189ec86 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -46,7 +46,13 @@ static int mdio_mux_read(struct mii_bus *bus, int phy_id, int regnum)
        struct mdio_mux_parent_bus *pb = cb->parent;
        int r;
-        mutex_lock(&pb->mii_bus->mdio_lock);
+        /* In theory multiple mdio_mux could be stacked, thus creating
+         * more than a single level of nesting.  But in practice,
+         * SINGLE_DEPTH_NESTING will cover the vast majority of use
+         * cases.  We use it, instead of trying to handle the general
+         * case.
+         */
+        mutex_lock_nested(&pb->mii_bus->mdio_lock, SINGLE_DEPTH_NESTING);
        r = pb->switch_fn(pb->current_child, cb->bus_number, pb->switch_data);
        if (r)
                goto out;
@@ -71,7 +77,7 @@ static int mdio_mux_write(struct mii_bus *bus, int phy_id,
        int r;
-        mutex_lock(&pb->mii_bus->mdio_lock);
+        mutex_lock_nested(&pb->mii_bus->mdio_lock, SINGLE_DEPTH_NESTING);
        r = pb->switch_fn(pb->current_child, cb->bus_number, pb->switch_data);
        if (r)
                goto out;
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 590f902deb6b..9d6c80c8a0cf 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -161,7 +161,7 @@ static struct phy_driver ks8051_driver = {
 static struct phy_driver ks8001_driver = {
        .phy_id         = PHY_ID_KS8001,
        .name           = "Micrel KS8001 or KS8721",
-        .phy_id_mask    = 0x00fffff0,
+        .phy_id_mask    = 0x00ffffff,
        .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause),
        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
        .config_init    = kszphy_config_init,
@@ -174,7 +174,7 @@ static struct phy_driver ks8001_driver = {
 static struct phy_driver ksz9021_driver = {
        .phy_id         = PHY_ID_KSZ9021,
-        .phy_id_mask    = 0x000fff10,
+        .phy_id_mask    = 0x000ffffe,
        .name           = "Micrel KSZ9021 Gigabit PHY",
        .features       = (PHY_GBIT_FEATURES | SUPPORTED_Pause
                                | SUPPORTED_Asym_Pause),
@@ -240,8 +240,8 @@ MODULE_AUTHOR("David J. Choi");
 MODULE_LICENSE("GPL");
 static struct mdio_device_id __maybe_unused micrel_tbl[] = {
-        { PHY_ID_KSZ9021, 0x000fff10 },
+        { PHY_ID_KSZ9021, 0x000ffffe },
-        { PHY_ID_KS8001, 0x00fffff0 },
+        { PHY_ID_KS8001, 0x00ffffff },
        { PHY_ID_KS8737, 0x00fffff0 },
        { PHY_ID_KS8041, 0x00fffff0 },
        { PHY_ID_KS8051, 0x00fffff0 },
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index 964031e3da87..a28a983d465e 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -59,6 +59,7 @@
 #define USB_PRODUCT_IPHONE_3G   0x1292
 #define USB_PRODUCT_IPHONE_3GS  0x1294
 #define USB_PRODUCT_IPHONE_4    0x1297
+#define USB_PRODUCT_IPAD 0x129a
 #define USB_PRODUCT_IPHONE_4_VZW 0x129c
 #define USB_PRODUCT_IPHONE_4S   0x12a0
@@ -101,6 +102,10 @@ static struct usb_device_id ipheth_table[] = {
                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                IPHETH_USBINTF_PROTO) },
        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPAD,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4_VZW,
                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
                IPHETH_USBINTF_PROTO) },
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 3b206786b5e7..a051cedd64bd 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -197,6 +197,10 @@ err:
 static int qmi_wwan_cdc_wdm_manage_power(struct usb_interface *intf, int on)
 {
        struct usbnet *dev = usb_get_intfdata(intf);
+        /* can be called while disconnecting */
+        if (!dev)
+                return 0;
        return qmi_wwan_manage_power(dev, on);
 }
@@ -257,29 +261,6 @@ err:
        return rv;
 }
-/* Gobi devices uses identical class/protocol codes for all interfaces regardless
- * of function. Some of these are CDC ACM like and have the exact same endpoints
- * we are looking for. This leaves two possible strategies for identifying the
- * correct interface:
- *   a) hardcoding interface number, or
- *   b) use the fact that the wwan interface is the only one lacking additional
- *      (CDC functional) descriptors
- *
- * Let's see if we can get away with the generic b) solution.
- */
-static int qmi_wwan_bind_gobi(struct usbnet *dev, struct usb_interface *intf)
-{
-        int rv = -EINVAL;
-        /* ignore any interface with additional descriptors */
-        if (intf->cur_altsetting->extralen)
-                goto err;
-        rv = qmi_wwan_bind_shared(dev, intf);
-err:
-        return rv;
-}
 static void qmi_wwan_unbind_shared(struct usbnet *dev, struct usb_interface *intf)
 {
        struct usb_driver *subdriver = (void *)dev->data[0];
@@ -347,15 +328,15 @@ static const struct driver_info	qmi_wwan_shared = {
        .manage_power   = qmi_wwan_manage_power,
 };
-static const struct driver_info qmi_wwan_gobi = {
+static const struct driver_info qmi_wwan_force_int0 = {
-        .description    = "Qualcomm Gobi wwan/QMI device",
+        .description    = "Qualcomm WWAN/QMI device",
        .flags          = FLAG_WWAN,
-        .bind           = qmi_wwan_bind_gobi,
+        .bind           = qmi_wwan_bind_shared,
        .unbind         = qmi_wwan_unbind_shared,
        .manage_power   = qmi_wwan_manage_power,
+        .data           = BIT(0), /* interface whitelist bitmap */
 };
-/* ZTE suck at making USB descriptors */
 static const struct driver_info qmi_wwan_force_int1 = {
        .description    = "Qualcomm WWAN/QMI device",
        .flags          = FLAG_WWAN,
@@ -365,6 +346,24 @@ static const struct driver_info	qmi_wwan_force_int1 = {
        .data           = BIT(1), /* interface whitelist bitmap */
 };
+static const struct driver_info qmi_wwan_force_int2 = {
+        .description    = "Qualcomm WWAN/QMI device",
+        .flags          = FLAG_WWAN,
+        .bind           = qmi_wwan_bind_shared,
+        .unbind         = qmi_wwan_unbind_shared,
+        .manage_power   = qmi_wwan_manage_power,
+        .data           = BIT(2), /* interface whitelist bitmap */
+};
+static const struct driver_info qmi_wwan_force_int3 = {
+        .description    = "Qualcomm WWAN/QMI device",
+        .flags          = FLAG_WWAN,
+        .bind           = qmi_wwan_bind_shared,
+        .unbind         = qmi_wwan_unbind_shared,
+        .manage_power   = qmi_wwan_manage_power,
+        .data           = BIT(3), /* interface whitelist bitmap */
+};
 static const struct driver_info qmi_wwan_force_int4 = {
        .description    = "Qualcomm WWAN/QMI device",
        .flags          = FLAG_WWAN,
@@ -390,16 +389,23 @@ static const struct driver_info	qmi_wwan_force_int4 = {
 static const struct driver_info qmi_wwan_sierra = {
        .description    = "Sierra Wireless wwan/QMI device",
        .flags          = FLAG_WWAN,
-        .bind           = qmi_wwan_bind_gobi,
+        .bind           = qmi_wwan_bind_shared,
        .unbind         = qmi_wwan_unbind_shared,
        .manage_power   = qmi_wwan_manage_power,
        .data           = BIT(8) | BIT(19), /* interface whitelist bitmap */
 };
 #define HUAWEI_VENDOR_ID        0x12D1
+/* Gobi 1000 QMI/wwan interface number is 3 according to qcserial */
+#define QMI_GOBI1K_DEVICE(vend, prod) \
+        USB_DEVICE(vend, prod), \
+        .driver_info = (unsigned long)&qmi_wwan_force_int3
+/* Gobi 2000 and Gobi 3000 QMI/wwan interface number is 0 according to qcserial */
 #define QMI_GOBI_DEVICE(vend, prod) \
        USB_DEVICE(vend, prod), \
-        .driver_info = (unsigned long)&qmi_wwan_gobi
+        .driver_info = (unsigned long)&qmi_wwan_force_int0
 static const struct usb_device_id products[] = {
        {       /* Huawei E392, E398 and possibly others sharing both device id and more... */
@@ -501,6 +507,15 @@ static const struct usb_device_id products[] = {
                .bInterfaceProtocol = 0xff,
                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
        },
+        {       /* ZTE MF60 */
+                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+                .idVendor           = 0x19d2,
+                .idProduct          = 0x1402,
+                .bInterfaceClass    = 0xff,
+                .bInterfaceSubClass = 0xff,
+                .bInterfaceProtocol = 0xff,
+                .driver_info        = (unsigned long)&qmi_wwan_force_int2,
+        },
        {       /* Sierra Wireless MC77xx in QMI mode */
                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
                .idVendor           = 0x1199,
@@ -510,20 +525,24 @@ static const struct usb_device_id products[] = {
                .bInterfaceProtocol = 0xff,
                .driver_info        = (unsigned long)&qmi_wwan_sierra,
        },
-        {QMI_GOBI_DEVICE(0x05c6, 0x9212)},      /* Acer Gobi Modem Device */
-        {QMI_GOBI_DEVICE(0x03f0, 0x1f1d)},      /* HP un2400 Gobi Modem Device */
+        /* Gobi 1000 devices */
-        {QMI_GOBI_DEVICE(0x03f0, 0x371d)},      /* HP un2430 Mobile Broadband Module */
+        {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
-        {QMI_GOBI_DEVICE(0x04da, 0x250d)},      /* Panasonic Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x03f0, 0x1f1d)},    /* HP un2400 Gobi Modem Device */
-        {QMI_GOBI_DEVICE(0x413c, 0x8172)},      /* Dell Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x03f0, 0x371d)},    /* HP un2430 Mobile Broadband Module */
-        {QMI_GOBI_DEVICE(0x1410, 0xa001)},      /* Novatel Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x04da, 0x250d)},    /* Panasonic Gobi Modem device */
-        {QMI_GOBI_DEVICE(0x0b05, 0x1776)},      /* Asus Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x413c, 0x8172)},    /* Dell Gobi Modem device */
-        {QMI_GOBI_DEVICE(0x19d2, 0xfff3)},      /* ONDA Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x1410, 0xa001)},    /* Novatel Gobi Modem device */
-        {QMI_GOBI_DEVICE(0x05c6, 0x9001)},      /* Generic Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x0b05, 0x1776)},    /* Asus Gobi Modem device */
-        {QMI_GOBI_DEVICE(0x05c6, 0x9002)},      /* Generic Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x19d2, 0xfff3)},    /* ONDA Gobi Modem device */
-        {QMI_GOBI_DEVICE(0x05c6, 0x9202)},      /* Generic Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x05c6, 0x9001)},    /* Generic Gobi Modem device */
-        {QMI_GOBI_DEVICE(0x05c6, 0x9203)},      /* Generic Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x05c6, 0x9002)},    /* Generic Gobi Modem device */
-        {QMI_GOBI_DEVICE(0x05c6, 0x9222)},      /* Generic Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x05c6, 0x9202)},    /* Generic Gobi Modem device */
-        {QMI_GOBI_DEVICE(0x05c6, 0x9009)},      /* Generic Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x05c6, 0x9203)},    /* Generic Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x05c6, 0x9222)},    /* Generic Gobi Modem device */
+        {QMI_GOBI1K_DEVICE(0x05c6, 0x9009)},    /* Generic Gobi Modem device */
+        /* Gobi 2000 and 3000 devices */
        {QMI_GOBI_DEVICE(0x413c, 0x8186)},      /* Dell Gobi 2000 Modem device (N0218, VU936) */
        {QMI_GOBI_DEVICE(0x05c6, 0x920b)},      /* Generic Gobi 2000 Modem device */
        {QMI_GOBI_DEVICE(0x05c6, 0x9225)},      /* Sony Gobi 2000 Modem device (N0279, VU730) */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 9f58330f1312..aba769d77459 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -796,11 +796,13 @@ int usbnet_open (struct net_device *net)
        if (info->manage_power) {
                retval = info->manage_power(dev, 1);
                if (retval < 0)
-                        goto done;
+                        goto done_manage_power_error;
                usb_autopm_put_interface(dev->intf);
        }
        return retval;
+done_manage_power_error:
+        clear_bit(EVENT_DEV_OPEN, &dev->flags);
 done:
        usb_autopm_put_interface(dev->intf);
 done_nopm:
@@ -876,9 +878,9 @@ void usbnet_get_drvinfo (struct net_device *net, struct ethtool_drvinfo *info)
 {
        struct usbnet *dev = netdev_priv(net);
-        strncpy (info->driver, dev->driver_name, sizeof info->driver);
+        strlcpy (info->driver, dev->driver_name, sizeof info->driver);
-        strncpy (info->version, DRIVER_VERSION, sizeof info->version);
+        strlcpy (info->version, DRIVER_VERSION, sizeof info->version);
-        strncpy (info->fw_version, dev->driver_info->description,
+        strlcpy (info->fw_version, dev->driver_info->description,
                sizeof info->fw_version);
        usb_make_path (dev->udev, info->bus_info, sizeof info->bus_info);
 }
@@ -1202,6 +1204,21 @@ deferred:
 }
 EXPORT_SYMBOL_GPL(usbnet_start_xmit);
+static void rx_alloc_submit(struct usbnet *dev, gfp_t flags)
+{
+        struct urb      *urb;
+        int             i;
+        /* don't refill the queue all at once */
+        for (i = 0; i < 10 && dev->rxq.qlen < RX_QLEN(dev); i++) {
+                urb = usb_alloc_urb(0, flags);
+                if (urb != NULL) {
+                        if (rx_submit(dev, urb, flags) == -ENOLINK)
+                                return;
+                }
+        }
+}
 /*-------------------------------------------------------------------------*/
 // tasklet (work deferred from completions, in_irq) or timer
@@ -1241,26 +1258,14 @@ static void usbnet_bh (unsigned long param)
                   !timer_pending (&dev->delay) &&
                   !test_bit (EVENT_RX_HALT, &dev->flags)) {
                int     temp = dev->rxq.qlen;
-                int     qlen = RX_QLEN (dev);
+                if (temp < RX_QLEN(dev)) {
-                if (temp < qlen) {
+                        rx_alloc_submit(dev, GFP_ATOMIC);
-                        struct urb      *urb;
-                        int             i;
-                        // don't refill the queue all at once
-                        for (i = 0; i < 10 && dev->rxq.qlen < qlen; i++) {
-                                urb = usb_alloc_urb (0, GFP_ATOMIC);
-                                if (urb != NULL) {
-                                        if (rx_submit (dev, urb, GFP_ATOMIC) ==
-                                            -ENOLINK)
-                                                return;
-                                }
-                        }
                        if (temp != dev->rxq.qlen)
                                netif_dbg(dev, link, dev->net,
                                          "rxqlen %d --> %d\n",
                                          temp, dev->rxq.qlen);
-                        if (dev->rxq.qlen < qlen)
+                        if (dev->rxq.qlen < RX_QLEN(dev))
                                tasklet_schedule (&dev->bh);
                }
                if (dev->txq.qlen < TX_QLEN (dev))
@@ -1513,6 +1518,7 @@ int usbnet_suspend (struct usb_interface *intf, pm_message_t message)
                spin_lock_irq(&dev->txq.lock);
                /* don't autosuspend while transmitting */
                if (dev->txq.qlen && PMSG_IS_AUTO(message)) {
+                        dev->suspend_count--;
                        spin_unlock_irq(&dev->txq.lock);
                        return -EBUSY;
                } else {
@@ -1569,6 +1575,13 @@ int usbnet_resume (struct usb_interface *intf)
                spin_unlock_irq(&dev->txq.lock);
                if (test_bit(EVENT_DEV_OPEN, &dev->flags)) {
+                        /* handle remote wakeup ASAP */
+                        if (!dev->wait &&
+                                netif_device_present(dev->net) &&
+                                !timer_pending(&dev->delay) &&
+                                !test_bit(EVENT_RX_HALT, &dev->flags))
+                                        rx_alloc_submit(dev, GFP_KERNEL);
                        if (!(dev->txq.qlen >= TX_QLEN(dev)))
                                netif_tx_wake_all_queues(dev->net);
                        tasklet_schedule (&dev->bh);
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 520a4b2eb9cc..a747c632597a 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -7233,8 +7233,8 @@ static int airo_get_aplist(struct net_device *dev,
                }
        } else {
                dwrq->flags = 1; /* Should be define'd */
-                memcpy(extra + sizeof(struct sockaddr)*i,
+                memcpy(extra + sizeof(struct sockaddr) * i, qual,
-                       &qual,  sizeof(struct iw_quality)*i);
+                       sizeof(struct iw_quality) * i);
        }
        dwrq->length = i;
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index c54b7d37bff1..420d69b2674c 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -143,6 +143,7 @@ struct ath_common {
        u32 keymax;
        DECLARE_BITMAP(keymap, ATH_KEYMAX);
        DECLARE_BITMAP(tkip_keymap, ATH_KEYMAX);
+        DECLARE_BITMAP(ccmp_keymap, ATH_KEYMAX);
        enum ath_crypt_caps crypt_caps;
        unsigned int clockrate;
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index fbaa30930076..44ad6fe0278f 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1045,11 +1045,11 @@ ath5k_drain_tx_buffs(struct ath5k_hw *ah)
                                ath5k_txbuf_free_skb(ah, bf);
-                                spin_lock_bh(&ah->txbuflock);
+                                spin_lock(&ah->txbuflock);
                                list_move_tail(&bf->list, &ah->txbuf);
                                ah->txbuf_len++;
                                txq->txq_len--;
-                                spin_unlock_bh(&ah->txbuflock);
+                                spin_unlock(&ah->txbuflock);
                        }
                        txq->link = NULL;
                        txq->txq_poll_mark = false;
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index a277cf6f339d..4866550ddd96 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -214,6 +214,7 @@ struct ath_frame_info {
        enum ath9k_key_type keytype;
        u8 keyix;
        u8 retries;
+        u8 rtscts_rate;
 };
 struct ath_buf_state {
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 2b8f61c210e1..abbd6effd60d 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -1496,6 +1496,7 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
                        priv->num_sta_assoc_vif++ : priv->num_sta_assoc_vif--;
                if (priv->ah->opmode == NL80211_IFTYPE_STATION) {
+                        ath9k_htc_choose_set_bssid(priv);
                        if (bss_conf->assoc && (priv->num_sta_assoc_vif == 1))
                                ath9k_htc_start_ani(priv);
                        else if (priv->num_sta_assoc_vif == 0)
@@ -1503,13 +1504,11 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
                }
        }
-        if (changed & BSS_CHANGED_BSSID) {
+        if (changed & BSS_CHANGED_IBSS) {
                if (priv->ah->opmode == NL80211_IFTYPE_ADHOC) {
                        common->curaid = bss_conf->aid;
                        memcpy(common->curbssid, bss_conf->bssid, ETH_ALEN);
                        ath9k_htc_set_bssid(priv);
-                } else if (priv->ah->opmode == NL80211_IFTYPE_STATION) {
-                        ath9k_htc_choose_set_bssid(priv);
                }
        }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 7db1890448f2..995ca8e1302e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -622,7 +622,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
        if (NR_CPUS > 1 && ah->config.serialize_regmode == SER_REG_MODE_AUTO) {
                if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI ||
-                    ((AR_SREV_9160(ah) || AR_SREV_9280(ah)) &&
+                    ((AR_SREV_9160(ah) || AR_SREV_9280(ah) || AR_SREV_9287(ah)) &&
                     !ah->is_pciexpress)) {
                        ah->config.serialize_regmode =
                                SER_REG_MODE_ON;
@@ -784,13 +784,25 @@ static void ath9k_hw_init_qos(struct ath_hw *ah)
 u32 ar9003_get_pll_sqsum_dvc(struct ath_hw *ah)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
+        int i = 0;
        REG_CLR_BIT(ah, PLL3, PLL3_DO_MEAS_MASK);
        udelay(100);
        REG_SET_BIT(ah, PLL3, PLL3_DO_MEAS_MASK);
-        while ((REG_READ(ah, PLL4) & PLL4_MEAS_DONE) == 0)
+        while ((REG_READ(ah, PLL4) & PLL4_MEAS_DONE) == 0) {
                udelay(100);
+                if (WARN_ON_ONCE(i >= 100)) {
+                        ath_err(common, "PLL4 meaurement not done\n");
+                        break;
+                }
+                i++;
+        }
        return (REG_READ(ah, PLL3) & SQSUM_DVC_MASK) >> 3;
 }
 EXPORT_SYMBOL(ar9003_get_pll_sqsum_dvc);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 4de4473776ac..dac1a2709e3c 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -971,6 +971,15 @@ void ath_hw_pll_work(struct work_struct *work)
                                            hw_pll_work.work);
        u32 pll_sqsum;
+        /*
+         * ensure that the PLL WAR is executed only
+         * after the STA is associated (or) if the
+         * beaconing had started in interfaces that
+         * uses beacons.
+         */
+        if (!(sc->sc_flags & SC_OP_BEACONS))
+                return;
        if (AR_SREV_9485(sc->sc_ah)) {
                ath9k_ps_wakeup(sc);
@@ -1443,15 +1452,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                }
        }
-        if ((ah->opmode == NL80211_IFTYPE_ADHOC) ||
-            ((vif->type == NL80211_IFTYPE_ADHOC) &&
-             sc->nvifs > 0)) {
-                ath_err(common, "Cannot create ADHOC interface when other"
-                        " interfaces already exist.\n");
-                ret = -EINVAL;
-                goto out;
-        }
        ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
        sc->nvifs++;
@@ -1476,15 +1476,6 @@ static int ath9k_change_interface(struct ieee80211_hw *hw,
        mutex_lock(&sc->mutex);
        ath9k_ps_wakeup(sc);
-        /* See if new interface type is valid. */
-        if ((new_type == NL80211_IFTYPE_ADHOC) &&
-            (sc->nvifs > 1)) {
-                ath_err(common, "When using ADHOC, it must be the only"
-                        " interface.\n");
-                ret = -EINVAL;
-                goto out;
-        }
        if (ath9k_uses_beacons(new_type) &&
            !ath9k_uses_beacons(vif->type)) {
                if (sc->nbcnvifs >= ATH_BCBUF) {
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index e1fcc68124dc..0735aeb3b26c 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -695,9 +695,9 @@ static bool ath_edma_get_buffers(struct ath_softc *sc,
                        __skb_unlink(skb, &rx_edma->rx_fifo);
                        list_add_tail(&bf->list, &sc->rx.rxbuf);
                        ath_rx_edma_buf_link(sc, qtype);
-                } else {
-                        bf = NULL;
                }
+                bf = NULL;
        }
        *dest = bf;
@@ -822,7 +822,8 @@ static bool ath9k_rx_accept(struct ath_common *common,
         * descriptor does contain a valid key index. This has been observed
         * mostly with CCMP encryption.
         */
-        if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID)
+        if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID ||
+            !test_bit(rx_stats->rs_keyix, common->ccmp_keymap))
                rx_stats->rs_status &= ~ATH9K_RXERR_KEYMISS;
        if (!rx_stats->rs_datalen) {
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index d59dd01d6cde..4d571394c7a8 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -938,6 +938,7 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
        struct ieee80211_tx_rate *rates;
        const struct ieee80211_rate *rate;
        struct ieee80211_hdr *hdr;
+        struct ath_frame_info *fi = get_frame_info(bf->bf_mpdu);
        int i;
        u8 rix = 0;
@@ -948,18 +949,7 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
        /* set dur_update_en for l-sig computation except for PS-Poll frames */
        info->dur_update = !ieee80211_is_pspoll(hdr->frame_control);
+        info->rtscts_rate = fi->rtscts_rate;
-        /*
-         * We check if Short Preamble is needed for the CTS rate by
-         * checking the BSS's global flag.
-         * But for the rate series, IEEE80211_TX_RC_USE_SHORT_PREAMBLE is used.
-         */
-        rate = ieee80211_get_rts_cts_rate(sc->hw, tx_info);
-        info->rtscts_rate = rate->hw_value;
-        if (tx_info->control.vif &&
-            tx_info->control.vif->bss_conf.use_short_preamble)
-                info->rtscts_rate |= rate->hw_value_short;
        for (i = 0; i < 4; i++) {
                bool is_40, is_sgi, is_sp;
@@ -1001,13 +991,13 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
                }
                /* legacy rates */
+                rate = &sc->sbands[tx_info->band].bitrates[rates[i].idx];
                if ((tx_info->band == IEEE80211_BAND_2GHZ) &&
                    !(rate->flags & IEEE80211_RATE_ERP_G))
                        phy = WLAN_RC_PHY_CCK;
                else
                        phy = WLAN_RC_PHY_OFDM;
-                rate = &sc->sbands[tx_info->band].bitrates[rates[i].idx];
                info->rates[i].Rate = rate->hw_value;
                if (rate->hw_value_short) {
                        if (rates[i].flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE)
@@ -1776,10 +1766,22 @@ static void setup_frame_info(struct ieee80211_hw *hw, struct sk_buff *skb,
        struct ieee80211_sta *sta = tx_info->control.sta;
        struct ieee80211_key_conf *hw_key = tx_info->control.hw_key;
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        const struct ieee80211_rate *rate;
        struct ath_frame_info *fi = get_frame_info(skb);
        struct ath_node *an = NULL;
        enum ath9k_key_type keytype;
+        bool short_preamble = false;
+        /*
+         * We check if Short Preamble is needed for the CTS rate by
+         * checking the BSS's global flag.
+         * But for the rate series, IEEE80211_TX_RC_USE_SHORT_PREAMBLE is used.
+         */
+        if (tx_info->control.vif &&
+            tx_info->control.vif->bss_conf.use_short_preamble)
+                short_preamble = true;
+        rate = ieee80211_get_rts_cts_rate(hw, tx_info);
        keytype = ath9k_cmn_get_hw_crypto_keytype(skb);
        if (sta)
@@ -1794,6 +1796,9 @@ static void setup_frame_info(struct ieee80211_hw *hw, struct sk_buff *skb,
                fi->keyix = ATH9K_TXKEYIX_INVALID;
        fi->keytype = keytype;
        fi->framelen = framelen;
+        fi->rtscts_rate = rate->hw_value;
+        if (short_preamble)
+                fi->rtscts_rate |= rate->hw_value_short;
 }
 u8 ath_txchainmask_reduction(struct ath_softc *sc, u8 chainmask, u32 rate)
diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c
index 0e81904956cf..5c54aa43ca2d 100644
--- a/drivers/net/wireless/ath/key.c
+++ b/drivers/net/wireless/ath/key.c
@@ -556,6 +556,9 @@ int ath_key_config(struct ath_common *common,
                return -EIO;
        set_bit(idx, common->keymap);
+        if (key->cipher == WLAN_CIPHER_SUITE_CCMP)
+                set_bit(idx, common->ccmp_keymap);
        if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
                set_bit(idx + 64, common->keymap);
                set_bit(idx, common->tkip_keymap);
@@ -582,6 +585,7 @@ void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key)
                return;
        clear_bit(key->hw_key_idx, common->keymap);
+        clear_bit(key->hw_key_idx, common->ccmp_keymap);
        if (key->cipher != WLAN_CIPHER_SUITE_TKIP)
                return;
diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index f1f8bd09bd87..c8baf020c20f 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -1072,7 +1072,7 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
        meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
        /* create a bounce buffer in zone_dma on mapping failure. */
        if (b43legacy_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
-                bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
+                bounce_skb = alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
                if (!bounce_skb) {
                        ring->current_slot = old_top_slot;
                        ring->used_slots = old_used_slots;
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 509301a5e7e2..ff5d689e13f3 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -3405,7 +3405,7 @@ il4965_remove_dynamic_key(struct il_priv *il,
                return 0;
        }
-        if (il->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET) {
+        if (il->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_INVALID) {
                IL_WARN("Removing wrong key %d 0x%x\n", keyconf->keyidx,
                        key_flags);
                spin_unlock_irqrestore(&il->sta_lock, flags);
@@ -3420,7 +3420,7 @@ il4965_remove_dynamic_key(struct il_priv *il,
        memset(&il->stations[sta_id].sta.key, 0, sizeof(struct il4965_keyinfo));
        il->stations[sta_id].sta.key.key_flags =
            STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
-        il->stations[sta_id].sta.key.key_offset = WEP_INVALID_OFFSET;
+        il->stations[sta_id].sta.key.key_offset = keyconf->hw_key_idx;
        il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
        il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index cbf2dc18341f..5d4807c2b56d 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -4767,14 +4767,12 @@ il_bg_watchdog(unsigned long data)
                return;
        /* monitor and check for other stuck queues */
-        if (il_is_any_associated(il)) {
+        for (cnt = 0; cnt < il->hw_params.max_txq_num; cnt++) {
-                for (cnt = 0; cnt < il->hw_params.max_txq_num; cnt++) {
+                /* skip as we already checked the command queue */
-                        /* skip as we already checked the command queue */
+                if (cnt == il->cmd_queue)
-                        if (cnt == il->cmd_queue)
+                        continue;
-                                continue;
+                if (il_check_stuck_queue(il, cnt))
-                        if (il_check_stuck_queue(il, cnt))
+                        return;
-                                return;
-                }
        }
        mod_timer(&il->watchdog,
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index e7c157e5ebeb..7f97dec8534d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -2239,6 +2239,7 @@ static ssize_t iwl_dbgfs_echo_test_write(struct file *file,
        return count;
 }
+#ifdef CONFIG_IWLWIFI_DEBUG
 static ssize_t iwl_dbgfs_log_event_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos)
@@ -2276,6 +2277,7 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
        return count;
 }
+#endif
 static ssize_t iwl_dbgfs_calib_disabled_read(struct file *file,
                                         char __user *user_buf,
@@ -2345,7 +2347,9 @@ DEBUGFS_READ_FILE_OPS(bt_traffic);
 DEBUGFS_READ_WRITE_FILE_OPS(protection_mode);
 DEBUGFS_READ_FILE_OPS(reply_tx_error);
 DEBUGFS_WRITE_FILE_OPS(echo_test);
+#ifdef CONFIG_IWLWIFI_DEBUG
 DEBUGFS_READ_WRITE_FILE_OPS(log_event);
+#endif
 DEBUGFS_READ_WRITE_FILE_OPS(calib_disabled);
 /*
@@ -2405,7 +2409,9 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
        DEBUGFS_ADD_FILE(rxon_flags, dir_debug, S_IWUSR);
        DEBUGFS_ADD_FILE(rxon_filter_flags, dir_debug, S_IWUSR);
        DEBUGFS_ADD_FILE(echo_test, dir_debug, S_IWUSR);
+#ifdef CONFIG_IWLWIFI_DEBUG
        DEBUGFS_ADD_FILE(log_event, dir_debug, S_IWUSR | S_IRUSR);
+#endif
        if (iwl_advanced_bt_coexist(priv))
                DEBUGFS_ADD_FILE(bt_traffic, dir_debug, S_IRUSR);
diff --git a/drivers/net/wireless/iwlwifi/iwl-mac80211.c b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
index 3ee23134c02b..013680332f07 100644
--- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c
+++ b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
@@ -796,6 +796,18 @@ int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
        switch (op) {
        case ADD:
                ret = iwlagn_mac_sta_add(hw, vif, sta);
+                if (ret)
+                        break;
+                /*
+                 * Clear the in-progress flag, the AP station entry was added
+                 * but we'll initialize LQ only when we've associated (which
+                 * would also clear the in-progress flag). This is necessary
+                 * in case we never initialize LQ because association fails.
+                 */
+                spin_lock_bh(&priv->sta_lock);
+                priv->stations[iwl_sta_id(sta)].used &=
+                        ~IWL_STA_UCODE_INPROGRESS;
+                spin_unlock_bh(&priv->sta_lock);
                break;
        case REMOVE:
                ret = iwlagn_mac_sta_remove(hw, vif, sta);
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index 9c44088054dd..900ee129e825 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -256,7 +256,8 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
        else
                last_seq = priv->rx_seq[tid];
-        if (last_seq >= new_node->start_win)
+        if (last_seq != MWIFIEX_DEF_11N_RX_SEQ_NUM &&
+            last_seq >= new_node->start_win)
                new_node->start_win = last_seq + 1;
        new_node->win_size = win_size;
@@ -596,5 +597,5 @@ void mwifiex_11n_cleanup_reorder_tbl(struct mwifiex_private *priv)
        spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
        INIT_LIST_HEAD(&priv->rx_reorder_tbl_ptr);
-        memset(priv->rx_seq, 0, sizeof(priv->rx_seq));
+        mwifiex_reset_11n_rx_seq_num(priv);
 }
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.h b/drivers/net/wireless/mwifiex/11n_rxreorder.h
index f1bffebabc60..6c9815a0f5d8 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.h
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.h
@@ -37,6 +37,13 @@
 #define ADDBA_RSP_STATUS_ACCEPT 0
+#define MWIFIEX_DEF_11N_RX_SEQ_NUM      0xffff
+static inline void mwifiex_reset_11n_rx_seq_num(struct mwifiex_private *priv)
+{
+        memset(priv->rx_seq, 0xff, sizeof(priv->rx_seq));
+}
 int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *,
                               u16 seqNum,
                               u16 tid, u8 *ta,
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 015fec3371a0..5c7fd185373c 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -958,6 +958,7 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
        case NL80211_HIDDEN_SSID_ZERO_CONTENTS:
                /* firmware doesn't support this type of hidden SSID */
        default:
+                kfree(bss_cfg);
                return -EINVAL;
        }
@@ -1484,7 +1485,7 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
        struct wireless_dev *wdev;
        if (!adapter)
-                return NULL;
+                return ERR_PTR(-EFAULT);
        switch (type) {
        case NL80211_IFTYPE_UNSPECIFIED:
@@ -1494,12 +1495,12 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                if (priv->bss_mode) {
                        wiphy_err(wiphy,
                                  "cannot create multiple sta/adhoc ifaces\n");
-                        return NULL;
+                        return ERR_PTR(-EINVAL);
                }
                wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
                if (!wdev)
-                        return NULL;
+                        return ERR_PTR(-ENOMEM);
                wdev->wiphy = wiphy;
                priv->wdev = wdev;
@@ -1522,12 +1523,12 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                if (priv->bss_mode) {
                        wiphy_err(wiphy, "Can't create multiple AP interfaces");
-                        return NULL;
+                        return ERR_PTR(-EINVAL);
                }
                wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
                if (!wdev)
-                        return NULL;
+                        return ERR_PTR(-ENOMEM);
                priv->wdev = wdev;
                wdev->wiphy = wiphy;
@@ -1544,14 +1545,15 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                break;
        default:
                wiphy_err(wiphy, "type not supported\n");
-                return NULL;
+                return ERR_PTR(-EINVAL);
        }
        dev = alloc_netdev_mq(sizeof(struct mwifiex_private *), name,
                              ether_setup, 1);
        if (!dev) {
                wiphy_err(wiphy, "no memory available for netdevice\n");
-                goto error;
+                priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+                return ERR_PTR(-ENOMEM);
        }
        mwifiex_init_priv_params(priv, dev);
@@ -1582,7 +1584,9 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
        /* Register network device */
        if (register_netdevice(dev)) {
                wiphy_err(wiphy, "cannot register virtual network device\n");
-                goto error;
+                free_netdev(dev);
+                priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+                return ERR_PTR(-EFAULT);
        }
        sema_init(&priv->async_sem, 1);
@@ -1594,12 +1598,6 @@ struct net_device *mwifiex_add_virtual_intf(struct wiphy *wiphy,
        mwifiex_dev_debugfs_init(priv);
 #endif
        return dev;
-error:
-        if (dev && (dev->reg_state == NETREG_UNREGISTERED))
-                free_netdev(dev);
-        priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
-        return NULL;
 }
 EXPORT_SYMBOL_GPL(mwifiex_add_virtual_intf);
diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c
index ceb82cd749cc..383820a52beb 100644
--- a/drivers/net/wireless/mwifiex/ie.c
+++ b/drivers/net/wireless/mwifiex/ie.c
@@ -213,6 +213,7 @@ mwifiex_update_uap_custom_ie(struct mwifiex_private *priv,
                /* save assoc resp ie index after auto-indexing */
                *assoc_idx = *((u16 *)pos);
+        kfree(ap_custom_ie);
        return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index e0377473282f..fc8a9bfa1248 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -978,10 +978,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
                dev_dbg(adapter->dev, "info: --- Rx: Event ---\n");
                adapter->event_cause = *(u32 *) skb->data;
-                skb_pull(skb, MWIFIEX_EVENT_HEADER_LEN);
                if ((skb->len > 0) && (skb->len  < MAX_EVENT_SIZE))
-                        memcpy(adapter->event_body, skb->data, skb->len);
+                        memcpy(adapter->event_body,
+                               skb->data + MWIFIEX_EVENT_HEADER_LEN,
+                               skb->len);
                /* event cause has been saved to adapter->event_cause */
                adapter->event_received = true;
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index 4ace5a3dcd23..11e731f3581c 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -406,9 +406,9 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                break;
        case EVENT_UAP_STA_ASSOC:
-                skb_pull(adapter->event_skb, MWIFIEX_UAP_EVENT_EXTRA_HEADER);
                memset(&sinfo, 0, sizeof(sinfo));
-                event = (struct mwifiex_assoc_event *)adapter->event_skb->data;
+                event = (struct mwifiex_assoc_event *)
+                        (adapter->event_body + MWIFIEX_UAP_EVENT_EXTRA_HEADER);
                if (le16_to_cpu(event->type) == TLV_TYPE_UAP_MGMT_FRAME) {
                        len = -1;
@@ -433,9 +433,8 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                                 GFP_KERNEL);
                break;
        case EVENT_UAP_STA_DEAUTH:
-                skb_pull(adapter->event_skb, MWIFIEX_UAP_EVENT_EXTRA_HEADER);
+                cfg80211_del_sta(priv->netdev, adapter->event_body +
-                cfg80211_del_sta(priv->netdev, adapter->event_skb->data,
+                                 MWIFIEX_UAP_EVENT_EXTRA_HEADER, GFP_KERNEL);
-                                 GFP_KERNEL);
                break;
        case EVENT_UAP_BSS_IDLE:
                priv->media_connected = false;
diff --git a/drivers/net/wireless/mwifiex/txrx.c b/drivers/net/wireless/mwifiex/txrx.c
index e2faec4db108..cecb27283196 100644
--- a/drivers/net/wireless/mwifiex/txrx.c
+++ b/drivers/net/wireless/mwifiex/txrx.c
@@ -161,15 +161,11 @@ int mwifiex_write_data_complete(struct mwifiex_adapter *adapter,
                goto done;
        for (i = 0; i < adapter->priv_num; i++) {
                tpriv = adapter->priv[i];
-                if ((GET_BSS_ROLE(tpriv) == MWIFIEX_BSS_ROLE_STA) &&
+                if (tpriv->media_connected &&
-                    (tpriv->media_connected)) {
+                    netif_queue_stopped(tpriv->netdev))
-                        if (netif_queue_stopped(tpriv->netdev))
+                        mwifiex_wake_up_net_dev_queue(tpriv->netdev, adapter);
-                                mwifiex_wake_up_net_dev_queue(tpriv->netdev,
-                                                              adapter);
-                }
        }
 done:
        dev_kfree_skb_any(skb);
diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index 8173ab66066d..89f9a2a45de3 100644
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -27,6 +27,17 @@ int mwifiex_set_secure_params(struct mwifiex_private *priv,
                              struct cfg80211_ap_settings *params) {
        int i;
+        if (!params->privacy) {
+                bss_config->protocol = PROTOCOL_NO_SECURITY;
+                bss_config->key_mgmt = KEY_MGMT_NONE;
+                bss_config->wpa_cfg.length = 0;
+                priv->sec_info.wep_enabled = 0;
+                priv->sec_info.wpa_enabled = 0;
+                priv->sec_info.wpa2_enabled = 0;
+                return 0;
+        }
        switch (params->auth_type) {
        case NL80211_AUTHTYPE_OPEN_SYSTEM:
                bss_config->auth_mode = WLAN_AUTH_OPEN;
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 49ebf20c56eb..22a5916564b8 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -49,6 +49,7 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
        struct device *dev = adapter->dev;
        u32 recv_type;
        __le32 tmp;
+        int ret;
        if (adapter->hs_activated)
                mwifiex_process_hs_config(adapter);
@@ -69,16 +70,19 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
                case MWIFIEX_USB_TYPE_CMD:
                        if (skb->len > MWIFIEX_SIZE_OF_CMD_BUFFER) {
                                dev_err(dev, "CMD: skb->len too large\n");
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                        } else if (!adapter->curr_cmd) {
                                dev_dbg(dev, "CMD: no curr_cmd\n");
                                if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
                                        mwifiex_process_sleep_confirm_resp(
                                                        adapter, skb->data,
                                                        skb->len);
-                                        return 0;
+                                        ret = 0;
+                                        goto exit_restore_skb;
                                }
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                        }
                        adapter->curr_cmd->resp_skb = skb;
@@ -87,20 +91,22 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
                case MWIFIEX_USB_TYPE_EVENT:
                        if (skb->len < sizeof(u32)) {
                                dev_err(dev, "EVENT: skb->len too small\n");
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                        }
                        skb_copy_from_linear_data(skb, &tmp, sizeof(u32));
                        adapter->event_cause = le32_to_cpu(tmp);
-                        skb_pull(skb, sizeof(u32));
                        dev_dbg(dev, "event_cause %#x\n", adapter->event_cause);
                        if (skb->len > MAX_EVENT_SIZE) {
                                dev_err(dev, "EVENT: event body too large\n");
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                        }
-                        skb_copy_from_linear_data(skb, adapter->event_body,
+                        memcpy(adapter->event_body, skb->data +
-                                                  skb->len);
+                               MWIFIEX_EVENT_HEADER_LEN, skb->len);
                        adapter->event_received = true;
                        adapter->event_skb = skb;
                        break;
@@ -124,6 +130,12 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
        }
        return -EINPROGRESS;
+exit_restore_skb:
+        /* The buffer will be reused for further cmds/events */
+        skb_push(skb, INTF_HEADER_LEN);
+        return ret;
 }
 static void mwifiex_usb_rx_complete(struct urb *urb)
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index f3fc65515857..3fa4d4176993 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -404,6 +404,8 @@ mwifiex_wmm_init(struct mwifiex_adapter *adapter)
                priv->add_ba_param.tx_win_size = MWIFIEX_AMPDU_DEF_TXWINSIZE;
                priv->add_ba_param.rx_win_size = MWIFIEX_AMPDU_DEF_RXWINSIZE;
+                mwifiex_reset_11n_rx_seq_num(priv);
                atomic_set(&priv->wmm.tx_pkts_queued, 0);
                atomic_set(&priv->wmm.highest_queued_prio, HIGH_PRIO_TID);
        }
@@ -1221,6 +1223,7 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
        if (!ptr->is_11n_enabled ||
            mwifiex_is_ba_stream_setup(priv, ptr, tid) ||
+            priv->wps.session_enable ||
            ((priv->sec_info.wpa_enabled ||
              priv->sec_info.wpa2_enabled) &&
             !priv->wpa_is_gtk_set)) {
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 2e9e6af21362..dfcd02ab6cae 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2110,7 +2110,7 @@ resize_buf:
        while (check_bssid_list_item(bssid, bssid_len, buf, len)) {
                if (rndis_bss_info_update(usbdev, bssid) && match_bssid &&
                    matched) {
-                        if (!ether_addr_equal(bssid->mac, match_bssid))
+                        if (ether_addr_equal(bssid->mac, match_bssid))
                                *matched = true;
                }
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index d357d1ed92f6..74ecc33fdd90 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -436,8 +436,8 @@ void rt2x00usb_kick_queue(struct data_queue *queue)
        case QID_RX:
                if (!rt2x00queue_full(queue))
                        rt2x00queue_for_each_entry(queue,
-                                                   Q_INDEX_DONE,
                                                   Q_INDEX,
+                                                   Q_INDEX_DONE,
                                                   NULL,
                                                   rt2x00usb_kick_rx_entry);
                break;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index d228358e6a40..9970c2b1b199 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -301,9 +301,11 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
        {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
        {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
        {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
+        {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
        {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
        {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
        {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+        {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
        /* HP - Lite-On ,8188CUS Slim Combo */
        {RTL_USB_DEVICE(0x103c, 0x1629, rtl92cu_hal_cfg)},
        {RTL_USB_DEVICE(0x13d3, 0x3357, rtl92cu_hal_cfg)}, /* AzureWave */
@@ -346,6 +348,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
        {RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Funai -Abocom*/
        {RTL_USB_DEVICE(0x0846, 0x9021, rtl92cu_hal_cfg)}, /*Netgear-Sercomm*/
        {RTL_USB_DEVICE(0x0b05, 0x17ab, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
+        {RTL_USB_DEVICE(0x0bda, 0x8186, rtl92cu_hal_cfg)}, /*Realtek 92CE-VAU*/
        {RTL_USB_DEVICE(0x0df6, 0x0061, rtl92cu_hal_cfg)}, /*Sitecom-Edimax*/
        {RTL_USB_DEVICE(0x0e66, 0x0019, rtl92cu_hal_cfg)}, /*Hawking-Edimax*/
        {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
diff --git a/drivers/net/wireless/ti/wl1251/acx.c b/drivers/net/wireless/ti/wl1251/acx.c
index ad87a1ac6462..db6430c1a084 100644
--- a/drivers/net/wireless/ti/wl1251/acx.c
+++ b/drivers/net/wireless/ti/wl1251/acx.c
@@ -869,7 +869,7 @@ int wl1251_acx_tsf_info(struct wl1251 *wl, u64 *mactime)
        }
        *mactime = tsf_info->current_tsf_lsb |
-                (tsf_info->current_tsf_msb << 31);
+                ((u64)tsf_info->current_tsf_msb << 32);
 out:
        kfree(tsf_info);
diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
index 9f15ccaf8f05..5ec50a476a69 100644
--- a/drivers/net/wireless/ti/wl1251/event.c
+++ b/drivers/net/wireless/ti/wl1251/event.c
@@ -76,8 +76,7 @@ static int wl1251_event_process(struct wl1251 *wl, struct event_mailbox *mbox)
                }
        }
-        if (vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID &&
+        if (vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
-            wl->station_mode != STATION_ACTIVE_MODE) {
                wl1251_debug(DEBUG_EVENT, "SYNCHRONIZATION_TIMEOUT_EVENT");
                /* indicate to the stack, that beacons have been lost */
diff --git a/drivers/net/wireless/ti/wl1251/spi.c b/drivers/net/wireless/ti/wl1251/spi.c
index 87f6305bda2c..567660cd2fcd 100644
--- a/drivers/net/wireless/ti/wl1251/spi.c
+++ b/drivers/net/wireless/ti/wl1251/spi.c
@@ -73,6 +73,8 @@ static void wl1251_spi_reset(struct wl1251 *wl)
        spi_sync(wl_to_spi(wl), &m);
        wl1251_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
+        kfree(cmd);
 }
 static void wl1251_spi_wake(struct wl1251 *wl)
@@ -127,6 +129,8 @@ static void wl1251_spi_wake(struct wl1251 *wl)
        spi_sync(wl_to_spi(wl), &m);
        wl1251_dump(DEBUG_SPI, "spi init -> ", cmd, WSPI_INIT_CMD_LEN);
+        kfree(cmd);
 }
 static void wl1251_spi_reset_wake(struct wl1251 *wl)
diff --git a/drivers/net/wireless/ti/wlcore/Kconfig b/drivers/net/wireless/ti/wlcore/Kconfig
index 54156b0b5c2d..d7b907e67170 100644
--- a/drivers/net/wireless/ti/wlcore/Kconfig
+++ b/drivers/net/wireless/ti/wlcore/Kconfig
@@ -1,7 +1,6 @@
 config WLCORE
        tristate "TI wlcore support"
        depends on WL_TI && GENERIC_HARDIRQS && MAC80211
-        depends on INET
        select FW_LOADER
        ---help---
          This module contains the main code for TI WLAN chips.  It abstracts
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 2027afe405fe..30899901aef5 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1935,14 +1935,14 @@ static int __devexit xennet_remove(struct xenbus_device *dev)
        dev_dbg(&dev->dev, "%s\n", dev->nodename);
-        unregister_netdev(info->netdev);
        xennet_disconnect_backend(info);
-        del_timer_sync(&info->rx_refill_timer);
        xennet_sysfs_delif(info->netdev);
+        unregister_netdev(info->netdev);
+        del_timer_sync(&info->rx_refill_timer);
        free_percpu(info->stats);
        free_netdev(info->netdev);
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 343ad29e211c..e44f8c2d239d 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -317,10 +317,9 @@ static const struct of_dev_auxdata *of_dev_lookup(const struct of_dev_auxdata *l
        for(; lookup->compatible != NULL; lookup++) {
                if (!of_device_is_compatible(np, lookup->compatible))
                        continue;
-                if (of_address_to_resource(np, 0, &res))
+                if (!of_address_to_resource(np, 0, &res))
-                        continue;
+                        if (res.start != lookup->phys_addr)
-                if (res.start != lookup->phys_addr)
+                                continue;
-                        continue;
                pr_debug("%s: devname=%s\n", np->full_name, lookup->name);
                return lookup;
        }
@@ -462,4 +461,5 @@ int of_platform_populate(struct device_node *root,
        of_node_put(root);
        return rc;
 }
+EXPORT_SYMBOL_GPL(of_platform_populate);
 #endif /* CONFIG_OF_ADDRESS */
diff --git a/drivers/oprofile/oprofile_perf.c b/drivers/oprofile/oprofile_perf.c
index da14432806c6..efc4b7f308cf 100644
--- a/drivers/oprofile/oprofile_perf.c
+++ b/drivers/oprofile/oprofile_perf.c
@@ -25,7 +25,7 @@ static int oprofile_perf_enabled;
 static DEFINE_MUTEX(oprofile_perf_mutex);
 static struct op_counter_config *counter_config;
-static struct perf_event **perf_events[nr_cpumask_bits];
+static struct perf_event **perf_events[NR_CPUS];
 static int num_counters;
 /*
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index bf0cee629b60..099f46cd8e87 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -748,6 +748,18 @@ static int pci_pm_suspend_noirq(struct device *dev)
        pci_pm_set_unknown_state(pci_dev);
+        /*
+         * Some BIOSes from ASUS have a bug: If a USB EHCI host controller's
+         * PCI COMMAND register isn't 0, the BIOS assumes that the controller
+         * hasn't been quiesced and tries to turn it off.  If the controller
+         * is already in D3, this can hang or cause memory corruption.
+         *
+         * Since the value of the COMMAND register doesn't matter once the
+         * device has been suspended, we can safely set it to 0 here.
