[gentoo-commits] linux-patches r1874 - genpatches-2.6/trunk/2.6.37

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2011-02-26 00:27:50 +0000 (Sat, 26 Feb 2011)
New Revision: 1874

Added:
   genpatches-2.6/trunk/2.6.37/1000_linux-2.6.37.1.patch
   genpatches-2.6/trunk/2.6.37/1001_linux-2.6.37.2.patch
Modified:
   genpatches-2.6/trunk/2.6.37/0000_README
Log:
Linux patches 2.6.37.1 and 2.6.37.2

Modified: genpatches-2.6/trunk/2.6.37/0000_README
===================================================================
--- genpatches-2.6/trunk/2.6.37/0000_README	2011-02-18 15:49:52 UTC (rev 1873)
+++ genpatches-2.6/trunk/2.6.37/0000_README	2011-02-26 00:27:50 UTC (rev 1874)
@@ -39,6 +39,14 @@
 Individual Patch Descriptions:
 --------------------------------------------------------------------------
 
+Patch:  1000_linux-2.6.37.1.patch
+From:   http://www.kernel.org
+Desc:   Linux 2.6.37.1
+
+Patch:  1001_linux-2.6.37.2.patch
+From:   http://www.kernel.org
+Desc:   Linux 2.6.37.2
+
 Patch:  2400_iwlwifi-fw-reload-rf-fix.patch
 From:   http://www.spinics.net/lists/linux-wireless/msg61225.html
 Desc:   Do not reload fw if WiMAX own the RF

Added: genpatches-2.6/trunk/2.6.37/1000_linux-2.6.37.1.patch
===================================================================
--- genpatches-2.6/trunk/2.6.37/1000_linux-2.6.37.1.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.37/1000_linux-2.6.37.1.patch	2011-02-26 00:27:50 UTC (rev 1874)
@@ -0,0 +1,10709 @@
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index 01ece1b..596bb3c 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -884,6 +884,7 @@ and is between 256 and 4096 characters. It is defined in the file
+ 			     controller
+ 	i8042.nopnp	[HW] Don't use ACPIPnP / PnPBIOS to discover KBD/AUX
+ 			     controllers
++	i8042.notimeout	[HW] Ignore timeout condition signalled by conroller
+ 	i8042.reset	[HW] Reset the controller during init and cleanup
+ 	i8042.unlock	[HW] Unlock (ignore) the keylock
+ 
+diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
+index 6bd82d2..7306b8e 100644
+--- a/arch/arm/kernel/head.S
++++ b/arch/arm/kernel/head.S
+@@ -91,6 +91,11 @@ ENTRY(stext)
+ 	movs	r8, r5				@ invalid machine (r5=0)?
+  THUMB( it	eq )		@ force fixup-able long branch encoding
+ 	beq	__error_a			@ yes, error 'a'
++
++	/*
++	 * r1 = machine no, r2 = atags,
++	 * r8 = machinfo, r9 = cpuid, r10 = procinfo
++	 */
+ 	bl	__vet_atags
+ #ifdef CONFIG_SMP_ON_UP
+ 	bl	__fixup_smp
+@@ -387,34 +392,32 @@ ENDPROC(__turn_mmu_on)
+ 
+ #ifdef CONFIG_SMP_ON_UP
+ __fixup_smp:
+-	mov	r7, #0x00070000
+-	orr	r6, r7, #0xff000000	@ mask 0xff070000
+-	orr	r7, r7, #0x41000000	@ val 0x41070000
+-	and	r0, r9, r6
+-	teq	r0, r7			@ ARM CPU and ARMv6/v7?
++	and	r3, r9, #0x000f0000	@ architecture version
++	teq	r3, #0x000f0000		@ CPU ID supported?
+ 	bne	__fixup_smp_on_up	@ no, assume UP
+ 
+-	orr	r6, r6, #0x0000ff00
+-	orr	r6, r6, #0x000000f0	@ mask 0xff07fff0
+-	orr	r7, r7, #0x0000b000
+-	orr	r7, r7, #0x00000020	@ val 0x4107b020
+-	and	r0, r9, r6
+-	teq	r0, r7			@ ARM 11MPCore?
++	bic	r3, r9, #0x00ff0000
++	bic	r3, r3, #0x0000000f	@ mask 0xff00fff0
++	mov	r4, #0x41000000
++	orr	r4, r4, #0x0000b000
++	orr	r4, r4, #0x00000020	@ val 0x4100b020
++	teq	r3, r4			@ ARM 11MPCore?
+ 	moveq	pc, lr			@ yes, assume SMP
+ 
+ 	mrc	p15, 0, r0, c0, c0, 5	@ read MPIDR
+-	tst	r0, #1 << 31
+-	movne	pc, lr			@ bit 31 => SMP
++	and	r0, r0, #0xc0000000	@ multiprocessing extensions and
++	teq	r0, #0x80000000		@ not part of a uniprocessor system?
++	moveq	pc, lr			@ yes, assume SMP
+ 
+ __fixup_smp_on_up:
+ 	adr	r0, 1f
+-	ldmia	r0, {r3, r6, r7}
++	ldmia	r0, {r3 - r5}
+ 	sub	r3, r0, r3
+-	add	r6, r6, r3
+-	add	r7, r7, r3
+-2:	cmp	r6, r7
+-	ldmia	r6!, {r0, r4}
+-	strlo	r4, [r0, r3]
++	add	r4, r4, r3
++	add	r5, r5, r3
++2:	cmp	r4, r5
++	ldmia	r4!, {r0, r6}
++	strlo	r6, [r0, r3]
+ 	blo	2b
+ 	mov	pc, lr
+ ENDPROC(__fixup_smp)
+diff --git a/arch/arm/mach-s5pv310/cpu.c b/arch/arm/mach-s5pv310/cpu.c
+index 82ce4aa..b2a37d0 100644
+--- a/arch/arm/mach-s5pv310/cpu.c
++++ b/arch/arm/mach-s5pv310/cpu.c
+@@ -168,7 +168,7 @@ static int __init s5pv310_l2x0_cache_init(void)
+ 	__raw_writel(L2X0_DYNAMIC_CLK_GATING_EN | L2X0_STNDBY_MODE_EN,
+ 		     S5P_VA_L2CC + L2X0_POWER_CTRL);
+ 
+-	l2x0_init(S5P_VA_L2CC, 0x7C070001, 0xC200ffff);
++	l2x0_init(S5P_VA_L2CC, 0x7C470001, 0xC200ffff);
+ 
+ 	return 0;
+ }
+diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
+index 5164069..cddd684 100644
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -297,6 +297,12 @@ void __init arm_memblock_init(struct meminfo *mi, struct machine_desc *mdesc)
+ 	memblock_reserve(__pa(_stext), _end - _stext);
+ #endif
+ #ifdef CONFIG_BLK_DEV_INITRD
++	if (phys_initrd_size &&
++	    memblock_is_region_reserved(phys_initrd_start, phys_initrd_size)) {
++		pr_err("INITRD: 0x%08lx+0x%08lx overlaps in-use memory region - disabling initrd\n",
++		       phys_initrd_start, phys_initrd_size);
++		phys_initrd_start = phys_initrd_size = 0;
++	}
+ 	if (phys_initrd_size) {
+ 		memblock_reserve(phys_initrd_start, phys_initrd_size);
+ 
+diff --git a/arch/arm/oprofile/common.c b/arch/arm/oprofile/common.c
+index 8aa9744..2b66391 100644
+--- a/arch/arm/oprofile/common.c
++++ b/arch/arm/oprofile/common.c
+@@ -10,8 +10,6 @@
+  */
+ 
+ #include <linux/cpumask.h>
+-#include <linux/err.h>
+-#include <linux/errno.h>
+ #include <linux/init.h>
+ #include <linux/mutex.h>
+ #include <linux/oprofile.h>
+@@ -46,6 +44,7 @@ char *op_name_from_perf_id(void)
+ 		return NULL;
+ 	}
+ }
++#endif
+ 
+ static int report_trace(struct stackframe *frame, void *d)
+ {
+@@ -111,6 +110,7 @@ static void arm_backtrace(struct pt_regs * const regs, unsigned int depth)
+ 
+ int __init oprofile_arch_init(struct oprofile_operations *ops)
+ {
++	/* provide backtrace support also in timer mode: */
+ 	ops->backtrace		= arm_backtrace;
+ 
+ 	return oprofile_perf_init(ops);
+@@ -120,11 +120,3 @@ void __exit oprofile_arch_exit(void)
+ {
+ 	oprofile_perf_exit();
+ }
+-#else
+-int __init oprofile_arch_init(struct oprofile_operations *ops)
+-{
+-	pr_info("oprofile: hardware counters not available\n");
+-	return -ENODEV;
+-}
+-void __exit oprofile_arch_exit(void) {}
+-#endif /* CONFIG_HW_PERF_EVENTS */
+diff --git a/arch/avr32/include/asm/syscalls.h b/arch/avr32/include/asm/syscalls.h
+index ab608b7..730a461 100644
+--- a/arch/avr32/include/asm/syscalls.h
++++ b/arch/avr32/include/asm/syscalls.h
+@@ -16,18 +16,9 @@
+ #include <linux/signal.h>
+ 
+ /* kernel/process.c */
+-asmlinkage int sys_fork(struct pt_regs *);
+ asmlinkage int sys_clone(unsigned long, unsigned long,
+ 			 unsigned long, unsigned long,
+ 			 struct pt_regs *);
+-asmlinkage int sys_vfork(struct pt_regs *);
+-asmlinkage int sys_execve(const char __user *, char __user *__user *,
+-			  char __user *__user *, struct pt_regs *);
+-
+-/* kernel/signal.c */
+-asmlinkage int sys_sigaltstack(const stack_t __user *, stack_t __user *,
+-			       struct pt_regs *);
+-asmlinkage int sys_rt_sigreturn(struct pt_regs *);
+ 
+ /* mm/cache.c */
+ asmlinkage int sys_cacheflush(int, void __user *, size_t);
+diff --git a/arch/parisc/kernel/firmware.c b/arch/parisc/kernel/firmware.c
+index df971fa..4896ed0 100644
+--- a/arch/parisc/kernel/firmware.c
++++ b/arch/parisc/kernel/firmware.c
+@@ -1126,15 +1126,13 @@ int pdc_iodc_print(const unsigned char *str, unsigned count)
+ 	unsigned int i;
+ 	unsigned long flags;
+ 
+-	for (i = 0; i < count && i < 79;) {
++	for (i = 0; i < count;) {
+ 		switch(str[i]) {
+ 		case '\n':
+ 			iodc_dbuf[i+0] = '\r';
+ 			iodc_dbuf[i+1] = '\n';
+ 			i += 2;
+ 			goto print;
+-		case '\b':	/* BS */
+-			i--; /* overwrite last */
+ 		default:
+ 			iodc_dbuf[i] = str[i];
+ 			i++;
+@@ -1142,15 +1140,6 @@ int pdc_iodc_print(const unsigned char *str, unsigned count)
+ 		}
+ 	}
+ 
+-	/* if we're at the end of line, and not already inserting a newline,
+-	 * insert one anyway. iodc console doesn't claim to support >79 char
+-	 * lines. don't account for this in the return value.
+-	 */
+-	if (i == 79 && iodc_dbuf[i-1] != '\n') {
+-		iodc_dbuf[i+0] = '\r';
+-		iodc_dbuf[i+1] = '\n';
+-	}
+-
+ print:
+         spin_lock_irqsave(&pdc_lock, flags);
+         real32_call(PAGE0->mem_cons.iodc_io,
+diff --git a/arch/powerpc/boot/dts/p1022ds.dts b/arch/powerpc/boot/dts/p1022ds.dts
+index 2bbecbb..69422eb 100644
+--- a/arch/powerpc/boot/dts/p1022ds.dts
++++ b/arch/powerpc/boot/dts/p1022ds.dts
+@@ -291,13 +291,13 @@
+ 			ranges = <0x0 0xc100 0x200>;
+ 			cell-index = <1>;
+ 			dma00: dma-channel@0 {
+-				compatible = "fsl,eloplus-dma-channel";
++				compatible = "fsl,ssi-dma-channel";
+ 				reg = <0x0 0x80>;
+ 				cell-index = <0>;
+ 				interrupts = <76 2>;
+ 			};
+ 			dma01: dma-channel@80 {
+-				compatible = "fsl,eloplus-dma-channel";
++				compatible = "fsl,ssi-dma-channel";
+ 				reg = <0x80 0x80>;
+ 				cell-index = <1>;
+ 				interrupts = <77 2>;
+diff --git a/arch/powerpc/kernel/cpu_setup_6xx.S b/arch/powerpc/kernel/cpu_setup_6xx.S
+index 55cba4a..f8cd9fb 100644
+--- a/arch/powerpc/kernel/cpu_setup_6xx.S
++++ b/arch/powerpc/kernel/cpu_setup_6xx.S
+@@ -18,7 +18,7 @@
+ #include <asm/mmu.h>
+ 
+ _GLOBAL(__setup_cpu_603)
+-	mflr	r4
++	mflr	r5
+ BEGIN_MMU_FTR_SECTION
+ 	li	r10,0
+ 	mtspr	SPRN_SPRG_603_LRU,r10		/* init SW LRU tracking */
+@@ -27,60 +27,60 @@ BEGIN_FTR_SECTION
+ 	bl	__init_fpu_registers
+ END_FTR_SECTION_IFCLR(CPU_FTR_FPU_UNAVAILABLE)
+ 	bl	setup_common_caches
+-	mtlr	r4
++	mtlr	r5
+ 	blr
+ _GLOBAL(__setup_cpu_604)
+-	mflr	r4
++	mflr	r5
+ 	bl	setup_common_caches
+ 	bl	setup_604_hid0
+-	mtlr	r4
++	mtlr	r5
+ 	blr
+ _GLOBAL(__setup_cpu_750)
+-	mflr	r4
++	mflr	r5
+ 	bl	__init_fpu_registers
+ 	bl	setup_common_caches
+ 	bl	setup_750_7400_hid0
+-	mtlr	r4
++	mtlr	r5
+ 	blr
+ _GLOBAL(__setup_cpu_750cx)
+-	mflr	r4
++	mflr	r5
+ 	bl	__init_fpu_registers
+ 	bl	setup_common_caches
+ 	bl	setup_750_7400_hid0
+ 	bl	setup_750cx
+-	mtlr	r4
++	mtlr	r5
+ 	blr
+ _GLOBAL(__setup_cpu_750fx)
+-	mflr	r4
++	mflr	r5
+ 	bl	__init_fpu_registers
+ 	bl	setup_common_caches
+ 	bl	setup_750_7400_hid0
+ 	bl	setup_750fx
+-	mtlr	r4
++	mtlr	r5
+ 	blr
+ _GLOBAL(__setup_cpu_7400)
+-	mflr	r4
++	mflr	r5
+ 	bl	__init_fpu_registers
+ 	bl	setup_7400_workarounds
+ 	bl	setup_common_caches
+ 	bl	setup_750_7400_hid0
+-	mtlr	r4
++	mtlr	r5
+ 	blr
+ _GLOBAL(__setup_cpu_7410)
+-	mflr	r4
++	mflr	r5
+ 	bl	__init_fpu_registers
+ 	bl	setup_7410_workarounds
+ 	bl	setup_common_caches
+ 	bl	setup_750_7400_hid0
+ 	li	r3,0
+ 	mtspr	SPRN_L2CR2,r3
+-	mtlr	r4
++	mtlr	r5
+ 	blr
+ _GLOBAL(__setup_cpu_745x)
+-	mflr	r4
++	mflr	r5
+ 	bl	setup_common_caches
+ 	bl	setup_745x_specifics
+-	mtlr	r4
++	mtlr	r5
+ 	blr
+ 
+ /* Enable caches for 603's, 604, 750 & 7400 */
+@@ -194,10 +194,10 @@ setup_750cx:
+ 	cror	4*cr0+eq,4*cr0+eq,4*cr1+eq
+ 	cror	4*cr0+eq,4*cr0+eq,4*cr2+eq
+ 	bnelr
+-	lwz	r6,CPU_SPEC_FEATURES(r5)
++	lwz	r6,CPU_SPEC_FEATURES(r4)
+ 	li	r7,CPU_FTR_CAN_NAP
+ 	andc	r6,r6,r7
+-	stw	r6,CPU_SPEC_FEATURES(r5)
++	stw	r6,CPU_SPEC_FEATURES(r4)
+ 	blr
+ 
+ /* 750fx specific
+@@ -225,12 +225,12 @@ BEGIN_FTR_SECTION
+ 	andis.	r11,r11,L3CR_L3E@h
+ 	beq	1f
+ END_FTR_SECTION_IFSET(CPU_FTR_L3CR)
+-	lwz	r6,CPU_SPEC_FEATURES(r5)
++	lwz	r6,CPU_SPEC_FEATURES(r4)
+ 	andi.	r0,r6,CPU_FTR_L3_DISABLE_NAP
+ 	beq	1f
+ 	li	r7,CPU_FTR_CAN_NAP
+ 	andc	r6,r6,r7
+-	stw	r6,CPU_SPEC_FEATURES(r5)
++	stw	r6,CPU_SPEC_FEATURES(r4)
+ 1:
+ 	mfspr	r11,SPRN_HID0
+ 
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 74505b2..c33210a 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -181,7 +181,7 @@ static void unmap_cpu_from_node(unsigned long cpu)
+ 	dbg("removing cpu %lu from node %d\n", cpu, node);
+ 
+ 	if (cpumask_test_cpu(cpu, node_to_cpumask_map[node])) {
+-		cpumask_set_cpu(cpu, node_to_cpumask_map[node]);
++		cpumask_clear_cpu(cpu, node_to_cpumask_map[node]);
+ 	} else {
+ 		printk(KERN_ERR "WARNING: cpu %lu not found in node %d\n",
+ 		       cpu, node);
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index f129040..8323f14 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -701,6 +701,13 @@ EXPORT_SYMBOL(arch_free_page);
+ /* NB: reg/unreg are called while guarded with the tracepoints_mutex */
+ extern long hcall_tracepoint_refcount;
+ 
++/*
++ * Since the tracing code might execute hcalls we need to guard against
++ * recursion. One example of this are spinlocks calling H_YIELD on
++ * shared processor partitions.
++ */
++static DEFINE_PER_CPU(unsigned int, hcall_trace_depth);
++
+ void hcall_tracepoint_regfunc(void)
+ {
+ 	hcall_tracepoint_refcount++;
+@@ -713,12 +720,42 @@ void hcall_tracepoint_unregfunc(void)
+ 
+ void __trace_hcall_entry(unsigned long opcode, unsigned long *args)
+ {
++	unsigned long flags;
++	unsigned int *depth;
++
++	local_irq_save(flags);
++
++	depth = &__get_cpu_var(hcall_trace_depth);
++
++	if (*depth)
++		goto out;
++
++	(*depth)++;
+ 	trace_hcall_entry(opcode, args);
++	(*depth)--;
++
++out:
++	local_irq_restore(flags);
+ }
+ 
+ void __trace_hcall_exit(long opcode, unsigned long retval,
+ 			unsigned long *retbuf)
+ {
++	unsigned long flags;
++	unsigned int *depth;
++
++	local_irq_save(flags);
++
++	depth = &__get_cpu_var(hcall_trace_depth);
++
++	if (*depth)
++		goto out;
++
++	(*depth)++;
+ 	trace_hcall_exit(opcode, retval, retbuf);
++	(*depth)--;
++
++out:
++	local_irq_restore(flags);
+ }
+ #endif
+diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
+index 9725369..9f99bef 100644
+--- a/arch/powerpc/sysdev/fsl_rio.c
++++ b/arch/powerpc/sysdev/fsl_rio.c
+@@ -973,7 +973,6 @@ fsl_rio_dbell_handler(int irq, void *dev_instance)
+ 	if (dsr & DOORBELL_DSR_QFI) {
+ 		pr_info("RIO: doorbell queue full\n");
+ 		out_be32(&priv->msg_regs->dsr, DOORBELL_DSR_QFI);
+-		goto out;
+ 	}
+ 
+ 	/* XXX Need to check/dispatch until queue empty */
+diff --git a/arch/sh/include/asm/io.h b/arch/sh/include/asm/io.h
+index b237d52..34ba197 100644
+--- a/arch/sh/include/asm/io.h
++++ b/arch/sh/include/asm/io.h
+@@ -322,7 +322,15 @@ __ioremap_29bit(phys_addr_t offset, unsigned long size, pgprot_t prot)
+ 	 * mapping must be done by the PMB or by using page tables.
+ 	 */
+ 	if (likely(PXSEG(offset) < P3SEG && PXSEG(last_addr) < P3SEG)) {
+-		if (unlikely(pgprot_val(prot) & _PAGE_CACHABLE))
++		u64 flags = pgprot_val(prot);
++
++		/*
++		 * Anything using the legacy PTEA space attributes needs
++		 * to be kicked down to page table mappings.
++		 */
++		if (unlikely(flags & _PAGE_PCC_MASK))
++			return NULL;
++		if (unlikely(flags & _PAGE_CACHABLE))
+ 			return (void __iomem *)P1SEGADDR(offset);
+ 
+ 		return (void __iomem *)P2SEGADDR(offset);
+diff --git a/arch/sh/include/asm/pgtable_32.h b/arch/sh/include/asm/pgtable_32.h
+index 43528ec..68f3eff 100644
+--- a/arch/sh/include/asm/pgtable_32.h
++++ b/arch/sh/include/asm/pgtable_32.h
+@@ -76,6 +76,10 @@
+ /* Wrapper for extended mode pgprot twiddling */
+ #define _PAGE_EXT(x)		((unsigned long long)(x) << 32)
+ 
++#ifdef CONFIG_X2TLB
++#define _PAGE_PCC_MASK	0x00000000	/* No legacy PTEA support */
++#else
++
+ /* software: moves to PTEA.TC (Timing Control) */
+ #define _PAGE_PCC_AREA5	0x00000000	/* use BSC registers for area5 */
+ #define _PAGE_PCC_AREA6	0x80000000	/* use BSC registers for area6 */
+@@ -89,7 +93,8 @@
+ #define _PAGE_PCC_ATR8	0x60000000	/* Attribute Memory space, 8 bit bus */
+ #define _PAGE_PCC_ATR16	0x60000001	/* Attribute Memory space, 6 bit bus */
+ 
+-#ifndef CONFIG_X2TLB
++#define _PAGE_PCC_MASK	0xe0000001
++
+ /* copy the ptea attributes */
+ static inline unsigned long copy_ptea_attributes(unsigned long x)
+ {
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index e330da2..57e823a 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -2035,6 +2035,7 @@ config OLPC
+ 	bool "One Laptop Per Child support"
+ 	select GPIOLIB
+ 	select OLPC_OPENFIRMWARE
++	depends on !X86_64 && !X86_PAE
+ 	---help---
+ 	  Add support for detecting the unique features of the OLPC
+ 	  XO hardware.
+diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
+index 4a2d4e0..8b5393e 100644
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -36,8 +36,6 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ 	unsigned cpu = smp_processor_id();
+ 
+ 	if (likely(prev != next)) {
+-		/* stop flush ipis for the previous mm */
+-		cpumask_clear_cpu(cpu, mm_cpumask(prev));
+ #ifdef CONFIG_SMP
+ 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+ 		percpu_write(cpu_tlbstate.active_mm, next);
+@@ -47,6 +45,9 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ 		/* Re-load page tables */
+ 		load_cr3(next->pgd);
+ 
++		/* stop flush ipis for the previous mm */
++		cpumask_clear_cpu(cpu, mm_cpumask(prev));
++
+ 		/*
+ 		 * load the LDT, if the LDT is different:
+ 		 */
+diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
+index 42d412f..ce1d54c 100644
+--- a/arch/x86/include/asm/uv/uv_bau.h
++++ b/arch/x86/include/asm/uv/uv_bau.h
+@@ -26,20 +26,22 @@
+  * BAU_SB_DESCRIPTOR_BASE register, set 1 is located at BASE + 512,
+  * set 2 is at BASE + 2*512, set 3 at BASE + 3*512, and so on.
+  *
+- * We will use 31 sets, one for sending BAU messages from each of the 32
++ * We will use one set for sending BAU messages from each of the
+  * cpu's on the uvhub.
+  *
+  * TLB shootdown will use the first of the 8 descriptors of each set.
+  * Each of the descriptors is 64 bytes in size (8*64 = 512 bytes in a set).
+  */
+ 
++#define MAX_CPUS_PER_UVHUB		64
++#define MAX_CPUS_PER_SOCKET		32
++#define UV_ADP_SIZE			64 /* hardware-provided max. */
++#define UV_CPUS_PER_ACT_STATUS		32 /* hardware-provided max. */
+ #define UV_ITEMS_PER_DESCRIPTOR		8
+ /* the 'throttle' to prevent the hardware stay-busy bug */
+ #define MAX_BAU_CONCURRENT		3
+-#define UV_CPUS_PER_ACT_STATUS		32
+ #define UV_ACT_STATUS_MASK		0x3
+ #define UV_ACT_STATUS_SIZE		2
+-#define UV_ADP_SIZE			32
+ #define UV_DISTRIBUTION_SIZE		256
+ #define UV_SW_ACK_NPENDING		8
+ #define UV_NET_ENDPOINT_INTD		0x38
+@@ -100,7 +102,6 @@
+  * number of destination side software ack resources
+  */
+ #define DEST_NUM_RESOURCES		8
+-#define MAX_CPUS_PER_NODE		32
+ /*
+  * completion statuses for sending a TLB flush message
+  */
+diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
+index 01c0f3e..bebabec 100644
+--- a/arch/x86/kernel/cpu/mtrr/main.c
++++ b/arch/x86/kernel/cpu/mtrr/main.c
+@@ -793,13 +793,21 @@ void set_mtrr_aps_delayed_init(void)
+ }
+ 
+ /*
+- * MTRR initialization for all AP's
++ * Delayed MTRR initialization for all AP's
+  */
+ void mtrr_aps_init(void)
+ {
+ 	if (!use_intel())
+ 		return;
+ 
++	/*
++	 * Check if someone has requested the delay of AP MTRR initialization,
++	 * by doing set_mtrr_aps_delayed_init(), prior to this point. If not,
++	 * then we are done.
++	 */
++	if (!mtrr_aps_delayed_init)
++		return;
++
+ 	set_mtrr(~0U, 0, 0, 0);
+ 	mtrr_aps_delayed_init = false;
+ }
+diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
+index 83ec017..e430114 100644
+--- a/arch/x86/kernel/irq.c
++++ b/arch/x86/kernel/irq.c
+@@ -357,7 +357,8 @@ void fixup_irqs(void)
+ 		if (irr  & (1 << (vector % 32))) {
+ 			irq = __get_cpu_var(vector_irq)[vector];
+ 
+-			data = irq_get_irq_data(irq);
++			desc = irq_to_desc(irq);
++			data = &desc->irq_data;
+ 			raw_spin_lock(&desc->lock);
+ 			if (data->chip->irq_retrigger)
+ 				data->chip->irq_retrigger(data);
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 57d1868..2502aaf 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -97,21 +97,31 @@ void show_regs(struct pt_regs *regs)
+ 
+ void show_regs_common(void)
+ {
+-	const char *board, *product;
++	const char *vendor, *product, *board;
+ 
+-	board = dmi_get_system_info(DMI_BOARD_NAME);
+-	if (!board)
+-		board = "";
++	vendor = dmi_get_system_info(DMI_SYS_VENDOR);
++	if (!vendor)
++		vendor = "";
+ 	product = dmi_get_system_info(DMI_PRODUCT_NAME);
+ 	if (!product)
+ 		product = "";
+ 
++	/* Board Name is optional */
++	board = dmi_get_system_info(DMI_BOARD_NAME);
++
+ 	printk(KERN_CONT "\n");
+-	printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s %s/%s\n",
++	printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
+ 		current->pid, current->comm, print_tainted(),
+ 		init_utsname()->release,
+ 		(int)strcspn(init_utsname()->version, " "),
+-		init_utsname()->version, board, product);
++		init_utsname()->version);
++	printk(KERN_CONT " ");
++	printk(KERN_CONT "%s %s", vendor, product);
++	if (board) {
++		printk(KERN_CONT "/");
++		printk(KERN_CONT "%s", board);
++	}
++	printk(KERN_CONT "\n");
+ }
+ 
+ void flush_thread(void)
+diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
+index ba9caa8..df58e9c 100644
+--- a/arch/x86/platform/uv/tlb_uv.c
++++ b/arch/x86/platform/uv/tlb_uv.c
+@@ -1341,7 +1341,7 @@ uv_activation_descriptor_init(int node, int pnode)
+ 
+ 	/*
+ 	 * each bau_desc is 64 bytes; there are 8 (UV_ITEMS_PER_DESCRIPTOR)
+-	 * per cpu; and up to 32 (UV_ADP_SIZE) cpu's per uvhub
++	 * per cpu; and one per cpu on the uvhub (UV_ADP_SIZE)
+ 	 */
+ 	bau_desc = kmalloc_node(sizeof(struct bau_desc) * UV_ADP_SIZE
+ 				* UV_ITEMS_PER_DESCRIPTOR, GFP_KERNEL, node);
+@@ -1490,7 +1490,7 @@ calculate_destination_timeout(void)
+ /*
+  * initialize the bau_control structure for each cpu
+  */
+-static void __init uv_init_per_cpu(int nuvhubs)
++static int __init uv_init_per_cpu(int nuvhubs)
+ {
+ 	int i;
+ 	int cpu;
+@@ -1507,7 +1507,7 @@ static void __init uv_init_per_cpu(int nuvhubs)
+ 	struct bau_control *smaster = NULL;
+ 	struct socket_desc {
+ 		short num_cpus;
+-		short cpu_number[16];
++		short cpu_number[MAX_CPUS_PER_SOCKET];
+ 	};
+ 	struct uvhub_desc {
+ 		unsigned short socket_mask;
+@@ -1540,6 +1540,10 @@ static void __init uv_init_per_cpu(int nuvhubs)
+ 		sdp = &bdp->socket[socket];
+ 		sdp->cpu_number[sdp->num_cpus] = cpu;
+ 		sdp->num_cpus++;
++		if (sdp->num_cpus > MAX_CPUS_PER_SOCKET) {
++			printk(KERN_EMERG "%d cpus per socket invalid\n", sdp->num_cpus);
++			return 1;
++		}
+ 	}
+ 	for (uvhub = 0; uvhub < nuvhubs; uvhub++) {
+ 		if (!(*(uvhub_mask + (uvhub/8)) & (1 << (uvhub%8))))
+@@ -1570,6 +1574,12 @@ static void __init uv_init_per_cpu(int nuvhubs)
+ 				bcp->uvhub_master = hmaster;
+ 				bcp->uvhub_cpu = uv_cpu_hub_info(cpu)->
+ 						blade_processor_id;
++				if (bcp->uvhub_cpu >= MAX_CPUS_PER_UVHUB) {
++					printk(KERN_EMERG
++						"%d cpus per uvhub invalid\n",
++						bcp->uvhub_cpu);
++					return 1;
++				}
+ 			}
+ nextsocket:
+ 			socket++;
+@@ -1595,6 +1605,7 @@ nextsocket:
+ 		bcp->congested_reps = congested_reps;
+ 		bcp->congested_period = congested_period;
+ 	}
++	return 0;
+ }
+ 
+ /*
+@@ -1625,7 +1636,10 @@ static int __init uv_bau_init(void)
+ 	spin_lock_init(&disable_lock);
+ 	congested_cycles = microsec_2_cycles(congested_response_us);
+ 
+-	uv_init_per_cpu(nuvhubs);
++	if (uv_init_per_cpu(nuvhubs)) {
++		nobau = 1;
++		return 0;
++	}
+ 
+ 	uv_partition_base_pnode = 0x7fffffff;
+ 	for (uvhub = 0; uvhub < nuvhubs; uvhub++)
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 4ce953f..8767520 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -64,13 +64,27 @@ static void drive_stat_acct(struct request *rq, int new_io)
+ 		return;
+ 
+ 	cpu = part_stat_lock();
+-	part = disk_map_sector_rcu(rq->rq_disk, blk_rq_pos(rq));
+ 
+-	if (!new_io)
++	if (!new_io) {
++		part = rq->part;
+ 		part_stat_inc(cpu, part, merges[rw]);
+-	else {
++	} else {
++		part = disk_map_sector_rcu(rq->rq_disk, blk_rq_pos(rq));
++		if (!kref_test_and_get(&part->ref)) {
++			/*
++			 * The partition is already being removed,
++			 * the request will be accounted on the disk only
++			 *
++			 * We take a reference on disk->part0 although that
++			 * partition will never be deleted, so we can treat
++			 * it as any other partition.
