443 files changed, 7855 insertions, 2590 deletions
diff --git a/Documentation/PCI/MSI-HOWTO.txt b/Documentation/PCI/MSI-HOWTO.txt
index 3f5e0b09bed5..53e6fca146d7 100644
--- a/Documentation/PCI/MSI-HOWTO.txt
+++ b/Documentation/PCI/MSI-HOWTO.txt
@@ -45,7 +45,7 @@ arrived in memory (this becomes more likely with devices behind PCI-PCI
 bridges).  In order to ensure that all the data has arrived in memory,
 the interrupt handler must read a register on the device which raised
 the interrupt.  PCI transaction ordering rules require that all the data
-arrives in memory before the value can be returned from the register.
+arrive in memory before the value may be returned from the register.
 Using MSIs avoids this problem as the interrupt-generating write cannot
 pass the data writes, so by the time the interrupt is raised, the driver
 knows that all the data has arrived in memory.
@@ -86,13 +86,13 @@ device.
 int pci_enable_msi(struct pci_dev *dev)
-A successful call will allocate ONE interrupt to the device, regardless
+A successful call allocates ONE interrupt to the device, regardless
-of how many MSIs the device supports.  The device will be switched from
+of how many MSIs the device supports.  The device is switched from
 pin-based interrupt mode to MSI mode.  The dev->irq number is changed
-to a new number which represents the message signaled interrupt.
+to a new number which represents the message signaled interrupt;
-This function should be called before the driver calls request_irq()
+consequently, this function should be called before the driver calls
-since enabling MSIs disables the pin-based IRQ and the driver will not
+request_irq(), because an MSI is delivered via a vector that is
-receive interrupts on the old interrupt.
+different from the vector of a pin-based interrupt.
 4.2.2 pci_enable_msi_block
@@ -111,20 +111,20 @@ the device are in the range dev->irq to dev->irq + count - 1.
 If this function returns a negative number, it indicates an error and
 the driver should not attempt to request any more MSI interrupts for
-this device.  If this function returns a positive number, it will be
+this device.  If this function returns a positive number, it is
-less than 'count' and indicate the number of interrupts that could have
+less than 'count' and indicates the number of interrupts that could have
-been allocated.  In neither case will the irq value have been
+been allocated.  In neither case is the irq value updated or the device
-updated, nor will the device have been switched into MSI mode.
+switched into MSI mode.
 The device driver must decide what action to take if
-pci_enable_msi_block() returns a value less than the number asked for.
+pci_enable_msi_block() returns a value less than the number requested.
-Some devices can make use of fewer interrupts than the maximum they
+For instance, the driver could still make use of fewer interrupts;
-request; in this case the driver should call pci_enable_msi_block()
+in this case the driver should call pci_enable_msi_block()
 again.  Note that it is not guaranteed to succeed, even when the
 'count' has been reduced to the value returned from a previous call to
 pci_enable_msi_block().  This is because there are multiple constraints
 on the number of vectors that can be allocated; pci_enable_msi_block()
-will return as soon as it finds any constraint that doesn't allow the
+returns as soon as it finds any constraint that doesn't allow the
 call to succeed.
 4.2.3 pci_disable_msi
@@ -137,10 +137,10 @@ interrupt number and frees the previously allocated message signaled
 interrupt(s).  The interrupt may subsequently be assigned to another
 device, so drivers should not cache the value of dev->irq.
-A device driver must always call free_irq() on the interrupt(s)
+Before calling this function, a device driver must always call free_irq()
-for which it has called request_irq() before calling this function.
+on any interrupt for which it previously called request_irq().
-Failure to do so will result in a BUG_ON(), the device will be left with
+Failure to do so results in a BUG_ON(), leaving the device with
-MSI enabled and will leak its vector.
+MSI enabled and thus leaking its vector.
 4.3 Using MSI-X
@@ -155,10 +155,10 @@ struct msix_entry {
 };
 This allows for the device to use these interrupts in a sparse fashion;
-for example it could use interrupts 3 and 1027 and allocate only a
+for example, it could use interrupts 3 and 1027 and yet allocate only a
 two-element array.  The driver is expected to fill in the 'entry' value
-in each element of the array to indicate which entries it wants the kernel
+in each element of the array to indicate for which entries the kernel
-to assign interrupts for.  It is invalid to fill in two entries with the
+should assign interrupts; it is invalid to fill in two entries with the
 same number.
 4.3.1 pci_enable_msix
@@ -168,10 +168,11 @@ int pci_enable_msix(struct pci_dev *dev, struct msix_entry *entries, int nvec)
 Calling this function asks the PCI subsystem to allocate 'nvec' MSIs.
 The 'entries' argument is a pointer to an array of msix_entry structs
 which should be at least 'nvec' entries in size.  On success, the
-function will return 0 and the device will have been switched into
+device is switched into MSI-X mode and the function returns 0.
-MSI-X interrupt mode.  The 'vector' elements in each entry will have
+The 'vector' member in each entry is populated with the interrupt number;
-been filled in with the interrupt number.  The driver should then call
+the driver should then call request_irq() for each 'vector' that it
-request_irq() for each 'vector' that it decides to use.
+decides to use.  The device driver is responsible for keeping track of the
+interrupts assigned to the MSI-X vectors so it can free them again later.
 If this function returns a negative number, it indicates an error and
 the driver should not attempt to allocate any more MSI-X interrupts for
@@ -181,16 +182,14 @@ below.
 This function, in contrast with pci_enable_msi(), does not adjust
 dev->irq.  The device will not generate interrupts for this interrupt
-number once MSI-X is enabled.  The device driver is responsible for
+number once MSI-X is enabled.
-keeping track of the interrupts assigned to the MSI-X vectors so it can
-free them again later.
 Device drivers should normally call this function once per device
 during the initialization phase.
-It is ideal if drivers can cope with a variable number of MSI-X interrupts,
+It is ideal if drivers can cope with a variable number of MSI-X interrupts;
 there are many reasons why the platform may not be able to provide the
-exact number a driver asks for.
+exact number that a driver asks for.
 A request loop to achieve that might look like:
@@ -212,15 +211,15 @@ static int foo_driver_enable_msix(struct foo_adapter *adapter, int nvec)
 void pci_disable_msix(struct pci_dev *dev)
-This API should be used to undo the effect of pci_enable_msix().  It frees
+This function should be used to undo the effect of pci_enable_msix().  It frees
 the previously allocated message signaled interrupts.  The interrupts may
 subsequently be assigned to another device, so drivers should not cache
 the value of the 'vector' elements over a call to pci_disable_msix().
-A device driver must always call free_irq() on the interrupt(s)
+Before calling this function, a device driver must always call free_irq()
-for which it has called request_irq() before calling this function.
+on any interrupt for which it previously called request_irq().
-Failure to do so will result in a BUG_ON(), the device will be left with
+Failure to do so results in a BUG_ON(), leaving the device with
-MSI enabled and will leak its vector.
+MSI-X enabled and thus leaking its vector.
 4.3.3 The MSI-X Table
@@ -232,10 +231,10 @@ mask or unmask an interrupt, it should call disable_irq() / enable_irq().
 4.4 Handling devices implementing both MSI and MSI-X capabilities
 If a device implements both MSI and MSI-X capabilities, it can
-run in either MSI mode or MSI-X mode but not both simultaneously.
+run in either MSI mode or MSI-X mode, but not both simultaneously.
 This is a requirement of the PCI spec, and it is enforced by the
 PCI layer.  Calling pci_enable_msi() when MSI-X is already enabled or
-pci_enable_msix() when MSI is already enabled will result in an error.
+pci_enable_msix() when MSI is already enabled results in an error.
 If a device driver wishes to switch between MSI and MSI-X at runtime,
 it must first quiesce the device, then switch it back to pin-interrupt
 mode, before calling pci_enable_msi() or pci_enable_msix() and resuming
@@ -251,7 +250,7 @@ the MSI-X facilities in preference to the MSI facilities.  As mentioned
 above, MSI-X supports any number of interrupts between 1 and 2048.
 In constrast, MSI is restricted to a maximum of 32 interrupts (and
 must be a power of two).  In addition, the MSI interrupt vectors must
-be allocated consecutively, so the system may not be able to allocate
+be allocated consecutively, so the system might not be able to allocate
 as many vectors for MSI as it could for MSI-X.  On some platforms, MSI
 interrupts must all be targeted at the same set of CPUs whereas MSI-X
 interrupts can all be targeted at different CPUs.
@@ -281,7 +280,7 @@ disabled to enabled and back again.
 Using 'lspci -v' (as root) may show some devices with "MSI", "Message
 Signalled Interrupts" or "MSI-X" capabilities.  Each of these capabilities
-has an 'Enable' flag which will be followed with either "+" (enabled)
+has an 'Enable' flag which is followed with either "+" (enabled)
 or "-" (disabled).
@@ -298,7 +297,7 @@ The PCI stack provides three ways to disable MSIs:
 Some host chipsets simply don't support MSIs properly.  If we're
 lucky, the manufacturer knows this and has indicated it in the ACPI
-FADT table.  In this case, Linux will automatically disable MSIs.
+FADT table.  In this case, Linux automatically disables MSIs.
 Some boards don't include this information in the table and so we have
 to detect them ourselves.  The complete list of these is found near the
 quirk_disable_all_msi() function in drivers/pci/quirks.c.
@@ -317,7 +316,7 @@ Some bridges allow you to enable MSIs by changing some bits in their
 PCI configuration space (especially the Hypertransport chipsets such
 as the nVidia nForce and Serverworks HT2000).  As with host chipsets,
 Linux mostly knows about them and automatically enables MSIs if it can.
-If you have a bridge which Linux doesn't yet know about, you can enable
+If you have a bridge unknown to Linux, you can enable
 MSIs in configuration space using whatever method you know works, then
 enable MSIs on that bridge by doing:
@@ -327,7 +326,7 @@ where $bridge is the PCI address of the bridge you've enabled (eg
 0000:00:0e.0).
 To disable MSIs, echo 0 instead of 1.  Changing this value should be
-done with caution as it can break interrupt handling for all devices
+done with caution as it could break interrupt handling for all devices
 below this bridge.
 Again, please notify linux-pci@vger.kernel.org of any bridges that need
@@ -336,7 +335,7 @@ special handling.
 5.3. Disabling MSIs on a single device
 Some devices are known to have faulty MSI implementations.  Usually this
-is handled in the individual device driver but occasionally it's necessary
+is handled in the individual device driver, but occasionally it's necessary
 to handle this with a quirk.  Some drivers have an option to disable use
 of MSI.  While this is a convenient workaround for the driver author,
 it is not good practise, and should not be emulated.
@@ -350,7 +349,7 @@ for your machine.  You should also check your .config to be sure you
 have enabled CONFIG_PCI_MSI.
 Then, 'lspci -t' gives the list of bridges above a device.  Reading
-/sys/bus/pci/devices/*/msi_bus will tell you whether MSI are enabled (1)
+/sys/bus/pci/devices/*/msi_bus will tell you whether MSIs are enabled (1)
 or disabled (0).  If 0 is found in any of the msi_bus files belonging
 to bridges between the PCI root and the device, MSIs are disabled.
diff --git a/Documentation/block/cfq-iosched.txt b/Documentation/block/cfq-iosched.txt
index e578feed6d81..6d670f570451 100644
--- a/Documentation/block/cfq-iosched.txt
+++ b/Documentation/block/cfq-iosched.txt
@@ -43,3 +43,74 @@ If one sets slice_idle=0 and if storage supports NCQ, CFQ internally switches
 to IOPS mode and starts providing fairness in terms of number of requests
 dispatched. Note that this mode switching takes effect only for group
 scheduling. For non-cgroup users nothing should change.
+CFQ IO scheduler Idling Theory
+===============================
+Idling on a queue is primarily about waiting for the next request to come
+on same queue after completion of a request. In this process CFQ will not
+dispatch requests from other cfq queues even if requests are pending there.
+The rationale behind idling is that it can cut down on number of seeks
+on rotational media. For example, if a process is doing dependent
+sequential reads (next read will come on only after completion of previous
+one), then not dispatching request from other queue should help as we
+did not move the disk head and kept on dispatching sequential IO from
+one queue.
+CFQ has following service trees and various queues are put on these trees.
+        sync-idle       sync-noidle     async
+All cfq queues doing synchronous sequential IO go on to sync-idle tree.
+On this tree we idle on each queue individually.
+All synchronous non-sequential queues go on sync-noidle tree. Also any
+request which are marked with REQ_NOIDLE go on this service tree. On this
+tree we do not idle on individual queues instead idle on the whole group
+of queues or the tree. So if there are 4 queues waiting for IO to dispatch
+we will idle only once last queue has dispatched the IO and there is
+no more IO on this service tree.
+All async writes go on async service tree. There is no idling on async
+queues.
+CFQ has some optimizations for SSDs and if it detects a non-rotational
+media which can support higher queue depth (multiple requests at in
+flight at a time), then it cuts down on idling of individual queues and
+all the queues move to sync-noidle tree and only tree idle remains. This
+tree idling provides isolation with buffered write queues on async tree.
+FAQ
+===
+Q1. Why to idle at all on queues marked with REQ_NOIDLE.
+A1. We only do tree idle (all queues on sync-noidle tree) on queues marked
+    with REQ_NOIDLE. This helps in providing isolation with all the sync-idle
+    queues. Otherwise in presence of many sequential readers, other
+    synchronous IO might not get fair share of disk.
+    For example, if there are 10 sequential readers doing IO and they get
+    100ms each. If a REQ_NOIDLE request comes in, it will be scheduled
+    roughly after 1 second. If after completion of REQ_NOIDLE request we
+    do not idle, and after a couple of milli seconds a another REQ_NOIDLE
+    request comes in, again it will be scheduled after 1second. Repeat it
+    and notice how a workload can lose its disk share and suffer due to
+    multiple sequential readers.
+    fsync can generate dependent IO where bunch of data is written in the
+    context of fsync, and later some journaling data is written. Journaling
+    data comes in only after fsync has finished its IO (atleast for ext4
+    that seemed to be the case). Now if one decides not to idle on fsync
+    thread due to REQ_NOIDLE, then next journaling write will not get
+    scheduled for another second. A process doing small fsync, will suffer
+    badly in presence of multiple sequential readers.
+    Hence doing tree idling on threads using REQ_NOIDLE flag on requests
+    provides isolation from multiple sequential readers and at the same
+    time we do not idle on individual threads.
+Q2. When to specify REQ_NOIDLE
+A2. I would think whenever one is doing synchronous write and not expecting
+    more writes to be dispatched from same context soon, should be able
+    to specify REQ_NOIDLE on writes and that probably should work well for
+    most of the cases.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 6ca1f5cb71e0..614d0382e2cb 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1350,9 +1350,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        it is equivalent to "nosmp", which also disables
                        the IO APIC.
-        max_loop=       [LOOP] Maximum number of loopback devices that can
+        max_loop=       [LOOP] The number of loop block devices that get
-                        be mounted
+        (loop.max_loop) unconditionally pre-created at init time. The default
-                        Format: <1-256>
+                        number is configured by BLK_DEV_LOOP_MIN_COUNT. Instead
+                        of statically allocating a predefined number, loop
+                        devices can be requested on-demand with the
+                        /dev/loop-control interface.
        mcatest=        [IA-64]
diff --git a/Documentation/networking/00-INDEX b/Documentation/networking/00-INDEX
index 4edd78dfb362..bbce1215434a 100644
--- a/Documentation/networking/00-INDEX
+++ b/Documentation/networking/00-INDEX
@@ -1,13 +1,21 @@
 00-INDEX
        - this file
+3c359.txt
+        - information on the 3Com TokenLink Velocity XL (3c5359) driver.
 3c505.txt
        - information on the 3Com EtherLink Plus (3c505) driver.
+3c509.txt
+        - information on the 3Com Etherlink III Series Ethernet cards.
 6pack.txt
        - info on the 6pack protocol, an alternative to KISS for AX.25
 DLINK.txt
        - info on the D-Link DE-600/DE-620 parallel port pocket adapters
 PLIP.txt
        - PLIP: The Parallel Line Internet Protocol device driver
+README.ipw2100
+        - README for the Intel PRO/Wireless 2100 driver.
+README.ipw2200
+        - README for the Intel PRO/Wireless 2915ABG and 2200BG driver.
 README.sb1000
        - info on General Instrument/NextLevel SURFboard1000 cable modem.
 alias.txt
@@ -20,8 +28,12 @@ atm.txt
        - info on where to get ATM programs and support for Linux.
 ax25.txt
        - info on using AX.25 and NET/ROM code for Linux
+batman-adv.txt
+        - B.A.T.M.A.N routing protocol on top of layer 2 Ethernet Frames.
 baycom.txt
        - info on the driver for Baycom style amateur radio modems
+bonding.txt
+        - Linux Ethernet Bonding Driver HOWTO: link aggregation in Linux.
 bridge.txt
        - where to get user space programs for ethernet bridging with Linux.
 can.txt
@@ -34,32 +46,60 @@ cxacru.txt
        - Conexant AccessRunner USB ADSL Modem
 cxacru-cf.py
        - Conexant AccessRunner USB ADSL Modem configuration file parser
+cxgb.txt
+        - Release Notes for the Chelsio N210 Linux device driver.
+dccp.txt
+        - the Datagram Congestion Control Protocol (DCCP) (RFC 4340..42).
 de4x5.txt
        - the Digital EtherWORKS DE4?? and DE5?? PCI Ethernet driver
 decnet.txt
        - info on using the DECnet networking layer in Linux.
 depca.txt
        - the Digital DEPCA/EtherWORKS DE1?? and DE2?? LANCE Ethernet driver
+dl2k.txt
+        - README for D-Link DL2000-based Gigabit Ethernet Adapters (dl2k.ko).
+dm9000.txt
+        - README for the Simtec DM9000 Network driver.
 dmfe.txt
        - info on the Davicom DM9102(A)/DM9132/DM9801 fast ethernet driver.
+dns_resolver.txt
+        - The DNS resolver module allows kernel servies to make DNS queries.
+driver.txt
+        - Softnet driver issues.
 e100.txt
        - info on Intel's EtherExpress PRO/100 line of 10/100 boards
 e1000.txt
        - info on Intel's E1000 line of gigabit ethernet boards
+e1000e.txt
+        - README for the Intel Gigabit Ethernet Driver (e1000e).
 eql.txt
        - serial IP load balancing
 ewrk3.txt
        - the Digital EtherWORKS 3 DE203/4/5 Ethernet driver
+fib_trie.txt
+        - Level Compressed Trie (LC-trie) notes: a structure for routing.
 filter.txt
        - Linux Socket Filtering
 fore200e.txt
        - FORE Systems PCA-200E/SBA-200E ATM NIC driver info.
 framerelay.txt
        - info on using Frame Relay/Data Link Connection Identifier (DLCI).
+gen_stats.txt
+        - Generic networking statistics for netlink users.
+generic_hdlc.txt
+        - The generic High Level Data Link Control (HDLC) layer.
 generic_netlink.txt
        - info on Generic Netlink
+gianfar.txt
+        - Gianfar Ethernet Driver.
 ieee802154.txt
        - Linux IEEE 802.15.4 implementation, API and drivers
+ifenslave.c
+        - Configure network interfaces for parallel routing (bonding).
+igb.txt
+        - README for the Intel Gigabit Ethernet Driver (igb).
+igbvf.txt
+        - README for the Intel Gigabit Ethernet Driver (igbvf).
 ip-sysctl.txt
        - /proc/sys/net/ipv4/* variables
 ip_dynaddr.txt
@@ -68,41 +108,117 @@ ipddp.txt
        - AppleTalk-IP Decapsulation and AppleTalk-IP Encapsulation
 iphase.txt
        - Interphase PCI ATM (i)Chip IA Linux driver info.
+ipv6.txt
+        - Options to the ipv6 kernel module.
+ipvs-sysctl.txt
+        - Per-inode explanation of the /proc/sys/net/ipv4/vs interface.
 irda.txt
        - where to get IrDA (infrared) utilities and info for Linux.
+ixgb.txt
+        - README for the Intel 10 Gigabit Ethernet Driver (ixgb).
+ixgbe.txt
+        - README for the Intel 10 Gigabit Ethernet Driver (ixgbe).
+ixgbevf.txt
+        - README for the Intel Virtual Function (VF) Driver (ixgbevf).
+l2tp.txt
+        - User guide to the L2TP tunnel protocol.
 lapb-module.txt
        - programming information of the LAPB module.
 ltpc.txt
        - the Apple or Farallon LocalTalk PC card driver
+mac80211-injection.txt
+        - HOWTO use packet injection with mac80211
 multicast.txt
        - Behaviour of cards under Multicast
+multiqueue.txt
+        - HOWTO for multiqueue network device support.
+netconsole.txt
+        - The network console module netconsole.ko: configuration and notes.
+netdev-features.txt
+        - Network interface features API description.
 netdevices.txt
        - info on network device driver functions exported to the kernel.
+netif-msg.txt
+        - Design of the network interface message level setting (NETIF_MSG_*).
+nfc.txt
+        - The Linux Near Field Communication (NFS) subsystem.
 olympic.txt
        - IBM PCI Pit/Pit-Phy/Olympic Token Ring driver info.
+operstates.txt
+        - Overview of network interface operational states.
+packet_mmap.txt
+        - User guide to memory mapped packet socket rings (PACKET_[RT]X_RING).
+phonet.txt
+        - The Phonet packet protocol used in Nokia cellular modems.
+phy.txt
+        - The PHY abstraction layer.
+pktgen.txt
+        - User guide to the kernel packet generator (pktgen.ko).
 policy-routing.txt
        - IP policy-based routing
+ppp_generic.txt
+        - Information about the generic PPP driver.
+proc_net_tcp.txt
+        - Per inode overview of the /proc/net/tcp and /proc/net/tcp6 interfaces.
+radiotap-headers.txt
+        - Background on radiotap headers.
 ray_cs.txt
        - Raylink Wireless LAN card driver info.
+rds.txt
+        - Background on the reliable, ordered datagram delivery method RDS.
+regulatory.txt
+        - Overview of the Linux wireless regulatory infrastructure.
+rxrpc.txt
+        - Guide to the RxRPC protocol.
+s2io.txt
+        - Release notes for Neterion Xframe I/II 10GbE driver.
+scaling.txt
+        - Explanation of network scaling techniques: RSS, RPS, RFS, aRFS, XPS.
+sctp.txt
+        - Notes on the Linux kernel implementation of the SCTP protocol.
+secid.txt
+        - Explanation of the secid member in flow structures.
 skfp.txt
        - SysKonnect FDDI (SK-5xxx, Compaq Netelligent) driver info.
 smc9.txt
        - the driver for SMC's 9000 series of Ethernet cards
 smctr.txt
        - SMC TokenCard TokenRing Linux driver info.
+spider-net.txt
+        - README for the Spidernet Driver (as found in PS3 / Cell BE).
+stmmac.txt
+        - README for the STMicro Synopsys Ethernet driver.
+tc-actions-env-rules.txt
+        - rules for traffic control (tc) actions.
+timestamping.txt
+        - overview of network packet timestamping variants.
 tcp.txt
        - short blurb on how TCP output takes place.
+tcp-thin.txt
+        - kernel tuning options for low rate 'thin' TCP streams.
 tlan.txt
        - ThunderLAN (Compaq Netelligent 10/100, Olicom OC-2xxx) driver info.
 tms380tr.txt
        - SysKonnect Token Ring ISA/PCI adapter driver info.
+tproxy.txt
+        - Transparent proxy support user guide.
 tuntap.txt
        - TUN/TAP device driver, allowing user space Rx/Tx of packets.
+udplite.txt
+        - UDP-Lite protocol (RFC 3828) introduction.
 vortex.txt
        - info on using 3Com Vortex (3c590, 3c592, 3c595, 3c597) Ethernet cards.
+vxge.txt
+        - README for the Neterion X3100 PCIe Server Adapter.
 x25.txt
        - general info on X.25 development.
 x25-iface.txt
        - description of the X.25 Packet Layer to LAPB device interface.
+xfrm_proc.txt
+        - description of the statistics package for XFRM.
+xfrm_sync.txt
+        - sync patches for XFRM enable migration of an SA between hosts.
+xfrm_sysctl.txt
+        - description of the XFRM configuration options.
 z8530drv.txt
        - info about Linux driver for Z8530 based HDLC cards for AX.25
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index db2a4067013c..81546990f41c 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -992,7 +992,7 @@ bindv6only - BOOLEAN
                TRUE: disable IPv4-mapped address feature
                FALSE: enable IPv4-mapped address feature
-        Default: FALSE (as specified in RFC2553bis)
+        Default: FALSE (as specified in RFC3493)
 IPv6 Fragmentation:
diff --git a/Documentation/networking/scaling.txt b/Documentation/networking/scaling.txt
index 7254b4b5910e..58fd7414e6c0 100644
--- a/Documentation/networking/scaling.txt
+++ b/Documentation/networking/scaling.txt
@@ -52,7 +52,8 @@ module parameter for specifying the number of hardware queues to
 configure. In the bnx2x driver, for instance, this parameter is called
 num_queues. A typical RSS configuration would be to have one receive queue
 for each CPU if the device supports enough queues, or otherwise at least
-one for each cache domain at a particular cache level (L1, L2, etc.).
+one for each memory domain, where a memory domain is a set of CPUs that
+share a particular memory level (L1, L2, NUMA node, etc.).
 The indirection table of an RSS device, which resolves a queue by masked
 hash, is usually programmed by the driver at initialization. The
@@ -82,11 +83,17 @@ RSS should be enabled when latency is a concern or whenever receive
 interrupt processing forms a bottleneck. Spreading load between CPUs
 decreases queue length. For low latency networking, the optimal setting
 is to allocate as many queues as there are CPUs in the system (or the
-NIC maximum, if lower). Because the aggregate number of interrupts grows
+NIC maximum, if lower). The most efficient high-rate configuration
-with each additional queue, the most efficient high-rate configuration
 is likely the one with the smallest number of receive queues where no
-CPU that processes receive interrupts reaches 100% utilization. Per-cpu
+receive queue overflows due to a saturated CPU, because in default
-load can be observed using the mpstat utility.
+mode with interrupt coalescing enabled, the aggregate number of
+interrupts (and thus work) grows with each additional queue.
+Per-cpu load can be observed using the mpstat utility, but note that on
+processors with hyperthreading (HT), each hyperthread is represented as
+a separate CPU. For interrupt handling, HT has shown no benefit in
+initial tests, so limit the number of queues to the number of CPU cores
+in the system.
 RPS: Receive Packet Steering
@@ -145,7 +152,7 @@ the bitmap.
 == Suggested Configuration
 For a single queue device, a typical RPS configuration would be to set
-the rps_cpus to the CPUs in the same cache domain of the interrupting
+the rps_cpus to the CPUs in the same memory domain of the interrupting
 CPU. If NUMA locality is not an issue, this could also be all CPUs in
 the system. At high interrupt rate, it might be wise to exclude the
 interrupting CPU from the map since that already performs much work.
@@ -154,7 +161,7 @@ For a multi-queue system, if RSS is configured so that a hardware
 receive queue is mapped to each CPU, then RPS is probably redundant
 and unnecessary. If there are fewer hardware queues than CPUs, then
 RPS might be beneficial if the rps_cpus for each queue are the ones that
-share the same cache domain as the interrupting CPU for that queue.
+share the same memory domain as the interrupting CPU for that queue.
 RFS: Receive Flow Steering
@@ -326,7 +333,7 @@ The queue chosen for transmitting a particular flow is saved in the
 corresponding socket structure for the flow (e.g. a TCP connection).
 This transmit queue is used for subsequent packets sent on the flow to
 prevent out of order (ooo) packets. The choice also amortizes the cost
-of calling get_xps_queues() over all packets in the connection. To avoid
+of calling get_xps_queues() over all packets in the flow. To avoid
 ooo packets, the queue for a flow can subsequently only be changed if
 skb->ooo_okay is set for a packet in the flow. This flag indicates that
 there are no outstanding packets in the flow, so the transmit queue can
diff --git a/Documentation/virtual/00-INDEX b/Documentation/virtual/00-INDEX
index fe0251c4cfb7..8e601991d91c 100644
--- a/Documentation/virtual/00-INDEX
+++ b/Documentation/virtual/00-INDEX
@@ -8,3 +8,6 @@ lguest/
        - Extremely simple hypervisor for experimental/educational use.
 uml/
        - User Mode Linux, builds/runs Linux kernel as a userspace program.
+virtio.txt
+        - Text version of draft virtio spec.
+          See http://ozlabs.org/~rusty/virtio-spec
diff --git a/Documentation/virtual/lguest/lguest.c b/Documentation/virtual/lguest/lguest.c
index 043bd7df3139..d928c134dee6 100644
--- a/Documentation/virtual/lguest/lguest.c
+++ b/Documentation/virtual/lguest/lguest.c
@@ -1996,6 +1996,9 @@ int main(int argc, char *argv[])
        /* We use a simple helper to copy the arguments separated by spaces. */
        concat((char *)(boot + 1), argv+optind+2);
+        /* Set kernel alignment to 16M (CONFIG_PHYSICAL_ALIGN) */
+        boot->hdr.kernel_alignment = 0x1000000;
        /* Boot protocol version: 2.07 supports the fields for lguest. */
        boot->hdr.version = 0x207;
diff --git a/Documentation/virtual/virtio-spec.txt b/Documentation/virtual/virtio-spec.txt
new file mode 100644
index 000000000000..a350ae135b8c
--- /dev/null
+++ b/Documentation/virtual/virtio-spec.txt
@@ -0,0 +1,2200 @@
+[Generated file: see http://ozlabs.org/~rusty/virtio-spec/]
+Virtio PCI Card Specification
+v0.9.1 DRAFT
+-
+Rusty Russell <rusty@rustcorp.com.au>IBM Corporation (Editor)
+2011 August 1.
+Purpose and Description
+This document describes the specifications of the “virtio” family
+of PCI[LaTeX Command: nomenclature] devices. These are devices
+are found in virtual environments[LaTeX Command: nomenclature],
+yet by design they are not all that different from physical PCI
+devices, and this document treats them as such. This allows the
+guest to use standard PCI drivers and discovery mechanisms.
+The purpose of virtio and this specification is that virtual
+environments and guests should have a straightforward, efficient,
+standard and extensible mechanism for virtual devices, rather
+than boutique per-environment or per-OS mechanisms.
+  Straightforward: Virtio PCI devices use normal PCI mechanisms
+  of interrupts and DMA which should be familiar to any device
+  driver author. There is no exotic page-flipping or COW
+  mechanism: it's just a PCI device.[footnote:
+This lack of page-sharing implies that the implementation of the
+device (e.g. the hypervisor or host) needs full access to the
+guest memory. Communication with untrusted parties (i.e.
+inter-guest communication) requires copying.
+]
+  Efficient: Virtio PCI devices consist of rings of descriptors
+  for input and output, which are neatly separated to avoid cache
+  effects from both guest and device writing to the same cache
+  lines.
+  Standard: Virtio PCI makes no assumptions about the environment
+  in which it operates, beyond supporting PCI. In fact the virtio
+  devices specified in the appendices do not require PCI at all:
+  they have been implemented on non-PCI buses.[footnote:
+The Linux implementation further separates the PCI virtio code
+from the specific virtio drivers: these drivers are shared with
+the non-PCI implementations (currently lguest and S/390).
+]
+  Extensible: Virtio PCI devices contain feature bits which are
+  acknowledged by the guest operating system during device setup.
+  This allows forwards and backwards compatibility: the device
+  offers all the features it knows about, and the driver
+  acknowledges those it understands and wishes to use.
+  Virtqueues
+The mechanism for bulk data transport on virtio PCI devices is
+pretentiously called a virtqueue. Each device can have zero or
+more virtqueues: for example, the network device has one for
+transmit and one for receive.
+Each virtqueue occupies two or more physically-contiguous pages
+(defined, for the purposes of this specification, as 4096 bytes),
+and consists of three parts:
+-------------------+-----------------------------------+-----------+
+| Descriptor Table  |   Available Ring     (padding)    | Used Ring |
+-------------------+-----------------------------------+-----------+
+When the driver wants to send buffers to the device, it puts them
+in one or more slots in the descriptor table, and writes the
+descriptor indices into the available ring. It then notifies the
+device. When the device has finished with the buffers, it writes
+the descriptors into the used ring, and sends an interrupt.
+Specification
+  PCI Discovery
+Any PCI device with Vendor ID 0x1AF4, and Device ID 0x1000
+through 0x103F inclusive is a virtio device[footnote:
+The actual value within this range is ignored
+]. The device must also have a Revision ID of 0 to match this
+specification.
+The Subsystem Device ID indicates which virtio device is
+supported by the device. The Subsystem Vendor ID should reflect
+the PCI Vendor ID of the environment (it's currently only used
+for informational purposes by the guest).
+----------------------+--------------------+---------------+
+| Subsystem Device ID  |   Virtio Device    | Specification |
+----------------------+--------------------+---------------+
+----------------------+--------------------+---------------+
+|          1           |   network card     |  Appendix C   |
+----------------------+--------------------+---------------+
+|          2           |   block device     |  Appendix D   |
+----------------------+--------------------+---------------+
+|          3           |      console       |  Appendix E   |
+----------------------+--------------------+---------------+
+|          4           |  entropy source    |  Appendix F   |
+----------------------+--------------------+---------------+
+|          5           | memory ballooning  |  Appendix G   |
+----------------------+--------------------+---------------+
+|          6           |     ioMemory       |       -       |
+----------------------+--------------------+---------------+
+|          9           |   9P transport     |       -       |
+----------------------+--------------------+---------------+
+  Device Configuration
+To configure the device, we use the first I/O region of the PCI
+device. This contains a virtio header followed by a
+device-specific region.
+There may be different widths of accesses to the I/O region; the “
+natural” access method for each field in the virtio header must
+be used (i.e. 32-bit accesses for 32-bit fields, etc), but the
+device-specific region can be accessed using any width accesses,
+and should obtain the same results.
+Note that this is possible because while the virtio header is PCI
+(i.e. little) endian, the device-specific region is encoded in
+the native endian of the guest (where such distinction is
+applicable).
+  Device Initialization Sequence
+We start with an overview of device initialization, then expand
+on the details of the device and how each step is preformed.
+  Reset the device. This is not required on initial start up.
+  The ACKNOWLEDGE status bit is set: we have noticed the device.
+  The DRIVER status bit is set: we know how to drive the device.
+  Device-specific setup, including reading the Device Feature
+  Bits, discovery of virtqueues for the device, optional MSI-X
+  setup, and reading and possibly writing the virtio
+  configuration space.
+  The subset of Device Feature Bits understood by the driver is
+  written to the device.
+  The DRIVER_OK status bit is set.
+  The device can now be used (ie. buffers added to the
+  virtqueues)[footnote:
+Historically, drivers have used the device before steps 5 and 6.
+This is only allowed if the driver does not use any features
+which would alter this early use of the device.
+]
+If any of these steps go irrecoverably wrong, the guest should
+set the FAILED status bit to indicate that it has given up on the
+device (it can reset the device later to restart if desired).
+We now cover the fields required for general setup in detail.
+  Virtio Header
+The virtio header looks as follows:
+------------++---------------------+---------------------+----------+--------+---------+---------+---------+--------+
+| Bits       || 32                  | 32                  | 32       | 16     | 16      | 16      | 8       | 8      |
+------------++---------------------+---------------------+----------+--------+---------+---------+---------+--------+
+| Read/Write || R                   | R+W                 | R+W      | R      | R+W     | R+W     | R+W     | R      |
+------------++---------------------+---------------------+----------+--------+---------+---------+---------+--------+
+| Purpose    || Device              | Guest               | Queue    | Queue  | Queue   | Queue   | Device  | ISR    |
+|            || Features bits 0:31  | Features bits 0:31  | Address  | Size   | Select  | Notify  | Status  | Status |
+------------++---------------------+---------------------+----------+--------+---------+---------+---------+--------+
+If MSI-X is enabled for the device, two additional fields
+immediately follow this header:
+------------++----------------+--------+
+| Bits       || 16             | 16     |
+              +----------------+--------+
+------------++----------------+--------+
+| Read/Write || R+W            | R+W    |
+------------++----------------+--------+
+| Purpose    || Configuration  | Queue  |
+| (MSI-X)    || Vector         | Vector |
+------------++----------------+--------+
+Finally, if feature bits (VIRTIO_F_FEATURES_HI) this is
+immediately followed by two additional fields:
+------------++----------------------+----------------------
+| Bits       || 32                   | 32
+------------++----------------------+----------------------
+| Read/Write || R                    | R+W
+------------++----------------------+----------------------
+| Purpose    || Device               | Guest
+|            || Features bits 32:63  | Features bits 32:63
+------------++----------------------+----------------------
+Immediately following these general headers, there may be
+device-specific headers:
+------------++--------------------+
+| Bits       || Device Specific    |
+              +--------------------+
+------------++--------------------+
+| Read/Write || Device Specific    |
+------------++--------------------+
+| Purpose    || Device Specific... |
+|            ||                    |
+------------++--------------------+
+  Device Status
+The Device Status field is updated by the guest to indicate its
+progress. This provides a simple low-level diagnostic: it's most
+useful to imagine them hooked up to traffic lights on the console
+indicating the status of each device.
+The device can be reset by writing a 0 to this field, otherwise
+at least one bit should be set:
+  ACKNOWLEDGE (1) Indicates that the guest OS has found the
+  device and recognized it as a valid virtio device.
+  DRIVER (2) Indicates that the guest OS knows how to drive the
+  device. Under Linux, drivers can be loadable modules so there
+  may be a significant (or infinite) delay before setting this
+  bit.
+  DRIVER_OK (3) Indicates that the driver is set up and ready to
+  drive the device.
+  FAILED (8) Indicates that something went wrong in the guest,
+  and it has given up on the device. This could be an internal
+  error, or the driver didn't like the device for some reason, or
+  even a fatal error during device operation. The device must be
+  reset before attempting to re-initialize.
+  Feature Bits
+The least significant 31 bits of the first configuration field
+indicates the features that the device supports (the high bit is
+reserved, and will be used to indicate the presence of future
+feature bits elsewhere). If more than 31 feature bits are
+supported, the device indicates so by setting feature bit 31 (see
+[cha:Reserved-Feature-Bits]). The bits are allocated as follows:
+  0 to 23 Feature bits for the specific device type
+  24 to 40 Feature bits reserved for extensions to the queue and
+  feature negotiation mechanisms
+  41 to 63 Feature bits reserved for future extensions
+For example, feature bit 0 for a network device (i.e. Subsystem
+Device ID 1) indicates that the device supports checksumming of
+packets.
+The feature bits are negotiated: the device lists all the
+features it understands in the Device Features field, and the
+guest writes the subset that it understands into the Guest
+Features field. The only way to renegotiate is to reset the
+device.
+In particular, new fields in the device configuration header are
+indicated by offering a feature bit, so the guest can check
+before accessing that part of the configuration space.
+This allows for forwards and backwards compatibility: if the
+device is enhanced with a new feature bit, older guests will not
+write that feature bit back to the Guest Features field and it
+can go into backwards compatibility mode. Similarly, if a guest
+is enhanced with a feature that the device doesn't support, it
+will not see that feature bit in the Device Features field and
+can go into backwards compatibility mode (or, for poor
+implementations, set the FAILED Device Status bit).
+Access to feature bits 32 to 63 is enabled by Guest by setting
+feature bit 31. If this bit is unset, Device must assume that all
+feature bits > 31 are unset.
+  Configuration/Queue Vectors
+When MSI-X capability is present and enabled in the device
+(through standard PCI configuration space) 4 bytes at byte offset
+20 are used to map configuration change and queue interrupts to
+MSI-X vectors. In this case, the ISR Status field is unused, and
+device specific configuration starts at byte offset 24 in virtio
+header structure. When MSI-X capability is not enabled, device
+specific configuration starts at byte offset 20 in virtio header.
+Writing a valid MSI-X Table entry number, 0 to 0x7FF, to one of
+Configuration/Queue Vector registers, maps interrupts triggered
+by the configuration change/selected queue events respectively to
+the corresponding MSI-X vector. To disable interrupts for a
+specific event type, unmap it by writing a special NO_VECTOR
+value:
+/* Vector value used to disable MSI for queue */
+#define VIRTIO_MSI_NO_VECTOR            0xffff
+Reading these registers returns vector mapped to a given event,
+or NO_VECTOR if unmapped. All queue and configuration change
+events are unmapped by default.
+Note that mapping an event to vector might require allocating
+internal device resources, and might fail. Devices report such
+failures by returning the NO_VECTOR value when the relevant
+Vector field is read. After mapping an event to vector, the
+driver must verify success by reading the Vector field value: on
+success, the previously written value is returned, and on
+failure, NO_VECTOR is returned. If a mapping failure is detected,
+the driver can retry mapping with fewervectors, or disable MSI-X.
+  Virtqueue Configuration
+As a device can have zero or more virtqueues for bulk data
+transport (for example, the network driver has two), the driver
+needs to configure them as part of the device-specific
+configuration.
+This is done as follows, for each virtqueue a device has:
+  Write the virtqueue index (first queue is 0) to the Queue
+  Select field.
+  Read the virtqueue size from the Queue Size field, which is
+  always a power of 2. This controls how big the virtqueue is
+  (see below). If this field is 0, the virtqueue does not exist.
+  Allocate and zero virtqueue in contiguous physical memory, on a
+  4096 byte alignment. Write the physical address, divided by
+  4096 to the Queue Address field.[footnote:
+The 4096 is based on the x86 page size, but it's also large
+enough to ensure that the separate parts of the virtqueue are on
+separate cache lines.
+]
+  Optionally, if MSI-X capability is present and enabled on the
+  device, select a vector to use to request interrupts triggered
+  by virtqueue events. Write the MSI-X Table entry number
+  corresponding to this vector in Queue Vector field. Read the
+  Queue Vector field: on success, previously written value is
+  returned; on failure, NO_VECTOR value is returned.
+The Queue Size field controls the total number of bytes required
+for the virtqueue according to the following formula:
+#define ALIGN(x) (((x) + 4095) & ~4095)
+static inline unsigned vring_size(unsigned int qsz)
+{
+     return ALIGN(sizeof(struct vring_desc)*qsz + sizeof(u16)*(2
+ qsz))
+          + ALIGN(sizeof(struct vring_used_elem)*qsz);
+}
+This currently wastes some space with padding, but also allows
+future extensions. The virtqueue layout structure looks like this
+(qsz is the Queue Size field, which is a variable, so this code
+won't compile):
+struct vring {
+    /* The actual descriptors (16 bytes each) */
+    struct vring_desc desc[qsz];
+    /* A ring of available descriptor heads with free-running
+index. */
+    struct vring_avail avail;
+    // Padding to the next 4096 boundary.
+    char pad[];
+    // A ring of used descriptor heads with free-running index.
+    struct vring_used used;
+};
+  A Note on Virtqueue Endianness
+Note that the endian of these fields and everything else in the
+virtqueue is the native endian of the guest, not little-endian as
+PCI normally is. This makes for simpler guest code, and it is
+assumed that the host already has to be deeply aware of the guest
+endian so such an “endian-aware” device is not a significant
+issue.
+  Descriptor Table
+The descriptor table refers to the buffers the guest is using for
+the device. The addresses are physical addresses, and the buffers
+can be chained via the next field. Each descriptor describes a
+buffer which is read-only or write-only, but a chain of
+descriptors can contain both read-only and write-only buffers.
+No descriptor chain may be more than 2^32 bytes long in total.struct vring_desc {
+    /* Address (guest-physical). */
+    u64 addr;
+    /* Length. */
+    u32 len;
+/* This marks a buffer as continuing via the next field. */
+#define VRING_DESC_F_NEXT   1
+/* This marks a buffer as write-only (otherwise read-only). */
+#define VRING_DESC_F_WRITE     2
+/* This means the buffer contains a list of buffer descriptors.
+*/
+#define VRING_DESC_F_INDIRECT   4
+    /* The flags as indicated above. */
+    u16 flags;
+    /* Next field if flags & NEXT */
+    u16 next;
+};
+The number of descriptors in the table is specified by the Queue
+Size field for this virtqueue.
+  <sub:Indirect-Descriptors>Indirect Descriptors
+Some devices benefit by concurrently dispatching a large number
+of large requests. The VIRTIO_RING_F_INDIRECT_DESC feature can be
+used to allow this (see [cha:Reserved-Feature-Bits]). To increase
+ring capacity it is possible to store a table of indirect
+descriptors anywhere in memory, and insert a descriptor in main
+virtqueue (with flags&INDIRECT on) that refers to memory buffer
+containing this indirect descriptor table; fields addr and len
+refer to the indirect table address and length in bytes,
+respectively. The indirect table layout structure looks like this
+(len is the length of the descriptor that refers to this table,
+which is a variable, so this code won't compile):
+struct indirect_descriptor_table {
+    /* The actual descriptors (16 bytes each) */
+    struct vring_desc desc[len / 16];
+};
+The first indirect descriptor is located at start of the indirect
+descriptor table (index 0), additional indirect descriptors are
+chained by next field. An indirect descriptor without next field
+(with flags&NEXT off) signals the end of the indirect descriptor
+table, and transfers control back to the main virtqueue. An
+indirect descriptor can not refer to another indirect descriptor
+table (flags&INDIRECT must be off). A single indirect descriptor
+table can include both read-only and write-only descriptors;
+write-only flag (flags&WRITE) in the descriptor that refers to it
+is ignored.
+  Available Ring
+The available ring refers to what descriptors we are offering the
+device: it refers to the head of a descriptor chain. The “flags”
+field is currently 0 or 1: 1 indicating that we do not need an
+interrupt when the device consumes a descriptor from the
+available ring. Alternatively, the guest can ask the device to
+delay interrupts until an entry with an index specified by the “
+used_event” field is written in the used ring (equivalently,
+until the idx field in the used ring will reach the value
+used_event + 1). The method employed by the device is controlled
+by the VIRTIO_RING_F_EVENT_IDX feature bit (see [cha:Reserved-Feature-Bits]
+). This interrupt suppression is merely an optimization; it may
+not suppress interrupts entirely.
+The “idx” field indicates where we would put the next descriptor
+entry (modulo the ring size). This starts at 0, and increases.
+struct vring_avail {
+#define VRING_AVAIL_F_NO_INTERRUPT      1
+   u16 flags;
+   u16 idx;
+   u16 ring[qsz]; /* qsz is the Queue Size field read from device
+*/
+   u16 used_event;
+};
+  Used Ring
+The used ring is where the device returns buffers once it is done
+with them. The flags field can be used by the device to hint that
+no notification is necessary when the guest adds to the available
+ring. Alternatively, the “avail_event” field can be used by the
+device to hint that no notification is necessary until an entry
+with an index specified by the “avail_event” is written in the
+available ring (equivalently, until the idx field in the
+available ring will reach the value avail_event + 1). The method
+employed by the device is controlled by the guest through the
+VIRTIO_RING_F_EVENT_IDX feature bit (see [cha:Reserved-Feature-Bits]
+). [footnote:
+These fields are kept here because this is the only part of the
+virtqueue written by the device
+].
+Each entry in the ring is a pair: the head entry of the
+descriptor chain describing the buffer (this matches an entry
+placed in the available ring by the guest earlier), and the total
+of bytes written into the buffer. The latter is extremely useful
+for guests using untrusted buffers: if you do not know exactly
+how much has been written by the device, you usually have to zero
+the buffer to ensure no data leakage occurs.
+/* u32 is used here for ids for padding reasons. */
+struct vring_used_elem {
+    /* Index of start of used descriptor chain. */
+    u32 id;
+    /* Total length of the descriptor chain which was used
+(written to) */
+    u32 len;
+};
+struct vring_used {
+#define VRING_USED_F_NO_NOTIFY  1
+    u16 flags;
+    u16 idx;
+    struct vring_used_elem ring[qsz];
+    u16 avail_event;
+};
+  Helpers for Managing Virtqueues
+The Linux Kernel Source code contains the definitions above and
+helper routines in a more usable form, in
+include/linux/virtio_ring.h. This was explicitly licensed by IBM
+and Red Hat under the (3-clause) BSD license so that it can be
+freely used by all other projects, and is reproduced (with slight
+variation to remove Linux assumptions) in Appendix A.
+  Device Operation
+There are two parts to device operation: supplying new buffers to
+the device, and processing used buffers from the device. As an
+example, the virtio network device has two virtqueues: the
+transmit virtqueue and the receive virtqueue. The driver adds
+outgoing (read-only) packets to the transmit virtqueue, and then
+frees them after they are used. Similarly, incoming (write-only)
+buffers are added to the receive virtqueue, and processed after
+they are used.
+  Supplying Buffers to The Device
+Actual transfer of buffers from the guest OS to the device
+operates as follows:
+  Place the buffer(s) into free descriptor(s).
+  If there are no free descriptors, the guest may choose to
+    notify the device even if notifications are suppressed (to
+    reduce latency).[footnote:
+The Linux drivers do this only for read-only buffers: for
+write-only buffers, it is assumed that the driver is merely
+trying to keep the receive buffer ring full, and no notification
+of this expected condition is necessary.
+]
+  Place the id of the buffer in the next ring entry of the
+  available ring.
+  The steps (1) and (2) may be performed repeatedly if batching
+  is possible.
+  A memory barrier should be executed to ensure the device sees
+  the updated descriptor table and available ring before the next
+  step.
+  The available “idx” field should be increased by the number of
+  entries added to the available ring.
+  A memory barrier should be executed to ensure that we update
+  the idx field before checking for notification suppression.
+  If notifications are not suppressed, the device should be
+  notified of the new buffers.
+Note that the above code does not take precautions against the
+available ring buffer wrapping around: this is not possible since
+the ring buffer is the same size as the descriptor table, so step
+(1) will prevent such a condition.
+In addition, the maximum queue size is 32768 (it must be a power
+of 2 which fits in 16 bits), so the 16-bit “idx” value can always
+distinguish between a full and empty buffer.
+Here is a description of each stage in more detail.
+  Placing Buffers Into The Descriptor Table
+A buffer consists of zero or more read-only physically-contiguous
+elements followed by zero or more physically-contiguous
+write-only elements (it must have at least one element). This
+algorithm maps it into the descriptor table:
+  for each buffer element, b:
+  Get the next free descriptor table entry, d
+  Set d.addr to the physical address of the start of b
+  Set d.len to the length of b.
+  If b is write-only, set d.flags to VRING_DESC_F_WRITE,
+    otherwise 0.
+  If there is a buffer element after this:
+    Set d.next to the index of the next free descriptor element.
+    Set the VRING_DESC_F_NEXT bit in d.flags.
+In practice, the d.next fields are usually used to chain free
+descriptors, and a separate count kept to check there are enough
+free descriptors before beginning the mappings.
+  Updating The Available Ring
+The head of the buffer we mapped is the first d in the algorithm
+above. A naive implementation would do the following:
+avail->ring[avail->idx % qsz] = head;
+However, in general we can add many descriptors before we update
+the “idx” field (at which point they become visible to the
+device), so we keep a counter of how many we've added:
+avail->ring[(avail->idx + added++) % qsz] = head;
+  Updating The Index Field
+Once the idx field of the virtqueue is updated, the device will
+be able to access the descriptor entries we've created and the
+memory they refer to. This is why a memory barrier is generally
+used before the idx update, to ensure it sees the most up-to-date
+copy.
+The idx field always increments, and we let it wrap naturally at
+65536:
+avail->idx += added;
+  <sub:Notifying-The-Device>Notifying The Device
+Device notification occurs by writing the 16-bit virtqueue index
+of this virtqueue to the Queue Notify field of the virtio header
+in the first I/O region of the PCI device. This can be expensive,
+however, so the device can suppress such notifications if it
+doesn't need them. We have to be careful to expose the new idx
+value before checking the suppression flag: it's OK to notify
+gratuitously, but not to omit a required notification. So again,
+we use a memory barrier here before reading the flags or the
+avail_event field.
+If the VIRTIO_F_RING_EVENT_IDX feature is not negotiated, and if
+the VRING_USED_F_NOTIFY flag is not set, we go ahead and write to
+the PCI configuration space.
+If the VIRTIO_F_RING_EVENT_IDX feature is negotiated, we read the
+avail_event field in the available ring structure. If the
+available index crossed_the avail_event field value since the
+last notification, we go ahead and write to the PCI configuration
+space. The avail_event field wraps naturally at 65536 as well:
+(u16)(new_idx - avail_event - 1) < (u16)(new_idx - old_idx)
+  <sub:Receiving-Used-Buffers>Receiving Used Buffers From The
+  Device
+Once the device has used a buffer (read from or written to it, or
+parts of both, depending on the nature of the virtqueue and the
+device), it sends an interrupt, following an algorithm very
+similar to the algorithm used for the driver to send the device a
+buffer:
+  Write the head descriptor number to the next field in the used
+  ring.
+  Update the used ring idx.
+  Determine whether an interrupt is necessary:
+  If the VIRTIO_F_RING_EVENT_IDX feature is not negotiated: check
+    if f the VRING_AVAIL_F_NO_INTERRUPT flag is not set in avail-
+    >flags
+  If the VIRTIO_F_RING_EVENT_IDX feature is negotiated: check
+    whether the used index crossed the used_event field value
+    since the last update. The used_event field wraps naturally
+    at 65536 as well:(u16)(new_idx - used_event - 1) < (u16)(new_idx - old_idx)
+  If an interrupt is necessary:
+  If MSI-X capability is disabled:
+    Set the lower bit of the ISR Status field for the device.
+    Send the appropriate PCI interrupt for the device.
+  If MSI-X capability is enabled:
+    Request the appropriate MSI-X interrupt message for the
+      device, Queue Vector field sets the MSI-X Table entry
+      number.
+    If Queue Vector field value is NO_VECTOR, no interrupt
+      message is requested for this event.
+The guest interrupt handler should:
+  If MSI-X capability is disabled: read the ISR Status field,
+  which will reset it to zero. If the lower bit is zero, the
+  interrupt was not for this device. Otherwise, the guest driver
+  should look through the used rings of each virtqueue for the
+  device, to see if any progress has been made by the device
+  which requires servicing.
+  If MSI-X capability is enabled: look through the used rings of
+  each virtqueue mapped to the specific MSI-X vector for the
+  device, to see if any progress has been made by the device
+  which requires servicing.
+For each ring, guest should then disable interrupts by writing
+VRING_AVAIL_F_NO_INTERRUPT flag in avail structure, if required.
+It can then process used ring entries finally enabling interrupts
+by clearing the VRING_AVAIL_F_NO_INTERRUPT flag or updating the
+EVENT_IDX field in the available structure, Guest should then
+execute a memory barrier, and then recheck the ring empty
+condition. This is necessary to handle the case where, after the
+last check and before enabling interrupts, an interrupt has been
+suppressed by the device:
+vring_disable_interrupts(vq);
+for (;;) {
+    if (vq->last_seen_used != vring->used.idx) {
+                vring_enable_interrupts(vq);
+                mb();
+                if (vq->last_seen_used != vring->used.idx)
+                        break;
+    }
+    struct vring_used_elem *e =
+vring.used->ring[vq->last_seen_used%vsz];
+    process_buffer(e);
+    vq->last_seen_used++;
+}
+  Dealing With Configuration Changes
+Some virtio PCI devices can change the device configuration
+state, as reflected in the virtio header in the PCI configuration
+space. In this case:
+  If MSI-X capability is disabled: an interrupt is delivered and
+  the second highest bit is set in the ISR Status field to
+  indicate that the driver should re-examine the configuration
+  space.Note that a single interrupt can indicate both that one
+  or more virtqueue has been used and that the configuration
+  space has changed: even if the config bit is set, virtqueues
+  must be scanned.
+  If MSI-X capability is enabled: an interrupt message is
+  requested. The Configuration Vector field sets the MSI-X Table
+  entry number to use. If Configuration Vector field value is
+  NO_VECTOR, no interrupt message is requested for this event.
+Creating New Device Types
+Various considerations are necessary when creating a new device
+type:
+  How Many Virtqueues?
+It is possible that a very simple device will operate entirely
+through its configuration space, but most will need at least one
+virtqueue in which it will place requests. A device with both
+input and output (eg. console and network devices described here)
+need two queues: one which the driver fills with buffers to
+receive input, and one which the driver places buffers to
+transmit output.
+  What Configuration Space Layout?
+Configuration space is generally used for rarely-changing or
+initialization-time parameters. But it is a limited resource, so
+it might be better to use a virtqueue to update configuration
+information (the network device does this for filtering,
+otherwise the table in the config space could potentially be very
+large).
+Note that this space is generally the guest's native endian,
+rather than PCI's little-endian.
+  What Device Number?
+Currently device numbers are assigned quite freely: a simple
+request mail to the author of this document or the Linux
+virtualization mailing list[footnote:
+https://lists.linux-foundation.org/mailman/listinfo/virtualization
+] will be sufficient to secure a unique one.
+Meanwhile for experimental drivers, use 65535 and work backwards.
+  How many MSI-X vectors?
+Using the optional MSI-X capability devices can speed up
+interrupt processing by removing the need to read ISR Status
+register by guest driver (which might be an expensive operation),
+reducing interrupt sharing between devices and queues within the
+device, and handling interrupts from multiple CPUs. However, some
+systems impose a limit (which might be as low as 256) on the
+total number of MSI-X vectors that can be allocated to all
+devices. Devices and/or device drivers should take this into
+account, limiting the number of vectors used unless the device is
+expected to cause a high volume of interrupts. Devices can
+control the number of vectors used by limiting the MSI-X Table
+Size or not presenting MSI-X capability in PCI configuration
+space. Drivers can control this by mapping events to as small
+number of vectors as possible, or disabling MSI-X capability
+altogether.
+  Message Framing
+The descriptors used for a buffer should not effect the semantics
+of the message, except for the total length of the buffer. For
+example, a network buffer consists of a 10 byte header followed
+by the network packet. Whether this is presented in the ring
+descriptor chain as (say) a 10 byte buffer and a 1514 byte
+buffer, or a single 1524 byte buffer, or even three buffers,
+should have no effect.
+In particular, no implementation should use the descriptor
+boundaries to determine the size of any header in a request.[footnote:
+The current qemu device implementations mistakenly insist that
+the first descriptor cover the header in these cases exactly, so
+a cautious driver should arrange it so.
+]
+  Device Improvements
+Any change to configuration space, or new virtqueues, or
+behavioural changes, should be indicated by negotiation of a new
+feature bit. This establishes clarity[footnote:
+Even if it does mean documenting design or implementation
+mistakes!
+] and avoids future expansion problems.
+Clusters of functionality which are always implemented together
+can use a single bit, but if one feature makes sense without the
+others they should not be gratuitously grouped together to
+conserve feature bits. We can always extend the spec when the
+first person needs more than 24 feature bits for their device.
+[LaTeX Command: printnomenclature]
+Appendix A: virtio_ring.h
+#ifndef VIRTIO_RING_H
+#define VIRTIO_RING_H
+/* An interface for efficient virtio implementation.
+ *
+ * This header is BSD licensed so anyone can use the definitions
+ * to implement compatible drivers/servers.
+ *
+ * Copyright 2007, 2009, IBM Corporation
+ * Copyright 2011, Red Hat, Inc
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or
+without
+ * modification, are permitted provided that the following
+conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above
+copyright
+ *    notice, this list of conditions and the following
+disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+copyright
+ *    notice, this list of conditions and the following
+disclaimer in the
+ *    documentation and/or other materials provided with the
+distribution.
+ * 3. Neither the name of IBM nor the names of its contributors
+ *    may be used to endorse or promote products derived from
+this software
+ *    without specific prior written permission.
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL IBM OR CONTRIBUTORS BE
+LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/* This marks a buffer as continuing via the next field. */
+#define VRING_DESC_F_NEXT       1
+/* This marks a buffer as write-only (otherwise read-only). */
+#define VRING_DESC_F_WRITE      2
+/* The Host uses this in used->flags to advise the Guest: don't
+kick me
+ * when you add a buffer.  It's unreliable, so it's simply an
+ * optimization.  Guest will still kick if it's out of buffers.
+*/
+#define VRING_USED_F_NO_NOTIFY  1
+/* The Guest uses this in avail->flags to advise the Host: don't
+ * interrupt me when you consume a buffer.  It's unreliable, so
+it's
+ * simply an optimization.  */
+#define VRING_AVAIL_F_NO_INTERRUPT      1
+/* Virtio ring descriptors: 16 bytes.
+ * These can chain together via "next". */
+struct vring_desc {
+        /* Address (guest-physical). */
+        uint64_t addr;
+        /* Length. */
+        uint32_t len;
+        /* The flags as indicated above. */
+        uint16_t flags;
+        /* We chain unused descriptors via this, too */
+        uint16_t next;
+};
+struct vring_avail {
+        uint16_t flags;
+        uint16_t idx;
+        uint16_t ring[];
+        uint16_t used_event;
+};
+/* u32 is used here for ids for padding reasons. */
+struct vring_used_elem {
+        /* Index of start of used descriptor chain. */
+        uint32_t id;
+        /* Total length of the descriptor chain which was written
+to. */
+        uint32_t len;
+};
+struct vring_used {
+        uint16_t flags;
+        uint16_t idx;
+        struct vring_used_elem ring[];
+        uint16_t avail_event;
+};
+struct vring {
+        unsigned int num;
+        struct vring_desc *desc;
+        struct vring_avail *avail;
+        struct vring_used *used;
+};
+/* The standard layout for the ring is a continuous chunk of
+memory which
+ * looks like this.  We assume num is a power of 2.
+ *
+ * struct vring {
+ *      // The actual descriptors (16 bytes each)
+ *      struct vring_desc desc[num];
+ *
+ *      // A ring of available descriptor heads with free-running
+index.
+ *      __u16 avail_flags;
+ *      __u16 avail_idx;
+ *      __u16 available[num];
+ *
+ *      // Padding to the next align boundary.
+ *      char pad[];
+ *
+ *      // A ring of used descriptor heads with free-running
+index.
+ *      __u16 used_flags;
+ *      __u16 EVENT_IDX;
+ *      struct vring_used_elem used[num];
+ * };
+ * Note: for virtio PCI, align is 4096.
+ */
+static inline void vring_init(struct vring *vr, unsigned int num,
+void *p,
+                              unsigned long align)
+{
+        vr->num = num;
+        vr->desc = p;
+        vr->avail = p + num*sizeof(struct vring_desc);
+        vr->used = (void *)(((unsigned long)&vr->avail->ring[num]
+                              + align-1)
+                            & ~(align - 1));
+}
+static inline unsigned vring_size(unsigned int num, unsigned long
+align)
+{
+        return ((sizeof(struct vring_desc)*num +
+sizeof(uint16_t)*(2+num)
+                 + align - 1) & ~(align - 1))
+                + sizeof(uint16_t)*3 + sizeof(struct
+vring_used_elem)*num;
+}
+static inline int vring_need_event(uint16_t event_idx, uint16_t
+new_idx, uint16_t old_idx)
+{
+         return (uint16_t)(new_idx - event_idx - 1) <
+(uint16_t)(new_idx - old_idx);
+}
+#endif /* VIRTIO_RING_H */
+<cha:Reserved-Feature-Bits>Appendix B: Reserved Feature Bits
+Currently there are five device-independent feature bits defined:
+  VIRTIO_F_NOTIFY_ON_EMPTY (24) Negotiating this feature
+  indicates that the driver wants an interrupt if the device runs
+  out of available descriptors on a virtqueue, even though
+  interrupts are suppressed using the VRING_AVAIL_F_NO_INTERRUPT
+  flag or the used_event field. An example of this is the
+  networking driver: it doesn't need to know every time a packet
+  is transmitted, but it does need to free the transmitted
+  packets a finite time after they are transmitted. It can avoid
+  using a timer if the device interrupts it when all the packets
+  are transmitted.
+  VIRTIO_F_RING_INDIRECT_DESC (28) Negotiating this feature
+  indicates that the driver can use descriptors with the
+  VRING_DESC_F_INDIRECT flag set, as described in [sub:Indirect-Descriptors]
+  .
+  VIRTIO_F_RING_EVENT_IDX(29) This feature enables the used_event
+  and the avail_event fields. If set, it indicates that the
+  device should ignore the flags field in the available ring
+  structure. Instead, the used_event field in this structure is
+  used by guest to suppress device interrupts. Further, the
+  driver should ignore the flags field in the used ring
+  structure. Instead, the avail_event field in this structure is
+  used by the device to suppress notifications. If unset, the
+  driver should ignore the used_event field; the device should
+  ignore the avail_event field; the flags field is used
+  VIRTIO_F_BAD_FEATURE(30) This feature should never be
+  negotiated by the guest; doing so is an indication that the
+  guest is faulty[footnote:
+An experimental virtio PCI driver contained in Linux version
+2.6.25 had this problem, and this feature bit can be used to
+detect it.
+]
+  VIRTIO_F_FEATURES_HIGH(31) This feature indicates that the
+  device supports feature bits 32:63. If unset, feature bits
+  32:63 are unset.
+Appendix C: Network Device
+The virtio network device is a virtual ethernet card, and is the
+most complex of the devices supported so far by virtio. It has
+enhanced rapidly and demonstrates clearly how support for new
+features should be added to an existing device. Empty buffers are
+placed in one virtqueue for receiving packets, and outgoing
+packets are enqueued into another for transmission in that order.
+A third command queue is used to control advanced filtering
+features.
+  Configuration
+  Subsystem Device ID 1
+  Virtqueues 0:receiveq. 1:transmitq. 2:controlq[footnote:
+Only if VIRTIO_NET_F_CTRL_VQ set
+]
+  Feature bits
+  VIRTIO_NET_F_CSUM (0) Device handles packets with partial
+    checksum
+  VIRTIO_NET_F_GUEST_CSUM (1) Guest handles packets with partial
+    checksum
+  VIRTIO_NET_F_MAC (5) Device has given MAC address.
+  VIRTIO_NET_F_GSO (6) (Deprecated) device handles packets with
+    any GSO type.[footnote:
+It was supposed to indicate segmentation offload support, but
+upon further investigation it became clear that multiple bits
+were required.
+]
+  VIRTIO_NET_F_GUEST_TSO4 (7) Guest can receive TSOv4.
+  VIRTIO_NET_F_GUEST_TSO6 (8) Guest can receive TSOv6.
+  VIRTIO_NET_F_GUEST_ECN (9) Guest can receive TSO with ECN.
+  VIRTIO_NET_F_GUEST_UFO (10) Guest can receive UFO.
+  VIRTIO_NET_F_HOST_TSO4 (11) Device can receive TSOv4.
+  VIRTIO_NET_F_HOST_TSO6 (12) Device can receive TSOv6.
+  VIRTIO_NET_F_HOST_ECN (13) Device can receive TSO with ECN.
+  VIRTIO_NET_F_HOST_UFO (14) Device can receive UFO.
+  VIRTIO_NET_F_MRG_RXBUF (15) Guest can merge receive buffers.
+  VIRTIO_NET_F_STATUS (16) Configuration status field is
+    available.
+  VIRTIO_NET_F_CTRL_VQ (17) Control channel is available.
+  VIRTIO_NET_F_CTRL_RX (18) Control channel RX mode support.
+  VIRTIO_NET_F_CTRL_VLAN (19) Control channel VLAN filtering.
+  Device configuration layout Two configuration fields are
+  currently defined. The mac address field always exists (though
+  is only valid if VIRTIO_NET_F_MAC is set), and the status field
+  only exists if VIRTIO_NET_F_STATUS is set. Only one bit is
+  currently defined for the status field: VIRTIO_NET_S_LINK_UP. #define VIRTIO_NET_S_LINK_UP    1
+struct virtio_net_config {
+    u8 mac[6];
+    u16 status;
+};
+  Device Initialization
+  The initialization routine should identify the receive and
+  transmission virtqueues.
+  If the VIRTIO_NET_F_MAC feature bit is set, the configuration
+  space “mac” entry indicates the “physical” address of the the
+  network card, otherwise a private MAC address should be
+  assigned. All guests are expected to negotiate this feature if
+  it is set.
+  If the VIRTIO_NET_F_CTRL_VQ feature bit is negotiated, identify
+  the control virtqueue.
+  If the VIRTIO_NET_F_STATUS feature bit is negotiated, the link
+  status can be read from the bottom bit of the “status” config
+  field. Otherwise, the link should be assumed active.
+  The receive virtqueue should be filled with receive buffers.
+  This is described in detail below in “Setting Up Receive
+  Buffers”.
+  A driver can indicate that it will generate checksumless
+  packets by negotating the VIRTIO_NET_F_CSUM feature. This “
+  checksum offload” is a common feature on modern network cards.
+  If that feature is negotiated, a driver can use TCP or UDP
+  segmentation offload by negotiating the VIRTIO_NET_F_HOST_TSO4
+  (IPv4 TCP), VIRTIO_NET_F_HOST_TSO6 (IPv6 TCP) and
+  VIRTIO_NET_F_HOST_UFO (UDP fragmentation) features. It should
+  not send TCP packets requiring segmentation offload which have
+  the Explicit Congestion Notification bit set, unless the
+  VIRTIO_NET_F_HOST_ECN feature is negotiated.[footnote:
+This is a common restriction in real, older network cards.
+]
+  The converse features are also available: a driver can save the
+  virtual device some work by negotiating these features.[footnote:
+For example, a network packet transported between two guests on
+the same system may not require checksumming at all, nor
+segmentation, if both guests are amenable.
+] The VIRTIO_NET_F_GUEST_CSUM feature indicates that partially
+  checksummed packets can be received, and if it can do that then
+  the VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6,
+  VIRTIO_NET_F_GUEST_UFO and VIRTIO_NET_F_GUEST_ECN are the input
+  equivalents of the features described above. See “Receiving
+  Packets” below.
+  Device Operation
+Packets are transmitted by placing them in the transmitq, and
+buffers for incoming packets are placed in the receiveq. In each
+case, the packet itself is preceeded by a header:
+struct virtio_net_hdr {
+#define VIRTIO_NET_HDR_F_NEEDS_CSUM    1
+        u8 flags;
+#define VIRTIO_NET_HDR_GSO_NONE        0
+#define VIRTIO_NET_HDR_GSO_TCPV4       1
+#define VIRTIO_NET_HDR_GSO_UDP           3
+#define VIRTIO_NET_HDR_GSO_TCPV6       4
+#define VIRTIO_NET_HDR_GSO_ECN      0x80
+        u8 gso_type;
+        u16 hdr_len;
+        u16 gso_size;
+        u16 csum_start;
+        u16 csum_offset;
+/* Only if VIRTIO_NET_F_MRG_RXBUF: */
+        u16 num_buffers
+};
+The controlq is used to control device features such as
+filtering.
+  Packet Transmission
+Transmitting a single packet is simple, but varies depending on
+the different features the driver negotiated.
+  If the driver negotiated VIRTIO_NET_F_CSUM, and the packet has
+  not been fully checksummed, then the virtio_net_hdr's fields
+  are set as follows. Otherwise, the packet must be fully
+  checksummed, and flags is zero.
+  flags has the VIRTIO_NET_HDR_F_NEEDS_CSUM set,
+  <ite:csum_start-is-set>csum_start is set to the offset within
+    the packet to begin checksumming, and
+  csum_offset indicates how many bytes after the csum_start the
+    new (16 bit ones' complement) checksum should be placed.[footnote:
+For example, consider a partially checksummed TCP (IPv4) packet.
+It will have a 14 byte ethernet header and 20 byte IP header
+followed by the TCP header (with the TCP checksum field 16 bytes
+into that header). csum_start will be 14+20 = 34 (the TCP
+checksum includes the header), and csum_offset will be 16. The
+value in the TCP checksum field will be the sum of the TCP pseudo
+header, so that replacing it by the ones' complement checksum of
+the TCP header and body will give the correct result.
+]
+  <enu:If-the-driver>If the driver negotiated
+  VIRTIO_NET_F_HOST_TSO4, TSO6 or UFO, and the packet requires
+  TCP segmentation or UDP fragmentation, then the “gso_type”
+  field is set to VIRTIO_NET_HDR_GSO_TCPV4, TCPV6 or UDP.
+  (Otherwise, it is set to VIRTIO_NET_HDR_GSO_NONE). In this
+  case, packets larger than 1514 bytes can be transmitted: the
+  metadata indicates how to replicate the packet header to cut it
+  into smaller packets. The other gso fields are set:
+  hdr_len is a hint to the device as to how much of the header
+    needs to be kept to copy into each packet, usually set to the
+    length of the headers, including the transport header.[footnote:
+Due to various bugs in implementations, this field is not useful
+as a guarantee of the transport header size.
+]
+  gso_size is the size of the packet beyond that header (ie.
+    MSS).
+  If the driver negotiated the VIRTIO_NET_F_HOST_ECN feature, the
+    VIRTIO_NET_HDR_GSO_ECN bit may be set in “gso_type” as well,
+    indicating that the TCP packet has the ECN bit set.[footnote:
+This case is not handled by some older hardware, so is called out
+specifically in the protocol.
+]
+  If the driver negotiated the VIRTIO_NET_F_MRG_RXBUF feature,
+  the num_buffers field is set to zero.
+  The header and packet are added as one output buffer to the
+  transmitq, and the device is notified of the new entry (see [sub:Notifying-The-Device]
+  ).[footnote:
+Note that the header will be two bytes longer for the
+VIRTIO_NET_F_MRG_RXBUF case.
+]
+  Packet Transmission Interrupt
+Often a driver will suppress transmission interrupts using the
+VRING_AVAIL_F_NO_INTERRUPT flag (see [sub:Receiving-Used-Buffers]
+) and check for used packets in the transmit path of following
+packets. However, it will still receive interrupts if the
+VIRTIO_F_NOTIFY_ON_EMPTY feature is negotiated, indicating that
+the transmission queue is completely emptied.
+The normal behavior in this interrupt handler is to retrieve and
+new descriptors from the used ring and free the corresponding
+headers and packets.
+  Setting Up Receive Buffers
+It is generally a good idea to keep the receive virtqueue as
+fully populated as possible: if it runs out, network performance
+will suffer.
+If the VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6 or
+VIRTIO_NET_F_GUEST_UFO features are used, the Guest will need to
+accept packets of up to 65550 bytes long (the maximum size of a
+TCP or UDP packet, plus the 14 byte ethernet header), otherwise
+1514 bytes. So unless VIRTIO_NET_F_MRG_RXBUF is negotiated, every
+buffer in the receive queue needs to be at least this length [footnote:
+Obviously each one can be split across multiple descriptor
+elements.
+].
+If VIRTIO_NET_F_MRG_RXBUF is negotiated, each buffer must be at
+least the size of the struct virtio_net_hdr.
+  Packet Receive Interrupt
+When a packet is copied into a buffer in the receiveq, the
+optimal path is to disable further interrupts for the receiveq
+(see [sub:Receiving-Used-Buffers]) and process packets until no
+more are found, then re-enable them.
+Processing packet involves:
+  If the driver negotiated the VIRTIO_NET_F_MRG_RXBUF feature,
+  then the “num_buffers” field indicates how many descriptors
+  this packet is spread over (including this one). This allows
+  receipt of large packets without having to allocate large
+  buffers. In this case, there will be at least “num_buffers” in
+  the used ring, and they should be chained together to form a
+  single packet. The other buffers will not begin with a struct
+  virtio_net_hdr.
+  If the VIRTIO_NET_F_MRG_RXBUF feature was not negotiated, or
+  the “num_buffers” field is one, then the entire packet will be
+  contained within this buffer, immediately following the struct
+  virtio_net_hdr.
+  If the VIRTIO_NET_F_GUEST_CSUM feature was negotiated, the
+  VIRTIO_NET_HDR_F_NEEDS_CSUM bit in the “flags” field may be
+  set: if so, the checksum on the packet is incomplete and the “
+  csum_start” and “csum_offset” fields indicate how to calculate
+  it (see [ite:csum_start-is-set]).
+  If the VIRTIO_NET_F_GUEST_TSO4, TSO6 or UFO options were
+  negotiated, then the “gso_type” may be something other than
+  VIRTIO_NET_HDR_GSO_NONE, and the “gso_size” field indicates the
+  desired MSS (see [enu:If-the-driver]).Control Virtqueue
+The driver uses the control virtqueue (if VIRTIO_NET_F_VTRL_VQ is
+negotiated) to send commands to manipulate various features of
+the device which would not easily map into the configuration
+space.
+All commands are of the following form:
+struct virtio_net_ctrl {
+        u8 class;
+        u8 command;
+        u8 command-specific-data[];
+        u8 ack;
+};
+/* ack values */
+#define VIRTIO_NET_OK     0
+#define VIRTIO_NET_ERR    1
+The class, command and command-specific-data are set by the
+driver, and the device sets the ack byte. There is little it can
+do except issue a diagnostic if the ack byte is not
+VIRTIO_NET_OK.
+  Packet Receive Filtering
+If the VIRTIO_NET_F_CTRL_RX feature is negotiated, the driver can
+send control commands for promiscuous mode, multicast receiving,
+and filtering of MAC addresses.
+Note that in general, these commands are best-effort: unwanted
+packets may still arrive.
+  Setting Promiscuous Mode
+#define VIRTIO_NET_CTRL_RX    0
+ #define VIRTIO_NET_CTRL_RX_PROMISC      0
+ #define VIRTIO_NET_CTRL_RX_ALLMULTI     1
+The class VIRTIO_NET_CTRL_RX has two commands:
+VIRTIO_NET_CTRL_RX_PROMISC turns promiscuous mode on and off, and
+VIRTIO_NET_CTRL_RX_ALLMULTI turns all-multicast receive on and
+off. The command-specific-data is one byte containing 0 (off) or
+1 (on).
+  Setting MAC Address Filtering
+struct virtio_net_ctrl_mac {
+        u32 entries;
+        u8 macs[entries][ETH_ALEN];
+};
+#define VIRTIO_NET_CTRL_MAC    1
+ #define VIRTIO_NET_CTRL_MAC_TABLE_SET        0
+The device can filter incoming packets by any number of
+destination MAC addresses.[footnote:
+Since there are no guarentees, it can use a hash filter
+orsilently switch to allmulti or promiscuous mode if it is given
+too many addresses.
+] This table is set using the class VIRTIO_NET_CTRL_MAC and the
+command VIRTIO_NET_CTRL_MAC_TABLE_SET. The command-specific-data
+is two variable length tables of 6-byte MAC addresses. The first
+table contains unicast addresses, and the second contains
+multicast addresses.
+  VLAN Filtering
+If the driver negotiates the VIRTION_NET_F_CTRL_VLAN feature, it
+can control a VLAN filter table in the device.
+#define VIRTIO_NET_CTRL_VLAN       2
+ #define VIRTIO_NET_CTRL_VLAN_ADD             0
+ #define VIRTIO_NET_CTRL_VLAN_DEL             1
+Both the VIRTIO_NET_CTRL_VLAN_ADD and VIRTIO_NET_CTRL_VLAN_DEL
+command take a 16-bit VLAN id as the command-specific-data.
+Appendix D: Block Device
+The virtio block device is a simple virtual block device (ie.
+disk). Read and write requests (and other exotic requests) are
+placed in the queue, and serviced (probably out of order) by the
+device except where noted.
+  Configuration
+  Subsystem Device ID 2
+  Virtqueues 0:requestq.
+  Feature bits
+  VIRTIO_BLK_F_BARRIER (0) Host supports request barriers.
+  VIRTIO_BLK_F_SIZE_MAX (1) Maximum size of any single segment is
+    in “size_max”.
+  VIRTIO_BLK_F_SEG_MAX (2) Maximum number of segments in a
+    request is in “seg_max”.
+  VIRTIO_BLK_F_GEOMETRY (4) Disk-style geometry specified in “
+    geometry”.
+  VIRTIO_BLK_F_RO (5) Device is read-only.
+  VIRTIO_BLK_F_BLK_SIZE (6) Block size of disk is in “blk_size”.
+  VIRTIO_BLK_F_SCSI (7) Device supports scsi packet commands.
+  VIRTIO_BLK_F_FLUSH (9) Cache flush command support.
+  Device configuration layout The capacity of the device
+  (expressed in 512-byte sectors) is always present. The
+  availability of the others all depend on various feature bits
+  as indicated above. struct virtio_blk_config {
+        u64 capacity;
+        u32 size_max;
+        u32 seg_max;
+        struct virtio_blk_geometry {
+                u16 cylinders;
+                u8 heads;
+                u8 sectors;
+        } geometry;
+        u32 blk_size;
+};
+  Device Initialization
+  The device size should be read from the “capacity”
+  configuration field. No requests should be submitted which goes
+  beyond this limit.
+  If the VIRTIO_BLK_F_BLK_SIZE feature is negotiated, the
+  blk_size field can be read to determine the optimal sector size
+  for the driver to use. This does not effect the units used in
+  the protocol (always 512 bytes), but awareness of the correct
+  value can effect performance.
+  If the VIRTIO_BLK_F_RO feature is set by the device, any write
+  requests will fail.
+  Device Operation
+The driver queues requests to the virtqueue, and they are used by
+the device (not necessarily in order). Each request is of form:
+struct virtio_blk_req {
+        u32 type;
+        u32 ioprio;
+        u64 sector;
+        char data[][512];
+        u8 status;
+};
+If the device has VIRTIO_BLK_F_SCSI feature, it can also support
+scsi packet command requests, each of these requests is of form:struct virtio_scsi_pc_req {
+        u32 type;
+        u32 ioprio;
+        u64 sector;
+    char cmd[];
+        char data[][512];
+#define SCSI_SENSE_BUFFERSIZE   96
+    u8 sense[SCSI_SENSE_BUFFERSIZE];
+    u32 errors;
+    u32 data_len;
+    u32 sense_len;
+    u32 residual;
+        u8 status;
+};
+The type of the request is either a read (VIRTIO_BLK_T_IN), a
+write (VIRTIO_BLK_T_OUT), a scsi packet command
+(VIRTIO_BLK_T_SCSI_CMD or VIRTIO_BLK_T_SCSI_CMD_OUT[footnote:
+the SCSI_CMD and SCSI_CMD_OUT types are equivalent, the device
+does not distinguish between them
+]) or a flush (VIRTIO_BLK_T_FLUSH or VIRTIO_BLK_T_FLUSH_OUT[footnote:
+the FLUSH and FLUSH_OUT types are equivalent, the device does not
+distinguish between them
+]). If the device has VIRTIO_BLK_F_BARRIER feature the high bit
+(VIRTIO_BLK_T_BARRIER) indicates that this request acts as a
+barrier and that all preceeding requests must be complete before
+this one, and all following requests must not be started until
+this is complete. Note that a barrier does not flush caches in
+the underlying backend device in host, and thus does not serve as
+data consistency guarantee. Driver must use FLUSH request to
+flush the host cache.
+#define VIRTIO_BLK_T_IN           0
+#define VIRTIO_BLK_T_OUT          1
+#define VIRTIO_BLK_T_SCSI_CMD     2
+#define VIRTIO_BLK_T_SCSI_CMD_OUT 3
+#define VIRTIO_BLK_T_FLUSH        4
+#define VIRTIO_BLK_T_FLUSH_OUT    5
+#define VIRTIO_BLK_T_BARRIER     0x80000000
+The ioprio field is a hint about the relative priorities of
+requests to the device: higher numbers indicate more important
+requests.
+The sector number indicates the offset (multiplied by 512) where
+the read or write is to occur. This field is unused and set to 0
+for scsi packet commands and for flush commands.
+The cmd field is only present for scsi packet command requests,
+and indicates the command to perform. This field must reside in a
+single, separate read-only buffer; command length can be derived
+from the length of this buffer.
+Note that these first three (four for scsi packet commands)
+fields are always read-only: the data field is either read-only
+or write-only, depending on the request. The size of the read or
+write can be derived from the total size of the request buffers.
+The sense field is only present for scsi packet command requests,
+and indicates the buffer for scsi sense data.
+The data_len field is only present for scsi packet command
+requests, this field is deprecated, and should be ignored by the
+driver. Historically, devices copied data length there.
+The sense_len field is only present for scsi packet command
+requests and indicates the number of bytes actually written to
+the sense buffer.
+The residual field is only present for scsi packet command
+requests and indicates the residual size, calculated as data
+length - number of bytes actually transferred.
+The final status byte is written by the device: either
+VIRTIO_BLK_S_OK for success, VIRTIO_BLK_S_IOERR for host or guest
+error or VIRTIO_BLK_S_UNSUPP for a request unsupported by host:#define VIRTIO_BLK_S_OK        0
+#define VIRTIO_BLK_S_IOERR     1
+#define VIRTIO_BLK_S_UNSUPP    2
+Historically, devices assumed that the fields type, ioprio and
+sector reside in a single, separate read-only buffer; the fields
+errors, data_len, sense_len and residual reside in a single,
+separate write-only buffer; the sense field in a separate
+write-only buffer of size 96 bytes, by itself; the fields errors,
+data_len, sense_len and residual in a single write-only buffer;
+and the status field is a separate read-only buffer of size 1
+byte, by itself.
+Appendix E: Console Device
+The virtio console device is a simple device for data input and
+output. A device may have one or more ports. Each port has a pair
+of input and output virtqueues. Moreover, a device has a pair of
+control IO virtqueues. The control virtqueues are used to
+communicate information between the device and the driver about
+ports being opened and closed on either side of the connection,
+indication from the host about whether a particular port is a
+console port, adding new ports, port hot-plug/unplug, etc., and
+indication from the guest about whether a port or a device was
+successfully added, port open/close, etc.. For data IO, one or
+more empty buffers are placed in the receive queue for incoming
+data and outgoing characters are placed in the transmit queue.
+  Configuration
+  Subsystem Device ID 3
+  Virtqueues 0:receiveq(port0). 1:transmitq(port0), 2:control
+  receiveq[footnote:
+Ports 2 onwards only if VIRTIO_CONSOLE_F_MULTIPORT is set
+], 3:control transmitq, 4:receiveq(port1), 5:transmitq(port1),
+  ...
+  Feature bits
+  VIRTIO_CONSOLE_F_SIZE (0) Configuration cols and rows fields
+    are valid.
+  VIRTIO_CONSOLE_F_MULTIPORT(1) Device has support for multiple
+    ports; configuration fields nr_ports and max_nr_ports are
+    valid and control virtqueues will be used.
+  Device configuration layout The size of the console is supplied
+  in the configuration space if the VIRTIO_CONSOLE_F_SIZE feature
+  is set. Furthermore, if the VIRTIO_CONSOLE_F_MULTIPORT feature
+  is set, the maximum number of ports supported by the device can
+  be fetched.struct virtio_console_config {
+        u16 cols;
+        u16 rows;
+        u32 max_nr_ports;
+};
+  Device Initialization
+  If the VIRTIO_CONSOLE_F_SIZE feature is negotiated, the driver
+  can read the console dimensions from the configuration fields.
+  If the VIRTIO_CONSOLE_F_MULTIPORT feature is negotiated, the
+  driver can spawn multiple ports, not all of which may be
+  attached to a console. Some could be generic ports. In this
+  case, the control virtqueues are enabled and according to the
+  max_nr_ports configuration-space value, the appropriate number
+  of virtqueues are created. A control message indicating the
+  driver is ready is sent to the host. The host can then send
+  control messages for adding new ports to the device. After
+  creating and initializing each port, a
+  VIRTIO_CONSOLE_PORT_READY control message is sent to the host
+  for that port so the host can let us know of any additional
+  configuration options set for that port.
+  The receiveq for each port is populated with one or more
+  receive buffers.
+  Device Operation
+  For output, a buffer containing the characters is placed in the
+  port's transmitq.[footnote:
+Because this is high importance and low bandwidth, the current
+Linux implementation polls for the buffer to be used, rather than
+waiting for an interrupt, simplifying the implementation
+significantly. However, for generic serial ports with the
+O_NONBLOCK flag set, the polling limitation is relaxed and the
+consumed buffers are freed upon the next write or poll call or
+when a port is closed or hot-unplugged.
+]
+  When a buffer is used in the receiveq (signalled by an
+  interrupt), the contents is the input to the port associated
+  with the virtqueue for which the notification was received.
+  If the driver negotiated the VIRTIO_CONSOLE_F_SIZE feature, a
+  configuration change interrupt may occur. The updated size can
+  be read from the configuration fields.
+  If the driver negotiated the VIRTIO_CONSOLE_F_MULTIPORT
+  feature, active ports are announced by the host using the
+  VIRTIO_CONSOLE_PORT_ADD control message. The same message is
+  used for port hot-plug as well.
+  If the host specified a port `name', a sysfs attribute is
+  created with the name filled in, so that udev rules can be
+  written that can create a symlink from the port's name to the
+  char device for port discovery by applications in the guest.
+  Changes to ports' state are effected by control messages.
+  Appropriate action is taken on the port indicated in the
+  control message. The layout of the structure of the control
+  buffer and the events associated are:struct virtio_console_control {
+        uint32_t id;    /* Port number */
+        uint16_t event; /* The kind of control event */
+        uint16_t value; /* Extra information for the event */
+};
+/* Some events for the internal messages (control packets) */
+#define VIRTIO_CONSOLE_DEVICE_READY     0
+#define VIRTIO_CONSOLE_PORT_ADD         1
+#define VIRTIO_CONSOLE_PORT_REMOVE      2
+#define VIRTIO_CONSOLE_PORT_READY       3
+#define VIRTIO_CONSOLE_CONSOLE_PORT     4
+#define VIRTIO_CONSOLE_RESIZE           5
+#define VIRTIO_CONSOLE_PORT_OPEN        6
+#define VIRTIO_CONSOLE_PORT_NAME        7
+Appendix F: Entropy Device
+The virtio entropy device supplies high-quality randomness for
+guest use.
+  Configuration
+  Subsystem Device ID 4
+  Virtqueues 0:requestq.
+  Feature bits None currently defined
+  Device configuration layout None currently defined.
+  Device Initialization
+  The virtqueue is initialized
+  Device Operation
+When the driver requires random bytes, it places the descriptor
+of one or more buffers in the queue. It will be completely filled
+by random data by the device.
+Appendix G: Memory Balloon Device
+The virtio memory balloon device is a primitive device for
+managing guest memory: the device asks for a certain amount of
+memory, and the guest supplies it (or withdraws it, if the device
+has more than it asks for). This allows the guest to adapt to
+changes in allowance of underlying physical memory. If the
+feature is negotiated, the device can also be used to communicate
+guest memory statistics to the host.
+  Configuration
+  Subsystem Device ID 5
+  Virtqueues 0:inflateq. 1:deflateq. 2:statsq.[footnote:
+Only if VIRTIO_BALLON_F_STATS_VQ set
+]
+  Feature bits
+  VIRTIO_BALLOON_F_MUST_TELL_HOST (0) Host must be told before
+    pages from the balloon are used.
+  VIRTIO_BALLOON_F_STATS_VQ (1) A virtqueue for reporting guest
+    memory statistics is present.
+  Device configuration layout Both fields of this configuration
+  are always available. Note that they are little endian, despite
+  convention that device fields are guest endian:struct virtio_balloon_config {
+        u32 num_pages;
+        u32 actual;
+};
+  Device Initialization
+  The inflate and deflate virtqueues are identified.
+  If the VIRTIO_BALLOON_F_STATS_VQ feature bit is negotiated:
+  Identify the stats virtqueue.
+  Add one empty buffer to the stats virtqueue and notify the
+    host.
+Device operation begins immediately.
+  Device Operation
+  Memory Ballooning The device is driven by the receipt of a
+  configuration change interrupt.
+  The “num_pages” configuration field is examined. If this is
+  greater than the “actual” number of pages, memory must be given
+  to the balloon. If it is less than the “actual” number of
+  pages, memory may be taken back from the balloon for general
+  use.
+  To supply memory to the balloon (aka. inflate):
+  The driver constructs an array of addresses of unused memory
+    pages. These addresses are divided by 4096[footnote:
+This is historical, and independent of the guest page size
+] and the descriptor describing the resulting 32-bit array is
+    added to the inflateq.
+  To remove memory from the balloon (aka. deflate):
+  The driver constructs an array of addresses of memory pages it
+    has previously given to the balloon, as described above. This
+    descriptor is added to the deflateq.
+  If the VIRTIO_BALLOON_F_MUST_TELL_HOST feature is set, the
+    guest may not use these requested pages until that descriptor
+    in the deflateq has been used by the device.
+  Otherwise, the guest may begin to re-use pages previously given
+    to the balloon before the device has acknowledged their
+    withdrawl. [footnote:
+In this case, deflation advice is merely a courtesy
+]
+  In either case, once the device has completed the inflation or
+  deflation, the “actual” field of the configuration should be
+  updated to reflect the new number of pages in the balloon.[footnote:
+As updates to configuration space are not atomic, this field
+isn't particularly reliable, but can be used to diagnose buggy
+guests.
+]
+  Memory Statistics
+The stats virtqueue is atypical because communication is driven
+by the device (not the driver). The channel becomes active at
+driver initialization time when the driver adds an empty buffer
+and notifies the device. A request for memory statistics proceeds
+as follows:
+  The device pushes the buffer onto the used ring and sends an
+  interrupt.
+  The driver pops the used buffer and discards it.
+  The driver collects memory statistics and writes them into a
+  new buffer.
+  The driver adds the buffer to the virtqueue and notifies the
+  device.
+  The device pops the buffer (retaining it to initiate a
+  subsequent request) and consumes the statistics.
+  Memory Statistics Format Each statistic consists of a 16 bit
+  tag and a 64 bit value. Both quantities are represented in the
+  native endian of the guest. All statistics are optional and the
+  driver may choose which ones to supply. To guarantee backwards
+  compatibility, unsupported statistics should be omitted.
+  struct virtio_balloon_stat {
+#define VIRTIO_BALLOON_S_SWAP_IN  0
+#define VIRTIO_BALLOON_S_SWAP_OUT 1
+#define VIRTIO_BALLOON_S_MAJFLT   2
+#define VIRTIO_BALLOON_S_MINFLT   3
+#define VIRTIO_BALLOON_S_MEMFREE  4
+#define VIRTIO_BALLOON_S_MEMTOT   5
+        u16 tag;
+        u64 val;
+} __attribute__((packed));
+  Tags
+  VIRTIO_BALLOON_S_SWAP_IN The amount of memory that has been
+  swapped in (in bytes).
+  VIRTIO_BALLOON_S_SWAP_OUT The amount of memory that has been
+  swapped out to disk (in bytes).
+  VIRTIO_BALLOON_S_MAJFLT The number of major page faults that
+  have occurred.
+  VIRTIO_BALLOON_S_MINFLT The number of minor page faults that
+  have occurred.
+  VIRTIO_BALLOON_S_MEMFREE The amount of memory not being used
+  for any purpose (in bytes).