+         */
+        if (pci_dev->class == PCI_CLASS_SERIAL_USB_EHCI)
+                pci_write_config_word(pci_dev, PCI_COMMAND, 0);
        return 0;
 }
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 77cb54a65cde..447e83472c01 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1744,11 +1744,6 @@ int pci_prepare_to_sleep(struct pci_dev *dev)
        if (target_state == PCI_POWER_ERROR)
                return -EIO;
-        /* Some devices mustn't be in D3 during system sleep */
-        if (target_state == PCI_D3hot &&
-                        (dev->dev_flags & PCI_DEV_FLAGS_NO_D3_DURING_SLEEP))
-                return 0;
        pci_enable_wake(dev, target_state, device_may_wakeup(&dev->dev));
        error = pci_set_power_state(dev, target_state);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 194b243a2817..2a7521677541 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2929,32 +2929,6 @@ static void __devinit disable_igfx_irq(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
-/*
- * The Intel 6 Series/C200 Series chipset's EHCI controllers on many
- * ASUS motherboards will cause memory corruption or a system crash
- * if they are in D3 while the system is put into S3 sleep.
- */
-static void __devinit asus_ehci_no_d3(struct pci_dev *dev)
-{
-        const char *sys_info;
-        static const char good_Asus_board[] = "P8Z68-V";
-        if (dev->dev_flags & PCI_DEV_FLAGS_NO_D3_DURING_SLEEP)
-                return;
-        if (dev->subsystem_vendor != PCI_VENDOR_ID_ASUSTEK)
-                return;
-        sys_info = dmi_get_system_info(DMI_BOARD_NAME);
-        if (sys_info && memcmp(sys_info, good_Asus_board,
-                        sizeof(good_Asus_board) - 1) == 0)
-                return;
-        dev_info(&dev->dev, "broken D3 during system sleep on ASUS\n");
-        dev->dev_flags |= PCI_DEV_FLAGS_NO_D3_DURING_SLEEP;
-        device_set_wakeup_capable(&dev->dev, false);
-}
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1c26, asus_ehci_no_d3);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1c2d, asus_ehci_no_d3);
 static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
                          struct pci_fixup *end)
 {
diff --git a/drivers/pinctrl/pinctrl-imx.c b/drivers/pinctrl/pinctrl-imx.c
index dd6d93aa5334..90c837f469a6 100644
--- a/drivers/pinctrl/pinctrl-imx.c
+++ b/drivers/pinctrl/pinctrl-imx.c
@@ -474,7 +474,9 @@ static int __devinit imx_pinctrl_parse_groups(struct device_node *np,
                grp->configs[j] = config & ~IMX_PAD_SION;
        }
+#ifdef DEBUG
        IMX_PMX_DUMP(info, grp->pins, grp->mux_mode, grp->configs, grp->npins);
+#endif
        return 0;
 }
diff --git a/drivers/pinctrl/pinctrl-imx6q.c b/drivers/pinctrl/pinctrl-imx6q.c
index 7737d4d71a3c..e9bf71fbedca 100644
--- a/drivers/pinctrl/pinctrl-imx6q.c
+++ b/drivers/pinctrl/pinctrl-imx6q.c
@@ -1950,6 +1950,8 @@ static struct imx_pin_reg imx6q_pin_regs[] = {
        IMX_PIN_REG(MX6Q_PAD_SD2_DAT3, 0x0744, 0x035C, 5, 0x0000, 0), /* MX6Q_PAD_SD2_DAT3__GPIO_1_12 */
        IMX_PIN_REG(MX6Q_PAD_SD2_DAT3, 0x0744, 0x035C, 6, 0x0000, 0), /* MX6Q_PAD_SD2_DAT3__SJC_DONE */
        IMX_PIN_REG(MX6Q_PAD_SD2_DAT3, 0x0744, 0x035C, 7, 0x0000, 0), /* MX6Q_PAD_SD2_DAT3__ANATOP_TESTO_3 */
+        IMX_PIN_REG(MX6Q_PAD_ENET_RX_ER, 0x04EC, 0x01D8, 0, 0x0000, 0), /* MX6Q_PAD_ENET_RX_ER__ANATOP_USBOTG_ID */
+        IMX_PIN_REG(MX6Q_PAD_GPIO_1, 0x05F4, 0x0224, 3, 0x0000, 0), /* MX6Q_PAD_GPIO_1__ANATOP_USBOTG_ID */
 };
 /* Pad names for the pinmux subsystem */
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 4f20f8dd3d7c..17f6dfd8dbfb 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -694,10 +694,10 @@ MODULE_DEVICE_TABLE(acpi, ideapad_device_ids);
 static int __devinit ideapad_acpi_add(struct acpi_device *adevice)
 {
        int ret, i;
-        unsigned long cfg;
+        int cfg;
        struct ideapad_private *priv;
-        if (read_method_int(adevice->handle, "_CFG", (int *)&cfg))
+        if (read_method_int(adevice->handle, "_CFG", &cfg))
                return -ENODEV;
        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
@@ -721,7 +721,7 @@ static int __devinit ideapad_acpi_add(struct acpi_device *adevice)
                goto input_failed;
        for (i = 0; i < IDEAPAD_RFKILL_DEV_NUM; i++) {
-                if (test_bit(ideapad_rfk_data[i].cfgbit, &cfg))
+                if (test_bit(ideapad_rfk_data[i].cfgbit, &priv->cfg))
                        ideapad_register_rfkill(adevice, i);
                else
                        priv->rfk[i] = NULL;
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index 0ffdb3cde2bb..9af4257d4901 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -72,6 +72,7 @@
 #include <linux/string.h>
 #include <linux/tick.h>
 #include <linux/timer.h>
+#include <linux/dmi.h>
 #include <drm/i915_drm.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
@@ -1485,6 +1486,24 @@ static DEFINE_PCI_DEVICE_TABLE(ips_id_table) = {
 MODULE_DEVICE_TABLE(pci, ips_id_table);
+static int ips_blacklist_callback(const struct dmi_system_id *id)
+{
+        pr_info("Blacklisted intel_ips for %s\n", id->ident);
+        return 1;
+}
+static const struct dmi_system_id ips_blacklist[] = {
+        {
+                .callback = ips_blacklist_callback,
+                .ident = "HP ProBook",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook"),
+                },
+        },
+        { }     /* terminating entry */
+};
 static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
 {
        u64 platform_info;
@@ -1494,6 +1513,9 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
        u16 htshi, trc, trc_required_mask;
        u8 tse;
+        if (dmi_check_system(ips_blacklist))
+                return -ENODEV;
        ips = kzalloc(sizeof(struct ips_driver), GFP_KERNEL);
        if (!ips)
                return -ENOMEM;
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index 210d4ae547c2..d456ff0c73b7 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -973,7 +973,7 @@ static ssize_t sony_nc_sysfs_store(struct device *dev,
                               struct device_attribute *attr,
                               const char *buffer, size_t count)
 {
-        unsigned long value = 0;
+        int value;
        int ret = 0;
        struct sony_nc_value *item =
            container_of(attr, struct sony_nc_value, devattr);
@@ -984,7 +984,7 @@ static ssize_t sony_nc_sysfs_store(struct device *dev,
        if (count > 31)
                return -EINVAL;
-        if (kstrtoul(buffer, 10, &value))
+        if (kstrtoint(buffer, 10, &value))
                return -EINVAL;
        if (item->validate)
@@ -994,7 +994,7 @@ static ssize_t sony_nc_sysfs_store(struct device *dev,
                return value;
        ret = sony_nc_int_call(sony_nc_acpi_handle, *item->acpiset,
-                        (int *)&value, NULL);
+                               &value, NULL);
        if (ret < 0)
                return -EIO;
@@ -1010,6 +1010,7 @@ static ssize_t sony_nc_sysfs_store(struct device *dev,
 struct sony_backlight_props {
        struct backlight_device *dev;
        int                     handle;
+        int                     cmd_base;
        u8                      offset;
        u8                      maxlvl;
 };
@@ -1037,7 +1038,7 @@ static int sony_nc_get_brightness_ng(struct backlight_device *bd)
        struct sony_backlight_props *sdev =
                (struct sony_backlight_props *)bl_get_data(bd);
-        sony_call_snc_handle(sdev->handle, 0x0200, &result);
+        sony_call_snc_handle(sdev->handle, sdev->cmd_base + 0x100, &result);
        return (result & 0xff) - sdev->offset;
 }
@@ -1049,7 +1050,8 @@ static int sony_nc_update_status_ng(struct backlight_device *bd)
                (struct sony_backlight_props *)bl_get_data(bd);
        value = bd->props.brightness + sdev->offset;
-        if (sony_call_snc_handle(sdev->handle, 0x0100 | (value << 16), &result))
+        if (sony_call_snc_handle(sdev->handle, sdev->cmd_base | (value << 0x10),
+                                &result))
                return -EIO;
        return value;
@@ -1172,6 +1174,11 @@ static int sony_nc_hotkeys_decode(u32 event, unsigned int handle)
 /*
 * ACPI callbacks
 */
+enum event_types {
+        HOTKEY = 1,
+        KILLSWITCH,
+        GFX_SWITCH
+};
 static void sony_nc_notify(struct acpi_device *device, u32 event)
 {
        u32 real_ev = event;
@@ -1196,7 +1203,7 @@ static void sony_nc_notify(struct acpi_device *device, u32 event)
                /* hotkey event */
                case 0x0100:
                case 0x0127:
-                        ev_type = 1;
+                        ev_type = HOTKEY;
                        real_ev = sony_nc_hotkeys_decode(event, handle);
                        if (real_ev > 0)
@@ -1216,7 +1223,7 @@ static void sony_nc_notify(struct acpi_device *device, u32 event)
                         * update the rfkill device status when the
                         * switch is moved.
                         */
-                        ev_type = 2;
+                        ev_type = KILLSWITCH;
                        sony_call_snc_handle(handle, 0x0100, &result);
                        real_ev = result & 0x03;
@@ -1226,6 +1233,24 @@ static void sony_nc_notify(struct acpi_device *device, u32 event)
                        break;
+                case 0x0128:
+                case 0x0146:
+                        /* Hybrid GFX switching */
+                        sony_call_snc_handle(handle, 0x0000, &result);
+                        dprintk("GFX switch event received (reason: %s)\n",
+                                        (result & 0x01) ?
+                                        "switch change" : "unknown");
+                        /* verify the switch state
+                         * 1: discrete GFX
+                         * 0: integrated GFX
+                         */
+                        sony_call_snc_handle(handle, 0x0100, &result);
+                        ev_type = GFX_SWITCH;
+                        real_ev = result & 0xff;
+                        break;
                default:
                        dprintk("Unknown event 0x%x for handle 0x%x\n",
                                        event, handle);
@@ -1238,7 +1263,7 @@ static void sony_nc_notify(struct acpi_device *device, u32 event)
        } else {
                /* old style event */
-                ev_type = 1;
+                ev_type = HOTKEY;
                sony_laptop_report_input_event(real_ev);
        }
@@ -1893,32 +1918,33 @@ static ssize_t sony_nc_battery_care_limit_store(struct device *dev,
         *  bits 4,5: store the limit into the EC
         *  bits 6,7: store the limit into the battery
         */
+        cmd = 0;
-        /*
+        if (value > 0) {
-         * handle 0x0115 should allow storing on battery too;
+                if (value <= 50)
-         * handle 0x0136 same as 0x0115 + health status;
+                        cmd = 0x20;
-         * handle 0x013f, same as 0x0136 but no storing on the battery
-         *
-         * Store only inside the EC for now, regardless the handle number
-         */
-        if (value == 0)
-                /* disable limits */
-                cmd = 0x0;
-        else if (value <= 50)
+                else if (value <= 80)
-                cmd = 0x21;
+                        cmd = 0x10;
-        else if (value <= 80)
+                else if (value <= 100)
-                cmd = 0x11;
+                        cmd = 0x30;
-        else if (value <= 100)
+                else
-                cmd = 0x31;
+                        return -EINVAL;
-        else
+                /*
-                return -EINVAL;
+                 * handle 0x0115 should allow storing on battery too;
+                 * handle 0x0136 same as 0x0115 + health status;
+                 * handle 0x013f, same as 0x0136 but no storing on the battery
+                 */
+                if (bcare_ctl->handle != 0x013f)
+                        cmd = cmd | (cmd << 2);
-        if (sony_call_snc_handle(bcare_ctl->handle, (cmd << 0x10) | 0x0100,
+                cmd = (cmd | 0x1) << 0x10;
-                                &result))
+        }
+        if (sony_call_snc_handle(bcare_ctl->handle, cmd | 0x0100, &result))
                return -EIO;
        return count;
@@ -2113,7 +2139,7 @@ static ssize_t sony_nc_thermal_mode_show(struct device *dev,
                struct device_attribute *attr, char *buffer)
 {
        ssize_t count = 0;
-        unsigned int mode = sony_nc_thermal_mode_get();
+        int mode = sony_nc_thermal_mode_get();
        if (mode < 0)
                return mode;
@@ -2472,6 +2498,7 @@ static void sony_nc_backlight_ng_read_limits(int handle,
 {
        u64 offset;
        int i;
+        int lvl_table_len = 0;
        u8 min = 0xff, max = 0x00;
        unsigned char buffer[32] = { 0 };
@@ -2480,8 +2507,6 @@ static void sony_nc_backlight_ng_read_limits(int handle,
        props->maxlvl = 0xff;
        offset = sony_find_snc_handle(handle);
-        if (offset < 0)
-                return;
        /* try to read the boundaries from ACPI tables, if we fail the above
         * defaults should be reasonable
@@ -2491,11 +2516,21 @@ static void sony_nc_backlight_ng_read_limits(int handle,
        if (i < 0)
                return;
+        switch (handle) {
+        case 0x012f:
+        case 0x0137:
+                lvl_table_len = 9;
+                break;
+        case 0x143:
+                lvl_table_len = 16;
+                break;
+        }
        /* the buffer lists brightness levels available, brightness levels are
         * from position 0 to 8 in the array, other values are used by ALS
         * control.
         */
-        for (i = 0; i < 9 && i < ARRAY_SIZE(buffer); i++) {
+        for (i = 0; i < lvl_table_len && i < ARRAY_SIZE(buffer); i++) {
                dprintk("Brightness level: %d\n", buffer[i]);
@@ -2520,16 +2555,24 @@ static void sony_nc_backlight_setup(void)
        const struct backlight_ops *ops = NULL;
        struct backlight_properties props;
-        if (sony_find_snc_handle(0x12f) != -1) {
+        if (sony_find_snc_handle(0x12f) >= 0) {
                ops = &sony_backlight_ng_ops;
+                sony_bl_props.cmd_base = 0x0100;
                sony_nc_backlight_ng_read_limits(0x12f, &sony_bl_props);
                max_brightness = sony_bl_props.maxlvl - sony_bl_props.offset;
-        } else if (sony_find_snc_handle(0x137) != -1) {
+        } else if (sony_find_snc_handle(0x137) >= 0) {
                ops = &sony_backlight_ng_ops;
+                sony_bl_props.cmd_base = 0x0100;
                sony_nc_backlight_ng_read_limits(0x137, &sony_bl_props);
                max_brightness = sony_bl_props.maxlvl - sony_bl_props.offset;
+        } else if (sony_find_snc_handle(0x143) >= 0) {
+                ops = &sony_backlight_ng_ops;
+                sony_bl_props.cmd_base = 0x3000;
+                sony_nc_backlight_ng_read_limits(0x143, &sony_bl_props);
+                max_brightness = sony_bl_props.maxlvl - sony_bl_props.offset;
        } else if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle, "GBRT",
                                                &unused))) {
                ops = &sony_backlight_ops;
@@ -2597,6 +2640,12 @@ static int sony_nc_add(struct acpi_device *device)
                }
        }
+        result = sony_laptop_setup_input(device);
+        if (result) {
+                pr_err("Unable to create input devices\n");
+                goto outplatform;
+        }
        if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle, "ECON",
                                         &handle))) {
                int arg = 1;
@@ -2614,12 +2663,6 @@ static int sony_nc_add(struct acpi_device *device)
        }
        /* setup input devices and helper fifo */
-        result = sony_laptop_setup_input(device);
-        if (result) {
-                pr_err("Unable to create input devices\n");
-                goto outsnc;
-        }
        if (acpi_video_backlight_support()) {
                pr_info("brightness ignored, must be controlled by ACPI video driver\n");
        } else {
@@ -2667,22 +2710,21 @@ static int sony_nc_add(struct acpi_device *device)
        return 0;
-      out_sysfs:
+out_sysfs:
        for (item = sony_nc_values; item->name; ++item) {
                device_remove_file(&sony_pf_device->dev, &item->devattr);
        }
        sony_nc_backlight_cleanup();
-        sony_laptop_remove_input();
-      outsnc:
        sony_nc_function_cleanup(sony_pf_device);
        sony_nc_handles_cleanup(sony_pf_device);
-      outpresent:
+outplatform:
+        sony_laptop_remove_input();
+outpresent:
        sony_pf_remove();
-      outwalk:
+outwalk:
        sony_nc_rfkill_cleanup();
        return result;
 }
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 09a737c868b5..8b4b3829d9e7 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -2519,9 +2519,12 @@ int regulator_set_optimum_mode(struct regulator *regulator, int uA_load)
 {
        struct regulator_dev *rdev = regulator->rdev;
        struct regulator *consumer;
-        int ret, output_uV, input_uV, total_uA_load = 0;
+        int ret, output_uV, input_uV = 0, total_uA_load = 0;
        unsigned int mode;
+        if (rdev->supply)
+                input_uV = regulator_get_voltage(rdev->supply);
        mutex_lock(&rdev->mutex);
        /*
@@ -2554,10 +2557,7 @@ int regulator_set_optimum_mode(struct regulator *regulator, int uA_load)
                goto out;
        }
-        /* get input voltage */
+        /* No supply? Use constraint voltage */
-        input_uV = 0;
-        if (rdev->supply)
-                input_uV = regulator_get_voltage(rdev->supply);
        if (input_uV <= 0)
                input_uV = rdev->constraints->input_uV;
        if (input_uV <= 0) {
diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
index 24d880e78ec6..f8d818abf98c 100644
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -4,9 +4,11 @@ menu "Remoteproc drivers (EXPERIMENTAL)"
 config REMOTEPROC
        tristate
        depends on EXPERIMENTAL
+        select FW_CONFIG
 config OMAP_REMOTEPROC
        tristate "OMAP remoteproc support"
+        depends on EXPERIMENTAL
        depends on ARCH_OMAP4
        depends on OMAP_IOMMU
        select REMOTEPROC
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 75506ec2840e..f56c8ba3a861 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -188,6 +188,26 @@ static int rpmsg_uevent(struct device *dev, struct kobj_uevent_env *env)
                                        rpdev->id.name);
 }
+/**
+ * __ept_release() - deallocate an rpmsg endpoint
+ * @kref: the ept's reference count
+ *
+ * This function deallocates an ept, and is invoked when its @kref refcount
+ * drops to zero.
+ *
+ * Never invoke this function directly!
+ */
+static void __ept_release(struct kref *kref)
+{
+        struct rpmsg_endpoint *ept = container_of(kref, struct rpmsg_endpoint,
+                                                  refcount);
+        /*
+         * At this point no one holds a reference to ept anymore,
+         * so we can directly free it
+         */
+        kfree(ept);
+}
 /* for more info, see below documentation of rpmsg_create_ept() */
 static struct rpmsg_endpoint *__rpmsg_create_ept(struct virtproc_info *vrp,
                struct rpmsg_channel *rpdev, rpmsg_rx_cb_t cb,
@@ -206,6 +226,9 @@ static struct rpmsg_endpoint *__rpmsg_create_ept(struct virtproc_info *vrp,
                return NULL;
        }
+        kref_init(&ept->refcount);
+        mutex_init(&ept->cb_lock);
        ept->rpdev = rpdev;
        ept->cb = cb;
        ept->priv = priv;
@@ -238,7 +261,7 @@ rem_idr:
        idr_remove(&vrp->endpoints, request);
 free_ept:
        mutex_unlock(&vrp->endpoints_lock);
-        kfree(ept);
+        kref_put(&ept->refcount, __ept_release);
        return NULL;
 }
@@ -302,11 +325,17 @@ EXPORT_SYMBOL(rpmsg_create_ept);
 static void
 __rpmsg_destroy_ept(struct virtproc_info *vrp, struct rpmsg_endpoint *ept)
 {
+        /* make sure new inbound messages can't find this ept anymore */
        mutex_lock(&vrp->endpoints_lock);
        idr_remove(&vrp->endpoints, ept->addr);
        mutex_unlock(&vrp->endpoints_lock);
-        kfree(ept);
+        /* make sure in-flight inbound messages won't invoke cb anymore */
+        mutex_lock(&ept->cb_lock);
+        ept->cb = NULL;
+        mutex_unlock(&ept->cb_lock);
+        kref_put(&ept->refcount, __ept_release);
 }
 /**
@@ -790,12 +819,28 @@ static void rpmsg_recv_done(struct virtqueue *rvq)
        /* use the dst addr to fetch the callback of the appropriate user */
        mutex_lock(&vrp->endpoints_lock);
        ept = idr_find(&vrp->endpoints, msg->dst);
+        /* let's make sure no one deallocates ept while we use it */
+        if (ept)
+                kref_get(&ept->refcount);
        mutex_unlock(&vrp->endpoints_lock);
-        if (ept && ept->cb)
+        if (ept) {
-                ept->cb(ept->rpdev, msg->data, msg->len, ept->priv, msg->src);
+                /* make sure ept->cb doesn't go away while we use it */
-        else
+                mutex_lock(&ept->cb_lock);
+                if (ept->cb)
+                        ept->cb(ept->rpdev, msg->data, msg->len, ept->priv,
+                                msg->src);
+                mutex_unlock(&ept->cb_lock);
+                /* farewell, ept, we don't need you anymore */
+                kref_put(&ept->refcount, __ept_release);
+        } else
                dev_warn(dev, "msg received with no recepient\n");
        /* publish the real size of the buffer */
@@ -1040,7 +1085,7 @@ static int __init rpmsg_init(void)
        return ret;
 }
-module_init(rpmsg_init);
+subsys_initcall(rpmsg_init);
 static void __exit rpmsg_fini(void)
 {
diff --git a/drivers/rtc/rtc-ab8500.c b/drivers/rtc/rtc-ab8500.c
index 4bcf9ca2818a..370889d0489b 100644
--- a/drivers/rtc/rtc-ab8500.c
+++ b/drivers/rtc/rtc-ab8500.c
@@ -17,6 +17,7 @@
 #include <linux/mfd/abx500.h>
 #include <linux/mfd/abx500/ab8500.h>
 #include <linux/delay.h>
+#include <linux/of.h>
 #define AB8500_RTC_SOFF_STAT_REG        0x00
 #define AB8500_RTC_CC_CONF_REG          0x01
@@ -422,7 +423,7 @@ static int __devinit ab8500_rtc_probe(struct platform_device *pdev)
        }
        err = request_threaded_irq(irq, NULL, rtc_alarm_handler,
-                IRQF_NO_SUSPEND, "ab8500-rtc", rtc);
+                IRQF_NO_SUSPEND | IRQF_ONESHOT, "ab8500-rtc", rtc);
        if (err < 0) {
                rtc_device_unregister(rtc);
                return err;
@@ -430,7 +431,6 @@ static int __devinit ab8500_rtc_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, rtc);
        err = ab8500_sysfs_rtc_register(&pdev->dev);
        if (err) {
                dev_err(&pdev->dev, "sysfs RTC failed to register\n");
@@ -454,10 +454,16 @@ static int __devexit ab8500_rtc_remove(struct platform_device *pdev)
        return 0;
 }
+static const struct of_device_id ab8500_rtc_match[] = {
+        { .compatible = "stericsson,ab8500-rtc", },
+        {}
+};
 static struct platform_driver ab8500_rtc_driver = {
        .driver = {
                .name = "ab8500-rtc",
                .owner = THIS_MODULE,
+                .of_match_table = ab8500_rtc_match,
        },
        .probe  = ab8500_rtc_probe,
        .remove = __devexit_p(ab8500_rtc_remove),
diff --git a/drivers/rtc/rtc-mxc.c b/drivers/rtc/rtc-mxc.c
index 5e1d64ee5228..e3e50d69baf8 100644
--- a/drivers/rtc/rtc-mxc.c
+++ b/drivers/rtc/rtc-mxc.c
@@ -202,10 +202,11 @@ static irqreturn_t mxc_rtc_interrupt(int irq, void *dev_id)
        struct platform_device *pdev = dev_id;
        struct rtc_plat_data *pdata = platform_get_drvdata(pdev);
        void __iomem *ioaddr = pdata->ioaddr;
+        unsigned long flags;
        u32 status;
        u32 events = 0;
-        spin_lock_irq(&pdata->rtc->irq_lock);
+        spin_lock_irqsave(&pdata->rtc->irq_lock, flags);
        status = readw(ioaddr + RTC_RTCISR) & readw(ioaddr + RTC_RTCIENR);
        /* clear interrupt sources */
        writew(status, ioaddr + RTC_RTCISR);
@@ -224,7 +225,7 @@ static irqreturn_t mxc_rtc_interrupt(int irq, void *dev_id)
                events |= (RTC_PF | RTC_IRQF);
        rtc_update_irq(pdata->rtc, 1, events);
-        spin_unlock_irq(&pdata->rtc->irq_lock);
+        spin_unlock_irqrestore(&pdata->rtc->irq_lock, flags);
        return IRQ_HANDLED;
 }
diff --git a/drivers/rtc/rtc-spear.c b/drivers/rtc/rtc-spear.c
index 1f76320e545b..e2785479113c 100644
--- a/drivers/rtc/rtc-spear.c
+++ b/drivers/rtc/rtc-spear.c
@@ -458,12 +458,12 @@ static int __devexit spear_rtc_remove(struct platform_device *pdev)
        clk_disable(config->clk);
        clk_put(config->clk);
        iounmap(config->ioaddr);
-        kfree(config);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (res)
                release_mem_region(res->start, resource_size(res));
        platform_set_drvdata(pdev, NULL);
        rtc_device_unregister(config->rtc);
+        kfree(config);
        return 0;
 }
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index 258abeabf624..c5d06fe83bba 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -510,7 +510,7 @@ static int __devinit twl_rtc_probe(struct platform_device *pdev)
        }
        ret = request_threaded_irq(irq, NULL, twl_rtc_interrupt,
-                                   IRQF_TRIGGER_RISING,
+                                   IRQF_TRIGGER_RISING | IRQF_ONESHOT,
                                   dev_name(&rtc->dev), rtc);
        if (ret < 0) {
                dev_err(&pdev->dev, "IRQ is not free.\n");
diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c
index 532d212b6b2c..393e7ce8e95a 100644
--- a/drivers/scsi/aic94xx/aic94xx_task.c
+++ b/drivers/scsi/aic94xx/aic94xx_task.c
@@ -201,7 +201,7 @@ static void asd_get_response_tasklet(struct asd_ascb *ascb,
                if (SAS_STATUS_BUF_SIZE >= sizeof(*resp)) {
                        resp->frame_len = le16_to_cpu(*(__le16 *)(r+6));
-                        memcpy(&resp->ending_fis[0], r+16, 24);
+                        memcpy(&resp->ending_fis[0], r+16, ATA_RESP_FIS_SIZE);
                        ts->buf_valid_size = sizeof(*resp);
                }
        }
diff --git a/drivers/scsi/bnx2i/bnx2i.h b/drivers/scsi/bnx2i/bnx2i.h
index 0c53c28dc3d3..7e77cf620291 100644
--- a/drivers/scsi/bnx2i/bnx2i.h
+++ b/drivers/scsi/bnx2i/bnx2i.h
@@ -350,6 +350,7 @@ struct bnx2i_hba {
        struct pci_dev *pcidev;
        struct net_device *netdev;
        void __iomem *regview;
+        resource_size_t reg_base;
        u32 age;
        unsigned long cnic_dev_type;
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index ece47e502282..86a12b48e477 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -2724,7 +2724,6 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep)
                goto arm_cq;
        }
-        reg_base = ep->hba->netdev->base_addr;
        if ((test_bit(BNX2I_NX2_DEV_5709, &ep->hba->cnic_dev_type)) &&
            (ep->hba->mail_queue_access == BNX2I_MQ_BIN_MODE)) {
                config2 = REG_RD(ep->hba, BNX2_MQ_CONFIG2);
@@ -2740,7 +2739,7 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep)
                /* 5709 device in normal node and 5706/5708 devices */
                reg_off = CTX_OFFSET + (MB_KERNEL_CTX_SIZE * cid_num);
-        ep->qp.ctx_base = ioremap_nocache(reg_base + reg_off,
+        ep->qp.ctx_base = ioremap_nocache(ep->hba->reg_base + reg_off,
                                          MB_KERNEL_CTX_SIZE);
        if (!ep->qp.ctx_base)
                return -ENOMEM;
diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c
index f8d516b53161..621538b8b544 100644
--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
+++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
@@ -811,13 +811,13 @@ struct bnx2i_hba *bnx2i_alloc_hba(struct cnic_dev *cnic)
        bnx2i_identify_device(hba);
        bnx2i_setup_host_queue_size(hba, shost);
+        hba->reg_base = pci_resource_start(hba->pcidev, 0);
        if (test_bit(BNX2I_NX2_DEV_5709, &hba->cnic_dev_type)) {
-                hba->regview = ioremap_nocache(hba->netdev->base_addr,
+                hba->regview = pci_iomap(hba->pcidev, 0, BNX2_MQ_CONFIG2);
-                                               BNX2_MQ_CONFIG2);
                if (!hba->regview)
                        goto ioreg_map_err;
        } else if (test_bit(BNX2I_NX2_DEV_57710, &hba->cnic_dev_type)) {
-                hba->regview = ioremap_nocache(hba->netdev->base_addr, 4096);
+                hba->regview = pci_iomap(hba->pcidev, 0, 4096);
                if (!hba->regview)
                        goto ioreg_map_err;
        }
@@ -884,7 +884,7 @@ cid_que_err:
        bnx2i_free_mp_bdt(hba);
 mp_bdt_mem_err:
        if (hba->regview) {
-                iounmap(hba->regview);
+                pci_iounmap(hba->pcidev, hba->regview);
                hba->regview = NULL;
        }
 ioreg_map_err:
@@ -910,7 +910,7 @@ void bnx2i_free_hba(struct bnx2i_hba *hba)
        pci_dev_put(hba->pcidev);
        if (hba->regview) {
-                iounmap(hba->regview);
+                pci_iounmap(hba->pcidev, hba->regview);
                hba->regview = NULL;
        }
        bnx2i_free_mp_bdt(hba);
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index 441d88ad99a7..d109cc3a17b6 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -139,12 +139,12 @@ static void sas_ata_task_done(struct sas_task *task)
        if (stat->stat == SAS_PROTO_RESPONSE || stat->stat == SAM_STAT_GOOD ||
            ((stat->stat == SAM_STAT_CHECK_CONDITION &&
              dev->sata_dev.command_set == ATAPI_COMMAND_SET))) {
-                ata_tf_from_fis(resp->ending_fis, &dev->sata_dev.tf);
+                memcpy(dev->sata_dev.fis, resp->ending_fis, ATA_RESP_FIS_SIZE);
                if (!link->sactive) {
-                        qc->err_mask |= ac_err_mask(dev->sata_dev.tf.command);
+                        qc->err_mask |= ac_err_mask(dev->sata_dev.fis[2]);
                } else {
-                        link->eh_info.err_mask |= ac_err_mask(dev->sata_dev.tf.command);
+                        link->eh_info.err_mask |= ac_err_mask(dev->sata_dev.fis[2]);
                        if (unlikely(link->eh_info.err_mask))
                                qc->flags |= ATA_QCFLAG_FAILED;
                }
@@ -161,8 +161,8 @@ static void sas_ata_task_done(struct sas_task *task)
                                qc->flags |= ATA_QCFLAG_FAILED;
                        }
-                        dev->sata_dev.tf.feature = 0x04; /* status err */
+                        dev->sata_dev.fis[3] = 0x04; /* status err */
-                        dev->sata_dev.tf.command = ATA_ERR;
+                        dev->sata_dev.fis[2] = ATA_ERR;
                }
        }
@@ -269,7 +269,7 @@ static bool sas_ata_qc_fill_rtf(struct ata_queued_cmd *qc)
 {
        struct domain_device *dev = qc->ap->private_data;
-        memcpy(&qc->result_tf, &dev->sata_dev.tf, sizeof(qc->result_tf));
+        ata_tf_from_fis(dev->sata_dev.fis, &qc->result_tf);
        return true;
 }
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 6986552b47e6..77759c78cc21 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3960,7 +3960,7 @@ void qlt_async_event(uint16_t code, struct scsi_qla_host *vha,
 {
        struct qla_hw_data *ha = vha->hw;
        struct qla_tgt *tgt = ha->tgt.qla_tgt;
-        int reason_code;
+        int login_code;
        ql_dbg(ql_dbg_tgt, vha, 0xe039,
            "scsi(%ld): ha state %d init_done %d oper_mode %d topo %d\n",
@@ -4003,9 +4003,9 @@ void qlt_async_event(uint16_t code, struct scsi_qla_host *vha,
        {
                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf03b,
                    "qla_target(%d): Async LOOP_UP occured "
-                    "(m[1]=%x, m[2]=%x, m[3]=%x, m[4]=%x)", vha->vp_idx,
+                    "(m[0]=%x, m[1]=%x, m[2]=%x, m[3]=%x)", vha->vp_idx,
-                    le16_to_cpu(mailbox[1]), le16_to_cpu(mailbox[2]),
+                    le16_to_cpu(mailbox[0]), le16_to_cpu(mailbox[1]),
-                    le16_to_cpu(mailbox[3]), le16_to_cpu(mailbox[4]));
+                    le16_to_cpu(mailbox[2]), le16_to_cpu(mailbox[3]));
                if (tgt->link_reinit_iocb_pending) {
                        qlt_send_notify_ack(vha, (void *)&tgt->link_reinit_iocb,
                            0, 0, 0, 0, 0, 0);
@@ -4020,23 +4020,24 @@ void qlt_async_event(uint16_t code, struct scsi_qla_host *vha,
        case MBA_RSCN_UPDATE:
                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf03c,
                    "qla_target(%d): Async event %#x occured "
-                    "(m[1]=%x, m[2]=%x, m[3]=%x, m[4]=%x)", vha->vp_idx, code,
+                    "(m[0]=%x, m[1]=%x, m[2]=%x, m[3]=%x)", vha->vp_idx, code,
-                    le16_to_cpu(mailbox[1]), le16_to_cpu(mailbox[2]),
+                    le16_to_cpu(mailbox[0]), le16_to_cpu(mailbox[1]),
-                    le16_to_cpu(mailbox[3]), le16_to_cpu(mailbox[4]));
+                    le16_to_cpu(mailbox[2]), le16_to_cpu(mailbox[3]));
                break;
        case MBA_PORT_UPDATE:
                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf03d,
                    "qla_target(%d): Port update async event %#x "
-                    "occured: updating the ports database (m[1]=%x, m[2]=%x, "
+                    "occured: updating the ports database (m[0]=%x, m[1]=%x, "
-                    "m[3]=%x, m[4]=%x)", vha->vp_idx, code,
+                    "m[2]=%x, m[3]=%x)", vha->vp_idx, code,
-                    le16_to_cpu(mailbox[1]), le16_to_cpu(mailbox[2]),
+                    le16_to_cpu(mailbox[0]), le16_to_cpu(mailbox[1]),
-                    le16_to_cpu(mailbox[3]), le16_to_cpu(mailbox[4]));
+                    le16_to_cpu(mailbox[2]), le16_to_cpu(mailbox[3]));
-                reason_code = le16_to_cpu(mailbox[2]);
-                if (reason_code == 0x4)
+                login_code = le16_to_cpu(mailbox[2]);
+                if (login_code == 0x4)
                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf03e,
                            "Async MB 2: Got PLOGI Complete\n");
-                else if (reason_code == 0x7)
+                else if (login_code == 0x7)
                        ql_dbg(ql_dbg_tgt_mgt, vha, 0xf03f,
                            "Async MB 2: Port Logged Out\n");
                break;
@@ -4044,9 +4045,9 @@ void qlt_async_event(uint16_t code, struct scsi_qla_host *vha,
        default:
                ql_dbg(ql_dbg_tgt_mgt, vha, 0xf040,
                    "qla_target(%d): Async event %#x occured: "
-                    "ignore (m[1]=%x, m[2]=%x, m[3]=%x, m[4]=%x)", vha->vp_idx,
+                    "ignore (m[0]=%x, m[1]=%x, m[2]=%x, m[3]=%x)", vha->vp_idx,
-                    code, le16_to_cpu(mailbox[1]), le16_to_cpu(mailbox[2]),
+                    code, le16_to_cpu(mailbox[0]), le16_to_cpu(mailbox[1]),
-                    le16_to_cpu(mailbox[3]), le16_to_cpu(mailbox[4]));
+                    le16_to_cpu(mailbox[2]), le16_to_cpu(mailbox[3]));
                break;
        }
diff --git a/drivers/scsi/scsi_wait_scan.c b/drivers/scsi/scsi_wait_scan.c
index ae7814874618..072734538876 100644
--- a/drivers/scsi/scsi_wait_scan.c
+++ b/drivers/scsi/scsi_wait_scan.c
@@ -22,11 +22,6 @@ static int __init wait_scan_init(void)
         * and might not yet have reached the scsi async scanning
         */
        wait_for_device_probe();
-        /*
-         * and then we wait for the actual asynchronous scsi scan
-         * to finish.
-         */
-        scsi_complete_async_scans();
        return 0;
 }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 6f0a4c612b3b..6f72b80121a0 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1899,6 +1899,8 @@ static int sd_try_rc16_first(struct scsi_device *sdp)
 {
        if (sdp->host->max_cmd_len < 16)
                return 0;
+        if (sdp->try_rc_10_first)
+                return 0;
        if (sdp->scsi_level > SCSI_SPC_2)
                return 1;
        if (scsi_device_protection(sdp))
diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
index 9888693a18fe..664f6e775d0e 100644
--- a/drivers/target/target_core_cdb.c
+++ b/drivers/target/target_core_cdb.c
@@ -1095,7 +1095,7 @@ int target_emulate_write_same(struct se_cmd *cmd)
        if (num_blocks != 0)
                range = num_blocks;
        else
-                range = (dev->transport->get_blocks(dev) - lba);
+                range = (dev->transport->get_blocks(dev) - lba) + 1;
        pr_debug("WRITE_SAME UNMAP: LBA: %llu Range: %llu\n",
                 (unsigned long long)lba, (unsigned long long)range);
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 85564998500a..a1bcd927a9e6 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -2031,7 +2031,7 @@ static int __core_scsi3_write_aptpl_to_file(
        if (IS_ERR(file) || !file || !file->f_dentry) {
                pr_err("filp_open(%s) for APTPL metadata"
                        " failed\n", path);
-                return (PTR_ERR(file) < 0 ? PTR_ERR(file) : -ENOENT);
+                return IS_ERR(file) ? PTR_ERR(file) : -ENOENT;
        }
        iov[0].iov_base = &buf[0];
@@ -3818,7 +3818,7 @@ int target_scsi3_emulate_pr_out(struct se_cmd *cmd)
                        " SPC-2 reservation is held, returning"
                        " RESERVATION_CONFLICT\n");
                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
-                ret = EINVAL;
+                ret = -EINVAL;
                goto out;
        }
@@ -3828,7 +3828,8 @@ int target_scsi3_emulate_pr_out(struct se_cmd *cmd)
         */
        if (!cmd->se_sess) {
                cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
        }
        if (cmd->data_length < 24) {
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index f03fb9730f5b..5b65f33939a8 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -230,6 +230,8 @@ u32 ft_get_task_tag(struct se_cmd *se_cmd)
 {
        struct ft_cmd *cmd = container_of(se_cmd, struct ft_cmd, se_cmd);
+        if (cmd->aborted)
+                return ~0;
        return fc_seq_exch(cmd->seq)->rxid;
 }
diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
index cb99da920068..87901fa74dd7 100644
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -58,7 +58,8 @@ static struct ft_tport *ft_tport_create(struct fc_lport *lport)
        struct ft_tport *tport;
        int i;
-        tport = rcu_dereference(lport->prov[FC_TYPE_FCP]);
+        tport = rcu_dereference_protected(lport->prov[FC_TYPE_FCP],
+                                          lockdep_is_held(&ft_lport_lock));
        if (tport && tport->tpg)
                return tport;
diff --git a/drivers/tty/hvc/hvc_opal.c b/drivers/tty/hvc/hvc_opal.c
index ced26c8ccd57..0d2ea0c224c3 100644
--- a/drivers/tty/hvc/hvc_opal.c
+++ b/drivers/tty/hvc/hvc_opal.c
@@ -401,7 +401,7 @@ out:
 }
 #ifdef CONFIG_PPC_EARLY_DEBUG_OPAL_RAW
-void __init udbg_init_debug_opal(void)
+void __init udbg_init_debug_opal_raw(void)
 {
        u32 index = CONFIG_PPC_EARLY_DEBUG_OPAL_VTERMNO;
        hvc_opal_privs[index] = &hvc_opal_boot_priv;
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index c691eea51537..f5ed3d75fa5a 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -46,7 +46,7 @@ obj-$(CONFIG_USB_MICROTEK)	+= image/
 obj-$(CONFIG_USB_SERIAL)        += serial/
 obj-$(CONFIG_USB)               += misc/
-obj-$(CONFIG_USB)               += phy/
+obj-$(CONFIG_USB_COMMON)        += phy/
 obj-$(CONFIG_EARLY_PRINTK_DBGP) += early/
 obj-$(CONFIG_USB_ATM)           += atm/
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 8fd398dffced..ee469274a3fe 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -500,6 +500,8 @@ retry:
                        goto retry;
                }
                if (!desc->reslength) { /* zero length read */
+                        dev_dbg(&desc->intf->dev, "%s: zero length - clearing WDM_READ\n", __func__);
+                        clear_bit(WDM_READ, &desc->flags);
                        spin_unlock_irq(&desc->iuspin);
                        goto retry;
                }
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 25a7422ee657..8fb484984c86 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2324,12 +2324,16 @@ static unsigned hub_is_wusb(struct usb_hub *hub)
 static int hub_port_reset(struct usb_hub *hub, int port1,
                        struct usb_device *udev, unsigned int delay, bool warm);
-/* Is a USB 3.0 port in the Inactive state? */
+/* Is a USB 3.0 port in the Inactive or Complinance Mode state?
-static bool hub_port_inactive(struct usb_hub *hub, u16 portstatus)
+ * Port worm reset is required to recover
+ */
+static bool hub_port_warm_reset_required(struct usb_hub *hub, u16 portstatus)
 {
        return hub_is_superspeed(hub->hdev) &&
-                (portstatus & USB_PORT_STAT_LINK_STATE) ==
+                (((portstatus & USB_PORT_STAT_LINK_STATE) ==
-                USB_SS_PORT_LS_SS_INACTIVE;
+                  USB_SS_PORT_LS_SS_INACTIVE) ||
+                 ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+                  USB_SS_PORT_LS_COMP_MOD)) ;
 }
 static int hub_port_wait_reset(struct usb_hub *hub, int port1,
@@ -2365,7 +2369,7 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
                         *
                         * See https://bugzilla.kernel.org/show_bug.cgi?id=41752
                         */
-                        if (hub_port_inactive(hub, portstatus)) {
+                        if (hub_port_warm_reset_required(hub, portstatus)) {
                                int ret;
                                if ((portchange & USB_PORT_STAT_C_CONNECTION))
@@ -4408,9 +4412,7 @@ static void hub_events(void)
                        /* Warm reset a USB3 protocol port if it's in
                         * SS.Inactive state.
                         */
-                        if (hub_is_superspeed(hub->hdev) &&
+                        if (hub_port_warm_reset_required(hub, portstatus)) {
-                                (portstatus & USB_PORT_STAT_LINK_STATE)
-                                        == USB_SS_PORT_LS_SS_INACTIVE) {
                                dev_dbg(hub_dev, "warm reset port %d\n", i);
                                hub_port_reset(hub, i, NULL,
                                                HUB_BH_RESET_TIME, true);
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 3df1a1973b05..ec70df7aba17 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1091,7 +1091,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
                if (r == req) {
                        /* wait until it is processed */
                        dwc3_stop_active_transfer(dwc, dep->number);
-                        goto out0;
+                        goto out1;
                }
                dev_err(dwc->dev, "request %p was not queued to %s\n",
                                request, ep->name);
@@ -1099,6 +1099,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
                goto out0;
        }
+out1:
        /* giveback the request */
        dwc3_gadget_giveback(dep, req, -ECONNRESET);
diff --git a/drivers/usb/gadget/fsl_qe_udc.h b/drivers/usb/gadget/fsl_qe_udc.h
index 4c07ca9cebf3..7026919fc901 100644
--- a/drivers/usb/gadget/fsl_qe_udc.h
+++ b/drivers/usb/gadget/fsl_qe_udc.h
@@ -153,10 +153,10 @@ struct usb_ep_para{
 #define USB_BUSMODE_DTB         0x02
 /* Endpoint basic handle */
-#define ep_index(EP)            ((EP)->desc->bEndpointAddress & 0xF)
+#define ep_index(EP)            ((EP)->ep.desc->bEndpointAddress & 0xF)
 #define ep_maxpacket(EP)        ((EP)->ep.maxpacket)
 #define ep_is_in(EP)    ((ep_index(EP) == 0) ? (EP->udc->ep0_dir == \
-                        USB_DIR_IN) : ((EP)->desc->bEndpointAddress \
+                        USB_DIR_IN) : ((EP)->ep.desc->bEndpointAddress \
                        & USB_DIR_IN) == USB_DIR_IN)
 /* ep0 transfer state */
diff --git a/drivers/usb/gadget/lpc32xx_udc.c b/drivers/usb/gadget/lpc32xx_udc.c
index 262acfd53e32..2ab0388d93eb 100644
--- a/drivers/usb/gadget/lpc32xx_udc.c
+++ b/drivers/usb/gadget/lpc32xx_udc.c
@@ -61,6 +61,7 @@
 #include <mach/irqs.h>
 #include <mach/board.h>
 #ifdef CONFIG_USB_GADGET_DEBUG_FILES
+#include <linux/debugfs.h>
 #include <linux/seq_file.h>
 #endif
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index 17cfb8a1131c..c30435499a02 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -281,14 +281,13 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
                }
        }
+        /* Hold PHYs in reset while initializing EHCI controller */
        if (pdata->phy_reset) {
                if (gpio_is_valid(pdata->reset_gpio_port[0]))
-                        gpio_request_one(pdata->reset_gpio_port[0],
+                        gpio_set_value_cansleep(pdata->reset_gpio_port[0], 0);
-                                         GPIOF_OUT_INIT_LOW, "USB1 PHY reset");
                if (gpio_is_valid(pdata->reset_gpio_port[1]))
-                        gpio_request_one(pdata->reset_gpio_port[1],
+                        gpio_set_value_cansleep(pdata->reset_gpio_port[1], 0);
-                                         GPIOF_OUT_INIT_LOW, "USB2 PHY reset");
                /* Hold the PHY in RESET for enough time till DIR is high */
                udelay(10);
@@ -330,6 +329,11 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
        omap_ehci->hcs_params = readl(&omap_ehci->caps->hcs_params);
        ehci_reset(omap_ehci);
+        ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
+        if (ret) {
+                dev_err(dev, "failed to add hcd with err %d\n", ret);
+                goto err_add_hcd;
+        }
        if (pdata->phy_reset) {
                /* Hold the PHY in RESET for enough time till
@@ -344,12 +348,6 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
                        gpio_set_value_cansleep(pdata->reset_gpio_port[1], 1);
        }
-        ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
-        if (ret) {
-                dev_err(dev, "failed to add hcd with err %d\n", ret);
-                goto err_add_hcd;
-        }
        /* root ports should always stay powered */
        ehci_port_power(omap_ehci, 1);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 2732ef660c5c..7b01094d7993 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -462,6 +462,42 @@ void xhci_test_and_clear_bit(struct xhci_hcd *xhci, __le32 __iomem **port_array,
        }
 }
+/* Updates Link Status for super Speed port */
+static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
+{
+        u32 pls = status_reg & PORT_PLS_MASK;
+        /* resume state is a xHCI internal state.
+         * Do not report it to usb core.
+         */
+        if (pls == XDEV_RESUME)
+                return;
+        /* When the CAS bit is set then warm reset
+         * should be performed on port
+         */
+        if (status_reg & PORT_CAS) {
+                /* The CAS bit can be set while the port is
+                 * in any link state.
+                 * Only roothubs have CAS bit, so we
+                 * pretend to be in compliance mode
+                 * unless we're already in compliance
+                 * or the inactive state.
+                 */
+                if (pls != USB_SS_PORT_LS_COMP_MOD &&
+                    pls != USB_SS_PORT_LS_SS_INACTIVE) {
+                        pls = USB_SS_PORT_LS_COMP_MOD;
+                }
+                /* Return also connection bit -
+                 * hub state machine resets port
+                 * when this bit is set.
+                 */
+                pls |= USB_PORT_STAT_CONNECTION;
+        }
+        /* update status field */
+        *status |= pls;
+}
 int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                u16 wIndex, char *buf, u16 wLength)
 {
@@ -606,13 +642,9 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                        else
                                status |= USB_PORT_STAT_POWER;
                }
-                /* Port Link State */
+                /* Update Port Link State for super speed ports*/
                if (hcd->speed == HCD_USB3) {
-                        /* resume state is a xHCI internal state.
+                        xhci_hub_report_link_state(&status, temp);
-                         * Do not report it to usb core.
-                         */
-                        if ((temp & PORT_PLS_MASK) != XDEV_RESUME)
-                                status |= (temp & PORT_PLS_MASK);
                }
                if (bus_state->port_c_suspend & (1 << wIndex))
                        status |= 1 << USB_PORT_FEAT_C_SUSPEND;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 23b4aefd1036..8275645889da 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -885,6 +885,17 @@ static void update_ring_for_set_deq_completion(struct xhci_hcd *xhci,
        num_trbs_free_temp = ep_ring->num_trbs_free;
        dequeue_temp = ep_ring->dequeue;
+        /* If we get two back-to-back stalls, and the first stalled transfer
+         * ends just before a link TRB, the dequeue pointer will be left on
+         * the link TRB by the code in the while loop.  So we have to update
+         * the dequeue pointer one segment further, or we'll jump off
+         * the segment into la-la-land.