++			 */
++			part = &rq->rq_disk->part0;
++			kref_get(&part->ref);
++		}
+ 		part_round_stats(cpu, part);
+ 		part_inc_in_flight(part, rw);
++		rq->part = part;
+ 	}
+ 
+ 	part_stat_unlock();
+@@ -128,6 +142,7 @@ void blk_rq_init(struct request_queue *q, struct request *rq)
+ 	rq->ref_count = 1;
+ 	rq->start_time = jiffies;
+ 	set_start_time_ns(rq);
++	rq->part = NULL;
+ }
+ EXPORT_SYMBOL(blk_rq_init);
+ 
+@@ -1776,7 +1791,7 @@ static void blk_account_io_completion(struct request *req, unsigned int bytes)
+ 		int cpu;
+ 
+ 		cpu = part_stat_lock();
+-		part = disk_map_sector_rcu(req->rq_disk, blk_rq_pos(req));
++		part = req->part;
+ 		part_stat_add(cpu, part, sectors[rw], bytes >> 9);
+ 		part_stat_unlock();
+ 	}
+@@ -1796,13 +1811,14 @@ static void blk_account_io_done(struct request *req)
+ 		int cpu;
+ 
+ 		cpu = part_stat_lock();
+-		part = disk_map_sector_rcu(req->rq_disk, blk_rq_pos(req));
++		part = req->part;
+ 
+ 		part_stat_inc(cpu, part, ios[rw]);
+ 		part_stat_add(cpu, part, ticks[rw], duration);
+ 		part_round_stats(cpu, part);
+ 		part_dec_in_flight(part, rw);
+ 
++		kref_put(&part->ref, __delete_partition);
+ 		part_stat_unlock();
+ 	}
+ }
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 74bc4a7..23ea74b 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -351,11 +351,12 @@ static void blk_account_io_merge(struct request *req)
+ 		int cpu;
+ 
+ 		cpu = part_stat_lock();
+-		part = disk_map_sector_rcu(req->rq_disk, blk_rq_pos(req));
++		part = req->part;
+ 
+ 		part_round_stats(cpu, part);
+ 		part_dec_in_flight(part, rq_data_dir(req));
+ 
++		kref_put(&part->ref, __delete_partition);
+ 		part_stat_unlock();
+ 	}
+ }
+diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
+index 4cd59b0..6f2a966 100644
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -3412,6 +3412,10 @@ static bool cfq_should_wait_busy(struct cfq_data *cfqd, struct cfq_queue *cfqq)
+ {
+ 	struct cfq_io_context *cic = cfqd->active_cic;
+ 
++	/* If the queue already has requests, don't wait */
++	if (!RB_EMPTY_ROOT(&cfqq->sort_list))
++		return false;
++
+ 	/* If there are other queues in the group, don't wait */
+ 	if (cfqq->cfqg->nr_cfqq > 1)
+ 		return false;
+diff --git a/block/genhd.c b/block/genhd.c
+index 5fa2b44..0c55eae 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -1192,6 +1192,7 @@ struct gendisk *alloc_disk_node(int minors, int node_id)
+ 			return NULL;
+ 		}
+ 		disk->part_tbl->part[0] = &disk->part0;
++		kref_init(&disk->part0.ref);
+ 
+ 		disk->minors = minors;
+ 		rand_initialize_disk(disk);
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 66aa4be..f03ea29 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -1102,9 +1102,9 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
+ 		struct request_queue *q = sdev->request_queue;
+ 		void *buf;
+ 
+-		/* set the min alignment and padding */
+-		blk_queue_update_dma_alignment(sdev->request_queue,
+-					       ATA_DMA_PAD_SZ - 1);
++		sdev->sector_size = ATA_SECT_SIZE;
++
++		/* set DMA padding */
+ 		blk_queue_update_dma_pad(sdev->request_queue,
+ 					 ATA_DMA_PAD_SZ - 1);
+ 
+@@ -1118,13 +1118,25 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
+ 
+ 		blk_queue_dma_drain(q, atapi_drain_needed, buf, ATAPI_MAX_DRAIN);
+ 	} else {
+-		/* ATA devices must be sector aligned */
+ 		sdev->sector_size = ata_id_logical_sector_size(dev->id);
+-		blk_queue_update_dma_alignment(sdev->request_queue,
+-					       sdev->sector_size - 1);
+ 		sdev->manage_start_stop = 1;
+ 	}
+ 
++	/*
++	 * ata_pio_sectors() expects buffer for each sector to not cross
++	 * page boundary.  Enforce it by requiring buffers to be sector
++	 * aligned, which works iff sector_size is not larger than
++	 * PAGE_SIZE.  ATAPI devices also need the alignment as
++	 * IDENTIFY_PACKET is executed as ATA_PROT_PIO.
++	 */
++	if (sdev->sector_size > PAGE_SIZE)
++		ata_dev_printk(dev, KERN_WARNING,
++			"sector_size=%u > PAGE_SIZE, PIO may malfunction\n",
++			sdev->sector_size);
++
++	blk_queue_update_dma_alignment(sdev->request_queue,
++				       sdev->sector_size - 1);
++
+ 	if (dev->flags & ATA_DFLAG_AN)
+ 		set_bit(SDEV_EVT_MEDIA_CHANGE, sdev->supported_events);
+ 
+diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
+index 8cc536e..d7d8026 100644
+--- a/drivers/ata/pata_mpc52xx.c
++++ b/drivers/ata/pata_mpc52xx.c
+@@ -610,7 +610,7 @@ static struct scsi_host_template mpc52xx_ata_sht = {
+ };
+ 
+ static struct ata_port_operations mpc52xx_ata_port_ops = {
+-	.inherits		= &ata_sff_port_ops,
++	.inherits		= &ata_bmdma_port_ops,
+ 	.sff_dev_select		= mpc52xx_ata_dev_select,
+ 	.set_piomode		= mpc52xx_ata_set_piomode,
+ 	.set_dmamode		= mpc52xx_ata_set_dmamode,
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index 02c652b..6b2d409 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -404,12 +404,15 @@ static int rpm_suspend(struct device *dev, int rpmflags)
+ 		goto out;
+ 	}
+ 
++	/* Maybe the parent is now able to suspend. */
+ 	if (parent && !parent->power.ignore_children) {
+-		spin_unlock_irq(&dev->power.lock);
++		spin_unlock(&dev->power.lock);
+ 
+-		pm_request_idle(parent);
++		spin_lock(&parent->power.lock);
++		rpm_idle(parent, RPM_ASYNC);
++		spin_unlock(&parent->power.lock);
+ 
+-		spin_lock_irq(&dev->power.lock);
++		spin_lock(&dev->power.lock);
+ 	}
+ 
+  out:
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index a32fb41..e6fc716 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -53,7 +53,6 @@
+ #define DBG_BLKDEV      0x0100
+ #define DBG_RX          0x0200
+ #define DBG_TX          0x0400
+-static DEFINE_MUTEX(nbd_mutex);
+ static unsigned int debugflags;
+ #endif /* NDEBUG */
+ 
+@@ -718,11 +717,9 @@ static int nbd_ioctl(struct block_device *bdev, fmode_t mode,
+ 	dprintk(DBG_IOCTL, "%s: nbd_ioctl cmd=%s(0x%x) arg=%lu\n",
+ 			lo->disk->disk_name, ioctl_cmd_to_ascii(cmd), cmd, arg);
+ 
+-	mutex_lock(&nbd_mutex);
+ 	mutex_lock(&lo->tx_lock);
+ 	error = __nbd_ioctl(bdev, lo, cmd, arg);
+ 	mutex_unlock(&lo->tx_lock);
+-	mutex_unlock(&nbd_mutex);
+ 
+ 	return error;
+ }
+diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
+index e72f49d..2c9dca9 100644
+--- a/drivers/char/agp/intel-agp.c
++++ b/drivers/char/agp/intel-agp.c
+@@ -774,20 +774,14 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
+ 	dev_info(&pdev->dev, "Intel %s Chipset\n", intel_agp_chipsets[i].name);
+ 
+ 	/*
+-	* If the device has not been properly setup, the following will catch
+-	* the problem and should stop the system from crashing.
+-	* 20030610 - hamish@×××.org
+-	*/
+-	if (pci_enable_device(pdev)) {
+-		dev_err(&pdev->dev, "can't enable PCI device\n");
+-		agp_put_bridge(bridge);
+-		return -ENODEV;
+-	}
+-
+-	/*
+ 	* The following fixes the case where the BIOS has "forgotten" to
+ 	* provide an address range for the GART.
+ 	* 20030610 - hamish@×××.org
++	* This happens before pci_enable_device() intentionally;
++	* calling pci_enable_device() before assigning the resource
++	* will result in the GART being disabled on machines with such
++	* BIOSs (the GART ends up with a BAR starting at 0, which
++	* conflicts a lot of other devices).
+ 	*/
+ 	r = &pdev->resource[0];
+ 	if (!r->start && r->end) {
+@@ -798,6 +792,17 @@ static int __devinit agp_intel_probe(struct pci_dev *pdev,
+ 		}
+ 	}
+ 
++	/*
++	* If the device has not been properly setup, the following will catch
++	* the problem and should stop the system from crashing.
++	* 20030610 - hamish@×××.org
++	*/
++	if (pci_enable_device(pdev)) {
++		dev_err(&pdev->dev, "can't enable PCI device\n");
++		agp_put_bridge(bridge);
++		return -ENODEV;
++	}
++
+ 	/* Fill in the mode register */
+ 	if (cap_ptr) {
+ 		pci_read_config_dword(pdev,
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index 035da9e..2689ddb 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -320,6 +320,7 @@ static int unload_when_empty = 1;
+ static int add_smi(struct smi_info *smi);
+ static int try_smi_init(struct smi_info *smi);
+ static void cleanup_one_si(struct smi_info *to_clean);
++static void cleanup_ipmi_si(void);
+ 
+ static ATOMIC_NOTIFIER_HEAD(xaction_notifier_list);
+ static int register_xaction_notifier(struct notifier_block *nb)
+@@ -3435,16 +3436,7 @@ static int __devinit init_ipmi_si(void)
+ 	mutex_lock(&smi_infos_lock);
+ 	if (unload_when_empty && list_empty(&smi_infos)) {
+ 		mutex_unlock(&smi_infos_lock);
+-#ifdef CONFIG_PCI
+-		if (pci_registered)
+-			pci_unregister_driver(&ipmi_pci_driver);
+-#endif
+-
+-#ifdef CONFIG_PPC_OF
+-		if (of_registered)
+-			of_unregister_platform_driver(&ipmi_of_platform_driver);
+-#endif
+-		driver_unregister(&ipmi_driver.driver);
++		cleanup_ipmi_si();
+ 		printk(KERN_WARNING PFX
+ 		       "Unable to find any System Interface(s)\n");
+ 		return -ENODEV;
+diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
+index 7c41335..55d0466 100644
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -364,12 +364,14 @@ unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
+ 		    tpm_protected_ordinal_duration[ordinal &
+ 						   TPM_PROTECTED_ORDINAL_MASK];
+ 
+-	if (duration_idx != TPM_UNDEFINED)
++	if (duration_idx != TPM_UNDEFINED) {
+ 		duration = chip->vendor.duration[duration_idx];
+-	if (duration <= 0)
++		/* if duration is 0, it's because chip->vendor.duration wasn't */
++		/* filled yet, so we set the lowest timeout just to give enough */
++		/* time for tpm_get_timeouts() to succeed */
++		return (duration <= 0 ? HZ : duration);
++	} else
+ 		return 2 * 60 * HZ;
+-	else
+-		return duration;
+ }
+ EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
+ 
+@@ -575,9 +577,11 @@ duration:
+ 	if (rc)
+ 		return;
+ 
+-	if (be32_to_cpu(tpm_cmd.header.out.return_code)
+-	    != 3 * sizeof(u32))
++	if (be32_to_cpu(tpm_cmd.header.out.return_code) != 0 ||
++	    be32_to_cpu(tpm_cmd.header.out.length)
++	    != sizeof(tpm_cmd.header.out) + sizeof(u32) + 3 * sizeof(u32))
+ 		return;
++
+ 	duration_cap = &tpm_cmd.params.getcap_out.cap.duration;
+ 	chip->vendor.duration[TPM_SHORT] =
+ 	    usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_short));
+@@ -921,6 +925,18 @@ ssize_t tpm_show_caps_1_2(struct device * dev,
+ }
+ EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
+ 
++ssize_t tpm_show_timeouts(struct device *dev, struct device_attribute *attr,
++			  char *buf)
++{
++	struct tpm_chip *chip = dev_get_drvdata(dev);
++
++	return sprintf(buf, "%d %d %d\n",
++	               jiffies_to_usecs(chip->vendor.duration[TPM_SHORT]),
++	               jiffies_to_usecs(chip->vendor.duration[TPM_MEDIUM]),
++	               jiffies_to_usecs(chip->vendor.duration[TPM_LONG]));
++}
++EXPORT_SYMBOL_GPL(tpm_show_timeouts);
++
+ ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
+ 			const char *buf, size_t count)
+ {
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index 792868d..ba1779c 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -56,6 +56,8 @@ extern ssize_t tpm_show_owned(struct device *, struct device_attribute *attr,
+ 				char *);
+ extern ssize_t tpm_show_temp_deactivated(struct device *,
+ 					 struct device_attribute *attr, char *);
++extern ssize_t tpm_show_timeouts(struct device *,
++				 struct device_attribute *attr, char *);
+ 
+ struct tpm_chip;
+ 
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index c17a305..0d1d38e 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -376,6 +376,7 @@ static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
+ 		   NULL);
+ static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+ static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
++static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
+ 
+ static struct attribute *tis_attrs[] = {
+ 	&dev_attr_pubek.attr,
+@@ -385,7 +386,8 @@ static struct attribute *tis_attrs[] = {
+ 	&dev_attr_owned.attr,
+ 	&dev_attr_temp_deactivated.attr,
+ 	&dev_attr_caps.attr,
+-	&dev_attr_cancel.attr, NULL,
++	&dev_attr_cancel.attr,
++	&dev_attr_timeouts.attr, NULL,
+ };
+ 
+ static struct attribute_group tis_attr_grp = {
+@@ -493,9 +495,6 @@ static int tpm_tis_init(struct device *dev, resource_size_t start,
+ 		 "1.2 TPM (device-id 0x%X, rev-id %d)\n",
+ 		 vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
+ 
+-	if (is_itpm(to_pnp_dev(dev)))
+-		itpm = 1;
+-
+ 	if (itpm)
+ 		dev_info(dev, "Intel iTPM workaround enabled\n");
+ 
+@@ -637,6 +636,9 @@ static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
+ 	else
+ 		interrupts = 0;
+ 
++	if (is_itpm(pnp_dev))
++		itpm = 1;
++
+ 	return tpm_tis_init(&pnp_dev->dev, start, len, irq);
+ }
+ 
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index 896a2ce..ad2520b 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -1462,6 +1462,17 @@ static void control_work_handler(struct work_struct *work)
+ 	spin_unlock(&portdev->cvq_lock);
+ }
+ 
++static void out_intr(struct virtqueue *vq)
++{
++	struct port *port;
++
++	port = find_port_by_vq(vq->vdev->priv, vq);
++	if (!port)
++		return;
++
++	wake_up_interruptible(&port->waitqueue);
++}
++
+ static void in_intr(struct virtqueue *vq)
+ {
+ 	struct port *port;
+@@ -1566,7 +1577,7 @@ static int init_vqs(struct ports_device *portdev)
+ 	 */
+ 	j = 0;
+ 	io_callbacks[j] = in_intr;
+-	io_callbacks[j + 1] = NULL;
++	io_callbacks[j + 1] = out_intr;
+ 	io_names[j] = "input";
+ 	io_names[j + 1] = "output";
+ 	j += 2;
+@@ -1580,7 +1591,7 @@ static int init_vqs(struct ports_device *portdev)
+ 		for (i = 1; i < nr_ports; i++) {
+ 			j += 2;
+ 			io_callbacks[j] = in_intr;
+-			io_callbacks[j + 1] = NULL;
++			io_callbacks[j + 1] = out_intr;
+ 			io_names[j] = "input";
+ 			io_names[j + 1] = "output";
+ 		}
+diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
+index a507108..97df791 100644
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -154,6 +154,45 @@ void cpuidle_resume_and_unlock(void)
+ 
+ EXPORT_SYMBOL_GPL(cpuidle_resume_and_unlock);
+ 
++#ifdef CONFIG_ARCH_HAS_CPU_RELAX
++static int poll_idle(struct cpuidle_device *dev, struct cpuidle_state *st)
++{
++	ktime_t	t1, t2;
++	s64 diff;
++	int ret;
++
++	t1 = ktime_get();
++	local_irq_enable();
++	while (!need_resched())
++		cpu_relax();
++
++	t2 = ktime_get();
++	diff = ktime_to_us(ktime_sub(t2, t1));
++	if (diff > INT_MAX)
++		diff = INT_MAX;
++
++	ret = (int) diff;
++	return ret;
++}
++
++static void poll_idle_init(struct cpuidle_device *dev)
++{
++	struct cpuidle_state *state = &dev->states[0];
++
++	cpuidle_set_statedata(state, NULL);
++
++	snprintf(state->name, CPUIDLE_NAME_LEN, "C0");
++	snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
++	state->exit_latency = 0;
++	state->target_residency = 0;
++	state->power_usage = -1;
++	state->flags = CPUIDLE_FLAG_POLL;
++	state->enter = poll_idle;
++}
++#else
++static void poll_idle_init(struct cpuidle_device *dev) {}
++#endif /* CONFIG_ARCH_HAS_CPU_RELAX */
++
+ /**
+  * cpuidle_enable_device - enables idle PM for a CPU
+  * @dev: the CPU
+@@ -178,6 +217,8 @@ int cpuidle_enable_device(struct cpuidle_device *dev)
+ 			return ret;
+ 	}
+ 
++	poll_idle_init(dev);
++
+ 	if ((ret = cpuidle_add_state_sysfs(dev)))
+ 		return ret;
+ 
+@@ -232,45 +273,6 @@ void cpuidle_disable_device(struct cpuidle_device *dev)
+ 
+ EXPORT_SYMBOL_GPL(cpuidle_disable_device);
+ 
+-#ifdef CONFIG_ARCH_HAS_CPU_RELAX
+-static int poll_idle(struct cpuidle_device *dev, struct cpuidle_state *st)
+-{
+-	ktime_t	t1, t2;
+-	s64 diff;
+-	int ret;
+-
+-	t1 = ktime_get();
+-	local_irq_enable();
+-	while (!need_resched())
+-		cpu_relax();
+-
+-	t2 = ktime_get();
+-	diff = ktime_to_us(ktime_sub(t2, t1));
+-	if (diff > INT_MAX)
+-		diff = INT_MAX;
+-
+-	ret = (int) diff;
+-	return ret;
+-}
+-
+-static void poll_idle_init(struct cpuidle_device *dev)
+-{
+-	struct cpuidle_state *state = &dev->states[0];
+-
+-	cpuidle_set_statedata(state, NULL);
+-
+-	snprintf(state->name, CPUIDLE_NAME_LEN, "C0");
+-	snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
+-	state->exit_latency = 0;
+-	state->target_residency = 0;
+-	state->power_usage = -1;
+-	state->flags = CPUIDLE_FLAG_POLL;
+-	state->enter = poll_idle;
+-}
+-#else
+-static void poll_idle_init(struct cpuidle_device *dev) {}
+-#endif /* CONFIG_ARCH_HAS_CPU_RELAX */
+-
+ /**
+  * __cpuidle_register_device - internal register function called before register
+  * and enable routines
+@@ -291,8 +293,6 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
+ 
+ 	init_completion(&dev->kobj_unregister);
+ 
+-	poll_idle_init(dev);
+-
+ 	/*
+ 	 * cpuidle driver should set the dev->power_specified bit
+ 	 * before registering the device if the driver provides
+diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
+index be04923..24ff355 100644
+--- a/drivers/firewire/core-card.c
++++ b/drivers/firewire/core-card.c
+@@ -75,6 +75,8 @@ static size_t config_rom_length = 1 + 4 + 1 + 1;
+ #define BIB_IRMC		((1) << 31)
+ #define NODE_CAPABILITIES	0x0c0083c0 /* per IEEE 1394 clause 8.3.2.6.5.2 */
+ 
++#define CANON_OUI		0x000085
++
+ static void generate_config_rom(struct fw_card *card, __be32 *config_rom)
+ {
+ 	struct fw_descriptor *desc;
+@@ -284,6 +286,7 @@ static void bm_work(struct work_struct *work)
+ 	bool root_device_is_running;
+ 	bool root_device_is_cmc;
+ 	bool irm_is_1394_1995_only;
++	bool keep_this_irm;
+ 
+ 	spin_lock_irq(&card->lock);
+ 
+@@ -305,6 +308,10 @@ static void bm_work(struct work_struct *work)
+ 	irm_is_1394_1995_only = irm_device && irm_device->config_rom &&
+ 			(irm_device->config_rom[2] & 0x000000f0) == 0;
+ 
++	/* Canon MV5i works unreliably if it is not root node. */
++	keep_this_irm = irm_device && irm_device->config_rom &&
++			irm_device->config_rom[3] >> 8 == CANON_OUI;
++
+ 	root_id  = root_node->node_id;
+ 	irm_id   = card->irm_node->node_id;
+ 	local_id = card->local_node->node_id;
+@@ -333,7 +340,7 @@ static void bm_work(struct work_struct *work)
+ 			goto pick_me;
+ 		}
+ 
+-		if (irm_is_1394_1995_only) {
++		if (irm_is_1394_1995_only && !keep_this_irm) {
+ 			new_root_id = local_id;
+ 			fw_notify("%s, making local node (%02x) root.\n",
+ 				  "IRM is not 1394a compliant", new_root_id);
+@@ -382,7 +389,7 @@ static void bm_work(struct work_struct *work)
+ 
+ 		spin_lock_irq(&card->lock);
+ 
+-		if (rcode != RCODE_COMPLETE) {
++		if (rcode != RCODE_COMPLETE && !keep_this_irm) {
+ 			/*
+ 			 * The lock request failed, maybe the IRM
+ 			 * isn't really IRM capable after all. Let's
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index e28e41668..bcb1126 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -378,10 +378,17 @@ static void __init print_filtered(const char *info)
+ 
+ static void __init dmi_dump_ids(void)
+ {
++	const char *board;	/* Board Name is optional */
++
+ 	printk(KERN_DEBUG "DMI: ");
+-	print_filtered(dmi_get_system_info(DMI_BOARD_NAME));
+-	printk(KERN_CONT "/");
++	print_filtered(dmi_get_system_info(DMI_SYS_VENDOR));
++	printk(KERN_CONT " ");
+ 	print_filtered(dmi_get_system_info(DMI_PRODUCT_NAME));
++	board = dmi_get_system_info(DMI_BOARD_NAME);
++	if (board) {
++		printk(KERN_CONT "/");
++		print_filtered(board);
++	}
+ 	printk(KERN_CONT ", BIOS ");
+ 	print_filtered(dmi_get_system_info(DMI_BIOS_VERSION));
+ 	printk(KERN_CONT " ");
+diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
+index 7af4436..7ea4bdd 100644
+--- a/drivers/gpu/drm/Kconfig
++++ b/drivers/gpu/drm/Kconfig
+@@ -100,7 +100,10 @@ config DRM_I830
+ config DRM_I915
+ 	tristate "i915 driver"
+ 	depends on AGP_INTEL
++	# we need shmfs for the swappable backing store, and in particular
++	# the shmem_readpage() which depends upon tmpfs
+ 	select SHMEM
++	select TMPFS
+ 	select DRM_KMS_HELPER
+ 	select FB_CFB_FILLRECT
+ 	select FB_CFB_COPYAREA
+diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
+index 2d4e17a..a0ce53d 100644
+--- a/drivers/gpu/drm/drm_crtc_helper.c
++++ b/drivers/gpu/drm/drm_crtc_helper.c
+@@ -650,9 +650,16 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
+ 						      old_fb)) {
+ 				DRM_ERROR("failed to set mode on [CRTC:%d]\n",
+ 					  set->crtc->base.id);
++				set->crtc->fb = old_fb;
+ 				ret = -EINVAL;
+ 				goto fail;
+ 			}
++			DRM_DEBUG_KMS("Setting connector DPMS state to on\n");
++			for (i = 0; i < set->num_connectors; i++) {
++				DRM_DEBUG_KMS("\t[CONNECTOR:%d:%s] set DPMS on\n", set->connectors[i]->base.id,
++					      drm_get_connector_name(set->connectors[i]));
++				set->connectors[i]->dpms = DRM_MODE_DPMS_ON;
++			}
+ 		}
+ 		drm_helper_disable_unused_functions(dev);
+ 	} else if (fb_changed) {
+@@ -664,14 +671,10 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
+ 			set->crtc->fb = set->fb;
+ 		ret = crtc_funcs->mode_set_base(set->crtc,
+ 						set->x, set->y, old_fb);
+-		if (ret != 0)
++		if (ret != 0) {
++			set->crtc->fb = old_fb;
+ 			goto fail;
+-	}
+-	DRM_DEBUG_KMS("Setting connector DPMS state to on\n");
+-	for (i = 0; i < set->num_connectors; i++) {
+-		DRM_DEBUG_KMS("\t[CONNECTOR:%d:%s] set DPMS on\n", set->connectors[i]->base.id,
+-			      drm_get_connector_name(set->connectors[i]));
+-		set->connectors[i]->dpms = DRM_MODE_DPMS_ON;
++		}
+ 	}
+ 
+ 	kfree(save_connectors);
+diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
+index cb900dc..4916c10 100644
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -1243,9 +1243,15 @@ static int i915_load_modeset_init(struct drm_device *dev,
+ 	if (ret)
+ 		DRM_INFO("failed to find VBIOS tables\n");
+ 
+-	/* if we have > 1 VGA cards, then disable the radeon VGA resources */
++	/* If we have > 1 VGA cards, then we need to arbitrate access
++	 * to the common VGA resources.
++	 *
++	 * If we are a secondary display controller (!PCI_DISPLAY_CLASS_VGA),
++	 * then we do not take part in VGA arbitration and the
++	 * vga_client_register() fails with -ENODEV.