+  VIRTIO_BALLOON_S_MEMTOT The total amount of memory available
+  (in bytes).
diff --git a/MAINTAINERS b/MAINTAINERS
index 1d445f572987..1a8cc600067d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1883,7 +1883,7 @@ S:	Maintained
 F:      drivers/connector/
 CONTROL GROUPS (CGROUPS)
-M:      Paul Menage <menage@google.com>
+M:      Paul Menage <paul@paulmenage.org>
 M:      Li Zefan <lizf@cn.fujitsu.com>
 L:      containers@lists.linux-foundation.org
 S:      Maintained
@@ -1932,7 +1932,7 @@ S:	Maintained
 F:      tools/power/cpupower
 CPUSETS
-M:      Paul Menage <menage@google.com>
+M:      Paul Menage <paul@paulmenage.org>
 W:      http://www.bullopensource.org/cpuset/
 W:      http://oss.sgi.com/projects/cpusets/
 S:      Supported
@@ -4971,7 +4971,7 @@ M:	Paul Mackerras <paulus@samba.org>
 M:      Ingo Molnar <mingo@elte.hu>
 M:      Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
 S:      Supported
-F:      kernel/perf_event*.c
+F:      kernel/events/*
 F:      include/linux/perf_event.h
 F:      arch/*/kernel/perf_event*.c
 F:      arch/*/kernel/*/perf_event*.c
@@ -5532,6 +5532,7 @@ F:	include/media/*7146*
 SAMSUNG AUDIO (ASoC) DRIVERS
 M:      Jassi Brar <jassisinghbrar@gmail.com>
+M:      Sangbeom Kim <sbkim73@samsung.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 S:      Supported
 F:      sound/soc/samsung
@@ -7087,7 +7088,7 @@ S:	Supported
 F:      drivers/mmc/host/vub300.c
 W1 DALLAS'S 1-WIRE BUS
-M:      Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+M:      Evgeniy Polyakov <zbr@ioremap.net>
 S:      Maintained
 F:      Documentation/w1/
 F:      drivers/w1/
diff --git a/Makefile b/Makefile
index 3241d41dfbff..788511f86a62 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 3
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
-NAME = Wet Seal
+NAME = "Divemaster Edition"
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/alpha/include/asm/sysinfo.h b/arch/alpha/include/asm/sysinfo.h
index 086aba284df2..e77d77cd07b8 100644
--- a/arch/alpha/include/asm/sysinfo.h
+++ b/arch/alpha/include/asm/sysinfo.h
@@ -27,13 +27,4 @@
 #define UAC_NOFIX                       2
 #define UAC_SIGBUS                      4
-#ifdef __KERNEL__
-/* This is the shift that is applied to the UAC bits as stored in the
-   per-thread flags.  See thread_info.h.  */
-#define UAC_SHIFT                       6
-#endif
 #endif /* __ASM_ALPHA_SYSINFO_H */
diff --git a/arch/alpha/include/asm/thread_info.h b/arch/alpha/include/asm/thread_info.h
index 6f32f9c84a2d..ff73db022342 100644
--- a/arch/alpha/include/asm/thread_info.h
+++ b/arch/alpha/include/asm/thread_info.h
@@ -74,9 +74,9 @@ register struct thread_info *__current_thread_info __asm__("$8");
 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
 #define TIF_POLLING_NRFLAG      8       /* poll_idle is polling NEED_RESCHED */
 #define TIF_DIE_IF_KERNEL       9       /* dik recursion lock */
-#define TIF_UAC_NOPRINT         10      /* see sysinfo.h */
+#define TIF_UAC_NOPRINT         10      /* ! Preserve sequence of following */
-#define TIF_UAC_NOFIX           11
+#define TIF_UAC_NOFIX           11      /* ! flags as they match            */
-#define TIF_UAC_SIGBUS          12
+#define TIF_UAC_SIGBUS          12      /* ! userspace part of 'osf_sysinfo' */
 #define TIF_MEMDIE              13      /* is terminating due to OOM killer */
 #define TIF_RESTORE_SIGMASK     14      /* restore signal mask in do_signal */
 #define TIF_FREEZE              16      /* is freezing for suspend */
@@ -97,7 +97,7 @@ register struct thread_info *__current_thread_info __asm__("$8");
 #define _TIF_ALLWORK_MASK       (_TIF_WORK_MASK         \
                                 | _TIF_SYSCALL_TRACE)
-#define ALPHA_UAC_SHIFT         10
+#define ALPHA_UAC_SHIFT         TIF_UAC_NOPRINT
 #define ALPHA_UAC_MASK          (1 << TIF_UAC_NOPRINT | 1 << TIF_UAC_NOFIX | \
                                 1 << TIF_UAC_SIGBUS)
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 326f0a2d56e5..01e8715e26d9 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -42,6 +42,7 @@
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <asm/sysinfo.h>
+#include <asm/thread_info.h>
 #include <asm/hwrpb.h>
 #include <asm/processor.h>
@@ -633,9 +634,10 @@ SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer,
        case GSI_UACPROC:
                if (nbytes < sizeof(unsigned int))
                        return -EINVAL;
-                w = (current_thread_info()->flags >> UAC_SHIFT) & UAC_BITMASK;
+                w = (current_thread_info()->flags >> ALPHA_UAC_SHIFT) &
-                if (put_user(w, (unsigned int __user *)buffer))
+                        UAC_BITMASK;
-                        return -EFAULT;
+                if (put_user(w, (unsigned int __user *)buffer))
+                        return -EFAULT;
                return 1;
        case GSI_PROC_TYPE:
@@ -756,8 +758,8 @@ SYSCALL_DEFINE5(osf_setsysinfo, unsigned long, op, void __user *, buffer,
                        case SSIN_UACPROC:
                        again:
                                old = current_thread_info()->flags;
-                                new = old & ~(UAC_BITMASK << UAC_SHIFT);
+                                new = old & ~(UAC_BITMASK << ALPHA_UAC_SHIFT);
-                                new = new | (w & UAC_BITMASK) << UAC_SHIFT;
+                                new = new | (w & UAC_BITMASK) << ALPHA_UAC_SHIFT;
                                if (cmpxchg(&current_thread_info()->flags,
                                            old, new) != old)
                                        goto again;
diff --git a/arch/cris/include/asm/serial.h b/arch/cris/include/asm/serial.h
new file mode 100644
index 000000000000..af7535a955fb
--- /dev/null
+++ b/arch/cris/include/asm/serial.h
@@ -0,0 +1,9 @@
+#ifndef _ASM_SERIAL_H
+#define _ASM_SERIAL_H
+/*
+ * This assumes you have a 1.8432 MHz clock for your UART.
+ */
+#define BASE_BAUD (1843200 / 16)
+#endif /* _ASM_SERIAL_H */
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 124854714958..3ff7785b3beb 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -162,7 +162,6 @@ config IA64_GENERIC
        select ACPI_NUMA
        select SWIOTLB
        select PCI_MSI
-        select DMAR
        help
          This selects the system type of your hardware.  A "generic" kernel
          will run on any supported IA-64 system.  However, if you configure
diff --git a/arch/ia64/configs/generic_defconfig b/arch/ia64/configs/generic_defconfig
index 1d7bca0a396d..0e5cd1405e0e 100644
--- a/arch/ia64/configs/generic_defconfig
+++ b/arch/ia64/configs/generic_defconfig
@@ -234,3 +234,4 @@ CONFIG_CRYPTO_MD5=y
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRC_T10DIF=y
 CONFIG_MISC_DEVICES=y
+CONFIG_DMAR=y
diff --git a/arch/m68k/include/asm/page_mm.h b/arch/m68k/include/asm/page_mm.h
index 31d5570d6567..89f201434b5a 100644
--- a/arch/m68k/include/asm/page_mm.h
+++ b/arch/m68k/include/asm/page_mm.h
@@ -162,7 +162,7 @@ static inline __attribute_const__ int __virt_to_node_shift(void)
        pgdat->node_mem_map + (__pfn - pgdat->node_start_pfn);          \
 })
 #define page_to_pfn(_page) ({                                           \
-        struct page *__p = (_page);                                     \
+        const struct page *__p = (_page);                               \
        struct pglist_data *pgdat;                                      \
        pgdat = &pg_data_map[page_to_nid(__p)];                         \
        ((__p) - pgdat->node_mem_map) + pgdat->node_start_pfn;          \
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index 2de8551df40f..c65f75aa7ff7 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -54,6 +54,7 @@
 #define ODSR_CLEAR              0x1c00
 #define LTLEECSR_ENABLE_ALL     0xFFC000FC
 #define ESCSR_CLEAR             0x07120204
+#define IECSR_CLEAR             0x80000000
 #define RIO_PORT1_EDCSR         0x0640
 #define RIO_PORT2_EDCSR         0x0680
@@ -1089,11 +1090,11 @@ static void port_error_handler(struct rio_mport *port, int offset)
        if (offset == 0) {
                out_be32((u32 *)(rio_regs_win + RIO_PORT1_EDCSR), 0);
-                out_be32((u32 *)(rio_regs_win + RIO_PORT1_IECSR), 0);
+                out_be32((u32 *)(rio_regs_win + RIO_PORT1_IECSR), IECSR_CLEAR);
                out_be32((u32 *)(rio_regs_win + RIO_ESCSR), ESCSR_CLEAR);
        } else {
                out_be32((u32 *)(rio_regs_win + RIO_PORT2_EDCSR), 0);
-                out_be32((u32 *)(rio_regs_win + RIO_PORT2_IECSR), 0);
+                out_be32((u32 *)(rio_regs_win + RIO_PORT2_IECSR), IECSR_CLEAR);
                out_be32((u32 *)(rio_regs_win + RIO_PORT2_ESCSR), ESCSR_CLEAR);
        }
 }
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index 068f8465c4ee..f297456dba7a 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -396,17 +396,19 @@ static __init void detect_machine_facilities(void)
 static __init void rescue_initrd(void)
 {
 #ifdef CONFIG_BLK_DEV_INITRD
+        unsigned long min_initrd_addr = (unsigned long) _end + (4UL << 20);
        /*
-         * Move the initrd right behind the bss section in case it starts
+         * Just like in case of IPL from VM reader we make sure there is a
-         * within the bss section. So we don't overwrite it when the bss
+         * gap of 4MB between end of kernel and start of initrd.
-         * section gets cleared.
+         * That way we can also be sure that saving an NSS will succeed,
+         * which however only requires different segments.
         */
        if (!INITRD_START || !INITRD_SIZE)
                return;
-        if (INITRD_START >= (unsigned long) __bss_stop)
+        if (INITRD_START >= min_initrd_addr)
                return;
-        memmove(__bss_stop, (void *) INITRD_START, INITRD_SIZE);
+        memmove((void *) min_initrd_addr, (void *) INITRD_START, INITRD_SIZE);
-        INITRD_START = (unsigned long) __bss_stop;
+        INITRD_START = min_initrd_addr;
 #endif
 }
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index 04361d5a4279..48c710206366 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -1220,7 +1220,7 @@ static int __init reipl_fcp_init(void)
        /* sysfs: create fcp kset for mixing attr group and bin attrs */
        reipl_fcp_kset = kset_create_and_add(IPL_FCP_STR, NULL,
                                             &reipl_kset->kobj);
-        if (!reipl_kset) {
+        if (!reipl_fcp_kset) {
                free_page((unsigned long) reipl_block_fcp);
                return -ENOMEM;
        }
@@ -1618,7 +1618,8 @@ static struct shutdown_action vmcmd_action = {SHUTDOWN_ACTION_VMCMD_STR,
 static void stop_run(struct shutdown_trigger *trigger)
 {
-        if (strcmp(trigger->name, ON_PANIC_STR) == 0)
+        if (strcmp(trigger->name, ON_PANIC_STR) == 0 ||
+            strcmp(trigger->name, ON_RESTART_STR) == 0)
                disabled_wait((unsigned long) __builtin_return_address(0));
        while (sigp(smp_processor_id(), sigp_stop) == sigp_busy)
                cpu_relax();
@@ -1717,7 +1718,7 @@ static void do_panic(void)
 /* on restart */
 static struct shutdown_trigger on_restart_trigger = {ON_RESTART_STR,
-        &reipl_action};
+        &stop_action};
 static ssize_t on_restart_show(struct kobject *kobj,
                               struct kobj_attribute *attr, char *page)
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 42c67beadcae..1a6f20d4e7e6 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -55,6 +55,7 @@ config SPARC64
        select PERF_USE_VMALLOC
        select IRQ_PREFLOW_FASTEOI
        select ARCH_HAVE_NMI_SAFE_CMPXCHG
+        select HAVE_C_RECORDMCOUNT
 config ARCH_DEFCONFIG
        string
diff --git a/arch/sparc/include/asm/sigcontext.h b/arch/sparc/include/asm/sigcontext.h
index a1607d180354..69914d748130 100644
--- a/arch/sparc/include/asm/sigcontext.h
+++ b/arch/sparc/include/asm/sigcontext.h
@@ -45,6 +45,19 @@ typedef struct {
        int                     si_mask;
 } __siginfo32_t;
+#define __SIGC_MAXWIN   7
+typedef struct {
+        unsigned long locals[8];
+        unsigned long ins[8];
+} __siginfo_reg_window;
+typedef struct {
+        int                     wsaved;
+        __siginfo_reg_window    reg_window[__SIGC_MAXWIN];
+        unsigned long           rwbuf_stkptrs[__SIGC_MAXWIN];
+} __siginfo_rwin_t;
 #ifdef CONFIG_SPARC64
 typedef struct {
        unsigned   int si_float_regs [64];
@@ -73,6 +86,7 @@ struct sigcontext {
                unsigned long   ss_size;
        }                       sigc_stack;
        unsigned long           sigc_mask;
+        __siginfo_rwin_t *      sigc_rwin_save;
 };
 #else
diff --git a/arch/sparc/include/asm/spinlock_32.h b/arch/sparc/include/asm/spinlock_32.h
index 5f5b8bf3f50d..bcc98fc35281 100644
--- a/arch/sparc/include/asm/spinlock_32.h
+++ b/arch/sparc/include/asm/spinlock_32.h
@@ -131,6 +131,15 @@ static inline void arch_write_lock(arch_rwlock_t *rw)
        *(volatile __u32 *)&lp->lock = ~0U;
 }
+static void inline arch_write_unlock(arch_rwlock_t *lock)
+{
+        __asm__ __volatile__(
+"       st              %%g0, [%0]"
+        : /* no outputs */
+        : "r" (lock)
+        : "memory");
+}
 static inline int arch_write_trylock(arch_rwlock_t *rw)
 {
        unsigned int val;
@@ -175,8 +184,6 @@ static inline int __arch_read_trylock(arch_rwlock_t *rw)
        res; \
 })
-#define arch_write_unlock(rw)   do { (rw)->lock = 0; } while(0)
 #define arch_spin_lock_flags(lock, flags) arch_spin_lock(lock)
 #define arch_read_lock_flags(rw, flags)   arch_read_lock(rw)
 #define arch_write_lock_flags(rw, flags)  arch_write_lock(rw)
diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
index 073936a8b275..968917694978 100644
--- a/arch/sparc/include/asm/spinlock_64.h
+++ b/arch/sparc/include/asm/spinlock_64.h
@@ -210,14 +210,8 @@ static int inline arch_write_trylock(arch_rwlock_t *lock)
        return result;
 }
-#define arch_read_lock(p)       arch_read_lock(p)
 #define arch_read_lock_flags(p, f) arch_read_lock(p)
-#define arch_read_trylock(p)    arch_read_trylock(p)
-#define arch_read_unlock(p)     arch_read_unlock(p)
-#define arch_write_lock(p)      arch_write_lock(p)
 #define arch_write_lock_flags(p, f) arch_write_lock(p)
-#define arch_write_unlock(p)    arch_write_unlock(p)
-#define arch_write_trylock(p)   arch_write_trylock(p)
 #define arch_read_can_lock(rw)          (!((rw)->lock & 0x80000000UL))
 #define arch_write_can_lock(rw) (!(rw)->lock)
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index b90b4a1d070a..cb85458f89d2 100644
--- a/arch/sparc/kernel/Makefile
+++ b/arch/sparc/kernel/Makefile
@@ -32,6 +32,7 @@ obj-$(CONFIG_SPARC32)   += sun4m_irq.o sun4c_irq.o sun4d_irq.o
 obj-y                   += process_$(BITS).o
 obj-y                   += signal_$(BITS).o
+obj-y                   += sigutil_$(BITS).o
 obj-$(CONFIG_SPARC32)   += ioport.o
 obj-y                   += setup_$(BITS).o
 obj-y                   += idprom.o
diff --git a/arch/sparc/kernel/pcic.c b/arch/sparc/kernel/pcic.c
index a19f04195478..1aaf8c180be5 100644
--- a/arch/sparc/kernel/pcic.c
+++ b/arch/sparc/kernel/pcic.c
@@ -352,8 +352,8 @@ int __init pcic_probe(void)
        strcpy(pbm->prom_name, namebuf);
        {
-                extern volatile int t_nmi[1];
+                extern volatile int t_nmi[4];
-                extern int pcic_nmi_trap_patch[1];
+                extern int pcic_nmi_trap_patch[4];
                t_nmi[0] = pcic_nmi_trap_patch[0];
                t_nmi[1] = pcic_nmi_trap_patch[1];
diff --git a/arch/sparc/kernel/signal32.c b/arch/sparc/kernel/signal32.c
index 75fad425e249..1ba95aff5d59 100644
--- a/arch/sparc/kernel/signal32.c
+++ b/arch/sparc/kernel/signal32.c
@@ -29,6 +29,8 @@
 #include <asm/visasm.h>
 #include <asm/compat_signal.h>
+#include "sigutil.h"
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
 /* This magic should be in g_upper[0] for all upper parts
@@ -44,14 +46,14 @@ typedef struct {
 struct signal_frame32 {
        struct sparc_stackf32   ss;
        __siginfo32_t           info;
-        /* __siginfo_fpu32_t * */ u32 fpu_save;
+        /* __siginfo_fpu_t * */ u32 fpu_save;
        unsigned int            insns[2];
        unsigned int            extramask[_COMPAT_NSIG_WORDS - 1];
        unsigned int            extra_size; /* Should be sizeof(siginfo_extra_v8plus_t) */
        /* Only valid if (info.si_regs.psr & (PSR_VERS|PSR_IMPL)) == PSR_V8PLUS */
        siginfo_extra_v8plus_t  v8plus;
-        __siginfo_fpu_t         fpu_state;
+        /* __siginfo_rwin_t * */u32 rwin_save;
-};
+} __attribute__((aligned(8)));
 typedef struct compat_siginfo{
        int si_signo;
@@ -110,18 +112,14 @@ struct rt_signal_frame32 {
        compat_siginfo_t        info;
        struct pt_regs32        regs;
        compat_sigset_t         mask;
-        /* __siginfo_fpu32_t * */ u32 fpu_save;
+        /* __siginfo_fpu_t * */ u32 fpu_save;
        unsigned int            insns[2];
        stack_t32               stack;
        unsigned int            extra_size; /* Should be sizeof(siginfo_extra_v8plus_t) */
        /* Only valid if (regs.psr & (PSR_VERS|PSR_IMPL)) == PSR_V8PLUS */
        siginfo_extra_v8plus_t  v8plus;
-        __siginfo_fpu_t         fpu_state;
+        /* __siginfo_rwin_t * */u32 rwin_save;
-};
+} __attribute__((aligned(8)));
-/* Align macros */
-#define SF_ALIGNEDSZ  (((sizeof(struct signal_frame32) + 15) & (~15)))
-#define RT_ALIGNEDSZ  (((sizeof(struct rt_signal_frame32) + 15) & (~15)))
 int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
 {
@@ -192,30 +190,13 @@ int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
        return 0;
 }
-static int restore_fpu_state32(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
-{
-        unsigned long *fpregs = current_thread_info()->fpregs;
-        unsigned long fprs;
-        int err;
-        
-        err = __get_user(fprs, &fpu->si_fprs);
-        fprs_write(0);
-        regs->tstate &= ~TSTATE_PEF;
-        if (fprs & FPRS_DL)
-                err |= copy_from_user(fpregs, &fpu->si_float_regs[0], (sizeof(unsigned int) * 32));
-        if (fprs & FPRS_DU)
-                err |= copy_from_user(fpregs+16, &fpu->si_float_regs[32], (sizeof(unsigned int) * 32));
-        err |= __get_user(current_thread_info()->xfsr[0], &fpu->si_fsr);
-        err |= __get_user(current_thread_info()->gsr[0], &fpu->si_gsr);
-        current_thread_info()->fpsaved[0] |= fprs;
-        return err;
-}
 void do_sigreturn32(struct pt_regs *regs)
 {
        struct signal_frame32 __user *sf;
+        compat_uptr_t fpu_save;
+        compat_uptr_t rwin_save;
        unsigned int psr;
-        unsigned pc, npc, fpu_save;
+        unsigned pc, npc;
        sigset_t set;
        unsigned seta[_COMPAT_NSIG_WORDS];
        int err, i;
@@ -273,8 +254,13 @@ void do_sigreturn32(struct pt_regs *regs)
        pt_regs_clear_syscall(regs);
        err |= __get_user(fpu_save, &sf->fpu_save);
-        if (fpu_save)
+        if (!err && fpu_save)
-                err |= restore_fpu_state32(regs, &sf->fpu_state);
+                err |= restore_fpu_state(regs, compat_ptr(fpu_save));
+        err |= __get_user(rwin_save, &sf->rwin_save);
+        if (!err && rwin_save) {
+                if (restore_rwin_state(compat_ptr(rwin_save)))
+                        goto segv;
+        }
        err |= __get_user(seta[0], &sf->info.si_mask);
        err |= copy_from_user(seta+1, &sf->extramask,
                              (_COMPAT_NSIG_WORDS - 1) * sizeof(unsigned int));
@@ -300,7 +286,9 @@ segv:
 asmlinkage void do_rt_sigreturn32(struct pt_regs *regs)
 {
        struct rt_signal_frame32 __user *sf;
-        unsigned int psr, pc, npc, fpu_save, u_ss_sp;
+        unsigned int psr, pc, npc, u_ss_sp;
+        compat_uptr_t fpu_save;
+        compat_uptr_t rwin_save;
        mm_segment_t old_fs;
        sigset_t set;
        compat_sigset_t seta;
@@ -359,8 +347,8 @@ asmlinkage void do_rt_sigreturn32(struct pt_regs *regs)
        pt_regs_clear_syscall(regs);
        err |= __get_user(fpu_save, &sf->fpu_save);
-        if (fpu_save)
+        if (!err && fpu_save)
-                err |= restore_fpu_state32(regs, &sf->fpu_state);
+                err |= restore_fpu_state(regs, compat_ptr(fpu_save));
        err |= copy_from_user(&seta, &sf->mask, sizeof(compat_sigset_t));
        err |= __get_user(u_ss_sp, &sf->stack.ss_sp);
        st.ss_sp = compat_ptr(u_ss_sp);
@@ -376,6 +364,12 @@ asmlinkage void do_rt_sigreturn32(struct pt_regs *regs)
        do_sigaltstack((stack_t __user *) &st, NULL, (unsigned long)sf);
        set_fs(old_fs);
        
+        err |= __get_user(rwin_save, &sf->rwin_save);
+        if (!err && rwin_save) {
+                if (restore_rwin_state(compat_ptr(rwin_save)))
+                        goto segv;
+        }
        switch (_NSIG_WORDS) {
                case 4: set.sig[3] = seta.sig[6] + (((long)seta.sig[7]) << 32);
                case 3: set.sig[2] = seta.sig[4] + (((long)seta.sig[5]) << 32);
@@ -433,26 +427,6 @@ static void __user *get_sigframe(struct sigaction *sa, struct pt_regs *regs, uns
        return (void __user *) sp;
 }
-static int save_fpu_state32(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
-{
-        unsigned long *fpregs = current_thread_info()->fpregs;
-        unsigned long fprs;
-        int err = 0;
-        
-        fprs = current_thread_info()->fpsaved[0];
-        if (fprs & FPRS_DL)
-                err |= copy_to_user(&fpu->si_float_regs[0], fpregs,
-                                    (sizeof(unsigned int) * 32));
-        if (fprs & FPRS_DU)
-                err |= copy_to_user(&fpu->si_float_regs[32], fpregs+16,
-                                    (sizeof(unsigned int) * 32));
-        err |= __put_user(current_thread_info()->xfsr[0], &fpu->si_fsr);
-        err |= __put_user(current_thread_info()->gsr[0], &fpu->si_gsr);
-        err |= __put_user(fprs, &fpu->si_fprs);
-        return err;
-}
 /* The I-cache flush instruction only works in the primary ASI, which
 * right now is the nucleus, aka. kernel space.
 *
@@ -515,18 +489,23 @@ static int setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
                         int signo, sigset_t *oldset)
 {
        struct signal_frame32 __user *sf;
+        int i, err, wsaved;
+        void __user *tail;
        int sigframe_size;
        u32 psr;
-        int i, err;
        unsigned int seta[_COMPAT_NSIG_WORDS];
        /* 1. Make sure everything is clean */
        synchronize_user_stack();
        save_and_clear_fpu();
        
-        sigframe_size = SF_ALIGNEDSZ;
+        wsaved = get_thread_wsaved();
-        if (!(current_thread_info()->fpsaved[0] & FPRS_FEF))
-                sigframe_size -= sizeof(__siginfo_fpu_t);
+        sigframe_size = sizeof(*sf);
+        if (current_thread_info()->fpsaved[0] & FPRS_FEF)
+                sigframe_size += sizeof(__siginfo_fpu_t);
+        if (wsaved)
+                sigframe_size += sizeof(__siginfo_rwin_t);
        sf = (struct signal_frame32 __user *)
                get_sigframe(&ka->sa, regs, sigframe_size);
@@ -534,8 +513,7 @@ static int setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
        if (invalid_frame_pointer(sf, sigframe_size))
                goto sigill;
-        if (get_thread_wsaved() != 0)
+        tail = (sf + 1);
-                goto sigill;
        /* 2. Save the current process state */
        if (test_thread_flag(TIF_32BIT)) {
@@ -560,11 +538,22 @@ static int setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
                          &sf->v8plus.asi);
        if (psr & PSR_EF) {
-                err |= save_fpu_state32(regs, &sf->fpu_state);
+                __siginfo_fpu_t __user *fp = tail;
-                err |= __put_user((u64)&sf->fpu_state, &sf->fpu_save);
+                tail += sizeof(*fp);
+                err |= save_fpu_state(regs, fp);
+                err |= __put_user((u64)fp, &sf->fpu_save);
        } else {
                err |= __put_user(0, &sf->fpu_save);
        }
+        if (wsaved) {
+                __siginfo_rwin_t __user *rwp = tail;
+                tail += sizeof(*rwp);
+                err |= save_rwin_state(wsaved, rwp);
+                err |= __put_user((u64)rwp, &sf->rwin_save);
+                set_thread_wsaved(0);
+        } else {
+                err |= __put_user(0, &sf->rwin_save);
+        }
        switch (_NSIG_WORDS) {
        case 4: seta[7] = (oldset->sig[3] >> 32);
@@ -580,10 +569,21 @@ static int setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
        err |= __copy_to_user(sf->extramask, seta + 1,
                              (_COMPAT_NSIG_WORDS - 1) * sizeof(unsigned int));
-        err |= copy_in_user((u32 __user *)sf,
+        if (!wsaved) {
-                            (u32 __user *)(regs->u_regs[UREG_FP]),
+                err |= copy_in_user((u32 __user *)sf,
-                            sizeof(struct reg_window32));
+                                    (u32 __user *)(regs->u_regs[UREG_FP]),
-        
+                                    sizeof(struct reg_window32));
+        } else {
+                struct reg_window *rp;
+                rp = &current_thread_info()->reg_window[wsaved - 1];
+                for (i = 0; i < 8; i++)
+                        err |= __put_user(rp->locals[i], &sf->ss.locals[i]);
+                for (i = 0; i < 6; i++)
+                        err |= __put_user(rp->ins[i], &sf->ss.ins[i]);
+                err |= __put_user(rp->ins[6], &sf->ss.fp);
+                err |= __put_user(rp->ins[7], &sf->ss.callers_pc);
+        }       
        if (err)
                goto sigsegv;
@@ -613,7 +613,6 @@ static int setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
                err |= __put_user(0x91d02010, &sf->insns[1]); /*t 0x10*/
                if (err)
                        goto sigsegv;
                flush_signal_insns(address);
        }
        return 0;
@@ -632,18 +631,23 @@ static int setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
                            siginfo_t *info)
 {
        struct rt_signal_frame32 __user *sf;
+        int i, err, wsaved;
+        void __user *tail;
        int sigframe_size;
        u32 psr;
-        int i, err;
        compat_sigset_t seta;
        /* 1. Make sure everything is clean */
        synchronize_user_stack();
        save_and_clear_fpu();
        
-        sigframe_size = RT_ALIGNEDSZ;
+        wsaved = get_thread_wsaved();
-        if (!(current_thread_info()->fpsaved[0] & FPRS_FEF))
-                sigframe_size -= sizeof(__siginfo_fpu_t);
+        sigframe_size = sizeof(*sf);
+        if (current_thread_info()->fpsaved[0] & FPRS_FEF)
+                sigframe_size += sizeof(__siginfo_fpu_t);
+        if (wsaved)
+                sigframe_size += sizeof(__siginfo_rwin_t);
        sf = (struct rt_signal_frame32 __user *)
                get_sigframe(&ka->sa, regs, sigframe_size);
@@ -651,8 +655,7 @@ static int setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
        if (invalid_frame_pointer(sf, sigframe_size))
                goto sigill;
-        if (get_thread_wsaved() != 0)
+        tail = (sf + 1);
-                goto sigill;
        /* 2. Save the current process state */
        if (test_thread_flag(TIF_32BIT)) {
@@ -677,11 +680,22 @@ static int setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
                          &sf->v8plus.asi);
        if (psr & PSR_EF) {
-                err |= save_fpu_state32(regs, &sf->fpu_state);
+                __siginfo_fpu_t __user *fp = tail;
-                err |= __put_user((u64)&sf->fpu_state, &sf->fpu_save);
+                tail += sizeof(*fp);
+                err |= save_fpu_state(regs, fp);
+                err |= __put_user((u64)fp, &sf->fpu_save);
        } else {
                err |= __put_user(0, &sf->fpu_save);
        }
+        if (wsaved) {
+                __siginfo_rwin_t __user *rwp = tail;
+                tail += sizeof(*rwp);
+                err |= save_rwin_state(wsaved, rwp);
+                err |= __put_user((u64)rwp, &sf->rwin_save);
+                set_thread_wsaved(0);
+        } else {
+                err |= __put_user(0, &sf->rwin_save);
+        }
        /* Update the siginfo structure.  */
        err |= copy_siginfo_to_user32(&sf->info, info);
@@ -703,9 +717,21 @@ static int setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
        }
        err |= __copy_to_user(&sf->mask, &seta, sizeof(compat_sigset_t));
-        err |= copy_in_user((u32 __user *)sf,
+        if (!wsaved) {
-                            (u32 __user *)(regs->u_regs[UREG_FP]),
+                err |= copy_in_user((u32 __user *)sf,
-                            sizeof(struct reg_window32));
+                                    (u32 __user *)(regs->u_regs[UREG_FP]),
+                                    sizeof(struct reg_window32));
+        } else {
+                struct reg_window *rp;
+                rp = &current_thread_info()->reg_window[wsaved - 1];
+                for (i = 0; i < 8; i++)
+                        err |= __put_user(rp->locals[i], &sf->ss.locals[i]);
+                for (i = 0; i < 6; i++)
+                        err |= __put_user(rp->ins[i], &sf->ss.ins[i]);
+                err |= __put_user(rp->ins[6], &sf->ss.fp);
+                err |= __put_user(rp->ins[7], &sf->ss.callers_pc);
+        }
        if (err)
                goto sigsegv;
        
diff --git a/arch/sparc/kernel/signal_32.c b/arch/sparc/kernel/signal_32.c
index 5e5c5fd03783..04ede8f04add 100644
--- a/arch/sparc/kernel/signal_32.c
+++ b/arch/sparc/kernel/signal_32.c
@@ -26,6 +26,8 @@
 #include <asm/pgtable.h>
 #include <asm/cacheflush.h>     /* flush_sig_insns */
+#include "sigutil.h"
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
 extern void fpsave(unsigned long *fpregs, unsigned long *fsr,
@@ -39,8 +41,8 @@ struct signal_frame {
        unsigned long           insns[2] __attribute__ ((aligned (8)));
        unsigned int            extramask[_NSIG_WORDS - 1];
        unsigned int            extra_size; /* Should be 0 */
-        __siginfo_fpu_t         fpu_state;
+        __siginfo_rwin_t __user *rwin_save;
-};
+} __attribute__((aligned(8)));
 struct rt_signal_frame {
        struct sparc_stackf     ss;
@@ -51,8 +53,8 @@ struct rt_signal_frame {
        unsigned int            insns[2];
        stack_t                 stack;
        unsigned int            extra_size; /* Should be 0 */
-        __siginfo_fpu_t         fpu_state;
+        __siginfo_rwin_t __user *rwin_save;
-};
+} __attribute__((aligned(8)));
 /* Align macros */
 #define SF_ALIGNEDSZ  (((sizeof(struct signal_frame) + 7) & (~7)))
@@ -79,43 +81,13 @@ asmlinkage int sys_sigsuspend(old_sigset_t set)
        return _sigpause_common(set);
 }
-static inline int
-restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
-{
-        int err;
-#ifdef CONFIG_SMP
-        if (test_tsk_thread_flag(current, TIF_USEDFPU))
-                regs->psr &= ~PSR_EF;
-#else
-        if (current == last_task_used_math) {
-                last_task_used_math = NULL;
-                regs->psr &= ~PSR_EF;
-        }
-#endif
-        set_used_math();
-        clear_tsk_thread_flag(current, TIF_USEDFPU);
-        if (!access_ok(VERIFY_READ, fpu, sizeof(*fpu)))
-                return -EFAULT;
-        err = __copy_from_user(&current->thread.float_regs[0], &fpu->si_float_regs[0],
-                               (sizeof(unsigned long) * 32));
-        err |= __get_user(current->thread.fsr, &fpu->si_fsr);
-        err |= __get_user(current->thread.fpqdepth, &fpu->si_fpqdepth);
-        if (current->thread.fpqdepth != 0)
-                err |= __copy_from_user(&current->thread.fpqueue[0],
-                                        &fpu->si_fpqueue[0],
-                                        ((sizeof(unsigned long) +
-                                        (sizeof(unsigned long *)))*16));
-        return err;
-}
 asmlinkage void do_sigreturn(struct pt_regs *regs)
 {
        struct signal_frame __user *sf;
        unsigned long up_psr, pc, npc;
        sigset_t set;
        __siginfo_fpu_t __user *fpu_save;
+        __siginfo_rwin_t __user *rwin_save;
        int err;
        /* Always make any pending restarted system calls return -EINTR */
@@ -150,9 +122,11 @@ asmlinkage void do_sigreturn(struct pt_regs *regs)
        pt_regs_clear_syscall(regs);
        err |= __get_user(fpu_save, &sf->fpu_save);
        if (fpu_save)
                err |= restore_fpu_state(regs, fpu_save);
+        err |= __get_user(rwin_save, &sf->rwin_save);
+        if (rwin_save)
+                err |= restore_rwin_state(rwin_save);
        /* This is pretty much atomic, no amount locking would prevent
         * the races which exist anyways.
@@ -180,6 +154,7 @@ asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
        struct rt_signal_frame __user *sf;
        unsigned int psr, pc, npc;
        __siginfo_fpu_t __user *fpu_save;
+        __siginfo_rwin_t __user *rwin_save;
        mm_segment_t old_fs;
        sigset_t set;
        stack_t st;
@@ -207,8 +182,7 @@ asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
        pt_regs_clear_syscall(regs);
        err |= __get_user(fpu_save, &sf->fpu_save);
+        if (!err && fpu_save)
-        if (fpu_save)
                err |= restore_fpu_state(regs, fpu_save);
        err |= __copy_from_user(&set, &sf->mask, sizeof(sigset_t));
        
@@ -228,6 +202,12 @@ asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
        do_sigaltstack((const stack_t __user *) &st, NULL, (unsigned long)sf);
        set_fs(old_fs);
+        err |= __get_user(rwin_save, &sf->rwin_save);
+        if (!err && rwin_save) {
+                if (restore_rwin_state(rwin_save))
+                        goto segv;
+        }
        sigdelsetmask(&set, ~_BLOCKABLE);
        spin_lock_irq(&current->sighand->siglock);
        current->blocked = set;
@@ -280,53 +260,23 @@ static inline void __user *get_sigframe(struct sigaction *sa, struct pt_regs *re
        return (void __user *) sp;
 }
-static inline int
-save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
-{
-        int err = 0;
-#ifdef CONFIG_SMP
-        if (test_tsk_thread_flag(current, TIF_USEDFPU)) {
-                put_psr(get_psr() | PSR_EF);
-                fpsave(&current->thread.float_regs[0], &current->thread.fsr,
-                       &current->thread.fpqueue[0], &current->thread.fpqdepth);
-                regs->psr &= ~(PSR_EF);
-                clear_tsk_thread_flag(current, TIF_USEDFPU);
-        }
-#else
-        if (current == last_task_used_math) {
-                put_psr(get_psr() | PSR_EF);
-                fpsave(&current->thread.float_regs[0], &current->thread.fsr,
-                       &current->thread.fpqueue[0], &current->thread.fpqdepth);
-                last_task_used_math = NULL;
-                regs->psr &= ~(PSR_EF);
-        }
-#endif
-        err |= __copy_to_user(&fpu->si_float_regs[0],
-                              &current->thread.float_regs[0],
-                              (sizeof(unsigned long) * 32));
-        err |= __put_user(current->thread.fsr, &fpu->si_fsr);
-        err |= __put_user(current->thread.fpqdepth, &fpu->si_fpqdepth);
-        if (current->thread.fpqdepth != 0)
-                err |= __copy_to_user(&fpu->si_fpqueue[0],
-                                      &current->thread.fpqueue[0],
-                                      ((sizeof(unsigned long) +
-                                      (sizeof(unsigned long *)))*16));
-        clear_used_math();
-        return err;
-}
 static int setup_frame(struct k_sigaction *ka, struct pt_regs *regs,
                       int signo, sigset_t *oldset)
 {
        struct signal_frame __user *sf;
-        int sigframe_size, err;
+        int sigframe_size, err, wsaved;
+        void __user *tail;
        /* 1. Make sure everything is clean */
        synchronize_user_stack();
-        sigframe_size = SF_ALIGNEDSZ;
+        wsaved = current_thread_info()->w_saved;
-        if (!used_math())
-                sigframe_size -= sizeof(__siginfo_fpu_t);
+        sigframe_size = sizeof(*sf);
+        if (used_math())
+                sigframe_size += sizeof(__siginfo_fpu_t);
+        if (wsaved)
+                sigframe_size += sizeof(__siginfo_rwin_t);
        sf = (struct signal_frame __user *)
                get_sigframe(&ka->sa, regs, sigframe_size);
@@ -334,8 +284,7 @@ static int setup_frame(struct k_sigaction *ka, struct pt_regs *regs,
        if (invalid_frame_pointer(sf, sigframe_size))
                goto sigill_and_return;
-        if (current_thread_info()->w_saved != 0)
+        tail = sf + 1;
-                goto sigill_and_return;
        /* 2. Save the current process state */
        err = __copy_to_user(&sf->info.si_regs, regs, sizeof(struct pt_regs));
@@ -343,17 +292,34 @@ static int setup_frame(struct k_sigaction *ka, struct pt_regs *regs,
        err |= __put_user(0, &sf->extra_size);
        if (used_math()) {
-                err |= save_fpu_state(regs, &sf->fpu_state);
+                __siginfo_fpu_t __user *fp = tail;
-                err |= __put_user(&sf->fpu_state, &sf->fpu_save);
+                tail += sizeof(*fp);
+                err |= save_fpu_state(regs, fp);
+                err |= __put_user(fp, &sf->fpu_save);
        } else {
                err |= __put_user(0, &sf->fpu_save);
        }
+        if (wsaved) {
+                __siginfo_rwin_t __user *rwp = tail;
+                tail += sizeof(*rwp);
+                err |= save_rwin_state(wsaved, rwp);
+                err |= __put_user(rwp, &sf->rwin_save);
+        } else {
+                err |= __put_user(0, &sf->rwin_save);
+        }
        err |= __put_user(oldset->sig[0], &sf->info.si_mask);
        err |= __copy_to_user(sf->extramask, &oldset->sig[1],
                              (_NSIG_WORDS - 1) * sizeof(unsigned int));
-        err |= __copy_to_user(sf, (char *) regs->u_regs[UREG_FP],
+        if (!wsaved) {
-                              sizeof(struct reg_window32));
+                err |= __copy_to_user(sf, (char *) regs->u_regs[UREG_FP],
+                                      sizeof(struct reg_window32));
+        } else {
+                struct reg_window32 *rp;
+                rp = &current_thread_info()->reg_window[wsaved - 1];
+                err |= __copy_to_user(sf, rp, sizeof(struct reg_window32));
+        }
        if (err)
                goto sigsegv;
        
@@ -399,21 +365,24 @@ static int setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
                          int signo, sigset_t *oldset, siginfo_t *info)
 {
        struct rt_signal_frame __user *sf;
-        int sigframe_size;
+        int sigframe_size, wsaved;
+        void __user *tail;
        unsigned int psr;
        int err;
        synchronize_user_stack();
-        sigframe_size = RT_ALIGNEDSZ;
+        wsaved = current_thread_info()->w_saved;
-        if (!used_math())
+        sigframe_size = sizeof(*sf);
-                sigframe_size -= sizeof(__siginfo_fpu_t);
+        if (used_math())
+                sigframe_size += sizeof(__siginfo_fpu_t);
+        if (wsaved)
+                sigframe_size += sizeof(__siginfo_rwin_t);
        sf = (struct rt_signal_frame __user *)
                get_sigframe(&ka->sa, regs, sigframe_size);
        if (invalid_frame_pointer(sf, sigframe_size))
                goto sigill;
-        if (current_thread_info()->w_saved != 0)
-                goto sigill;
+        tail = sf + 1;
        err  = __put_user(regs->pc, &sf->regs.pc);
        err |= __put_user(regs->npc, &sf->regs.npc);
        err |= __put_user(regs->y, &sf->regs.y);
@@ -425,11 +394,21 @@ static int setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
        err |= __put_user(0, &sf->extra_size);
        if (psr & PSR_EF) {
-                err |= save_fpu_state(regs, &sf->fpu_state);
+                __siginfo_fpu_t *fp = tail;
-                err |= __put_user(&sf->fpu_state, &sf->fpu_save);
+                tail += sizeof(*fp);
+                err |= save_fpu_state(regs, fp);
+                err |= __put_user(fp, &sf->fpu_save);
        } else {
                err |= __put_user(0, &sf->fpu_save);
        }
+        if (wsaved) {
+                __siginfo_rwin_t *rwp = tail;
+                tail += sizeof(*rwp);
+                err |= save_rwin_state(wsaved, rwp);
+                err |= __put_user(rwp, &sf->rwin_save);
+        } else {
+                err |= __put_user(0, &sf->rwin_save);
+        }
        err |= __copy_to_user(&sf->mask, &oldset->sig[0], sizeof(sigset_t));
        
        /* Setup sigaltstack */
@@ -437,8 +416,15 @@ static int setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
        err |= __put_user(sas_ss_flags(regs->u_regs[UREG_FP]), &sf->stack.ss_flags);
        err |= __put_user(current->sas_ss_size, &sf->stack.ss_size);
        
-        err |= __copy_to_user(sf, (char *) regs->u_regs[UREG_FP],
+        if (!wsaved) {
-                              sizeof(struct reg_window32));
+                err |= __copy_to_user(sf, (char *) regs->u_regs[UREG_FP],
+                                      sizeof(struct reg_window32));
+        } else {
+                struct reg_window32 *rp;
+                rp = &current_thread_info()->reg_window[wsaved - 1];
+                err |= __copy_to_user(sf, rp, sizeof(struct reg_window32));
+        }
        err |= copy_siginfo_to_user(&sf->info, info);
diff --git a/arch/sparc/kernel/signal_64.c b/arch/sparc/kernel/signal_64.c
index 006fe4515886..47509df3b893 100644
--- a/arch/sparc/kernel/signal_64.c
+++ b/arch/sparc/kernel/signal_64.c
@@ -34,6 +34,7 @@
 #include "entry.h"
 #include "systbls.h"
+#include "sigutil.h"
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
@@ -236,7 +237,7 @@ struct rt_signal_frame {
        __siginfo_fpu_t __user  *fpu_save;
        stack_t                 stack;
        sigset_t                mask;
-        __siginfo_fpu_t         fpu_state;
+        __siginfo_rwin_t        *rwin_save;
 };
 static long _sigpause_common(old_sigset_t set)
@@ -266,33 +267,12 @@ asmlinkage long sys_sigsuspend(old_sigset_t set)
        return _sigpause_common(set);
 }
-static inline int
-restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
-{
-        unsigned long *fpregs = current_thread_info()->fpregs;
-        unsigned long fprs;
-        int err;
-        err = __get_user(fprs, &fpu->si_fprs);
-        fprs_write(0);
-        regs->tstate &= ~TSTATE_PEF;
-        if (fprs & FPRS_DL)
-                err |= copy_from_user(fpregs, &fpu->si_float_regs[0],
-                               (sizeof(unsigned int) * 32));
-        if (fprs & FPRS_DU)
-                err |= copy_from_user(fpregs+16, &fpu->si_float_regs[32],
-                               (sizeof(unsigned int) * 32));
-        err |= __get_user(current_thread_info()->xfsr[0], &fpu->si_fsr);
-        err |= __get_user(current_thread_info()->gsr[0], &fpu->si_gsr);
-        current_thread_info()->fpsaved[0] |= fprs;
-        return err;
-}
 void do_rt_sigreturn(struct pt_regs *regs)
 {
        struct rt_signal_frame __user *sf;
        unsigned long tpc, tnpc, tstate;
        __siginfo_fpu_t __user *fpu_save;
+        __siginfo_rwin_t __user *rwin_save;
        sigset_t set;
        int err;
@@ -325,8 +305,8 @@ void do_rt_sigreturn(struct pt_regs *regs)
        regs->tstate |= (tstate & (TSTATE_ASI | TSTATE_ICC | TSTATE_XCC));
        err |= __get_user(fpu_save, &sf->fpu_save);
-        if (fpu_save)
+        if (!err && fpu_save)
-                err |= restore_fpu_state(regs, &sf->fpu_state);
+                err |= restore_fpu_state(regs, fpu_save);
        err |= __copy_from_user(&set, &sf->mask, sizeof(sigset_t));
        err |= do_sigaltstack(&sf->stack, NULL, (unsigned long)sf);
@@ -334,6 +314,12 @@ void do_rt_sigreturn(struct pt_regs *regs)
        if (err)
                goto segv;
+        err |= __get_user(rwin_save, &sf->rwin_save);
+        if (!err && rwin_save) {
+                if (restore_rwin_state(rwin_save))
+                        goto segv;
+        }
        regs->tpc = tpc;
        regs->tnpc = tnpc;
@@ -351,34 +337,13 @@ segv:
 }
 /* Checks if the fp is valid */
-static int invalid_frame_pointer(void __user *fp, int fplen)
+static int invalid_frame_pointer(void __user *fp)
 {
        if (((unsigned long) fp) & 15)
                return 1;
        return 0;
 }
-static inline int
-save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
-{
-        unsigned long *fpregs = current_thread_info()->fpregs;
-        unsigned long fprs;
-        int err = 0;
-        
-        fprs = current_thread_info()->fpsaved[0];
-        if (fprs & FPRS_DL)
-                err |= copy_to_user(&fpu->si_float_regs[0], fpregs,
-                                    (sizeof(unsigned int) * 32));
-        if (fprs & FPRS_DU)
-                err |= copy_to_user(&fpu->si_float_regs[32], fpregs+16,
-                                    (sizeof(unsigned int) * 32));
-        err |= __put_user(current_thread_info()->xfsr[0], &fpu->si_fsr);
-        err |= __put_user(current_thread_info()->gsr[0], &fpu->si_gsr);
-        err |= __put_user(fprs, &fpu->si_fprs);
-        return err;
-}
 static inline void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, unsigned long framesize)
 {
        unsigned long sp = regs->u_regs[UREG_FP] + STACK_BIAS;
@@ -414,34 +379,48 @@ setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
               int signo, sigset_t *oldset, siginfo_t *info)
 {
        struct rt_signal_frame __user *sf;
-        int sigframe_size, err;
+        int wsaved, err, sf_size;
+        void __user *tail;
        /* 1. Make sure everything is clean */
        synchronize_user_stack();
        save_and_clear_fpu();
        
-        sigframe_size = sizeof(struct rt_signal_frame);
+        wsaved = get_thread_wsaved();
-        if (!(current_thread_info()->fpsaved[0] & FPRS_FEF))
-                sigframe_size -= sizeof(__siginfo_fpu_t);
+        sf_size = sizeof(struct rt_signal_frame);
+        if (current_thread_info()->fpsaved[0] & FPRS_FEF)
+                sf_size += sizeof(__siginfo_fpu_t);
+        if (wsaved)
+                sf_size += sizeof(__siginfo_rwin_t);
        sf = (struct rt_signal_frame __user *)
-                get_sigframe(ka, regs, sigframe_size);
+                get_sigframe(ka, regs, sf_size);
-        
-        if (invalid_frame_pointer (sf, sigframe_size))
-                goto sigill;
-        if (get_thread_wsaved() != 0)
+        if (invalid_frame_pointer (sf))
                goto sigill;
+        tail = (sf + 1);
        /* 2. Save the current process state */
        err = copy_to_user(&sf->regs, regs, sizeof (*regs));
        if (current_thread_info()->fpsaved[0] & FPRS_FEF) {
-                err |= save_fpu_state(regs, &sf->fpu_state);
+                __siginfo_fpu_t __user *fpu_save = tail;
-                err |= __put_user((u64)&sf->fpu_state, &sf->fpu_save);
+                tail += sizeof(__siginfo_fpu_t);
+                err |= save_fpu_state(regs, fpu_save);
+                err |= __put_user((u64)fpu_save, &sf->fpu_save);
        } else {
                err |= __put_user(0, &sf->fpu_save);
        }
+        if (wsaved) {
+                __siginfo_rwin_t __user *rwin_save = tail;
+                tail += sizeof(__siginfo_rwin_t);
+                err |= save_rwin_state(wsaved, rwin_save);
+                err |= __put_user((u64)rwin_save, &sf->rwin_save);
+                set_thread_wsaved(0);
+        } else {
+                err |= __put_user(0, &sf->rwin_save);
+        }
        
        /* Setup sigaltstack */
        err |= __put_user(current->sas_ss_sp, &sf->stack.ss_sp);
@@ -450,10 +429,17 @@ setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
        err |= copy_to_user(&sf->mask, oldset, sizeof(sigset_t));
-        err |= copy_in_user((u64 __user *)sf,
+        if (!wsaved) {
-                            (u64 __user *)(regs->u_regs[UREG_FP]+STACK_BIAS),
+                err |= copy_in_user((u64 __user *)sf,
-                            sizeof(struct reg_window));
+                                    (u64 __user *)(regs->u_regs[UREG_FP] +
+                                                   STACK_BIAS),
+                                    sizeof(struct reg_window));
+        } else {
+                struct reg_window *rp;
+                rp = &current_thread_info()->reg_window[wsaved - 1];
+                err |= copy_to_user(sf, rp, sizeof(struct reg_window));
+        }
        if (info)
                err |= copy_siginfo_to_user(&sf->info, info);
        else {
diff --git a/arch/sparc/kernel/sigutil.h b/arch/sparc/kernel/sigutil.h
new file mode 100644
index 000000000000..d223aa432bb6
--- /dev/null
+++ b/arch/sparc/kernel/sigutil.h
@@ -0,0 +1,9 @@
+#ifndef _SIGUTIL_H
+#define _SIGUTIL_H
+int save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu);
+int restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu);
+int save_rwin_state(int wsaved, __siginfo_rwin_t __user *rwin);
+int restore_rwin_state(__siginfo_rwin_t __user *rp);
+#endif /* _SIGUTIL_H */
diff --git a/arch/sparc/kernel/sigutil_32.c b/arch/sparc/kernel/sigutil_32.c
new file mode 100644
index 000000000000..35c7897b009a
--- /dev/null
+++ b/arch/sparc/kernel/sigutil_32.c
@@ -0,0 +1,120 @@
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/thread_info.h>
+#include <linux/uaccess.h>
+#include <linux/sched.h>
+#include <asm/sigcontext.h>
+#include <asm/fpumacro.h>
+#include <asm/ptrace.h>
+#include "sigutil.h"
+int save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+{
+        int err = 0;
+#ifdef CONFIG_SMP
+        if (test_tsk_thread_flag(current, TIF_USEDFPU)) {
+                put_psr(get_psr() | PSR_EF);
+                fpsave(&current->thread.float_regs[0], &current->thread.fsr,
+                       &current->thread.fpqueue[0], &current->thread.fpqdepth);
+                regs->psr &= ~(PSR_EF);
+                clear_tsk_thread_flag(current, TIF_USEDFPU);
+        }
+#else
+        if (current == last_task_used_math) {
+                put_psr(get_psr() | PSR_EF);
+                fpsave(&current->thread.float_regs[0], &current->thread.fsr,
+                       &current->thread.fpqueue[0], &current->thread.fpqdepth);
+                last_task_used_math = NULL;
+                regs->psr &= ~(PSR_EF);
+        }
+#endif
+        err |= __copy_to_user(&fpu->si_float_regs[0],
+                              &current->thread.float_regs[0],
+                              (sizeof(unsigned long) * 32));
+        err |= __put_user(current->thread.fsr, &fpu->si_fsr);
+        err |= __put_user(current->thread.fpqdepth, &fpu->si_fpqdepth);
+        if (current->thread.fpqdepth != 0)
+                err |= __copy_to_user(&fpu->si_fpqueue[0],
+                                      &current->thread.fpqueue[0],
+                                      ((sizeof(unsigned long) +
+                                      (sizeof(unsigned long *)))*16));
+        clear_used_math();
+        return err;
+}
+int restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+{
+        int err;
+#ifdef CONFIG_SMP
+        if (test_tsk_thread_flag(current, TIF_USEDFPU))
+                regs->psr &= ~PSR_EF;
+#else
+        if (current == last_task_used_math) {
+                last_task_used_math = NULL;
+                regs->psr &= ~PSR_EF;
+        }
+#endif
+        set_used_math();
+        clear_tsk_thread_flag(current, TIF_USEDFPU);
+        if (!access_ok(VERIFY_READ, fpu, sizeof(*fpu)))
+                return -EFAULT;
+        err = __copy_from_user(&current->thread.float_regs[0], &fpu->si_float_regs[0],
+                               (sizeof(unsigned long) * 32));
+        err |= __get_user(current->thread.fsr, &fpu->si_fsr);
+        err |= __get_user(current->thread.fpqdepth, &fpu->si_fpqdepth);
+        if (current->thread.fpqdepth != 0)
+                err |= __copy_from_user(&current->thread.fpqueue[0],
+                                        &fpu->si_fpqueue[0],
+                                        ((sizeof(unsigned long) +
+                                        (sizeof(unsigned long *)))*16));
+        return err;
+}
+int save_rwin_state(int wsaved, __siginfo_rwin_t __user *rwin)
+{
+        int i, err = __put_user(wsaved, &rwin->wsaved);
+        for (i = 0; i < wsaved; i++) {
+                struct reg_window32 *rp;
+                unsigned long fp;
+                rp = &current_thread_info()->reg_window[i];
+                fp = current_thread_info()->rwbuf_stkptrs[i];
+                err |= copy_to_user(&rwin->reg_window[i], rp,
+                                    sizeof(struct reg_window32));
+                err |= __put_user(fp, &rwin->rwbuf_stkptrs[i]);
+        }
+        return err;
+}
+int restore_rwin_state(__siginfo_rwin_t __user *rp)
+{
+        struct thread_info *t = current_thread_info();
+        int i, wsaved, err;
+        __get_user(wsaved, &rp->wsaved);
+        if (wsaved > NSWINS)
+                return -EFAULT;
+        err = 0;
+        for (i = 0; i < wsaved; i++) {
+                err |= copy_from_user(&t->reg_window[i],
+                                      &rp->reg_window[i],
+                                      sizeof(struct reg_window32));
+                err |= __get_user(t->rwbuf_stkptrs[i],
+                                  &rp->rwbuf_stkptrs[i]);
+        }
+        if (err)
+                return err;
+        t->w_saved = wsaved;
+        synchronize_user_stack();
+        if (t->w_saved)
+                return -EFAULT;
+        return 0;
+}
diff --git a/arch/sparc/kernel/sigutil_64.c b/arch/sparc/kernel/sigutil_64.c
new file mode 100644
index 000000000000..e7dc508c38eb
--- /dev/null
+++ b/arch/sparc/kernel/sigutil_64.c
@@ -0,0 +1,93 @@
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/thread_info.h>
+#include <linux/uaccess.h>
+#include <asm/sigcontext.h>
+#include <asm/fpumacro.h>
+#include <asm/ptrace.h>
+#include "sigutil.h"
+int save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+{
+        unsigned long *fpregs = current_thread_info()->fpregs;
+        unsigned long fprs;
+        int err = 0;
+        
+        fprs = current_thread_info()->fpsaved[0];
+        if (fprs & FPRS_DL)
+                err |= copy_to_user(&fpu->si_float_regs[0], fpregs,
+                                    (sizeof(unsigned int) * 32));
+        if (fprs & FPRS_DU)
+                err |= copy_to_user(&fpu->si_float_regs[32], fpregs+16,
+                                    (sizeof(unsigned int) * 32));
+        err |= __put_user(current_thread_info()->xfsr[0], &fpu->si_fsr);
+        err |= __put_user(current_thread_info()->gsr[0], &fpu->si_gsr);
+        err |= __put_user(fprs, &fpu->si_fprs);
+        return err;
+}
+int restore_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
+{
+        unsigned long *fpregs = current_thread_info()->fpregs;
+        unsigned long fprs;
+        int err;
+        err = __get_user(fprs, &fpu->si_fprs);
+        fprs_write(0);
+        regs->tstate &= ~TSTATE_PEF;
+        if (fprs & FPRS_DL)
+                err |= copy_from_user(fpregs, &fpu->si_float_regs[0],
+                               (sizeof(unsigned int) * 32));
+        if (fprs & FPRS_DU)
+                err |= copy_from_user(fpregs+16, &fpu->si_float_regs[32],
+                               (sizeof(unsigned int) * 32));
+        err |= __get_user(current_thread_info()->xfsr[0], &fpu->si_fsr);
+        err |= __get_user(current_thread_info()->gsr[0], &fpu->si_gsr);
+        current_thread_info()->fpsaved[0] |= fprs;
+        return err;
+}
+int save_rwin_state(int wsaved, __siginfo_rwin_t __user *rwin)
+{
+        int i, err = __put_user(wsaved, &rwin->wsaved);
+        for (i = 0; i < wsaved; i++) {
+                struct reg_window *rp = &current_thread_info()->reg_window[i];
+                unsigned long fp = current_thread_info()->rwbuf_stkptrs[i];
+                err |= copy_to_user(&rwin->reg_window[i], rp,
+                                    sizeof(struct reg_window));
+                err |= __put_user(fp, &rwin->rwbuf_stkptrs[i]);
+        }
+        return err;
+}
+int restore_rwin_state(__siginfo_rwin_t __user *rp)
+{
+        struct thread_info *t = current_thread_info();
+        int i, wsaved, err;
+        __get_user(wsaved, &rp->wsaved);
+        if (wsaved > NSWINS)
+                return -EFAULT;
+        err = 0;
+        for (i = 0; i < wsaved; i++) {
+                err |= copy_from_user(&t->reg_window[i],
+                                      &rp->reg_window[i],
+                                      sizeof(struct reg_window));
+                err |= __get_user(t->rwbuf_stkptrs[i],
+                                  &rp->rwbuf_stkptrs[i]);
+        }
+        if (err)
+                return err;
+        set_thread_wsaved(wsaved);
+        synchronize_user_stack();
+        if (get_thread_wsaved())
+                return -EFAULT;
+        return 0;
+}
diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
index 64a619d47d34..7ff4669580cf 100644
--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -39,7 +39,7 @@ typedef struct xpaddr {
    ((unsigned long)((u64)CONFIG_XEN_MAX_DOMAIN_MEMORY * 1024 * 1024 * 1024 / PAGE_SIZE))
 extern unsigned long *machine_to_phys_mapping;
-extern unsigned int   machine_to_phys_order;
+extern unsigned long  machine_to_phys_nr;
 extern unsigned long get_phys_to_machine(unsigned long pfn);
 extern bool set_phys_to_machine(unsigned long pfn, unsigned long mfn);
@@ -87,7 +87,7 @@ static inline unsigned long mfn_to_pfn(unsigned long mfn)
        if (xen_feature(XENFEAT_auto_translated_physmap))
                return mfn;
-        if (unlikely((mfn >> machine_to_phys_order) != 0)) {
+        if (unlikely(mfn >= machine_to_phys_nr)) {
                pfn = ~0;
                goto try_override;
        }
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index adc66c3a1fef..34b18594e724 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -207,7 +207,6 @@ static int __cpuinit uv_wakeup_secondary(int phys_apicid, unsigned long start_ri
            ((start_rip << UVH_IPI_INT_VECTOR_SHFT) >> 12) |
            APIC_DM_INIT;
        uv_write_global_mmr64(pnode, UVH_IPI_INT, val);
-        mdelay(10);
        val = (1UL << UVH_IPI_INT_SEND_SHFT) |
            (phys_apicid << UVH_IPI_INT_APIC_ID_SHFT) |
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index 08119a37e53c..6b96110bb0c3 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -149,7 +149,6 @@ struct set_mtrr_data {
 */
 static int mtrr_rendezvous_handler(void *info)
 {
-#ifdef CONFIG_SMP
        struct set_mtrr_data *data = info;
        /*
@@ -171,7 +170,6 @@ static int mtrr_rendezvous_handler(void *info)
        } else if (mtrr_aps_delayed_init || !cpu_online(smp_processor_id())) {
                mtrr_if->set_all();
        }
-#endif
        return 0;
 }
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 5c1a91974918..f3f6f5344001 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -54,6 +54,7 @@
 #include <asm/ftrace.h>
 #include <asm/irq_vectors.h>
 #include <asm/cpufeature.h>
+#include <asm/alternative-asm.h>
 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
 #include <linux/elf-em.h>
@@ -873,12 +874,7 @@ ENTRY(simd_coprocessor_error)
 661:    pushl_cfi $do_general_protection
 662:
 .section .altinstructions,"a"
-        .balign 4
+        altinstruction_entry 661b, 663f, X86_FEATURE_XMM, 662b-661b, 664f-663f
-        .long 661b
-        .long 663f
-        .word X86_FEATURE_XMM
-        .byte 662b-661b
-        .byte 664f-663f
 .previous
 .section .altinstr_replacement,"ax"
 663:    pushl $do_simd_coprocessor_error
diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig
index 988724b236b6..ff5790d8e990 100644
--- a/arch/x86/kvm/Kconfig
+++ b/arch/x86/kvm/Kconfig
@@ -22,6 +22,8 @@ config KVM
        depends on HAVE_KVM
        # for device assignment:
        depends on PCI
+        # for TASKSTATS/TASK_DELAY_ACCT:
+        depends on NET
        select PREEMPT_NOTIFIERS
        select MMU_NOTIFIER
        select ANON_INODES
@@ -31,6 +33,7 @@ config KVM
        select KVM_ASYNC_PF
        select USER_RETURN_NOTIFIER
        select KVM_MMIO
+        select TASKSTATS
        select TASK_DELAY_ACCT
        ---help---
          Support hosting fully virtualized guest machines using hardware
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 247aae3dc008..0d17c8c50acd 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -17,6 +17,7 @@
 #include <asm/traps.h>                  /* dotraplinkage, ...           */
 #include <asm/pgalloc.h>                /* pgd_*(), ...                 */
 #include <asm/kmemcheck.h>              /* kmemcheck_*(), ...           */
+#include <asm/vsyscall.h>
 /*
 * Page fault error code bits:
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index ae3cb23cd89b..c95330267f08 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -360,6 +360,15 @@ struct pci_bus * __devinit pci_acpi_scan_root(struct acpi_pci_root *root)
                }
        }
+        /* After the PCI-E bus has been walked and all devices discovered,
+         * configure any settings of the fabric that might be necessary.
+         */
+        if (bus) {
+                struct pci_bus *child;
+                list_for_each_entry(child, &bus->children, node)
+                        pcie_bus_configure_settings(child, child->self->pcie_mpss);
+        }
        if (!bus)
                kfree(sd);
diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
index 7000e74b3087..58425adc22c6 100644
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -689,7 +689,9 @@ static int __init sfi_parse_devs(struct sfi_table_header *table)
                        irq_attr.trigger = 1;
                        irq_attr.polarity = 1;
                        io_apic_set_pci_routing(NULL, pentry->irq, &irq_attr);
-                }
+                } else
+                        pentry->irq = 0; /* No irq */
                switch (pentry->type) {
                case SFI_DEV_TYPE_IPC:
                        /* ID as IRQ is a hack that will go away */
diff --git a/arch/x86/platform/olpc/olpc.c b/arch/x86/platform/olpc/olpc.c
index 8b9940e78e2f..7cce722667b8 100644
--- a/arch/x86/platform/olpc/olpc.c
+++ b/arch/x86/platform/olpc/olpc.c
@@ -161,13 +161,13 @@ restart:
        if (inbuf && inlen) {
                /* write data to EC */
                for (i = 0; i < inlen; i++) {
+                        pr_devel("olpc-ec:  sending cmd arg 0x%x\n", inbuf[i]);
+                        outb(inbuf[i], 0x68);
                        if (wait_on_ibf(0x6c, 0)) {
                                printk(KERN_ERR "olpc-ec:  timeout waiting for"
                                                " EC accept data!\n");
                                goto err;
                        }
-                        pr_devel("olpc-ec:  sending cmd arg 0x%x\n", inbuf[i]);
-                        outb(inbuf[i], 0x68);
                }
        }
        if (outbuf && outlen) {
diff --git a/arch/x86/vdso/vdso32/sysenter.S b/arch/x86/vdso/vdso32/sysenter.S
index e2800affa754..e354bceee0e0 100644
--- a/arch/x86/vdso/vdso32/sysenter.S
+++ b/arch/x86/vdso/vdso32/sysenter.S
@@ -43,7 +43,7 @@ __kernel_vsyscall:
        .space 7,0x90
        /* 14: System call restart point is here! (SYSENTER_RETURN-2) */
-        jmp .Lenter_kernel
+        int $0x80
        /* 16: System call normal return point is here! */
 VDSO32_SYSENTER_RETURN: /* Symbol used by sysenter.c via vdso32-syms.h */
        pop %ebp
diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile
index 3326204e251f..add2c2d729ce 100644
--- a/arch/x86/xen/Makefile
+++ b/arch/x86/xen/Makefile
@@ -15,7 +15,7 @@ obj-y		:= enlighten.o setup.o multicalls.o mmu.o irq.o \
                        grant-table.o suspend.o platform-pci-unplug.o \
                        p2m.o
-obj-$(CONFIG_FTRACE) += trace.o
+obj-$(CONFIG_EVENT_TRACING) += trace.o
 obj-$(CONFIG_SMP)               += smp.o
 obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= spinlock.o
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index e2345af01af0..2d69617950f7 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -77,8 +77,8 @@ EXPORT_SYMBOL_GPL(xen_domain_type);
 unsigned long *machine_to_phys_mapping = (void *)MACH2PHYS_VIRT_START;
 EXPORT_SYMBOL(machine_to_phys_mapping);
-unsigned int   machine_to_phys_order;
+unsigned long  machine_to_phys_nr;
-EXPORT_SYMBOL(machine_to_phys_order);
+EXPORT_SYMBOL(machine_to_phys_nr);
 struct start_info *xen_start_info;
 EXPORT_SYMBOL_GPL(xen_start_info);
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 8cce339db5e7..20a614275064 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1713,15 +1713,19 @@ static void __init xen_map_identity_early(pmd_t *pmd, unsigned long max_pfn)
 void __init xen_setup_machphys_mapping(void)
 {
        struct xen_machphys_mapping mapping;
-        unsigned long machine_to_phys_nr_ents;
        if (HYPERVISOR_memory_op(XENMEM_machphys_mapping, &mapping) == 0) {
                machine_to_phys_mapping = (unsigned long *)mapping.v_start;
-                machine_to_phys_nr_ents = mapping.max_mfn + 1;
+                machine_to_phys_nr = mapping.max_mfn + 1;
        } else {
-                machine_to_phys_nr_ents = MACH2PHYS_NR_ENTRIES;
+                machine_to_phys_nr = MACH2PHYS_NR_ENTRIES;
        }
-        machine_to_phys_order = fls(machine_to_phys_nr_ents - 1);
+#ifdef CONFIG_X86_32
+        if ((machine_to_phys_mapping + machine_to_phys_nr)
+            < machine_to_phys_mapping)
+                machine_to_phys_nr = (unsigned long *)NULL
+                                     - machine_to_phys_mapping;
+#endif
 }
 #ifdef CONFIG_X86_64
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index b4533a86d7e4..e79dbb95482b 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -521,8 +521,6 @@ static void __init xen_hvm_smp_prepare_cpus(unsigned int max_cpus)
        native_smp_prepare_cpus(max_cpus);
        WARN_ON(xen_smp_intr_init(0));
-        if (!xen_have_vector_callback)
-                return;
        xen_init_lock_cpu(0);
        xen_init_spinlocks();
 }
@@ -546,6 +544,8 @@ static void xen_hvm_cpu_die(unsigned int cpu)
 void __init xen_hvm_smp_init(void)
 {
+        if (!xen_have_vector_callback)
+                return;
        smp_ops.smp_prepare_cpus = xen_hvm_smp_prepare_cpus;
        smp_ops.smp_send_reschedule = xen_smp_send_reschedule;
        smp_ops.cpu_up = xen_hvm_cpu_up;
diff --git a/block/Kconfig b/block/Kconfig
index 60be1e0455da..e97934eececa 100644
--- a/block/Kconfig
+++ b/block/Kconfig
@@ -65,6 +65,16 @@ config BLK_DEV_BSG
          If unsure, say Y.
+config BLK_DEV_BSGLIB
+        bool "Block layer SG support v4 helper lib"
+        default n
+        select BLK_DEV_BSG
+        help
+          Subsystems will normally enable this if needed. Users will not
+          normally need to manually enable this.
+          If unsure, say N.
 config BLK_DEV_INTEGRITY
        bool "Block layer data integrity support"
        ---help---
diff --git a/block/Makefile b/block/Makefile
index 0fec4b3fab51..514c6e4f427a 100644
--- a/block/Makefile
+++ b/block/Makefile
@@ -8,6 +8,7 @@ obj-$(CONFIG_BLOCK) := elevator.o blk-core.o blk-tag.o blk-sysfs.o \
                        blk-iopoll.o blk-lib.o ioctl.o genhd.o scsi_ioctl.o
 obj-$(CONFIG_BLK_DEV_BSG)       += bsg.o
+obj-$(CONFIG_BLK_DEV_BSGLIB)    += bsg-lib.o
 obj-$(CONFIG_BLK_CGROUP)        += blk-cgroup.o
 obj-$(CONFIG_BLK_DEV_THROTTLING)        += blk-throttle.o
 obj-$(CONFIG_IOSCHED_NOOP)      += noop-iosched.o
diff --git a/block/blk-core.c b/block/blk-core.c
index b627558c461f..90e1ffdeb415 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1702,6 +1702,7 @@ EXPORT_SYMBOL_GPL(blk_rq_check_limits);
 int blk_insert_cloned_request(struct request_queue *q, struct request *rq)
 {
        unsigned long flags;
+        int where = ELEVATOR_INSERT_BACK;
        if (blk_rq_check_limits(q, rq))
                return -EIO;
@@ -1718,7 +1719,10 @@ int blk_insert_cloned_request(struct request_queue *q, struct request *rq)
         */
        BUG_ON(blk_queued_rq(rq));
-        add_acct_request(q, rq, ELEVATOR_INSERT_BACK);
+        if (rq->cmd_flags & (REQ_FLUSH|REQ_FUA))
+                where = ELEVATOR_INSERT_FLUSH;
+        add_acct_request(q, rq, where);
        spin_unlock_irqrestore(q->queue_lock, flags);
        return 0;
@@ -2275,7 +2279,7 @@ static bool blk_end_bidi_request(struct request *rq, int error,
 *     %false - we are done with this request
 *     %true  - still buffers pending for this request
 **/
-static bool __blk_end_bidi_request(struct request *rq, int error,
+bool __blk_end_bidi_request(struct request *rq, int error,
                                   unsigned int nr_bytes, unsigned int bidi_bytes)
 {
        if (blk_update_bidi_request(rq, error, nr_bytes, bidi_bytes))
diff --git a/block/blk-flush.c b/block/blk-flush.c
index bb21e4c36f70..491eb30a242d 100644
--- a/block/blk-flush.c
+++ b/block/blk-flush.c
@@ -95,11 +95,12 @@ static unsigned int blk_flush_policy(unsigned int fflags, struct request *rq)
 {
        unsigned int policy = 0;
+        if (blk_rq_sectors(rq))
+                policy |= REQ_FSEQ_DATA;
        if (fflags & REQ_FLUSH) {
                if (rq->cmd_flags & REQ_FLUSH)
                        policy |= REQ_FSEQ_PREFLUSH;
-                if (blk_rq_sectors(rq))
-                        policy |= REQ_FSEQ_DATA;
                if (!(fflags & REQ_FUA) && (rq->cmd_flags & REQ_FUA))
                        policy |= REQ_FSEQ_POSTFLUSH;
        }
@@ -122,7 +123,7 @@ static void blk_flush_restore_request(struct request *rq)
        /* make @rq a normal request */
        rq->cmd_flags &= ~REQ_FLUSH_SEQ;
-        rq->end_io = NULL;
+        rq->end_io = rq->flush.saved_end_io;
 }
 /**
@@ -300,9 +301,6 @@ void blk_insert_flush(struct request *rq)
        unsigned int fflags = q->flush_flags;   /* may change, cache */
        unsigned int policy = blk_flush_policy(fflags, rq);
-        BUG_ON(rq->end_io);
-        BUG_ON(!rq->bio || rq->bio != rq->biotail);
        /*
         * @policy now records what operations need to be done.  Adjust
         * REQ_FLUSH and FUA for the driver.
@@ -312,6 +310,19 @@ void blk_insert_flush(struct request *rq)
                rq->cmd_flags &= ~REQ_FUA;
        /*
+         * An empty flush handed down from a stacking driver may
+         * translate into nothing if the underlying device does not
+         * advertise a write-back cache.  In this case, simply
+         * complete the request.
+         */
+        if (!policy) {
+                __blk_end_bidi_request(rq, 0, 0, 0);
+                return;
+        }
+        BUG_ON(!rq->bio || rq->bio != rq->biotail);
+        /*
         * If there's data but flush is not necessary, the request can be
         * processed directly without going through flush machinery.  Queue
         * for normal execution.
@@ -319,6 +330,7 @@ void blk_insert_flush(struct request *rq)
        if ((policy & REQ_FSEQ_DATA) &&
            !(policy & (REQ_FSEQ_PREFLUSH | REQ_FSEQ_POSTFLUSH))) {
                list_add_tail(&rq->queuelist, &q->queue_head);
+                blk_run_queue_async(q);
                return;
        }
@@ -329,6 +341,7 @@ void blk_insert_flush(struct request *rq)
        memset(&rq->flush, 0, sizeof(rq->flush));
        INIT_LIST_HEAD(&rq->flush.list);
        rq->cmd_flags |= REQ_FLUSH_SEQ;
+        rq->flush.saved_end_io = rq->end_io; /* Usually NULL */
        rq->end_io = flush_data_end_io;
        blk_flush_complete_seq(rq, REQ_FSEQ_ACTIONS & ~policy, 0);
diff --git a/block/blk-softirq.c b/block/blk-softirq.c
index 475fab809a80..58340d0cb23a 100644
--- a/block/blk-softirq.c
+++ b/block/blk-softirq.c
@@ -124,6 +124,14 @@ void __blk_complete_request(struct request *req)
        } else
                ccpu = cpu;
+        /*
+         * If current CPU and requested CPU are in the same group, running
+         * softirq in current CPU. One might concern this is just like
+         * QUEUE_FLAG_SAME_FORCE, but actually not. blk_complete_request() is
+         * running in interrupt handler, and currently I/O controller doesn't
+         * support multiple interrupts, so current CPU is unique actually. This
+         * avoids IPI sending from current CPU to the first CPU of a group.
+         */
        if (ccpu == cpu || ccpu == group_cpu) {
                struct list_head *list;
 do_local:
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index f6a794120505..a19f58c6fc3a 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -746,7 +746,7 @@ static bool tg_may_dispatch(struct throtl_data *td, struct throtl_grp *tg,
 static void throtl_charge_bio(struct throtl_grp *tg, struct bio *bio)
 {
        bool rw = bio_data_dir(bio);
-        bool sync = bio->bi_rw & REQ_SYNC;
+        bool sync = rw_is_sync(bio->bi_rw);
        /* Charge the bio to the group */
        tg->bytes_disp[rw] += bio->bi_size;
@@ -1150,7 +1150,7 @@ int blk_throtl_bio(struct request_queue *q, struct bio **biop)
                if (tg_no_rule_group(tg, rw)) {
                        blkiocg_update_dispatch_stats(&tg->blkg, bio->bi_size,
-                                        rw, bio->bi_rw & REQ_SYNC);
+                                        rw, rw_is_sync(bio->bi_rw));
                        rcu_read_unlock();
                        return 0;
                }
diff --git a/block/blk.h b/block/blk.h
index d6586287adc9..20b900a377c9 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -17,6 +17,8 @@ int blk_rq_append_bio(struct request_queue *q, struct request *rq,
                      struct bio *bio);
 void blk_dequeue_request(struct request *rq);
 void __blk_queue_free_tags(struct request_queue *q);
+bool __blk_end_bidi_request(struct request *rq, int error,
+                            unsigned int nr_bytes, unsigned int bidi_bytes);
 void blk_rq_timed_out_timer(unsigned long data);
 void blk_delete_timer(struct request *);
diff --git a/block/bsg-lib.c b/block/bsg-lib.c
new file mode 100644
index 000000000000..6690e6e41037
--- /dev/null
+++ b/block/bsg-lib.c
@@ -0,0 +1,298 @@
+/*
+ *  BSG helper library
+ *
+ *  Copyright (C) 2008   James Smart, Emulex Corporation
+ *  Copyright (C) 2011   Red Hat, Inc.  All rights reserved.
+ *  Copyright (C) 2011   Mike Christie
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+#include <linux/slab.h>
+#include <linux/blkdev.h>
+#include <linux/delay.h>
+#include <linux/scatterlist.h>
+#include <linux/bsg-lib.h>
+#include <linux/module.h>
+#include <scsi/scsi_cmnd.h>
+/**
+ * bsg_destroy_job - routine to teardown/delete a bsg job
+ * @job: bsg_job that is to be torn down
+ */
+static void bsg_destroy_job(struct bsg_job *job)
+{
+        put_device(job->dev);   /* release reference for the request */
+        kfree(job->request_payload.sg_list);
+        kfree(job->reply_payload.sg_list);
+        kfree(job);
+}
+/**
+ * bsg_job_done - completion routine for bsg requests
+ * @job: bsg_job that is complete
+ * @result: job reply result
+ * @reply_payload_rcv_len: length of payload recvd
+ *
+ * The LLD should call this when the bsg job has completed.
+ */
+void bsg_job_done(struct bsg_job *job, int result,
+                  unsigned int reply_payload_rcv_len)
+{
+        struct request *req = job->req;
+        struct request *rsp = req->next_rq;
+        int err;
+        err = job->req->errors = result;
+        if (err < 0)
+                /* we're only returning the result field in the reply */
+                job->req->sense_len = sizeof(u32);
+        else
+                job->req->sense_len = job->reply_len;
+        /* we assume all request payload was transferred, residual == 0 */
+        req->resid_len = 0;
+        if (rsp) {
+                WARN_ON(reply_payload_rcv_len > rsp->resid_len);
+                /* set reply (bidi) residual */
+                rsp->resid_len -= min(reply_payload_rcv_len, rsp->resid_len);
+        }
+        blk_complete_request(req);
+}
+EXPORT_SYMBOL_GPL(bsg_job_done);
+/**
+ * bsg_softirq_done - softirq done routine for destroying the bsg requests
+ * @rq: BSG request that holds the job to be destroyed
+ */
+static void bsg_softirq_done(struct request *rq)
+{
+        struct bsg_job *job = rq->special;
+        blk_end_request_all(rq, rq->errors);
+        bsg_destroy_job(job);
+}
+static int bsg_map_buffer(struct bsg_buffer *buf, struct request *req)
+{
+        size_t sz = (sizeof(struct scatterlist) * req->nr_phys_segments);
+        BUG_ON(!req->nr_phys_segments);
+        buf->sg_list = kzalloc(sz, GFP_KERNEL);
+        if (!buf->sg_list)
+                return -ENOMEM;
+        sg_init_table(buf->sg_list, req->nr_phys_segments);
+        buf->sg_cnt = blk_rq_map_sg(req->q, req, buf->sg_list);
+        buf->payload_len = blk_rq_bytes(req);
+        return 0;
+}
+/**
+ * bsg_create_job - create the bsg_job structure for the bsg request
+ * @dev: device that is being sent the bsg request
+ * @req: BSG request that needs a job structure
+ */
+static int bsg_create_job(struct device *dev, struct request *req)
+{
+        struct request *rsp = req->next_rq;
+        struct request_queue *q = req->q;
+        struct bsg_job *job;
+        int ret;
+        BUG_ON(req->special);
+        job = kzalloc(sizeof(struct bsg_job) + q->bsg_job_size, GFP_KERNEL);
+        if (!job)
+                return -ENOMEM;
+        req->special = job;
+        job->req = req;
+        if (q->bsg_job_size)
+                job->dd_data = (void *)&job[1];
+        job->request = req->cmd;
+        job->request_len = req->cmd_len;
+        job->reply = req->sense;
+        job->reply_len = SCSI_SENSE_BUFFERSIZE; /* Size of sense buffer
+                                                 * allocated */
+        if (req->bio) {
+                ret = bsg_map_buffer(&job->request_payload, req);
+                if (ret)
+                        goto failjob_rls_job;
+        }
+        if (rsp && rsp->bio) {
+                ret = bsg_map_buffer(&job->reply_payload, rsp);
+                if (ret)
+                        goto failjob_rls_rqst_payload;
+        }
+        job->dev = dev;
+        /* take a reference for the request */
+        get_device(job->dev);
+        return 0;
+failjob_rls_rqst_payload:
+        kfree(job->request_payload.sg_list);
+failjob_rls_job:
+        kfree(job);
+        return -ENOMEM;
+}
+/*
+ * bsg_goose_queue - restart queue in case it was stopped
+ * @q: request q to be restarted
+ */
+void bsg_goose_queue(struct request_queue *q)
+{
+        if (!q)
+                return;
+        blk_run_queue_async(q);
+}
+EXPORT_SYMBOL_GPL(bsg_goose_queue);
+/**
+ * bsg_request_fn - generic handler for bsg requests
+ * @q: request queue to manage
+ *
+ * On error the create_bsg_job function should return a -Exyz error value
+ * that will be set to the req->errors.
+ *
+ * Drivers/subsys should pass this to the queue init function.
+ */
+void bsg_request_fn(struct request_queue *q)
+{
+        struct device *dev = q->queuedata;
+        struct request *req;
+        struct bsg_job *job;
+        int ret;
+        if (!get_device(dev))
+                return;
+        while (1) {
+                req = blk_fetch_request(q);
+                if (!req)
+                        break;
+                spin_unlock_irq(q->queue_lock);
+                ret = bsg_create_job(dev, req);
+                if (ret) {
+                        req->errors = ret;
+                        blk_end_request_all(req, ret);
+                        spin_lock_irq(q->queue_lock);
+                        continue;
+                }
+                job = req->special;
+                ret = q->bsg_job_fn(job);
+                spin_lock_irq(q->queue_lock);
+                if (ret)
+                        break;
+        }
+        spin_unlock_irq(q->queue_lock);
+        put_device(dev);
+        spin_lock_irq(q->queue_lock);
+}
+EXPORT_SYMBOL_GPL(bsg_request_fn);
+/**
+ * bsg_setup_queue - Create and add the bsg hooks so we can receive requests
+ * @dev: device to attach bsg device to
+ * @q: request queue setup by caller
+ * @name: device to give bsg device
+ * @job_fn: bsg job handler
+ * @dd_job_size: size of LLD data needed for each job
+ *
+ * The caller should have setup the reuqest queue with bsg_request_fn
+ * as the request_fn.
+ */
+int bsg_setup_queue(struct device *dev, struct request_queue *q,
+                    char *name, bsg_job_fn *job_fn, int dd_job_size)
+{
+        int ret;
+        q->queuedata = dev;
+        q->bsg_job_size = dd_job_size;
+        q->bsg_job_fn = job_fn;
+        queue_flag_set_unlocked(QUEUE_FLAG_BIDI, q);
+        blk_queue_softirq_done(q, bsg_softirq_done);
+        blk_queue_rq_timeout(q, BLK_DEFAULT_SG_TIMEOUT);
+        ret = bsg_register_queue(q, dev, name, NULL);
+        if (ret) {
+                printk(KERN_ERR "%s: bsg interface failed to "
+                       "initialize - register queue\n", dev->kobj.name);
+                return ret;
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(bsg_setup_queue);
+/**
+ * bsg_remove_queue - Deletes the bsg dev from the q
+ * @q:  the request_queue that is to be torn down.
+ *
+ * Notes:
+ *   Before unregistering the queue empty any requests that are blocked
+ */
+void bsg_remove_queue(struct request_queue *q)
+{
+        struct request *req; /* block request */
+        int counts; /* totals for request_list count and starved */
+        if (!q)
+                return;
+        /* Stop taking in new requests */
+        spin_lock_irq(q->queue_lock);
+        blk_stop_queue(q);
+        /* drain all requests in the queue */
+        while (1) {
+                /* need the lock to fetch a request
+                 * this may fetch the same reqeust as the previous pass
+                 */
+                req = blk_fetch_request(q);
+                /* save requests in use and starved */
+                counts = q->rq.count[0] + q->rq.count[1] +
+                         q->rq.starved[0] + q->rq.starved[1];
+                spin_unlock_irq(q->queue_lock);
+                /* any requests still outstanding? */
+                if (counts == 0)
+                        break;
+                /* This may be the same req as the previous iteration,
+                 * always send the blk_end_request_all after a prefetch.
+                 * It is not okay to not end the request because the
+                 * prefetch started the request.
+                 */
+                if (req) {
+                        /* return -ENXIO to indicate that this queue is
+                         * going away
+                         */
+                        req->errors = -ENXIO;
+                        blk_end_request_all(req, -ENXIO);
+                }
+                msleep(200); /* allow bsg to possibly finish */
+                spin_lock_irq(q->queue_lock);
+        }
+        bsg_unregister_queue(q);
+}
+EXPORT_SYMBOL_GPL(bsg_remove_queue);
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 1f96ad6254f1..a33bd4377c61 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -130,6 +130,8 @@ struct cfq_queue {
        unsigned long slice_end;
        long slice_resid;
+        /* pending metadata requests */
+        int meta_pending;
        /* number of requests that are on the dispatch list or inside driver */
        int dispatched;
@@ -682,6 +684,9 @@ cfq_choose_req(struct cfq_data *cfqd, struct request *rq1, struct request *rq2,
        if (rq_is_sync(rq1) != rq_is_sync(rq2))
                return rq_is_sync(rq1) ? rq1 : rq2;
+        if ((rq1->cmd_flags ^ rq2->cmd_flags) & REQ_META)
+                return rq1->cmd_flags & REQ_META ? rq1 : rq2;
        s1 = blk_rq_pos(rq1);
        s2 = blk_rq_pos(rq2);
@@ -1209,6 +1214,9 @@ static void cfq_destroy_cfqg(struct cfq_data *cfqd, struct cfq_group *cfqg)
        hlist_del_init(&cfqg->cfqd_node);
+        BUG_ON(cfqd->nr_blkcg_linked_grps <= 0);
+        cfqd->nr_blkcg_linked_grps--;
        /*
         * Put the reference taken at the time of creation so that when all
         * queues are gone, group can be destroyed.
@@ -1604,6 +1612,10 @@ static void cfq_remove_request(struct request *rq)
        cfqq->cfqd->rq_queued--;
        cfq_blkiocg_update_io_remove_stats(&(RQ_CFQG(rq))->blkg,
                                        rq_data_dir(rq), rq_is_sync(rq));
+        if (rq->cmd_flags & REQ_META) {
+                WARN_ON(!cfqq->meta_pending);
+                cfqq->meta_pending--;
+        }
 }
 static int cfq_merge(struct request_queue *q, struct request **req,
@@ -3357,6 +3369,13 @@ cfq_should_preempt(struct cfq_data *cfqd, struct cfq_queue *new_cfqq,
                return true;
        /*
+         * So both queues are sync. Let the new request get disk time if
+         * it's a metadata request and the current queue is doing regular IO.
+         */
+        if ((rq->cmd_flags & REQ_META) && !cfqq->meta_pending)
+                return true;
+        /*
         * Allow an RT request to pre-empt an ongoing non-RT cfqq timeslice.
         */
        if (cfq_class_rt(new_cfqq) && !cfq_class_rt(cfqq))
@@ -3420,6 +3439,8 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
        struct cfq_io_context *cic = RQ_CIC(rq);
        cfqd->rq_queued++;
+        if (rq->cmd_flags & REQ_META)
+                cfqq->meta_pending++;
        cfq_update_io_thinktime(cfqd, cfqq, cic);
        cfq_update_io_seektime(cfqd, cfqq, rq);
diff --git a/block/genhd.c b/block/genhd.c
index 5cb51c55f6d8..e2f67902dd02 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -1146,17 +1146,17 @@ static int diskstats_show(struct seq_file *seqf, void *v)
                cpu = part_stat_lock();
                part_round_stats(cpu, hd);
                part_stat_unlock();
-                seq_printf(seqf, "%4d %7d %s %lu %lu %llu "
+                seq_printf(seqf, "%4d %7d %s %lu %lu %lu "
-                           "%u %lu %lu %llu %u %u %u %u\n",
+                           "%u %lu %lu %lu %u %u %u %u\n",
                           MAJOR(part_devt(hd)), MINOR(part_devt(hd)),
                           disk_name(gp, hd->partno, buf),
                           part_stat_read(hd, ios[READ]),
                           part_stat_read(hd, merges[READ]),
-                           (unsigned long long)part_stat_read(hd, sectors[READ]),
+                           part_stat_read(hd, sectors[READ]),
                           jiffies_to_msecs(part_stat_read(hd, ticks[READ])),
                           part_stat_read(hd, ios[WRITE]),
                           part_stat_read(hd, merges[WRITE]),
-                           (unsigned long long)part_stat_read(hd, sectors[WRITE]),
+                           part_stat_read(hd, sectors[WRITE]),
                           jiffies_to_msecs(part_stat_read(hd, ticks[WRITE])),
                           part_in_flight(hd),
                           jiffies_to_msecs(part_stat_read(hd, io_ticks)),
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index ca3e6be44a04..5987e0ba8c2d 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -468,6 +468,15 @@ config PATA_ICSIDE
          interface card.  This is not required for ICS partition support.
          If you are unsure, say N to this.
+config PATA_IMX
+        tristate "PATA support for Freescale iMX"
+        depends on ARCH_MXC
+        help
+          This option enables support for the PATA host available on Freescale
+          iMX SoCs.