+         */
+        if (last_trb(xhci, ep_ring, ep_ring->deq_seg, ep_ring->dequeue)) {
+                ep_ring->deq_seg = ep_ring->deq_seg->next;
+                ep_ring->dequeue = ep_ring->deq_seg->trbs;
+        }
        while (ep_ring->dequeue != dev->eps[ep_index].queued_deq_ptr) {
                /* We have more usable TRBs */
                ep_ring->num_trbs_free++;
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index de3d6e3e57be..55c0785810c9 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -341,7 +341,11 @@ struct xhci_op_regs {
 #define PORT_PLC        (1 << 22)
 /* port configure error change - port failed to configure its link partner */
 #define PORT_CEC        (1 << 23)
-/* bit 24 reserved */
+/* Cold Attach Status - xHC can set this bit to report device attached during
+ * Sx state. Warm port reset should be perfomed to clear this bit and move port
+ * to connected state.
+ */
+#define PORT_CAS        (1 << 24)
 /* wake on connect (enable) */
 #define PORT_WKCONN_E   (1 << 25)
 /* wake on disconnect (enable) */
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index ef8d744800ac..e090c799d87b 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -375,11 +375,21 @@ static void musb_advance_schedule(struct musb *musb, struct urb *urb,
         */
        if (list_empty(&qh->hep->urb_list)) {
                struct list_head        *head;
+                struct dma_controller   *dma = musb->dma_controller;
-                if (is_in)
+                if (is_in) {
                        ep->rx_reinit = 1;
-                else
+                        if (ep->rx_channel) {
+                                dma->channel_release(ep->rx_channel);
+                                ep->rx_channel = NULL;
+                        }
+                } else {
                        ep->tx_reinit = 1;
+                        if (ep->tx_channel) {
+                                dma->channel_release(ep->tx_channel);
+                                ep->tx_channel = NULL;
+                        }
+                }
                /* Clobber old pointers to this qh */
                musb_ep_set_qh(ep, is_in, NULL);
diff --git a/drivers/usb/otg/twl6030-usb.c b/drivers/usb/otg/twl6030-usb.c
index d2a9a8e691b9..0eabb049b6a9 100644
--- a/drivers/usb/otg/twl6030-usb.c
+++ b/drivers/usb/otg/twl6030-usb.c
@@ -305,9 +305,8 @@ static irqreturn_t twl6030_usbotg_irq(int irq, void *_twl)
                regulator_enable(twl->usb3v3);
                twl->asleep = 1;
-                twl6030_writeb(twl, TWL_MODULE_USB, USB_ID_INT_EN_HI_CLR, 0x1);
+                twl6030_writeb(twl, TWL_MODULE_USB, 0x1, USB_ID_INT_EN_HI_CLR);
-                twl6030_writeb(twl, TWL_MODULE_USB, USB_ID_INT_EN_HI_SET,
+                twl6030_writeb(twl, TWL_MODULE_USB, 0x10, USB_ID_INT_EN_HI_SET);
-                                                                0x10);
                status = USB_EVENT_ID;
                otg->default_a = true;
                twl->phy.state = OTG_STATE_A_IDLE;
@@ -316,12 +315,10 @@ static irqreturn_t twl6030_usbotg_irq(int irq, void *_twl)
                atomic_notifier_call_chain(&twl->phy.notifier, status,
                                                        otg->gadget);
        } else  {
-                twl6030_writeb(twl, TWL_MODULE_USB, USB_ID_INT_EN_HI_CLR,
+                twl6030_writeb(twl, TWL_MODULE_USB, 0x10, USB_ID_INT_EN_HI_CLR);
-                                                                0x10);
+                twl6030_writeb(twl, TWL_MODULE_USB, 0x1, USB_ID_INT_EN_HI_SET);
-                twl6030_writeb(twl, TWL_MODULE_USB, USB_ID_INT_EN_HI_SET,
-                                                                0x1);
        }
-        twl6030_writeb(twl, TWL_MODULE_USB, USB_ID_INT_LATCH_CLR, status);
+        twl6030_writeb(twl, TWL_MODULE_USB, status, USB_ID_INT_LATCH_CLR);
        return IRQ_HANDLED;
 }
@@ -343,7 +340,7 @@ static int twl6030_enable_irq(struct usb_phy *x)
 {
        struct twl6030_usb *twl = phy_to_twl(x);
-        twl6030_writeb(twl, TWL_MODULE_USB, USB_ID_INT_EN_HI_SET, 0x1);
+        twl6030_writeb(twl, TWL_MODULE_USB, 0x1, USB_ID_INT_EN_HI_SET);
        twl6030_interrupt_unmask(0x05, REG_INT_MSK_LINE_C);
        twl6030_interrupt_unmask(0x05, REG_INT_MSK_STS_C);
diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
index 3cfabcba7447..e7cf84f0751a 100644
--- a/drivers/usb/phy/Kconfig
+++ b/drivers/usb/phy/Kconfig
@@ -2,11 +2,11 @@
 # Physical Layer USB driver configuration
 #
 comment "USB Physical Layer drivers"
-        depends on USB
+        depends on USB || USB_GADGET
 config USB_ISP1301
        tristate "NXP ISP1301 USB transceiver support"
-        depends on USB
+        depends on USB || USB_GADGET
        depends on I2C
        help
          Say Y here to add support for the NXP ISP1301 USB transceiver driver.
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 73d25cd8cba5..1e71079ce33b 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -93,6 +93,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
        { USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */
        { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */
+        { USB_DEVICE(0x10C4, 0x815F) }, /* Timewave HamLinkUSB */
        { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */
        { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */
        { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
@@ -134,7 +135,13 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10CE, 0xEA6A) }, /* Silicon Labs MobiData GPRS USB Modem 100EU */
        { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */
        { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */
+        { USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */
+        { USB_DEVICE(0x166A, 0x0301) }, /* Clipsal 5800PC C-Bus Wireless PC Interface */
        { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */
+        { USB_DEVICE(0x166A, 0x0304) }, /* Clipsal 5000CT2 C-Bus Black and White Touchscreen */
+        { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */
+        { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */
+        { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */
        { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
        { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */
        { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
@@ -146,7 +153,11 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
        { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
        { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
+        { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
+        { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */
        { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
+        { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
+        { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
        { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
        { } /* Terminating Entry */
 };
diff --git a/drivers/usb/serial/metro-usb.c b/drivers/usb/serial/metro-usb.c
index 81423f7361db..d47eb06fe463 100644
--- a/drivers/usb/serial/metro-usb.c
+++ b/drivers/usb/serial/metro-usb.c
@@ -222,14 +222,6 @@ static int metrousb_open(struct tty_struct *tty, struct usb_serial_port *port)
        metro_priv->throttled = 0;
        spin_unlock_irqrestore(&metro_priv->lock, flags);
-        /*
-         * Force low_latency on so that our tty_push actually forces the data
-         * through, otherwise it is scheduled, and with high data rates (like
-         * with OHCI) data can get lost.
-         */
-        if (tty)
-                tty->low_latency = 1;
        /* Clear the urb pipe. */
        usb_clear_halt(serial->dev, port->interrupt_in_urb->pipe);
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index e668a2460bd4..417ab1b0aa30 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -236,6 +236,7 @@ static void option_instat_callback(struct urb *urb);
 #define NOVATELWIRELESS_PRODUCT_G1              0xA001
 #define NOVATELWIRELESS_PRODUCT_G1_M            0xA002
 #define NOVATELWIRELESS_PRODUCT_G2              0xA010
+#define NOVATELWIRELESS_PRODUCT_MC551           0xB001
 /* AMOI PRODUCTS */
 #define AMOI_VENDOR_ID                          0x1614
@@ -496,6 +497,19 @@ static void option_instat_callback(struct urb *urb);
 /* MediaTek products */
 #define MEDIATEK_VENDOR_ID                      0x0e8d
+#define MEDIATEK_PRODUCT_DC_1COM                0x00a0
+#define MEDIATEK_PRODUCT_DC_4COM                0x00a5
+#define MEDIATEK_PRODUCT_DC_5COM                0x00a4
+#define MEDIATEK_PRODUCT_7208_1COM              0x7101
+#define MEDIATEK_PRODUCT_7208_2COM              0x7102
+#define MEDIATEK_PRODUCT_FP_1COM                0x0003
+#define MEDIATEK_PRODUCT_FP_2COM                0x0023
+#define MEDIATEK_PRODUCT_FPDC_1COM              0x0043
+#define MEDIATEK_PRODUCT_FPDC_2COM              0x0033
+/* Cellient products */
+#define CELLIENT_VENDOR_ID                      0x2692
+#define CELLIENT_PRODUCT_MEN200                 0x9005
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
@@ -549,6 +563,10 @@ static const struct option_blacklist_info net_intf1_blacklist = {
        .reserved = BIT(1),
 };
+static const struct option_blacklist_info net_intf2_blacklist = {
+        .reserved = BIT(2),
+};
 static const struct option_blacklist_info net_intf3_blacklist = {
        .reserved = BIT(3),
 };
@@ -734,6 +752,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1) },
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G1_M) },
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) },
+        /* Novatel Ovation MC551 a.k.a. Verizon USB551L */
+        { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
        { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
        { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
@@ -1092,6 +1112,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff),
+                .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
          0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
@@ -1233,6 +1255,18 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a1, 0xff, 0x02, 0x01) },
        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a2, 0xff, 0x00, 0x00) },
        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x00a2, 0xff, 0x02, 0x01) },        /* MediaTek MT6276M modem & app port */
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_1COM, 0x0a, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_5COM, 0xff, 0x02, 0x01) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_5COM, 0xff, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM, 0xff, 0x02, 0x01) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM, 0xff, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7208_1COM, 0x02, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7208_2COM, 0x02, 0x02, 0x01) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FP_1COM, 0x0a, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FP_2COM, 0x0a, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FPDC_1COM, 0x0a, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FPDC_2COM, 0x0a, 0x00, 0x00) },
+        { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
        { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index a324a5d21e99..11418da9bc09 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -202,6 +202,12 @@ static int slave_configure(struct scsi_device *sdev)
                if (us->fflags & US_FL_NO_READ_CAPACITY_16)
                        sdev->no_read_capacity_16 = 1;
+                /*
+                 * Many devices do not respond properly to READ_CAPACITY_16.
+                 * Tell the SCSI layer to try READ_CAPACITY_10 first.
+                 */
+                sdev->try_rc_10_first = 1;
                /* assume SPC3 or latter devices support sense size > 18 */
                if (sdev->scsi_level > SCSI_SPC_2)
                        us->fflags |= US_FL_SANE_SENSE;
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index caf22bf5f822..1719886bb9be 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1107,13 +1107,6 @@ UNUSUAL_DEV( 0x090a, 0x1200, 0x0000, 0x9999,
                USB_SC_RBC, USB_PR_BULK, NULL,
                0 ),
-/* Feiya QDI U2 DISK, reported by Hans de Goede <hdegoede@redhat.com> */
-UNUSUAL_DEV( 0x090c, 0x1000, 0x0000, 0xffff,
-                "Feiya",
-                "QDI U2 DISK",
-                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-                US_FL_NO_READ_CAPACITY_16 ),
 /* aeb */
 UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
                "Feiya",
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 94dbd25caa30..112156f68afb 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -191,7 +191,9 @@ static int vhost_worker(void *data)
        struct vhost_dev *dev = data;
        struct vhost_work *work = NULL;
        unsigned uninitialized_var(seq);
+        mm_segment_t oldfs = get_fs();
+        set_fs(USER_DS);
        use_mm(dev->mm);
        for (;;) {
@@ -229,6 +231,7 @@ static int vhost_worker(void *data)
        }
        unuse_mm(dev->mm);
+        set_fs(oldfs);
        return 0;
 }
diff --git a/drivers/video/omap2/dss/core.c b/drivers/video/omap2/dss/core.c
index 5066eee10ccf..58bd9c27369d 100644
--- a/drivers/video/omap2/dss/core.c
+++ b/drivers/video/omap2/dss/core.c
@@ -32,6 +32,7 @@
 #include <linux/io.h>
 #include <linux/device.h>
 #include <linux/regulator/consumer.h>
+#include <linux/suspend.h>
 #include <video/omapdss.h>
@@ -201,6 +202,28 @@ int dss_debugfs_create_file(const char *name, void (*write)(struct seq_file *))
 #endif /* CONFIG_DEBUG_FS && CONFIG_OMAP2_DSS_DEBUG_SUPPORT */
 /* PLATFORM DEVICE */
+static int omap_dss_pm_notif(struct notifier_block *b, unsigned long v, void *d)
+{
+        DSSDBG("pm notif %lu\n", v);
+        switch (v) {
+        case PM_SUSPEND_PREPARE:
+                DSSDBG("suspending displays\n");
+                return dss_suspend_all_devices();
+        case PM_POST_SUSPEND:
+                DSSDBG("resuming displays\n");
+                return dss_resume_all_devices();
+        default:
+                return 0;
+        }
+}
+static struct notifier_block omap_dss_pm_notif_block = {
+        .notifier_call = omap_dss_pm_notif,
+};
 static int __init omap_dss_probe(struct platform_device *pdev)
 {
        struct omap_dss_board_info *pdata = pdev->dev.platform_data;
@@ -224,6 +247,8 @@ static int __init omap_dss_probe(struct platform_device *pdev)
        else if (pdata->default_device)
                core.default_display_name = pdata->default_device->name;
+        register_pm_notifier(&omap_dss_pm_notif_block);
        return 0;
 err_debugfs:
@@ -233,6 +258,8 @@ err_debugfs:
 static int omap_dss_remove(struct platform_device *pdev)
 {
+        unregister_pm_notifier(&omap_dss_pm_notif_block);
        dss_uninitialize_debugfs();
        dss_uninit_overlays(pdev);
@@ -247,25 +274,9 @@ static void omap_dss_shutdown(struct platform_device *pdev)
        dss_disable_all_devices();
 }
-static int omap_dss_suspend(struct platform_device *pdev, pm_message_t state)
-{
-        DSSDBG("suspend %d\n", state.event);
-        return dss_suspend_all_devices();
-}
-static int omap_dss_resume(struct platform_device *pdev)
-{
-        DSSDBG("resume\n");
-        return dss_resume_all_devices();
-}
 static struct platform_driver omap_dss_driver = {
        .remove         = omap_dss_remove,
        .shutdown       = omap_dss_shutdown,
-        .suspend        = omap_dss_suspend,
-        .resume         = omap_dss_resume,
        .driver         = {
                .name   = "omapdss",
                .owner  = THIS_MODULE,
diff --git a/drivers/video/omap2/dss/dispc.c b/drivers/video/omap2/dss/dispc.c
index 4749ac356469..397d4eee11bb 100644
--- a/drivers/video/omap2/dss/dispc.c
+++ b/drivers/video/omap2/dss/dispc.c
@@ -384,7 +384,7 @@ void dispc_runtime_put(void)
        DSSDBG("dispc_runtime_put\n");
        r = pm_runtime_put_sync(&dispc.pdev->dev);
-        WARN_ON(r < 0);
+        WARN_ON(r < 0 && r != -ENOSYS);
 }
 static inline bool dispc_mgr_is_lcd(enum omap_channel channel)
diff --git a/drivers/video/omap2/dss/dsi.c b/drivers/video/omap2/dss/dsi.c
index ca8382d346e9..14ce8cc079e3 100644
--- a/drivers/video/omap2/dss/dsi.c
+++ b/drivers/video/omap2/dss/dsi.c
@@ -1075,7 +1075,7 @@ void dsi_runtime_put(struct platform_device *dsidev)
        DSSDBG("dsi_runtime_put\n");
        r = pm_runtime_put_sync(&dsi->pdev->dev);
-        WARN_ON(r < 0);
+        WARN_ON(r < 0 && r != -ENOSYS);
 }
 /* source clock for DSI PLL. this could also be PCLKFREE */
diff --git a/drivers/video/omap2/dss/dss.c b/drivers/video/omap2/dss/dss.c
index 770632359a17..d2b57197b292 100644
--- a/drivers/video/omap2/dss/dss.c
+++ b/drivers/video/omap2/dss/dss.c
@@ -731,7 +731,7 @@ static void dss_runtime_put(void)
        DSSDBG("dss_runtime_put\n");
        r = pm_runtime_put_sync(&dss.pdev->dev);
-        WARN_ON(r < 0 && r != -EBUSY);
+        WARN_ON(r < 0 && r != -ENOSYS && r != -EBUSY);
 }
 /* DEBUGFS */
diff --git a/drivers/video/omap2/dss/hdmi.c b/drivers/video/omap2/dss/hdmi.c
index 8195c7166d20..26a2430a7028 100644
--- a/drivers/video/omap2/dss/hdmi.c
+++ b/drivers/video/omap2/dss/hdmi.c
@@ -138,7 +138,7 @@ static void hdmi_runtime_put(void)
        DSSDBG("hdmi_runtime_put\n");
        r = pm_runtime_put_sync(&hdmi.pdev->dev);
-        WARN_ON(r < 0);
+        WARN_ON(r < 0 && r != -ENOSYS);
 }
 static int __init hdmi_init_display(struct omap_dss_device *dssdev)
diff --git a/drivers/video/omap2/dss/rfbi.c b/drivers/video/omap2/dss/rfbi.c
index 3d8c206e90e5..7985fa12b9b4 100644
--- a/drivers/video/omap2/dss/rfbi.c
+++ b/drivers/video/omap2/dss/rfbi.c
@@ -141,7 +141,7 @@ static void rfbi_runtime_put(void)
        DSSDBG("rfbi_runtime_put\n");
        r = pm_runtime_put_sync(&rfbi.pdev->dev);
-        WARN_ON(r < 0);
+        WARN_ON(r < 0 && r != -ENOSYS);
 }
 void rfbi_bus_lock(void)
diff --git a/drivers/video/omap2/dss/venc.c b/drivers/video/omap2/dss/venc.c
index 2b8973931ff4..3907c8b6ecbc 100644
--- a/drivers/video/omap2/dss/venc.c
+++ b/drivers/video/omap2/dss/venc.c
@@ -402,7 +402,7 @@ static void venc_runtime_put(void)
        DSSDBG("venc_runtime_put\n");
        r = pm_runtime_put_sync(&venc.pdev->dev);
-        WARN_ON(r < 0);
+        WARN_ON(r < 0 && r != -ENOSYS);
 }
 static const struct venc_config *venc_timings_to_config(
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index bfbc15ca38dd..0908e6044333 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -47,7 +47,7 @@ struct virtio_balloon
        struct task_struct *thread;
        /* Waiting for host to ack the pages we released. */
-        struct completion acked;
+        wait_queue_head_t acked;
        /* Number of balloon pages we've told the Host we're not using. */
        unsigned int num_pages;
@@ -89,29 +89,25 @@ static struct page *balloon_pfn_to_page(u32 pfn)
 static void balloon_ack(struct virtqueue *vq)
 {
-        struct virtio_balloon *vb;
+        struct virtio_balloon *vb = vq->vdev->priv;
-        unsigned int len;
-        vb = virtqueue_get_buf(vq, &len);
+        wake_up(&vb->acked);
-        if (vb)
-                complete(&vb->acked);
 }
 static void tell_host(struct virtio_balloon *vb, struct virtqueue *vq)
 {
        struct scatterlist sg;
+        unsigned int len;
        sg_init_one(&sg, vb->pfns, sizeof(vb->pfns[0]) * vb->num_pfns);
-        init_completion(&vb->acked);
        /* We should always be able to add one buffer to an empty queue. */
        if (virtqueue_add_buf(vq, &sg, 1, 0, vb, GFP_KERNEL) < 0)
                BUG();
        virtqueue_kick(vq);
        /* When host has read buffer, this completes via balloon_ack */
-        wait_for_completion(&vb->acked);
+        wait_event(vb->acked, virtqueue_get_buf(vq, &len));
 }
 static void set_page_pfns(u32 pfns[], struct page *page)
@@ -231,12 +227,8 @@ static void update_balloon_stats(struct virtio_balloon *vb)
 */
 static void stats_request(struct virtqueue *vq)
 {
-        struct virtio_balloon *vb;
+        struct virtio_balloon *vb = vq->vdev->priv;
-        unsigned int len;
-        vb = virtqueue_get_buf(vq, &len);
-        if (!vb)
-                return;
        vb->need_stats_update = 1;
        wake_up(&vb->config_change);
 }
@@ -245,11 +237,14 @@ static void stats_handle_request(struct virtio_balloon *vb)
 {
        struct virtqueue *vq;
        struct scatterlist sg;
+        unsigned int len;
        vb->need_stats_update = 0;
        update_balloon_stats(vb);
        vq = vb->stats_vq;
+        if (!virtqueue_get_buf(vq, &len))
+                return;
        sg_init_one(&sg, vb->stats, sizeof(vb->stats));
        if (virtqueue_add_buf(vq, &sg, 1, 0, vb, GFP_KERNEL) < 0)
                BUG();
@@ -358,6 +353,7 @@ static int virtballoon_probe(struct virtio_device *vdev)
        INIT_LIST_HEAD(&vb->pages);
        vb->num_pages = 0;
        init_waitqueue_head(&vb->config_change);
+        init_waitqueue_head(&vb->acked);
        vb->vdev = vdev;
        vb->need_stats_update = 0;
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 2b763815aeec..1eff743ec497 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -146,7 +146,7 @@ struct cmn_registers {
 }  __attribute__((packed));
 static unsigned int hpwdt_nmi_decoding;
-static unsigned int allow_kdump;
+static unsigned int allow_kdump = 1;
 static unsigned int is_icru;
 static DEFINE_SPINLOCK(rom_lock);
 static void *cru_rom_addr;
@@ -756,6 +756,8 @@ error:
 static void hpwdt_exit_nmi_decoding(void)
 {
        unregister_nmi_handler(NMI_UNKNOWN, "hpwdt");
+        unregister_nmi_handler(NMI_SERR, "hpwdt");
+        unregister_nmi_handler(NMI_IO_CHECK, "hpwdt");
        if (cru_rom_addr)
                iounmap(cru_rom_addr);
 }
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index bc47e9012f37..9c2c27c3b424 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -699,3 +699,4 @@ MODULE_DESCRIPTION("Intel TCO WatchDog Timer Driver");
 MODULE_VERSION(DRV_VERSION);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
index 672d169bf1da..ef8edecfc526 100644
--- a/drivers/watchdog/watchdog_dev.c
+++ b/drivers/watchdog/watchdog_dev.c
@@ -349,7 +349,7 @@ static long watchdog_ioctl(struct file *file, unsigned int cmd,
                        sizeof(struct watchdog_info)) ? -EFAULT : 0;
        case WDIOC_GETSTATUS:
                err = watchdog_get_status(wdd, &val);
-                if (err)
+                if (err == -ENODEV)
                        return err;
                return put_user(val, p);
        case WDIOC_GETBOOTSTATUS:
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 7301cdb4b2cb..a383c18e74e8 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -301,10 +301,14 @@ static int __resolve_indirect_ref(struct btrfs_fs_info *fs_info,
                goto out;
        eb = path->nodes[level];
-        if (!eb) {
+        while (!eb) {
-                WARN_ON(1);
+                if (!level) {
-                ret = 1;
+                        WARN_ON(1);
-                goto out;
+                        ret = 1;
+                        goto out;
+                }
+                level--;
+                eb = path->nodes[level];
        }
        ret = add_all_parents(root, path, parents, level, &ref->key_for_search,
@@ -835,6 +839,7 @@ again:
                        }
                        ret = __add_delayed_refs(head, delayed_ref_seq,
                                                 &prefs_delayed);
+                        mutex_unlock(&head->mutex);
                        if (ret) {
                                spin_unlock(&delayed_refs->lock);
                                goto out;
@@ -928,8 +933,6 @@ again:
        }
 out:
-        if (head)
-                mutex_unlock(&head->mutex);
        btrfs_free_path(path);
        while (!list_empty(&prefs)) {
                ref = list_first_entry(&prefs, struct __prelim_ref, list);
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 15cbc2bf4ff0..8206b3900587 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -1024,11 +1024,18 @@ __tree_mod_log_oldest_root(struct btrfs_fs_info *fs_info,
                if (!looped && !tm)
                        return 0;
                /*
-                 * we must have key remove operations in the log before the
+                 * if there are no tree operation for the oldest root, we simply
-                 * replace operation.
+                 * return it. this should only happen if that (old) root is at
+                 * level 0.
                 */
-                BUG_ON(!tm);
+                if (!tm)
+                        break;
+                /*
+                 * if there's an operation that's not a root replacement, we
+                 * found the oldest version of our root. normally, we'll find a
+                 * MOD_LOG_KEY_REMOVE_WHILE_FREEING operation here.
+                 */
                if (tm->op != MOD_LOG_ROOT_REPLACE)
                        break;
@@ -1087,11 +1094,7 @@ __tree_mod_log_rewind(struct extent_buffer *eb, u64 time_seq,
                                                      tm->generation);
                        break;
                case MOD_LOG_KEY_ADD:
-                        if (tm->slot != n - 1) {
+                        /* if a move operation is needed it's in the log */
-                                o_dst = btrfs_node_key_ptr_offset(tm->slot);
-                                o_src = btrfs_node_key_ptr_offset(tm->slot + 1);
-                                memmove_extent_buffer(eb, o_dst, o_src, p_size);
-                        }
                        n--;
                        break;
                case MOD_LOG_MOVE_KEYS:
@@ -1192,16 +1195,8 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
        }
        tm = tree_mod_log_search(root->fs_info, logical, time_seq);
-        /*
-         * there was an item in the log when __tree_mod_log_oldest_root
-         * returned. this one must not go away, because the time_seq passed to
-         * us must be blocking its removal.
-         */
-        BUG_ON(!tm);
        if (old_root)
-                eb = alloc_dummy_extent_buffer(tm->index << PAGE_CACHE_SHIFT,
+                eb = alloc_dummy_extent_buffer(logical, root->nodesize);
-                                               root->nodesize);
        else
                eb = btrfs_clone_extent_buffer(root->node);
        btrfs_tree_read_unlock(root->node);
@@ -1216,7 +1211,10 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
                btrfs_set_header_level(eb, old_root->level);
                btrfs_set_header_generation(eb, old_generation);
        }
-        __tree_mod_log_rewind(eb, time_seq, tm);
+        if (tm)
+                __tree_mod_log_rewind(eb, time_seq, tm);
+        else
+                WARN_ON(btrfs_header_level(eb) != 0);
        extent_buffer_get(eb);
        return eb;
@@ -2995,7 +2993,7 @@ static noinline int insert_new_root(struct btrfs_trans_handle *trans,
 static void insert_ptr(struct btrfs_trans_handle *trans,
                       struct btrfs_root *root, struct btrfs_path *path,
                       struct btrfs_disk_key *key, u64 bytenr,
-                       int slot, int level, int tree_mod_log)
+                       int slot, int level)
 {
        struct extent_buffer *lower;
        int nritems;
@@ -3008,7 +3006,7 @@ static void insert_ptr(struct btrfs_trans_handle *trans,
        BUG_ON(slot > nritems);
        BUG_ON(nritems == BTRFS_NODEPTRS_PER_BLOCK(root));
        if (slot != nritems) {
-                if (tree_mod_log && level)
+                if (level)
                        tree_mod_log_eb_move(root->fs_info, lower, slot + 1,
                                             slot, nritems - slot);
                memmove_extent_buffer(lower,
@@ -3016,7 +3014,7 @@ static void insert_ptr(struct btrfs_trans_handle *trans,
                              btrfs_node_key_ptr_offset(slot),
                              (nritems - slot) * sizeof(struct btrfs_key_ptr));
        }
-        if (tree_mod_log && level) {
+        if (level) {
                ret = tree_mod_log_insert_key(root->fs_info, lower, slot,
                                              MOD_LOG_KEY_ADD);
                BUG_ON(ret < 0);
@@ -3104,7 +3102,7 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
        btrfs_mark_buffer_dirty(split);
        insert_ptr(trans, root, path, &disk_key, split->start,
-                   path->slots[level + 1] + 1, level + 1, 1);
+                   path->slots[level + 1] + 1, level + 1);
        if (path->slots[level] >= mid) {
                path->slots[level] -= mid;
@@ -3641,7 +3639,7 @@ static noinline void copy_for_split(struct btrfs_trans_handle *trans,
        btrfs_set_header_nritems(l, mid);
        btrfs_item_key(right, &disk_key, 0);
        insert_ptr(trans, root, path, &disk_key, right->start,
-                   path->slots[1] + 1, 1, 0);
+                   path->slots[1] + 1, 1);
        btrfs_mark_buffer_dirty(right);
        btrfs_mark_buffer_dirty(l);
@@ -3848,7 +3846,7 @@ again:
                if (mid <= slot) {
                        btrfs_set_header_nritems(right, 0);
                        insert_ptr(trans, root, path, &disk_key, right->start,
-                                   path->slots[1] + 1, 1, 0);
+                                   path->slots[1] + 1, 1);
                        btrfs_tree_unlock(path->nodes[0]);
                        free_extent_buffer(path->nodes[0]);
                        path->nodes[0] = right;
@@ -3857,7 +3855,7 @@ again:
                } else {
                        btrfs_set_header_nritems(right, 0);
                        insert_ptr(trans, root, path, &disk_key, right->start,
-                                          path->slots[1], 1, 0);
+                                          path->slots[1], 1);
                        btrfs_tree_unlock(path->nodes[0]);
                        free_extent_buffer(path->nodes[0]);
                        path->nodes[0] = right;
@@ -5121,6 +5119,18 @@ again:
                if (!path->skip_locking) {
                        ret = btrfs_try_tree_read_lock(next);
+                        if (!ret && time_seq) {
+                                /*
+                                 * If we don't get the lock, we may be racing
+                                 * with push_leaf_left, holding that lock while
+                                 * itself waiting for the leaf we've currently
+                                 * locked. To solve this situation, we give up
+                                 * on our lock and cycle.
+                                 */
+                                btrfs_release_path(path);
+                                cond_resched();
+                                goto again;
+                        }
                        if (!ret) {
                                btrfs_set_path_blocking(path);
                                btrfs_tree_read_lock(next);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 7b845ff4af99..2936ca49b3b4 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2354,12 +2354,17 @@ retry_root_backup:
                                  BTRFS_CSUM_TREE_OBJECTID, csum_root);
        if (ret)
                goto recovery_tree_root;
        csum_root->track_dirty = 1;
        fs_info->generation = generation;
        fs_info->last_trans_committed = generation;
+        ret = btrfs_recover_balance(fs_info);
+        if (ret) {
+                printk(KERN_WARNING "btrfs: failed to recover balance\n");
+                goto fail_block_groups;
+        }
        ret = btrfs_init_dev_stats(fs_info);
        if (ret) {
                printk(KERN_ERR "btrfs: failed to init dev_stats: %d\n",
@@ -2485,20 +2490,23 @@ retry_root_backup:
                goto fail_trans_kthread;
        }
-        if (!(sb->s_flags & MS_RDONLY)) {
+        if (sb->s_flags & MS_RDONLY)
-                down_read(&fs_info->cleanup_work_sem);
+                return 0;
-                err = btrfs_orphan_cleanup(fs_info->fs_root);
-                if (!err)
-                        err = btrfs_orphan_cleanup(fs_info->tree_root);
-                up_read(&fs_info->cleanup_work_sem);
-                if (!err)
+        down_read(&fs_info->cleanup_work_sem);
-                        err = btrfs_recover_balance(fs_info->tree_root);
+        if ((ret = btrfs_orphan_cleanup(fs_info->fs_root)) ||
+            (ret = btrfs_orphan_cleanup(fs_info->tree_root))) {
+                up_read(&fs_info->cleanup_work_sem);
+                close_ctree(tree_root);
+                return ret;
+        }
+        up_read(&fs_info->cleanup_work_sem);
-                if (err) {
+        ret = btrfs_resume_balance_async(fs_info);
-                        close_ctree(tree_root);
+        if (ret) {
-                        return err;
+                printk(KERN_WARNING "btrfs: failed to resume balance\n");
-                }
+                close_ctree(tree_root);
+                return ret;
        }
        return 0;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 4b5a1e1bdefb..6e1d36702ff7 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2347,12 +2347,10 @@ next:
        return count;
 }
 static void wait_for_more_refs(struct btrfs_delayed_ref_root *delayed_refs,
-                        unsigned long num_refs)
+                               unsigned long num_refs,
+                               struct list_head *first_seq)
 {
-        struct list_head *first_seq = delayed_refs->seq_head.next;
        spin_unlock(&delayed_refs->lock);
        pr_debug("waiting for more refs (num %ld, first %p)\n",
                 num_refs, first_seq);
@@ -2381,6 +2379,7 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
        struct btrfs_delayed_ref_root *delayed_refs;
        struct btrfs_delayed_ref_node *ref;
        struct list_head cluster;
+        struct list_head *first_seq = NULL;
        int ret;
        u64 delayed_start;
        int run_all = count == (unsigned long)-1;
@@ -2436,8 +2435,10 @@ again:
                                 */
                                consider_waiting = 1;
                                num_refs = delayed_refs->num_entries;
+                                first_seq = root->fs_info->tree_mod_seq_list.next;
                        } else {
-                                wait_for_more_refs(delayed_refs, num_refs);
+                                wait_for_more_refs(delayed_refs,
+                                                   num_refs, first_seq);
                                /*
                                 * after waiting, things have changed. we
                                 * dropped the lock and someone else might have
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index aaa12c1eb348..01c21b6c6d43 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -3324,6 +3324,7 @@ static int extent_write_cache_pages(struct extent_io_tree *tree,
                             writepage_t writepage, void *data,
                             void (*flush_fn)(void *))
 {
+        struct inode *inode = mapping->host;
        int ret = 0;
        int done = 0;
        int nr_to_write_done = 0;
@@ -3334,6 +3335,18 @@ static int extent_write_cache_pages(struct extent_io_tree *tree,
        int scanned = 0;
        int tag;
+        /*
+         * We have to hold onto the inode so that ordered extents can do their
+         * work when the IO finishes.  The alternative to this is failing to add
+         * an ordered extent if the igrab() fails there and that is a huge pain
+         * to deal with, so instead just hold onto the inode throughout the
+         * writepages operation.  If it fails here we are freeing up the inode
+         * anyway and we'd rather not waste our time writing out stuff that is
+         * going to be truncated anyway.
+         */
+        if (!igrab(inode))
+                return 0;
        pagevec_init(&pvec, 0);
        if (wbc->range_cyclic) {
                index = mapping->writeback_index; /* Start from prev offset */
@@ -3428,6 +3441,7 @@ retry:
                index = 0;
                goto retry;
        }
+        btrfs_add_delayed_iput(inode);
        return ret;
 }
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 70dc8ca73e25..9aa01ec2138d 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1334,7 +1334,6 @@ static ssize_t __btrfs_direct_write(struct kiocb *iocb,
                                    loff_t *ppos, size_t count, size_t ocount)
 {
        struct file *file = iocb->ki_filp;
-        struct inode *inode = fdentry(file)->d_inode;
        struct iov_iter i;
        ssize_t written;
        ssize_t written_buffered;
@@ -1344,18 +1343,6 @@ static ssize_t __btrfs_direct_write(struct kiocb *iocb,
        written = generic_file_direct_write(iocb, iov, &nr_segs, pos, ppos,
                                            count, ocount);
-        /*
-         * the generic O_DIRECT will update in-memory i_size after the
-         * DIOs are done.  But our endio handlers that update the on
-         * disk i_size never update past the in memory i_size.  So we
-         * need one more update here to catch any additions to the
-         * file
-         */
-        if (inode->i_size != BTRFS_I(inode)->disk_i_size) {
-                btrfs_ordered_update_i_size(inode, inode->i_size, NULL);
-                mark_inode_dirty(inode);
-        }
        if (written < 0 || written == count)
                return written;
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 81296c57405a..6c4e2baa9290 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1543,29 +1543,26 @@ again:
        end = bitmap_info->offset + (u64)(BITS_PER_BITMAP * ctl->unit) - 1;
        /*
-         * XXX - this can go away after a few releases.
+         * We need to search for bits in this bitmap.  We could only cover some
-         *
+         * of the extent in this bitmap thanks to how we add space, so we need
-         * since the only user of btrfs_remove_free_space is the tree logging
+         * to search for as much as it as we can and clear that amount, and then
-         * stuff, and the only way to test that is under crash conditions, we
+         * go searching for the next bit.
-         * want to have this debug stuff here just in case somethings not
-         * working.  Search the bitmap for the space we are trying to use to
-         * make sure its actually there.  If its not there then we need to stop
-         * because something has gone wrong.
         */
        search_start = *offset;
-        search_bytes = *bytes;
+        search_bytes = ctl->unit;
        search_bytes = min(search_bytes, end - search_start + 1);
        ret = search_bitmap(ctl, bitmap_info, &search_start, &search_bytes);
        BUG_ON(ret < 0 || search_start != *offset);
-        if (*offset > bitmap_info->offset && *offset + *bytes > end) {
+        /* We may have found more bits than what we need */
-                bitmap_clear_bits(ctl, bitmap_info, *offset, end - *offset + 1);
+        search_bytes = min(search_bytes, *bytes);
-                *bytes -= end - *offset + 1;
-                *offset = end + 1;
+        /* Cannot clear past the end of the bitmap */
-        } else if (*offset >= bitmap_info->offset && *offset + *bytes <= end) {
+        search_bytes = min(search_bytes, end - search_start + 1);
-                bitmap_clear_bits(ctl, bitmap_info, *offset, *bytes);
-                *bytes = 0;
+        bitmap_clear_bits(ctl, bitmap_info, search_start, search_bytes);
-        }
+        *offset += search_bytes;
+        *bytes -= search_bytes;
        if (*bytes) {
                struct rb_node *next = rb_next(&bitmap_info->offset_index);
@@ -1596,7 +1593,7 @@ again:
                 * everything over again.
                 */
                search_start = *offset;
-                search_bytes = *bytes;
+                search_bytes = ctl->unit;
                ret = search_bitmap(ctl, bitmap_info, &search_start,
                                    &search_bytes);
                if (ret < 0 || search_start != *offset)
@@ -1879,12 +1876,14 @@ int btrfs_remove_free_space(struct btrfs_block_group_cache *block_group,
 {
        struct btrfs_free_space_ctl *ctl = block_group->free_space_ctl;
        struct btrfs_free_space *info;
-        struct btrfs_free_space *next_info = NULL;
        int ret = 0;
        spin_lock(&ctl->tree_lock);
 again:
+        if (!bytes)
+                goto out_lock;
        info = tree_search_offset(ctl, offset, 0, 0);
        if (!info) {
                /*
@@ -1905,88 +1904,48 @@ again:
                }
        }
-        if (info->bytes < bytes && rb_next(&info->offset_index)) {
+        if (!info->bitmap) {
-                u64 end;
-                next_info = rb_entry(rb_next(&info->offset_index),
-                                             struct btrfs_free_space,
-                                             offset_index);
-                if (next_info->bitmap)
-                        end = next_info->offset +
-                              BITS_PER_BITMAP * ctl->unit - 1;
-                else
-                        end = next_info->offset + next_info->bytes;
-                if (next_info->bytes < bytes ||
-                    next_info->offset > offset || offset > end) {
-                        printk(KERN_CRIT "Found free space at %llu, size %llu,"
-                              " trying to use %llu\n",
-                              (unsigned long long)info->offset,
-                              (unsigned long long)info->bytes,
-                              (unsigned long long)bytes);
-                        WARN_ON(1);
-                        ret = -EINVAL;
-                        goto out_lock;
-                }
-                info = next_info;
-        }
-        if (info->bytes == bytes) {
                unlink_free_space(ctl, info);
-                if (info->bitmap) {
+                if (offset == info->offset) {
-                        kfree(info->bitmap);
+                        u64 to_free = min(bytes, info->bytes);
-                        ctl->total_bitmaps--;
-                }
+                        info->bytes -= to_free;
-                kmem_cache_free(btrfs_free_space_cachep, info);
+                        info->offset += to_free;
-                ret = 0;
+                        if (info->bytes) {
-                goto out_lock;
+                                ret = link_free_space(ctl, info);
-        }
+                                WARN_ON(ret);
+                        } else {
-        if (!info->bitmap && info->offset == offset) {
+                                kmem_cache_free(btrfs_free_space_cachep, info);
-                unlink_free_space(ctl, info);
+                        }
-                info->offset += bytes;
-                info->bytes -= bytes;
-                ret = link_free_space(ctl, info);
-                WARN_ON(ret);
-                goto out_lock;
-        }
-        if (!info->bitmap && info->offset <= offset &&
+                        offset += to_free;
-            info->offset + info->bytes >= offset + bytes) {
+                        bytes -= to_free;
-                u64 old_start = info->offset;
+                        goto again;
-                /*
+                } else {
-                 * we're freeing space in the middle of the info,
+                        u64 old_end = info->bytes + info->offset;
-                 * this can happen during tree log replay
-                 *
-                 * first unlink the old info and then
-                 * insert it again after the hole we're creating
-                 */
-                unlink_free_space(ctl, info);
-                if (offset + bytes < info->offset + info->bytes) {
-                        u64 old_end = info->offset + info->bytes;
-                        info->offset = offset + bytes;
+                        info->bytes = offset - info->offset;
-                        info->bytes = old_end - info->offset;
                        ret = link_free_space(ctl, info);
                        WARN_ON(ret);
                        if (ret)
                                goto out_lock;
-                } else {
-                        /* the hole we're creating ends at the end
-                         * of the info struct, just free the info
-                         */
-                        kmem_cache_free(btrfs_free_space_cachep, info);
-                }
-                spin_unlock(&ctl->tree_lock);
-                /* step two, insert a new info struct to cover
+                        /* Not enough bytes in this entry to satisfy us */
-                 * anything before the hole
+                        if (old_end < offset + bytes) {
-                 */
+                                bytes -= old_end - offset;
-                ret = btrfs_add_free_space(block_group, old_start,
+                                offset = old_end;
-                                           offset - old_start);
+                                goto again;
-                WARN_ON(ret); /* -ENOMEM */
+                        } else if (old_end == offset + bytes) {
-                goto out;
+                                /* all done */
+                                goto out_lock;
+                        }
+                        spin_unlock(&ctl->tree_lock);
+                        ret = btrfs_add_free_space(block_group, offset + bytes,
+                                                   old_end - (offset + bytes));
+                        WARN_ON(ret);
+                        goto out;
+                }
        }
        ret = remove_from_bitmap(ctl, info, &offset, &bytes);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index d8bb0dbc4941..a7d1921ac76b 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3754,7 +3754,7 @@ void btrfs_evict_inode(struct inode *inode)
        btrfs_wait_ordered_range(inode, 0, (u64)-1);
        if (root->fs_info->log_root_recovering) {
-                BUG_ON(!test_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
+                BUG_ON(test_bit(BTRFS_INODE_HAS_ORPHAN_ITEM,
                                 &BTRFS_I(inode)->runtime_flags));
                goto no_delete;
        }
@@ -5876,8 +5876,17 @@ map:
        bh_result->b_size = len;
        bh_result->b_bdev = em->bdev;
        set_buffer_mapped(bh_result);
-        if (create && !test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
+        if (create) {
-                set_buffer_new(bh_result);
+                if (!test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
+                        set_buffer_new(bh_result);
+                /*
+                 * Need to update the i_size under the extent lock so buffered
+                 * readers will get the updated i_size when we unlock.
+                 */
+                if (start + len > i_size_read(inode))
+                        i_size_write(inode, start + len);
+        }
        free_extent_map(em);
@@ -6360,12 +6369,48 @@ static ssize_t btrfs_direct_IO(int rw, struct kiocb *iocb,
                 */
                ordered = btrfs_lookup_ordered_range(inode, lockstart,
                                                     lockend - lockstart + 1);
-                if (!ordered)
+                /*
+                 * We need to make sure there are no buffered pages in this
+                 * range either, we could have raced between the invalidate in
+                 * generic_file_direct_write and locking the extent.  The
+                 * invalidate needs to happen so that reads after a write do not
+                 * get stale data.
+                 */
+                if (!ordered && (!writing ||
+                    !test_range_bit(&BTRFS_I(inode)->io_tree,
+                                    lockstart, lockend, EXTENT_UPTODATE, 0,
+                                    cached_state)))
                        break;
                unlock_extent_cached(&BTRFS_I(inode)->io_tree, lockstart, lockend,
                                     &cached_state, GFP_NOFS);
-                btrfs_start_ordered_extent(inode, ordered, 1);
-                btrfs_put_ordered_extent(ordered);
+                if (ordered) {
+                        btrfs_start_ordered_extent(inode, ordered, 1);
+                        btrfs_put_ordered_extent(ordered);
+                } else {
+                        /* Screw you mmap */
+                        ret = filemap_write_and_wait_range(file->f_mapping,
+                                                           lockstart,
+                                                           lockend);
+                        if (ret)
+                                goto out;
+                        /*
+                         * If we found a page that couldn't be invalidated just
+                         * fall back to buffered.
+                         */
+                        ret = invalidate_inode_pages2_range(file->f_mapping,
+                                        lockstart >> PAGE_CACHE_SHIFT,
+                                        lockend >> PAGE_CACHE_SHIFT);
+                        if (ret) {
+                                if (ret == -EBUSY)
+                                        ret = 0;
+                                goto out;
+                        }
+                }
                cond_resched();
        }
diff --git a/fs/btrfs/ioctl.h b/fs/btrfs/ioctl.h
index 497c530724cf..e440aa653c30 100644
--- a/fs/btrfs/ioctl.h
+++ b/fs/btrfs/ioctl.h
@@ -339,7 +339,7 @@ struct btrfs_ioctl_get_dev_stats {
 #define BTRFS_IOC_WAIT_SYNC  _IOW(BTRFS_IOCTL_MAGIC, 22, __u64)
 #define BTRFS_IOC_SNAP_CREATE_V2 _IOW(BTRFS_IOCTL_MAGIC, 23, \
                                   struct btrfs_ioctl_vol_args_v2)
-#define BTRFS_IOC_SUBVOL_GETFLAGS _IOW(BTRFS_IOCTL_MAGIC, 25, __u64)
+#define BTRFS_IOC_SUBVOL_GETFLAGS _IOR(BTRFS_IOCTL_MAGIC, 25, __u64)
 #define BTRFS_IOC_SUBVOL_SETFLAGS _IOW(BTRFS_IOCTL_MAGIC, 26, __u64)
 #define BTRFS_IOC_SCRUB _IOWR(BTRFS_IOCTL_MAGIC, 27, \
                              struct btrfs_ioctl_scrub_args)
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 0eb9a4da069e..e23991574fdf 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -1187,6 +1187,10 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
                if (ret)
                        goto restore;
+                ret = btrfs_resume_balance_async(fs_info);
+                if (ret)
+                        goto restore;
                sb->s_flags &= ~MS_RDONLY;
        }
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 2017d0ff511c..8abeae4224f9 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -690,6 +690,8 @@ static noinline int drop_one_dir_item(struct btrfs_trans_handle *trans,
        kfree(name);
        iput(inode);
+        btrfs_run_delayed_items(trans, root);
        return ret;
 }
@@ -895,6 +897,7 @@ again:
                                ret = btrfs_unlink_inode(trans, root, dir,
                                                         inode, victim_name,
                                                         victim_name_len);
+                                btrfs_run_delayed_items(trans, root);
                        }
                        kfree(victim_name);
                        ptr = (unsigned long)(victim_ref + 1) + victim_name_len;
@@ -1475,6 +1478,9 @@ again:
                        ret = btrfs_unlink_inode(trans, root, dir, inode,
                                                 name, name_len);
                        BUG_ON(ret);
+                        btrfs_run_delayed_items(trans, root);
                        kfree(name);
                        iput(inode);
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 8a3d2594b807..ecaad40e7ef4 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2845,31 +2845,48 @@ out:
 static int balance_kthread(void *data)
 {
-        struct btrfs_balance_control *bctl =
+        struct btrfs_fs_info *fs_info = data;
-                        (struct btrfs_balance_control *)data;
-        struct btrfs_fs_info *fs_info = bctl->fs_info;
        int ret = 0;
        mutex_lock(&fs_info->volume_mutex);
        mutex_lock(&fs_info->balance_mutex);
-        set_balance_control(bctl);
+        if (fs_info->balance_ctl) {
-        if (btrfs_test_opt(fs_info->tree_root, SKIP_BALANCE)) {
-                printk(KERN_INFO "btrfs: force skipping balance\n");
-        } else {
                printk(KERN_INFO "btrfs: continuing balance\n");
-                ret = btrfs_balance(bctl, NULL);
+                ret = btrfs_balance(fs_info->balance_ctl, NULL);
        }
        mutex_unlock(&fs_info->balance_mutex);
        mutex_unlock(&fs_info->volume_mutex);
        return ret;
 }
-int btrfs_recover_balance(struct btrfs_root *tree_root)
+int btrfs_resume_balance_async(struct btrfs_fs_info *fs_info)
 {
        struct task_struct *tsk;
+        spin_lock(&fs_info->balance_lock);
+        if (!fs_info->balance_ctl) {
+                spin_unlock(&fs_info->balance_lock);
+                return 0;
+        }
+        spin_unlock(&fs_info->balance_lock);
+        if (btrfs_test_opt(fs_info->tree_root, SKIP_BALANCE)) {
+                printk(KERN_INFO "btrfs: force skipping balance\n");
+                return 0;
+        }
+        tsk = kthread_run(balance_kthread, fs_info, "btrfs-balance");
+        if (IS_ERR(tsk))
+                return PTR_ERR(tsk);
+        return 0;
+}
+int btrfs_recover_balance(struct btrfs_fs_info *fs_info)
+{
        struct btrfs_balance_control *bctl;
        struct btrfs_balance_item *item;
        struct btrfs_disk_balance_args disk_bargs;
@@ -2882,29 +2899,30 @@ int btrfs_recover_balance(struct btrfs_root *tree_root)
        if (!path)
                return -ENOMEM;
-        bctl = kzalloc(sizeof(*bctl), GFP_NOFS);
-        if (!bctl) {
-                ret = -ENOMEM;
-                goto out;
-        }
        key.objectid = BTRFS_BALANCE_OBJECTID;
        key.type = BTRFS_BALANCE_ITEM_KEY;
        key.offset = 0;
-        ret = btrfs_search_slot(NULL, tree_root, &key, path, 0, 0);
+        ret = btrfs_search_slot(NULL, fs_info->tree_root, &key, path, 0, 0);
        if (ret < 0)
-                goto out_bctl;
+                goto out;
        if (ret > 0) { /* ret = -ENOENT; */
                ret = 0;
-                goto out_bctl;
+                goto out;
+        }
+        bctl = kzalloc(sizeof(*bctl), GFP_NOFS);
+        if (!bctl) {
+                ret = -ENOMEM;
+                goto out;
        }
        leaf = path->nodes[0];
        item = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_balance_item);
-        bctl->fs_info = tree_root->fs_info;
+        bctl->fs_info = fs_info;
-        bctl->flags = btrfs_balance_flags(leaf, item) | BTRFS_BALANCE_RESUME;
+        bctl->flags = btrfs_balance_flags(leaf, item);
+        bctl->flags |= BTRFS_BALANCE_RESUME;
        btrfs_balance_data(leaf, item, &disk_bargs);
        btrfs_disk_balance_args_to_cpu(&bctl->data, &disk_bargs);
@@ -2913,14 +2931,13 @@ int btrfs_recover_balance(struct btrfs_root *tree_root)
        btrfs_balance_sys(leaf, item, &disk_bargs);
        btrfs_disk_balance_args_to_cpu(&bctl->sys, &disk_bargs);
-        tsk = kthread_run(balance_kthread, bctl, "btrfs-balance");
+        mutex_lock(&fs_info->volume_mutex);
-        if (IS_ERR(tsk))
+        mutex_lock(&fs_info->balance_mutex);
-                ret = PTR_ERR(tsk);
-        else
-                goto out;
-out_bctl:
+        set_balance_control(bctl);
-        kfree(bctl);
+        mutex_unlock(&fs_info->balance_mutex);
+        mutex_unlock(&fs_info->volume_mutex);
 out:
        btrfs_free_path(path);
        return ret;
@@ -4061,16 +4078,18 @@ static void btrfs_end_bio(struct bio *bio, int err)
                        BUG_ON(stripe_index >= bbio->num_stripes);
                        dev = bbio->stripes[stripe_index].dev;
-                        if (bio->bi_rw & WRITE)
+                        if (dev->bdev) {
-                                btrfs_dev_stat_inc(dev,
+                                if (bio->bi_rw & WRITE)
-                                                   BTRFS_DEV_STAT_WRITE_ERRS);
+                                        btrfs_dev_stat_inc(dev,
-                        else
+                                                BTRFS_DEV_STAT_WRITE_ERRS);
-                                btrfs_dev_stat_inc(dev,
+                                else
-                                                   BTRFS_DEV_STAT_READ_ERRS);
+                                        btrfs_dev_stat_inc(dev,
-                        if ((bio->bi_rw & WRITE_FLUSH) == WRITE_FLUSH)
+                                                BTRFS_DEV_STAT_READ_ERRS);
-                                btrfs_dev_stat_inc(dev,
+                                if ((bio->bi_rw & WRITE_FLUSH) == WRITE_FLUSH)
-                                                   BTRFS_DEV_STAT_FLUSH_ERRS);
+                                        btrfs_dev_stat_inc(dev,
-                        btrfs_dev_stat_print_on_error(dev);
+                                                BTRFS_DEV_STAT_FLUSH_ERRS);
+                                btrfs_dev_stat_print_on_error(dev);
+                        }
                }
        }
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 74366f27a76b..95f6637614db 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -281,7 +281,8 @@ int btrfs_shrink_device(struct btrfs_device *device, u64 new_size);
 int btrfs_init_new_device(struct btrfs_root *root, char *path);
 int btrfs_balance(struct btrfs_balance_control *bctl,
                  struct btrfs_ioctl_balance_args *bargs);
-int btrfs_recover_balance(struct btrfs_root *tree_root);
+int btrfs_resume_balance_async(struct btrfs_fs_info *fs_info);
+int btrfs_recover_balance(struct btrfs_fs_info *fs_info);
 int btrfs_pause_balance(struct btrfs_fs_info *fs_info);
 int btrfs_cancel_balance(struct btrfs_fs_info *fs_info);
 int btrfs_chunk_readonly(struct btrfs_root *root, u64 chunk_offset);
diff --git a/fs/buffer.c b/fs/buffer.c
index 838a9cf246bd..c7062c896d7c 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1036,6 +1036,9 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
 static struct buffer_head *
 __getblk_slow(struct block_device *bdev, sector_t block, int size)
 {
+        int ret;
+        struct buffer_head *bh;
        /* Size must be multiple of hard sectorsize */
        if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
                        (size < 512 || size > PAGE_SIZE))) {
@@ -1048,20 +1051,21 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
                return NULL;
        }
-        for (;;) {
+retry:
-                struct buffer_head * bh;
+        bh = __find_get_block(bdev, block, size);
-                int ret;
+        if (bh)
+                return bh;
+        ret = grow_buffers(bdev, block, size);
+        if (ret == 0) {
+                free_more_memory();
+                goto retry;
+        } else if (ret > 0) {
                bh = __find_get_block(bdev, block, size);
                if (bh)
                        return bh;
-                ret = grow_buffers(bdev, block, size);
-                if (ret < 0)
-                        return NULL;
-                if (ret == 0)
-                        free_more_memory();
        }
+        return NULL;
 }
 /*
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 5b400730c213..4ee522b3f66f 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -86,7 +86,31 @@ static struct {
 #endif /* CONFIG_CIFS_WEAK_PW_HASH */
 #endif /* CIFS_POSIX */
-/* Forward declarations */
+#ifdef CONFIG_HIGHMEM
+/*
+ * On arches that have high memory, kmap address space is limited. By
+ * serializing the kmap operations on those arches, we ensure that we don't
+ * end up with a bunch of threads in writeback with partially mapped page
+ * arrays, stuck waiting for kmap to come back. That situation prevents
+ * progress and can deadlock.