++	 */
+ 	ret = vga_client_register(dev->pdev, dev, NULL, i915_vga_set_decode);
+-	if (ret)
++	if (ret && ret != -ENODEV)
+ 		goto cleanup_ringbuffer;
+ 
+ 	intel_register_dsm_handler();
+diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
+index f737960..da769bc 100644
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -54,7 +54,7 @@ extern int intel_agp_enabled;
+ 
+ #define INTEL_VGA_DEVICE(id, info) {		\
+ 	.class = PCI_CLASS_DISPLAY_VGA << 8,	\
+-	.class_mask = 0xffff00,			\
++	.class_mask = 0xff0000,			\
+ 	.vendor = 0x8086,			\
+ 	.device = id,				\
+ 	.subvendor = PCI_ANY_ID,		\
+@@ -501,6 +501,14 @@ int i915_reset(struct drm_device *dev, u8 flags)
+ static int __devinit
+ i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
++	/* Only bind to function 0 of the device. Early generations
++	 * used function 1 as a placeholder for multi-head. This causes
++	 * us confusion instead, especially on the systems where both
++	 * functions have the same PCI-ID!
++	 */
++	if (PCI_FUNC(pdev->devfn))
++		return -ENODEV;
++
+ 	return drm_get_pci_dev(pdev, ent, &driver);
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 409826d..d2896eb 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -329,6 +329,7 @@ typedef struct drm_i915_private {
+ 
+ 	/* LVDS info */
+ 	int backlight_level;  /* restore backlight to this value */
++	bool backlight_enabled;
+ 	struct drm_display_mode *panel_fixed_mode;
+ 	struct drm_display_mode *lfp_lvds_vbt_mode; /* if any */
+ 	struct drm_display_mode *sdvo_lvds_vbt_mode; /* if any */
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index cb8f434..0a1b276 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -3057,10 +3057,11 @@
+ #define  EDP_LINK_TRAIN_600MV_3_5DB_SNB_A	(0x01<<22)
+ #define  EDP_LINK_TRAIN_800MV_0DB_SNB_A		(0x0<<22)
+ /* SNB B-stepping */
+-#define  EDP_LINK_TRAIN_400MV_0DB_SNB_B		(0x0<<22)
+-#define  EDP_LINK_TRAIN_400MV_6DB_SNB_B		(0x3a<<22)
+-#define  EDP_LINK_TRAIN_600MV_3_5DB_SNB_B	(0x39<<22)
+-#define  EDP_LINK_TRAIN_800MV_0DB_SNB_B		(0x38<<22)
++#define  EDP_LINK_TRAIN_400_600MV_0DB_SNB_B	(0x0<<22)
++#define  EDP_LINK_TRAIN_400MV_3_5DB_SNB_B	(0x1<<22)
++#define  EDP_LINK_TRAIN_400_600MV_6DB_SNB_B	(0x3a<<22)
++#define  EDP_LINK_TRAIN_600_800MV_3_5DB_SNB_B	(0x39<<22)
++#define  EDP_LINK_TRAIN_800_1200MV_0DB_SNB_B	(0x38<<22)
+ #define  EDP_LINK_TRAIN_VOL_EMP_MASK_SNB	(0x3f<<22)
+ 
+ #endif /* _I915_REG_H_ */
+diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
+index 8df5743..17035b8 100644
+--- a/drivers/gpu/drm/i915/intel_crt.c
++++ b/drivers/gpu/drm/i915/intel_crt.c
+@@ -30,6 +30,7 @@
+ #include "drm.h"
+ #include "drm_crtc.h"
+ #include "drm_crtc_helper.h"
++#include "drm_edid.h"
+ #include "intel_drv.h"
+ #include "i915_drm.h"
+ #include "i915_drv.h"
+@@ -287,8 +288,9 @@ static bool intel_crt_ddc_probe(struct drm_i915_private *dev_priv, int ddc_bus)
+ 	return i2c_transfer(&dev_priv->gmbus[ddc_bus].adapter, msgs, 1) == 1;
+ }
+ 
+-static bool intel_crt_detect_ddc(struct intel_crt *crt)
++static bool intel_crt_detect_ddc(struct drm_connector *connector)
+ {
++	struct intel_crt *crt = intel_attached_crt(connector);
+ 	struct drm_i915_private *dev_priv = crt->base.base.dev->dev_private;
+ 
+ 	/* CRT should always be at 0, but check anyway */
+@@ -301,8 +303,26 @@ static bool intel_crt_detect_ddc(struct intel_crt *crt)
+ 	}
+ 
+ 	if (intel_ddc_probe(&crt->base, dev_priv->crt_ddc_pin)) {
+-		DRM_DEBUG_KMS("CRT detected via DDC:0x50 [EDID]\n");
+-		return true;
++		struct edid *edid;
++		bool is_digital = false;
++
++		edid = drm_get_edid(connector,
++			&dev_priv->gmbus[dev_priv->crt_ddc_pin].adapter);
++		/*
++		 * This may be a DVI-I connector with a shared DDC
++		 * link between analog and digital outputs, so we
++		 * have to check the EDID input spec of the attached device.
++		 */
++		if (edid != NULL) {
++			is_digital = edid->input & DRM_EDID_INPUT_DIGITAL;
++			connector->display_info.raw_edid = NULL;
++			kfree(edid);
++		}
++
++		if (!is_digital) {
++			DRM_DEBUG_KMS("CRT detected via DDC:0x50 [EDID]\n");
++			return true;
++		}
+ 	}
+ 
+ 	return false;
+@@ -458,7 +478,7 @@ intel_crt_detect(struct drm_connector *connector, bool force)
+ 		}
+ 	}
+ 
+-	if (intel_crt_detect_ddc(crt))
++	if (intel_crt_detect_ddc(connector))
+ 		return connector_status_connected;
+ 
+ 	if (!force)
+@@ -472,7 +492,7 @@ intel_crt_detect(struct drm_connector *connector, bool force)
+ 		crtc = intel_get_load_detect_pipe(&crt->base, connector,
+ 						  NULL, &dpms_mode);
+ 		if (crtc) {
+-			if (intel_crt_detect_ddc(crt))
++			if (intel_crt_detect_ddc(connector))
+ 				status = connector_status_connected;
+ 			else
+ 				status = intel_crt_load_detect(crtc, crt);
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index fca5232..3abd904 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -3714,7 +3714,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
+ 		int lane = 0, link_bw, bpp;
+ 		/* CPU eDP doesn't require FDI link, so just set DP M/N
+ 		   according to current link config */
+-		if (has_edp_encoder && !intel_encoder_is_pch_edp(&encoder->base)) {
++		if (has_edp_encoder && !intel_encoder_is_pch_edp(&has_edp_encoder->base)) {
+ 			target_clock = mode->clock;
+ 			intel_edp_link_config(has_edp_encoder,
+ 					      &lane, &link_bw);
+@@ -5498,6 +5498,8 @@ static void intel_setup_outputs(struct drm_device *dev)
+ 		encoder->base.possible_clones =
+ 			intel_encoder_clones(dev, encoder->clone_mask);
+ 	}
++
++	intel_panel_setup_backlight(dev);
+ }
+ 
+ static void intel_user_framebuffer_destroy(struct drm_framebuffer *fb)
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 864417c..c1f13bf 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1153,18 +1153,27 @@ intel_dp_signal_levels(uint8_t train_set, int lane_count)
+ static uint32_t
+ intel_gen6_edp_signal_levels(uint8_t train_set)
+ {
+-	switch (train_set & (DP_TRAIN_VOLTAGE_SWING_MASK|DP_TRAIN_PRE_EMPHASIS_MASK)) {
++	int signal_levels = train_set & (DP_TRAIN_VOLTAGE_SWING_MASK |
++					 DP_TRAIN_PRE_EMPHASIS_MASK);
++	switch (signal_levels) {
+ 	case DP_TRAIN_VOLTAGE_SWING_400 | DP_TRAIN_PRE_EMPHASIS_0:
+-		return EDP_LINK_TRAIN_400MV_0DB_SNB_B;
++	case DP_TRAIN_VOLTAGE_SWING_600 | DP_TRAIN_PRE_EMPHASIS_0:
++		return EDP_LINK_TRAIN_400_600MV_0DB_SNB_B;
++	case DP_TRAIN_VOLTAGE_SWING_400 | DP_TRAIN_PRE_EMPHASIS_3_5:
++		return EDP_LINK_TRAIN_400MV_3_5DB_SNB_B;
+ 	case DP_TRAIN_VOLTAGE_SWING_400 | DP_TRAIN_PRE_EMPHASIS_6:
+-		return EDP_LINK_TRAIN_400MV_6DB_SNB_B;
++	case DP_TRAIN_VOLTAGE_SWING_600 | DP_TRAIN_PRE_EMPHASIS_6:
++		return EDP_LINK_TRAIN_400_600MV_6DB_SNB_B;
+ 	case DP_TRAIN_VOLTAGE_SWING_600 | DP_TRAIN_PRE_EMPHASIS_3_5:
+-		return EDP_LINK_TRAIN_600MV_3_5DB_SNB_B;
++	case DP_TRAIN_VOLTAGE_SWING_800 | DP_TRAIN_PRE_EMPHASIS_3_5:
++		return EDP_LINK_TRAIN_600_800MV_3_5DB_SNB_B;
+ 	case DP_TRAIN_VOLTAGE_SWING_800 | DP_TRAIN_PRE_EMPHASIS_0:
+-		return EDP_LINK_TRAIN_800MV_0DB_SNB_B;
++	case DP_TRAIN_VOLTAGE_SWING_1200 | DP_TRAIN_PRE_EMPHASIS_0:
++		return EDP_LINK_TRAIN_800_1200MV_0DB_SNB_B;
+ 	default:
+-		DRM_DEBUG_KMS("Unsupported voltage swing/pre-emphasis level\n");
+-		return EDP_LINK_TRAIN_400MV_0DB_SNB_B;
++		DRM_DEBUG_KMS("Unsupported voltage swing/pre-emphasis level:"
++			      "0x%x\n", signal_levels);
++		return EDP_LINK_TRAIN_400_600MV_0DB_SNB_B;
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index e52c612..1e68293 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -256,6 +256,9 @@ extern void intel_pch_panel_fitting(struct drm_device *dev,
+ extern u32 intel_panel_get_max_backlight(struct drm_device *dev);
+ extern u32 intel_panel_get_backlight(struct drm_device *dev);
+ extern void intel_panel_set_backlight(struct drm_device *dev, u32 level);
++extern void intel_panel_setup_backlight(struct drm_device *dev);
++extern void intel_panel_enable_backlight(struct drm_device *dev);
++extern void intel_panel_disable_backlight(struct drm_device *dev);
+ 
+ extern void intel_crtc_load_lut(struct drm_crtc *crtc);
+ extern void intel_encoder_prepare (struct drm_encoder *encoder);
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 25bcedf..fe779b3 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -106,7 +106,7 @@ static void intel_lvds_enable(struct intel_lvds *intel_lvds)
+ 	I915_WRITE(ctl_reg, I915_READ(ctl_reg) | POWER_TARGET_ON);
+ 	POSTING_READ(lvds_reg);
+ 
+-	intel_panel_set_backlight(dev, dev_priv->backlight_level);
++	intel_panel_enable_backlight(dev);
+ }
+ 
+ static void intel_lvds_disable(struct intel_lvds *intel_lvds)
+@@ -123,8 +123,7 @@ static void intel_lvds_disable(struct intel_lvds *intel_lvds)
+ 		lvds_reg = LVDS;
+ 	}
+ 
+-	dev_priv->backlight_level = intel_panel_get_backlight(dev);
+-	intel_panel_set_backlight(dev, 0);
++	intel_panel_disable_backlight(dev);
+ 
+ 	I915_WRITE(ctl_reg, I915_READ(ctl_reg) & ~POWER_TARGET_ON);
+ 
+@@ -395,8 +394,6 @@ static void intel_lvds_prepare(struct drm_encoder *encoder)
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	struct intel_lvds *intel_lvds = to_intel_lvds(encoder);
+ 
+-	dev_priv->backlight_level = intel_panel_get_backlight(dev);
+-
+ 	/* We try to do the minimum that is necessary in order to unlock
+ 	 * the registers for mode setting.
+ 	 *
+@@ -427,9 +424,6 @@ static void intel_lvds_commit(struct drm_encoder *encoder)
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	struct intel_lvds *intel_lvds = to_intel_lvds(encoder);
+ 
+-	if (dev_priv->backlight_level == 0)
+-		dev_priv->backlight_level = intel_panel_get_max_backlight(dev);
+-
+ 	/* Undo any unlocking done in prepare to prevent accidental
+ 	 * adjustment of the registers.
+ 	 */
+@@ -703,6 +697,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
+ 	},
+ 	{
+ 		.callback = intel_no_lvds_dmi_callback,
++		.ident = "AOpen i915GMm-HFS",
++		.matches = {
++			DMI_MATCH(DMI_BOARD_VENDOR, "AOpen"),
++			DMI_MATCH(DMI_BOARD_NAME, "i915GMm-HFS"),
++		},
++	},
++	{
++		.callback = intel_no_lvds_dmi_callback,
+ 		.ident = "Aopen i945GTt-VFA",
+ 		.matches = {
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "AO00001JW"),
+diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
+index 92ff8f3..0df86b5 100644
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -218,3 +218,34 @@ void intel_panel_set_backlight(struct drm_device *dev, u32 level)
+ 		tmp &= ~BACKLIGHT_DUTY_CYCLE_MASK;
+ 	I915_WRITE(BLC_PWM_CTL, tmp | level);
+ }
++
++void intel_panel_disable_backlight(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++
++	if (dev_priv->backlight_enabled) {
++		dev_priv->backlight_level = intel_panel_get_backlight(dev);
++		dev_priv->backlight_enabled = false;
++	}
++
++	intel_panel_set_backlight(dev, 0);
++}
++
++void intel_panel_enable_backlight(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++
++	if (dev_priv->backlight_level == 0)
++		dev_priv->backlight_level = intel_panel_get_max_backlight(dev);
++
++	intel_panel_set_backlight(dev, dev_priv->backlight_level);
++	dev_priv->backlight_enabled = true;
++}
++
++void intel_panel_setup_backlight(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++
++	dev_priv->backlight_level = intel_panel_get_backlight(dev);
++	dev_priv->backlight_enabled = dev_priv->backlight_level != 0;
++}
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index 6bc42fa..920ca27 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -1024,9 +1024,13 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
+ 	if (!intel_sdvo_set_target_input(intel_sdvo))
+ 		return;
+ 
+-	if (intel_sdvo->has_hdmi_monitor &&
+-	    !intel_sdvo_set_avi_infoframe(intel_sdvo))
+-		return;
++	if (intel_sdvo->has_hdmi_monitor) {
++		intel_sdvo_set_encode(intel_sdvo, SDVO_ENCODE_HDMI);
++		intel_sdvo_set_colorimetry(intel_sdvo,
++					   SDVO_COLORIMETRY_RGB256);
++		intel_sdvo_set_avi_infoframe(intel_sdvo);
++	} else
++		intel_sdvo_set_encode(intel_sdvo, SDVO_ENCODE_DVI);
+ 
+ 	if (intel_sdvo->is_tv &&
+ 	    !intel_sdvo_set_tv_format(intel_sdvo))
+@@ -1395,6 +1399,9 @@ intel_sdvo_detect(struct drm_connector *connector, bool force)
+ 
+ 	intel_sdvo->attached_output = response;
+ 
++	intel_sdvo->has_hdmi_monitor = false;
++	intel_sdvo->has_hdmi_audio = false;
++
+ 	if ((intel_sdvo_connector->output_flag & response) == 0)
+ 		ret = connector_status_disconnected;
+ 	else if (response & SDVO_TMDS_MASK)
+@@ -1919,20 +1926,7 @@ intel_sdvo_select_i2c_bus(struct drm_i915_private *dev_priv,
+ static bool
+ intel_sdvo_is_hdmi_connector(struct intel_sdvo *intel_sdvo, int device)
+ {
+-	int is_hdmi;
+-
+-	if (!intel_sdvo_check_supp_encode(intel_sdvo))
+-		return false;
+-
+-	if (!intel_sdvo_set_target_output(intel_sdvo,
+-					  device == 0 ? SDVO_OUTPUT_TMDS0 : SDVO_OUTPUT_TMDS1))
+-		return false;
+-
+-	is_hdmi = 0;
+-	if (!intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_ENCODE, &is_hdmi, 1))
+-		return false;
+-
+-	return !!is_hdmi;
++	return intel_sdvo_check_supp_encode(intel_sdvo);
+ }
+ 
+ static u8
+@@ -2034,12 +2028,7 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device)
+ 	connector->connector_type = DRM_MODE_CONNECTOR_DVID;
+ 
+ 	if (intel_sdvo_is_hdmi_connector(intel_sdvo, device)) {
+-		/* enable hdmi encoding mode if supported */
+-		intel_sdvo_set_encode(intel_sdvo, SDVO_ENCODE_HDMI);
+-		intel_sdvo_set_colorimetry(intel_sdvo,
+-					   SDVO_COLORIMETRY_RGB256);
+ 		connector->connector_type = DRM_MODE_CONNECTOR_HDMIA;
+-
+ 		intel_sdvo->is_hdmi = true;
+ 	}
+ 	intel_sdvo->base.clone_mask = ((1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 9fbabaa..6b7fc4b 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -531,6 +531,7 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ 					dp_clock = dig_connector->dp_clock;
+ 				}
+ 			}
++/* this might work properly with the new pll algo */
+ #if 0 /* doesn't work properly on some laptops */
+ 			/* use recommended ref_div for ss */
+ 			if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
+@@ -548,6 +549,11 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ 					adjusted_clock = mode->clock * 2;
+ 				if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT))
+ 					pll->flags |= RADEON_PLL_PREFER_CLOSEST_LOWER;
++				/* rv515 needs more testing with this option */
++				if (rdev->family != CHIP_RV515) {
++					if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT))
++						pll->flags |= RADEON_PLL_IS_LCD;
++				}
+ 			} else {
+ 				if (encoder->encoder_type != DRM_MODE_ENCODER_DAC)
+ 					pll->flags |= RADEON_PLL_NO_ODD_POST_DIV;
+@@ -915,8 +921,16 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
+ 	/* adjust pixel clock as needed */
+ 	adjusted_clock = atombios_adjust_pll(crtc, mode, pll, ss_enabled, &ss);
+ 
+-	radeon_compute_pll(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
+-			   &ref_div, &post_div);
++	/* rv515 seems happier with the old algo */
++	if (rdev->family == CHIP_RV515)
++		radeon_compute_pll_legacy(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
++					  &ref_div, &post_div);
++	else if (ASIC_IS_AVIVO(rdev))
++		radeon_compute_pll_avivo(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
++					 &ref_div, &post_div);
++	else
++		radeon_compute_pll_legacy(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
++					  &ref_div, &post_div);
+ 
+ 	atombios_crtc_program_ss(crtc, ATOM_DISABLE, radeon_crtc->pll_id, &ss);
+ 
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index 4e7778d..695de9a 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -187,9 +187,9 @@ static int dp_link_clock_for_mode_clock(u8 dpcd[DP_DPCD_SIZE], int mode_clock)
+ int dp_mode_valid(u8 dpcd[DP_DPCD_SIZE], int mode_clock)
+ {
+ 	int lanes = dp_lanes_for_mode_clock(dpcd, mode_clock);
+-	int bw = dp_lanes_for_mode_clock(dpcd, mode_clock);
++	int dp_clock = dp_link_clock_for_mode_clock(dpcd, mode_clock);
+ 
+-	if ((lanes == 0) || (bw == 0))
++	if ((lanes == 0) || (dp_clock == 0))
+ 		return MODE_CLOCK_HIGH;
+ 
+ 	return MODE_OK;
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index 7b337c3..cff593d 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -1135,7 +1135,7 @@ static int evergreen_cp_start(struct radeon_device *rdev)
+ 	cp_me = 0xff;
+ 	WREG32(CP_ME_CNTL, cp_me);
+ 
+-	r = radeon_ring_lock(rdev, evergreen_default_size + 15);
++	r = radeon_ring_lock(rdev, evergreen_default_size + 19);
+ 	if (r) {
+ 		DRM_ERROR("radeon: cp failed to lock ring (%d).\n", r);
+ 		return r;
+@@ -1168,6 +1168,11 @@ static int evergreen_cp_start(struct radeon_device *rdev)
+ 	radeon_ring_write(rdev, 0xffffffff);
+ 	radeon_ring_write(rdev, 0xffffffff);
+ 
++	radeon_ring_write(rdev, 0xc0026900);
++	radeon_ring_write(rdev, 0x00000316);
++	radeon_ring_write(rdev, 0x0000000e); /* VGT_VERTEX_REUSE_BLOCK_CNTL */
++	radeon_ring_write(rdev, 0x00000010); /*  */
++
+ 	radeon_ring_unlock_commit(rdev);
+ 
+ 	return 0;
+diff --git a/drivers/gpu/drm/radeon/evergreen_blit_kms.c b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
+index e0e5901..a2cfead 100644
+--- a/drivers/gpu/drm/radeon/evergreen_blit_kms.c
++++ b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
+@@ -230,7 +230,7 @@ draw_auto(struct radeon_device *rdev)
+ 
+ }
+ 
+-/* emits 30 */
++/* emits 34 */
+ static void
+ set_default_state(struct radeon_device *rdev)
+ {
+@@ -243,6 +243,8 @@ set_default_state(struct radeon_device *rdev)
+ 	int num_hs_threads, num_ls_threads;
+ 	int num_ps_stack_entries, num_vs_stack_entries, num_gs_stack_entries, num_es_stack_entries;
+ 	int num_hs_stack_entries, num_ls_stack_entries;
++	u64 gpu_addr;
++	int dwords;
+ 
+ 	switch (rdev->family) {
+ 	case CHIP_CEDAR:
+@@ -409,6 +411,14 @@ set_default_state(struct radeon_device *rdev)
+ 	radeon_ring_write(rdev, 0x00000000);
+ 	radeon_ring_write(rdev, 0x00000000);
+ 
++	/* emit an IB pointing at default state */
++	dwords = ALIGN(rdev->r600_blit.state_len, 0x10);
++	gpu_addr = rdev->r600_blit.shader_gpu_addr + rdev->r600_blit.state_offset;
++	radeon_ring_write(rdev, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
++	radeon_ring_write(rdev, gpu_addr & 0xFFFFFFFC);
++	radeon_ring_write(rdev, upper_32_bits(gpu_addr) & 0xFF);
++	radeon_ring_write(rdev, dwords);
++
+ }
+ 
+ static inline uint32_t i2f(uint32_t input)
+@@ -439,8 +449,10 @@ static inline uint32_t i2f(uint32_t input)
+ int evergreen_blit_init(struct radeon_device *rdev)
+ {
+ 	u32 obj_size;
+-	int r;
++	int r, dwords;
+ 	void *ptr;
++	u32 packet2s[16];
++	int num_packet2s = 0;
+ 
+ 	/* pin copy shader into vram if already initialized */
+ 	if (rdev->r600_blit.shader_obj)
+@@ -448,8 +460,17 @@ int evergreen_blit_init(struct radeon_device *rdev)
+ 
+ 	mutex_init(&rdev->r600_blit.mutex);
+ 	rdev->r600_blit.state_offset = 0;
+-	rdev->r600_blit.state_len = 0;
+-	obj_size = 0;
++
++	rdev->r600_blit.state_len = evergreen_default_size;
++
++	dwords = rdev->r600_blit.state_len;
++	while (dwords & 0xf) {
++		packet2s[num_packet2s++] = PACKET2(0);
++		dwords++;
++	}
++
++	obj_size = dwords * 4;
++	obj_size = ALIGN(obj_size, 256);
+ 
+ 	rdev->r600_blit.vs_offset = obj_size;
+ 	obj_size += evergreen_vs_size * 4;
+@@ -479,6 +500,12 @@ int evergreen_blit_init(struct radeon_device *rdev)
+ 		return r;
+ 	}
+ 
++	memcpy_toio(ptr + rdev->r600_blit.state_offset,
++		    evergreen_default_state, rdev->r600_blit.state_len * 4);
++
++	if (num_packet2s)
++		memcpy_toio(ptr + rdev->r600_blit.state_offset + (rdev->r600_blit.state_len * 4),
++			    packet2s, num_packet2s * 4);
+ 	memcpy(ptr + rdev->r600_blit.vs_offset, evergreen_vs, evergreen_vs_size * 4);
+ 	memcpy(ptr + rdev->r600_blit.ps_offset, evergreen_ps, evergreen_ps_size * 4);
+ 	radeon_bo_kunmap(rdev->r600_blit.shader_obj);
+@@ -564,7 +591,7 @@ int evergreen_blit_prepare_copy(struct radeon_device *rdev, int size_bytes)
+ 	/* calculate number of loops correctly */
+ 	ring_size = num_loops * dwords_per_loop;
+ 	/* set default  + shaders */
+-	ring_size += 46; /* shaders + def state */
++	ring_size += 50; /* shaders + def state */
+ 	ring_size += 10; /* fence emit for VB IB */
+ 	ring_size += 5; /* done copy */
+ 	ring_size += 10; /* fence emit for done copy */
+@@ -572,7 +599,7 @@ int evergreen_blit_prepare_copy(struct radeon_device *rdev, int size_bytes)
+ 	if (r)
+ 		return r;
+ 
+-	set_default_state(rdev); /* 30 */
++	set_default_state(rdev); /* 34 */
+ 	set_shaders(rdev); /* 16 */
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index bc5a2c3..57b9de3 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -313,7 +313,6 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
+ 				     uint16_t *line_mux,
+ 				     struct radeon_hpd *hpd)
+ {
+-	struct radeon_device *rdev = dev->dev_private;
+ 
+ 	/* Asus M2A-VM HDMI board lists the DVI port as HDMI */
+ 	if ((dev->pdev->device == 0x791e) &&
+@@ -388,6 +387,13 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
+ 			*line_mux = 0x90;
+ 	}
+ 
++	/* mac rv630, rv730, others */
++	if ((supported_device == ATOM_DEVICE_TV1_SUPPORT) &&
++	    (*connector_type == DRM_MODE_CONNECTOR_DVII)) {
++		*connector_type = DRM_MODE_CONNECTOR_9PinDIN;
++		*line_mux = CONNECTOR_7PIN_DIN_ENUM_ID1;
++	}
++
+ 	/* ASUS HD 3600 XT board lists the DVI port as HDMI */
+ 	if ((dev->pdev->device == 0x9598) &&
+ 	    (dev->pdev->subsystem_vendor == 0x1043) &&
+@@ -425,21 +431,23 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
+ 		}
+ 	}
+ 
+-	/* Acer laptop reports DVI-D as DVI-I and hpd pins reversed */
++	/* Acer laptop (Acer TravelMate 5730G) has an HDMI port
++	 * on the laptop and a DVI port on the docking station and
++	 * both share the same encoder, hpd pin, and ddc line.
++	 * So while the bios table is technically correct,
++	 * we drop the DVI port here since xrandr has no concept of
++	 * encoders and will try and drive both connectors
++	 * with different crtcs which isn't possible on the hardware
++	 * side and leaves no crtcs for LVDS or VGA.
++	 */
+ 	if ((dev->pdev->device == 0x95c4) &&
+ 	    (dev->pdev->subsystem_vendor == 0x1025) &&
+ 	    (dev->pdev->subsystem_device == 0x013c)) {
+-		struct radeon_gpio_rec gpio;
+-
+ 		if ((*connector_type == DRM_MODE_CONNECTOR_DVII) &&
+ 		    (supported_device == ATOM_DEVICE_DFP1_SUPPORT)) {
+-			gpio = radeon_lookup_gpio(rdev, 6);
+-			*hpd = radeon_atom_get_hpd_info_from_gpio(rdev, &gpio);
++			/* actually it's a DVI-D port not DVI-I */
+ 			*connector_type = DRM_MODE_CONNECTOR_DVID;
+-		} else if ((*connector_type == DRM_MODE_CONNECTOR_HDMIA) &&
+-			   (supported_device == ATOM_DEVICE_DFP1_SUPPORT)) {
+-			gpio = radeon_lookup_gpio(rdev, 7);
+-			*hpd = radeon_atom_get_hpd_info_from_gpio(rdev, &gpio);
++			return false;
+ 		}
+ 	}
+ 
+@@ -1128,16 +1136,6 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
+ 				p1pll->pll_out_min = 64800;
+ 			else
+ 				p1pll->pll_out_min = 20000;
+-		} else if (p1pll->pll_out_min > 64800) {
+-			/* Limiting the pll output range is a good thing generally as
+-			 * it limits the number of possible pll combinations for a given
+-			 * frequency presumably to the ones that work best on each card.
+-			 * However, certain duallink DVI monitors seem to like
+-			 * pll combinations that would be limited by this at least on
+-			 * pre-DCE 3.0 r6xx hardware.  This might need to be adjusted per
+-			 * family.