+          If unsure, say N.
 config PATA_IT8213
        tristate "IT8213 PATA support (Experimental)"
        depends on PCI && EXPERIMENTAL
diff --git a/drivers/ata/Makefile b/drivers/ata/Makefile
index 8ac64e1aa051..9550d691fd19 100644
--- a/drivers/ata/Makefile
+++ b/drivers/ata/Makefile
@@ -48,6 +48,7 @@ obj-$(CONFIG_PATA_HPT37X)	+= pata_hpt37x.o
 obj-$(CONFIG_PATA_HPT3X2N)      += pata_hpt3x2n.o
 obj-$(CONFIG_PATA_HPT3X3)       += pata_hpt3x3.o
 obj-$(CONFIG_PATA_ICSIDE)       += pata_icside.o
+obj-$(CONFIG_PATA_IMX)          += pata_imx.o
 obj-$(CONFIG_PATA_IT8213)       += pata_it8213.o
 obj-$(CONFIG_PATA_IT821X)       += pata_it821x.o
 obj-$(CONFIG_PATA_JMICRON)      += pata_jmicron.o
diff --git a/drivers/ata/pata_imx.c b/drivers/ata/pata_imx.c
new file mode 100644
index 000000000000..ca9d9caedfa3
--- /dev/null
+++ b/drivers/ata/pata_imx.c
@@ -0,0 +1,253 @@
+/*
+ * Freescale iMX PATA driver
+ *
+ * Copyright (C) 2011 Arnaud Patard <arnaud.patard@rtp-net.org>
+ *
+ * Based on pata_platform - Copyright (C) 2006 - 2007  Paul Mundt
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * TODO:
+ * - dmaengine support
+ * - check if timing stuff needed
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/blkdev.h>
+#include <scsi/scsi_host.h>
+#include <linux/ata.h>
+#include <linux/libata.h>
+#include <linux/platform_device.h>
+#include <linux/clk.h>
+#define DRV_NAME "pata_imx"
+#define PATA_IMX_ATA_CONTROL            0x24
+#define PATA_IMX_ATA_CTRL_FIFO_RST_B    (1<<7)
+#define PATA_IMX_ATA_CTRL_ATA_RST_B     (1<<6)
+#define PATA_IMX_ATA_CTRL_IORDY_EN      (1<<0)
+#define PATA_IMX_ATA_INT_EN             0x2C
+#define PATA_IMX_ATA_INTR_ATA_INTRQ2    (1<<3)
+#define PATA_IMX_DRIVE_DATA             0xA0
+#define PATA_IMX_DRIVE_CONTROL          0xD8
+struct pata_imx_priv {
+        struct clk *clk;
+        /* timings/interrupt/control regs */
+        u8 *host_regs;
+        u32 ata_ctl;
+};
+static int pata_imx_set_mode(struct ata_link *link, struct ata_device **unused)
+{
+        struct ata_device *dev;
+        struct ata_port *ap = link->ap;
+        struct pata_imx_priv *priv = ap->host->private_data;
+        u32 val;
+        ata_for_each_dev(dev, link, ENABLED) {
+                dev->pio_mode = dev->xfer_mode = XFER_PIO_0;
+                dev->xfer_shift = ATA_SHIFT_PIO;
+                dev->flags |= ATA_DFLAG_PIO;
+                val = __raw_readl(priv->host_regs + PATA_IMX_ATA_CONTROL);
+                if (ata_pio_need_iordy(dev))
+                        val |= PATA_IMX_ATA_CTRL_IORDY_EN;
+                else
+                        val &= ~PATA_IMX_ATA_CTRL_IORDY_EN;
+                __raw_writel(val, priv->host_regs + PATA_IMX_ATA_CONTROL);
+                ata_dev_printk(dev, KERN_INFO, "configured for PIO\n");
+        }
+        return 0;
+}
+static struct scsi_host_template pata_imx_sht = {
+        ATA_PIO_SHT(DRV_NAME),
+};
+static struct ata_port_operations pata_imx_port_ops = {
+        .inherits               = &ata_sff_port_ops,
+        .sff_data_xfer          = ata_sff_data_xfer_noirq,
+        .cable_detect           = ata_cable_unknown,
+        .set_mode               = pata_imx_set_mode,
+};
+static void pata_imx_setup_port(struct ata_ioports *ioaddr)
+{
+        /* Fixup the port shift for platforms that need it */
+        ioaddr->data_addr       = ioaddr->cmd_addr + (ATA_REG_DATA    << 2);
+        ioaddr->error_addr      = ioaddr->cmd_addr + (ATA_REG_ERR     << 2);
+        ioaddr->feature_addr    = ioaddr->cmd_addr + (ATA_REG_FEATURE << 2);
+        ioaddr->nsect_addr      = ioaddr->cmd_addr + (ATA_REG_NSECT   << 2);
+        ioaddr->lbal_addr       = ioaddr->cmd_addr + (ATA_REG_LBAL    << 2);
+        ioaddr->lbam_addr       = ioaddr->cmd_addr + (ATA_REG_LBAM    << 2);
+        ioaddr->lbah_addr       = ioaddr->cmd_addr + (ATA_REG_LBAH    << 2);
+        ioaddr->device_addr     = ioaddr->cmd_addr + (ATA_REG_DEVICE  << 2);
+        ioaddr->status_addr     = ioaddr->cmd_addr + (ATA_REG_STATUS  << 2);
+        ioaddr->command_addr    = ioaddr->cmd_addr + (ATA_REG_CMD     << 2);
+}
+static int __devinit pata_imx_probe(struct platform_device *pdev)
+{
+        struct ata_host *host;
+        struct ata_port *ap;
+        struct pata_imx_priv *priv;
+        int irq = 0;
+        struct resource *io_res;
+        io_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (io_res == NULL)
+                return -EINVAL;
+        irq = platform_get_irq(pdev, 0);
+        if (irq <= 0)
+                return -EINVAL;
+        priv = devm_kzalloc(&pdev->dev,
+                                sizeof(struct pata_imx_priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+        priv->clk = clk_get(&pdev->dev, NULL);
+        if (IS_ERR(priv->clk)) {
+                dev_err(&pdev->dev, "Failed to get clock\n");
+                return PTR_ERR(priv->clk);
+        }
+        clk_enable(priv->clk);
+        host = ata_host_alloc(&pdev->dev, 1);
+        if (!host)
+                goto free_priv;
+        host->private_data = priv;
+        ap = host->ports[0];
+        ap->ops = &pata_imx_port_ops;
+        ap->pio_mask = ATA_PIO0;
+        ap->flags |= ATA_FLAG_SLAVE_POSS;
+        priv->host_regs = devm_ioremap(&pdev->dev, io_res->start,
+                resource_size(io_res));
+        if (!priv->host_regs) {
+                dev_err(&pdev->dev, "failed to map IO/CTL base\n");
+                goto free_priv;
+        }
+        ap->ioaddr.cmd_addr = priv->host_regs + PATA_IMX_DRIVE_DATA;
+        ap->ioaddr.ctl_addr = priv->host_regs + PATA_IMX_DRIVE_CONTROL;
+        ap->ioaddr.altstatus_addr = ap->ioaddr.ctl_addr;
+        pata_imx_setup_port(&ap->ioaddr);
+        ata_port_desc(ap, "cmd 0x%llx ctl 0x%llx",
+                (unsigned long long)io_res->start + PATA_IMX_DRIVE_DATA,
+                (unsigned long long)io_res->start + PATA_IMX_DRIVE_CONTROL);
+        /* deassert resets */
+        __raw_writel(PATA_IMX_ATA_CTRL_FIFO_RST_B |
+                        PATA_IMX_ATA_CTRL_ATA_RST_B,
+                        priv->host_regs + PATA_IMX_ATA_CONTROL);
+        /* enable interrupts */
+        __raw_writel(PATA_IMX_ATA_INTR_ATA_INTRQ2,
+                        priv->host_regs + PATA_IMX_ATA_INT_EN);
+        /* activate */
+        return ata_host_activate(host, irq, ata_sff_interrupt, 0,
+                                &pata_imx_sht);
+free_priv:
+        clk_disable(priv->clk);
+        clk_put(priv->clk);
+        return -ENOMEM;
+}
+static int __devexit pata_imx_remove(struct platform_device *pdev)
+{
+        struct ata_host *host = dev_get_drvdata(&pdev->dev);
+        struct pata_imx_priv *priv = host->private_data;
+        ata_host_detach(host);
+        __raw_writel(0, priv->host_regs + PATA_IMX_ATA_INT_EN);
+        clk_disable(priv->clk);
+        clk_put(priv->clk);
+        return 0;
+}
+#ifdef CONFIG_PM
+static int pata_imx_suspend(struct device *dev)
+{
+        struct ata_host *host = dev_get_drvdata(dev);
+        struct pata_imx_priv *priv = host->private_data;
+        int ret;
+        ret = ata_host_suspend(host, PMSG_SUSPEND);
+        if (!ret) {
+                __raw_writel(0, priv->host_regs + PATA_IMX_ATA_INT_EN);
+                priv->ata_ctl =
+                        __raw_readl(priv->host_regs + PATA_IMX_ATA_CONTROL);
+                clk_disable(priv->clk);
+        }
+        return ret;
+}
+static int pata_imx_resume(struct device *dev)
+{
+        struct ata_host *host = dev_get_drvdata(dev);
+        struct pata_imx_priv *priv = host->private_data;
+        clk_enable(priv->clk);
+        __raw_writel(priv->ata_ctl, priv->host_regs + PATA_IMX_ATA_CONTROL);
+        __raw_writel(PATA_IMX_ATA_INTR_ATA_INTRQ2,
+                        priv->host_regs + PATA_IMX_ATA_INT_EN);
+        ata_host_resume(host);
+        return 0;
+}
+static const struct dev_pm_ops pata_imx_pm_ops = {
+        .suspend        = pata_imx_suspend,
+        .resume         = pata_imx_resume,
+};
+#endif
+static struct platform_driver pata_imx_driver = {
+        .probe          = pata_imx_probe,
+        .remove         = __devexit_p(pata_imx_remove),
+        .driver = {
+                .name           = DRV_NAME,
+                .owner          = THIS_MODULE,
+#ifdef CONFIG_PM
+                .pm             = &pata_imx_pm_ops,
+#endif
+        },
+};
+static int __init pata_imx_init(void)
+{
+        return platform_driver_register(&pata_imx_driver);
+}
+static void __exit pata_imx_exit(void)
+{
+        platform_driver_unregister(&pata_imx_driver);
+}
+module_init(pata_imx_init);
+module_exit(pata_imx_exit);
+MODULE_AUTHOR("Arnaud Patard <arnaud.patard@rtp-net.org>");
+MODULE_DESCRIPTION("low-level driver for iMX PATA");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c
index 65e4be6be220..8e9f5048a10a 100644
--- a/drivers/ata/pata_via.c
+++ b/drivers/ata/pata_via.c
@@ -124,6 +124,17 @@ static const struct via_isa_bridge {
        { NULL }
 };
+static const struct dmi_system_id no_atapi_dma_dmi_table[] = {
+        {
+                .ident = "AVERATEC 3200",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "AVERATEC"),
+                        DMI_MATCH(DMI_BOARD_NAME, "3200"),
+                },
+        },
+        { }
+};
 struct via_port {
        u8 cached_device;
 };
@@ -355,6 +366,13 @@ static unsigned long via_mode_filter(struct ata_device *dev, unsigned long mask)
                        mask &= ~ ATA_MASK_UDMA;
                }
        }
+        if (dev->class == ATA_DEV_ATAPI &&
+            dmi_check_system(no_atapi_dma_dmi_table)) {
+                ata_dev_warn(dev, "controller locks up on ATAPI DMA, forcing PIO\n");
+                mask &= ATA_MASK_PIO;
+        }
        return mask;
 }
diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
index 0a9a774a7e1e..5c4237452f50 100644
--- a/drivers/ata/sata_dwc_460ex.c
+++ b/drivers/ata/sata_dwc_460ex.c
@@ -1329,7 +1329,7 @@ static int sata_dwc_port_start(struct ata_port *ap)
                        dev_err(ap->dev, "%s: dma_alloc_coherent failed\n",
                                 __func__);
                        err = -ENOMEM;
-                        goto CLEANUP;
+                        goto CLEANUP_ALLOC;
                }
        }
@@ -1349,15 +1349,13 @@ static int sata_dwc_port_start(struct ata_port *ap)
        /* Clear any error bits before libata starts issuing commands */
        clear_serror();
        ap->private_data = hsdevp;
+        dev_dbg(ap->dev, "%s: done\n", __func__);
+        return 0;
+CLEANUP_ALLOC:
+        kfree(hsdevp);
 CLEANUP:
-        if (err) {
+        dev_dbg(ap->dev, "%s: fail. ap->id = %d\n", __func__, ap->print_id);
-                sata_dwc_port_stop(ap);
-                dev_dbg(ap->dev, "%s: fail\n", __func__);
-        } else {
-                dev_dbg(ap->dev, "%s: done\n", __func__);
-        }
        return err;
 }
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index 98c1d780f552..9dfb40b8c2c9 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -438,7 +438,7 @@ static void sil_host_intr(struct ata_port *ap, u32 bmdma2)
        u8 status;
        if (unlikely(bmdma2 & SIL_DMA_SATA_IRQ)) {
-                u32 serror;
+                u32 serror = 0xffffffff;
                /* SIEN doesn't mask SATA IRQs on some 3112s.  Those
                 * controllers continue to assert IRQ as long as
diff --git a/drivers/base/devres.c b/drivers/base/devres.c
index cf7a0c788052..65cd74832450 100644
--- a/drivers/base/devres.c
+++ b/drivers/base/devres.c
@@ -397,6 +397,7 @@ static int remove_nodes(struct device *dev,
 static int release_nodes(struct device *dev, struct list_head *first,
                         struct list_head *end, unsigned long flags)
+        __releases(&dev->devres_lock)
 {
        LIST_HEAD(todo);
        int cnt;
diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
index 33e1bed68fdd..a4760e095ff5 100644
--- a/drivers/base/devtmpfs.c
+++ b/drivers/base/devtmpfs.c
@@ -376,7 +376,7 @@ int devtmpfs_mount(const char *mntdir)
        return err;
 }
-static __initdata DECLARE_COMPLETION(setup_done);
+static DECLARE_COMPLETION(setup_done);
 static int handle(const char *name, mode_t mode, struct device *dev)
 {
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index bbb03e6f7255..06ed6b4e7df5 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -521,11 +521,6 @@ static int _request_firmware(const struct firmware **firmware_p,
        if (!firmware_p)
                return -EINVAL;
-        if (WARN_ON(usermodehelper_is_disabled())) {
-                dev_err(device, "firmware: %s will not be loaded\n", name);
-                return -EBUSY;
-        }
        *firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL);
        if (!firmware) {
                dev_err(device, "%s: kmalloc(struct firmware) failed\n",
@@ -539,6 +534,12 @@ static int _request_firmware(const struct firmware **firmware_p,
                return 0;
        }
+        if (WARN_ON(usermodehelper_is_disabled())) {
+                dev_err(device, "firmware: %s will not be loaded\n", name);
+                retval = -EBUSY;
+                goto out;
+        }
        if (uevent)
                dev_dbg(device, "firmware: requesting %s\n", name);
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 0cad9c7f6bb5..99a5272d7c2f 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -33,7 +33,7 @@ EXPORT_SYMBOL_GPL(platform_bus);
 /**
 * arch_setup_pdev_archdata - Allow manipulation of archdata before its used
- * @dev: platform device
+ * @pdev: platform device
 *
 * This is called before platform_device_add() such that any pdev_archdata may
 * be setup before the platform_notifier is called.  So if a user needs to
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index e18566a0fedd..1c374579407c 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -460,6 +460,21 @@ static int pm_genpd_runtime_resume(struct device *dev)
        return 0;
 }
+/**
+ * pm_genpd_poweroff_unused - Power off all PM domains with no devices in use.
+ */
+void pm_genpd_poweroff_unused(void)
+{
+        struct generic_pm_domain *genpd;
+        mutex_lock(&gpd_list_lock);
+        list_for_each_entry(genpd, &gpd_list, gpd_list_node)
+                genpd_queue_power_off_work(genpd);
+        mutex_unlock(&gpd_list_lock);
+}
 #else
 static inline void genpd_power_off_work_fn(struct work_struct *work) {}
@@ -1255,18 +1270,3 @@ void pm_genpd_init(struct generic_pm_domain *genpd,
        list_add(&genpd->gpd_list_node, &gpd_list);
        mutex_unlock(&gpd_list_lock);
 }
-/**
- * pm_genpd_poweroff_unused - Power off all PM domains with no devices in use.
- */
-void pm_genpd_poweroff_unused(void)
-{
-        struct generic_pm_domain *genpd;
-        mutex_lock(&gpd_list_lock);
-        list_for_each_entry(genpd, &gpd_list, gpd_list_node)
-                genpd_queue_power_off_work(genpd);
-        mutex_unlock(&gpd_list_lock);
-}
diff --git a/drivers/base/regmap/regmap-i2c.c b/drivers/base/regmap/regmap-i2c.c
index c2231ff06cbc..c4f7a45cd2c3 100644
--- a/drivers/base/regmap/regmap-i2c.c
+++ b/drivers/base/regmap/regmap-i2c.c
@@ -113,3 +113,4 @@ struct regmap *regmap_init_i2c(struct i2c_client *i2c,
 }
 EXPORT_SYMBOL_GPL(regmap_init_i2c);
+MODULE_LICENSE("GPL");
diff --git a/drivers/base/regmap/regmap-spi.c b/drivers/base/regmap/regmap-spi.c
index 4deba0621bc7..f8396945d6ed 100644
--- a/drivers/base/regmap/regmap-spi.c
+++ b/drivers/base/regmap/regmap-spi.c
@@ -13,6 +13,7 @@
 #include <linux/regmap.h>
 #include <linux/spi/spi.h>
 #include <linux/init.h>
+#include <linux/module.h>
 static int regmap_spi_write(struct device *dev, const void *data, size_t count)
 {
@@ -70,3 +71,5 @@ struct regmap *regmap_init_spi(struct spi_device *spi,
        return regmap_init(&spi->dev, &regmap_spi, config);
 }
 EXPORT_SYMBOL_GPL(regmap_init_spi);
+MODULE_LICENSE("GPL");
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index cf3565cae93d..0eef4da1ac61 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -317,7 +317,7 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
                u8[0] |= map->bus->read_flag_mask;
        ret = map->bus->read(map->dev, map->work_buf, map->format.reg_bytes,
-                             val, map->format.val_bytes);
+                             val, val_len);
        if (ret != 0)
                return ret;
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 717d6e4e18d3..6f07ec1c2f58 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -256,6 +256,21 @@ config BLK_DEV_LOOP
          Most users will answer N here.
+config BLK_DEV_LOOP_MIN_COUNT
+        int "Number of loop devices to pre-create at init time"
+        depends on BLK_DEV_LOOP
+        default 8
+        help
+          Static number of loop devices to be unconditionally pre-created
+          at init time.
+          This default value can be overwritten on the kernel command
+          line or with module-parameter loop.max_loop.
+          The historic default is 8. If a late 2011 version of losetup(8)
+          is used, it can be set to 0, since needed loop devices can be
+          dynamically allocated with the /dev/loop-control interface.
 config BLK_DEV_CRYPTOLOOP
        tristate "Cryptoloop Support"
        select CRYPTO
@@ -471,7 +486,7 @@ config XEN_BLKDEV_FRONTEND
          in another domain which drives the actual block device.
 config XEN_BLKDEV_BACKEND
-        tristate "Block-device backend driver"
+        tristate "Xen block-device backend driver"
        depends on XEN_BACKEND
        help
          The block-device backend driver allows the kernel to export its
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index 515bcd948a43..0feab261e295 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -1829,10 +1829,10 @@ static int drbd_nl_syncer_conf(struct drbd_conf *mdev, struct drbd_nl_cfg_req *n
        /* silently ignore cpu mask on UP kernel */
        if (nr_cpu_ids > 1 && sc.cpu_mask[0] != 0) {
-                err = __bitmap_parse(sc.cpu_mask, 32, 0,
+                err = bitmap_parse(sc.cpu_mask, 32,
                                cpumask_bits(new_cpu_mask), nr_cpu_ids);
                if (err) {
-                        dev_warn(DEV, "__bitmap_parse() failed with %d\n", err);
+                        dev_warn(DEV, "bitmap_parse() failed with %d\n", err);
                        retcode = ERR_CPU_MASK_PARSE;
                        goto fail;
                }
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 76c8da78212b..4720c7ade0ae 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -75,11 +75,11 @@
 #include <linux/kthread.h>
 #include <linux/splice.h>
 #include <linux/sysfs.h>
+#include <linux/miscdevice.h>
 #include <asm/uaccess.h>
-static LIST_HEAD(loop_devices);
+static DEFINE_IDR(loop_index_idr);
-static DEFINE_MUTEX(loop_devices_mutex);
+static DEFINE_MUTEX(loop_index_mutex);
 static int max_part;
 static int part_shift;
@@ -722,17 +722,10 @@ static inline int is_loop_device(struct file *file)
 static ssize_t loop_attr_show(struct device *dev, char *page,
                              ssize_t (*callback)(struct loop_device *, char *))
 {
-        struct loop_device *l, *lo = NULL;
+        struct gendisk *disk = dev_to_disk(dev);
+        struct loop_device *lo = disk->private_data;
-        mutex_lock(&loop_devices_mutex);
-        list_for_each_entry(l, &loop_devices, lo_list)
-                if (disk_to_dev(l->lo_disk) == dev) {
-                        lo = l;
-                        break;
-                }
-        mutex_unlock(&loop_devices_mutex);
-        return lo ? callback(lo, page) : -EIO;
+        return callback(lo, page);
 }
 #define LOOP_ATTR_RO(_name)                                             \
@@ -750,10 +743,10 @@ static ssize_t loop_attr_backing_file_show(struct loop_device *lo, char *buf)
        ssize_t ret;
        char *p = NULL;
-        mutex_lock(&lo->lo_ctl_mutex);
+        spin_lock_irq(&lo->lo_lock);
        if (lo->lo_backing_file)
                p = d_path(&lo->lo_backing_file->f_path, buf, PAGE_SIZE - 1);
-        mutex_unlock(&lo->lo_ctl_mutex);
+        spin_unlock_irq(&lo->lo_lock);
        if (IS_ERR_OR_NULL(p))
                ret = PTR_ERR(p);
@@ -1007,7 +1000,9 @@ static int loop_clr_fd(struct loop_device *lo, struct block_device *bdev)
        kthread_stop(lo->lo_thread);
+        spin_lock_irq(&lo->lo_lock);
        lo->lo_backing_file = NULL;
+        spin_unlock_irq(&lo->lo_lock);
        loop_release_xfer(lo);
        lo->transfer = NULL;
@@ -1485,13 +1480,22 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode,
 static int lo_open(struct block_device *bdev, fmode_t mode)
 {
-        struct loop_device *lo = bdev->bd_disk->private_data;
+        struct loop_device *lo;
+        int err = 0;
+        mutex_lock(&loop_index_mutex);
+        lo = bdev->bd_disk->private_data;
+        if (!lo) {
+                err = -ENXIO;
+                goto out;
+        }
        mutex_lock(&lo->lo_ctl_mutex);
        lo->lo_refcnt++;
        mutex_unlock(&lo->lo_ctl_mutex);
+out:
-        return 0;
+        mutex_unlock(&loop_index_mutex);
+        return err;
 }
 static int lo_release(struct gendisk *disk, fmode_t mode)
@@ -1557,40 +1561,71 @@ int loop_register_transfer(struct loop_func_table *funcs)
        return 0;
 }
+static int unregister_transfer_cb(int id, void *ptr, void *data)
+{
+        struct loop_device *lo = ptr;
+        struct loop_func_table *xfer = data;
+        mutex_lock(&lo->lo_ctl_mutex);
+        if (lo->lo_encryption == xfer)
+                loop_release_xfer(lo);
+        mutex_unlock(&lo->lo_ctl_mutex);
+        return 0;
+}
 int loop_unregister_transfer(int number)
 {
        unsigned int n = number;
-        struct loop_device *lo;
        struct loop_func_table *xfer;
        if (n == 0 || n >= MAX_LO_CRYPT || (xfer = xfer_funcs[n]) == NULL)
                return -EINVAL;
        xfer_funcs[n] = NULL;
+        idr_for_each(&loop_index_idr, &unregister_transfer_cb, xfer);
-        list_for_each_entry(lo, &loop_devices, lo_list) {
-                mutex_lock(&lo->lo_ctl_mutex);
-                if (lo->lo_encryption == xfer)
-                        loop_release_xfer(lo);
-                mutex_unlock(&lo->lo_ctl_mutex);
-        }
        return 0;
 }
 EXPORT_SYMBOL(loop_register_transfer);
 EXPORT_SYMBOL(loop_unregister_transfer);
-static struct loop_device *loop_alloc(int i)
+static int loop_add(struct loop_device **l, int i)
 {
        struct loop_device *lo;
        struct gendisk *disk;
+        int err;
        lo = kzalloc(sizeof(*lo), GFP_KERNEL);
-        if (!lo)
+        if (!lo) {
+                err = -ENOMEM;
                goto out;
+        }
+        err = idr_pre_get(&loop_index_idr, GFP_KERNEL);
+        if (err < 0)
+                goto out_free_dev;
+        if (i >= 0) {
+                int m;
+                /* create specific i in the index */
+                err = idr_get_new_above(&loop_index_idr, lo, i, &m);
+                if (err >= 0 && i != m) {
+                        idr_remove(&loop_index_idr, m);
+                        err = -EEXIST;
+                }
+        } else if (i == -1) {
+                int m;
+                /* get next free nr */
+                err = idr_get_new(&loop_index_idr, lo, &m);
+                if (err >= 0)
+                        i = m;
+        } else {
+                err = -EINVAL;
+        }
+        if (err < 0)
+                goto out_free_dev;
        lo->lo_queue = blk_alloc_queue(GFP_KERNEL);
        if (!lo->lo_queue)
@@ -1611,81 +1646,158 @@ static struct loop_device *loop_alloc(int i)
        disk->private_data      = lo;
        disk->queue             = lo->lo_queue;
        sprintf(disk->disk_name, "loop%d", i);
-        return lo;
+        add_disk(disk);
+        *l = lo;
+        return lo->lo_number;
 out_free_queue:
        blk_cleanup_queue(lo->lo_queue);
 out_free_dev:
        kfree(lo);
 out:
-        return NULL;
+        return err;
 }
-static void loop_free(struct loop_device *lo)
+static void loop_remove(struct loop_device *lo)
 {
+        del_gendisk(lo->lo_disk);
        blk_cleanup_queue(lo->lo_queue);
        put_disk(lo->lo_disk);
-        list_del(&lo->lo_list);
        kfree(lo);
 }
-static struct loop_device *loop_init_one(int i)
+static int find_free_cb(int id, void *ptr, void *data)
+{
+        struct loop_device *lo = ptr;
+        struct loop_device **l = data;
+        if (lo->lo_state == Lo_unbound) {
+                *l = lo;
+                return 1;
+        }
+        return 0;
+}
+static int loop_lookup(struct loop_device **l, int i)
 {
        struct loop_device *lo;
+        int ret = -ENODEV;
-        list_for_each_entry(lo, &loop_devices, lo_list) {
+        if (i < 0) {
-                if (lo->lo_number == i)
+                int err;
-                        return lo;
+                err = idr_for_each(&loop_index_idr, &find_free_cb, &lo);
+                if (err == 1) {
+                        *l = lo;
+                        ret = lo->lo_number;
+                }
+                goto out;
        }
-        lo = loop_alloc(i);
+        /* lookup and return a specific i */
+        lo = idr_find(&loop_index_idr, i);
        if (lo) {
-                add_disk(lo->lo_disk);
+                *l = lo;
-                list_add_tail(&lo->lo_list, &loop_devices);
+                ret = lo->lo_number;
        }
-        return lo;
+out:
-}
+        return ret;
-static void loop_del_one(struct loop_device *lo)
-{
-        del_gendisk(lo->lo_disk);
-        loop_free(lo);
 }
 static struct kobject *loop_probe(dev_t dev, int *part, void *data)
 {
        struct loop_device *lo;
        struct kobject *kobj;
+        int err;
-        mutex_lock(&loop_devices_mutex);
+        mutex_lock(&loop_index_mutex);
-        lo = loop_init_one(MINOR(dev) >> part_shift);
+        err = loop_lookup(&lo, MINOR(dev) >> part_shift);
-        kobj = lo ? get_disk(lo->lo_disk) : ERR_PTR(-ENOMEM);
+        if (err < 0)
-        mutex_unlock(&loop_devices_mutex);
+                err = loop_add(&lo, MINOR(dev) >> part_shift);
+        if (err < 0)
+                kobj = ERR_PTR(err);
+        else
+                kobj = get_disk(lo->lo_disk);
+        mutex_unlock(&loop_index_mutex);
        *part = 0;
        return kobj;
 }
+static long loop_control_ioctl(struct file *file, unsigned int cmd,
+                               unsigned long parm)
+{
+        struct loop_device *lo;
+        int ret = -ENOSYS;
+        mutex_lock(&loop_index_mutex);
+        switch (cmd) {
+        case LOOP_CTL_ADD:
+                ret = loop_lookup(&lo, parm);
+                if (ret >= 0) {
+                        ret = -EEXIST;
+                        break;
+                }
+                ret = loop_add(&lo, parm);
+                break;
+        case LOOP_CTL_REMOVE:
+                ret = loop_lookup(&lo, parm);
+                if (ret < 0)
+                        break;
+                mutex_lock(&lo->lo_ctl_mutex);
+                if (lo->lo_state != Lo_unbound) {
+                        ret = -EBUSY;
+                        mutex_unlock(&lo->lo_ctl_mutex);
+                        break;
+                }
+                if (lo->lo_refcnt > 0) {
+                        ret = -EBUSY;
+                        mutex_unlock(&lo->lo_ctl_mutex);
+                        break;
+                }
+                lo->lo_disk->private_data = NULL;
+                mutex_unlock(&lo->lo_ctl_mutex);
+                idr_remove(&loop_index_idr, lo->lo_number);
+                loop_remove(lo);
+                break;
+        case LOOP_CTL_GET_FREE:
+                ret = loop_lookup(&lo, -1);
+                if (ret >= 0)
+                        break;
+                ret = loop_add(&lo, -1);
+        }
+        mutex_unlock(&loop_index_mutex);
+        return ret;
+}
+static const struct file_operations loop_ctl_fops = {
+        .open           = nonseekable_open,
+        .unlocked_ioctl = loop_control_ioctl,
+        .compat_ioctl   = loop_control_ioctl,
+        .owner          = THIS_MODULE,
+        .llseek         = noop_llseek,
+};
+static struct miscdevice loop_misc = {
+        .minor          = LOOP_CTRL_MINOR,
+        .name           = "loop-control",
+        .fops           = &loop_ctl_fops,
+};
+MODULE_ALIAS_MISCDEV(LOOP_CTRL_MINOR);
+MODULE_ALIAS("devname:loop-control");
 static int __init loop_init(void)
 {
        int i, nr;
        unsigned long range;
-        struct loop_device *lo, *next;
+        struct loop_device *lo;
+        int err;
-        /*
+        err = misc_register(&loop_misc);
-         * loop module now has a feature to instantiate underlying device
+        if (err < 0)
-         * structure on-demand, provided that there is an access dev node.
+                return err;
-         * However, this will not work well with user space tool that doesn't
-         * know about such "feature".  In order to not break any existing
-         * tool, we do the following:
-         *
-         * (1) if max_loop is specified, create that many upfront, and this
-         *     also becomes a hard limit.
-         * (2) if max_loop is not specified, create 8 loop device on module
-         *     load, user can further extend loop device by create dev node
-         *     themselves and have kernel automatically instantiate actual
-         *     device on-demand.
-         */
        part_shift = 0;
        if (max_part > 0) {
@@ -1708,57 +1820,60 @@ static int __init loop_init(void)
        if (max_loop > 1UL << (MINORBITS - part_shift))
                return -EINVAL;
+        /*
+         * If max_loop is specified, create that many devices upfront.
+         * This also becomes a hard limit. If max_loop is not specified,
+         * create CONFIG_BLK_DEV_LOOP_MIN_COUNT loop devices at module
+         * init time. Loop devices can be requested on-demand with the
+         * /dev/loop-control interface, or be instantiated by accessing
+         * a 'dead' device node.
+         */
        if (max_loop) {
                nr = max_loop;
                range = max_loop << part_shift;
        } else {
-                nr = 8;
+                nr = CONFIG_BLK_DEV_LOOP_MIN_COUNT;
                range = 1UL << MINORBITS;
        }
        if (register_blkdev(LOOP_MAJOR, "loop"))
                return -EIO;
-        for (i = 0; i < nr; i++) {
-                lo = loop_alloc(i);
-                if (!lo)
-                        goto Enomem;
-                list_add_tail(&lo->lo_list, &loop_devices);
-        }
-        /* point of no return */
-        list_for_each_entry(lo, &loop_devices, lo_list)
-                add_disk(lo->lo_disk);
        blk_register_region(MKDEV(LOOP_MAJOR, 0), range,
                                  THIS_MODULE, loop_probe, NULL, NULL);
+        /* pre-create number of devices given by config or max_loop */
+        mutex_lock(&loop_index_mutex);
+        for (i = 0; i < nr; i++)
+                loop_add(&lo, i);
+        mutex_unlock(&loop_index_mutex);
        printk(KERN_INFO "loop: module loaded\n");
        return 0;
+}
-Enomem:
+static int loop_exit_cb(int id, void *ptr, void *data)
-        printk(KERN_INFO "loop: out of memory\n");
+{
+        struct loop_device *lo = ptr;
-        list_for_each_entry_safe(lo, next, &loop_devices, lo_list)
-                loop_free(lo);
-        unregister_blkdev(LOOP_MAJOR, "loop");
+        loop_remove(lo);
-        return -ENOMEM;
+        return 0;
 }
 static void __exit loop_exit(void)
 {
        unsigned long range;
-        struct loop_device *lo, *next;
        range = max_loop ? max_loop << part_shift : 1UL << MINORBITS;
-        list_for_each_entry_safe(lo, next, &loop_devices, lo_list)
+        idr_for_each(&loop_index_idr, &loop_exit_cb, NULL);
-                loop_del_one(lo);
+        idr_remove_all(&loop_index_idr);
+        idr_destroy(&loop_index_idr);
        blk_unregister_region(MKDEV(LOOP_MAJOR, 0), range);
        unregister_blkdev(LOOP_MAJOR, "loop");
+        misc_deregister(&loop_misc);
 }
 module_init(loop_init);
diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
index 773bfa792777..ae3e167e17ad 100644
--- a/drivers/block/swim3.c
+++ b/drivers/block/swim3.c
@@ -1184,6 +1184,7 @@ static struct of_device_id swim3_match[] =
        {
        .compatible     = "swim3"
        },
+        { /* end of list */ }
 };
 static struct macio_driver swim3_driver =
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index b536a9cef917..9ea8c2576c70 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -123,8 +123,8 @@ static DEFINE_SPINLOCK(minor_lock);
 #define BLKIF_MINOR_EXT(dev) ((dev)&(~EXTENDED))
 #define EMULATED_HD_DISK_MINOR_OFFSET (0)
 #define EMULATED_HD_DISK_NAME_OFFSET (EMULATED_HD_DISK_MINOR_OFFSET / 256)
-#define EMULATED_SD_DISK_MINOR_OFFSET (EMULATED_HD_DISK_MINOR_OFFSET + (4 * 16))
+#define EMULATED_SD_DISK_MINOR_OFFSET (0)
-#define EMULATED_SD_DISK_NAME_OFFSET (EMULATED_HD_DISK_NAME_OFFSET + 4)
+#define EMULATED_SD_DISK_NAME_OFFSET (EMULATED_SD_DISK_MINOR_OFFSET / 256)
 #define DEV_NAME        "xvd"   /* name in /dev */
@@ -529,7 +529,7 @@ static int xlvbd_alloc_gendisk(blkif_sector_t capacity,
                minor = BLKIF_MINOR_EXT(info->vdevice);
                nr_parts = PARTS_PER_EXT_DISK;
                offset = minor / nr_parts;
-                if (xen_hvm_domain() && offset <= EMULATED_HD_DISK_NAME_OFFSET + 4)
+                if (xen_hvm_domain() && offset < EMULATED_HD_DISK_NAME_OFFSET + 4)
                        printk(KERN_WARNING "blkfront: vdevice 0x%x might conflict with "
                                        "emulated IDE disks,\n\t choose an xvd device name"
                                        "from xvde on\n", info->vdevice);
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 75fb965b8f72..f997c27d79e2 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -1929,11 +1929,17 @@ static int dvd_read_manufact(struct cdrom_device_info *cdi, dvd_struct *s,
                goto out;
        s->manufact.len = buf[0] << 8 | buf[1];
-        if (s->manufact.len < 0 || s->manufact.len > 2048) {
+        if (s->manufact.len < 0) {
                cdinfo(CD_WARNING, "Received invalid manufacture info length"
                                   " (%d)\n", s->manufact.len);
                ret = -EIO;
        } else {
+                if (s->manufact.len > 2048) {
+                        cdinfo(CD_WARNING, "Received invalid manufacture info "
+                                        "length (%d): truncating to 2048\n",
+                                        s->manufact.len);
+                        s->manufact.len = 2048;
+                }
                memcpy(s->manufact.value, &buf[4], s->manufact.len);
        }
diff --git a/drivers/char/msm_smd_pkt.c b/drivers/char/msm_smd_pkt.c
index b6f8a65c9960..8eca55deb3a3 100644
--- a/drivers/char/msm_smd_pkt.c
+++ b/drivers/char/msm_smd_pkt.c
@@ -379,9 +379,8 @@ static int __init smd_pkt_init(void)
        for (i = 0; i < NUM_SMD_PKT_PORTS; ++i) {
                smd_pkt_devp[i] = kzalloc(sizeof(struct smd_pkt_dev),
                                          GFP_KERNEL);
-                if (IS_ERR(smd_pkt_devp[i])) {
+                if (!smd_pkt_devp[i]) {
-                        r = PTR_ERR(smd_pkt_devp[i]);
+                        pr_err("kmalloc() failed\n");
-                        pr_err("kmalloc() failed %d\n", r);
                        goto clean_cdevs;
                }
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index 04f1e7ce02b1..f6cf448d69b4 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1670,7 +1670,7 @@ static void i7core_mce_output_error(struct mem_ctl_info *mci,
        char *type, *optype, *err, *msg;
        unsigned long error = m->status & 0x1ff0000l;
        u32 optypenum = (m->status >> 4) & 0x07;
-        u32 core_err_cnt = (m->status >> 38) && 0x7fff;
+        u32 core_err_cnt = (m->status >> 38) & 0x7fff;
        u32 dimm = (m->misc >> 16) & 0x3;
        u32 channel = (m->misc >> 18) & 0x3;
        u32 syndrome = m->misc >> 32;
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index e6ad3bb6c1a6..4799393247c8 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -216,15 +216,33 @@ struct inbound_phy_packet_event {
        struct fw_cdev_event_phy_packet phy_packet;
 };
-static inline void __user *u64_to_uptr(__u64 value)
+#ifdef CONFIG_COMPAT
+static void __user *u64_to_uptr(u64 value)
+{
+        if (is_compat_task())
+                return compat_ptr(value);
+        else
+                return (void __user *)(unsigned long)value;
+}
+static u64 uptr_to_u64(void __user *ptr)
+{
+        if (is_compat_task())
+                return ptr_to_compat(ptr);
+        else
+                return (u64)(unsigned long)ptr;
+}
+#else
+static inline void __user *u64_to_uptr(u64 value)
 {
        return (void __user *)(unsigned long)value;
 }
-static inline __u64 uptr_to_u64(void __user *ptr)
+static inline u64 uptr_to_u64(void __user *ptr)
 {
-        return (__u64)(unsigned long)ptr;
+        return (u64)(unsigned long)ptr;
 }
+#endif /* CONFIG_COMPAT */
 static int fw_device_op_open(struct inode *inode, struct file *file)
 {
diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index 8ba7f7928f1f..f3b890da1e87 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -455,15 +455,20 @@ static struct device_attribute fw_device_attributes[] = {
 static int read_rom(struct fw_device *device,
                    int generation, int index, u32 *data)
 {
-        int rcode;
+        u64 offset = (CSR_REGISTER_BASE | CSR_CONFIG_ROM) + index * 4;
+        int i, rcode;
        /* device->node_id, accessed below, must not be older than generation */
        smp_rmb();
-        rcode = fw_run_transaction(device->card, TCODE_READ_QUADLET_REQUEST,
+        for (i = 10; i < 100; i += 10) {
-                        device->node_id, generation, device->max_speed,
+                rcode = fw_run_transaction(device->card,
-                        (CSR_REGISTER_BASE | CSR_CONFIG_ROM) + index * 4,
+                                TCODE_READ_QUADLET_REQUEST, device->node_id,
-                        data, 4);
+                                generation, device->max_speed, offset, data, 4);
+                if (rcode != RCODE_BUSY)
+                        break;
+                msleep(i);
+        }
        be32_to_cpus(data);
        return rcode;
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index bcf792fac442..57cd3a406edf 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2179,8 +2179,13 @@ static int ohci_enable(struct fw_card *card,
                        ohci_driver_name, ohci)) {
                fw_error("Failed to allocate interrupt %d.\n", dev->irq);
                pci_disable_msi(dev);
-                dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
-                                  ohci->config_rom, ohci->config_rom_bus);
+                if (config_rom) {
+                        dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
+                                          ohci->next_config_rom,
+                                          ohci->next_config_rom_bus);
+                        ohci->next_config_rom = NULL;
+                }
                return -EIO;
        }
diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c
index 68810fd1a59d..aa83de9db1b9 100644
--- a/drivers/firmware/google/gsmi.c
+++ b/drivers/firmware/google/gsmi.c
@@ -420,7 +420,7 @@ static efi_status_t gsmi_get_next_variable(unsigned long *name_size,
 static efi_status_t gsmi_set_variable(efi_char16_t *name,
                                      efi_guid_t *vendor,
-                                      unsigned long attr,
+                                      u32 attr,
                                      unsigned long data_size,
                                      void *data)
 {
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index a8ab6263e0d7..3c395a59da35 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -499,7 +499,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
        seq_printf(m, "Interrupts received: %d\n",
                   atomic_read(&dev_priv->irq_received));
        for (i = 0; i < I915_NUM_RINGS; i++) {
-                if (IS_GEN6(dev)) {
+                if (IS_GEN6(dev) || IS_GEN7(dev)) {
                        seq_printf(m, "Graphics Interrupt mask (%s):    %08x\n",
                                   dev_priv->ring[i].name,
                                   I915_READ_IMR(&dev_priv->ring[i]));
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index feb4f164fd1b..7916bd97d5c1 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -36,6 +36,7 @@
 #include <linux/io-mapping.h>
 #include <linux/i2c.h>
 #include <drm/intel-gtt.h>
+#include <linux/backlight.h>
 /* General customization:
 */
@@ -690,6 +691,7 @@ typedef struct drm_i915_private {
        int child_dev_num;
        struct child_device_config *child_dev;
        struct drm_connector *int_lvds_connector;
+        struct drm_connector *int_edp_connector;
        bool mchbar_need_disable;
@@ -723,6 +725,8 @@ typedef struct drm_i915_private {
        /* list of fbdev register on this device */
        struct intel_fbdev *fbdev;
+        struct backlight_device *backlight;
        struct drm_property *broadcast_rgb_property;
        struct drm_property *force_audio_property;
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 02f96fd0d52d..9cbb0cd8f46a 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2058,8 +2058,10 @@ void intel_irq_init(struct drm_device *dev)
                dev->driver->get_vblank_counter = gm45_get_vblank_counter;
        }
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
-        dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
+                dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
+        else
+                dev->driver->get_vblank_timestamp = NULL;
        dev->driver->get_scanout_position = i915_get_crtc_scanoutpos;
        if (IS_IVYBRIDGE(dev)) {
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index d1331f771e2f..542453f7498c 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -375,6 +375,7 @@
 # define MI_FLUSH_ENABLE                                (1 << 11)
 #define GFX_MODE        0x02520
+#define GFX_MODE_GEN7   0x0229c
 #define   GFX_RUN_LIST_ENABLE           (1<<15)
 #define   GFX_TLB_INVALIDATE_ALWAYS     (1<<13)
 #define   GFX_SURFACE_FAULT_ENABLE      (1<<12)
@@ -382,6 +383,9 @@
 #define   GFX_PSMI_GRANULARITY          (1<<10)
 #define   GFX_PPGTT_ENABLE              (1<<9)
+#define GFX_MODE_ENABLE(bit) (((bit) << 16) | (bit))
+#define GFX_MODE_DISABLE(bit) (((bit) << 16) | (0))
 #define SCPD0           0x0209c /* 915+ only */
 #define IER             0x020a0
 #define IIR             0x020a4
@@ -1318,6 +1322,7 @@
 #define   ADPA_PIPE_SELECT_MASK (1<<30)
 #define   ADPA_PIPE_A_SELECT    0
 #define   ADPA_PIPE_B_SELECT    (1<<30)
+#define   ADPA_PIPE_SELECT(pipe) ((pipe) << 30)
 #define   ADPA_USE_VGA_HVPOLARITY (1<<15)
 #define   ADPA_SETS_HVPOLARITY  0
 #define   ADPA_VSYNC_CNTL_DISABLE (1<<11)
@@ -1460,6 +1465,7 @@
 /* Selects pipe B for LVDS data.  Must be set on pre-965. */
 #define   LVDS_PIPEB_SELECT             (1 << 30)
 #define   LVDS_PIPE_MASK                (1 << 30)
+#define   LVDS_PIPE(pipe)               ((pipe) << 30)
 /* LVDS dithering flag on 965/g4x platform */
 #define   LVDS_ENABLE_DITHER            (1 << 25)
 /* LVDS sync polarity flags. Set to invert (i.e. negative) */
@@ -1499,9 +1505,6 @@
 #define   LVDS_B0B3_POWER_DOWN          (0 << 2)
 #define   LVDS_B0B3_POWER_UP            (3 << 2)
-#define LVDS_PIPE_ENABLED(V, P) \
-        (((V) & (LVDS_PIPE_MASK | LVDS_PORT_EN)) == ((P) << 30 | LVDS_PORT_EN))
 /* Video Data Island Packet control */
 #define VIDEO_DIP_DATA          0x61178
 #define VIDEO_DIP_CTL           0x61170
@@ -3256,14 +3259,12 @@
 #define  ADPA_CRT_HOTPLUG_VOLREF_475MV  (1<<17)
 #define  ADPA_CRT_HOTPLUG_FORCE_TRIGGER (1<<16)
-#define ADPA_PIPE_ENABLED(V, P) \
-        (((V) & (ADPA_TRANS_SELECT_MASK | ADPA_DAC_ENABLE)) == ((P) << 30 | ADPA_DAC_ENABLE))
 /* or SDVOB */
 #define HDMIB   0xe1140
 #define  PORT_ENABLE    (1 << 31)
 #define  TRANSCODER_A   (0)
 #define  TRANSCODER_B   (1 << 30)
+#define  TRANSCODER(pipe)       ((pipe) << 30)
 #define  TRANSCODER_MASK   (1 << 30)
 #define  COLOR_FORMAT_8bpc      (0)
 #define  COLOR_FORMAT_12bpc     (3 << 26)
@@ -3280,9 +3281,6 @@
 #define  HSYNC_ACTIVE_HIGH      (1 << 3)
 #define  PORT_DETECTED          (1 << 2)
-#define HDMI_PIPE_ENABLED(V, P) \
-        (((V) & (TRANSCODER_MASK | PORT_ENABLE)) == ((P) << 30 | PORT_ENABLE))
 /* PCH SDVOB multiplex with HDMIB */
 #define PCH_SDVOB       HDMIB
@@ -3349,6 +3347,7 @@
 #define  PORT_TRANS_B_SEL_CPT   (1<<29)
 #define  PORT_TRANS_C_SEL_CPT   (2<<29)
 #define  PORT_TRANS_SEL_MASK    (3<<29)
+#define  PORT_TRANS_SEL_CPT(pipe)       ((pipe) << 29)
 #define TRANS_DP_CTL_A          0xe0300
 #define TRANS_DP_CTL_B          0xe1300
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 87677d60d0df..f10742359ec9 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -871,7 +871,8 @@ int i915_restore_state(struct drm_device *dev)
        }
        mutex_unlock(&dev->struct_mutex);
-        intel_init_clock_gating(dev);
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                intel_init_clock_gating(dev);
        if (IS_IRONLAKE_M(dev)) {
                ironlake_enable_drps(dev);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 35364e68a091..ee1d701317f7 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -980,8 +980,8 @@ static void assert_transcoder_disabled(struct drm_i915_private *dev_priv,
             pipe_name(pipe));
 }
-static bool dp_pipe_enabled(struct drm_i915_private *dev_priv, enum pipe pipe,
+static bool dp_pipe_enabled(struct drm_i915_private *dev_priv,
-                            int reg, u32 port_sel, u32 val)
+                            enum pipe pipe, u32 port_sel, u32 val)
 {
        if ((val & DP_PORT_EN) == 0)
                return false;
@@ -998,11 +998,58 @@ static bool dp_pipe_enabled(struct drm_i915_private *dev_priv, enum pipe pipe,
        return true;
 }
+static bool hdmi_pipe_enabled(struct drm_i915_private *dev_priv,
+                              enum pipe pipe, u32 val)
+{
+        if ((val & PORT_ENABLE) == 0)
+                return false;
+        if (HAS_PCH_CPT(dev_priv->dev)) {
+                if ((val & PORT_TRANS_SEL_MASK) != PORT_TRANS_SEL_CPT(pipe))
+                        return false;
+        } else {
+                if ((val & TRANSCODER_MASK) != TRANSCODER(pipe))
+                        return false;
+        }
+        return true;
+}
+static bool lvds_pipe_enabled(struct drm_i915_private *dev_priv,
+                              enum pipe pipe, u32 val)
+{
+        if ((val & LVDS_PORT_EN) == 0)
+                return false;
+        if (HAS_PCH_CPT(dev_priv->dev)) {
+                if ((val & PORT_TRANS_SEL_MASK) != PORT_TRANS_SEL_CPT(pipe))
+                        return false;
+        } else {
+                if ((val & LVDS_PIPE_MASK) != LVDS_PIPE(pipe))
+                        return false;
+        }
+        return true;
+}
+static bool adpa_pipe_enabled(struct drm_i915_private *dev_priv,
+                              enum pipe pipe, u32 val)
+{
+        if ((val & ADPA_DAC_ENABLE) == 0)
+                return false;
+        if (HAS_PCH_CPT(dev_priv->dev)) {
+                if ((val & PORT_TRANS_SEL_MASK) != PORT_TRANS_SEL_CPT(pipe))
+                        return false;
+        } else {
+                if ((val & ADPA_PIPE_SELECT_MASK) != ADPA_PIPE_SELECT(pipe))
+                        return false;
+        }
+        return true;
+}
 static void assert_pch_dp_disabled(struct drm_i915_private *dev_priv,
                                   enum pipe pipe, int reg, u32 port_sel)
 {
        u32 val = I915_READ(reg);
-        WARN(dp_pipe_enabled(dev_priv, pipe, reg, port_sel, val),
+        WARN(dp_pipe_enabled(dev_priv, pipe, port_sel, val),
             "PCH DP (0x%08x) enabled on transcoder %c, should be disabled\n",
             reg, pipe_name(pipe));
 }
@@ -1011,7 +1058,7 @@ static void assert_pch_hdmi_disabled(struct drm_i915_private *dev_priv,
                                     enum pipe pipe, int reg)
 {
        u32 val = I915_READ(reg);
-        WARN(HDMI_PIPE_ENABLED(val, pipe),
+        WARN(hdmi_pipe_enabled(dev_priv, val, pipe),
             "PCH DP (0x%08x) enabled on transcoder %c, should be disabled\n",
             reg, pipe_name(pipe));
 }
@@ -1028,13 +1075,13 @@ static void assert_pch_ports_disabled(struct drm_i915_private *dev_priv,
        reg = PCH_ADPA;
        val = I915_READ(reg);
-        WARN(ADPA_PIPE_ENABLED(val, pipe),
+        WARN(adpa_pipe_enabled(dev_priv, val, pipe),
             "PCH VGA enabled on transcoder %c, should be disabled\n",
             pipe_name(pipe));
        reg = PCH_LVDS;
        val = I915_READ(reg);
-        WARN(LVDS_PIPE_ENABLED(val, pipe),
+        WARN(lvds_pipe_enabled(dev_priv, val, pipe),
             "PCH LVDS enabled on transcoder %c, should be disabled\n",
             pipe_name(pipe));
@@ -1360,7 +1407,7 @@ static void disable_pch_dp(struct drm_i915_private *dev_priv,
                           enum pipe pipe, int reg, u32 port_sel)
 {
        u32 val = I915_READ(reg);
-        if (dp_pipe_enabled(dev_priv, pipe, reg, port_sel, val)) {
+        if (dp_pipe_enabled(dev_priv, pipe, port_sel, val)) {
                DRM_DEBUG_KMS("Disabling pch dp %x on pipe %d\n", reg, pipe);
                I915_WRITE(reg, val & ~DP_PORT_EN);
        }
@@ -1370,7 +1417,7 @@ static void disable_pch_hdmi(struct drm_i915_private *dev_priv,
                             enum pipe pipe, int reg)
 {
        u32 val = I915_READ(reg);
-        if (HDMI_PIPE_ENABLED(val, pipe)) {
+        if (hdmi_pipe_enabled(dev_priv, val, pipe)) {
                DRM_DEBUG_KMS("Disabling pch HDMI %x on pipe %d\n",
                              reg, pipe);
                I915_WRITE(reg, val & ~PORT_ENABLE);
@@ -1392,12 +1439,13 @@ static void intel_disable_pch_ports(struct drm_i915_private *dev_priv,
        reg = PCH_ADPA;
        val = I915_READ(reg);
-        if (ADPA_PIPE_ENABLED(val, pipe))
+        if (adpa_pipe_enabled(dev_priv, val, pipe))
                I915_WRITE(reg, val & ~ADPA_DAC_ENABLE);
        reg = PCH_LVDS;
        val = I915_READ(reg);
-        if (LVDS_PIPE_ENABLED(val, pipe)) {
+        if (lvds_pipe_enabled(dev_priv, val, pipe)) {
+                DRM_DEBUG_KMS("disable lvds on pipe %d val 0x%08x\n", pipe, val);
                I915_WRITE(reg, val & ~LVDS_PORT_EN);
                POSTING_READ(reg);
                udelay(100);
@@ -5049,6 +5097,81 @@ static int i9xx_crtc_mode_set(struct drm_crtc *crtc,
        return ret;
 }
+static void ironlake_update_pch_refclk(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct drm_mode_config *mode_config = &dev->mode_config;
+        struct drm_crtc *crtc;
+        struct intel_encoder *encoder;
+        struct intel_encoder *has_edp_encoder = NULL;
+        u32 temp;
+        bool has_lvds = false;
+        /* We need to take the global config into account */
+        list_for_each_entry(crtc, &mode_config->crtc_list, head) {
+                if (!crtc->enabled)
+                        continue;
+                list_for_each_entry(encoder, &mode_config->encoder_list,
+                                    base.head) {
+                        if (encoder->base.crtc != crtc)
+                                continue;
+                        switch (encoder->type) {
+                        case INTEL_OUTPUT_LVDS:
+                                has_lvds = true;
+                        case INTEL_OUTPUT_EDP:
+                                has_edp_encoder = encoder;
+                                break;
+                        }
+                }
+        }
+        /* Ironlake: try to setup display ref clock before DPLL
+         * enabling. This is only under driver's control after
+         * PCH B stepping, previous chipset stepping should be
+         * ignoring this setting.
+         */
+        temp = I915_READ(PCH_DREF_CONTROL);
+        /* Always enable nonspread source */
+        temp &= ~DREF_NONSPREAD_SOURCE_MASK;
+        temp |= DREF_NONSPREAD_SOURCE_ENABLE;
+        temp &= ~DREF_SSC_SOURCE_MASK;
+        temp |= DREF_SSC_SOURCE_ENABLE;
+        I915_WRITE(PCH_DREF_CONTROL, temp);
+        POSTING_READ(PCH_DREF_CONTROL);
+        udelay(200);
+        if (has_edp_encoder) {
+                if (intel_panel_use_ssc(dev_priv)) {
+                        temp |= DREF_SSC1_ENABLE;
+                        I915_WRITE(PCH_DREF_CONTROL, temp);
+                        POSTING_READ(PCH_DREF_CONTROL);
+                        udelay(200);
+                }
+                temp &= ~DREF_CPU_SOURCE_OUTPUT_MASK;
+                /* Enable CPU source on CPU attached eDP */
+                if (!intel_encoder_is_pch_edp(&has_edp_encoder->base)) {
+                        if (intel_panel_use_ssc(dev_priv))
+                                temp |= DREF_CPU_SOURCE_OUTPUT_DOWNSPREAD;
+                        else
+                                temp |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD;
+                } else {
+                        /* Enable SSC on PCH eDP if needed */
+                        if (intel_panel_use_ssc(dev_priv)) {
+                                DRM_ERROR("enabling SSC on PCH\n");
+                                temp |= DREF_SUPERSPREAD_SOURCE_ENABLE;
+                        }
+                }
+                I915_WRITE(PCH_DREF_CONTROL, temp);
+                POSTING_READ(PCH_DREF_CONTROL);
+                udelay(200);
+        }
+}
 static int ironlake_crtc_mode_set(struct drm_crtc *crtc,
                                  struct drm_display_mode *mode,
                                  struct drm_display_mode *adjusted_mode,
@@ -5244,49 +5367,7 @@ static int ironlake_crtc_mode_set(struct drm_crtc *crtc,
        ironlake_compute_m_n(intel_crtc->bpp, lane, target_clock, link_bw,
                             &m_n);
-        /* Ironlake: try to setup display ref clock before DPLL
+        ironlake_update_pch_refclk(dev);
-         * enabling. This is only under driver's control after
-         * PCH B stepping, previous chipset stepping should be
-         * ignoring this setting.
-         */
-        temp = I915_READ(PCH_DREF_CONTROL);
-        /* Always enable nonspread source */
-        temp &= ~DREF_NONSPREAD_SOURCE_MASK;
-        temp |= DREF_NONSPREAD_SOURCE_ENABLE;
-        temp &= ~DREF_SSC_SOURCE_MASK;
-        temp |= DREF_SSC_SOURCE_ENABLE;
-        I915_WRITE(PCH_DREF_CONTROL, temp);
-        POSTING_READ(PCH_DREF_CONTROL);
-        udelay(200);
-        if (has_edp_encoder) {
-                if (intel_panel_use_ssc(dev_priv)) {
-                        temp |= DREF_SSC1_ENABLE;
-                        I915_WRITE(PCH_DREF_CONTROL, temp);
-                        POSTING_READ(PCH_DREF_CONTROL);
-                        udelay(200);
-                }
-                temp &= ~DREF_CPU_SOURCE_OUTPUT_MASK;
-                /* Enable CPU source on CPU attached eDP */
-                if (!intel_encoder_is_pch_edp(&has_edp_encoder->base)) {
-                        if (intel_panel_use_ssc(dev_priv))
-                                temp |= DREF_CPU_SOURCE_OUTPUT_DOWNSPREAD;
-                        else
-                                temp |= DREF_CPU_SOURCE_OUTPUT_NONSPREAD;
-                } else {
-                        /* Enable SSC on PCH eDP if needed */
-                        if (intel_panel_use_ssc(dev_priv)) {
-                                DRM_ERROR("enabling SSC on PCH\n");
-                                temp |= DREF_SUPERSPREAD_SOURCE_ENABLE;
-                        }
-                }
-                I915_WRITE(PCH_DREF_CONTROL, temp);
-                POSTING_READ(PCH_DREF_CONTROL);
-                udelay(200);
-        }
        fp = clock.n << 16 | clock.m1 << 8 | clock.m2;
        if (has_reduced_clock)
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 0feae908bb37..44fef5e1c490 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1841,6 +1841,11 @@ done:
 static void
 intel_dp_destroy (struct drm_connector *connector)
 {
+        struct drm_device *dev = connector->dev;
+        if (intel_dpd_is_edp(dev))
+                intel_panel_destroy_backlight(dev);
        drm_sysfs_connector_remove(connector);
        drm_connector_cleanup(connector);
        kfree(connector);
@@ -2072,6 +2077,8 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                                        DRM_MODE_TYPE_PREFERRED;
                        }
                }
+                dev_priv->int_edp_connector = connector;
+                intel_panel_setup_backlight(dev);
        }
        intel_dp_add_properties(intel_dp, connector);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 7b330e76a435..0b2ee9d39980 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -297,9 +297,10 @@ extern void intel_pch_panel_fitting(struct drm_device *dev,
 extern u32 intel_panel_get_max_backlight(struct drm_device *dev);
 extern u32 intel_panel_get_backlight(struct drm_device *dev);
 extern void intel_panel_set_backlight(struct drm_device *dev, u32 level);
-extern void intel_panel_setup_backlight(struct drm_device *dev);
+extern int intel_panel_setup_backlight(struct drm_device *dev);
 extern void intel_panel_enable_backlight(struct drm_device *dev);
 extern void intel_panel_disable_backlight(struct drm_device *dev);
+extern void intel_panel_destroy_backlight(struct drm_device *dev);
 extern enum drm_connector_status intel_panel_detect(struct drm_device *dev);
 extern void intel_crtc_load_lut(struct drm_crtc *crtc);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 2e8ddfcba40c..31da77f5c051 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -72,14 +72,16 @@ static void intel_lvds_enable(struct intel_lvds *intel_lvds)
 {
        struct drm_device *dev = intel_lvds->base.base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        u32 ctl_reg, lvds_reg;
+        u32 ctl_reg, lvds_reg, stat_reg;
        if (HAS_PCH_SPLIT(dev)) {
                ctl_reg = PCH_PP_CONTROL;
                lvds_reg = PCH_LVDS;
+                stat_reg = PCH_PP_STATUS;
        } else {
                ctl_reg = PP_CONTROL;
                lvds_reg = LVDS;
+                stat_reg = PP_STATUS;
        }
        I915_WRITE(lvds_reg, I915_READ(lvds_reg) | LVDS_PORT_EN);
@@ -94,17 +96,16 @@ static void intel_lvds_enable(struct intel_lvds *intel_lvds)
                DRM_DEBUG_KMS("applying panel-fitter: %x, %x\n",
                              intel_lvds->pfit_control,
                              intel_lvds->pfit_pgm_ratios);
-                if (wait_for((I915_READ(PP_STATUS) & PP_ON) == 0, 1000)) {
-                        DRM_ERROR("timed out waiting for panel to power off\n");
+                I915_WRITE(PFIT_PGM_RATIOS, intel_lvds->pfit_pgm_ratios);
-                } else {
+                I915_WRITE(PFIT_CONTROL, intel_lvds->pfit_control);
-                        I915_WRITE(PFIT_PGM_RATIOS, intel_lvds->pfit_pgm_ratios);
+                intel_lvds->pfit_dirty = false;
-                        I915_WRITE(PFIT_CONTROL, intel_lvds->pfit_control);
-                        intel_lvds->pfit_dirty = false;
-                }
        }
        I915_WRITE(ctl_reg, I915_READ(ctl_reg) | POWER_TARGET_ON);
        POSTING_READ(lvds_reg);
+        if (wait_for((I915_READ(stat_reg) & PP_ON) != 0, 1000))
+                DRM_ERROR("timed out waiting for panel to power on\n");
        intel_panel_enable_backlight(dev);
 }
@@ -113,24 +114,25 @@ static void intel_lvds_disable(struct intel_lvds *intel_lvds)
 {
        struct drm_device *dev = intel_lvds->base.base.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        u32 ctl_reg, lvds_reg;
+        u32 ctl_reg, lvds_reg, stat_reg;
        if (HAS_PCH_SPLIT(dev)) {
                ctl_reg = PCH_PP_CONTROL;
                lvds_reg = PCH_LVDS;
+                stat_reg = PCH_PP_STATUS;
        } else {
                ctl_reg = PP_CONTROL;
                lvds_reg = LVDS;
+                stat_reg = PP_STATUS;
        }
        intel_panel_disable_backlight(dev);
        I915_WRITE(ctl_reg, I915_READ(ctl_reg) & ~POWER_TARGET_ON);
+        if (wait_for((I915_READ(stat_reg) & PP_ON) == 0, 1000))
+                DRM_ERROR("timed out waiting for panel to power off\n");
        if (intel_lvds->pfit_control) {
-                if (wait_for((I915_READ(PP_STATUS) & PP_ON) == 0, 1000))
-                        DRM_ERROR("timed out waiting for panel to power off\n");
                I915_WRITE(PFIT_CONTROL, 0);
                intel_lvds->pfit_dirty = true;
        }
@@ -398,53 +400,21 @@ out:
 static void intel_lvds_prepare(struct drm_encoder *encoder)
 {
-        struct drm_device *dev = encoder->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_lvds *intel_lvds = to_intel_lvds(encoder);
-        /* We try to do the minimum that is necessary in order to unlock
+        /*
-         * the registers for mode setting.
-         *
-         * On Ironlake, this is quite simple as we just set the unlock key
-         * and ignore all subtleties. (This may cause some issues...)
-         *
         * Prior to Ironlake, we must disable the pipe if we want to adjust
         * the panel fitter. However at all other times we can just reset
         * the registers regardless.
         */
+        if (!HAS_PCH_SPLIT(encoder->dev) && intel_lvds->pfit_dirty)
-        if (HAS_PCH_SPLIT(dev)) {
+                intel_lvds_disable(intel_lvds);
-                I915_WRITE(PCH_PP_CONTROL,
-                           I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
-        } else if (intel_lvds->pfit_dirty) {
-                I915_WRITE(PP_CONTROL,
-                           (I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS)
-                           & ~POWER_TARGET_ON);
-        } else {
-                I915_WRITE(PP_CONTROL,
-                           I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
-        }
 }
 static void intel_lvds_commit(struct drm_encoder *encoder)
 {
-        struct drm_device *dev = encoder->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_lvds *intel_lvds = to_intel_lvds(encoder);
-        /* Undo any unlocking done in prepare to prevent accidental
-         * adjustment of the registers.
-         */
-        if (HAS_PCH_SPLIT(dev)) {
-                u32 val = I915_READ(PCH_PP_CONTROL);
-                if ((val & PANEL_UNLOCK_REGS) == PANEL_UNLOCK_REGS)
-                        I915_WRITE(PCH_PP_CONTROL, val & 0x3);
-        } else {
-                u32 val = I915_READ(PP_CONTROL);
-                if ((val & PANEL_UNLOCK_REGS) == PANEL_UNLOCK_REGS)
-                        I915_WRITE(PP_CONTROL, val & 0x3);
-        }
        /* Always do a full power on as we do not know what state
         * we were left in.
         */
@@ -582,6 +552,8 @@ static void intel_lvds_destroy(struct drm_connector *connector)
        struct drm_device *dev = connector->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
+        intel_panel_destroy_backlight(dev);
        if (dev_priv->lid_notifier.notifier_call)
                acpi_lid_notifier_unregister(&dev_priv->lid_notifier);
        drm_sysfs_connector_remove(connector);
@@ -1040,6 +1012,19 @@ out:
                pwm = I915_READ(BLC_PWM_PCH_CTL1);
                pwm |= PWM_PCH_ENABLE;
                I915_WRITE(BLC_PWM_PCH_CTL1, pwm);
+                /*
+                 * Unlock registers and just
+                 * leave them unlocked
+                 */
+                I915_WRITE(PCH_PP_CONTROL,
+                           I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
+        } else {
+                /*
+                 * Unlock registers and just
+                 * leave them unlocked
+                 */
+                I915_WRITE(PP_CONTROL,
+                           I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
        }
        dev_priv->lid_notifier.notifier_call = intel_lid_notify;
        if (acpi_lid_notifier_register(&dev_priv->lid_notifier)) {
@@ -1049,6 +1034,9 @@ out:
        /* keep the LVDS connector */
        dev_priv->int_lvds_connector = connector;
        drm_sysfs_connector_add(connector);
+        intel_panel_setup_backlight(dev);
        return true;
 failed:
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index b7c5ddb564d1..b8e8158bb16e 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -227,7 +227,6 @@ void intel_opregion_asle_intr(struct drm_device *dev)
        asle->aslc = asle_stat;
 }
-/* Only present on Ironlake+ */
 void intel_opregion_gse_intr(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 05f500cd9c24..a9e0c7bcd317 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -277,7 +277,7 @@ void intel_panel_enable_backlight(struct drm_device *dev)
        dev_priv->backlight_enabled = true;
 }
-void intel_panel_setup_backlight(struct drm_device *dev)
+static void intel_panel_init_backlight(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
@@ -309,3 +309,73 @@ intel_panel_detect(struct drm_device *dev)
        return connector_status_unknown;
 }
+#ifdef CONFIG_BACKLIGHT_CLASS_DEVICE
+static int intel_panel_update_status(struct backlight_device *bd)
+{
+        struct drm_device *dev = bl_get_data(bd);
+        intel_panel_set_backlight(dev, bd->props.brightness);
+        return 0;
+}
+static int intel_panel_get_brightness(struct backlight_device *bd)
+{
+        struct drm_device *dev = bl_get_data(bd);
+        return intel_panel_get_backlight(dev);
+}
+static const struct backlight_ops intel_panel_bl_ops = {
+        .update_status = intel_panel_update_status,
+        .get_brightness = intel_panel_get_brightness,
+};
+int intel_panel_setup_backlight(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct backlight_properties props;
+        struct drm_connector *connector;
+        intel_panel_init_backlight(dev);
+        if (dev_priv->int_lvds_connector)
+                connector = dev_priv->int_lvds_connector;
+        else if (dev_priv->int_edp_connector)
+                connector = dev_priv->int_edp_connector;
+        else
+                return -ENODEV;
+        props.type = BACKLIGHT_RAW;
+        props.max_brightness = intel_panel_get_max_backlight(dev);
+        dev_priv->backlight =
+                backlight_device_register("intel_backlight",
+                                          &connector->kdev, dev,
+                                          &intel_panel_bl_ops, &props);
+        if (IS_ERR(dev_priv->backlight)) {
+                DRM_ERROR("Failed to register backlight: %ld\n",
+                          PTR_ERR(dev_priv->backlight));
+                dev_priv->backlight = NULL;
+                return -ENODEV;
+        }
+        dev_priv->backlight->props.brightness = intel_panel_get_backlight(dev);
+        return 0;
+}
+void intel_panel_destroy_backlight(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (dev_priv->backlight)
+                backlight_device_unregister(dev_priv->backlight);
+}
+#else
+int intel_panel_setup_backlight(struct drm_device *dev)
+{
+        intel_panel_init_backlight(dev);
+        return 0;
+}
+void intel_panel_destroy_backlight(struct drm_device *dev)
+{
+        return;
+}
+#endif
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 47b9b2777038..c30626ea9f93 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -290,6 +290,10 @@ static int init_render_ring(struct intel_ring_buffer *ring)
                if (IS_GEN6(dev) || IS_GEN7(dev))
                        mode |= MI_FLUSH_ENABLE << 16 | MI_FLUSH_ENABLE;
                I915_WRITE(MI_MODE, mode);
+                if (IS_GEN7(dev))
+                        I915_WRITE(GFX_MODE_GEN7,
+                                   GFX_MODE_DISABLE(GFX_TLB_INVALIDATE_ALWAYS) |
+                                   GFX_MODE_ENABLE(GFX_REPLAY_MODE));
        }
        if (INTEL_INFO(dev)->gen >= 6) {
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 645b84b3d203..7ad43c6b1db7 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -613,6 +613,18 @@ static bool radeon_dp_get_link_status(struct radeon_connector *radeon_connector,
        return true;
 }
+bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector)
+{
+        u8 link_status[DP_LINK_STATUS_SIZE];
+        struct radeon_connector_atom_dig *dig = radeon_connector->con_priv;
+        if (!radeon_dp_get_link_status(radeon_connector, link_status))
+                return false;
+        if (dp_channel_eq_ok(link_status, dig->dp_lane_count))
+                return false;
+        return true;
+}
 struct radeon_dp_link_train_info {
        struct radeon_device *rdev;
        struct drm_encoder *encoder;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 14dce9f22172..fb5fa0898868 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -743,7 +743,7 @@ static void evergreen_program_watermarks(struct radeon_device *rdev,
                    !evergreen_average_bandwidth_vs_available_bandwidth(&wm) ||
                    !evergreen_check_latency_hiding(&wm) ||
                    (rdev->disp_priority == 2)) {
-                        DRM_INFO("force priority to high\n");
+                        DRM_DEBUG_KMS("force priority to high\n");
                        priority_a_cnt |= PRIORITY_ALWAYS_ON;
                        priority_b_cnt |= PRIORITY_ALWAYS_ON;
                }
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 6d6b5f16bc09..4f0c1ecac72e 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -60,18 +60,20 @@ void radeon_connector_hotplug(struct drm_connector *connector)
        radeon_hpd_set_polarity(rdev, radeon_connector->hpd.hpd);
-        /* powering up/down the eDP panel generates hpd events which
+        /* if the connector is already off, don't turn it back on */
-         * can interfere with modesetting.
+        if (connector->dpms != DRM_MODE_DPMS_ON)
-         */
-        if (connector->connector_type == DRM_MODE_CONNECTOR_eDP)
                return;
-        /* pre-r600 did not always have the hpd pins mapped accurately to connectors */
+        /* just deal with DP (not eDP) here. */
-        if (rdev->family >= CHIP_R600) {
+        if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) {
-                if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd))
+                int saved_dpms = connector->dpms;
+                if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) &&
+                    radeon_dp_needs_link_train(radeon_connector))
                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
                else
                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+                connector->dpms = saved_dpms;
        }
 }
@@ -464,6 +466,16 @@ static bool radeon_connector_needs_extended_probe(struct radeon_device *dev,
                    (supported_device == ATOM_DEVICE_DFP2_SUPPORT))
                        return true;
        }
+        /* TOSHIBA Satellite L300D with ATI Mobility Radeon x1100
+         * (RS690M) sends data to i2c bus for a HDMI connector that
+         * is not implemented */
+        if ((dev->pdev->device == 0x791f) &&
+            (dev->pdev->subsystem_vendor == 0x1179) &&
+            (dev->pdev->subsystem_device == 0xff68)) {
+                if ((connector_type == DRM_MODE_CONNECTOR_HDMIA) &&
+                    (supported_device == ATOM_DEVICE_DFP2_SUPPORT))
+                        return true;
+        }
        /* Default: no EDID header probe required for DDC probing */
        return false;
@@ -474,11 +486,19 @@ static void radeon_fixup_lvds_native_mode(struct drm_encoder *encoder,
 {
        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
        struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
+        struct drm_display_mode *t, *mode;
+        /* If the EDID preferred mode doesn't match the native mode, use it */
+        list_for_each_entry_safe(mode, t, &connector->probed_modes, head) {
+                if (mode->type & DRM_MODE_TYPE_PREFERRED) {
+                        if (mode->hdisplay != native_mode->hdisplay ||
+                            mode->vdisplay != native_mode->vdisplay)
+                                memcpy(native_mode, mode, sizeof(*mode));
+                }
+        }
        /* Try to get native mode details from EDID if necessary */
        if (!native_mode->clock) {
-                struct drm_display_mode *t, *mode;
                list_for_each_entry_safe(mode, t, &connector->probed_modes, head) {
                        if (mode->hdisplay == native_mode->hdisplay &&
                            mode->vdisplay == native_mode->vdisplay) {
@@ -489,6 +509,7 @@ static void radeon_fixup_lvds_native_mode(struct drm_encoder *encoder,
                        }
                }
        }
        if (!native_mode->clock) {
                DRM_DEBUG_KMS("No LVDS native mode details, disabling RMX\n");
                radeon_encoder->rmx_type = RMX_OFF;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 440e6ecccc40..b51e15725c6e 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -32,6 +32,7 @@
 #include <drm/radeon_drm.h>
 #include <linux/vgaarb.h>
 #include <linux/vga_switcheroo.h>
+#include <linux/efi.h>
 #include "radeon_reg.h"
 #include "radeon.h"
 #include "atom.h"
@@ -300,6 +301,8 @@ void radeon_vram_location(struct radeon_device *rdev, struct radeon_mc *mc, u64
                mc->mc_vram_size = mc->aper_size;
        }
        mc->vram_end = mc->vram_start + mc->mc_vram_size - 1;
+        if (radeon_vram_limit && radeon_vram_limit < mc->real_vram_size)
+                mc->real_vram_size = radeon_vram_limit;
        dev_info(rdev->dev, "VRAM: %lluM 0x%016llX - 0x%016llX (%lluM used)\n",
                        mc->mc_vram_size >> 20, mc->vram_start,
                        mc->vram_end, mc->real_vram_size >> 20);
@@ -348,6 +351,9 @@ bool radeon_card_posted(struct radeon_device *rdev)
 {
        uint32_t reg;
+        if (efi_enabled && rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE)
+                return false;
        /* first check CRTCs */
        if (ASIC_IS_DCE41(rdev)) {
                reg = RREG32(EVERGREEN_CRTC_CONTROL + EVERGREEN_CRTC0_REGISTER_OFFSET) |
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index b293487e5aa3..319d85d7e759 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -2323,6 +2323,9 @@ radeon_add_atom_encoder(struct drm_device *dev,
        default:
                encoder->possible_crtcs = 0x3;
                break;
+        case 4:
+                encoder->possible_crtcs = 0xf;
+                break;
        case 6:
                encoder->possible_crtcs = 0x3f;
                break;
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index d09031c03e26..68820f5f6303 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -479,6 +479,7 @@ extern void radeon_dp_set_link_config(struct drm_connector *connector,
                                      struct drm_display_mode *mode);
 extern void radeon_dp_link_train(struct drm_encoder *encoder,
                                 struct drm_connector *connector);
+extern bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector);
 extern u8 radeon_dp_getsinktype(struct radeon_connector *radeon_connector);
 extern bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector);
 extern void atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mode);
diff --git a/drivers/gpu/drm/radeon/radeon_test.c b/drivers/gpu/drm/radeon/radeon_test.c
index dee4a0c1b4b2..602fa3541c45 100644
--- a/drivers/gpu/drm/radeon/radeon_test.c
+++ b/drivers/gpu/drm/radeon/radeon_test.c
@@ -40,10 +40,14 @@ void radeon_test_moves(struct radeon_device *rdev)
        size = 1024 * 1024;
        /* Number of tests =
-         * (Total GTT - IB pool - writeback page - ring buffer) / test size
+         * (Total GTT - IB pool - writeback page - ring buffers) / test size
         */
-        n = ((u32)(rdev->mc.gtt_size - RADEON_IB_POOL_SIZE*64*1024 - RADEON_GPU_PAGE_SIZE -
+        n = rdev->mc.gtt_size - RADEON_IB_POOL_SIZE*64*1024 - rdev->cp.ring_size;
-             rdev->cp.ring_size)) / size;
+        if (rdev->wb.wb_obj)
+                n -= RADEON_GPU_PAGE_SIZE;
+        if (rdev->ih.ring_obj)
+                n -= rdev->ih.ring_size;
+        n /= size;
        gtt_obj = kzalloc(n * sizeof(*gtt_obj), GFP_KERNEL);
        if (!gtt_obj) {
@@ -132,9 +136,15 @@ void radeon_test_moves(struct radeon_device *rdev)
                     gtt_start++, vram_start++) {
                        if (*vram_start != gtt_start) {
                                DRM_ERROR("Incorrect GTT->VRAM copy %d: Got 0x%p, "
-                                          "expected 0x%p (GTT map 0x%p-0x%p)\n",
+                                          "expected 0x%p (GTT/VRAM offset "
-                                          i, *vram_start, gtt_start, gtt_map,
+                                          "0x%16llx/0x%16llx)\n",
-                                          gtt_end);
+                                          i, *vram_start, gtt_start,
+                                          (unsigned long long)
+                                          (gtt_addr - rdev->mc.gtt_start +
+                                           (void*)gtt_start - gtt_map),
+                                          (unsigned long long)
+                                          (vram_addr - rdev->mc.vram_start +
+                                           (void*)gtt_start - gtt_map));
                                radeon_bo_kunmap(vram_obj);
                                goto out_cleanup;
                        }
@@ -175,9 +185,15 @@ void radeon_test_moves(struct radeon_device *rdev)
                     gtt_start++, vram_start++) {
                        if (*gtt_start != vram_start) {
                                DRM_ERROR("Incorrect VRAM->GTT copy %d: Got 0x%p, "
-                                          "expected 0x%p (VRAM map 0x%p-0x%p)\n",
+                                          "expected 0x%p (VRAM/GTT offset "
-                                          i, *gtt_start, vram_start, vram_map,
+                                          "0x%16llx/0x%16llx)\n",
-                                          vram_end);
+                                          i, *gtt_start, vram_start,
+                                          (unsigned long long)
+                                          (vram_addr - rdev->mc.vram_start +
+                                           (void*)vram_start - vram_map),
+                                          (unsigned long long)
+                                          (gtt_addr - rdev->mc.gtt_start +
+                                           (void*)vram_start - vram_map));
                                radeon_bo_kunmap(gtt_obj[i]);
                                goto out_cleanup;
                        }
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 60125ddba1e9..9b86fb0e4122 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -450,6 +450,29 @@ static int radeon_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_mem_
                        return -EINVAL;
                mem->bus.base = rdev->mc.aper_base;
                mem->bus.is_iomem = true;
+#ifdef __alpha__
+                /*
+                 * Alpha: use bus.addr to hold the ioremap() return,
+                 * so we can modify bus.base below.
+                 */
+                if (mem->placement & TTM_PL_FLAG_WC)
+                        mem->bus.addr =
+                                ioremap_wc(mem->bus.base + mem->bus.offset,
+                                           mem->bus.size);
+                else
+                        mem->bus.addr =
+                                ioremap_nocache(mem->bus.base + mem->bus.offset,
+                                                mem->bus.size);
+                /*
+                 * Alpha: Use just the bus offset plus
+                 * the hose/domain memory base for bus.base.
+                 * It then can be used to build PTEs for VRAM
+                 * access, as done in ttm_bo_vm_fault().
+                 */
+                mem->bus.base = (mem->bus.base & 0x0ffffffffUL) +
+                        rdev->ddev->hose->dense_mem_base;
+#endif
                break;
        default:
                return -EINVAL;
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 56619f64b6bf..a4d38d85909a 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -353,8 +353,10 @@ static int ttm_bo_add_ttm(struct ttm_buffer_object *bo, bool zero_alloc)
                ret = ttm_tt_set_user(bo->ttm, current,
                                      bo->buffer_start, bo->num_pages);
-                if (unlikely(ret != 0))
+                if (unlikely(ret != 0)) {
                        ttm_tt_destroy(bo->ttm);
+                        bo->ttm = NULL;
+                }
                break;
        default:
                printk(KERN_ERR TTM_PFX "Illegal buffer object type\n");
@@ -390,10 +392,12 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
         * Create and bind a ttm if required.
         */
-        if (!(new_man->flags & TTM_MEMTYPE_FLAG_FIXED) && (bo->ttm == NULL)) {
+        if (!(new_man->flags & TTM_MEMTYPE_FLAG_FIXED)) {
-                ret = ttm_bo_add_ttm(bo, false);
+                if (bo->ttm == NULL) {
-                if (ret)
+                        ret = ttm_bo_add_ttm(bo, false);
-                        goto out_err;
+                        if (ret)
+                                goto out_err;
+                }
                ret = ttm_tt_set_placement_caching(bo->ttm, mem->placement);
                if (ret)
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 77dbf408c0d0..ae3c6f5dd2b7 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -635,13 +635,13 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
                if (ret)
                        return ret;
-                ttm_bo_free_old_node(bo);
                if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) &&
                    (bo->ttm != NULL)) {
                        ttm_tt_unbind(bo->ttm);
                        ttm_tt_destroy(bo->ttm);
                        bo->ttm = NULL;
                }
+                ttm_bo_free_old_node(bo);
        } else {
                /**
                 * This should help pipeline ordinary buffer moves.
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 306b15f39c9c..1130a8987125 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -589,6 +589,7 @@ config HID_WACOM_POWER_SUPPLY
 config HID_WIIMOTE
        tristate "Nintendo Wii Remote support"
        depends on BT_HIDP
+        depends on LEDS_CLASS
        ---help---
        Support for the Nintendo Wii Remote bluetooth device.
diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index b85744fe8464..18b3bc646bf3 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -444,6 +444,12 @@ static const struct hid_device_id apple_devices[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER4_HF_JIS),
                .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN |
                        APPLE_RDESC_JIS },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_REVB_ANSI),
+                .driver_data = APPLE_HAS_FN },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_REVB_ISO),
+                .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_REVB_JIS),
+                .driver_data = APPLE_HAS_FN },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI),
                .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_ISO),
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 1a5cf0c9cfca..242353df3dc4 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1340,6 +1340,9 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5_ISO) },
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5_JIS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_REVB_ANSI) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_REVB_ISO) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_REVB_JIS) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
        { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index db63ccf21cc8..7d27d2b0445a 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -109,6 +109,9 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI    0x0245
 #define USB_DEVICE_ID_APPLE_WELLSPRING5_ISO     0x0246
 #define USB_DEVICE_ID_APPLE_WELLSPRING5_JIS     0x0247
+#define USB_DEVICE_ID_APPLE_ALU_REVB_ANSI       0x024f
+#define USB_DEVICE_ID_APPLE_ALU_REVB_ISO        0x0250
+#define USB_DEVICE_ID_APPLE_ALU_REVB_JIS        0x0251
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI  0x0239
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO   0x023a
 #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS   0x023b
@@ -576,6 +579,9 @@
 #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
 #define USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE        0x0600
+#define USB_VENDOR_ID_SIGMA_MICRO       0x1c4f
+#define USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD      0x0002
 #define USB_VENDOR_ID_SKYCABLE                  0x1223
 #define USB_DEVICE_ID_SKYCABLE_WIRELESS_PRESENTER       0x3F07
diff --git a/drivers/hid/hid-wiimote.c b/drivers/hid/hid-wiimote.c
index a594383ce03d..85a02e5f9fe8 100644
--- a/drivers/hid/hid-wiimote.c
+++ b/drivers/hid/hid-wiimote.c
@@ -10,10 +10,10 @@
 * any later version.
 */
-#include <linux/atomic.h>
 #include <linux/device.h>
 #include <linux/hid.h>
 #include <linux/input.h>
+#include <linux/leds.h>
 #include <linux/module.h>
 #include <linux/spinlock.h>
 #include "hid-ids.h"
@@ -33,9 +33,9 @@ struct wiimote_state {
 };
 struct wiimote_data {
-        atomic_t ready;
        struct hid_device *hdev;
        struct input_dev *input;
+        struct led_classdev *leds[4];
        spinlock_t qlock;
        __u8 head;
@@ -53,8 +53,15 @@ struct wiimote_data {
 #define WIIPROTO_FLAGS_LEDS (WIIPROTO_FLAG_LED1 | WIIPROTO_FLAG_LED2 | \
                                        WIIPROTO_FLAG_LED3 | WIIPROTO_FLAG_LED4)
+/* return flag for led \num */
+#define WIIPROTO_FLAG_LED(num) (WIIPROTO_FLAG_LED1 << (num - 1))
 enum wiiproto_reqs {
+        WIIPROTO_REQ_NULL = 0x0,
        WIIPROTO_REQ_LED = 0x11,
+        WIIPROTO_REQ_DRM = 0x12,
+        WIIPROTO_REQ_STATUS = 0x20,
+        WIIPROTO_REQ_RETURN = 0x22,
        WIIPROTO_REQ_DRM_K = 0x30,
 };
@@ -87,9 +94,6 @@ static __u16 wiiproto_keymap[] = {
        BTN_MODE,       /* WIIPROTO_KEY_HOME */
 };
-#define dev_to_wii(pdev) hid_get_drvdata(container_of(pdev, struct hid_device, \
-                                                                        dev))
 static ssize_t wiimote_hid_send(struct hid_device *hdev, __u8 *buffer,
                                                                size_t count)
 {
@@ -192,66 +196,96 @@ static void wiiproto_req_leds(struct wiimote_data *wdata, int leds)
        wiimote_queue(wdata, cmd, sizeof(cmd));
 }
-#define wiifs_led_show_set(num)                                         \
+/*
-static ssize_t wiifs_led_show_##num(struct device *dev,                 \
+ * Check what peripherals of the wiimote are currently
-                        struct device_attribute *attr, char *buf)       \
+ * active and select a proper DRM that supports all of
-{                                                                       \
+ * the requested data inputs.
-        struct wiimote_data *wdata = dev_to_wii(dev);                   \
+ */
-        unsigned long flags;                                            \
+static __u8 select_drm(struct wiimote_data *wdata)
-        int state;                                                      \
+{
-                                                                        \
+        return WIIPROTO_REQ_DRM_K;
-        if (!atomic_read(&wdata->ready))                                \
+}
-                return -EBUSY;                                          \
-                                                                        \
+static void wiiproto_req_drm(struct wiimote_data *wdata, __u8 drm)
-        spin_lock_irqsave(&wdata->state.lock, flags);                   \
+{
-        state = !!(wdata->state.flags & WIIPROTO_FLAG_LED##num);        \
+        __u8 cmd[3];
-        spin_unlock_irqrestore(&wdata->state.lock, flags);              \
-                                                                        \
+        if (drm == WIIPROTO_REQ_NULL)
-        return sprintf(buf, "%d\n", state);                             \
+                drm = select_drm(wdata);
-}                                                                       \
-static ssize_t wiifs_led_set_##num(struct device *dev,                  \
+        cmd[0] = WIIPROTO_REQ_DRM;
-        struct device_attribute *attr, const char *buf, size_t count)   \
+        cmd[1] = 0;
-{                                                                       \
+        cmd[2] = drm;
-        struct wiimote_data *wdata = dev_to_wii(dev);                   \
-        int tmp = simple_strtoul(buf, NULL, 10);                        \
+        wiimote_queue(wdata, cmd, sizeof(cmd));
-        unsigned long flags;                                            \
+}
-        __u8 state;                                                     \
-                                                                        \
+static enum led_brightness wiimote_leds_get(struct led_classdev *led_dev)
-        if (!atomic_read(&wdata->ready))                                \
+{
-                return -EBUSY;                                          \
+        struct wiimote_data *wdata;
-                                                                        \
+        struct device *dev = led_dev->dev->parent;
-        spin_lock_irqsave(&wdata->state.lock, flags);                   \
+        int i;
-                                                                        \
+        unsigned long flags;
-        state = wdata->state.flags;                                     \
+        bool value = false;
-                                                                        \
-        if (tmp)                                                        \
+        wdata = hid_get_drvdata(container_of(dev, struct hid_device, dev));
-                wiiproto_req_leds(wdata, state | WIIPROTO_FLAG_LED##num);\
-        else                                                            \
+        for (i = 0; i < 4; ++i) {
-                wiiproto_req_leds(wdata, state & ~WIIPROTO_FLAG_LED##num);\
+                if (wdata->leds[i] == led_dev) {
-                                                                        \
+                        spin_lock_irqsave(&wdata->state.lock, flags);
-        spin_unlock_irqrestore(&wdata->state.lock, flags);              \
+                        value = wdata->state.flags & WIIPROTO_FLAG_LED(i + 1);
-                                                                        \
+                        spin_unlock_irqrestore(&wdata->state.lock, flags);
-        return count;                                                   \
+                        break;
-}                                                                       \
+                }
-static DEVICE_ATTR(led##num, S_IRUGO | S_IWUSR, wiifs_led_show_##num,   \
+        }
-                                                wiifs_led_set_##num)
+        return value ? LED_FULL : LED_OFF;
-wiifs_led_show_set(1);
+}
-wiifs_led_show_set(2);
-wiifs_led_show_set(3);
+static void wiimote_leds_set(struct led_classdev *led_dev,
-wiifs_led_show_set(4);
+                                                enum led_brightness value)
+{
+        struct wiimote_data *wdata;
+        struct device *dev = led_dev->dev->parent;
+        int i;
+        unsigned long flags;
+        __u8 state, flag;
+        wdata = hid_get_drvdata(container_of(dev, struct hid_device, dev));
+        for (i = 0; i < 4; ++i) {
+                if (wdata->leds[i] == led_dev) {
+                        flag = WIIPROTO_FLAG_LED(i + 1);
+                        spin_lock_irqsave(&wdata->state.lock, flags);
+                        state = wdata->state.flags;
+                        if (value == LED_OFF)
+                                wiiproto_req_leds(wdata, state & ~flag);
+                        else
+                                wiiproto_req_leds(wdata, state | flag);
+                        spin_unlock_irqrestore(&wdata->state.lock, flags);
+                        break;
+                }
+        }
+}
 static int wiimote_input_event(struct input_dev *dev, unsigned int type,
                                                unsigned int code, int value)
 {
+        return 0;
+}
+static int wiimote_input_open(struct input_dev *dev)
+{
        struct wiimote_data *wdata = input_get_drvdata(dev);
-        if (!atomic_read(&wdata->ready))
+        return hid_hw_open(wdata->hdev);
-                return -EBUSY;
+}
-        /* smp_rmb: Make sure wdata->xy is available when wdata->ready is 1 */
-        smp_rmb();
-        return 0;
+static void wiimote_input_close(struct input_dev *dev)
+{
+        struct wiimote_data *wdata = input_get_drvdata(dev);
+        hid_hw_close(wdata->hdev);
 }
 static void handler_keys(struct wiimote_data *wdata, const __u8 *payload)
@@ -281,6 +315,26 @@ static void handler_keys(struct wiimote_data *wdata, const __u8 *payload)
        input_sync(wdata->input);
 }
+static void handler_status(struct wiimote_data *wdata, const __u8 *payload)
+{
+        handler_keys(wdata, payload);
+        /* on status reports the drm is reset so we need to resend the drm */
+        wiiproto_req_drm(wdata, WIIPROTO_REQ_NULL);
+}
+static void handler_return(struct wiimote_data *wdata, const __u8 *payload)
+{
+        __u8 err = payload[3];
+        __u8 cmd = payload[2];
+        handler_keys(wdata, payload);
+        if (err)
+                hid_warn(wdata->hdev, "Remote error %hhu on req %hhu\n", err,
+                                                                        cmd);
+}
 struct wiiproto_handler {
        __u8 id;
        size_t size;
@@ -288,6 +342,8 @@ struct wiiproto_handler {
 };
 static struct wiiproto_handler handlers[] = {
+        { .id = WIIPROTO_REQ_STATUS, .size = 6, .func = handler_status },
+        { .id = WIIPROTO_REQ_RETURN, .size = 4, .func = handler_return },
        { .id = WIIPROTO_REQ_DRM_K, .size = 2, .func = handler_keys },
        { .id = 0 }
 };
@@ -300,11 +356,6 @@ static int wiimote_hid_event(struct hid_device *hdev, struct hid_report *report,
        int i;
        unsigned long flags;
-        if (!atomic_read(&wdata->ready))
-                return -EBUSY;
-        /* smp_rmb: Make sure wdata->xy is available when wdata->ready is 1 */
-        smp_rmb();
        if (size < 1)
                return -EINVAL;
@@ -321,6 +372,58 @@ static int wiimote_hid_event(struct hid_device *hdev, struct hid_report *report,
        return 0;
 }
+static void wiimote_leds_destroy(struct wiimote_data *wdata)
+{
+        int i;
+        struct led_classdev *led;
+        for (i = 0; i < 4; ++i) {
+                if (wdata->leds[i]) {
+                        led = wdata->leds[i];
+                        wdata->leds[i] = NULL;
+                        led_classdev_unregister(led);
+                        kfree(led);
+                }
+        }
+}
+static int wiimote_leds_create(struct wiimote_data *wdata)
+{
+        int i, ret;
+        struct device *dev = &wdata->hdev->dev;
+        size_t namesz = strlen(dev_name(dev)) + 9;
+        struct led_classdev *led;
+        char *name;
+        for (i = 0; i < 4; ++i) {
+                led = kzalloc(sizeof(struct led_classdev) + namesz, GFP_KERNEL);
+                if (!led) {
+                        ret = -ENOMEM;
+                        goto err;
+                }
+                name = (void*)&led[1];
+                snprintf(name, namesz, "%s:blue:p%d", dev_name(dev), i);
+                led->name = name;
+                led->brightness = 0;
+                led->max_brightness = 1;
+                led->brightness_get = wiimote_leds_get;
+                led->brightness_set = wiimote_leds_set;
+                ret = led_classdev_register(dev, led);
+                if (ret) {
+                        kfree(led);
+                        goto err;
+                }
+                wdata->leds[i] = led;
+        }
+        return 0;
+err:
+        wiimote_leds_destroy(wdata);
+        return ret;
+}
 static struct wiimote_data *wiimote_create(struct hid_device *hdev)
 {
        struct wiimote_data *wdata;
@@ -341,6 +444,8 @@ static struct wiimote_data *wiimote_create(struct hid_device *hdev)
        input_set_drvdata(wdata->input, wdata);
        wdata->input->event = wiimote_input_event;
+        wdata->input->open = wiimote_input_open;
+        wdata->input->close = wiimote_input_close;
        wdata->input->dev.parent = &wdata->hdev->dev;
        wdata->input->id.bustype = wdata->hdev->bus;
        wdata->input->id.vendor = wdata->hdev->vendor;
@@ -362,6 +467,12 @@ static struct wiimote_data *wiimote_create(struct hid_device *hdev)
 static void wiimote_destroy(struct wiimote_data *wdata)
 {
+        wiimote_leds_destroy(wdata);
+        input_unregister_device(wdata->input);
+        cancel_work_sync(&wdata->worker);
+        hid_hw_stop(wdata->hdev);
        kfree(wdata);
 }
@@ -377,19 +488,6 @@ static int wiimote_hid_probe(struct hid_device *hdev,
                return -ENOMEM;
        }
-        ret = device_create_file(&hdev->dev, &dev_attr_led1);
-        if (ret)
-                goto err;
-        ret = device_create_file(&hdev->dev, &dev_attr_led2);
-        if (ret)
-                goto err;
-        ret = device_create_file(&hdev->dev, &dev_attr_led3);
-        if (ret)
-                goto err;
-        ret = device_create_file(&hdev->dev, &dev_attr_led4);
-        if (ret)
-                goto err;
        ret = hid_parse(hdev);
        if (ret) {
                hid_err(hdev, "HID parse failed\n");
@@ -408,9 +506,10 @@ static int wiimote_hid_probe(struct hid_device *hdev,
                goto err_stop;
        }
-        /* smp_wmb: Write wdata->xy first before wdata->ready is set to 1 */
+        ret = wiimote_leds_create(wdata);
-        smp_wmb();
+        if (ret)
-        atomic_set(&wdata->ready, 1);
+                goto err_free;
        hid_info(hdev, "New device registered\n");
        /* by default set led1 after device initialization */
@@ -420,15 +519,15 @@ static int wiimote_hid_probe(struct hid_device *hdev,
        return 0;
+err_free:
+        wiimote_destroy(wdata);
+        return ret;
 err_stop:
        hid_hw_stop(hdev);
 err:
        input_free_device(wdata->input);
-        device_remove_file(&hdev->dev, &dev_attr_led1);
+        kfree(wdata);
-        device_remove_file(&hdev->dev, &dev_attr_led2);
-        device_remove_file(&hdev->dev, &dev_attr_led3);
-        device_remove_file(&hdev->dev, &dev_attr_led4);
-        wiimote_destroy(wdata);
        return ret;
 }
@@ -437,16 +536,6 @@ static void wiimote_hid_remove(struct hid_device *hdev)
        struct wiimote_data *wdata = hid_get_drvdata(hdev);
        hid_info(hdev, "Device removed\n");
-        device_remove_file(&hdev->dev, &dev_attr_led1);
-        device_remove_file(&hdev->dev, &dev_attr_led2);
-        device_remove_file(&hdev->dev, &dev_attr_led3);
-        device_remove_file(&hdev->dev, &dev_attr_led4);
-        hid_hw_stop(hdev);
-        input_unregister_device(wdata->input);
-        cancel_work_sync(&wdata->worker);
        wiimote_destroy(wdata);
 }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 621959d5cc42..4bdb5d46c52c 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -89,6 +89,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
        { 0, 0 }
 };
diff --git a/drivers/hwmon/i5k_amb.c b/drivers/hwmon/i5k_amb.c
index c4c40be0edbf..d22f241b6a67 100644
--- a/drivers/hwmon/i5k_amb.c
+++ b/drivers/hwmon/i5k_amb.c
@@ -114,7 +114,6 @@ struct i5k_amb_data {
        void __iomem *amb_mmio;
        struct i5k_device_attribute *attrs;
        unsigned int num_attrs;
-        unsigned long chipset_id;
 };
 static ssize_t show_name(struct device *dev, struct device_attribute *devattr,
@@ -444,8 +443,6 @@ static int __devinit i5k_find_amb_registers(struct i5k_amb_data *data,
                goto out;
        }
-        data->chipset_id = devid;
        res = 0;
 out:
        pci_dev_put(pcidev);
@@ -478,23 +475,13 @@ out:
        return res;
 }
-static unsigned long i5k_channel_pci_id(struct i5k_amb_data *data,
+static struct {
-                                        unsigned long channel)
+        unsigned long err;
-{
+        unsigned long fbd0;
-        switch (data->chipset_id) {
+} chipset_ids[] __devinitdata  = {
-        case PCI_DEVICE_ID_INTEL_5000_ERR:
+        { PCI_DEVICE_ID_INTEL_5000_ERR, PCI_DEVICE_ID_INTEL_5000_FBD0 },
-                return PCI_DEVICE_ID_INTEL_5000_FBD0 + channel;
+        { PCI_DEVICE_ID_INTEL_5400_ERR, PCI_DEVICE_ID_INTEL_5400_FBD0 },
-        case PCI_DEVICE_ID_INTEL_5400_ERR:
+        { 0, 0 }
-                return PCI_DEVICE_ID_INTEL_5400_FBD0 + channel;
-        default:
-                BUG();
-        }
-}
-static unsigned long chipset_ids[] = {
-        PCI_DEVICE_ID_INTEL_5000_ERR,
-        PCI_DEVICE_ID_INTEL_5400_ERR,
-        0
 };
 #ifdef MODULE
@@ -510,8 +497,7 @@ static int __devinit i5k_amb_probe(struct platform_device *pdev)
 {
        struct i5k_amb_data *data;
        struct resource *reso;
-        int i;
+        int i, res;
-        int res = -ENODEV;
        data = kzalloc(sizeof(*data), GFP_KERNEL);
        if (!data)
@@ -520,22 +506,22 @@ static int __devinit i5k_amb_probe(struct platform_device *pdev)
        /* Figure out where the AMB registers live */
        i = 0;
        do {
-                res = i5k_find_amb_registers(data, chipset_ids[i]);
+                res = i5k_find_amb_registers(data, chipset_ids[i].err);
+                if (res == 0)
+                        break;
                i++;
-        } while (res && chipset_ids[i]);
+        } while (chipset_ids[i].err);
        if (res)
                goto err;
        /* Copy the DIMM presence map for the first two channels */
-        res = i5k_channel_probe(&data->amb_present[0],
+        res = i5k_channel_probe(&data->amb_present[0], chipset_ids[i].fbd0);
-                                i5k_channel_pci_id(data, 0));
        if (res)
                goto err;
        /* Copy the DIMM presence map for the optional second two channels */
-        i5k_channel_probe(&data->amb_present[2],
+        i5k_channel_probe(&data->amb_present[2], chipset_ids[i].fbd0 + 1);
-                          i5k_channel_pci_id(data, 1));
        /* Set up resource regions */
        reso = request_mem_region(data->amb_base, data->amb_len, DRVNAME);
diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c
index d7926f4336b5..eab11615dced 100644
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -211,8 +211,7 @@ static int lookup_comp(struct ntc_data *data,
        if (data->comp[mid].ohm <= ohm) {
                *i_low = mid;
                *i_high = mid - 1;
-        }
+        } else {
-        if (data->comp[mid].ohm > ohm) {
                *i_low = mid + 1;
                *i_high = mid;
        }
diff --git a/drivers/i2c/busses/i2c-nomadik.c b/drivers/i2c/busses/i2c-nomadik.c
index 0c731ca69f15..b228e09c5d05 100644
--- a/drivers/i2c/busses/i2c-nomadik.c
+++ b/drivers/i2c/busses/i2c-nomadik.c
@@ -146,6 +146,7 @@ struct i2c_nmk_client {
 * @stop: stop condition
 * @xfer_complete: acknowledge completion for a I2C message
 * @result: controller propogated result
+ * @regulator: pointer to i2c regulator
 * @busy: Busy doing transfer
 */
 struct nmk_i2c_dev {
@@ -417,12 +418,12 @@ static int read_i2c(struct nmk_i2c_dev *dev)
        writel(readl(dev->virtbase + I2C_IMSCR) | irq_mask,
                        dev->virtbase + I2C_IMSCR);
-        timeout = wait_for_completion_interruptible_timeout(
+        timeout = wait_for_completion_timeout(
                &dev->xfer_complete, dev->adap.timeout);
        if (timeout < 0) {
                dev_err(&dev->pdev->dev,
-                        "wait_for_completion_interruptible_timeout"
+                        "wait_for_completion_timeout"
                        "returned %d waiting for event\n", timeout);
                status = timeout;
        }
@@ -504,12 +505,12 @@ static int write_i2c(struct nmk_i2c_dev *dev)
        writel(readl(dev->virtbase + I2C_IMSCR) | irq_mask,
                        dev->virtbase + I2C_IMSCR);
-        timeout = wait_for_completion_interruptible_timeout(
+        timeout = wait_for_completion_timeout(
                &dev->xfer_complete, dev->adap.timeout);
        if (timeout < 0) {
                dev_err(&dev->pdev->dev,
-                        "wait_for_completion_interruptible_timeout"
+                        "wait_for_completion_timeout "
                        "returned %d waiting for event\n", timeout);
                status = timeout;
        }
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 1a766cf74f6b..2dfb63176856 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -1139,41 +1139,12 @@ omap_i2c_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_SUSPEND
-static int omap_i2c_suspend(struct device *dev)
-{
-        if (!pm_runtime_suspended(dev))
-                if (dev->bus && dev->bus->pm && dev->bus->pm->runtime_suspend)
-                        dev->bus->pm->runtime_suspend(dev);
-        return 0;
-}
-static int omap_i2c_resume(struct device *dev)
-{
-        if (!pm_runtime_suspended(dev))
-                if (dev->bus && dev->bus->pm && dev->bus->pm->runtime_resume)
-                        dev->bus->pm->runtime_resume(dev);
-        return 0;
-}
-static struct dev_pm_ops omap_i2c_pm_ops = {
-        .suspend = omap_i2c_suspend,
-        .resume = omap_i2c_resume,
-};
-#define OMAP_I2C_PM_OPS (&omap_i2c_pm_ops)
-#else
-#define OMAP_I2C_PM_OPS NULL
-#endif
 static struct platform_driver omap_i2c_driver = {
        .probe          = omap_i2c_probe,
        .remove         = omap_i2c_remove,
        .driver         = {
                .name   = "omap_i2c",
                .owner  = THIS_MODULE,
-                .pm     = OMAP_I2C_PM_OPS,
        },
 };
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 43f89ba0a908..fe89c4660d55 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -717,11 +717,13 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ipoib_neigh *neigh;
-        struct neighbour *n;
+        struct neighbour *n = NULL;
        unsigned long flags;
-        n = dst_get_neighbour(skb_dst(skb));
+        if (likely(skb_dst(skb)))
-        if (likely(skb_dst(skb) && n)) {
+                n = dst_get_neighbour(skb_dst(skb));
+        if (likely(n)) {
                if (unlikely(!*to_ipoib_neigh(n))) {
                        ipoib_path_lookup(skb, dev);
                        return NETDEV_TX_OK;
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index 8db008de5392..9c61b9c2c597 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -101,13 +101,17 @@ iscsi_iser_recv(struct iscsi_conn *conn,
        /* verify PDU length */
        datalen = ntoh24(hdr->dlength);
-        if (datalen != rx_data_len) {
+        if (datalen > rx_data_len || (datalen + 4) < rx_data_len) {
-                printk(KERN_ERR "iscsi_iser: datalen %d (hdr) != %d (IB) \n",
+                iser_err("wrong datalen %d (hdr), %d (IB)\n",
-                       datalen, rx_data_len);
+                        datalen, rx_data_len);
                rc = ISCSI_ERR_DATALEN;
                goto error;
        }
+        if (datalen != rx_data_len)
+                iser_dbg("aligned datalen (%d) hdr, %d (IB)\n",
+                        datalen, rx_data_len);
        /* read AHS */
        ahslen = hdr->hlength * 4;
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index 342cbc1bdaae..db6f3ce9f3bf 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -89,7 +89,7 @@
        } while (0)
 #define SHIFT_4K        12
-#define SIZE_4K (1UL << SHIFT_4K)
+#define SIZE_4K (1ULL << SHIFT_4K)
 #define MASK_4K (~(SIZE_4K-1))
                                        /* support up to 512KB in one RDMA */
diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index 5745b7fe158c..f299de6b419b 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -412,7 +412,7 @@ int iser_send_control(struct iscsi_conn *conn,
                memcpy(iser_conn->ib_conn->login_buf, task->data,
                                                        task->data_count);
                tx_dsg->addr    = iser_conn->ib_conn->login_dma;
-                tx_dsg->length  = data_seg_len;
+                tx_dsg->length  = task->data_count;
                tx_dsg->lkey    = device->mr->lkey;
                mdesc->num_sge = 2;
        }
diff --git a/drivers/input/joystick/analog.c b/drivers/input/joystick/analog.c
index 9882971827e6..358cd7ee905b 100644
--- a/drivers/input/joystick/analog.c
+++ b/drivers/input/joystick/analog.c
@@ -139,7 +139,7 @@ struct analog_port {
 #include <linux/i8253.h>
 #define GET_TIME(x)     do { if (cpu_has_tsc) rdtscl(x); else x = get_time_pit(); } while (0)
-#define DELTA(x,y)      (cpu_has_tsc ? ((y) - (x)) : ((x) - (y) + ((x) < (y) ? CLOCK_TICK_RATE / HZ : 0)))
+#define DELTA(x,y)      (cpu_has_tsc ? ((y) - (x)) : ((x) - (y) + ((x) < (y) ? PIT_TICK_RATE / HZ : 0)))
 #define TIME_NAME       (cpu_has_tsc?"TSC":"PIT")
 static unsigned int get_time_pit(void)
 {
diff --git a/drivers/input/keyboard/ep93xx_keypad.c b/drivers/input/keyboard/ep93xx_keypad.c
index c8242dd190d0..aa17e024d803 100644
--- a/drivers/input/keyboard/ep93xx_keypad.c
+++ b/drivers/input/keyboard/ep93xx_keypad.c
@@ -20,6 +20,7 @@
 * flag.