+ */
+static DEFINE_MUTEX(cifs_kmap_mutex);
+static inline void
+cifs_kmap_lock(void)
+{
+        mutex_lock(&cifs_kmap_mutex);
+}
+static inline void
+cifs_kmap_unlock(void)
+{
+        mutex_unlock(&cifs_kmap_mutex);
+}
+#else /* !CONFIG_HIGHMEM */
+#define cifs_kmap_lock() do { ; } while(0)
+#define cifs_kmap_unlock() do { ; } while(0)
+#endif /* CONFIG_HIGHMEM */
 /* Mark as invalid, all open files on tree connections since they
   were closed when session to server was lost */
@@ -1503,7 +1527,9 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
        }
        /* marshal up the page array */
+        cifs_kmap_lock();
        len = rdata->marshal_iov(rdata, data_len);
+        cifs_kmap_unlock();
        data_len -= len;
        /* issue the read if we have any iovecs left to fill */
@@ -2069,7 +2095,9 @@ cifs_async_writev(struct cifs_writedata *wdata)
         * and set the iov_len properly for each one. It may also set
         * wdata->bytes too.
         */
+        cifs_kmap_lock();
        wdata->marshal_iov(iov, wdata);
+        cifs_kmap_unlock();
        cFYI(1, "async write at %llu %u bytes", wdata->offset, wdata->bytes);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 78db68a5cf44..94b7788c3189 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1653,24 +1653,26 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                         * If yes, we have encountered a double deliminator
                         * reset the NULL character to the deliminator
                         */
-                        if (tmp_end < end && tmp_end[1] == delim)
+                        if (tmp_end < end && tmp_end[1] == delim) {
                                tmp_end[0] = delim;
-                        /* Keep iterating until we get to a single deliminator
+                                /* Keep iterating until we get to a single
-                         * OR the end
+                                 * deliminator OR the end
-                         */
+                                 */
-                        while ((tmp_end = strchr(tmp_end, delim)) != NULL &&
+                                while ((tmp_end = strchr(tmp_end, delim))
-                               (tmp_end[1] == delim)) {
+                                        != NULL && (tmp_end[1] == delim)) {
-                                tmp_end = (char *) &tmp_end[2];
+                                                tmp_end = (char *) &tmp_end[2];
-                        }
+                                }
-                        /* Reset var options to point to next element */
+                                /* Reset var options to point to next element */
-                        if (tmp_end) {
+                                if (tmp_end) {
-                                tmp_end[0] = '\0';
+                                        tmp_end[0] = '\0';
-                                options = (char *) &tmp_end[1];
+                                        options = (char *) &tmp_end[1];
-                        } else
+                                } else
-                                /* Reached the end of the mount option string */
+                                        /* Reached the end of the mount option
-                                options = end;
+                                         * string */
+                                        options = end;
+                        }
                        /* Now build new password string */
                        temp_len = strlen(value);
@@ -3443,6 +3445,18 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 #define CIFS_DEFAULT_NON_POSIX_RSIZE (60 * 1024)
 #define CIFS_DEFAULT_NON_POSIX_WSIZE (65536)
+/*
+ * On hosts with high memory, we can't currently support wsize/rsize that are
+ * larger than we can kmap at once. Cap the rsize/wsize at
+ * LAST_PKMAP * PAGE_SIZE. We'll never be able to fill a read or write request
+ * larger than that anyway.
+ */
+#ifdef CONFIG_HIGHMEM
+#define CIFS_KMAP_SIZE_LIMIT    (LAST_PKMAP * PAGE_CACHE_SIZE)
+#else /* CONFIG_HIGHMEM */
+#define CIFS_KMAP_SIZE_LIMIT    (1<<24)
+#endif /* CONFIG_HIGHMEM */
 static unsigned int
 cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
 {
@@ -3473,6 +3487,9 @@ cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
                wsize = min_t(unsigned int, wsize,
                                server->maxBuf - sizeof(WRITE_REQ) + 4);
+        /* limit to the amount that we can kmap at once */
+        wsize = min_t(unsigned int, wsize, CIFS_KMAP_SIZE_LIMIT);
        /* hard limit of CIFS_MAX_WSIZE */
        wsize = min_t(unsigned int, wsize, CIFS_MAX_WSIZE);
@@ -3493,18 +3510,15 @@ cifs_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
         * MS-CIFS indicates that servers are only limited by the client's
         * bufsize for reads, testing against win98se shows that it throws
         * INVALID_PARAMETER errors if you try to request too large a read.
+         * OS/2 just sends back short reads.
         *
-         * If the server advertises a MaxBufferSize of less than one page,
+         * If the server doesn't advertise CAP_LARGE_READ_X, then assume that
-         * assume that it also can't satisfy reads larger than that either.
+         * it can't handle a read request larger than its MaxBufferSize either.
-         *
-         * FIXME: Is there a better heuristic for this?
         */
        if (tcon->unix_ext && (unix_cap & CIFS_UNIX_LARGE_READ_CAP))
                defsize = CIFS_DEFAULT_IOSIZE;
        else if (server->capabilities & CAP_LARGE_READ_X)
                defsize = CIFS_DEFAULT_NON_POSIX_RSIZE;
-        else if (server->maxBuf >= PAGE_CACHE_SIZE)
-                defsize = CIFSMaxBufSize;
        else
                defsize = server->maxBuf - sizeof(READ_RSP);
@@ -3517,6 +3531,9 @@ cifs_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
        if (!(server->capabilities & CAP_LARGE_READ_X))
                rsize = min_t(unsigned int, CIFSMaxBufSize, rsize);
+        /* limit to the amount that we can kmap at once */
+        rsize = min_t(unsigned int, rsize, CIFS_KMAP_SIZE_LIMIT);
        /* hard limit of CIFS_MAX_RSIZE */
        rsize = min_t(unsigned int, rsize, CIFS_MAX_RSIZE);
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 0a8224d1c4c5..a4217f02fab2 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -86,9 +86,12 @@ cifs_readdir_lookup(struct dentry *parent, struct qstr *name,
        dentry = d_lookup(parent, name);
        if (dentry) {
-                /* FIXME: check for inode number changes? */
+                inode = dentry->d_inode;
-                if (dentry->d_inode != NULL)
+                /* update inode in place if i_ino didn't change */
+                if (inode && CIFS_I(inode)->uniqueid == fattr->cf_uniqueid) {
+                        cifs_fattr_to_inode(inode, fattr);
                        return dentry;
+                }
                d_drop(dentry);
                dput(dentry);
        }
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 3097ee58fd7d..f25d4ea14be4 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -365,16 +365,14 @@ cifs_setup_async_request(struct TCP_Server_Info *server, struct kvec *iov,
        if (mid == NULL)
                return -ENOMEM;
-        /* put it on the pending_mid_q */
-        spin_lock(&GlobalMid_Lock);
-        list_add_tail(&mid->qhead, &server->pending_mid_q);
-        spin_unlock(&GlobalMid_Lock);
        rc = cifs_sign_smb2(iov, nvec, server, &mid->sequence_number);
-        if (rc)
+        if (rc) {
-                delete_mid(mid);
+                DeleteMidQEntry(mid);
+                return rc;
+        }
        *ret_mid = mid;
-        return rc;
+        return 0;
 }
 /*
@@ -407,17 +405,21 @@ cifs_call_async(struct TCP_Server_Info *server, struct kvec *iov,
        mid->callback_data = cbdata;
        mid->mid_state = MID_REQUEST_SUBMITTED;
+        /* put it on the pending_mid_q */
+        spin_lock(&GlobalMid_Lock);
+        list_add_tail(&mid->qhead, &server->pending_mid_q);
+        spin_unlock(&GlobalMid_Lock);
        cifs_in_send_inc(server);
        rc = smb_sendv(server, iov, nvec);
        cifs_in_send_dec(server);
        cifs_save_when_sent(mid);
        mutex_unlock(&server->srv_mutex);
-        if (rc)
+        if (rc == 0)
-                goto out_err;
+                return 0;
-        return rc;
-out_err:
        delete_mid(mid);
        add_credits(server, 1);
        wake_up(&server->request_q);
diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
index 69f994a7d524..0dbe58a8b172 100644
--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -149,7 +149,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
        (*lower_file) = dentry_open(lower_dentry, lower_mnt, flags, cred);
        if (!IS_ERR(*lower_file))
                goto out;
-        if (flags & O_RDONLY) {
+        if ((flags & O_ACCMODE) == O_RDONLY) {
                rc = PTR_ERR((*lower_file));
                goto out;
        }
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index 3a06f4043df4..c0038f6566d4 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -49,7 +49,10 @@ ecryptfs_miscdev_poll(struct file *file, poll_table *pt)
        mutex_lock(&ecryptfs_daemon_hash_mux);
        /* TODO: Just use file->private_data? */
        rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
-        BUG_ON(rc || !daemon);
+        if (rc || !daemon) {
+                mutex_unlock(&ecryptfs_daemon_hash_mux);
+                return -EINVAL;
+        }
        mutex_lock(&daemon->mux);
        mutex_unlock(&ecryptfs_daemon_hash_mux);
        if (daemon->flags & ECRYPTFS_DAEMON_ZOMBIE) {
@@ -122,6 +125,7 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
                goto out_unlock_daemon;
        }
        daemon->flags |= ECRYPTFS_DAEMON_MISCDEV_OPEN;
+        file->private_data = daemon;
        atomic_inc(&ecryptfs_num_miscdev_opens);
 out_unlock_daemon:
        mutex_unlock(&daemon->mux);
@@ -152,9 +156,9 @@ ecryptfs_miscdev_release(struct inode *inode, struct file *file)
        mutex_lock(&ecryptfs_daemon_hash_mux);
        rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
-        BUG_ON(rc || !daemon);
+        if (rc || !daemon)
+                daemon = file->private_data;
        mutex_lock(&daemon->mux);
-        BUG_ON(daemon->pid != task_pid(current));
        BUG_ON(!(daemon->flags & ECRYPTFS_DAEMON_MISCDEV_OPEN));
        daemon->flags &= ~ECRYPTFS_DAEMON_MISCDEV_OPEN;
        atomic_dec(&ecryptfs_num_miscdev_opens);
@@ -191,31 +195,32 @@ int ecryptfs_send_miscdev(char *data, size_t data_size,
                          struct ecryptfs_msg_ctx *msg_ctx, u8 msg_type,
                          u16 msg_flags, struct ecryptfs_daemon *daemon)
 {
-        int rc = 0;
+        struct ecryptfs_message *msg;
-        mutex_lock(&msg_ctx->mux);
+        msg = kmalloc((sizeof(*msg) + data_size), GFP_KERNEL);
-        msg_ctx->msg = kmalloc((sizeof(*msg_ctx->msg) + data_size),
+        if (!msg) {
-                               GFP_KERNEL);
-        if (!msg_ctx->msg) {
-                rc = -ENOMEM;
                printk(KERN_ERR "%s: Out of memory whilst attempting "
                       "to kmalloc(%zd, GFP_KERNEL)\n", __func__,
-                       (sizeof(*msg_ctx->msg) + data_size));
+                       (sizeof(*msg) + data_size));
-                goto out_unlock;
+                return -ENOMEM;
        }
+        mutex_lock(&msg_ctx->mux);
+        msg_ctx->msg = msg;
        msg_ctx->msg->index = msg_ctx->index;
        msg_ctx->msg->data_len = data_size;
        msg_ctx->type = msg_type;
        memcpy(msg_ctx->msg->data, data, data_size);
        msg_ctx->msg_size = (sizeof(*msg_ctx->msg) + data_size);
-        mutex_lock(&daemon->mux);
        list_add_tail(&msg_ctx->daemon_out_list, &daemon->msg_ctx_out_queue);
+        mutex_unlock(&msg_ctx->mux);
+        mutex_lock(&daemon->mux);
        daemon->num_queued_msg_ctx++;
        wake_up_interruptible(&daemon->wait);
        mutex_unlock(&daemon->mux);
-out_unlock:
-        mutex_unlock(&msg_ctx->mux);
+        return 0;
-        return rc;
 }
 /*
@@ -269,8 +274,16 @@ ecryptfs_miscdev_read(struct file *file, char __user *buf, size_t count,
        mutex_lock(&ecryptfs_daemon_hash_mux);
        /* TODO: Just use file->private_data? */
        rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
-        BUG_ON(rc || !daemon);
+        if (rc || !daemon) {
+                mutex_unlock(&ecryptfs_daemon_hash_mux);
+                return -EINVAL;
+        }
        mutex_lock(&daemon->mux);
+        if (task_pid(current) != daemon->pid) {
+                mutex_unlock(&daemon->mux);
+                mutex_unlock(&ecryptfs_daemon_hash_mux);
+                return -EPERM;
+        }
        if (daemon->flags & ECRYPTFS_DAEMON_ZOMBIE) {
                rc = 0;
                mutex_unlock(&ecryptfs_daemon_hash_mux);
@@ -307,9 +320,6 @@ check_list:
                 * message from the queue; try again */
                goto check_list;
        }
-        BUG_ON(euid != daemon->euid);
-        BUG_ON(current_user_ns() != daemon->user_ns);
-        BUG_ON(task_pid(current) != daemon->pid);
        msg_ctx = list_first_entry(&daemon->msg_ctx_out_queue,
                                   struct ecryptfs_msg_ctx, daemon_out_list);
        BUG_ON(!msg_ctx);
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 74598f67efeb..1c8b55670804 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1710,7 +1710,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                goto error_tgt_fput;
        /* Check if EPOLLWAKEUP is allowed */
-        if ((epds.events & EPOLLWAKEUP) && !capable(CAP_EPOLLWAKEUP))
+        if ((epds.events & EPOLLWAKEUP) && !capable(CAP_BLOCK_SUSPEND))
                epds.events &= ~EPOLLWAKEUP;
        /*
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index e34deac3f366..6ec6f9ee2fec 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -268,7 +268,6 @@ group_extend_out:
                err = ext4_move_extents(filp, donor_filp, me.orig_start,
                                        me.donor_start, me.len, &me.moved_len);
                mnt_drop_write_file(filp);
-                mnt_drop_write(filp->f_path.mnt);
                if (copy_to_user((struct move_extent __user *)arg,
                                 &me, sizeof(me)))
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index a3d81ebf6d86..0038b32cb362 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -738,22 +738,21 @@ static int
 fat_encode_fh(struct inode *inode, __u32 *fh, int *lenp, struct inode *parent)
 {
        int len = *lenp;
-        u32 ipos_h, ipos_m, ipos_l;
+        struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb);
+        loff_t i_pos;
        if (len < 5) {
                *lenp = 5;
                return 255; /* no room */
        }
-        ipos_h = MSDOS_I(inode)->i_pos >> 8;
+        i_pos = fat_i_pos_read(sbi, inode);
-        ipos_m = (MSDOS_I(inode)->i_pos & 0xf0) << 24;
-        ipos_l = (MSDOS_I(inode)->i_pos & 0x0f) << 28;
        *lenp = 5;
        fh[0] = inode->i_ino;
        fh[1] = inode->i_generation;
-        fh[2] = ipos_h;
+        fh[2] = i_pos >> 8;
-        fh[3] = ipos_m | MSDOS_I(inode)->i_logstart;
+        fh[3] = ((i_pos & 0xf0) << 24) | MSDOS_I(inode)->i_logstart;
-        fh[4] = ipos_l;
+        fh[4] = (i_pos & 0x0f) << 28;
        if (parent)
                fh[4] |= MSDOS_I(parent)->i_logstart;
        return 3;
diff --git a/fs/fifo.c b/fs/fifo.c
index b1a524d798e7..cf6f4345ceb0 100644
--- a/fs/fifo.c
+++ b/fs/fifo.c
@@ -14,7 +14,7 @@
 #include <linux/sched.h>
 #include <linux/pipe_fs_i.h>
-static void wait_for_partner(struct inode* inode, unsigned int *cnt)
+static int wait_for_partner(struct inode* inode, unsigned int *cnt)
 {
        int cur = *cnt; 
@@ -23,6 +23,7 @@ static void wait_for_partner(struct inode* inode, unsigned int *cnt)
                if (signal_pending(current))
                        break;
        }
+        return cur == *cnt ? -ERESTARTSYS : 0;
 }
 static void wake_up_partner(struct inode* inode)
@@ -67,8 +68,7 @@ static int fifo_open(struct inode *inode, struct file *filp)
                                 * seen a writer */
                                filp->f_version = pipe->w_counter;
                        } else {
-                                wait_for_partner(inode, &pipe->w_counter);
+                                if (wait_for_partner(inode, &pipe->w_counter))
-                                if(signal_pending(current))
                                        goto err_rd;
                        }
                }
@@ -90,8 +90,7 @@ static int fifo_open(struct inode *inode, struct file *filp)
                        wake_up_partner(inode);
                if (!pipe->readers) {
-                        wait_for_partner(inode, &pipe->r_counter);
+                        if (wait_for_partner(inode, &pipe->r_counter))
-                        if (signal_pending(current))
                                goto err_wr;
                }
                break;
diff --git a/fs/locks.c b/fs/locks.c
index 814c51d0de47..fce6238d52c1 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1465,7 +1465,7 @@ int generic_setlease(struct file *filp, long arg, struct file_lock **flp)
        case F_WRLCK:
                return generic_add_lease(filp, arg, flp);
        default:
-                BUG();
+                return -EINVAL;
        }
 }
 EXPORT_SYMBOL(generic_setlease);
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 9a4cbfc85d81..48253372ab1d 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -484,6 +484,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
        list_for_each_entry_safe(req, tmp, &reqs, wb_list) {
                if (!nfs_pageio_add_request(&desc, req)) {
+                        nfs_list_remove_request(req);
                        nfs_list_add_request(req, &failed);
                        spin_lock(cinfo.lock);
                        dreq->flags = 0;
@@ -494,8 +495,11 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
        }
        nfs_pageio_complete(&desc);
-        while (!list_empty(&failed))
+        while (!list_empty(&failed)) {
+                req = nfs_list_entry(failed.next);
+                nfs_list_remove_request(req);
                nfs_unlock_and_release_request(req);
+        }
        if (put_dreq(dreq))
                nfs_direct_write_complete(dreq, dreq->inode);
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 906f09c7d842..06228192f64e 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2860,6 +2860,8 @@ static struct dentry *nfs4_try_mount(int flags, const char *dev_name,
        dfprintk(MOUNT, "--> nfs4_try_mount()\n");
+        mount_info->fill_super = nfs4_fill_super;
        export_path = data->nfs_server.export_path;
        data->nfs_server.export_path = "/";
        root_mnt = nfs_do_root_mount(&nfs4_remote_fs_type, flags, mount_info,
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 81a4cd22f80b..4f7795fb5fc0 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -456,7 +456,7 @@ static void ocfs2_update_lock_stats(struct ocfs2_lock_res *res, int level,
        stats->ls_gets++;
        stats->ls_total += ktime_to_ns(kt);
        /* overflow */
-        if (unlikely(stats->ls_gets) == 0) {
+        if (unlikely(stats->ls_gets == 0)) {
                stats->ls_gets++;
                stats->ls_total = ktime_to_ns(kt);
        }
@@ -3932,6 +3932,8 @@ unqueue:
 static void ocfs2_schedule_blocked_lock(struct ocfs2_super *osb,
                                        struct ocfs2_lock_res *lockres)
 {
+        unsigned long flags;
        assert_spin_locked(&lockres->l_lock);
        if (lockres->l_flags & OCFS2_LOCK_FREEING) {
@@ -3945,21 +3947,22 @@ static void ocfs2_schedule_blocked_lock(struct ocfs2_super *osb,
        lockres_or_flags(lockres, OCFS2_LOCK_QUEUED);
-        spin_lock(&osb->dc_task_lock);
+        spin_lock_irqsave(&osb->dc_task_lock, flags);
        if (list_empty(&lockres->l_blocked_list)) {
                list_add_tail(&lockres->l_blocked_list,
                              &osb->blocked_lock_list);
                osb->blocked_lock_count++;
        }
-        spin_unlock(&osb->dc_task_lock);
+        spin_unlock_irqrestore(&osb->dc_task_lock, flags);
 }
 static void ocfs2_downconvert_thread_do_work(struct ocfs2_super *osb)
 {
        unsigned long processed;
+        unsigned long flags;
        struct ocfs2_lock_res *lockres;
-        spin_lock(&osb->dc_task_lock);
+        spin_lock_irqsave(&osb->dc_task_lock, flags);
        /* grab this early so we know to try again if a state change and
         * wake happens part-way through our work  */
        osb->dc_work_sequence = osb->dc_wake_sequence;
@@ -3972,38 +3975,40 @@ static void ocfs2_downconvert_thread_do_work(struct ocfs2_super *osb)
                                     struct ocfs2_lock_res, l_blocked_list);
                list_del_init(&lockres->l_blocked_list);
                osb->blocked_lock_count--;
-                spin_unlock(&osb->dc_task_lock);
+                spin_unlock_irqrestore(&osb->dc_task_lock, flags);
                BUG_ON(!processed);
                processed--;
                ocfs2_process_blocked_lock(osb, lockres);
-                spin_lock(&osb->dc_task_lock);
+                spin_lock_irqsave(&osb->dc_task_lock, flags);
        }
-        spin_unlock(&osb->dc_task_lock);
+        spin_unlock_irqrestore(&osb->dc_task_lock, flags);
 }
 static int ocfs2_downconvert_thread_lists_empty(struct ocfs2_super *osb)
 {
        int empty = 0;
+        unsigned long flags;
-        spin_lock(&osb->dc_task_lock);
+        spin_lock_irqsave(&osb->dc_task_lock, flags);
        if (list_empty(&osb->blocked_lock_list))
                empty = 1;
-        spin_unlock(&osb->dc_task_lock);
+        spin_unlock_irqrestore(&osb->dc_task_lock, flags);
        return empty;
 }
 static int ocfs2_downconvert_thread_should_wake(struct ocfs2_super *osb)
 {
        int should_wake = 0;
+        unsigned long flags;
-        spin_lock(&osb->dc_task_lock);
+        spin_lock_irqsave(&osb->dc_task_lock, flags);
        if (osb->dc_work_sequence != osb->dc_wake_sequence)
                should_wake = 1;
-        spin_unlock(&osb->dc_task_lock);
+        spin_unlock_irqrestore(&osb->dc_task_lock, flags);
        return should_wake;
 }
@@ -4033,10 +4038,12 @@ static int ocfs2_downconvert_thread(void *arg)
 void ocfs2_wake_downconvert_thread(struct ocfs2_super *osb)
 {
-        spin_lock(&osb->dc_task_lock);
+        unsigned long flags;
+        spin_lock_irqsave(&osb->dc_task_lock, flags);
        /* make sure the voting thread gets a swipe at whatever changes
         * the caller may have made to the voting state */
        osb->dc_wake_sequence++;
-        spin_unlock(&osb->dc_task_lock);
+        spin_unlock_irqrestore(&osb->dc_task_lock, flags);
        wake_up(&osb->dc_event);
 }
diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
index 2f5b92ef0e53..70b5863a2d64 100644
--- a/fs/ocfs2/extent_map.c
+++ b/fs/ocfs2/extent_map.c
@@ -923,8 +923,6 @@ out_unlock:
        ocfs2_inode_unlock(inode, 0);
 out:
-        if (ret && ret != -ENXIO)
-                ret = -ENXIO;
        return ret;
 }
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 061591a3ab08..7602783d7f41 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1950,7 +1950,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode,
        if (ret < 0)
                mlog_errno(ret);
-        if (file->f_flags & O_SYNC)
+        if (file && (file->f_flags & O_SYNC))
                handle->h_sync = 1;
        ocfs2_commit_trans(osb, handle);
@@ -2422,8 +2422,10 @@ out_dio:
                unaligned_dio = 0;
        }
-        if (unaligned_dio)
+        if (unaligned_dio) {
+                ocfs2_iocb_clear_unaligned_aio(iocb);
                atomic_dec(&OCFS2_I(inode)->ip_unaligned_aio);
+        }
 out:
        if (rw_level != -1)
diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index 92fcd575775a..0a86e302655f 100644
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -399,8 +399,6 @@ int ocfs2_global_read_info(struct super_block *sb, int type)
                              msecs_to_jiffies(oinfo->dqi_syncms));
 out_err:
-        if (status)
-                mlog_errno(status);
        return status;
 out_unlock:
        ocfs2_unlock_global_qf(oinfo, 0);
diff --git a/fs/open.c b/fs/open.c
index d6c79a0dffc7..1540632d8387 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -397,10 +397,10 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
 {
        struct file *file;
        struct inode *inode;
-        int error;
+        int error, fput_needed;
        error = -EBADF;
-        file = fget(fd);
+        file = fget_raw_light(fd, &fput_needed);
        if (!file)
                goto out;
@@ -414,7 +414,7 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
        if (!error)
                set_fs_pwd(current->fs, &file->f_path);
 out_putf:
-        fput(file);
+        fput_light(file, fput_needed);
 out:
        return error;
 }
diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index fbb0b478a346..d5378d028589 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -110,6 +110,7 @@ int ramfs_nommu_expand_for_mapping(struct inode *inode, size_t newsize)
                /* prevent the page from being discarded on memory pressure */
                SetPageDirty(page);
+                SetPageUptodate(page);
                unlock_page(page);
                put_page(page);
diff --git a/fs/splice.c b/fs/splice.c
index c9f1318a3b82..7bf08fa22ec9 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -273,13 +273,16 @@ void spd_release_page(struct splice_pipe_desc *spd, unsigned int i)
 * Check if we need to grow the arrays holding pages and partial page
 * descriptions.
 */
-int splice_grow_spd(struct pipe_inode_info *pipe, struct splice_pipe_desc *spd)
+int splice_grow_spd(const struct pipe_inode_info *pipe, struct splice_pipe_desc *spd)
 {
-        if (pipe->buffers <= PIPE_DEF_BUFFERS)
+        unsigned int buffers = ACCESS_ONCE(pipe->buffers);
+        spd->nr_pages_max = buffers;
+        if (buffers <= PIPE_DEF_BUFFERS)
                return 0;
-        spd->pages = kmalloc(pipe->buffers * sizeof(struct page *), GFP_KERNEL);
+        spd->pages = kmalloc(buffers * sizeof(struct page *), GFP_KERNEL);
-        spd->partial = kmalloc(pipe->buffers * sizeof(struct partial_page), GFP_KERNEL);
+        spd->partial = kmalloc(buffers * sizeof(struct partial_page), GFP_KERNEL);
        if (spd->pages && spd->partial)
                return 0;
@@ -289,10 +292,9 @@ int splice_grow_spd(struct pipe_inode_info *pipe, struct splice_pipe_desc *spd)
        return -ENOMEM;
 }
-void splice_shrink_spd(struct pipe_inode_info *pipe,
+void splice_shrink_spd(struct splice_pipe_desc *spd)
-                       struct splice_pipe_desc *spd)
 {
-        if (pipe->buffers <= PIPE_DEF_BUFFERS)
+        if (spd->nr_pages_max <= PIPE_DEF_BUFFERS)
                return;
        kfree(spd->pages);
@@ -315,6 +317,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
        struct splice_pipe_desc spd = {
                .pages = pages,
                .partial = partial,
+                .nr_pages_max = PIPE_DEF_BUFFERS,
                .flags = flags,
                .ops = &page_cache_pipe_buf_ops,
                .spd_release = spd_release_page,
@@ -326,7 +329,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
        index = *ppos >> PAGE_CACHE_SHIFT;
        loff = *ppos & ~PAGE_CACHE_MASK;
        req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-        nr_pages = min(req_pages, pipe->buffers);
+        nr_pages = min(req_pages, spd.nr_pages_max);
        /*
         * Lookup the (hopefully) full range of pages we need.
@@ -497,7 +500,7 @@ fill_it:
        if (spd.nr_pages)
                error = splice_to_pipe(pipe, &spd);
-        splice_shrink_spd(pipe, &spd);
+        splice_shrink_spd(&spd);
        return error;
 }
@@ -598,6 +601,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
        struct splice_pipe_desc spd = {
                .pages = pages,
                .partial = partial,
+                .nr_pages_max = PIPE_DEF_BUFFERS,
                .flags = flags,
                .ops = &default_pipe_buf_ops,
                .spd_release = spd_release_page,
@@ -608,8 +612,8 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
        res = -ENOMEM;
        vec = __vec;
-        if (pipe->buffers > PIPE_DEF_BUFFERS) {
+        if (spd.nr_pages_max > PIPE_DEF_BUFFERS) {
-                vec = kmalloc(pipe->buffers * sizeof(struct iovec), GFP_KERNEL);
+                vec = kmalloc(spd.nr_pages_max * sizeof(struct iovec), GFP_KERNEL);
                if (!vec)
                        goto shrink_ret;
        }
@@ -617,7 +621,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
        offset = *ppos & ~PAGE_CACHE_MASK;
        nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-        for (i = 0; i < nr_pages && i < pipe->buffers && len; i++) {
+        for (i = 0; i < nr_pages && i < spd.nr_pages_max && len; i++) {
                struct page *page;
                page = alloc_page(GFP_USER);
@@ -665,7 +669,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
 shrink_ret:
        if (vec != __vec)
                kfree(vec);
-        splice_shrink_spd(pipe, &spd);
+        splice_shrink_spd(&spd);
        return res;
 err:
@@ -1614,6 +1618,7 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
        struct splice_pipe_desc spd = {
                .pages = pages,
                .partial = partial,
+                .nr_pages_max = PIPE_DEF_BUFFERS,
                .flags = flags,
                .ops = &user_page_pipe_buf_ops,
                .spd_release = spd_release_page,
@@ -1629,13 +1634,13 @@ static long vmsplice_to_pipe(struct file *file, const struct iovec __user *iov,
        spd.nr_pages = get_iovec_page_array(iov, nr_segs, spd.pages,
                                            spd.partial, false,
-                                            pipe->buffers);
+                                            spd.nr_pages_max);
        if (spd.nr_pages <= 0)
                ret = spd.nr_pages;
        else
                ret = splice_to_pipe(pipe, &spd);
-        splice_shrink_spd(pipe, &spd);
+        splice_shrink_spd(&spd);
        return ret;
 }
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 84a7e6f3c046..92df3b081539 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -2918,7 +2918,7 @@ int dbg_debugfs_init_fs(struct ubifs_info *c)
        struct dentry *dent;
        struct ubifs_debug_info *d = c->dbg;
-        if (!IS_ENABLED(DEBUG_FS))
+        if (!IS_ENABLED(CONFIG_DEBUG_FS))
                return 0;
        n = snprintf(d->dfs_dir_name, UBIFS_DFS_DIR_LEN + 1, UBIFS_DFS_DIR_NAME,
@@ -3013,7 +3013,7 @@ out:
 */
 void dbg_debugfs_exit_fs(struct ubifs_info *c)
 {
-        if (IS_ENABLED(DEBUG_FS))
+        if (IS_ENABLED(CONFIG_DEBUG_FS))
                debugfs_remove_recursive(c->dbg->dfs_dir);
 }
@@ -3099,7 +3099,7 @@ int dbg_debugfs_init(void)
        const char *fname;
        struct dentry *dent;
-        if (!IS_ENABLED(DEBUG_FS))
+        if (!IS_ENABLED(CONFIG_DEBUG_FS))
                return 0;
        fname = "ubifs";
@@ -3166,7 +3166,7 @@ out:
 */
 void dbg_debugfs_exit(void)
 {
-        if (IS_ENABLED(DEBUG_FS))
+        if (IS_ENABLED(CONFIG_DEBUG_FS))
                debugfs_remove_recursive(dfs_rootdir);
 }
diff --git a/fs/ubifs/find.c b/fs/ubifs/find.c
index 2559d174e004..28ec13af28d9 100644
--- a/fs/ubifs/find.c
+++ b/fs/ubifs/find.c
@@ -939,8 +939,8 @@ static int find_dirtiest_idx_leb(struct ubifs_info *c)
        }
        dbg_find("LEB %d, dirty %d and free %d flags %#x", lp->lnum, lp->dirty,
                 lp->free, lp->flags);
-        ubifs_assert(lp->flags | LPROPS_TAKEN);
+        ubifs_assert(lp->flags & LPROPS_TAKEN);
-        ubifs_assert(lp->flags | LPROPS_INDEX);
+        ubifs_assert(lp->flags & LPROPS_INDEX);
        return lnum;
 }
diff --git a/fs/udf/super.c b/fs/udf/super.c
index ac8a348dcb69..8d86a8706c0e 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -56,6 +56,7 @@
 #include <linux/seq_file.h>
 #include <linux/bitmap.h>
 #include <linux/crc-itu-t.h>
+#include <linux/log2.h>
 #include <asm/byteorder.h>
 #include "udf_sb.h"
@@ -1215,16 +1216,65 @@ out_bh:
        return ret;
 }
+static int udf_load_sparable_map(struct super_block *sb,
+                                 struct udf_part_map *map,
+                                 struct sparablePartitionMap *spm)
+{
+        uint32_t loc;
+        uint16_t ident;
+        struct sparingTable *st;
+        struct udf_sparing_data *sdata = &map->s_type_specific.s_sparing;
+        int i;
+        struct buffer_head *bh;
+        map->s_partition_type = UDF_SPARABLE_MAP15;
+        sdata->s_packet_len = le16_to_cpu(spm->packetLength);
+        if (!is_power_of_2(sdata->s_packet_len)) {
+                udf_err(sb, "error loading logical volume descriptor: "
+                        "Invalid packet length %u\n",
+                        (unsigned)sdata->s_packet_len);
+                return -EIO;
+        }
+        if (spm->numSparingTables > 4) {
+                udf_err(sb, "error loading logical volume descriptor: "
+                        "Too many sparing tables (%d)\n",
+                        (int)spm->numSparingTables);
+                return -EIO;
+        }
+        for (i = 0; i < spm->numSparingTables; i++) {
+                loc = le32_to_cpu(spm->locSparingTable[i]);
+                bh = udf_read_tagged(sb, loc, loc, &ident);
+                if (!bh)
+                        continue;
+                st = (struct sparingTable *)bh->b_data;
+                if (ident != 0 ||
+                    strncmp(st->sparingIdent.ident, UDF_ID_SPARING,
+                            strlen(UDF_ID_SPARING)) ||
+                    sizeof(*st) + le16_to_cpu(st->reallocationTableLen) >
+                                                        sb->s_blocksize) {
+                        brelse(bh);
+                        continue;
+                }
+                sdata->s_spar_map[i] = bh;
+        }
+        map->s_partition_func = udf_get_pblock_spar15;
+        return 0;
+}
 static int udf_load_logicalvol(struct super_block *sb, sector_t block,
                               struct kernel_lb_addr *fileset)
 {
        struct logicalVolDesc *lvd;
-        int i, j, offset;
+        int i, offset;
        uint8_t type;
        struct udf_sb_info *sbi = UDF_SB(sb);
        struct genericPartitionMap *gpm;
        uint16_t ident;
        struct buffer_head *bh;
+        unsigned int table_len;
        int ret = 0;
        bh = udf_read_tagged(sb, block, block, &ident);
@@ -1232,15 +1282,20 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
                return 1;
        BUG_ON(ident != TAG_IDENT_LVD);
        lvd = (struct logicalVolDesc *)bh->b_data;
+        table_len = le32_to_cpu(lvd->mapTableLength);
-        i = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
+        if (sizeof(*lvd) + table_len > sb->s_blocksize) {
-        if (i != 0) {
+                udf_err(sb, "error loading logical volume descriptor: "
-                ret = i;
+                        "Partition table too long (%u > %lu)\n", table_len,
+                        sb->s_blocksize - sizeof(*lvd));
                goto out_bh;
        }
+        ret = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
+        if (ret)
+                goto out_bh;
        for (i = 0, offset = 0;
-             i < sbi->s_partitions && offset < le32_to_cpu(lvd->mapTableLength);
+             i < sbi->s_partitions && offset < table_len;
             i++, offset += gpm->partitionMapLength) {
                struct udf_part_map *map = &sbi->s_partmaps[i];
                gpm = (struct genericPartitionMap *)
@@ -1275,38 +1330,9 @@ static int udf_load_logicalvol(struct super_block *sb, sector_t block,
                        } else if (!strncmp(upm2->partIdent.ident,
                                                UDF_ID_SPARABLE,
                                                strlen(UDF_ID_SPARABLE))) {
-                                uint32_t loc;
+                                if (udf_load_sparable_map(sb, map,
-                                struct sparingTable *st;
+                                    (struct sparablePartitionMap *)gpm) < 0)
-                                struct sparablePartitionMap *spm =
+                                        goto out_bh;
-                                        (struct sparablePartitionMap *)gpm;
-                                map->s_partition_type = UDF_SPARABLE_MAP15;
-                                map->s_type_specific.s_sparing.s_packet_len =
-                                                le16_to_cpu(spm->packetLength);
-                                for (j = 0; j < spm->numSparingTables; j++) {
-                                        struct buffer_head *bh2;
-                                        loc = le32_to_cpu(
-                                                spm->locSparingTable[j]);
-                                        bh2 = udf_read_tagged(sb, loc, loc,
-                                                             &ident);
-                                        map->s_type_specific.s_sparing.
-                                                        s_spar_map[j] = bh2;
-                                        if (bh2 == NULL)
-                                                continue;
-                                        st = (struct sparingTable *)bh2->b_data;
-                                        if (ident != 0 || strncmp(
-                                                st->sparingIdent.ident,
-                                                UDF_ID_SPARING,
-                                                strlen(UDF_ID_SPARING))) {
-                                                brelse(bh2);
-                                                map->s_type_specific.s_sparing.
-                                                        s_spar_map[j] = NULL;
-                                        }
-                                }
-                                map->s_partition_func = udf_get_pblock_spar15;
                        } else if (!strncmp(upm2->partIdent.ident,
                                                UDF_ID_METADATA,
                                                strlen(UDF_ID_METADATA))) {
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 9d1aeb7e2734..4f33c32affe3 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -1074,13 +1074,13 @@ restart:
         * If we couldn't get anything, give up.
         */
        if (bno_cur_lt == NULL && bno_cur_gt == NULL) {
+                xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR);
                if (!forced++) {
                        trace_xfs_alloc_near_busy(args);
                        xfs_log_force(args->mp, XFS_LOG_SYNC);
                        goto restart;
                }
-                xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR);
                trace_xfs_alloc_size_neither(args);
                args->agbno = NULLAGBLOCK;
                return 0;
@@ -2434,13 +2434,22 @@ xfs_alloc_vextent_worker(
        current_restore_flags_nested(&pflags, PF_FSTRANS);
 }
+/*
-int                             /* error */
+ * Data allocation requests often come in with little stack to work on. Push
+ * them off to a worker thread so there is lots of stack to use. Metadata
+ * requests, OTOH, are generally from low stack usage paths, so avoid the
+ * context switch overhead here.
+ */
+int
 xfs_alloc_vextent(
-        xfs_alloc_arg_t *args)  /* allocation argument structure */
+        struct xfs_alloc_arg    *args)
 {
        DECLARE_COMPLETION_ONSTACK(done);
+        if (!args->userdata)
+                return __xfs_alloc_vextent(args);
        args->done = &done;
        INIT_WORK_ONSTACK(&args->work, xfs_alloc_vextent_worker);
        queue_work(xfs_alloc_wq, &args->work);
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index a4beb421018a..269b35c084da 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -989,27 +989,6 @@ xfs_buf_ioerror_alert(
                (__uint64_t)XFS_BUF_ADDR(bp), func, bp->b_error, bp->b_length);
 }
-int
-xfs_bwrite(
-        struct xfs_buf          *bp)
-{
-        int                     error;
-        ASSERT(xfs_buf_islocked(bp));
-        bp->b_flags |= XBF_WRITE;
-        bp->b_flags &= ~(XBF_ASYNC | XBF_READ | _XBF_DELWRI_Q);
-        xfs_bdstrat_cb(bp);
-        error = xfs_buf_iowait(bp);
-        if (error) {
-                xfs_force_shutdown(bp->b_target->bt_mount,
-                                   SHUTDOWN_META_IO_ERROR);
-        }
-        return error;
-}
 /*
 * Called when we want to stop a buffer from getting written or read.
 * We attach the EIO error, muck with its flags, and call xfs_buf_ioend
@@ -1079,14 +1058,7 @@ xfs_bioerror_relse(
        return EIO;
 }
+STATIC int
-/*
- * All xfs metadata buffers except log state machine buffers
- * get this attached as their b_bdstrat callback function.
- * This is so that we can catch a buffer
- * after prematurely unpinning it to forcibly shutdown the filesystem.
- */
-int
 xfs_bdstrat_cb(
        struct xfs_buf  *bp)
 {
@@ -1107,6 +1079,27 @@ xfs_bdstrat_cb(
        return 0;
 }
+int
+xfs_bwrite(
+        struct xfs_buf          *bp)
+{
+        int                     error;
+        ASSERT(xfs_buf_islocked(bp));
+        bp->b_flags |= XBF_WRITE;
+        bp->b_flags &= ~(XBF_ASYNC | XBF_READ | _XBF_DELWRI_Q);
+        xfs_bdstrat_cb(bp);
+        error = xfs_buf_iowait(bp);
+        if (error) {
+                xfs_force_shutdown(bp->b_target->bt_mount,
+                                   SHUTDOWN_META_IO_ERROR);
+        }
+        return error;
+}
 /*
 * Wrapper around bdstrat so that we can stop data from going to disk in case
 * we are shutting down the filesystem.  Typically user data goes thru this
@@ -1243,7 +1236,7 @@ xfs_buf_iorequest(
         */
        atomic_set(&bp->b_io_remaining, 1);
        _xfs_buf_ioapply(bp);
-        _xfs_buf_ioend(bp, 0);
+        _xfs_buf_ioend(bp, 1);
        xfs_buf_rele(bp);
 }
diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index 7f1d1392ce37..79344c48008e 100644
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -180,7 +180,6 @@ extern void xfs_buf_unlock(xfs_buf_t *);
 extern int xfs_bwrite(struct xfs_buf *bp);
 extern void xfsbdstrat(struct xfs_mount *, struct xfs_buf *);
-extern int xfs_bdstrat_cb(struct xfs_buf *);
 extern void xfs_buf_ioend(xfs_buf_t *,  int);
 extern void xfs_buf_ioerror(xfs_buf_t *, int);
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 45df2b857d48..d9e451115f98 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -954,7 +954,7 @@ xfs_buf_iodone_callbacks(
                if (!XFS_BUF_ISSTALE(bp)) {
                        bp->b_flags |= XBF_WRITE | XBF_ASYNC | XBF_DONE;
-                        xfs_bdstrat_cb(bp);
+                        xfs_buf_iorequest(bp);
                } else {
                        xfs_buf_relse(bp);
                }
diff --git a/include/asm-generic/dma-contiguous.h b/include/asm-generic/dma-contiguous.h
index c544356b374b..294b1e755ab2 100644
--- a/include/asm-generic/dma-contiguous.h
+++ b/include/asm-generic/dma-contiguous.h
@@ -18,7 +18,7 @@ static inline void dev_set_cma_area(struct device *dev, struct cma *cma)
 {
        if (dev)
                dev->cma_area = cma;
-        if (!dev || !dma_contiguous_default_area)
+        if (!dev && !dma_contiguous_default_area)
                dma_contiguous_default_area = cma;
 }
diff --git a/include/linux/aio.h b/include/linux/aio.h
index 2314ad8b3c9c..b1a520ec8b59 100644
--- a/include/linux/aio.h
+++ b/include/linux/aio.h
@@ -140,6 +140,7 @@ struct kiocb {
                (x)->ki_dtor = NULL;                    \
                (x)->ki_obj.tsk = tsk;                  \
                (x)->ki_user_data = 0;                  \
+                (x)->private = NULL;                    \
        } while (0)
 #define AIO_RING_MAGIC                  0xa10a10a1
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index ba43f408baa3..07954b05b86c 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -827,7 +827,6 @@ extern bool __blk_end_request_err(struct request *rq, int error);
 extern void blk_complete_request(struct request *);
 extern void __blk_complete_request(struct request *);
 extern void blk_abort_request(struct request *);
-extern void blk_abort_queue(struct request_queue *);
 extern void blk_unprep_request(struct request *);
 /*
diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
index 324fe08ea3b1..6d6795d46a75 100644
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -91,6 +91,11 @@ extern void *__alloc_bootmem_node_nopanic(pg_data_t *pgdat,
                                  unsigned long size,
                                  unsigned long align,
                                  unsigned long goal);
+void *___alloc_bootmem_node_nopanic(pg_data_t *pgdat,
+                                  unsigned long size,
+                                  unsigned long align,
+                                  unsigned long goal,
+                                  unsigned long limit);
 extern void *__alloc_bootmem_low(unsigned long size,
                                 unsigned long align,
                                 unsigned long goal);
diff --git a/include/linux/capability.h b/include/linux/capability.h
index 68d56effc328..d10b7ed595b1 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -360,11 +360,11 @@ struct cpu_vfs_cap_data {
 #define CAP_WAKE_ALARM            35
-/* Allow preventing system suspends while epoll events are pending */
+/* Allow preventing system suspends */
-#define CAP_EPOLLWAKEUP      36
+#define CAP_BLOCK_SUSPEND    36
-#define CAP_LAST_CAP         CAP_EPOLLWAKEUP
+#define CAP_LAST_CAP         CAP_BLOCK_SUSPEND
 #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP)
diff --git a/include/linux/device.h b/include/linux/device.h
index 161d96241b1b..6de94151ff6f 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -865,8 +865,6 @@ extern int (*platform_notify_remove)(struct device *dev);
 extern struct device *get_device(struct device *dev);
 extern void put_device(struct device *dev);
-extern void wait_for_device_probe(void);
 #ifdef CONFIG_DEVTMPFS
 extern int devtmpfs_create_node(struct device *dev);
 extern int devtmpfs_delete_node(struct device *dev);
diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
index 6f8be328770a..f4bb378ccf6a 100644
--- a/include/linux/eventpoll.h
+++ b/include/linux/eventpoll.h
@@ -34,7 +34,7 @@
 * re-allowed until epoll_wait is called again after consuming the wakeup
 * event(s).