+-			 */
+-			p1pll->pll_out_min = 64800;
+ 		}
+ 
+ 		p1pll->pll_in_min =
+@@ -2359,7 +2357,7 @@ void radeon_atom_initialize_bios_scratch_regs(struct drm_device *dev)
+ 	bios_2_scratch &= ~ATOM_S2_VRI_BRIGHT_ENABLE;
+ 
+ 	/* tell the bios not to handle mode switching */
+-	bios_6_scratch |= (ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH | ATOM_S6_ACC_MODE);
++	bios_6_scratch |= ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH;
+ 
+ 	if (rdev->family >= CHIP_R600) {
+ 		WREG32(R600_BIOS_2_SCRATCH, bios_2_scratch);
+@@ -2410,10 +2408,13 @@ void radeon_atom_output_lock(struct drm_encoder *encoder, bool lock)
+ 	else
+ 		bios_6_scratch = RREG32(RADEON_BIOS_6_SCRATCH);
+ 
+-	if (lock)
++	if (lock) {
+ 		bios_6_scratch |= ATOM_S6_CRITICAL_STATE;
+-	else
++		bios_6_scratch &= ~ATOM_S6_ACC_MODE;
++	} else {
+ 		bios_6_scratch &= ~ATOM_S6_CRITICAL_STATE;
++		bios_6_scratch |= ATOM_S6_ACC_MODE;
++	}
+ 
+ 	if (rdev->family >= CHIP_R600)
+ 		WREG32(R600_BIOS_6_SCRATCH, bios_6_scratch);
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 1df4dc6..a26a70d 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -448,6 +448,115 @@ static int radeon_ddc_dump(struct drm_connector *connector)
+ 	return ret;
+ }
+ 
++/* avivo */
++static void avivo_get_fb_div(struct radeon_pll *pll,
++			     u32 target_clock,
++			     u32 post_div,
++			     u32 ref_div,
++			     u32 *fb_div,
++			     u32 *frac_fb_div)
++{
++	u32 tmp = post_div * ref_div;
++
++	tmp *= target_clock;
++	*fb_div = tmp / pll->reference_freq;
++	*frac_fb_div = tmp % pll->reference_freq;
++}
++
++static u32 avivo_get_post_div(struct radeon_pll *pll,
++			      u32 target_clock)
++{
++	u32 vco, post_div, tmp;
++
++	if (pll->flags & RADEON_PLL_USE_POST_DIV)
++		return pll->post_div;
++
++	if (pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP) {
++		if (pll->flags & RADEON_PLL_IS_LCD)
++			vco = pll->lcd_pll_out_min;
++		else
++			vco = pll->pll_out_min;
++	} else {
++		if (pll->flags & RADEON_PLL_IS_LCD)
++			vco = pll->lcd_pll_out_max;
++		else
++			vco = pll->pll_out_max;
++	}
++
++	post_div = vco / target_clock;
++	tmp = vco % target_clock;
++
++	if (pll->flags & RADEON_PLL_PREFER_MINM_OVER_MAXP) {
++		if (tmp)
++			post_div++;
++	} else {
++		if (!tmp)
++			post_div--;
++	}
++
++	return post_div;
++}
++
++#define MAX_TOLERANCE 10
++
++void radeon_compute_pll_avivo(struct radeon_pll *pll,
++			      u32 freq,
++			      u32 *dot_clock_p,
++			      u32 *fb_div_p,
++			      u32 *frac_fb_div_p,
++			      u32 *ref_div_p,
++			      u32 *post_div_p)
++{
++	u32 target_clock = freq / 10;
++	u32 post_div = avivo_get_post_div(pll, target_clock);
++	u32 ref_div = pll->min_ref_div;
++	u32 fb_div = 0, frac_fb_div = 0, tmp;
++
++	if (pll->flags & RADEON_PLL_USE_REF_DIV)
++		ref_div = pll->reference_div;
++
++	if (pll->flags & RADEON_PLL_USE_FRAC_FB_DIV) {
++		avivo_get_fb_div(pll, target_clock, post_div, ref_div, &fb_div, &frac_fb_div);
++		frac_fb_div = (100 * frac_fb_div) / pll->reference_freq;
++		if (frac_fb_div >= 5) {
++			frac_fb_div -= 5;
++			frac_fb_div = frac_fb_div / 10;
++			frac_fb_div++;
++		}
++		if (frac_fb_div >= 10) {
++			fb_div++;
++			frac_fb_div = 0;
++		}
++	} else {
++		while (ref_div <= pll->max_ref_div) {
++			avivo_get_fb_div(pll, target_clock, post_div, ref_div,
++					 &fb_div, &frac_fb_div);
++			if (frac_fb_div >= (pll->reference_freq / 2))
++				fb_div++;
++			frac_fb_div = 0;
++			tmp = (pll->reference_freq * fb_div) / (post_div * ref_div);
++			tmp = (tmp * 10000) / target_clock;
++
++			if (tmp > (10000 + MAX_TOLERANCE))
++				ref_div++;
++			else if (tmp >= (10000 - MAX_TOLERANCE))
++				break;
++			else
++				ref_div++;
++		}
++	}
++
++	*dot_clock_p = ((pll->reference_freq * fb_div * 10) + (pll->reference_freq * frac_fb_div)) /
++		(ref_div * post_div * 10);
++	*fb_div_p = fb_div;
++	*frac_fb_div_p = frac_fb_div;
++	*ref_div_p = ref_div;
++	*post_div_p = post_div;
++	DRM_DEBUG_KMS("%d, pll dividers - fb: %d.%d ref: %d, post %d\n",
++		      *dot_clock_p, fb_div, frac_fb_div, ref_div, post_div);
++}
++
++/* pre-avivo */
+ static inline uint32_t radeon_div(uint64_t n, uint32_t d)
+ {
+ 	uint64_t mod;
+@@ -458,13 +567,13 @@ static inline uint32_t radeon_div(uint64_t n, uint32_t d)
+ 	return n;
+ }
+ 
+-void radeon_compute_pll(struct radeon_pll *pll,
+-			uint64_t freq,
+-			uint32_t *dot_clock_p,
+-			uint32_t *fb_div_p,
+-			uint32_t *frac_fb_div_p,
+-			uint32_t *ref_div_p,
+-			uint32_t *post_div_p)
++void radeon_compute_pll_legacy(struct radeon_pll *pll,
++			       uint64_t freq,
++			       uint32_t *dot_clock_p,
++			       uint32_t *fb_div_p,
++			       uint32_t *frac_fb_div_p,
++			       uint32_t *ref_div_p,
++			       uint32_t *post_div_p)
+ {
+ 	uint32_t min_ref_div = pll->min_ref_div;
+ 	uint32_t max_ref_div = pll->max_ref_div;
+@@ -494,6 +603,9 @@ void radeon_compute_pll(struct radeon_pll *pll,
+ 		pll_out_max = pll->pll_out_max;
+ 	}
+ 
++	if (pll_out_min > 64800)
++		pll_out_min = 64800;
++
+ 	if (pll->flags & RADEON_PLL_USE_REF_DIV)
+ 		min_ref_div = max_ref_div = pll->reference_div;
+ 	else {
+@@ -517,7 +629,7 @@ void radeon_compute_pll(struct radeon_pll *pll,
+ 		max_fractional_feed_div = pll->max_frac_feedback_div;
+ 	}
+ 
+-	for (post_div = max_post_div; post_div >= min_post_div; --post_div) {
++	for (post_div = min_post_div; post_div <= max_post_div; ++post_div) {
+ 		uint32_t ref_div;
+ 
+ 		if ((pll->flags & RADEON_PLL_NO_ODD_POST_DIV) && (post_div & 1))
+@@ -633,6 +745,10 @@ void radeon_compute_pll(struct radeon_pll *pll,
+ 	*frac_fb_div_p = best_frac_feedback_div;
+ 	*ref_div_p = best_ref_div;
+ 	*post_div_p = best_post_div;
++	DRM_DEBUG_KMS("%d %d, pll dividers - fb: %d.%d ref: %d, post %d\n",
++		      freq, best_freq / 1000, best_feedback_div, best_frac_feedback_div,
++		      best_ref_div, best_post_div);
++
+ }
+ 
+ static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb)
+diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+index ace2e63..cf0638c 100644
+--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
++++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+@@ -778,9 +778,9 @@ static void radeon_set_pll(struct drm_crtc *crtc, struct drm_display_mode *mode)
+ 	DRM_DEBUG_KMS("\n");
+ 
+ 	if (!use_bios_divs) {
+-		radeon_compute_pll(pll, mode->clock,
+-				   &freq, &feedback_div, &frac_fb_div,
+-				   &reference_div, &post_divider);
++		radeon_compute_pll_legacy(pll, mode->clock,
++					  &freq, &feedback_div, &frac_fb_div,
++					  &reference_div, &post_divider);
+ 
+ 		for (post_div = &post_divs[0]; post_div->divider; ++post_div) {
+ 			if (post_div->divider == post_divider)
+diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
+index e301c6f..aa22570 100644
+--- a/drivers/gpu/drm/radeon/radeon_mode.h
++++ b/drivers/gpu/drm/radeon/radeon_mode.h
+@@ -149,6 +149,7 @@ struct radeon_tmds_pll {
+ #define RADEON_PLL_PREFER_CLOSEST_LOWER (1 << 11)
+ #define RADEON_PLL_USE_POST_DIV         (1 << 12)
+ #define RADEON_PLL_IS_LCD               (1 << 13)
++#define RADEON_PLL_PREFER_MINM_OVER_MAXP (1 << 14)
+ 
+ struct radeon_pll {
+ 	/* reference frequency */
+@@ -510,13 +511,21 @@ extern bool radeon_atombios_get_asic_ss_info(struct radeon_device *rdev,
+ 					     struct radeon_atom_ss *ss,
+ 					     int id, u32 clock);
+ 
+-extern void radeon_compute_pll(struct radeon_pll *pll,
+-			       uint64_t freq,
+-			       uint32_t *dot_clock_p,
+-			       uint32_t *fb_div_p,
+-			       uint32_t *frac_fb_div_p,
+-			       uint32_t *ref_div_p,
+-			       uint32_t *post_div_p);
++extern void radeon_compute_pll_legacy(struct radeon_pll *pll,
++				      uint64_t freq,
++				      uint32_t *dot_clock_p,
++				      uint32_t *fb_div_p,
++				      uint32_t *frac_fb_div_p,
++				      uint32_t *ref_div_p,
++				      uint32_t *post_div_p);
++
++extern void radeon_compute_pll_avivo(struct radeon_pll *pll,
++				     u32 freq,
++				     u32 *dot_clock_p,
++				     u32 *fb_div_p,
++				     u32 *frac_fb_div_p,
++				     u32 *ref_div_p,
++				     u32 *post_div_p);
+ 
+ extern void radeon_setup_encoder_clones(struct drm_device *dev);
+ 
+diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
+index c380c65..ace2b16 100644
+--- a/drivers/gpu/vga/vgaarb.c
++++ b/drivers/gpu/vga/vgaarb.c
+@@ -636,7 +636,7 @@ int vga_client_register(struct pci_dev *pdev, void *cookie,
+ 			void (*irq_set_state)(void *cookie, bool state),
+ 			unsigned int (*set_vga_decode)(void *cookie, bool decode))
+ {
+-	int ret = -1;
++	int ret = -ENODEV;
+ 	struct vga_device *vgadev;
+ 	unsigned long flags;
+ 
+diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
+index b6598aa..87a5fd51 100644
+--- a/drivers/hwmon/applesmc.c
++++ b/drivers/hwmon/applesmc.c
+@@ -162,6 +162,10 @@ static const char *temperature_sensors_sets[][41] = {
+ /* Set 22: MacBook Pro 7,1 */
+ 	{ "TB0T", "TB1T", "TB2T", "TC0D", "TC0P", "TN0D", "TN0P", "TN0S",
+ 	  "TN1D", "TN1F", "TN1G", "TN1S", "Th1H", "Ts0P", "Ts0S", NULL },
++/* Set 23: MacBook Air 3,1 */
++	{ "TB0T", "TB1T", "TB2T", "TC0D", "TC0E", "TC0P", "TC1E", "TCZ3",
++	  "TCZ4", "TCZ5", "TG0E", "TG1E", "TG2E", "TGZ3", "TGZ4", "TGZ5",
++	  "TH0F", "TH0O", "TM0P" },
+ };
+ 
+ /* List of keys used to read/write fan speeds */
+@@ -444,38 +448,22 @@ static int applesmc_read_motion_sensor(int index, s16* value)
+ }
+ 
+ /*
+- * applesmc_device_init - initialize the accelerometer.  Returns zero on success
+- * and negative error code on failure.  Can sleep.
++ * applesmc_device_init - initialize the accelerometer.  Can sleep.
+  */
+-static int applesmc_device_init(void)
++static void applesmc_device_init(void)
+ {
+-	int total, ret = -ENXIO;
++	int total;
+ 	u8 buffer[2];
+ 
+ 	if (!applesmc_accelerometer)
+-		return 0;
++		return;
+ 
+ 	mutex_lock(&applesmc_lock);
+ 
+ 	for (total = INIT_TIMEOUT_MSECS; total > 0; total -= INIT_WAIT_MSECS) {
+-		if (debug)
+-			printk(KERN_DEBUG "applesmc try %d\n", total);
+ 		if (!applesmc_read_key(MOTION_SENSOR_KEY, buffer, 2) &&
+-				(buffer[0] != 0x00 || buffer[1] != 0x00)) {
+-			if (total == INIT_TIMEOUT_MSECS) {
+-				printk(KERN_DEBUG "applesmc: device has"
+-						" already been initialized"
+-						" (0x%02x, 0x%02x).\n",
+-						buffer[0], buffer[1]);
+-			} else {
+-				printk(KERN_DEBUG "applesmc: device"
+-						" successfully initialized"
+-						" (0x%02x, 0x%02x).\n",
+-						buffer[0], buffer[1]);
+-			}
+-			ret = 0;
++				(buffer[0] != 0x00 || buffer[1] != 0x00))
+ 			goto out;
+-		}
+ 		buffer[0] = 0xe0;
+ 		buffer[1] = 0x00;
+ 		applesmc_write_key(MOTION_SENSOR_KEY, buffer, 2);
+@@ -486,7 +474,6 @@ static int applesmc_device_init(void)
+ 
+ out:
+ 	mutex_unlock(&applesmc_lock);
+-	return ret;
+ }
+ 
+ /*
+@@ -512,13 +499,8 @@ static int applesmc_get_fan_count(void)
+ /* Device model stuff */
+ static int applesmc_probe(struct platform_device *dev)
+ {
+-	int ret;
+-
+-	ret = applesmc_device_init();
+-	if (ret)
+-		return ret;
++	applesmc_device_init();
+ 
+-	printk(KERN_INFO "applesmc: device successfully initialized.\n");
+ 	return 0;
+ }
+ 
+@@ -535,9 +517,7 @@ static int applesmc_pm_resume(struct device *dev)
+ /* Reinitialize device on resume from hibernation */
+ static int applesmc_pm_restore(struct device *dev)
+ {
+-	int ret = applesmc_device_init();
+-	if (ret)
+-		return ret;
++	applesmc_device_init();
+ 	return applesmc_pm_resume(dev);
+ }
+ 
+@@ -1524,11 +1504,17 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = {
+ 	{ .accelerometer = 1, .light = 1, .temperature_set = 21 },
+ /* MacBook Pro 7,1: accelerometer, backlight and temperature set 22 */
+ 	{ .accelerometer = 1, .light = 1, .temperature_set = 22 },
++/* MacBook Air 3,1: accelerometer, backlight and temperature set 23 */
++	{ .accelerometer = 0, .light = 0, .temperature_set = 23 },
+ };
+ 
+ /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
+  * So we need to put "Apple MacBook Pro" before "Apple MacBook". */
+ static __initdata struct dmi_system_id applesmc_whitelist[] = {
++	{ applesmc_dmi_match, "Apple MacBook Air 3", {
++	  DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
++	  DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3") },
++		&applesmc_dmi_data[23]},
+ 	{ applesmc_dmi_match, "Apple MacBook Air 2", {
+ 	  DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+ 	  DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir2") },
+diff --git a/drivers/hwmon/lm63.c b/drivers/hwmon/lm63.c
+index 776aeb3..508cb29 100644
+--- a/drivers/hwmon/lm63.c
++++ b/drivers/hwmon/lm63.c
+@@ -98,6 +98,9 @@ static const unsigned short normal_i2c[] = { 0x18, 0x4c, 0x4e, I2C_CLIENT_END };
+  * value, it uses signed 8-bit values with LSB = 1 degree Celsius.
+  * For remote temperature, low and high limits, it uses signed 11-bit values
+  * with LSB = 0.125 degree Celsius, left-justified in 16-bit registers.
++ * For LM64 the actual remote diode temperature is 16 degree Celsius higher
++ * than the register reading. Remote temperature setpoints have to be
++ * adapted accordingly.
+  */
+ 
+ #define FAN_FROM_REG(reg)	((reg) == 0xFFFC || (reg) == 0 ? 0 : \
+@@ -165,6 +168,8 @@ struct lm63_data {
+ 	struct mutex update_lock;
+ 	char valid; /* zero until following fields are valid */
+ 	unsigned long last_updated; /* in jiffies */
++	int kind;
++	int temp2_offset;
+ 
+ 	/* registers values */
+ 	u8 config, config_fan;
+@@ -247,16 +252,34 @@ static ssize_t show_pwm1_enable(struct device *dev, struct device_attribute *dum
+ 	return sprintf(buf, "%d\n", data->config_fan & 0x20 ? 1 : 2);
+ }
+ 
+-static ssize_t show_temp8(struct device *dev, struct device_attribute *devattr,
+-			  char *buf)
++/*
++ * There are 8bit registers for both local(temp1) and remote(temp2) sensor.
++ * For remote sensor registers temp2_offset has to be considered,
++ * for local sensor it must not.
++ * So we need separate 8bit accessors for local and remote sensor.
++ */
++static ssize_t show_local_temp8(struct device *dev,
++				struct device_attribute *devattr,
++				char *buf)
+ {
+ 	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+ 	struct lm63_data *data = lm63_update_device(dev);
+ 	return sprintf(buf, "%d\n", TEMP8_FROM_REG(data->temp8[attr->index]));
+ }
+ 
+-static ssize_t set_temp8(struct device *dev, struct device_attribute *dummy,
+-			 const char *buf, size_t count)
++static ssize_t show_remote_temp8(struct device *dev,
++				 struct device_attribute *devattr,
++				 char *buf)
++{
++	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
++	struct lm63_data *data = lm63_update_device(dev);
++	return sprintf(buf, "%d\n", TEMP8_FROM_REG(data->temp8[attr->index])
++		       + data->temp2_offset);
++}
++
++static ssize_t set_local_temp8(struct device *dev,
++			       struct device_attribute *dummy,
++			       const char *buf, size_t count)
+ {
+ 	struct i2c_client *client = to_i2c_client(dev);
+ 	struct lm63_data *data = i2c_get_clientdata(client);
+@@ -274,7 +297,8 @@ static ssize_t show_temp11(struct device *dev, struct device_attribute *devattr,
+ {
+ 	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+ 	struct lm63_data *data = lm63_update_device(dev);
+-	return sprintf(buf, "%d\n", TEMP11_FROM_REG(data->temp11[attr->index]));
++	return sprintf(buf, "%d\n", TEMP11_FROM_REG(data->temp11[attr->index])
++		       + data->temp2_offset);
+ }
+ 
+ static ssize_t set_temp11(struct device *dev, struct device_attribute *devattr,
+@@ -294,7 +318,7 @@ static ssize_t set_temp11(struct device *dev, struct device_attribute *devattr,
+ 	int nr = attr->index;
+ 
+ 	mutex_lock(&data->update_lock);
+-	data->temp11[nr] = TEMP11_TO_REG(val);
++	data->temp11[nr] = TEMP11_TO_REG(val - data->temp2_offset);
+ 	i2c_smbus_write_byte_data(client, reg[(nr - 1) * 2],
+ 				  data->temp11[nr] >> 8);
+ 	i2c_smbus_write_byte_data(client, reg[(nr - 1) * 2 + 1],
+@@ -310,6 +334,7 @@ static ssize_t show_temp2_crit_hyst(struct device *dev, struct device_attribute
+ {
+ 	struct lm63_data *data = lm63_update_device(dev);
+ 	return sprintf(buf, "%d\n", TEMP8_FROM_REG(data->temp8[2])
++		       + data->temp2_offset
+ 		       - TEMP8_FROM_REG(data->temp2_crit_hyst));
+ }
+ 
+@@ -324,7 +349,7 @@ static ssize_t set_temp2_crit_hyst(struct device *dev, struct device_attribute *
+ 	long hyst;
+ 
+ 	mutex_lock(&data->update_lock);
+-	hyst = TEMP8_FROM_REG(data->temp8[2]) - val;
++	hyst = TEMP8_FROM_REG(data->temp8[2]) + data->temp2_offset - val;
+ 	i2c_smbus_write_byte_data(client, LM63_REG_REMOTE_TCRIT_HYST,
+ 				  HYST_TO_REG(hyst));
+ 	mutex_unlock(&data->update_lock);
+@@ -355,16 +380,21 @@ static SENSOR_DEVICE_ATTR(fan1_min, S_IWUSR | S_IRUGO, show_fan,
+ static DEVICE_ATTR(pwm1, S_IWUSR | S_IRUGO, show_pwm1, set_pwm1);
+ static DEVICE_ATTR(pwm1_enable, S_IRUGO, show_pwm1_enable, NULL);
+ 
+-static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, show_temp8, NULL, 0);
+-static SENSOR_DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO, show_temp8,
+-	set_temp8, 1);
++static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, show_local_temp8, NULL, 0);
++static SENSOR_DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO, show_local_temp8,
++	set_local_temp8, 1);
+ 
+ static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO, show_temp11, NULL, 0);
+ static SENSOR_DEVICE_ATTR(temp2_min, S_IWUSR | S_IRUGO, show_temp11,
+ 	set_temp11, 1);
+ static SENSOR_DEVICE_ATTR(temp2_max, S_IWUSR | S_IRUGO, show_temp11,
+ 	set_temp11, 2);
+-static SENSOR_DEVICE_ATTR(temp2_crit, S_IRUGO, show_temp8, NULL, 2);
++/*
++ * On LM63, temp2_crit can be set only once, which should be job
++ * of the bootloader.
++ */
++static SENSOR_DEVICE_ATTR(temp2_crit, S_IRUGO, show_remote_temp8,
++	NULL, 2);
+ static DEVICE_ATTR(temp2_crit_hyst, S_IWUSR | S_IRUGO, show_temp2_crit_hyst,
+ 	set_temp2_crit_hyst);
+ 
+@@ -479,7 +509,12 @@ static int lm63_probe(struct i2c_client *new_client,
+ 	data->valid = 0;
+ 	mutex_init(&data->update_lock);
+ 
+-	/* Initialize the LM63 chip */
++	/* Set the device type */
++	data->kind = id->driver_data;
++	if (data->kind == lm64)
++		data->temp2_offset = 16000;
++
++	/* Initialize chip */
+ 	lm63_init_client(new_client);
+ 
+ 	/* Register sysfs hooks */
+diff --git a/drivers/hwmon/via686a.c b/drivers/hwmon/via686a.c
+index f397ce7..b2074e3 100644
+--- a/drivers/hwmon/via686a.c
++++ b/drivers/hwmon/via686a.c
+@@ -687,6 +687,13 @@ static int __devexit via686a_remove(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
++static void via686a_update_fan_div(struct via686a_data *data)
++{
++	int reg = via686a_read_value(data, VIA686A_REG_FANDIV);
++	data->fan_div[0] = (reg >> 4) & 0x03;
++	data->fan_div[1] = reg >> 6;
++}
++
+ static void __devinit via686a_init_device(struct via686a_data *data)
+ {
+ 	u8 reg;
+@@ -700,6 +707,9 @@ static void __devinit via686a_init_device(struct via686a_data *data)
+ 	via686a_write_value(data, VIA686A_REG_TEMP_MODE,
+ 			    (reg & ~VIA686A_TEMP_MODE_MASK)
+ 			    | VIA686A_TEMP_MODE_CONTINUOUS);
++
++	/* Pre-read fan clock divisor values */
++	via686a_update_fan_div(data);
+ }
+ 
+ static struct via686a_data *via686a_update_device(struct device *dev)
+@@ -751,9 +761,7 @@ static struct via686a_data *via686a_update_device(struct device *dev)
+ 		    (via686a_read_value(data, VIA686A_REG_TEMP_LOW23) &
+ 		     0xc0) >> 6;
+ 
+-		i = via686a_read_value(data, VIA686A_REG_FANDIV);
+-		data->fan_div[0] = (i >> 4) & 0x03;
+-		data->fan_div[1] = i >> 6;
++		via686a_update_fan_div(data);
+ 		data->alarms =
+ 		    via686a_read_value(data,
+ 				       VIA686A_REG_ALARM1) |
+diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
+index 6b4cc56..44bb9c2 100644
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -1021,6 +1021,14 @@ static int i2c_do_del_adapter(struct i2c_driver *driver,
+ static int __unregister_client(struct device *dev, void *dummy)
+ {
+ 	struct i2c_client *client = i2c_verify_client(dev);
++	if (client && strcmp(client->name, "dummy"))
++		i2c_unregister_device(client);
++	return 0;
++}
++
++static int __unregister_dummy(struct device *dev, void *dummy)
++{
++	struct i2c_client *client = i2c_verify_client(dev);
+ 	if (client)
+ 		i2c_unregister_device(client);
+ 	return 0;
+@@ -1075,8 +1083,12 @@ int i2c_del_adapter(struct i2c_adapter *adap)
+ 	mutex_unlock(&adap->userspace_clients_lock);
+ 
+ 	/* Detach any active clients. This can't fail, thus we do not
+-	   checking the returned value. */
++	 * check the returned value. This is a two-pass process, because
++	 * we can't remove the dummy devices during the first pass: they
++	 * could have been instantiated by real devices wishing to clean
++	 * them up properly, so we give them a chance to do that first. */
+ 	res = device_for_each_child(&adap->dev, NULL, __unregister_client);
++	res = device_for_each_child(&adap->dev, NULL, __unregister_dummy);
+ 
+ #ifdef CONFIG_I2C_COMPAT
+ 	class_compat_remove_link(i2c_adapter_compat_class, &adap->dev,
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index c131d58..a1e141e 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -59,6 +59,8 @@
+ #include <linux/hrtimer.h>	/* ktime_get_real() */
+ #include <trace/events/power.h>
+ #include <linux/sched.h>
++#include <linux/notifier.h>
++#include <linux/cpu.h>
+ #include <asm/mwait.h>
+ 
+ #define INTEL_IDLE_VERSION "0.4"
+@@ -73,6 +75,7 @@ static int max_cstate = MWAIT_MAX_NUM_CSTATES - 1;
+ 
+ static unsigned int mwait_substates;
+ 
++#define LAPIC_TIMER_ALWAYS_RELIABLE 0xFFFFFFFF
+ /* Reliable LAPIC Timer States, bit 1 for C1 etc.  */
+ static unsigned int lapic_timer_reliable_states = (1 << 1);	 /* Default to only C1 */
+ 
+@@ -244,6 +247,35 @@ static int intel_idle(struct cpuidle_device *dev, struct cpuidle_state *state)
+ 	return usec_delta;
+ }
+ 
++static void __setup_broadcast_timer(void *arg)
++{
++	unsigned long reason = (unsigned long)arg;
++	int cpu = smp_processor_id();
++
++	reason = reason ?
++		CLOCK_EVT_NOTIFY_BROADCAST_ON : CLOCK_EVT_NOTIFY_BROADCAST_OFF;
++
++	clockevents_notify(reason, &cpu);
++}
++
++static int setup_broadcast_cpuhp_notify(struct notifier_block *n,
++		unsigned long action, void *hcpu)
++{
++	int hotcpu = (unsigned long)hcpu;
++
++	switch (action & 0xf) {
++	case CPU_ONLINE:
++		smp_call_function_single(hotcpu, __setup_broadcast_timer,
++			(void *)true, 1);
++		break;
++	}
++	return NOTIFY_OK;
++}
++
++static struct notifier_block setup_broadcast_notifier = {
++	.notifier_call = setup_broadcast_cpuhp_notify,
++};
++
+ /*
+  * intel_idle_probe()
+  */
+@@ -306,7 +338,11 @@ static int intel_idle_probe(void)
+ 	}
+ 
+ 	if (boot_cpu_has(X86_FEATURE_ARAT))	/* Always Reliable APIC Timer */
+-		lapic_timer_reliable_states = 0xFFFFFFFF;
++		lapic_timer_reliable_states = LAPIC_TIMER_ALWAYS_RELIABLE;
++	else {
++		smp_call_function(__setup_broadcast_timer, (void *)true, 1);
++		register_cpu_notifier(&setup_broadcast_notifier);
++	}
+ 
+ 	pr_debug(PREFIX "v" INTEL_IDLE_VERSION
+ 		" model 0x%X\n", boot_cpu_data.x86_model);
+@@ -429,6 +465,11 @@ static void __exit intel_idle_exit(void)
+ 	intel_idle_cpuidle_devices_uninit();
+ 	cpuidle_unregister_driver(&intel_idle_driver);
+ 
++	if (lapic_timer_reliable_states != LAPIC_TIMER_ALWAYS_RELIABLE) {
++		smp_call_function(__setup_broadcast_timer, (void *)false, 1);
++		unregister_cpu_notifier(&setup_broadcast_notifier);
++	}
++
+ 	return;
+ }
+ 
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 0dc62b1..8b00e6c 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -380,7 +380,7 @@ static void send_flowc(struct c4iw_ep *ep, struct sk_buff *skb)
+ 					  16)) | FW_WR_FLOWID(ep->hwtid));
+ 
+ 	flowc->mnemval[0].mnemonic = FW_FLOWC_MNEM_PFNVFN;
+-	flowc->mnemval[0].val = cpu_to_be32(0);
++	flowc->mnemval[0].val = cpu_to_be32(PCI_FUNC(ep->com.dev->rdev.lldi.pdev->devfn) << 8);
+ 	flowc->mnemval[1].mnemonic = FW_FLOWC_MNEM_CH;
+ 	flowc->mnemval[1].val = cpu_to_be32(ep->tx_chan);
+ 	flowc->mnemval[2].mnemonic = FW_FLOWC_MNEM_PORT;
+diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
+index 057cb25..8ae09e7 100644
+--- a/drivers/infiniband/hw/cxgb4/qp.c
++++ b/drivers/infiniband/hw/cxgb4/qp.c
+@@ -220,7 +220,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
+ 		V_FW_RI_RES_WR_DCAEN(0) |
+ 		V_FW_RI_RES_WR_DCACPU(0) |
+ 		V_FW_RI_RES_WR_FBMIN(2) |
+-		V_FW_RI_RES_WR_FBMAX(3) |
++		V_FW_RI_RES_WR_FBMAX(2) |
+ 		V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
+ 		V_FW_RI_RES_WR_CIDXFTHRESH(0) |
+ 		V_FW_RI_RES_WR_EQSIZE(eqsize));
+@@ -243,7 +243,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
+ 		V_FW_RI_RES_WR_DCAEN(0) |
+ 		V_FW_RI_RES_WR_DCACPU(0) |
+ 		V_FW_RI_RES_WR_FBMIN(2) |
+-		V_FW_RI_RES_WR_FBMAX(3) |
++		V_FW_RI_RES_WR_FBMAX(2) |
+ 		V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
+ 		V_FW_RI_RES_WR_CIDXFTHRESH(0) |
+ 		V_FW_RI_RES_WR_EQSIZE(eqsize));
+@@ -1029,7 +1029,6 @@ static int rdma_fini(struct c4iw_dev *rhp, struct c4iw_qp *qhp,
+ 	wqe->cookie = (unsigned long) &ep->com.wr_wait;
+ 
+ 	wqe->u.fini.type = FW_RI_TYPE_FINI;
+-	c4iw_init_wr_wait(&ep->com.wr_wait);
+ 	ret = c4iw_ofld_send(&rhp->rdev, skb);
+ 	if (ret)
+ 		goto out;
+@@ -1125,7 +1124,6 @@ static int rdma_init(struct c4iw_dev *rhp, struct c4iw_qp *qhp)
+ 	if (qhp->attr.mpa_attr.initiator)
+ 		build_rtr_msg(qhp->attr.mpa_attr.p2p_type, &wqe->u.init);
+ 
+-	c4iw_init_wr_wait(&qhp->ep->com.wr_wait);
+ 	ret = c4iw_ofld_send(&rhp->rdev, skb);
+ 	if (ret)
+ 		goto out;
+diff --git a/drivers/input/input.c b/drivers/input/input.c
+index db409d6..e8a8802 100644
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -73,7 +73,6 @@ static int input_defuzz_abs_event(int value, int old_val, int fuzz)
+  * dev->event_lock held and interrupts disabled.