 */
+#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 #include <linux/clk.h>
diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c
index f270447ba951..a5a77915c650 100644
--- a/drivers/input/keyboard/tegra-kbc.c
+++ b/drivers/input/keyboard/tegra-kbc.c
@@ -702,7 +702,7 @@ err_iounmap:
 err_free_mem_region:
        release_mem_region(res->start, resource_size(res));
 err_free_mem:
-        input_free_device(kbc->idev);
+        input_free_device(input_dev);
        kfree(kbc);
        return err;
diff --git a/drivers/input/misc/ad714x-i2c.c b/drivers/input/misc/ad714x-i2c.c
index e21deb1baa8a..025417d74ca2 100644
--- a/drivers/input/misc/ad714x-i2c.c
+++ b/drivers/input/misc/ad714x-i2c.c
@@ -1,7 +1,7 @@
 /*
 * AD714X CapTouch Programmable Controller driver (I2C bus)
 *
- * Copyright 2009 Analog Devices Inc.
+ * Copyright 2009-2011 Analog Devices Inc.
 *
 * Licensed under the GPL-2 or later.
 */
@@ -27,54 +27,49 @@ static int ad714x_i2c_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(ad714x_i2c_pm, ad714x_i2c_suspend, ad714x_i2c_resume);
-static int ad714x_i2c_write(struct device *dev, unsigned short reg,
+static int ad714x_i2c_write(struct ad714x_chip *chip,
-                                unsigned short data)
+                            unsigned short reg, unsigned short data)
 {
-        struct i2c_client *client = to_i2c_client(dev);
+        struct i2c_client *client = to_i2c_client(chip->dev);
-        int ret = 0;
+        int error;
-        u8 *_reg = (u8 *)&reg;
-        u8 *_data = (u8 *)&data;
+        chip->xfer_buf[0] = cpu_to_be16(reg);
+        chip->xfer_buf[1] = cpu_to_be16(data);
-        u8 tx[4] = {
-                _reg[1],
+        error = i2c_master_send(client, (u8 *)chip->xfer_buf,
-                _reg[0],
+                                2 * sizeof(*chip->xfer_buf));
-                _data[1],
+        if (unlikely(error < 0)) {
-                _data[0]
+                dev_err(&client->dev, "I2C write error: %d\n", error);
-        };
+                return error;
+        }
-        ret = i2c_master_send(client, tx, 4);
-        if (ret < 0)
+        return 0;
-                dev_err(&client->dev, "I2C write error\n");
-        return ret;
 }
-static int ad714x_i2c_read(struct device *dev, unsigned short reg,
+static int ad714x_i2c_read(struct ad714x_chip *chip,
-                                unsigned short *data)
+                           unsigned short reg, unsigned short *data, size_t len)
 {
-        struct i2c_client *client = to_i2c_client(dev);
+        struct i2c_client *client = to_i2c_client(chip->dev);
-        int ret = 0;
+        int i;
-        u8 *_reg = (u8 *)&reg;
+        int error;
-        u8 *_data = (u8 *)data;
+        chip->xfer_buf[0] = cpu_to_be16(reg);
-        u8 tx[2] = {
-                _reg[1],
+        error = i2c_master_send(client, (u8 *)chip->xfer_buf,
-                _reg[0]
+                                sizeof(*chip->xfer_buf));
-        };
+        if (error >= 0)
-        u8 rx[2];
+                error = i2c_master_recv(client, (u8 *)chip->xfer_buf,
+                                        len * sizeof(*chip->xfer_buf));
-        ret = i2c_master_send(client, tx, 2);
-        if (ret >= 0)
+        if (unlikely(error < 0)) {
-                ret = i2c_master_recv(client, rx, 2);
+                dev_err(&client->dev, "I2C read error: %d\n", error);
+                return error;
-        if (unlikely(ret < 0)) {
-                dev_err(&client->dev, "I2C read error\n");
-        } else {
-                _data[0] = rx[1];
-                _data[1] = rx[0];
        }
-        return ret;
+        for (i = 0; i < len; i++)
+                data[i] = be16_to_cpu(chip->xfer_buf[i]);
+        return 0;
 }
 static int __devinit ad714x_i2c_probe(struct i2c_client *client,
diff --git a/drivers/input/misc/ad714x-spi.c b/drivers/input/misc/ad714x-spi.c
index 4120dd549305..875b50811361 100644
--- a/drivers/input/misc/ad714x-spi.c
+++ b/drivers/input/misc/ad714x-spi.c
@@ -1,12 +1,12 @@
 /*
 * AD714X CapTouch Programmable Controller driver (SPI bus)
 *
- * Copyright 2009 Analog Devices Inc.
+ * Copyright 2009-2011 Analog Devices Inc.
 *
 * Licensed under the GPL-2 or later.
 */
-#include <linux/input.h>        /* BUS_I2C */
+#include <linux/input.h>        /* BUS_SPI */
 #include <linux/module.h>
 #include <linux/spi/spi.h>
 #include <linux/pm.h>
@@ -30,30 +30,68 @@ static int ad714x_spi_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(ad714x_spi_pm, ad714x_spi_suspend, ad714x_spi_resume);
-static int ad714x_spi_read(struct device *dev, unsigned short reg,
+static int ad714x_spi_read(struct ad714x_chip *chip,
-                unsigned short *data)
+                           unsigned short reg, unsigned short *data, size_t len)
 {
-        struct spi_device *spi = to_spi_device(dev);
+        struct spi_device *spi = to_spi_device(chip->dev);
-        unsigned short tx = AD714x_SPI_CMD_PREFIX | AD714x_SPI_READ | reg;
+        struct spi_message message;
+        struct spi_transfer xfer[2];
+        int i;
+        int error;
+        spi_message_init(&message);
+        memset(xfer, 0, sizeof(xfer));
+        chip->xfer_buf[0] = cpu_to_be16(AD714x_SPI_CMD_PREFIX |
+                                        AD714x_SPI_READ | reg);
+        xfer[0].tx_buf = &chip->xfer_buf[0];
+        xfer[0].len = sizeof(chip->xfer_buf[0]);
+        spi_message_add_tail(&xfer[0], &message);
+        xfer[1].rx_buf = &chip->xfer_buf[1];
+        xfer[1].len = sizeof(chip->xfer_buf[1]) * len;
+        spi_message_add_tail(&xfer[1], &message);
+        error = spi_sync(spi, &message);
+        if (unlikely(error)) {
+                dev_err(chip->dev, "SPI read error: %d\n", error);
+                return error;
+        }
+        for (i = 0; i < len; i++)
+                data[i] = be16_to_cpu(chip->xfer_buf[i + 1]);
-        return spi_write_then_read(spi, (u8 *)&tx, 2, (u8 *)data, 2);
+        return 0;
 }
-static int ad714x_spi_write(struct device *dev, unsigned short reg,
+static int ad714x_spi_write(struct ad714x_chip *chip,
-                unsigned short data)
+                            unsigned short reg, unsigned short data)
 {
-        struct spi_device *spi = to_spi_device(dev);
+        struct spi_device *spi = to_spi_device(chip->dev);
-        unsigned short tx[2] = {
+        int error;
-                AD714x_SPI_CMD_PREFIX | reg,
-                data
+        chip->xfer_buf[0] = cpu_to_be16(AD714x_SPI_CMD_PREFIX | reg);
-        };
+        chip->xfer_buf[1] = cpu_to_be16(data);
+        error = spi_write(spi, (u8 *)chip->xfer_buf,
+                          2 * sizeof(*chip->xfer_buf));
+        if (unlikely(error)) {
+                dev_err(chip->dev, "SPI write error: %d\n", error);
+                return error;
+        }
-        return spi_write(spi, (u8 *)tx, 4);
+        return 0;
 }
 static int __devinit ad714x_spi_probe(struct spi_device *spi)
 {
        struct ad714x_chip *chip;
+        int err;
+        spi->bits_per_word = 8;
+        err = spi_setup(spi);
+        if (err < 0)
+                return err;
        chip = ad714x_probe(&spi->dev, BUS_SPI, spi->irq,
                            ad714x_spi_read, ad714x_spi_write);
diff --git a/drivers/input/misc/ad714x.c b/drivers/input/misc/ad714x.c
index c3a62c42cd28..ca42c7d2a3c7 100644
--- a/drivers/input/misc/ad714x.c
+++ b/drivers/input/misc/ad714x.c
@@ -1,7 +1,7 @@
 /*
 * AD714X CapTouch Programmable Controller driver supporting AD7142/3/7/8/7A
 *
- * Copyright 2009 Analog Devices Inc.
+ * Copyright 2009-2011 Analog Devices Inc.
 *
 * Licensed under the GPL-2 or later.
 */
@@ -59,7 +59,6 @@
 #define STAGE11_AMBIENT         0x27D
 #define PER_STAGE_REG_NUM      36
-#define STAGE_NUM              12
 #define STAGE_CFGREG_NUM       8
 #define SYS_CFGREG_NUM         8
@@ -124,27 +123,6 @@ struct ad714x_driver_data {
 * information to integrate all things which will be private data
 * of spi/i2c device
 */
-struct ad714x_chip {
-        unsigned short h_state;
-        unsigned short l_state;
-        unsigned short c_state;
-        unsigned short adc_reg[STAGE_NUM];
-        unsigned short amb_reg[STAGE_NUM];
-        unsigned short sensor_val[STAGE_NUM];
-        struct ad714x_platform_data *hw;
-        struct ad714x_driver_data *sw;
-        int irq;
-        struct device *dev;
-        ad714x_read_t read;
-        ad714x_write_t write;
-        struct mutex mutex;
-        unsigned product;
-        unsigned version;
-};
 static void ad714x_use_com_int(struct ad714x_chip *ad714x,
                                int start_stage, int end_stage)
@@ -154,13 +132,13 @@ static void ad714x_use_com_int(struct ad714x_chip *ad714x,
        mask = ((1 << (end_stage + 1)) - 1) - ((1 << start_stage) - 1);
-        ad714x->read(ad714x->dev, STG_COM_INT_EN_REG, &data);
+        ad714x->read(ad714x, STG_COM_INT_EN_REG, &data, 1);
        data |= 1 << end_stage;
-        ad714x->write(ad714x->dev, STG_COM_INT_EN_REG, data);
+        ad714x->write(ad714x, STG_COM_INT_EN_REG, data);
-        ad714x->read(ad714x->dev, STG_HIGH_INT_EN_REG, &data);
+        ad714x->read(ad714x, STG_HIGH_INT_EN_REG, &data, 1);
        data &= ~mask;
-        ad714x->write(ad714x->dev, STG_HIGH_INT_EN_REG, data);
+        ad714x->write(ad714x, STG_HIGH_INT_EN_REG, data);
 }
 static void ad714x_use_thr_int(struct ad714x_chip *ad714x,
@@ -171,13 +149,13 @@ static void ad714x_use_thr_int(struct ad714x_chip *ad714x,
        mask = ((1 << (end_stage + 1)) - 1) - ((1 << start_stage) - 1);
-        ad714x->read(ad714x->dev, STG_COM_INT_EN_REG, &data);
+        ad714x->read(ad714x, STG_COM_INT_EN_REG, &data, 1);
        data &= ~(1 << end_stage);
-        ad714x->write(ad714x->dev, STG_COM_INT_EN_REG, data);
+        ad714x->write(ad714x, STG_COM_INT_EN_REG, data);
-        ad714x->read(ad714x->dev, STG_HIGH_INT_EN_REG, &data);
+        ad714x->read(ad714x, STG_HIGH_INT_EN_REG, &data, 1);
        data |= mask;
-        ad714x->write(ad714x->dev, STG_HIGH_INT_EN_REG, data);
+        ad714x->write(ad714x, STG_HIGH_INT_EN_REG, data);
 }
 static int ad714x_cal_highest_stage(struct ad714x_chip *ad714x,
@@ -273,15 +251,16 @@ static void ad714x_slider_cal_sensor_val(struct ad714x_chip *ad714x, int idx)
        struct ad714x_slider_plat *hw = &ad714x->hw->slider[idx];
        int i;
+        ad714x->read(ad714x, CDC_RESULT_S0 + hw->start_stage,
+                        &ad714x->adc_reg[hw->start_stage],
+                        hw->end_stage - hw->start_stage + 1);
        for (i = hw->start_stage; i <= hw->end_stage; i++) {
-                ad714x->read(ad714x->dev, CDC_RESULT_S0 + i,
+                ad714x->read(ad714x, STAGE0_AMBIENT + i * PER_STAGE_REG_NUM,
-                        &ad714x->adc_reg[i]);
+                                &ad714x->amb_reg[i], 1);
-                ad714x->read(ad714x->dev,
-                                STAGE0_AMBIENT + i * PER_STAGE_REG_NUM,
+                ad714x->sensor_val[i] =
-                                &ad714x->amb_reg[i]);
+                        abs(ad714x->adc_reg[i] - ad714x->amb_reg[i]);
-                ad714x->sensor_val[i] = abs(ad714x->adc_reg[i] -
-                                ad714x->amb_reg[i]);
        }
 }
@@ -444,15 +423,16 @@ static void ad714x_wheel_cal_sensor_val(struct ad714x_chip *ad714x, int idx)
        struct ad714x_wheel_plat *hw = &ad714x->hw->wheel[idx];
        int i;
+        ad714x->read(ad714x, CDC_RESULT_S0 + hw->start_stage,
+                        &ad714x->adc_reg[hw->start_stage],
+                        hw->end_stage - hw->start_stage + 1);
        for (i = hw->start_stage; i <= hw->end_stage; i++) {
-                ad714x->read(ad714x->dev, CDC_RESULT_S0 + i,
+                ad714x->read(ad714x, STAGE0_AMBIENT + i * PER_STAGE_REG_NUM,
-                        &ad714x->adc_reg[i]);
+                                &ad714x->amb_reg[i], 1);
-                ad714x->read(ad714x->dev,
-                                STAGE0_AMBIENT + i * PER_STAGE_REG_NUM,
-                                &ad714x->amb_reg[i]);
                if (ad714x->adc_reg[i] > ad714x->amb_reg[i])
-                        ad714x->sensor_val[i] = ad714x->adc_reg[i] -
+                        ad714x->sensor_val[i] =
-                                ad714x->amb_reg[i];
+                                ad714x->adc_reg[i] - ad714x->amb_reg[i];
                else
                        ad714x->sensor_val[i] = 0;
        }
@@ -597,15 +577,16 @@ static void touchpad_cal_sensor_val(struct ad714x_chip *ad714x, int idx)
        struct ad714x_touchpad_plat *hw = &ad714x->hw->touchpad[idx];
        int i;
+        ad714x->read(ad714x, CDC_RESULT_S0 + hw->x_start_stage,
+                        &ad714x->adc_reg[hw->x_start_stage],
+                        hw->x_end_stage - hw->x_start_stage + 1);
        for (i = hw->x_start_stage; i <= hw->x_end_stage; i++) {
-                ad714x->read(ad714x->dev, CDC_RESULT_S0 + i,
+                ad714x->read(ad714x, STAGE0_AMBIENT + i * PER_STAGE_REG_NUM,
-                                &ad714x->adc_reg[i]);
+                                &ad714x->amb_reg[i], 1);
-                ad714x->read(ad714x->dev,
-                                STAGE0_AMBIENT + i * PER_STAGE_REG_NUM,
-                                &ad714x->amb_reg[i]);
                if (ad714x->adc_reg[i] > ad714x->amb_reg[i])
-                        ad714x->sensor_val[i] = ad714x->adc_reg[i] -
+                        ad714x->sensor_val[i] =
-                                ad714x->amb_reg[i];
+                                ad714x->adc_reg[i] - ad714x->amb_reg[i];
                else
                        ad714x->sensor_val[i] = 0;
        }
@@ -891,7 +872,7 @@ static int ad714x_hw_detect(struct ad714x_chip *ad714x)
 {
        unsigned short data;
-        ad714x->read(ad714x->dev, AD714X_PARTID_REG, &data);
+        ad714x->read(ad714x, AD714X_PARTID_REG, &data, 1);
        switch (data & 0xFFF0) {
        case AD7142_PARTID:
                ad714x->product = 0x7142;
@@ -940,23 +921,20 @@ static void ad714x_hw_init(struct ad714x_chip *ad714x)
        for (i = 0; i < STAGE_NUM; i++) {
                reg_base = AD714X_STAGECFG_REG + i * STAGE_CFGREG_NUM;
                for (j = 0; j < STAGE_CFGREG_NUM; j++)
-                        ad714x->write(ad714x->dev, reg_base + j,
+                        ad714x->write(ad714x, reg_base + j,
                                        ad714x->hw->stage_cfg_reg[i][j]);
        }
        for (i = 0; i < SYS_CFGREG_NUM; i++)
-                ad714x->write(ad714x->dev, AD714X_SYSCFG_REG + i,
+                ad714x->write(ad714x, AD714X_SYSCFG_REG + i,
                        ad714x->hw->sys_cfg_reg[i]);
        for (i = 0; i < SYS_CFGREG_NUM; i++)
-                ad714x->read(ad714x->dev, AD714X_SYSCFG_REG + i,
+                ad714x->read(ad714x, AD714X_SYSCFG_REG + i, &data, 1);
-                        &data);
-        ad714x->write(ad714x->dev, AD714X_STG_CAL_EN_REG, 0xFFF);
+        ad714x->write(ad714x, AD714X_STG_CAL_EN_REG, 0xFFF);
        /* clear all interrupts */
-        ad714x->read(ad714x->dev, STG_LOW_INT_STA_REG, &data);
+        ad714x->read(ad714x, STG_LOW_INT_STA_REG, &ad714x->l_state, 3);
-        ad714x->read(ad714x->dev, STG_HIGH_INT_STA_REG, &data);
-        ad714x->read(ad714x->dev, STG_COM_INT_STA_REG, &data);
 }
 static irqreturn_t ad714x_interrupt_thread(int irq, void *data)
@@ -966,9 +944,7 @@ static irqreturn_t ad714x_interrupt_thread(int irq, void *data)
        mutex_lock(&ad714x->mutex);
-        ad714x->read(ad714x->dev, STG_LOW_INT_STA_REG, &ad714x->l_state);
+        ad714x->read(ad714x, STG_LOW_INT_STA_REG, &ad714x->l_state, 3);
-        ad714x->read(ad714x->dev, STG_HIGH_INT_STA_REG, &ad714x->h_state);
-        ad714x->read(ad714x->dev, STG_COM_INT_STA_REG, &ad714x->c_state);
        for (i = 0; i < ad714x->hw->button_num; i++)
                ad714x_button_state_machine(ad714x, i);
@@ -1245,7 +1221,7 @@ int ad714x_disable(struct ad714x_chip *ad714x)
        mutex_lock(&ad714x->mutex);
        data = ad714x->hw->sys_cfg_reg[AD714X_PWR_CTRL] | 0x3;
-        ad714x->write(ad714x->dev, AD714X_PWR_CTRL, data);
+        ad714x->write(ad714x, AD714X_PWR_CTRL, data);
        mutex_unlock(&ad714x->mutex);
@@ -1255,24 +1231,20 @@ EXPORT_SYMBOL(ad714x_disable);
 int ad714x_enable(struct ad714x_chip *ad714x)
 {
-        unsigned short data;
        dev_dbg(ad714x->dev, "%s enter\n", __func__);
        mutex_lock(&ad714x->mutex);
        /* resume to non-shutdown mode */
-        ad714x->write(ad714x->dev, AD714X_PWR_CTRL,
+        ad714x->write(ad714x, AD714X_PWR_CTRL,
                        ad714x->hw->sys_cfg_reg[AD714X_PWR_CTRL]);
        /* make sure the interrupt output line is not low level after resume,
         * otherwise we will get no chance to enter falling-edge irq again
         */
-        ad714x->read(ad714x->dev, STG_LOW_INT_STA_REG, &data);
+        ad714x->read(ad714x, STG_LOW_INT_STA_REG, &ad714x->l_state, 3);
-        ad714x->read(ad714x->dev, STG_HIGH_INT_STA_REG, &data);
-        ad714x->read(ad714x->dev, STG_COM_INT_STA_REG, &data);
        mutex_unlock(&ad714x->mutex);
diff --git a/drivers/input/misc/ad714x.h b/drivers/input/misc/ad714x.h
index 45c54fb13f07..3c85455aa66d 100644
--- a/drivers/input/misc/ad714x.h
+++ b/drivers/input/misc/ad714x.h
@@ -1,7 +1,7 @@
 /*
 * AD714X CapTouch Programmable Controller driver (bus interfaces)
 *
- * Copyright 2009 Analog Devices Inc.
+ * Copyright 2009-2011 Analog Devices Inc.
 *
 * Licensed under the GPL-2 or later.
 */
@@ -11,11 +11,40 @@
 #include <linux/types.h>
+#define STAGE_NUM              12
 struct device;
+struct ad714x_platform_data;
+struct ad714x_driver_data;
 struct ad714x_chip;
-typedef int (*ad714x_read_t)(struct device *, unsigned short, unsigned short *);
+typedef int (*ad714x_read_t)(struct ad714x_chip *, unsigned short, unsigned short *, size_t);
-typedef int (*ad714x_write_t)(struct device *, unsigned short, unsigned short);
+typedef int (*ad714x_write_t)(struct ad714x_chip *, unsigned short, unsigned short);
+struct ad714x_chip {
+        unsigned short l_state;
+        unsigned short h_state;
+        unsigned short c_state;
+        unsigned short adc_reg[STAGE_NUM];
+        unsigned short amb_reg[STAGE_NUM];
+        unsigned short sensor_val[STAGE_NUM];
+        struct ad714x_platform_data *hw;
+        struct ad714x_driver_data *sw;
+        int irq;
+        struct device *dev;
+        ad714x_read_t read;
+        ad714x_write_t write;
+        struct mutex mutex;
+        unsigned product;
+        unsigned version;
+        __be16 xfer_buf[16] ____cacheline_aligned;
+};
 int ad714x_disable(struct ad714x_chip *ad714x);
 int ad714x_enable(struct ad714x_chip *ad714x);
diff --git a/drivers/input/misc/mma8450.c b/drivers/input/misc/mma8450.c
index 6c76cf792991..0794778295fc 100644
--- a/drivers/input/misc/mma8450.c
+++ b/drivers/input/misc/mma8450.c
@@ -234,7 +234,7 @@ static const struct of_device_id mma8450_dt_ids[] = {
        { .compatible = "fsl,mma8450", },
        { /* sentinel */ }
 };
-MODULE_DEVICE_TABLE(i2c, mma8450_dt_ids);
+MODULE_DEVICE_TABLE(of, mma8450_dt_ids);
 static struct i2c_driver mma8450_driver = {
        .driver = {
diff --git a/drivers/input/misc/mpu3050.c b/drivers/input/misc/mpu3050.c
index b95fac15b2ea..f71dc728da58 100644
--- a/drivers/input/misc/mpu3050.c
+++ b/drivers/input/misc/mpu3050.c
@@ -282,7 +282,7 @@ err_free_irq:
 err_pm_set_suspended:
        pm_runtime_set_suspended(&client->dev);
 err_free_mem:
-        input_unregister_device(idev);
+        input_free_device(idev);
        kfree(sensor);
        return error;
 }
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index 3126983c004a..da280189ef07 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -67,6 +67,14 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI    0x0245
 #define USB_DEVICE_ID_APPLE_WELLSPRING5_ISO     0x0246
 #define USB_DEVICE_ID_APPLE_WELLSPRING5_JIS     0x0247
+/* MacbookAir4,2 (unibody, July 2011) */
+#define USB_DEVICE_ID_APPLE_WELLSPRING6_ANSI    0x024c
+#define USB_DEVICE_ID_APPLE_WELLSPRING6_ISO     0x024d
+#define USB_DEVICE_ID_APPLE_WELLSPRING6_JIS     0x024e
+/* Macbook8,2 (unibody) */
+#define USB_DEVICE_ID_APPLE_WELLSPRING5A_ANSI   0x0252
+#define USB_DEVICE_ID_APPLE_WELLSPRING5A_ISO    0x0253
+#define USB_DEVICE_ID_APPLE_WELLSPRING5A_JIS    0x0254
 #define BCM5974_DEVICE(prod) {                                  \
        .match_flags = (USB_DEVICE_ID_MATCH_DEVICE |            \
@@ -104,6 +112,14 @@ static const struct usb_device_id bcm5974_table[] = {
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI),
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5_ISO),
        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5_JIS),
+        /* MacbookAir4,2 */
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING6_ANSI),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING6_ISO),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING6_JIS),
+        /* MacbookPro8,2 */
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5A_ANSI),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5A_ISO),
+        BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5A_JIS),
        /* Terminating entry */
        {}
 };
@@ -294,6 +310,30 @@ static const struct bcm5974_config bcm5974_config_table[] = {
                { DIM_X, DIM_X / SN_COORD, -4415, 5050 },
                { DIM_Y, DIM_Y / SN_COORD, -55, 6680 }
        },
+        {
+                USB_DEVICE_ID_APPLE_WELLSPRING6_ANSI,
+                USB_DEVICE_ID_APPLE_WELLSPRING6_ISO,
+                USB_DEVICE_ID_APPLE_WELLSPRING6_JIS,
+                HAS_INTEGRATED_BUTTON,
+                0x84, sizeof(struct bt_data),
+                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
+                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
+                { DIM_X, DIM_X / SN_COORD, -4620, 5140 },
+                { DIM_Y, DIM_Y / SN_COORD, -150, 6600 }
+        },
+        {
+                USB_DEVICE_ID_APPLE_WELLSPRING5A_ANSI,
+                USB_DEVICE_ID_APPLE_WELLSPRING5A_ISO,
+                USB_DEVICE_ID_APPLE_WELLSPRING5A_JIS,
+                HAS_INTEGRATED_BUTTON,
+                0x84, sizeof(struct bt_data),
+                0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+                { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
+                { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
+                { DIM_X, DIM_X / SN_COORD, -4750, 5280 },
+                { DIM_Y, DIM_Y / SN_COORD, -150, 6730 }
+        },
        {}
 };
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 449c0a46dbac..d27c9d91630b 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -49,6 +49,7 @@ struct hid_descriptor {
 #define USB_REQ_GET_REPORT      0x01
 #define USB_REQ_SET_REPORT      0x09
 #define WAC_HID_FEATURE_REPORT  0x03
+#define WAC_MSG_RETRIES         5
 static int usb_get_report(struct usb_interface *intf, unsigned char type,
                                unsigned char id, void *buf, int size)
@@ -165,7 +166,7 @@ static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hi
                        report,
                        hid_desc->wDescriptorLength,
                        5000); /* 5 secs */
-        } while (result < 0 && limit++ < 5);
+        } while (result < 0 && limit++ < WAC_MSG_RETRIES);
        /* No need to parse the Descriptor. It isn't an error though */
        if (result < 0)
@@ -319,24 +320,26 @@ static int wacom_query_tablet_data(struct usb_interface *intf, struct wacom_feat
        int limit = 0, report_id = 2;
        int error = -ENOMEM;
-        rep_data = kmalloc(2, GFP_KERNEL);
+        rep_data = kmalloc(4, GFP_KERNEL);
        if (!rep_data)
                return error;
-        /* ask to report tablet data if it is 2FGT Tablet PC or
+        /* ask to report tablet data if it is MT Tablet PC or
         * not a Tablet PC */
        if (features->type == TABLETPC2FG) {
                do {
                        rep_data[0] = 3;
                        rep_data[1] = 4;
+                        rep_data[2] = 0;
+                        rep_data[3] = 0;
                        report_id = 3;
                        error = usb_set_report(intf, WAC_HID_FEATURE_REPORT,
-                                report_id, rep_data, 2);
+                                report_id, rep_data, 4);
                        if (error >= 0)
                                error = usb_get_report(intf,
                                        WAC_HID_FEATURE_REPORT, report_id,
-                                        rep_data, 3);
+                                        rep_data, 4);
-                } while ((error < 0 || rep_data[1] != 4) && limit++ < 5);
+                } while ((error < 0 || rep_data[1] != 4) && limit++ < WAC_MSG_RETRIES);
        } else if (features->type != TABLETPC) {
                do {
                        rep_data[0] = 2;
@@ -347,7 +350,7 @@ static int wacom_query_tablet_data(struct usb_interface *intf, struct wacom_feat
                                error = usb_get_report(intf,
                                        WAC_HID_FEATURE_REPORT, report_id,
                                        rep_data, 2);
-                } while ((error < 0 || rep_data[1] != 2) && limit++ < 5);
+                } while ((error < 0 || rep_data[1] != 2) && limit++ < WAC_MSG_RETRIES);
        }
        kfree(rep_data);
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 03ebcc8b24b5..c1c2f7b28d89 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1460,6 +1460,9 @@ static const struct wacom_features wacom_features_0xD3 =
 static const struct wacom_features wacom_features_0xD4 =
        { "Wacom Bamboo Pen",     WACOM_PKGLEN_BBFUN,     14720,  9200, 1023,
          63, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
+static const struct wacom_features wacom_features_0xD5 =
+        { "Wacom Bamboo Pen 6x8",     WACOM_PKGLEN_BBFUN, 21648, 13530, 1023,
+          63, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
 static const struct wacom_features wacom_features_0xD6 =
        { "Wacom BambooPT 2FG 4x5", WACOM_PKGLEN_BBFUN,   14720,  9200, 1023,
          63, BAMBOO_PT, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
@@ -1564,6 +1567,7 @@ const struct usb_device_id wacom_ids[] = {
        { USB_DEVICE_WACOM(0xD2) },
        { USB_DEVICE_WACOM(0xD3) },
        { USB_DEVICE_WACOM(0xD4) },
+        { USB_DEVICE_WACOM(0xD5) },
        { USB_DEVICE_WACOM(0xD6) },
        { USB_DEVICE_WACOM(0xD7) },
        { USB_DEVICE_WACOM(0xD8) },
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index ae00604a6a81..f5d66859f232 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -244,6 +244,7 @@ struct mxt_finger {
        int x;
        int y;
        int area;
+        int pressure;
 };
 /* Each client has this additional data */
@@ -536,6 +537,8 @@ static void mxt_input_report(struct mxt_data *data, int single_id)
                                        finger[id].x);
                        input_report_abs(input_dev, ABS_MT_POSITION_Y,
                                        finger[id].y);
+                        input_report_abs(input_dev, ABS_MT_PRESSURE,
+                                        finger[id].pressure);
                } else {
                        finger[id].status = 0;
                }
@@ -546,6 +549,8 @@ static void mxt_input_report(struct mxt_data *data, int single_id)
        if (status != MXT_RELEASE) {
                input_report_abs(input_dev, ABS_X, finger[single_id].x);
                input_report_abs(input_dev, ABS_Y, finger[single_id].y);
+                input_report_abs(input_dev,
+                                 ABS_PRESSURE, finger[single_id].pressure);
        }
        input_sync(input_dev);
@@ -560,6 +565,7 @@ static void mxt_input_touchevent(struct mxt_data *data,
        int x;
        int y;
        int area;
+        int pressure;
        /* Check the touch is present on the screen */
        if (!(status & MXT_DETECT)) {
@@ -584,6 +590,7 @@ static void mxt_input_touchevent(struct mxt_data *data,
                y = y >> 2;
        area = message->message[4];
+        pressure = message->message[5];
        dev_dbg(dev, "[%d] %s x: %d, y: %d, area: %d\n", id,
                status & MXT_MOVE ? "moved" : "pressed",
@@ -594,6 +601,7 @@ static void mxt_input_touchevent(struct mxt_data *data,
        finger[id].x = x;
        finger[id].y = y;
        finger[id].area = area;
+        finger[id].pressure = pressure;
        mxt_input_report(data, id);
 }
@@ -1116,6 +1124,8 @@ static int __devinit mxt_probe(struct i2c_client *client,
                             0, data->max_x, 0, 0);
        input_set_abs_params(input_dev, ABS_Y,
                             0, data->max_y, 0, 0);
+        input_set_abs_params(input_dev, ABS_PRESSURE,
+                             0, 255, 0, 0);
        /* For multi touch */
        input_mt_init_slots(input_dev, MXT_MAX_FINGER);
@@ -1125,6 +1135,8 @@ static int __devinit mxt_probe(struct i2c_client *client,
                             0, data->max_x, 0, 0);
        input_set_abs_params(input_dev, ABS_MT_POSITION_Y,
                             0, data->max_y, 0, 0);
+        input_set_abs_params(input_dev, ABS_MT_PRESSURE,
+                             0, 255, 0, 0);
        input_set_drvdata(input_dev, data);
        i2c_set_clientdata(client, data);
diff --git a/drivers/input/touchscreen/max11801_ts.c b/drivers/input/touchscreen/max11801_ts.c
index 4f2713d92791..4627fe55b401 100644
--- a/drivers/input/touchscreen/max11801_ts.c
+++ b/drivers/input/touchscreen/max11801_ts.c
@@ -9,7 +9,8 @@
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License.
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
 */
 /*
diff --git a/drivers/input/touchscreen/tnetv107x-ts.c b/drivers/input/touchscreen/tnetv107x-ts.c
index 089b0a0f3d8c..0e8f63e5b36f 100644
--- a/drivers/input/touchscreen/tnetv107x-ts.c
+++ b/drivers/input/touchscreen/tnetv107x-ts.c
@@ -13,6 +13,7 @@
 * GNU General Public License for more details.
 */
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/err.h>
 #include <linux/errno.h>
diff --git a/drivers/leds/leds-ams-delta.c b/drivers/leds/leds-ams-delta.c
index b9826032450b..8c00937bf7e7 100644
--- a/drivers/leds/leds-ams-delta.c
+++ b/drivers/leds/leds-ams-delta.c
@@ -8,6 +8,7 @@
 * published by the Free Software Foundation.
 */
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/leds/leds-bd2802.c b/drivers/leds/leds-bd2802.c
index 3ebe3824662d..ea2185531f82 100644
--- a/drivers/leds/leds-bd2802.c
+++ b/drivers/leds/leds-bd2802.c
@@ -662,6 +662,11 @@ failed_unregister_led1_R:
 static void bd2802_unregister_led_classdev(struct bd2802_led *led)
 {
        cancel_work_sync(&led->work);
+        led_classdev_unregister(&led->cdev_led2b);
+        led_classdev_unregister(&led->cdev_led2g);
+        led_classdev_unregister(&led->cdev_led2r);
+        led_classdev_unregister(&led->cdev_led1b);
+        led_classdev_unregister(&led->cdev_led1g);
        led_classdev_unregister(&led->cdev_led1r);
 }
diff --git a/drivers/leds/leds-hp6xx.c b/drivers/leds/leds-hp6xx.c
index e4ce1fd46338..bcfbd3a60eab 100644
--- a/drivers/leds/leds-hp6xx.c
+++ b/drivers/leds/leds-hp6xx.c
@@ -10,6 +10,7 @@
 * published by the Free Software Foundation.
 */
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 0a4d86c6c4a4..2d6423c2d193 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -146,6 +146,7 @@ config PHANTOM
 config INTEL_MID_PTI
        tristate "Parallel Trace Interface for MIPI P1149.7 cJTAG standard"
+        depends on PCI
        default n
        help
          The PTI (Parallel Trace Interface) driver directs
diff --git a/drivers/misc/ab8500-pwm.c b/drivers/misc/ab8500-pwm.c
index 54e3d05b63cc..35903154ca2e 100644
--- a/drivers/misc/ab8500-pwm.c
+++ b/drivers/misc/ab8500-pwm.c
@@ -164,5 +164,5 @@ subsys_initcall(ab8500_pwm_init);
 module_exit(ab8500_pwm_exit);
 MODULE_AUTHOR("Arun MURTHY <arun.murthy@stericsson.com>");
 MODULE_DESCRIPTION("AB8500 Pulse Width Modulation Driver");
-MODULE_ALIAS("AB8500 PWM driver");
+MODULE_ALIAS("platform:ab8500-pwm");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/fsa9480.c b/drivers/misc/fsa9480.c
index 5325a7e70dcf..27dc0d21aafa 100644
--- a/drivers/misc/fsa9480.c
+++ b/drivers/misc/fsa9480.c
@@ -455,7 +455,7 @@ static int __devinit fsa9480_probe(struct i2c_client *client,
 fail2:
        if (client->irq)
-                free_irq(client->irq, NULL);
+                free_irq(client->irq, usbsw);
 fail1:
        i2c_set_clientdata(client, NULL);
        kfree(usbsw);
@@ -466,7 +466,7 @@ static int __devexit fsa9480_remove(struct i2c_client *client)
 {
        struct fsa9480_usbsw *usbsw = i2c_get_clientdata(client);
        if (client->irq)
-                free_irq(client->irq, NULL);
+                free_irq(client->irq, usbsw);
        i2c_set_clientdata(client, NULL);
        sysfs_remove_group(&client->dev.kobj, &fsa9480_group);
diff --git a/drivers/misc/pti.c b/drivers/misc/pti.c
index 8653bd0b1a33..06df1877ad0f 100644
--- a/drivers/misc/pti.c
+++ b/drivers/misc/pti.c
@@ -33,6 +33,8 @@
 #include <linux/mutex.h>
 #include <linux/miscdevice.h>
 #include <linux/pti.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
 #define DRIVERNAME              "pti"
 #define PCINAME                 "pciPTI"
diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index 54c91ffe4a91..ba168a7d54d4 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -338,6 +338,12 @@ void st_int_recv(void *disc_data,
                        /* Unknow packet? */
                default:
                        type = *ptr;
+                        if (st_gdata->list[type] == NULL) {
+                                pr_err("chip/interface misbehavior dropping"
+                                        " frame starting with 0x%02x", type);
+                                goto done;
+                        }
                        st_gdata->rx_skb = alloc_skb(
                                        st_gdata->list[type]->max_frame_size,
                                        GFP_ATOMIC);
@@ -354,6 +360,7 @@ void st_int_recv(void *disc_data,
                ptr++;
                count--;
        }
+done:
        spin_unlock_irqrestore(&st_gdata->lock, flags);
        pr_debug("done %s", __func__);
        return;
@@ -717,9 +724,10 @@ static void st_tty_close(struct tty_struct *tty)
         */
        spin_lock_irqsave(&st_gdata->lock, flags);
        for (i = ST_BT; i < ST_MAX_CHANNELS; i++) {
-                if (st_gdata->list[i] != NULL)
+                if (st_gdata->is_registered[i] == true)
                        pr_err("%d not un-registered", i);
                st_gdata->list[i] = NULL;
+                st_gdata->is_registered[i] = false;
        }
        st_gdata->protos_registered = 0;
        spin_unlock_irqrestore(&st_gdata->lock, flags);
diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index 38fd2f04c07e..3a3580566dfc 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -68,6 +68,7 @@ void validate_firmware_response(struct kim_data_s *kim_gdata)
        if (unlikely(skb->data[5] != 0)) {
                pr_err("no proper response during fw download");
                pr_err("data6 %x", skb->data[5]);
+                kfree_skb(skb);
                return;         /* keep waiting for the proper response */
        }
        /* becos of all the script being downloaded */
@@ -210,6 +211,7 @@ static long read_local_version(struct kim_data_s *kim_gdata, char *bts_scr_name)
                pr_err(" waiting for ver info- timed out ");
                return -ETIMEDOUT;
        }
+        INIT_COMPLETION(kim_gdata->kim_rcvd);
        version =
                MAKEWORD(kim_gdata->resp_buffer[13],
@@ -298,6 +300,7 @@ static long download_firmware(struct kim_data_s *kim_gdata)
                switch (((struct bts_action *)ptr)->type) {
                case ACTION_SEND_COMMAND:       /* action send */
+                        pr_debug("S");
                        action_ptr = &(((struct bts_action *)ptr)->data[0]);
                        if (unlikely
                            (((struct hci_command *)action_ptr)->opcode ==
@@ -335,6 +338,10 @@ static long download_firmware(struct kim_data_s *kim_gdata)
                                release_firmware(kim_gdata->fw_entry);
                                return -ETIMEDOUT;
                        }
+                        /* reinit completion before sending for the
+                         * relevant wait
+                         */
+                        INIT_COMPLETION(kim_gdata->kim_rcvd);
                        /*
                         * Free space found in uart buffer, call st_int_write
@@ -361,6 +368,7 @@ static long download_firmware(struct kim_data_s *kim_gdata)
                        }
                        break;
                case ACTION_WAIT_EVENT:  /* wait */
+                        pr_debug("W");
                        if (!wait_for_completion_timeout
                                        (&kim_gdata->kim_rcvd,
                                         msecs_to_jiffies(CMD_RESP_TIME))) {
@@ -434,11 +442,17 @@ long st_kim_start(void *kim_data)
 {
        long err = 0;
        long retry = POR_RETRY_COUNT;
+        struct ti_st_plat_data  *pdata;
        struct kim_data_s       *kim_gdata = (struct kim_data_s *)kim_data;
        pr_info(" %s", __func__);
+        pdata = kim_gdata->kim_pdev->dev.platform_data;
        do {
+                /* platform specific enabling code here */
+                if (pdata->chip_enable)
+                        pdata->chip_enable(kim_gdata);
                /* Configure BT nShutdown to HIGH state */
                gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
                mdelay(5);      /* FIXME: a proper toggle */
@@ -460,6 +474,12 @@ long st_kim_start(void *kim_data)
                        pr_info("ldisc_install = 0");
                        sysfs_notify(&kim_gdata->kim_pdev->dev.kobj,
                                        NULL, "install");
+                        /* the following wait is never going to be completed,
+                         * since the ldisc was never installed, hence serving
+                         * as a mdelay of LDISC_TIME msecs */
+                        err = wait_for_completion_timeout
+                                (&kim_gdata->ldisc_installed,
+                                 msecs_to_jiffies(LDISC_TIME));
                        err = -ETIMEDOUT;
                        continue;
                } else {
@@ -472,6 +492,13 @@ long st_kim_start(void *kim_data)
                                pr_info("ldisc_install = 0");
                                sysfs_notify(&kim_gdata->kim_pdev->dev.kobj,
                                                NULL, "install");
+                                /* this wait might be completed, though in the
+                                 * tty_close() since the ldisc is already
+                                 * installed */
+                                err = wait_for_completion_timeout
+                                        (&kim_gdata->ldisc_installed,
+                                         msecs_to_jiffies(LDISC_TIME));
+                                err = -EINVAL;
                                continue;
                        } else {        /* on success don't retry */
                                break;
@@ -489,6 +516,8 @@ long st_kim_stop(void *kim_data)
 {
        long err = 0;
        struct kim_data_s       *kim_gdata = (struct kim_data_s *)kim_data;
+        struct ti_st_plat_data  *pdata =
+                kim_gdata->kim_pdev->dev.platform_data;
        INIT_COMPLETION(kim_gdata->ldisc_installed);
@@ -515,6 +544,10 @@ long st_kim_stop(void *kim_data)
        gpio_set_value(kim_gdata->nshutdown, GPIO_HIGH);
        mdelay(1);
        gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
+        /* platform specific disable */
+        if (pdata->chip_disable)
+                pdata->chip_disable(kim_gdata);
        return err;
 }
diff --git a/drivers/misc/ti-st/st_ll.c b/drivers/misc/ti-st/st_ll.c
index 3f2495138855..1ff460a8e9c7 100644
--- a/drivers/misc/ti-st/st_ll.c
+++ b/drivers/misc/ti-st/st_ll.c
@@ -22,6 +22,7 @@
 #define pr_fmt(fmt) "(stll) :" fmt
 #include <linux/skbuff.h>
 #include <linux/module.h>
+#include <linux/platform_device.h>
 #include <linux/ti_wilink_st.h>
 /**********************************************************************/
@@ -37,6 +38,9 @@ static void send_ll_cmd(struct st_data_s *st_data,
 static void ll_device_want_to_sleep(struct st_data_s *st_data)
 {
+        struct kim_data_s       *kim_data;
+        struct ti_st_plat_data  *pdata;
        pr_debug("%s", __func__);
        /* sanity check */
        if (st_data->ll_state != ST_LL_AWAKE)
@@ -46,10 +50,19 @@ static void ll_device_want_to_sleep(struct st_data_s *st_data)
        send_ll_cmd(st_data, LL_SLEEP_ACK);
        /* update state */
        st_data->ll_state = ST_LL_ASLEEP;
+        /* communicate to platform about chip asleep */
+        kim_data = st_data->kim_data;
+        pdata = kim_data->kim_pdev->dev.platform_data;
+        if (pdata->chip_asleep)
+                pdata->chip_asleep(NULL);
 }
 static void ll_device_want_to_wakeup(struct st_data_s *st_data)
 {
+        struct kim_data_s       *kim_data;
+        struct ti_st_plat_data  *pdata;
        /* diff actions in diff states */
        switch (st_data->ll_state) {
        case ST_LL_ASLEEP:
@@ -70,6 +83,12 @@ static void ll_device_want_to_wakeup(struct st_data_s *st_data)
        }
        /* update state */
        st_data->ll_state = ST_LL_AWAKE;
+        /* communicate to platform about chip wakeup */
+        kim_data = st_data->kim_data;
+        pdata = kim_data->kim_pdev->dev.platform_data;
+        if (pdata->chip_asleep)
+                pdata->chip_awake(NULL);
 }
 /**********************************************************************/
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 38a83acd502e..43f2ea541088 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3419,9 +3419,27 @@ static int bond_xmit_hash_policy_l2(struct sk_buff *skb, int count)
 static int bond_open(struct net_device *bond_dev)
 {
        struct bonding *bond = netdev_priv(bond_dev);
+        struct slave *slave;
+        int i;
        bond->kill_timers = 0;
+        /* reset slave->backup and slave->inactive */
+        read_lock(&bond->lock);
+        if (bond->slave_cnt > 0) {
+                read_lock(&bond->curr_slave_lock);
+                bond_for_each_slave(bond, slave, i) {
+                        if ((bond->params.mode == BOND_MODE_ACTIVEBACKUP)
+                                && (slave != bond->curr_active_slave)) {
+                                bond_set_slave_inactive_flags(slave);
+                        } else {
+                                bond_set_slave_active_flags(slave);
+                        }
+                }
+                read_unlock(&bond->curr_slave_lock);
+        }
+        read_unlock(&bond->lock);
        INIT_DELAYED_WORK(&bond->mcast_work, bond_resend_igmp_join_requests_delayed);
        if (bond_is_lb(bond)) {
diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
index 231385b8e08f..c7f3d4ea1167 100644
--- a/drivers/net/can/sja1000/plx_pci.c
+++ b/drivers/net/can/sja1000/plx_pci.c
@@ -408,7 +408,7 @@ static void plx_pci_del_card(struct pci_dev *pdev)
        struct sja1000_priv *priv;
        int i = 0;
-        for (i = 0; i < card->channels; i++) {
+        for (i = 0; i < PLX_PCI_MAX_CHAN; i++) {
                dev = card->net_dev[i];
                if (!dev)
                        continue;
@@ -536,7 +536,6 @@ static int __devinit plx_pci_add_card(struct pci_dev *pdev,
                        if (err) {
                                dev_err(&pdev->dev, "Registering device failed "
                                        "(err=%d)\n", err);
-                                free_sja1000dev(dev);
                                goto failure_cleanup;
                        }
@@ -549,6 +548,7 @@ static int __devinit plx_pci_add_card(struct pci_dev *pdev,
                        dev_err(&pdev->dev, "Channel #%d not detected\n",
                                i + 1);
                        free_sja1000dev(dev);
+                        card->net_dev[i] = NULL;
                }
        }
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 35916f485028..8533ad7f3559 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -155,6 +155,9 @@ struct e1000_info;
 #define HV_M_STATUS_SPEED_1000            0x0200
 #define HV_M_STATUS_LINK_UP               0x0040
+#define E1000_ICH_FWSM_PCIM2PCI         0x01000000 /* ME PCIm-to-PCI active */
+#define E1000_ICH_FWSM_PCIM2PCI_COUNT   2000
 /* Time to wait before putting the device into D3 if there's no link (in ms). */
 #define LINK_TIMEOUT            100
@@ -454,6 +457,7 @@ struct e1000_info {
 #define FLAG2_DISABLE_AIM                 (1 << 8)
 #define FLAG2_CHECK_PHY_HANG              (1 << 9)
 #define FLAG2_NO_DISABLE_RX               (1 << 10)
+#define FLAG2_PCIM2PCI_ARBITER_WA         (1 << 11)
 #define E1000_RX_DESC_PS(R, i)      \
        (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 4e36978b8fd8..54add27c8f76 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -137,8 +137,9 @@
 #define HV_PM_CTRL              PHY_REG(770, 17)
 /* PHY Low Power Idle Control */
-#define I82579_LPI_CTRL                 PHY_REG(772, 20)
+#define I82579_LPI_CTRL                         PHY_REG(772, 20)
-#define I82579_LPI_CTRL_ENABLE_MASK     0x6000
+#define I82579_LPI_CTRL_ENABLE_MASK             0x6000
+#define I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT    0x80
 /* EMI Registers */
 #define I82579_EMI_ADDR         0x10
@@ -163,6 +164,11 @@
 #define HV_KMRN_MODE_CTRL      PHY_REG(769, 16)
 #define HV_KMRN_MDIO_SLOW      0x0400
+/* KMRN FIFO Control and Status */
+#define HV_KMRN_FIFO_CTRLSTA                  PHY_REG(770, 16)
+#define HV_KMRN_FIFO_CTRLSTA_PREAMBLE_MASK    0x7000
+#define HV_KMRN_FIFO_CTRLSTA_PREAMBLE_SHIFT   12
 /* ICH GbE Flash Hardware Sequencing Flash Status Register bit breakdown */
 /* Offset 04h HSFSTS */
 union ich8_hws_flash_status {
@@ -657,6 +663,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
        struct e1000_mac_info *mac = &hw->mac;
        s32 ret_val;
        bool link;
+        u16 phy_reg;
        /*
         * We only want to go out to the PHY registers to see if Auto-Neg
@@ -689,16 +696,35 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
        mac->get_link_status = false;
-        if (hw->phy.type == e1000_phy_82578) {
+        switch (hw->mac.type) {
-                ret_val = e1000_link_stall_workaround_hv(hw);
+        case e1000_pch2lan:
-                if (ret_val)
-                        goto out;
-        }
-        if (hw->mac.type == e1000_pch2lan) {
                ret_val = e1000_k1_workaround_lv(hw);
                if (ret_val)
                        goto out;
+                /* fall-thru */
+        case e1000_pchlan:
+                if (hw->phy.type == e1000_phy_82578) {
+                        ret_val = e1000_link_stall_workaround_hv(hw);
+                        if (ret_val)
+                                goto out;
+                }
+                /*
+                 * Workaround for PCHx parts in half-duplex:
+                 * Set the number of preambles removed from the packet
+                 * when it is passed from the PHY to the MAC to prevent
+                 * the MAC from misinterpreting the packet type.
+                 */
+                e1e_rphy(hw, HV_KMRN_FIFO_CTRLSTA, &phy_reg);
+                phy_reg &= ~HV_KMRN_FIFO_CTRLSTA_PREAMBLE_MASK;
+                if ((er32(STATUS) & E1000_STATUS_FD) != E1000_STATUS_FD)
+                        phy_reg |= (1 << HV_KMRN_FIFO_CTRLSTA_PREAMBLE_SHIFT);
+                e1e_wphy(hw, HV_KMRN_FIFO_CTRLSTA, phy_reg);
+                break;
+        default:
+                break;
        }
        /*
@@ -788,6 +814,11 @@ static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
            (adapter->hw.phy.type == e1000_phy_igp_3))
                adapter->flags |= FLAG_LSC_GIG_SPEED_DROP;
+        /* Enable workaround for 82579 w/ ME enabled */
+        if ((adapter->hw.mac.type == e1000_pch2lan) &&
+            (er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                adapter->flags2 |= FLAG2_PCIM2PCI_ARBITER_WA;
        /* Disable EEE by default until IEEE802.3az spec is finalized */
        if (adapter->flags2 & FLAG2_HAS_EEE)
                adapter->hw.dev_spec.ich8lan.eee_disable = true;
@@ -1355,7 +1386,7 @@ static s32 e1000_hv_phy_workarounds_ich8lan(struct e1000_hw *hw)
                        return ret_val;
                /* Preamble tuning for SSC */
-                ret_val = e1e_wphy(hw, PHY_REG(770, 16), 0xA204);
+                ret_val = e1e_wphy(hw, HV_KMRN_FIFO_CTRLSTA, 0xA204);
                if (ret_val)
                        return ret_val;
        }
@@ -1645,6 +1676,7 @@ static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
        s32 ret_val = 0;
        u16 status_reg = 0;
        u32 mac_reg;
+        u16 phy_reg;
        if (hw->mac.type != e1000_pch2lan)
                goto out;
@@ -1659,12 +1691,19 @@ static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
                mac_reg = er32(FEXTNVM4);
                mac_reg &= ~E1000_FEXTNVM4_BEACON_DURATION_MASK;
-                if (status_reg & HV_M_STATUS_SPEED_1000)
+                ret_val = e1e_rphy(hw, I82579_LPI_CTRL, &phy_reg);
+                if (ret_val)
+                        goto out;
+                if (status_reg & HV_M_STATUS_SPEED_1000) {
                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_8USEC;
-                else
+                        phy_reg &= ~I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT;
+                } else {
                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_16USEC;
+                        phy_reg |= I82579_LPI_CTRL_FORCE_PLL_LOCK_COUNT;
+                }
                ew32(FEXTNVM4, mac_reg);
+                ret_val = e1e_wphy(hw, I82579_LPI_CTRL, phy_reg);
        }
 out:
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 362f70382cdd..2198e615f241 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -519,6 +519,63 @@ static void e1000_rx_checksum(struct e1000_adapter *adapter, u32 status_err,
 }
 /**
+ * e1000e_update_tail_wa - helper function for e1000e_update_[rt]dt_wa()
+ * @hw: pointer to the HW structure
+ * @tail: address of tail descriptor register
+ * @i: value to write to tail descriptor register
+ *
+ * When updating the tail register, the ME could be accessing Host CSR
+ * registers at the same time.  Normally, this is handled in h/w by an
+ * arbiter but on some parts there is a bug that acknowledges Host accesses
+ * later than it should which could result in the descriptor register to
+ * have an incorrect value.  Workaround this by checking the FWSM register
+ * which has bit 24 set while ME is accessing Host CSR registers, wait
+ * if it is set and try again a number of times.
+ **/
+static inline s32 e1000e_update_tail_wa(struct e1000_hw *hw, u8 __iomem * tail,
+                                        unsigned int i)
+{
+        unsigned int j = 0;
+        while ((j++ < E1000_ICH_FWSM_PCIM2PCI_COUNT) &&
+               (er32(FWSM) & E1000_ICH_FWSM_PCIM2PCI))
+                udelay(50);
+        writel(i, tail);
+        if ((j == E1000_ICH_FWSM_PCIM2PCI_COUNT) && (i != readl(tail)))
+                return E1000_ERR_SWFW_SYNC;
+        return 0;
+}
+static void e1000e_update_rdt_wa(struct e1000_adapter *adapter, unsigned int i)
+{
+        u8 __iomem *tail = (adapter->hw.hw_addr + adapter->rx_ring->tail);
+        struct e1000_hw *hw = &adapter->hw;
+        if (e1000e_update_tail_wa(hw, tail, i)) {
+                u32 rctl = er32(RCTL);
+                ew32(RCTL, rctl & ~E1000_RCTL_EN);
+                e_err("ME firmware caused invalid RDT - resetting\n");
+                schedule_work(&adapter->reset_task);
+        }
+}
+static void e1000e_update_tdt_wa(struct e1000_adapter *adapter, unsigned int i)
+{
+        u8 __iomem *tail = (adapter->hw.hw_addr + adapter->tx_ring->tail);
+        struct e1000_hw *hw = &adapter->hw;
+        if (e1000e_update_tail_wa(hw, tail, i)) {
+                u32 tctl = er32(TCTL);
+                ew32(TCTL, tctl & ~E1000_TCTL_EN);
+                e_err("ME firmware caused invalid TDT - resetting\n");
+                schedule_work(&adapter->reset_task);
+        }
+}
+/**
 * e1000_alloc_rx_buffers - Replace used receive buffers; legacy & extended
 * @adapter: address of board private structure
 **/
@@ -573,7 +630,10 @@ map_skb:
                         * such as IA-64).
                         */
                        wmb();
-                        writel(i, adapter->hw.hw_addr + rx_ring->tail);
+                        if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                                e1000e_update_rdt_wa(adapter, i);
+                        else
+                                writel(i, adapter->hw.hw_addr + rx_ring->tail);
                }
                i++;
                if (i == rx_ring->count)
@@ -673,7 +733,11 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_adapter *adapter,
                         * such as IA-64).
                         */
                        wmb();
-                        writel(i << 1, adapter->hw.hw_addr + rx_ring->tail);
+                        if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                                e1000e_update_rdt_wa(adapter, i << 1);
+                        else
+                                writel(i << 1,
+                                       adapter->hw.hw_addr + rx_ring->tail);
                }
                i++;
@@ -756,7 +820,10 @@ check_page:
                 * applicable for weak-ordered memory model archs,
                 * such as IA-64). */
                wmb();
-                writel(i, adapter->hw.hw_addr + rx_ring->tail);
+                if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                        e1000e_update_rdt_wa(adapter, i);
+                else
+                        writel(i, adapter->hw.hw_addr + rx_ring->tail);
        }
 }
@@ -4689,7 +4756,12 @@ static void e1000_tx_queue(struct e1000_adapter *adapter,
        wmb();
        tx_ring->next_to_use = i;
-        writel(i, adapter->hw.hw_addr + tx_ring->tail);
+        if (adapter->flags2 & FLAG2_PCIM2PCI_ARBITER_WA)
+                e1000e_update_tdt_wa(adapter, i);
+        else
+                writel(i, adapter->hw.hw_addr + tx_ring->tail);
        /*
         * we need this if more than one processor can write to our tail
         * at a time, it synchronizes IO on IA64/Altix systems
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index e55df308a3af..6d5fbd4d4256 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -5615,7 +5615,8 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                goto out_error;
        }
-        nv_vlan_mode(dev, dev->features);
+        if (id->driver_data & DEV_HAS_VLAN)
+                nv_vlan_mode(dev, dev->features);
        netif_carrier_off(dev);
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 2659daad783d..31d5c574e5a9 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -2710,8 +2710,13 @@ static int gfar_process_frame(struct net_device *dev, struct sk_buff *skb,
        /* Tell the skb what kind of packet this is */
        skb->protocol = eth_type_trans(skb, dev);
-        /* Set vlan tag */
+        /*
-        if (fcb->flags & RXFCB_VLN)
+         * There's need to check for NETIF_F_HW_VLAN_RX here.
+         * Even if vlan rx accel is disabled, on some chips
+         * RXFCB_VLN is pseudo randomly set.
+         */
+        if (dev->features & NETIF_F_HW_VLAN_RX &&
+            fcb->flags & RXFCB_VLN)
                __vlan_hwaccel_put_tag(skb, fcb->vlctl);
        /* Send the packet up the stack */
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 6e350692d118..25a8c2adb001 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -686,10 +686,21 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
 {
        unsigned int last_rule_idx = priv->cur_filer_idx;
        unsigned int cmp_rqfpr;
-        unsigned int local_rqfpr[MAX_FILER_IDX + 1];
+        unsigned int *local_rqfpr;
-        unsigned int local_rqfcr[MAX_FILER_IDX + 1];
+        unsigned int *local_rqfcr;
        int i = 0x0, k = 0x0;
        int j = MAX_FILER_IDX, l = 0x0;
+        int ret = 1;
+        local_rqfpr = kmalloc(sizeof(unsigned int) * (MAX_FILER_IDX + 1),
+                GFP_KERNEL);
+        local_rqfcr = kmalloc(sizeof(unsigned int) * (MAX_FILER_IDX + 1),
+                GFP_KERNEL);
+        if (!local_rqfpr || !local_rqfcr) {
+                pr_err("Out of memory\n");
+                ret = 0;
+                goto err;
+        }
        switch (class) {
        case TCP_V4_FLOW:
@@ -706,7 +717,8 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
                break;
        default:
                pr_err("Right now this class is not supported\n");
-                return 0;
+                ret = 0;
+                goto err;
        }
        for (i = 0; i < MAX_FILER_IDX + 1; i++) {
@@ -721,7 +733,8 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
        if (i == MAX_FILER_IDX + 1) {
                pr_err("No parse rule found, can't create hash rules\n");
-                return 0;
+                ret = 0;
+                goto err;
        }
        /* If a match was found, then it begins the starting of a cluster rule
@@ -765,7 +778,10 @@ static int gfar_ethflow_to_filer_table(struct gfar_private *priv, u64 ethflow, u
                priv->cur_filer_idx = priv->cur_filer_idx - 1;
        }
-        return 1;
+err:
+        kfree(local_rqfcr);
+        kfree(local_rqfpr);
+        return ret;
 }
 static int gfar_set_hash_opts(struct gfar_private *priv, struct ethtool_rxnfc *cmd)
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index e86297b32733..22790394318a 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1459,8 +1459,10 @@ static void ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                if (ixgbe_rx_is_fcoe(adapter, rx_desc)) {
                        ddp_bytes = ixgbe_fcoe_ddp(adapter, rx_desc, skb,
                                                   staterr);
-                        if (!ddp_bytes)
+                        if (!ddp_bytes) {
+                                dev_kfree_skb_any(skb);
                                goto next_desc;
+                        }
                }
 #endif /* IXGBE_FCOE */
                ixgbe_receive_skb(q_vector, skb, staterr, rx_ring, rx_desc);
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 86ac38c96bcf..3bb131137033 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -80,13 +80,13 @@ static int rionet_capable = 1;
 */
 static struct rio_dev **rionet_active;
-#define is_rionet_capable(pef, src_ops, dst_ops)                \
+#define is_rionet_capable(src_ops, dst_ops)                     \
-                        ((pef & RIO_PEF_INB_MBOX) &&            \
+                        ((src_ops & RIO_SRC_OPS_DATA_MSG) &&    \
-                         (pef & RIO_PEF_INB_DOORBELL) &&        \
+                         (dst_ops & RIO_DST_OPS_DATA_MSG) &&    \
                         (src_ops & RIO_SRC_OPS_DOORBELL) &&    \
                         (dst_ops & RIO_DST_OPS_DOORBELL))
 #define dev_rionet_capable(dev) \
-        is_rionet_capable(dev->pef, dev->src_ops, dev->dst_ops)
+        is_rionet_capable(dev->src_ops, dev->dst_ops)
 #define RIONET_MAC_MATCH(x)     (*(u32 *)x == 0x00010001)
 #define RIONET_GET_DESTID(x)    (*(u16 *)(x + 4))
@@ -282,7 +282,6 @@ static int rionet_open(struct net_device *ndev)
 {
        int i, rc = 0;
        struct rionet_peer *peer, *tmp;
-        u32 pwdcsr;
        struct rionet_private *rnet = netdev_priv(ndev);
        if (netif_msg_ifup(rnet))
@@ -332,13 +331,8 @@ static int rionet_open(struct net_device *ndev)
                        continue;
                }
-                /*
+                /* Send a join message */
-                 * If device has initialized inbound doorbells,
+                rio_send_doorbell(peer->rdev, RIONET_DOORBELL_JOIN);
-                 * send a join message
-                 */
-                rio_read_config_32(peer->rdev, RIO_WRITE_PORT_CSR, &pwdcsr);
-                if (pwdcsr & RIO_DOORBELL_AVAIL)
-                        rio_send_doorbell(peer->rdev, RIONET_DOORBELL_JOIN);
        }
      out:
@@ -492,7 +486,7 @@ static int rionet_setup_netdev(struct rio_mport *mport, struct net_device *ndev)
 static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
 {
        int rc = -ENODEV;
-        u32 lpef, lsrc_ops, ldst_ops;
+        u32 lsrc_ops, ldst_ops;
        struct rionet_peer *peer;
        struct net_device *ndev = NULL;
@@ -515,12 +509,11 @@ static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
         * on later probes
         */
        if (!rionet_check) {
-                rio_local_read_config_32(rdev->net->hport, RIO_PEF_CAR, &lpef);
                rio_local_read_config_32(rdev->net->hport, RIO_SRC_OPS_CAR,
                                         &lsrc_ops);
                rio_local_read_config_32(rdev->net->hport, RIO_DST_OPS_CAR,
                                         &ldst_ops);
-                if (!is_rionet_capable(lpef, lsrc_ops, ldst_ops)) {
+                if (!is_rionet_capable(lsrc_ops, ldst_ops)) {
                        printk(KERN_ERR
                               "%s: local device is not network capable\n",
                               DRV_NAME);
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index ad35c210b839..190f619e4215 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -21,6 +21,7 @@
 */
 #include <linux/init.h>
+#include <linux/interrupt.h>
 #include <linux/dma-mapping.h>
 #include <linux/etherdevice.h>
 #include <linux/delay.h>
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index a03336e086d5..f06fb78383a1 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -228,23 +228,40 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
        if (ctx->rx_max != le32_to_cpu(ctx->ncm_parm.dwNtbInMaxSize)) {
                if (flags & USB_CDC_NCM_NCAP_NTB_INPUT_SIZE) {
-                        struct usb_cdc_ncm_ndp_input_size ndp_in_sz;
+                        struct usb_cdc_ncm_ndp_input_size *ndp_in_sz;
+                        ndp_in_sz = kzalloc(sizeof(*ndp_in_sz), GFP_KERNEL);
+                        if (!ndp_in_sz) {
+                                err = -ENOMEM;
+                                goto size_err;
+                        }
                        err = usb_control_msg(ctx->udev,
                                        usb_sndctrlpipe(ctx->udev, 0),
                                        USB_CDC_SET_NTB_INPUT_SIZE,
                                        USB_TYPE_CLASS | USB_DIR_OUT
                                         | USB_RECIP_INTERFACE,
-                                        0, iface_no, &ndp_in_sz, 8, 1000);
+                                        0, iface_no, ndp_in_sz, 8, 1000);
+                        kfree(ndp_in_sz);
                } else {
-                        __le32 dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
+                        __le32 *dwNtbInMaxSize;
+                        dwNtbInMaxSize = kzalloc(sizeof(*dwNtbInMaxSize),
+                                        GFP_KERNEL);
+                        if (!dwNtbInMaxSize) {
+                                err = -ENOMEM;
+                                goto size_err;
+                        }
+                        *dwNtbInMaxSize = cpu_to_le32(ctx->rx_max);
                        err = usb_control_msg(ctx->udev,
                                        usb_sndctrlpipe(ctx->udev, 0),
                                        USB_CDC_SET_NTB_INPUT_SIZE,
                                        USB_TYPE_CLASS | USB_DIR_OUT
                                         | USB_RECIP_INTERFACE,
-                                        0, iface_no, &dwNtbInMaxSize, 4, 1000);
+                                        0, iface_no, dwNtbInMaxSize, 4, 1000);
+                        kfree(dwNtbInMaxSize);
                }
+size_err:
                if (err < 0)
                        pr_debug("Setting NTB Input Size failed\n");
        }
@@ -325,19 +342,29 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
        /* set Max Datagram Size (MTU) */
        if (flags & USB_CDC_NCM_NCAP_MAX_DATAGRAM_SIZE) {
-                __le16 max_datagram_size;
+                __le16 *max_datagram_size;
                u16 eth_max_sz = le16_to_cpu(ctx->ether_desc->wMaxSegmentSize);
+                max_datagram_size = kzalloc(sizeof(*max_datagram_size),
+                                GFP_KERNEL);
+                if (!max_datagram_size) {
+                        err = -ENOMEM;
+                        goto max_dgram_err;
+                }
                err = usb_control_msg(ctx->udev, usb_rcvctrlpipe(ctx->udev, 0),
                                USB_CDC_GET_MAX_DATAGRAM_SIZE,
                                USB_TYPE_CLASS | USB_DIR_IN
                                 | USB_RECIP_INTERFACE,
-                                0, iface_no, &max_datagram_size,
+                                0, iface_no, max_datagram_size,
                                2, 1000);
                if (err < 0) {
                        pr_debug("GET_MAX_DATAGRAM_SIZE failed, use size=%u\n",
                                                CDC_NCM_MIN_DATAGRAM_SIZE);
+                        kfree(max_datagram_size);
                } else {
-                        ctx->max_datagram_size = le16_to_cpu(max_datagram_size);
+                        ctx->max_datagram_size =
+                                le16_to_cpu(*max_datagram_size);
                        /* Check Eth descriptor value */
                        if (eth_max_sz < CDC_NCM_MAX_DATAGRAM_SIZE) {
                                if (ctx->max_datagram_size > eth_max_sz)
@@ -360,8 +387,10 @@ static u8 cdc_ncm_setup(struct cdc_ncm_ctx *ctx)
                                                USB_TYPE_CLASS | USB_DIR_OUT
                                                 | USB_RECIP_INTERFACE,
                                                0,
-                                                iface_no, &max_datagram_size,
+                                                iface_no, max_datagram_size,
                                                2, 1000);
+                        kfree(max_datagram_size);
+max_dgram_err:
                        if (err < 0)
                                pr_debug("SET_MAX_DATAGRAM_SIZE failed\n");
                }
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index deb1eca13c9f..7c5336c5c37f 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -515,10 +515,6 @@ static void velocity_init_cam_filter(struct velocity_info *vptr)
        mac_set_cam_mask(regs, vptr->mCAMmask);
        /* Enable VCAMs */
-        if (test_bit(0, vptr->active_vlans))
-                WORD_REG_BITS_ON(MCFG_RTGOPT, &regs->MCFG);
        for_each_set_bit(vid, vptr->active_vlans, VLAN_N_VID) {
                mac_set_vlan_cam(regs, i, (u8 *) &vid);
                vptr->vCAMmask[i / 8] |= 0x1 << (i % 8);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 1cbacb389652..0959583feb27 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1929,14 +1929,17 @@ static void
 vmxnet3_vlan_rx_add_vid(struct net_device *netdev, u16 vid)
 {
        struct vmxnet3_adapter *adapter = netdev_priv(netdev);
-        u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
-        unsigned long flags;
-        VMXNET3_SET_VFTABLE_ENTRY(vfTable, vid);
+        if (!(netdev->flags & IFF_PROMISC)) {
-        spin_lock_irqsave(&adapter->cmd_lock, flags);
+                u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
-        VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                unsigned long flags;
-                               VMXNET3_CMD_UPDATE_VLAN_FILTERS);
-        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+                VMXNET3_SET_VFTABLE_ENTRY(vfTable, vid);
+                spin_lock_irqsave(&adapter->cmd_lock, flags);
+                VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                                       VMXNET3_CMD_UPDATE_VLAN_FILTERS);
+                spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+        }
        set_bit(vid, adapter->active_vlans);
 }
@@ -1946,14 +1949,17 @@ static void
 vmxnet3_vlan_rx_kill_vid(struct net_device *netdev, u16 vid)
 {
        struct vmxnet3_adapter *adapter = netdev_priv(netdev);
-        u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
-        unsigned long flags;
-        VMXNET3_CLEAR_VFTABLE_ENTRY(vfTable, vid);
+        if (!(netdev->flags & IFF_PROMISC)) {
-        spin_lock_irqsave(&adapter->cmd_lock, flags);
+                u32 *vfTable = adapter->shared->devRead.rxFilterConf.vfTable;
-        VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                unsigned long flags;
-                               VMXNET3_CMD_UPDATE_VLAN_FILTERS);
-        spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+                VMXNET3_CLEAR_VFTABLE_ENTRY(vfTable, vid);
+                spin_lock_irqsave(&adapter->cmd_lock, flags);
+                VMXNET3_WRITE_BAR1_REG(adapter, VMXNET3_REG_CMD,
+                                       VMXNET3_CMD_UPDATE_VLAN_FILTERS);
+                spin_unlock_irqrestore(&adapter->cmd_lock, flags);
+        }
        clear_bit(vid, adapter->active_vlans);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-pci.c b/drivers/net/wireless/iwlwifi/iwl-pci.c
index 69d4ec467dca..2fdbffa079c1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-pci.c
+++ b/drivers/net/wireless/iwlwifi/iwl-pci.c
@@ -478,27 +478,22 @@ out_no_pci:
        return err;
 }
-static void iwl_pci_down(struct iwl_bus *bus)
-{
-        struct iwl_pci_bus *pci_bus = (struct iwl_pci_bus *) bus->bus_specific;
-        pci_disable_msi(pci_bus->pci_dev);
-        pci_iounmap(pci_bus->pci_dev, pci_bus->hw_base);
-        pci_release_regions(pci_bus->pci_dev);
-        pci_disable_device(pci_bus->pci_dev);
-        pci_set_drvdata(pci_bus->pci_dev, NULL);
-        kfree(bus);
-}
 static void __devexit iwl_pci_remove(struct pci_dev *pdev)
 {
        struct iwl_priv *priv = pci_get_drvdata(pdev);
-        void *bus_specific = priv->bus->bus_specific;
+        struct iwl_bus *bus = priv->bus;
+        struct iwl_pci_bus *pci_bus = IWL_BUS_GET_PCI_BUS(bus);
+        struct pci_dev *pci_dev = IWL_BUS_GET_PCI_DEV(bus);
        iwl_remove(priv);
-        iwl_pci_down(bus_specific);
+        pci_disable_msi(pci_dev);
+        pci_iounmap(pci_dev, pci_bus->hw_base);
+        pci_release_regions(pci_dev);
+        pci_disable_device(pci_dev);
+        pci_set_drvdata(pci_dev, NULL);
+        kfree(bus);
 }
 #ifdef CONFIG_PM
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 939563162fb3..dbf501ca317f 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -464,6 +464,15 @@ static bool rt2800usb_txdone_entry_check(struct queue_entry *entry, u32 reg)
        int wcid, ack, pid;
        int tx_wcid, tx_ack, tx_pid;
+        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+            !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags)) {
+                WARNING(entry->queue->rt2x00dev,
+                        "Data pending for entry %u in queue %u\n",
+                        entry->entry_idx, entry->queue->qid);
+                cond_resched();
+                return false;
+        }
        wcid    = rt2x00_get_field32(reg, TX_STA_FIFO_WCID);
        ack     = rt2x00_get_field32(reg, TX_STA_FIFO_TX_ACK_REQUIRED);
        pid     = rt2x00_get_field32(reg, TX_STA_FIFO_PID_TYPE);
@@ -529,12 +538,11 @@ static void rt2800usb_txdone(struct rt2x00_dev *rt2x00dev)
                        entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
                        if (rt2800usb_txdone_entry_check(entry, reg))
                                break;
+                        entry = NULL;
                }
-                if (!entry || rt2x00queue_empty(queue))
+                if (entry)
-                        break;
+                        rt2800_txdone_entry(entry, reg);
-                rt2800_txdone_entry(entry, reg);
        }
 }
@@ -558,8 +566,10 @@ static void rt2800usb_work_txdone(struct work_struct *work)
                while (!rt2x00queue_empty(queue)) {
                        entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
-                        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+                        if (test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags) ||
+                            !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags))
                                break;
                        if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags))
                                rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE);
                        else if (rt2x00queue_status_timeout(entry))
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index b6b4542c2460..7fbb55c9da82 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -262,23 +262,20 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
        struct queue_entry *entry = (struct queue_entry *)urb->context;
        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        if (!test_and_clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
+        if (!test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
                return;
-        if (rt2x00dev->ops->lib->tx_dma_done)
-                rt2x00dev->ops->lib->tx_dma_done(entry);
-        /*
-         * Report the frame as DMA done
-         */
-        rt2x00lib_dmadone(entry);
        /*
         * Check if the frame was correctly uploaded
         */
        if (urb->status)
                set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
+        /*
+         * Report the frame as DMA done
+         */
+        rt2x00lib_dmadone(entry);
+        if (rt2x00dev->ops->lib->tx_dma_done)
+                rt2x00dev->ops->lib->tx_dma_done(entry);
        /*
         * Schedule the delayed work for reading the TX status
         * from the device.
diff --git a/drivers/net/wireless/wl12xx/acx.c b/drivers/net/wireless/wl12xx/acx.c
index 7e33f1f4f3d4..34f6ab53e519 100644
--- a/drivers/net/wireless/wl12xx/acx.c
+++ b/drivers/net/wireless/wl12xx/acx.c
@@ -77,8 +77,6 @@ int wl1271_acx_sleep_auth(struct wl1271 *wl, u8 sleep_auth)
        auth->sleep_auth = sleep_auth;
        ret = wl1271_cmd_configure(wl, ACX_SLEEP_AUTH, auth, sizeof(*auth));
-        if (ret < 0)
-                return ret;
 out:
        kfree(auth);
@@ -624,10 +622,8 @@ int wl1271_acx_cca_threshold(struct wl1271 *wl)
        ret = wl1271_cmd_configure(wl, ACX_CCA_THRESHOLD,
                                   detection, sizeof(*detection));
-        if (ret < 0) {
+        if (ret < 0)
                wl1271_warning("failed to set cca threshold: %d", ret);
-                return ret;
-        }
 out:
        kfree(detection);
diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
index 5d5e1ef87206..88add68bd9ac 100644
--- a/drivers/net/wireless/wl12xx/testmode.c
+++ b/drivers/net/wireless/wl12xx/testmode.c
@@ -139,12 +139,15 @@ static int wl1271_tm_cmd_interrogate(struct wl1271 *wl, struct nlattr *tb[])
        if (ret < 0) {
                wl1271_warning("testmode cmd interrogate failed: %d", ret);
+                kfree(cmd);
                return ret;
        }
        skb = cfg80211_testmode_alloc_reply_skb(wl->hw->wiphy, sizeof(*cmd));
-        if (!skb)
+        if (!skb) {
+                kfree(cmd);
                return -ENOMEM;
+        }
        NLA_PUT(skb, WL1271_TM_ATTR_DATA, sizeof(*cmd), cmd);
diff --git a/drivers/pci/hotplug/pcihp_slot.c b/drivers/pci/hotplug/pcihp_slot.c
index 749fdf070319..753b21aaea61 100644
--- a/drivers/pci/hotplug/pcihp_slot.c
+++ b/drivers/pci/hotplug/pcihp_slot.c
@@ -158,47 +158,6 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
         */
 }
-/* Program PCIE MaxPayload setting on device: ensure parent maxpayload <= device */
-static int pci_set_payload(struct pci_dev *dev)
-{
-       int pos, ppos;
-       u16 pctl, psz;
-       u16 dctl, dsz, dcap, dmax;
-       struct pci_dev *parent;
-       parent = dev->bus->self;
-       pos = pci_find_capability(dev, PCI_CAP_ID_EXP);
-       if (!pos)
-               return 0;
-       /* Read Device MaxPayload capability and setting */
-       pci_read_config_word(dev, pos + PCI_EXP_DEVCTL, &dctl);
-       pci_read_config_word(dev, pos + PCI_EXP_DEVCAP, &dcap);
-       dsz = (dctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5;
-       dmax = (dcap & PCI_EXP_DEVCAP_PAYLOAD);
-       /* Read Parent MaxPayload setting */
-       ppos = pci_find_capability(parent, PCI_CAP_ID_EXP);
-       if (!ppos)
-               return 0;
-       pci_read_config_word(parent, ppos + PCI_EXP_DEVCTL, &pctl);
-       psz = (pctl &  PCI_EXP_DEVCTL_PAYLOAD) >> 5;
-       /* If parent payload > device max payload -> error
-        * If parent payload > device payload -> set speed
-        * If parent payload <= device payload -> do nothing
-        */
-       if (psz > dmax)
-               return -1;
-       else if (psz > dsz) {
-               dev_info(&dev->dev, "Setting MaxPayload to %d\n", 128 << psz);
-               pci_write_config_word(dev, pos + PCI_EXP_DEVCTL,
-                                     (dctl & ~PCI_EXP_DEVCTL_PAYLOAD) +
-                                     (psz << 5));
-       }
-       return 0;
-}
 void pci_configure_slot(struct pci_dev *dev)
 {
        struct pci_dev *cdev;
@@ -210,9 +169,7 @@ void pci_configure_slot(struct pci_dev *dev)
                        (dev->class >> 8) == PCI_CLASS_BRIDGE_PCI)))
                return;
-       ret = pci_set_payload(dev);
+        pcie_bus_configure_settings(dev->bus, dev->bus->self->pcie_mpss);
-       if (ret)
-               dev_warn(&dev->dev, "could not set device max payload\n");
        memset(&hpp, 0, sizeof(hpp));
        ret = pci_get_hp_params(dev, &hpp);
diff --git a/drivers/pci/of.c b/drivers/pci/of.c
index c94d37ec55c8..f0929934bb7a 100644
--- a/drivers/pci/of.c
+++ b/drivers/pci/of.c
@@ -55,7 +55,7 @@ struct device_node * __weak pcibios_get_phb_of_node(struct pci_bus *bus)
         */
        if (bus->bridge->of_node)
                return of_node_get(bus->bridge->of_node);
-        if (bus->bridge->parent->of_node)
+        if (bus->bridge->parent && bus->bridge->parent->of_node)
                return of_node_get(bus->bridge->parent->of_node);
        return NULL;
 }
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 08a95b369d85..0ce67423a0a3 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -77,6 +77,8 @@ unsigned long pci_cardbus_mem_size = DEFAULT_CARDBUS_MEM_SIZE;
 unsigned long pci_hotplug_io_size  = DEFAULT_HOTPLUG_IO_SIZE;
 unsigned long pci_hotplug_mem_size = DEFAULT_HOTPLUG_MEM_SIZE;
+enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_PERFORMANCE;
 /*
 * The default CLS is used if arch didn't set CLS explicitly and not
 * all pci devices agree on the same value.  Arch can override either
@@ -3223,6 +3225,67 @@ out:
 EXPORT_SYMBOL(pcie_set_readrq);
 /**
+ * pcie_get_mps - get PCI Express maximum payload size
+ * @dev: PCI device to query
+ *
+ * Returns maximum payload size in bytes
+ *    or appropriate error value.
+ */
+int pcie_get_mps(struct pci_dev *dev)
+{
+        int ret, cap;
+        u16 ctl;
+        cap = pci_pcie_cap(dev);
+        if (!cap)
+                return -EINVAL;
+        ret = pci_read_config_word(dev, cap + PCI_EXP_DEVCTL, &ctl);
+        if (!ret)
+                ret = 128 << ((ctl & PCI_EXP_DEVCTL_PAYLOAD) >> 5);
+        return ret;
+}
+/**
+ * pcie_set_mps - set PCI Express maximum payload size
+ * @dev: PCI device to query
+ * @mps: maximum payload size in bytes
+ *    valid values are 128, 256, 512, 1024, 2048, 4096
+ *
+ * If possible sets maximum payload size
+ */
+int pcie_set_mps(struct pci_dev *dev, int mps)
+{
+        int cap, err = -EINVAL;
+        u16 ctl, v;
+        if (mps < 128 || mps > 4096 || !is_power_of_2(mps))
+                goto out;
+        v = ffs(mps) - 8;
+        if (v > dev->pcie_mpss) 
+                goto out;
+        v <<= 5;
+        cap = pci_pcie_cap(dev);
+        if (!cap)
+                goto out;
+        err = pci_read_config_word(dev, cap + PCI_EXP_DEVCTL, &ctl);
+        if (err)
+                goto out;
+        if ((ctl & PCI_EXP_DEVCTL_PAYLOAD) != v) {
+                ctl &= ~PCI_EXP_DEVCTL_PAYLOAD;
+                ctl |= v;
+                err = pci_write_config_word(dev, cap + PCI_EXP_DEVCTL, ctl);
+        }
+out:
+        return err;
+}
+/**
 * pci_select_bars - Make BAR mask from the type of resource
 * @dev: the PCI device for which BAR mask is made
 * @flags: resource type mask to be selected
@@ -3505,6 +3568,10 @@ static int __init pci_setup(char *str)
                                pci_hotplug_io_size = memparse(str + 9, &str);
                        } else if (!strncmp(str, "hpmemsize=", 10)) {
                                pci_hotplug_mem_size = memparse(str + 10, &str);
+                        } else if (!strncmp(str, "pcie_bus_safe", 13)) {
+                                pcie_bus_config = PCIE_BUS_SAFE;
+                        } else if (!strncmp(str, "pcie_bus_perf", 13)) {
+                                pcie_bus_config = PCIE_BUS_PERFORMANCE;
                        } else {
                                printk(KERN_ERR "PCI: Unknown option `%s'\n",
                                                str);
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index c8cee764b0de..b74084e9ca12 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -283,6 +283,8 @@ static inline int pci_iov_bus_range(struct pci_bus *bus)
 #endif /* CONFIG_PCI_IOV */
+extern unsigned long pci_cardbus_resource_alignment(struct resource *);
 static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
                                         struct resource *res)
 {
@@ -292,6 +294,8 @@ static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
        if (resno >= PCI_IOV_RESOURCES && resno <= PCI_IOV_RESOURCE_END)
                return pci_sriov_resource_alignment(dev, resno);
 #endif
+        if (dev->class >> 8  == PCI_CLASS_BRIDGE_CARDBUS)
+                return pci_cardbus_resource_alignment(res);
        return resource_alignment(res);
 }
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 795c9026d55f..8473727b29fa 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -856,6 +856,8 @@ void set_pcie_port_type(struct pci_dev *pdev)
        pdev->pcie_cap = pos;
        pci_read_config_word(pdev, pos + PCI_EXP_FLAGS, &reg16);
        pdev->pcie_type = (reg16 & PCI_EXP_FLAGS_TYPE) >> 4;
+        pci_read_config_word(pdev, pos + PCI_EXP_DEVCAP, &reg16);
+        pdev->pcie_mpss = reg16 & PCI_EXP_DEVCAP_PAYLOAD;
 }
 void set_pcie_hotplug_bridge(struct pci_dev *pdev)
@@ -1326,6 +1328,150 @@ int pci_scan_slot(struct pci_bus *bus, int devfn)
        return nr;
 }
+static int pcie_find_smpss(struct pci_dev *dev, void *data)
+{
+        u8 *smpss = data;
+        if (!pci_is_pcie(dev))
+                return 0;
+        /* For PCIE hotplug enabled slots not connected directly to a
+         * PCI-E root port, there can be problems when hotplugging
+         * devices.  This is due to the possibility of hotplugging a
+         * device into the fabric with a smaller MPS that the devices
+         * currently running have configured.  Modifying the MPS on the
+         * running devices could cause a fatal bus error due to an
+         * incoming frame being larger than the newly configured MPS.
+         * To work around this, the MPS for the entire fabric must be
+         * set to the minimum size.  Any devices hotplugged into this
+         * fabric will have the minimum MPS set.  If the PCI hotplug
+         * slot is directly connected to the root port and there are not
+         * other devices on the fabric (which seems to be the most
+         * common case), then this is not an issue and MPS discovery
+         * will occur as normal.
+         */
+        if (dev->is_hotplug_bridge && (!list_is_singular(&dev->bus->devices) ||
+            dev->bus->self->pcie_type != PCI_EXP_TYPE_ROOT_PORT))
+                *smpss = 0;
+        if (*smpss > dev->pcie_mpss)
+                *smpss = dev->pcie_mpss;
+        return 0;
+}
+static void pcie_write_mps(struct pci_dev *dev, int mps)
+{
+        int rc, dev_mpss;
+        dev_mpss = 128 << dev->pcie_mpss;
+        if (pcie_bus_config == PCIE_BUS_PERFORMANCE) {
+                if (dev->bus->self) {
+                        dev_dbg(&dev->bus->dev, "Bus MPSS %d\n",
+                                128 << dev->bus->self->pcie_mpss);
+                        /* For "MPS Force Max", the assumption is made that
+                         * downstream communication will never be larger than
+                         * the MRRS.  So, the MPS only needs to be configured
+                         * for the upstream communication.  This being the case,
+                         * walk from the top down and set the MPS of the child
+                         * to that of the parent bus.