 *
- * Requires CAP_EPOLLWAKEUP
+ * Requires CAP_BLOCK_SUSPEND
 */
 #define EPOLLWAKEUP (1 << 29)
diff --git a/include/linux/gpio.h b/include/linux/gpio.h
index f07fc2d08159..2e31e8b3a190 100644
--- a/include/linux/gpio.h
+++ b/include/linux/gpio.h
@@ -22,8 +22,8 @@
 /* Gpio pin is open source */
 #define GPIOF_OPEN_SOURCE       (1 << 3)
-#define GPIOF_EXPORT            (1 << 2)
+#define GPIOF_EXPORT            (1 << 4)
-#define GPIOF_EXPORT_CHANGEABLE (1 << 3)
+#define GPIOF_EXPORT_CHANGEABLE (1 << 5)
 #define GPIOF_EXPORT_DIR_FIXED  (GPIOF_EXPORT)
 #define GPIOF_EXPORT_DIR_CHANGEABLE (GPIOF_EXPORT | GPIOF_EXPORT_CHANGEABLE)
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 449fa385703d..42970de1b40c 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -200,6 +200,7 @@ struct hid_item {
 #define HID_UP_DIGITIZER        0x000d0000
 #define HID_UP_PID              0x000f0000
 #define HID_UP_HPVENDOR         0xff7f0000
+#define HID_UP_HPVENDOR2        0xff010000
 #define HID_UP_MSVENDOR         0xff000000
 #define HID_UP_CUSTOM           0x00ff0000
 #define HID_UP_LOGIVENDOR       0xffbc0000
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index fd0dc30c9f15..cc07d2777bbe 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -165,6 +165,7 @@ enum  hrtimer_base_type {
 * @lock:               lock protecting the base and associated clock bases
 *                      and timers
 * @active_bases:       Bitfield to mark bases with active timers
+ * @clock_was_set:      Indicates that clock was set from irq context.
 * @expires_next:       absolute time of the next event which was scheduled
 *                      via clock_set_next_event()
 * @hres_active:        State of high resolution mode
@@ -177,7 +178,8 @@ enum  hrtimer_base_type {
 */
 struct hrtimer_cpu_base {
        raw_spinlock_t                  lock;
-        unsigned long                   active_bases;
+        unsigned int                    active_bases;
+        unsigned int                    clock_was_set;
 #ifdef CONFIG_HIGH_RES_TIMERS
        ktime_t                         expires_next;
        int                             hres_active;
@@ -286,6 +288,8 @@ extern void hrtimer_peek_ahead_timers(void);
 # define MONOTONIC_RES_NSEC     HIGH_RES_NSEC
 # define KTIME_MONOTONIC_RES    KTIME_HIGH_RES
+extern void clock_was_set_delayed(void);
 #else
 # define MONOTONIC_RES_NSEC     LOW_RES_NSEC
@@ -306,6 +310,9 @@ static inline int hrtimer_is_hres_active(struct hrtimer *timer)
 {
        return 0;
 }
+static inline void clock_was_set_delayed(void) { }
 #endif
 extern void clock_was_set(void);
@@ -320,6 +327,7 @@ extern ktime_t ktime_get(void);
 extern ktime_t ktime_get_real(void);
 extern ktime_t ktime_get_boottime(void);
 extern ktime_t ktime_get_monotonic_offset(void);
+extern ktime_t ktime_get_update_offsets(ktime_t *offs_real, ktime_t *offs_boot);
 DECLARE_PER_CPU(struct tick_device, tick_cpu_device);
diff --git a/include/linux/input.h b/include/linux/input.h
index a81671453575..2740d080ec6b 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -116,6 +116,7 @@ struct input_keymap_entry {
 /**
 * EVIOCGMTSLOTS(len) - get MT slot values
+ * @len: size of the data buffer in bytes
 *
 * The ioctl buffer argument should be binary equivalent to
 *
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 61f5cec031e0..a5261e3d2e3c 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -301,8 +301,6 @@ static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
 * @irq_pm_shutdown:    function called from core code on shutdown once per chip
 * @irq_print_chip:     optional to print special chip info in show_interrupts
 * @flags:              chip specific flags
- *
- * @release:            release function solely used by UML
 */
 struct irq_chip {
        const char      *name;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index c4464356b35b..96c158a37d3e 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -815,7 +815,7 @@ static inline void kvm_free_irq_routing(struct kvm *kvm) {}
 #ifdef CONFIG_HAVE_KVM_EVENTFD
 void kvm_eventfd_init(struct kvm *kvm);
-int kvm_irqfd(struct kvm *kvm, int fd, int gsi, int flags);
+int kvm_irqfd(struct kvm *kvm, struct kvm_irqfd *args);
 void kvm_irqfd_release(struct kvm *kvm);
 void kvm_irq_routing_update(struct kvm *, struct kvm_irq_routing_table *);
 int kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args);
@@ -824,7 +824,7 @@ int kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args);
 static inline void kvm_eventfd_init(struct kvm *kvm) {}
-static inline int kvm_irqfd(struct kvm *kvm, int fd, int gsi, int flags)
+static inline int kvm_irqfd(struct kvm *kvm, struct kvm_irqfd *args)
 {
        return -EINVAL;
 }
diff --git a/include/linux/memblock.h b/include/linux/memblock.h
index a6bb10235148..19dc455b4f3d 100644
--- a/include/linux/memblock.h
+++ b/include/linux/memblock.h
@@ -50,9 +50,7 @@ phys_addr_t memblock_find_in_range_node(phys_addr_t start, phys_addr_t end,
                                phys_addr_t size, phys_addr_t align, int nid);
 phys_addr_t memblock_find_in_range(phys_addr_t start, phys_addr_t end,
                                   phys_addr_t size, phys_addr_t align);
-int memblock_free_reserved_regions(void);
+phys_addr_t get_allocated_memblock_reserved_regions_info(phys_addr_t *addr);
-int memblock_reserve_reserved_regions(void);
 void memblock_allow_resize(void);
 int memblock_add_node(phys_addr_t base, phys_addr_t size, int nid);
 int memblock_add(phys_addr_t base, phys_addr_t size);
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 2427706f78b4..68c569fcbb66 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -694,7 +694,7 @@ typedef struct pglist_data {
                                             range, including holes */
        int node_id;
        wait_queue_head_t kswapd_wait;
-        struct task_struct *kswapd;
+        struct task_struct *kswapd;     /* Protected by lock_memory_hotplug() */
        int kswapd_max_order;
        enum zone_type classzone_idx;
 } pg_data_t;
diff --git a/include/linux/pci.h b/include/linux/pci.h
index fefb4e19bf6a..d8c379dba6ad 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -176,8 +176,6 @@ enum pci_dev_flags {
        PCI_DEV_FLAGS_NO_D3 = (__force pci_dev_flags_t) 2,
        /* Provide indication device is assigned by a Virtual Machine Manager */
        PCI_DEV_FLAGS_ASSIGNED = (__force pci_dev_flags_t) 4,
-        /* Device causes system crash if in D3 during S3 sleep */
-        PCI_DEV_FLAGS_NO_D3_DURING_SLEEP = (__force pci_dev_flags_t) 8,
 };
 enum pci_irq_reroute_variant {
diff --git a/include/linux/prctl.h b/include/linux/prctl.h
index 3988012255dc..289760f424aa 100644
--- a/include/linux/prctl.h
+++ b/include/linux/prctl.h
@@ -141,6 +141,8 @@
 * Changing LSM security domain is considered a new privilege.  So, for example,
 * asking selinux for a specific new context (e.g. with runcon) will result
 * in execve returning -EPERM.
+ *
+ * See Documentation/prctl/no_new_privs.txt for more details.
 */
 #define PR_SET_NO_NEW_PRIVS     38
 #define PR_GET_NO_NEW_PRIVS     39
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 26d1a47591f1..9cac722b169c 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -184,7 +184,6 @@ static inline int rcu_preempt_depth(void)
 /* Internal to kernel */
 extern void rcu_sched_qs(int cpu);
 extern void rcu_bh_qs(int cpu);
-extern void rcu_preempt_note_context_switch(void);
 extern void rcu_check_callbacks(int cpu, int user);
 struct notifier_block;
 extern void rcu_idle_enter(void);
diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h
index 854dc4c5c271..4e56a9c69a35 100644
--- a/include/linux/rcutiny.h
+++ b/include/linux/rcutiny.h
@@ -87,6 +87,10 @@ static inline void kfree_call_rcu(struct rcu_head *head,
 #ifdef CONFIG_TINY_RCU
+static inline void rcu_preempt_note_context_switch(void)
+{
+}
 static inline int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies)
 {
        *delta_jiffies = ULONG_MAX;
@@ -95,6 +99,7 @@ static inline int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies)
 #else /* #ifdef CONFIG_TINY_RCU */
+void rcu_preempt_note_context_switch(void);
 int rcu_preempt_needs_cpu(void);
 static inline int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies)
@@ -108,6 +113,7 @@ static inline int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies)
 static inline void rcu_note_context_switch(int cpu)
 {
        rcu_sched_qs(cpu);
+        rcu_preempt_note_context_switch();
 }
 /*
diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h
index a8e50e44203c..82a673905edb 100644
--- a/include/linux/rpmsg.h
+++ b/include/linux/rpmsg.h
@@ -38,6 +38,8 @@
 #include <linux/types.h>
 #include <linux/device.h>
 #include <linux/mod_devicetable.h>
+#include <linux/kref.h>
+#include <linux/mutex.h>
 /* The feature bitmap for virtio rpmsg */
 #define VIRTIO_RPMSG_F_NS       0 /* RP supports name service notifications */
@@ -120,7 +122,9 @@ typedef void (*rpmsg_rx_cb_t)(struct rpmsg_channel *, void *, int, void *, u32);
 /**
 * struct rpmsg_endpoint - binds a local rpmsg address to its user
 * @rpdev: rpmsg channel device
+ * @refcount: when this drops to zero, the ept is deallocated
 * @cb: rx callback handler
+ * @cb_lock: must be taken before accessing/changing @cb
 * @addr: local rpmsg address
 * @priv: private data for the driver's use
 *
@@ -140,7 +144,9 @@ typedef void (*rpmsg_rx_cb_t)(struct rpmsg_channel *, void *, int, void *, u32);
 */
 struct rpmsg_endpoint {
        struct rpmsg_channel *rpdev;
+        struct kref refcount;
        rpmsg_rx_cb_t cb;
+        struct mutex cb_lock;
        u32 addr;
        void *priv;
 };
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 4059c0f33f07..4a1f493e0fef 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1871,22 +1871,12 @@ static inline void rcu_copy_process(struct task_struct *p)
        INIT_LIST_HEAD(&p->rcu_node_entry);
 }
-static inline void rcu_switch_from(struct task_struct *prev)
-{
-        if (prev->rcu_read_lock_nesting != 0)
-                rcu_preempt_note_context_switch();
-}
 #else
 static inline void rcu_copy_process(struct task_struct *p)
 {
 }
-static inline void rcu_switch_from(struct task_struct *prev)
-{
-}
 #endif
 #ifdef CONFIG_SMP
@@ -1909,6 +1899,14 @@ static inline int set_cpus_allowed_ptr(struct task_struct *p,
 }
 #endif
+#ifdef CONFIG_NO_HZ
+void calc_load_enter_idle(void);
+void calc_load_exit_idle(void);
+#else
+static inline void calc_load_enter_idle(void) { }
+static inline void calc_load_exit_idle(void) { }
+#endif /* CONFIG_NO_HZ */
 #ifndef CONFIG_CPUMASK_OFFSTACK
 static inline int set_cpus_allowed(struct task_struct *p, cpumask_t new_mask)
 {
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index b534a1be540a..642cb7355df3 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -225,14 +225,11 @@ enum {
        /* device driver is going to provide hardware time stamp */
        SKBTX_IN_PROGRESS = 1 << 2,
-        /* ensure the originating sk reference is available on driver level */
-        SKBTX_DRV_NEEDS_SK_REF = 1 << 3,
        /* device driver supports TX zero-copy buffers */
-        SKBTX_DEV_ZEROCOPY = 1 << 4,
+        SKBTX_DEV_ZEROCOPY = 1 << 3,
        /* generate wifi status information (where possible) */
-        SKBTX_WIFI_STATUS = 1 << 5,
+        SKBTX_WIFI_STATUS = 1 << 4,
 };
 /*
diff --git a/include/linux/splice.h b/include/linux/splice.h
index 26e5b613deda..09a545a7dfa3 100644
--- a/include/linux/splice.h
+++ b/include/linux/splice.h
@@ -51,7 +51,8 @@ struct partial_page {
 struct splice_pipe_desc {
        struct page **pages;            /* page map */
        struct partial_page *partial;   /* pages[] may not be contig */
-        int nr_pages;                   /* number of pages in map */
+        int nr_pages;                   /* number of populated pages in map */
+        unsigned int nr_pages_max;      /* pages[] & partial[] arrays size */
        unsigned int flags;             /* splice flags */
        const struct pipe_buf_operations *ops;/* ops associated with output pipe */
        void (*spd_release)(struct splice_pipe_desc *, unsigned int);
@@ -85,9 +86,8 @@ extern ssize_t splice_direct_to_actor(struct file *, struct splice_desc *,
 /*
 * for dynamic pipe sizing
 */
-extern int splice_grow_spd(struct pipe_inode_info *, struct splice_pipe_desc *);
+extern int splice_grow_spd(const struct pipe_inode_info *, struct splice_pipe_desc *);
-extern void splice_shrink_spd(struct pipe_inode_info *,
+extern void splice_shrink_spd(struct splice_pipe_desc *);
-                                struct splice_pipe_desc *);
 extern void spd_release_page(struct splice_pipe_desc *, unsigned int);
 extern const struct pipe_buf_operations page_cache_pipe_buf_ops;
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 66a7b579e31c..3def64ba77fa 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -1144,6 +1144,12 @@ struct extended_inquiry_info {
        __u8     data[240];
 } __packed;
+#define HCI_EV_KEY_REFRESH_COMPLETE     0x30
+struct hci_ev_key_refresh_complete {
+        __u8    status;
+        __le16  handle;
+} __packed;
 #define HCI_EV_IO_CAPA_REQUEST          0x31
 struct hci_ev_io_capa_request {
        bdaddr_t bdaddr;
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index d6146b4811c2..95374d1696a1 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -1425,7 +1425,7 @@ static inline void ip_vs_notrack(struct sk_buff *skb)
        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
        if (!ct || !nf_ct_is_untracked(ct)) {
-                nf_reset(skb);
+                nf_conntrack_put(skb->nfct);
                skb->nfct = &nf_ct_untracked_get()->ct_general;
                skb->nfctinfo = IP_CT_NEW;
                nf_conntrack_get(skb->nfct);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 1937c7d98304..95e39b6a02ec 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1940,6 +1940,11 @@ enum ieee80211_rate_control_changed {
 *      to also unregister the device. If it returns 1, then mac80211
 *      will also go through the regular complete restart on resume.
 *
+ * @set_wakeup: Enable or disable wakeup when WoWLAN configuration is
+ *      modified. The reason is that device_set_wakeup_enable() is
+ *      supposed to be called when the configuration changes, not only
+ *      in suspend().
+ *
 * @add_interface: Called when a netdevice attached to the hardware is
 *      enabled. Because it is not called for monitor mode devices, @start
 *      and @stop must be implemented.
@@ -2966,6 +2971,7 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 * ieee80211_generic_frame_duration - Calculate the duration field for a frame
 * @hw: pointer obtained from ieee80211_alloc_hw().
 * @vif: &struct ieee80211_vif pointer from the add_interface callback.
+ * @band: the band to calculate the frame duration on
 * @frame_len: the length of the frame.
 * @rate: the rate at which the frame is going to be transmitted.
 *
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h
index a88fb6939387..e1ce1048fe5f 100644
--- a/include/net/netfilter/nf_conntrack_ecache.h
+++ b/include/net/netfilter/nf_conntrack_ecache.h
@@ -78,7 +78,7 @@ nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
        struct net *net = nf_ct_net(ct);
        struct nf_conntrack_ecache *e;
-        if (net->ct.nf_conntrack_event_cb == NULL)
+        if (!rcu_access_pointer(net->ct.nf_conntrack_event_cb))
                return;
        e = nf_ct_ecache_find(ct);
diff --git a/include/net/phonet/gprs.h b/include/net/phonet/gprs.h
index 928daf595beb..bcd525e39a0b 100644
--- a/include/net/phonet/gprs.h
+++ b/include/net/phonet/gprs.h
@@ -5,7 +5,7 @@
 *
 * Copyright (C) 2008 Nokia Corporation.
 *
- * Author: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Author: Rémi Denis-Courmont
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index e4652fe58958..fecdf31816f2 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -912,6 +912,9 @@ struct sctp_transport {
                /* Is this structure kfree()able? */
                malloced:1;
+        /* Has this transport moved the ctsn since we last sacked */
+        __u32 sack_generation;
        struct flowi fl;
        /* This is the peer's IP address and port. */
@@ -1584,6 +1587,7 @@ struct sctp_association {
                 */
                __u8    sack_needed;     /* Do we need to sack the peer? */
                __u32   sack_cnt;
+                __u32   sack_generation;
                /* These are capabilities which our peer advertised.  */
                __u8    ecn_capable:1,      /* Can peer do ECN? */
diff --git a/include/net/sctp/tsnmap.h b/include/net/sctp/tsnmap.h
index e7728bc14ccf..2c5d2b4d5d1e 100644
--- a/include/net/sctp/tsnmap.h
+++ b/include/net/sctp/tsnmap.h
@@ -117,7 +117,8 @@ void sctp_tsnmap_free(struct sctp_tsnmap *map);
 int sctp_tsnmap_check(const struct sctp_tsnmap *, __u32 tsn);
 /* Mark this TSN as seen.  */
-int sctp_tsnmap_mark(struct sctp_tsnmap *, __u32 tsn);
+int sctp_tsnmap_mark(struct sctp_tsnmap *, __u32 tsn,
+                     struct sctp_transport *trans);
 /* Mark this TSN and all lower as seen. */
 void sctp_tsnmap_skip(struct sctp_tsnmap *map, __u32 tsn);
diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
index f4f1c96dca72..10ce74f589c5 100644
--- a/include/scsi/libsas.h
+++ b/include/scsi/libsas.h
@@ -163,6 +163,8 @@ enum ata_command_set {
        ATAPI_COMMAND_SET = 1,
 };
+#define ATA_RESP_FIS_SIZE 24
 struct sata_device {
        enum   ata_command_set command_set;
        struct smp_resp        rps_resp; /* report_phy_sata_resp */
@@ -171,7 +173,7 @@ struct sata_device {
        struct ata_port *ap;
        struct ata_host ata_host;
-        struct ata_taskfile tf;
+        u8     fis[ATA_RESP_FIS_SIZE];
 };
 enum {
@@ -537,7 +539,7 @@ enum exec_status {
 */
 struct ata_task_resp {
        u16  frame_len;
-        u8   ending_fis[24];      /* dev to host or data-in */
+        u8   ending_fis[ATA_RESP_FIS_SIZE];       /* dev to host or data-in */
 };
 #define SAS_STATUS_BUF_SIZE 96
diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h
index 1e1198546c72..ac06cc595890 100644
--- a/include/scsi/scsi_cmnd.h
+++ b/include/scsi/scsi_cmnd.h
@@ -134,10 +134,16 @@ struct scsi_cmnd {
 static inline struct scsi_driver *scsi_cmd_to_driver(struct scsi_cmnd *cmd)
 {
+        struct scsi_driver **sdp;
        if (!cmd->request->rq_disk)
                return NULL;
-        return *(struct scsi_driver **)cmd->request->rq_disk->private_data;
+        sdp = (struct scsi_driver **)cmd->request->rq_disk->private_data;
+        if (!sdp)
+                return NULL;
+        return *sdp;
 }
 extern struct scsi_cmnd *scsi_get_command(struct scsi_device *, gfp_t);
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 6efb2e1416e0..ba9698852321 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -151,6 +151,7 @@ struct scsi_device {
                                           SD_LAST_BUGGY_SECTORS */
        unsigned no_read_disc_info:1;   /* Avoid READ_DISC_INFO cmds */
        unsigned no_read_capacity_16:1; /* Avoid READ_CAPACITY_16 cmds */
+        unsigned try_rc_10_first:1;     /* Try READ_CAPACACITY_10 first */
        unsigned is_visible:1;  /* is the device visible in sysfs */
        DECLARE_BITMAP(supported_events, SDEV_EVT_MAXBITS); /* supported events */
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 2097684cf194..b303dfc7dce0 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -901,13 +901,10 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
                mutex_unlock(&cgroup_mutex);
                /*
-                 * We want to drop the active superblock reference from the
+                 * Drop the active superblock reference that we took when we
-                 * cgroup creation after all the dentry refs are gone -
+                 * created the cgroup
-                 * kill_sb gets mighty unhappy otherwise.  Mark
-                 * dentry->d_fsdata with cgroup_diput() to tell
-                 * cgroup_d_release() to call deactivate_super().
                 */
-                dentry->d_fsdata = cgroup_diput;
+                deactivate_super(cgrp->root->sb);
                /*
                 * if we're getting rid of the cgroup, refcount should ensure
@@ -933,13 +930,6 @@ static int cgroup_delete(const struct dentry *d)
        return 1;
 }
-static void cgroup_d_release(struct dentry *dentry)
-{
-        /* did cgroup_diput() tell me to deactivate super? */
-        if (dentry->d_fsdata == cgroup_diput)
-                deactivate_super(dentry->d_sb);
-}
 static void remove_dir(struct dentry *d)
 {
        struct dentry *parent = dget(d->d_parent);
@@ -1547,7 +1537,6 @@ static int cgroup_get_rootdir(struct super_block *sb)
        static const struct dentry_operations cgroup_dops = {
                .d_iput = cgroup_diput,
                .d_delete = cgroup_delete,
-                .d_release = cgroup_d_release,
        };
        struct inode *inode =
@@ -3894,8 +3883,12 @@ static void css_dput_fn(struct work_struct *work)
 {
        struct cgroup_subsys_state *css =
                container_of(work, struct cgroup_subsys_state, dput_work);
+        struct dentry *dentry = css->cgroup->dentry;
+        struct super_block *sb = dentry->d_sb;
-        dput(css->cgroup->dentry);
+        atomic_inc(&sb->s_active);
+        dput(dentry);
+        deactivate_super(sb);
 }
 static void init_cgroup_css(struct cgroup_subsys_state *css,
diff --git a/kernel/fork.c b/kernel/fork.c
index ab5211b9e622..f00e319d8376 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -304,12 +304,17 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
        }
        err = arch_dup_task_struct(tsk, orig);
-        if (err)
-                goto out;
+        /*
+         * We defer looking at err, because we will need this setup
+         * for the clean up path to work correctly.
+         */
        tsk->stack = ti;
        setup_thread_stack(tsk, orig);
+        if (err)
+                goto out;
        clear_user_return_notifier(tsk);
        clear_tsk_need_resched(tsk);
        stackend = end_of_stack(tsk);
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index ae34bf51682b..6db7a5ed52b5 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -657,6 +657,14 @@ static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
        return 0;
 }
+static inline ktime_t hrtimer_update_base(struct hrtimer_cpu_base *base)
+{
+        ktime_t *offs_real = &base->clock_base[HRTIMER_BASE_REALTIME].offset;
+        ktime_t *offs_boot = &base->clock_base[HRTIMER_BASE_BOOTTIME].offset;
+        return ktime_get_update_offsets(offs_real, offs_boot);
+}
 /*
 * Retrigger next event is called after clock was set
 *
@@ -665,22 +673,12 @@ static inline int hrtimer_enqueue_reprogram(struct hrtimer *timer,
 static void retrigger_next_event(void *arg)
 {
        struct hrtimer_cpu_base *base = &__get_cpu_var(hrtimer_bases);
-        struct timespec realtime_offset, xtim, wtm, sleep;
        if (!hrtimer_hres_active())
                return;
-        /* Optimized out for !HIGH_RES */
-        get_xtime_and_monotonic_and_sleep_offset(&xtim, &wtm, &sleep);
-        set_normalized_timespec(&realtime_offset, -wtm.tv_sec, -wtm.tv_nsec);
-        /* Adjust CLOCK_REALTIME offset */
        raw_spin_lock(&base->lock);
-        base->clock_base[HRTIMER_BASE_REALTIME].offset =
+        hrtimer_update_base(base);
-                timespec_to_ktime(realtime_offset);
-        base->clock_base[HRTIMER_BASE_BOOTTIME].offset =
-                timespec_to_ktime(sleep);
        hrtimer_force_reprogram(base, 0);
        raw_spin_unlock(&base->lock);
 }
@@ -710,13 +708,25 @@ static int hrtimer_switch_to_hres(void)
                base->clock_base[i].resolution = KTIME_HIGH_RES;
        tick_setup_sched_timer();
        /* "Retrigger" the interrupt to get things going */
        retrigger_next_event(NULL);
        local_irq_restore(flags);
        return 1;
 }
+/*
+ * Called from timekeeping code to reprogramm the hrtimer interrupt
+ * device. If called from the timer interrupt context we defer it to
+ * softirq context.
+ */
+void clock_was_set_delayed(void)
+{
+        struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
+        cpu_base->clock_was_set = 1;
+        __raise_softirq_irqoff(HRTIMER_SOFTIRQ);
+}
 #else
 static inline int hrtimer_hres_active(void) { return 0; }
@@ -1250,11 +1260,10 @@ void hrtimer_interrupt(struct clock_event_device *dev)
        cpu_base->nr_events++;
        dev->next_event.tv64 = KTIME_MAX;
-        entry_time = now = ktime_get();
+        raw_spin_lock(&cpu_base->lock);
+        entry_time = now = hrtimer_update_base(cpu_base);
 retry:
        expires_next.tv64 = KTIME_MAX;
-        raw_spin_lock(&cpu_base->lock);
        /*
         * We set expires_next to KTIME_MAX here with cpu_base->lock
         * held to prevent that a timer is enqueued in our queue via
@@ -1330,8 +1339,12 @@ retry:
         * We need to prevent that we loop forever in the hrtimer
         * interrupt routine. We give it 3 attempts to avoid
         * overreacting on some spurious event.
+         *
+         * Acquire base lock for updating the offsets and retrieving
+         * the current time.
         */
-        now = ktime_get();
+        raw_spin_lock(&cpu_base->lock);
+        now = hrtimer_update_base(cpu_base);
        cpu_base->nr_retries++;
        if (++retries < 3)
                goto retry;
@@ -1343,6 +1356,7 @@ retry:
         */
        cpu_base->nr_hangs++;
        cpu_base->hang_detected = 1;
+        raw_spin_unlock(&cpu_base->lock);
        delta = ktime_sub(now, entry_time);
        if (delta.tv64 > cpu_base->max_hang_time.tv64)
                cpu_base->max_hang_time = delta;
@@ -1395,6 +1409,13 @@ void hrtimer_peek_ahead_timers(void)
 static void run_hrtimer_softirq(struct softirq_action *h)
 {
+        struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
+        if (cpu_base->clock_was_set) {
+                cpu_base->clock_was_set = 0;
+                clock_was_set();
+        }
        hrtimer_peek_ahead_timers();
 }
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index 8b53db38a279..238025f5472e 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -27,7 +27,6 @@
 #include <linux/syscore_ops.h>
 #include <linux/ctype.h>
 #include <linux/genhd.h>
-#include <scsi/scsi_scan.h>
 #include "power.h"
@@ -748,13 +747,6 @@ static int software_resume(void)
                        async_synchronize_full();
                }
-                /*
-                 * We can't depend on SCSI devices being available after loading
-                 * one of their modules until scsi_complete_async_scans() is
-                 * called and the resume device usually is a SCSI one.
-                 */
-                scsi_complete_async_scans();
                swsusp_resume_device = name_to_dev_t(resume_file);
                if (!swsusp_resume_device) {
                        error = -ENODEV;
diff --git a/kernel/power/user.c b/kernel/power/user.c
index 91b0fd021a95..4ed81e74f86f 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -24,7 +24,6 @@
 #include <linux/console.h>
 #include <linux/cpu.h>
 #include <linux/freezer.h>
-#include <scsi/scsi_scan.h>
 #include <asm/uaccess.h>
@@ -84,7 +83,6 @@ static int snapshot_open(struct inode *inode, struct file *filp)
                 * appear.
                 */
                wait_for_device_probe();
-                scsi_complete_async_scans();
                data->swap = -1;
                data->mode = O_WRONLY;
diff --git a/kernel/printk.c b/kernel/printk.c
index a2276b916769..177fa49357a5 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -193,12 +193,21 @@ static int console_may_schedule;
 * separated by ',', and find the message after the ';' character.
 */
+enum log_flags {
+        LOG_NOCONS      = 1,    /* already flushed, do not print to console */
+        LOG_NEWLINE     = 2,    /* text ended with a newline */
+        LOG_PREFIX      = 4,    /* text started with a prefix */
+        LOG_CONT        = 8,    /* text is a fragment of a continuation line */
+};
 struct log {
        u64 ts_nsec;            /* timestamp in nanoseconds */
        u16 len;                /* length of entire record */
        u16 text_len;           /* length of text buffer */
        u16 dict_len;           /* length of dictionary buffer */
-        u16 level;              /* syslog level + facility */
+        u8 facility;            /* syslog facility */
+        u8 flags:5;             /* internal record flags */
+        u8 level:3;             /* syslog level */
 };
 /*
@@ -210,6 +219,8 @@ static DEFINE_RAW_SPINLOCK(logbuf_lock);
 /* the next printk record to read by syslog(READ) or /proc/kmsg */
 static u64 syslog_seq;
 static u32 syslog_idx;
+static enum log_flags syslog_prev;
+static size_t syslog_partial;
 /* index and sequence number of the first record stored in the buffer */
 static u64 log_first_seq;
@@ -286,6 +297,7 @@ static u32 log_next(u32 idx)
 /* insert record into the buffer, discard old ones, update heads */
 static void log_store(int facility, int level,
+                      enum log_flags flags, u64 ts_nsec,
                      const char *dict, u16 dict_len,
                      const char *text, u16 text_len)
 {
@@ -329,8 +341,13 @@ static void log_store(int facility, int level,
        msg->text_len = text_len;
        memcpy(log_dict(msg), dict, dict_len);
        msg->dict_len = dict_len;
-        msg->level = (facility << 3) | (level & 7);
+        msg->facility = facility;
-        msg->ts_nsec = local_clock();
+        msg->level = level & 7;
+        msg->flags = flags & 0x1f;
+        if (ts_nsec > 0)
+                msg->ts_nsec = ts_nsec;
+        else
+                msg->ts_nsec = local_clock();
        memset(log_dict(msg) + dict_len, 0, pad_len);
        msg->len = sizeof(struct log) + text_len + dict_len + pad_len;
@@ -417,20 +434,20 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
        ret = mutex_lock_interruptible(&user->lock);
        if (ret)
                return ret;
-        raw_spin_lock(&logbuf_lock);
+        raw_spin_lock_irq(&logbuf_lock);
        while (user->seq == log_next_seq) {
                if (file->f_flags & O_NONBLOCK) {
                        ret = -EAGAIN;
-                        raw_spin_unlock(&logbuf_lock);
+                        raw_spin_unlock_irq(&logbuf_lock);
                        goto out;
                }
-                raw_spin_unlock(&logbuf_lock);
+                raw_spin_unlock_irq(&logbuf_lock);
                ret = wait_event_interruptible(log_wait,
                                               user->seq != log_next_seq);
                if (ret)
                        goto out;
-                raw_spin_lock(&logbuf_lock);
+                raw_spin_lock_irq(&logbuf_lock);
        }
        if (user->seq < log_first_seq) {
@@ -438,7 +455,7 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
                user->idx = log_first_idx;
                user->seq = log_first_seq;
                ret = -EPIPE;
-                raw_spin_unlock(&logbuf_lock);
+                raw_spin_unlock_irq(&logbuf_lock);
                goto out;
        }
@@ -446,13 +463,13 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
        ts_usec = msg->ts_nsec;
        do_div(ts_usec, 1000);
        len = sprintf(user->buf, "%u,%llu,%llu;",
-                      msg->level, user->seq, ts_usec);
+                      (msg->facility << 3) | msg->level, user->seq, ts_usec);
        /* escape non-printable characters */
        for (i = 0; i < msg->text_len; i++) {
                unsigned char c = log_text(msg)[i];
-                if (c < ' ' || c >= 128)
+                if (c < ' ' || c >= 127 || c == '\\')
                        len += sprintf(user->buf + len, "\\x%02x", c);
                else
                        user->buf[len++] = c;
@@ -476,7 +493,7 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
                                continue;
                        }
-                        if (c < ' ' || c >= 128) {
+                        if (c < ' ' || c >= 127 || c == '\\') {
                                len += sprintf(user->buf + len, "\\x%02x", c);
                                continue;
                        }
@@ -488,7 +505,7 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
        user->idx = log_next(user->idx);
        user->seq++;
-        raw_spin_unlock(&logbuf_lock);
+        raw_spin_unlock_irq(&logbuf_lock);
        if (len > count) {
                ret = -EINVAL;
@@ -515,7 +532,7 @@ static loff_t devkmsg_llseek(struct file *file, loff_t offset, int whence)
        if (offset)
                return -ESPIPE;
-        raw_spin_lock(&logbuf_lock);
+        raw_spin_lock_irq(&logbuf_lock);
        switch (whence) {
        case SEEK_SET:
                /* the first record */
@@ -539,7 +556,7 @@ static loff_t devkmsg_llseek(struct file *file, loff_t offset, int whence)
        default:
                ret = -EINVAL;
        }
-        raw_spin_unlock(&logbuf_lock);
+        raw_spin_unlock_irq(&logbuf_lock);
        return ret;
 }
@@ -553,14 +570,14 @@ static unsigned int devkmsg_poll(struct file *file, poll_table *wait)
        poll_wait(file, &log_wait, wait);
-        raw_spin_lock(&logbuf_lock);
+        raw_spin_lock_irq(&logbuf_lock);
        if (user->seq < log_next_seq) {
                /* return error when data has vanished underneath us */
                if (user->seq < log_first_seq)
                        ret = POLLIN|POLLRDNORM|POLLERR|POLLPRI;
                ret = POLLIN|POLLRDNORM;
        }
-        raw_spin_unlock(&logbuf_lock);
+        raw_spin_unlock_irq(&logbuf_lock);
        return ret;
 }
@@ -584,10 +601,10 @@ static int devkmsg_open(struct inode *inode, struct file *file)
        mutex_init(&user->lock);
-        raw_spin_lock(&logbuf_lock);
+        raw_spin_lock_irq(&logbuf_lock);
        user->idx = log_first_idx;
        user->seq = log_first_seq;
-        raw_spin_unlock(&logbuf_lock);
+        raw_spin_unlock_irq(&logbuf_lock);
        file->private_data = user;
        return 0;
@@ -787,44 +804,64 @@ static bool printk_time;
 #endif
 module_param_named(time, printk_time, bool, S_IRUGO | S_IWUSR);
+static size_t print_time(u64 ts, char *buf)
+{
+        unsigned long rem_nsec;
+        if (!printk_time)
+                return 0;
+        if (!buf)
+                return 15;
+        rem_nsec = do_div(ts, 1000000000);
+        return sprintf(buf, "[%5lu.%06lu] ",
+                       (unsigned long)ts, rem_nsec / 1000);
+}
 static size_t print_prefix(const struct log *msg, bool syslog, char *buf)
 {
        size_t len = 0;
+        unsigned int prefix = (msg->facility << 3) | msg->level;
        if (syslog) {
                if (buf) {
-                        len += sprintf(buf, "<%u>", msg->level);
+                        len += sprintf(buf, "<%u>", prefix);
                } else {
                        len += 3;
-                        if (msg->level > 9)
+                        if (prefix > 999)
-                                len++;
+                                len += 3;
-                        if (msg->level > 99)
+                        else if (prefix > 99)
+                                len += 2;
+                        else if (prefix > 9)
                                len++;
                }
        }
-        if (printk_time) {
+        len += print_time(msg->ts_nsec, buf ? buf + len : NULL);
-                if (buf) {
-                        unsigned long long ts = msg->ts_nsec;
-                        unsigned long rem_nsec = do_div(ts, 1000000000);
-                        len += sprintf(buf + len, "[%5lu.%06lu] ",
-                                         (unsigned long) ts, rem_nsec / 1000);
-                } else {
-                        len += 15;
-                }
-        }
        return len;
 }
-static size_t msg_print_text(const struct log *msg, bool syslog,
+static size_t msg_print_text(const struct log *msg, enum log_flags prev,
-                             char *buf, size_t size)
+                             bool syslog, char *buf, size_t size)
 {
        const char *text = log_text(msg);
        size_t text_size = msg->text_len;
+        bool prefix = true;
+        bool newline = true;
        size_t len = 0;
+        if ((prev & LOG_CONT) && !(msg->flags & LOG_PREFIX))
+                prefix = false;
+        if (msg->flags & LOG_CONT) {
+                if ((prev & LOG_CONT) && !(prev & LOG_NEWLINE))
+                        prefix = false;
+                if (!(msg->flags & LOG_NEWLINE))
+                        newline = false;
+        }
        do {
                const char *next = memchr(text, '\n', text_size);
                size_t text_len;
@@ -842,16 +879,22 @@ static size_t msg_print_text(const struct log *msg, bool syslog,
                            text_len + 1>= size - len)
                                break;
-                        len += print_prefix(msg, syslog, buf + len);
+                        if (prefix)
+                                len += print_prefix(msg, syslog, buf + len);
                        memcpy(buf + len, text, text_len);
                        len += text_len;
-                        buf[len++] = '\n';
+                        if (next || newline)
+                                buf[len++] = '\n';
                } else {
                        /* SYSLOG_ACTION_* buffer size only calculation */
-                        len += print_prefix(msg, syslog, NULL);
+                        if (prefix)
-                        len += text_len + 1;
+                                len += print_prefix(msg, syslog, NULL);
+                        len += text_len;
+                        if (next || newline)
+                                len++;
                }
+                prefix = true;
                text = next;
        } while (text);
@@ -862,28 +905,60 @@ static int syslog_print(char __user *buf, int size)
 {
        char *text;
        struct log *msg;
-        int len;
+        int len = 0;
        text = kmalloc(LOG_LINE_MAX, GFP_KERNEL);
        if (!text)
                return -ENOMEM;
-        raw_spin_lock_irq(&logbuf_lock);
+        while (size > 0) {
-        if (syslog_seq < log_first_seq) {
+                size_t n;
-                /* messages are gone, move to first one */
+                size_t skip;
-                syslog_seq = log_first_seq;
-                syslog_idx = log_first_idx;
-        }
-        msg = log_from_idx(syslog_idx);
-        len = msg_print_text(msg, true, text, LOG_LINE_MAX);
-        syslog_idx = log_next(syslog_idx);
-        syslog_seq++;
-        raw_spin_unlock_irq(&logbuf_lock);
-        if (len > size)
+                raw_spin_lock_irq(&logbuf_lock);
-                len = -EINVAL;
+                if (syslog_seq < log_first_seq) {
-        else if (len > 0 && copy_to_user(buf, text, len))
+                        /* messages are gone, move to first one */
-                len = -EFAULT;
+                        syslog_seq = log_first_seq;
+                        syslog_idx = log_first_idx;
+                        syslog_prev = 0;
+                        syslog_partial = 0;
+                }
+                if (syslog_seq == log_next_seq) {
+                        raw_spin_unlock_irq(&logbuf_lock);
+                        break;
+                }
+                skip = syslog_partial;
+                msg = log_from_idx(syslog_idx);
+                n = msg_print_text(msg, syslog_prev, true, text, LOG_LINE_MAX);
+                if (n - syslog_partial <= size) {
+                        /* message fits into buffer, move forward */
+                        syslog_idx = log_next(syslog_idx);
+                        syslog_seq++;
+                        syslog_prev = msg->flags;
+                        n -= syslog_partial;
+                        syslog_partial = 0;
+                } else if (!len){
+                        /* partial read(), remember position */
+                        n = size;
+                        syslog_partial += n;
+                } else
+                        n = 0;
+                raw_spin_unlock_irq(&logbuf_lock);
+                if (!n)
+                        break;
+                if (copy_to_user(buf, text + skip, n)) {
+                        if (!len)
+                                len = -EFAULT;
+                        break;
+                }
+                len += n;
+                size -= n;
+                buf += n;
+        }
        kfree(text);
        return len;
@@ -903,6 +978,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                u64 next_seq;
                u64 seq;
                u32 idx;
+                enum log_flags prev;
                if (clear_seq < log_first_seq) {
                        /* messages are gone, move to first available one */
@@ -916,10 +992,11 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                 */
                seq = clear_seq;
                idx = clear_idx;
+                prev = 0;
                while (seq < log_next_seq) {
                        struct log *msg = log_from_idx(idx);
-                        len += msg_print_text(msg, true, NULL, 0);
+                        len += msg_print_text(msg, prev, true, NULL, 0);
                        idx = log_next(idx);
                        seq++;
                }
@@ -927,10 +1004,11 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                /* move first record forward until length fits into the buffer */
                seq = clear_seq;
                idx = clear_idx;
+                prev = 0;
                while (len > size && seq < log_next_seq) {
                        struct log *msg = log_from_idx(idx);
-                        len -= msg_print_text(msg, true, NULL, 0);
+                        len -= msg_print_text(msg, prev, true, NULL, 0);
                        idx = log_next(idx);
                        seq++;
                }
@@ -939,17 +1017,19 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                next_seq = log_next_seq;
                len = 0;
+                prev = 0;
                while (len >= 0 && seq < next_seq) {
                        struct log *msg = log_from_idx(idx);
                        int textlen;
-                        textlen = msg_print_text(msg, true, text, LOG_LINE_MAX);
+                        textlen = msg_print_text(msg, prev, true, text, LOG_LINE_MAX);
                        if (textlen < 0) {
                                len = textlen;
                                break;
                        }
                        idx = log_next(idx);
                        seq++;
+                        prev = msg->flags;
                        raw_spin_unlock_irq(&logbuf_lock);
                        if (copy_to_user(buf + len, text, textlen))
@@ -962,6 +1042,7 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
                                /* messages are gone, move to next one */
                                seq = log_first_seq;
                                idx = log_first_idx;
+                                prev = 0;
                        }
                }
        }
@@ -980,7 +1061,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
 {
        bool clear = false;
        static int saved_console_loglevel = -1;
-        static DEFINE_MUTEX(syslog_mutex);
        int error;
        error = check_syslog_permissions(type, from_file);
@@ -1007,17 +1087,11 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
                        error = -EFAULT;
                        goto out;
                }
-                error = mutex_lock_interruptible(&syslog_mutex);
-                if (error)
-                        goto out;
                error = wait_event_interruptible(log_wait,
                                                 syslog_seq != log_next_seq);
-                if (error) {
+                if (error)
-                        mutex_unlock(&syslog_mutex);
                        goto out;
-                }
                error = syslog_print(buf, len);
-                mutex_unlock(&syslog_mutex);
                break;
        /* Read/clear last kernel messages */
        case SYSLOG_ACTION_READ_CLEAR:
@@ -1040,6 +1114,7 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
        /* Clear ring buffer */
        case SYSLOG_ACTION_CLEAR:
                syslog_print_all(NULL, 0, true);
+                break;
        /* Disable logging to console */
        case SYSLOG_ACTION_CONSOLE_OFF:
                if (saved_console_loglevel == -1)
@@ -1072,6 +1147,8 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
                        /* messages are gone, move to first one */
                        syslog_seq = log_first_seq;
                        syslog_idx = log_first_idx;
+                        syslog_prev = 0;
+                        syslog_partial = 0;
                }
                if (from_file) {
                        /*
@@ -1081,19 +1158,20 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
                         */
                        error = log_next_idx - syslog_idx;
                } else {
-                        u64 seq;
+                        u64 seq = syslog_seq;
-                        u32 idx;
+                        u32 idx = syslog_idx;
+                        enum log_flags prev = syslog_prev;
                        error = 0;
-                        seq = syslog_seq;
-                        idx = syslog_idx;
                        while (seq < log_next_seq) {
                                struct log *msg = log_from_idx(idx);
-                                error += msg_print_text(msg, true, NULL, 0);
+                                error += msg_print_text(msg, prev, true, NULL, 0);
                                idx = log_next(idx);
                                seq++;
+                                prev = msg->flags;
                        }
+                        error -= syslog_partial;
                }
                raw_spin_unlock_irq(&logbuf_lock);
                break;
@@ -1272,22 +1350,98 @@ static inline void printk_delay(void)
        }
 }
+/*
+ * Continuation lines are buffered, and not committed to the record buffer
+ * until the line is complete, or a race forces it. The line fragments
+ * though, are printed immediately to the consoles to ensure everything has
+ * reached the console in case of a kernel crash.
+ */
+static struct cont {
+        char buf[LOG_LINE_MAX];
+        size_t len;                     /* length == 0 means unused buffer */
+        size_t cons;                    /* bytes written to console */
+        struct task_struct *owner;      /* task of first print*/
+        u64 ts_nsec;                    /* time of first print */
+        u8 level;                       /* log level of first message */
+        u8 facility;                    /* log level of first message */
+        bool flushed:1;                 /* buffer sealed and committed */
+} cont;
+static void cont_flush(void)
+{
+        if (cont.flushed)
+                return;
+        if (cont.len == 0)
+                return;
+        log_store(cont.facility, cont.level, LOG_NOCONS, cont.ts_nsec,
+                  NULL, 0, cont.buf, cont.len);
+        cont.flushed = true;
+}
+static bool cont_add(int facility, int level, const char *text, size_t len)
+{
+        if (cont.len && cont.flushed)
+                return false;
+        if (cont.len + len > sizeof(cont.buf)) {
+                cont_flush();
+                return false;
+        }
+        if (!cont.len) {
+                cont.facility = facility;
+                cont.level = level;
+                cont.owner = current;
+                cont.ts_nsec = local_clock();
+                cont.cons = 0;
+                cont.flushed = false;
+        }
+        memcpy(cont.buf + cont.len, text, len);
+        cont.len += len;
+        return true;
+}
+static size_t cont_print_text(char *text, size_t size)
+{
+        size_t textlen = 0;
+        size_t len;
+        if (cont.cons == 0) {
+                textlen += print_time(cont.ts_nsec, text);
+                size -= textlen;
+        }
+        len = cont.len - cont.cons;
+        if (len > 0) {
+                if (len+1 > size)
+                        len = size-1;
+                memcpy(text + textlen, cont.buf + cont.cons, len);
+                textlen += len;
+                cont.cons = cont.len;
+        }
+        if (cont.flushed) {
+                text[textlen++] = '\n';
+                /* got everything, release buffer */
+                cont.len = 0;
+        }
+        return textlen;
+}
 asmlinkage int vprintk_emit(int facility, int level,
                            const char *dict, size_t dictlen,
                            const char *fmt, va_list args)
 {
        static int recursion_bug;
-        static char cont_buf[LOG_LINE_MAX];
-        static size_t cont_len;
-        static int cont_level;
-        static struct task_struct *cont_task;
        static char textbuf[LOG_LINE_MAX];
        char *text = textbuf;
        size_t text_len;
+        enum log_flags lflags = 0;
        unsigned long flags;
        int this_cpu;
-        bool newline = false;
-        bool prefix = false;
        int printed_len = 0;
        boot_delay_msec();
@@ -1326,7 +1480,8 @@ asmlinkage int vprintk_emit(int facility, int level,
                recursion_bug = 0;
                printed_len += strlen(recursion_msg);
                /* emit KERN_CRIT message */
-                log_store(0, 2, NULL, 0, recursion_msg, printed_len);
+                log_store(0, 2, LOG_PREFIX|LOG_NEWLINE, 0,
+                          NULL, 0, recursion_msg, printed_len);
        }
        /*
@@ -1338,7 +1493,7 @@ asmlinkage int vprintk_emit(int facility, int level,
        /* mark and strip a trailing newline */
        if (text_len && text[text_len-1] == '\n') {
                text_len--;
-                newline = true;
+                lflags |= LOG_NEWLINE;
        }
        /* strip syslog prefix and extract log level or control flags */
@@ -1348,7 +1503,7 @@ asmlinkage int vprintk_emit(int facility, int level,
                        if (level == -1)
                                level = text[1] - '0';
                case 'd':       /* KERN_DEFAULT */
-                        prefix = true;
+                        lflags |= LOG_PREFIX;
                case 'c':       /* KERN_CONT */
                        text += 3;
                        text_len -= 3;
@@ -1358,61 +1513,41 @@ asmlinkage int vprintk_emit(int facility, int level,
        if (level == -1)
                level = default_message_loglevel;
-        if (dict) {
+        if (dict)
-                prefix = true;
+                lflags |= LOG_PREFIX|LOG_NEWLINE;
-                newline = true;
-        }
-        if (!newline) {
+        if (!(lflags & LOG_NEWLINE)) {
-                if (cont_len && (prefix || cont_task != current)) {
+                /*
-                        /*
+                 * Flush the conflicting buffer. An earlier newline was missing,
-                         * Flush earlier buffer, which is either from a
+                 * or another task also prints continuation lines.
-                         * different thread, or when we got a new prefix.
+                 */
-                         */
+                if (cont.len && (lflags & LOG_PREFIX || cont.owner != current))
-                        log_store(facility, cont_level, NULL, 0, cont_buf, cont_len);
+                        cont_flush();
-                        cont_len = 0;
-                }
-                if (!cont_len) {
-                        cont_level = level;
-                        cont_task = current;
-                }
-                /* buffer or append to earlier buffer from the same thread */
+                /* buffer line if possible, otherwise store it right away */
-                if (cont_len + text_len > sizeof(cont_buf))
+                if (!cont_add(facility, level, text, text_len))
-                        text_len = sizeof(cont_buf) - cont_len;
+                        log_store(facility, level, lflags | LOG_CONT, 0,
-                memcpy(cont_buf + cont_len, text, text_len);
+                                  dict, dictlen, text, text_len);
-                cont_len += text_len;
        } else {
-                if (cont_len && cont_task == current) {
+                bool stored = false;
-                        if (prefix) {
-                                /*
-                                 * New prefix from the same thread; flush. We
-                                 * either got no earlier newline, or we race
-                                 * with an interrupt.
-                                 */
-                                log_store(facility, cont_level,
-                                          NULL, 0, cont_buf, cont_len);
-                                cont_len = 0;
-                        }
-                        /* append to the earlier buffer and flush */
+                /*
-                        if (cont_len + text_len > sizeof(cont_buf))
+                 * If an earlier newline was missing and it was the same task,
-                                text_len = sizeof(cont_buf) - cont_len;
+                 * either merge it with the current buffer and flush, or if
-                        memcpy(cont_buf + cont_len, text, text_len);
+                 * there was a race with interrupts (prefix == true) then just
-                        cont_len += text_len;
+                 * flush it out and store this line separately.