+  */
+ static void input_pass_event(struct input_dev *dev,
+-			     struct input_handler *src_handler,
+ 			     unsigned int type, unsigned int code, int value)
+ {
+ 	struct input_handler *handler;
+@@ -92,15 +91,6 @@ static void input_pass_event(struct input_dev *dev,
+ 				continue;
+ 
+ 			handler = handle->handler;
+-
+-			/*
+-			 * If this is the handler that injected this
+-			 * particular event we want to skip it to avoid
+-			 * filters firing again and again.
+-			 */
+-			if (handler == src_handler)
+-				continue;
+-
+ 			if (!handler->filter) {
+ 				if (filtered)
+ 					break;
+@@ -130,7 +120,7 @@ static void input_repeat_key(unsigned long data)
+ 	if (test_bit(dev->repeat_key, dev->key) &&
+ 	    is_event_supported(dev->repeat_key, dev->keybit, KEY_MAX)) {
+ 
+-		input_pass_event(dev, NULL, EV_KEY, dev->repeat_key, 2);
++		input_pass_event(dev, EV_KEY, dev->repeat_key, 2);
+ 
+ 		if (dev->sync) {
+ 			/*
+@@ -139,7 +129,7 @@ static void input_repeat_key(unsigned long data)
+ 			 * Otherwise assume that the driver will send
+ 			 * SYN_REPORT once it's done.
+ 			 */
+-			input_pass_event(dev, NULL, EV_SYN, SYN_REPORT, 1);
++			input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
+ 		}
+ 
+ 		if (dev->rep[REP_PERIOD])
+@@ -172,7 +162,6 @@ static void input_stop_autorepeat(struct input_dev *dev)
+ #define INPUT_PASS_TO_ALL	(INPUT_PASS_TO_HANDLERS | INPUT_PASS_TO_DEVICE)
+ 
+ static int input_handle_abs_event(struct input_dev *dev,
+-				  struct input_handler *src_handler,
+ 				  unsigned int code, int *pval)
+ {
+ 	bool is_mt_event;
+@@ -216,15 +205,13 @@ static int input_handle_abs_event(struct input_dev *dev,
+ 	/* Flush pending "slot" event */
+ 	if (is_mt_event && dev->slot != input_abs_get_val(dev, ABS_MT_SLOT)) {
+ 		input_abs_set_val(dev, ABS_MT_SLOT, dev->slot);
+-		input_pass_event(dev, src_handler,
+-				 EV_ABS, ABS_MT_SLOT, dev->slot);
++		input_pass_event(dev, EV_ABS, ABS_MT_SLOT, dev->slot);
+ 	}
+ 
+ 	return INPUT_PASS_TO_HANDLERS;
+ }
+ 
+ static void input_handle_event(struct input_dev *dev,
+-			       struct input_handler *src_handler,
+ 			       unsigned int type, unsigned int code, int value)
+ {
+ 	int disposition = INPUT_IGNORE_EVENT;
+@@ -277,8 +264,7 @@ static void input_handle_event(struct input_dev *dev,
+ 
+ 	case EV_ABS:
+ 		if (is_event_supported(code, dev->absbit, ABS_MAX))
+-			disposition = input_handle_abs_event(dev, src_handler,
+-							     code, &value);
++			disposition = input_handle_abs_event(dev, code, &value);
+ 
+ 		break;
+ 
+@@ -336,7 +322,7 @@ static void input_handle_event(struct input_dev *dev,
+ 		dev->event(dev, type, code, value);
+ 
+ 	if (disposition & INPUT_PASS_TO_HANDLERS)
+-		input_pass_event(dev, src_handler, type, code, value);
++		input_pass_event(dev, type, code, value);
+ }
+ 
+ /**
+@@ -365,7 +351,7 @@ void input_event(struct input_dev *dev,
+ 
+ 		spin_lock_irqsave(&dev->event_lock, flags);
+ 		add_input_randomness(type, code, value);
+-		input_handle_event(dev, NULL, type, code, value);
++		input_handle_event(dev, type, code, value);
+ 		spin_unlock_irqrestore(&dev->event_lock, flags);
+ 	}
+ }
+@@ -395,8 +381,7 @@ void input_inject_event(struct input_handle *handle,
+ 		rcu_read_lock();
+ 		grab = rcu_dereference(dev->grab);
+ 		if (!grab || grab == handle)
+-			input_handle_event(dev, handle->handler,
+-					   type, code, value);
++			input_handle_event(dev, type, code, value);
+ 		rcu_read_unlock();
+ 
+ 		spin_unlock_irqrestore(&dev->event_lock, flags);
+@@ -609,10 +594,10 @@ static void input_dev_release_keys(struct input_dev *dev)
+ 		for (code = 0; code <= KEY_MAX; code++) {
+ 			if (is_event_supported(code, dev->keybit, KEY_MAX) &&
+ 			    __test_and_clear_bit(code, dev->key)) {
+-				input_pass_event(dev, NULL, EV_KEY, code, 0);
++				input_pass_event(dev, EV_KEY, code, 0);
+ 			}
+ 		}
+-		input_pass_event(dev, NULL, EV_SYN, SYN_REPORT, 1);
++		input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
+ 	}
+ }
+ 
+@@ -887,9 +872,9 @@ int input_set_keycode(struct input_dev *dev,
+ 	    !is_event_supported(old_keycode, dev->keybit, KEY_MAX) &&
+ 	    __test_and_clear_bit(old_keycode, dev->key)) {
+ 
+-		input_pass_event(dev, NULL, EV_KEY, old_keycode, 0);
++		input_pass_event(dev, EV_KEY, old_keycode, 0);
+ 		if (dev->sync)
+-			input_pass_event(dev, NULL, EV_SYN, SYN_REPORT, 1);
++			input_pass_event(dev, EV_SYN, SYN_REPORT, 1);
+ 	}
+ 
+  out:
+diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
+index b952317..ee82851 100644
+--- a/drivers/input/mouse/bcm5974.c
++++ b/drivers/input/mouse/bcm5974.c
+@@ -55,6 +55,14 @@
+ #define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI	0x0236
+ #define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO	0x0237
+ #define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS	0x0238
++/* MacbookAir3,2 (unibody), aka wellspring5 */
++#define USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI	0x023f
++#define USB_DEVICE_ID_APPLE_WELLSPRING4_ISO	0x0240
++#define USB_DEVICE_ID_APPLE_WELLSPRING4_JIS	0x0241
++/* MacbookAir3,1 (unibody), aka wellspring4 */
++#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI	0x0242
++#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO	0x0243
++#define USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS	0x0244
+ 
+ #define BCM5974_DEVICE(prod) {					\
+ 	.match_flags = (USB_DEVICE_ID_MATCH_DEVICE |		\
+@@ -80,6 +88,14 @@ static const struct usb_device_id bcm5974_table[] = {
+ 	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI),
+ 	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING3_ISO),
+ 	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING3_JIS),
++	/* MacbookAir3,2 */
++	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI),
++	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4_ISO),
++	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4_JIS),
++	/* MacbookAir3,1 */
++	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI),
++	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO),
++	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS),
+ 	/* Terminating entry */
+ 	{}
+ };
+@@ -234,6 +250,30 @@ static const struct bcm5974_config bcm5974_config_table[] = {
+ 		{ DIM_X, DIM_X / SN_COORD, -4460, 5166 },
+ 		{ DIM_Y, DIM_Y / SN_COORD, -75, 6700 }
+ 	},
++	{
++		USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI,
++		USB_DEVICE_ID_APPLE_WELLSPRING4_ISO,
++		USB_DEVICE_ID_APPLE_WELLSPRING4_JIS,
++		HAS_INTEGRATED_BUTTON,
++		0x84, sizeof(struct bt_data),
++		0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
++		{ DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
++		{ DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
++		{ DIM_X, DIM_X / SN_COORD, -4620, 5140 },
++		{ DIM_Y, DIM_Y / SN_COORD, -150, 6600 }
++	},
++	{
++		USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI,
++		USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO,
++		USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS,
++		HAS_INTEGRATED_BUTTON,
++		0x84, sizeof(struct bt_data),
++		0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
++		{ DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
++		{ DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
++		{ DIM_X, DIM_X / SN_COORD, -4616, 5112 },
++		{ DIM_Y, DIM_Y / SN_COORD, -142, 5234 }
++	},
+ 	{}
+ };
+ 
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index a5475b5..b04dd27 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -424,6 +424,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
+ 		},
+ 	},
++	{
++		/* Dell Vostro V13 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
++		},
++	},
+ 	{ }
+ };
+ 
+@@ -545,6 +552,17 @@ static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
+ };
+ #endif
+ 
++static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
++	{
++		/* Dell Vostro V13 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
++		},
++	},
++	{ }
++};
++
+ /*
+  * Some Wistron based laptops need us to explicitly enable the 'Dritek
+  * keyboard extension' to make their extra keys start generating scancodes.
+@@ -897,6 +915,9 @@ static int __init i8042_platform_init(void)
+ 	if (dmi_check_system(i8042_dmi_nomux_table))
+ 		i8042_nomux = true;
+ 
++	if (dmi_check_system(i8042_dmi_notimeout_table))
++		i8042_notimeout = true;
++
+ 	if (dmi_check_system(i8042_dmi_dritek_table))
+ 		i8042_dritek = true;
+ #endif /* CONFIG_X86 */
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index 18db5a8..039037d 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -61,6 +61,10 @@ static bool i8042_noloop;
+ module_param_named(noloop, i8042_noloop, bool, 0);
+ MODULE_PARM_DESC(noloop, "Disable the AUX Loopback command while probing for the AUX port");
+ 
++static bool i8042_notimeout;
++module_param_named(notimeout, i8042_notimeout, bool, 0);
++MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042");
++
+ #ifdef CONFIG_X86
+ static bool i8042_dritek;
+ module_param_named(dritek, i8042_dritek, bool, 0);
+@@ -503,7 +507,7 @@ static irqreturn_t i8042_interrupt(int irq, void *dev_id)
+ 	} else {
+ 
+ 		dfl = ((str & I8042_STR_PARITY) ? SERIO_PARITY : 0) |
+-		      ((str & I8042_STR_TIMEOUT) ? SERIO_TIMEOUT : 0);
++		      ((str & I8042_STR_TIMEOUT && !i8042_notimeout) ? SERIO_TIMEOUT : 0);
+ 
+ 		port_no = (str & I8042_STR_AUXDATA) ?
+ 				I8042_AUX_PORT_NO : I8042_KBD_PORT_NO;
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 487ecda..406091f 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -33,7 +33,6 @@ struct pgpath {
+ 	unsigned fail_count;		/* Cumulative failure count */
+ 
+ 	struct dm_path path;
+-	struct work_struct deactivate_path;
+ 	struct work_struct activate_path;
+ };
+ 
+@@ -116,7 +115,6 @@ static struct workqueue_struct *kmultipathd, *kmpath_handlerd;
+ static void process_queued_ios(struct work_struct *work);
+ static void trigger_event(struct work_struct *work);
+ static void activate_path(struct work_struct *work);
+-static void deactivate_path(struct work_struct *work);
+ 
+ 
+ /*-----------------------------------------------
+@@ -129,7 +127,6 @@ static struct pgpath *alloc_pgpath(void)
+ 
+ 	if (pgpath) {
+ 		pgpath->is_active = 1;
+-		INIT_WORK(&pgpath->deactivate_path, deactivate_path);
+ 		INIT_WORK(&pgpath->activate_path, activate_path);
+ 	}
+ 
+@@ -141,14 +138,6 @@ static void free_pgpath(struct pgpath *pgpath)
+ 	kfree(pgpath);
+ }
+ 
+-static void deactivate_path(struct work_struct *work)
+-{
+-	struct pgpath *pgpath =
+-		container_of(work, struct pgpath, deactivate_path);
+-
+-	blk_abort_queue(pgpath->path.dev->bdev->bd_disk->queue);
+-}
+-
+ static struct priority_group *alloc_priority_group(void)
+ {
+ 	struct priority_group *pg;
+@@ -995,7 +984,6 @@ static int fail_path(struct pgpath *pgpath)
+ 		      pgpath->path.dev->name, m->nr_valid_paths);
+ 
+ 	schedule_work(&m->trigger_event);
+-	queue_work(kmultipathd, &pgpath->deactivate_path);
+ 
+ out:
+ 	spin_unlock_irqrestore(&m->lock, flags);
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 7cb1352..81cb2f5 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1992,13 +1992,14 @@ static void event_callback(void *context)
+ 	wake_up(&md->eventq);
+ }
+ 
++/*
++ * Protected by md->suspend_lock obtained by dm_swap_table().
++ */
+ static void __set_size(struct mapped_device *md, sector_t size)
+ {
+ 	set_capacity(md->disk, size);
+ 
+-	mutex_lock(&md->bdev->bd_inode->i_mutex);
+ 	i_size_write(md->bdev->bd_inode, (loff_t)size << SECTOR_SHIFT);
+-	mutex_unlock(&md->bdev->bd_inode->i_mutex);
+ }
+ 
+ /*
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 175c424..0e5a483 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -287,11 +287,14 @@ static int md_make_request(struct request_queue *q, struct bio *bio)
+ 	mddev_t *mddev = q->queuedata;
+ 	int rv;
+ 	int cpu;
++	unsigned int sectors;
+ 
+-	if (mddev == NULL || mddev->pers == NULL) {
++	if (mddev == NULL || mddev->pers == NULL
++	    || !mddev->ready) {
+ 		bio_io_error(bio);
+ 		return 0;
+ 	}
++	smp_rmb(); /* Ensure implications of  'active' are visible */
+ 	rcu_read_lock();
+ 	if (mddev->suspended) {
+ 		DEFINE_WAIT(__wait);
+@@ -309,12 +312,16 @@ static int md_make_request(struct request_queue *q, struct bio *bio)
+ 	atomic_inc(&mddev->active_io);
+ 	rcu_read_unlock();
+ 
++	/*
++	 * save the sectors now since our bio can
++	 * go away inside make_request
++	 */
++	sectors = bio_sectors(bio);
+ 	rv = mddev->pers->make_request(mddev, bio);
+ 
+ 	cpu = part_stat_lock();
+ 	part_stat_inc(cpu, &mddev->gendisk->part0, ios[rw]);
+-	part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw],
+-		      bio_sectors(bio));
++	part_stat_add(cpu, &mddev->gendisk->part0, sectors[rw], sectors);
+ 	part_stat_unlock();
+ 
+ 	if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended)
+@@ -3115,7 +3122,7 @@ level_store(mddev_t *mddev, const char *buf, size_t len)
+ 		char nm[20];
+ 		if (rdev->raid_disk < 0)
+ 			continue;
+-		if (rdev->new_raid_disk > mddev->raid_disks)
++		if (rdev->new_raid_disk >= mddev->raid_disks)
+ 			rdev->new_raid_disk = -1;
+ 		if (rdev->new_raid_disk == rdev->raid_disk)
+ 			continue;
+@@ -4564,7 +4571,8 @@ int md_run(mddev_t *mddev)
+ 	mddev->safemode_timer.data = (unsigned long) mddev;
+ 	mddev->safemode_delay = (200 * HZ)/1000 +1; /* 200 msec delay */
+ 	mddev->in_sync = 1;
+-
++	smp_wmb();
++	mddev->ready = 1;
+ 	list_for_each_entry(rdev, &mddev->disks, same_set)
+ 		if (rdev->raid_disk >= 0) {
+ 			char nm[20];
+@@ -4725,6 +4733,7 @@ EXPORT_SYMBOL_GPL(md_stop_writes);
+ 
+ void md_stop(mddev_t *mddev)
+ {
++	mddev->ready = 0;
+ 	mddev->pers->stop(mddev);
+ 	if (mddev->pers->sync_request && mddev->to_remove == NULL)
+ 		mddev->to_remove = &md_redundancy_group;
+@@ -5159,9 +5168,10 @@ static int add_new_disk(mddev_t * mddev, mdu_disk_info_t *info)
+ 		/* set saved_raid_disk if appropriate */
+ 		if (!mddev->persistent) {
+ 			if (info->state & (1<<MD_DISK_SYNC)  &&
+-			    info->raid_disk < mddev->raid_disks)
++			    info->raid_disk < mddev->raid_disks) {
+ 				rdev->raid_disk = info->raid_disk;
+-			else
++				set_bit(In_sync, &rdev->flags);
++			} else
+ 				rdev->raid_disk = -1;
+ 		} else
+ 			super_types[mddev->major_version].
+@@ -6041,7 +6051,8 @@ static int md_thread(void * arg)
+ 			 || kthread_should_stop(),
+ 			 thread->timeout);
+ 
+-		if (test_and_clear_bit(THREAD_WAKEUP, &thread->flags))
++		clear_bit(THREAD_WAKEUP, &thread->flags);
++		if (!kthread_should_stop())
+ 			thread->run(thread->mddev);
+ 	}
+ 
+diff --git a/drivers/md/md.h b/drivers/md/md.h
+index d05bab5..a161283 100644
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -148,7 +148,8 @@ struct mddev_s
+ 						       * are happening, so run/
+ 						       * takeover/stop are not safe
+ 						       */
+-
++	int				ready; /* See when safe to pass
++						* IO requests down */
+ 	struct gendisk			*gendisk;
+ 
+ 	struct kobject			kobj;
+diff --git a/drivers/media/IR/ir-keytable.c b/drivers/media/IR/ir-keytable.c
+index f60107c..c4645d7 100644
+--- a/drivers/media/IR/ir-keytable.c
++++ b/drivers/media/IR/ir-keytable.c
+@@ -374,21 +374,27 @@ static int ir_getkeycode(struct input_dev *dev,
+ 		index = ir_lookup_by_scancode(rc_tab, scancode);
+ 	}
+ 
+-	if (index >= rc_tab->len) {
+-		if (!(ke->flags & INPUT_KEYMAP_BY_INDEX))
+-			IR_dprintk(1, "unknown key for scancode 0x%04x\n",
+-				   scancode);
++	if (index < rc_tab->len) {
++		entry = &rc_tab->scan[index];
++
++		ke->index = index;
++		ke->keycode = entry->keycode;
++		ke->len = sizeof(entry->scancode);
++		memcpy(ke->scancode, &entry->scancode, sizeof(entry->scancode));
++
++	} else if (!(ke->flags & INPUT_KEYMAP_BY_INDEX)) {
++		/*
++		 * We do not really know the valid range of scancodes
++		 * so let's respond with KEY_RESERVED to anything we
++		 * do not have mapping for [yet].
++		 */
++		ke->index = index;
++		ke->keycode = KEY_RESERVED;
++	} else {
+ 		retval = -EINVAL;
+ 		goto out;
+ 	}
+ 
+-	entry = &rc_tab->scan[index];
+-
+-	ke->index = index;
+-	ke->keycode = entry->keycode;
+-	ke->len = sizeof(entry->scancode);
+-	memcpy(ke->scancode, &entry->scancode, sizeof(entry->scancode));
+-
+ 	retval = 0;
+ 
+ out:
+diff --git a/drivers/media/dvb/frontends/ix2505v.c b/drivers/media/dvb/frontends/ix2505v.c
+index 55f2eba..6360c68 100644
+--- a/drivers/media/dvb/frontends/ix2505v.c
++++ b/drivers/media/dvb/frontends/ix2505v.c
+@@ -72,7 +72,7 @@ static int ix2505v_read_status_reg(struct ix2505v_state *state)
+ 	ret = i2c_transfer(state->i2c, msg, 1);
+ 	deb_i2c("Read %s ", __func__);
+ 
+-	return (ret = 1) ? (int) b2[0] : -1;
++	return (ret == 1) ? (int) b2[0] : -1;
+ }
+ 
+ static int ix2505v_write(struct ix2505v_state *state, u8 buf[], u8 count)
+diff --git a/drivers/media/radio/radio-aimslab.c b/drivers/media/radio/radio-aimslab.c
+index 05e832f..6cc5d13 100644
+--- a/drivers/media/radio/radio-aimslab.c
++++ b/drivers/media/radio/radio-aimslab.c
+@@ -31,7 +31,6 @@
+ #include <linux/module.h>	/* Modules 			*/
+ #include <linux/init.h>		/* Initdata			*/
+ #include <linux/ioport.h>	/* request_region		*/
+-#include <linux/delay.h>	/* udelay			*/
+ #include <linux/videodev2.h>	/* kernel radio structs		*/
+ #include <linux/version.h>	/* for KERNEL_VERSION MACRO	*/
+ #include <linux/io.h>		/* outb, outb_p			*/
+@@ -71,27 +70,17 @@ static struct rtrack rtrack_card;
+ 
+ /* local things */
+ 
+-static void sleep_delay(long n)
+-{
+-	/* Sleep nicely for 'n' uS */
+-	int d = n / msecs_to_jiffies(1000);
+-	if (!d)
+-		udelay(n);
+-	else
+-		msleep(jiffies_to_msecs(d));
+-}
+-
+ static void rt_decvol(struct rtrack *rt)
+ {
+ 	outb(0x58, rt->io);		/* volume down + sigstr + on	*/
+-	sleep_delay(100000);
++	msleep(100);
+ 	outb(0xd8, rt->io);		/* volume steady + sigstr + on	*/
+ }
+ 
+ static void rt_incvol(struct rtrack *rt)
+ {
+ 	outb(0x98, rt->io);		/* volume up + sigstr + on	*/
+-	sleep_delay(100000);
++	msleep(100);
+ 	outb(0xd8, rt->io);		/* volume steady + sigstr + on	*/
+ }
+ 
+@@ -120,7 +109,7 @@ static int rt_setvol(struct rtrack *rt, int vol)
+ 
+ 	if (vol == 0) {			/* volume = 0 means mute the card */
+ 		outb(0x48, rt->io);	/* volume down but still "on"	*/
+-		sleep_delay(2000000);	/* make sure it's totally down	*/
++		msleep(2000);	/* make sure it's totally down	*/
+ 		outb(0xd0, rt->io);	/* volume steady, off		*/
+ 		rt->curvol = 0;		/* track the volume state!	*/
+ 		mutex_unlock(&rt->lock);
+@@ -155,7 +144,7 @@ static void send_0_byte(struct rtrack *rt)
+ 		outb_p(128+64+16+8+  1, rt->io);  /* on + wr-enable + data low */
+ 		outb_p(128+64+16+8+2+1, rt->io);  /* clock */
+ 	}
+-	sleep_delay(1000);
++	msleep(1);
+ }
+ 
+ static void send_1_byte(struct rtrack *rt)
+@@ -169,7 +158,7 @@ static void send_1_byte(struct rtrack *rt)
+ 		outb_p(128+64+16+8+4+2+1, rt->io); /* clock */
+ 	}
+ 
+-	sleep_delay(1000);
++	msleep(1);
+ }
+ 
+ static int rt_setfreq(struct rtrack *rt, unsigned long freq)
+@@ -420,7 +409,7 @@ static int __init rtrack_init(void)
+ 
+ 	/* this ensures that the volume is all the way down  */
+ 	outb(0x48, rt->io);		/* volume down but still "on"	*/
+-	sleep_delay(2000000);	/* make sure it's totally down	*/
++	msleep(2000);	/* make sure it's totally down	*/
+ 	outb(0xc0, rt->io);		/* steady volume, mute card	*/
+ 
+ 	if (video_register_device(&rt->vdev, VFL_TYPE_RADIO, radio_nr) < 0) {
+diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
+index f7e9168..2637f6f 100644
+--- a/drivers/media/video/em28xx/em28xx-cards.c
++++ b/drivers/media/video/em28xx/em28xx-cards.c
+@@ -1633,11 +1633,11 @@ struct em28xx_board em28xx_boards[] = {
+ 		.input           = { {
+ 			.type     = EM28XX_VMUX_COMPOSITE1,
+ 			.vmux     = SAA7115_COMPOSITE0,
+-			.amux     = EM28XX_AMUX_VIDEO2,
++			.amux     = EM28XX_AMUX_LINE_IN,
+ 		}, {
+ 			.type     = EM28XX_VMUX_SVIDEO,
+ 			.vmux     = SAA7115_SVIDEO3,
+-			.amux     = EM28XX_AMUX_VIDEO2,
++			.amux     = EM28XX_AMUX_LINE_IN,
+ 		} },
+ 	},
+ 	[EM2860_BOARD_TERRATEC_AV350] = {
+diff --git a/drivers/mmc/host/bfin_sdh.c b/drivers/mmc/host/bfin_sdh.c
+index bac7d62..0371bf5 100644
+--- a/drivers/mmc/host/bfin_sdh.c
++++ b/drivers/mmc/host/bfin_sdh.c
+@@ -462,7 +462,7 @@ static int __devinit sdh_probe(struct platform_device *pdev)
+ 		goto out;
+ 	}
+ 
+-	mmc = mmc_alloc_host(sizeof(*mmc), &pdev->dev);
++	mmc = mmc_alloc_host(sizeof(struct sdh_host), &pdev->dev);
+ 	if (!mmc) {
+ 		ret = -ENOMEM;
+ 		goto out;
+diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
+index 17f8518..ea2c288 100644
+--- a/drivers/mtd/nand/pxa3xx_nand.c
++++ b/drivers/mtd/nand/pxa3xx_nand.c
+@@ -885,6 +885,7 @@ static int pxa3xx_nand_detect_config(struct pxa3xx_nand_info *info)
+ 	/* set info fields needed to __readid */
+ 	info->read_id_bytes = (info->page_size == 2048) ? 4 : 2;
+ 	info->reg_ndcr = ndcr;
++	info->cmdset = &default_cmdset;
+ 
+ 	if (__readid(info, &id))
+ 		return -ENODEV;
+@@ -915,7 +916,6 @@ static int pxa3xx_nand_detect_config(struct pxa3xx_nand_info *info)
+ 
+ 	info->ndtr0cs0 = nand_readl(info, NDTR0CS0);
+ 	info->ndtr1cs0 = nand_readl(info, NDTR1CS0);
+-	info->cmdset = &default_cmdset;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
+index 4d62f7b..b3b251e 100644
+--- a/drivers/net/e1000/e1000_main.c
++++ b/drivers/net/e1000/e1000_main.c
+@@ -971,11 +971,13 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
+ 		 */
+ 		dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
+ 		pci_using_dac = 1;
+-	} else if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(32))) {
+-		dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+ 	} else {
+-		pr_err("No usable DMA config, aborting\n");
+-		goto err_dma;
++		err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
++		if (err) {
++			pr_err("No usable DMA config, aborting\n");
++			goto err_dma;
++		}
++		dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
+ 	}
+ 
+ 	netdev->netdev_ops = &e1000_netdev_ops;
+diff --git a/drivers/net/fec.c b/drivers/net/fec.c
+index cce32d4..52e9ca8 100644
+--- a/drivers/net/fec.c
++++ b/drivers/net/fec.c
+@@ -651,8 +651,8 @@ static int fec_enet_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
+ 	fep->mii_timeout = 0;
+ 	init_completion(&fep->mdio_done);
+ 
+-	/* start a read op */
+-	writel(FEC_MMFR_ST | FEC_MMFR_OP_READ |
++	/* start a write op */
++	writel(FEC_MMFR_ST | FEC_MMFR_OP_WRITE |
+ 		FEC_MMFR_PA(mii_id) | FEC_MMFR_RA(regnum) |
+ 		FEC_MMFR_TA | FEC_MMFR_DATA(value),
+ 		fep->hwp + FEC_MII_DATA);
+diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
+index eee0b29..57d747a 100644
+--- a/drivers/net/ixgbe/ixgbe_main.c
++++ b/drivers/net/ixgbe/ixgbe_main.c
+@@ -2912,9 +2912,16 @@ static void ixgbe_set_rx_buffer_len(struct ixgbe_adapter *adapter)
+ 	u32 mhadd, hlreg0;
+ 
+ 	/* Decide whether to use packet split mode or not */
++	/* On by default */
++	adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
++
+ 	/* Do not use packet split if we're in SR-IOV Mode */
+-	if (!adapter->num_vfs)
+-		adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
++	if (adapter->num_vfs)
++		adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
++
++	/* Disable packet split due to 82599 erratum #45 */
++	if (hw->mac.type == ixgbe_mac_82599EB)
++		adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
+ 
+ 	/* Set the RX buffer length according to the mode */
+ 	if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index b6d4028..c1689ba 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -446,6 +446,20 @@ static void skb_recv_done(struct virtqueue *rvq)
+ 	}
+ }
+ 
++static void virtnet_napi_enable(struct virtnet_info *vi)
++{
++	napi_enable(&vi->napi);
++
++	/* If all buffers were filled by other side before we napi_enabled, we
++	 * won't get another interrupt, so process any outstanding packets
++	 * now.  virtnet_poll wants re-enable the queue, so we disable here.