+                         */
+                        mps = 128 << dev->bus->self->pcie_mpss;
+                        if (mps > dev_mpss)
+                                dev_warn(&dev->dev, "MPS configured higher than"
+                                         " maximum supported by the device.  If"
+                                         " a bus issue occurs, try running with"
+                                         " pci=pcie_bus_safe.\n");
+                }
+                dev->pcie_mpss = ffs(mps) - 8;
+        }
+        rc = pcie_set_mps(dev, mps);
+        if (rc)
+                dev_err(&dev->dev, "Failed attempting to set the MPS\n");
+}
+static void pcie_write_mrrs(struct pci_dev *dev, int mps)
+{
+        int rc, mrrs;
+        if (pcie_bus_config == PCIE_BUS_PERFORMANCE) {
+                int dev_mpss = 128 << dev->pcie_mpss;
+                /* For Max performance, the MRRS must be set to the largest
+                 * supported value.  However, it cannot be configured larger
+                 * than the MPS the device or the bus can support.  This assumes
+                 * that the largest MRRS available on the device cannot be
+                 * smaller than the device MPSS.
+                 */
+                mrrs = mps < dev_mpss ? mps : dev_mpss;
+        } else
+                /* In the "safe" case, configure the MRRS for fairness on the
+                 * bus by making all devices have the same size
+                 */
+                mrrs = mps;
+        /* MRRS is a R/W register.  Invalid values can be written, but a
+         * subsiquent read will verify if the value is acceptable or not.
+         * If the MRRS value provided is not acceptable (e.g., too large),
+         * shrink the value until it is acceptable to the HW.
+         */
+        while (mrrs != pcie_get_readrq(dev) && mrrs >= 128) {
+                rc = pcie_set_readrq(dev, mrrs);
+                if (rc)
+                        dev_err(&dev->dev, "Failed attempting to set the MRRS\n");
+                mrrs /= 2;
+        }
+}
+static int pcie_bus_configure_set(struct pci_dev *dev, void *data)
+{
+        int mps = 128 << *(u8 *)data;
+        if (!pci_is_pcie(dev))
+                return 0;
+        dev_info(&dev->dev, "Dev MPS %d MPSS %d MRRS %d\n",
+                 pcie_get_mps(dev), 128<<dev->pcie_mpss, pcie_get_readrq(dev));
+        pcie_write_mps(dev, mps);
+        pcie_write_mrrs(dev, mps);
+        dev_info(&dev->dev, "Dev MPS %d MPSS %d MRRS %d\n",
+                 pcie_get_mps(dev), 128<<dev->pcie_mpss, pcie_get_readrq(dev));
+        return 0;
+}
+/* pcie_bus_configure_mps requires that pci_walk_bus work in a top-down,
+ * parents then children fashion.  If this changes, then this code will not
+ * work as designed.
+ */
+void pcie_bus_configure_settings(struct pci_bus *bus, u8 mpss)
+{
+        u8 smpss = mpss;
+        if (!bus->self)
+                return;
+        if (!pci_is_pcie(bus->self))
+                return;
+        if (pcie_bus_config == PCIE_BUS_SAFE) {
+                pcie_find_smpss(bus->self, &smpss);
+                pci_walk_bus(bus, pcie_find_smpss, &smpss);
+        }
+        pcie_bus_configure_set(bus->self, &smpss);
+        pci_walk_bus(bus, pcie_bus_configure_set, &smpss);
+}
+EXPORT_SYMBOL_GPL(pcie_bus_configure_settings);
 unsigned int __devinit pci_scan_child_bus(struct pci_bus *bus)
 {
        unsigned int devfn, pass, max = bus->secondary;
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 8a1d3c7863a8..784da9d36029 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -34,6 +34,7 @@ struct resource_list_x {
        resource_size_t start;
        resource_size_t end;
        resource_size_t add_size;
+        resource_size_t min_align;
        unsigned long flags;
 };
@@ -65,7 +66,7 @@ void pci_realloc(void)
 */
 static void add_to_list(struct resource_list_x *head,
                 struct pci_dev *dev, struct resource *res,
-                 resource_size_t add_size)
+                 resource_size_t add_size, resource_size_t min_align)
 {
        struct resource_list_x *list = head;
        struct resource_list_x *ln = list->next;
@@ -84,13 +85,16 @@ static void add_to_list(struct resource_list_x *head,
        tmp->end = res->end;
        tmp->flags = res->flags;
        tmp->add_size = add_size;
+        tmp->min_align = min_align;
        list->next = tmp;
 }
 static void add_to_failed_list(struct resource_list_x *head,
                                struct pci_dev *dev, struct resource *res)
 {
-        add_to_list(head, dev, res, 0);
+        add_to_list(head, dev, res,
+                        0 /* dont care */,
+                        0 /* dont care */);
 }
 static void __dev_sort_resources(struct pci_dev *dev,
@@ -121,18 +125,18 @@ static inline void reset_resource(struct resource *res)
 }
 /**
- * adjust_resources_sorted() - satisfy any additional resource requests
+ * reassign_resources_sorted() - satisfy any additional resource requests
 *
- * @add_head : head of the list tracking requests requiring additional
+ * @realloc_head : head of the list tracking requests requiring additional
 *             resources
 * @head     : head of the list tracking requests with allocated
 *             resources
 *
- * Walk through each element of the add_head and try to procure
+ * Walk through each element of the realloc_head and try to procure
 * additional resources for the element, provided the element
 * is in the head list.
 */
-static void adjust_resources_sorted(struct resource_list_x *add_head,
+static void reassign_resources_sorted(struct resource_list_x *realloc_head,
                struct resource_list *head)
 {
        struct resource *res;
@@ -141,8 +145,8 @@ static void adjust_resources_sorted(struct resource_list_x *add_head,
        resource_size_t add_size;
        int idx;
-        prev = add_head;
+        prev = realloc_head;
-        for (list = add_head->next; list;) {
+        for (list = realloc_head->next; list;) {
                res = list->res;
                /* skip resource that has been reset */
                if (!res->flags)
@@ -159,13 +163,17 @@ static void adjust_resources_sorted(struct resource_list_x *add_head,
                idx = res - &list->dev->resource[0];
                add_size=list->add_size;
-                if (!resource_size(res) && add_size) {
+                if (!resource_size(res)) {
-                         res->end = res->start + add_size - 1;
+                        res->start = list->start;
-                         if(pci_assign_resource(list->dev, idx))
+                        res->end = res->start + add_size - 1;
+                        if(pci_assign_resource(list->dev, idx))
                                reset_resource(res);
-                } else if (add_size) {
+                } else {
-                        adjust_resource(res, res->start,
+                        resource_size_t align = list->min_align;
-                                resource_size(res) + add_size);
+                        res->flags |= list->flags & (IORESOURCE_STARTALIGN|IORESOURCE_SIZEALIGN);
+                        if (pci_reassign_resource(list->dev, idx, add_size, align))
+                                dev_printk(KERN_DEBUG, &list->dev->dev, "failed to add optional resources res=%pR\n",
+                                                        res);
                }
 out:
                tmp = list;
@@ -210,16 +218,16 @@ static void assign_requested_resources_sorted(struct resource_list *head,
 }
 static void __assign_resources_sorted(struct resource_list *head,
-                                 struct resource_list_x *add_head,
+                                 struct resource_list_x *realloc_head,
                                 struct resource_list_x *fail_head)
 {
        /* Satisfy the must-have resource requests */
        assign_requested_resources_sorted(head, fail_head);
-        /* Try to satisfy any additional nice-to-have resource
+        /* Try to satisfy any additional optional resource
                requests */
-        if (add_head)
+        if (realloc_head)
-                adjust_resources_sorted(add_head, head);
+                reassign_resources_sorted(realloc_head, head);
        free_list(resource_list, head);
 }
@@ -235,7 +243,7 @@ static void pdev_assign_resources_sorted(struct pci_dev *dev,
 }
 static void pbus_assign_resources_sorted(const struct pci_bus *bus,
-                                         struct resource_list_x *add_head,
+                                         struct resource_list_x *realloc_head,
                                         struct resource_list_x *fail_head)
 {
        struct pci_dev *dev;
@@ -245,7 +253,7 @@ static void pbus_assign_resources_sorted(const struct pci_bus *bus,
        list_for_each_entry(dev, &bus->devices, bus_list)
                __dev_sort_resources(dev, &head);
-        __assign_resources_sorted(&head, add_head, fail_head);
+        __assign_resources_sorted(&head, realloc_head, fail_head);
 }
 void pci_setup_cardbus(struct pci_bus *bus)
@@ -540,13 +548,27 @@ static resource_size_t calculate_memsize(resource_size_t size,
        return size;
 }
+static resource_size_t get_res_add_size(struct resource_list_x *realloc_head,
+                                        struct resource *res)
+{
+        struct resource_list_x *list;
+        /* check if it is in realloc_head list */
+        for (list = realloc_head->next; list && list->res != res;
+                        list = list->next);
+        if (list)
+                return list->add_size;
+        return 0;
+}
 /**
 * pbus_size_io() - size the io window of a given bus
 *
 * @bus : the bus
 * @min_size : the minimum io window that must to be allocated
 * @add_size : additional optional io window
- * @add_head : track the additional io window on this list
+ * @realloc_head : track the additional io window on this list
 *
 * Sizing the IO windows of the PCI-PCI bridge is trivial,
 * since these windows have 4K granularity and the IO ranges
@@ -554,11 +576,12 @@ static resource_size_t calculate_memsize(resource_size_t size,
 * We must be careful with the ISA aliasing though.
 */
 static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
-                resource_size_t add_size, struct resource_list_x *add_head)
+                resource_size_t add_size, struct resource_list_x *realloc_head)
 {
        struct pci_dev *dev;
        struct resource *b_res = find_free_bus_resource(bus, IORESOURCE_IO);
        unsigned long size = 0, size0 = 0, size1 = 0;
+        resource_size_t children_add_size = 0;
        if (!b_res)
                return;
@@ -579,11 +602,16 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
                                size += r_size;
                        else
                                size1 += r_size;
+                        if (realloc_head)
+                                children_add_size += get_res_add_size(realloc_head, r);
                }
        }
        size0 = calculate_iosize(size, min_size, size1,
                        resource_size(b_res), 4096);
-        size1 = (!add_head || (add_head && !add_size)) ? size0 :
+        if (children_add_size > add_size)
+                add_size = children_add_size;
+        size1 = (!realloc_head || (realloc_head && !add_size)) ? size0 :
                calculate_iosize(size, min_size+add_size, size1,
                        resource_size(b_res), 4096);
        if (!size0 && !size1) {
@@ -598,8 +626,8 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
        b_res->start = 4096;
        b_res->end = b_res->start + size0 - 1;
        b_res->flags |= IORESOURCE_STARTALIGN;
-        if (size1 > size0 && add_head)
+        if (size1 > size0 && realloc_head)
-                add_to_list(add_head, bus->self, b_res, size1-size0);
+                add_to_list(realloc_head, bus->self, b_res, size1-size0, 4096);
 }
 /**
@@ -608,7 +636,7 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
 * @bus : the bus
 * @min_size : the minimum memory window that must to be allocated
 * @add_size : additional optional memory window
- * @add_head : track the additional memory window on this list
+ * @realloc_head : track the additional memory window on this list
 *
 * Calculate the size of the bus and minimal alignment which
 * guarantees that all child resources fit in this size.
@@ -616,7 +644,7 @@ static void pbus_size_io(struct pci_bus *bus, resource_size_t min_size,
 static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
                         unsigned long type, resource_size_t min_size,
                        resource_size_t add_size,
-                        struct resource_list_x *add_head)
+                        struct resource_list_x *realloc_head)
 {
        struct pci_dev *dev;
        resource_size_t min_align, align, size, size0, size1;
@@ -624,6 +652,7 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
        int order, max_order;
        struct resource *b_res = find_free_bus_resource(bus, type);
        unsigned int mem64_mask = 0;
+        resource_size_t children_add_size = 0;
        if (!b_res)
                return 0;
@@ -645,6 +674,16 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
                        if (r->parent || (r->flags & mask) != type)
                                continue;
                        r_size = resource_size(r);
+#ifdef CONFIG_PCI_IOV
+                        /* put SRIOV requested res to the optional list */
+                        if (realloc_head && i >= PCI_IOV_RESOURCES &&
+                                        i <= PCI_IOV_RESOURCE_END) {
+                                r->end = r->start - 1;
+                                add_to_list(realloc_head, dev, r, r_size, 0/* dont' care */);
+                                children_add_size += r_size;
+                                continue;
+                        }
+#endif
                        /* For bridges size != alignment */
                        align = pci_resource_alignment(dev, r);
                        order = __ffs(align) - 20;
@@ -665,6 +704,9 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
                        if (order > max_order)
                                max_order = order;
                        mem64_mask &= r->flags & IORESOURCE_MEM_64;
+                        if (realloc_head)
+                                children_add_size += get_res_add_size(realloc_head, r);
                }
        }
        align = 0;
@@ -681,7 +723,9 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
                align += aligns[order];
        }
        size0 = calculate_memsize(size, min_size, 0, resource_size(b_res), min_align);
-        size1 = (!add_head || (add_head && !add_size)) ? size0 :
+        if (children_add_size > add_size)
+                add_size = children_add_size;
+        size1 = (!realloc_head || (realloc_head && !add_size)) ? size0 :
                calculate_memsize(size, min_size+add_size, 0,
                                resource_size(b_res), min_align);
        if (!size0 && !size1) {
@@ -695,12 +739,22 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask,
        b_res->start = min_align;
        b_res->end = size0 + min_align - 1;
        b_res->flags |= IORESOURCE_STARTALIGN | mem64_mask;
-        if (size1 > size0 && add_head)
+        if (size1 > size0 && realloc_head)
-                add_to_list(add_head, bus->self, b_res, size1-size0);
+                add_to_list(realloc_head, bus->self, b_res, size1-size0, min_align);
        return 1;
 }
-static void pci_bus_size_cardbus(struct pci_bus *bus)
+unsigned long pci_cardbus_resource_alignment(struct resource *res)
+{
+        if (res->flags & IORESOURCE_IO)
+                return pci_cardbus_io_size;
+        if (res->flags & IORESOURCE_MEM)
+                return pci_cardbus_mem_size;
+        return 0;
+}
+static void pci_bus_size_cardbus(struct pci_bus *bus,
+                        struct resource_list_x *realloc_head)
 {
        struct pci_dev *bridge = bus->self;
        struct resource *b_res = &bridge->resource[PCI_BRIDGE_RESOURCES];
@@ -711,12 +765,14 @@ static void pci_bus_size_cardbus(struct pci_bus *bus)
         * a fixed amount of bus space for CardBus bridges.
         */
        b_res[0].start = 0;
-        b_res[0].end = pci_cardbus_io_size - 1;
        b_res[0].flags |= IORESOURCE_IO | IORESOURCE_SIZEALIGN;
+        if (realloc_head)
+                add_to_list(realloc_head, bridge, b_res, pci_cardbus_io_size, 0 /* dont care */);
        b_res[1].start = 0;
-        b_res[1].end = pci_cardbus_io_size - 1;
        b_res[1].flags |= IORESOURCE_IO | IORESOURCE_SIZEALIGN;
+        if (realloc_head)
+                add_to_list(realloc_head, bridge, b_res+1, pci_cardbus_io_size, 0 /* dont care */);
        /*
         * Check whether prefetchable memory is supported
@@ -736,21 +792,31 @@ static void pci_bus_size_cardbus(struct pci_bus *bus)
         */
        if (ctrl & PCI_CB_BRIDGE_CTL_PREFETCH_MEM0) {
                b_res[2].start = 0;
-                b_res[2].end = pci_cardbus_mem_size - 1;
                b_res[2].flags |= IORESOURCE_MEM | IORESOURCE_PREFETCH | IORESOURCE_SIZEALIGN;
+                if (realloc_head)
+                        add_to_list(realloc_head, bridge, b_res+2, pci_cardbus_mem_size, 0 /* dont care */);
                b_res[3].start = 0;
-                b_res[3].end = pci_cardbus_mem_size - 1;
                b_res[3].flags |= IORESOURCE_MEM | IORESOURCE_SIZEALIGN;
+                if (realloc_head)
+                        add_to_list(realloc_head, bridge, b_res+3, pci_cardbus_mem_size, 0 /* dont care */);
        } else {
                b_res[3].start = 0;
-                b_res[3].end = pci_cardbus_mem_size * 2 - 1;
                b_res[3].flags |= IORESOURCE_MEM | IORESOURCE_SIZEALIGN;
+                if (realloc_head)
+                        add_to_list(realloc_head, bridge, b_res+3, pci_cardbus_mem_size * 2, 0 /* dont care */);
        }
+        /* set the size of the resource to zero, so that the resource does not
+         * get assigned during required-resource allocation cycle but gets assigned
+         * during the optional-resource allocation cycle.
+         */
+        b_res[0].start = b_res[1].start = b_res[2].start = b_res[3].start = 1;
+        b_res[0].end = b_res[1].end = b_res[2].end = b_res[3].end = 0;
 }
 void __ref __pci_bus_size_bridges(struct pci_bus *bus,
-                        struct resource_list_x *add_head)
+                        struct resource_list_x *realloc_head)
 {
        struct pci_dev *dev;
        unsigned long mask, prefmask;
@@ -763,12 +829,12 @@ void __ref __pci_bus_size_bridges(struct pci_bus *bus,
                switch (dev->class >> 8) {
                case PCI_CLASS_BRIDGE_CARDBUS:
-                        pci_bus_size_cardbus(b);
+                        pci_bus_size_cardbus(b, realloc_head);
                        break;
                case PCI_CLASS_BRIDGE_PCI:
                default:
-                        __pci_bus_size_bridges(b, add_head);
+                        __pci_bus_size_bridges(b, realloc_head);
                        break;
                }
        }
@@ -792,7 +858,7 @@ void __ref __pci_bus_size_bridges(struct pci_bus *bus,
                 * Follow thru
                 */
        default:
-                pbus_size_io(bus, 0, additional_io_size, add_head);
+                pbus_size_io(bus, 0, additional_io_size, realloc_head);
                /* If the bridge supports prefetchable range, size it
                   separately. If it doesn't, or its prefetchable window
                   has already been allocated by arch code, try
@@ -800,11 +866,11 @@ void __ref __pci_bus_size_bridges(struct pci_bus *bus,
                   resources. */
                mask = IORESOURCE_MEM;
                prefmask = IORESOURCE_MEM | IORESOURCE_PREFETCH;
-                if (pbus_size_mem(bus, prefmask, prefmask, 0, additional_mem_size, add_head))
+                if (pbus_size_mem(bus, prefmask, prefmask, 0, additional_mem_size, realloc_head))
                        mask = prefmask; /* Success, size non-prefetch only. */
                else
                        additional_mem_size += additional_mem_size;
-                pbus_size_mem(bus, mask, IORESOURCE_MEM, 0, additional_mem_size, add_head);
+                pbus_size_mem(bus, mask, IORESOURCE_MEM, 0, additional_mem_size, realloc_head);
                break;
        }
 }
@@ -816,20 +882,20 @@ void __ref pci_bus_size_bridges(struct pci_bus *bus)
 EXPORT_SYMBOL(pci_bus_size_bridges);
 static void __ref __pci_bus_assign_resources(const struct pci_bus *bus,
-                                         struct resource_list_x *add_head,
+                                         struct resource_list_x *realloc_head,
                                         struct resource_list_x *fail_head)
 {
        struct pci_bus *b;
        struct pci_dev *dev;
-        pbus_assign_resources_sorted(bus, add_head, fail_head);
+        pbus_assign_resources_sorted(bus, realloc_head, fail_head);
        list_for_each_entry(dev, &bus->devices, bus_list) {
                b = dev->subordinate;
                if (!b)
                        continue;
-                __pci_bus_assign_resources(b, add_head, fail_head);
+                __pci_bus_assign_resources(b, realloc_head, fail_head);
                switch (dev->class >> 8) {
                case PCI_CLASS_BRIDGE_PCI:
@@ -1039,7 +1105,7 @@ void __init
 pci_assign_unassigned_resources(void)
 {
        struct pci_bus *bus;
-        struct resource_list_x add_list; /* list of resources that
+        struct resource_list_x realloc_list; /* list of resources that
                                        want additional resources */
        int tried_times = 0;
        enum release_type rel_type = leaf_only;
@@ -1052,7 +1118,7 @@ pci_assign_unassigned_resources(void)
        head.next = NULL;
-        add_list.next = NULL;
+        realloc_list.next = NULL;
        pci_try_num = max_depth + 1;
        printk(KERN_DEBUG "PCI: max bus depth: %d pci_try_num: %d\n",
@@ -1062,12 +1128,12 @@ again:
        /* Depth first, calculate sizes and alignments of all
           subordinate buses. */
        list_for_each_entry(bus, &pci_root_buses, node)
-                __pci_bus_size_bridges(bus, &add_list);
+                __pci_bus_size_bridges(bus, &realloc_list);
        /* Depth last, allocate resources and update the hardware. */
        list_for_each_entry(bus, &pci_root_buses, node)
-                __pci_bus_assign_resources(bus, &add_list, &head);
+                __pci_bus_assign_resources(bus, &realloc_list, &head);
-        BUG_ON(add_list.next);
+        BUG_ON(realloc_list.next);
        tried_times++;
        /* any device complain? */
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 319f359906e8..51a9095c7da4 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -128,16 +128,16 @@ void pci_disable_bridge_window(struct pci_dev *dev)
 }
 #endif  /* CONFIG_PCI_QUIRKS */
 static int __pci_assign_resource(struct pci_bus *bus, struct pci_dev *dev,
-                                 int resno)
+                int resno, resource_size_t size, resource_size_t align)
 {
        struct resource *res = dev->resource + resno;
-        resource_size_t size, min, align;
+        resource_size_t min;
        int ret;
-        size = resource_size(res);
        min = (res->flags & IORESOURCE_IO) ? PCIBIOS_MIN_IO : PCIBIOS_MIN_MEM;
-        align = pci_resource_alignment(dev, res);
        /* First, try exact prefetching match.. */
        ret = pci_bus_alloc_resource(bus, res, size, align, min,
@@ -154,56 +154,101 @@ static int __pci_assign_resource(struct pci_bus *bus, struct pci_dev *dev,
                ret = pci_bus_alloc_resource(bus, res, size, align, min, 0,
                                             pcibios_align_resource, dev);
        }
+        return ret;
+}
-        if (ret < 0 && dev->fw_addr[resno]) {
+static int pci_revert_fw_address(struct resource *res, struct pci_dev *dev, 
-                struct resource *root, *conflict;
+                int resno, resource_size_t size)
-                resource_size_t start, end;
+{
+        struct resource *root, *conflict;
+        resource_size_t start, end;
+        int ret = 0;
-                /*
+        if (res->flags & IORESOURCE_IO)
-                 * If we failed to assign anything, let's try the address
+                root = &ioport_resource;
-                 * where firmware left it.  That at least has a chance of
+        else
-                 * working, which is better than just leaving it disabled.
+                root = &iomem_resource;
-                 */
+        start = res->start;
+        end = res->end;
+        res->start = dev->fw_addr[resno];
+        res->end = res->start + size - 1;
+        dev_info(&dev->dev, "BAR %d: trying firmware assignment %pR\n",
+                 resno, res);
+        conflict = request_resource_conflict(root, res);
+        if (conflict) {
+                dev_info(&dev->dev,
+                         "BAR %d: %pR conflicts with %s %pR\n", resno,
+                         res, conflict->name, conflict);
+                res->start = start;
+                res->end = end;
+                ret = 1;
+        }
+        return ret;
+}
+static int _pci_assign_resource(struct pci_dev *dev, int resno, int size, resource_size_t min_align)
+{
+        struct resource *res = dev->resource + resno;
+        struct pci_bus *bus;
+        int ret;
+        char *type;
-                if (res->flags & IORESOURCE_IO)
+        bus = dev->bus;
-                        root = &ioport_resource;
+        while ((ret = __pci_assign_resource(bus, dev, resno, size, min_align))) {
+                if (!bus->parent || !bus->self->transparent)
+                        break;
+                bus = bus->parent;
+        }
+        if (ret) {
+                if (res->flags & IORESOURCE_MEM)
+                        if (res->flags & IORESOURCE_PREFETCH)
+                                type = "mem pref";
+                        else
+                                type = "mem";
+                else if (res->flags & IORESOURCE_IO)
+                        type = "io";
                else
-                        root = &iomem_resource;
+                        type = "unknown";
+                dev_info(&dev->dev,
-                start = res->start;
+                         "BAR %d: can't assign %s (size %#llx)\n",
-                end = res->end;
+                         resno, type, (unsigned long long) resource_size(res));
-                res->start = dev->fw_addr[resno];
-                res->end = res->start + size - 1;
-                dev_info(&dev->dev, "BAR %d: trying firmware assignment %pR\n",
-                         resno, res);
-                conflict = request_resource_conflict(root, res);
-                if (conflict) {
-                        dev_info(&dev->dev,
-                                 "BAR %d: %pR conflicts with %s %pR\n", resno,
-                                 res, conflict->name, conflict);
-                        res->start = start;
-                        res->end = end;
-                } else
-                        ret = 0;
        }
+        return ret;
+}
+int pci_reassign_resource(struct pci_dev *dev, int resno, resource_size_t addsize,
+                        resource_size_t min_align)
+{
+        struct resource *res = dev->resource + resno;
+        resource_size_t new_size;
+        int ret;
+        if (!res->parent) {
+                dev_info(&dev->dev, "BAR %d: can't reassign an unassigned resouce %pR "
+                         "\n", resno, res);
+                return -EINVAL;
+        }
+        new_size = resource_size(res) + addsize + min_align;
+        ret = _pci_assign_resource(dev, resno, new_size, min_align);
        if (!ret) {
                res->flags &= ~IORESOURCE_STARTALIGN;
                dev_info(&dev->dev, "BAR %d: assigned %pR\n", resno, res);
                if (resno < PCI_BRIDGE_RESOURCES)
                        pci_update_resource(dev, resno);
        }
        return ret;
 }
 int pci_assign_resource(struct pci_dev *dev, int resno)
 {
        struct resource *res = dev->resource + resno;
-        resource_size_t align;
+        resource_size_t align, size;
        struct pci_bus *bus;
        int ret;
-        char *type;
        align = pci_resource_alignment(dev, res);
        if (!align) {
@@ -213,34 +258,27 @@ int pci_assign_resource(struct pci_dev *dev, int resno)
        }
        bus = dev->bus;
-        while ((ret = __pci_assign_resource(bus, dev, resno))) {
+        size = resource_size(res);
-                if (bus->parent && bus->self->transparent)
+        ret = _pci_assign_resource(dev, resno, size, align);
-                        bus = bus->parent;
-                else
-                        bus = NULL;
-                if (bus)
-                        continue;
-                break;
-        }
-        if (ret) {
+        /*
-                if (res->flags & IORESOURCE_MEM)
+         * If we failed to assign anything, let's try the address
-                        if (res->flags & IORESOURCE_PREFETCH)
+         * where firmware left it.  That at least has a chance of
-                                type = "mem pref";
+         * working, which is better than just leaving it disabled.
-                        else
+         */
-                                type = "mem";
+        if (ret < 0 && dev->fw_addr[resno])
-                else if (res->flags & IORESOURCE_IO)
+                ret = pci_revert_fw_address(res, dev, resno, size);
-                        type = "io";
-                else
-                        type = "unknown";
-                dev_info(&dev->dev,
-                         "BAR %d: can't assign %s (size %#llx)\n",
-                         resno, type, (unsigned long long) resource_size(res));
-        }
+        if (!ret) {
+                res->flags &= ~IORESOURCE_STARTALIGN;
+                dev_info(&dev->dev, "BAR %d: assigned %pR\n", resno, res);
+                if (resno < PCI_BRIDGE_RESOURCES)
+                        pci_update_resource(dev, resno);
+        }
        return ret;
 }
 /* Sort resources by alignment */
 void pdev_sort_resources(struct pci_dev *dev, struct resource_list *head)
 {
diff --git a/drivers/power/max8997_charger.c b/drivers/power/max8997_charger.c
index 7106b49b26e4..ffc5033ea9c9 100644
--- a/drivers/power/max8997_charger.c
+++ b/drivers/power/max8997_charger.c
@@ -20,6 +20,7 @@
 */
 #include <linux/err.h>
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/platform_device.h>
 #include <linux/power_supply.h>
diff --git a/drivers/power/max8998_charger.c b/drivers/power/max8998_charger.c
index cc21fa2120be..ef8efadb58cb 100644
--- a/drivers/power/max8998_charger.c
+++ b/drivers/power/max8998_charger.c
@@ -20,6 +20,7 @@
 */
 #include <linux/err.h>
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/platform_device.h>
 #include <linux/power_supply.h>
diff --git a/drivers/power/s3c_adc_battery.c b/drivers/power/s3c_adc_battery.c
index a675e31b4f13..d32d0d70f9ba 100644
--- a/drivers/power/s3c_adc_battery.c
+++ b/drivers/power/s3c_adc_battery.c
@@ -20,6 +20,7 @@
 #include <linux/s3c_adc_battery.h>
 #include <linux/errno.h>
 #include <linux/init.h>
+#include <linux/module.h>
 #include <plat/adc.h>
diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c
index ee893581d4b7..ebe77dd87daf 100644
--- a/drivers/rapidio/rio-scan.c
+++ b/drivers/rapidio/rio-scan.c
@@ -505,8 +505,7 @@ static struct rio_dev __devinit *rio_setup_device(struct rio_net *net,
        rdev->dev.dma_mask = &rdev->dma_mask;
        rdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
-        if ((rdev->pef & RIO_PEF_INB_DOORBELL) &&
+        if (rdev->dst_ops & RIO_DST_OPS_DOORBELL)
-            (rdev->dst_ops & RIO_DST_OPS_DOORBELL))
                rio_init_dbell_res(&rdev->riores[RIO_DOORBELL_RESOURCE],
                                   0, 0xffff);
diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 3195dbd3ec34..44e91e598f8d 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -639,7 +639,7 @@ EXPORT_SYMBOL_GPL(rtc_irq_unregister);
 static int rtc_update_hrtimer(struct rtc_device *rtc, int enabled)
 {
        /*
-         * We unconditionally cancel the timer here, because otherwise
+         * We always cancel the timer here first, because otherwise
         * we could run into BUG_ON(timer->state != HRTIMER_STATE_CALLBACK);
         * when we manage to start the timer before the callback
         * returns HRTIMER_RESTART.
@@ -708,7 +708,7 @@ int rtc_irq_set_freq(struct rtc_device *rtc, struct rtc_task *task, int freq)
        int err = 0;
        unsigned long flags;
-        if (freq <= 0 || freq > 5000)
+        if (freq <= 0 || freq > RTC_MAX_FREQ)
                return -EINVAL;
 retry:
        spin_lock_irqsave(&rtc->irq_task_lock, flags);
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 9329dbb9ebab..4e7c04e773e0 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -152,10 +152,6 @@ static int s3c_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm)
                goto retry_get_time;
        }
-        pr_debug("read time %04d.%02d.%02d %02d:%02d:%02d\n",
-                 1900 + rtc_tm->tm_year, rtc_tm->tm_mon, rtc_tm->tm_mday,
-                 rtc_tm->tm_hour, rtc_tm->tm_min, rtc_tm->tm_sec);
        rtc_tm->tm_sec = bcd2bin(rtc_tm->tm_sec);
        rtc_tm->tm_min = bcd2bin(rtc_tm->tm_min);
        rtc_tm->tm_hour = bcd2bin(rtc_tm->tm_hour);
@@ -164,6 +160,11 @@ static int s3c_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm)
        rtc_tm->tm_year = bcd2bin(rtc_tm->tm_year);
        rtc_tm->tm_year += 100;
+        pr_debug("read time %04d.%02d.%02d %02d:%02d:%02d\n",
+                 1900 + rtc_tm->tm_year, rtc_tm->tm_mon, rtc_tm->tm_mday,
+                 rtc_tm->tm_hour, rtc_tm->tm_min, rtc_tm->tm_sec);
        rtc_tm->tm_mon -= 1;
        clk_disable(rtc_clk);
@@ -269,10 +270,9 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        clk_enable(rtc_clk);
        pr_debug("s3c_rtc_setalarm: %d, %04d.%02d.%02d %02d:%02d:%02d\n",
                 alrm->enabled,
-                 1900 + tm->tm_year, tm->tm_mon, tm->tm_mday,
+                 1900 + tm->tm_year, tm->tm_mon + 1, tm->tm_mday,
                 tm->tm_hour, tm->tm_min, tm->tm_sec);
        alrm_en = readb(base + S3C2410_RTCALM) & S3C2410_RTCALM_ALMEN;
        writeb(0x00, base + S3C2410_RTCALM);
@@ -319,49 +319,7 @@ static int s3c_rtc_proc(struct device *dev, struct seq_file *seq)
        return 0;
 }
-static int s3c_rtc_open(struct device *dev)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct rtc_device *rtc_dev = platform_get_drvdata(pdev);
-        int ret;
-        ret = request_irq(s3c_rtc_alarmno, s3c_rtc_alarmirq,
-                          IRQF_DISABLED,  "s3c2410-rtc alarm", rtc_dev);
-        if (ret) {
-                dev_err(dev, "IRQ%d error %d\n", s3c_rtc_alarmno, ret);
-                return ret;
-        }
-        ret = request_irq(s3c_rtc_tickno, s3c_rtc_tickirq,
-                          IRQF_DISABLED,  "s3c2410-rtc tick", rtc_dev);
-        if (ret) {
-                dev_err(dev, "IRQ%d error %d\n", s3c_rtc_tickno, ret);
-                goto tick_err;
-        }
-        return ret;
- tick_err:
-        free_irq(s3c_rtc_alarmno, rtc_dev);
-        return ret;
-}
-static void s3c_rtc_release(struct device *dev)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct rtc_device *rtc_dev = platform_get_drvdata(pdev);
-        /* do not clear AIE here, it may be needed for wake */
-        free_irq(s3c_rtc_alarmno, rtc_dev);
-        free_irq(s3c_rtc_tickno, rtc_dev);
-}
 static const struct rtc_class_ops s3c_rtcops = {
-        .open           = s3c_rtc_open,
-        .release        = s3c_rtc_release,
        .read_time      = s3c_rtc_gettime,
        .set_time       = s3c_rtc_settime,
        .read_alarm     = s3c_rtc_getalarm,
@@ -425,6 +383,9 @@ static int __devexit s3c_rtc_remove(struct platform_device *dev)
 {
        struct rtc_device *rtc = platform_get_drvdata(dev);
+        free_irq(s3c_rtc_alarmno, rtc);
+        free_irq(s3c_rtc_tickno, rtc);
        platform_set_drvdata(dev, NULL);
        rtc_device_unregister(rtc);
@@ -548,10 +509,32 @@ static int __devinit s3c_rtc_probe(struct platform_device *pdev)
        s3c_rtc_setfreq(&pdev->dev, 1);
+        ret = request_irq(s3c_rtc_alarmno, s3c_rtc_alarmirq,
+                          IRQF_DISABLED,  "s3c2410-rtc alarm", rtc);
+        if (ret) {
+                dev_err(&pdev->dev, "IRQ%d error %d\n", s3c_rtc_alarmno, ret);
+                goto err_alarm_irq;
+        }
+        ret = request_irq(s3c_rtc_tickno, s3c_rtc_tickirq,
+                          IRQF_DISABLED,  "s3c2410-rtc tick", rtc);
+        if (ret) {
+                dev_err(&pdev->dev, "IRQ%d error %d\n", s3c_rtc_tickno, ret);
+                free_irq(s3c_rtc_alarmno, rtc);
+                goto err_tick_irq;
+        }
        clk_disable(rtc_clk);
        return 0;
+ err_tick_irq:
+        free_irq(s3c_rtc_alarmno, rtc);
+ err_alarm_irq:
+        platform_set_drvdata(pdev, NULL);
+        rtc_device_unregister(rtc);
 err_nortc:
        s3c_rtc_enable(pdev, 0);
        clk_disable(rtc_clk);
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index eb4e034378cd..f1a2016829fc 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -249,6 +249,7 @@ static int dasd_ioctl_reset_profile(struct dasd_block *block)
 static int dasd_ioctl_read_profile(struct dasd_block *block, void __user *argp)
 {
        struct dasd_profile_info_t *data;
+        int rc = 0;
        data = kmalloc(sizeof(*data), GFP_KERNEL);
        if (!data)
@@ -279,11 +280,14 @@ static int dasd_ioctl_read_profile(struct dasd_block *block, void __user *argp)
                spin_unlock_bh(&block->profile.lock);
        } else {
                spin_unlock_bh(&block->profile.lock);
-                return -EIO;
+                rc = -EIO;
+                goto out;
        }
        if (copy_to_user(argp, data, sizeof(*data)))
-                return -EFAULT;
+                rc = -EFAULT;
-        return 0;
+out:
+        kfree(data);
+        return rc;
 }
 #else
 static int dasd_ioctl_reset_profile(struct dasd_block *block)
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index be55fb2b1b1c..837e010299a8 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -383,8 +383,10 @@ static int sclp_attach_storage(u8 id)
        switch (sccb->header.response_code) {
        case 0x0020:
                set_bit(id, sclp_storage_ids);
-                for (i = 0; i < sccb->assigned; i++)
+                for (i = 0; i < sccb->assigned; i++) {
-                        sclp_unassign_storage(sccb->entries[i] >> 16);
+                        if (sccb->entries[i])
+                                sclp_unassign_storage(sccb->entries[i] >> 16);
+                }
                break;
        default:
                rc = -EIO;
diff --git a/drivers/staging/brcm80211/brcmsmac/otp.c b/drivers/staging/brcm80211/brcmsmac/otp.c
index 34253cf37812..4a70180eba5d 100644
--- a/drivers/staging/brcm80211/brcmsmac/otp.c
+++ b/drivers/staging/brcm80211/brcmsmac/otp.c
@@ -16,6 +16,7 @@
 #include <linux/io.h>
 #include <linux/errno.h>
+#include <linux/string.h>
 #include <brcm_hw_ids.h>
 #include <chipcommon.h>
diff --git a/drivers/staging/brcm80211/brcmsmac/types.h b/drivers/staging/brcm80211/brcmsmac/types.h
index bbf21897ae0e..823b5e4672e2 100644
--- a/drivers/staging/brcm80211/brcmsmac/types.h
+++ b/drivers/staging/brcm80211/brcmsmac/types.h
@@ -18,6 +18,7 @@
 #define _BRCM_TYPES_H_
 #include <linux/types.h>
+#include <linux/io.h>
 /* Bus types */
 #define SI_BUS                  0       /* SOC Interconnect */
diff --git a/drivers/staging/gma500/mdfld_dsi_dbi.c b/drivers/staging/gma500/mdfld_dsi_dbi.c
index 02e17c9c8637..fd211f3467c4 100644
--- a/drivers/staging/gma500/mdfld_dsi_dbi.c
+++ b/drivers/staging/gma500/mdfld_dsi_dbi.c
@@ -711,10 +711,11 @@ struct mdfld_dsi_encoder *mdfld_dsi_dbi_init(struct drm_device *dev,
        /* Create drm encoder object */
        connector = &dsi_connector->base.base;
        encoder = &dbi_output->base.base;
+        /* Review this if we ever get MIPI-HDMI bridges or similar */
        drm_encoder_init(dev,
                        encoder,
                        p_funcs->encoder_funcs,
-                        DRM_MODE_ENCODER_MIPI);
+                        DRM_MODE_ENCODER_LVDS);
        drm_encoder_helper_add(encoder, p_funcs->encoder_helper_funcs);
        /* Attach to given connector */
diff --git a/drivers/staging/gma500/mdfld_dsi_dbi.h b/drivers/staging/gma500/mdfld_dsi_dbi.h
index dc6242c51d0b..f0fa986fd934 100644
--- a/drivers/staging/gma500/mdfld_dsi_dbi.h
+++ b/drivers/staging/gma500/mdfld_dsi_dbi.h
@@ -42,9 +42,6 @@
 #include "mdfld_dsi_output.h"
 #include "mdfld_output.h"
-#define DRM_MODE_ENCODER_MIPI  5
 /*
 * DBI encoder which inherits from mdfld_dsi_encoder
 */
diff --git a/drivers/staging/gma500/mdfld_dsi_dpi.c b/drivers/staging/gma500/mdfld_dsi_dpi.c
index 6e03a91e947e..e685f1217baa 100644
--- a/drivers/staging/gma500/mdfld_dsi_dpi.c
+++ b/drivers/staging/gma500/mdfld_dsi_dpi.c
@@ -777,10 +777,15 @@ struct mdfld_dsi_encoder *mdfld_dsi_dpi_init(struct drm_device *dev,
        /* Create drm encoder object */
        connector = &dsi_connector->base.base;
        encoder = &dpi_output->base.base;
+        /*
+         * On existing hardware this will be a panel of some form,
+         * if future devices also have HDMI bridges this will need
+         * revisiting
+         */
        drm_encoder_init(dev,
                        encoder,
                        p_funcs->encoder_funcs,
-                        DRM_MODE_ENCODER_MIPI);
+                        DRM_MODE_ENCODER_LVDS);
        drm_encoder_helper_add(encoder,
                                p_funcs->encoder_helper_funcs);
        
diff --git a/drivers/staging/gma500/mdfld_dsi_output.c b/drivers/staging/gma500/mdfld_dsi_output.c
index 7536095c30a0..9050c0f78b15 100644
--- a/drivers/staging/gma500/mdfld_dsi_output.c
+++ b/drivers/staging/gma500/mdfld_dsi_output.c
@@ -955,7 +955,9 @@ void mdfld_dsi_output_init(struct drm_device *dev,
        psb_output->type = (pipe == 0) ? INTEL_OUTPUT_MIPI : INTEL_OUTPUT_MIPI2;
        connector = &psb_output->base;
-        drm_connector_init(dev, connector, &mdfld_dsi_connector_funcs, DRM_MODE_CONNECTOR_MIPI);
+        /* Revisit type if MIPI/HDMI bridges ever appear on Medfield */
+        drm_connector_init(dev, connector, &mdfld_dsi_connector_funcs,
+                                                DRM_MODE_CONNECTOR_LVDS);
        drm_connector_helper_add(connector, &mdfld_dsi_connector_helper_funcs);
        
        connector->display_info.subpixel_order = SubPixelHorizontalRGB;
diff --git a/drivers/staging/gma500/medfield.h b/drivers/staging/gma500/medfield.h
index 38165e8367e5..09e9687431f1 100644
--- a/drivers/staging/gma500/medfield.h
+++ b/drivers/staging/gma500/medfield.h
@@ -21,8 +21,6 @@
 * DEALINGS IN THE SOFTWARE.
 */
-#define DRM_MODE_ENCODER_MIPI  5
 /* Medfield DSI controller registers */
 #define MIPIA_DEVICE_READY_REG                          0xb000
diff --git a/drivers/staging/gma500/psb_drv.h b/drivers/staging/gma500/psb_drv.h
index 72f487a2a1b7..fd4732dd783a 100644
--- a/drivers/staging/gma500/psb_drv.h
+++ b/drivers/staging/gma500/psb_drv.h
@@ -35,7 +35,6 @@
 /* Append new drm mode definition here, align with libdrm definition */
 #define DRM_MODE_SCALE_NO_SCALE         2
-#define DRM_MODE_CONNECTOR_MIPI         15
 enum {
        CHIP_PSB_8108 = 0,              /* Poulsbo */
diff --git a/drivers/staging/octeon/ethernet-rgmii.c b/drivers/staging/octeon/ethernet-rgmii.c
index 9c0d2936e486..c3d73f8431ae 100644
--- a/drivers/staging/octeon/ethernet-rgmii.c
+++ b/drivers/staging/octeon/ethernet-rgmii.c
@@ -26,6 +26,7 @@
 **********************************************************************/
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/interrupt.h>
 #include <linux/phy.h>
 #include <linux/ratelimit.h>
 #include <net/dst.h>
diff --git a/drivers/staging/octeon/ethernet-spi.c b/drivers/staging/octeon/ethernet-spi.c
index 970825421884..d0e2d514968a 100644
--- a/drivers/staging/octeon/ethernet-spi.c
+++ b/drivers/staging/octeon/ethernet-spi.c
@@ -26,6 +26,7 @@
 **********************************************************************/
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/interrupt.h>
 #include <net/dst.h>
 #include <asm/octeon/octeon.h>
diff --git a/drivers/staging/tidspbridge/core/dsp-clock.c b/drivers/staging/tidspbridge/core/dsp-clock.c
index 589a0554332e..3d1279c424a8 100644
--- a/drivers/staging/tidspbridge/core/dsp-clock.c
+++ b/drivers/staging/tidspbridge/core/dsp-clock.c
@@ -209,7 +209,6 @@ int dsp_clk_enable(enum dsp_clk_id clk_id)
                break;
 #ifdef CONFIG_OMAP_MCBSP
        case MCBSP_CLK:
-                omap_mcbsp_set_io_type(MCBSP_ID(clk_id), OMAP_MCBSP_POLL_IO);
                omap_mcbsp_request(MCBSP_ID(clk_id));
                omap2_mcbsp_set_clks_src(MCBSP_ID(clk_id), MCBSP_CLKS_PAD_SRC);
                break;
diff --git a/drivers/staging/zcache/tmem.c b/drivers/staging/zcache/tmem.c
index 975e34bcd722..1ca66ea9b281 100644
--- a/drivers/staging/zcache/tmem.c
+++ b/drivers/staging/zcache/tmem.c
@@ -604,7 +604,7 @@ int tmem_get(struct tmem_pool *pool, struct tmem_oid *oidp, uint32_t index,
        struct tmem_obj *obj;
        void *pampd;
        bool ephemeral = is_ephemeral(pool);
-        uint32_t ret = -1;
+        int ret = -1;
        struct tmem_hashbucket *hb;
        bool free = (get_and_free == 1) || ((get_and_free == 0) && ephemeral);
        bool lock_held = false;
diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
index 855a5bb56a47..a3f5162bfedc 100644
--- a/drivers/staging/zcache/zcache-main.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -1158,7 +1158,7 @@ static void *zcache_pampd_create(char *data, size_t size, bool raw, int eph,
        size_t clen;
        int ret;
        unsigned long count;
-        struct page *page = virt_to_page(data);
+        struct page *page = (struct page *)(data);
        struct zcache_client *cli = pool->client;
        uint16_t client_id = get_client_id_from_client(cli);
        unsigned long zv_mean_zsize;
@@ -1227,7 +1227,7 @@ static int zcache_pampd_get_data(char *data, size_t *bufsize, bool raw,
        int ret = 0;
        BUG_ON(is_ephemeral(pool));
-        zv_decompress(virt_to_page(data), pampd);
+        zv_decompress((struct page *)(data), pampd);
        return ret;
 }
@@ -1539,7 +1539,7 @@ static int zcache_put_page(int cli_id, int pool_id, struct tmem_oid *oidp,
                goto out;
        if (!zcache_freeze && zcache_do_preload(pool) == 0) {
                /* preload does preempt_disable on success */
-                ret = tmem_put(pool, oidp, index, page_address(page),
+                ret = tmem_put(pool, oidp, index, (char *)(page),
                                PAGE_SIZE, 0, is_ephemeral(pool));
                if (ret < 0) {
                        if (is_ephemeral(pool))
@@ -1572,7 +1572,7 @@ static int zcache_get_page(int cli_id, int pool_id, struct tmem_oid *oidp,
        pool = zcache_get_pool_by_id(cli_id, pool_id);
        if (likely(pool != NULL)) {
                if (atomic_read(&pool->obj_count) > 0)
-                        ret = tmem_get(pool, oidp, index, page_address(page),
+                        ret = tmem_get(pool, oidp, index, (char *)(page),
                                        &size, 0, is_ephemeral(pool));
                zcache_put_pool(pool);
        }
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index c24fb10de60b..6a4ea29c2f36 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -2243,7 +2243,6 @@ static int iscsit_handle_snack(
        case 0:
                return iscsit_handle_recovery_datain_or_r2t(conn, buf,
                        hdr->itt, hdr->ttt, hdr->begrun, hdr->runlength);
-                return 0;
        case ISCSI_FLAG_SNACK_TYPE_STATUS:
                return iscsit_handle_status_snack(conn, hdr->itt, hdr->ttt,
                        hdr->begrun, hdr->runlength);
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index f095e65b1ccf..f1643dbf6a92 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -268,7 +268,7 @@ struct se_tpg_np *lio_target_call_addnptotpg(
                                ISCSI_TCP);
        if (IS_ERR(tpg_np)) {
                iscsit_put_tpg(tpg);
-                return ERR_PTR(PTR_ERR(tpg_np));
+                return ERR_CAST(tpg_np);
        }
        pr_debug("LIO_Target_ConfigFS: addnptotpg done!\n");
@@ -1285,7 +1285,7 @@ struct se_wwn *lio_target_call_coreaddtiqn(
        tiqn = iscsit_add_tiqn((unsigned char *)name);
        if (IS_ERR(tiqn))
-                return ERR_PTR(PTR_ERR(tiqn));
+                return ERR_CAST(tiqn);
        /*
         * Setup struct iscsi_wwn_stat_grps for se_wwn->fabric_stat_group.
         */
diff --git a/drivers/target/iscsi/iscsi_target_erl1.c b/drivers/target/iscsi/iscsi_target_erl1.c
index 980650792cf6..c4c68da3e500 100644
--- a/drivers/target/iscsi/iscsi_target_erl1.c
+++ b/drivers/target/iscsi/iscsi_target_erl1.c
@@ -834,7 +834,7 @@ static int iscsit_attach_ooo_cmdsn(
                         */
                        list_for_each_entry(ooo_tmp, &sess->sess_ooo_cmdsn_list,
                                                ooo_list) {
-                                while (ooo_tmp->cmdsn < ooo_cmdsn->cmdsn)
+                                if (ooo_tmp->cmdsn < ooo_cmdsn->cmdsn)
                                        continue;
                                list_add(&ooo_cmdsn->ooo_list,
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index bcaf82f47037..daad362a93ce 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1013,19 +1013,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
                                        ISCSI_LOGIN_STATUS_TARGET_ERROR);
                        goto new_sess_out;
                }
-#if 0
+                snprintf(conn->login_ip, sizeof(conn->login_ip), "%pI6c",
-                if (!iscsi_ntop6((const unsigned char *)
+                                &sock_in6.sin6_addr.in6_u);
-                                &sock_in6.sin6_addr.in6_u,
+                conn->login_port = ntohs(sock_in6.sin6_port);
-                                (char *)&conn->ipv6_login_ip[0],
-                                IPV6_ADDRESS_SPACE)) {
-                        pr_err("iscsi_ntop6() failed\n");
-                        iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
-                                        ISCSI_LOGIN_STATUS_TARGET_ERROR);
-                        goto new_sess_out;
-                }
-#else
-                pr_debug("Skipping iscsi_ntop6()\n");
-#endif
        } else {
                memset(&sock_in, 0, sizeof(struct sockaddr_in));
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index 252e246cf51e..497b2e718a76 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -545,13 +545,13 @@ int iscsi_copy_param_list(
        struct iscsi_param_list *src_param_list,
        int leading)
 {
-        struct iscsi_param *new_param = NULL, *param = NULL;
+        struct iscsi_param *param = NULL;
+        struct iscsi_param *new_param = NULL;
        struct iscsi_param_list *param_list = NULL;
        param_list = kzalloc(sizeof(struct iscsi_param_list), GFP_KERNEL);
        if (!param_list) {
-                pr_err("Unable to allocate memory for"
+                pr_err("Unable to allocate memory for struct iscsi_param_list.\n");
-                                " struct iscsi_param_list.\n");
                goto err_out;
        }
        INIT_LIST_HEAD(&param_list->param_list);
@@ -567,8 +567,17 @@ int iscsi_copy_param_list(
                new_param = kzalloc(sizeof(struct iscsi_param), GFP_KERNEL);
                if (!new_param) {
-                        pr_err("Unable to allocate memory for"
+                        pr_err("Unable to allocate memory for struct iscsi_param.\n");
-                                " struct iscsi_param.\n");
+                        goto err_out;
+                }
+                new_param->name = kstrdup(param->name, GFP_KERNEL);
+                new_param->value = kstrdup(param->value, GFP_KERNEL);
+                if (!new_param->value || !new_param->name) {
+                        kfree(new_param->value);
+                        kfree(new_param->name);
+                        kfree(new_param);
+                        pr_err("Unable to allocate memory for parameter name/value.\n");
                        goto err_out;
                }
@@ -580,32 +589,12 @@ int iscsi_copy_param_list(
                new_param->use = param->use;
                new_param->type_range = param->type_range;
-                new_param->name = kzalloc(strlen(param->name) + 1, GFP_KERNEL);
-                if (!new_param->name) {
-                        pr_err("Unable to allocate memory for"
-                                " parameter name.\n");
-                        goto err_out;
-                }
-                new_param->value = kzalloc(strlen(param->value) + 1,
-                                GFP_KERNEL);
-                if (!new_param->value) {
-                        pr_err("Unable to allocate memory for"
-                                " parameter value.\n");
-                        goto err_out;
-                }
-                memcpy(new_param->name, param->name, strlen(param->name));
-                new_param->name[strlen(param->name)] = '\0';
-                memcpy(new_param->value, param->value, strlen(param->value));
-                new_param->value[strlen(param->value)] = '\0';
                list_add_tail(&new_param->p_list, &param_list->param_list);
        }
-        if (!list_empty(&param_list->param_list))
+        if (!list_empty(&param_list->param_list)) {
                *dst_param_list = param_list;
-        else {
+        } else {
                pr_err("No parameters allocated.\n");
                goto err_out;
        }
diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
index a1acb0167902..a0d23bc0fc98 100644
--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -243,7 +243,7 @@ struct iscsi_cmd *iscsit_allocate_se_cmd_for_tmr(
        if (!cmd->tmr_req) {
                pr_err("Unable to allocate memory for"
                        " Task Management command!\n");
-                return NULL;
+                goto out;
        }
        /*
         * TASK_REASSIGN for ERL=2 / connection stays inside of
@@ -298,8 +298,6 @@ struct iscsi_cmd *iscsit_allocate_se_cmd_for_tmr(
        return cmd;
 out:
        iscsit_release_cmd(cmd);
-        if (se_cmd)
-                transport_free_se_cmd(se_cmd);
        return NULL;
 }
diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
index 8ae09a1bdf74..89ae923c5da6 100644
--- a/drivers/target/target_core_cdb.c
+++ b/drivers/target/target_core_cdb.c
@@ -67,6 +67,7 @@ target_emulate_inquiry_std(struct se_cmd *cmd)
 {
        struct se_lun *lun = cmd->se_lun;
        struct se_device *dev = cmd->se_dev;
+        struct se_portal_group *tpg = lun->lun_sep->sep_tpg;
        unsigned char *buf;
        /*
@@ -81,9 +82,13 @@ target_emulate_inquiry_std(struct se_cmd *cmd)
        buf = transport_kmap_first_data_page(cmd);
-        buf[0] = dev->transport->get_device_type(dev);
+        if (dev == tpg->tpg_virt_lun0.lun_se_dev) {
-        if (buf[0] == TYPE_TAPE)
+                buf[0] = 0x3f; /* Not connected */
-                buf[1] = 0x80;
+        } else {
+                buf[0] = dev->transport->get_device_type(dev);
+                if (buf[0] == TYPE_TAPE)
+                        buf[1] = 0x80;
+        }
        buf[2] = dev->transport->get_device_rev(dev);
        /*
@@ -915,8 +920,8 @@ target_emulate_modesense(struct se_cmd *cmd, int ten)
                length += target_modesense_control(dev, &buf[offset+length]);
                break;
        default:
-                pr_err("Got Unknown Mode Page: 0x%02x\n",
+                pr_err("MODE SENSE: unimplemented page/subpage: 0x%02x/0x%02x\n",
-                                cdb[2] & 0x3f);
+                       cdb[2] & 0x3f, cdb[3]);
                return PYX_TRANSPORT_UNKNOWN_MODE_PAGE;
        }
        offset += length;
@@ -1072,8 +1077,6 @@ target_emulate_unmap(struct se_task *task)
                size -= 16;
        }
-        task->task_scsi_status = GOOD;
-        transport_complete_task(task, 1);
 err:
        transport_kunmap_first_data_page(cmd);
@@ -1085,24 +1088,17 @@ err:
 * Note this is not used for TCM/pSCSI passthrough
 */
 static int
-target_emulate_write_same(struct se_task *task, int write_same32)
+target_emulate_write_same(struct se_task *task, u32 num_blocks)
 {
        struct se_cmd *cmd = task->task_se_cmd;
        struct se_device *dev = cmd->se_dev;
        sector_t range;
        sector_t lba = cmd->t_task_lba;
-        unsigned int num_blocks;
        int ret;
        /*
-         * Extract num_blocks from the WRITE_SAME_* CDB.  Then use the explict
+         * Use the explicit range when non zero is supplied, otherwise calculate
-         * range when non zero is supplied, otherwise calculate the remaining
+         * the remaining range based on ->get_blocks() - starting LBA.
-         * range based on ->get_blocks() - starting LBA.
         */
-        if (write_same32)
-                num_blocks = get_unaligned_be32(&cmd->t_task_cdb[28]);
-        else
-                num_blocks = get_unaligned_be32(&cmd->t_task_cdb[10]);
        if (num_blocks != 0)
                range = num_blocks;
        else
@@ -1117,8 +1113,6 @@ target_emulate_write_same(struct se_task *task, int write_same32)
                return ret;
        }
-        task->task_scsi_status = GOOD;
-        transport_complete_task(task, 1);
        return 0;
 }
@@ -1165,13 +1159,23 @@ transport_emulate_control_cdb(struct se_task *task)
                }
                ret = target_emulate_unmap(task);
                break;
+        case WRITE_SAME:
+                if (!dev->transport->do_discard) {
+                        pr_err("WRITE_SAME emulation not supported"
+                                        " for: %s\n", dev->transport->name);
+                        return PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
+                }
+                ret = target_emulate_write_same(task,
+                                get_unaligned_be16(&cmd->t_task_cdb[7]));
+                break;
        case WRITE_SAME_16:
                if (!dev->transport->do_discard) {
                        pr_err("WRITE_SAME_16 emulation not supported"
                                        " for: %s\n", dev->transport->name);
                        return PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
                }
-                ret = target_emulate_write_same(task, 0);
+                ret = target_emulate_write_same(task,
+                                get_unaligned_be32(&cmd->t_task_cdb[10]));
                break;
        case VARIABLE_LENGTH_CMD:
                service_action =
@@ -1184,7 +1188,8 @@ transport_emulate_control_cdb(struct se_task *task)
                                        dev->transport->name);
                                return PYX_TRANSPORT_UNKNOWN_SAM_OPCODE;
                        }
-                        ret = target_emulate_write_same(task, 1);
+                        ret = target_emulate_write_same(task,
+                                get_unaligned_be32(&cmd->t_task_cdb[28]));
                        break;
                default:
                        pr_err("Unsupported VARIABLE_LENGTH_CMD SA:"
@@ -1219,8 +1224,14 @@ transport_emulate_control_cdb(struct se_task *task)
        if (ret < 0)
                return ret;
-        task->task_scsi_status = GOOD;
+        /*
-        transport_complete_task(task, 1);
+         * Handle the successful completion here unless a caller
+         * has explictly requested an asychronous completion.
+         */
+        if (!(cmd->se_cmd_flags & SCF_EMULATE_CDB_ASYNC)) {
+                task->task_scsi_status = GOOD;
+                transport_complete_task(task, 1);
+        }
        return PYX_TRANSPORT_SENT_TO_TRANSPORT;
 }
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index b38b6c993e65..ca6e4a4df134 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -472,9 +472,9 @@ void core_clear_lun_from_tpg(struct se_lun *lun, struct se_portal_group *tpg)
        struct se_dev_entry *deve;
        u32 i;
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        list_for_each_entry(nacl, &tpg->acl_node_list, acl_list) {
-                spin_unlock_bh(&tpg->acl_node_lock);
+                spin_unlock_irq(&tpg->acl_node_lock);
                spin_lock_irq(&nacl->device_list_lock);
                for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) {
@@ -491,9 +491,9 @@ void core_clear_lun_from_tpg(struct se_lun *lun, struct se_portal_group *tpg)
                }
                spin_unlock_irq(&nacl->device_list_lock);
-                spin_lock_bh(&tpg->acl_node_lock);
+                spin_lock_irq(&tpg->acl_node_lock);
        }
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
 }
 static struct se_port *core_alloc_port(struct se_device *dev)
@@ -839,6 +839,24 @@ int se_dev_check_shutdown(struct se_device *dev)
        return ret;
 }
+u32 se_dev_align_max_sectors(u32 max_sectors, u32 block_size)
+{
+        u32 tmp, aligned_max_sectors;
+        /*
+         * Limit max_sectors to a PAGE_SIZE aligned value for modern
+         * transport_allocate_data_tasks() operation.
+         */
+        tmp = rounddown((max_sectors * block_size), PAGE_SIZE);
+        aligned_max_sectors = (tmp / block_size);
+        if (max_sectors != aligned_max_sectors) {
+                printk(KERN_INFO "Rounding down aligned max_sectors from %u"
+                                " to %u\n", max_sectors, aligned_max_sectors);
+                return aligned_max_sectors;
+        }
+        return max_sectors;
+}
 void se_dev_set_default_attribs(
        struct se_device *dev,
        struct se_dev_limits *dev_limits)
@@ -878,6 +896,11 @@ void se_dev_set_default_attribs(
         * max_sectors is based on subsystem plugin dependent requirements.
         */
        dev->se_sub_dev->se_dev_attrib.hw_max_sectors = limits->max_hw_sectors;
+        /*
+         * Align max_sectors down to PAGE_SIZE to follow transport_allocate_data_tasks()
+         */
+        limits->max_sectors = se_dev_align_max_sectors(limits->max_sectors,
+                                                limits->logical_block_size);
        dev->se_sub_dev->se_dev_attrib.max_sectors = limits->max_sectors;
        /*
         * Set optimal_sectors from max_sectors, which can be lowered via
@@ -1242,6 +1265,11 @@ int se_dev_set_max_sectors(struct se_device *dev, u32 max_sectors)
                        return -EINVAL;
                }
        }
+        /*
+         * Align max_sectors down to PAGE_SIZE to follow transport_allocate_data_tasks()
+         */
+        max_sectors = se_dev_align_max_sectors(max_sectors,
+                                dev->se_sub_dev->se_dev_attrib.block_size);
        dev->se_sub_dev->se_dev_attrib.max_sectors = max_sectors;
        pr_debug("dev[%p]: SE Device max_sectors changed to %u\n",
@@ -1344,15 +1372,17 @@ struct se_lun *core_dev_add_lun(
         */
        if (tpg->se_tpg_tfo->tpg_check_demo_mode(tpg)) {
                struct se_node_acl *acl;
-                spin_lock_bh(&tpg->acl_node_lock);
+                spin_lock_irq(&tpg->acl_node_lock);
                list_for_each_entry(acl, &tpg->acl_node_list, acl_list) {
-                        if (acl->dynamic_node_acl) {
+                        if (acl->dynamic_node_acl &&
-                                spin_unlock_bh(&tpg->acl_node_lock);
+                            (!tpg->se_tpg_tfo->tpg_check_demo_mode_login_only ||
+                             !tpg->se_tpg_tfo->tpg_check_demo_mode_login_only(tpg))) {
+                                spin_unlock_irq(&tpg->acl_node_lock);
                                core_tpg_add_node_to_devs(acl, tpg);
-                                spin_lock_bh(&tpg->acl_node_lock);
+                                spin_lock_irq(&tpg->acl_node_lock);
                        }
                }
-                spin_unlock_bh(&tpg->acl_node_lock);
+                spin_unlock_irq(&tpg->acl_node_lock);
        }
        return lun_p;
diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index f1654694f4ea..55bbe0847a6d 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -481,7 +481,7 @@ static struct config_group *target_fabric_make_nodeacl(
        se_nacl = tf->tf_ops.fabric_make_nodeacl(se_tpg, group, name);
        if (IS_ERR(se_nacl))
-                return ERR_PTR(PTR_ERR(se_nacl));
+                return ERR_CAST(se_nacl);
        nacl_cg = &se_nacl->acl_group;
        nacl_cg->default_groups = se_nacl->acl_default_groups;
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 1c1b849cd4fb..7fd3a161f7cc 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -1598,14 +1598,14 @@ static int core_scsi3_decode_spec_i_port(
                         * from the decoded fabric module specific TransportID
                         * at *i_str.
                         */
-                        spin_lock_bh(&tmp_tpg->acl_node_lock);
+                        spin_lock_irq(&tmp_tpg->acl_node_lock);
                        dest_node_acl = __core_tpg_get_initiator_node_acl(
                                                tmp_tpg, i_str);
                        if (dest_node_acl) {
                                atomic_inc(&dest_node_acl->acl_pr_ref_count);
                                smp_mb__after_atomic_inc();
                        }
-                        spin_unlock_bh(&tmp_tpg->acl_node_lock);
+                        spin_unlock_irq(&tmp_tpg->acl_node_lock);
                        if (!dest_node_acl) {
                                core_scsi3_tpg_undepend_item(tmp_tpg);
@@ -3496,14 +3496,14 @@ after_iport_check:
        /*
         * Locate the destination struct se_node_acl from the received Transport ID
         */
-        spin_lock_bh(&dest_se_tpg->acl_node_lock);
+        spin_lock_irq(&dest_se_tpg->acl_node_lock);
        dest_node_acl = __core_tpg_get_initiator_node_acl(dest_se_tpg,
                                initiator_str);
        if (dest_node_acl) {
                atomic_inc(&dest_node_acl->acl_pr_ref_count);
                smp_mb__after_atomic_inc();
        }
-        spin_unlock_bh(&dest_se_tpg->acl_node_lock);
+        spin_unlock_irq(&dest_se_tpg->acl_node_lock);
        if (!dest_node_acl) {
                pr_err("Unable to locate %s dest_node_acl for"
diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c
index 3dd81d24d9a9..e567e129c697 100644
--- a/drivers/target/target_core_rd.c
+++ b/drivers/target/target_core_rd.c
@@ -390,12 +390,10 @@ static int rd_MEMCPY_read(struct rd_request *req)
                                length = req->rd_size;
                        dst = sg_virt(&sg_d[i++]) + dst_offset;
-                        if (!dst)
+                        BUG_ON(!dst);
-                                BUG();
                        src = sg_virt(&sg_s[j]) + src_offset;
-                        if (!src)
+                        BUG_ON(!src);
-                                BUG();
                        dst_offset = 0;
                        src_offset = length;
@@ -415,8 +413,7 @@ static int rd_MEMCPY_read(struct rd_request *req)
                                length = req->rd_size;
                        dst = sg_virt(&sg_d[i]) + dst_offset;
-                        if (!dst)
+                        BUG_ON(!dst);
-                                BUG();
                        if (sg_d[i].length == length) {
                                i++;
@@ -425,8 +422,7 @@ static int rd_MEMCPY_read(struct rd_request *req)
                                dst_offset = length;
                        src = sg_virt(&sg_s[j++]) + src_offset;
-                        if (!src)
+                        BUG_ON(!src);
-                                BUG();
                        src_offset = 0;
                        page_end = 1;
@@ -510,12 +506,10 @@ static int rd_MEMCPY_write(struct rd_request *req)
                                length = req->rd_size;
                        src = sg_virt(&sg_s[i++]) + src_offset;
-                        if (!src)
+                        BUG_ON(!src);
-                                BUG();
                        dst = sg_virt(&sg_d[j]) + dst_offset;
-                        if (!dst)
+                        BUG_ON(!dst);
-                                BUG();
                        src_offset = 0;
                        dst_offset = length;
@@ -535,8 +529,7 @@ static int rd_MEMCPY_write(struct rd_request *req)
                                length = req->rd_size;
                        src = sg_virt(&sg_s[i]) + src_offset;
-                        if (!src)
+                        BUG_ON(!src);
-                                BUG();
                        if (sg_s[i].length == length) {
                                i++;
@@ -545,8 +538,7 @@ static int rd_MEMCPY_write(struct rd_request *req)
                                src_offset = length;
                        dst = sg_virt(&sg_d[j++]) + dst_offset;
-                        if (!dst)
+                        BUG_ON(!dst);
-                                BUG();
                        dst_offset = 0;
                        page_end = 1;
diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
index 4f1ba4c5ef11..162b736c7342 100644
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -137,15 +137,15 @@ struct se_node_acl *core_tpg_get_initiator_node_acl(
 {
        struct se_node_acl *acl;
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        list_for_each_entry(acl, &tpg->acl_node_list, acl_list) {
                if (!strcmp(acl->initiatorname, initiatorname) &&
                    !acl->dynamic_node_acl) {
-                        spin_unlock_bh(&tpg->acl_node_lock);
+                        spin_unlock_irq(&tpg->acl_node_lock);
                        return acl;
                }
        }
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
        return NULL;
 }
@@ -298,13 +298,21 @@ struct se_node_acl *core_tpg_check_initiator_node_acl(
                tpg->se_tpg_tfo->tpg_release_fabric_acl(tpg, acl);
                return NULL;
        }
+        /*
+         * Here we only create demo-mode MappedLUNs from the active
+         * TPG LUNs if the fabric is not explictly asking for
+         * tpg_check_demo_mode_login_only() == 1.
+         */
+        if ((tpg->se_tpg_tfo->tpg_check_demo_mode_login_only != NULL) &&
+            (tpg->se_tpg_tfo->tpg_check_demo_mode_login_only(tpg) == 1))
+                do { ; } while (0);
+        else
+                core_tpg_add_node_to_devs(acl, tpg);
-        core_tpg_add_node_to_devs(acl, tpg);
+        spin_lock_irq(&tpg->acl_node_lock);
-        spin_lock_bh(&tpg->acl_node_lock);
        list_add_tail(&acl->acl_list, &tpg->acl_node_list);
        tpg->num_node_acls++;
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
        pr_debug("%s_TPG[%u] - Added DYNAMIC ACL with TCQ Depth: %d for %s"
                " Initiator Node: %s\n", tpg->se_tpg_tfo->get_fabric_name(),
@@ -354,7 +362,7 @@ struct se_node_acl *core_tpg_add_initiator_node_acl(
 {
        struct se_node_acl *acl = NULL;
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        acl = __core_tpg_get_initiator_node_acl(tpg, initiatorname);
        if (acl) {
                if (acl->dynamic_node_acl) {
@@ -362,7 +370,7 @@ struct se_node_acl *core_tpg_add_initiator_node_acl(
                        pr_debug("%s_TPG[%u] - Replacing dynamic ACL"
                                " for %s\n", tpg->se_tpg_tfo->get_fabric_name(),
                                tpg->se_tpg_tfo->tpg_get_tag(tpg), initiatorname);
-                        spin_unlock_bh(&tpg->acl_node_lock);
+                        spin_unlock_irq(&tpg->acl_node_lock);
                        /*
                         * Release the locally allocated struct se_node_acl
                         * because * core_tpg_add_initiator_node_acl() returned
@@ -378,10 +386,10 @@ struct se_node_acl *core_tpg_add_initiator_node_acl(
                        " Node %s already exists for TPG %u, ignoring"
                        " request.\n",  tpg->se_tpg_tfo->get_fabric_name(),
                        initiatorname, tpg->se_tpg_tfo->tpg_get_tag(tpg));
-                spin_unlock_bh(&tpg->acl_node_lock);
+                spin_unlock_irq(&tpg->acl_node_lock);
                return ERR_PTR(-EEXIST);
        }
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
        if (!se_nacl) {
                pr_err("struct se_node_acl pointer is NULL\n");
@@ -418,10 +426,10 @@ struct se_node_acl *core_tpg_add_initiator_node_acl(
                return ERR_PTR(-EINVAL);
        }
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        list_add_tail(&acl->acl_list, &tpg->acl_node_list);
        tpg->num_node_acls++;
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
 done:
        pr_debug("%s_TPG[%hu] - Added ACL with TCQ Depth: %d for %s"
@@ -445,14 +453,14 @@ int core_tpg_del_initiator_node_acl(
        struct se_session *sess, *sess_tmp;
        int dynamic_acl = 0;
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        if (acl->dynamic_node_acl) {
                acl->dynamic_node_acl = 0;
                dynamic_acl = 1;
        }
        list_del(&acl->acl_list);
        tpg->num_node_acls--;
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
        spin_lock_bh(&tpg->session_lock);
        list_for_each_entry_safe(sess, sess_tmp,
@@ -503,21 +511,21 @@ int core_tpg_set_initiator_node_queue_depth(
        struct se_node_acl *acl;
        int dynamic_acl = 0;
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        acl = __core_tpg_get_initiator_node_acl(tpg, initiatorname);
        if (!acl) {
                pr_err("Access Control List entry for %s Initiator"
                        " Node %s does not exists for TPG %hu, ignoring"
                        " request.\n", tpg->se_tpg_tfo->get_fabric_name(),
                        initiatorname, tpg->se_tpg_tfo->tpg_get_tag(tpg));
-                spin_unlock_bh(&tpg->acl_node_lock);
+                spin_unlock_irq(&tpg->acl_node_lock);
                return -ENODEV;
        }
        if (acl->dynamic_node_acl) {
                acl->dynamic_node_acl = 0;
                dynamic_acl = 1;
        }
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
        spin_lock_bh(&tpg->session_lock);
        list_for_each_entry(sess, &tpg->tpg_sess_list, sess_list) {
@@ -533,10 +541,10 @@ int core_tpg_set_initiator_node_queue_depth(
                                tpg->se_tpg_tfo->get_fabric_name(), initiatorname);
                        spin_unlock_bh(&tpg->session_lock);
-                        spin_lock_bh(&tpg->acl_node_lock);
+                        spin_lock_irq(&tpg->acl_node_lock);
                        if (dynamic_acl)
                                acl->dynamic_node_acl = 1;
-                        spin_unlock_bh(&tpg->acl_node_lock);
+                        spin_unlock_irq(&tpg->acl_node_lock);
                        return -EEXIST;
                }
                /*
@@ -571,10 +579,10 @@ int core_tpg_set_initiator_node_queue_depth(
                if (init_sess)
                        tpg->se_tpg_tfo->close_session(init_sess);
-                spin_lock_bh(&tpg->acl_node_lock);
+                spin_lock_irq(&tpg->acl_node_lock);
                if (dynamic_acl)
                        acl->dynamic_node_acl = 1;
-                spin_unlock_bh(&tpg->acl_node_lock);
+                spin_unlock_irq(&tpg->acl_node_lock);
                return -EINVAL;
        }
        spin_unlock_bh(&tpg->session_lock);
@@ -590,10 +598,10 @@ int core_tpg_set_initiator_node_queue_depth(
                initiatorname, tpg->se_tpg_tfo->get_fabric_name(),
                tpg->se_tpg_tfo->tpg_get_tag(tpg));
-        spin_lock_bh(&tpg->acl_node_lock);
+        spin_lock_irq(&tpg->acl_node_lock);
        if (dynamic_acl)
                acl->dynamic_node_acl = 1;
-        spin_unlock_bh(&tpg->acl_node_lock);
+        spin_unlock_irq(&tpg->acl_node_lock);
        return 0;
 }
@@ -717,20 +725,20 @@ int core_tpg_deregister(struct se_portal_group *se_tpg)
         * not been released because of TFO->tpg_check_demo_mode_cache() == 1
         * in transport_deregister_session().
         */
-        spin_lock_bh(&se_tpg->acl_node_lock);
+        spin_lock_irq(&se_tpg->acl_node_lock);
        list_for_each_entry_safe(nacl, nacl_tmp, &se_tpg->acl_node_list,
                        acl_list) {
                list_del(&nacl->acl_list);
                se_tpg->num_node_acls--;
-                spin_unlock_bh(&se_tpg->acl_node_lock);
+                spin_unlock_irq(&se_tpg->acl_node_lock);
                core_tpg_wait_for_nacl_pr_ref(nacl);
                core_free_device_list_for_node(nacl, se_tpg);
                se_tpg->se_tpg_tfo->tpg_release_fabric_acl(se_tpg, nacl);
-                spin_lock_bh(&se_tpg->acl_node_lock);
+                spin_lock_irq(&se_tpg->acl_node_lock);
        }
-        spin_unlock_bh(&se_tpg->acl_node_lock);
+        spin_unlock_irq(&se_tpg->acl_node_lock);
        if (se_tpg->se_tpg_type == TRANSPORT_TPG_TYPE_NORMAL)
                core_tpg_release_virtual_lun0(se_tpg);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 89760329d5d0..8d0c58ea6316 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -389,17 +389,18 @@ void transport_deregister_session(struct se_session *se_sess)
 {
        struct se_portal_group *se_tpg = se_sess->se_tpg;
        struct se_node_acl *se_nacl;
+        unsigned long flags;
        if (!se_tpg) {
                transport_free_session(se_sess);
                return;
        }
-        spin_lock_bh(&se_tpg->session_lock);
+        spin_lock_irqsave(&se_tpg->session_lock, flags);
        list_del(&se_sess->sess_list);
        se_sess->se_tpg = NULL;
        se_sess->fabric_sess_ptr = NULL;
-        spin_unlock_bh(&se_tpg->session_lock);
+        spin_unlock_irqrestore(&se_tpg->session_lock, flags);
        /*
         * Determine if we need to do extra work for this initiator node's
@@ -407,22 +408,22 @@ void transport_deregister_session(struct se_session *se_sess)
         */
        se_nacl = se_sess->se_node_acl;
        if (se_nacl) {
-                spin_lock_bh(&se_tpg->acl_node_lock);
+                spin_lock_irqsave(&se_tpg->acl_node_lock, flags);
                if (se_nacl->dynamic_node_acl) {
                        if (!se_tpg->se_tpg_tfo->tpg_check_demo_mode_cache(
                                        se_tpg)) {
                                list_del(&se_nacl->acl_list);
                                se_tpg->num_node_acls--;
-                                spin_unlock_bh(&se_tpg->acl_node_lock);
+                                spin_unlock_irqrestore(&se_tpg->acl_node_lock, flags);
                                core_tpg_wait_for_nacl_pr_ref(se_nacl);
                                core_free_device_list_for_node(se_nacl, se_tpg);
                                se_tpg->se_tpg_tfo->tpg_release_fabric_acl(se_tpg,
                                                se_nacl);
-                                spin_lock_bh(&se_tpg->acl_node_lock);
+                                spin_lock_irqsave(&se_tpg->acl_node_lock, flags);
                        }
                }
-                spin_unlock_bh(&se_tpg->acl_node_lock);
+                spin_unlock_irqrestore(&se_tpg->acl_node_lock, flags);
        }
        transport_free_session(se_sess);
@@ -2053,8 +2054,14 @@ static void transport_generic_request_failure(
                cmd->scsi_sense_reason = TCM_UNSUPPORTED_SCSI_OPCODE;
                break;
        }
+        /*
-        if (!sc)
+         * If a fabric does not define a cmd->se_tfo->new_cmd_map caller,
+         * make the call to transport_send_check_condition_and_sense()
+         * directly.  Otherwise expect the fabric to make the call to
+         * transport_send_check_condition_and_sense() after handling
+         * possible unsoliticied write data payloads.
+         */
+        if (!sc && !cmd->se_tfo->new_cmd_map)
                transport_new_cmd_failure(cmd);
        else {
                ret = transport_send_check_condition_and_sense(cmd,
@@ -2847,12 +2854,42 @@ static int transport_cmd_get_valid_sectors(struct se_cmd *cmd)
                        " transport_dev_end_lba(): %llu\n",
                        cmd->t_task_lba, sectors,
                        transport_dev_end_lba(dev));
-                pr_err("  We should return CHECK_CONDITION"
+                return -EINVAL;
-                       " but we don't yet\n");
-                return 0;
        }
-        return sectors;
+        return 0;
+}
+static int target_check_write_same_discard(unsigned char *flags, struct se_device *dev)
+{
+        /*
+         * Determine if the received WRITE_SAME is used to for direct
+         * passthrough into Linux/SCSI with struct request via TCM/pSCSI
+         * or we are signaling the use of internal WRITE_SAME + UNMAP=1
+         * emulation for -> Linux/BLOCK disbard with TCM/IBLOCK code.
+         */
+        int passthrough = (dev->transport->transport_type ==
+                                TRANSPORT_PLUGIN_PHBA_PDEV);
+        if (!passthrough) {
+                if ((flags[0] & 0x04) || (flags[0] & 0x02)) {
+                        pr_err("WRITE_SAME PBDATA and LBDATA"
+                                " bits not supported for Block Discard"
+                                " Emulation\n");
+                        return -ENOSYS;
+                }
+                /*
+                 * Currently for the emulated case we only accept
+                 * tpws with the UNMAP=1 bit set.
+                 */
+                if (!(flags[0] & 0x08)) {
+                        pr_err("WRITE_SAME w/o UNMAP bit not"
+                                " supported for Block Discard Emulation\n");
+                        return -ENOSYS;
+                }
+        }
+        return 0;
 }
 /*      transport_generic_cmd_sequencer():
@@ -3065,7 +3102,7 @@ static int transport_generic_cmd_sequencer(
                                goto out_unsupported_cdb;
                        if (sectors)
-                                size = transport_get_size(sectors, cdb, cmd);
+                                size = transport_get_size(1, cdb, cmd);
                        else {
                                pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not"
                                       " supported\n");
@@ -3075,27 +3112,9 @@ static int transport_generic_cmd_sequencer(
                        cmd->t_task_lba = get_unaligned_be64(&cdb[12]);
                        cmd->se_cmd_flags |= SCF_SCSI_CONTROL_SG_IO_CDB;
-                        /*
+                        if (target_check_write_same_discard(&cdb[10], dev) < 0)
-                         * Skip the remaining assignments for TCM/PSCSI passthrough
-                         */
-                        if (passthrough)
-                                break;
-                        if ((cdb[10] & 0x04) || (cdb[10] & 0x02)) {
-                                pr_err("WRITE_SAME PBDATA and LBDATA"
-                                        " bits not supported for Block Discard"
-                                        " Emulation\n");
                                goto out_invalid_cdb_field;
-                        }
-                        /*
-                         * Currently for the emulated case we only accept
-                         * tpws with the UNMAP=1 bit set.
-                         */
-                        if (!(cdb[10] & 0x08)) {
-                                pr_err("WRITE_SAME w/o UNMAP bit not"
-                                        " supported for Block Discard Emulation\n");
-                                goto out_invalid_cdb_field;
-                        }
                        break;
                default:
                        pr_err("VARIABLE_LENGTH_CMD service action"
@@ -3330,10 +3349,12 @@ static int transport_generic_cmd_sequencer(
                cmd->se_cmd_flags |= SCF_EMULATE_CDB_ASYNC;
                /*
                 * Check to ensure that LBA + Range does not exceed past end of
-                 * device.
+                 * device for IBLOCK and FILEIO ->do_sync_cache() backend calls
                 */
-                if (!transport_cmd_get_valid_sectors(cmd))
+                if ((cmd->t_task_lba != 0) || (sectors != 0)) {
-                        goto out_invalid_cdb_field;
+                        if (transport_cmd_get_valid_sectors(cmd) < 0)
+                                goto out_invalid_cdb_field;
+                }
                break;
        case UNMAP:
                size = get_unaligned_be16(&cdb[7]);
@@ -3345,40 +3366,38 @@ static int transport_generic_cmd_sequencer(
                        goto out_unsupported_cdb;
                if (sectors)
-                        size = transport_get_size(sectors, cdb, cmd);
+                        size = transport_get_size(1, cdb, cmd);
                else {
                        pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not supported\n");
                        goto out_invalid_cdb_field;
                }
                cmd->t_task_lba = get_unaligned_be64(&cdb[2]);
-                passthrough = (dev->transport->transport_type ==
+                cmd->se_cmd_flags |= SCF_SCSI_CONTROL_SG_IO_CDB;
-                                TRANSPORT_PLUGIN_PHBA_PDEV);
-                /*
+                if (target_check_write_same_discard(&cdb[1], dev) < 0)
-                 * Determine if the received WRITE_SAME_16 is used to for direct
+                        goto out_invalid_cdb_field;
-                 * passthrough into Linux/SCSI with struct request via TCM/pSCSI
+                break;
-                 * or we are signaling the use of internal WRITE_SAME + UNMAP=1
+        case WRITE_SAME:
-                 * emulation for -> Linux/BLOCK disbard with TCM/IBLOCK and
+                sectors = transport_get_sectors_10(cdb, cmd, &sector_ret);
-                 * TCM/FILEIO subsystem plugin backstores.
+                if (sector_ret)
-                 */
+                        goto out_unsupported_cdb;
-                if (!passthrough) {
-                        if ((cdb[1] & 0x04) || (cdb[1] & 0x02)) {
+                if (sectors)
-                                pr_err("WRITE_SAME PBDATA and LBDATA"
+                        size = transport_get_size(1, cdb, cmd);
-                                        " bits not supported for Block Discard"
+                else {
-                                        " Emulation\n");
+                        pr_err("WSNZ=1, WRITE_SAME w/sectors=0 not supported\n");
-                                goto out_invalid_cdb_field;
+                        goto out_invalid_cdb_field;
-                        }
-                        /*
-                         * Currently for the emulated case we only accept
-                         * tpws with the UNMAP=1 bit set.
-                         */
-                        if (!(cdb[1] & 0x08)) {
-                                pr_err("WRITE_SAME w/o UNMAP bit not "
-                                        " supported for Block Discard Emulation\n");
-                                goto out_invalid_cdb_field;
-                        }
                }
+                cmd->t_task_lba = get_unaligned_be32(&cdb[2]);
                cmd->se_cmd_flags |= SCF_SCSI_CONTROL_SG_IO_CDB;
+                /*
+                 * Follow sbcr26 with WRITE_SAME (10) and check for the existence
+                 * of byte 1 bit 3 UNMAP instead of original reserved field
+                 */
+                if (target_check_write_same_discard(&cdb[1], dev) < 0)
+                        goto out_invalid_cdb_field;
                break;
        case ALLOW_MEDIUM_REMOVAL:
        case GPCMD_CLOSE_TRACK:
@@ -3873,9 +3892,7 @@ EXPORT_SYMBOL(transport_generic_map_mem_to_cmd);
 static int transport_new_cmd_obj(struct se_cmd *cmd)
 {
        struct se_device *dev = cmd->se_dev;
-        u32 task_cdbs;
+        int set_counts = 1, rc, task_cdbs;
-        u32 rc;
-        int set_counts = 1;
        /*
         * Setup any BIDI READ tasks and memory from
@@ -3893,7 +3910,7 @@ static int transport_new_cmd_obj(struct se_cmd *cmd)
                        cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
                        cmd->scsi_sense_reason =
                                TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-                        return PYX_TRANSPORT_LU_COMM_FAILURE;
+                        return -EINVAL;
                }
                atomic_inc(&cmd->t_fe_count);
                atomic_inc(&cmd->t_se_count);
@@ -3912,7 +3929,7 @@ static int transport_new_cmd_obj(struct se_cmd *cmd)
                cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
                cmd->scsi_sense_reason =
                        TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-                return PYX_TRANSPORT_LU_COMM_FAILURE;
+                return -EINVAL;
        }
        if (set_counts) {
@@ -4028,8 +4045,6 @@ void transport_do_task_sg_chain(struct se_cmd *cmd)
                if (!task->task_sg)
                        continue;
-                BUG_ON(!task->task_padded_sg);
                if (!sg_first) {
                        sg_first = task->task_sg;
                        chained_nents = task->task_sg_nents;
@@ -4037,9 +4052,19 @@ void transport_do_task_sg_chain(struct se_cmd *cmd)
                        sg_chain(sg_prev, sg_prev_nents, task->task_sg);
                        chained_nents += task->task_sg_nents;
                }
+                /*
+                 * For the padded tasks, use the extra SGL vector allocated
+                 * in transport_allocate_data_tasks() for the sg_prev_nents
+                 * offset into sg_chain() above..  The last task of a
+                 * multi-task list, or a single task will not have
+                 * task->task_sg_padded set..
+                 */
+                if (task->task_padded_sg)
+                        sg_prev_nents = (task->task_sg_nents + 1);
+                else
+                        sg_prev_nents = task->task_sg_nents;
                sg_prev = task->task_sg;
-                sg_prev_nents = task->task_sg_nents;
        }
        /*
         * Setup the starting pointer and total t_tasks_sg_linked_no including
@@ -4091,7 +4116,7 @@ static int transport_allocate_data_tasks(
        
        cmd_sg = sgl;
        for (i = 0; i < task_count; i++) {
-                unsigned int task_size;
+                unsigned int task_size, task_sg_nents_padded;
                int count;
                task = transport_generic_get_task(cmd, data_direction);
@@ -4110,30 +4135,33 @@ static int transport_allocate_data_tasks(
                /* Update new cdb with updated lba/sectors */
                cmd->transport_split_cdb(task->task_lba, task->task_sectors, cdb);
+                /*
+                 * This now assumes that passed sg_ents are in PAGE_SIZE chunks
+                 * in order to calculate the number per task SGL entries
+                 */
+                task->task_sg_nents = DIV_ROUND_UP(task->task_size, PAGE_SIZE);
                /*
                 * Check if the fabric module driver is requesting that all
                 * struct se_task->task_sg[] be chained together..  If so,
                 * then allocate an extra padding SG entry for linking and
-                 * marking the end of the chained SGL.
+                 * marking the end of the chained SGL for every task except
-                 * Possibly over-allocate task sgl size by using cmd sgl size.
+                 * the last one for (task_count > 1) operation, or skipping
-                 * It's so much easier and only a waste when task_count > 1.
+                 * the extra padding for the (task_count == 1) case.
-                 * That is extremely rare.
                 */
-                task->task_sg_nents = sgl_nents;
+                if (cmd->se_tfo->task_sg_chaining && (i < (task_count - 1))) {
-                if (cmd->se_tfo->task_sg_chaining) {
+                        task_sg_nents_padded = (task->task_sg_nents + 1);
-                        task->task_sg_nents++;
                        task->task_padded_sg = 1;
-                }
+                } else
+                        task_sg_nents_padded = task->task_sg_nents;
                task->task_sg = kmalloc(sizeof(struct scatterlist) *
-                                        task->task_sg_nents, GFP_KERNEL);
+                                        task_sg_nents_padded, GFP_KERNEL);
                if (!task->task_sg) {
                        cmd->se_dev->transport->free_task(task);
                        return -ENOMEM;
                }
-                sg_init_table(task->task_sg, task->task_sg_nents);
+                sg_init_table(task->task_sg, task_sg_nents_padded);
                task_size = task->task_size;
@@ -4230,10 +4258,13 @@ static u32 transport_allocate_tasks(
        struct scatterlist *sgl,
        unsigned int sgl_nents)
 {
-        if (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB)
+        if (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB) {
+                if (transport_cmd_get_valid_sectors(cmd) < 0)
+                        return -EINVAL;
                return transport_allocate_data_tasks(cmd, lba, data_direction,
                                                     sgl, sgl_nents);
-        else
+        } else
                return transport_allocate_control_task(cmd);
 }
@@ -4726,6 +4757,13 @@ int transport_send_check_condition_and_sense(
         */
        switch (reason) {
        case TCM_NON_EXISTENT_LUN:
+                /* CURRENT ERROR */
+                buffer[offset] = 0x70;
+                /* ILLEGAL REQUEST */
+                buffer[offset+SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
+                /* LOGICAL UNIT NOT SUPPORTED */
+                buffer[offset+SPC_ASC_KEY_OFFSET] = 0x25;
+                break;
        case TCM_UNSUPPORTED_SCSI_OPCODE:
        case TCM_SECTOR_COUNT_TOO_MANY:
                /* CURRENT ERROR */
diff --git a/drivers/target/tcm_fc/tfc_conf.c b/drivers/target/tcm_fc/tfc_conf.c
index 8781d1e423df..b15879d43e22 100644
--- a/drivers/target/tcm_fc/tfc_conf.c
+++ b/drivers/target/tcm_fc/tfc_conf.c
@@ -256,7 +256,7 @@ struct ft_node_acl *ft_acl_get(struct ft_tpg *tpg, struct fc_rport_priv *rdata)
        struct se_portal_group *se_tpg = &tpg->se_tpg;
        struct se_node_acl *se_acl;
-        spin_lock_bh(&se_tpg->acl_node_lock);
+        spin_lock_irq(&se_tpg->acl_node_lock);
        list_for_each_entry(se_acl, &se_tpg->acl_node_list, acl_list) {
                acl = container_of(se_acl, struct ft_node_acl, se_node_acl);
                pr_debug("acl %p port_name %llx\n",
@@ -270,7 +270,7 @@ struct ft_node_acl *ft_acl_get(struct ft_tpg *tpg, struct fc_rport_priv *rdata)
                        break;
                }
        }
-        spin_unlock_bh(&se_tpg->acl_node_lock);
+        spin_unlock_irq(&se_tpg->acl_node_lock);
        return found;
 }
@@ -655,9 +655,7 @@ static void __exit ft_exit(void)
        synchronize_rcu();
 }
-#ifdef MODULE
 MODULE_DESCRIPTION("FC TCM fabric driver " FT_VERSION);
 MODULE_LICENSE("GPL");
 module_init(ft_init);
 module_exit(ft_exit);
-#endif /* MODULE */
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 98b6e3bdb000..e809e9d4683c 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -446,8 +446,19 @@ static inline void legacy_pty_init(void) { }
 int pty_limit = NR_UNIX98_PTY_DEFAULT;
 static int pty_limit_min;
 static int pty_limit_max = NR_UNIX98_PTY_MAX;
+static int tty_count;
 static int pty_count;
+static inline void pty_inc_count(void)
+{
+        pty_count = (++tty_count) / 2;
+}
+static inline void pty_dec_count(void)
+{
+        pty_count = (--tty_count) / 2;
+}
 static struct cdev ptmx_cdev;
 static struct ctl_table pty_table[] = {
@@ -542,6 +553,7 @@ static struct tty_struct *pts_unix98_lookup(struct tty_driver *driver,
 static void pty_unix98_shutdown(struct tty_struct *tty)
 {
+        tty_driver_remove_tty(tty->driver, tty);
        /* We have our own method as we don't use the tty index */
        kfree(tty->termios);
 }
@@ -588,7 +600,8 @@ static int pty_unix98_install(struct tty_driver *driver, struct tty_struct *tty)
         */
        tty_driver_kref_get(driver);
        tty->count++;
-        pty_count++;
+        pty_inc_count(); /* tty */
+        pty_inc_count(); /* tty->link */
        return 0;
 err_free_mem:
        deinitialize_tty_struct(o_tty);
@@ -602,7 +615,7 @@ err_free_tty:
 static void pty_unix98_remove(struct tty_driver *driver, struct tty_struct *tty)
 {
-        pty_count--;
+        pty_dec_count();
 }
 static const struct tty_operations ptm_unix98_ops = {
diff --git a/drivers/tty/serial/8250.c b/drivers/tty/serial/8250.c
index f2dfec82faf8..7f50999eebc2 100644
--- a/drivers/tty/serial/8250.c
+++ b/drivers/tty/serial/8250.c
@@ -1819,6 +1819,8 @@ static void serial8250_backup_timeout(unsigned long data)
        unsigned int iir, ier = 0, lsr;
        unsigned long flags;
+        spin_lock_irqsave(&up->port.lock, flags);
        /*
         * Must disable interrupts or else we risk racing with the interrupt
         * based handler.
@@ -1836,10 +1838,8 @@ static void serial8250_backup_timeout(unsigned long data)
         * the "Diva" UART used on the management processor on many HP
         * ia64 and parisc boxes.