-                        log_store(facility, cont_level,
+                 */
-                                  NULL, 0, cont_buf, cont_len);
+                if (cont.len && cont.owner == current) {
-                        cont_len = 0;
+                        if (!(lflags & LOG_PREFIX))
-                        cont_task = NULL;
+                                stored = cont_add(facility, level, text, text_len);
-                        printed_len = cont_len;
+                        cont_flush();
-                } else {
-                        /* ordinary single and terminated line */
-                        log_store(facility, level,
-                                  dict, dictlen, text, text_len);
-                        printed_len = text_len;
                }
+                if (!stored)
+                        log_store(facility, level, lflags, 0,
+                                  dict, dictlen, text, text_len);
        }
+        printed_len += text_len;
        /*
         * Try to acquire and then immediately release the console semaphore.
@@ -1499,11 +1634,18 @@ EXPORT_SYMBOL(printk);
 #else
 #define LOG_LINE_MAX 0
+static struct cont {
+        size_t len;
+        size_t cons;
+        u8 level;
+        bool flushed:1;
+} cont;
 static struct log *log_from_idx(u32 idx) { return NULL; }
 static u32 log_next(u32 idx) { return 0; }
 static void call_console_drivers(int level, const char *text, size_t len) {}
-static size_t msg_print_text(const struct log *msg, bool syslog,
+static size_t msg_print_text(const struct log *msg, enum log_flags prev,
-                             char *buf, size_t size) { return 0; }
+                             bool syslog, char *buf, size_t size) { return 0; }
+static size_t cont_print_text(char *text, size_t size) { return 0; }
 #endif /* CONFIG_PRINTK */
@@ -1778,6 +1920,7 @@ void wake_up_klogd(void)
 /* the next printk record to write to the console */
 static u64 console_seq;
 static u32 console_idx;
+static enum log_flags console_prev;
 /**
 * console_unlock - unlock the console system
@@ -1795,6 +1938,7 @@ static u32 console_idx;
 */
 void console_unlock(void)
 {
+        static char text[LOG_LINE_MAX];
        static u64 seen_seq;
        unsigned long flags;
        bool wake_klogd = false;
@@ -1807,10 +1951,23 @@ void console_unlock(void)
        console_may_schedule = 0;
+        /* flush buffered message fragment immediately to console */
+        raw_spin_lock_irqsave(&logbuf_lock, flags);
+        if (cont.len && (cont.cons < cont.len || cont.flushed)) {
+                size_t len;
+                len = cont_print_text(text, sizeof(text));
+                raw_spin_unlock(&logbuf_lock);
+                stop_critical_timings();
+                call_console_drivers(cont.level, text, len);
+                start_critical_timings();
+                local_irq_restore(flags);
+        } else
+                raw_spin_unlock_irqrestore(&logbuf_lock, flags);
 again:
        for (;;) {
                struct log *msg;
-                static char text[LOG_LINE_MAX];
                size_t len;
                int level;
@@ -1824,18 +1981,35 @@ again:
                        /* messages are gone, move to first one */
                        console_seq = log_first_seq;
                        console_idx = log_first_idx;
+                        console_prev = 0;
                }
+skip:
                if (console_seq == log_next_seq)
                        break;
                msg = log_from_idx(console_idx);
-                level = msg->level & 7;
+                if (msg->flags & LOG_NOCONS) {
+                        /*
-                len = msg_print_text(msg, false, text, sizeof(text));
+                         * Skip record we have buffered and already printed
+                         * directly to the console when we received it.
+                         */
+                        console_idx = log_next(console_idx);
+                        console_seq++;
+                        /*
+                         * We will get here again when we register a new
+                         * CON_PRINTBUFFER console. Clear the flag so we
+                         * will properly dump everything later.
+                         */
+                        msg->flags &= ~LOG_NOCONS;
+                        goto skip;
+                }
+                level = msg->level;
+                len = msg_print_text(msg, console_prev, false,
+                                     text, sizeof(text));
                console_idx = log_next(console_idx);
                console_seq++;
+                console_prev = msg->flags;
                raw_spin_unlock(&logbuf_lock);
                stop_critical_timings();        /* don't trace print latency */
@@ -2098,6 +2272,7 @@ void register_console(struct console *newcon)
                raw_spin_lock_irqsave(&logbuf_lock, flags);
                console_seq = syslog_seq;
                console_idx = syslog_idx;
+                console_prev = syslog_prev;
                raw_spin_unlock_irqrestore(&logbuf_lock, flags);
                /*
                 * We're about to replay the log buffer.  Only do this to the
@@ -2391,8 +2566,7 @@ bool kmsg_dump_get_line(struct kmsg_dumper *dumper, bool syslog,
        }
        msg = log_from_idx(dumper->cur_idx);
-        l = msg_print_text(msg, syslog,
+        l = msg_print_text(msg, 0, syslog, line, size);
-                              line, size);
        dumper->cur_idx = log_next(dumper->cur_idx);
        dumper->cur_seq++;
@@ -2409,7 +2583,7 @@ EXPORT_SYMBOL_GPL(kmsg_dump_get_line);
 * kmsg_dump_get_buffer - copy kmsg log lines
 * @dumper: registered kmsg dumper
 * @syslog: include the "<4>" prefixes
- * @line: buffer to copy the line to
+ * @buf: buffer to copy the line to
 * @size: maximum size of the buffer
 * @len: length of line placed into buffer
 *
@@ -2432,6 +2606,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
        u32 idx;
        u64 next_seq;
        u32 next_idx;
+        enum log_flags prev;
        size_t l = 0;
        bool ret = false;
@@ -2454,23 +2629,27 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
        /* calculate length of entire buffer */
        seq = dumper->cur_seq;
        idx = dumper->cur_idx;
+        prev = 0;
        while (seq < dumper->next_seq) {
                struct log *msg = log_from_idx(idx);
-                l += msg_print_text(msg, true, NULL, 0);
+                l += msg_print_text(msg, prev, true, NULL, 0);
                idx = log_next(idx);
                seq++;
+                prev = msg->flags;
        }
        /* move first record forward until length fits into the buffer */
        seq = dumper->cur_seq;
        idx = dumper->cur_idx;
+        prev = 0;
        while (l > size && seq < dumper->next_seq) {
                struct log *msg = log_from_idx(idx);
-                l -= msg_print_text(msg, true, NULL, 0);
+                l -= msg_print_text(msg, prev, true, NULL, 0);
                idx = log_next(idx);
                seq++;
+                prev = msg->flags;
        }
        /* last message in next interation */
@@ -2478,14 +2657,14 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
        next_idx = idx;
        l = 0;
+        prev = 0;
        while (seq < dumper->next_seq) {
                struct log *msg = log_from_idx(idx);
-                l += msg_print_text(msg, syslog,
+                l += msg_print_text(msg, prev, syslog, buf + l, size - l);
-                                    buf + l, size - l);
                idx = log_next(idx);
                seq++;
+                prev = msg->flags;
        }
        dumper->next_seq = next_seq;
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 3b0f1337f75b..4b97bba7396e 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -201,6 +201,7 @@ void rcu_note_context_switch(int cpu)
 {
        trace_rcu_utilization("Start context switch");
        rcu_sched_qs(cpu);
+        rcu_preempt_note_context_switch(cpu);
        trace_rcu_utilization("End context switch");
 }
 EXPORT_SYMBOL_GPL(rcu_note_context_switch);
@@ -1530,7 +1531,7 @@ static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp)
 {
        unsigned long flags;
        struct rcu_head *next, *list, **tail;
-        int bl, count, count_lazy;
+        int bl, count, count_lazy, i;
        /* If no callbacks are ready, just return.*/
        if (!cpu_has_callbacks_ready_to_invoke(rdp)) {
@@ -1553,9 +1554,9 @@ static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp)
        rdp->nxtlist = *rdp->nxttail[RCU_DONE_TAIL];
        *rdp->nxttail[RCU_DONE_TAIL] = NULL;
        tail = rdp->nxttail[RCU_DONE_TAIL];
-        for (count = RCU_NEXT_SIZE - 1; count >= 0; count--)
+        for (i = RCU_NEXT_SIZE - 1; i >= 0; i--)
-                if (rdp->nxttail[count] == rdp->nxttail[RCU_DONE_TAIL])
+                if (rdp->nxttail[i] == rdp->nxttail[RCU_DONE_TAIL])
-                        rdp->nxttail[count] = &rdp->nxtlist;
+                        rdp->nxttail[i] = &rdp->nxtlist;
        local_irq_restore(flags);
        /* Invoke callbacks. */
@@ -1583,9 +1584,9 @@ static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp)
        if (list != NULL) {
                *tail = rdp->nxtlist;
                rdp->nxtlist = list;
-                for (count = 0; count < RCU_NEXT_SIZE; count++)
+                for (i = 0; i < RCU_NEXT_SIZE; i++)
-                        if (&rdp->nxtlist == rdp->nxttail[count])
+                        if (&rdp->nxtlist == rdp->nxttail[i])
-                                rdp->nxttail[count] = tail;
+                                rdp->nxttail[i] = tail;
                        else
                                break;
        }
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index ea056495783e..19b61ac1079f 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -444,6 +444,7 @@ DECLARE_PER_CPU(char, rcu_cpu_has_work);
 /* Forward declarations for rcutree_plugin.h */
 static void rcu_bootup_announce(void);
 long rcu_batches_completed(void);
+static void rcu_preempt_note_context_switch(int cpu);
 static int rcu_preempt_blocked_readers_cgp(struct rcu_node *rnp);
 #ifdef CONFIG_HOTPLUG_CPU
 static void rcu_report_unblock_qs_rnp(struct rcu_node *rnp,
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index 5271a020887e..3e4899459f3d 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -153,7 +153,7 @@ static void rcu_preempt_qs(int cpu)
 *
 * Caller must disable preemption.
 */
-void rcu_preempt_note_context_switch(void)
+static void rcu_preempt_note_context_switch(int cpu)
 {
        struct task_struct *t = current;
        unsigned long flags;
@@ -164,7 +164,7 @@ void rcu_preempt_note_context_switch(void)
            (t->rcu_read_unlock_special & RCU_READ_UNLOCK_BLOCKED) == 0) {
                /* Possibly blocking in an RCU read-side critical section. */
-                rdp = __this_cpu_ptr(rcu_preempt_state.rda);
+                rdp = per_cpu_ptr(rcu_preempt_state.rda, cpu);
                rnp = rdp->mynode;
                raw_spin_lock_irqsave(&rnp->lock, flags);
                t->rcu_read_unlock_special |= RCU_READ_UNLOCK_BLOCKED;
@@ -228,7 +228,7 @@ void rcu_preempt_note_context_switch(void)
         * means that we continue to block the current grace period.
         */
        local_irq_save(flags);
-        rcu_preempt_qs(smp_processor_id());
+        rcu_preempt_qs(cpu);
        local_irq_restore(flags);
 }
@@ -1002,6 +1002,14 @@ void rcu_force_quiescent_state(void)
 EXPORT_SYMBOL_GPL(rcu_force_quiescent_state);
 /*
+ * Because preemptible RCU does not exist, we never have to check for
+ * CPUs being in quiescent states.
+ */
+static void rcu_preempt_note_context_switch(int cpu)
+{
+}
+/*
 * Because preemptible RCU does not exist, there are never any preempted
 * RCU readers.
 */
diff --git a/kernel/relay.c b/kernel/relay.c
index ab56a1764d4d..e8cd2027abbd 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -1235,6 +1235,7 @@ static ssize_t subbuf_splice_actor(struct file *in,
        struct splice_pipe_desc spd = {
                .pages = pages,
                .nr_pages = 0,
+                .nr_pages_max = PIPE_DEF_BUFFERS,
                .partial = partial,
                .flags = flags,
                .ops = &relay_pipe_buf_ops,
@@ -1302,8 +1303,8 @@ static ssize_t subbuf_splice_actor(struct file *in,
                ret += padding;
 out:
-        splice_shrink_spd(pipe, &spd);
+        splice_shrink_spd(&spd);
-        return ret;
+        return ret;
 }
 static ssize_t relay_file_splice_read(struct file *in,
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index d5594a4268d4..468bdd44c1ba 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2081,7 +2081,6 @@ context_switch(struct rq *rq, struct task_struct *prev,
 #endif
        /* Here we just switch the register state and the stack. */
-        rcu_switch_from(prev);
        switch_to(prev, next, prev);
        barrier();
@@ -2161,11 +2160,73 @@ unsigned long this_cpu_load(void)
 }
+/*
+ * Global load-average calculations
+ *
+ * We take a distributed and async approach to calculating the global load-avg
+ * in order to minimize overhead.
+ *
+ * The global load average is an exponentially decaying average of nr_running +
+ * nr_uninterruptible.
+ *
+ * Once every LOAD_FREQ:
+ *
+ *   nr_active = 0;
+ *   for_each_possible_cpu(cpu)
+ *      nr_active += cpu_of(cpu)->nr_running + cpu_of(cpu)->nr_uninterruptible;
+ *
+ *   avenrun[n] = avenrun[0] * exp_n + nr_active * (1 - exp_n)
+ *
+ * Due to a number of reasons the above turns in the mess below:
+ *
+ *  - for_each_possible_cpu() is prohibitively expensive on machines with
+ *    serious number of cpus, therefore we need to take a distributed approach
+ *    to calculating nr_active.
+ *
+ *        \Sum_i x_i(t) = \Sum_i x_i(t) - x_i(t_0) | x_i(t_0) := 0
+ *                      = \Sum_i { \Sum_j=1 x_i(t_j) - x_i(t_j-1) }
+ *
+ *    So assuming nr_active := 0 when we start out -- true per definition, we
+ *    can simply take per-cpu deltas and fold those into a global accumulate
+ *    to obtain the same result. See calc_load_fold_active().
+ *
+ *    Furthermore, in order to avoid synchronizing all per-cpu delta folding
+ *    across the machine, we assume 10 ticks is sufficient time for every
+ *    cpu to have completed this task.
+ *
+ *    This places an upper-bound on the IRQ-off latency of the machine. Then
+ *    again, being late doesn't loose the delta, just wrecks the sample.
+ *
+ *  - cpu_rq()->nr_uninterruptible isn't accurately tracked per-cpu because
+ *    this would add another cross-cpu cacheline miss and atomic operation
+ *    to the wakeup path. Instead we increment on whatever cpu the task ran
+ *    when it went into uninterruptible state and decrement on whatever cpu
+ *    did the wakeup. This means that only the sum of nr_uninterruptible over
+ *    all cpus yields the correct result.
+ *
+ *  This covers the NO_HZ=n code, for extra head-aches, see the comment below.
+ */
 /* Variables and functions for calc_load */
 static atomic_long_t calc_load_tasks;
 static unsigned long calc_load_update;
 unsigned long avenrun[3];
-EXPORT_SYMBOL(avenrun);
+EXPORT_SYMBOL(avenrun); /* should be removed */
+/**
+ * get_avenrun - get the load average array
+ * @loads:      pointer to dest load array
+ * @offset:     offset to add
+ * @shift:      shift count to shift the result left
+ *
+ * These values are estimates at best, so no need for locking.
+ */
+void get_avenrun(unsigned long *loads, unsigned long offset, int shift)
+{
+        loads[0] = (avenrun[0] + offset) << shift;
+        loads[1] = (avenrun[1] + offset) << shift;
+        loads[2] = (avenrun[2] + offset) << shift;
+}
 static long calc_load_fold_active(struct rq *this_rq)
 {
@@ -2182,6 +2243,9 @@ static long calc_load_fold_active(struct rq *this_rq)
        return delta;
 }
+/*
+ * a1 = a0 * e + a * (1 - e)
+ */
 static unsigned long
 calc_load(unsigned long load, unsigned long exp, unsigned long active)
 {
@@ -2193,30 +2257,118 @@ calc_load(unsigned long load, unsigned long exp, unsigned long active)
 #ifdef CONFIG_NO_HZ
 /*
- * For NO_HZ we delay the active fold to the next LOAD_FREQ update.
+ * Handle NO_HZ for the global load-average.
+ *
+ * Since the above described distributed algorithm to compute the global
+ * load-average relies on per-cpu sampling from the tick, it is affected by
+ * NO_HZ.
+ *
+ * The basic idea is to fold the nr_active delta into a global idle-delta upon
+ * entering NO_HZ state such that we can include this as an 'extra' cpu delta
+ * when we read the global state.
+ *
+ * Obviously reality has to ruin such a delightfully simple scheme:
+ *
+ *  - When we go NO_HZ idle during the window, we can negate our sample
+ *    contribution, causing under-accounting.
+ *
+ *    We avoid this by keeping two idle-delta counters and flipping them
+ *    when the window starts, thus separating old and new NO_HZ load.
+ *
+ *    The only trick is the slight shift in index flip for read vs write.
+ *
+ *        0s            5s            10s           15s
+ *          +10           +10           +10           +10
+ *        |-|-----------|-|-----------|-|-----------|-|
+ *    r:0 0 1           1 0           0 1           1 0
+ *    w:0 1 1           0 0           1 1           0 0
+ *
+ *    This ensures we'll fold the old idle contribution in this window while
+ *    accumlating the new one.
+ *
+ *  - When we wake up from NO_HZ idle during the window, we push up our
+ *    contribution, since we effectively move our sample point to a known
+ *    busy state.
+ *
+ *    This is solved by pushing the window forward, and thus skipping the
+ *    sample, for this cpu (effectively using the idle-delta for this cpu which
+ *    was in effect at the time the window opened). This also solves the issue
+ *    of having to deal with a cpu having been in NOHZ idle for multiple
+ *    LOAD_FREQ intervals.
 *
 * When making the ILB scale, we should try to pull this in as well.
 */
-static atomic_long_t calc_load_tasks_idle;
+static atomic_long_t calc_load_idle[2];
+static int calc_load_idx;
-void calc_load_account_idle(struct rq *this_rq)
+static inline int calc_load_write_idx(void)
 {
+        int idx = calc_load_idx;
+        /*
+         * See calc_global_nohz(), if we observe the new index, we also
+         * need to observe the new update time.
+         */
+        smp_rmb();
+        /*
+         * If the folding window started, make sure we start writing in the
+         * next idle-delta.
+         */
+        if (!time_before(jiffies, calc_load_update))
+                idx++;
+        return idx & 1;
+}
+static inline int calc_load_read_idx(void)
+{
+        return calc_load_idx & 1;
+}
+void calc_load_enter_idle(void)
+{
+        struct rq *this_rq = this_rq();
        long delta;
+        /*
+         * We're going into NOHZ mode, if there's any pending delta, fold it
+         * into the pending idle delta.
+         */
        delta = calc_load_fold_active(this_rq);
-        if (delta)
+        if (delta) {
-                atomic_long_add(delta, &calc_load_tasks_idle);
+                int idx = calc_load_write_idx();
+                atomic_long_add(delta, &calc_load_idle[idx]);
+        }
 }
-static long calc_load_fold_idle(void)
+void calc_load_exit_idle(void)
 {
-        long delta = 0;
+        struct rq *this_rq = this_rq();
+        /*
+         * If we're still before the sample window, we're done.
+         */
+        if (time_before(jiffies, this_rq->calc_load_update))
+                return;
        /*
-         * Its got a race, we don't care...
+         * We woke inside or after the sample window, this means we're already
+         * accounted through the nohz accounting, so skip the entire deal and
+         * sync up for the next window.
         */
-        if (atomic_long_read(&calc_load_tasks_idle))
+        this_rq->calc_load_update = calc_load_update;
-                delta = atomic_long_xchg(&calc_load_tasks_idle, 0);
+        if (time_before(jiffies, this_rq->calc_load_update + 10))
+                this_rq->calc_load_update += LOAD_FREQ;
+}
+static long calc_load_fold_idle(void)
+{
+        int idx = calc_load_read_idx();
+        long delta = 0;
+        if (atomic_long_read(&calc_load_idle[idx]))
+                delta = atomic_long_xchg(&calc_load_idle[idx], 0);
        return delta;
 }
@@ -2302,66 +2454,39 @@ static void calc_global_nohz(void)
 {
        long delta, active, n;
-        /*
+        if (!time_before(jiffies, calc_load_update + 10)) {
-         * If we crossed a calc_load_update boundary, make sure to fold
+                /*
-         * any pending idle changes, the respective CPUs might have
+                 * Catch-up, fold however many we are behind still
-         * missed the tick driven calc_load_account_active() update
+                 */
-         * due to NO_HZ.
+                delta = jiffies - calc_load_update - 10;
-         */
+                n = 1 + (delta / LOAD_FREQ);
-        delta = calc_load_fold_idle();
-        if (delta)
-                atomic_long_add(delta, &calc_load_tasks);
-        /*
-         * It could be the one fold was all it took, we done!
-         */
-        if (time_before(jiffies, calc_load_update + 10))
-                return;
-        /*
-         * Catch-up, fold however many we are behind still
-         */
-        delta = jiffies - calc_load_update - 10;
-        n = 1 + (delta / LOAD_FREQ);
-        active = atomic_long_read(&calc_load_tasks);
+                active = atomic_long_read(&calc_load_tasks);
-        active = active > 0 ? active * FIXED_1 : 0;
+                active = active > 0 ? active * FIXED_1 : 0;
-        avenrun[0] = calc_load_n(avenrun[0], EXP_1, active, n);
+                avenrun[0] = calc_load_n(avenrun[0], EXP_1, active, n);
-        avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n);
+                avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n);
-        avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n);
+                avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n);
-        calc_load_update += n * LOAD_FREQ;
+                calc_load_update += n * LOAD_FREQ;
-}
+        }
-#else
-void calc_load_account_idle(struct rq *this_rq)
-{
-}
-static inline long calc_load_fold_idle(void)
+        /*
-{
+         * Flip the idle index...
-        return 0;
+         *
+         * Make sure we first write the new time then flip the index, so that
+         * calc_load_write_idx() will see the new time when it reads the new
+         * index, this avoids a double flip messing things up.
+         */
+        smp_wmb();
+        calc_load_idx++;
 }
+#else /* !CONFIG_NO_HZ */
-static void calc_global_nohz(void)
+static inline long calc_load_fold_idle(void) { return 0; }
-{
+static inline void calc_global_nohz(void) { }
-}
-#endif
-/**
+#endif /* CONFIG_NO_HZ */
- * get_avenrun - get the load average array
- * @loads:      pointer to dest load array
- * @offset:     offset to add
- * @shift:      shift count to shift the result left
- *
- * These values are estimates at best, so no need for locking.
- */
-void get_avenrun(unsigned long *loads, unsigned long offset, int shift)
-{
-        loads[0] = (avenrun[0] + offset) << shift;
-        loads[1] = (avenrun[1] + offset) << shift;
-        loads[2] = (avenrun[2] + offset) << shift;
-}
 /*
 * calc_load - update the avenrun load estimates 10 ticks after the
@@ -2369,11 +2494,18 @@ void get_avenrun(unsigned long *loads, unsigned long offset, int shift)
 */
 void calc_global_load(unsigned long ticks)
 {
-        long active;
+        long active, delta;
        if (time_before(jiffies, calc_load_update + 10))
                return;
+        /*
+         * Fold the 'old' idle-delta to include all NO_HZ cpus.
+         */
+        delta = calc_load_fold_idle();
+        if (delta)
+                atomic_long_add(delta, &calc_load_tasks);
        active = atomic_long_read(&calc_load_tasks);
        active = active > 0 ? active * FIXED_1 : 0;
@@ -2384,12 +2516,7 @@ void calc_global_load(unsigned long ticks)
        calc_load_update += LOAD_FREQ;
        /*
-         * Account one period with whatever state we found before
+         * In case we idled for multiple LOAD_FREQ intervals, catch up in bulk.
-         * folding in the nohz state and ageing the entire idle period.
-         *
-         * This avoids loosing a sample when we go idle between 
-         * calc_load_account_active() (10 ticks ago) and now and thus
-         * under-accounting.
         */
        calc_global_nohz();
 }
@@ -2406,7 +2533,6 @@ static void calc_load_account_active(struct rq *this_rq)
                return;
        delta  = calc_load_fold_active(this_rq);
-        delta += calc_load_fold_idle();
        if (delta)
                atomic_long_add(delta, &calc_load_tasks);
@@ -2414,6 +2540,10 @@ static void calc_load_account_active(struct rq *this_rq)
 }
 /*
+ * End of global load-average stuff
+ */
+/*
 * The exact cpuload at various idx values, calculated at every tick would be
 * load = (2^idx - 1) / 2^idx * load + 1 / 2^idx * cur_load
 *
diff --git a/kernel/sched/idle_task.c b/kernel/sched/idle_task.c
index b44d604b35d1..b6baf370cae9 100644
--- a/kernel/sched/idle_task.c
+++ b/kernel/sched/idle_task.c
@@ -25,7 +25,6 @@ static void check_preempt_curr_idle(struct rq *rq, struct task_struct *p, int fl
 static struct task_struct *pick_next_task_idle(struct rq *rq)
 {
        schedstat_inc(rq, sched_goidle);
-        calc_load_account_idle(rq);
        return rq->idle;
 }
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 6d52cea7f33d..55844f24435a 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -942,8 +942,6 @@ static inline u64 sched_avg_period(void)
        return (u64)sysctl_sched_time_avg * NSEC_PER_MSEC / 2;
 }
-void calc_load_account_idle(struct rq *this_rq);
 #ifdef CONFIG_SCHED_HRTICK
 /*
diff --git a/kernel/sys.c b/kernel/sys.c
index e0c8ffc50d7f..2d39a84cd857 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1788,7 +1788,6 @@ SYSCALL_DEFINE1(umask, int, mask)
 #ifdef CONFIG_CHECKPOINT_RESTORE
 static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
 {
-        struct vm_area_struct *vma;
        struct file *exe_file;
        struct dentry *dentry;
        int err;
@@ -1816,13 +1815,17 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
        down_write(&mm->mmap_sem);
        /*
-         * Forbid mm->exe_file change if there are mapped other files.
+         * Forbid mm->exe_file change if old file still mapped.
         */
        err = -EBUSY;
-        for (vma = mm->mmap; vma; vma = vma->vm_next) {
+        if (mm->exe_file) {
-                if (vma->vm_file && !path_equal(&vma->vm_file->f_path,
+                struct vm_area_struct *vma;
-                                                &exe_file->f_path))
-                        goto exit_unlock;
+                for (vma = mm->mmap; vma; vma = vma->vm_next)
+                        if (vma->vm_file &&
+                            path_equal(&vma->vm_file->f_path,
+                                       &mm->exe_file->f_path))
+                                goto exit_unlock;
        }
        /*
@@ -1835,6 +1838,7 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
        if (test_and_set_bit(MMF_EXE_FILE_CHANGED, &mm->flags))
                goto exit_unlock;
+        err = 0;
        set_mm_exe_file(mm, exe_file);
 exit_unlock:
        up_write(&mm->mmap_sem);
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 70b33abcc7bb..b7fbadc5c973 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -409,7 +409,9 @@ int second_overflow(unsigned long secs)
                        time_state = TIME_DEL;
                break;
        case TIME_INS:
-                if (secs % 86400 == 0) {
+                if (!(time_status & STA_INS))
+                        time_state = TIME_OK;
+                else if (secs % 86400 == 0) {
                        leap = -1;
                        time_state = TIME_OOP;
                        time_tai++;
@@ -418,7 +420,9 @@ int second_overflow(unsigned long secs)
                }
                break;
        case TIME_DEL:
-                if ((secs + 1) % 86400 == 0) {
+                if (!(time_status & STA_DEL))
+                        time_state = TIME_OK;
+                else if ((secs + 1) % 86400 == 0) {
                        leap = 1;
                        time_tai--;
                        time_state = TIME_WAIT;
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 869997833928..4a08472c3ca7 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -406,6 +406,7 @@ static void tick_nohz_stop_sched_tick(struct tick_sched *ts)
                 */
                if (!ts->tick_stopped) {
                        select_nohz_load_balancer(1);
+                        calc_load_enter_idle();
                        ts->idle_tick = hrtimer_get_expires(&ts->sched_timer);
                        ts->tick_stopped = 1;
@@ -597,6 +598,7 @@ void tick_nohz_idle_exit(void)
                account_idle_ticks(ticks);
 #endif
+        calc_load_exit_idle();
        touch_softlockup_watchdog();
        /*
         * Cancel the scheduled timer and restore the tick
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 6f46a00a1e8a..3447cfaf11e7 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -70,6 +70,12 @@ struct timekeeper {
        /* The raw monotonic time for the CLOCK_MONOTONIC_RAW posix clock. */
        struct timespec raw_time;
+        /* Offset clock monotonic -> clock realtime */
+        ktime_t offs_real;
+        /* Offset clock monotonic -> clock boottime */
+        ktime_t offs_boot;
        /* Seqlock for all timekeeper values */
        seqlock_t lock;
 };
@@ -172,6 +178,14 @@ static inline s64 timekeeping_get_ns_raw(void)
        return clocksource_cyc2ns(cycle_delta, clock->mult, clock->shift);
 }
+static void update_rt_offset(void)
+{
+        struct timespec tmp, *wtm = &timekeeper.wall_to_monotonic;
+        set_normalized_timespec(&tmp, -wtm->tv_sec, -wtm->tv_nsec);
+        timekeeper.offs_real = timespec_to_ktime(tmp);
+}
 /* must hold write on timekeeper.lock */
 static void timekeeping_update(bool clearntp)
 {
@@ -179,6 +193,7 @@ static void timekeeping_update(bool clearntp)
                timekeeper.ntp_error = 0;
                ntp_clear();
        }
+        update_rt_offset();
        update_vsyscall(&timekeeper.xtime, &timekeeper.wall_to_monotonic,
                         timekeeper.clock, timekeeper.mult);
 }
@@ -604,6 +619,7 @@ void __init timekeeping_init(void)
        }
        set_normalized_timespec(&timekeeper.wall_to_monotonic,
                                -boot.tv_sec, -boot.tv_nsec);
+        update_rt_offset();
        timekeeper.total_sleep_time.tv_sec = 0;
        timekeeper.total_sleep_time.tv_nsec = 0;
        write_sequnlock_irqrestore(&timekeeper.lock, flags);
@@ -612,6 +628,12 @@ void __init timekeeping_init(void)
 /* time in seconds when suspend began */
 static struct timespec timekeeping_suspend_time;
+static void update_sleep_time(struct timespec t)
+{
+        timekeeper.total_sleep_time = t;
+        timekeeper.offs_boot = timespec_to_ktime(t);
+}
 /**
 * __timekeeping_inject_sleeptime - Internal function to add sleep interval
 * @delta: pointer to a timespec delta value
@@ -630,8 +652,7 @@ static void __timekeeping_inject_sleeptime(struct timespec *delta)
        timekeeper.xtime = timespec_add(timekeeper.xtime, *delta);
        timekeeper.wall_to_monotonic =
                        timespec_sub(timekeeper.wall_to_monotonic, *delta);
-        timekeeper.total_sleep_time = timespec_add(
+        update_sleep_time(timespec_add(timekeeper.total_sleep_time, *delta));
-                                        timekeeper.total_sleep_time, *delta);
 }
@@ -696,6 +717,7 @@ static void timekeeping_resume(void)
        timekeeper.clock->cycle_last = timekeeper.clock->read(timekeeper.clock);
        timekeeper.ntp_error = 0;
        timekeeping_suspended = 0;
+        timekeeping_update(false);
        write_sequnlock_irqrestore(&timekeeper.lock, flags);
        touch_softlockup_watchdog();
@@ -963,6 +985,8 @@ static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
                leap = second_overflow(timekeeper.xtime.tv_sec);
                timekeeper.xtime.tv_sec += leap;
                timekeeper.wall_to_monotonic.tv_sec -= leap;
+                if (leap)
+                        clock_was_set_delayed();
        }
        /* Accumulate raw time */
@@ -1079,6 +1103,8 @@ static void update_wall_time(void)
                leap = second_overflow(timekeeper.xtime.tv_sec);
                timekeeper.xtime.tv_sec += leap;
                timekeeper.wall_to_monotonic.tv_sec -= leap;
+                if (leap)
+                        clock_was_set_delayed();
        }
        timekeeping_update(false);
@@ -1246,6 +1272,40 @@ void get_xtime_and_monotonic_and_sleep_offset(struct timespec *xtim,
        } while (read_seqretry(&timekeeper.lock, seq));
 }
+#ifdef CONFIG_HIGH_RES_TIMERS
+/**
+ * ktime_get_update_offsets - hrtimer helper
+ * @offs_real:  pointer to storage for monotonic -> realtime offset
+ * @offs_boot:  pointer to storage for monotonic -> boottime offset
+ *
+ * Returns current monotonic time and updates the offsets
+ * Called from hrtimer_interupt() or retrigger_next_event()
+ */
+ktime_t ktime_get_update_offsets(ktime_t *offs_real, ktime_t *offs_boot)
+{
+        ktime_t now;
+        unsigned int seq;
+        u64 secs, nsecs;
+        do {
+                seq = read_seqbegin(&timekeeper.lock);
+                secs = timekeeper.xtime.tv_sec;
+                nsecs = timekeeper.xtime.tv_nsec;
+                nsecs += timekeeping_get_ns();
+                /* If arch requires, add in gettimeoffset() */
+                nsecs += arch_gettimeoffset();
+                *offs_real = timekeeper.offs_real;
+                *offs_boot = timekeeper.offs_boot;
+        } while (read_seqretry(&timekeeper.lock, seq));
+        now = ktime_add_ns(ktime_set(secs, 0), nsecs);
+        now = ktime_sub(now, *offs_real);
+        return now;
+}
+#endif
 /**
 * ktime_get_monotonic_offset() - get wall_to_monotonic in ktime_t format
 */
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 1d0f6a8a0e5e..f765465bffe4 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1075,6 +1075,7 @@ rb_allocate_cpu_buffer(struct ring_buffer *buffer, int nr_pages, int cpu)
        rb_init_page(bpage->page);
        INIT_LIST_HEAD(&cpu_buffer->reader_page->list);
+        INIT_LIST_HEAD(&cpu_buffer->new_pages);
        ret = rb_allocate_pages(cpu_buffer, nr_pages);
        if (ret < 0)
@@ -1346,10 +1347,9 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned int nr_pages)
                         * If something was added to this page, it was full
                         * since it is not the tail page. So we deduct the
                         * bytes consumed in ring buffer from here.
-                         * No need to update overruns, since this page is
+                         * Increment overrun to account for the lost events.
-                         * deleted from ring buffer and its entries are
-                         * already accounted for.
                         */
+                        local_add(page_entries, &cpu_buffer->overrun);
                        local_sub(BUF_PAGE_SIZE, &cpu_buffer->entries_bytes);
                }
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 49249c28690d..a7fa0702be1c 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3609,6 +3609,7 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
                .pages          = pages_def,
                .partial        = partial_def,
                .nr_pages       = 0, /* This gets updated below. */
+                .nr_pages_max   = PIPE_DEF_BUFFERS,
                .flags          = flags,
                .ops            = &tracing_pipe_buf_ops,
                .spd_release    = tracing_spd_release_pipe,
@@ -3680,7 +3681,7 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
        ret = splice_to_pipe(pipe, &spd);
 out:
-        splice_shrink_spd(pipe, &spd);
+        splice_shrink_spd(&spd);
        return ret;
 out_err:
@@ -4231,6 +4232,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
        struct splice_pipe_desc spd = {
                .pages          = pages_def,
                .partial        = partial_def,
+                .nr_pages_max   = PIPE_DEF_BUFFERS,
                .flags          = flags,
                .ops            = &buffer_pipe_buf_ops,
                .spd_release    = buffer_spd_release,
@@ -4318,7 +4320,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
        }
        ret = splice_to_pipe(pipe, &spd);
-        splice_shrink_spd(pipe, &spd);
+        splice_shrink_spd(&spd);
 out:
        return ret;
 }
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index 518aea714d21..66ce41489133 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -78,7 +78,7 @@ static LIST_HEAD(free_entries);
 static DEFINE_SPINLOCK(free_entries_lock);
 /* Global disable flag - will be set in case of an error */
-static bool global_disable __read_mostly;
+static u32 global_disable __read_mostly;
 /* Global error count */
 static u32 error_count;
@@ -657,7 +657,7 @@ static int dma_debug_fs_init(void)
        global_disable_dent = debugfs_create_bool("disabled", 0444,
                        dma_debug_dent,
-                        (u32 *)&global_disable);
+                        &global_disable);
        if (!global_disable_dent)
                goto out_err;
diff --git a/mm/bootmem.c b/mm/bootmem.c
index ec4fcb7a56c8..bcb63ac48cc5 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -698,7 +698,7 @@ void * __init __alloc_bootmem(unsigned long size, unsigned long align,
        return ___alloc_bootmem(size, align, goal, limit);
 }
-static void * __init ___alloc_bootmem_node_nopanic(pg_data_t *pgdat,
+void * __init ___alloc_bootmem_node_nopanic(pg_data_t *pgdat,
                                unsigned long size, unsigned long align,
                                unsigned long goal, unsigned long limit)
 {
@@ -710,6 +710,10 @@ again:
        if (ptr)
                return ptr;
+        /* do not panic in alloc_bootmem_bdata() */
+        if (limit && goal + size > limit)
+                limit = 0;
        ptr = alloc_bootmem_bdata(pgdat->bdata, size, align, goal, limit);
        if (ptr)
                return ptr;
diff --git a/mm/compaction.c b/mm/compaction.c
index 7ea259d82a99..2f42d9528539 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -701,8 +701,11 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)
                if (err) {
                        putback_lru_pages(&cc->migratepages);
                        cc->nr_migratepages = 0;
+                        if (err == -ENOMEM) {
+                                ret = COMPACT_PARTIAL;
+                                goto out;
+                        }
                }
        }
 out:
diff --git a/mm/madvise.c b/mm/madvise.c
index deff1b64a08c..14d260fa0d17 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -15,6 +15,7 @@
 #include <linux/sched.h>
 #include <linux/ksm.h>
 #include <linux/fs.h>
+#include <linux/file.h>
 /*
 * Any behaviour which results in changes to the vma->vm_flags needs to
@@ -204,14 +205,16 @@ static long madvise_remove(struct vm_area_struct *vma,
 {
        loff_t offset;
        int error;
+        struct file *f;
        *prev = NULL;   /* tell sys_madvise we drop mmap_sem */
        if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
                return -EINVAL;
-        if (!vma->vm_file || !vma->vm_file->f_mapping
+        f = vma->vm_file;
-                || !vma->vm_file->f_mapping->host) {
+        if (!f || !f->f_mapping || !f->f_mapping->host) {
                        return -EINVAL;
        }
@@ -221,11 +224,18 @@ static long madvise_remove(struct vm_area_struct *vma,
        offset = (loff_t)(start - vma->vm_start)
                        + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
-        /* filesystem's fallocate may need to take i_mutex */
+        /*
+         * Filesystem's fallocate may need to take i_mutex.  We need to
+         * explicitly grab a reference because the vma (and hence the
+         * vma's reference to the file) can go away as soon as we drop
+         * mmap_sem.
+         */
+        get_file(f);
        up_read(&current->mm->mmap_sem);
-        error = do_fallocate(vma->vm_file,
+        error = do_fallocate(f,
                                FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
                                offset, end - start);
+        fput(f);
        down_read(&current->mm->mmap_sem);
        return error;
 }
diff --git a/mm/memblock.c b/mm/memblock.c
index d4382095f8bd..5cc6731b00cc 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -143,30 +143,6 @@ phys_addr_t __init_memblock memblock_find_in_range(phys_addr_t start,
                                           MAX_NUMNODES);
 }
-/*
- * Free memblock.reserved.regions
- */
-int __init_memblock memblock_free_reserved_regions(void)
-{
-        if (memblock.reserved.regions == memblock_reserved_init_regions)
-                return 0;
-        return memblock_free(__pa(memblock.reserved.regions),
-                 sizeof(struct memblock_region) * memblock.reserved.max);
-}
-/*
- * Reserve memblock.reserved.regions
- */
-int __init_memblock memblock_reserve_reserved_regions(void)
-{
-        if (memblock.reserved.regions == memblock_reserved_init_regions)
-                return 0;
-        return memblock_reserve(__pa(memblock.reserved.regions),
-                 sizeof(struct memblock_region) * memblock.reserved.max);
-}
 static void __init_memblock memblock_remove_region(struct memblock_type *type, unsigned long r)
 {
        type->total_size -= type->regions[r].size;
@@ -184,6 +160,18 @@ static void __init_memblock memblock_remove_region(struct memblock_type *type, u
        }
 }
+phys_addr_t __init_memblock get_allocated_memblock_reserved_regions_info(
+                                        phys_addr_t *addr)
+{
+        if (memblock.reserved.regions == memblock_reserved_init_regions)
+                return 0;
+        *addr = __pa(memblock.reserved.regions);
+        return PAGE_ALIGN(sizeof(struct memblock_region) *
+                          memblock.reserved.max);
+}
 /**
 * memblock_double_array - double the size of the memblock regions array
 * @type: memblock type of the regions array being doubled
@@ -204,6 +192,7 @@ static int __init_memblock memblock_double_array(struct memblock_type *type,
                                                phys_addr_t new_area_size)
 {
        struct memblock_region *new_array, *old_array;
+        phys_addr_t old_alloc_size, new_alloc_size;
        phys_addr_t old_size, new_size, addr;
        int use_slab = slab_is_available();
        int *in_slab;
@@ -217,6 +206,12 @@ static int __init_memblock memblock_double_array(struct memblock_type *type,
        /* Calculate new doubled size */
        old_size = type->max * sizeof(struct memblock_region);
        new_size = old_size << 1;
+        /*
+         * We need to allocated new one align to PAGE_SIZE,
+         *   so we can free them completely later.
+         */
+        old_alloc_size = PAGE_ALIGN(old_size);
+        new_alloc_size = PAGE_ALIGN(new_size);
        /* Retrieve the slab flag */
        if (type == &memblock.memory)
@@ -245,11 +240,11 @@ static int __init_memblock memblock_double_array(struct memblock_type *type,
                addr = memblock_find_in_range(new_area_start + new_area_size,
                                                memblock.current_limit,
-                                                new_size, sizeof(phys_addr_t));
+                                                new_alloc_size, PAGE_SIZE);
                if (!addr && new_area_size)
                        addr = memblock_find_in_range(0,
                                        min(new_area_start, memblock.current_limit),
-                                        new_size, sizeof(phys_addr_t));
+                                        new_alloc_size, PAGE_SIZE);
                new_array = addr ? __va(addr) : 0;
        }
@@ -279,13 +274,13 @@ static int __init_memblock memblock_double_array(struct memblock_type *type,
                kfree(old_array);
        else if (old_array != memblock_memory_init_regions &&
                 old_array != memblock_reserved_init_regions)
-                memblock_free(__pa(old_array), old_size);
+                memblock_free(__pa(old_array), old_alloc_size);
        /* Reserve the new array if that comes from the memblock.
         * Otherwise, we needn't do it
         */
        if (!use_slab)
-                BUG_ON(memblock_reserve(addr, new_size));
+                BUG_ON(memblock_reserve(addr, new_alloc_size));
        /* Update slab flag */
        *in_slab = use_slab;
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 0d7e3ec8e0f3..427bb291dd0f 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -618,7 +618,7 @@ int __ref add_memory(int nid, u64 start, u64 size)
                pgdat = hotadd_new_pgdat(nid, start);
                ret = -ENOMEM;
                if (!pgdat)
-                        goto out;
+                        goto error;
                new_pgdat = 1;
        }
diff --git a/mm/nobootmem.c b/mm/nobootmem.c
index d23415c001bc..405573010f99 100644
--- a/mm/nobootmem.c
+++ b/mm/nobootmem.c
@@ -105,27 +105,35 @@ static void __init __free_pages_memory(unsigned long start, unsigned long end)
                __free_pages_bootmem(pfn_to_page(i), 0);
 }
+static unsigned long __init __free_memory_core(phys_addr_t start,
+                                 phys_addr_t end)
+{
+        unsigned long start_pfn = PFN_UP(start);
+        unsigned long end_pfn = min_t(unsigned long,
+                                      PFN_DOWN(end), max_low_pfn);
+        if (start_pfn > end_pfn)
+                return 0;
+        __free_pages_memory(start_pfn, end_pfn);
+        return end_pfn - start_pfn;
+}
 unsigned long __init free_low_memory_core_early(int nodeid)
 {
        unsigned long count = 0;
-        phys_addr_t start, end;
+        phys_addr_t start, end, size;
        u64 i;
-        /* free reserved array temporarily so that it's treated as free area */
+        for_each_free_mem_range(i, MAX_NUMNODES, &start, &end, NULL)
-        memblock_free_reserved_regions();
+                count += __free_memory_core(start, end);
-        for_each_free_mem_range(i, MAX_NUMNODES, &start, &end, NULL) {
+        /* free range that is used for reserved array if we allocate it */
-                unsigned long start_pfn = PFN_UP(start);
+        size = get_allocated_memblock_reserved_regions_info(&start);
-                unsigned long end_pfn = min_t(unsigned long,
+        if (size)
-                                              PFN_DOWN(end), max_low_pfn);
+                count += __free_memory_core(start, start + size);
-                if (start_pfn < end_pfn) {
-                        __free_pages_memory(start_pfn, end_pfn);
-                        count += end_pfn - start_pfn;
-                }
-        }
-        /* put region array back? */
-        memblock_reserve_reserved_regions();
        return count;
 }
@@ -274,7 +282,7 @@ void * __init __alloc_bootmem(unsigned long size, unsigned long align,
        return ___alloc_bootmem(size, align, goal, limit);
 }
-static void * __init ___alloc_bootmem_node_nopanic(pg_data_t *pgdat,
+void * __init ___alloc_bootmem_node_nopanic(pg_data_t *pgdat,
                                                   unsigned long size,
                                                   unsigned long align,
                                                   unsigned long goal,
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 44030096da63..4a4f9219683f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5635,7 +5635,12 @@ static struct page *
 __alloc_contig_migrate_alloc(struct page *page, unsigned long private,
                             int **resultp)
 {
-        return alloc_page(GFP_HIGHUSER_MOVABLE);
+        gfp_t gfp_mask = GFP_USER | __GFP_MOVABLE;
+        if (PageHighMem(page))
+                gfp_mask |= __GFP_HIGHMEM;
+        return alloc_page(gfp_mask);
 }
 /* [start, end) must belong to a single zone. */
diff --git a/mm/shmem.c b/mm/shmem.c
index a15a466d0d1d..bd106361be4b 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -264,46 +264,55 @@ static int shmem_radix_tree_replace(struct address_space *mapping,
 }
 /*
+ * Sometimes, before we decide whether to proceed or to fail, we must check
+ * that an entry was not already brought back from swap by a racing thread.
+ *
+ * Checking page is not enough: by the time a SwapCache page is locked, it
+ * might be reused, and again be SwapCache, using the same swap as before.
+ */
+static bool shmem_confirm_swap(struct address_space *mapping,
+                               pgoff_t index, swp_entry_t swap)
+{
+        void *item;
+        rcu_read_lock();
+        item = radix_tree_lookup(&mapping->page_tree, index);
+        rcu_read_unlock();
+        return item == swp_to_radix_entry(swap);
+}
+/*
 * Like add_to_page_cache_locked, but error if expected item has gone.
 */
 static int shmem_add_to_page_cache(struct page *page,
                                   struct address_space *mapping,
                                   pgoff_t index, gfp_t gfp, void *expected)
 {
-        int error = 0;
+        int error;
        VM_BUG_ON(!PageLocked(page));
        VM_BUG_ON(!PageSwapBacked(page));
+        page_cache_get(page);
+        page->mapping = mapping;
+        page->index = index;
+        spin_lock_irq(&mapping->tree_lock);
        if (!expected)
-                error = radix_tree_preload(gfp & GFP_RECLAIM_MASK);
+                error = radix_tree_insert(&mapping->page_tree, index, page);
+        else
+                error = shmem_radix_tree_replace(mapping, index, expected,
+                                                                 page);
        if (!error) {
-                page_cache_get(page);
+                mapping->nrpages++;
-                page->mapping = mapping;
+                __inc_zone_page_state(page, NR_FILE_PAGES);
-                page->index = index;
+                __inc_zone_page_state(page, NR_SHMEM);
+                spin_unlock_irq(&mapping->tree_lock);
-                spin_lock_irq(&mapping->tree_lock);
+        } else {
-                if (!expected)
+                page->mapping = NULL;
-                        error = radix_tree_insert(&mapping->page_tree,
+                spin_unlock_irq(&mapping->tree_lock);
-                                                        index, page);
+                page_cache_release(page);
-                else
-                        error = shmem_radix_tree_replace(mapping, index,
-                                                        expected, page);
-                if (!error) {
-                        mapping->nrpages++;
-                        __inc_zone_page_state(page, NR_FILE_PAGES);
-                        __inc_zone_page_state(page, NR_SHMEM);
-                        spin_unlock_irq(&mapping->tree_lock);
-                } else {
-                        page->mapping = NULL;
-                        spin_unlock_irq(&mapping->tree_lock);
-                        page_cache_release(page);
-                }
-                if (!expected)
-                        radix_tree_preload_end();
        }
-        if (error)
-                mem_cgroup_uncharge_cache_page(page);
        return error;
 }
@@ -1124,9 +1133,9 @@ repeat:
                /* We have to do this with page locked to prevent races */
                lock_page(page);
                if (!PageSwapCache(page) || page_private(page) != swap.val ||
-                    page->mapping) {
+                    !shmem_confirm_swap(mapping, index, swap)) {
                        error = -EEXIST;        /* try again */
-                        goto failed;
+                        goto unlock;
                }
                if (!PageUptodate(page)) {
                        error = -EIO;
@@ -1142,9 +1151,12 @@ repeat:
                error = mem_cgroup_cache_charge(page, current->mm,
                                                gfp & GFP_RECLAIM_MASK);
-                if (!error)
+                if (!error) {
                        error = shmem_add_to_page_cache(page, mapping, index,
                                                gfp, swp_to_radix_entry(swap));
+                        /* We already confirmed swap, and make no allocation */
+                        VM_BUG_ON(error);
+                }
                if (error)
                        goto failed;
@@ -1181,11 +1193,18 @@ repeat:
                __set_page_locked(page);
                error = mem_cgroup_cache_charge(page, current->mm,
                                                gfp & GFP_RECLAIM_MASK);
-                if (!error)
-                        error = shmem_add_to_page_cache(page, mapping, index,
-                                                gfp, NULL);
                if (error)
                        goto decused;
+                error = radix_tree_preload(gfp & GFP_RECLAIM_MASK);
+                if (!error) {
+                        error = shmem_add_to_page_cache(page, mapping, index,
+                                                        gfp, NULL);
+                        radix_tree_preload_end();
+                }
+                if (error) {
+                        mem_cgroup_uncharge_cache_page(page);
+                        goto decused;
+                }
                lru_cache_add_anon(page);
                spin_lock(&info->lock);
@@ -1245,14 +1264,10 @@ decused:
 unacct:
        shmem_unacct_blocks(info->flags, 1);
 failed:
-        if (swap.val && error != -EINVAL) {
+        if (swap.val && error != -EINVAL &&
-                struct page *test = find_get_page(mapping, index);
+            !shmem_confirm_swap(mapping, index, swap))
-                if (test && !radix_tree_exceptional_entry(test))
+                error = -EEXIST;
-                        page_cache_release(test);
+unlock:
-                /* Have another try if the entry has changed */
-                if (test != swp_to_radix_entry(swap))
-                        error = -EEXIST;
-        }
        if (page) {
                unlock_page(page);
                page_cache_release(page);
@@ -1264,7 +1279,7 @@ failed:
                spin_unlock(&info->lock);
                goto repeat;
        }
-        if (error == -EEXIST)
+        if (error == -EEXIST)   /* from above or from radix_tree_insert */
                goto repeat;
        return error;
 }
@@ -1594,6 +1609,7 @@ static ssize_t shmem_file_splice_read(struct file *in, loff_t *ppos,
        struct splice_pipe_desc spd = {
                .pages = pages,
                .partial = partial,
+                .nr_pages_max = PIPE_DEF_BUFFERS,
                .flags = flags,
                .ops = &page_cache_pipe_buf_ops,
                .spd_release = spd_release_page,
@@ -1682,7 +1698,7 @@ static ssize_t shmem_file_splice_read(struct file *in, loff_t *ppos,
        if (spd.nr_pages)
                error = splice_to_pipe(pipe, &spd);
-        splice_shrink_spd(pipe, &spd);
+        splice_shrink_spd(&spd);
        if (error > 0) {
                *ppos += error;
@@ -1691,98 +1707,6 @@ static ssize_t shmem_file_splice_read(struct file *in, loff_t *ppos,
        return error;
 }
-/*
- * llseek SEEK_DATA or SEEK_HOLE through the radix_tree.