++	 * We synchronize against interrupts via NAPI_STATE_SCHED */
++	if (napi_schedule_prep(&vi->napi)) {
++		virtqueue_disable_cb(vi->rvq);
++		__napi_schedule(&vi->napi);
++	}
++}
++
+ static void refill_work(struct work_struct *work)
+ {
+ 	struct virtnet_info *vi;
+@@ -454,7 +468,7 @@ static void refill_work(struct work_struct *work)
+ 	vi = container_of(work, struct virtnet_info, refill.work);
+ 	napi_disable(&vi->napi);
+ 	still_empty = !try_fill_recv(vi, GFP_KERNEL);
+-	napi_enable(&vi->napi);
++	virtnet_napi_enable(vi);
+ 
+ 	/* In theory, this can happen: if we don't get any buffers in
+ 	 * we will *never* try to fill again. */
+@@ -638,16 +652,7 @@ static int virtnet_open(struct net_device *dev)
+ {
+ 	struct virtnet_info *vi = netdev_priv(dev);
+ 
+-	napi_enable(&vi->napi);
+-
+-	/* If all buffers were filled by other side before we napi_enabled, we
+-	 * won't get another interrupt, so process any outstanding packets
+-	 * now.  virtnet_poll wants re-enable the queue, so we disable here.
+-	 * We synchronize against interrupts via NAPI_STATE_SCHED */
+-	if (napi_schedule_prep(&vi->napi)) {
+-		virtqueue_disable_cb(vi->rvq);
+-		__napi_schedule(&vi->napi);
+-	}
++	virtnet_napi_enable(vi);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+index 15f62cd..9b6ba23 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9002_calib.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
+@@ -681,10 +681,6 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
+ 
+ 	/* Do NF cal only at longer intervals */
+ 	if (longcal || nfcal_pending) {
+-		/* Do periodic PAOffset Cal */
+-		ar9002_hw_pa_cal(ah, false);
+-		ar9002_hw_olc_temp_compensation(ah);
+-
+ 		/*
+ 		 * Get the value from the previous NF cal and update
+ 		 * history buffer.
+@@ -699,8 +695,12 @@ static bool ar9002_hw_calibrate(struct ath_hw *ah,
+ 			ath9k_hw_loadnf(ah, ah->curchan);
+ 		}
+ 
+-		if (longcal)
++		if (longcal) {
+ 			ath9k_hw_start_nfcal(ah, false);
++			/* Do periodic PAOffset Cal */
++			ar9002_hw_pa_cal(ah, false);
++			ar9002_hw_olc_temp_compensation(ah);
++		}
+ 	}
+ 
+ 	return iscaldone;
+diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+index 48261b7..2528b29 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
++++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+@@ -444,9 +444,8 @@ static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
+ 		}
+ 
+ 		/* WAR for ASPM system hang */
+-		if (AR_SREV_9280(ah) || AR_SREV_9285(ah) || AR_SREV_9287(ah)) {
++		if (AR_SREV_9285(ah) || AR_SREV_9287(ah))
+ 			val |= (AR_WA_BIT6 | AR_WA_BIT7);
+-		}
+ 
+ 		if (AR_SREV_9285E_20(ah))
+ 			val |= AR_WA_BIT23;
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+index a7b82f0..aa355df 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -22,12 +22,14 @@
+ #define COMP_CKSUM_LEN 2
+ 
+ #define AR_CH0_TOP (0x00016288)
+-#define AR_CH0_TOP_XPABIASLVL (0x3)
++#define AR_CH0_TOP_XPABIASLVL (0x300)
+ #define AR_CH0_TOP_XPABIASLVL_S (8)
+ 
+ #define AR_CH0_THERM (0x00016290)
+-#define AR_CH0_THERM_SPARE (0x3f)
+-#define AR_CH0_THERM_SPARE_S (0)
++#define AR_CH0_THERM_XPABIASLVL_MSB 0x3
++#define AR_CH0_THERM_XPABIASLVL_MSB_S 0
++#define AR_CH0_THERM_XPASHORT2GND 0x4
++#define AR_CH0_THERM_XPASHORT2GND_S 2
+ 
+ #define AR_SWITCH_TABLE_COM_ALL (0xffff)
+ #define AR_SWITCH_TABLE_COM_ALL_S (0)
+@@ -995,9 +997,9 @@ static s32 ar9003_hw_xpa_bias_level_get(struct ath_hw *ah, bool is2ghz)
+ static void ar9003_hw_xpa_bias_level_apply(struct ath_hw *ah, bool is2ghz)
+ {
+ 	int bias = ar9003_hw_xpa_bias_level_get(ah, is2ghz);
+-	REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, (bias & 0x3));
+-	REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_SPARE,
+-		      ((bias >> 2) & 0x3));
++	REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
++	REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPABIASLVL_MSB, bias >> 2);
++	REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPASHORT2GND, 1);
+ }
+ 
+ static u32 ar9003_hw_ant_ctrl_common_get(struct ath_hw *ah, bool is2ghz)
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index 0963071..c0b60ce 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -178,8 +178,8 @@ void ath_descdma_cleanup(struct ath_softc *sc, struct ath_descdma *dd,
+ 
+ /* returns delimiter padding required given the packet length */
+ #define ATH_AGGR_GET_NDELIM(_len)					\
+-	(((((_len) + ATH_AGGR_DELIM_SZ) < ATH_AGGR_MINPLEN) ?           \
+-	  (ATH_AGGR_MINPLEN - (_len) - ATH_AGGR_DELIM_SZ) : 0) >> 2)
++       (((_len) >= ATH_AGGR_MINPLEN) ? 0 :                             \
++        DIV_ROUND_UP(ATH_AGGR_MINPLEN - (_len), ATH_AGGR_DELIM_SZ))
+ 
+ #define BAW_WITHIN(_start, _bawsz, _seqno) \
+ 	((((_seqno) - (_start)) & 4095) < (_bawsz))
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index 0de3c3d..270671f 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -144,16 +144,36 @@ static void hif_usb_tx_cb(struct urb *urb)
+ 	case -ENODEV:
+ 	case -ESHUTDOWN:
+ 		/*
+-		 * The URB has been killed, free the SKBs
+-		 * and return.
++		 * The URB has been killed, free the SKBs.
+ 		 */
+ 		ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
+-		return;
++
++		/*
++		 * If the URBs are being flushed, no need to add this
++		 * URB to the free list.
++		 */
++		spin_lock(&hif_dev->tx.tx_lock);
++		if (hif_dev->tx.flags & HIF_USB_TX_FLUSH) {
++			spin_unlock(&hif_dev->tx.tx_lock);
++			return;
++		}
++		spin_unlock(&hif_dev->tx.tx_lock);
++
++		/*
++		 * In the stop() case, this URB has to be added to
++		 * the free list.
++		 */
++		goto add_free;
+ 	default:
+ 		break;
+ 	}
+ 
+-	/* Check if TX has been stopped */
++	/*
++	 * Check if TX has been stopped, this is needed because
++	 * this CB could have been invoked just after the TX lock
++	 * was released in hif_stop() and kill_urb() hasn't been
++	 * called yet.
++	 */
+ 	spin_lock(&hif_dev->tx.tx_lock);
+ 	if (hif_dev->tx.flags & HIF_USB_TX_STOP) {
+ 		spin_unlock(&hif_dev->tx.tx_lock);
+@@ -305,6 +325,7 @@ static void hif_usb_start(void *hif_handle, u8 pipe_id)
+ static void hif_usb_stop(void *hif_handle, u8 pipe_id)
+ {
+ 	struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle;
++	struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+@@ -312,6 +333,12 @@ static void hif_usb_stop(void *hif_handle, u8 pipe_id)
+ 	hif_dev->tx.tx_skb_cnt = 0;
+ 	hif_dev->tx.flags |= HIF_USB_TX_STOP;
+ 	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
++
++	/* The pending URBs have to be canceled. */
++	list_for_each_entry_safe(tx_buf, tx_buf_tmp,
++				 &hif_dev->tx.tx_pending, list) {
++		usb_kill_urb(tx_buf->urb);
++	}
+ }
+ 
+ static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb,
+@@ -578,6 +605,7 @@ free:
+ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
+ {
+ 	struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
++	unsigned long flags;
+ 
+ 	list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+ 				 &hif_dev->tx.tx_buf, list) {
+@@ -588,6 +616,10 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
+ 		kfree(tx_buf);
+ 	}
+ 
++	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
++	hif_dev->tx.flags |= HIF_USB_TX_FLUSH;
++	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
++
+ 	list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+ 				 &hif_dev->tx.tx_pending, list) {
+ 		usb_kill_urb(tx_buf->urb);
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
+index 2daf97b..30d0938 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
+@@ -62,6 +62,7 @@ struct tx_buf {
+ };
+ 
+ #define HIF_USB_TX_STOP  BIT(0)
++#define HIF_USB_TX_FLUSH BIT(1)
+ 
+ struct hif_usb_tx {
+ 	u8 flags;
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index c7fbe25..5dcf140 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -385,6 +385,9 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
+ 	else
+ 		ah->config.ht_enable = 0;
+ 
++	/* PAPRD needs some more work to be enabled */
++	ah->config.paprd_disable = 1;
++
+ 	ah->config.rx_intr_mitigation = true;
+ 	ah->config.pcieSerDesWrite = true;
+ 
+@@ -1949,7 +1952,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
+ 		pCap->rx_status_len = sizeof(struct ar9003_rxs);
+ 		pCap->tx_desc_len = sizeof(struct ar9003_txc);
+ 		pCap->txs_len = sizeof(struct ar9003_txs);
+-		if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
++		if (!ah->config.paprd_disable &&
++		    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+ 			pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
+ 	} else {
+ 		pCap->tx_desc_len = sizeof(struct ath_desc);
+diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
+index d47d1b4..1240376 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -215,6 +215,7 @@ struct ath9k_ops_config {
+ 	u32 pcie_waen;
+ 	u8 analog_shiftreg;
+ 	u8 ht_enable;
++	u8 paprd_disable;
+ 	u32 ofdm_trig_low;
+ 	u32 ofdm_trig_high;
+ 	u32 cck_trig_high;
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index c0c3464..d1b0db4 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -295,7 +295,8 @@ int ath_set_channel(struct ath_softc *sc, struct ieee80211_hw *hw,
+ 	ath9k_hw_set_interrupts(ah, ah->imask);
+ 
+ 	if (!(sc->sc_flags & (SC_OP_OFFCHANNEL))) {
+-		ath_beacon_config(sc, NULL);
++		if (sc->sc_flags & SC_OP_BEACONS)
++			ath_beacon_config(sc, NULL);
+ 		ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
+ 		ath_start_ani(common);
+ 	}
+@@ -1418,8 +1419,9 @@ static void ath9k_stop(struct ieee80211_hw *hw)
+ 	ath9k_hw_configpcipowersave(ah, 1, 1);
+ 	ath9k_ps_restore(sc);
+ 
+-	/* Finally, put the chip in FULL SLEEP mode */
+-	ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
++	sc->ps_idle = true;
++	ath9k_set_wiphy_idle(aphy, true);
++	ath_radio_disable(sc, hw);
+ 
+ 	sc->sc_flags |= SC_OP_INVALID;
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
+index b5b6514..894ebadb 100644
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -290,6 +290,10 @@ static int ath_pci_resume(struct pci_dev *pdev)
+ 			    AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+ 	ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
+ 
++	sc->ps_idle = true;
++	ath9k_set_wiphy_idle(aphy, true);
++	ath_radio_disable(sc, hw);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
+index 939a0e9..84866a4 100644
+--- a/drivers/net/wireless/ath/carl9170/rx.c
++++ b/drivers/net/wireless/ath/carl9170/rx.c
+@@ -564,7 +564,7 @@ static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
+ 	cam = ieee80211_check_tim(tim_ie, tim_len, ar->common.curaid);
+ 
+ 	/* 2. Maybe the AP wants to send multicast/broadcast data? */
+-	cam = !!(tim_ie->bitmap_ctrl & 0x01);
++	cam |= !!(tim_ie->bitmap_ctrl & 0x01);
+ 
+ 	if (!cam) {
+ 		/* back to low-power land. */
+diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c
+index bd21a4d..32fcc19 100644
+--- a/drivers/net/wireless/ath/key.c
++++ b/drivers/net/wireless/ath/key.c
+@@ -60,6 +60,8 @@ bool ath_hw_keyreset(struct ath_common *common, u16 entry)
+ 		REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), 0);
+ 		REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), 0);
+ 		REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), 0);
++		if (common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)
++			REG_WRITE(ah, AR_KEYTABLE_KEY4(micentry), 0);
+ 
+ 	}
+ 
+diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
+index bd8a413..2176ede 100644
+--- a/drivers/net/wireless/hostap/hostap_cs.c
++++ b/drivers/net/wireless/hostap/hostap_cs.c
+@@ -518,22 +518,21 @@ static int prism2_config(struct pcmcia_device *link)
+ 	hw_priv->link = link;
+ 
+ 	/*
+-	 * Make sure the IRQ handler cannot proceed until at least
+-	 * dev->base_addr is initialized.
++	 * We enable IRQ here, but IRQ handler will not proceed
++	 * until dev->base_addr is set below. This protect us from
++	 * receive interrupts when driver is not initialized.
+ 	 */
+-	spin_lock_irqsave(&local->irq_init_lock, flags);
+-
+ 	ret = pcmcia_request_irq(link, prism2_interrupt);
+ 	if (ret)
+-		goto failed_unlock;
++		goto failed;
+ 
+ 	ret = pcmcia_enable_device(link);
+ 	if (ret)
+-		goto failed_unlock;
++		goto failed;
+ 
++	spin_lock_irqsave(&local->irq_init_lock, flags);
+ 	dev->irq = link->irq;
+ 	dev->base_addr = link->resource[0]->start;
+-
+ 	spin_unlock_irqrestore(&local->irq_init_lock, flags);
+ 
+ 	local->shutdown = 0;
+@@ -546,8 +545,6 @@ static int prism2_config(struct pcmcia_device *link)
+ 
+ 	return ret;
+ 
+- failed_unlock:
+-	spin_unlock_irqrestore(&local->irq_init_lock, flags);
+  failed:
+ 	kfree(hw_priv);
+ 	prism2_release((u_long)link);
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
+index c2636a7..f0468cd 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -1319,6 +1319,9 @@ static void iwl_irq_tasklet_legacy(struct iwl_priv *priv)
+ 	/* only Re-enable if diabled by irq */
+ 	if (test_bit(STATUS_INT_ENABLED, &priv->status))
+ 		iwl_enable_interrupts(priv);
++	/* Re-enable RF_KILL if it occurred */
++	else if (handled & CSR_INT_BIT_RF_KILL)
++		iwl_enable_rfkill_int(priv);
+ 
+ #ifdef CONFIG_IWLWIFI_DEBUG
+ 	if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
+@@ -1533,6 +1536,9 @@ static void iwl_irq_tasklet(struct iwl_priv *priv)
+ 	/* only Re-enable if diabled by irq */
+ 	if (test_bit(STATUS_INT_ENABLED, &priv->status))
+ 		iwl_enable_interrupts(priv);
++	/* Re-enable RF_KILL if it occurred */
++	else if (handled & CSR_INT_BIT_RF_KILL)
++		iwl_enable_rfkill_int(priv);
+ }
+ 
+ /* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
+@@ -3530,9 +3536,10 @@ static void iwl_mac_stop(struct ieee80211_hw *hw)
+ 
+ 	flush_workqueue(priv->workqueue);
+ 
+-	/* enable interrupts again in order to receive rfkill changes */
++	/* User space software may expect getting rfkill changes
++	 * even if interface is down */
+ 	iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
+-	iwl_enable_interrupts(priv);
++	iwl_enable_rfkill_int(priv);
+ 
+ 	IWL_DEBUG_MAC80211(priv, "leave\n");
+ }
+@@ -4515,14 +4522,14 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	 * 8. Enable interrupts and read RFKILL state
+ 	 *********************************************/
+ 
+-	/* enable interrupts if needed: hw bug w/a */
++	/* enable rfkill interrupt: hw bug w/a */
+ 	pci_read_config_word(priv->pci_dev, PCI_COMMAND, &pci_cmd);
+ 	if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
+ 		pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
+ 		pci_write_config_word(priv->pci_dev, PCI_COMMAND, pci_cmd);
+ 	}
+ 
+-	iwl_enable_interrupts(priv);
++	iwl_enable_rfkill_int(priv);
+ 
+ 	/* If platform's RF_KILL switch is NOT set to KILL */
+ 	if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
+diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
+index 1aaef70..19f5586 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
++++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
+@@ -163,6 +163,12 @@ static inline void iwl_disable_interrupts(struct iwl_priv *priv)
+ 	IWL_DEBUG_ISR(priv, "Disabled interrupts\n");
+ }
+ 
++static inline void iwl_enable_rfkill_int(struct iwl_priv *priv)
++{
++	IWL_DEBUG_ISR(priv, "Enabling rfkill interrupt\n");
++	iwl_write32(priv, CSR_INT_MASK, CSR_INT_BIT_RF_KILL);
++}
++
+ static inline void iwl_enable_interrupts(struct iwl_priv *priv)
+ {
+ 	IWL_DEBUG_ISR(priv, "Enabling interrupts\n");
+diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
+index 76b2318a..f618b96 100644
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -618,7 +618,7 @@ static void p54_tx_80211_header(struct p54_common *priv, struct sk_buff *skb,
+ 	else
+ 		*burst_possible = false;
+ 
+-	if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)
++	if (!(info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
+ 		*flags |= P54_HDR_FLAG_DATA_OUT_SEQNR;
+ 
+ 	if (info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE)
+diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
+index 9be8089..4c6fba7 100644
+--- a/drivers/net/wireless/rt2x00/rt73usb.c
++++ b/drivers/net/wireless/rt2x00/rt73usb.c
+@@ -2417,6 +2417,7 @@ static struct usb_device_id rt73usb_device_table[] = {
+ 	{ USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
+ 	{ USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
+ 	{ USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
++	{ USB_DEVICE(0x0812, 0x3101), USB_DEVICE_DATA(&rt73usb_ops) },
+ 	/* Qcom */
+ 	{ USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) },
+ 	{ USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
+diff --git a/drivers/pci/pci-stub.c b/drivers/pci/pci-stub.c
+index f7b68ca..4ae494b 100644
+--- a/drivers/pci/pci-stub.c
++++ b/drivers/pci/pci-stub.c
+@@ -54,6 +54,9 @@ static int __init pci_stub_init(void)
+ 			subdevice = PCI_ANY_ID, class=0, class_mask=0;
+ 		int fields;
+ 
++		if (!strlen(id))
++			continue;
++
+ 		fields = sscanf(id, "%x:%x:%x:%x:%x:%x",
+ 				&vendor, &device, &subvendor, &subdevice,
+ 				&class, &class_mask);
+diff --git a/drivers/power/ds2760_battery.c b/drivers/power/ds2760_battery.c
+index b3c01c1..11e1ac5 100644
+--- a/drivers/power/ds2760_battery.c
++++ b/drivers/power/ds2760_battery.c
+@@ -212,7 +212,7 @@ static int ds2760_battery_read_status(struct ds2760_device_info *di)
+ 	if (di->rem_capacity > 100)
+ 		di->rem_capacity = 100;
+ 
+-	if (di->current_uA >= 100L)
++	if (di->current_uA < -100L)
+ 		di->life_sec = -((di->accum_current_uAh - di->empty_uAh) * 36L)
+ 					/ (di->current_uA / 100L);
+ 	else
+diff --git a/drivers/power/jz4740-battery.c b/drivers/power/jz4740-battery.c
+index a8108a7..2bbe04a 100644
+--- a/drivers/power/jz4740-battery.c
++++ b/drivers/power/jz4740-battery.c
+@@ -47,6 +47,8 @@ struct jz_battery {
+ 
+ 	struct power_supply battery;
+ 	struct delayed_work work;
++
++	struct mutex lock;
+ };
+ 
+ static inline struct jz_battery *psy_to_jz_battery(struct power_supply *psy)
+@@ -68,6 +70,8 @@ static long jz_battery_read_voltage(struct jz_battery *battery)
+ 	unsigned long val;
+ 	long voltage;
+ 
++	mutex_lock(&battery->lock);
++
+ 	INIT_COMPLETION(battery->read_completion);
+ 
+ 	enable_irq(battery->irq);
+@@ -91,6 +95,8 @@ static long jz_battery_read_voltage(struct jz_battery *battery)
+ 	battery->cell->disable(battery->pdev);
+ 	disable_irq(battery->irq);
+ 
++	mutex_unlock(&battery->lock);
++
+ 	return voltage;
+ }
+ 
+@@ -291,6 +297,7 @@ static int __devinit jz_battery_probe(struct platform_device *pdev)
+ 	jz_battery->pdev = pdev;
+ 
+ 	init_completion(&jz_battery->read_completion);
++	mutex_init(&jz_battery->lock);
+ 
+ 	INIT_DELAYED_WORK(&jz_battery->work, jz_battery_work);
+ 
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index 5856167..dd8242d 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -36,6 +36,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/mod_devicetable.h>
+ #include <linux/log2.h>
++#include <linux/pm.h>
+ 
+ /* this is for "generic access to PC-style RTC" using CMOS_READ/CMOS_WRITE */
+ #include <asm-generic/rtc.h>
+@@ -850,7 +851,7 @@ static void __exit cmos_do_remove(struct device *dev)
+ 
+ #ifdef	CONFIG_PM
+ 
+-static int cmos_suspend(struct device *dev, pm_message_t mesg)
++static int cmos_suspend(struct device *dev)
+ {
+ 	struct cmos_rtc	*cmos = dev_get_drvdata(dev);
+ 	unsigned char	tmp;
+@@ -898,7 +899,7 @@ static int cmos_suspend(struct device *dev, pm_message_t mesg)
+  */
+ static inline int cmos_poweroff(struct device *dev)
+ {
+-	return cmos_suspend(dev, PMSG_HIBERNATE);
++	return cmos_suspend(dev);
+ }
+ 
+ static int cmos_resume(struct device *dev)
+@@ -945,9 +946,9 @@ static int cmos_resume(struct device *dev)
+ 	return 0;
+ }
+ 
++static SIMPLE_DEV_PM_OPS(cmos_pm_ops, cmos_suspend, cmos_resume);
++
+ #else
+-#define	cmos_suspend	NULL
+-#define	cmos_resume	NULL
+ 
+ static inline int cmos_poweroff(struct device *dev)
+ {
+@@ -1077,7 +1078,7 @@ static void __exit cmos_pnp_remove(struct pnp_dev *pnp)
+ 
+ static int cmos_pnp_suspend(struct pnp_dev *pnp, pm_message_t mesg)
+ {
+-	return cmos_suspend(&pnp->dev, mesg);
++	return cmos_suspend(&pnp->dev);
+ }
+ 
+ static int cmos_pnp_resume(struct pnp_dev *pnp)
+@@ -1157,8 +1158,9 @@ static struct platform_driver cmos_platform_driver = {
+ 	.shutdown	= cmos_platform_shutdown,
+ 	.driver = {
+ 		.name		= (char *) driver_name,
+-		.suspend	= cmos_suspend,
+-		.resume		= cmos_resume,
++#ifdef CONFIG_PM
++		.pm		= &cmos_pm_ops,
++#endif
+ 	}
+ };
+ 
+diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
+index 0f4ef87..3e6ad23 100644
+--- a/drivers/s390/cio/qdio.h
++++ b/drivers/s390/cio/qdio.h
+@@ -91,6 +91,12 @@ enum qdio_irq_states {
+ #define AC1_SC_QEBSM_AVAILABLE		0x02	/* available for subchannel */
+ #define AC1_SC_QEBSM_ENABLED		0x01	/* enabled for subchannel */
+ 
++/* SIGA flags */
++#define QDIO_SIGA_WRITE		0x00
++#define QDIO_SIGA_READ		0x01
++#define QDIO_SIGA_SYNC		0x02
++#define QDIO_SIGA_QEBSM_FLAG	0x80
++
+ #ifdef CONFIG_64BIT
+ static inline int do_sqbs(u64 token, unsigned char state, int queue,
+ 			  int *start, int *count)
+diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
+index 5fcfa7f..27de2ea 100644
+--- a/drivers/s390/cio/qdio_main.c
++++ b/drivers/s390/cio/qdio_main.c
+@@ -29,11 +29,12 @@ MODULE_AUTHOR("Utz Bacher <utz.bacher@××××××.com>,"\
+ MODULE_DESCRIPTION("QDIO base support");
+ MODULE_LICENSE("GPL");
+ 
+-static inline int do_siga_sync(struct subchannel_id schid,
+-			       unsigned int out_mask, unsigned int in_mask)
++static inline int do_siga_sync(unsigned long schid,
++			       unsigned int out_mask, unsigned int in_mask,
++			       unsigned int fc)
+ {
+-	register unsigned long __fc asm ("0") = 2;
+-	register struct subchannel_id __schid asm ("1") = schid;
++	register unsigned long __fc asm ("0") = fc;
++	register unsigned long __schid asm ("1") = schid;
+ 	register unsigned long out asm ("2") = out_mask;
+ 	register unsigned long in asm ("3") = in_mask;
+ 	int cc;
+@@ -47,10 +48,11 @@ static inline int do_siga_sync(struct subchannel_id schid,
+ 	return cc;
+ }
+ 
+-static inline int do_siga_input(struct subchannel_id schid, unsigned int mask)
++static inline int do_siga_input(unsigned long schid, unsigned int mask,
++				unsigned int fc)
+ {
+-	register unsigned long __fc asm ("0") = 1;
+-	register struct subchannel_id __schid asm ("1") = schid;
++	register unsigned long __fc asm ("0") = fc;
++	register unsigned long __schid asm ("1") = schid;
+ 	register unsigned long __mask asm ("2") = mask;
+ 	int cc;
+ 
+@@ -279,6 +281,8 @@ void qdio_init_buf_states(struct qdio_irq *irq_ptr)
+ static inline int qdio_siga_sync(struct qdio_q *q, unsigned int output,
+ 			  unsigned int input)
+ {
++	unsigned long schid = *((u32 *) &q->irq_ptr->schid);
++	unsigned int fc = QDIO_SIGA_SYNC;
+ 	int cc;
+ 
+ 	if (!need_siga_sync(q))
+@@ -287,7 +291,12 @@ static inline int qdio_siga_sync(struct qdio_q *q, unsigned int output,
+ 	DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "siga-s:%1d", q->nr);
+ 	qperf_inc(q, siga_sync);
+ 
+-	cc = do_siga_sync(q->irq_ptr->schid, output, input);
++	if (is_qebsm(q)) {
++		schid = q->irq_ptr->sch_token;
++		fc |= QDIO_SIGA_QEBSM_FLAG;
++	}
++
++	cc = do_siga_sync(schid, output, input, fc);
+ 	if (cc)
+ 		DBF_ERROR("%4x SIGA-S:%2d", SCH_NO(q), cc);
+ 	return cc;
+@@ -313,8 +322,8 @@ static inline int qdio_siga_sync_all(struct qdio_q *q)
+ 
+ static int qdio_siga_output(struct qdio_q *q, unsigned int *busy_bit)
+ {
+-	unsigned long schid;
+-	unsigned int fc = 0;
++	unsigned long schid = *((u32 *) &q->irq_ptr->schid);
++	unsigned int fc = QDIO_SIGA_WRITE;
+ 	u64 start_time = 0;
+ 	int cc;
+ 
+@@ -323,11 +332,8 @@ static int qdio_siga_output(struct qdio_q *q, unsigned int *busy_bit)
+ 
+ 	if (is_qebsm(q)) {
+ 		schid = q->irq_ptr->sch_token;
+-		fc |= 0x80;
++		fc |= QDIO_SIGA_QEBSM_FLAG;
+ 	}
+-	else
+-		schid = *((u32 *)&q->irq_ptr->schid);
+-
+ again:
+ 	cc = do_siga_output(schid, q->mask, busy_bit, fc);
+ 
+@@ -347,12 +353,19 @@ again:
+ 
+ static inline int qdio_siga_input(struct qdio_q *q)
+ {
++	unsigned long schid = *((u32 *) &q->irq_ptr->schid);
++	unsigned int fc = QDIO_SIGA_READ;
+ 	int cc;
+ 
+ 	DBF_DEV_EVENT(DBF_INFO, q->irq_ptr, "siga-r:%1d", q->nr);
+ 	qperf_inc(q, siga_read);
+ 
+-	cc = do_siga_input(q->irq_ptr->schid, q->mask);
++	if (is_qebsm(q)) {
++		schid = q->irq_ptr->sch_token;
++		fc |= QDIO_SIGA_QEBSM_FLAG;
++	}
++
++	cc = do_siga_input(schid, q->mask, fc);
+ 	if (cc)
+ 		DBF_ERROR("%4x SIGA-R:%2d", SCH_NO(q), cc);
+ 	return cc;
+diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
+index 8fd8c62..a1ba52a 100644
+--- a/drivers/s390/crypto/ap_bus.c
++++ b/drivers/s390/crypto/ap_bus.c
+@@ -154,7 +154,7 @@ static inline int ap_instructions_available(void)
+  */
+ static int ap_interrupts_available(void)
+ {
+-	return test_facility(1) && test_facility(2);
++	return test_facility(2) && test_facility(65);
+ }
+ 
+ /**
+diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
+index 29251fa..812d32c 100644
+--- a/drivers/scsi/libsas/sas_scsi_host.c
++++ b/drivers/scsi/libsas/sas_scsi_host.c
+@@ -647,6 +647,7 @@ void sas_scsi_recover_host(struct Scsi_Host *shost)
+ 
+ 	spin_lock_irqsave(shost->host_lock, flags);
+ 	list_splice_init(&shost->eh_cmd_q, &eh_work_q);
++	shost->host_eh_scheduled = 0;
+ 	spin_unlock_irqrestore(shost->host_lock, flags);
+ 
+ 	SAS_DPRINTK("Enter %s\n", __func__);
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
+index 12faf64..7227227 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -2057,9 +2057,9 @@ _base_allocate_memory_pools(struct MPT2SAS_ADAPTER *ioc,  int sleep_flag)
+ 		/* adjust hba_queue_depth, reply_free_queue_depth,
+ 		 * and queue_size
+ 		 */
+-		ioc->hba_queue_depth -= queue_diff;
+-		ioc->reply_free_queue_depth -= queue_diff;
+-		queue_size -= queue_diff;
++		ioc->hba_queue_depth -= (queue_diff / 2);
++		ioc->reply_free_queue_depth -= (queue_diff / 2);
++		queue_size = facts->MaxReplyDescriptorPostQueueDepth;
+ 	}
+ 	ioc->reply_post_queue_depth = queue_size;
+ 
+@@ -3662,6 +3662,11 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
+ 	ioc->scsih_cmds.status = MPT2_CMD_NOT_USED;
+ 	mutex_init(&ioc->scsih_cmds.mutex);
+ 
++	/* scsih internal command bits */
++	ioc->scsih_cmds.reply = kzalloc(ioc->reply_sz, GFP_KERNEL);
++	ioc->scsih_cmds.status = MPT2_CMD_NOT_USED;
++	mutex_init(&ioc->scsih_cmds.mutex);
++
+ 	/* task management internal command bits */
+ 	ioc->tm_cmds.reply = kzalloc(ioc->reply_sz, GFP_KERNEL);
+ 	ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
+@@ -3786,6 +3791,8 @@ mpt2sas_base_detach(struct MPT2SAS_ADAPTER *ioc)
+ static void
+ _base_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
+ {
++	mpt2sas_scsih_reset_handler(ioc, reset_phase);
++	mpt2sas_ctl_reset_handler(ioc, reset_phase);
+ 	switch (reset_phase) {
+ 	case MPT2_IOC_PRE_RESET:
+ 		dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: "
+@@ -3816,8 +3823,6 @@ _base_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
+ 		    "MPT2_IOC_DONE_RESET\n", ioc->name, __func__));
+ 		break;
+ 	}
+-	mpt2sas_scsih_reset_handler(ioc, reset_phase);
+-	mpt2sas_ctl_reset_handler(ioc, reset_phase);
+ }
+ 
+ /**
+@@ -3871,6 +3876,7 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
+ {
+ 	int r;
+ 	unsigned long flags;
++	u8 pe_complete = ioc->wait_for_port_enable_to_complete;
+ 
+ 	dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter\n", ioc->name,
+ 	    __func__));
+@@ -3913,6 +3919,14 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
+ 	if (r)
+ 		goto out;
+ 	_base_reset_handler(ioc, MPT2_IOC_AFTER_RESET);
++
++	/* If this hard reset is called while port enable is active, then
++	 * there is no reason to call make_ioc_operational
++	 */
++	if (pe_complete) {
++		r = -EFAULT;
++		goto out;
++	}
+ 	r = _base_make_ioc_operational(ioc, sleep_flag);
+ 	if (!r)
+ 		_base_reset_handler(ioc, MPT2_IOC_DONE_RESET);
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+index 1a96a00..90bc21e 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -819,7 +819,7 @@ _scsih_is_end_device(u32 device_info)
+ }
+ 
+ /**
+- * mptscsih_get_scsi_lookup - returns scmd entry
++ * _scsih_scsi_lookup_get - returns scmd entry
+  * @ioc: per adapter object
+  * @smid: system request message index
+  *
+@@ -832,6 +832,28 @@ _scsih_scsi_lookup_get(struct MPT2SAS_ADAPTER *ioc, u16 smid)
+ }
+ 
+ /**
++ * _scsih_scsi_lookup_get_clear - returns scmd entry
++ * @ioc: per adapter object
++ * @smid: system request message index
++ *
++ * Returns the smid stored scmd pointer.