         */
-        spin_lock_irqsave(&up->port.lock, flags);
        lsr = serial_in(up, UART_LSR);
        up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
-        spin_unlock_irqrestore(&up->port.lock, flags);
        if ((iir & UART_IIR_NO_INT) && (up->ier & UART_IER_THRI) &&
            (!uart_circ_empty(&up->port.state->xmit) || up->port.x_char) &&
            (lsr & UART_LSR_THRE)) {
@@ -1848,11 +1848,13 @@ static void serial8250_backup_timeout(unsigned long data)
        }
        if (!(iir & UART_IIR_NO_INT))
-                serial8250_handle_port(up);
+                transmit_chars(up);
        if (is_real_interrupt(up->port.irq))
                serial_out(up, UART_IER, ier);
+        spin_unlock_irqrestore(&up->port.lock, flags);
        /* Standard timer interval plus 0.2s to keep the port running */
        mod_timer(&up->timer,
                jiffies + uart_poll_timeout(&up->port) + HZ / 5);
diff --git a/drivers/tty/serial/8250_pci.c b/drivers/tty/serial/8250_pci.c
index 6b887d90a205..3abeca2a2a1b 100644
--- a/drivers/tty/serial/8250_pci.c
+++ b/drivers/tty/serial/8250_pci.c
@@ -1599,11 +1599,6 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
                .device         = 0x800D,
                .init           = pci_eg20t_init,
        },
-        {
-                .vendor         = 0x10DB,
-                .device         = 0x800D,
-                .init           = pci_eg20t_init,
-        },
        /*
         * Cronyx Omega PCI (PLX-chip based)
         */
@@ -4021,7 +4016,7 @@ static struct pci_device_id serial_pci_tbl[] = {
                0, 0, pbn_NETMOS9900_2s_115200 },
        /*
-         * Best Connectivity PCI Multi I/O cards
+         * Best Connectivity and Rosewill PCI Multi I/O cards
         */
        {       PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9865,
@@ -4029,6 +4024,10 @@ static struct pci_device_id serial_pci_tbl[] = {
                0, 0, pbn_b0_1_115200 },
        {       PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9865,
+                0xA000, 0x3002,
+                0, 0, pbn_b0_bt_2_115200 },
+        {       PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9865,
                0xA000, 0x3004,
                0, 0, pbn_b0_bt_4_115200 },
        /* Intel CE4100 */
diff --git a/drivers/tty/serial/8250_pnp.c b/drivers/tty/serial/8250_pnp.c
index fc301f6722e1..a2f236510ff1 100644
--- a/drivers/tty/serial/8250_pnp.c
+++ b/drivers/tty/serial/8250_pnp.c
@@ -109,6 +109,9 @@ static const struct pnp_device_id pnp_dev_table[] = {
        /* IBM */
        /* IBM Thinkpad 701 Internal Modem Voice */
        {       "IBM0033",              0       },
+        /* Intermec */
+        /* Intermec CV60 touchscreen port */
+        {       "PNP4972",              0       },
        /* Intertex */
        /* Intertex 28k8 33k6 Voice EXT PnP */
        {       "IXDC801",              0       },
diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
index af9b7814965a..b922f5d2e61e 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -1609,9 +1609,11 @@ static struct console atmel_console = {
 static int __init atmel_console_init(void)
 {
        if (atmel_default_console_device) {
-                add_preferred_console(ATMEL_DEVICENAME,
+                struct atmel_uart_data *pdata =
-                                      atmel_default_console_device->id, NULL);
+                        atmel_default_console_device->dev.platform_data;
-                atmel_init_port(&atmel_ports[atmel_default_console_device->id],
+                add_preferred_console(ATMEL_DEVICENAME, pdata->num, NULL);
+                atmel_init_port(&atmel_ports[pdata->num],
                                atmel_default_console_device);
                register_console(&atmel_console);
        }
diff --git a/drivers/tty/serial/max3107-aava.c b/drivers/tty/serial/max3107-aava.c
index a1fe304f2f52..d73aadd7a9ad 100644
--- a/drivers/tty/serial/max3107-aava.c
+++ b/drivers/tty/serial/max3107-aava.c
@@ -340,5 +340,5 @@ module_exit(max3107_exit);
 MODULE_DESCRIPTION("MAX3107 driver");
 MODULE_AUTHOR("Aavamobile");
-MODULE_ALIAS("aava-max3107-spi");
+MODULE_ALIAS("spi:aava-max3107");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/tty/serial/max3107.c b/drivers/tty/serial/max3107.c
index 750b4f627315..a8164601c0ea 100644
--- a/drivers/tty/serial/max3107.c
+++ b/drivers/tty/serial/max3107.c
@@ -1209,5 +1209,5 @@ module_exit(max3107_exit);
 MODULE_DESCRIPTION("MAX3107 driver");
 MODULE_AUTHOR("Aavamobile");
-MODULE_ALIAS("max3107-spi");
+MODULE_ALIAS("spi:max3107");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/tty/serial/mrst_max3110.c b/drivers/tty/serial/mrst_max3110.c
index a764bf99743b..23bc743f2a22 100644
--- a/drivers/tty/serial/mrst_max3110.c
+++ b/drivers/tty/serial/mrst_max3110.c
@@ -917,4 +917,4 @@ module_init(serial_m3110_init);
 module_exit(serial_m3110_exit);
 MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("max3110-uart");
+MODULE_ALIAS("spi:max3110-uart");
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index c37df8d0fa28..5e713d3ef1f4 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -806,8 +806,7 @@ serial_omap_set_termios(struct uart_port *port, struct ktermios *termios,
        serial_omap_set_mctrl(&up->port, up->port.mctrl);
        /* Software Flow Control Configuration */
-        if (termios->c_iflag & (IXON | IXOFF))
+        serial_omap_configure_xonxoff(up, termios);
-                serial_omap_configure_xonxoff(up, termios);
        spin_unlock_irqrestore(&up->port.lock, flags);
        dev_dbg(up->port.dev, "serial_omap_set_termios+%d\n", up->pdev->id);
diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
index 846dfcd3ce0d..b46218d679e2 100644
--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -598,7 +598,8 @@ static void pch_request_dma(struct uart_port *port)
        dma_cap_zero(mask);
        dma_cap_set(DMA_SLAVE, mask);
-        dma_dev = pci_get_bus_and_slot(2, PCI_DEVFN(0xa, 0)); /* Get DMA's dev
+        dma_dev = pci_get_bus_and_slot(priv->pdev->bus->number,
+                                       PCI_DEVFN(0xa, 0)); /* Get DMA's dev
                                                                information */
        /* Set Tx DMA */
        param = &priv->param_tx;
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index afc629423152..6edafb5ace18 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1225,15 +1225,19 @@ static const struct dev_pm_ops s3c24xx_serial_pm_ops = {
        .suspend = s3c24xx_serial_suspend,
        .resume = s3c24xx_serial_resume,
 };
+#define SERIAL_SAMSUNG_PM_OPS   (&s3c24xx_serial_pm_ops)
 #else /* !CONFIG_PM_SLEEP */
-#define s3c24xx_serial_pm_ops   NULL
+#define SERIAL_SAMSUNG_PM_OPS   NULL
 #endif /* CONFIG_PM_SLEEP */
 int s3c24xx_serial_init(struct platform_driver *drv,
                        struct s3c24xx_uart_info *info)
 {
        dbg("s3c24xx_serial_init(%p,%p)\n", drv, info);
-        drv->driver.pm = &s3c24xx_serial_pm_ops;
+        drv->driver.pm = SERIAL_SAMSUNG_PM_OPS;
        return platform_driver_register(drv);
 }
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index db7912cb7ae0..a3efbea5dbba 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -200,6 +200,11 @@ static int uart_startup(struct tty_struct *tty, struct uart_state *state, int in
                clear_bit(TTY_IO_ERROR, &tty->flags);
        }
+        /*
+         * This is to allow setserial on this port. People may want to set
+         * port/irq/type and then reconfigure the port properly if it failed
+         * now.
+         */
        if (retval && capable(CAP_SYS_ADMIN))
                retval = 0;
diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c
index c327218cad44..9af9f0879a24 100644
--- a/drivers/tty/serial/ucc_uart.c
+++ b/drivers/tty/serial/ucc_uart.c
@@ -235,7 +235,7 @@ static inline void *qe2cpu_addr(dma_addr_t addr, struct uart_qe_port *qe_port)
                return qe_port->bd_virt + (addr - qe_port->bd_dma_addr);
        /* something nasty happened */
-        printk(KERN_ERR "%s: addr=%x\n", __func__, addr);
+        printk(KERN_ERR "%s: addr=%llx\n", __func__, (u64)addr);
        BUG();
        return NULL;
 }
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 150e4f747c7d..4f1fc81112e6 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1295,8 +1295,7 @@ static int tty_driver_install_tty(struct tty_driver *driver,
 *
 *      Locking: tty_mutex for now
 */
-static void tty_driver_remove_tty(struct tty_driver *driver,
+void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *tty)
-                                                struct tty_struct *tty)
 {
        if (driver->ops->remove)
                driver->ops->remove(driver, tty);
diff --git a/drivers/video/backlight/adp8870_bl.c b/drivers/video/backlight/adp8870_bl.c
index 05a8832bb3eb..d06886a2bfb5 100644
--- a/drivers/video/backlight/adp8870_bl.c
+++ b/drivers/video/backlight/adp8870_bl.c
@@ -1009,4 +1009,4 @@ module_exit(adp8870_exit);
 MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
 MODULE_DESCRIPTION("ADP8870 Backlight driver");
-MODULE_ALIAS("platform:adp8870-backlight");
+MODULE_ALIAS("i2c:adp8870-backlight");
diff --git a/drivers/video/backlight/ep93xx_bl.c b/drivers/video/backlight/ep93xx_bl.c
index 9f1e389d51d2..b0582917f0c8 100644
--- a/drivers/video/backlight/ep93xx_bl.c
+++ b/drivers/video/backlight/ep93xx_bl.c
@@ -11,7 +11,7 @@
 * BRIGHT, on the Cirrus EP9307, EP9312, and EP9315 processors.
 */
+#include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/io.h>
 #include <linux/fb.h>
diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
index b8f38ec6eb18..8b5b2a4124c7 100644
--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -28,6 +28,8 @@ struct pwm_bl_data {
        unsigned int            lth_brightness;
        int                     (*notify)(struct device *,
                                          int brightness);
+        void                    (*notify_after)(struct device *,
+                                        int brightness);
        int                     (*check_fb)(struct device *, struct fb_info *);
 };
@@ -55,6 +57,10 @@ static int pwm_backlight_update_status(struct backlight_device *bl)
                pwm_config(pb->pwm, brightness, pb->period);
                pwm_enable(pb->pwm);
        }
+        if (pb->notify_after)
+                pb->notify_after(pb->dev, brightness);
        return 0;
 }
@@ -105,6 +111,7 @@ static int pwm_backlight_probe(struct platform_device *pdev)
        pb->period = data->pwm_period_ns;
        pb->notify = data->notify;
+        pb->notify_after = data->notify_after;
        pb->check_fb = data->check_fb;
        pb->lth_brightness = data->lth_brightness *
                (data->pwm_period_ns / data->max_brightness);
@@ -172,6 +179,8 @@ static int pwm_backlight_suspend(struct platform_device *pdev,
                pb->notify(pb->dev, 0);
        pwm_config(pb->pwm, 0, pb->period);
        pwm_disable(pb->pwm);
+        if (pb->notify_after)
+                pb->notify_after(pb->dev, 0);
        return 0;
 }
diff --git a/drivers/w1/masters/ds2490.c b/drivers/w1/masters/ds2490.c
index 02bf7bf7160b..b5abaae38e97 100644
--- a/drivers/w1/masters/ds2490.c
+++ b/drivers/w1/masters/ds2490.c
@@ -1,7 +1,7 @@
 /*
 *      dscore.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
@@ -1024,5 +1024,5 @@ module_init(ds_init);
 module_exit(ds_fini);
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("DS2490 USB <-> W1 bus master driver (DS9490*)");
diff --git a/drivers/w1/masters/matrox_w1.c b/drivers/w1/masters/matrox_w1.c
index 334d1ccf9c92..f667c26b2195 100644
--- a/drivers/w1/masters/matrox_w1.c
+++ b/drivers/w1/masters/matrox_w1.c
@@ -1,7 +1,7 @@
 /*
 *      matrox_w1.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
@@ -39,7 +39,7 @@
 #include "../w1_log.h"
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Driver for transport(Dallas 1-wire prtocol) over VGA DDC(matrox gpio).");
 static struct pci_device_id matrox_w1_tbl[] = {
diff --git a/drivers/w1/slaves/w1_ds2408.c b/drivers/w1/slaves/w1_ds2408.c
index c37781899d90..7c8cdb8aed26 100644
--- a/drivers/w1/slaves/w1_ds2408.c
+++ b/drivers/w1/slaves/w1_ds2408.c
@@ -373,7 +373,7 @@ static int w1_f29_add_slave(struct w1_slave *sl)
 static void w1_f29_remove_slave(struct w1_slave *sl)
 {
        int i;
-        for (i = NB_SYSFS_BIN_FILES; i <= 0; --i)
+        for (i = NB_SYSFS_BIN_FILES - 1; i >= 0; --i)
                sysfs_remove_bin_file(&sl->dev.kobj,
                        &(w1_f29_sysfs_bin_files[i]));
 }
diff --git a/drivers/w1/slaves/w1_smem.c b/drivers/w1/slaves/w1_smem.c
index cc8c02e92593..84655625c870 100644
--- a/drivers/w1/slaves/w1_smem.c
+++ b/drivers/w1/slaves/w1_smem.c
@@ -1,7 +1,7 @@
 /*
 *      w1_smem.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
@@ -32,7 +32,7 @@
 #include "../w1_family.h"
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Driver for 1-wire Dallas network protocol, 64bit memory family.");
 static struct w1_family w1_smem_family_01 = {
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 402928b135d1..a1ef9b5b38cf 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -1,7 +1,7 @@
 /*
 *      w1_therm.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
@@ -34,7 +34,7 @@
 #include "../w1_family.h"
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Driver for 1-wire Dallas network protocol, temperature family.");
 /* Allow the strong pullup to be disabled, but default to enabled.
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index 6c136c19e982..c37497823851 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -1,7 +1,7 @@
 /*
 *      w1.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
@@ -42,7 +42,7 @@
 #include "w1_netlink.h"
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Driver for 1-wire Dallas network protocol.");
 static int w1_timeout = 10;
diff --git a/drivers/w1/w1.h b/drivers/w1/w1.h
index 1ce23fc6186c..4d012ca3f32c 100644
--- a/drivers/w1/w1.h
+++ b/drivers/w1/w1.h
@@ -1,7 +1,7 @@
 /*
 *      w1.h
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_family.c b/drivers/w1/w1_family.c
index 4a099041f28a..63359797c8b1 100644
--- a/drivers/w1/w1_family.c
+++ b/drivers/w1/w1_family.c
@@ -1,7 +1,7 @@
 /*
 *      w1_family.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_family.h b/drivers/w1/w1_family.h
index 98a1ac0f4693..490cda2281bc 100644
--- a/drivers/w1/w1_family.h
+++ b/drivers/w1/w1_family.h
@@ -1,7 +1,7 @@
 /*
 *      w1_family.h
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_int.c b/drivers/w1/w1_int.c
index b50be3f1073d..d220bce2cee4 100644
--- a/drivers/w1/w1_int.c
+++ b/drivers/w1/w1_int.c
@@ -1,7 +1,7 @@
 /*
 *      w1_int.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_int.h b/drivers/w1/w1_int.h
index 4274082d2262..2ad7d4414bed 100644
--- a/drivers/w1/w1_int.h
+++ b/drivers/w1/w1_int.h
@@ -1,7 +1,7 @@
 /*
 *      w1_int.h
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_io.c b/drivers/w1/w1_io.c
index 8e8b64cfafb6..765b37b62a4f 100644
--- a/drivers/w1/w1_io.c
+++ b/drivers/w1/w1_io.c
@@ -1,7 +1,7 @@
 /*
 *      w1_io.c
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_log.h b/drivers/w1/w1_log.h
index e6ab7cf08f88..9c7bd62e6bdc 100644
--- a/drivers/w1/w1_log.h
+++ b/drivers/w1/w1_log.h
@@ -1,7 +1,7 @@
 /*
 *      w1_log.h
 *
- * Copyright (c) 2004 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2004 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c
index 55aabd927c60..40788c925d1c 100644
--- a/drivers/w1/w1_netlink.c
+++ b/drivers/w1/w1_netlink.c
@@ -1,7 +1,7 @@
 /*
 * w1_netlink.c
 *
- * Copyright (c) 2003 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2003 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/w1/w1_netlink.h b/drivers/w1/w1_netlink.h
index 27e950f935b1..b0922dc29658 100644
--- a/drivers/w1/w1_netlink.h
+++ b/drivers/w1/w1_netlink.h
@@ -1,7 +1,7 @@
 /*
 * w1_netlink.h
 *
- * Copyright (c) 2003 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * Copyright (c) 2003 Evgeniy Polyakov <zbr@ioremap.net>
 *
 *
 * This program is free software; you can redistribute it and/or modify
diff --git a/drivers/xen/xen-selfballoon.c b/drivers/xen/xen-selfballoon.c
index 1b4afd81f872..6ea852e25162 100644
--- a/drivers/xen/xen-selfballoon.c
+++ b/drivers/xen/xen-selfballoon.c
@@ -70,6 +70,7 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/mman.h>
+#include <linux/module.h>
 #include <linux/workqueue.h>
 #include <xen/balloon.h>
 #include <xen/tmem.h>
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 54b8c28bebc8..720d885e8dca 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -474,17 +474,22 @@ befs_follow_link(struct dentry *dentry, struct nameidata *nd)
                befs_data_stream *data = &befs_ino->i_data.ds;
                befs_off_t len = data->size;
-                befs_debug(sb, "Follow long symlink");
+                if (len == 0) {
+                        befs_error(sb, "Long symlink with illegal length");
-                link = kmalloc(len, GFP_NOFS);
-                if (!link) {
-                        link = ERR_PTR(-ENOMEM);
-                } else if (befs_read_lsymlink(sb, data, link, len) != len) {
-                        kfree(link);
-                        befs_error(sb, "Failed to read entire long symlink");
                        link = ERR_PTR(-EIO);
                } else {
-                        link[len - 1] = '\0';
+                        befs_debug(sb, "Follow long symlink");
+                        link = kmalloc(len, GFP_NOFS);
+                        if (!link) {
+                                link = ERR_PTR(-ENOMEM);
+                        } else if (befs_read_lsymlink(sb, data, link, len) != len) {
+                                kfree(link);
+                                befs_error(sb, "Failed to read entire long symlink");
+                                link = ERR_PTR(-EIO);
+                        } else {
+                                link[len - 1] = '\0';
+                        }
                }
        } else {
                link = befs_ino->i_data.symlink;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 0469263e327e..03912c5c6f49 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -1415,17 +1415,15 @@ void btrfs_set_##name(struct extent_buffer *eb, type *s, u##bits val);
 #define BTRFS_SETGET_HEADER_FUNCS(name, type, member, bits)             \
 static inline u##bits btrfs_##name(struct extent_buffer *eb)            \
 {                                                                       \
-        type *p = kmap_atomic(eb->first_page, KM_USER0);                \
+        type *p = page_address(eb->first_page);                         \
        u##bits res = le##bits##_to_cpu(p->member);                     \
-        kunmap_atomic(p, KM_USER0);                                     \
        return res;                                                     \
 }                                                                       \
 static inline void btrfs_set_##name(struct extent_buffer *eb,           \
                                    u##bits val)                        \
 {                                                                       \
-        type *p = kmap_atomic(eb->first_page, KM_USER0);                \
+        type *p = page_address(eb->first_page);                         \
        p->member = cpu_to_le##bits(val);                               \
-        kunmap_atomic(p, KM_USER0);                                     \
 }
 #define BTRFS_SETGET_STACK_FUNCS(name, type, member, bits)              \
@@ -2367,8 +2365,8 @@ static inline int btrfs_insert_empty_item(struct btrfs_trans_handle *trans,
 int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path);
 int btrfs_prev_leaf(struct btrfs_root *root, struct btrfs_path *path);
 int btrfs_leaf_free_space(struct btrfs_root *root, struct extent_buffer *leaf);
-int btrfs_drop_snapshot(struct btrfs_root *root,
+void btrfs_drop_snapshot(struct btrfs_root *root,
-                        struct btrfs_block_rsv *block_rsv, int update_ref);
+                         struct btrfs_block_rsv *block_rsv, int update_ref);
 int btrfs_drop_subtree(struct btrfs_trans_handle *trans,
                        struct btrfs_root *root,
                        struct extent_buffer *node,
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 66bac226944e..f5be06a2462f 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1782,6 +1782,9 @@ static int btrfs_discard_extent(struct btrfs_root *root, u64 bytenr,
                for (i = 0; i < multi->num_stripes; i++, stripe++) {
+                        if (!stripe->dev->can_discard)
+                                continue;
                        ret = btrfs_issue_discard(stripe->dev->bdev,
                                                  stripe->physical,
                                                  stripe->length);
@@ -1789,11 +1792,16 @@ static int btrfs_discard_extent(struct btrfs_root *root, u64 bytenr,
                                discarded_bytes += stripe->length;
                        else if (ret != -EOPNOTSUPP)
                                break;
+                        /*
+                         * Just in case we get back EOPNOTSUPP for some reason,
+                         * just ignore the return value so we don't screw up
+                         * people calling discard_extent.
+                         */
+                        ret = 0;
                }
                kfree(multi);
        }
-        if (discarded_bytes && ret == -EOPNOTSUPP)
-                ret = 0;
        if (actual_bytes)
                *actual_bytes = discarded_bytes;
@@ -6269,8 +6277,8 @@ static noinline int walk_up_tree(struct btrfs_trans_handle *trans,
 * also make sure backrefs for the shared block and all lower level
 * blocks are properly updated.
 */
-int btrfs_drop_snapshot(struct btrfs_root *root,
+void btrfs_drop_snapshot(struct btrfs_root *root,
-                        struct btrfs_block_rsv *block_rsv, int update_ref)
+                         struct btrfs_block_rsv *block_rsv, int update_ref)
 {
        struct btrfs_path *path;
        struct btrfs_trans_handle *trans;
@@ -6283,13 +6291,16 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
        int level;
        path = btrfs_alloc_path();
-        if (!path)
+        if (!path) {
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto out;
+        }
        wc = kzalloc(sizeof(*wc), GFP_NOFS);
        if (!wc) {
                btrfs_free_path(path);
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto out;
        }
        trans = btrfs_start_transaction(tree_root, 0);
@@ -6318,7 +6329,7 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
                path->lowest_level = 0;
                if (ret < 0) {
                        err = ret;
-                        goto out;
+                        goto out_free;
                }
                WARN_ON(ret > 0);
@@ -6425,11 +6436,14 @@ int btrfs_drop_snapshot(struct btrfs_root *root,
                free_extent_buffer(root->commit_root);
                kfree(root);
        }
-out:
+out_free:
        btrfs_end_transaction_throttle(trans, tree_root);
        kfree(wc);
        btrfs_free_path(path);
-        return err;
+out:
+        if (err)
+                btrfs_std_error(root->fs_info, err);
+        return;
 }
 /*
@@ -6720,6 +6734,10 @@ int btrfs_can_relocate(struct btrfs_root *root, u64 bytenr)
        struct btrfs_space_info *space_info;
        struct btrfs_fs_devices *fs_devices = root->fs_info->fs_devices;
        struct btrfs_device *device;
+        u64 min_free;
+        u64 dev_min = 1;
+        u64 dev_nr = 0;
+        int index;
        int full = 0;
        int ret = 0;
@@ -6729,8 +6747,10 @@ int btrfs_can_relocate(struct btrfs_root *root, u64 bytenr)
        if (!block_group)
                return -1;
+        min_free = btrfs_block_group_used(&block_group->item);
        /* no bytes used, we're good */
-        if (!btrfs_block_group_used(&block_group->item))
+        if (!min_free)
                goto out;
        space_info = block_group->space_info;
@@ -6746,10 +6766,9 @@ int btrfs_can_relocate(struct btrfs_root *root, u64 bytenr)
         * all of the extents from this block group.  If we can, we're good
         */
        if ((space_info->total_bytes != block_group->key.offset) &&
-           (space_info->bytes_used + space_info->bytes_reserved +
+            (space_info->bytes_used + space_info->bytes_reserved +
-            space_info->bytes_pinned + space_info->bytes_readonly +
+             space_info->bytes_pinned + space_info->bytes_readonly +
-            btrfs_block_group_used(&block_group->item) <
+             min_free < space_info->total_bytes)) {
-            space_info->total_bytes)) {
                spin_unlock(&space_info->lock);
                goto out;
        }
@@ -6766,9 +6785,31 @@ int btrfs_can_relocate(struct btrfs_root *root, u64 bytenr)
        if (full)
                goto out;
+        /*
+         * index:
+         *      0: raid10
+         *      1: raid1
+         *      2: dup
+         *      3: raid0
+         *      4: single
+         */
+        index = get_block_group_index(block_group);
+        if (index == 0) {
+                dev_min = 4;
+                /* Divide by 2 */
+                min_free >>= 1;
+        } else if (index == 1) {
+                dev_min = 2;
+        } else if (index == 2) {
+                /* Multiply by 2 */
+                min_free <<= 1;
+        } else if (index == 3) {
+                dev_min = fs_devices->rw_devices;
+                do_div(min_free, dev_min);
+        }
        mutex_lock(&root->fs_info->chunk_mutex);
        list_for_each_entry(device, &fs_devices->alloc_list, dev_alloc_list) {
-                u64 min_free = btrfs_block_group_used(&block_group->item);
                u64 dev_offset;
                /*
@@ -6779,7 +6820,11 @@ int btrfs_can_relocate(struct btrfs_root *root, u64 bytenr)
                        ret = find_free_dev_extent(NULL, device, min_free,
                                                   &dev_offset, NULL);
                        if (!ret)
+                                dev_nr++;
+                        if (dev_nr >= dev_min)
                                break;
                        ret = -1;
                }
        }
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 658d66959abe..e7872e485f13 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -150,6 +150,8 @@ int btrfs_add_inode_defrag(struct btrfs_trans_handle *trans,
        spin_lock(&root->fs_info->defrag_inodes_lock);
        if (!BTRFS_I(inode)->in_defrag)
                __btrfs_add_inode_defrag(inode, defrag);
+        else
+                kfree(defrag);
        spin_unlock(&root->fs_info->defrag_inodes_lock);
        return 0;
 }
@@ -1638,11 +1640,15 @@ static long btrfs_fallocate(struct file *file, int mode,
        cur_offset = alloc_start;
        while (1) {
+                u64 actual_end;
                em = btrfs_get_extent(inode, NULL, 0, cur_offset,
                                      alloc_end - cur_offset, 0);
                BUG_ON(IS_ERR_OR_NULL(em));
                last_byte = min(extent_map_end(em), alloc_end);
+                actual_end = min_t(u64, extent_map_end(em), offset + len);
                last_byte = (last_byte + mask) & ~mask;
                if (em->block_start == EXTENT_MAP_HOLE ||
                    (cur_offset >= inode->i_size &&
                     !test_bit(EXTENT_FLAG_PREALLOC, &em->flags))) {
@@ -1655,6 +1661,16 @@ static long btrfs_fallocate(struct file *file, int mode,
                                free_extent_map(em);
                                break;
                        }
+                } else if (actual_end > inode->i_size &&
+                           !(mode & FALLOC_FL_KEEP_SIZE)) {
+                        /*
+                         * We didn't need to allocate any more space, but we
+                         * still extended the size of the file so we need to
+                         * update i_size.
+                         */
+                        inode->i_ctime = CURRENT_TIME;
+                        i_size_write(inode, actual_end);
+                        btrfs_ordered_update_i_size(inode, actual_end, NULL);
                }
                free_extent_map(em);
@@ -1804,10 +1820,14 @@ static loff_t btrfs_file_llseek(struct file *file, loff_t offset, int origin)
                }
        }
-        if (offset < 0 && !(file->f_mode & FMODE_UNSIGNED_OFFSET))
+        if (offset < 0 && !(file->f_mode & FMODE_UNSIGNED_OFFSET)) {
-                return -EINVAL;
+                ret = -EINVAL;
-        if (offset > inode->i_sb->s_maxbytes)
+                goto out;
-                return -EINVAL;
+        }
+        if (offset > inode->i_sb->s_maxbytes) {
+                ret = -EINVAL;
+                goto out;
+        }
        /* Special lock needed here? */
        if (offset != file->f_pos) {
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 6377713f639c..6a265b9f85f2 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1168,9 +1168,9 @@ static void recalculate_thresholds(struct btrfs_free_space_ctl *ctl)
                div64_u64(extent_bytes, (sizeof(struct btrfs_free_space)));
 }
-static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
+static inline void __bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
-                              struct btrfs_free_space *info, u64 offset,
+                                       struct btrfs_free_space *info,
-                              u64 bytes)
+                                       u64 offset, u64 bytes)
 {
        unsigned long start, count;
@@ -1181,6 +1181,13 @@ static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
        bitmap_clear(info->bitmap, start, count);
        info->bytes -= bytes;
+}
+static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
+                              struct btrfs_free_space *info, u64 offset,
+                              u64 bytes)
+{
+        __bitmap_clear_bits(ctl, info, offset, bytes);
        ctl->free_space -= bytes;
 }
@@ -1984,7 +1991,7 @@ static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
                return 0;
        ret = search_start;
-        bitmap_clear_bits(ctl, entry, ret, bytes);
+        __bitmap_clear_bits(ctl, entry, ret, bytes);
        return ret;
 }
@@ -2039,7 +2046,6 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
                                continue;
                        }
                } else {
                        ret = entry->offset;
                        entry->offset += bytes;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 15fceefbca0a..0ccc7438ad34 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -7354,11 +7354,15 @@ static int btrfs_set_page_dirty(struct page *page)
 static int btrfs_permission(struct inode *inode, int mask)
 {
        struct btrfs_root *root = BTRFS_I(inode)->root;
+        umode_t mode = inode->i_mode;
-        if (btrfs_root_readonly(root) && (mask & MAY_WRITE))
+        if (mask & MAY_WRITE &&
-                return -EROFS;
+            (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))) {
-        if ((BTRFS_I(inode)->flags & BTRFS_INODE_READONLY) && (mask & MAY_WRITE))
+                if (btrfs_root_readonly(root))
-                return -EACCES;
+                        return -EROFS;
+                if (BTRFS_I(inode)->flags & BTRFS_INODE_READONLY)
+                        return -EACCES;
+        }
        return generic_permission(inode, mask);
 }
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 7cf013349941..970977aab224 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2236,6 +2236,10 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                btrfs_wait_ordered_range(src, off, len);
        }
+        /* truncate page cache pages from target inode range */
+        truncate_inode_pages_range(&inode->i_data, off,
+                                   ALIGN(off + len, PAGE_CACHE_SIZE) - 1);
        /* clone data */
        key.objectid = btrfs_ino(src);
        key.type = BTRFS_EXTENT_DATA_KEY;
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index babee65f8eda..786639fca067 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -799,14 +799,15 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
                                  struct extent_buffer *eb, int slot,
                                  struct btrfs_key *key)
 {
-        struct inode *dir;
-        int ret;
        struct btrfs_inode_ref *ref;
+        struct btrfs_dir_item *di;
+        struct inode *dir;
        struct inode *inode;
-        char *name;
-        int namelen;
        unsigned long ref_ptr;
        unsigned long ref_end;
+        char *name;
+        int namelen;
+        int ret;
        int search_done = 0;
        /*
@@ -909,6 +910,25 @@ again:
        }
        btrfs_release_path(path);
+        /* look for a conflicting sequence number */
+        di = btrfs_lookup_dir_index_item(trans, root, path, btrfs_ino(dir),
+                                         btrfs_inode_ref_index(eb, ref),
+                                         name, namelen, 0);
+        if (di && !IS_ERR(di)) {
+                ret = drop_one_dir_item(trans, root, path, dir, di);
+                BUG_ON(ret);
+        }
+        btrfs_release_path(path);
+        /* look for a conflicing name */
+        di = btrfs_lookup_dir_item(trans, root, path, btrfs_ino(dir),
+                                   name, namelen, 0);
+        if (di && !IS_ERR(di)) {
+                ret = drop_one_dir_item(trans, root, path, dir, di);
+                BUG_ON(ret);
+        }
+        btrfs_release_path(path);
 insert:
        /* insert our name */
        ret = btrfs_add_link(trans, dir, inode, name, namelen, 0,
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 53875ae73ad4..f2a4cc79da61 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -142,6 +142,7 @@ static noinline int run_scheduled_bios(struct btrfs_device *device)
        unsigned long limit;
        unsigned long last_waited = 0;
        int force_reg = 0;
+        int sync_pending = 0;
        struct blk_plug plug;
        /*
@@ -229,6 +230,22 @@ loop_lock:
                BUG_ON(atomic_read(&cur->bi_cnt) == 0);
+                /*
+                 * if we're doing the sync list, record that our
+                 * plug has some sync requests on it
+                 *
+                 * If we're doing the regular list and there are
+                 * sync requests sitting around, unplug before
+                 * we add more
+                 */
+                if (pending_bios == &device->pending_sync_bios) {
+                        sync_pending = 1;
+                } else if (sync_pending) {
+                        blk_finish_plug(&plug);
+                        blk_start_plug(&plug);
+                        sync_pending = 0;
+                }
                submit_bio(cur->bi_rw, cur);
                num_run++;
                batch_run++;
@@ -500,6 +517,9 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
                        fs_devices->rw_devices--;
                }
+                if (device->can_discard)
+                        fs_devices->num_can_discard--;
                new_device = kmalloc(sizeof(*new_device), GFP_NOFS);
                BUG_ON(!new_device);
                memcpy(new_device, device, sizeof(*new_device));
@@ -508,6 +528,7 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
                new_device->bdev = NULL;
                new_device->writeable = 0;
                new_device->in_fs_metadata = 0;
+                new_device->can_discard = 0;
                list_replace_rcu(&device->dev_list, &new_device->dev_list);
                call_rcu(&device->rcu, free_device);
@@ -547,6 +568,7 @@ int btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
 static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                                fmode_t flags, void *holder)
 {
+        struct request_queue *q;
        struct block_device *bdev;
        struct list_head *head = &fs_devices->devices;
        struct btrfs_device *device;
@@ -603,6 +625,12 @@ static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                        seeding = 0;
                }
+                q = bdev_get_queue(bdev);
+                if (blk_queue_discard(q)) {
+                        device->can_discard = 1;
+                        fs_devices->num_can_discard++;
+                }
                device->bdev = bdev;
                device->in_fs_metadata = 0;
                device->mode = flags;
@@ -835,6 +863,7 @@ int find_free_dev_extent(struct btrfs_trans_handle *trans,
        max_hole_start = search_start;
        max_hole_size = 0;
+        hole_size = 0;
        if (search_start >= search_end) {
                ret = -ENOSPC;
@@ -917,7 +946,14 @@ next:
                cond_resched();
        }
-        hole_size = search_end- search_start;
+        /*
+         * At this point, search_start should be the end of
+         * allocated dev extents, and when shrinking the device,
+         * search_end may be smaller than search_start.
+         */
+        if (search_end > search_start)
+                hole_size = search_end - search_start;
        if (hole_size > max_hole_size) {
                max_hole_start = search_start;
                max_hole_size = hole_size;
@@ -1543,6 +1579,7 @@ error:
 int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
 {
+        struct request_queue *q;
        struct btrfs_trans_handle *trans;
        struct btrfs_device *device;
        struct block_device *bdev;
@@ -1612,6 +1649,9 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
        lock_chunks(root);
+        q = bdev_get_queue(bdev);
+        if (blk_queue_discard(q))
+                device->can_discard = 1;
        device->writeable = 1;
        device->work.func = pending_bios_fn;
        generate_random_uuid(device->uuid);
@@ -1647,6 +1687,8 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
        root->fs_info->fs_devices->num_devices++;
        root->fs_info->fs_devices->open_devices++;
        root->fs_info->fs_devices->rw_devices++;
+        if (device->can_discard)
+                root->fs_info->fs_devices->num_can_discard++;
        root->fs_info->fs_devices->total_rw_bytes += device->total_bytes;
        if (!blk_queue_nonrot(bdev_get_queue(bdev)))
@@ -2413,9 +2455,10 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
                        total_avail = device->total_bytes - device->bytes_used;
                else
                        total_avail = 0;
-                /* avail is off by max(alloc_start, 1MB), but that is the same
-                 * for all devices, so it doesn't hurt the sorting later on
+                /* If there is no space on this device, skip it. */
-                 */
+                if (total_avail == 0)
+                        continue;
                ret = find_free_dev_extent(trans, device,
                                           max_stripe_size * dev_stripes,
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 7c12d61ae7ae..6d866db4e177 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -48,6 +48,7 @@ struct btrfs_device {
        int writeable;
        int in_fs_metadata;
        int missing;
+        int can_discard;
        spinlock_t io_lock;
@@ -104,6 +105,7 @@ struct btrfs_fs_devices {
        u64 rw_devices;
        u64 missing_devices;
        u64 total_rw_bytes;
+        u64 num_can_discard;
        struct block_device *latest_bdev;
        /* all of the devices in the FS, protected by a mutex
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 2fe3cf13b2e9..6d40656e1e29 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -176,7 +176,7 @@ static int cifs_debug_data_proc_show(struct seq_file *m, void *v)
 #ifdef CONFIG_CIFS_STATS2
                        seq_printf(m, " In Send: %d In MaxReq Wait: %d",
-                                atomic_read(&server->inSend),
+                                atomic_read(&server->in_send),
                                atomic_read(&server->num_waiters));
 #endif
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 21de1d6d5849..d0f59faefb78 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -991,24 +991,6 @@ struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,
        return pntsd;
 }
-static int set_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb, __u16 fid,
-                struct cifs_ntsd *pnntsd, u32 acllen)
-{
-        int xid, rc;
-        struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
-        if (IS_ERR(tlink))
-                return PTR_ERR(tlink);
-        xid = GetXid();
-        rc = CIFSSMBSetCIFSACL(xid, tlink_tcon(tlink), fid, pnntsd, acllen);
-        FreeXid(xid);
-        cifs_put_tlink(tlink);
-        cFYI(DBG2, "SetCIFSACL rc = %d", rc);
-        return rc;
-}
 static int set_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, const char *path,
                struct cifs_ntsd *pnntsd, u32 acllen)
 {
@@ -1047,18 +1029,10 @@ int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
                                struct inode *inode, const char *path)
 {
        struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
-        struct cifsFileInfo *open_file;
-        int rc;
        cFYI(DBG2, "set ACL for %s from mode 0x%x", path, inode->i_mode);
-        open_file = find_readable_file(CIFS_I(inode), true);
+        return set_cifs_acl_by_path(cifs_sb, path, pnntsd, acllen);
-        if (!open_file)
-                return set_cifs_acl_by_path(cifs_sb, path, pnntsd, acllen);
-        rc = set_cifs_acl_by_fid(cifs_sb, open_file->netfid, pnntsd, acllen);
-        cifsFileInfo_put(open_file);
-        return rc;
 }
 /* Translate the CIFS ACL (simlar to NTFS ACL) for a file into mode bits */
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index cb71dc1f94d1..95da8027983d 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -125,5 +125,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CIFS_NFSD_EXPORT */
-#define CIFS_VERSION   "1.74"
+#define CIFS_VERSION   "1.75"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 38ce6d44b145..95dad9d14cf1 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -291,7 +291,7 @@ struct TCP_Server_Info {
        struct fscache_cookie   *fscache; /* client index cache cookie */
 #endif
 #ifdef CONFIG_CIFS_STATS2
-        atomic_t inSend; /* requests trying to send */
+        atomic_t in_send; /* requests trying to send */
        atomic_t num_waiters;   /* blocked waiting to get in sendrecv */
 #endif
 };
@@ -672,12 +672,54 @@ struct mid_q_entry {
        bool multiEnd:1;        /* both received */
 };
-struct oplock_q_entry {
+/*      Make code in transport.c a little cleaner by moving
-        struct list_head qhead;
+        update of optional stats into function below */
-        struct inode *pinode;
+#ifdef CONFIG_CIFS_STATS2
-        struct cifs_tcon *tcon;
-        __u16 netfid;
+static inline void cifs_in_send_inc(struct TCP_Server_Info *server)
-};
+{
+        atomic_inc(&server->in_send);
+}
+static inline void cifs_in_send_dec(struct TCP_Server_Info *server)
+{
+        atomic_dec(&server->in_send);
+}
+static inline void cifs_num_waiters_inc(struct TCP_Server_Info *server)
+{
+        atomic_inc(&server->num_waiters);
+}
+static inline void cifs_num_waiters_dec(struct TCP_Server_Info *server)
+{
+        atomic_dec(&server->num_waiters);
+}
+static inline void cifs_save_when_sent(struct mid_q_entry *mid)
+{
+        mid->when_sent = jiffies;
+}
+#else
+static inline void cifs_in_send_inc(struct TCP_Server_Info *server)
+{
+}
+static inline void cifs_in_send_dec(struct TCP_Server_Info *server)
+{
+}
+static inline void cifs_num_waiters_inc(struct TCP_Server_Info *server)
+{
+}
+static inline void cifs_num_waiters_dec(struct TCP_Server_Info *server)
+{
+}
+static inline void cifs_save_when_sent(struct mid_q_entry *mid)
+{
+}
+#endif
 /* for pending dnotify requests */
 struct dir_notify_req {
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 80c2e3add3a2..633c246b6775 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2878,7 +2878,8 @@ cleanup_volume_info_contents(struct smb_vol *volume_info)
        kfree(volume_info->username);
        kzfree(volume_info->password);
        kfree(volume_info->UNC);
-        kfree(volume_info->UNCip);
+        if (volume_info->UNCip != volume_info->UNC + 2)
+                kfree(volume_info->UNCip);
        kfree(volume_info->domainname);
        kfree(volume_info->iocharset);
        kfree(volume_info->prepath);
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index ae576fbb5142..72d448bf96ce 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -105,8 +105,8 @@ cifs_bp_rename_retry:
        }
        rcu_read_unlock();
        if (namelen != dfsplen || read_seqretry(&rename_lock, seq)) {
-                cERROR(1, "did not end path lookup where expected namelen is %d",
+                cFYI(1, "did not end path lookup where expected. namelen=%d "
-                        namelen);
+                        "dfsplen=%d", namelen, dfsplen);
                /* presumably this is only possible if racing with a rename
                of one of the parent directories  (we can not lock the dentries
                above us to prevent this, but retrying should be harmless) */
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index c1b9c4b10739..10ca6b2c26b7 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -266,15 +266,11 @@ static int wait_for_free_request(struct TCP_Server_Info *server,
        while (1) {
                if (atomic_read(&server->inFlight) >= cifs_max_pending) {
                        spin_unlock(&GlobalMid_Lock);
-#ifdef CONFIG_CIFS_STATS2
+                        cifs_num_waiters_inc(server);
-                        atomic_inc(&server->num_waiters);
-#endif
                        wait_event(server->request_q,
                                   atomic_read(&server->inFlight)
                                     < cifs_max_pending);
-#ifdef CONFIG_CIFS_STATS2
+                        cifs_num_waiters_dec(server);
-                        atomic_dec(&server->num_waiters);
-#endif
                        spin_lock(&GlobalMid_Lock);
                } else {
                        if (server->tcpStatus == CifsExiting) {
@@ -381,15 +377,13 @@ cifs_call_async(struct TCP_Server_Info *server, struct kvec *iov,
        mid->callback = callback;
        mid->callback_data = cbdata;
        mid->midState = MID_REQUEST_SUBMITTED;
-#ifdef CONFIG_CIFS_STATS2
-        atomic_inc(&server->inSend);
+        cifs_in_send_inc(server);
-#endif
        rc = smb_sendv(server, iov, nvec);
-#ifdef CONFIG_CIFS_STATS2
+        cifs_in_send_dec(server);
-        atomic_dec(&server->inSend);
+        cifs_save_when_sent(mid);
-        mid->when_sent = jiffies;
-#endif
        mutex_unlock(&server->srv_mutex);
        if (rc)
                goto out_err;
@@ -575,14 +569,10 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses,
        }
        midQ->midState = MID_REQUEST_SUBMITTED;
-#ifdef CONFIG_CIFS_STATS2
+        cifs_in_send_inc(ses->server);
-        atomic_inc(&ses->server->inSend);
-#endif
        rc = smb_sendv(ses->server, iov, n_vec);
-#ifdef CONFIG_CIFS_STATS2
+        cifs_in_send_dec(ses->server);
-        atomic_dec(&ses->server->inSend);
+        cifs_save_when_sent(midQ);
-        midQ->when_sent = jiffies;
-#endif
        mutex_unlock(&ses->server->srv_mutex);
@@ -703,14 +693,11 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
        }
        midQ->midState = MID_REQUEST_SUBMITTED;
-#ifdef CONFIG_CIFS_STATS2
-        atomic_inc(&ses->server->inSend);
+        cifs_in_send_inc(ses->server);
-#endif
        rc = smb_send(ses->server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
-#ifdef CONFIG_CIFS_STATS2
+        cifs_in_send_dec(ses->server);
-        atomic_dec(&ses->server->inSend);
+        cifs_save_when_sent(midQ);
-        midQ->when_sent = jiffies;
-#endif
        mutex_unlock(&ses->server->srv_mutex);
        if (rc < 0)
@@ -843,14 +830,10 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
        }
        midQ->midState = MID_REQUEST_SUBMITTED;
-#ifdef CONFIG_CIFS_STATS2
+        cifs_in_send_inc(ses->server);
-        atomic_inc(&ses->server->inSend);
-#endif
        rc = smb_send(ses->server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
-#ifdef CONFIG_CIFS_STATS2
+        cifs_in_send_dec(ses->server);
-        atomic_dec(&ses->server->inSend);
+        cifs_save_when_sent(midQ);
-        midQ->when_sent = jiffies;
-#endif
        mutex_unlock(&ses->server->srv_mutex);
        if (rc < 0) {
diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index bb85757689b6..5802fa1dab18 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -289,10 +289,10 @@ static inline int ext4_should_order_data(struct inode *inode)
 static inline int ext4_should_writeback_data(struct inode *inode)
 {
-        if (!S_ISREG(inode->i_mode))
-                return 0;
        if (EXT4_JOURNAL(inode) == NULL)
                return 1;
+        if (!S_ISREG(inode->i_mode))
+                return 0;
        if (ext4_test_inode_flag(inode, EXT4_INODE_JOURNAL_DATA))
                return 0;
        if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index b8602cde5b5a..0962642119c0 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -800,12 +800,17 @@ ssize_t ext4_ind_direct_IO(int rw, struct kiocb *iocb,
        }
 retry:
-        if (rw == READ && ext4_should_dioread_nolock(inode))
+        if (rw == READ && ext4_should_dioread_nolock(inode)) {
+                if (unlikely(!list_empty(&ei->i_completed_io_list))) {
+                        mutex_lock(&inode->i_mutex);
+                        ext4_flush_completed_IO(inode);
+                        mutex_unlock(&inode->i_mutex);
+                }
                ret = __blockdev_direct_IO(rw, iocb, inode,
                                 inode->i_sb->s_bdev, iov,
                                 offset, nr_segs,
                                 ext4_get_block, NULL, NULL, 0);
-        else {
+        } else {
                ret = blockdev_direct_IO(rw, iocb, inode, iov,
                                 offset, nr_segs, ext4_get_block);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index d47264cafee0..c4da98a959ae 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -120,6 +120,12 @@ void ext4_evict_inode(struct inode *inode)
        int err;
        trace_ext4_evict_inode(inode);
+        mutex_lock(&inode->i_mutex);
+        ext4_flush_completed_IO(inode);
+        mutex_unlock(&inode->i_mutex);
+        ext4_ioend_wait(inode);
        if (inode->i_nlink) {
                /*
                 * When journalling data dirty buffers are tracked only in the
@@ -983,6 +989,8 @@ static int ext4_journalled_write_end(struct file *file,
        from = pos & (PAGE_CACHE_SIZE - 1);
        to = from + len;
+        BUG_ON(!ext4_handle_valid(handle));
        if (copied < len) {
                if (!PageUptodate(page))
                        copied = 0;
@@ -1283,7 +1291,12 @@ static int mpage_da_submit_io(struct mpage_da_data *mpd,
                        else if (test_opt(inode->i_sb, MBLK_IO_SUBMIT))
                                err = ext4_bio_write_page(&io_submit, page,
                                                          len, mpd->wbc);
-                        else
+                        else if (buffer_uninit(page_bufs)) {
+                                ext4_set_bh_endio(page_bufs, inode);
+                                err = block_write_full_page_endio(page,
+                                        noalloc_get_block_write,
+                                        mpd->wbc, ext4_end_io_buffer_write);
+                        } else
                                err = block_write_full_page(page,
                                        noalloc_get_block_write, mpd->wbc);
@@ -1699,6 +1712,8 @@ static int __ext4_journalled_writepage(struct page *page,
                goto out;
        }
+        BUG_ON(!ext4_handle_valid(handle));
        ret = walk_page_buffers(handle, page_bufs, 0, len, NULL,
                                do_journal_get_write_access);
@@ -2668,8 +2683,15 @@ static void ext4_end_io_buffer_write(struct buffer_head *bh, int uptodate)
                goto out;
        }
-        io_end->flag = EXT4_IO_END_UNWRITTEN;
+        /*
+         * It may be over-defensive here to check EXT4_IO_END_UNWRITTEN now,
+         * but being more careful is always safe for the future change.
+         */
        inode = io_end->inode;
+        if (!(io_end->flag & EXT4_IO_END_UNWRITTEN)) {
+                io_end->flag |= EXT4_IO_END_UNWRITTEN;
+                atomic_inc(&EXT4_I(inode)->i_aiodio_unwritten);
+        }
        /* Add the io_end to per-inode completed io list*/
        spin_lock_irqsave(&EXT4_I(inode)->i_completed_io_lock, flags);
diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
index 430c401d0895..78839af7ce29 100644
--- a/fs/ext4/page-io.c
+++ b/fs/ext4/page-io.c
@@ -334,8 +334,10 @@ submit_and_retry:
        if ((io_end->num_io_pages >= MAX_IO_PAGES) &&
            (io_end->pages[io_end->num_io_pages-1] != io_page))
                goto submit_and_retry;
-        if (buffer_uninit(bh))
+        if (buffer_uninit(bh) && !(io_end->flag & EXT4_IO_END_UNWRITTEN)) {
-                io->io_end->flag |= EXT4_IO_END_UNWRITTEN;
+                io_end->flag |= EXT4_IO_END_UNWRITTEN;
+                atomic_inc(&EXT4_I(inode)->i_aiodio_unwritten);
+        }
        io->io_end->size += bh->b_size;
        io->io_next_block++;
        ret = bio_add_page(io->io_bio, bh->b_page, bh->b_size, bh_offset(bh));
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 4687fea0c00f..44d0c8db2239 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -919,7 +919,6 @@ static void ext4_i_callback(struct rcu_head *head)
 static void ext4_destroy_inode(struct inode *inode)
 {
-        ext4_ioend_wait(inode);
        if (!list_empty(&(EXT4_I(inode)->i_orphan))) {
                ext4_msg(inode->i_sb, KERN_ERR,
                         "Inode %lu (%p): orphan list check failed!",
diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 4ad64732cbce..5efbd5d7701a 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -1231,7 +1231,7 @@ int fat_add_entries(struct inode *dir, void *slots, int nr_slots,
        struct super_block *sb = dir->i_sb;
        struct msdos_sb_info *sbi = MSDOS_SB(sb);
        struct buffer_head *bh, *prev, *bhs[3]; /* 32*slots (672bytes) */
-        struct msdos_dir_entry *de;
+        struct msdos_dir_entry *uninitialized_var(de);
        int err, free_slots, i, nr_bhs;
        loff_t pos, i_pos;
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 5942fec22c65..1726d7303047 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -1188,9 +1188,9 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
 out:
        /* UTF-8 doesn't provide FAT semantics */
        if (!strcmp(opts->iocharset, "utf8")) {
-                fat_msg(sb, KERN_ERR, "utf8 is not a recommended IO charset"
+                fat_msg(sb, KERN_WARNING, "utf8 is not a recommended IO charset"
                       " for FAT filesystems, filesystem will be "
-                       "case sensitive!\n");
+                       "case sensitive!");
        }
        /* If user doesn't specify allow_utime, it's initialized from dmask. */
@@ -1367,6 +1367,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
        sbi->free_clusters = -1;        /* Don't know yet */
        sbi->free_clus_valid = 0;
        sbi->prev_free = FAT_START_ENT;
+        sb->s_maxbytes = 0xffffffff;
        if (!sbi->fat_length && b->fat32_length) {
                struct fat_boot_fsinfo *fsinfo;
@@ -1377,8 +1378,6 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
                sbi->fat_length = le32_to_cpu(b->fat32_length);
                sbi->root_cluster = le32_to_cpu(b->root_cluster);
-                sb->s_maxbytes = 0xffffffff;
                /* MC - if info_sector is 0, don't multiply by 0 */
                sbi->fsinfo_sector = le16_to_cpu(b->info_sector);
                if (sbi->fsinfo_sector == 0)
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 640fc229df10..168a80f7f12b 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1358,6 +1358,10 @@ static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
        if (outarg.namelen > FUSE_NAME_MAX)
                goto err;
+        err = -EINVAL;
+        if (size != sizeof(outarg) + outarg.namelen + 1)
+                goto err;
        name.name = buf;
        name.len = outarg.namelen;
        err = fuse_copy_one(cs, buf, outarg.namelen + 1);
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index d480d9af46c9..594f07a81c28 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -14,6 +14,7 @@
 #include <linux/sched.h>
 #include <linux/module.h>
 #include <linux/compat.h>
+#include <linux/swap.h>
 static const struct file_operations fuse_direct_io_file_operations;
@@ -245,6 +246,12 @@ void fuse_release_common(struct file *file, int opcode)
        req = ff->reserved_req;
        fuse_prepare_release(ff, file->f_flags, opcode);
+        if (ff->flock) {
+                struct fuse_release_in *inarg = &req->misc.release.in;
+                inarg->release_flags |= FUSE_RELEASE_FLOCK_UNLOCK;
+                inarg->lock_owner = fuse_lock_owner_id(ff->fc,
+                                                       (fl_owner_t) file);
+        }
        /* Hold vfsmount and dentry until release is finished */
        path_get(&file->f_path);
        req->misc.release.path = file->f_path;
@@ -755,18 +762,6 @@ static size_t fuse_send_write(struct fuse_req *req, struct file *file,
        return req->misc.write.out.size;
 }
-static int fuse_write_begin(struct file *file, struct address_space *mapping,
-                        loff_t pos, unsigned len, unsigned flags,
-                        struct page **pagep, void **fsdata)
-{
-        pgoff_t index = pos >> PAGE_CACHE_SHIFT;
-        *pagep = grab_cache_page_write_begin(mapping, index, flags);
-        if (!*pagep)
-                return -ENOMEM;
-        return 0;
-}
 void fuse_write_update_size(struct inode *inode, loff_t pos)
 {
        struct fuse_conn *fc = get_fuse_conn(inode);
@@ -779,62 +774,6 @@ void fuse_write_update_size(struct inode *inode, loff_t pos)
        spin_unlock(&fc->lock);
 }
-static int fuse_buffered_write(struct file *file, struct inode *inode,
-                               loff_t pos, unsigned count, struct page *page)
-{
-        int err;
-        size_t nres;
-        struct fuse_conn *fc = get_fuse_conn(inode);
-        unsigned offset = pos & (PAGE_CACHE_SIZE - 1);
-        struct fuse_req *req;
-        if (is_bad_inode(inode))
-                return -EIO;
-        /*
-         * Make sure writepages on the same page are not mixed up with
-         * plain writes.
-         */
-        fuse_wait_on_page_writeback(inode, page->index);
-        req = fuse_get_req(fc);
-        if (IS_ERR(req))
-                return PTR_ERR(req);
-        req->in.argpages = 1;
-        req->num_pages = 1;
-        req->pages[0] = page;
-        req->page_offset = offset;
-        nres = fuse_send_write(req, file, pos, count, NULL);
-        err = req->out.h.error;
-        fuse_put_request(fc, req);
-        if (!err && !nres)
-                err = -EIO;
-        if (!err) {
-                pos += nres;
-                fuse_write_update_size(inode, pos);
-                if (count == PAGE_CACHE_SIZE)
-                        SetPageUptodate(page);
-        }
-        fuse_invalidate_attr(inode);
-        return err ? err : nres;
-}
-static int fuse_write_end(struct file *file, struct address_space *mapping,
-                        loff_t pos, unsigned len, unsigned copied,
-                        struct page *page, void *fsdata)
-{
-        struct inode *inode = mapping->host;
-        int res = 0;
-        if (copied)
-                res = fuse_buffered_write(file, inode, pos, copied, page);
-        unlock_page(page);
-        page_cache_release(page);
-        return res;
-}
 static size_t fuse_send_write_pages(struct fuse_req *req, struct file *file,
                                    struct inode *inode, loff_t pos,
                                    size_t count)
@@ -908,6 +847,8 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
                pagefault_enable();
                flush_dcache_page(page);
+                mark_page_accessed(page);
                if (!tmp) {
                        unlock_page(page);
                        page_cache_release(page);
@@ -1559,11 +1500,14 @@ static int fuse_file_flock(struct file *file, int cmd, struct file_lock *fl)
        struct fuse_conn *fc = get_fuse_conn(inode);
        int err;
-        if (fc->no_lock) {
+        if (fc->no_flock) {
                err = flock_lock_file_wait(file, fl);
        } else {
+                struct fuse_file *ff = file->private_data;
                /* emulate flock with POSIX locks */
                fl->fl_owner = (fl_owner_t) file;
+                ff->flock = true;
                err = fuse_setlk(file, fl, 1);
        }
@@ -2201,8 +2145,6 @@ static const struct address_space_operations fuse_file_aops  = {
        .readpage       = fuse_readpage,
        .writepage      = fuse_writepage,
        .launder_page   = fuse_launder_page,
-        .write_begin    = fuse_write_begin,
-        .write_end      = fuse_write_end,
        .readpages      = fuse_readpages,
        .set_page_dirty = __set_page_dirty_nobuffers,
        .bmap           = fuse_bmap,
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index c6aa2d4b8517..cf6db0a93219 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -135,6 +135,9 @@ struct fuse_file {
        /** Wait queue head for poll */
        wait_queue_head_t poll_wait;
+        /** Has flock been performed on this file? */
+        bool flock:1;
 };
 /** One input argument of a request */
@@ -448,7 +451,7 @@ struct fuse_conn {
        /** Is removexattr not implemented by fs? */
        unsigned no_removexattr:1;
-        /** Are file locking primitives not implemented by fs? */
+        /** Are posix file locking primitives not implemented by fs? */
        unsigned no_lock:1;
        /** Is access not implemented by fs? */
@@ -472,6 +475,9 @@ struct fuse_conn {
        /** Don't apply umask to creation modes */
        unsigned dont_mask:1;
+        /** Are BSD file locking primitives not implemented by fs? */
+        unsigned no_flock:1;
        /** The number of requests waiting for completion */
        atomic_t num_waiting;
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 38f84cd48b67..12b502929da9 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -71,7 +71,7 @@ struct fuse_mount_data {
        unsigned blksize;
 };
-struct fuse_forget_link *fuse_alloc_forget()
+struct fuse_forget_link *fuse_alloc_forget(void)
 {
        return kzalloc(sizeof(struct fuse_forget_link), GFP_KERNEL);
 }
@@ -809,6 +809,10 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                                fc->async_read = 1;
                        if (!(arg->flags & FUSE_POSIX_LOCKS))
                                fc->no_lock = 1;
+                        if (arg->minor >= 17) {
+                                if (!(arg->flags & FUSE_FLOCK_LOCKS))
+                                        fc->no_flock = 1;
+                        }
                        if (arg->flags & FUSE_ATOMIC_O_TRUNC)
                                fc->atomic_o_trunc = 1;
                        if (arg->minor >= 9) {
@@ -823,6 +827,7 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                } else {
                        ra_pages = fc->max_read / PAGE_CACHE_SIZE;
                        fc->no_lock = 1;
+                        fc->no_flock = 1;
                }
                fc->bdi.ra_pages = min(fc->bdi.ra_pages, ra_pages);
@@ -843,7 +848,8 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req)
        arg->minor = FUSE_KERNEL_MINOR_VERSION;
        arg->max_readahead = fc->bdi.ra_pages * PAGE_CACHE_SIZE;
        arg->flags |= FUSE_ASYNC_READ | FUSE_POSIX_LOCKS | FUSE_ATOMIC_O_TRUNC |
-                FUSE_EXPORT_SUPPORT | FUSE_BIG_WRITES | FUSE_DONT_MASK;
+                FUSE_EXPORT_SUPPORT | FUSE_BIG_WRITES | FUSE_DONT_MASK |
+                FUSE_FLOCK_LOCKS;
        req->in.h.opcode = FUSE_INIT;
        req->in.numargs = 1;
        req->in.args[0].size = sizeof(*arg);
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 87b6e0421c12..ec889538e5a6 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -491,6 +491,7 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb, uid_t uid,
                        inode->i_op = &page_symlink_inode_operations;
                        break;
                }
+                lockdep_annotate_inode_mutex_key(inode);
        }
        return inode;
 }
diff --git a/fs/inode.c b/fs/inode.c
index 73920d555c88..ec7924696a13 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -848,16 +848,9 @@ struct inode *new_inode(struct super_block *sb)
 }
 EXPORT_SYMBOL(new_inode);
-/**
- * unlock_new_inode - clear the I_NEW state and wake up any waiters
- * @inode:      new inode to unlock
- *
- * Called when the inode is fully initialised to clear the new state of the
- * inode and wake up anyone waiting for the inode to finish initialisation.
- */
-void unlock_new_inode(struct inode *inode)
-{
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
+void lockdep_annotate_inode_mutex_key(struct inode *inode)
+{
        if (S_ISDIR(inode->i_mode)) {
                struct file_system_type *type = inode->i_sb->s_type;
@@ -873,7 +866,20 @@ void unlock_new_inode(struct inode *inode)
                                          &type->i_mutex_dir_key);
                }
        }
+}
+EXPORT_SYMBOL(lockdep_annotate_inode_mutex_key);
 #endif
+/**
+ * unlock_new_inode - clear the I_NEW state and wake up any waiters
+ * @inode:      new inode to unlock
+ *
+ * Called when the inode is fully initialised to clear the new state of the
+ * inode and wake up anyone waiting for the inode to finish initialisation.
+ */
+void unlock_new_inode(struct inode *inode)
+{
+        lockdep_annotate_inode_mutex_key(inode);
        spin_lock(&inode->i_lock);
        WARN_ON(!(inode->i_state & I_NEW));
        inode->i_state &= ~I_NEW;
diff --git a/fs/jfs/jfs_umount.c b/fs/jfs/jfs_umount.c
index adcf92d3b603..7971f37534a3 100644
--- a/fs/jfs/jfs_umount.c
+++ b/fs/jfs/jfs_umount.c
@@ -68,7 +68,7 @@ int jfs_umount(struct super_block *sb)
                /*
                 * Wait for outstanding transactions to be written to log:
                 */
-                jfs_flush_journal(log, 1);
+                jfs_flush_journal(log, 2);
        /*
         * close fileset inode allocation map (aka fileset inode)
@@ -146,7 +146,7 @@ int jfs_umount_rw(struct super_block *sb)
         *
         * remove file system from log active file system list.
         */
-        jfs_flush_journal(log, 1);
+        jfs_flush_journal(log, 2);
        /*
         * Make sure all metadata makes it to disk
diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
index e56564d2ef95..9561c8fc8bdb 100644
--- a/fs/nfs/blocklayout/blocklayout.c
+++ b/fs/nfs/blocklayout/blocklayout.c
@@ -36,6 +36,7 @@
 #include <linux/namei.h>
 #include <linux/bio.h>          /* struct bio */
 #include <linux/buffer_head.h>  /* various write calls */
+#include <linux/prefetch.h>
 #include "blocklayout.h"
diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h
index b257383bb565..07df5f1d85e5 100644
--- a/fs/nfs/callback.h
+++ b/fs/nfs/callback.h
@@ -38,6 +38,7 @@ enum nfs4_callback_opnum {
 struct cb_process_state {
        __be32                  drc_status;
        struct nfs_client       *clp;
+        int                     slotid;
 };
 struct cb_compound_hdr_arg {
@@ -166,7 +167,6 @@ extern unsigned nfs4_callback_layoutrecall(
        void *dummy, struct cb_process_state *cps);
 extern void nfs4_check_drain_bc_complete(struct nfs4_session *ses);
-extern void nfs4_cb_take_slot(struct nfs_client *clp);
 struct cb_devicenotifyitem {
        uint32_t                cbd_notify_type;
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index 74780f9f852c..43926add945b 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -348,7 +348,7 @@ validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
        /* Normal */
        if (likely(args->csa_sequenceid == slot->seq_nr + 1)) {
                slot->seq_nr++;
-                return htonl(NFS4_OK);
+                goto out_ok;
        }
        /* Replay */
@@ -367,11 +367,14 @@ validate_seqid(struct nfs4_slot_table *tbl, struct cb_sequenceargs * args)
        /* Wraparound */
        if (args->csa_sequenceid == 1 && (slot->seq_nr + 1) == 0) {
                slot->seq_nr = 1;
-                return htonl(NFS4_OK);
+                goto out_ok;
        }
        /* Misordered request */
        return htonl(NFS4ERR_SEQ_MISORDERED);
+out_ok:
+        tbl->highest_used_slotid = args->csa_slotid;
+        return htonl(NFS4_OK);
 }
 /*
@@ -433,26 +436,37 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
                              struct cb_sequenceres *res,
                              struct cb_process_state *cps)
 {
+        struct nfs4_slot_table *tbl;
        struct nfs_client *clp;
        int i;
        __be32 status = htonl(NFS4ERR_BADSESSION);
-        cps->clp = NULL;
        clp = nfs4_find_client_sessionid(args->csa_addr, &args->csa_sessionid);
        if (clp == NULL)
                goto out;
+        tbl = &clp->cl_session->bc_slot_table;
+        spin_lock(&tbl->slot_tbl_lock);
        /* state manager is resetting the session */
        if (test_bit(NFS4_SESSION_DRAINING, &clp->cl_session->session_state)) {
-                status = NFS4ERR_DELAY;
+                spin_unlock(&tbl->slot_tbl_lock);
+                status = htonl(NFS4ERR_DELAY);
+                /* Return NFS4ERR_BADSESSION if we're draining the session
+                 * in order to reset it.
+                 */
+                if (test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state))
+                        status = htonl(NFS4ERR_BADSESSION);
                goto out;
        }
        status = validate_seqid(&clp->cl_session->bc_slot_table, args);
+        spin_unlock(&tbl->slot_tbl_lock);
        if (status)
                goto out;
+        cps->slotid = args->csa_slotid;
        /*
         * Check for pending referring calls.  If a match is found, a
         * related callback was received before the response to the original
@@ -469,7 +483,6 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
        res->csr_slotid = args->csa_slotid;
        res->csr_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;
        res->csr_target_highestslotid = NFS41_BC_MAX_CALLBACKS - 1;
-        nfs4_cb_take_slot(clp);
 out:
        cps->clp = clp; /* put in nfs4_callback_compound */
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index c6c86a77e043..918ad647afea 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -754,26 +754,15 @@ static void nfs4_callback_free_slot(struct nfs4_session *session)
         * Let the state manager know callback processing done.
         * A single slot, so highest used slotid is either 0 or -1
         */
-        tbl->highest_used_slotid--;
+        tbl->highest_used_slotid = -1;
        nfs4_check_drain_bc_complete(session);
        spin_unlock(&tbl->slot_tbl_lock);
 }
-static void nfs4_cb_free_slot(struct nfs_client *clp)
+static void nfs4_cb_free_slot(struct cb_process_state *cps)
 {
-        if (clp && clp->cl_session)
+        if (cps->slotid != -1)
-                nfs4_callback_free_slot(clp->cl_session);
+                nfs4_callback_free_slot(cps->clp->cl_session);
-}
-/* A single slot, so highest used slotid is either 0 or -1 */
-void nfs4_cb_take_slot(struct nfs_client *clp)
-{
-        struct nfs4_slot_table *tbl = &clp->cl_session->bc_slot_table;
-        spin_lock(&tbl->slot_tbl_lock);
-        tbl->highest_used_slotid++;
-        BUG_ON(tbl->highest_used_slotid != 0);
-        spin_unlock(&tbl->slot_tbl_lock);
 }
 #else /* CONFIG_NFS_V4_1 */
@@ -784,7 +773,7 @@ preprocess_nfs41_op(int nop, unsigned int op_nr, struct callback_op **op)
        return htonl(NFS4ERR_MINOR_VERS_MISMATCH);
 }
-static void nfs4_cb_free_slot(struct nfs_client *clp)
+static void nfs4_cb_free_slot(struct cb_process_state *cps)
 {
 }
 #endif /* CONFIG_NFS_V4_1 */
@@ -866,6 +855,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
        struct cb_process_state cps = {
                .drc_status = 0,
                .clp = NULL,
+                .slotid = -1,
        };
        unsigned int nops = 0;
@@ -906,7 +896,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
        *hdr_res.status = status;
        *hdr_res.nops = htonl(nops);
-        nfs4_cb_free_slot(cps.clp);
+        nfs4_cb_free_slot(&cps);
        nfs_put_client(cps.clp);
        dprintk("%s: done, status = %u\n", __func__, ntohl(status));
        return rpc_success;
diff --git a/fs/nfs/objlayout/objio_osd.c b/fs/nfs/objlayout/objio_osd.c
index 9383ca7245bc..d0cda12fddc3 100644
--- a/fs/nfs/objlayout/objio_osd.c
+++ b/fs/nfs/objlayout/objio_osd.c
@@ -479,7 +479,6 @@ static int _io_check(struct objio_state *ios, bool is_write)
        for (i = 0; i <  ios->numdevs; i++) {
                struct osd_sense_info osi;
                struct osd_request *or = ios->per_dev[i].or;
-                unsigned dev;
                int ret;
                if (!or)
@@ -500,9 +499,8 @@ static int _io_check(struct objio_state *ios, bool is_write)
                        continue; /* we recovered */
                }
-                dev = ios->per_dev[i].dev;
+                objlayout_io_set_result(&ios->ol_state, i,
-                objlayout_io_set_result(&ios->ol_state, dev,
+                                        &ios->layout->comps[i].oc_object_id,
-                                        &ios->layout->comps[dev].oc_object_id,
                                        osd_pri_2_pnfs_err(osi.osd_err_pri),
                                        ios->per_dev[i].offset,
                                        ios->per_dev[i].length,
@@ -589,22 +587,19 @@ static void _calc_stripe_info(struct objio_state *ios, u64 file_offset,
 }
 static int _add_stripe_unit(struct objio_state *ios,  unsigned *cur_pg,
-                unsigned pgbase, struct _objio_per_comp *per_dev, int cur_len,
+                unsigned pgbase, struct _objio_per_comp *per_dev, int len,
                gfp_t gfp_flags)
 {
        unsigned pg = *cur_pg;
+        int cur_len = len;
        struct request_queue *q =
                        osd_request_queue(_io_od(ios, per_dev->dev));
-        per_dev->length += cur_len;
        if (per_dev->bio == NULL) {
-                unsigned stripes = ios->layout->num_comps /
+                unsigned pages_in_stripe = ios->layout->group_width *
-                                                     ios->layout->mirrors_p1;
-                unsigned pages_in_stripe = stripes *
                                      (ios->layout->stripe_unit / PAGE_SIZE);
                unsigned bio_size = (ios->ol_state.nr_pages + pages_in_stripe) /
-                                    stripes;
+                                    ios->layout->group_width;
                if (BIO_MAX_PAGES_KMALLOC < bio_size)
                        bio_size = BIO_MAX_PAGES_KMALLOC;
@@ -632,6 +627,7 @@ static int _add_stripe_unit(struct objio_state *ios,  unsigned *cur_pg,
        }
        BUG_ON(cur_len);
+        per_dev->length += len;
        *cur_pg = pg;
        return 0;
 }
@@ -650,7 +646,7 @@ static int _prepare_one_group(struct objio_state *ios, u64 length,
        int ret = 0;
        while (length) {
-                struct _objio_per_comp *per_dev = &ios->per_dev[dev];
+                struct _objio_per_comp *per_dev = &ios->per_dev[dev - first_dev];
                unsigned cur_len, page_off = 0;
                if (!per_dev->length) {
@@ -670,8 +666,8 @@ static int _prepare_one_group(struct objio_state *ios, u64 length,
                                cur_len = stripe_unit;
                        }
-                        if (max_comp < dev)
+                        if (max_comp < dev - first_dev)
-                                max_comp = dev;
+                                max_comp = dev - first_dev;
                } else {
                        cur_len = stripe_unit;
                }
@@ -806,7 +802,7 @@ static int _read_mirrors(struct objio_state *ios, unsigned cur_comp)
        struct _objio_per_comp *per_dev = &ios->per_dev[cur_comp];
        unsigned dev = per_dev->dev;
        struct pnfs_osd_object_cred *cred =
-                        &ios->layout->comps[dev];
+                        &ios->layout->comps[cur_comp];
        struct osd_obj_id obj = {
                .partition = cred->oc_object_id.oid_partition_id,
                .id = cred->oc_object_id.oid_object_id,
@@ -904,7 +900,7 @@ static int _write_mirrors(struct objio_state *ios, unsigned cur_comp)
        for (; cur_comp < last_comp; ++cur_comp, ++dev) {
                struct osd_request *or = NULL;
                struct pnfs_osd_object_cred *cred =
-                                        &ios->layout->comps[dev];
+                                        &ios->layout->comps[cur_comp];
                struct osd_obj_id obj = {
                        .partition = cred->oc_object_id.oid_partition_id,
                        .id = cred->oc_object_id.oid_object_id,
diff --git a/fs/nfs/objlayout/pnfs_osd_xdr_cli.c b/fs/nfs/objlayout/pnfs_osd_xdr_cli.c
index 16fc758e9123..b3918f7ac34d 100644
--- a/fs/nfs/objlayout/pnfs_osd_xdr_cli.c
+++ b/fs/nfs/objlayout/pnfs_osd_xdr_cli.c
@@ -170,6 +170,9 @@ int pnfs_osd_xdr_decode_layout_map(struct pnfs_osd_layout *layout,
        p = _osd_xdr_decode_data_map(p, &layout->olo_map);
        layout->olo_comps_index = be32_to_cpup(p++);
        layout->olo_num_comps = be32_to_cpup(p++);
+        dprintk("%s: olo_comps_index=%d olo_num_comps=%d\n", __func__,
+                layout->olo_comps_index, layout->olo_num_comps);
        iter->total_comps = layout->olo_num_comps;
        return 0;
 }
diff --git a/fs/xfs/Makefile b/fs/xfs/Makefile
index 75bb316529dd..427a4e82a588 100644
--- a/fs/xfs/Makefile
+++ b/fs/xfs/Makefile
@@ -16,44 +16,53 @@
 # Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 #
-ccflags-y := -I$(src) -I$(src)/linux-2.6
+ccflags-y += -I$(src)                   # needed for trace events
-ccflags-$(CONFIG_XFS_DEBUG) += -g
-XFS_LINUX := linux-2.6
+ccflags-$(CONFIG_XFS_DEBUG) += -g
 obj-$(CONFIG_XFS_FS)            += xfs.o
-xfs-y                           += linux-2.6/xfs_trace.o
+# this one should be compiled first, as the tracing macros can easily blow up
+xfs-y                           += xfs_trace.o
-xfs-$(CONFIG_XFS_QUOTA)         += $(addprefix quota/, \
-                                   xfs_dquot.o \
-                                   xfs_dquot_item.o \
-                                   xfs_trans_dquot.o \
-                                   xfs_qm_syscalls.o \
-                                   xfs_qm_bhv.o \
-                                   xfs_qm.o)
-xfs-$(CONFIG_XFS_QUOTA)         += linux-2.6/xfs_quotaops.o
-ifeq ($(CONFIG_XFS_QUOTA),y)
-xfs-$(CONFIG_PROC_FS)           += quota/xfs_qm_stats.o
-endif
-xfs-$(CONFIG_XFS_RT)            += xfs_rtalloc.o
-xfs-$(CONFIG_XFS_POSIX_ACL)     += $(XFS_LINUX)/xfs_acl.o
-xfs-$(CONFIG_PROC_FS)           += $(XFS_LINUX)/xfs_stats.o
-xfs-$(CONFIG_SYSCTL)            += $(XFS_LINUX)/xfs_sysctl.o
-xfs-$(CONFIG_COMPAT)            += $(XFS_LINUX)/xfs_ioctl32.o
+# highlevel code
+xfs-y                           += xfs_aops.o \
+                                   xfs_bit.o \
+                                   xfs_buf.o \
+                                   xfs_dfrag.o \
+                                   xfs_discard.o \
+                                   xfs_error.o \
+                                   xfs_export.o \
+                                   xfs_file.o \
+                                   xfs_filestream.o \
+                                   xfs_fsops.o \
+                                   xfs_fs_subr.o \
+                                   xfs_globals.o \
+                                   xfs_iget.o \
+                                   xfs_ioctl.o \
+                                   xfs_iomap.o \
+                                   xfs_iops.o \
+                                   xfs_itable.o \
+                                   xfs_message.o \
+                                   xfs_mru_cache.o \
+                                   xfs_super.o \
+                                   xfs_sync.o \
+                                   xfs_xattr.o \
+                                   xfs_rename.o \
+                                   xfs_rw.o \
+                                   xfs_utils.o \
+                                   xfs_vnodeops.o \
+                                   kmem.o \
+                                   uuid.o
+# code shared with libxfs
 xfs-y                           += xfs_alloc.o \
                                   xfs_alloc_btree.o \
                                   xfs_attr.o \
                                   xfs_attr_leaf.o \
-                                   xfs_bit.o \
                                   xfs_bmap.o \
                                   xfs_bmap_btree.o \
                                   xfs_btree.o \
-                                   xfs_buf_item.o \
                                   xfs_da_btree.o \
                                   xfs_dir2.o \
                                   xfs_dir2_block.o \
@@ -61,49 +70,37 @@ xfs-y				+= xfs_alloc.o \
                                   xfs_dir2_leaf.o \
                                   xfs_dir2_node.o \
                                   xfs_dir2_sf.o \
-                                   xfs_error.o \
-                                   xfs_extfree_item.o \
-                                   xfs_filestream.o \
-                                   xfs_fsops.o \
                                   xfs_ialloc.o \
                                   xfs_ialloc_btree.o \
-                                   xfs_iget.o \
                                   xfs_inode.o \
-                                   xfs_inode_item.o \
-                                   xfs_iomap.o \
-                                   xfs_itable.o \
-                                   xfs_dfrag.o \
-                                   xfs_log.o \
-                                   xfs_log_cil.o \
                                   xfs_log_recover.o \
                                   xfs_mount.o \
-                                   xfs_mru_cache.o \
+                                   xfs_trans.o
-                                   xfs_rename.o \
-                                   xfs_trans.o \
+# low-level transaction/log code
+xfs-y                           += xfs_log.o \
+                                   xfs_log_cil.o \
+                                   xfs_buf_item.o \
+                                   xfs_extfree_item.o \
+                                   xfs_inode_item.o \
                                   xfs_trans_ail.o \
                                   xfs_trans_buf.o \
                                   xfs_trans_extfree.o \
                                   xfs_trans_inode.o \
-                                   xfs_utils.o \
-                                   xfs_vnodeops.o \
-                                   xfs_rw.o
-# Objects in linux/
-xfs-y                           += $(addprefix $(XFS_LINUX)/, \
-                                   kmem.o \
-                                   xfs_aops.o \
-                                   xfs_buf.o \
-                                   xfs_discard.o \
-                                   xfs_export.o \
-                                   xfs_file.o \
-                                   xfs_fs_subr.o \
-                                   xfs_globals.o \
-                                   xfs_ioctl.o \
-                                   xfs_iops.o \
-                                   xfs_message.o \
-                                   xfs_super.o \
-                                   xfs_sync.o \
-                                   xfs_xattr.o)
-# Objects in support/
+# optional features
-xfs-y                           += support/uuid.o
+xfs-$(CONFIG_XFS_QUOTA)         += xfs_dquot.o \
+                                   xfs_dquot_item.o \
+                                   xfs_trans_dquot.o \
+                                   xfs_qm_syscalls.o \
+                                   xfs_qm_bhv.o \
+                                   xfs_qm.o \
+                                   xfs_quotaops.o
+ifeq ($(CONFIG_XFS_QUOTA),y)
+xfs-$(CONFIG_PROC_FS)           += xfs_qm_stats.o
+endif
+xfs-$(CONFIG_XFS_RT)            += xfs_rtalloc.o
+xfs-$(CONFIG_XFS_POSIX_ACL)     += xfs_acl.o
+xfs-$(CONFIG_PROC_FS)           += xfs_stats.o
+xfs-$(CONFIG_SYSCTL)            += xfs_sysctl.o
+xfs-$(CONFIG_COMPAT)            += xfs_ioctl32.o
diff --git a/fs/xfs/linux-2.6/kmem.c b/fs/xfs/kmem.c
index a907de565db3..a907de565db3 100644
--- a/fs/xfs/linux-2.6/kmem.c
+++ b/fs/xfs/kmem.c
diff --git a/fs/xfs/linux-2.6/kmem.h b/fs/xfs/kmem.h
index f7c8f7a9ea6d..f7c8f7a9ea6d 100644
--- a/fs/xfs/linux-2.6/kmem.h
+++ b/fs/xfs/kmem.h
diff --git a/fs/xfs/linux-2.6/mrlock.h b/fs/xfs/mrlock.h
index ff6a19873e5c..ff6a19873e5c 100644
--- a/fs/xfs/linux-2.6/mrlock.h
+++ b/fs/xfs/mrlock.h
diff --git a/fs/xfs/linux-2.6/time.h b/fs/xfs/time.h
index 387e695a184c..387e695a184c 100644
--- a/fs/xfs/linux-2.6/time.h
+++ b/fs/xfs/time.h
diff --git a/fs/xfs/support/uuid.c b/fs/xfs/uuid.c
index b83f76b6d410..b83f76b6d410 100644
--- a/fs/xfs/support/uuid.c
+++ b/fs/xfs/uuid.c
diff --git a/fs/xfs/support/uuid.h b/fs/xfs/uuid.h
index 4732d71262cc..4732d71262cc 100644
--- a/fs/xfs/support/uuid.h
+++ b/fs/xfs/uuid.h
diff --git a/fs/xfs/xfs.h b/fs/xfs/xfs.h
index 53ec3ea9a625..d8b11b7f94aa 100644
--- a/fs/xfs/xfs.h
+++ b/fs/xfs/xfs.h
@@ -24,5 +24,6 @@
 #define XFS_BUF_LOCK_TRACKING 1
 #endif
-#include <linux-2.6/xfs_linux.h>
+#include "xfs_linux.h"
 #endif  /* __XFS_H__ */
diff --git a/fs/xfs/linux-2.6/xfs_acl.c b/fs/xfs/xfs_acl.c
index b6c4b3795c4a..b6c4b3795c4a 100644
--- a/fs/xfs/linux-2.6/xfs_acl.c
+++ b/fs/xfs/xfs_acl.c
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/xfs_aops.c
index 63e971e2b837..63e971e2b837 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
diff --git a/fs/xfs/linux-2.6/xfs_aops.h b/fs/xfs/xfs_aops.h
index 71f721e1a71f..71f721e1a71f 100644
--- a/fs/xfs/linux-2.6/xfs_aops.h
+++ b/fs/xfs/xfs_aops.h
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/xfs_buf.c
index c57836dc778f..c57836dc778f 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/xfs_buf.h
index 620972b8094d..620972b8094d 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
diff --git a/fs/xfs/linux-2.6/xfs_discard.c b/fs/xfs/xfs_discard.c
index 244e797dae32..244e797dae32 100644
--- a/fs/xfs/linux-2.6/xfs_discard.c
+++ b/fs/xfs/xfs_discard.c
diff --git a/fs/xfs/linux-2.6/xfs_discard.h b/fs/xfs/xfs_discard.h
index 344879aea646..344879aea646 100644
--- a/fs/xfs/linux-2.6/xfs_discard.h
+++ b/fs/xfs/xfs_discard.h
diff --git a/fs/xfs/quota/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index db62959bed13..db62959bed13 100644
--- a/fs/xfs/quota/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
diff --git a/fs/xfs/quota/xfs_dquot.h b/fs/xfs/xfs_dquot.h
index 34b7e945dbfa..34b7e945dbfa 100644
--- a/fs/xfs/quota/xfs_dquot.h
+++ b/fs/xfs/xfs_dquot.h
diff --git a/fs/xfs/quota/xfs_dquot_item.c b/fs/xfs/xfs_dquot_item.c
index 9e0e2fa3f2c8..9e0e2fa3f2c8 100644
--- a/fs/xfs/quota/xfs_dquot_item.c
+++ b/fs/xfs/xfs_dquot_item.c
diff --git a/fs/xfs/quota/xfs_dquot_item.h b/fs/xfs/xfs_dquot_item.h
index 5acae2ada70b..5acae2ada70b 100644
--- a/fs/xfs/quota/xfs_dquot_item.h
+++ b/fs/xfs/xfs_dquot_item.h
diff --git a/fs/xfs/linux-2.6/xfs_export.c b/fs/xfs/xfs_export.c
index 75e5d322e48f..75e5d322e48f 100644
--- a/fs/xfs/linux-2.6/xfs_export.c
+++ b/fs/xfs/xfs_export.c
diff --git a/fs/xfs/linux-2.6/xfs_export.h b/fs/xfs/xfs_export.h
index 3272b6ae7a35..3272b6ae7a35 100644
--- a/fs/xfs/linux-2.6/xfs_export.h
+++ b/fs/xfs/xfs_export.h
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/xfs_file.c
index 7f7b42469ea7..7f7b42469ea7 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/xfs_file.c
diff --git a/fs/xfs/linux-2.6/xfs_fs_subr.c b/fs/xfs/xfs_fs_subr.c
index ed88ed16811c..ed88ed16811c 100644
--- a/fs/xfs/linux-2.6/xfs_fs_subr.c
+++ b/fs/xfs/xfs_fs_subr.c
diff --git a/fs/xfs/linux-2.6/xfs_globals.c b/fs/xfs/xfs_globals.c
index 76e81cff70b9..76e81cff70b9 100644
--- a/fs/xfs/linux-2.6/xfs_globals.c
+++ b/fs/xfs/xfs_globals.c
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index f7ce7debe14c..f7ce7debe14c 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.h b/fs/xfs/xfs_ioctl.h
index d56173b34a2a..d56173b34a2a 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.h
+++ b/fs/xfs/xfs_ioctl.h
diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
index 54e623bfbb85..54e623bfbb85 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl32.c
+++ b/fs/xfs/xfs_ioctl32.c
diff --git a/fs/xfs/linux-2.6/xfs_ioctl32.h b/fs/xfs/xfs_ioctl32.h
index 80f4060e8970..80f4060e8970 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl32.h
+++ b/fs/xfs/xfs_ioctl32.h
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/xfs_iops.c
index b9c172b3fbbe..b9c172b3fbbe 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
diff --git a/fs/xfs/linux-2.6/xfs_iops.h b/fs/xfs/xfs_iops.h
index ef41c92ce66e..ef41c92ce66e 100644
--- a/fs/xfs/linux-2.6/xfs_iops.h
+++ b/fs/xfs/xfs_iops.h
diff --git a/fs/xfs/linux-2.6/xfs_linux.h b/fs/xfs/xfs_linux.h
index d42f814e4d35..1e8a45e74c3e 100644
--- a/fs/xfs/linux-2.6/xfs_linux.h
+++ b/fs/xfs/xfs_linux.h
@@ -32,13 +32,12 @@
 # define XFS_BIG_INUMS  0
 #endif
-#include <xfs_types.h>
+#include "xfs_types.h"
-#include <kmem.h>
+#include "kmem.h"
-#include <mrlock.h>
+#include "mrlock.h"
-#include <time.h>
+#include "time.h"
+#include "uuid.h"
-#include <support/uuid.h>
 #include <linux/semaphore.h>
 #include <linux/mm.h>
@@ -78,14 +77,14 @@
 #include <asm/byteorder.h>
 #include <asm/unaligned.h>
-#include <xfs_vnode.h>
+#include "xfs_vnode.h"
-#include <xfs_stats.h>
+#include "xfs_stats.h"
-#include <xfs_sysctl.h>
+#include "xfs_sysctl.h"
-#include <xfs_iops.h>
+#include "xfs_iops.h"
-#include <xfs_aops.h>
+#include "xfs_aops.h"
-#include <xfs_super.h>
+#include "xfs_super.h"
-#include <xfs_buf.h>
+#include "xfs_buf.h"
-#include <xfs_message.h>
+#include "xfs_message.h"
 #ifdef __BIG_ENDIAN
 #define XFS_NATIVE_HOST 1
diff --git a/fs/xfs/linux-2.6/xfs_message.c b/fs/xfs/xfs_message.c
index bd672def95ac..bd672def95ac 100644
--- a/fs/xfs/linux-2.6/xfs_message.c
+++ b/fs/xfs/xfs_message.c
diff --git a/fs/xfs/linux-2.6/xfs_message.h b/fs/xfs/xfs_message.h
index 7fb7ea007672..7fb7ea007672 100644
--- a/fs/xfs/linux-2.6/xfs_message.h
+++ b/fs/xfs/xfs_message.h
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/xfs_qm.c
index 9a0aa76facdf..9a0aa76facdf 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/xfs_qm.c
diff --git a/fs/xfs/quota/xfs_qm.h b/fs/xfs/xfs_qm.h
index 43b9abe1052c..43b9abe1052c 100644
--- a/fs/xfs/quota/xfs_qm.h
+++ b/fs/xfs/xfs_qm.h
diff --git a/fs/xfs/quota/xfs_qm_bhv.c b/fs/xfs/xfs_qm_bhv.c
index a0a829addca9..a0a829addca9 100644
--- a/fs/xfs/quota/xfs_qm_bhv.c
+++ b/fs/xfs/xfs_qm_bhv.c
diff --git a/fs/xfs/quota/xfs_qm_stats.c b/fs/xfs/xfs_qm_stats.c
index 8671a0b32644..8671a0b32644 100644
--- a/fs/xfs/quota/xfs_qm_stats.c
+++ b/fs/xfs/xfs_qm_stats.c
diff --git a/fs/xfs/quota/xfs_qm_stats.h b/fs/xfs/xfs_qm_stats.h
index 5b964fc0dc09..5b964fc0dc09 100644
--- a/fs/xfs/quota/xfs_qm_stats.h
+++ b/fs/xfs/xfs_qm_stats.h
diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/xfs_qm_syscalls.c
index 609246f42e6c..609246f42e6c 100644
--- a/fs/xfs/quota/xfs_qm_syscalls.c
+++ b/fs/xfs/xfs_qm_syscalls.c
diff --git a/fs/xfs/quota/xfs_quota_priv.h b/fs/xfs/xfs_quota_priv.h
index 94a3d927d716..94a3d927d716 100644
--- a/fs/xfs/quota/xfs_quota_priv.h
+++ b/fs/xfs/xfs_quota_priv.h
diff --git a/fs/xfs/linux-2.6/xfs_quotaops.c b/fs/xfs/xfs_quotaops.c
index 29b9d642e93d..7e76f537abb7 100644
--- a/fs/xfs/linux-2.6/xfs_quotaops.c
+++ b/fs/xfs/xfs_quotaops.c
@@ -25,7 +25,7 @@
 #include "xfs_trans.h"
 #include "xfs_bmap_btree.h"
 #include "xfs_inode.h"
-#include "quota/xfs_qm.h"
+#include "xfs_qm.h"
 #include <linux/quota.h>
diff --git a/fs/xfs/linux-2.6/xfs_stats.c b/fs/xfs/xfs_stats.c
index 76fdc5861932..76fdc5861932 100644
--- a/fs/xfs/linux-2.6/xfs_stats.c
+++ b/fs/xfs/xfs_stats.c
diff --git a/fs/xfs/linux-2.6/xfs_stats.h b/fs/xfs/xfs_stats.h
index 736854b1ca1a..736854b1ca1a 100644
--- a/fs/xfs/linux-2.6/xfs_stats.h
+++ b/fs/xfs/xfs_stats.h
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/xfs_super.c
index 9a72dda58bd0..9a72dda58bd0 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/xfs_super.c
diff --git a/fs/xfs/linux-2.6/xfs_super.h b/fs/xfs/xfs_super.h
index 50a3266c999e..50a3266c999e 100644
--- a/fs/xfs/linux-2.6/xfs_super.h
+++ b/fs/xfs/xfs_super.h
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/xfs_sync.c
index 4604f90f86a3..4604f90f86a3 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/xfs_sync.c
diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/xfs_sync.h
index 941202e7ac6e..941202e7ac6e 100644
--- a/fs/xfs/linux-2.6/xfs_sync.h
+++ b/fs/xfs/xfs_sync.h
diff --git a/fs/xfs/linux-2.6/xfs_sysctl.c b/fs/xfs/xfs_sysctl.c
index ee2d2adaa438..ee2d2adaa438 100644
--- a/fs/xfs/linux-2.6/xfs_sysctl.c
+++ b/fs/xfs/xfs_sysctl.c
diff --git a/fs/xfs/linux-2.6/xfs_sysctl.h b/fs/xfs/xfs_sysctl.h
index b9937d450f8e..b9937d450f8e 100644
--- a/fs/xfs/linux-2.6/xfs_sysctl.h
+++ b/fs/xfs/xfs_sysctl.h
diff --git a/fs/xfs/linux-2.6/xfs_trace.c b/fs/xfs/xfs_trace.c
index 88d25d4aa56e..9010ce885e6a 100644
--- a/fs/xfs/linux-2.6/xfs_trace.c
+++ b/fs/xfs/xfs_trace.c
@@ -43,8 +43,8 @@
 #include "xfs_quota.h"
 #include "xfs_iomap.h"
 #include "xfs_aops.h"
-#include "quota/xfs_dquot_item.h"
+#include "xfs_dquot_item.h"
-#include "quota/xfs_dquot.h"
+#include "xfs_dquot.h"
 #include "xfs_log_recover.h"
 #include "xfs_inode_item.h"
diff --git a/fs/xfs/linux-2.6/xfs_trace.h b/fs/xfs/xfs_trace.h
index 690fc7a7bd72..690fc7a7bd72 100644
--- a/fs/xfs/linux-2.6/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
diff --git a/fs/xfs/quota/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c
index 4d00ee67792d..4d00ee67792d 100644
--- a/fs/xfs/quota/xfs_trans_dquot.c
+++ b/fs/xfs/xfs_trans_dquot.c
diff --git a/fs/xfs/linux-2.6/xfs_vnode.h b/fs/xfs/xfs_vnode.h
index 7c220b4227bc..7c220b4227bc 100644
--- a/fs/xfs/linux-2.6/xfs_vnode.h
+++ b/fs/xfs/xfs_vnode.h
diff --git a/fs/xfs/linux-2.6/xfs_xattr.c b/fs/xfs/xfs_xattr.c
index 87d3e03878c8..87d3e03878c8 100644
--- a/fs/xfs/linux-2.6/xfs_xattr.c
+++ b/fs/xfs/xfs_xattr.c
diff --git a/include/asm-generic/memory_model.h b/include/asm-generic/memory_model.h
index fb2d63f13f4c..aea9e45efce6 100644
--- a/include/asm-generic/memory_model.h
+++ b/include/asm-generic/memory_model.h
@@ -39,7 +39,7 @@
 })
 #define __page_to_pfn(pg)                                               \
-({      struct page *__pg = (pg);                                       \
+({      const struct page *__pg = (pg);                                 \
        struct pglist_data *__pgdat = NODE_DATA(page_to_nid(__pg));     \
        (unsigned long)(__pg - __pgdat->node_mem_map) +                 \
         __pgdat->node_start_pfn;                                       \
@@ -57,7 +57,7 @@
 * section[i].section_mem_map == mem_map's address - start_pfn;
 */
 #define __page_to_pfn(pg)                                       \
-({      struct page *__pg = (pg);                               \
+({      const struct page *__pg = (pg);                         \
        int __sec = page_to_section(__pg);                      \
        (unsigned long)(__pg - __section_mem_map_addr(__nr_to_section(__sec))); \
 })
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 6395692b2e7a..32f0076e844b 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -125,7 +125,11 @@ enum rq_flag_bits {
        __REQ_SYNC,             /* request is sync (sync write or read) */
        __REQ_META,             /* metadata io request */
        __REQ_DISCARD,          /* request to discard sectors */
+        __REQ_SECURE,           /* secure discard (used with __REQ_DISCARD) */
        __REQ_NOIDLE,           /* don't anticipate more IO after this one */
+        __REQ_FUA,              /* forced unit access */
+        __REQ_FLUSH,            /* request for cache flush */
        /* bio only flags */
        __REQ_RAHEAD,           /* read ahead, can fail anytime */
@@ -135,7 +139,6 @@ enum rq_flag_bits {
        /* request only flags */
        __REQ_SORTED,           /* elevator knows about this request */
        __REQ_SOFTBARRIER,      /* may not be passed by ioscheduler */
-        __REQ_FUA,              /* forced unit access */
        __REQ_NOMERGE,          /* don't touch this for merging */
        __REQ_STARTED,          /* drive already may have started this one */
        __REQ_DONTPREP,         /* don't call prep for this one */
@@ -146,11 +149,9 @@ enum rq_flag_bits {
        __REQ_PREEMPT,          /* set for "ide_preempt" requests */
        __REQ_ALLOCED,          /* request came from our alloc pool */
        __REQ_COPY_USER,        /* contains copies of user pages */
-        __REQ_FLUSH,            /* request for cache flush */
        __REQ_FLUSH_SEQ,        /* request for flush sequence */
        __REQ_IO_STAT,          /* account I/O stat */
        __REQ_MIXED_MERGE,      /* merge of different types, fail separately */
-        __REQ_SECURE,           /* secure discard (used with __REQ_DISCARD) */
        __REQ_NR_BITS,          /* stops here */
 };
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 0e67c45b3bc9..84b15d54f8c2 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -30,6 +30,7 @@ struct request_pm_state;
 struct blk_trace;
 struct request;
 struct sg_io_hdr;
+struct bsg_job;
 #define BLKDEV_MIN_RQ   4
 #define BLKDEV_MAX_RQ   128     /* Default maximum */
@@ -117,6 +118,7 @@ struct request {
                struct {
                        unsigned int            seq;
                        struct list_head        list;
+                        rq_end_io_fn            *saved_end_io;
                } flush;
        };
@@ -209,6 +211,7 @@ typedef int (merge_bvec_fn) (struct request_queue *, struct bvec_merge_data *,
 typedef void (softirq_done_fn)(struct request *);
 typedef int (dma_drain_needed_fn)(struct request *);
 typedef int (lld_busy_fn) (struct request_queue *q);
+typedef int (bsg_job_fn) (struct bsg_job *);
 enum blk_eh_timer_return {
        BLK_EH_NOT_HANDLED,
@@ -375,6 +378,8 @@ struct request_queue {
        struct mutex            sysfs_lock;
 #if defined(CONFIG_BLK_DEV_BSG)
+        bsg_job_fn              *bsg_job_fn;
+        int                     bsg_job_size;
        struct bsg_class_device bsg_dev;
 #endif
diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
index 8c7c2de7631a..8e9e4bc6d73b 100644
--- a/include/linux/blktrace_api.h
+++ b/include/linux/blktrace_api.h
@@ -14,7 +14,7 @@
 enum blktrace_cat {
        BLK_TC_READ     = 1 << 0,       /* reads */
        BLK_TC_WRITE    = 1 << 1,       /* writes */
-        BLK_TC_BARRIER  = 1 << 2,       /* barrier */
+        BLK_TC_FLUSH    = 1 << 2,       /* flush */
        BLK_TC_SYNC     = 1 << 3,       /* sync IO */
        BLK_TC_SYNCIO   = BLK_TC_SYNC,
        BLK_TC_QUEUE    = 1 << 4,       /* queueing/merging */
@@ -28,8 +28,9 @@ enum blktrace_cat {
        BLK_TC_META     = 1 << 12,      /* metadata */
        BLK_TC_DISCARD  = 1 << 13,      /* discard requests */
        BLK_TC_DRV_DATA = 1 << 14,      /* binary per-driver data */
+        BLK_TC_FUA      = 1 << 15,      /* fua requests */
-        BLK_TC_END      = 1 << 15,      /* only 16-bits, reminder */
+        BLK_TC_END      = 1 << 15,      /* we've run out of bits! */
 };
 #define BLK_TC_SHIFT            (16)
diff --git a/include/linux/bsg-lib.h b/include/linux/bsg-lib.h
new file mode 100644
index 000000000000..f55ab8cdc106
--- /dev/null
+++ b/include/linux/bsg-lib.h
@@ -0,0 +1,73 @@
+/*
+ *  BSG helper library
+ *
+ *  Copyright (C) 2008   James Smart, Emulex Corporation
+ *  Copyright (C) 2011   Red Hat, Inc.  All rights reserved.