- */
-static pgoff_t shmem_seek_hole_data(struct address_space *mapping,
-                                    pgoff_t index, pgoff_t end, int origin)
-{
-        struct page *page;
-        struct pagevec pvec;
-        pgoff_t indices[PAGEVEC_SIZE];
-        bool done = false;
-        int i;
-        pagevec_init(&pvec, 0);
-        pvec.nr = 1;            /* start small: we may be there already */
-        while (!done) {
-                pvec.nr = shmem_find_get_pages_and_swap(mapping, index,
-                                        pvec.nr, pvec.pages, indices);
-                if (!pvec.nr) {
-                        if (origin == SEEK_DATA)
-                                index = end;
-                        break;
-                }
-                for (i = 0; i < pvec.nr; i++, index++) {
-                        if (index < indices[i]) {
-                                if (origin == SEEK_HOLE) {
-                                        done = true;
-                                        break;
-                                }
-                                index = indices[i];
-                        }
-                        page = pvec.pages[i];
-                        if (page && !radix_tree_exceptional_entry(page)) {
-                                if (!PageUptodate(page))
-                                        page = NULL;
-                        }
-                        if (index >= end ||
-                            (page && origin == SEEK_DATA) ||
-                            (!page && origin == SEEK_HOLE)) {
-                                done = true;
-                                break;
-                        }
-                }
-                shmem_deswap_pagevec(&pvec);
-                pagevec_release(&pvec);
-                pvec.nr = PAGEVEC_SIZE;
-                cond_resched();
-        }
-        return index;
-}
-static loff_t shmem_file_llseek(struct file *file, loff_t offset, int origin)
-{
-        struct address_space *mapping;
-        struct inode *inode;
-        pgoff_t start, end;
-        loff_t new_offset;
-        if (origin != SEEK_DATA && origin != SEEK_HOLE)
-                return generic_file_llseek_size(file, offset, origin,
-                                                        MAX_LFS_FILESIZE);
-        mapping = file->f_mapping;
-        inode = mapping->host;
-        mutex_lock(&inode->i_mutex);
-        /* We're holding i_mutex so we can access i_size directly */
-        if (offset < 0)
-                offset = -EINVAL;
-        else if (offset >= inode->i_size)
-                offset = -ENXIO;
-        else {
-                start = offset >> PAGE_CACHE_SHIFT;
-                end = (inode->i_size + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
-                new_offset = shmem_seek_hole_data(mapping, start, end, origin);
-                new_offset <<= PAGE_CACHE_SHIFT;
-                if (new_offset > offset) {
-                        if (new_offset < inode->i_size)
-                                offset = new_offset;
-                        else if (origin == SEEK_DATA)
-                                offset = -ENXIO;
-                        else
-                                offset = inode->i_size;
-                }
-        }
-        if (offset >= 0 && offset != file->f_pos) {
-                file->f_pos = offset;
-                file->f_version = 0;
-        }
-        mutex_unlock(&inode->i_mutex);
-        return offset;
-}
 static long shmem_fallocate(struct file *file, int mode, loff_t offset,
                                                         loff_t len)
 {
@@ -2786,7 +2710,7 @@ static const struct address_space_operations shmem_aops = {
 static const struct file_operations shmem_file_operations = {
        .mmap           = shmem_mmap,
 #ifdef CONFIG_TMPFS
-        .llseek         = shmem_file_llseek,
+        .llseek         = generic_file_llseek,
        .read           = do_sync_read,
        .write          = do_sync_write,
        .aio_read       = shmem_file_aio_read,
diff --git a/mm/sparse.c b/mm/sparse.c
index 6a4bf9160e85..c7bb952400c8 100644
--- a/mm/sparse.c
+++ b/mm/sparse.c
@@ -275,8 +275,9 @@ static unsigned long * __init
 sparse_early_usemaps_alloc_pgdat_section(struct pglist_data *pgdat,
                                         unsigned long size)
 {
-        pg_data_t *host_pgdat;
+        unsigned long goal, limit;
-        unsigned long goal;
+        unsigned long *p;
+        int nid;
        /*
         * A page may contain usemaps for other sections preventing the
         * page being freed and making a section unremovable while
@@ -287,10 +288,17 @@ sparse_early_usemaps_alloc_pgdat_section(struct pglist_data *pgdat,
         * from the same section as the pgdat where possible to avoid
         * this problem.
         */
-        goal = __pa(pgdat) & PAGE_SECTION_MASK;
+        goal = __pa(pgdat) & (PAGE_SECTION_MASK << PAGE_SHIFT);
-        host_pgdat = NODE_DATA(early_pfn_to_nid(goal >> PAGE_SHIFT));
+        limit = goal + (1UL << PA_SECTION_SHIFT);
-        return __alloc_bootmem_node_nopanic(host_pgdat, size,
+        nid = early_pfn_to_nid(goal >> PAGE_SHIFT);
-                                            SMP_CACHE_BYTES, goal);
+again:
+        p = ___alloc_bootmem_node_nopanic(NODE_DATA(nid), size,
+                                          SMP_CACHE_BYTES, goal, limit);
+        if (!p && limit) {
+                limit = 0;
+                goto again;
+        }
+        return p;
 }
 static void __init check_usemap_section_nr(int nid, unsigned long *usemap)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index eeb3bc9d1d36..66e431060c05 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2688,7 +2688,10 @@ static void kswapd_try_to_sleep(pg_data_t *pgdat, int order, int classzone_idx)
                 * them before going back to sleep.
                 */
                set_pgdat_percpu_threshold(pgdat, calculate_normal_threshold);
-                schedule();
+                if (!kthread_should_stop())
+                        schedule();
                set_pgdat_percpu_threshold(pgdat, calculate_pressure_threshold);
        } else {
                if (remaining)
@@ -2955,14 +2958,17 @@ int kswapd_run(int nid)
 }
 /*
- * Called by memory hotplug when all memory in a node is offlined.
+ * Called by memory hotplug when all memory in a node is offlined.  Caller must
+ * hold lock_memory_hotplug().
 */
 void kswapd_stop(int nid)
 {
        struct task_struct *kswapd = NODE_DATA(nid)->kswapd;
-        if (kswapd)
+        if (kswapd) {
                kthread_stop(kswapd);
+                NODE_DATA(nid)->kswapd = NULL;
+        }
 }
 static int __init kswapd_init(void)
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 6089f0cf23b4..9096bcb08132 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -403,6 +403,9 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                break;
        case NETDEV_DOWN:
+                if (dev->features & NETIF_F_HW_VLAN_FILTER)
+                        vlan_vid_del(dev, 0);
                /* Put all VLANs for this dev in the down state too.  */
                for (i = 0; i < VLAN_N_VID; i++) {
                        vlandev = vlan_group_get_device(grp, i);
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 9ee48cb30179..3d33ecf13327 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -368,7 +368,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                const char *sptr = va_arg(ap, const char *);
                                uint16_t len = 0;
                                if (sptr)
-                                        len = min_t(uint16_t, strlen(sptr),
+                                        len = min_t(size_t, strlen(sptr),
                                                                USHRT_MAX);
                                errcode = p9pdu_writef(pdu, proto_version,
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 051f7abae66d..779095ded689 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -842,6 +842,7 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol,
                case AX25_P_NETROM:
                        if (ax25_protocol_is_registered(AX25_P_NETROM))
                                return -ESOCKTNOSUPPORT;
+                        break;
 #endif
 #ifdef CONFIG_ROSE_MODULE
                case AX25_P_ROSE:
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 8bf97515a77d..c5863f499133 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -1351,6 +1351,7 @@ void bla_free(struct bat_priv *bat_priv)
 * @bat_priv: the bat priv with all the soft interface information
 * @skb: the frame to be checked
 * @vid: the VLAN ID of the frame
+ * @is_bcast: the packet came in a broadcast packet type.
 *
 * bla_rx avoidance checks if:
 *  * we have to race for a claim
@@ -1361,7 +1362,8 @@ void bla_free(struct bat_priv *bat_priv)
 * process the skb.
 *
 */
-int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid)
+int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid,
+           bool is_bcast)
 {
        struct ethhdr *ethhdr;
        struct claim search_claim, *claim = NULL;
@@ -1380,7 +1382,7 @@ int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid)
        if (unlikely(atomic_read(&bat_priv->bla_num_requests)))
                /* don't allow broadcasts while requests are in flight */
-                if (is_multicast_ether_addr(ethhdr->h_dest))
+                if (is_multicast_ether_addr(ethhdr->h_dest) && is_bcast)
                        goto handled;
        memcpy(search_claim.addr, ethhdr->h_source, ETH_ALEN);
@@ -1406,8 +1408,13 @@ int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid)
        }
        /* if it is a broadcast ... */
-        if (is_multicast_ether_addr(ethhdr->h_dest)) {
+        if (is_multicast_ether_addr(ethhdr->h_dest) && is_bcast) {
-                /* ... drop it. the responsible gateway is in charge. */
+                /* ... drop it. the responsible gateway is in charge.
+                 *
+                 * We need to check is_bcast because with the gateway
+                 * feature, broadcasts (like DHCP requests) may be sent
+                 * using a unicast packet type.
+                 */
                goto handled;
        } else {
                /* seems the client considers us as its best gateway.
diff --git a/net/batman-adv/bridge_loop_avoidance.h b/net/batman-adv/bridge_loop_avoidance.h
index e39f93acc28f..dc5227b398d4 100644
--- a/net/batman-adv/bridge_loop_avoidance.h
+++ b/net/batman-adv/bridge_loop_avoidance.h
@@ -23,7 +23,8 @@
 #define _NET_BATMAN_ADV_BLA_H_
 #ifdef CONFIG_BATMAN_ADV_BLA
-int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid);
+int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid,
+           bool is_bcast);
 int bla_tx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid);
 int bla_is_backbone_gw(struct sk_buff *skb,
                       struct orig_node *orig_node, int hdr_size);
@@ -41,7 +42,7 @@ void bla_free(struct bat_priv *bat_priv);
 #else /* ifdef CONFIG_BATMAN_ADV_BLA */
 static inline int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb,
-                         short vid)
+                         short vid, bool is_bcast)
 {
        return 0;
 }
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 840e2c64a301..015471d801b4 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -617,6 +617,8 @@ int recv_tt_query(struct sk_buff *skb, struct hard_iface *recv_if)
                         * changes */
                        if (skb_linearize(skb) < 0)
                                goto out;
+                        /* skb_linearize() possibly changed skb->data */
+                        tt_query = (struct tt_query_packet *)skb->data;
                        tt_len = tt_query->tt_data * sizeof(struct tt_change);
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 6e2530b02043..a0ec0e4ada4c 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -256,7 +256,11 @@ void interface_rx(struct net_device *soft_iface,
        struct bat_priv *bat_priv = netdev_priv(soft_iface);
        struct ethhdr *ethhdr;
        struct vlan_ethhdr *vhdr;
+        struct batman_header *batadv_header = (struct batman_header *)skb->data;
        short vid __maybe_unused = -1;
+        bool is_bcast;
+        is_bcast = (batadv_header->packet_type == BAT_BCAST);
        /* check if enough space is available for pulling, and pull */
        if (!pskb_may_pull(skb, hdr_size))
@@ -302,7 +306,7 @@ void interface_rx(struct net_device *soft_iface,
        /* Let the bridge loop avoidance check the packet. If will
         * not handle it, we can safely push it up.
         */
-        if (bla_rx(bat_priv, skb, vid))
+        if (bla_rx(bat_priv, skb, vid, is_bcast))
                goto out;
        netif_rx(skb);
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index a66c2dcd1088..2ab83d7fb1f8 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -141,13 +141,14 @@ static void tt_orig_list_entry_free_rcu(struct rcu_head *rcu)
        struct tt_orig_list_entry *orig_entry;
        orig_entry = container_of(rcu, struct tt_orig_list_entry, rcu);
-        atomic_dec(&orig_entry->orig_node->tt_size);
        orig_node_free_ref(orig_entry->orig_node);
        kfree(orig_entry);
 }
 static void tt_orig_list_entry_free_ref(struct tt_orig_list_entry *orig_entry)
 {
+        /* to avoid race conditions, immediately decrease the tt counter */
+        atomic_dec(&orig_entry->orig_node->tt_size);
        call_rcu(&orig_entry->rcu, tt_orig_list_entry_free_rcu);
 }
@@ -910,7 +911,6 @@ void tt_global_del_orig(struct bat_priv *bat_priv,
                }
                spin_unlock_bh(list_lock);
        }
-        atomic_set(&orig_node->tt_size, 0);
        orig_node->tt_initialised = false;
 }
@@ -2031,10 +2031,10 @@ bool is_ap_isolated(struct bat_priv *bat_priv, uint8_t *src, uint8_t *dst)
 {
        struct tt_local_entry *tt_local_entry = NULL;
        struct tt_global_entry *tt_global_entry = NULL;
-        bool ret = true;
+        bool ret = false;
        if (!atomic_read(&bat_priv->ap_isolation))
-                return false;
+                goto out;
        tt_local_entry = tt_local_hash_find(bat_priv, dst);
        if (!tt_local_entry)
@@ -2044,10 +2044,10 @@ bool is_ap_isolated(struct bat_priv *bat_priv, uint8_t *src, uint8_t *dst)
        if (!tt_global_entry)
                goto out;
-        if (_is_ap_isolated(tt_local_entry, tt_global_entry))
+        if (!_is_ap_isolated(tt_local_entry, tt_global_entry))
                goto out;
-        ret = false;
+        ret = true;
 out:
        if (tt_global_entry)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 4eefb7f65cf6..94ad124a4ea3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3043,6 +3043,50 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
        hci_dev_unlock(hdev);
 }
+static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
+                                         struct sk_buff *skb)
+{
+        struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
+        struct hci_conn *conn;
+        BT_DBG("%s status %u handle %u", hdev->name, ev->status,
+               __le16_to_cpu(ev->handle));
+        hci_dev_lock(hdev);
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
+        if (!conn)
+                goto unlock;
+        if (!ev->status)
+                conn->sec_level = conn->pending_sec_level;
+        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
+        if (ev->status && conn->state == BT_CONNECTED) {
+                hci_acl_disconn(conn, HCI_ERROR_AUTH_FAILURE);
+                hci_conn_put(conn);
+                goto unlock;
+        }
+        if (conn->state == BT_CONFIG) {
+                if (!ev->status)
+                        conn->state = BT_CONNECTED;
+                hci_proto_connect_cfm(conn, ev->status);
+                hci_conn_put(conn);
+        } else {
+                hci_auth_cfm(conn, ev->status);
+                hci_conn_hold(conn);
+                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                hci_conn_put(conn);
+        }
+unlock:
+        hci_dev_unlock(hdev);
+}
 static inline u8 hci_get_auth_req(struct hci_conn *conn)
 {
        /* If remote requests dedicated bonding follow that lead */
@@ -3559,6 +3603,10 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
                hci_extended_inquiry_result_evt(hdev, skb);
                break;
+        case HCI_EV_KEY_REFRESH_COMPLETE:
+                hci_key_refresh_complete_evt(hdev, skb);
+                break;
        case HCI_EV_IO_CAPA_REQUEST:
                hci_io_capa_request_evt(hdev, skb);
                break;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 24f144b72a96..4554e80d16a3 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1295,7 +1295,12 @@ static void security_timeout(struct work_struct *work)
        struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
                                                security_timer.work);
-        l2cap_conn_del(conn->hcon, ETIMEDOUT);
+        BT_DBG("conn %p", conn);
+        if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
+                smp_chan_destroy(conn);
+                l2cap_conn_del(conn->hcon, ETIMEDOUT);
+        }
 }
 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
@@ -2910,12 +2915,14 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
        while (len >= L2CAP_CONF_OPT_SIZE) {
                len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
-                switch (type) {
+                if (type != L2CAP_CONF_RFC)
-                case L2CAP_CONF_RFC:
+                        continue;
-                        if (olen == sizeof(rfc))
-                                memcpy(&rfc, (void *)val, olen);
+                if (olen != sizeof(rfc))
-                        goto done;
+                        break;
-                }
+                memcpy(&rfc, (void *)val, olen);
+                goto done;
        }
        /* Use sane default values in case a misbehaving remote device
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 25d220776079..3e5e3362ea00 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1598,7 +1598,7 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
        else
                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
-        if (!conn) {
+        if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
                err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
                                 MGMT_STATUS_NOT_CONNECTED);
                goto failed;
@@ -1873,6 +1873,22 @@ static void pairing_complete_cb(struct hci_conn *conn, u8 status)
                pairing_complete(cmd, mgmt_status(status));
 }
+static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
+{
+        struct pending_cmd *cmd;
+        BT_DBG("status %u", status);
+        if (!status)
+                return;
+        cmd = find_pairing(conn);
+        if (!cmd)
+                BT_DBG("Unable to find a pending command");
+        else
+                pairing_complete(cmd, mgmt_status(status));
+}
 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                       u16 len)
 {
@@ -1934,6 +1950,8 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
        /* For LE, just connecting isn't a proof that the pairing finished */
        if (cp->addr.type == BDADDR_BREDR)
                conn->connect_cfm_cb = pairing_complete_cb;
+        else
+                conn->connect_cfm_cb = le_connect_complete_cb;
        conn->security_cfm_cb = pairing_complete_cb;
        conn->disconn_cfm_cb = pairing_complete_cb;
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 6fc7c4708f3e..37df4e9b3896 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -648,7 +648,7 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
        auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
-        ret = tk_request(conn, 0, auth, rsp->io_capability, req->io_capability);
+        ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
        if (ret)
                return SMP_UNSPECIFIED;
@@ -703,7 +703,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
        return 0;
 }
-static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
+static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
 {
        struct smp_ltk *key;
        struct hci_conn *hcon = conn->hcon;
@@ -712,6 +712,9 @@ static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
        if (!key)
                return 0;
+        if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
+                return 0;
        if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
                return 1;
@@ -732,7 +735,7 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
        hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
-        if (smp_ltk_encrypt(conn))
+        if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
                return 0;
        if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
@@ -771,7 +774,7 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
                return 1;
        if (hcon->link_mode & HCI_LM_MASTER)
-                if (smp_ltk_encrypt(conn))
+                if (smp_ltk_encrypt(conn, sec_level))
                        goto done;
        if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 0a942fbccc9a..e1144e1617be 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -240,6 +240,7 @@ int br_add_bridge(struct net *net, const char *name)
                return -ENOMEM;
        dev_net_set(dev, net);
+        dev->rtnl_link_ops = &br_link_ops;
        res = register_netdev(dev);
        if (res)
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 2080485515f1..fe41260fbf38 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -208,7 +208,7 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
        return 0;
 }
-static struct rtnl_link_ops br_link_ops __read_mostly = {
+struct rtnl_link_ops br_link_ops __read_mostly = {
        .kind           = "bridge",
        .priv_size      = sizeof(struct net_bridge),
        .setup          = br_dev_setup,
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 1a8ad4fb9a6b..a768b2408edf 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -549,6 +549,7 @@ extern int (*br_fdb_test_addr_hook)(struct net_device *dev, unsigned char *addr)
 #endif
 /* br_netlink.c */
+extern struct rtnl_link_ops br_link_ops;
 extern int br_netlink_init(void);
 extern void br_netlink_fini(void);
 extern void br_ifinfo_notify(int event, struct net_bridge_port *port);
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index aa6f716524fd..8c83c175b03a 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -4,8 +4,7 @@
 * Author:      Sjur Brendeland/sjur.brandeland@stericsson.com
 * License terms: GNU General Public License (GPL) version 2
 *
- * Borrowed heavily from file: pn_dev.c. Thanks to
+ * Borrowed heavily from file: pn_dev.c. Thanks to Remi Denis-Courmont
- *  Remi Denis-Courmont <remi.denis-courmont@nokia.com>
 *  and Sakari Ailus <sakari.ailus@nokia.com>
 */
@@ -562,9 +561,9 @@ static int __init caif_device_init(void)
 static void __exit caif_device_exit(void)
 {
-        unregister_pernet_subsys(&caif_net_ops);
        unregister_netdevice_notifier(&caif_device_notifier);
        dev_remove_pack(&caif_packet_type);
+        unregister_pernet_subsys(&caif_net_ops);
 }
 module_init(caif_device_init);
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index fb8944355264..78f1cdad5b33 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -220,6 +220,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
                                                cfsk_hold, cfsk_put);
                cf_sk->sk.sk_state = CAIF_CONNECTED;
                set_tx_flow_on(cf_sk);
+                cf_sk->sk.sk_shutdown = 0;
                cf_sk->sk.sk_state_change(&cf_sk->sk);
                break;
diff --git a/net/can/raw.c b/net/can/raw.c
index cde1b4a20f75..46cca3a91d19 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -681,9 +681,6 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,
        if (err < 0)
                goto free_skb;
-        /* to be able to check the received tx sock reference in raw_rcv() */
-        skb_shinfo(skb)->tx_flags |= SKBTX_DRV_NEEDS_SK_REF;
        skb->dev = dev;
        skb->sk  = sk;
diff --git a/net/core/dev.c b/net/core/dev.c
index cd0981977f5c..0f28a9e0b8ad 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1136,8 +1136,8 @@ void dev_load(struct net *net, const char *name)
                no_module = request_module("netdev-%s", name);
        if (no_module && capable(CAP_SYS_MODULE)) {
                if (!request_module("%s", name))
-                        pr_err("Loading kernel module for a network device with CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-%s instead.\n",
+                        pr_warn("Loading kernel module for a network device with CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-%s instead.\n",
-                               name);
+                                name);
        }
 }
 EXPORT_SYMBOL(dev_load);
@@ -2089,25 +2089,6 @@ static int dev_gso_segment(struct sk_buff *skb, netdev_features_t features)
        return 0;
 }
-/*
- * Try to orphan skb early, right before transmission by the device.
- * We cannot orphan skb if tx timestamp is requested or the sk-reference
- * is needed on driver level for other reasons, e.g. see net/can/raw.c
- */
-static inline void skb_orphan_try(struct sk_buff *skb)
-{
-        struct sock *sk = skb->sk;
-        if (sk && !skb_shinfo(skb)->tx_flags) {
-                /* skb_tx_hash() wont be able to get sk.
-                 * We copy sk_hash into skb->rxhash
-                 */
-                if (!skb->rxhash)
-                        skb->rxhash = sk->sk_hash;
-                skb_orphan(skb);
-        }
-}
 static bool can_checksum_protocol(netdev_features_t features, __be16 protocol)
 {
        return ((features & NETIF_F_GEN_CSUM) ||
@@ -2193,8 +2174,6 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                if (!list_empty(&ptype_all))
                        dev_queue_xmit_nit(skb, dev);
-                skb_orphan_try(skb);
                features = netif_skb_features(skb);
                if (vlan_tx_tag_present(skb) &&
@@ -2304,7 +2283,7 @@ u16 __skb_tx_hash(const struct net_device *dev, const struct sk_buff *skb,
        if (skb->sk && skb->sk->sk_hash)
                hash = skb->sk->sk_hash;
        else
-                hash = (__force u16) skb->protocol ^ skb->rxhash;
+                hash = (__force u16) skb->protocol;
        hash = jhash_1word(hash, hashrnd);
        return (u16) (((u64) hash * qcount) >> 32) + qoffset;
@@ -2465,8 +2444,12 @@ static void skb_update_prio(struct sk_buff *skb)
 {
        struct netprio_map *map = rcu_dereference_bh(skb->dev->priomap);
-        if ((!skb->priority) && (skb->sk) && map)
+        if (!skb->priority && skb->sk && map) {
-                skb->priority = map->priomap[skb->sk->sk_cgrp_prioidx];
+                unsigned int prioidx = skb->sk->sk_cgrp_prioidx;
+                if (prioidx < map->priomap_len)
+                        skb->priority = map->priomap[prioidx];
+        }
 }
 #else
 #define skb_update_prio(skb)
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index 5b8aa2fae48b..b2e9caa1ad1a 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -49,8 +49,9 @@ static int get_prioidx(u32 *prio)
                return -ENOSPC;
        }
        set_bit(prioidx, prioidx_map);
+        if (atomic_read(&max_prioidx) < prioidx)
+                atomic_set(&max_prioidx, prioidx);
        spin_unlock_irqrestore(&prioidx_map_lock, flags);
-        atomic_set(&max_prioidx, prioidx);
        *prio = prioidx;
        return 0;
 }
@@ -64,7 +65,7 @@ static void put_prioidx(u32 idx)
        spin_unlock_irqrestore(&prioidx_map_lock, flags);
 }
-static void extend_netdev_table(struct net_device *dev, u32 new_len)
+static int extend_netdev_table(struct net_device *dev, u32 new_len)
 {
        size_t new_size = sizeof(struct netprio_map) +
                           ((sizeof(u32) * new_len));
@@ -76,7 +77,7 @@ static void extend_netdev_table(struct net_device *dev, u32 new_len)
        if (!new_priomap) {
                pr_warn("Unable to alloc new priomap!\n");
-                return;
+                return -ENOMEM;
        }
        for (i = 0;
@@ -89,46 +90,79 @@ static void extend_netdev_table(struct net_device *dev, u32 new_len)
        rcu_assign_pointer(dev->priomap, new_priomap);
        if (old_priomap)
                kfree_rcu(old_priomap, rcu);
+        return 0;
 }
-static void update_netdev_tables(void)
+static int write_update_netdev_table(struct net_device *dev)
 {
+        int ret = 0;
+        u32 max_len;
+        struct netprio_map *map;
+        rtnl_lock();
+        max_len = atomic_read(&max_prioidx) + 1;
+        map = rtnl_dereference(dev->priomap);
+        if (!map || map->priomap_len < max_len)
+                ret = extend_netdev_table(dev, max_len);
+        rtnl_unlock();
+        return ret;
+}
+static int update_netdev_tables(void)
+{
+        int ret = 0;
        struct net_device *dev;
-        u32 max_len = atomic_read(&max_prioidx) + 1;
+        u32 max_len;
        struct netprio_map *map;
        rtnl_lock();
+        max_len = atomic_read(&max_prioidx) + 1;
        for_each_netdev(&init_net, dev) {
                map = rtnl_dereference(dev->priomap);
-                if ((!map) ||
+                /*
-                    (map->priomap_len < max_len))
+                 * don't allocate priomap if we didn't
-                        extend_netdev_table(dev, max_len);
+                 * change net_prio.ifpriomap (map == NULL),
+                 * this will speed up skb_update_prio.
+                 */
+                if (map && map->priomap_len < max_len) {
+                        ret = extend_netdev_table(dev, max_len);
+                        if (ret < 0)
+                                break;
+                }
        }
        rtnl_unlock();
+        return ret;
 }
 static struct cgroup_subsys_state *cgrp_create(struct cgroup *cgrp)
 {
        struct cgroup_netprio_state *cs;
-        int ret;
+        int ret = -EINVAL;
        cs = kzalloc(sizeof(*cs), GFP_KERNEL);
        if (!cs)
                return ERR_PTR(-ENOMEM);
-        if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx) {
+        if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx)
-                kfree(cs);
+                goto out;
-                return ERR_PTR(-EINVAL);
-        }
        ret = get_prioidx(&cs->prioidx);
-        if (ret != 0) {
+        if (ret < 0) {
                pr_warn("No space in priority index array\n");
-                kfree(cs);
+                goto out;
-                return ERR_PTR(ret);
+        }
+        ret = update_netdev_tables();
+        if (ret < 0) {
+                put_prioidx(cs->prioidx);
+                goto out;
        }
        return &cs->css;
+out:
+        kfree(cs);
+        return ERR_PTR(ret);
 }
 static void cgrp_destroy(struct cgroup *cgrp)
@@ -141,7 +175,7 @@ static void cgrp_destroy(struct cgroup *cgrp)
        rtnl_lock();
        for_each_netdev(&init_net, dev) {
                map = rtnl_dereference(dev->priomap);
-                if (map)
+                if (map && cs->prioidx < map->priomap_len)
                        map->priomap[cs->prioidx] = 0;
        }
        rtnl_unlock();
@@ -165,7 +199,7 @@ static int read_priomap(struct cgroup *cont, struct cftype *cft,
        rcu_read_lock();
        for_each_netdev_rcu(&init_net, dev) {
                map = rcu_dereference(dev->priomap);
-                priority = map ? map->priomap[prioidx] : 0;
+                priority = (map && prioidx < map->priomap_len) ? map->priomap[prioidx] : 0;
                cb->fill(cb, dev->name, priority);
        }
        rcu_read_unlock();
@@ -220,13 +254,17 @@ static int write_priomap(struct cgroup *cgrp, struct cftype *cft,
        if (!dev)
                goto out_free_devname;
-        update_netdev_tables();
+        ret = write_update_netdev_table(dev);
-        ret = 0;
+        if (ret < 0)
+                goto out_put_dev;
        rcu_read_lock();
        map = rcu_dereference(dev->priomap);
        if (map)
                map->priomap[prioidx] = priority;
        rcu_read_unlock();
+out_put_dev:
        dev_put(dev);
 out_free_devname:
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d78671e9d545..d124306b81fd 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -353,7 +353,7 @@ struct sk_buff *__netdev_alloc_skb(struct net_device *dev,
        unsigned int fragsz = SKB_DATA_ALIGN(length + NET_SKB_PAD) +
                              SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-        if (fragsz <= PAGE_SIZE && !(gfp_mask & __GFP_WAIT)) {
+        if (fragsz <= PAGE_SIZE && !(gfp_mask & (__GFP_WAIT | GFP_DMA))) {
                void *data = netdev_alloc_frag(fragsz);
                if (likely(data)) {
@@ -1755,6 +1755,7 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
        struct splice_pipe_desc spd = {
                .pages = pages,
                .partial = partial,
+                .nr_pages_max = MAX_SKB_FRAGS,
                .flags = flags,
                .ops = &sock_pipe_buf_ops,
                .spd_release = sock_spd_release,
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 6fbb2ad7bb6d..16705611589a 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -230,6 +230,12 @@ static int dgram_sendmsg(struct kiocb *iocb, struct sock *sk,
        mtu = dev->mtu;
        pr_debug("name = %s, mtu = %u\n", dev->name, mtu);
+        if (size > mtu) {
+                pr_debug("size = %Zu, mtu = %u\n", size, mtu);
+                err = -EINVAL;
+                goto out_dev;
+        }
        hlen = LL_RESERVED_SPACE(dev);
        tlen = dev->needed_tailroom;
        skb = sock_alloc_send_skb(sk, hlen + tlen + size,
@@ -258,12 +264,6 @@ static int dgram_sendmsg(struct kiocb *iocb, struct sock *sk,
        if (err < 0)
                goto out_skb;
-        if (size > mtu) {
-                pr_debug("size = %Zu, mtu = %u\n", size, mtu);
-                err = -EINVAL;
-                goto out_skb;
-        }
        skb->dev = dev;
        skb->sk  = sk;
        skb->protocol = htons(ETH_P_IEEE802154);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 74c21b924a79..608327661960 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1349,8 +1349,8 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                        if (w->leaf && fn->fn_flags & RTN_RTINFO) {
                                int err;
-                                if (w->count < w->skip) {
+                                if (w->skip) {
-                                        w->count++;
+                                        w->skip--;
                                        continue;
                                }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 999a982ad3fd..becb048d18d4 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2957,10 +2957,6 @@ static int __net_init ip6_route_net_init(struct net *net)
        net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ;
        net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40;
-#ifdef CONFIG_PROC_FS
-        proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
-        proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
-#endif
        net->ipv6.ip6_rt_gc_expire = 30*HZ;
        ret = 0;
@@ -2981,10 +2977,6 @@ out_ip6_dst_ops:
 static void __net_exit ip6_route_net_exit(struct net *net)
 {
-#ifdef CONFIG_PROC_FS
-        proc_net_remove(net, "ipv6_route");
-        proc_net_remove(net, "rt6_stats");
-#endif
        kfree(net->ipv6.ip6_null_entry);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
        kfree(net->ipv6.ip6_prohibit_entry);
@@ -2993,11 +2985,33 @@ static void __net_exit ip6_route_net_exit(struct net *net)
        dst_entries_destroy(&net->ipv6.ip6_dst_ops);
 }
+static int __net_init ip6_route_net_init_late(struct net *net)
+{
+#ifdef CONFIG_PROC_FS
+        proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
+        proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
+#endif
+        return 0;
+}
+static void __net_exit ip6_route_net_exit_late(struct net *net)
+{
+#ifdef CONFIG_PROC_FS
+        proc_net_remove(net, "ipv6_route");
+        proc_net_remove(net, "rt6_stats");
+#endif
+}
 static struct pernet_operations ip6_route_net_ops = {
        .init = ip6_route_net_init,
        .exit = ip6_route_net_exit,
 };
+static struct pernet_operations ip6_route_net_late_ops = {
+        .init = ip6_route_net_init_late,
+        .exit = ip6_route_net_exit_late,
+};
 static struct notifier_block ip6_route_dev_notifier = {
        .notifier_call = ip6_route_dev_notify,
        .priority = 0,
@@ -3047,19 +3061,25 @@ int __init ip6_route_init(void)
        if (ret)
                goto xfrm6_init;
+        ret = register_pernet_subsys(&ip6_route_net_late_ops);
+        if (ret)
+                goto fib6_rules_init;
        ret = -ENOBUFS;
        if (__rtnl_register(PF_INET6, RTM_NEWROUTE, inet6_rtm_newroute, NULL, NULL) ||
            __rtnl_register(PF_INET6, RTM_DELROUTE, inet6_rtm_delroute, NULL, NULL) ||
            __rtnl_register(PF_INET6, RTM_GETROUTE, inet6_rtm_getroute, NULL, NULL))
-                goto fib6_rules_init;
+                goto out_register_late_subsys;
        ret = register_netdevice_notifier(&ip6_route_dev_notifier);
        if (ret)
-                goto fib6_rules_init;
+                goto out_register_late_subsys;
 out:
        return ret;
+out_register_late_subsys:
+        unregister_pernet_subsys(&ip6_route_net_late_ops);
 fib6_rules_init:
        fib6_rules_cleanup();
 xfrm6_init:
@@ -3078,6 +3098,7 @@ out_kmem_cache:
 void ip6_route_cleanup(void)
 {
        unregister_netdevice_notifier(&ip6_route_dev_notifier);
+        unregister_pernet_subsys(&ip6_route_net_late_ops);
        fib6_rules_cleanup();
        xfrm6_fini();
        fib6_gc_cleanup();
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 3a9aec29581a..9df64a50b075 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1212,7 +1212,8 @@ have_isn:
        tcp_rsk(req)->snt_isn = isn;
        tcp_rsk(req)->snt_synack = tcp_time_stamp;
-        security_inet_conn_request(sk, skb, req);
+        if (security_inet_conn_request(sk, skb, req))
+                goto drop_and_release;
        if (tcp_v6_send_synack(sk, req,
                               (struct request_values *)&tmp_ext,
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 07d7d55a1b93..cd6f7a991d80 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -372,7 +372,6 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
                        skb_trim(skb, skb->dev->mtu);
        }
        skb->protocol = ETH_P_AF_IUCV;
-        skb_shinfo(skb)->tx_flags |= SKBTX_DRV_NEEDS_SK_REF;
        nskb = skb_clone(skb, GFP_ATOMIC);
        if (!nskb)
                return -ENOMEM;
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 185f12f4a5fa..47b259fccd27 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -42,6 +42,11 @@ struct l2tp_eth {
        struct sock             *tunnel_sock;
        struct l2tp_session     *session;
        struct list_head        list;
+        atomic_long_t           tx_bytes;
+        atomic_long_t           tx_packets;
+        atomic_long_t           rx_bytes;
+        atomic_long_t           rx_packets;
+        atomic_long_t           rx_errors;
 };
 /* via l2tp_session_priv() */
@@ -88,24 +93,40 @@ static int l2tp_eth_dev_xmit(struct sk_buff *skb, struct net_device *dev)
        struct l2tp_eth *priv = netdev_priv(dev);
        struct l2tp_session *session = priv->session;
+        atomic_long_add(skb->len, &priv->tx_bytes);
+        atomic_long_inc(&priv->tx_packets);
        l2tp_xmit_skb(session, skb, session->hdr_len);
-        dev->stats.tx_bytes += skb->len;
+        return NETDEV_TX_OK;
-        dev->stats.tx_packets++;
+}
-        return 0;
+static struct rtnl_link_stats64 *l2tp_eth_get_stats64(struct net_device *dev,
+                                                      struct rtnl_link_stats64 *stats)
+{
+        struct l2tp_eth *priv = netdev_priv(dev);
+        stats->tx_bytes   = atomic_long_read(&priv->tx_bytes);
+        stats->tx_packets = atomic_long_read(&priv->tx_packets);
+        stats->rx_bytes   = atomic_long_read(&priv->rx_bytes);
+        stats->rx_packets = atomic_long_read(&priv->rx_packets);
+        stats->rx_errors  = atomic_long_read(&priv->rx_errors);
+        return stats;
 }
 static struct net_device_ops l2tp_eth_netdev_ops = {
        .ndo_init               = l2tp_eth_dev_init,
        .ndo_uninit             = l2tp_eth_dev_uninit,
        .ndo_start_xmit         = l2tp_eth_dev_xmit,
+        .ndo_get_stats64        = l2tp_eth_get_stats64,
 };
 static void l2tp_eth_dev_setup(struct net_device *dev)
 {
        ether_setup(dev);
-        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+        dev->priv_flags         &= ~IFF_TX_SKB_SHARING;
+        dev->features           |= NETIF_F_LLTX;
        dev->netdev_ops         = &l2tp_eth_netdev_ops;
        dev->destructor         = free_netdev;
 }
@@ -114,17 +135,17 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
 {
        struct l2tp_eth_sess *spriv = l2tp_session_priv(session);
        struct net_device *dev = spriv->dev;
+        struct l2tp_eth *priv = netdev_priv(dev);
        if (session->debug & L2TP_MSG_DATA) {
                unsigned int length;
-                u8 *ptr = skb->data;
                length = min(32u, skb->len);
                if (!pskb_may_pull(skb, length))
                        goto error;
                pr_debug("%s: eth recv\n", session->name);
-                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
+                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
        }
        if (!pskb_may_pull(skb, sizeof(ETH_HLEN)))
@@ -139,15 +160,15 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
        nf_reset(skb);
        if (dev_forward_skb(dev, skb) == NET_RX_SUCCESS) {
-                dev->stats.rx_packets++;
+                atomic_long_inc(&priv->rx_packets);
-                dev->stats.rx_bytes += data_len;
+                atomic_long_add(data_len, &priv->rx_bytes);
-        } else
+        } else {
-                dev->stats.rx_errors++;
+                atomic_long_inc(&priv->rx_errors);
+        }
        return;
 error:
-        dev->stats.rx_errors++;
+        atomic_long_inc(&priv->rx_errors);
        kfree_skb(skb);
 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index e9cecca5c44d..7d5108a867ad 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2093,6 +2093,9 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
        int i, ret;
+        if (!ieee80211_sdata_running(sdata))
+                return -ENETDOWN;
        if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
                ret = drv_set_bitrate_mask(local, sdata, mask);
                if (ret)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 91d84cc77bbf..0db5d34a06b6 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1342,7 +1342,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
        struct ieee80211_local *local = sdata->local;
        struct sta_info *sta;
        u32 changed = 0;
-        u8 bssid[ETH_ALEN];
        ASSERT_MGD_MTX(ifmgd);
@@ -1352,10 +1351,9 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
        if (WARN_ON(!ifmgd->associated))
                return;
-        memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
+        ieee80211_stop_poll(sdata);
        ifmgd->associated = NULL;
-        memset(ifmgd->bssid, 0, ETH_ALEN);
        /*
         * we need to commit the associated = NULL change because the
@@ -1375,7 +1373,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
        netif_carrier_off(sdata->dev);
        mutex_lock(&local->sta_mtx);
-        sta = sta_info_get(sdata, bssid);
+        sta = sta_info_get(sdata, ifmgd->bssid);
        if (sta) {
                set_sta_flag(sta, WLAN_STA_BLOCK_BA);
                ieee80211_sta_tear_down_BA_sessions(sta, tx);
@@ -1384,13 +1382,16 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
        /* deauthenticate/disassociate now */
        if (tx || frame_buf)
-                ieee80211_send_deauth_disassoc(sdata, bssid, stype, reason,
+                ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
-                                               tx, frame_buf);
+                                               reason, tx, frame_buf);
        /* flush out frame */
        if (tx)
                drv_flush(local, false);
+        /* clear bssid only after building the needed mgmt frames */
+        memset(ifmgd->bssid, 0, ETH_ALEN);
        /* remove AP and TDLS peers */
        sta_info_flush(local, sdata);
@@ -2173,15 +2174,13 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                       sdata->name, mgmt->sa, status_code);
                ieee80211_destroy_assoc_data(sdata, false);
        } else {
-                printk(KERN_DEBUG "%s: associated\n", sdata->name);
                if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
                        /* oops -- internal error -- send timeout for now */
-                        ieee80211_destroy_assoc_data(sdata, true);
+                        ieee80211_destroy_assoc_data(sdata, false);
-                        sta_info_destroy_addr(sdata, mgmt->bssid);
                        cfg80211_put_bss(*bss);
                        return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
                }
+                printk(KERN_DEBUG "%s: associated\n", sdata->name);
                /*
                 * destroy assoc_data afterwards, as otherwise an idle
@@ -2612,8 +2611,6 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
        u8 frame_buf[DEAUTH_DISASSOC_LEN];
-        ieee80211_stop_poll(sdata);
        ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
                               false, frame_buf);
        mutex_unlock(&ifmgd->mtx);
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 2d1acc6c5445..f9e51ef8dfa2 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -809,7 +809,7 @@ minstrel_ht_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
                        max_rates = sband->n_bitrates;
        }
-        msp = kzalloc(sizeof(struct minstrel_ht_sta), gfp);
+        msp = kzalloc(sizeof(*msp), gfp);
        if (!msp)
                return NULL;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7bcecf73aafb..965e6ec0adb6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2455,7 +2455,7 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
         * frames that we didn't handle, including returning unknown
         * ones. For all other modes we will return them to the sender,
         * setting the 0x80 bit in the action category, as required by
-         * 802.11-2007 7.3.1.11.
+         * 802.11-2012 9.24.4.
         * Newer versions of hostapd shall also use the management frame
         * registration mechanisms, but older ones still use cooked
         * monitor interfaces so push all frames there.
@@ -2465,6 +2465,9 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
                return RX_DROP_MONITOR;
+        if (is_multicast_ether_addr(mgmt->da))
+                return RX_DROP_MONITOR;
        /* do not return rejected action frames */
        if (mgmt->u.action.category & 0x80)
                return RX_DROP_UNUSABLE;
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 3bb24a121c95..a470e1123a55 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -271,6 +271,9 @@ struct sta_ampdu_mlme {
 * @plink_timer: peer link watch timer
 * @plink_timer_was_running: used by suspend/resume to restore timers
 * @t_offset: timing offset relative to this host
+ * @t_offset_setpoint: reference timing offset of this sta to be used when
+ *      calculating clockdrift
+ * @ch_type: peer's channel type
 * @debugfs: debug filesystem info
 * @dead: set to true when sta is unlinked
 * @uploaded: set to true when sta is uploaded to the driver
@@ -278,6 +281,8 @@ struct sta_ampdu_mlme {
 * @sta: station information we share with the driver
 * @sta_state: duplicates information about station state (for debug)
 * @beacon_loss_count: number of times beacon loss has triggered
+ * @supports_40mhz: tracks whether the station advertised 40 MHz support
+ *      as we overwrite its HT parameters with the currently used value
 */
 struct sta_info {
        /* General information, mostly static */
diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
index 8781d8f904d9..434b6873b352 100644
--- a/net/mac802154/tx.c
+++ b/net/mac802154/tx.c
@@ -83,9 +83,10 @@ netdev_tx_t mac802154_tx(struct mac802154_priv *priv, struct sk_buff *skb,
 {
        struct xmit_work *work;
-        if (!(priv->phy->channels_supported[page] & (1 << chan)))
+        if (!(priv->phy->channels_supported[page] & (1 << chan))) {
                WARN_ON(1);
                return NETDEV_TX_OK;
+        }
        if (!(priv->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
                u16 crc = crc_ccitt(0, skb->data, skb->len);
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 819c342f5b30..9730882697aa 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -640,6 +640,14 @@ find_free_id(const char *name, ip_set_id_t *index, struct ip_set **set)
 }
 static int
+ip_set_none(struct sock *ctnl, struct sk_buff *skb,
+            const struct nlmsghdr *nlh,
+            const struct nlattr * const attr[])
+{
+        return -EOPNOTSUPP;
+}
+static int
 ip_set_create(struct sock *ctnl, struct sk_buff *skb,
              const struct nlmsghdr *nlh,
              const struct nlattr * const attr[])
@@ -1539,6 +1547,10 @@ nlmsg_failure:
 }
 static const struct nfnl_callback ip_set_netlink_subsys_cb[IPSET_MSG_MAX] = {
+        [IPSET_CMD_NONE]        = {
+                .call           = ip_set_none,
+                .attr_count     = IPSET_ATTR_CMD_MAX,
+        },
        [IPSET_CMD_CREATE]      = {
                .call           = ip_set_create,
                .attr_count     = IPSET_ATTR_CMD_MAX,
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index ee863943c826..d5d3607ae7bc 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -38,30 +38,6 @@ struct iface_node {
 #define iface_data(n)   (rb_entry(n, struct iface_node, node)->iface)
-static inline long
-ifname_compare(const char *_a, const char *_b)
-{
-        const long *a = (const long *)_a;
-        const long *b = (const long *)_b;
-        BUILD_BUG_ON(IFNAMSIZ > 4 * sizeof(unsigned long));
-        if (a[0] != b[0])
-                return a[0] - b[0];
-        if (IFNAMSIZ > sizeof(long)) {
-                if (a[1] != b[1])
-                        return a[1] - b[1];
-        }
-        if (IFNAMSIZ > 2 * sizeof(long)) {
-                if (a[2] != b[2])
-                        return a[2] - b[2];
-        }
-        if (IFNAMSIZ > 3 * sizeof(long)) {
-                if (a[3] != b[3])
-                        return a[3] - b[3];
-        }
-        return 0;
-}
 static void
 rbtree_destroy(struct rb_root *root)
 {
@@ -99,7 +75,7 @@ iface_test(struct rb_root *root, const char **iface)
        while (n) {
                const char *d = iface_data(n);
-                long res = ifname_compare(*iface, d);
+                int res = strcmp(*iface, d);
                if (res < 0)
                        n = n->rb_left;
@@ -121,7 +97,7 @@ iface_add(struct rb_root *root, const char **iface)
        while (*n) {
                char *ifname = iface_data(*n);
-                long res = ifname_compare(*iface, ifname);
+                int res = strcmp(*iface, ifname);
                p = *n;
                if (res < 0)
@@ -366,7 +342,7 @@ hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[],
        struct hash_netiface4_elem data = { .cidr = HOST_MASK };
        u32 ip = 0, ip_to, last;
        u32 timeout = h->timeout;
-        char iface[IFNAMSIZ] = {};
+        char iface[IFNAMSIZ];
        int ret;
        if (unlikely(!tb[IPSET_ATTR_IP] ||
@@ -663,7 +639,7 @@ hash_netiface6_uadt(struct ip_set *set, struct nlattr *tb[],
        ipset_adtfn adtfn = set->variant->adt[adt];
        struct hash_netiface6_elem data = { .cidr = HOST_MASK };
        u32 timeout = h->timeout;
-        char iface[IFNAMSIZ] = {};
+        char iface[IFNAMSIZ];
        int ret;
        if (unlikely(!tb[IPSET_ATTR_IP] ||
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index dd811b8dd97c..84444dda194b 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -76,19 +76,19 @@ static void __ip_vs_del_service(struct ip_vs_service *svc);
 #ifdef CONFIG_IP_VS_IPV6
 /* Taken from rt6_fill_node() in net/ipv6/route.c, is there a better way? */
-static int __ip_vs_addr_is_local_v6(struct net *net,
+static bool __ip_vs_addr_is_local_v6(struct net *net,
-                                    const struct in6_addr *addr)
+                                     const struct in6_addr *addr)
 {
-        struct rt6_info *rt;
        struct flowi6 fl6 = {
                .daddr = *addr,
        };
+        struct dst_entry *dst = ip6_route_output(net, NULL, &fl6);
+        bool is_local;
-        rt = (struct rt6_info *)ip6_route_output(net, NULL, &fl6);
+        is_local = !dst->error && dst->dev && (dst->dev->flags & IFF_LOOPBACK);
-        if (rt && rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK))
-                return 1;
-        return 0;
+        dst_release(dst);
+        return is_local;
 }
 #endif
@@ -1521,11 +1521,12 @@ static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
 {
        struct net_device *dev = ptr;
        struct net *net = dev_net(dev);
+        struct netns_ipvs *ipvs = net_ipvs(net);
        struct ip_vs_service *svc;
        struct ip_vs_dest *dest;
        unsigned int idx;
-        if (event != NETDEV_UNREGISTER)
+        if (event != NETDEV_UNREGISTER || !ipvs)
                return NOTIFY_DONE;
        IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
        EnterFunction(2);
@@ -1551,7 +1552,7 @@ static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
                }
        }
-        list_for_each_entry(dest, &net_ipvs(net)->dest_trash, n_list) {
+        list_for_each_entry(dest, &ipvs->dest_trash, n_list) {
                __ip_vs_dev_reset(dest, dev);
        }
        mutex_unlock(&__ip_vs_mutex);
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 3e797d1fcb94..791d56bbd74a 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -169,8 +169,10 @@ replay:
                err = nla_parse(cda, ss->cb[cb_id].attr_count,
                                attr, attrlen, ss->cb[cb_id].policy);
-                if (err < 0)
+                if (err < 0) {
+                        rcu_read_unlock();
                        return err;
+                }
                if (nc->call_rcu) {
                        err = nc->call_rcu(net->nfnl, skb, nlh,
diff --git a/net/netfilter/xt_set.c b/net/netfilter/xt_set.c
index 035960ec5cb9..c6f7db720d84 100644
--- a/net/netfilter/xt_set.c
+++ b/net/netfilter/xt_set.c
@@ -16,6 +16,7 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_set.h>
+#include <linux/netfilter/ipset/ip_set_timeout.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
@@ -310,7 +311,8 @@ set_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
                info->del_set.flags, 0, UINT_MAX);
        /* Normalize to fit into jiffies */
-        if (add_opt.timeout > UINT_MAX/MSEC_PER_SEC)
+        if (add_opt.timeout != IPSET_NO_TIMEOUT &&
+            add_opt.timeout > UINT_MAX/MSEC_PER_SEC)
                add_opt.timeout = UINT_MAX/MSEC_PER_SEC;
        if (info->add_set.index != IPSET_INVALID_ID)
                ip_set_add(info->add_set.index, skb, par, &add_opt);
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 17a707db40eb..e06d458fc719 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -292,7 +292,7 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *addr,
        pr_debug("%p\n", sk);
-        if (llcp_sock == NULL)
+        if (llcp_sock == NULL || llcp_sock->dev == NULL)
                return -EBADFD;
        addr->sa_family = AF_NFC;
diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
index cb2646179e5f..2ab196a9f228 100644
--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c
@@ -106,7 +106,7 @@ static __u8 *nci_extract_rf_params_nfca_passive_poll(struct nci_dev *ndev,
        nfca_poll->sens_res = __le16_to_cpu(*((__u16 *)data));
        data += 2;
-        nfca_poll->nfcid1_len = *data++;
+        nfca_poll->nfcid1_len = min_t(__u8, *data++, NFC_NFCID1_MAXSIZE);
        pr_debug("sens_res 0x%x, nfcid1_len %d\n",
                 nfca_poll->sens_res, nfca_poll->nfcid1_len);
@@ -130,7 +130,7 @@ static __u8 *nci_extract_rf_params_nfcb_passive_poll(struct nci_dev *ndev,
                        struct rf_tech_specific_params_nfcb_poll *nfcb_poll,
                                                     __u8 *data)
 {
-        nfcb_poll->sensb_res_len = *data++;
+        nfcb_poll->sensb_res_len = min_t(__u8, *data++, NFC_SENSB_RES_MAXSIZE);
        pr_debug("sensb_res_len %d\n", nfcb_poll->sensb_res_len);
@@ -145,7 +145,7 @@ static __u8 *nci_extract_rf_params_nfcf_passive_poll(struct nci_dev *ndev,
                                                     __u8 *data)
 {
        nfcf_poll->bit_rate = *data++;
-        nfcf_poll->sensf_res_len = *data++;
+        nfcf_poll->sensf_res_len = min_t(__u8, *data++, NFC_SENSF_RES_MAXSIZE);
        pr_debug("bit_rate %d, sensf_res_len %d\n",
                 nfcf_poll->bit_rate, nfcf_poll->sensf_res_len);
@@ -331,7 +331,7 @@ static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev,
        switch (ntf->activation_rf_tech_and_mode) {
        case NCI_NFC_A_PASSIVE_POLL_MODE:
                nfca_poll = &ntf->activation_params.nfca_poll_iso_dep;
-                nfca_poll->rats_res_len = *data++;
+                nfca_poll->rats_res_len = min_t(__u8, *data++, 20);
                pr_debug("rats_res_len %d\n", nfca_poll->rats_res_len);
                if (nfca_poll->rats_res_len > 0) {
                        memcpy(nfca_poll->rats_res,
@@ -341,7 +341,7 @@ static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev,
        case NCI_NFC_B_PASSIVE_POLL_MODE:
                nfcb_poll = &ntf->activation_params.nfcb_poll_iso_dep;
-                nfcb_poll->attrib_res_len = *data++;
+                nfcb_poll->attrib_res_len = min_t(__u8, *data++, 50);
                pr_debug("attrib_res_len %d\n", nfcb_poll->attrib_res_len);
                if (nfcb_poll->attrib_res_len > 0) {
                        memcpy(nfcb_poll->attrib_res,
diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index ec1134c9e07f..8b8a6a2b2bad 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -54,7 +54,10 @@ static int rawsock_release(struct socket *sock)
 {
        struct sock *sk = sock->sk;
-        pr_debug("sock=%p\n", sock);
+        pr_debug("sock=%p sk=%p\n", sock, sk);
+        if (!sk)
+                return 0;
        sock_orphan(sk);
        sock_put(sk);
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index 779ce4ff92ec..5a940dbd74a3 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -5,8 +5,8 @@
 *
 * Copyright (C) 2008 Nokia Corporation.