++ * Then will derefrence the stored scmd pointer.
++ */
++static inline struct scsi_cmnd *
++_scsih_scsi_lookup_get_clear(struct MPT2SAS_ADAPTER *ioc, u16 smid)
++{
++	unsigned long flags;
++	struct scsi_cmnd *scmd;
++
++	spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
++	scmd = ioc->scsi_lookup[smid - 1].scmd;
++	ioc->scsi_lookup[smid - 1].scmd = NULL;
++	spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
++
++	return scmd;
++}
++
++/**
+  * _scsih_scsi_lookup_find_by_scmd - scmd lookup
+  * @ioc: per adapter object
+  * @smid: system request message index
+@@ -2957,9 +2979,6 @@ _scsih_check_topo_delete_events(struct MPT2SAS_ADAPTER *ioc,
+ 	u16 handle;
+ 
+ 	for (i = 0 ; i < event_data->NumEntries; i++) {
+-		if (event_data->PHY[i].PhyStatus &
+-		    MPI2_EVENT_SAS_TOPO_PHYSTATUS_VACANT)
+-			continue;
+ 		handle = le16_to_cpu(event_data->PHY[i].AttachedDevHandle);
+ 		if (!handle)
+ 			continue;
+@@ -3186,7 +3205,7 @@ _scsih_flush_running_cmds(struct MPT2SAS_ADAPTER *ioc)
+ 	u16 count = 0;
+ 
+ 	for (smid = 1; smid <= ioc->scsiio_depth; smid++) {
+-		scmd = _scsih_scsi_lookup_get(ioc, smid);
++		scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
+ 		if (!scmd)
+ 			continue;
+ 		count++;
+@@ -3780,7 +3799,7 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply)
+ 	u32 response_code = 0;
+ 
+ 	mpi_reply = mpt2sas_base_get_reply_virt_addr(ioc, reply);
+-	scmd = _scsih_scsi_lookup_get(ioc, smid);
++	scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
+ 	if (scmd == NULL)
+ 		return 1;
+ 
+@@ -4942,6 +4961,12 @@ _scsih_sas_device_status_change_event(struct MPT2SAS_ADAPTER *ioc,
+ 		     event_data);
+ #endif
+ 
++	/* In MPI Revision K (0xC), the internal device reset complete was
++	 * implemented, so avoid setting tm_busy flag for older firmware.
++	 */
++	if ((ioc->facts.HeaderVersion >> 8) < 0xC)
++		return;
++
+ 	if (event_data->ReasonCode !=
+ 	    MPI2_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET &&
+ 	   event_data->ReasonCode !=
+@@ -5036,6 +5061,7 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
+     struct fw_event_work *fw_event)
+ {
+ 	struct scsi_cmnd *scmd;
++	struct scsi_device *sdev;
+ 	u16 smid, handle;
+ 	u32 lun;
+ 	struct MPT2SAS_DEVICE *sas_device_priv_data;
+@@ -5046,12 +5072,17 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
+ 	Mpi2EventDataSasBroadcastPrimitive_t *event_data = fw_event->event_data;
+ #endif
+ 	u16 ioc_status;
++	unsigned long flags;
++	int r;
++
+ 	dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "broadcast primative: "
+ 	    "phy number(%d), width(%d)\n", ioc->name, event_data->PhyNum,
+ 	    event_data->PortWidth));
+ 	dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter\n", ioc->name,
+ 	    __func__));
+ 
++	spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
++	ioc->broadcast_aen_busy = 0;
+ 	termination_count = 0;
+ 	query_count = 0;
+ 	mpi_reply = ioc->tm_cmds.reply;
+@@ -5059,7 +5090,8 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
+ 		scmd = _scsih_scsi_lookup_get(ioc, smid);
+ 		if (!scmd)
+ 			continue;
+-		sas_device_priv_data = scmd->device->hostdata;
++		sdev = scmd->device;
++		sas_device_priv_data = sdev->hostdata;
+ 		if (!sas_device_priv_data || !sas_device_priv_data->sas_target)
+ 			continue;
+ 		 /* skip hidden raid components */
+@@ -5075,6 +5107,7 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
+ 		lun = sas_device_priv_data->lun;
+ 		query_count++;
+ 
++		spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
+ 		mpt2sas_scsih_issue_tm(ioc, handle, 0, 0, lun,
+ 		    MPI2_SCSITASKMGMT_TASKTYPE_QUERY_TASK, smid, 30, NULL);
+ 		ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
+@@ -5084,14 +5117,20 @@ _scsih_sas_broadcast_primative_event(struct MPT2SAS_ADAPTER *ioc,
+ 		    (mpi_reply->ResponseCode ==
+ 		     MPI2_SCSITASKMGMT_RSP_TM_SUCCEEDED ||
+ 		     mpi_reply->ResponseCode ==
+-		     MPI2_SCSITASKMGMT_RSP_IO_QUEUED_ON_IOC))
++		     MPI2_SCSITASKMGMT_RSP_IO_QUEUED_ON_IOC)) {
++			spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+ 			continue;
+-
+-		mpt2sas_scsih_issue_tm(ioc, handle, 0, 0, lun,
+-		    MPI2_SCSITASKMGMT_TASKTYPE_ABRT_TASK_SET, 0, 30, NULL);
++		}
++		r = mpt2sas_scsih_issue_tm(ioc, handle, sdev->channel, sdev->id,
++		    sdev->lun, MPI2_SCSITASKMGMT_TASKTYPE_ABORT_TASK, smid, 30,
++		    scmd);
++		if (r == FAILED)
++			sdev_printk(KERN_WARNING, sdev, "task abort: FAILED "
++			    "scmd(%p)\n", scmd);
+ 		termination_count += le32_to_cpu(mpi_reply->TerminationCount);
++		spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+ 	}
+-	ioc->broadcast_aen_busy = 0;
++	spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
+ 
+ 	dtmprintk(ioc, printk(MPT2SAS_INFO_FMT
+ 	    "%s - exit, query_count = %d termination_count = %d\n",
+@@ -6687,6 +6726,7 @@ _scsih_remove(struct pci_dev *pdev)
+ 		destroy_workqueue(wq);
+ 
+ 	/* release all the volumes */
++	_scsih_ir_shutdown(ioc);
+ 	list_for_each_entry_safe(raid_device, next, &ioc->raid_device_list,
+ 	    list) {
+ 		if (raid_device->starget) {
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 9564961..9c9e6d3 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1175,6 +1175,12 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ 	u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
+ 	u64 bad_lba;
+ 	int info_valid;
++	/*
++	 * resid is optional but mostly filled in.  When it's unused,
++	 * its value is zero, so we assume the whole buffer transferred
++	 */
++	unsigned int transferred = scsi_bufflen(scmd) - scsi_get_resid(scmd);
++	unsigned int good_bytes;
+ 
+ 	if (scmd->request->cmd_type != REQ_TYPE_FS)
+ 		return 0;
+@@ -1208,7 +1214,8 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ 	/* This computation should always be done in terms of
+ 	 * the resolution of the device's medium.
+ 	 */
+-	return (bad_lba - start_lba) * scmd->device->sector_size;
++	good_bytes = (bad_lba - start_lba) * scmd->device->sector_size;
++	return min(good_bytes, transferred);
+ }
+ 
+ /**
+diff --git a/drivers/serial/68360serial.c b/drivers/serial/68360serial.c
+index 88b1335..bc21eea 100644
+--- a/drivers/serial/68360serial.c
++++ b/drivers/serial/68360serial.c
+@@ -2428,6 +2428,7 @@ static const struct tty_operations rs_360_ops = {
+ 	/* .read_proc = rs_360_read_proc, */
+ 	.tiocmget = rs_360_tiocmget,
+ 	.tiocmset = rs_360_tiocmset,
++	.get_icount = rs_360_get_icount,
+ };
+ 
+ static int __init rs_360_init(void)
+diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
+index 09a5508..b2b40f91 100644
+--- a/drivers/serial/8250.c
++++ b/drivers/serial/8250.c
+@@ -236,7 +236,8 @@ static const struct serial8250_config uart_config[] = {
+ 		.fifo_size	= 128,
+ 		.tx_loadsz	= 128,
+ 		.fcr		= UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
+-		.flags		= UART_CAP_FIFO | UART_CAP_EFR | UART_CAP_SLEEP,
++		/* UART_CAP_EFR breaks billionon CF bluetooth card. */
++		.flags		= UART_CAP_FIFO | UART_CAP_SLEEP,
+ 	},
+ 	[PORT_16654] = {
+ 		.name		= "ST16654",
+diff --git a/drivers/ssb/pcmcia.c b/drivers/ssb/pcmcia.c
+index c7345db..f853379 100644
+--- a/drivers/ssb/pcmcia.c
++++ b/drivers/ssb/pcmcia.c
+@@ -733,7 +733,7 @@ int ssb_pcmcia_get_invariants(struct ssb_bus *bus,
+ 
+ 	/* Fetch the vendor specific tuples. */
+ 	res = pcmcia_loop_tuple(bus->host_pcmcia, SSB_PCMCIA_CIS,
+-				ssb_pcmcia_do_get_invariants, sprom);
++				ssb_pcmcia_do_get_invariants, iv);
+ 	if ((res == 0) || (res == -ENOSPC))
+ 		return 0;
+ 
+diff --git a/drivers/staging/bcm/InterfaceInit.c b/drivers/staging/bcm/InterfaceInit.c
+index 824f9a4..dc760ef 100644
+--- a/drivers/staging/bcm/InterfaceInit.c
++++ b/drivers/staging/bcm/InterfaceInit.c
+@@ -4,6 +4,7 @@ static struct usb_device_id InterfaceUsbtable[] = {
+     { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3) },
+ 	{ USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3B) },
+ 	{ USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3L) },
++	{ USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_SM250) },
+     	{ USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_226) },
+ 	{ USB_DEVICE(BCM_USB_VENDOR_ID_FOXCONN, BCM_USB_PRODUCT_ID_1901) },
+     {}
+diff --git a/drivers/staging/bcm/InterfaceInit.h b/drivers/staging/bcm/InterfaceInit.h
+index e7a96e5..6c21625 100644
+--- a/drivers/staging/bcm/InterfaceInit.h
++++ b/drivers/staging/bcm/InterfaceInit.h
+@@ -8,6 +8,7 @@
+ #define BCM_USB_PRODUCT_ID_T3 	0x0300
+ #define BCM_USB_PRODUCT_ID_T3B 	0x0210
+ #define BCM_USB_PRODUCT_ID_T3L 	0x0220
++#define BCM_USB_PRODUCT_ID_SM250 	0xbccd
+ #define BCM_USB_PRODUCT_ID_SYM  0x15E
+ #define BCM_USB_PRODUCT_ID_1901 0xe017
+ #define BCM_USB_PRODUCT_ID_226  0x0132
+diff --git a/drivers/staging/brcm80211/sys/wl_mac80211.c b/drivers/staging/brcm80211/sys/wl_mac80211.c
+index d060377..cb2041a 100644
+--- a/drivers/staging/brcm80211/sys/wl_mac80211.c
++++ b/drivers/staging/brcm80211/sys/wl_mac80211.c
+@@ -299,11 +299,8 @@ static void wl_ops_stop(struct ieee80211_hw *hw)
+ 	wl_info_t *wl = hw->priv;
+ 	ASSERT(wl);
+ 	WL_LOCK(wl);
+-	wl_down(wl);
+ 	ieee80211_stop_queues(hw);
+ 	WL_UNLOCK(wl);
+-
+-	return;
+ }
+ 
+ static int
+@@ -336,7 +333,14 @@ wl_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ static void
+ wl_ops_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ {
+-	return;
++	struct wl_info *wl;
++
++	wl = HW_TO_WL(hw);
++
++	/* put driver in down state */
++	WL_LOCK(wl);
++	wl_down(wl);
++	WL_UNLOCK(wl);
+ }
+ 
+ static int
+@@ -972,7 +976,7 @@ static wl_info_t *wl_attach(u16 vendor, u16 device, unsigned long regs,
+ 	wl_found++;
+ 	return wl;
+ 
+- fail:
++fail:
+ 	wl_free(wl);
+ fail1:
+ 	return NULL;
+@@ -1356,7 +1360,6 @@ wl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	return 0;
+ }
+ 
+-#ifdef LINUXSTA_PS
+ static int wl_suspend(struct pci_dev *pdev, pm_message_t state)
+ {
+ 	wl_info_t *wl;
+@@ -1371,11 +1374,12 @@ static int wl_suspend(struct pci_dev *pdev, pm_message_t state)
+ 		return -ENODEV;
+ 	}
+ 
++	/* only need to flag hw is down for proper resume */
+ 	WL_LOCK(wl);
+-	wl_down(wl);
+ 	wl->pub->hw_up = false;
+ 	WL_UNLOCK(wl);
+-	pci_save_state(pdev, wl->pci_psstate);
++
++	pci_save_state(pdev);
+ 	pci_disable_device(pdev);
+ 	return pci_set_power_state(pdev, PCI_D3hot);
+ }
+@@ -1399,7 +1403,7 @@ static int wl_resume(struct pci_dev *pdev)
+ 	if (err)
+ 		return err;
+ 
+-	pci_restore_state(pdev, wl->pci_psstate);
++	pci_restore_state(pdev);
+ 
+ 	err = pci_enable_device(pdev);
+ 	if (err)
+@@ -1411,13 +1415,12 @@ static int wl_resume(struct pci_dev *pdev)
+ 	if ((val & 0x0000ff00) != 0)
+ 		pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
+ 
+-	WL_LOCK(wl);
+-	err = wl_up(wl);
+-	WL_UNLOCK(wl);
+-
++	/*
++	*  done. driver will be put in up state
++	*  in wl_ops_add_interface() call.
++	*/
+ 	return err;
+ }
+-#endif				/* LINUXSTA_PS */
+ 
+ static void wl_remove(struct pci_dev *pdev)
+ {
+@@ -1450,14 +1453,12 @@ static void wl_remove(struct pci_dev *pdev)
+ }
+ 
+ static struct pci_driver wl_pci_driver = {
+- .name  = "brcm80211",
+- .probe = wl_pci_probe,
+-#ifdef LINUXSTA_PS
+- .suspend = wl_suspend,
+- .resume  = wl_resume,
+-#endif				/* LINUXSTA_PS */
+- .remove   = __devexit_p(wl_remove),
+- .id_table = wl_id_table,
++	.name = "brcm80211",
++	.probe = wl_pci_probe,
++	.suspend = wl_suspend,
++	.resume = wl_resume,
++	.remove = __devexit_p(wl_remove),
++	.id_table = wl_id_table,
+ };
+ #endif				/* !BCMSDIO */
+ 
+diff --git a/drivers/staging/comedi/drivers/jr3_pci.c b/drivers/staging/comedi/drivers/jr3_pci.c
+index 8b383ee..5c6c727 100644
+--- a/drivers/staging/comedi/drivers/jr3_pci.c
++++ b/drivers/staging/comedi/drivers/jr3_pci.c
+@@ -54,6 +54,7 @@ Devices: [JR3] PCI force sensor board (jr3_pci)
+ 
+ #define PCI_VENDOR_ID_JR3 0x1762
+ #define PCI_DEVICE_ID_JR3_1_CHANNEL 0x3111
++#define PCI_DEVICE_ID_JR3_1_CHANNEL_NEW 0x1111
+ #define PCI_DEVICE_ID_JR3_2_CHANNEL 0x3112
+ #define PCI_DEVICE_ID_JR3_3_CHANNEL 0x3113
+ #define PCI_DEVICE_ID_JR3_4_CHANNEL 0x3114
+@@ -73,6 +74,8 @@ static DEFINE_PCI_DEVICE_TABLE(jr3_pci_pci_table) = {
+ 	{
+ 	PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_1_CHANNEL,
+ 		    PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, {
++	PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_1_CHANNEL_NEW,
++		    PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, {
+ 	PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_2_CHANNEL,
+ 		    PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, {
+ 	PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_3_CHANNEL,
+@@ -807,6 +810,10 @@ static int jr3_pci_attach(struct comedi_device *dev,
+ 					devpriv->n_channels = 1;
+ 				}
+ 				break;
++			case PCI_DEVICE_ID_JR3_1_CHANNEL_NEW:{
++					devpriv->n_channels = 1;
++				}
++				break;
+ 			case PCI_DEVICE_ID_JR3_2_CHANNEL:{
+ 					devpriv->n_channels = 2;
+ 				}
+diff --git a/drivers/staging/comedi/drivers/ni_labpc.c b/drivers/staging/comedi/drivers/ni_labpc.c
+index 4d1868d..0728c3c 100644
+--- a/drivers/staging/comedi/drivers/ni_labpc.c
++++ b/drivers/staging/comedi/drivers/ni_labpc.c
+@@ -575,7 +575,8 @@ int labpc_common_attach(struct comedi_device *dev, unsigned long iobase,
+ 	/* grab our IRQ */
+ 	if (irq) {
+ 		isr_flags = 0;
+-		if (thisboard->bustype == pci_bustype)
++		if (thisboard->bustype == pci_bustype
++		    || thisboard->bustype == pcmcia_bustype)
+ 			isr_flags |= IRQF_SHARED;
+ 		if (request_irq(irq, labpc_interrupt, isr_flags,
+ 				driver_labpc.driver_name, dev)) {
+diff --git a/drivers/staging/hv/blkvsc_drv.c b/drivers/staging/hv/blkvsc_drv.c
+index 3f81ca5..b255c8b 100644
+--- a/drivers/staging/hv/blkvsc_drv.c
++++ b/drivers/staging/hv/blkvsc_drv.c
+@@ -368,6 +368,7 @@ static int blkvsc_probe(struct device *device)
+ 		blkdev->gd->first_minor = 0;
+ 	blkdev->gd->fops = &block_ops;
+ 	blkdev->gd->private_data = blkdev;
++	blkdev->gd->driverfs_dev = &(blkdev->device_ctx->device);
+ 	sprintf(blkdev->gd->disk_name, "hd%c", 'a' + devnum);
+ 
+ 	blkvsc_do_inquiry(blkdev);
+diff --git a/drivers/staging/hv/netvsc.c b/drivers/staging/hv/netvsc.c
+index 4c2632c..d7dcc66 100644
+--- a/drivers/staging/hv/netvsc.c
++++ b/drivers/staging/hv/netvsc.c
+@@ -1236,7 +1236,7 @@ static void NetVscOnChannelCallback(void *Context)
+ 	/* ASSERT(device); */
+ 
+ 	packet = kzalloc(NETVSC_PACKET_SIZE * sizeof(unsigned char),
+-			 GFP_KERNEL);
++			 GFP_ATOMIC);
+ 	if (!packet)
+ 		return;
+ 	buffer = packet;
+diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
+index 1415352..cb79dff 100644
+--- a/drivers/staging/hv/netvsc_drv.c
++++ b/drivers/staging/hv/netvsc_drv.c
+@@ -233,6 +233,7 @@ static void netvsc_linkstatus_callback(struct hv_device *device_obj,
+ 	if (status == 1) {
+ 		netif_carrier_on(net);
+ 		netif_wake_queue(net);
++		netif_notify_peers(net);
+ 	} else {
+ 		netif_carrier_off(net);
+ 		netif_stop_queue(net);
+@@ -355,7 +356,6 @@ static int netvsc_probe(struct device *device)
+ 
+ 	/* Set initial state */
+ 	netif_carrier_off(net);
+-	netif_stop_queue(net);
+ 
+ 	net_device_ctx = netdev_priv(net);
+ 	net_device_ctx->device_ctx = device_ctx;
+diff --git a/drivers/staging/iio/adc/ad7476_core.c b/drivers/staging/iio/adc/ad7476_core.c
+index deb68c8..b8b54da 100644
+--- a/drivers/staging/iio/adc/ad7476_core.c
++++ b/drivers/staging/iio/adc/ad7476_core.c
+@@ -68,7 +68,7 @@ static ssize_t ad7476_show_scale(struct device *dev,
+ 	/* Corresponds to Vref / 2^(bits) */
+ 	unsigned int scale_uv = (st->int_vref_mv * 1000) >> st->chip_info->bits;
+ 
+-	return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
++	return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
+ }
+ static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad7476_show_scale, NULL, 0);
+ 
+diff --git a/drivers/staging/iio/adc/ad799x_core.c b/drivers/staging/iio/adc/ad799x_core.c
+index 6309d52..89ccf37 100644
+--- a/drivers/staging/iio/adc/ad799x_core.c
++++ b/drivers/staging/iio/adc/ad799x_core.c
+@@ -432,7 +432,7 @@ static ssize_t ad799x_show_scale(struct device *dev,
+ 	/* Corresponds to Vref / 2^(bits) */
+ 	unsigned int scale_uv = (st->int_vref_mv * 1000) >> st->chip_info->bits;
+ 
+-	return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
++	return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
+ }
+ 
+ static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad799x_show_scale, NULL, 0);
+diff --git a/drivers/staging/rt2860/chips/rt3090.c b/drivers/staging/rt2860/chips/rt3090.c
+index c2933c6..cbc59f8 100644
+--- a/drivers/staging/rt2860/chips/rt3090.c
++++ b/drivers/staging/rt2860/chips/rt3090.c
+@@ -51,7 +51,8 @@ void NICInitRT3090RFRegisters(struct rt_rtmp_adapter *pAd)
+ 	if (IS_RT3090(pAd)) {
+ 		/* Init RF calibration */
+ 		/* Driver should toggle RF R30 bit7 before init RF registers */
+-		u32 RfReg = 0, data;
++		u8 RfReg;
++		u32 data;
+ 
+ 		RT30xxReadRFRegister(pAd, RF_R30, (u8 *)&RfReg);
+ 		RfReg |= 0x80;
+diff --git a/drivers/staging/rt2860/chips/rt30xx.c b/drivers/staging/rt2860/chips/rt30xx.c
+index 4367a19..88eba51 100644
+--- a/drivers/staging/rt2860/chips/rt30xx.c
++++ b/drivers/staging/rt2860/chips/rt30xx.c
+@@ -53,7 +53,7 @@ struct rt_reg_pair RT30xx_RFRegTable[] = {
+ 	,
+ 	{RF_R06, 0x02}
+ 	,
+-	{RF_R07, 0x70}
++	{RF_R07, 0x60}
+ 	,
+ 	{RF_R09, 0x0F}
+ 	,
+@@ -441,7 +441,7 @@ void RT30xxReverseRFSleepModeSetup(struct rt_rtmp_adapter *pAd)
+ 
+ 		/* VCO_IC, RF R7 register Bit 4 & Bit 5 to 1 */
+ 		RT30xxReadRFRegister(pAd, RF_R07, &RFValue);
+-		RFValue |= 0x30;
++		RFValue |= 0x20;
+ 		RT30xxWriteRFRegister(pAd, RF_R07, RFValue);
+ 
+ 		/* Idoh, RF R9 register Bit 1, Bit 2 & Bit 3 to 1 */
+diff --git a/drivers/staging/rt2860/rt_main_dev.c b/drivers/staging/rt2860/rt_main_dev.c
+index ad60cea..caf8b76 100644
+--- a/drivers/staging/rt2860/rt_main_dev.c
++++ b/drivers/staging/rt2860/rt_main_dev.c
+@@ -483,8 +483,6 @@ struct net_device *RtmpPhyNetDevInit(struct rt_rtmp_adapter *pAd,
+ 	net_dev->ml_priv = (void *)pAd;
+ 	pAd->net_dev = net_dev;
+ 
+-	netif_stop_queue(net_dev);
+-
+ 	return net_dev;
+ 
+ }
+diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
+index cd15daa..aca0c46 100644
+--- a/drivers/staging/rt2860/usb_main_dev.c
++++ b/drivers/staging/rt2860/usb_main_dev.c
+@@ -106,6 +106,7 @@ struct usb_device_id rtusb_usb_id[] = {
+ 	{USB_DEVICE(0x0411, 0x016f)},	/* MelCo.,Inc. WLI-UC-G301N */
+ 	{USB_DEVICE(0x1737, 0x0070)},	/* Linksys WUSB100 */
+ 	{USB_DEVICE(0x1737, 0x0071)},	/* Linksys WUSB600N */
++	{USB_DEVICE(0x1737, 0x0078)},	/* Linksys WUSB100v2 */
+ 	{USB_DEVICE(0x0411, 0x00e8)},	/* Buffalo WLI-UC-G300N */
+ 	{USB_DEVICE(0x050d, 0x815c)},	/* Belkin F5D8053 */
+ 	{USB_DEVICE(0x100D, 0x9031)},	/* Motorola 2770 */
+diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
+index f1f0c63..e2b2cd9 100644
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -47,54 +47,123 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
+ static void r871xu_dev_remove(struct usb_interface *pusb_intf);
+ 
+ static struct usb_device_id rtl871x_usb_id_tbl[] = {
+-	/*92SU
+-	 * Realtek */
+-	{USB_DEVICE(0x0bda, 0x8171)},
+-	{USB_DEVICE(0x0bda, 0x8172)},
++
++/* RTL8188SU */
++	/* Realtek */
++	{USB_DEVICE(0x0BDA, 0x8171)},
+ 	{USB_DEVICE(0x0bda, 0x8173)},
+-	{USB_DEVICE(0x0bda, 0x8174)},
+ 	{USB_DEVICE(0x0bda, 0x8712)},
+ 	{USB_DEVICE(0x0bda, 0x8713)},
+ 	{USB_DEVICE(0x0bda, 0xC512)},
+-	/* Abocom  */
++	/* Abocom */
+ 	{USB_DEVICE(0x07B8, 0x8188)},
++	/* ASUS */
++	{USB_DEVICE(0x0B05, 0x1786)},
++	{USB_DEVICE(0x0B05, 0x1791)}, /* 11n mode disable */
++	/* Belkin */
++	{USB_DEVICE(0x050D, 0x945A)},
+ 	/* Corega */
+-	{USB_DEVICE(0x07aa, 0x0047)},
+-	/* Dlink */
+-	{USB_DEVICE(0x07d1, 0x3303)},
+-	{USB_DEVICE(0x07d1, 0x3302)},
+-	{USB_DEVICE(0x07d1, 0x3300)},
+-	/* Dlink for Skyworth */
+-	{USB_DEVICE(0x14b2, 0x3300)},
+-	{USB_DEVICE(0x14b2, 0x3301)},
+-	{USB_DEVICE(0x14b2, 0x3302)},
++	{USB_DEVICE(0x07AA, 0x0047)},
++	/* D-Link */
++	{USB_DEVICE(0x2001, 0x3306)},
++	{USB_DEVICE(0x07D1, 0x3306)}, /* 11n mode disable */
++	/* Edimax */
++	{USB_DEVICE(0x7392, 0x7611)},
+ 	/* EnGenius */
+ 	{USB_DEVICE(0x1740, 0x9603)},
+-	{USB_DEVICE(0x1740, 0x9605)},
++	/* Hawking */
++	{USB_DEVICE(0x0E66, 0x0016)},
++	/* Hercules */
++	{USB_DEVICE(0x06F8, 0xE034)},
++	{USB_DEVICE(0x06F8, 0xE032)},
++	/* Logitec */
++	{USB_DEVICE(0x0789, 0x0167)},
++	/* PCI */
++	{USB_DEVICE(0x2019, 0xAB28)},
++	{USB_DEVICE(0x2019, 0xED16)},
++	/* Sitecom */
++	{USB_DEVICE(0x0DF6, 0x0057)},
++	{USB_DEVICE(0x0DF6, 0x0045)},
++	{USB_DEVICE(0x0DF6, 0x0059)}, /* 11n mode disable */
++	{USB_DEVICE(0x0DF6, 0x004B)},
++	{USB_DEVICE(0x0DF6, 0x0063)},