+ *  Copyright (C) 2011   Mike Christie
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+#ifndef _BLK_BSG_
+#define _BLK_BSG_
+#include <linux/blkdev.h>
+struct request;
+struct device;
+struct scatterlist;
+struct request_queue;
+struct bsg_buffer {
+        unsigned int payload_len;
+        int sg_cnt;
+        struct scatterlist *sg_list;
+};
+struct bsg_job {
+        struct device *dev;
+        struct request *req;
+        /* Transport/driver specific request/reply structs */
+        void *request;
+        void *reply;
+        unsigned int request_len;
+        unsigned int reply_len;
+        /*
+         * On entry : reply_len indicates the buffer size allocated for
+         * the reply.
+         *
+         * Upon completion : the message handler must set reply_len
+         *  to indicates the size of the reply to be returned to the
+         *  caller.
+         */
+        /* DMA payloads for the request/response */
+        struct bsg_buffer request_payload;
+        struct bsg_buffer reply_payload;
+        void *dd_data;          /* Used for driver-specific storage */
+};
+void bsg_job_done(struct bsg_job *job, int result,
+                  unsigned int reply_payload_rcv_len);
+int bsg_setup_queue(struct device *dev, struct request_queue *q, char *name,
+                    bsg_job_fn *job_fn, int dd_job_size);
+void bsg_request_fn(struct request_queue *q);
+void bsg_remove_queue(struct request_queue *q);
+void bsg_goose_queue(struct request_queue *q);
+#endif
diff --git a/include/linux/connector.h b/include/linux/connector.h
index 0c69ad825b39..3c9c54fd5690 100644
--- a/include/linux/connector.h
+++ b/include/linux/connector.h
@@ -1,7 +1,7 @@
 /*
 *      connector.h
 * 
- * 2004-2005 Copyright (c) Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ * 2004-2005 Copyright (c) Evgeniy Polyakov <zbr@ioremap.net>
 * All rights reserved.
 * 
 * This program is free software; you can redistribute it and/or modify
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 178cdb4f1d4a..c2bd68f2277a 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2318,6 +2318,11 @@ extern struct inode * iget5_locked(struct super_block *, unsigned long, int (*te
 extern struct inode * iget_locked(struct super_block *, unsigned long);
 extern int insert_inode_locked4(struct inode *, unsigned long, int (*test)(struct inode *, void *), void *);
 extern int insert_inode_locked(struct inode *);
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+extern void lockdep_annotate_inode_mutex_key(struct inode *inode);
+#else
+static inline void lockdep_annotate_inode_mutex_key(struct inode *inode) { };
+#endif
 extern void unlock_new_inode(struct inode *);
 extern unsigned int get_next_ino(void);
diff --git a/include/linux/fuse.h b/include/linux/fuse.h
index d464de53db43..464cff526860 100644
--- a/include/linux/fuse.h
+++ b/include/linux/fuse.h
@@ -47,6 +47,9 @@
 *  - FUSE_IOCTL_UNRESTRICTED shall now return with array of 'struct
 *    fuse_ioctl_iovec' instead of ambiguous 'struct iovec'
 *  - add FUSE_IOCTL_32BIT flag
+ *
+ * 7.17
+ *  - add FUSE_FLOCK_LOCKS and FUSE_RELEASE_FLOCK_UNLOCK
 */
 #ifndef _LINUX_FUSE_H
@@ -78,7 +81,7 @@
 #define FUSE_KERNEL_VERSION 7
 /** Minor version number of this interface */
-#define FUSE_KERNEL_MINOR_VERSION 16
+#define FUSE_KERNEL_MINOR_VERSION 17
 /** The node ID of the root inode */
 #define FUSE_ROOT_ID 1
@@ -153,8 +156,10 @@ struct fuse_file_lock {
 /**
 * INIT request/reply flags
 *
+ * FUSE_POSIX_LOCKS: remote locking for POSIX file locks
 * FUSE_EXPORT_SUPPORT: filesystem handles lookups of "." and ".."
 * FUSE_DONT_MASK: don't apply umask to file mode on create operations
+ * FUSE_FLOCK_LOCKS: remote locking for BSD style file locks
 */
 #define FUSE_ASYNC_READ         (1 << 0)
 #define FUSE_POSIX_LOCKS        (1 << 1)
@@ -163,6 +168,7 @@ struct fuse_file_lock {
 #define FUSE_EXPORT_SUPPORT     (1 << 4)
 #define FUSE_BIG_WRITES         (1 << 5)
 #define FUSE_DONT_MASK          (1 << 6)
+#define FUSE_FLOCK_LOCKS        (1 << 10)
 /**
 * CUSE INIT request/reply flags
@@ -175,6 +181,7 @@ struct fuse_file_lock {
 * Release flags
 */
 #define FUSE_RELEASE_FLUSH      (1 << 0)
+#define FUSE_RELEASE_FLOCK_UNLOCK       (1 << 1)
 /**
 * Getattr flags
diff --git a/include/linux/hash.h b/include/linux/hash.h
index 06d25c189cc5..b80506bdd733 100644
--- a/include/linux/hash.h
+++ b/include/linux/hash.h
@@ -63,7 +63,7 @@ static inline u32 hash_32(u32 val, unsigned int bits)
        return hash >> (32 - bits);
 }
-static inline unsigned long hash_ptr(void *ptr, unsigned int bits)
+static inline unsigned long hash_ptr(const void *ptr, unsigned int bits)
 {
        return hash_long((unsigned long)ptr, bits);
 }
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 87a06f345bd2..59517300a315 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -23,6 +23,7 @@
 #include <linux/errno.h>
 #include <linux/topology.h>
 #include <linux/wait.h>
+#include <linux/module.h>
 #include <asm/irq.h>
 #include <asm/ptrace.h>
@@ -547,7 +548,15 @@ static inline struct msi_desc *irq_data_get_msi(struct irq_data *d)
        return d->msi_desc;
 }
-int irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node);
+int __irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node,
+                struct module *owner);
+static inline int irq_alloc_descs(int irq, unsigned int from, unsigned int cnt,
+                int node)
+{
+        return __irq_alloc_descs(irq, from, cnt, node, THIS_MODULE);
+}
 void irq_free_descs(unsigned int irq, unsigned int cnt);
 int irq_reserve_irqs(unsigned int from, unsigned int cnt);
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index 2d921b35212c..150134ac709a 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -66,6 +66,7 @@ struct irq_desc {
 #ifdef CONFIG_PROC_FS
        struct proc_dir_entry   *dir;
 #endif
+        struct module           *owner;
        const char              *name;
 } ____cacheline_internodealigned_in_smp;
diff --git a/include/linux/loop.h b/include/linux/loop.h
index 66c194e2d9b9..683d69890119 100644
--- a/include/linux/loop.h
+++ b/include/linux/loop.h
@@ -64,7 +64,6 @@ struct loop_device {
        struct request_queue    *lo_queue;
        struct gendisk          *lo_disk;
-        struct list_head        lo_list;
 };
 #endif /* __KERNEL__ */
@@ -161,4 +160,8 @@ int loop_unregister_transfer(int number);
 #define LOOP_CHANGE_FD          0x4C06
 #define LOOP_SET_CAPACITY       0x4C07
+/* /dev/loop-control interface */
+#define LOOP_CTL_ADD            0x4C80
+#define LOOP_CTL_REMOVE         0x4C81
+#define LOOP_CTL_GET_FREE       0x4C82
 #endif
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index 18fd13028ba1..c309b1ecdc1c 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -40,6 +40,7 @@
 #define BTRFS_MINOR             234
 #define AUTOFS_MINOR            235
 #define MAPPER_CTRL_MINOR       236
+#define LOOP_CTRL_MINOR         237
 #define MISC_DYNAMIC_MINOR      255
 struct device;
diff --git a/include/linux/mm.h b/include/linux/mm.h
index fd599f4bb846..7438071b44aa 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -685,7 +685,7 @@ static inline void set_page_section(struct page *page, unsigned long section)
        page->flags |= (section & SECTIONS_MASK) << SECTIONS_PGSHIFT;
 }
-static inline unsigned long page_to_section(struct page *page)
+static inline unsigned long page_to_section(const struct page *page)
 {
        return (page->flags >> SECTIONS_PGSHIFT) & SECTIONS_MASK;
 }
@@ -720,7 +720,7 @@ static inline void set_page_links(struct page *page, enum zone_type zone,
 static __always_inline void *lowmem_page_address(const struct page *page)
 {
-        return __va(PFN_PHYS(page_to_pfn((struct page *)page)));
+        return __va(PFN_PHYS(page_to_pfn(page)));
 }
 #if defined(CONFIG_HIGHMEM) && !defined(WANT_PAGE_VIRTUAL)
@@ -737,7 +737,7 @@ static __always_inline void *lowmem_page_address(const struct page *page)
 #endif
 #if defined(HASHED_PAGE_VIRTUAL)
-void *page_address(struct page *page);
+void *page_address(const struct page *page);
 void set_page_address(struct page *page, void *virtual);
 void page_address_init(void);
 #endif
diff --git a/include/linux/pci.h b/include/linux/pci.h
index f27893b3b724..8c230cbcbb48 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -251,7 +251,8 @@ struct pci_dev {
        u8              revision;       /* PCI revision, low byte of class word */
        u8              hdr_type;       /* PCI header type (`multi' flag masked out) */
        u8              pcie_cap;       /* PCI-E capability offset */
-        u8              pcie_type;      /* PCI-E device/port type */
+        u8              pcie_type:4;    /* PCI-E device/port type */
+        u8              pcie_mpss:3;    /* PCI-E Max Payload Size Supported */
        u8              rom_base_reg;   /* which config register controls the ROM */
        u8              pin;            /* which interrupt pin this device uses */
@@ -617,6 +618,16 @@ struct pci_driver {
 /* these external functions are only available when PCI support is enabled */
 #ifdef CONFIG_PCI
+extern void pcie_bus_configure_settings(struct pci_bus *bus, u8 smpss);
+enum pcie_bus_config_types {
+        PCIE_BUS_PERFORMANCE,
+        PCIE_BUS_SAFE,
+        PCIE_BUS_PEER2PEER,
+};
+extern enum pcie_bus_config_types pcie_bus_config;
 extern struct bus_type pci_bus_type;
 /* Do NOT directly access these two variables, unless you are arch specific pci
@@ -796,10 +807,13 @@ int pcix_get_mmrbc(struct pci_dev *dev);
 int pcix_set_mmrbc(struct pci_dev *dev, int mmrbc);
 int pcie_get_readrq(struct pci_dev *dev);
 int pcie_set_readrq(struct pci_dev *dev, int rq);
+int pcie_get_mps(struct pci_dev *dev);
+int pcie_set_mps(struct pci_dev *dev, int mps);
 int __pci_reset_function(struct pci_dev *dev);
 int pci_reset_function(struct pci_dev *dev);
 void pci_update_resource(struct pci_dev *dev, int resno);
 int __must_check pci_assign_resource(struct pci_dev *dev, int i);
+int __must_check pci_reassign_resource(struct pci_dev *dev, int i, resource_size_t add_size, resource_size_t align);
 int pci_select_bars(struct pci_dev *dev, unsigned long flags);
 /* ROM control related routines */
diff --git a/include/linux/personality.h b/include/linux/personality.h
index eec3bae164d4..8fc7dd1a57ff 100644
--- a/include/linux/personality.h
+++ b/include/linux/personality.h
@@ -22,6 +22,7 @@ extern int		__set_personality(unsigned int);
 * These occupy the top three bytes.
 */
 enum {
+        UNAME26 =               0x0020000,
        ADDR_NO_RANDOMIZE =     0x0040000,      /* disable randomization of VA space */
        FDPIC_FUNCPTRS =        0x0080000,      /* userspace function ptrs point to descriptors
                                                 * (signal handling)
diff --git a/include/linux/pm_domain.h b/include/linux/pm_domain.h
index 21097cb086fe..f9ec1736a116 100644
--- a/include/linux/pm_domain.h
+++ b/include/linux/pm_domain.h
@@ -72,8 +72,6 @@ extern int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,
 extern void pm_genpd_init(struct generic_pm_domain *genpd,
                          struct dev_power_governor *gov, bool is_off);
 extern int pm_genpd_poweron(struct generic_pm_domain *genpd);
-extern void pm_genpd_poweroff_unused(void);
-extern void genpd_queue_power_off_work(struct generic_pm_domain *genpd);
 #else
 static inline int pm_genpd_add_device(struct generic_pm_domain *genpd,
                                      struct device *dev)
@@ -101,8 +99,14 @@ static inline int pm_genpd_poweron(struct generic_pm_domain *genpd)
 {
        return -ENOSYS;
 }
-static inline void pm_genpd_poweroff_unused(void) {}
+#endif
+#ifdef CONFIG_PM_GENERIC_DOMAINS_RUNTIME
+extern void genpd_queue_power_off_work(struct generic_pm_domain *genpd);
+extern void pm_genpd_poweroff_unused(void);
+#else
 static inline void genpd_queue_power_off_work(struct generic_pm_domain *gpd) {}
+static inline void pm_genpd_poweroff_unused(void) {}
 #endif
 #endif /* _LINUX_PM_DOMAIN_H */
diff --git a/include/linux/pwm_backlight.h b/include/linux/pwm_backlight.h
index 5e3e25a3c9c3..63d2df43e61a 100644
--- a/include/linux/pwm_backlight.h
+++ b/include/linux/pwm_backlight.h
@@ -14,6 +14,7 @@ struct platform_pwm_backlight_data {
        unsigned int pwm_period_ns;
        int (*init)(struct device *dev);
        int (*notify)(struct device *dev, int brightness);
+        void (*notify_after)(struct device *dev, int brightness);
        void (*exit)(struct device *dev);
        int (*check_fb)(struct device *dev, struct fb_info *info);
 };
diff --git a/include/linux/rio_regs.h b/include/linux/rio_regs.h
index 9026b30238f3..218168a2b5e9 100644
--- a/include/linux/rio_regs.h
+++ b/include/linux/rio_regs.h
@@ -36,12 +36,12 @@
 #define  RIO_PEF_PROCESSOR              0x20000000      /* [I] Processor */
 #define  RIO_PEF_SWITCH                 0x10000000      /* [I] Switch */
 #define  RIO_PEF_MULTIPORT              0x08000000      /* [VI, 2.1] Multiport */
-#define  RIO_PEF_INB_MBOX               0x00f00000      /* [II] Mailboxes */
+#define  RIO_PEF_INB_MBOX               0x00f00000      /* [II, <= 1.2] Mailboxes */
-#define  RIO_PEF_INB_MBOX0              0x00800000      /* [II] Mailbox 0 */
+#define  RIO_PEF_INB_MBOX0              0x00800000      /* [II, <= 1.2] Mailbox 0 */
-#define  RIO_PEF_INB_MBOX1              0x00400000      /* [II] Mailbox 1 */
+#define  RIO_PEF_INB_MBOX1              0x00400000      /* [II, <= 1.2] Mailbox 1 */
-#define  RIO_PEF_INB_MBOX2              0x00200000      /* [II] Mailbox 2 */
+#define  RIO_PEF_INB_MBOX2              0x00200000      /* [II, <= 1.2] Mailbox 2 */
-#define  RIO_PEF_INB_MBOX3              0x00100000      /* [II] Mailbox 3 */
+#define  RIO_PEF_INB_MBOX3              0x00100000      /* [II, <= 1.2] Mailbox 3 */
-#define  RIO_PEF_INB_DOORBELL           0x00080000      /* [II] Doorbells */
+#define  RIO_PEF_INB_DOORBELL           0x00080000      /* [II, <= 1.2] Doorbells */
 #define  RIO_PEF_EXT_RT                 0x00000200      /* [III, 1.3] Extended route table support */
 #define  RIO_PEF_STD_RT                 0x00000100      /* [III, 1.3] Standard route table support */
 #define  RIO_PEF_CTLS                   0x00000010      /* [III] CTLS */
@@ -102,7 +102,7 @@
 #define RIO_SWITCH_RT_LIMIT     0x34    /* [III, 1.3] Switch Route Table Destination ID Limit CAR */
 #define  RIO_RT_MAX_DESTID              0x0000ffff
-#define RIO_MBOX_CSR            0x40    /* [II] Mailbox CSR */
+#define RIO_MBOX_CSR            0x40    /* [II, <= 1.2] Mailbox CSR */
 #define  RIO_MBOX0_AVAIL                0x80000000      /* [II] Mbox 0 avail */
 #define  RIO_MBOX0_FULL                 0x40000000      /* [II] Mbox 0 full */
 #define  RIO_MBOX0_EMPTY                0x20000000      /* [II] Mbox 0 empty */
@@ -128,8 +128,8 @@
 #define  RIO_MBOX3_FAIL                 0x00000008      /* [II] Mbox 3 fail */
 #define  RIO_MBOX3_ERROR                0x00000004      /* [II] Mbox 3 error */
-#define RIO_WRITE_PORT_CSR      0x44    /* [I] Write Port CSR */
+#define RIO_WRITE_PORT_CSR      0x44    /* [I, <= 1.2] Write Port CSR */
-#define RIO_DOORBELL_CSR        0x44    /* [II] Doorbell CSR */
+#define RIO_DOORBELL_CSR        0x44    /* [II, <= 1.2] Doorbell CSR */
 #define  RIO_DOORBELL_AVAIL             0x80000000      /* [II] Doorbell avail */
 #define  RIO_DOORBELL_FULL              0x40000000      /* [II] Doorbell full */
 #define  RIO_DOORBELL_EMPTY             0x20000000      /* [II] Doorbell empty */
diff --git a/include/linux/rtc.h b/include/linux/rtc.h
index b27ebea25660..93f4d035076b 100644
--- a/include/linux/rtc.h
+++ b/include/linux/rtc.h
@@ -97,6 +97,9 @@ struct rtc_pll_info {
 #define RTC_AF 0x20     /* Alarm interrupt */
 #define RTC_UF 0x10     /* Update interrupt for 1Hz RTC */
+#define RTC_MAX_FREQ    8192
 #ifdef __KERNEL__
 #include <linux/types.h>
diff --git a/include/linux/ti_wilink_st.h b/include/linux/ti_wilink_st.h
index b004e557caa9..2ef4385da6bf 100644
--- a/include/linux/ti_wilink_st.h
+++ b/include/linux/ti_wilink_st.h
@@ -410,7 +410,28 @@ struct gps_event_hdr {
        u16 plen;
 } __attribute__ ((packed));
-/* platform data */
+/**
+ * struct ti_st_plat_data - platform data shared between ST driver and
+ *      platform specific board file which adds the ST device.
+ * @nshutdown_gpio: Host's GPIO line to which chip's BT_EN is connected.
+ * @dev_name: The UART/TTY name to which chip is interfaced. (eg: /dev/ttyS1)
+ * @flow_cntrl: Should always be 1, since UART's CTS/RTS is used for PM
+ *      purposes.
+ * @baud_rate: The baud rate supported by the Host UART controller, this will
+ *      be shared across with the chip via a HCI VS command from User-Space Init
+ *      Mgr application.
+ * @suspend:
+ * @resume: legacy PM routines hooked to platform specific board file, so as
+ *      to take chip-host interface specific action.
+ * @chip_enable:
+ * @chip_disable: Platform/Interface specific mux mode setting, GPIO
+ *      configuring, Host side PM disabling etc.. can be done here.
+ * @chip_asleep:
+ * @chip_awake: Chip specific deep sleep states is communicated to Host
+ *      specific board-xx.c to take actions such as cut UART clocks when chip
+ *      asleep or run host faster when chip awake etc..
+ *
+ */
 struct ti_st_plat_data {
        long nshutdown_gpio;
        unsigned char dev_name[UART_DEV_NAME_LEN]; /* uart name */
@@ -418,6 +439,10 @@ struct ti_st_plat_data {
        unsigned long baud_rate;
        int (*suspend)(struct platform_device *, pm_message_t);
        int (*resume)(struct platform_device *);
+        int (*chip_enable) (struct kim_data_s *);
+        int (*chip_disable) (struct kim_data_s *);
+        int (*chip_asleep) (struct kim_data_s *);
+        int (*chip_awake) (struct kim_data_s *);
 };
 #endif /* TI_WILINK_ST_H */
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 44bc0c5617e1..5f2ede82b3d6 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -421,6 +421,8 @@ extern void tty_driver_flush_buffer(struct tty_struct *tty);
 extern void tty_throttle(struct tty_struct *tty);
 extern void tty_unthrottle(struct tty_struct *tty);
 extern int tty_do_resize(struct tty_struct *tty, struct winsize *ws);
+extern void tty_driver_remove_tty(struct tty_driver *driver,
+                                  struct tty_struct *tty);
 extern void tty_shutdown(struct tty_struct *tty);
 extern void tty_free_termios(struct tty_struct *tty);
 extern int is_current_pgrp_orphaned(void);
diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
index 9deeac855240..ecdaeb98b293 100644
--- a/include/linux/tty_driver.h
+++ b/include/linux/tty_driver.h
@@ -47,6 +47,9 @@
 *
 *      This routine is called synchronously when a particular tty device
 *      is closed for the last time freeing up the resources.
+ *      Note that tty_shutdown() is not called if ops->shutdown is defined.
+ *      This means one is responsible to take care of calling ops->remove (e.g.
+ *      via tty_driver_remove_tty) and releasing tty->termios.
 *
 *
 * void (*cleanup)(struct tty_struct * tty);
diff --git a/include/linux/writeback.h b/include/linux/writeback.h
index f1bfa12ea246..2b8963ff0f35 100644
--- a/include/linux/writeback.h
+++ b/include/linux/writeback.h
@@ -12,15 +12,6 @@
 *
 *      (thresh - thresh/DIRTY_FULL_SCOPE, thresh)
 *
- * The 1/16 region above the global dirty limit will be put to maximum pauses:
- *
- *      (limit, limit + limit/DIRTY_MAXPAUSE_AREA)
- *
- * The 1/16 region above the max-pause region, dirty exceeded bdi's will be put
- * to loops:
- *
- *      (limit + limit/DIRTY_MAXPAUSE_AREA, limit + limit/DIRTY_PASSGOOD_AREA)
- *
 * Further beyond, all dirtier tasks will enter a loop waiting (possibly long
 * time) for the dirty pages to drop, unless written enough pages.
 *
@@ -31,8 +22,6 @@
 */
 #define DIRTY_SCOPE             8
 #define DIRTY_FULL_SCOPE        (DIRTY_SCOPE / 2)
-#define DIRTY_MAXPAUSE_AREA             16
-#define DIRTY_PASSGOOD_AREA             8
 /*
 * 4MB minimal write chunk size
diff --git a/include/target/target_core_fabric_ops.h b/include/target/target_core_fabric_ops.h
index 2de8fe907596..126c675f4f14 100644
--- a/include/target/target_core_fabric_ops.h
+++ b/include/target/target_core_fabric_ops.h
@@ -27,6 +27,12 @@ struct target_core_fabric_ops {
        int (*tpg_check_demo_mode_cache)(struct se_portal_group *);
        int (*tpg_check_demo_mode_write_protect)(struct se_portal_group *);
        int (*tpg_check_prod_mode_write_protect)(struct se_portal_group *);
+        /*
+         * Optionally used by fabrics to allow demo-mode login, but not
+         * expose any TPG LUNs, and return 'not connected' in standard
+         * inquiry response
+         */
+        int (*tpg_check_demo_mode_login_only)(struct se_portal_group *);
        struct se_node_acl *(*tpg_alloc_fabric_acl)(
                                        struct se_portal_group *);
        void (*tpg_release_fabric_acl)(struct se_portal_group *,
diff --git a/include/trace/events/block.h b/include/trace/events/block.h
index bf366547da25..05c5e61f0a7c 100644
--- a/include/trace/events/block.h
+++ b/include/trace/events/block.h
@@ -8,6 +8,8 @@
 #include <linux/blkdev.h>
 #include <linux/tracepoint.h>
+#define RWBS_LEN        8
 DECLARE_EVENT_CLASS(block_rq_with_error,
        TP_PROTO(struct request_queue *q, struct request *rq),
@@ -19,7 +21,7 @@ DECLARE_EVENT_CLASS(block_rq_with_error,
                __field(  sector_t,     sector                  )
                __field(  unsigned int, nr_sector               )
                __field(  int,          errors                  )
-                __array(  char,         rwbs,   6               )
+                __array(  char,         rwbs,   RWBS_LEN        )
                __dynamic_array( char,  cmd,    blk_cmd_buf_len(rq)     )
        ),
@@ -104,7 +106,7 @@ DECLARE_EVENT_CLASS(block_rq,
                __field(  sector_t,     sector                  )
                __field(  unsigned int, nr_sector               )
                __field(  unsigned int, bytes                   )
-                __array(  char,         rwbs,   6               )
+                __array(  char,         rwbs,   RWBS_LEN        )
                __array(  char,         comm,   TASK_COMM_LEN   )
                __dynamic_array( char,  cmd,    blk_cmd_buf_len(rq)     )
        ),
@@ -183,7 +185,7 @@ TRACE_EVENT(block_bio_bounce,
                __field( dev_t,         dev                     )
                __field( sector_t,      sector                  )
                __field( unsigned int,  nr_sector               )
-                __array( char,          rwbs,   6               )
+                __array( char,          rwbs,   RWBS_LEN        )
                __array( char,          comm,   TASK_COMM_LEN   )
        ),
@@ -222,7 +224,7 @@ TRACE_EVENT(block_bio_complete,
                __field( sector_t,      sector          )
                __field( unsigned,      nr_sector       )
                __field( int,           error           )
-                __array( char,          rwbs,   6       )
+                __array( char,          rwbs,   RWBS_LEN)
        ),
        TP_fast_assign(
@@ -249,7 +251,7 @@ DECLARE_EVENT_CLASS(block_bio,
                __field( dev_t,         dev                     )
                __field( sector_t,      sector                  )
                __field( unsigned int,  nr_sector               )
-                __array( char,          rwbs,   6               )
+                __array( char,          rwbs,   RWBS_LEN        )
                __array( char,          comm,   TASK_COMM_LEN   )
        ),
@@ -321,7 +323,7 @@ DECLARE_EVENT_CLASS(block_get_rq,
                __field( dev_t,         dev                     )
                __field( sector_t,      sector                  )
                __field( unsigned int,  nr_sector               )
-                __array( char,          rwbs,   6               )
+                __array( char,          rwbs,   RWBS_LEN        )
                __array( char,          comm,   TASK_COMM_LEN   )
        ),
@@ -456,7 +458,7 @@ TRACE_EVENT(block_split,
                __field( dev_t,         dev                             )
                __field( sector_t,      sector                          )
                __field( sector_t,      new_sector                      )
-                __array( char,          rwbs,           6               )
+                __array( char,          rwbs,           RWBS_LEN        )
                __array( char,          comm,           TASK_COMM_LEN   )
        ),
@@ -498,7 +500,7 @@ TRACE_EVENT(block_bio_remap,
                __field( unsigned int,  nr_sector       )
                __field( dev_t,         old_dev         )
                __field( sector_t,      old_sector      )
-                __array( char,          rwbs,   6       )
+                __array( char,          rwbs,   RWBS_LEN)
        ),
        TP_fast_assign(
@@ -542,7 +544,7 @@ TRACE_EVENT(block_rq_remap,
                __field( unsigned int,  nr_sector       )
                __field( dev_t,         old_dev         )
                __field( sector_t,      old_sector      )
-                __array( char,          rwbs,   6       )
+                __array( char,          rwbs,   RWBS_LEN)
        ),
        TP_fast_assign(
diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c
index 3a2cab407b93..e38544dddb18 100644
--- a/kernel/irq/generic-chip.c
+++ b/kernel/irq/generic-chip.c
@@ -246,7 +246,7 @@ void irq_setup_generic_chip(struct irq_chip_generic *gc, u32 msk,
                gc->mask_cache = irq_reg_readl(gc->reg_base + ct->regs.mask);
        for (i = gc->irq_base; msk; msk >>= 1, i++) {
-                if (!msk & 0x01)
+                if (!(msk & 0x01))
                        continue;
                if (flags & IRQ_GC_INIT_NESTED_LOCK)
@@ -301,7 +301,7 @@ void irq_remove_generic_chip(struct irq_chip_generic *gc, u32 msk,
        raw_spin_unlock(&gc_lock);
        for (; msk; msk >>= 1, i++) {
-                if (!msk & 0x01)
+                if (!(msk & 0x01))
                        continue;
                /* Remove handler first. That will mask the irq line */
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 4c60a50e66b2..039b889ea053 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -70,7 +70,8 @@ static inline void desc_smp_init(struct irq_desc *desc, int node) { }
 static inline int desc_node(struct irq_desc *desc) { return 0; }
 #endif
-static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node)
+static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node,
+                struct module *owner)
 {
        int cpu;
@@ -86,6 +87,7 @@ static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node)
        desc->irq_count = 0;
        desc->irqs_unhandled = 0;
        desc->name = NULL;
+        desc->owner = owner;
        for_each_possible_cpu(cpu)
                *per_cpu_ptr(desc->kstat_irqs, cpu) = 0;
        desc_smp_init(desc, node);
@@ -128,7 +130,7 @@ static void free_masks(struct irq_desc *desc)
 static inline void free_masks(struct irq_desc *desc) { }
 #endif
-static struct irq_desc *alloc_desc(int irq, int node)
+static struct irq_desc *alloc_desc(int irq, int node, struct module *owner)
 {
        struct irq_desc *desc;
        gfp_t gfp = GFP_KERNEL;
@@ -147,7 +149,7 @@ static struct irq_desc *alloc_desc(int irq, int node)
        raw_spin_lock_init(&desc->lock);
        lockdep_set_class(&desc->lock, &irq_desc_lock_class);
-        desc_set_defaults(irq, desc, node);
+        desc_set_defaults(irq, desc, node, owner);
        return desc;
@@ -173,13 +175,14 @@ static void free_desc(unsigned int irq)
        kfree(desc);
 }
-static int alloc_descs(unsigned int start, unsigned int cnt, int node)
+static int alloc_descs(unsigned int start, unsigned int cnt, int node,
+                       struct module *owner)
 {
        struct irq_desc *desc;
        int i;
        for (i = 0; i < cnt; i++) {
-                desc = alloc_desc(start + i, node);
+                desc = alloc_desc(start + i, node, owner);
                if (!desc)
                        goto err;
                mutex_lock(&sparse_irq_lock);
@@ -227,7 +230,7 @@ int __init early_irq_init(void)
                nr_irqs = initcnt;
        for (i = 0; i < initcnt; i++) {
-                desc = alloc_desc(i, node);
+                desc = alloc_desc(i, node, NULL);
                set_bit(i, allocated_irqs);
                irq_insert_desc(i, desc);
        }
@@ -261,7 +264,7 @@ int __init early_irq_init(void)
                alloc_masks(&desc[i], GFP_KERNEL, node);
                raw_spin_lock_init(&desc[i].lock);
                lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
-                desc_set_defaults(i, &desc[i], node);
+                desc_set_defaults(i, &desc[i], node, NULL);
        }
        return arch_early_irq_init();
 }
@@ -276,8 +279,16 @@ static void free_desc(unsigned int irq)
        dynamic_irq_cleanup(irq);
 }
-static inline int alloc_descs(unsigned int start, unsigned int cnt, int node)
+static inline int alloc_descs(unsigned int start, unsigned int cnt, int node,
+                              struct module *owner)
 {
+        u32 i;
+        for (i = 0; i < cnt; i++) {
+                struct irq_desc *desc = irq_to_desc(start + i);
+                desc->owner = owner;
+        }
        return start;
 }
@@ -333,11 +344,13 @@ EXPORT_SYMBOL_GPL(irq_free_descs);
 * @from:       Start the search from this irq number
 * @cnt:        Number of consecutive irqs to allocate.
 * @node:       Preferred node on which the irq descriptor should be allocated
+ * @owner:      Owning module (can be NULL)
 *
 * Returns the first irq number or error code
 */
 int __ref
-irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node)
+__irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node,
+                  struct module *owner)
 {
        int start, ret;
@@ -366,13 +379,13 @@ irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int node)
        bitmap_set(allocated_irqs, start, cnt);
        mutex_unlock(&sparse_irq_lock);
-        return alloc_descs(start, cnt, node);
+        return alloc_descs(start, cnt, node, owner);
 err:
        mutex_unlock(&sparse_irq_lock);
        return ret;
 }
-EXPORT_SYMBOL_GPL(irq_alloc_descs);
+EXPORT_SYMBOL_GPL(__irq_alloc_descs);
 /**
 * irq_reserve_irqs - mark irqs allocated
@@ -440,7 +453,7 @@ void dynamic_irq_cleanup(unsigned int irq)
        unsigned long flags;
        raw_spin_lock_irqsave(&desc->lock, flags);
-        desc_set_defaults(irq, desc, desc_node(desc));
+        desc_set_defaults(irq, desc, desc_node(desc), NULL);
        raw_spin_unlock_irqrestore(&desc->lock, flags);
 }
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 0a7840aeb0fb..9b956fa20308 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -883,6 +883,8 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
        if (desc->irq_data.chip == &no_irq_chip)
                return -ENOSYS;
+        if (!try_module_get(desc->owner))
+                return -ENODEV;
        /*
         * Some drivers like serial.c use request_irq() heavily,
         * so we have to be careful not to interfere with a
@@ -906,8 +908,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
         */
        nested = irq_settings_is_nested_thread(desc);
        if (nested) {
-                if (!new->thread_fn)
+                if (!new->thread_fn) {
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto out_mput;
+                }
                /*
                 * Replace the primary handler which was provided from
                 * the driver for non nested interrupt handling by the
@@ -929,8 +933,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                t = kthread_create(irq_thread, new, "irq/%d-%s", irq,
                                   new->name);
-                if (IS_ERR(t))
+                if (IS_ERR(t)) {
-                        return PTR_ERR(t);
+                        ret = PTR_ERR(t);
+                        goto out_mput;
+                }
                /*
                 * We keep the reference to the task struct even if
                 * the thread dies to avoid that the interrupt code
@@ -1095,6 +1101,8 @@ out_thread:
                        kthread_stop(t);
                put_task_struct(t);
        }
+out_mput:
+        module_put(desc->owner);
        return ret;
 }
@@ -1203,6 +1211,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
                put_task_struct(action->thread);
        }
+        module_put(desc->owner);
        return action;
 }
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 8c24294e477f..91d67ce3a8d5 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -3111,7 +3111,13 @@ static int match_held_lock(struct held_lock *hlock, struct lockdep_map *lock)
                if (!class)
                        class = look_up_lock_class(lock, 0);
-                if (DEBUG_LOCKS_WARN_ON(!class))
+                /*
+                 * If look_up_lock_class() failed to find a class, we're trying
+                 * to test if we hold a lock that has never yet been acquired.
+                 * Clearly if the lock hasn't been acquired _ever_, we're not
+                 * holding it either, so report failure.
+                 */
+                if (!class)
                        return 0;
                if (DEBUG_LOCKS_WARN_ON(!hlock->nest_lock))
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index b1914cb9095c..3744c594b19b 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -231,3 +231,7 @@ config PM_CLK
 config PM_GENERIC_DOMAINS
        bool
        depends on PM
+config PM_GENERIC_DOMAINS_RUNTIME
+        def_bool y
+        depends on PM_RUNTIME && PM_GENERIC_DOMAINS
diff --git a/kernel/printk.c b/kernel/printk.c
index 836a2ae0ac31..28a40d8171b8 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -1604,7 +1604,7 @@ static int __init printk_late_init(void)
        struct console *con;
        for_each_console(con) {
-                if (con->flags & CON_BOOT) {
+                if (!keep_bootcon && con->flags & CON_BOOT) {
                        printk(KERN_INFO "turn off boot console %s%d\n",
                                con->name, con->index);
                        unregister_console(con);
diff --git a/kernel/sys.c b/kernel/sys.c
index dd948a1fca4c..18ee1d2f6474 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -37,6 +37,8 @@
 #include <linux/fs_struct.h>
 #include <linux/gfp.h>
 #include <linux/syscore_ops.h>
+#include <linux/version.h>
+#include <linux/ctype.h>
 #include <linux/compat.h>
 #include <linux/syscalls.h>
@@ -44,6 +46,8 @@
 #include <linux/user_namespace.h>
 #include <linux/kmsg_dump.h>
+/* Move somewhere else to avoid recompiling? */
+#include <generated/utsrelease.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -1161,6 +1165,34 @@ DECLARE_RWSEM(uts_sem);
 #define override_architecture(name)     0
 #endif
+/*
+ * Work around broken programs that cannot handle "Linux 3.0".
+ * Instead we map 3.x to 2.6.40+x, so e.g. 3.0 would be 2.6.40
+ */
+static int override_release(char __user *release, int len)
+{
+        int ret = 0;
+        char buf[len];
+        if (current->personality & UNAME26) {
+                char *rest = UTS_RELEASE;
+                int ndots = 0;
+                unsigned v;
+                while (*rest) {
+                        if (*rest == '.' && ++ndots >= 3)
+                                break;
+                        if (!isdigit(*rest) && *rest != '.')
+                                break;
+                        rest++;
+                }
+                v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
+                snprintf(buf, len, "2.6.%u%s", v, rest);
+                ret = copy_to_user(release, buf, len);
+        }
+        return ret;
+}
 SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
 {
        int errno = 0;
@@ -1170,6 +1202,8 @@ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
                errno = -EFAULT;
        up_read(&uts_sem);
+        if (!errno && override_release(name->release, sizeof(name->release)))
+                errno = -EFAULT;
        if (!errno && override_architecture(name))
                errno = -EFAULT;
        return errno;
@@ -1191,6 +1225,8 @@ SYSCALL_DEFINE1(uname, struct old_utsname __user *, name)
                error = -EFAULT;
        up_read(&uts_sem);
+        if (!error && override_release(name->release, sizeof(name->release)))
+                error = -EFAULT;
        if (!error && override_architecture(name))
                error = -EFAULT;
        return error;
@@ -1225,6 +1261,8 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
        if (!error && override_architecture(name))
                error = -EFAULT;
+        if (!error && override_release(name->release, sizeof(name->release)))
+                error = -EFAULT;
        return error ? -EFAULT : 0;
 }
 #endif
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index 3b8e028b9601..e8bffbe2ba4b 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -1,6 +1,6 @@
 #include <linux/stat.h>
 #include <linux/sysctl.h>
-#include "../fs/xfs/linux-2.6/xfs_sysctl.h"
+#include "../fs/xfs/xfs_sysctl.h"
 #include <linux/sunrpc/debug.h>
 #include <linux/string.h>
 #include <net/ip_vs.h>
diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
index 4e4932a7b360..362da653813d 100644
--- a/kernel/sysctl_check.c
+++ b/kernel/sysctl_check.c
@@ -1,6 +1,6 @@
 #include <linux/stat.h>
 #include <linux/sysctl.h>
-#include "../fs/xfs/linux-2.6/xfs_sysctl.h"
+#include "../fs/xfs/xfs_sysctl.h"
 #include <linux/sunrpc/debug.h>
 #include <linux/string.h>
 #include <net/ip_vs.h>
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 6957aa298dfa..7c910a5593a6 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -206,6 +206,8 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
        what |= MASK_TC_BIT(rw, RAHEAD);
        what |= MASK_TC_BIT(rw, META);
        what |= MASK_TC_BIT(rw, DISCARD);
+        what |= MASK_TC_BIT(rw, FLUSH);
+        what |= MASK_TC_BIT(rw, FUA);
        pid = tsk->pid;
        if (act_log_check(bt, what, sector, pid))
@@ -1054,6 +1056,9 @@ static void fill_rwbs(char *rwbs, const struct blk_io_trace *t)
                goto out;
        }
+        if (tc & BLK_TC_FLUSH)
+                rwbs[i++] = 'F';
        if (tc & BLK_TC_DISCARD)
                rwbs[i++] = 'D';
        else if (tc & BLK_TC_WRITE)
@@ -1063,10 +1068,10 @@ static void fill_rwbs(char *rwbs, const struct blk_io_trace *t)
        else
                rwbs[i++] = 'N';
+        if (tc & BLK_TC_FUA)
+                rwbs[i++] = 'F';
        if (tc & BLK_TC_AHEAD)
                rwbs[i++] = 'A';
-        if (tc & BLK_TC_BARRIER)
-                rwbs[i++] = 'B';
        if (tc & BLK_TC_SYNC)
                rwbs[i++] = 'S';
        if (tc & BLK_TC_META)
@@ -1132,7 +1137,7 @@ typedef int (blk_log_action_t) (struct trace_iterator *iter, const char *act);
 static int blk_log_action_classic(struct trace_iterator *iter, const char *act)
 {
-        char rwbs[6];
+        char rwbs[RWBS_LEN];
        unsigned long long ts  = iter->ts;
        unsigned long nsec_rem = do_div(ts, NSEC_PER_SEC);
        unsigned secs          = (unsigned long)ts;
@@ -1148,7 +1153,7 @@ static int blk_log_action_classic(struct trace_iterator *iter, const char *act)
 static int blk_log_action(struct trace_iterator *iter, const char *act)
 {
-        char rwbs[6];
+        char rwbs[RWBS_LEN];
        const struct blk_io_trace *t = te_blk_io_trace(iter->ent);
        fill_rwbs(rwbs, t);
@@ -1561,7 +1566,7 @@ static const struct {
 } mask_maps[] = {
        { BLK_TC_READ,          "read"          },
        { BLK_TC_WRITE,         "write"         },
-        { BLK_TC_BARRIER,       "barrier"       },
+        { BLK_TC_FLUSH,         "flush"         },
        { BLK_TC_SYNC,          "sync"          },
        { BLK_TC_QUEUE,         "queue"         },
        { BLK_TC_REQUEUE,       "requeue"       },
@@ -1573,6 +1578,7 @@ static const struct {
        { BLK_TC_META,          "meta"          },
        { BLK_TC_DISCARD,       "discard"       },
        { BLK_TC_DRV_DATA,      "drv_data"      },
+        { BLK_TC_FUA,           "fua"           },
 };
 static int blk_trace_str2mask(const char *str)
@@ -1788,6 +1794,9 @@ void blk_fill_rwbs(char *rwbs, u32 rw, int bytes)
 {
        int i = 0;
+        if (rw & REQ_FLUSH)
+                rwbs[i++] = 'F';
        if (rw & WRITE)
                rwbs[i++] = 'W';
        else if (rw & REQ_DISCARD)
@@ -1797,6 +1806,8 @@ void blk_fill_rwbs(char *rwbs, u32 rw, int bytes)
        else
                rwbs[i++] = 'N';
+        if (rw & REQ_FUA)
+                rwbs[i++] = 'F';
        if (rw & REQ_RAHEAD)
                rwbs[i++] = 'A';
        if (rw & REQ_SYNC)
diff --git a/mm/highmem.c b/mm/highmem.c
index 693394daa2ed..5ef672c07f75 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -326,7 +326,7 @@ static struct page_address_slot {
        spinlock_t lock;                        /* Protect this bucket's list */
 } ____cacheline_aligned_in_smp page_address_htable[1<<PA_HASH_ORDER];
-static struct page_address_slot *page_slot(struct page *page)
+static struct page_address_slot *page_slot(const struct page *page)
 {
        return &page_address_htable[hash_ptr(page, PA_HASH_ORDER)];
 }
@@ -337,7 +337,7 @@ static struct page_address_slot *page_slot(struct page *page)
 *
 * Returns the page's virtual address.
 */
-void *page_address(struct page *page)
+void *page_address(const struct page *page)
 {
        unsigned long flags;
        void *ret;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 930de9437271..ebd1e86bef1c 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1841,29 +1841,23 @@ static int mem_cgroup_hierarchical_reclaim(struct mem_cgroup *root_mem,
 */
 static bool mem_cgroup_oom_lock(struct mem_cgroup *mem)
 {
-        int lock_count = -1;
        struct mem_cgroup *iter, *failed = NULL;
        bool cond = true;
        for_each_mem_cgroup_tree_cond(iter, mem, cond) {
-                bool locked = iter->oom_lock;
+                if (iter->oom_lock) {
-                iter->oom_lock = true;
-                if (lock_count == -1)
-                        lock_count = iter->oom_lock;
-                else if (lock_count != locked) {
                        /*
                         * this subtree of our hierarchy is already locked
                         * so we cannot give a lock.
                         */
-                        lock_count = 0;
                        failed = iter;
                        cond = false;
-                }
+                } else
+                        iter->oom_lock = true;
        }
        if (!failed)
-                goto done;
+                return true;
        /*
         * OK, we failed to lock the whole subtree so we have to clean up
@@ -1877,8 +1871,7 @@ static bool mem_cgroup_oom_lock(struct mem_cgroup *mem)
                }
                iter->oom_lock = false;
        }
-done:
+        return false;
-        return lock_count;
 }
 /*
@@ -2169,13 +2162,7 @@ static void drain_all_stock(struct mem_cgroup *root_mem, bool sync)
        /* Notify other cpus that system-wide "drain" is running */
        get_online_cpus();
-        /*
+        curcpu = get_cpu();
-         * Get a hint for avoiding draining charges on the current cpu,
-         * which must be exhausted by our charging.  It is not required that
-         * this be a precise check, so we use raw_smp_processor_id() instead of
-         * getcpu()/putcpu().
-         */
-        curcpu = raw_smp_processor_id();
        for_each_online_cpu(cpu) {
                struct memcg_stock_pcp *stock = &per_cpu(memcg_stock, cpu);
                struct mem_cgroup *mem;
@@ -2192,6 +2179,7 @@ static void drain_all_stock(struct mem_cgroup *root_mem, bool sync)
                                schedule_work_on(cpu, &stock->work);
                }
        }
+        put_cpu();
        if (!sync)
                goto out;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index d1960744f881..0e309cd1b5b9 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -754,21 +754,10 @@ static void balance_dirty_pages(struct address_space *mapping,
                 * 200ms is typically more than enough to curb heavy dirtiers;
                 * (b) the pause time limit makes the dirtiers more responsive.
                 */
-                if (nr_dirty < dirty_thresh +
+                if (nr_dirty < dirty_thresh &&
-                               dirty_thresh / DIRTY_MAXPAUSE_AREA &&
+                    bdi_dirty < (task_bdi_thresh + bdi_thresh) / 2 &&
                    time_after(jiffies, start_time + MAX_PAUSE))
                        break;
-                /*
-                 * pass-good area. When some bdi gets blocked (eg. NFS server
-                 * not responding), or write bandwidth dropped dramatically due
-                 * to concurrent reads, or dirty threshold suddenly dropped and
-                 * the dirty pages cannot be brought down anytime soon (eg. on
-                 * slow USB stick), at least let go of the good bdi's.
-                 */
-                if (nr_dirty < dirty_thresh +
-                               dirty_thresh / DIRTY_PASSGOOD_AREA &&
-                    bdi_dirty < bdi_thresh)
-                        break;
                /*
                 * Increase the delay for each loop, up to our previous
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 7ef69124fa3e..b7719ec10dc5 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2283,7 +2283,7 @@ unsigned long mem_cgroup_shrink_node_zone(struct mem_cgroup *mem,
                .mem_cgroup = mem,
                .memcg_record = rec,
        };
-        unsigned long start, end;
+        ktime_t start, end;
        sc.gfp_mask = (gfp_mask & GFP_RECLAIM_MASK) |
                        (GFP_HIGHUSER_MOVABLE & ~GFP_RECLAIM_MASK);
@@ -2292,7 +2292,7 @@ unsigned long mem_cgroup_shrink_node_zone(struct mem_cgroup *mem,
                                                      sc.may_writepage,
                                                      sc.gfp_mask);
-        start = sched_clock();
+        start = ktime_get();
        /*
         * NOTE: Although we can get the priority field, using it
         * here is not a good idea, since it limits the pages we can scan.
@@ -2301,10 +2301,10 @@ unsigned long mem_cgroup_shrink_node_zone(struct mem_cgroup *mem,
         * the priority and make it zero.
         */
        shrink_zone(0, zone, &sc);
-        end = sched_clock();
+        end = ktime_get();
        if (rec)
-                rec->elapsed += end - start;
+                rec->elapsed += ktime_to_ns(ktime_sub(end, start));
        *scanned = sc.nr_scanned;
        trace_mm_vmscan_memcg_softlimit_reclaim_end(sc.nr_reclaimed);
@@ -2319,7 +2319,7 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem_cont,
 {
        struct zonelist *zonelist;
        unsigned long nr_reclaimed;
-        unsigned long start, end;
+        ktime_t start, end;
        int nid;
        struct scan_control sc = {
                .may_writepage = !laptop_mode,
@@ -2337,7 +2337,7 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem_cont,
                .gfp_mask = sc.gfp_mask,
        };
-        start = sched_clock();
+        start = ktime_get();
        /*
         * Unlike direct reclaim via alloc_pages(), memcg's reclaim doesn't
         * take care of from where we get pages. So the node where we start the
@@ -2352,9 +2352,9 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *mem_cont,
                                            sc.gfp_mask);
        nr_reclaimed = do_try_to_free_pages(zonelist, &sc, &shrink);
-        end = sched_clock();
+        end = ktime_get();
        if (rec)
-                rec->elapsed += end - start;
+                rec->elapsed += ktime_to_ns(ktime_sub(end, start));
        trace_mm_vmscan_memcg_reclaim_end(nr_reclaimed);
@@ -2529,6 +2529,9 @@ loop_again:
                                        high_wmark_pages(zone), 0, 0)) {
                                end_zone = i;
                                break;
+                        } else {
+                                /* If balanced, clear the congested flag */
+                                zone_clear_flag(zone, ZONE_CONGESTED);
                        }
                }
                if (i < 0)
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 5f27f8e30254..f1f2f7bb6661 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -167,6 +167,8 @@ struct sk_buff *vlan_untag(struct sk_buff *skb)
        if (unlikely(!skb))
                goto err_free;
+        skb_reset_network_header(skb);
+        skb_reset_transport_header(skb);
        return skb;
 err_free:
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 52cfd0c3ea71..d07223c834af 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -558,12 +558,13 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
        spin_unlock_irqrestore(&rq->lock, flags);
        skb_queue_walk_safe(&queue, skb, tmp) {
-                struct net_device *dev = skb->dev;
+                struct net_device *dev;
+                br2684_push(atmvcc, skb);
+                dev = skb->dev;
                dev->stats.rx_bytes -= skb->len;
                dev->stats.rx_packets--;
-                br2684_push(atmvcc, skb);
        }
        /* initialize netdev carrier state */
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 2cdf0070419f..e73815456adf 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -231,6 +231,7 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
 int br_add_bridge(struct net *net, const char *name)
 {
        struct net_device *dev;
+        int res;
        dev = alloc_netdev(sizeof(struct net_bridge), name,
                           br_dev_setup);
@@ -240,7 +241,10 @@ int br_add_bridge(struct net *net, const char *name)
        dev_net_set(dev, net);
-        return register_netdev(dev);
+        res = register_netdev(dev);
+        if (res)
+                free_netdev(dev);
+        return res;
 }
 int br_del_bridge(struct net *net, const char *name)
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 9cb191ecaba8..147ede38ab48 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -913,7 +913,7 @@ static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
 }
 static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
-                    char __user *optval, int __user *optlen)
+                    char __user *optval, int __user *optlen, unsigned flags)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        int len;
@@ -962,7 +962,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                msg.msg_control = optval;
                msg.msg_controllen = len;
-                msg.msg_flags = 0;
+                msg.msg_flags = flags;
                lock_sock(sk);
                skb = np->pktoptions;
@@ -1222,7 +1222,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
        if(level != SOL_IPV6)
                return -ENOPROTOOPT;
-        err = do_ipv6_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ipv6_getsockopt(sk, level, optname, optval, optlen, 0);
 #ifdef CONFIG_NETFILTER
        /* we need to exclude all possible ENOPROTOOPTs except default case */
        if (err == -ENOPROTOOPT && optname != IPV6_2292PKTOPTIONS) {
@@ -1264,7 +1264,8 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
                return compat_mc_getsockopt(sk, level, optname, optval, optlen,
                        ipv6_getsockopt);
-        err = do_ipv6_getsockopt(sk, level, optname, optval, optlen);
+        err = do_ipv6_getsockopt(sk, level, optname, optval, optlen,
+                                 MSG_CMSG_COMPAT);
 #ifdef CONFIG_NETFILTER
        /* we need to exclude all possible ENOPROTOOPTs except default case */
        if (err == -ENOPROTOOPT && optname != IPV6_2292PKTOPTIONS) {
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 07bf1085458f..00b15ac7a702 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -672,6 +672,9 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
        if (skb->protocol != htons(ETH_P_IPV6))
                goto tx_error;
+        if (tos == 1)
+                tos = ipv6_get_dsfield(iph6);
        /* ISATAP (RFC4214) - must come before 6to4 */
        if (dev->priv_flags & IFF_ISATAP) {
                struct neighbour *neigh = NULL;
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 102fc212cd64..e051398fdf6b 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -196,8 +196,7 @@ static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a,
        skb2->skb_iif = skb->dev->ifindex;
        skb2->dev = dev;
-        dev_queue_xmit(skb2);
+        err = dev_queue_xmit(skb2);
-        err = 0;
 out:
        if (err) {
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 9d761c95eca2..3dfc47134e51 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2574,7 +2574,8 @@ sub process {
                                } else {
                                        $cast = $cast2;
                                }
-                                WARN("$call() should probably be ${call}_t($cast, $arg1, $arg2)\n" . $herecurr);
+                                WARN("MINMAX",
+                                     "$call() should probably be ${call}_t($cast, $arg1, $arg2)\n" . $herecurr);
                        }
                }
diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl
index eb2f1e64edf7..4594f3341051 100755
--- a/scripts/get_maintainer.pl
+++ b/scripts/get_maintainer.pl
@@ -1389,7 +1389,7 @@ sub vcs_exists {
        warn("$P: No supported VCS found.  Add --nogit to options?\n");
        warn("Using a git repository produces better results.\n");
        warn("Try Linus Torvalds' latest git repository using:\n");
-        warn("git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git\n");
+        warn("git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git\n");
        $printed_novcs = 1;
    }
    return 0;
diff --git a/sound/aoa/fabrics/layout.c b/sound/aoa/fabrics/layout.c
index 3fd1a7e24928..552b97afbca5 100644
--- a/sound/aoa/fabrics/layout.c
+++ b/sound/aoa/fabrics/layout.c
@@ -1073,10 +1073,10 @@ static int aoa_fabric_layout_probe(struct soundbus_dev *sdev)
        sdev->pcmid = -1;
        list_del(&ldev->list);
        layouts_list_items--;
+        kfree(ldev);
 outnodev:
        of_node_put(sound);
        layout_device = NULL;
-        kfree(ldev);
        return -ENODEV;
 }
diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c
index 200c9a1d48b7..a872d0a82976 100644
--- a/sound/pci/ac97/ac97_patch.c
+++ b/sound/pci/ac97/ac97_patch.c
@@ -1909,6 +1909,7 @@ static unsigned int ad1981_jacks_whitelist[] = {
        0x103c0944, /* HP nc6220 */
        0x103c0934, /* HP nc8220 */
        0x103c006d, /* HP nx9105 */
+        0x103c300d, /* HP Compaq dc5100 SFF(PT003AW) */
        0x17340088, /* FSC Scenic-W */
        0 /* end */
 };
diff --git a/sound/pci/hda/alc268_quirks.c b/sound/pci/hda/alc268_quirks.c
index be58bf2f3aec..2e5876ce71fe 100644
--- a/sound/pci/hda/alc268_quirks.c
+++ b/sound/pci/hda/alc268_quirks.c
@@ -476,8 +476,8 @@ static const struct snd_pci_quirk alc268_ssid_cfg_tbl[] = {
 static const struct alc_config_preset alc268_presets[] = {
        [ALC267_QUANTA_IL1] = {
-                .mixers = { alc267_quanta_il1_mixer, alc268_beep_mixer,
+                .mixers = { alc267_quanta_il1_mixer, alc268_beep_mixer },
-                            alc268_capture_nosrc_mixer },
+                .cap_mixer = alc268_capture_nosrc_mixer,
                .init_verbs = { alc268_base_init_verbs, alc268_eapd_verbs,
                                alc267_quanta_il1_verbs },
                .num_dacs = ARRAY_SIZE(alc268_dac_nids),
@@ -492,8 +492,8 @@ static const struct alc_config_preset alc268_presets[] = {
                .init_hook = alc_inithook,
        },
        [ALC268_3ST] = {
-                .mixers = { alc268_base_mixer, alc268_capture_alt_mixer,
+                .mixers = { alc268_base_mixer, alc268_beep_mixer },
-                            alc268_beep_mixer },
+                .cap_mixer = alc268_capture_alt_mixer,
                .init_verbs = { alc268_base_init_verbs },
                .num_dacs = ARRAY_SIZE(alc268_dac_nids),
                .dac_nids = alc268_dac_nids,
@@ -507,8 +507,8 @@ static const struct alc_config_preset alc268_presets[] = {
                .input_mux = &alc268_capture_source,
        },
        [ALC268_TOSHIBA] = {
-                .mixers = { alc268_toshiba_mixer, alc268_capture_alt_mixer,
+                .mixers = { alc268_toshiba_mixer, alc268_beep_mixer },
-                            alc268_beep_mixer },
+                .cap_mixer = alc268_capture_alt_mixer,
                .init_verbs = { alc268_base_init_verbs, alc268_eapd_verbs,
                                alc268_toshiba_verbs },
                .num_dacs = ARRAY_SIZE(alc268_dac_nids),
@@ -525,8 +525,8 @@ static const struct alc_config_preset alc268_presets[] = {
                .init_hook = alc_inithook,
        },
        [ALC268_ACER] = {
-                .mixers = { alc268_acer_mixer, alc268_capture_alt_mixer,
+                .mixers = { alc268_acer_mixer, alc268_beep_mixer },
-                            alc268_beep_mixer },
+                .cap_mixer = alc268_capture_alt_mixer,
                .init_verbs = { alc268_base_init_verbs, alc268_eapd_verbs,
                                alc268_acer_verbs },
                .num_dacs = ARRAY_SIZE(alc268_dac_nids),
@@ -543,8 +543,8 @@ static const struct alc_config_preset alc268_presets[] = {
                .init_hook = alc_inithook,
        },
        [ALC268_ACER_DMIC] = {
-                .mixers = { alc268_acer_dmic_mixer, alc268_capture_alt_mixer,
+                .mixers = { alc268_acer_dmic_mixer, alc268_beep_mixer },
-                            alc268_beep_mixer },
+                .cap_mixer = alc268_capture_alt_mixer,
                .init_verbs = { alc268_base_init_verbs, alc268_eapd_verbs,
                                alc268_acer_verbs },
                .num_dacs = ARRAY_SIZE(alc268_dac_nids),
@@ -561,9 +561,8 @@ static const struct alc_config_preset alc268_presets[] = {
                .init_hook = alc_inithook,
        },
        [ALC268_ACER_ASPIRE_ONE] = {
-                .mixers = { alc268_acer_aspire_one_mixer,
+                .mixers = { alc268_acer_aspire_one_mixer, alc268_beep_mixer},
-                            alc268_beep_mixer,
+                .cap_mixer = alc268_capture_nosrc_mixer,
-                            alc268_capture_nosrc_mixer },
                .init_verbs = { alc268_base_init_verbs, alc268_eapd_verbs,
                                alc268_acer_aspire_one_verbs },
                .num_dacs = ARRAY_SIZE(alc268_dac_nids),
@@ -579,8 +578,8 @@ static const struct alc_config_preset alc268_presets[] = {
                .init_hook = alc_inithook,
        },
        [ALC268_DELL] = {
-                .mixers = { alc268_dell_mixer, alc268_beep_mixer,
+                .mixers = { alc268_dell_mixer, alc268_beep_mixer},
-                            alc268_capture_nosrc_mixer },
+                .cap_mixer = alc268_capture_nosrc_mixer,
                .init_verbs = { alc268_base_init_verbs, alc268_eapd_verbs,
                                alc268_dell_verbs },
                .num_dacs = ARRAY_SIZE(alc268_dac_nids),
@@ -596,8 +595,8 @@ static const struct alc_config_preset alc268_presets[] = {
                .init_hook = alc_inithook,
        },
        [ALC268_ZEPTO] = {
-                .mixers = { alc268_base_mixer, alc268_capture_alt_mixer,
+                .mixers = { alc268_base_mixer, alc268_beep_mixer },
-                            alc268_beep_mixer },
+                .cap_mixer = alc268_capture_alt_mixer,
                .init_verbs = { alc268_base_init_verbs, alc268_eapd_verbs,
                                alc268_toshiba_verbs },
                .num_dacs = ARRAY_SIZE(alc268_dac_nids),
@@ -616,7 +615,8 @@ static const struct alc_config_preset alc268_presets[] = {
        },
 #ifdef CONFIG_SND_DEBUG
        [ALC268_TEST] = {
-                .mixers = { alc268_test_mixer, alc268_capture_mixer },
+                .mixers = { alc268_test_mixer },
+                .cap_mixer = alc268_capture_mixer,
                .init_verbs = { alc268_base_init_verbs, alc268_eapd_verbs,
                                alc268_volume_init_verbs,
                                alc268_beep_init_verbs },
diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
index 28ce17d09c33..c34f730f4815 100644
--- a/sound/pci/hda/hda_eld.c
+++ b/sound/pci/hda/hda_eld.c
@@ -144,25 +144,17 @@ static int cea_sampling_frequencies[8] = {
        SNDRV_PCM_RATE_192000,  /* 7: 192000Hz */
 };
-static unsigned char hdmi_get_eld_byte(struct hda_codec *codec, hda_nid_t nid,
+static unsigned int hdmi_get_eld_data(struct hda_codec *codec, hda_nid_t nid,
                                        int byte_index)
 {
        unsigned int val;
        val = snd_hda_codec_read(codec, nid, 0,
                                        AC_VERB_GET_HDMI_ELDD, byte_index);
 #ifdef BE_PARANOID
        printk(KERN_INFO "HDMI: ELD data byte %d: 0x%x\n", byte_index, val);
 #endif
+        return val;
-        if ((val & AC_ELDD_ELD_VALID) == 0) {
-                snd_printd(KERN_INFO "HDMI: invalid ELD data byte %d\n",
-                                                                byte_index);
-                val = 0;
-        }
-        return val & AC_ELDD_ELD_DATA;
 }
 #define GRAB_BITS(buf, byte, lowbit, bits)              \
@@ -344,11 +336,26 @@ int snd_hdmi_get_eld(struct hdmi_eld *eld,
        if (!buf)
                return -ENOMEM;
-        for (i = 0; i < size; i++)
+        for (i = 0; i < size; i++) {
-                buf[i] = hdmi_get_eld_byte(codec, nid, i);
+                unsigned int val = hdmi_get_eld_data(codec, nid, i);
+                if (!(val & AC_ELDD_ELD_VALID)) {
+                        if (!i) {
+                                snd_printd(KERN_INFO
+                                           "HDMI: invalid ELD data\n");
+                                ret = -EINVAL;
+                                goto error;
+                        }
+                        snd_printd(KERN_INFO
+                                  "HDMI: invalid ELD data byte %d\n", i);
+                        val = 0;
+                } else
+                        val &= AC_ELDD_ELD_DATA;
+                buf[i] = val;
+        }
        ret = hdmi_update_eld(eld, buf, size);
+error:
        kfree(buf);
        return ret;
 }
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index 47d6ffc9b5b5..d6c93d92b550 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -375,7 +375,7 @@ static int is_ext_mic(struct hda_codec *codec, unsigned int idx)
 static hda_nid_t get_adc(struct hda_codec *codec, hda_nid_t pin,
                         unsigned int *idxp)
 {
-        int i;
+        int i, idx;
        hda_nid_t nid;
        nid = codec->start_nid;
@@ -384,9 +384,11 @@ static hda_nid_t get_adc(struct hda_codec *codec, hda_nid_t pin,
                type = get_wcaps_type(get_wcaps(codec, nid));
                if (type != AC_WID_AUD_IN)
                        continue;
-                *idxp = snd_hda_get_conn_index(codec, nid, pin, false);
+                idx = snd_hda_get_conn_index(codec, nid, pin, false);
-                if (*idxp >= 0)
+                if (idx >= 0) {
+                        *idxp = idx;
                        return nid;
+                }
        }
        return 0;
 }
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 502fc9499453..7696d05b9356 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3348,6 +3348,8 @@ static hda_nid_t get_unassigned_dac(struct hda_codec *codec, hda_nid_t pin,
 #define MAX_AUTO_DACS   5
+#define DAC_SLAVE_FLAG  0x8000  /* filled dac is a slave */
 /* fill analog DAC list from the widget tree */
 static int fill_cx_auto_dacs(struct hda_codec *codec, hda_nid_t *dacs)
 {
@@ -3370,16 +3372,26 @@ static int fill_cx_auto_dacs(struct hda_codec *codec, hda_nid_t *dacs)
 /* fill pin_dac_pair list from the pin and dac list */
 static int fill_dacs_for_pins(struct hda_codec *codec, hda_nid_t *pins,
                              int num_pins, hda_nid_t *dacs, int *rest,
-                              struct pin_dac_pair *filled, int type)
+                              struct pin_dac_pair *filled, int nums, 
+                              int type)
 {
-        int i, nums;
+        int i, start = nums;
-        nums = 0;
+        for (i = 0; i < num_pins; i++, nums++) {
-        for (i = 0; i < num_pins; i++) {
                filled[nums].pin = pins[i];
                filled[nums].type = type;
                filled[nums].dac = get_unassigned_dac(codec, pins[i], dacs, rest);
-                nums++;
+                if (filled[nums].dac) 
+                        continue;
+                if (filled[start].dac && get_connection_index(codec, pins[i], filled[start].dac) >= 0) {
+                        filled[nums].dac = filled[start].dac | DAC_SLAVE_FLAG;
+                        continue;
+                }
+                if (filled[0].dac && get_connection_index(codec, pins[i], filled[0].dac) >= 0) {
+                        filled[nums].dac = filled[0].dac | DAC_SLAVE_FLAG;
+                        continue;
+                }
+                snd_printdd("Failed to find a DAC for pin 0x%x", pins[i]);
        }
        return nums;
 }
@@ -3395,19 +3407,19 @@ static void cx_auto_parse_output(struct hda_codec *codec)
        rest = fill_cx_auto_dacs(codec, dacs);
        /* parse all analog output pins */
        nums = fill_dacs_for_pins(codec, cfg->line_out_pins, cfg->line_outs,
-                                  dacs, &rest, spec->dac_info,
+                          dacs, &rest, spec->dac_info, 0,
-                                  AUTO_PIN_LINE_OUT);
+                          AUTO_PIN_LINE_OUT);
-        nums += fill_dacs_for_pins(codec, cfg->hp_pins, cfg->hp_outs,
+        nums = fill_dacs_for_pins(codec, cfg->hp_pins, cfg->hp_outs,
-                                  dacs, &rest, spec->dac_info + nums,
+                          dacs, &rest, spec->dac_info, nums,
-                                  AUTO_PIN_HP_OUT);
+                          AUTO_PIN_HP_OUT);
-        nums += fill_dacs_for_pins(codec, cfg->speaker_pins, cfg->speaker_outs,
+        nums = fill_dacs_for_pins(codec, cfg->speaker_pins, cfg->speaker_outs,
-                                  dacs, &rest, spec->dac_info + nums,
+                          dacs, &rest, spec->dac_info, nums,
-                                  AUTO_PIN_SPEAKER_OUT);
+                          AUTO_PIN_SPEAKER_OUT);
        spec->dac_info_filled = nums;
        /* fill multiout struct */
        for (i = 0; i < nums; i++) {
                hda_nid_t dac = spec->dac_info[i].dac;
-                if (!dac)
+                if (!dac || (dac & DAC_SLAVE_FLAG))
                        continue;
                switch (spec->dac_info[i].type) {
                case AUTO_PIN_LINE_OUT:
@@ -3862,7 +3874,7 @@ static void cx_auto_parse_input(struct hda_codec *codec)
        }
        if (imux->num_items >= 2 && cfg->num_inputs == imux->num_items)
                cx_auto_check_auto_mic(codec);
-        if (imux->num_items > 1 && !spec->auto_mic) {
+        if (imux->num_items > 1) {
                for (i = 1; i < imux->num_items; i++) {
                        if (spec->imux_info[i].adc != spec->imux_info[0].adc) {
                                spec->adc_switching = 1;
@@ -4035,6 +4047,8 @@ static void cx_auto_init_output(struct hda_codec *codec)
                nid = spec->dac_info[i].dac;
                if (!nid)
                        nid = spec->multiout.dac_nids[0];
+                else if (nid & DAC_SLAVE_FLAG)
+                        nid &= ~DAC_SLAVE_FLAG;
                select_connection(codec, spec->dac_info[i].pin, nid);
        }
        if (spec->auto_mute) {
@@ -4167,9 +4181,11 @@ static int try_add_pb_volume(struct hda_codec *codec, hda_nid_t dac,
                             hda_nid_t pin, const char *name, int idx)
 {
        unsigned int caps;
-        caps = query_amp_caps(codec, dac, HDA_OUTPUT);
+        if (dac && !(dac & DAC_SLAVE_FLAG)) {
-        if (caps & AC_AMPCAP_NUM_STEPS)
+                caps = query_amp_caps(codec, dac, HDA_OUTPUT);
-                return cx_auto_add_pb_volume(codec, dac, name, idx);
+                if (caps & AC_AMPCAP_NUM_STEPS)
+                        return cx_auto_add_pb_volume(codec, dac, name, idx);
+        }
        caps = query_amp_caps(codec, pin, HDA_OUTPUT);
        if (caps & AC_AMPCAP_NUM_STEPS)
                return cx_auto_add_pb_volume(codec, pin, name, idx);
@@ -4191,8 +4207,7 @@ static int cx_auto_build_output_controls(struct hda_codec *codec)
        for (i = 0; i < spec->dac_info_filled; i++) {
                const char *label;
                int idx, type;
-                if (!spec->dac_info[i].dac)
+                hda_nid_t dac = spec->dac_info[i].dac;
-                        continue;
                type = spec->dac_info[i].type;
                if (type == AUTO_PIN_LINE_OUT)
                        type = spec->autocfg.line_out_type;
@@ -4211,7 +4226,7 @@ static int cx_auto_build_output_controls(struct hda_codec *codec)
                        idx = num_spk++;
                        break;
                }
-                err = try_add_pb_volume(codec, spec->dac_info[i].dac,
+                err = try_add_pb_volume(codec, dac,
                                        spec->dac_info[i].pin,
                                        label, idx);
                if (err < 0)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 9a1aa09f47fe..7cabd7317163 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -565,11 +565,11 @@ static void alc_hp_automute(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        if (!spec->automute)
-                return;
        spec->jack_present =
                detect_jacks(codec, ARRAY_SIZE(spec->autocfg.hp_pins),
                             spec->autocfg.hp_pins);
+        if (!spec->automute)
+                return;
        update_speakers(codec);
 }
@@ -578,11 +578,11 @@ static void alc_line_automute(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        if (!spec->automute || !spec->detect_line)
-                return;
        spec->line_jack_present =
                detect_jacks(codec, ARRAY_SIZE(spec->autocfg.line_out_pins),
                             spec->autocfg.line_out_pins);
+        if (!spec->automute || !spec->detect_line)
+                return;
        update_speakers(codec);
 }
@@ -1784,6 +1784,7 @@ static const char * const alc_slave_vols[] = {
        "Speaker Playback Volume",
        "Mono Playback Volume",
        "Line-Out Playback Volume",
+        "PCM Playback Volume",
        NULL,
 };
@@ -1798,6 +1799,7 @@ static const char * const alc_slave_sws[] = {
        "Mono Playback Switch",
        "IEC958 Playback Switch",
        "Line-Out Playback Switch",
+        "PCM Playback Switch",
        NULL,
 };
@@ -3081,16 +3083,22 @@ static void alc_auto_init_multi_out(struct hda_codec *codec)
 static void alc_auto_init_extra_out(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
-        hda_nid_t pin;
+        hda_nid_t pin, dac;
        pin = spec->autocfg.hp_pins[0];
-        if (pin)
+        if (pin) {
-                alc_auto_set_output_and_unmute(codec, pin, PIN_HP,
+                dac = spec->multiout.hp_nid;
-                                                  spec->multiout.hp_nid);
+                if (!dac)
+                        dac = spec->multiout.dac_nids[0];
+                alc_auto_set_output_and_unmute(codec, pin, PIN_HP, dac);
+        }
        pin = spec->autocfg.speaker_pins[0];
-        if (pin)
+        if (pin) {
-                alc_auto_set_output_and_unmute(codec, pin, PIN_OUT,
+                dac = spec->multiout.extra_out_nid[0];
-                                        spec->multiout.extra_out_nid[0]);
+                if (!dac)
+                        dac = spec->multiout.dac_nids[0];
+                alc_auto_set_output_and_unmute(codec, pin, PIN_OUT, dac);
+        }
 }
 /*
diff --git a/sound/soc/blackfin/bf5xx-ad193x.c b/sound/soc/blackfin/bf5xx-ad193x.c
index d6651c033cb7..a118a0fb9d81 100644
--- a/sound/soc/blackfin/bf5xx-ad193x.c
+++ b/sound/soc/blackfin/bf5xx-ad193x.c
@@ -56,7 +56,7 @@ static int bf5xx_ad193x_hw_params(struct snd_pcm_substream *substream,
        switch (params_rate(params)) {
        case 48000:
-                clk = 12288000;
+                clk = 24576000;
                break;
        }
diff --git a/sound/soc/codecs/ad193x.c b/sound/soc/codecs/ad193x.c
index 2374ca5ffe68..eedb6f5e5823 100644
--- a/sound/soc/codecs/ad193x.c
+++ b/sound/soc/codecs/ad193x.c
@@ -27,11 +27,6 @@ struct ad193x_priv {
        int sysclk;
 };
-/* ad193x register cache & default register settings */
-static const u8 ad193x_reg[AD193X_NUM_REGS] = {
-        0, 0, 0, 0, 0, 0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0, 0, 0,
-};
 /*
 * AD193X volume/mute/de-emphasis etc. controls
 */
@@ -307,7 +302,8 @@ static int ad193x_hw_params(struct snd_pcm_substream *substream,
        snd_soc_write(codec, AD193X_PLL_CLK_CTRL0, reg);
        reg = snd_soc_read(codec, AD193X_DAC_CTRL2);
-        reg = (reg & (~AD193X_DAC_WORD_LEN_MASK)) | word_len;
+        reg = (reg & (~AD193X_DAC_WORD_LEN_MASK))
+                | (word_len << AD193X_DAC_WORD_LEN_SHFT);
        snd_soc_write(codec, AD193X_DAC_CTRL2, reg);
        reg = snd_soc_read(codec, AD193X_ADC_CTRL1);
@@ -389,9 +385,6 @@ static int ad193x_probe(struct snd_soc_codec *codec)
 static struct snd_soc_codec_driver soc_codec_dev_ad193x = {
        .probe =        ad193x_probe,
-        .reg_cache_default = ad193x_reg,
-        .reg_cache_size = AD193X_NUM_REGS,
-        .reg_word_size = sizeof(u16),
 };
 #if defined(CONFIG_SPI_MASTER)
diff --git a/sound/soc/codecs/ad193x.h b/sound/soc/codecs/ad193x.h
index 9747b5497877..cccc2e8e5fbd 100644
--- a/sound/soc/codecs/ad193x.h
+++ b/sound/soc/codecs/ad193x.h
@@ -34,7 +34,8 @@
 #define AD193X_DAC_LEFT_HIGH    (1 << 3)
 #define AD193X_DAC_BCLK_INV     (1 << 7)
 #define AD193X_DAC_CTRL2        0x804
-#define AD193X_DAC_WORD_LEN_MASK        0xC
+#define AD193X_DAC_WORD_LEN_SHFT        3
+#define AD193X_DAC_WORD_LEN_MASK        0x18
 #define AD193X_DAC_MASTER_MUTE  1
 #define AD193X_DAC_CHNL_MUTE    0x805
 #define AD193X_DACL1_MUTE       0
@@ -63,7 +64,7 @@
 #define AD193X_ADC_CTRL1        0x80f
 #define AD193X_ADC_SERFMT_MASK          0x60
 #define AD193X_ADC_SERFMT_STEREO        (0 << 5)
-#define AD193X_ADC_SERFMT_TDM           (1 << 2)
+#define AD193X_ADC_SERFMT_TDM           (1 << 5)
 #define AD193X_ADC_SERFMT_AUX           (2 << 5)
 #define AD193X_ADC_WORD_LEN_MASK        0x3
 #define AD193X_ADC_CTRL2        0x810
diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
index 409d89d1f34c..fbd7eb9e61ce 100644
--- a/sound/soc/codecs/sta32x.c
+++ b/sound/soc/codecs/sta32x.c
@@ -857,6 +857,7 @@ static __devinit int sta32x_i2c_probe(struct i2c_client *i2c,
        ret = snd_soc_register_codec(&i2c->dev, &sta32x_codec, &sta32x_dai, 1);
        if (ret != 0) {
                dev_err(&i2c->dev, "Failed to register codec (%d)\n", ret);
+                kfree(sta32x);
                return ret;
        }
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 60d740ebeb5b..1725550c293e 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -2221,6 +2221,8 @@ static int sysclk_event(struct snd_soc_dapm_widget *w,
        switch (event) {
        case SND_SOC_DAPM_PRE_PMU:
                if (fll) {
+                        try_wait_for_completion(&wm8962->fll_lock);
                        snd_soc_update_bits(codec, WM8962_FLL_CONTROL_1,
                                            WM8962_FLL_ENA, WM8962_FLL_ENA);
                        if (wm8962->irq) {
@@ -2927,10 +2929,6 @@ static int wm8962_set_bias_level(struct snd_soc_codec *codec,
                                            WM8962_BIAS_ENA | 0x180);
                        msleep(5);
-                        snd_soc_update_bits(codec, WM8962_CLOCKING2,
-                                            WM8962_CLKREG_OVD,
-                                            WM8962_CLKREG_OVD);
                }
                /* VMID 2*250k */
@@ -3288,6 +3286,8 @@ static int wm8962_set_fll(struct snd_soc_codec *codec, int fll_id, int source,
        snd_soc_write(codec, WM8962_FLL_CONTROL_7, fll_div.lambda);
        snd_soc_write(codec, WM8962_FLL_CONTROL_8, fll_div.n);
+        try_wait_for_completion(&wm8962->fll_lock);
        snd_soc_update_bits(codec, WM8962_FLL_CONTROL_1,
                            WM8962_FLL_FRAC | WM8962_FLL_REFCLK_SRC_MASK |
                            WM8962_FLL_ENA, fll1);
@@ -3868,6 +3868,10 @@ static int wm8962_probe(struct snd_soc_codec *codec)
         */
        snd_soc_update_bits(codec, WM8962_CLOCKING2, WM8962_SYSCLK_ENA, 0);
+        /* Ensure we have soft control over all registers */
+        snd_soc_update_bits(codec, WM8962_CLOCKING2,
+                            WM8962_CLKREG_OVD, WM8962_CLKREG_OVD);
        regulator_bulk_disable(ARRAY_SIZE(wm8962->supplies), wm8962->supplies);
        if (pdata) {
diff --git a/sound/soc/codecs/wm8996.c b/sound/soc/codecs/wm8996.c
index ab8e9d1aaff0..0cdb9d105671 100644
--- a/sound/soc/codecs/wm8996.c
+++ b/sound/soc/codecs/wm8996.c
@@ -420,7 +420,7 @@ static const char *sidetone_hpf_text[] = {
 };
 static const struct soc_enum sidetone_hpf =
-        SOC_ENUM_SINGLE(WM8996_SIDETONE, 7, 6, sidetone_hpf_text);
+        SOC_ENUM_SINGLE(WM8996_SIDETONE, 7, 7, sidetone_hpf_text);
 static const char *hpf_mode_text[] = {
        "HiFi", "Custom", "Voice"
@@ -988,15 +988,10 @@ SND_SOC_DAPM_MICBIAS("MICB1", WM8996_POWER_MANAGEMENT_1, 8, 0),
 SND_SOC_DAPM_PGA("IN1L PGA", WM8996_POWER_MANAGEMENT_2, 5, 0, NULL, 0),
 SND_SOC_DAPM_PGA("IN1R PGA", WM8996_POWER_MANAGEMENT_2, 4, 0, NULL, 0),
-SND_SOC_DAPM_MUX("IN1L Mux", SND_SOC_NOPM, 0, 0, &in1_mux),
+SND_SOC_DAPM_MUX("IN1L Mux", WM8996_POWER_MANAGEMENT_7, 2, 0, &in1_mux),
-SND_SOC_DAPM_MUX("IN1R Mux", SND_SOC_NOPM, 0, 0, &in1_mux),
+SND_SOC_DAPM_MUX("IN1R Mux", WM8996_POWER_MANAGEMENT_7, 3, 0, &in1_mux),
-SND_SOC_DAPM_MUX("IN2L Mux", SND_SOC_NOPM, 0, 0, &in2_mux),
+SND_SOC_DAPM_MUX("IN2L Mux", WM8996_POWER_MANAGEMENT_7, 6, 0, &in2_mux),
-SND_SOC_DAPM_MUX("IN2R Mux", SND_SOC_NOPM, 0, 0, &in2_mux),
+SND_SOC_DAPM_MUX("IN2R Mux", WM8996_POWER_MANAGEMENT_7, 7, 0, &in2_mux),
-SND_SOC_DAPM_PGA("IN1L", WM8996_POWER_MANAGEMENT_7, 2, 0, NULL, 0),
-SND_SOC_DAPM_PGA("IN1R", WM8996_POWER_MANAGEMENT_7, 3, 0, NULL, 0),
-SND_SOC_DAPM_PGA("IN2L", WM8996_POWER_MANAGEMENT_7, 6, 0, NULL, 0),
-SND_SOC_DAPM_PGA("IN2R", WM8996_POWER_MANAGEMENT_7, 7, 0, NULL, 0),
 SND_SOC_DAPM_SUPPLY("DMIC2", WM8996_POWER_MANAGEMENT_7, 9, 0, NULL, 0),
 SND_SOC_DAPM_SUPPLY("DMIC1", WM8996_POWER_MANAGEMENT_7, 8, 0, NULL, 0),
@@ -1213,6 +1208,16 @@ static const struct snd_soc_dapm_route wm8996_dapm_routes[] = {
        { "AIF2RX0", NULL, "AIFCLK" },
        { "AIF2RX1", NULL, "AIFCLK" },
+        { "AIF1TX0", NULL, "AIFCLK" },
+        { "AIF1TX1", NULL, "AIFCLK" },
+        { "AIF1TX2", NULL, "AIFCLK" },
+        { "AIF1TX3", NULL, "AIFCLK" },
+        { "AIF1TX4", NULL, "AIFCLK" },
+        { "AIF1TX5", NULL, "AIFCLK" },
+        { "AIF2TX0", NULL, "AIFCLK" },
+        { "AIF2TX1", NULL, "AIFCLK" },
        { "DSP1RXL", NULL, "SYSDSPCLK" },
        { "DSP1RXR", NULL, "SYSDSPCLK" },
        { "DSP2RXL", NULL, "SYSDSPCLK" },
@@ -2106,6 +2111,9 @@ static int wm8996_set_fll(struct snd_soc_codec *codec, int fll_id, int source,
        snd_soc_write(codec, WM8996_FLL_EFS_1, fll_div.lambda);
+        /* Clear any pending completions (eg, from failed startups) */
+        try_wait_for_completion(&wm8996->fll_lock);
        snd_soc_update_bits(codec, WM8996_FLL_CONTROL_1,
                            WM8996_FLL_ENA, WM8996_FLL_ENA);
diff --git a/sound/soc/ep93xx/ep93xx-i2s.c b/sound/soc/ep93xx/ep93xx-i2s.c
index 56efa0c1c9a9..099614e16651 100644
--- a/sound/soc/ep93xx/ep93xx-i2s.c
+++ b/sound/soc/ep93xx/ep93xx-i2s.c
@@ -385,14 +385,14 @@ static int ep93xx_i2s_probe(struct platform_device *pdev)
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!res) {
                err = -ENODEV;
-                goto fail;
+                goto fail_free_info;
        }
        info->mem = request_mem_region(res->start, resource_size(res),
                                       pdev->name);
        if (!info->mem) {
                err = -EBUSY;
-                goto fail;
+                goto fail_free_info;
        }
        info->regs = ioremap(info->mem->start, resource_size(info->mem));
@@ -435,6 +435,7 @@ fail_unmap_mem:
        iounmap(info->regs);
 fail_release_mem:
        release_mem_region(info->mem->start, resource_size(info->mem));
+fail_free_info:
        kfree(info);
 fail:
        return err;
diff --git a/sound/soc/fsl/fsl_dma.c b/sound/soc/fsl/fsl_dma.c
index 732208c8c0b4..cb50598338e9 100644
--- a/sound/soc/fsl/fsl_dma.c
+++ b/sound/soc/fsl/fsl_dma.c
@@ -879,10 +879,12 @@ static struct device_node *find_ssi_node(struct device_node *dma_channel_np)
                 * assume that device_node pointers are a valid comparison.
                 */
                np = of_parse_phandle(ssi_np, "fsl,playback-dma", 0);
+                of_node_put(np);
                if (np == dma_channel_np)
                        return ssi_np;
                np = of_parse_phandle(ssi_np, "fsl,capture-dma", 0);
+                of_node_put(np);
                if (np == dma_channel_np)
                        return ssi_np;
        }
diff --git a/sound/soc/fsl/mpc8610_hpcd.c b/sound/soc/fsl/mpc8610_hpcd.c
index a19297959587..358f0baaf71b 100644
--- a/sound/soc/fsl/mpc8610_hpcd.c
+++ b/sound/soc/fsl/mpc8610_hpcd.c
@@ -345,8 +345,10 @@ static int mpc8610_hpcd_probe(struct platform_device *pdev)
        }
        machine_data = kzalloc(sizeof(struct mpc8610_hpcd_data), GFP_KERNEL);
-        if (!machine_data)
+        if (!machine_data) {
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto error_alloc;
+        }
        machine_data->dai[0].cpu_dai_name = dev_name(&ssi_pdev->dev);
        machine_data->dai[0].ops = &mpc8610_hpcd_ops;
@@ -494,7 +496,7 @@ static int mpc8610_hpcd_probe(struct platform_device *pdev)
        ret = platform_device_add(sound_device);
        if (ret) {
                dev_err(&pdev->dev, "platform device add failed\n");
-                goto error;
+                goto error_sound;
        }
        dev_set_drvdata(&pdev->dev, sound_device);
@@ -502,14 +504,12 @@ static int mpc8610_hpcd_probe(struct platform_device *pdev)
        return 0;
+error_sound:
+        platform_device_unregister(sound_device);
 error:
-        of_node_put(codec_np);
-        if (sound_device)
-                platform_device_unregister(sound_device);
        kfree(machine_data);
+error_alloc:
+        of_node_put(codec_np);
        return ret;
 }
diff --git a/sound/soc/fsl/p1022_ds.c b/sound/soc/fsl/p1022_ds.c
index 8fa4d5f8eda1..fcb862eb0c73 100644
--- a/sound/soc/fsl/p1022_ds.c
+++ b/sound/soc/fsl/p1022_ds.c
@@ -297,8 +297,10 @@ static int get_dma_channel(struct device_node *ssi_np,
         * dai->platform name should already point to an allocated buffer.
         */
        ret = of_address_to_resource(dma_channel_np, 0, &res);
-        if (ret)
+        if (ret) {
+                of_node_put(dma_channel_np);
                return ret;
+        }
        snprintf((char *)dai->platform_name, DAI_NAME_SIZE, "%llx.%s",
                 (unsigned long long) res.start, dma_channel_np->name);
diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
index a33fc51f363b..8f16cd37c2af 100644
--- a/sound/soc/kirkwood/kirkwood-i2s.c
+++ b/sound/soc/kirkwood/kirkwood-i2s.c
@@ -424,7 +424,7 @@ static __devinit int kirkwood_i2s_dev_probe(struct platform_device *pdev)
        if (!priv->mem) {
                dev_err(&pdev->dev, "request_mem_region failed\n");
                err = -EBUSY;
-                goto error;
+                goto error_alloc;
        }
        priv->io = ioremap(priv->mem->start, SZ_16K);
diff --git a/sound/soc/omap/ams-delta.c b/sound/soc/omap/ams-delta.c
index 30fe0d0efe1c..0aa475f92efa 100644
--- a/sound/soc/omap/ams-delta.c
+++ b/sound/soc/omap/ams-delta.c
@@ -514,7 +514,7 @@ static int ams_delta_cx20442_init(struct snd_soc_pcm_runtime *rtd)
        }
        /* Set codec bias level */
-        ams_delta_set_bias_level(card, SND_SOC_BIAS_STANDBY);
+        ams_delta_set_bias_level(card, dapm, SND_SOC_BIAS_STANDBY);
        /* Add hook switch - can be used to control the codec from userspace
         * even if line discipline fails */
@@ -649,7 +649,9 @@ static void __exit ams_delta_module_exit(void)
                        ams_delta_hook_switch_gpios);
        /* Keep modem power on */
-        ams_delta_set_bias_level(&ams_delta_audio_card, SND_SOC_BIAS_STANDBY);
+        ams_delta_set_bias_level(&ams_delta_audio_card,
+                                 &ams_delta_audio_card.rtd[0].codec->dapm,
+                                 SND_SOC_BIAS_STANDBY);
        platform_device_unregister(cx20442_platform_device);
        platform_device_unregister(ams_delta_audio_platform_device);
diff --git a/sound/soc/samsung/Kconfig b/sound/soc/samsung/Kconfig
index b99091fc34eb..65f980ef2870 100644
--- a/sound/soc/samsung/Kconfig
+++ b/sound/soc/samsung/Kconfig
@@ -185,6 +185,7 @@ config SND_SOC_SPEYSIDE
        select SND_SAMSUNG_I2S
        select SND_SOC_WM8996
        select SND_SOC_WM9081
+        select SND_SOC_WM1250_EV1
 config SND_SOC_SPEYSIDE_WM8962
        tristate "Audio support for Wolfson Speyside with WM8962"
diff --git a/sound/soc/samsung/h1940_uda1380.c b/sound/soc/samsung/h1940_uda1380.c
index 241f55d00660..c6c65892294e 100644
--- a/sound/soc/samsung/h1940_uda1380.c
+++ b/sound/soc/samsung/h1940_uda1380.c
@@ -13,6 +13,7 @@
 *
 */
+#include <linux/types.h>
 #include <linux/gpio.h>
 #include <sound/soc.h>
diff --git a/sound/soc/samsung/rx1950_uda1380.c b/sound/soc/samsung/rx1950_uda1380.c
index 1e574a5d440d..bc8c1676459f 100644
--- a/sound/soc/samsung/rx1950_uda1380.c
+++ b/sound/soc/samsung/rx1950_uda1380.c
@@ -17,6 +17,7 @@
 *
 */
+#include <linux/types.h>
 #include <linux/gpio.h>
 #include <sound/soc.h>
diff --git a/sound/soc/samsung/speyside_wm8962.c b/sound/soc/samsung/speyside_wm8962.c
index 0b9eb5f7ec4c..72535f2daaf2 100644
--- a/sound/soc/samsung/speyside_wm8962.c
+++ b/sound/soc/samsung/speyside_wm8962.c
@@ -23,6 +23,9 @@ static int speyside_wm8962_set_bias_level(struct snd_soc_card *card,
        struct snd_soc_dai *codec_dai = card->rtd[0].codec_dai;
        int ret;
+        if (dapm->dev != codec_dai->dev)
+                return 0;
        switch (level) {
        case SND_SOC_BIAS_PREPARE:
                if (dapm->bias_level == SND_SOC_BIAS_STANDBY) {
@@ -57,6 +60,9 @@ static int speyside_wm8962_set_bias_level_post(struct snd_soc_card *card,
        struct snd_soc_dai *codec_dai = card->rtd[0].codec_dai;
        int ret;
+        if (dapm->dev != codec_dai->dev)
+                return 0;
        switch (level) {
        case SND_SOC_BIAS_STANDBY:
                ret = snd_soc_dai_set_sysclk(codec_dai, WM8962_SYSCLK_MCLK,
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 83ad8ca27490..b085d8e87574 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1913,7 +1913,7 @@ struct snd_kcontrol *snd_soc_cnew(const struct snd_kcontrol_new *_template,
        if (prefix) {
                name_len = strlen(long_name) + strlen(prefix) + 2;
-                name = kmalloc(name_len, GFP_ATOMIC);
+                name = kmalloc(name_len, GFP_KERNEL);
                if (!name)
                        return NULL;
diff --git a/sound/soc/soc-io.c b/sound/soc/soc-io.c
index cca490c80589..a62f7dd4ba96 100644
--- a/sound/soc/soc-io.c
+++ b/sound/soc/soc-io.c
@@ -205,6 +205,25 @@ static unsigned int snd_soc_16_8_read_i2c(struct snd_soc_codec *codec,
 #define snd_soc_16_8_read_i2c NULL
 #endif
+#if defined(CONFIG_SPI_MASTER)
+static unsigned int snd_soc_16_8_read_spi(struct snd_soc_codec *codec,
+                                          unsigned int r)
+{
+        struct spi_device *spi = codec->control_data;
+        const u16 reg = cpu_to_be16(r | 0x100);
+        u8 data;
+        int ret;
+        ret = spi_write_then_read(spi, &reg, 2, &data, 1);
+        if (ret < 0)
+                return 0;
+        return data;
+}
+#else
+#define snd_soc_16_8_read_spi NULL
+#endif
 static int snd_soc_16_8_write(struct snd_soc_codec *codec, unsigned int reg,
                              unsigned int value)
 {
@@ -295,6 +314,7 @@ static struct {
        int (*write)(struct snd_soc_codec *codec, unsigned int, unsigned int);
        unsigned int (*read)(struct snd_soc_codec *, unsigned int);
        unsigned int (*i2c_read)(struct snd_soc_codec *, unsigned int);
+        unsigned int (*spi_read)(struct snd_soc_codec *, unsigned int);
 } io_types[] = {
        {
                .addr_bits = 4, .data_bits = 12,
@@ -318,6 +338,7 @@ static struct {
                .addr_bits = 16, .data_bits = 8,
                .write = snd_soc_16_8_write,
                .i2c_read = snd_soc_16_8_read_i2c,
+                .spi_read = snd_soc_16_8_read_spi,
        },
        {
                .addr_bits = 16, .data_bits = 16,
@@ -383,6 +404,8 @@ int snd_soc_codec_set_cache_io(struct snd_soc_codec *codec,
 #ifdef CONFIG_SPI_MASTER
                codec->hw_write = do_spi_write;
 #endif
+                if (io_types[i].spi_read)
+                        codec->hw_read = io_types[i].spi_read;
                codec->control_data = container_of(codec->dev,
                                                   struct spi_device,
diff --git a/sound/soc/soc-jack.c b/sound/soc/soc-jack.c
index 7c17b98d5846..38b00131b2fe 100644
--- a/sound/soc/soc-jack.c
+++ b/sound/soc/soc-jack.c
@@ -327,7 +327,7 @@ int snd_soc_jack_add_gpios(struct snd_soc_jack *jack, int count,
                                              IRQF_TRIGGER_FALLING,
                                              gpios[i].name,
                                              &gpios[i]);
-                if (ret)
+                if (ret < 0)
                        goto err;
                if (gpios[i].wake) {
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index b5759397afa3..2879c883eebc 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -290,6 +290,9 @@ static int soc_pcm_close(struct snd_pcm_substream *substream)
        codec_dai->active--;
        codec->active--;
+        if (!cpu_dai->active && !codec_dai->active)
+                rtd->rate = 0;
        /* Muting the DAC suppresses artifacts caused during digital
         * shutdown, for example from stopping clocks.