 *
- * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Authors: Sakari Ailus <sakari.ailus@nokia.com>
- * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ *          Rémi Denis-Courmont
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index bf35b4e1a14c..12c30f3e643e 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -5,8 +5,8 @@
 *
 * Copyright (C) 2008 Nokia Corporation.
 *
- * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Authors: Sakari Ailus <sakari.ailus@nokia.com>
- * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ *          Rémi Denis-Courmont
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index d01208968c83..a2fba7edfd1f 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -5,7 +5,7 @@
 *
 * Copyright (C) 2008 Nokia Corporation.
 *
- * Author: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Author: Rémi Denis-Courmont
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 9dd4f926f7d1..576f22c9c76e 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -5,7 +5,7 @@
 *
 * Copyright (C) 2008 Nokia Corporation.
 *
- * Author: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Author: Rémi Denis-Courmont
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 36f75a9e2c3d..5bf6341e2dd4 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -5,8 +5,8 @@
 *
 * Copyright (C) 2008 Nokia Corporation.
 *
- * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Authors: Sakari Ailus <sakari.ailus@nokia.com>
- * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ *          Rémi Denis-Courmont
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index cfdf135fcd69..7dd762a464e5 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -5,8 +5,8 @@
 *
 * Copyright (C) 2008 Nokia Corporation.
 *
- * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Authors: Sakari Ailus <sakari.ailus@nokia.com>
- * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ *          Remi Denis-Courmont
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 89cfa9ce4939..0acc943f713a 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -5,8 +5,8 @@
 *
 * Copyright (C) 2008 Nokia Corporation.
 *
- * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Authors: Sakari Ailus <sakari.ailus@nokia.com>
- * Original author: Sakari Ailus <sakari.ailus@nokia.com>
+ *          Rémi Denis-Courmont
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/sysctl.c b/net/phonet/sysctl.c
index 696348fd31a1..d6bbbbd0af18 100644
--- a/net/phonet/sysctl.c
+++ b/net/phonet/sysctl.c
@@ -5,7 +5,7 @@
 *
 * Copyright (C) 2008 Nokia Corporation.
 *
- * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com>
+ * Author: Rémi Denis-Courmont
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c
index 2754f098d436..bebaa43484bc 100644
--- a/net/rxrpc/ar-peer.c
+++ b/net/rxrpc/ar-peer.c
@@ -229,7 +229,7 @@ found_UDP_peer:
        return peer;
 new_UDP_peer:
-        _net("Rx UDP DGRAM from NEW peer %d", peer->debug_id);
+        _net("Rx UDP DGRAM from NEW peer");
        read_unlock_bh(&rxrpc_peer_lock);
        _leave(" = -EBUSY [new]");
        return ERR_PTR(-EBUSY);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index a2a95aabf9c2..c412ad0d0308 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -331,29 +331,22 @@ static psched_time_t packet_len_2_sched_time(unsigned int len, struct netem_sche
        return PSCHED_NS2TICKS(ticks);
 }
-static int tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
+static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
 {
        struct sk_buff_head *list = &sch->q;
        psched_time_t tnext = netem_skb_cb(nskb)->time_to_send;
-        struct sk_buff *skb;
+        struct sk_buff *skb = skb_peek_tail(list);
-        if (likely(skb_queue_len(list) < sch->limit)) {
-                skb = skb_peek_tail(list);
-                /* Optimize for add at tail */
-                if (likely(!skb || tnext >= netem_skb_cb(skb)->time_to_send))
-                        return qdisc_enqueue_tail(nskb, sch);
-                skb_queue_reverse_walk(list, skb) {
+        /* Optimize for add at tail */
-                        if (tnext >= netem_skb_cb(skb)->time_to_send)
+        if (likely(!skb || tnext >= netem_skb_cb(skb)->time_to_send))
-                                break;
+                return __skb_queue_tail(list, nskb);
-                }
-                __skb_queue_after(list, skb, nskb);
+        skb_queue_reverse_walk(list, skb) {
-                sch->qstats.backlog += qdisc_pkt_len(nskb);
+                if (tnext >= netem_skb_cb(skb)->time_to_send)
-                return NET_XMIT_SUCCESS;
+                        break;
        }
-        return qdisc_reshape_fail(nskb, sch);
+        __skb_queue_after(list, skb, nskb);
 }
 /*
@@ -368,7 +361,6 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        /* We don't fill cb now as skb_unshare() may invalidate it */
        struct netem_skb_cb *cb;
        struct sk_buff *skb2;
-        int ret;
        int count = 1;
        /* Random duplication */
@@ -419,6 +411,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
        }
+        if (unlikely(skb_queue_len(&sch->q) >= sch->limit))
+                return qdisc_reshape_fail(skb, sch);
+        sch->qstats.backlog += qdisc_pkt_len(skb);
        cb = netem_skb_cb(skb);
        if (q->gap == 0 ||              /* not doing reordering */
            q->counter < q->gap - 1 ||  /* inside last reordering gap */
@@ -450,7 +447,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                cb->time_to_send = now + delay;
                ++q->counter;
-                ret = tfifo_enqueue(skb, sch);
+                tfifo_enqueue(skb, sch);
        } else {
                /*
                 * Do re-ordering by putting one out of N packets at the front
@@ -460,16 +457,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                q->counter = 0;
                __skb_queue_head(&sch->q, skb);
-                sch->qstats.backlog += qdisc_pkt_len(skb);
                sch->qstats.requeues++;
-                ret = NET_XMIT_SUCCESS;
-        }
-        if (ret != NET_XMIT_SUCCESS) {
-                if (net_xmit_drop_count(ret)) {
-                        sch->qstats.drops++;
-                        return ret;
-                }
        }
        return NET_XMIT_SUCCESS;
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index 74305c883bd3..30ea4674cabd 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -570,6 +570,8 @@ static int sfb_dump(struct Qdisc *sch, struct sk_buff *skb)
        sch->qstats.backlog = q->qdisc->qstats.backlog;
        opts = nla_nest_start(skb, TCA_OPTIONS);
+        if (opts == NULL)
+                goto nla_put_failure;
        if (nla_put(skb, TCA_SFB_PARMS, sizeof(opt), &opt))
                goto nla_put_failure;
        return nla_nest_end(skb, opts);
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 5bc9ab161b37..b16517ee1aaf 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -271,6 +271,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         */
        asoc->peer.sack_needed = 1;
        asoc->peer.sack_cnt = 0;
+        asoc->peer.sack_generation = 1;
        /* Assume that the peer will tell us if he recognizes ASCONF
         * as part of INIT exchange.
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 80564fe03024..8b9b6790a3df 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -736,15 +736,12 @@ static void __sctp_unhash_endpoint(struct sctp_endpoint *ep)
        epb = &ep->base;
-        if (hlist_unhashed(&epb->node))
-                return;
        epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
        head = &sctp_ep_hashtable[epb->hashent];
        sctp_write_lock(&head->lock);
-        __hlist_del(&epb->node);
+        hlist_del_init(&epb->node);
        sctp_write_unlock(&head->lock);
 }
@@ -825,7 +822,7 @@ static void __sctp_unhash_established(struct sctp_association *asoc)
        head = &sctp_assoc_hashtable[epb->hashent];
        sctp_write_lock(&head->lock);
-        __hlist_del(&epb->node);
+        hlist_del_init(&epb->node);
        sctp_write_unlock(&head->lock);
 }
diff --git a/net/sctp/output.c b/net/sctp/output.c
index f1b7d4bb591e..6ae47acaaec6 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -248,6 +248,11 @@ static sctp_xmit_t sctp_packet_bundle_sack(struct sctp_packet *pkt,
                /* If the SACK timer is running, we have a pending SACK */
                if (timer_pending(timer)) {
                        struct sctp_chunk *sack;
+                        if (pkt->transport->sack_generation !=
+                            pkt->transport->asoc->peer.sack_generation)
+                                return retval;
                        asoc->a_rwnd = asoc->rwnd;
                        sack = sctp_make_sack(asoc);
                        if (sack) {
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 5942d27b1444..9c90811d1134 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -673,7 +673,9 @@ void sctp_addr_wq_timeout_handler(unsigned long arg)
                                SCTP_DEBUG_PRINTK("sctp_addrwq_timo_handler: sctp_asconf_mgmt failed\n");
                        sctp_bh_unlock_sock(sk);
                }
+#if IS_ENABLED(CONFIG_IPV6)
 free_next:
+#endif
                list_del(&addrw->list);
                kfree(addrw);
        }
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index a85eeeb55dd0..b6de71efb140 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -734,8 +734,10 @@ struct sctp_chunk *sctp_make_sack(const struct sctp_association *asoc)
        int len;
        __u32 ctsn;
        __u16 num_gabs, num_dup_tsns;
+        struct sctp_association *aptr = (struct sctp_association *)asoc;
        struct sctp_tsnmap *map = (struct sctp_tsnmap *)&asoc->peer.tsn_map;
        struct sctp_gap_ack_block gabs[SCTP_MAX_GABS];
+        struct sctp_transport *trans;
        memset(gabs, 0, sizeof(gabs));
        ctsn = sctp_tsnmap_get_ctsn(map);
@@ -805,6 +807,20 @@ struct sctp_chunk *sctp_make_sack(const struct sctp_association *asoc)
                sctp_addto_chunk(retval, sizeof(__u32) * num_dup_tsns,
                                 sctp_tsnmap_get_dups(map));
+        /* Once we have a sack generated, check to see what our sack
+         * generation is, if its 0, reset the transports to 0, and reset
+         * the association generation to 1
+         *
+         * The idea is that zero is never used as a valid generation for the
+         * association so no transport will match after a wrap event like this,
+         * Until the next sack
+         */
+        if (++aptr->peer.sack_generation == 0) {
+                list_for_each_entry(trans, &asoc->peer.transport_addr_list,
+                                    transports)
+                        trans->sack_generation = 0;
+                aptr->peer.sack_generation = 1;
+        }
 nodata:
        return retval;
 }
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index c96d1a81cf42..8716da1a8592 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -1268,7 +1268,7 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                case SCTP_CMD_REPORT_TSN:
                        /* Record the arrival of a TSN.  */
                        error = sctp_tsnmap_mark(&asoc->peer.tsn_map,
-                                                 cmd->obj.u32);
+                                                 cmd->obj.u32, NULL);
                        break;
                case SCTP_CMD_REPORT_FWDTSN:
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index b3b8a8d813eb..31c7bfcd9b58 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1231,8 +1231,14 @@ out_free:
        SCTP_DEBUG_PRINTK("About to exit __sctp_connect() free asoc: %p"
                          " kaddrs: %p err: %d\n",
                          asoc, kaddrs, err);
-        if (asoc)
+        if (asoc) {
+                /* sctp_primitive_ASSOCIATE may have added this association
+                 * To the hash table, try to unhash it, just in case, its a noop
+                 * if it wasn't hashed so we're safe
+                 */
+                sctp_unhash_established(asoc);
                sctp_association_free(asoc);
+        }
        return err;
 }
@@ -1942,8 +1948,10 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
        goto out_unlock;
 out_free:
-        if (new_asoc)
+        if (new_asoc) {
+                sctp_unhash_established(asoc);
                sctp_association_free(asoc);
+        }
 out_unlock:
        sctp_release_sock(sk);
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index b026ba0c6992..1dcceb6e0ce6 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -68,6 +68,8 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
        peer->af_specific = sctp_get_af_specific(addr->sa.sa_family);
        memset(&peer->saddr, 0, sizeof(union sctp_addr));
+        peer->sack_generation = 0;
        /* From 6.3.1 RTO Calculation:
         *
         * C1) Until an RTT measurement has been made for a packet sent to the
diff --git a/net/sctp/tsnmap.c b/net/sctp/tsnmap.c
index f1e40cebc981..b5fb7c409023 100644
--- a/net/sctp/tsnmap.c
+++ b/net/sctp/tsnmap.c
@@ -114,7 +114,8 @@ int sctp_tsnmap_check(const struct sctp_tsnmap *map, __u32 tsn)
 /* Mark this TSN as seen.  */
-int sctp_tsnmap_mark(struct sctp_tsnmap *map, __u32 tsn)
+int sctp_tsnmap_mark(struct sctp_tsnmap *map, __u32 tsn,
+                     struct sctp_transport *trans)
 {
        u16 gap;
@@ -133,6 +134,9 @@ int sctp_tsnmap_mark(struct sctp_tsnmap *map, __u32 tsn)
                 */
                map->max_tsn_seen++;
                map->cumulative_tsn_ack_point++;
+                if (trans)
+                        trans->sack_generation =
+                                trans->asoc->peer.sack_generation;
                map->base_tsn++;
        } else {
                /* Either we already have a gap, or about to record a gap, so
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 8a84017834c2..33d894776192 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -715,7 +715,8 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
         * can mark it as received so the tsn_map is updated correctly.
         */
        if (sctp_tsnmap_mark(&asoc->peer.tsn_map,
-                             ntohl(chunk->subh.data_hdr->tsn)))
+                             ntohl(chunk->subh.data_hdr->tsn),
+                             chunk->transport))
                goto fail_mark;
        /* First calculate the padding, so we don't inadvertently
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index f2d1de7f2ffb..f5a6a4f4faf7 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -1051,7 +1051,7 @@ void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
        if (chunk && (freed >= needed)) {
                __u32 tsn;
                tsn = ntohl(chunk->subh.data_hdr->tsn);
-                sctp_tsnmap_mark(&asoc->peer.tsn_map, tsn);
+                sctp_tsnmap_mark(&asoc->peer.tsn_map, tsn, chunk->transport);
                sctp_ulpq_tail_data(ulpq, chunk, gfp);
                sctp_ulpq_partial_delivery(ulpq, chunk, gfp);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 15f347477a99..baf5704740ee 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1389,7 +1389,7 @@ static void reg_set_request_processed(void)
        spin_unlock(&reg_requests_lock);
        if (last_request->initiator == NL80211_REGDOM_SET_BY_USER)
-                cancel_delayed_work_sync(&reg_timeout);
+                cancel_delayed_work(&reg_timeout);
        if (need_more_processing)
                schedule_work(&reg_work);
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 8f2d68fc3a44..316cfd00914f 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -804,7 +804,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
             ntype == NL80211_IFTYPE_P2P_CLIENT))
                return -EBUSY;
-        if (ntype != otype) {
+        if (ntype != otype && netif_running(dev)) {
                err = cfg80211_can_change_interface(rdev, dev->ieee80211_ptr,
                                                    ntype);
                if (err)
diff --git a/scripts/gfp-translate b/scripts/gfp-translate
index c9230e158a8f..c9230e158a8f 100644..100755
--- a/scripts/gfp-translate
+++ b/scripts/gfp-translate
diff --git a/security/security.c b/security/security.c
index 3efc9b12aef4..860aeb349cb3 100644
--- a/security/security.c
+++ b/security/security.c
@@ -23,6 +23,7 @@
 #include <linux/mman.h>
 #include <linux/mount.h>
 #include <linux/personality.h>
+#include <linux/backing-dev.h>
 #include <net/flow.h>
 #define MAX_LSM_EVM_XATTR       2
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 372ec6502aa8..ffd8900a38e8 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2717,7 +2717,7 @@ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
                        ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
                return dentry_has_perm(cred, dentry, FILE__SETATTR);
-        if (ia_valid & ATTR_SIZE)
+        if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
                av |= FILE__OPEN;
        return dentry_has_perm(cred, dentry, av);
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index b8c53723e09b..df2de54a958d 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -145,7 +145,9 @@ struct security_class_mapping secclass_map[] = {
            "node_bind", "name_connect", NULL } },
        { "memprotect", { "mmap_zero", NULL } },
        { "peer", { "recv", NULL } },
-        { "capability2", { "mac_override", "mac_admin", "syslog", NULL } },
+        { "capability2",
+          { "mac_override", "mac_admin", "syslog", "wake_alarm", "block_suspend",
+            NULL } },
        { "kernel_service", { "use_as_override", "create_files_as", NULL } },
        { "tun_socket",
          { COMMON_SOCK_PERMS, NULL } },
diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig
index 163b6b5de3eb..d03079764189 100644
--- a/sound/pci/hda/Kconfig
+++ b/sound/pci/hda/Kconfig
@@ -97,19 +97,6 @@ config SND_HDA_CODEC_REALTEK
          snd-hda-codec-realtek.
          This module is automatically loaded at probing.
-config SND_HDA_ENABLE_REALTEK_QUIRKS
-        bool "Build static quirks for Realtek codecs"
-        depends on SND_HDA_CODEC_REALTEK
-        default y
-        help
-          Say Y here to build the static quirks codes for Realtek codecs.
-          If you need the "model" preset that the default BIOS auto-parser
-          can't handle, turn this option on.
-          If your device works with model=auto option, basically you don't
-          need the quirk code.  By turning this off, you can reduce the
-          module size quite a lot.
 config SND_HDA_CODEC_ANALOG
        bool "Build Analog Device HD-audio codec support"
        default y
diff --git a/sound/pci/hda/hda_auto_parser.c b/sound/pci/hda/hda_auto_parser.c
index 6e9ef3e25093..f7520b9f909c 100644
--- a/sound/pci/hda/hda_auto_parser.c
+++ b/sound/pci/hda/hda_auto_parser.c
@@ -618,7 +618,6 @@ int snd_hda_gen_add_verbs(struct hda_gen_spec *spec,
                          const struct hda_verb *list)
 {
        const struct hda_verb **v;
-        snd_array_init(&spec->verbs, sizeof(struct hda_verb *), 8);
        v = snd_array_new(&spec->verbs);
        if (!v)
                return -ENOMEM;
diff --git a/sound/pci/hda/hda_auto_parser.h b/sound/pci/hda/hda_auto_parser.h
index 2a7889dfbd1b..632ad0ad3007 100644
--- a/sound/pci/hda/hda_auto_parser.h
+++ b/sound/pci/hda/hda_auto_parser.h
@@ -157,4 +157,14 @@ void snd_hda_pick_fixup(struct hda_codec *codec,
                        const struct snd_pci_quirk *quirk,
                        const struct hda_fixup *fixlist);
+static inline void snd_hda_gen_init(struct hda_gen_spec *spec)
+{
+        snd_array_init(&spec->verbs, sizeof(struct hda_verb *), 8);
+}
+static inline void snd_hda_gen_free(struct hda_gen_spec *spec)
+{
+        snd_array_free(&spec->verbs);
+}
 #endif /* __SOUND_HDA_AUTO_PARSER_H */
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 7504e62188d6..51cb2a2e4fce 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -1184,6 +1184,7 @@ static void snd_hda_codec_free(struct hda_codec *codec)
 {
        if (!codec)
                return;
+        snd_hda_jack_tbl_clear(codec);
        restore_init_pincfgs(codec);
 #ifdef CONFIG_SND_HDA_POWER_SAVE
        cancel_delayed_work(&codec->power_work);
@@ -1192,6 +1193,7 @@ static void snd_hda_codec_free(struct hda_codec *codec)
        list_del(&codec->list);
        snd_array_free(&codec->mixers);
        snd_array_free(&codec->nids);
+        snd_array_free(&codec->cvt_setups);
        snd_array_free(&codec->conn_lists);
        snd_array_free(&codec->spdif_out);
        codec->bus->caddr_tbl[codec->addr] = NULL;
@@ -2333,6 +2335,8 @@ int snd_hda_codec_reset(struct hda_codec *codec)
        /* free only driver_pins so that init_pins + user_pins are restored */
        snd_array_free(&codec->driver_pins);
        restore_pincfgs(codec);
+        snd_array_free(&codec->cvt_setups);
+        snd_array_free(&codec->spdif_out);
        codec->num_pcms = 0;
        codec->pcm_info = NULL;
        codec->preset = NULL;
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 172370b3793b..2bf99fc1cbf2 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -445,8 +445,10 @@ static int conexant_init(struct hda_codec *codec)
 static void conexant_free(struct hda_codec *codec)
 {
+        struct conexant_spec *spec = codec->spec;
+        snd_hda_gen_free(&spec->gen);
        snd_hda_detach_beep_device(codec);
-        kfree(codec->spec);
+        kfree(spec);
 }
 static const struct snd_kcontrol_new cxt_capture_mixers[] = {
@@ -4466,6 +4468,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
        SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
        SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
        SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
+        SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
        {}
 };
@@ -4497,6 +4500,7 @@ static int patch_conexant_auto(struct hda_codec *codec)
        if (!spec)
                return -ENOMEM;
        codec->spec = spec;
+        snd_hda_gen_init(&spec->gen);
        switch (codec->vendor_id) {
        case 0x14f15045:
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index f8f4906e498d..aa4c25e0f327 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2289,6 +2289,7 @@ static void alc_free(struct hda_codec *codec)
        alc_shutup(codec);
        alc_free_kctls(codec);
        alc_free_bind_ctls(codec);
+        snd_hda_gen_free(&spec->gen);
        kfree(spec);
        snd_hda_detach_beep_device(codec);
 }
@@ -4253,6 +4254,7 @@ static int alc_alloc_spec(struct hda_codec *codec, hda_nid_t mixer_nid)
                return -ENOMEM;
        codec->spec = spec;
        spec->mixer_nid = mixer_nid;
+        snd_hda_gen_init(&spec->gen);
        err = alc_codec_rename_from_preset(codec);
        if (err < 0) {
@@ -6686,6 +6688,31 @@ static const struct alc_model_fixup alc662_fixup_models[] = {
        {}
 };
+static void alc662_fill_coef(struct hda_codec *codec)
+{
+        int val, coef;
+        coef = alc_get_coef0(codec);
+        switch (codec->vendor_id) {
+        case 0x10ec0662:
+                if ((coef & 0x00f0) == 0x0030) {
+                        val = alc_read_coef_idx(codec, 0x4); /* EAPD Ctrl */
+                        alc_write_coef_idx(codec, 0x4, val & ~(1<<10));
+                }
+                break;
+        case 0x10ec0272:
+        case 0x10ec0273:
+        case 0x10ec0663:
+        case 0x10ec0665:
+        case 0x10ec0670:
+        case 0x10ec0671:
+        case 0x10ec0672:
+                val = alc_read_coef_idx(codec, 0xd); /* EAPD Ctrl */
+                alc_write_coef_idx(codec, 0xd, val | (1<<14));
+                break;
+        }
+}
 /*
 */
@@ -6705,12 +6732,8 @@ static int patch_alc662(struct hda_codec *codec)
        alc_fix_pll_init(codec, 0x20, 0x04, 15);
-        if ((alc_get_coef0(codec) & (1 << 14)) &&
+        spec->init_hook = alc662_fill_coef;
-            codec->bus->pci->subsystem_vendor == 0x1025 &&
+        alc662_fill_coef(codec);
-            spec->cdefine.platform_type == 1) {
-                if (alc_codec_rename(codec, "ALC272X") < 0)
-                        goto error;
-        }
        alc_pick_fixup(codec, alc662_fixup_models,
                       alc662_fixup_tbl, alc662_fixups);
@@ -6718,6 +6741,13 @@ static int patch_alc662(struct hda_codec *codec)
        alc_auto_parse_customize_define(codec);
+        if ((alc_get_coef0(codec) & (1 << 14)) &&
+            codec->bus->pci->subsystem_vendor == 0x1025 &&
+            spec->cdefine.platform_type == 1) {
+                if (alc_codec_rename(codec, "ALC272X") < 0)
+                        goto error;
+        }
        /* automatic parse from the BIOS config */
        err = alc662_parse_auto_config(codec);
        if (err < 0)
@@ -6800,6 +6830,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
        { .id = 0x10ec0272, .name = "ALC272", .patch = patch_alc662 },
        { .id = 0x10ec0275, .name = "ALC275", .patch = patch_alc269 },
        { .id = 0x10ec0276, .name = "ALC276", .patch = patch_alc269 },
+        { .id = 0x10ec0280, .name = "ALC280", .patch = patch_alc269 },
        { .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660",
          .patch = patch_alc861 },
        { .id = 0x10ec0660, .name = "ALC660-VD", .patch = patch_alc861vd },
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 7db8228f1b88..07675282015a 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -4367,7 +4367,7 @@ static int stac92xx_init(struct hda_codec *codec)
                                         AC_PINCTL_IN_EN);
        for (i = 0; i < spec->num_pwrs; i++)  {
                hda_nid_t nid = spec->pwr_nids[i];
-                int pinctl, def_conf;
+                unsigned int pinctl, def_conf;
                def_conf = snd_hda_codec_get_pincfg(codec, nid);
                def_conf = get_defcfg_connect(def_conf);
@@ -4376,6 +4376,11 @@ static int stac92xx_init(struct hda_codec *codec)
                        stac_toggle_power_map(codec, nid, 0);
                        continue;
                }
+                if (def_conf == AC_JACK_PORT_FIXED) {
+                        /* no need for jack detection for fixed pins */
+                        stac_toggle_power_map(codec, nid, 1);
+                        continue;
+                }
                /* power on when no jack detection is available */
                /* or when the VREF is used for controlling LED */
                if (!spec->hp_detect ||
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index 64d2a4fa34b2..e9b62b5ea637 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -935,9 +935,7 @@ static int aic3x_hw_params(struct snd_pcm_substream *substream,
        }
 found:
-        data = snd_soc_read(codec, AIC3X_PLL_PROGA_REG);
+        snd_soc_update_bits(codec, AIC3X_PLL_PROGA_REG, PLLP_MASK, pll_p);
-        snd_soc_write(codec, AIC3X_PLL_PROGA_REG,
-                      data | (pll_p << PLLP_SHIFT));
        snd_soc_write(codec, AIC3X_OVRF_STATUS_AND_PLLR_REG,
                      pll_r << PLLR_SHIFT);
        snd_soc_write(codec, AIC3X_PLL_PROGB_REG, pll_j << PLLJ_SHIFT);
diff --git a/sound/soc/codecs/tlv320aic3x.h b/sound/soc/codecs/tlv320aic3x.h
index 6f097fb60683..08c7f6685ff0 100644
--- a/sound/soc/codecs/tlv320aic3x.h
+++ b/sound/soc/codecs/tlv320aic3x.h
@@ -166,6 +166,7 @@
 /* PLL registers bitfields */
 #define PLLP_SHIFT              0
+#define PLLP_MASK               7
 #define PLLQ_SHIFT              3
 #define PLLR_SHIFT              0
 #define PLLJ_SHIFT              2
diff --git a/sound/soc/codecs/wm2200.c b/sound/soc/codecs/wm2200.c
index acbdc5fde923..32682c1b7cde 100644
--- a/sound/soc/codecs/wm2200.c
+++ b/sound/soc/codecs/wm2200.c
@@ -1491,6 +1491,7 @@ static int wm2200_bclk_rates_dat[WM2200_NUM_BCLK_RATES] = {
 static int wm2200_bclk_rates_cd[WM2200_NUM_BCLK_RATES] = {
        5644800,
+        3763200,
        2882400,
        1881600,
        1411200,
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index aa8c98b628da..1436b6ce74d1 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -727,9 +727,6 @@ static void wm1811_jackdet_set_mode(struct snd_soc_codec *codec, u16 mode)
        if (!wm8994->jackdet || !wm8994->jack_cb)
                return;
-        if (!wm8994->jackdet || !wm8994->jack_cb)
-                return;
        if (wm8994->active_refcount)
                mode = WM1811_JACKDET_MODE_AUDIO;
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index e6906901debb..0f647d22cb4a 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -414,7 +414,7 @@ struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip,
 {
        struct list_head *p;
        struct snd_usb_endpoint *ep;
-        int ret, is_playback = direction == SNDRV_PCM_STREAM_PLAYBACK;
+        int is_playback = direction == SNDRV_PCM_STREAM_PLAYBACK;
        mutex_lock(&chip->mutex);
@@ -434,16 +434,6 @@ struct snd_usb_endpoint *snd_usb_add_endpoint(struct snd_usb_audio *chip,
                    type == SND_USB_ENDPOINT_TYPE_DATA ? "data" : "sync",
                    ep_num);
-        /* select the alt setting once so the endpoints become valid */
-        ret = usb_set_interface(chip->dev, alts->desc.bInterfaceNumber,
-                                alts->desc.bAlternateSetting);
-        if (ret < 0) {
-                snd_printk(KERN_ERR "%s(): usb_set_interface() failed, ret = %d\n",
-                                        __func__, ret);
-                ep = NULL;
-                goto __exit_unlock;
-        }
        ep = kzalloc(sizeof(*ep), GFP_KERNEL);
        if (!ep)
                goto __exit_unlock;
@@ -831,9 +821,6 @@ int snd_usb_endpoint_start(struct snd_usb_endpoint *ep)
        if (++ep->use_count != 1)
                return 0;
-        if (snd_BUG_ON(!test_bit(EP_FLAG_ACTIVATED, &ep->flags)))
-                return -EINVAL;
        /* just to be sure */
        deactivate_urbs(ep, 0, 1);
        wait_clear_urbs(ep);
@@ -911,9 +898,6 @@ void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep,
        if (snd_BUG_ON(ep->use_count == 0))
                return;
-        if (snd_BUG_ON(!test_bit(EP_FLAG_ACTIVATED, &ep->flags)))
-                return;
        if (--ep->use_count == 0) {
                deactivate_urbs(ep, force, can_sleep);
                ep->data_subs = NULL;
@@ -927,42 +911,6 @@ void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep,
 }
 /**
- * snd_usb_endpoint_activate: activate an snd_usb_endpoint
- *
- * @ep: the endpoint to activate
- *
- * If the endpoint is not currently in use, this functions will select the
- * correct alternate interface setting for the interface of this endpoint.
- *
- * In case of any active users, this functions does nothing.
- *
- * Returns an error if usb_set_interface() failed, 0 in all other
- * cases.
- */
-int snd_usb_endpoint_activate(struct snd_usb_endpoint *ep)
-{
-        if (ep->use_count != 0)
-                return 0;
-        if (!ep->chip->shutdown &&
-            !test_and_set_bit(EP_FLAG_ACTIVATED, &ep->flags)) {
-                int ret;
-                ret = usb_set_interface(ep->chip->dev, ep->iface, ep->alt_idx);
-                if (ret < 0) {
-                        snd_printk(KERN_ERR "%s() usb_set_interface() failed, ret = %d\n",
-                                                __func__, ret);
-                        clear_bit(EP_FLAG_ACTIVATED, &ep->flags);
-                        return ret;
-                }
-                return 0;
-        }
-        return -EBUSY;
-}
-/**
 * snd_usb_endpoint_deactivate: deactivate an snd_usb_endpoint
 *
 * @ep: the endpoint to deactivate
@@ -980,24 +928,15 @@ int snd_usb_endpoint_deactivate(struct snd_usb_endpoint *ep)
        if (!ep)
                return -EINVAL;
+        deactivate_urbs(ep, 1, 1);
+        wait_clear_urbs(ep);
        if (ep->use_count != 0)
                return 0;
-        if (!ep->chip->shutdown &&
+        clear_bit(EP_FLAG_ACTIVATED, &ep->flags);
-            test_and_clear_bit(EP_FLAG_ACTIVATED, &ep->flags)) {
-                int ret;
-                ret = usb_set_interface(ep->chip->dev, ep->iface, 0);
-                if (ret < 0) {
-                        snd_printk(KERN_ERR "%s(): usb_set_interface() failed, ret = %d\n",
-                                                __func__, ret);
-                        return ret;
-                }
-                return 0;
+        return 0;
-        }
-        return -EBUSY;
 }
 /**
diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index 41daaa24c25f..e71fe55cebef 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -341,6 +341,14 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
                .map = audigy2nx_map,
                .selector_map = audigy2nx_selectors,
        },
+        {       /* Logitech, Inc. QuickCam Pro for Notebooks */
+                .id = USB_ID(0x046d, 0x0991),
+                .ignore_ctl_error = 1,
+        },
+        {       /* Logitech, Inc. QuickCam E 3500 */
+                .id = USB_ID(0x046d, 0x09a4),
+                .ignore_ctl_error = 1,
+        },
        {
                /* Hercules DJ Console (Windows Edition) */
                .id = USB_ID(0x06f8, 0xb000),
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 54607f8c4f66..a1298f379428 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -261,19 +261,6 @@ static void stop_endpoints(struct snd_usb_substream *subs,
                                      force, can_sleep, wait);
 }
-static int activate_endpoints(struct snd_usb_substream *subs)
-{
-        if (subs->sync_endpoint) {
-                int ret;
-                ret = snd_usb_endpoint_activate(subs->sync_endpoint);
-                if (ret < 0)
-                        return ret;
-        }
-        return snd_usb_endpoint_activate(subs->data_endpoint);
-}
 static int deactivate_endpoints(struct snd_usb_substream *subs)
 {
        int reta, retb;
@@ -314,6 +301,33 @@ static int set_format(struct snd_usb_substream *subs, struct audioformat *fmt)
        if (fmt == subs->cur_audiofmt)
                return 0;
+        /* close the old interface */
+        if (subs->interface >= 0 && subs->interface != fmt->iface) {
+                err = usb_set_interface(subs->dev, subs->interface, 0);
+                if (err < 0) {
+                        snd_printk(KERN_ERR "%d:%d:%d: return to setting 0 failed (%d)\n",
+                                dev->devnum, fmt->iface, fmt->altsetting, err);
+                        return -EIO;
+                }
+                subs->interface = -1;
+                subs->altset_idx = 0;
+        }
+        /* set interface */
+        if (subs->interface != fmt->iface ||
+            subs->altset_idx != fmt->altset_idx) {
+                err = usb_set_interface(dev, fmt->iface, fmt->altsetting);
+                if (err < 0) {
+                        snd_printk(KERN_ERR "%d:%d:%d: usb_set_interface failed (%d)\n",
+                                   dev->devnum, fmt->iface, fmt->altsetting, err);
+                        return -EIO;
+                }
+                snd_printdd(KERN_INFO "setting usb interface %d:%d\n",
+                                fmt->iface, fmt->altsetting);
+                subs->interface = fmt->iface;
+                subs->altset_idx = fmt->altset_idx;
+        }
        subs->data_endpoint = snd_usb_add_endpoint(subs->stream->chip,
                                                   alts, fmt->endpoint, subs->direction,
                                                   SND_USB_ENDPOINT_TYPE_DATA);
@@ -387,7 +401,7 @@ add_sync_ep:
                subs->data_endpoint->sync_master = subs->sync_endpoint;
        }
-        if ((err = snd_usb_init_pitch(subs->stream->chip, subs->interface, alts, fmt)) < 0)
+        if ((err = snd_usb_init_pitch(subs->stream->chip, fmt->iface, alts, fmt)) < 0)
                return err;
        subs->cur_audiofmt = fmt;
@@ -450,7 +464,7 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream,
                struct usb_interface *iface;
                iface = usb_ifnum_to_if(subs->dev, fmt->iface);
                alts = &iface->altsetting[fmt->altset_idx];
-                ret = snd_usb_init_sample_rate(subs->stream->chip, subs->interface, alts, fmt, rate);
+                ret = snd_usb_init_sample_rate(subs->stream->chip, fmt->iface, alts, fmt, rate);
                if (ret < 0)
                        return ret;
                subs->cur_rate = rate;
@@ -460,12 +474,6 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream,
                mutex_lock(&subs->stream->chip->shutdown_mutex);
                /* format changed */
                stop_endpoints(subs, 0, 0, 0);
-                deactivate_endpoints(subs);
-                ret = activate_endpoints(subs);
-                if (ret < 0)
-                        goto unlock;
                ret = snd_usb_endpoint_set_params(subs->data_endpoint, hw_params, fmt,
                                                  subs->sync_endpoint);
                if (ret < 0)
@@ -500,6 +508,7 @@ static int snd_usb_hw_free(struct snd_pcm_substream *substream)
        subs->period_bytes = 0;
        mutex_lock(&subs->stream->chip->shutdown_mutex);
        stop_endpoints(subs, 0, 1, 1);
+        deactivate_endpoints(subs);
        mutex_unlock(&subs->stream->chip->shutdown_mutex);
        return snd_pcm_lib_free_vmalloc_buffer(substream);
 }
@@ -938,16 +947,20 @@ static int snd_usb_pcm_open(struct snd_pcm_substream *substream, int direction)
 static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
 {
-        int ret;
        struct snd_usb_stream *as = snd_pcm_substream_chip(substream);
        struct snd_usb_substream *subs = &as->substream[direction];
        stop_endpoints(subs, 0, 0, 0);
-        ret = deactivate_endpoints(subs);
+        if (!as->chip->shutdown && subs->interface >= 0) {
+                usb_set_interface(subs->dev, subs->interface, 0);
+                subs->interface = -1;
+        }
        subs->pcm_substream = NULL;
        snd_usb_autosuspend(subs->stream->chip);
-        return ret;
+        return 0;
 }
 /* Since a URB can handle only a single linear buffer, we must use double
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index d89ab4c7d44b..79780fa57a43 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -1831,6 +1831,36 @@ YAMAHA_DEVICE(0x7010, "UB99"),
                }
        }
 },
+{
+        USB_DEVICE(0x0582, 0x014d),
+        .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
+                /* .vendor_name = "BOSS", */
+                /* .product_name = "GT-100", */
+                .ifnum = QUIRK_ANY_INTERFACE,
+                .type = QUIRK_COMPOSITE,
+                .data = (const struct snd_usb_audio_quirk[]) {
+                        {
+                                .ifnum = 1,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 2,
+                                .type = QUIRK_AUDIO_STANDARD_INTERFACE
+                        },
+                        {
+                                .ifnum = 3,
+                                .type = QUIRK_MIDI_FIXED_ENDPOINT,
+                                .data = & (const struct snd_usb_midi_endpoint_info) {
+                                        .out_cables = 0x0001,
+                                        .in_cables  = 0x0001
+                                }
+                        },
+                        {
+                                .ifnum = -1
+                        }
+                }
+        }
+},
 /* Guillemot devices */
 {
diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
index 35ae56864e4f..a1f4e3669142 100644
--- a/tools/perf/util/map.c
+++ b/tools/perf/util/map.c
@@ -669,25 +669,26 @@ struct machine *machines__find(struct rb_root *self, pid_t pid)
 struct machine *machines__findnew(struct rb_root *self, pid_t pid)
 {
        char path[PATH_MAX];
-        const char *root_dir;
+        const char *root_dir = "";
        struct machine *machine = machines__find(self, pid);
-        if (!machine || machine->pid != pid) {
+        if (machine && (machine->pid == pid))
-                if (pid == HOST_KERNEL_ID || pid == DEFAULT_GUEST_KERNEL_ID)
+                goto out;
-                        root_dir = "";
-                else {
+        if ((pid != HOST_KERNEL_ID) &&
-                        if (!symbol_conf.guestmount)
+            (pid != DEFAULT_GUEST_KERNEL_ID) &&
-                                goto out;
+            (symbol_conf.guestmount)) {
-                        sprintf(path, "%s/%d", symbol_conf.guestmount, pid);
+                sprintf(path, "%s/%d", symbol_conf.guestmount, pid);
-                        if (access(path, R_OK)) {
+                if (access(path, R_OK)) {
-                                pr_err("Can't access file %s\n", path);
+                        pr_err("Can't access file %s\n", path);
-                                goto out;
+                        machine = NULL;
-                        }
+                        goto out;
-                        root_dir = path;
                }
-                machine = machines__add(self, pid, root_dir);
+                root_dir = path;
        }
+        machine = machines__add(self, pid, root_dir);
 out:
        return machine;
 }
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index c3e399bcf18d..56142d0fb8d7 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -926,7 +926,7 @@ static struct machine *
                else
                        pid = event->ip.pid;
-                return perf_session__find_machine(session, pid);
+                return perf_session__findnew_machine(session, pid);
        }
        return perf_session__find_host_machine(session);
diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
index df2fddbf0cd2..5dd3b5ec8411 100644
--- a/tools/perf/util/trace-event-parse.c
+++ b/tools/perf/util/trace-event-parse.c
@@ -198,9 +198,8 @@ void print_trace_event(int cpu, void *data, int size)
        record.data = data;
        trace_seq_init(&s);
-        pevent_print_event(pevent, &s, &record);
+        pevent_event_info(&s, event, &record);
        trace_seq_do_printf(&s);
-        printf("\n");
 }
 void print_event(int cpu, void *data, int size, unsigned long long nsecs,
diff --git a/virt/kvm/assigned-dev.c b/virt/kvm/assigned-dev.c
index b1e091ae2f37..23a41a9f8db9 100644
--- a/virt/kvm/assigned-dev.c
+++ b/virt/kvm/assigned-dev.c
@@ -334,6 +334,11 @@ static int assigned_device_enable_host_intx(struct kvm *kvm,
 }
 #ifdef __KVM_HAVE_MSI
+static irqreturn_t kvm_assigned_dev_msi(int irq, void *dev_id)
+{
+        return IRQ_WAKE_THREAD;
+}
 static int assigned_device_enable_host_msi(struct kvm *kvm,
                                           struct kvm_assigned_dev_kernel *dev)
 {
@@ -346,7 +351,7 @@ static int assigned_device_enable_host_msi(struct kvm *kvm,
        }
        dev->host_irq = dev->dev->irq;
-        if (request_threaded_irq(dev->host_irq, NULL,
+        if (request_threaded_irq(dev->host_irq, kvm_assigned_dev_msi,
                                 kvm_assigned_dev_thread_msi, 0,
                                 dev->irq_name, dev)) {
                pci_disable_msi(dev->dev);
@@ -358,6 +363,11 @@ static int assigned_device_enable_host_msi(struct kvm *kvm,
 #endif
 #ifdef __KVM_HAVE_MSIX
+static irqreturn_t kvm_assigned_dev_msix(int irq, void *dev_id)
+{
+        return IRQ_WAKE_THREAD;
+}
 static int assigned_device_enable_host_msix(struct kvm *kvm,
                                            struct kvm_assigned_dev_kernel *dev)
 {
@@ -374,7 +384,8 @@ static int assigned_device_enable_host_msix(struct kvm *kvm,
        for (i = 0; i < dev->entries_nr; i++) {
                r = request_threaded_irq(dev->host_msix_entries[i].vector,
-                                         NULL, kvm_assigned_dev_thread_msix,
+                                         kvm_assigned_dev_msix,
+                                         kvm_assigned_dev_thread_msix,
                                         0, dev->irq_name, dev);
                if (r)
                        goto err;
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index f59c1e8de7a2..7d7e2aaffece 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -198,7 +198,7 @@ static void irqfd_update(struct kvm *kvm, struct _irqfd *irqfd,
 }
 static int
-kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi)
+kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
 {
        struct kvm_irq_routing_table *irq_rt;
        struct _irqfd *irqfd, *tmp;
@@ -212,12 +212,12 @@ kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi)
                return -ENOMEM;
        irqfd->kvm = kvm;
-        irqfd->gsi = gsi;
+        irqfd->gsi = args->gsi;
        INIT_LIST_HEAD(&irqfd->list);
        INIT_WORK(&irqfd->inject, irqfd_inject);
        INIT_WORK(&irqfd->shutdown, irqfd_shutdown);
-        file = eventfd_fget(fd);
+        file = eventfd_fget(args->fd);
        if (IS_ERR(file)) {
                ret = PTR_ERR(file);
                goto fail;
@@ -298,19 +298,19 @@ kvm_eventfd_init(struct kvm *kvm)
 * shutdown any irqfd's that match fd+gsi
 */
 static int
-kvm_irqfd_deassign(struct kvm *kvm, int fd, int gsi)
+kvm_irqfd_deassign(struct kvm *kvm, struct kvm_irqfd *args)
 {
        struct _irqfd *irqfd, *tmp;
        struct eventfd_ctx *eventfd;
-        eventfd = eventfd_ctx_fdget(fd);
+        eventfd = eventfd_ctx_fdget(args->fd);
        if (IS_ERR(eventfd))
                return PTR_ERR(eventfd);
        spin_lock_irq(&kvm->irqfds.lock);
        list_for_each_entry_safe(irqfd, tmp, &kvm->irqfds.items, list) {
-                if (irqfd->eventfd == eventfd && irqfd->gsi == gsi) {
+                if (irqfd->eventfd == eventfd && irqfd->gsi == args->gsi) {
                        /*
                         * This rcu_assign_pointer is needed for when
                         * another thread calls kvm_irq_routing_update before
@@ -338,12 +338,15 @@ kvm_irqfd_deassign(struct kvm *kvm, int fd, int gsi)
 }
 int
-kvm_irqfd(struct kvm *kvm, int fd, int gsi, int flags)
+kvm_irqfd(struct kvm *kvm, struct kvm_irqfd *args)
 {
-        if (flags & KVM_IRQFD_FLAG_DEASSIGN)
+        if (args->flags & ~KVM_IRQFD_FLAG_DEASSIGN)
-                return kvm_irqfd_deassign(kvm, fd, gsi);
+                return -EINVAL;
+        if (args->flags & KVM_IRQFD_FLAG_DEASSIGN)
+                return kvm_irqfd_deassign(kvm, args);
-        return kvm_irqfd_assign(kvm, fd, gsi);
+        return kvm_irqfd_assign(kvm, args);
 }
 /*
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 7e140683ff14..44ee7124b16d 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2047,7 +2047,7 @@ static long kvm_vm_ioctl(struct file *filp,
                r = -EFAULT;
                if (copy_from_user(&data, argp, sizeof data))
                        goto out;
-                r = kvm_irqfd(kvm, data.fd, data.gsi, data.flags);
+                r = kvm_irqfd(kvm, &data);
                break;
        }
        case KVM_IOEVENTFD: {
@@ -2845,6 +2845,7 @@ void kvm_exit(void)
        kvm_arch_hardware_unsetup();
        kvm_arch_exit();
        free_cpumask_var(cpus_hardware_enabled);
+        __free_page(fault_page);
        __free_page(hwpoison_page);
        __free_page(bad_page);
 }