         */
diff --git a/sound/soc/tegra/tegra_wm8903.c b/sound/soc/tegra/tegra_wm8903.c
index 661373c2352a..be27f1d229af 100644
--- a/sound/soc/tegra/tegra_wm8903.c
+++ b/sound/soc/tegra/tegra_wm8903.c
@@ -319,7 +319,7 @@ static int tegra_wm8903_init(struct snd_soc_pcm_runtime *rtd)
        snd_soc_dapm_force_enable_pin(dapm, "Mic Bias");
        /* FIXME: Calculate automatically based on DAPM routes? */
-        if (!machine_is_harmony() && !machine_is_ventana())
+        if (!machine_is_harmony())
                snd_soc_dapm_nc_pin(dapm, "IN1L");
        if (!machine_is_seaboard() && !machine_is_aebl())
                snd_soc_dapm_nc_pin(dapm, "IN1R");
@@ -395,7 +395,7 @@ static __devinit int tegra_wm8903_driver_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, card);
        snd_soc_card_set_drvdata(card, machine);
-        if (machine_is_harmony() || machine_is_ventana()) {
+        if (machine_is_harmony()) {
                card->dapm_routes = harmony_audio_map;
                card->num_dapm_routes = ARRAY_SIZE(harmony_audio_map);
        } else if (machine_is_seaboard()) {
diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
index aa52b3e13bb5..2cf87f5afed4 100644
--- a/sound/usb/caiaq/audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -139,8 +139,12 @@ static void stream_stop(struct snd_usb_caiaqdev *dev)
        for (i = 0; i < N_URBS; i++) {
                usb_kill_urb(dev->data_urbs_in[i]);
-                usb_kill_urb(dev->data_urbs_out[i]);
+                if (test_bit(i, &dev->outurb_active_mask))
+                        usb_kill_urb(dev->data_urbs_out[i]);
        }
+        dev->outurb_active_mask = 0;
 }
 static int snd_usb_caiaq_substream_open(struct snd_pcm_substream *substream)
@@ -612,8 +616,8 @@ static void read_completed(struct urb *urb)
 {
        struct snd_usb_caiaq_cb_info *info = urb->context;
        struct snd_usb_caiaqdev *dev;
-        struct urb *out;
+        struct urb *out = NULL;
-        int frame, len, send_it = 0, outframe = 0;
+        int i, frame, len, send_it = 0, outframe = 0;
        size_t offset = 0;
        if (urb->status || !info)
@@ -624,7 +628,17 @@ static void read_completed(struct urb *urb)
        if (!dev->streaming)
                return;
-        out = dev->data_urbs_out[info->index];
+        /* find an unused output urb that is unused */
+        for (i = 0; i < N_URBS; i++)
+                if (test_and_set_bit(i, &dev->outurb_active_mask) == 0) {
+                        out = dev->data_urbs_out[i];
+                        break;
+                }
+        if (!out) {
+                log("Unable to find an output urb to use\n");
+                goto requeue;
+        }
        /* read the recently received packet and send back one which has
         * the same layout */
@@ -655,8 +669,12 @@ static void read_completed(struct urb *urb)
                out->number_of_packets = outframe;
                out->transfer_flags = URB_ISO_ASAP;
                usb_submit_urb(out, GFP_ATOMIC);
+        } else {
+                struct snd_usb_caiaq_cb_info *oinfo = out->context;
+                clear_bit(oinfo->index, &dev->outurb_active_mask);
        }
+requeue:
        /* re-submit inbound urb */
        for (frame = 0; frame < FRAMES_PER_URB; frame++) {
                urb->iso_frame_desc[frame].offset = BYTES_PER_FRAME * frame;
@@ -678,6 +696,8 @@ static void write_completed(struct urb *urb)
                dev->output_running = 1;
                wake_up(&dev->prepare_wait_queue);
        }
+        clear_bit(info->index, &dev->outurb_active_mask);
 }
 static struct urb **alloc_urbs(struct snd_usb_caiaqdev *dev, int dir, int *ret)
@@ -829,6 +849,9 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *dev)
        if (!dev->data_cb_info)
                return -ENOMEM;
+        dev->outurb_active_mask = 0;
+        BUILD_BUG_ON(N_URBS > (sizeof(dev->outurb_active_mask) * 8));
        for (i = 0; i < N_URBS; i++) {
                dev->data_cb_info[i].dev = dev;
                dev->data_cb_info[i].index = i;
diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h
index b2b310194ffa..3f9c6339ae90 100644
--- a/sound/usb/caiaq/device.h
+++ b/sound/usb/caiaq/device.h
@@ -96,6 +96,7 @@ struct snd_usb_caiaqdev {
        int input_panic, output_panic, warned;
        char *audio_in_buf, *audio_out_buf;
        unsigned int samplerates, bpp;
+        unsigned long outurb_active_mask;
        struct snd_pcm_substream *sub_playback[MAX_STREAMS];
        struct snd_pcm_substream *sub_capture[MAX_STREAMS];
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index c04d7c71ac88..cdd19d7fe500 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -152,6 +152,7 @@ static inline void check_mapped_dB(const struct usbmix_name_map *p,
        if (p && p->dB) {
                cval->dBmin = p->dB->min;
                cval->dBmax = p->dB->max;
+                cval->initialized = 1;
        }
 }
@@ -1092,7 +1093,7 @@ static void build_feature_ctl(struct mixer_build *state, void *raw_desc,
                                " Switch" : " Volume");
                if (control == UAC_FU_VOLUME) {
                        check_mapped_dB(map, cval);
-                        if (cval->dBmin < cval->dBmax) {
+                        if (cval->dBmin < cval->dBmax || !cval->initialized) {
                                kctl->tlv.c = mixer_vol_tlv;
                                kctl->vd[0].access |= 
                                        SNDRV_CTL_ELEM_ACCESS_TLV_READ |
diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c
index 5f2a5c7046df..710ae3d0a489 100644
--- a/tools/perf/builtin-probe.c
+++ b/tools/perf/builtin-probe.c
@@ -134,10 +134,18 @@ static int opt_show_lines(const struct option *opt __used,
 {
        int ret = 0;
-        if (str)
+        if (!str)
-                ret = parse_line_range_desc(str, &params.line_range);
+                return 0;
-        INIT_LIST_HEAD(&params.line_range.line_list);
+        if (params.show_lines) {
+                pr_warning("Warning: more than one --line options are"
+                           " detected. Only the first one is valid.\n");
+                return 0;
+        }
        params.show_lines = true;
+        ret = parse_line_range_desc(str, &params.line_range);
+        INIT_LIST_HEAD(&params.line_range.line_list);
        return ret;
 }
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index f6426b496f4a..6b0519f885e4 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -45,7 +45,7 @@ static int			freq				=   1000;
 static int                      output;
 static int                      pipe_output                     =      0;
 static const char               *output_name                    = NULL;
-static int                      group                           =      0;
+static bool                     group                           =  false;
 static int                      realtime_prio                   =      0;
 static bool                     nodelay                         =  false;
 static bool                     raw_samples                     =  false;
@@ -753,6 +753,8 @@ const struct option record_options[] = {
                    "child tasks do not inherit counters"),
        OPT_UINTEGER('F', "freq", &user_freq, "profile at this frequency"),
        OPT_UINTEGER('m', "mmap-pages", &mmap_pages, "number of mmap data pages"),
+        OPT_BOOLEAN(0, "group", &group,
+                    "put the counters into a counter group"),
        OPT_BOOLEAN('g', "call-graph", &call_graph,
                    "do call-graph (stack chain/backtrace) recording"),
        OPT_INCR('v', "verbose", &verbose,
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 1ad04ce29c34..5deb17d9e795 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -193,6 +193,7 @@ static int			big_num_opt			=  -1;
 static const char               *cpu_list;
 static const char               *csv_sep                        = NULL;
 static bool                     csv_output                      = false;
+static bool                     group                           = false;
 static volatile int done = 0;
@@ -280,14 +281,14 @@ static int create_perf_stat_counter(struct perf_evsel *evsel)
        attr->inherit = !no_inherit;
        if (system_wide)
-                return perf_evsel__open_per_cpu(evsel, evsel_list->cpus, false);
+                return perf_evsel__open_per_cpu(evsel, evsel_list->cpus, group);
        if (target_pid == -1 && target_tid == -1) {
                attr->disabled = 1;
                attr->enable_on_exec = 1;
        }
-        return perf_evsel__open_per_thread(evsel, evsel_list->threads, false);
+        return perf_evsel__open_per_thread(evsel, evsel_list->threads, group);
 }
 /*
@@ -1043,6 +1044,8 @@ static const struct option options[] = {
                    "stat events on existing thread id"),
        OPT_BOOLEAN('a', "all-cpus", &system_wide,
                    "system-wide collection from all CPUs"),
+        OPT_BOOLEAN('g', "group", &group,
+                    "put the counters into a counter group"),
        OPT_BOOLEAN('c', "scale", &scale,
                    "scale/normalize counters"),
        OPT_INCR('v', "verbose", &verbose,
diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
index fddf40f30d3e..ee51e9b4dc09 100644
--- a/tools/perf/util/dwarf-aux.c
+++ b/tools/perf/util/dwarf-aux.c
@@ -96,6 +96,39 @@ int cu_find_lineinfo(Dwarf_Die *cu_die, unsigned long addr,
        return *lineno ?: -ENOENT;
 }
+static int __die_find_inline_cb(Dwarf_Die *die_mem, void *data);
+/**
+ * cu_walk_functions_at - Walk on function DIEs at given address
+ * @cu_die: A CU DIE
+ * @addr: An address
+ * @callback: A callback which called with found DIEs
+ * @data: A user data
+ *
+ * Walk on function DIEs at given @addr in @cu_die. Passed DIEs
+ * should be subprogram or inlined-subroutines.
+ */
+int cu_walk_functions_at(Dwarf_Die *cu_die, Dwarf_Addr addr,
+                    int (*callback)(Dwarf_Die *, void *), void *data)
+{
+        Dwarf_Die die_mem;
+        Dwarf_Die *sc_die;
+        int ret = -ENOENT;
+        /* Inlined function could be recursive. Trace it until fail */
+        for (sc_die = die_find_realfunc(cu_die, addr, &die_mem);
+             sc_die != NULL;
+             sc_die = die_find_child(sc_die, __die_find_inline_cb, &addr,
+                                     &die_mem)) {
+                ret = callback(sc_die, data);
+                if (ret)
+                        break;
+        }
+        return ret;
+}
 /**
 * die_compare_name - Compare diename and tname
 * @dw_die: a DIE
@@ -198,6 +231,19 @@ static int die_get_attr_udata(Dwarf_Die *tp_die, unsigned int attr_name,
        return 0;
 }
+/* Get attribute and translate it as a sdata */
+static int die_get_attr_sdata(Dwarf_Die *tp_die, unsigned int attr_name,
+                              Dwarf_Sword *result)
+{
+        Dwarf_Attribute attr;
+        if (dwarf_attr(tp_die, attr_name, &attr) == NULL ||
+            dwarf_formsdata(&attr, result) != 0)
+                return -ENOENT;
+        return 0;
+}
 /**
 * die_is_signed_type - Check whether a type DIE is signed or not
 * @tp_die: a DIE of a type
@@ -250,6 +296,50 @@ int die_get_data_member_location(Dwarf_Die *mb_die, Dwarf_Word *offs)
        return 0;
 }
+/* Get the call file index number in CU DIE */
+static int die_get_call_fileno(Dwarf_Die *in_die)
+{
+        Dwarf_Sword idx;
+        if (die_get_attr_sdata(in_die, DW_AT_call_file, &idx) == 0)
+                return (int)idx;
+        else
+                return -ENOENT;
+}
+/* Get the declared file index number in CU DIE */
+static int die_get_decl_fileno(Dwarf_Die *pdie)
+{
+        Dwarf_Sword idx;
+        if (die_get_attr_sdata(pdie, DW_AT_decl_file, &idx) == 0)
+                return (int)idx;
+        else
+                return -ENOENT;
+}
+/**
+ * die_get_call_file - Get callsite file name of inlined function instance
+ * @in_die: a DIE of an inlined function instance
+ *
+ * Get call-site file name of @in_die. This means from which file the inline
+ * function is called.
+ */
+const char *die_get_call_file(Dwarf_Die *in_die)
+{
+        Dwarf_Die cu_die;
+        Dwarf_Files *files;
+        int idx;
+        idx = die_get_call_fileno(in_die);
+        if (idx < 0 || !dwarf_diecu(in_die, &cu_die, NULL, NULL) ||
+            dwarf_getsrcfiles(&cu_die, &files, NULL) != 0)
+                return NULL;
+        return dwarf_filesrc(files, idx, NULL, NULL);
+}
 /**
 * die_find_child - Generic DIE search function in DIE tree
 * @rt_die: a root DIE
@@ -374,9 +464,78 @@ Dwarf_Die *die_find_inlinefunc(Dwarf_Die *sp_die, Dwarf_Addr addr,
        return die_mem;
 }
+struct __instance_walk_param {
+        void    *addr;
+        int     (*callback)(Dwarf_Die *, void *);
+        void    *data;
+        int     retval;
+};
+static int __die_walk_instances_cb(Dwarf_Die *inst, void *data)
+{
+        struct __instance_walk_param *iwp = data;
+        Dwarf_Attribute attr_mem;
+        Dwarf_Die origin_mem;
+        Dwarf_Attribute *attr;
+        Dwarf_Die *origin;
+        int tmp;
+        attr = dwarf_attr(inst, DW_AT_abstract_origin, &attr_mem);
+        if (attr == NULL)
+                return DIE_FIND_CB_CONTINUE;
+        origin = dwarf_formref_die(attr, &origin_mem);
+        if (origin == NULL || origin->addr != iwp->addr)
+                return DIE_FIND_CB_CONTINUE;
+        /* Ignore redundant instances */
+        if (dwarf_tag(inst) == DW_TAG_inlined_subroutine) {
+                dwarf_decl_line(origin, &tmp);
+                if (die_get_call_lineno(inst) == tmp) {
+                        tmp = die_get_decl_fileno(origin);
+                        if (die_get_call_fileno(inst) == tmp)
+                                return DIE_FIND_CB_CONTINUE;
+                }
+        }
+        iwp->retval = iwp->callback(inst, iwp->data);
+        return (iwp->retval) ? DIE_FIND_CB_END : DIE_FIND_CB_CONTINUE;
+}
+/**
+ * die_walk_instances - Walk on instances of given DIE
+ * @or_die: an abstract original DIE
+ * @callback: a callback function which is called with instance DIE
+ * @data: user data
+ *
+ * Walk on the instances of give @in_die. @in_die must be an inlined function
+ * declartion. This returns the return value of @callback if it returns
+ * non-zero value, or -ENOENT if there is no instance.
+ */
+int die_walk_instances(Dwarf_Die *or_die, int (*callback)(Dwarf_Die *, void *),
+                       void *data)
+{
+        Dwarf_Die cu_die;
+        Dwarf_Die die_mem;
+        struct __instance_walk_param iwp = {
+                .addr = or_die->addr,
+                .callback = callback,
+                .data = data,
+                .retval = -ENOENT,
+        };
+        if (dwarf_diecu(or_die, &cu_die, NULL, NULL) == NULL)
+                return -ENOENT;
+        die_find_child(&cu_die, __die_walk_instances_cb, &iwp, &die_mem);
+        return iwp.retval;
+}
 /* Line walker internal parameters */
 struct __line_walk_param {
-        const char *fname;
+        bool recursive;
        line_walk_callback_t callback;
        void *data;
        int retval;
@@ -385,39 +544,56 @@ struct __line_walk_param {
 static int __die_walk_funclines_cb(Dwarf_Die *in_die, void *data)
 {
        struct __line_walk_param *lw = data;
-        Dwarf_Addr addr;
+        Dwarf_Addr addr = 0;
+        const char *fname;
        int lineno;
        if (dwarf_tag(in_die) == DW_TAG_inlined_subroutine) {
+                fname = die_get_call_file(in_die);
                lineno = die_get_call_lineno(in_die);
-                if (lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) {
+                if (fname && lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) {
-                        lw->retval = lw->callback(lw->fname, lineno, addr,
+                        lw->retval = lw->callback(fname, lineno, addr, lw->data);
-                                                  lw->data);
                        if (lw->retval != 0)
                                return DIE_FIND_CB_END;
                }
        }
-        return DIE_FIND_CB_SIBLING;
+        if (!lw->recursive)
+                /* Don't need to search recursively */
+                return DIE_FIND_CB_SIBLING;
+        if (addr) {
+                fname = dwarf_decl_file(in_die);
+                if (fname && dwarf_decl_line(in_die, &lineno) == 0) {
+                        lw->retval = lw->callback(fname, lineno, addr, lw->data);
+                        if (lw->retval != 0)
+                                return DIE_FIND_CB_END;
+                }
+        }
+        /* Continue to search nested inlined function call-sites */
+        return DIE_FIND_CB_CONTINUE;
 }
 /* Walk on lines of blocks included in given DIE */
-static int __die_walk_funclines(Dwarf_Die *sp_die,
+static int __die_walk_funclines(Dwarf_Die *sp_die, bool recursive,
                                line_walk_callback_t callback, void *data)
 {
        struct __line_walk_param lw = {
+                .recursive = recursive,
                .callback = callback,
                .data = data,
                .retval = 0,
        };
        Dwarf_Die die_mem;
        Dwarf_Addr addr;
+        const char *fname;
        int lineno;
        /* Handle function declaration line */
-        lw.fname = dwarf_decl_file(sp_die);
+        fname = dwarf_decl_file(sp_die);
-        if (lw.fname && dwarf_decl_line(sp_die, &lineno) == 0 &&
+        if (fname && dwarf_decl_line(sp_die, &lineno) == 0 &&
            dwarf_entrypc(sp_die, &addr) == 0) {
-                lw.retval = callback(lw.fname, lineno, addr, data);
+                lw.retval = callback(fname, lineno, addr, data);
                if (lw.retval != 0)
                        goto done;
        }
@@ -430,7 +606,7 @@ static int __die_walk_culines_cb(Dwarf_Die *sp_die, void *data)
 {
        struct __line_walk_param *lw = data;
-        lw->retval = __die_walk_funclines(sp_die, lw->callback, lw->data);
+        lw->retval = __die_walk_funclines(sp_die, true, lw->callback, lw->data);
        if (lw->retval != 0)
                return DWARF_CB_ABORT;
@@ -439,7 +615,7 @@ static int __die_walk_culines_cb(Dwarf_Die *sp_die, void *data)
 /**
 * die_walk_lines - Walk on lines inside given DIE
- * @rt_die: a root DIE (CU or subprogram)
+ * @rt_die: a root DIE (CU, subprogram or inlined_subroutine)
 * @callback: callback routine
 * @data: user data
 *
@@ -460,12 +636,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
        size_t nlines, i;
        /* Get the CU die */
-        if (dwarf_tag(rt_die) == DW_TAG_subprogram)
+        if (dwarf_tag(rt_die) != DW_TAG_compile_unit)
                cu_die = dwarf_diecu(rt_die, &die_mem, NULL, NULL);
        else
                cu_die = rt_die;
        if (!cu_die) {
-                pr_debug2("Failed to get CU from subprogram\n");
+                pr_debug2("Failed to get CU from given DIE.\n");
                return -EINVAL;
        }
@@ -509,7 +685,11 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data)
         * subroutines. We have to check functions list or given function.
         */
        if (rt_die != cu_die)
-                ret = __die_walk_funclines(rt_die, callback, data);
+                /*
+                 * Don't need walk functions recursively, because nested
+                 * inlined functions don't have lines of the specified DIE.
+                 */
+                ret = __die_walk_funclines(rt_die, false, callback, data);
        else {
                struct __line_walk_param param = {
                        .callback = callback,
diff --git a/tools/perf/util/dwarf-aux.h b/tools/perf/util/dwarf-aux.h
index bc3b21167e70..6ce1717784b7 100644
--- a/tools/perf/util/dwarf-aux.h
+++ b/tools/perf/util/dwarf-aux.h
@@ -34,12 +34,19 @@ extern const char *cu_get_comp_dir(Dwarf_Die *cu_die);
 extern int cu_find_lineinfo(Dwarf_Die *cudie, unsigned long addr,
                            const char **fname, int *lineno);
+/* Walk on funcitons at given address */
+extern int cu_walk_functions_at(Dwarf_Die *cu_die, Dwarf_Addr addr,
+                        int (*callback)(Dwarf_Die *, void *), void *data);
 /* Compare diename and tname */
 extern bool die_compare_name(Dwarf_Die *dw_die, const char *tname);
 /* Get callsite line number of inline-function instance */
 extern int die_get_call_lineno(Dwarf_Die *in_die);
+/* Get callsite file name of inlined function instance */
+extern const char *die_get_call_file(Dwarf_Die *in_die);
 /* Get type die */
 extern Dwarf_Die *die_get_type(Dwarf_Die *vr_die, Dwarf_Die *die_mem);
@@ -73,6 +80,10 @@ extern Dwarf_Die *die_find_realfunc(Dwarf_Die *cu_die, Dwarf_Addr addr,
 extern Dwarf_Die *die_find_inlinefunc(Dwarf_Die *sp_die, Dwarf_Addr addr,
                                      Dwarf_Die *die_mem);
+/* Walk on the instances of given DIE */
+extern int die_walk_instances(Dwarf_Die *in_die,
+                              int (*callback)(Dwarf_Die *, void *), void *data);
 /* Walker on lines (Note: line number will not be sorted) */
 typedef int (* line_walk_callback_t) (const char *fname, int lineno,
                                      Dwarf_Addr addr, void *data);
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index e03e7bc8205e..c12bd476c6f7 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -85,10 +85,19 @@ int perf_evlist__add_default(struct perf_evlist *evlist)
        struct perf_evsel *evsel = perf_evsel__new(&attr, 0);
        if (evsel == NULL)
-                return -ENOMEM;
+                goto error;
+        /* use strdup() because free(evsel) assumes name is allocated */
+        evsel->name = strdup("cycles");
+        if (!evsel->name)
+                goto error_free;
        perf_evlist__add(evlist, evsel);
        return 0;
+error_free:
+        perf_evsel__delete(evsel);
+error:
+        return -ENOMEM;
 }
 void perf_evlist__disable(struct perf_evlist *evlist)
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index d4f3101773db..b6c1ad123ca9 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -726,7 +726,16 @@ static int perf_header__read_build_ids_abi_quirk(struct perf_header *header,
                        return -1;
                bev.header = old_bev.header;
-                bev.pid    = 0;
+                /*
+                 * As the pid is the missing value, we need to fill
+                 * it properly. The header.misc value give us nice hint.
+                 */
+                bev.pid = HOST_KERNEL_ID;
+                if (bev.header.misc == PERF_RECORD_MISC_GUEST_USER ||
+                    bev.header.misc == PERF_RECORD_MISC_GUEST_KERNEL)
+                        bev.pid = DEFAULT_GUEST_KERNEL_ID;
                memcpy(bev.build_id, old_bev.build_id, sizeof(bev.build_id));
                __event_process_build_id(&bev, filename, session);
diff --git a/tools/perf/util/include/linux/compiler.h b/tools/perf/util/include/linux/compiler.h
index 791f9dd27ebf..547628e97f3d 100644
--- a/tools/perf/util/include/linux/compiler.h
+++ b/tools/perf/util/include/linux/compiler.h
@@ -5,7 +5,9 @@
 #define __always_inline inline
 #endif
 #define __user
+#ifndef __attribute_const__
 #define __attribute_const__
+#endif
 #define __used          __attribute__((__unused__))
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 4ea7e19f5251..928918b796b2 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -697,7 +697,11 @@ parse_raw_event(const char **strp, struct perf_event_attr *attr)
                return EVT_FAILED;
        n = hex2u64(str + 1, &config);
        if (n > 0) {
-                *strp = str + n + 1;
+                const char *end = str + n + 1;
+                if (*end != '\0' && *end != ',' && *end != ':')
+                        return EVT_FAILED;
+                *strp = end;
                attr->type = PERF_TYPE_RAW;
                attr->config = config;
                return EVT_HANDLED;
@@ -1097,6 +1101,4 @@ void print_events(const char *event_glob)
        printf("\n");
        print_tracepoint_events(NULL, NULL);
-        exit(129);
 }
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 3e44a3e36519..555fc3864b90 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -612,12 +612,12 @@ static int convert_variable(Dwarf_Die *vr_die, struct probe_finder *pf)
        return ret;
 }
-/* Find a variable in a subprogram die */
+/* Find a variable in a scope DIE */
-static int find_variable(Dwarf_Die *sp_die, struct probe_finder *pf)
+static int find_variable(Dwarf_Die *sc_die, struct probe_finder *pf)
 {
-        Dwarf_Die vr_die, *scopes;
+        Dwarf_Die vr_die;
        char buf[32], *ptr;
-        int ret, nscopes;
+        int ret = 0;
        if (!is_c_varname(pf->pvar->var)) {
                /* Copy raw parameters */
@@ -652,30 +652,16 @@ static int find_variable(Dwarf_Die *sp_die, struct probe_finder *pf)
        if (pf->tvar->name == NULL)
                return -ENOMEM;
-        pr_debug("Searching '%s' variable in context.\n",
+        pr_debug("Searching '%s' variable in context.\n", pf->pvar->var);
-                 pf->pvar->var);
        /* Search child die for local variables and parameters. */
-        if (die_find_variable_at(sp_die, pf->pvar->var, pf->addr, &vr_die))
+        if (!die_find_variable_at(sc_die, pf->pvar->var, pf->addr, &vr_die)) {
-                ret = convert_variable(&vr_die, pf);
+                /* Search again in global variables */
-        else {
+                if (!die_find_variable_at(&pf->cu_die, pf->pvar->var, 0, &vr_die))
-                /* Search upper class */
+                        ret = -ENOENT;
-                nscopes = dwarf_getscopes_die(sp_die, &scopes);
-                while (nscopes-- > 1) {
-                        pr_debug("Searching variables in %s\n",
-                                 dwarf_diename(&scopes[nscopes]));
-                        /* We should check this scope, so give dummy address */
-                        if (die_find_variable_at(&scopes[nscopes],
-                                                 pf->pvar->var, 0,
-                                                 &vr_die)) {
-                                ret = convert_variable(&vr_die, pf);
-                                goto found;
-                        }
-                }
-                if (scopes)
-                        free(scopes);
-                ret = -ENOENT;
        }
-found:
+        if (ret == 0)
+                ret = convert_variable(&vr_die, pf);
        if (ret < 0)
                pr_warning("Failed to find '%s' in this function.\n",
                           pf->pvar->var);
@@ -718,26 +704,30 @@ static int convert_to_trace_point(Dwarf_Die *sp_die, Dwarf_Addr paddr,
        return 0;
 }
-/* Call probe_finder callback with real subprogram DIE */
+/* Call probe_finder callback with scope DIE */
-static int call_probe_finder(Dwarf_Die *sp_die, struct probe_finder *pf)
+static int call_probe_finder(Dwarf_Die *sc_die, struct probe_finder *pf)
 {
-        Dwarf_Die die_mem;
        Dwarf_Attribute fb_attr;
        size_t nops;
        int ret;
-        /* If no real subprogram, find a real one */
+        if (!sc_die) {
-        if (!sp_die || dwarf_tag(sp_die) != DW_TAG_subprogram) {
+                pr_err("Caller must pass a scope DIE. Program error.\n");
-                sp_die = die_find_realfunc(&pf->cu_die, pf->addr, &die_mem);
+                return -EINVAL;
-                if (!sp_die) {
+        }
+        /* If not a real subprogram, find a real one */
+        if (dwarf_tag(sc_die) != DW_TAG_subprogram) {
+                if (!die_find_realfunc(&pf->cu_die, pf->addr, &pf->sp_die)) {
                        pr_warning("Failed to find probe point in any "
                                   "functions.\n");
                        return -ENOENT;
                }
-        }
+        } else
+                memcpy(&pf->sp_die, sc_die, sizeof(Dwarf_Die));
-        /* Get the frame base attribute/ops */
+        /* Get the frame base attribute/ops from subprogram */
-        dwarf_attr(sp_die, DW_AT_frame_base, &fb_attr);
+        dwarf_attr(&pf->sp_die, DW_AT_frame_base, &fb_attr);
        ret = dwarf_getlocation_addr(&fb_attr, pf->addr, &pf->fb_ops, &nops, 1);
        if (ret <= 0 || nops == 0) {
                pf->fb_ops = NULL;
@@ -755,7 +745,7 @@ static int call_probe_finder(Dwarf_Die *sp_die, struct probe_finder *pf)
        }
        /* Call finder's callback handler */
-        ret = pf->callback(sp_die, pf);
+        ret = pf->callback(sc_die, pf);
        /* *pf->fb_ops will be cached in libdw. Don't free it. */
        pf->fb_ops = NULL;
@@ -763,17 +753,82 @@ static int call_probe_finder(Dwarf_Die *sp_die, struct probe_finder *pf)
        return ret;
 }
+struct find_scope_param {
+        const char *function;
+        const char *file;
+        int line;
+        int diff;
+        Dwarf_Die *die_mem;
+        bool found;
+};
+static int find_best_scope_cb(Dwarf_Die *fn_die, void *data)
+{
+        struct find_scope_param *fsp = data;
+        const char *file;
+        int lno;
+        /* Skip if declared file name does not match */
+        if (fsp->file) {
+                file = dwarf_decl_file(fn_die);
+                if (!file || strcmp(fsp->file, file) != 0)
+                        return 0;
+        }
+        /* If the function name is given, that's what user expects */
+        if (fsp->function) {
+                if (die_compare_name(fn_die, fsp->function)) {
+                        memcpy(fsp->die_mem, fn_die, sizeof(Dwarf_Die));
+                        fsp->found = true;
+                        return 1;
+                }
+        } else {
+                /* With the line number, find the nearest declared DIE */
+                dwarf_decl_line(fn_die, &lno);
+                if (lno < fsp->line && fsp->diff > fsp->line - lno) {
+                        /* Keep a candidate and continue */
+                        fsp->diff = fsp->line - lno;
+                        memcpy(fsp->die_mem, fn_die, sizeof(Dwarf_Die));
+                        fsp->found = true;
+                }
+        }
+        return 0;
+}
+/* Find an appropriate scope fits to given conditions */
+static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem)
+{
+        struct find_scope_param fsp = {
+                .function = pf->pev->point.function,
+                .file = pf->fname,
+                .line = pf->lno,
+                .diff = INT_MAX,
+                .die_mem = die_mem,
+                .found = false,
+        };
+        cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, &fsp);
+        return fsp.found ? die_mem : NULL;
+}
 static int probe_point_line_walker(const char *fname, int lineno,
                                   Dwarf_Addr addr, void *data)
 {
        struct probe_finder *pf = data;
+        Dwarf_Die *sc_die, die_mem;
        int ret;
        if (lineno != pf->lno || strtailcmp(fname, pf->fname) != 0)
                return 0;
        pf->addr = addr;
-        ret = call_probe_finder(NULL, pf);
+        sc_die = find_best_scope(pf, &die_mem);
+        if (!sc_die) {
+                pr_warning("Failed to find scope of probe point.\n");
+                return -ENOENT;
+        }
+        ret = call_probe_finder(sc_die, pf);
        /* Continue if no error, because the line will be in inline function */
        return ret < 0 ? ret : 0;
@@ -827,6 +882,7 @@ static int probe_point_lazy_walker(const char *fname, int lineno,
                                   Dwarf_Addr addr, void *data)
 {
        struct probe_finder *pf = data;
+        Dwarf_Die *sc_die, die_mem;
        int ret;
        if (!line_list__has_line(&pf->lcache, lineno) ||
@@ -836,7 +892,14 @@ static int probe_point_lazy_walker(const char *fname, int lineno,
        pr_debug("Probe line found: line:%d addr:0x%llx\n",
                 lineno, (unsigned long long)addr);
        pf->addr = addr;
-        ret = call_probe_finder(NULL, pf);
+        pf->lno = lineno;
+        sc_die = find_best_scope(pf, &die_mem);
+        if (!sc_die) {
+                pr_warning("Failed to find scope of probe point.\n");
+                return -ENOENT;
+        }
+        ret = call_probe_finder(sc_die, pf);
        /*
         * Continue if no error, because the lazy pattern will match
@@ -861,42 +924,39 @@ static int find_probe_point_lazy(Dwarf_Die *sp_die, struct probe_finder *pf)
        return die_walk_lines(sp_die, probe_point_lazy_walker, pf);
 }
-/* Callback parameter with return value */
-struct dwarf_callback_param {
-        void *data;
-        int retval;
-};
 static int probe_point_inline_cb(Dwarf_Die *in_die, void *data)
 {
-        struct dwarf_callback_param *param = data;
+        struct probe_finder *pf = data;
-        struct probe_finder *pf = param->data;
        struct perf_probe_point *pp = &pf->pev->point;
        Dwarf_Addr addr;
+        int ret;
        if (pp->lazy_line)
-                param->retval = find_probe_point_lazy(in_die, pf);
+                ret = find_probe_point_lazy(in_die, pf);
        else {
                /* Get probe address */
                if (dwarf_entrypc(in_die, &addr) != 0) {
                        pr_warning("Failed to get entry address of %s.\n",
                                   dwarf_diename(in_die));
-                        param->retval = -ENOENT;
+                        return -ENOENT;
-                        return DWARF_CB_ABORT;
                }
                pf->addr = addr;
                pf->addr += pp->offset;
                pr_debug("found inline addr: 0x%jx\n",
                         (uintmax_t)pf->addr);
-                param->retval = call_probe_finder(in_die, pf);
+                ret = call_probe_finder(in_die, pf);
-                if (param->retval < 0)
-                        return DWARF_CB_ABORT;
        }
-        return DWARF_CB_OK;
+        return ret;
 }
+/* Callback parameter with return value for libdw */
+struct dwarf_callback_param {
+        void *data;
+        int retval;
+};
 /* Search function from function name */
 static int probe_point_search_cb(Dwarf_Die *sp_die, void *data)
 {
@@ -933,14 +993,10 @@ static int probe_point_search_cb(Dwarf_Die *sp_die, void *data)
                        /* TODO: Check the address in this function */
                        param->retval = call_probe_finder(sp_die, pf);
                }
-        } else {
+        } else
-                struct dwarf_callback_param _param = {.data = (void *)pf,
-                                                      .retval = 0};
                /* Inlined function: search instances */
-                dwarf_func_inline_instances(sp_die, probe_point_inline_cb,
+                param->retval = die_walk_instances(sp_die,
-                                            &_param);
+                                        probe_point_inline_cb, (void *)pf);
-                param->retval = _param.retval;
-        }
        return DWARF_CB_ABORT; /* Exit; no same symbol in this CU. */
 }
@@ -1060,7 +1116,7 @@ found:
 }
 /* Add a found probe point into trace event list */
-static int add_probe_trace_event(Dwarf_Die *sp_die, struct probe_finder *pf)
+static int add_probe_trace_event(Dwarf_Die *sc_die, struct probe_finder *pf)
 {
        struct trace_event_finder *tf =
                        container_of(pf, struct trace_event_finder, pf);
@@ -1075,8 +1131,9 @@ static int add_probe_trace_event(Dwarf_Die *sp_die, struct probe_finder *pf)
        }
        tev = &tf->tevs[tf->ntevs++];
-        ret = convert_to_trace_point(sp_die, pf->addr, pf->pev->point.retprobe,
+        /* Trace point should be converted from subprogram DIE */
-                                     &tev->point);
+        ret = convert_to_trace_point(&pf->sp_die, pf->addr,
+                                     pf->pev->point.retprobe, &tev->point);
        if (ret < 0)
                return ret;
@@ -1091,7 +1148,8 @@ static int add_probe_trace_event(Dwarf_Die *sp_die, struct probe_finder *pf)
        for (i = 0; i < pf->pev->nargs; i++) {
                pf->pvar = &pf->pev->args[i];
                pf->tvar = &tev->args[i];
-                ret = find_variable(sp_die, pf);
+                /* Variable should be found from scope DIE */
+                ret = find_variable(sc_die, pf);
                if (ret != 0)
                        return ret;
        }
@@ -1159,13 +1217,13 @@ static int collect_variables_cb(Dwarf_Die *die_mem, void *data)
 }
 /* Add a found vars into available variables list */
-static int add_available_vars(Dwarf_Die *sp_die, struct probe_finder *pf)
+static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf)
 {
        struct available_var_finder *af =
                        container_of(pf, struct available_var_finder, pf);
        struct variable_list *vl;
-        Dwarf_Die die_mem, *scopes = NULL;
+        Dwarf_Die die_mem;
-        int ret, nscopes;
+        int ret;
        /* Check number of tevs */
        if (af->nvls == af->max_vls) {
@@ -1174,8 +1232,9 @@ static int add_available_vars(Dwarf_Die *sp_die, struct probe_finder *pf)
        }
        vl = &af->vls[af->nvls++];
-        ret = convert_to_trace_point(sp_die, pf->addr, pf->pev->point.retprobe,
+        /* Trace point should be converted from subprogram DIE */
-                                     &vl->point);
+        ret = convert_to_trace_point(&pf->sp_die, pf->addr,
+                                     pf->pev->point.retprobe, &vl->point);
        if (ret < 0)
                return ret;
@@ -1187,19 +1246,14 @@ static int add_available_vars(Dwarf_Die *sp_die, struct probe_finder *pf)
        if (vl->vars == NULL)
                return -ENOMEM;
        af->child = true;
-        die_find_child(sp_die, collect_variables_cb, (void *)af, &die_mem);
+        die_find_child(sc_die, collect_variables_cb, (void *)af, &die_mem);
        /* Find external variables */
        if (!af->externs)
                goto out;
        /* Don't need to search child DIE for externs. */
        af->child = false;
-        nscopes = dwarf_getscopes_die(sp_die, &scopes);
+        die_find_child(&pf->cu_die, collect_variables_cb, (void *)af, &die_mem);
-        while (nscopes-- > 1)
-                die_find_child(&scopes[nscopes], collect_variables_cb,
-                               (void *)af, &die_mem);
-        if (scopes)
-                free(scopes);
 out:
        if (strlist__empty(vl->vars)) {
@@ -1391,10 +1445,14 @@ static int find_line_range_by_line(Dwarf_Die *sp_die, struct line_finder *lf)
 static int line_range_inline_cb(Dwarf_Die *in_die, void *data)
 {
-        struct dwarf_callback_param *param = data;
+        find_line_range_by_line(in_die, data);
-        param->retval = find_line_range_by_line(in_die, param->data);
+        /*
-        return DWARF_CB_ABORT;  /* No need to find other instances */
+         * We have to check all instances of inlined function, because
+         * some execution paths can be optimized out depends on the
+         * function argument of instances
+         */
+        return 0;
 }
 /* Search function from function name */
@@ -1422,15 +1480,10 @@ static int line_range_search_cb(Dwarf_Die *sp_die, void *data)
                pr_debug("New line range: %d to %d\n", lf->lno_s, lf->lno_e);
                lr->start = lf->lno_s;
                lr->end = lf->lno_e;
-                if (dwarf_func_inline(sp_die)) {
+                if (dwarf_func_inline(sp_die))
-                        struct dwarf_callback_param _param;
+                        param->retval = die_walk_instances(sp_die,
-                        _param.data = (void *)lf;
+                                                line_range_inline_cb, lf);
-                        _param.retval = 0;
+                else
-                        dwarf_func_inline_instances(sp_die,
-                                                    line_range_inline_cb,
-                                                    &_param);
-                        param->retval = _param.retval;
-                } else
                        param->retval = find_line_range_by_line(sp_die, lf);
                return DWARF_CB_ABORT;
        }
diff --git a/tools/perf/util/probe-finder.h b/tools/perf/util/probe-finder.h
index c478b42a2473..1132c8f0ce89 100644
--- a/tools/perf/util/probe-finder.h
+++ b/tools/perf/util/probe-finder.h
@@ -57,7 +57,7 @@ struct probe_finder {
        struct perf_probe_event *pev;           /* Target probe event */
        /* Callback when a probe point is found */
-        int (*callback)(Dwarf_Die *sp_die, struct probe_finder *pf);
+        int (*callback)(Dwarf_Die *sc_die, struct probe_finder *pf);
        /* For function searching */
        int                     lno;            /* Line number */
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index a8b53714542a..469c0264ed29 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1506,7 +1506,7 @@ int dso__load(struct dso *dso, struct map *map, symbol_filter_t filter)
        if (strncmp(dso->name, "/tmp/perf-", 10) == 0) {
                struct stat st;
-                if (stat(dso->name, &st) < 0)
+                if (lstat(dso->name, &st) < 0)
                        return -1;
                if (st.st_uid && (st.st_uid != geteuid())) {
@@ -2181,27 +2181,22 @@ size_t machines__fprintf_dsos_buildid(struct rb_root *machines,
        return ret;
 }
-struct dso *dso__new_kernel(const char *name)
+static struct dso*
+dso__kernel_findnew(struct machine *machine, const char *name,
+                    const char *short_name, int dso_type)
 {
-        struct dso *dso = dso__new(name ?: "[kernel.kallsyms]");
+        /*
+         * The kernel dso could be created by build_id processing.
-        if (dso != NULL) {
+         */
-                dso__set_short_name(dso, "[kernel]");
+        struct dso *dso = __dsos__findnew(&machine->kernel_dsos, name);
-                dso->kernel = DSO_TYPE_KERNEL;
-        }
-        return dso;
-}
-static struct dso *dso__new_guest_kernel(struct machine *machine,
+        /*
-                                        const char *name)
+         * We need to run this in all cases, since during the build_id
-{
+         * processing we had no idea this was the kernel dso.
-        char bf[PATH_MAX];
+         */
-        struct dso *dso = dso__new(name ?: machine__mmap_name(machine, bf,
-                                                              sizeof(bf)));
        if (dso != NULL) {
-                dso__set_short_name(dso, "[guest.kernel]");
+                dso__set_short_name(dso, short_name);
-                dso->kernel = DSO_TYPE_GUEST_KERNEL;
+                dso->kernel = dso_type;
        }
        return dso;
@@ -2219,24 +2214,36 @@ void dso__read_running_kernel_build_id(struct dso *dso, struct machine *machine)
                dso->has_build_id = true;
 }
-static struct dso *machine__create_kernel(struct machine *machine)
+static struct dso *machine__get_kernel(struct machine *machine)
 {
        const char *vmlinux_name = NULL;
        struct dso *kernel;
        if (machine__is_host(machine)) {
                vmlinux_name = symbol_conf.vmlinux_name;
-                kernel = dso__new_kernel(vmlinux_name);
+                if (!vmlinux_name)
+                        vmlinux_name = "[kernel.kallsyms]";
+                kernel = dso__kernel_findnew(machine, vmlinux_name,
+                                             "[kernel]",
+                                             DSO_TYPE_KERNEL);
        } else {
+                char bf[PATH_MAX];
                if (machine__is_default_guest(machine))
                        vmlinux_name = symbol_conf.default_guest_vmlinux_name;
-                kernel = dso__new_guest_kernel(machine, vmlinux_name);
+                if (!vmlinux_name)
+                        vmlinux_name = machine__mmap_name(machine, bf,
+                                                          sizeof(bf));
+                kernel = dso__kernel_findnew(machine, vmlinux_name,
+                                             "[guest.kernel]",
+                                             DSO_TYPE_GUEST_KERNEL);
        }
-        if (kernel != NULL) {
+        if (kernel != NULL && (!kernel->has_build_id))
                dso__read_running_kernel_build_id(kernel, machine);
-                dsos__add(&machine->kernel_dsos, kernel);
-        }
        return kernel;
 }
@@ -2340,7 +2347,7 @@ void machine__destroy_kernel_maps(struct machine *machine)
 int machine__create_kernel_maps(struct machine *machine)
 {
-        struct dso *kernel = machine__create_kernel(machine);
+        struct dso *kernel = machine__get_kernel(machine);
        if (kernel == NULL ||
            __machine__create_kernel_maps(machine, kernel) < 0)
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 325ee36a9d29..4f377d92e75a 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -155,7 +155,6 @@ struct dso {
 };
 struct dso *dso__new(const char *name);
-struct dso *dso__new_kernel(const char *name);
 void dso__delete(struct dso *dso);
 int dso__name_len(const struct dso *dso);
diff --git a/tools/perf/util/ui/browsers/top.c b/tools/perf/util/ui/browsers/top.c
index 5a06538532af..88403cf8396a 100644
--- a/tools/perf/util/ui/browsers/top.c
+++ b/tools/perf/util/ui/browsers/top.c
@@ -208,6 +208,5 @@ int perf_top__tui_browser(struct perf_top *top)
                },
        };
-        ui_helpline__push("Press <- or ESC to exit");
        return perf_top_browser__run(&browser);
 }
diff --git a/tools/power/cpupower/Makefile b/tools/power/cpupower/Makefile
index 94c2cf0a98b8..e8a03aceceb1 100644
--- a/tools/power/cpupower/Makefile
+++ b/tools/power/cpupower/Makefile
@@ -24,7 +24,7 @@
 # Set the following to `true' to make a unstripped, unoptimized
 # binary. Leave this set to `false' for production use.
-DEBUG ?=        false
+DEBUG ?=        true
 # make the build silent. Set this to something else to make it noisy again.
 V ?=            false
@@ -35,7 +35,7 @@ NLS ?=		true
 # Set the following to 'true' to build/install the
 # cpufreq-bench benchmarking tool
-CPUFRQ_BENCH ?= true
+CPUFREQ_BENCH ?= true
 # Prefix to the directories we're installing to
 DESTDIR ?=
@@ -137,9 +137,10 @@ CFLAGS +=	-pipe
 ifeq ($(strip $(NLS)),true)
        INSTALL_NLS += install-gmo
        COMPILE_NLS += create-gmo
+        CFLAGS += -DNLS
 endif
-ifeq ($(strip $(CPUFRQ_BENCH)),true)
+ifeq ($(strip $(CPUFREQ_BENCH)),true)
        INSTALL_BENCH += install-bench
        COMPILE_BENCH += compile-bench
 endif
diff --git a/tools/power/cpupower/debug/x86_64/Makefile b/tools/power/cpupower/debug/x86_64/Makefile
index dbf13998462a..3326217dd311 100644
--- a/tools/power/cpupower/debug/x86_64/Makefile
+++ b/tools/power/cpupower/debug/x86_64/Makefile
@@ -1,10 +1,10 @@
 default: all
-centrino-decode: centrino-decode.c
+centrino-decode: ../i386/centrino-decode.c
-        $(CC) $(CFLAGS) -o centrino-decode centrino-decode.c
+        $(CC) $(CFLAGS) -o $@ $<
-powernow-k8-decode: powernow-k8-decode.c
+powernow-k8-decode: ../i386/powernow-k8-decode.c
-        $(CC) $(CFLAGS) -o powernow-k8-decode powernow-k8-decode.c
+        $(CC) $(CFLAGS) -o $@ $<
 all: centrino-decode powernow-k8-decode
diff --git a/tools/power/cpupower/debug/x86_64/centrino-decode.c b/tools/power/cpupower/debug/x86_64/centrino-decode.c
deleted file mode 120000
index 26fb3f1d8fc7..000000000000
--- a/tools/power/cpupower/debug/x86_64/centrino-decode.c
+++ /dev/null
@@ -1 +0,0 @@
-../i386/centrino-decode.c
-\ No newline at end of file
diff --git a/tools/power/cpupower/debug/x86_64/powernow-k8-decode.c b/tools/power/cpupower/debug/x86_64/powernow-k8-decode.c
deleted file mode 120000
index eb30c79cf9df..000000000000
--- a/tools/power/cpupower/debug/x86_64/powernow-k8-decode.c
+++ /dev/null
@@ -1 +0,0 @@
-../i386/powernow-k8-decode.c
-\ No newline at end of file
diff --git a/tools/power/cpupower/man/cpupower-frequency-info.1 b/tools/power/cpupower/man/cpupower-frequency-info.1
index 3194811d58f5..bb60a8d1e45a 100644
--- a/tools/power/cpupower/man/cpupower-frequency-info.1
+++ b/tools/power/cpupower/man/cpupower-frequency-info.1
@@ -1,10 +1,10 @@
-.TH "cpufreq-info" "1" "0.1" "Mattia Dongili" ""
+.TH "cpupower-frequency-info" "1" "0.1" "Mattia Dongili" ""
 .SH "NAME"
 .LP 
-cpufreq\-info \- Utility to retrieve cpufreq kernel information
+cpupower frequency\-info \- Utility to retrieve cpufreq kernel information
 .SH "SYNTAX"
 .LP 
-cpufreq\-info [\fIoptions\fP]
+cpupower [ \-c cpulist ] frequency\-info [\fIoptions\fP]
 .SH "DESCRIPTION"
 .LP 
 A small tool which prints out cpufreq information helpful to developers and interested users.
diff --git a/tools/power/cpupower/man/cpupower-frequency-set.1 b/tools/power/cpupower/man/cpupower-frequency-set.1
index 26e3e13eee3b..685f469093ad 100644
--- a/tools/power/cpupower/man/cpupower-frequency-set.1
+++ b/tools/power/cpupower/man/cpupower-frequency-set.1
@@ -1,13 +1,13 @@
-.TH "cpufreq-set" "1" "0.1" "Mattia Dongili" ""
+.TH "cpupower-freqency-set" "1" "0.1" "Mattia Dongili" ""
 .SH "NAME"
 .LP 
-cpufreq\-set \- A small tool which allows to modify cpufreq settings.
+cpupower frequency\-set \- A small tool which allows to modify cpufreq settings.
 .SH "SYNTAX"
 .LP 
-cpufreq\-set [\fIoptions\fP]
+cpupower [ \-c cpu ] frequency\-set [\fIoptions\fP]
 .SH "DESCRIPTION"
 .LP 
-cpufreq\-set allows you to modify cpufreq settings without having to type e.g. "/sys/devices/system/cpu/cpu0/cpufreq/scaling_set_speed" all the time.
+cpupower frequency\-set allows you to modify cpufreq settings without having to type e.g. "/sys/devices/system/cpu/cpu0/cpufreq/scaling_set_speed" all the time.
 .SH "OPTIONS"
 .LP 
 .TP 
diff --git a/tools/power/cpupower/man/cpupower.1 b/tools/power/cpupower/man/cpupower.1
index 78c20feab85c..baf741d06e82 100644
--- a/tools/power/cpupower/man/cpupower.1
+++ b/tools/power/cpupower/man/cpupower.1
@@ -3,7 +3,7 @@
 cpupower \- Shows and sets processor power related values
 .SH SYNOPSIS
 .ft B
-.B cpupower [ \-c cpulist ] subcommand [ARGS]
+.B cpupower [ \-c cpulist ] <command> [ARGS]
 .B cpupower \-v|\-\-version
@@ -13,24 +13,24 @@ cpupower \- Shows and sets processor power related values
 \fBcpupower \fP is a collection of tools to examine and tune power saving
 related features of your processor.
-The manpages of the subcommands (cpupower\-<subcommand>(1)) provide detailed
+The manpages of the commands (cpupower\-<command>(1)) provide detailed
 descriptions of supported features. Run \fBcpupower help\fP to get an overview
-of supported subcommands.
+of supported commands.
 .SH Options
 .PP
 \-\-help, \-h
 .RS 4
-Shows supported subcommands and general usage.
+Shows supported commands and general usage.
 .RE
 .PP
 \-\-cpu cpulist,  \-c cpulist
 .RS 4
 Only show or set values for specific cores.
-This option is not supported by all subcommands, details can be found in the
+This option is not supported by all commands, details can be found in the
-manpages of the subcommands.
+manpages of the commands.
-Some subcommands access all cores (typically the *\-set commands), some only
+Some commands access all cores (typically the *\-set commands), some only
 the first core (typically the *\-info commands) by default.
 The syntax for <cpulist> is based on how the kernel exports CPU bitmasks via
diff --git a/tools/power/cpupower/utils/builtin.h b/tools/power/cpupower/utils/builtin.h
index c870ffba5219..c10496fbe3c6 100644
--- a/tools/power/cpupower/utils/builtin.h
+++ b/tools/power/cpupower/utils/builtin.h
@@ -8,11 +8,4 @@ extern int cmd_freq_info(int argc, const char **argv);
 extern int cmd_idle_info(int argc, const char **argv);
 extern int cmd_monitor(int argc, const char **argv);
-extern void set_help(void);
-extern void info_help(void);
-extern void freq_set_help(void);
-extern void freq_info_help(void);
-extern void idle_info_help(void);
-extern void monitor_help(void);
 #endif
diff --git a/tools/power/cpupower/utils/cpufreq-info.c b/tools/power/cpupower/utils/cpufreq-info.c
index 5a1d25f056b3..28953c9a7bd5 100644
--- a/tools/power/cpupower/utils/cpufreq-info.c
+++ b/tools/power/cpupower/utils/cpufreq-info.c
@@ -510,37 +510,6 @@ static int get_latency(unsigned int cpu, unsigned int human)
        return 0;
 }
-void freq_info_help(void)
-{
-        printf(_("Usage: cpupower freqinfo [options]\n"));
-        printf(_("Options:\n"));
-        printf(_("  -e, --debug          Prints out debug information [default]\n"));
-        printf(_("  -f, --freq           Get frequency the CPU currently runs at, according\n"
-               "                       to the cpufreq core *\n"));
-        printf(_("  -w, --hwfreq         Get frequency the CPU currently runs at, by reading\n"
-               "                       it from hardware (only available to root) *\n"));
-        printf(_("  -l, --hwlimits       Determine the minimum and maximum CPU frequency allowed *\n"));
-        printf(_("  -d, --driver         Determines the used cpufreq kernel driver *\n"));
-        printf(_("  -p, --policy         Gets the currently used cpufreq policy *\n"));
-        printf(_("  -g, --governors      Determines available cpufreq governors *\n"));
-        printf(_("  -r, --related-cpus   Determines which CPUs run at the same hardware frequency *\n"));
-        printf(_("  -a, --affected-cpus  Determines which CPUs need to have their frequency\n"
-                        "                       coordinated by software *\n"));
-        printf(_("  -s, --stats          Shows cpufreq statistics if available\n"));
-        printf(_("  -y, --latency        Determines the maximum latency on CPU frequency changes *\n"));
-        printf(_("  -b, --boost          Checks for turbo or boost modes  *\n"));
-        printf(_("  -o, --proc           Prints out information like provided by the /proc/cpufreq\n"
-               "                       interface in 2.4. and early 2.6. kernels\n"));
-        printf(_("  -m, --human          human-readable output for the -f, -w, -s and -y parameters\n"));
-        printf(_("  -h, --help           Prints out this screen\n"));
-        printf("\n");
-        printf(_("If no argument is given, full output about\n"
-               "cpufreq is printed which is useful e.g. for reporting bugs.\n\n"));
-        printf(_("By default info of CPU 0 is shown which can be overridden\n"
-                 "with the cpupower --cpu main command option.\n"));
-}
 static struct option info_opts[] = {
        { .name = "debug",      .has_arg = no_argument,         .flag = NULL,   .val = 'e'},
        { .name = "boost",      .has_arg = no_argument,         .flag = NULL,   .val = 'b'},
@@ -556,7 +525,6 @@ static struct option info_opts[] = {
        { .name = "latency",    .has_arg = no_argument,         .flag = NULL,   .val = 'y'},
        { .name = "proc",       .has_arg = no_argument,         .flag = NULL,   .val = 'o'},
        { .name = "human",      .has_arg = no_argument,         .flag = NULL,   .val = 'm'},
-        { .name = "help",       .has_arg = no_argument,         .flag = NULL,   .val = 'h'},
        { },
 };
@@ -570,16 +538,12 @@ int cmd_freq_info(int argc, char **argv)
        int output_param = 0;
        do {
-                ret = getopt_long(argc, argv, "hoefwldpgrasmyb", info_opts, NULL);
+                ret = getopt_long(argc, argv, "oefwldpgrasmyb", info_opts, NULL);
                switch (ret) {
                case '?':
                        output_param = '?';
                        cont = 0;
                        break;
-                case 'h':
-                        output_param = 'h';
-                        cont = 0;
-                        break;
                case -1:
                        cont = 0;
                        break;
@@ -642,11 +606,7 @@ int cmd_freq_info(int argc, char **argv)
                return -EINVAL;
        case '?':
                printf(_("invalid or unknown argument\n"));
-                freq_info_help();
                return -EINVAL;
-        case 'h':
-                freq_info_help();
-                return EXIT_SUCCESS;
        case 'o':
                proc_cpufreq_output();
                return EXIT_SUCCESS;
diff --git a/tools/power/cpupower/utils/cpufreq-set.c b/tools/power/cpupower/utils/cpufreq-set.c
index 5f783622bf31..dd1539eb8c63 100644
--- a/tools/power/cpupower/utils/cpufreq-set.c
+++ b/tools/power/cpupower/utils/cpufreq-set.c
@@ -20,34 +20,11 @@
 #define NORM_FREQ_LEN 32
-void freq_set_help(void)
-{
-        printf(_("Usage: cpupower frequency-set [options]\n"));
-        printf(_("Options:\n"));
-        printf(_("  -d FREQ, --min FREQ      new minimum CPU frequency the governor may select\n"));
-        printf(_("  -u FREQ, --max FREQ      new maximum CPU frequency the governor may select\n"));
-        printf(_("  -g GOV, --governor GOV   new cpufreq governor\n"));
-        printf(_("  -f FREQ, --freq FREQ     specific frequency to be set. Requires userspace\n"
-               "                           governor to be available and loaded\n"));
-        printf(_("  -r, --related            Switches all hardware-related CPUs\n"));
-        printf(_("  -h, --help               Prints out this screen\n"));
-        printf("\n");
-        printf(_("Notes:\n"
-               "1. Omitting the -c or --cpu argument is equivalent to setting it to \"all\"\n"));
-        printf(_("2. The -f FREQ, --freq FREQ parameter cannot be combined with any other parameter\n"
-               "   except the -c CPU, --cpu CPU parameter\n"
-               "3. FREQuencies can be passed in Hz, kHz (default), MHz, GHz, or THz\n"
-               "   by postfixing the value with the wanted unit name, without any space\n"
-               "   (FREQuency in kHz =^ Hz * 0.001 =^ MHz * 1000 =^ GHz * 1000000).\n"));
-}
 static struct option set_opts[] = {
        { .name = "min",        .has_arg = required_argument,   .flag = NULL,   .val = 'd'},
        { .name = "max",        .has_arg = required_argument,   .flag = NULL,   .val = 'u'},
        { .name = "governor",   .has_arg = required_argument,   .flag = NULL,   .val = 'g'},
        { .name = "freq",       .has_arg = required_argument,   .flag = NULL,   .val = 'f'},
-        { .name = "help",       .has_arg = no_argument,         .flag = NULL,   .val = 'h'},
        { .name = "related",    .has_arg = no_argument,         .flag = NULL,   .val='r'},
        { },
 };
@@ -80,7 +57,6 @@ const struct freq_units def_units[] = {
 static void print_unknown_arg(void)
 {
        printf(_("invalid or unknown argument\n"));
-        freq_set_help();
 }
 static unsigned long string_to_frequency(const char *str)
@@ -231,14 +207,11 @@ int cmd_freq_set(int argc, char **argv)
        /* parameter parsing */
        do {
-                ret = getopt_long(argc, argv, "d:u:g:f:hr", set_opts, NULL);
+                ret = getopt_long(argc, argv, "d:u:g:f:r", set_opts, NULL);
                switch (ret) {
                case '?':
                        print_unknown_arg();
                        return -EINVAL;
-                case 'h':
-                        freq_set_help();
-                        return 0;
                case -1:
                        cont = 0;
                        break;
diff --git a/tools/power/cpupower/utils/cpuidle-info.c b/tools/power/cpupower/utils/cpuidle-info.c
index 70da3574f1e9..b028267c1376 100644
--- a/tools/power/cpupower/utils/cpuidle-info.c
+++ b/tools/power/cpupower/utils/cpuidle-info.c
@@ -139,30 +139,14 @@ static void proc_cpuidle_cpu_output(unsigned int cpu)
        }
 }
-/* --freq / -f */
-void idle_info_help(void)
-{
-        printf(_ ("Usage: cpupower idleinfo [options]\n"));
-        printf(_ ("Options:\n"));
-        printf(_ ("  -s, --silent         Only show general C-state information\n"));
-        printf(_ ("  -o, --proc           Prints out information like provided by the /proc/acpi/processor/*/power\n"
-               "                       interface in older kernels\n"));
-        printf(_ ("  -h, --help           Prints out this screen\n"));
-        printf("\n");
-}
 static struct option info_opts[] = {
        { .name = "silent",     .has_arg = no_argument, .flag = NULL,   .val = 's'},
        { .name = "proc",       .has_arg = no_argument, .flag = NULL,   .val = 'o'},
-        { .name = "help",       .has_arg = no_argument, .flag = NULL,   .val = 'h'},
        { },
 };
 static inline void cpuidle_exit(int fail)
 {
-        idle_info_help();
        exit(EXIT_FAILURE);
 }
@@ -174,7 +158,7 @@ int cmd_idle_info(int argc, char **argv)
        unsigned int cpu = 0;
        do {
-                ret = getopt_long(argc, argv, "hos", info_opts, NULL);
+                ret = getopt_long(argc, argv, "os", info_opts, NULL);
                if (ret == -1)
                        break;
                switch (ret) {
@@ -182,10 +166,6 @@ int cmd_idle_info(int argc, char **argv)
                        output_param = '?';
                        cont = 0;
                        break;
-                case 'h':
-                        output_param = 'h';
-                        cont = 0;
-                        break;
                case 's':
                        verbose = 0;
                        break;
@@ -211,8 +191,6 @@ int cmd_idle_info(int argc, char **argv)
        case '?':
                printf(_("invalid or unknown argument\n"));
                cpuidle_exit(EXIT_FAILURE);
-        case 'h':
-                cpuidle_exit(EXIT_SUCCESS);
        }
        /* Default is: show output of CPU 0 only */
diff --git a/tools/power/cpupower/utils/cpupower-info.c b/tools/power/cpupower/utils/cpupower-info.c
index 85253cb7600e..3f68632c28c7 100644
--- a/tools/power/cpupower/utils/cpupower-info.c
+++ b/tools/power/cpupower/utils/cpupower-info.c
@@ -16,31 +16,16 @@
 #include "helpers/helpers.h"
 #include "helpers/sysfs.h"
-void info_help(void)
-{
-        printf(_("Usage: cpupower info [ -b ] [ -m ] [ -s ]\n"));
-        printf(_("Options:\n"));
-        printf(_("  -b, --perf-bias    Gets CPU's power vs performance policy on some\n"
-               "                           Intel models [0-15], see manpage for details\n"));
-        printf(_("  -m, --sched-mc     Gets the kernel's multi core scheduler policy.\n"));
-        printf(_("  -s, --sched-smt    Gets the kernel's thread sibling scheduler policy.\n"));
-        printf(_("  -h, --help               Prints out this screen\n"));
-        printf(_("\nPassing no option will show all info, by default only on core 0\n"));
-        printf("\n");
-}
 static struct option set_opts[] = {
        { .name = "perf-bias",  .has_arg = optional_argument,   .flag = NULL,   .val = 'b'},
        { .name = "sched-mc",   .has_arg = optional_argument,   .flag = NULL,   .val = 'm'},
        { .name = "sched-smt",  .has_arg = optional_argument,   .flag = NULL,   .val = 's'},
-        { .name = "help",       .has_arg = no_argument,         .flag = NULL,   .val = 'h'},
        { },
 };
 static void print_wrong_arg_exit(void)
 {
        printf(_("invalid or unknown argument\n"));
-        info_help();
        exit(EXIT_FAILURE);
 }
@@ -64,11 +49,8 @@ int cmd_info(int argc, char **argv)
        textdomain(PACKAGE);
        /* parameter parsing */
-        while ((ret = getopt_long(argc, argv, "msbh", set_opts, NULL)) != -1) {
+        while ((ret = getopt_long(argc, argv, "msb", set_opts, NULL)) != -1) {
                switch (ret) {
-                case 'h':
-                        info_help();
-                        return 0;
                case 'b':
                        if (params.perf_bias)
                                print_wrong_arg_exit();
diff --git a/tools/power/cpupower/utils/cpupower-set.c b/tools/power/cpupower/utils/cpupower-set.c
index bc1b391e46f0..dc4de3762111 100644
--- a/tools/power/cpupower/utils/cpupower-set.c
+++ b/tools/power/cpupower/utils/cpupower-set.c
@@ -17,30 +17,16 @@
 #include "helpers/sysfs.h"
 #include "helpers/bitmask.h"
-void set_help(void)
-{
-        printf(_("Usage: cpupower set [ -b val ] [ -m val ] [ -s val ]\n"));
-        printf(_("Options:\n"));
-        printf(_("  -b, --perf-bias [VAL]    Sets CPU's power vs performance policy on some\n"
-               "                           Intel models [0-15], see manpage for details\n"));
-        printf(_("  -m, --sched-mc  [VAL]    Sets the kernel's multi core scheduler policy.\n"));
-        printf(_("  -s, --sched-smt [VAL]    Sets the kernel's thread sibling scheduler policy.\n"));
-        printf(_("  -h, --help               Prints out this screen\n"));
-        printf("\n");
-}
 static struct option set_opts[] = {
        { .name = "perf-bias",  .has_arg = optional_argument,   .flag = NULL,   .val = 'b'},
        { .name = "sched-mc",   .has_arg = optional_argument,   .flag = NULL,   .val = 'm'},
        { .name = "sched-smt",  .has_arg = optional_argument,   .flag = NULL,   .val = 's'},
-        { .name = "help",       .has_arg = no_argument,         .flag = NULL,   .val = 'h'},
        { },
 };
 static void print_wrong_arg_exit(void)
 {
        printf(_("invalid or unknown argument\n"));
-        set_help();
        exit(EXIT_FAILURE);
 }
@@ -66,12 +52,9 @@ int cmd_set(int argc, char **argv)
        params.params = 0;
        /* parameter parsing */
-        while ((ret = getopt_long(argc, argv, "m:s:b:h",
+        while ((ret = getopt_long(argc, argv, "m:s:b:",
                                                set_opts, NULL)) != -1) {
                switch (ret) {
-                case 'h':
-                        set_help();
-                        return 0;
                case 'b':
                        if (params.perf_bias)
                                print_wrong_arg_exit();
@@ -110,10 +93,8 @@ int cmd_set(int argc, char **argv)
                }
        };
-        if (!params.params) {
+        if (!params.params)
-                set_help();
+                print_wrong_arg_exit();
-                return -EINVAL;
-        }
        if (params.sched_mc) {
                ret = sysfs_set_sched("mc", sched_mc);
diff --git a/tools/power/cpupower/utils/cpupower.c b/tools/power/cpupower/utils/cpupower.c
index 5844ae0f786f..52bee591c1c5 100644
--- a/tools/power/cpupower/utils/cpupower.c
+++ b/tools/power/cpupower/utils/cpupower.c
@@ -11,6 +11,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <errno.h>
 #include "builtin.h"
 #include "helpers/helpers.h"
@@ -19,13 +20,12 @@
 struct cmd_struct {
        const char *cmd;
        int (*main)(int, const char **);
-        void (*usage)(void);
        int needs_root;
 };
 #define ARRAY_SIZE(x) (sizeof(x)/sizeof(x[0]))
-int cmd_help(int argc, const char **argv);
+static int cmd_help(int argc, const char **argv);
 /* Global cpu_info object available for all binaries
 * Info only retrieved from CPU 0
@@ -44,55 +44,66 @@ int be_verbose;
 static void print_help(void);
 static struct cmd_struct commands[] = {
-        { "frequency-info",     cmd_freq_info,  freq_info_help, 0       },
+        { "frequency-info",     cmd_freq_info,  0       },
-        { "frequency-set",      cmd_freq_set,   freq_set_help,  1       },
+        { "frequency-set",      cmd_freq_set,   1       },
-        { "idle-info",          cmd_idle_info,  idle_info_help, 0       },
+        { "idle-info",          cmd_idle_info,  0       },
-        { "set",                cmd_set,        set_help,       1       },
+        { "set",                cmd_set,        1       },
-        { "info",               cmd_info,       info_help,      0       },
+        { "info",               cmd_info,       0       },
-        { "monitor",            cmd_monitor,    monitor_help,   0       },
+        { "monitor",            cmd_monitor,    0       },
-        { "help",               cmd_help,       print_help,     0       },
+        { "help",               cmd_help,       0       },
-        /*      { "bench",      cmd_bench,      NULL,           1       }, */
+        /*      { "bench",      cmd_bench,      1       }, */
 };
-int cmd_help(int argc, const char **argv)
-{
-        unsigned int i;
-        if (argc > 1) {
-                for (i = 0; i < ARRAY_SIZE(commands); i++) {
-                        struct cmd_struct *p = commands + i;
-                        if (strcmp(p->cmd, argv[1]))
-                                continue;
-                        if (p->usage) {
-                                p->usage();
-                                return EXIT_SUCCESS;
-                        }
-                }
-        }
-        print_help();
-        if (argc == 1)
-                return EXIT_SUCCESS; /* cpupower help */
-        return EXIT_FAILURE;
-}
 static void print_help(void)
 {
        unsigned int i;
 #ifdef DEBUG
-        printf(_("cpupower [ -d ][ -c cpulist ] subcommand [ARGS]\n"));
+        printf(_("Usage:\tcpupower [-d|--debug] [-c|--cpu cpulist ] <command> [<args>]\n"));
-        printf(_("  -d, --debug      May increase output (stderr) on some subcommands\n"));
 #else
-        printf(_("cpupower [ -c cpulist ] subcommand [ARGS]\n"));
+        printf(_("Usage:\tcpupower [-c|--cpu cpulist ] <command> [<args>]\n"));
 #endif
-        printf(_("cpupower --version\n"));
+        printf(_("Supported commands are:\n"));
-        printf(_("Supported subcommands are:\n"));
        for (i = 0; i < ARRAY_SIZE(commands); i++)
                printf("\t%s\n", commands[i].cmd);
-        printf(_("\nSome subcommands can make use of the -c cpulist option.\n"));
+        printf(_("\nNot all commands can make use of the -c cpulist option.\n"));
-        printf(_("Look at the general cpupower manpage how to use it\n"));
+        printf(_("\nUse 'cpupower help <command>' for getting help for above commands.\n"));
-        printf(_("and read up the subcommand's manpage whether it is supported.\n"));
+}
-        printf(_("\nUse cpupower help subcommand for getting help for above subcommands.\n"));
+static int print_man_page(const char *subpage)
+{
+        int len;
+        char *page;
+        len = 10; /* enough for "cpupower-" */
+        if (subpage != NULL)
+                len += strlen(subpage);
+        page = malloc(len);
+        if (!page)
+                return -ENOMEM;
+        sprintf(page, "cpupower");
+        if ((subpage != NULL) && strcmp(subpage, "help")) {
+                strcat(page, "-");
+                strcat(page, subpage);
+        }
+        execlp("man", "man", page, NULL);
+        /* should not be reached */
+        return -EINVAL;
+}
+static int cmd_help(int argc, const char **argv)
+{
+        if (argc > 1) {
+                print_man_page(argv[1]); /* exits within execlp() */
+                return EXIT_FAILURE;
+        }
+        print_help();
+        return EXIT_SUCCESS;
 }
 static void print_version(void)
diff --git a/tools/power/cpupower/utils/helpers/helpers.h b/tools/power/cpupower/utils/helpers/helpers.h
index 592ee362b877..2747e738efb0 100644
--- a/tools/power/cpupower/utils/helpers/helpers.h
+++ b/tools/power/cpupower/utils/helpers/helpers.h
@@ -16,11 +16,20 @@
 #include "helpers/bitmask.h"
 /* Internationalization ****************************/
+#ifdef NLS
 #define _(String) gettext(String)
 #ifndef gettext_noop
 #define gettext_noop(String) String
 #endif
 #define N_(String) gettext_noop(String)
+#else /* !NLS */
+#define _(String) String
+#define N_(String) String
+#endif
 /* Internationalization ****************************/
 extern int run_as_root;
@@ -96,6 +105,9 @@ struct cpupower_topology {
                int pkg;
                int core;
                int cpu;
+                /* flags */
+                unsigned int is_online:1;
        } *core_info;
 };
diff --git a/tools/power/cpupower/utils/helpers/sysfs.c b/tools/power/cpupower/utils/helpers/sysfs.c
index 55e2466674c6..c6343024a611 100644
--- a/tools/power/cpupower/utils/helpers/sysfs.c
+++ b/tools/power/cpupower/utils/helpers/sysfs.c
@@ -56,6 +56,56 @@ static unsigned int sysfs_write_file(const char *path,
        return (unsigned int) numwrite;
 }
+/*
+ * Detect whether a CPU is online
+ *
+ * Returns:
+ *     1 -> if CPU is online
+ *     0 -> if CPU is offline
+ *     negative errno values in error case
+ */
+int sysfs_is_cpu_online(unsigned int cpu)
+{
+        char path[SYSFS_PATH_MAX];
+        int fd;
+        ssize_t numread;
+        unsigned long long value;
+        char linebuf[MAX_LINE_LEN];
+        char *endp;
+        struct stat statbuf;
+        snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u", cpu);
+        if (stat(path, &statbuf) != 0)
+                return 0;
+        /*
+         * kernel without CONFIG_HOTPLUG_CPU
+         * -> cpuX directory exists, but not cpuX/online file
+         */
+        snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/online", cpu);
+        if (stat(path, &statbuf) != 0)
+                return 1;
+        fd = open(path, O_RDONLY);
+        if (fd == -1)
+                return -errno;
+        numread = read(fd, linebuf, MAX_LINE_LEN - 1);
+        if (numread < 1) {
+                close(fd);
+                return -EIO;
+        }
+        linebuf[numread] = '\0';
+        close(fd);
+        value = strtoull(linebuf, &endp, 0);
+        if (value > 1 || value < 0)
+                return -EINVAL;
+        return value;
+}
 /* CPUidle idlestate specific /sys/devices/system/cpu/cpuX/cpuidle/ access */
 /*
diff --git a/tools/power/cpupower/utils/helpers/sysfs.h b/tools/power/cpupower/utils/helpers/sysfs.h
index f9373e090637..8cb797bbceb0 100644
--- a/tools/power/cpupower/utils/helpers/sysfs.h
+++ b/tools/power/cpupower/utils/helpers/sysfs.h
@@ -7,6 +7,8 @@
 extern unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen);
+extern int sysfs_is_cpu_online(unsigned int cpu);
 extern unsigned long sysfs_get_idlestate_latency(unsigned int cpu,
                                                unsigned int idlestate);
 extern unsigned long sysfs_get_idlestate_usage(unsigned int cpu,
diff --git a/tools/power/cpupower/utils/helpers/topology.c b/tools/power/cpupower/utils/helpers/topology.c
index 385ee5c7570c..4eae2c47ba48 100644
--- a/tools/power/cpupower/utils/helpers/topology.c
+++ b/tools/power/cpupower/utils/helpers/topology.c
@@ -41,6 +41,8 @@ struct cpuid_core_info {
        unsigned int pkg;
        unsigned int thread;
        unsigned int cpu;
+        /* flags */
+        unsigned int is_online:1;
 };
 static int __compare(const void *t1, const void *t2)
@@ -78,6 +80,8 @@ int get_cpu_topology(struct cpupower_topology *cpu_top)
                return -ENOMEM;
        cpu_top->pkgs = cpu_top->cores = 0;
        for (cpu = 0; cpu < cpus; cpu++) {
+                cpu_top->core_info[cpu].cpu = cpu;
+                cpu_top->core_info[cpu].is_online = sysfs_is_cpu_online(cpu);
                cpu_top->core_info[cpu].pkg =
                        sysfs_topology_read_file(cpu, "physical_package_id");
                if ((int)cpu_top->core_info[cpu].pkg != -1 &&
@@ -85,7 +89,6 @@ int get_cpu_topology(struct cpupower_topology *cpu_top)
                        cpu_top->pkgs = cpu_top->core_info[cpu].pkg;
                cpu_top->core_info[cpu].core =
                        sysfs_topology_read_file(cpu, "core_id");
-                cpu_top->core_info[cpu].cpu = cpu;
        }
        cpu_top->pkgs++;
diff --git a/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c b/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c
index d048b96a6155..bcd22a1a3970 100644
--- a/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c
+++ b/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c
@@ -134,7 +134,7 @@ static struct cpuidle_monitor *cpuidle_register(void)
        /* Assume idle state count is the same for all CPUs */
        cpuidle_sysfs_monitor.hw_states_num = sysfs_get_idlestate_count(0);
-        if (cpuidle_sysfs_monitor.hw_states_num == 0)
+        if (cpuidle_sysfs_monitor.hw_states_num <= 0)
                return NULL;
        for (num = 0; num < cpuidle_sysfs_monitor.hw_states_num; num++) {
diff --git a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
index ba4bf068380d..0d6571e418db 100644
--- a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
+++ b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c
@@ -43,6 +43,12 @@ static struct cpupower_topology cpu_top;
 /* ToDo: Document this in the manpage */
 static char range_abbr[RANGE_MAX] = { 'T', 'C', 'P', 'M', };
+static void print_wrong_arg_exit(void)
+{
+        printf(_("invalid or unknown argument\n"));
+        exit(EXIT_FAILURE);
+}
 long long timespec_diff_us(struct timespec start, struct timespec end)
 {
        struct timespec temp;
@@ -56,21 +62,6 @@ long long timespec_diff_us(struct timespec start, struct timespec end)
        return (temp.tv_sec * 1000000) + (temp.tv_nsec / 1000);
 }
-void monitor_help(void)
-{
-        printf(_("cpupower monitor: [-m <mon1>,[<mon2>],.. ] command\n"));
-        printf(_("cpupower monitor: [-m <mon1>,[<mon2>],.. ] [ -i interval_sec ]\n"));
-        printf(_("cpupower monitor: -l\n"));
-        printf(_("\t command: pass an arbitrary command to measure specific workload\n"));
-        printf(_("\t -i: time intervall to measure for in seconds (default 1)\n"));
-        printf(_("\t -l: list available CPU sleep monitors (for use with -m)\n"));
-        printf(_("\t -m: show specific CPU sleep monitors only (in same order)\n"));
-        printf(_("\t -h: print this help\n"));
-        printf("\n");
-        printf(_("only one of: -l, -m are allowed\nIf none of them is passed,"));
-        printf(_(" all supported monitors are shown\n"));
-}
 void print_n_spaces(int n)
 {
        int x;
@@ -149,6 +140,10 @@ void print_results(int topology_depth, int cpu)
        unsigned long long result;
        cstate_t s;
+        /* Be careful CPUs may got resorted for pkg value do not just use cpu */
+        if (!bitmask_isbitset(cpus_chosen, cpu_top.core_info[cpu].cpu))
+                return;
        if (topology_depth > 2)
                printf("%4d|", cpu_top.core_info[cpu].pkg);
        if (topology_depth > 1)
@@ -190,9 +185,13 @@ void print_results(int topology_depth, int cpu)
                        }
                }
        }
-        /* cpu offline */
+        /*
-        if (cpu_top.core_info[cpu].pkg == -1 ||
+         * The monitor could still provide useful data, for example
-            cpu_top.core_info[cpu].core == -1) {
+         * AMD HW counters partly sit in PCI config space.
+         * It's up to the monitor plug-in to check .is_online, this one
+         * is just for additional info.
+         */
+        if (!cpu_top.core_info[cpu].is_online) {
                printf(_(" *is offline\n"));
                return;
        } else
@@ -238,7 +237,6 @@ static void parse_monitor_param(char *param)
        if (hits == 0) {
                printf(_("No matching monitor found in %s, "
                         "try -l option\n"), param);
-                monitor_help();
                exit(EXIT_FAILURE);
        }
        /* Override detected/registerd monitors array with requested one */
@@ -335,37 +333,27 @@ static void cmdline(int argc, char *argv[])
        int opt;
        progname = basename(argv[0]);
-        while ((opt = getopt(argc, argv, "+hli:m:")) != -1) {
+        while ((opt = getopt(argc, argv, "+li:m:")) != -1) {
                switch (opt) {
-                case 'h':
-                        monitor_help();
-                        exit(EXIT_SUCCESS);
                case 'l':
-                        if (mode) {
+                        if (mode)
-                                monitor_help();
+                                print_wrong_arg_exit();
-                                exit(EXIT_FAILURE);
-                        }
                        mode = list;
                        break;
                case 'i':
                        /* only allow -i with -m or no option */
-                        if (mode && mode != show) {
+                        if (mode && mode != show)
-                                monitor_help();
+                                print_wrong_arg_exit();
-                                exit(EXIT_FAILURE);
-                        }
                        interval = atoi(optarg);
                        break;
                case 'm':
-                        if (mode) {
+                        if (mode)
-                                monitor_help();
+                                print_wrong_arg_exit();
-                                exit(EXIT_FAILURE);
-                        }
                        mode = show;
                        show_monitors_param = optarg;
                        break;
                default:
-                        monitor_help();
+                        print_wrong_arg_exit();
-                        exit(EXIT_FAILURE);
                }
        }
        if (!mode)
@@ -385,6 +373,10 @@ int cmd_monitor(int argc, char **argv)
                return EXIT_FAILURE;
        }
+        /* Default is: monitor all CPUs */
+        if (bitmask_isallclear(cpus_chosen))
+                bitmask_setall(cpus_chosen);
        dprint("System has up to %d CPU cores\n", cpu_count);
        for (num = 0; all_monitors[num]; num++) {
diff --git a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
index 63ca87a05e5f..5650ab5a2c20 100644
--- a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
+++ b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
@@ -22,12 +22,15 @@
 #define MSR_TSC 0x10
+#define MSR_AMD_HWCR 0xc0010015
 enum mperf_id { C0 = 0, Cx, AVG_FREQ, MPERF_CSTATE_COUNT };
 static int mperf_get_count_percent(unsigned int self_id, double *percent,
                                   unsigned int cpu);
 static int mperf_get_count_freq(unsigned int id, unsigned long long *count,
                                unsigned int cpu);
+static struct timespec time_start, time_end;
 static cstate_t mperf_cstates[MPERF_CSTATE_COUNT] = {
        {
@@ -54,19 +57,33 @@ static cstate_t mperf_cstates[MPERF_CSTATE_COUNT] = {
        },
 };
+enum MAX_FREQ_MODE { MAX_FREQ_SYSFS, MAX_FREQ_TSC_REF };
+static int max_freq_mode;
+/*
+ * The max frequency mperf is ticking at (in C0), either retrieved via:
+ *   1) calculated after measurements if we know TSC ticks at mperf/P0 frequency
+ *   2) cpufreq /sys/devices/.../cpu0/cpufreq/cpuinfo_max_freq at init time
+ * 1. Is preferred as it also works without cpufreq subsystem (e.g. on Xen)
+ */
+static unsigned long max_frequency;
 static unsigned long long tsc_at_measure_start;
 static unsigned long long tsc_at_measure_end;
-static unsigned long max_frequency;
 static unsigned long long *mperf_previous_count;
 static unsigned long long *aperf_previous_count;
 static unsigned long long *mperf_current_count;
 static unsigned long long *aperf_current_count;
 /* valid flag for all CPUs. If a MSR read failed it will be zero */
 static int *is_valid;
 static int mperf_get_tsc(unsigned long long *tsc)
 {
-        return read_msr(0, MSR_TSC, tsc);
+        int ret;
+        ret = read_msr(0, MSR_TSC, tsc);
+        if (ret)
+                dprint("Reading TSC MSR failed, returning %llu\n", *tsc);
+        return ret;
 }
 static int mperf_init_stats(unsigned int cpu)
@@ -97,36 +114,11 @@ static int mperf_measure_stats(unsigned int cpu)
        return 0;
 }
-/*
- * get_average_perf()
- *
- * Returns the average performance (also considers boosted frequencies)
- *
- * Input:
- *   aperf_diff: Difference of the aperf register over a time period
- *   mperf_diff: Difference of the mperf register over the same time period
- *   max_freq:   Maximum frequency (P0)
- *
- * Returns:
- *   Average performance over the time period
- */
-static unsigned long get_average_perf(unsigned long long aperf_diff,
-                                      unsigned long long mperf_diff)
-{
-        unsigned int perf_percent = 0;
-        if (((unsigned long)(-1) / 100) < aperf_diff) {
-                int shift_count = 7;
-                aperf_diff >>= shift_count;
-                mperf_diff >>= shift_count;
-        }
-        perf_percent = (aperf_diff * 100) / mperf_diff;
-        return (max_frequency * perf_percent) / 100;
-}
 static int mperf_get_count_percent(unsigned int id, double *percent,
                                   unsigned int cpu)
 {
        unsigned long long aperf_diff, mperf_diff, tsc_diff;
+        unsigned long long timediff;
        if (!is_valid[cpu])
                return -1;
@@ -136,11 +128,19 @@ static int mperf_get_count_percent(unsigned int id, double *percent,
        mperf_diff = mperf_current_count[cpu] - mperf_previous_count[cpu];
        aperf_diff = aperf_current_count[cpu] - aperf_previous_count[cpu];
-        tsc_diff = tsc_at_measure_end - tsc_at_measure_start;
-        *percent = 100.0 * mperf_diff / tsc_diff;
+        if (max_freq_mode == MAX_FREQ_TSC_REF) {
-        dprint("%s: mperf_diff: %llu, tsc_diff: %llu\n",
+                tsc_diff = tsc_at_measure_end - tsc_at_measure_start;
-               mperf_cstates[id].name, mperf_diff, tsc_diff);
+                *percent = 100.0 * mperf_diff / tsc_diff;
+                dprint("%s: TSC Ref - mperf_diff: %llu, tsc_diff: %llu\n",
+                       mperf_cstates[id].name, mperf_diff, tsc_diff);
+        } else if (max_freq_mode == MAX_FREQ_SYSFS) {
+                timediff = timespec_diff_us(time_start, time_end);
+                *percent = 100.0 * mperf_diff / timediff;
+                dprint("%s: MAXFREQ - mperf_diff: %llu, time_diff: %llu\n",
+                       mperf_cstates[id].name, mperf_diff, timediff);
+        } else
+                return -1;
        if (id == Cx)
                *percent = 100.0 - *percent;
@@ -154,7 +154,7 @@ static int mperf_get_count_percent(unsigned int id, double *percent,
 static int mperf_get_count_freq(unsigned int id, unsigned long long *count,
                                unsigned int cpu)
 {
-        unsigned long long aperf_diff, mperf_diff;
+        unsigned long long aperf_diff, mperf_diff, time_diff, tsc_diff;
        if (id != AVG_FREQ)
                return 1;
@@ -165,11 +165,21 @@ static int mperf_get_count_freq(unsigned int id, unsigned long long *count,
        mperf_diff = mperf_current_count[cpu] - mperf_previous_count[cpu];
        aperf_diff = aperf_current_count[cpu] - aperf_previous_count[cpu];
-        /* Return MHz for now, might want to return KHz if column width is more
+        if (max_freq_mode == MAX_FREQ_TSC_REF) {
-           generic */
+                /* Calculate max_freq from TSC count */
-        *count = get_average_perf(aperf_diff, mperf_diff) / 1000;
+                tsc_diff = tsc_at_measure_end - tsc_at_measure_start;
-        dprint("%s: %llu\n", mperf_cstates[id].name, *count);
+                time_diff = timespec_diff_us(time_start, time_end);
+                max_frequency = tsc_diff / time_diff;
+        }
+        *count = max_frequency * ((double)aperf_diff / mperf_diff);
+        dprint("%s: Average freq based on %s maximum frequency:\n",
+               mperf_cstates[id].name,
+               (max_freq_mode == MAX_FREQ_TSC_REF) ? "TSC calculated" : "sysfs read");
+        dprint("%max_frequency: %lu", max_frequency);
+        dprint("aperf_diff: %llu\n", aperf_diff);
+        dprint("mperf_diff: %llu\n", mperf_diff);
+        dprint("avg freq:   %llu\n", *count);
        return 0;
 }
@@ -178,6 +188,7 @@ static int mperf_start(void)
        int cpu;
        unsigned long long dbg;
+        clock_gettime(CLOCK_REALTIME, &time_start);
        mperf_get_tsc(&tsc_at_measure_start);
        for (cpu = 0; cpu < cpu_count; cpu++)
@@ -193,32 +204,104 @@ static int mperf_stop(void)
        unsigned long long dbg;
        int cpu;
-        mperf_get_tsc(&tsc_at_measure_end);
        for (cpu = 0; cpu < cpu_count; cpu++)
                mperf_measure_stats(cpu);
+        mperf_get_tsc(&tsc_at_measure_end);
+        clock_gettime(CLOCK_REALTIME, &time_end);
        mperf_get_tsc(&dbg);
        dprint("TSC diff: %llu\n", dbg - tsc_at_measure_end);
        return 0;
 }
-struct cpuidle_monitor mperf_monitor;
+/*
+ * Mperf register is defined to tick at P0 (maximum) frequency
-struct cpuidle_monitor *mperf_register(void)
+ *
+ * Instead of reading out P0 which can be tricky to read out from HW,
+ * we use TSC counter if it reliably ticks at P0/mperf frequency.
+ *
+ * Still try to fall back to:
+ * /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
+ * on older Intel HW without invariant TSC feature.
+ * Or on AMD machines where TSC does not tick at P0 (do not exist yet, but
+ * it's still double checked (MSR_AMD_HWCR)).
+ *
+ * On these machines the user would still get useful mperf
+ * stats when acpi-cpufreq driver is loaded.
+ */
+static int init_maxfreq_mode(void)
 {
+        int ret;
+        unsigned long long hwcr;
        unsigned long min;
-        if (!(cpupower_cpu_info.caps & CPUPOWER_CAP_APERF))
+        if (!cpupower_cpu_info.caps & CPUPOWER_CAP_INV_TSC)
-                return NULL;
+                goto use_sysfs;
-        /* Assume min/max all the same on all cores */
+        if (cpupower_cpu_info.vendor == X86_VENDOR_AMD) {
+                /* MSR_AMD_HWCR tells us whether TSC runs at P0/mperf
+                 * freq.
+                 * A test whether hwcr is accessable/available would be:
+                 * (cpupower_cpu_info.family > 0x10 ||
+                 *   cpupower_cpu_info.family == 0x10 &&
+                 *   cpupower_cpu_info.model >= 0x2))
+                 * This should be the case for all aperf/mperf
+                 * capable AMD machines and is therefore safe to test here.
+                 * Compare with Linus kernel git commit: acf01734b1747b1ec4
+                 */
+                ret = read_msr(0, MSR_AMD_HWCR, &hwcr);
+                /*
+                 * If the MSR read failed, assume a Xen system that did
+                 * not explicitly provide access to it and assume TSC works
+                */
+                if (ret != 0) {
+                        dprint("TSC read 0x%x failed - assume TSC working\n",
+                               MSR_AMD_HWCR);
+                        return 0;
+                } else if (1 & (hwcr >> 24)) {
+                        max_freq_mode = MAX_FREQ_TSC_REF;
+                        return 0;
+                } else { /* Use sysfs max frequency if available */ }
+        } else if (cpupower_cpu_info.vendor == X86_VENDOR_INTEL) {
+                /*
+                 * On Intel we assume mperf (in C0) is ticking at same
+                 * rate than TSC
+                 */
+                max_freq_mode = MAX_FREQ_TSC_REF;
+                return 0;
+        }
+use_sysfs:
        if (cpufreq_get_hardware_limits(0, &min, &max_frequency)) {
                dprint("Cannot retrieve max freq from cpufreq kernel "
                       "subsystem\n");
-                return NULL;
+                return -1;
        }
+        max_freq_mode = MAX_FREQ_SYSFS;
+        return 0;
+}
+/*
+ * This monitor provides:
+ *
+ * 1) Average frequency a CPU resided in
+ *    This always works if the CPU has aperf/mperf capabilities
+ *
+ * 2) C0 and Cx (any sleep state) time a CPU resided in
+ *    Works if mperf timer stops ticking in sleep states which
+ *    seem to be the case on all current HW.
+ * Both is directly retrieved from HW registers and is independent
+ * from kernel statistics.
+ */
+struct cpuidle_monitor mperf_monitor;
+struct cpuidle_monitor *mperf_register(void)
+{
+        if (!(cpupower_cpu_info.caps & CPUPOWER_CAP_APERF))
+                return NULL;
+        if (init_maxfreq_mode())
+                return NULL;
        /* Free this at program termination */
        is_valid = calloc(cpu_count, sizeof(int));