++	/* Sweex */
++	{USB_DEVICE(0x177F, 0x0154)},
++	/* Thinkware */
++	{USB_DEVICE(0x0BDA, 0x5077)},
++	/* Toshiba */
++	{USB_DEVICE(0x1690, 0x0752)},
++	/* - */
++	{USB_DEVICE(0x20F4, 0x646B)},
++	{USB_DEVICE(0x083A, 0xC512)},
++
++/* RTL8191SU */
++	/* Realtek */
++	{USB_DEVICE(0x0BDA, 0x8172)},
++	/* Amigo */
++	{USB_DEVICE(0x0EB0, 0x9061)},
++	/* ASUS/EKB */
++	{USB_DEVICE(0x0BDA, 0x8172)},
++	{USB_DEVICE(0x13D3, 0x3323)},
++	{USB_DEVICE(0x13D3, 0x3311)}, /* 11n mode disable */
++	{USB_DEVICE(0x13D3, 0x3342)},
++	/* ASUS/EKBLenovo */
++	{USB_DEVICE(0x13D3, 0x3333)},
++	{USB_DEVICE(0x13D3, 0x3334)},
++	{USB_DEVICE(0x13D3, 0x3335)}, /* 11n mode disable */
++	{USB_DEVICE(0x13D3, 0x3336)}, /* 11n mode disable */
++	/* ASUS/Media BOX */
++	{USB_DEVICE(0x13D3, 0x3309)},
+ 	/* Belkin */
+-	{USB_DEVICE(0x050d, 0x815F)},
+-	{USB_DEVICE(0x050d, 0x945A)},
+-	{USB_DEVICE(0x050d, 0x845A)},
+-	/* Guillemot */
+-	{USB_DEVICE(0x06f8, 0xe031)},
++	{USB_DEVICE(0x050D, 0x815F)},
++	/* D-Link */
++	{USB_DEVICE(0x07D1, 0x3302)},
++	{USB_DEVICE(0x07D1, 0x3300)},
++	{USB_DEVICE(0x07D1, 0x3303)},
+ 	/* Edimax */
+-	{USB_DEVICE(0x7392, 0x7611)},
+ 	{USB_DEVICE(0x7392, 0x7612)},
+-	{USB_DEVICE(0x7392, 0x7622)},
+-	/* Sitecom */
+-	{USB_DEVICE(0x0DF6, 0x0045)},
++	/* EnGenius */
++	{USB_DEVICE(0x1740, 0x9605)},
++	/* Guillemot */
++	{USB_DEVICE(0x06F8, 0xE031)},
+ 	/* Hawking */
+ 	{USB_DEVICE(0x0E66, 0x0015)},
+-	{USB_DEVICE(0x0E66, 0x0016)},
+-	{USB_DEVICE(0x0b05, 0x1786)},
+-	{USB_DEVICE(0x0b05, 0x1791)},    /* 11n mode disable */
+-
++	/* Mediao */
+ 	{USB_DEVICE(0x13D3, 0x3306)},
+-	{USB_DEVICE(0x13D3, 0x3309)},
++	/* PCI */
++	{USB_DEVICE(0x2019, 0xED18)},
++	{USB_DEVICE(0x2019, 0x4901)},
++	/* Sitecom */
++	{USB_DEVICE(0x0DF6, 0x0058)},
++	{USB_DEVICE(0x0DF6, 0x0049)},
++	{USB_DEVICE(0x0DF6, 0x004C)},
++	{USB_DEVICE(0x0DF6, 0x0064)},
++	/* Skyworth */
++	{USB_DEVICE(0x14b2, 0x3300)},
++	{USB_DEVICE(0x14b2, 0x3301)},
++	{USB_DEVICE(0x14B2, 0x3302)},
++	/* - */
++	{USB_DEVICE(0x04F2, 0xAFF2)},
++	{USB_DEVICE(0x04F2, 0xAFF5)},
++	{USB_DEVICE(0x04F2, 0xAFF6)},
++	{USB_DEVICE(0x13D3, 0x3339)},
++	{USB_DEVICE(0x13D3, 0x3340)}, /* 11n mode disable */
++	{USB_DEVICE(0x13D3, 0x3341)}, /* 11n mode disable */
+ 	{USB_DEVICE(0x13D3, 0x3310)},
+-	{USB_DEVICE(0x13D3, 0x3311)},    /* 11n mode disable */
+ 	{USB_DEVICE(0x13D3, 0x3325)},
+-	{USB_DEVICE(0x083A, 0xC512)},
++
++/* RTL8192SU */
++	/* Realtek */
++	{USB_DEVICE(0x0BDA, 0x8174)},
++	{USB_DEVICE(0x0BDA, 0x8174)},
++	/* Belkin */
++	{USB_DEVICE(0x050D, 0x845A)},
++	/* Corega */
++	{USB_DEVICE(0x07AA, 0x0051)},
++	/* Edimax */
++	{USB_DEVICE(0x7392, 0x7622)},
++	/* NEC */
++	{USB_DEVICE(0x0409, 0x02B6)},
+ 	{}
+ };
+ 
+@@ -103,8 +172,20 @@ MODULE_DEVICE_TABLE(usb, rtl871x_usb_id_tbl);
+ static struct specific_device_id specific_device_id_tbl[] = {
+ 	{.idVendor = 0x0b05, .idProduct = 0x1791,
+ 		 .flags = SPEC_DEV_ID_DISABLE_HT},
++	{.idVendor = 0x0df6, .idProduct = 0x0059,
++		 .flags = SPEC_DEV_ID_DISABLE_HT},
++	{.idVendor = 0x13d3, .idProduct = 0x3306,
++		 .flags = SPEC_DEV_ID_DISABLE_HT},
+ 	{.idVendor = 0x13D3, .idProduct = 0x3311,
+ 		 .flags = SPEC_DEV_ID_DISABLE_HT},
++	{.idVendor = 0x13d3, .idProduct = 0x3335,
++		 .flags = SPEC_DEV_ID_DISABLE_HT},
++	{.idVendor = 0x13d3, .idProduct = 0x3336,
++		 .flags = SPEC_DEV_ID_DISABLE_HT},
++	{.idVendor = 0x13d3, .idProduct = 0x3340,
++		 .flags = SPEC_DEV_ID_DISABLE_HT},
++	{.idVendor = 0x13d3, .idProduct = 0x3341,
++		 .flags = SPEC_DEV_ID_DISABLE_HT},
+ 	{}
+ };
+ 
+diff --git a/drivers/staging/speakup/kobjects.c b/drivers/staging/speakup/kobjects.c
+index cc79f9e..a082f8d 100644
+--- a/drivers/staging/speakup/kobjects.c
++++ b/drivers/staging/speakup/kobjects.c
+@@ -332,7 +332,7 @@ static ssize_t silent_store(struct kobject *kobj, struct kobj_attribute *attr,
+ 	unsigned long flags;
+ 
+ 	len = strlen(buf);
+-	if (len > 0 || len < 3) {
++	if (len > 0 && len < 3) {
+ 		ch = buf[0];
+ 		if (ch == '\n')
+ 			ch = '0';
+diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
+index 832608d..08bd26a 100644
+--- a/drivers/staging/usbip/vhci_hcd.c
++++ b/drivers/staging/usbip/vhci_hcd.c
+@@ -799,20 +799,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
+ 		spin_unlock_irqrestore(&vdev->priv_lock, flags2);
+ 	}
+ 
+-
+-	if (!vdev->ud.tcp_socket) {
+-		/* tcp connection is closed */
+-		usbip_uinfo("vhci_hcd: vhci_urb_dequeue() gives back urb %p\n",
+-									urb);
+-
+-		usb_hcd_unlink_urb_from_ep(hcd, urb);
+-
+-		spin_unlock_irqrestore(&the_controller->lock, flags);
+-		usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb,
+-								urb->status);
+-		spin_lock_irqsave(&the_controller->lock, flags);
+-	}
+-
+ 	spin_unlock_irqrestore(&the_controller->lock, flags);
+ 
+ 	usbip_dbg_vhci_hc("leave\n");
+diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
+index d0e9e02..080e85f 100644
+--- a/drivers/staging/zram/zram_drv.c
++++ b/drivers/staging/zram/zram_drv.c
+@@ -227,6 +227,7 @@ static int zram_read(struct zram *zram, struct bio *bio)
+ 
+ 		if (zram_test_flag(zram, index, ZRAM_ZERO)) {
+ 			handle_zero_page(page);
++			index++;
+ 			continue;
+ 		}
+ 
+@@ -235,12 +236,14 @@ static int zram_read(struct zram *zram, struct bio *bio)
+ 			pr_debug("Read before write: sector=%lu, size=%u",
+ 				(ulong)(bio->bi_sector), bio->bi_size);
+ 			/* Do nothing */
++			index++;
+ 			continue;
+ 		}
+ 
+ 		/* Page is stored uncompressed since it's incompressible */
+ 		if (unlikely(zram_test_flag(zram, index, ZRAM_UNCOMPRESSED))) {
+ 			handle_uncompressed_page(zram, page, index);
++			index++;
+ 			continue;
+ 		}
+ 
+@@ -320,6 +323,7 @@ static int zram_write(struct zram *zram, struct bio *bio)
+ 			mutex_unlock(&zram->lock);
+ 			zram_stat_inc(&zram->stats.pages_zero);
+ 			zram_set_flag(zram, index, ZRAM_ZERO);
++			index++;
+ 			continue;
+ 		}
+ 
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index c5f8e5b..dc74295 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -2375,6 +2375,7 @@ static int gsmld_config(struct tty_struct *tty, struct gsm_mux *gsm,
+ 
+ 	gsm->initiator = c->initiator;
+ 	gsm->mru = c->mru;
++	gsm->mtu = c->mtu;
+ 	gsm->encoding = c->encapsulation;
+ 	gsm->adaption = c->adaption;
+ 	gsm->n2 = c->n2;
+diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
+index c556ed9..81f1395 100644
+--- a/drivers/tty/sysrq.c
++++ b/drivers/tty/sysrq.c
+@@ -46,7 +46,7 @@
+ #include <asm/irq_regs.h>
+ 
+ /* Whether we react on sysrq keys or just ignore them */
+-static int __read_mostly sysrq_enabled = 1;
++static int __read_mostly sysrq_enabled = SYSRQ_DEFAULT_ENABLE;
+ static bool __read_mostly sysrq_always_enabled;
+ 
+ static bool sysrq_on(void)
+@@ -571,6 +571,7 @@ struct sysrq_state {
+ 	unsigned int alt_use;
+ 	bool active;
+ 	bool need_reinject;
++	bool reinjecting;
+ };
+ 
+ static void sysrq_reinject_alt_sysrq(struct work_struct *work)
+@@ -581,6 +582,10 @@ static void sysrq_reinject_alt_sysrq(struct work_struct *work)
+ 	unsigned int alt_code = sysrq->alt_use;
+ 
+ 	if (sysrq->need_reinject) {
++		/* we do not want the assignment to be reordered */
++		sysrq->reinjecting = true;
++		mb();
++
+ 		/* Simulate press and release of Alt + SysRq */
+ 		input_inject_event(handle, EV_KEY, alt_code, 1);
+ 		input_inject_event(handle, EV_KEY, KEY_SYSRQ, 1);
+@@ -589,6 +594,9 @@ static void sysrq_reinject_alt_sysrq(struct work_struct *work)
+ 		input_inject_event(handle, EV_KEY, KEY_SYSRQ, 0);
+ 		input_inject_event(handle, EV_KEY, alt_code, 0);
+ 		input_inject_event(handle, EV_SYN, SYN_REPORT, 1);
++
++		mb();
++		sysrq->reinjecting = false;
+ 	}
+ }
+ 
+@@ -599,6 +607,13 @@ static bool sysrq_filter(struct input_handle *handle,
+ 	bool was_active = sysrq->active;
+ 	bool suppress;
+ 
++	/*
++	 * Do not filter anything if we are in the process of re-injecting
++	 * Alt+SysRq combination.
++	 */
++	if (sysrq->reinjecting)
++		return false;
++
+ 	switch (type) {
+ 
+ 	case EV_SYN:
+@@ -629,7 +644,7 @@ static bool sysrq_filter(struct input_handle *handle,
+ 				sysrq->alt_use = sysrq->alt;
+ 				/*
+ 				 * If nothing else will be pressed we'll need
+-				 * to * re-inject Alt-SysRq keysroke.
++				 * to re-inject Alt-SysRq keysroke.
+ 				 */
+ 				sysrq->need_reinject = true;
+ 			}
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index d6ede98..4ab49d4 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1607,6 +1607,7 @@ static const struct usb_device_id acm_ids[] = {
+ 	{ NOKIA_PCSUITE_ACM_INFO(0x0154), }, /* Nokia 5800 XpressMusic */
+ 	{ NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */
+ 	{ NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */
++	{ NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */
+ 	{ SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */
+ 
+ 	/* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
+diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
+index 3799573..4de52dc 100644
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -406,7 +406,12 @@ static int suspend_common(struct device *dev, bool do_wakeup)
+ 			return retval;
+ 	}
+ 
+-	synchronize_irq(pci_dev->irq);
++	/* If MSI-X is enabled, the driver will have synchronized all vectors
++	 * in pci_suspend(). If MSI or legacy PCI is enabled, that will be
++	 * synchronized here.
++	 */
++	if (!hcd->msix_enabled)
++		synchronize_irq(pci_dev->irq);
+ 
+ 	/* Downstream ports from this root hub should already be quiesced, so
+ 	 * there will be no DMA activity.  Now we can shut down the upstream
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index ced846a..8aa6b51 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1956,7 +1956,6 @@ int hcd_bus_resume(struct usb_device *rhdev, pm_message_t msg)
+ 
+ 	dev_dbg(&rhdev->dev, "usb %s%s\n",
+ 			(msg.event & PM_EVENT_AUTO ? "auto-" : ""), "resume");
+-	clear_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags);
+ 	if (!hcd->driver->bus_resume)
+ 		return -ENOENT;
+ 	if (hcd->state == HC_STATE_RUNNING)
+@@ -1964,6 +1963,7 @@ int hcd_bus_resume(struct usb_device *rhdev, pm_message_t msg)
+ 
+ 	hcd->state = HC_STATE_RESUMING;
+ 	status = hcd->driver->bus_resume(hcd);
++	clear_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags);
+ 	if (status == 0) {
+ 		/* TRSMRCY = 10 msec */
+ 		msleep(10);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 27115b4..31edd87 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -677,6 +677,8 @@ static void hub_init_func3(struct work_struct *ws);
+ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ {
+ 	struct usb_device *hdev = hub->hdev;
++	struct usb_hcd *hcd;
++	int ret;
+ 	int port1;
+ 	int status;
+ 	bool need_debounce_delay = false;
+@@ -715,6 +717,25 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ 			usb_autopm_get_interface_no_resume(
+ 					to_usb_interface(hub->intfdev));
+ 			return;		/* Continues at init2: below */
++		} else if (type == HUB_RESET_RESUME) {
++			/* The internal host controller state for the hub device
++			 * may be gone after a host power loss on system resume.
++			 * Update the device's info so the HW knows it's a hub.
++			 */
++			hcd = bus_to_hcd(hdev->bus);
++			if (hcd->driver->update_hub_device) {
++				ret = hcd->driver->update_hub_device(hcd, hdev,
++						&hub->tt, GFP_NOIO);
++				if (ret < 0) {
++					dev_err(hub->intfdev, "Host not "
++							"accepting hub info "
++							"update.\n");
++					dev_err(hub->intfdev, "LS/FS devices "
++							"and hubs may not work "
++							"under this hub\n.");
++				}
++			}
++			hub_power_on(hub, true);
+ 		} else {
+ 			hub_power_on(hub, true);
+ 		}
+@@ -2723,6 +2744,11 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
+ 		udev->ttport = hdev->ttport;
+ 	} else if (udev->speed != USB_SPEED_HIGH
+ 			&& hdev->speed == USB_SPEED_HIGH) {
++		if (!hub->tt.hub) {
++			dev_err(&udev->dev, "parent hub has no TT\n");
++			retval = -EINVAL;
++			goto fail;
++		}
+ 		udev->tt = &hub->tt;
+ 		udev->ttport = port1;
+ 	}
+diff --git a/drivers/usb/gadget/printer.c b/drivers/usb/gadget/printer.c
+index 2fc8636..12ff6cf 100644
+--- a/drivers/usb/gadget/printer.c
++++ b/drivers/usb/gadget/printer.c
+@@ -131,31 +131,31 @@ static struct printer_dev usb_printer_gadget;
+  * parameters are in UTF-8 (superset of ASCII's 7 bit characters).
+  */
+ 
+-static ushort __initdata idVendor;
++static ushort idVendor;
+ module_param(idVendor, ushort, S_IRUGO);
+ MODULE_PARM_DESC(idVendor, "USB Vendor ID");
+ 
+-static ushort __initdata idProduct;
++static ushort idProduct;
+ module_param(idProduct, ushort, S_IRUGO);
+ MODULE_PARM_DESC(idProduct, "USB Product ID");
+ 
+-static ushort __initdata bcdDevice;
++static ushort bcdDevice;
+ module_param(bcdDevice, ushort, S_IRUGO);
+ MODULE_PARM_DESC(bcdDevice, "USB Device version (BCD)");
+ 
+-static char *__initdata iManufacturer;
++static char *iManufacturer;
+ module_param(iManufacturer, charp, S_IRUGO);
+ MODULE_PARM_DESC(iManufacturer, "USB Manufacturer string");
+ 
+-static char *__initdata iProduct;
++static char *iProduct;
+ module_param(iProduct, charp, S_IRUGO);
+ MODULE_PARM_DESC(iProduct, "USB Product string");
+ 
+-static char *__initdata iSerialNum;
++static char *iSerialNum;
+ module_param(iSerialNum, charp, S_IRUGO);
+ MODULE_PARM_DESC(iSerialNum, "1");
+ 
+-static char *__initdata iPNPstring;
++static char *iPNPstring;
+ module_param(iPNPstring, charp, S_IRUGO);
+ MODULE_PARM_DESC(iPNPstring, "MFG:linux;MDL:g_printer;CLS:PRINTER;SN:1;");
+ 
+@@ -1596,13 +1596,12 @@ cleanup(void)
+ 	int status;
+ 
+ 	mutex_lock(&usb_printer_gadget.lock_printer_io);
+-	class_destroy(usb_gadget_class);
+-	unregister_chrdev_region(g_printer_devno, 2);
+-
+ 	status = usb_gadget_unregister_driver(&printer_driver);
+ 	if (status)
+ 		ERROR(dev, "usb_gadget_unregister_driver %x\n", status);
+ 
++	unregister_chrdev_region(g_printer_devno, 2);
++	class_destroy(usb_gadget_class);
+ 	mutex_unlock(&usb_printer_gadget.lock_printer_io);
+ }
+ module_exit(cleanup);
+diff --git a/drivers/usb/host/ehci-au1xxx.c b/drivers/usb/host/ehci-au1xxx.c
+index 2baf8a8..a869e3c 100644
+--- a/drivers/usb/host/ehci-au1xxx.c
++++ b/drivers/usb/host/ehci-au1xxx.c
+@@ -227,8 +227,8 @@ static int ehci_hcd_au1xxx_drv_suspend(struct device *dev)
+ 	 * mark HW unaccessible.  The PM and USB cores make sure that
+ 	 * the root hub is either suspended or stopped.
+ 	 */
+-	spin_lock_irqsave(&ehci->lock, flags);
+ 	ehci_prepare_ports_for_controller_suspend(ehci, device_may_wakeup(dev));
++	spin_lock_irqsave(&ehci->lock, flags);
+ 	ehci_writel(ehci, 0, &ehci->regs->intr_enable);
+ 	(void)ehci_readl(ehci, &ehci->regs->intr_enable);
+ 
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index e906280..6716312 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -114,6 +114,9 @@ MODULE_PARM_DESC(hird, "host initiated resume duration, +1 for each 75us\n");
+ 
+ #define	INTR_MASK (STS_IAA | STS_FATAL | STS_PCD | STS_ERR | STS_INT)
+ 
++/* for ASPM quirk of ISOC on AMD SB800 */
++static struct pci_dev *amd_nb_dev;
++
+ /*-------------------------------------------------------------------------*/
+ 
+ #include "ehci.h"
+@@ -529,6 +532,11 @@ static void ehci_stop (struct usb_hcd *hcd)
+ 	spin_unlock_irq (&ehci->lock);
+ 	ehci_mem_cleanup (ehci);
+ 
++	if (amd_nb_dev) {
++		pci_dev_put(amd_nb_dev);
++		amd_nb_dev = NULL;
++	}
++
+ #ifdef	EHCI_STATS
+ 	ehci_dbg (ehci, "irq normal %ld err %ld reclaim %ld (lost %ld)\n",
+ 		ehci->stats.normal, ehci->stats.error, ehci->stats.reclaim,
+@@ -564,6 +572,8 @@ static int ehci_init(struct usb_hcd *hcd)
+ 	ehci->iaa_watchdog.function = ehci_iaa_watchdog;
+ 	ehci->iaa_watchdog.data = (unsigned long) ehci;
+ 
++	hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
++
+ 	/*
+ 	 * hw default: 1K periodic list heads, one per frame.
+ 	 * periodic_size can shrink by USBCMD update if hcc_params allows.
+@@ -571,11 +581,20 @@ static int ehci_init(struct usb_hcd *hcd)
+ 	ehci->periodic_size = DEFAULT_I_TDPS;
+ 	INIT_LIST_HEAD(&ehci->cached_itd_list);
+ 	INIT_LIST_HEAD(&ehci->cached_sitd_list);
++
++	if (HCC_PGM_FRAMELISTLEN(hcc_params)) {
++		/* periodic schedule size can be smaller than default */
++		switch (EHCI_TUNE_FLS) {
++		case 0: ehci->periodic_size = 1024; break;
++		case 1: ehci->periodic_size = 512; break;
++		case 2: ehci->periodic_size = 256; break;
++		default:	BUG();
++		}
++	}
+ 	if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0)
+ 		return retval;
+ 
+ 	/* controllers may cache some of the periodic schedule ... */
+-	hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
+ 	if (HCC_ISOC_CACHE(hcc_params))		// full frame cache
+ 		ehci->i_thresh = 2 + 8;
+ 	else					// N microframes cached
+@@ -629,12 +648,6 @@ static int ehci_init(struct usb_hcd *hcd)
+ 		/* periodic schedule size can be smaller than default */
+ 		temp &= ~(3 << 2);
+ 		temp |= (EHCI_TUNE_FLS << 2);
+-		switch (EHCI_TUNE_FLS) {
+-		case 0: ehci->periodic_size = 1024; break;
+-		case 1: ehci->periodic_size = 512; break;
+-		case 2: ehci->periodic_size = 256; break;
+-		default:	BUG();
+-		}
+ 	}
+ 	if (HCC_LPM(hcc_params)) {
+ 		/* support link power management EHCI 1.1 addendum */
+diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
+index 796ea0c..8a515f0 100644
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -111,6 +111,7 @@ static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci,
+ {
+ 	int		port;
+ 	u32		temp;
++	unsigned long	flags;
+ 
+ 	/* If remote wakeup is enabled for the root hub but disabled
+ 	 * for the controller, we must adjust all the port wakeup flags
+@@ -120,6 +121,8 @@ static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci,
+ 	if (!ehci_to_hcd(ehci)->self.root_hub->do_remote_wakeup || do_wakeup)
+ 		return;
+ 
++	spin_lock_irqsave(&ehci->lock, flags);
++
+ 	/* clear phy low-power mode before changing wakeup flags */
+ 	if (ehci->has_hostpc) {
+ 		port = HCS_N_PORTS(ehci->hcs_params);
+@@ -131,7 +134,9 @@ static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci,
+ 			temp = ehci_readl(ehci, hostpc_reg);
+ 			ehci_writel(ehci, temp & ~HOSTPC_PHCD, hostpc_reg);
+ 		}
++		spin_unlock_irqrestore(&ehci->lock, flags);
+ 		msleep(5);
++		spin_lock_irqsave(&ehci->lock, flags);
+ 	}
+ 
+ 	port = HCS_N_PORTS(ehci->hcs_params);
+@@ -170,6 +175,8 @@ static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci,
+ 	/* Does the root hub have a port wakeup pending? */
+ 	if (!suspending && (ehci_readl(ehci, &ehci->regs->status) & STS_PCD))
+ 		usb_hcd_resume_root_hub(ehci_to_hcd(ehci));
++
++	spin_unlock_irqrestore(&ehci->lock, flags);
+ }
+ 
+ static int ehci_bus_suspend (struct usb_hcd *hcd)
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index 655f3c9..331ab20 100644
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -41,6 +41,42 @@ static int ehci_pci_reinit(struct ehci_hcd *ehci, struct pci_dev *pdev)
+ 	return 0;
+ }
+ 
++static int ehci_quirk_amd_hudson(struct ehci_hcd *ehci)
++{
++	struct pci_dev *amd_smbus_dev;
++	u8 rev = 0;
++
++	amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI, 0x4385, NULL);
++	if (amd_smbus_dev) {
++		pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
++		if (rev < 0x40) {
++			pci_dev_put(amd_smbus_dev);
++			amd_smbus_dev = NULL;
++			return 0;
++		}
++	} else {
++		amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x780b, NULL);
++		if (!amd_smbus_dev)
++			return 0;
++		pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
++		if (rev < 0x11 || rev > 0x18) {
++			pci_dev_put(amd_smbus_dev);
++			amd_smbus_dev = NULL;
++			return 0;
++		}
++	}
++
++	if (!amd_nb_dev)
++		amd_nb_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x1510, NULL);
++
++	ehci_info(ehci, "QUIRK: Enable exception for AMD Hudson ASPM\n");
++
++	pci_dev_put(amd_smbus_dev);
++	amd_smbus_dev = NULL;
++
++	return 1;
++}
++
+ /* called during probe() after chip reset completes */
+ static int ehci_pci_setup(struct usb_hcd *hcd)
+ {
+@@ -99,6 +135,9 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
+ 	/* cache this readonly data; minimize chip reads */
+ 	ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
+ 
++	if (ehci_quirk_amd_hudson(ehci))
++		ehci->amd_l1_fix = 1;
++
+ 	retval = ehci_halt(ehci);
+ 	if (retval)
+ 		return retval;
+@@ -321,8 +360,8 @@ static int ehci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+ 	 * mark HW unaccessible.  The PM and USB cores make sure that
+ 	 * the root hub is either suspended or stopped.
+ 	 */
+-	spin_lock_irqsave (&ehci->lock, flags);
+ 	ehci_prepare_ports_for_controller_suspend(ehci, do_wakeup);
++	spin_lock_irqsave (&ehci->lock, flags);
+ 	ehci_writel(ehci, 0, &ehci->regs->intr_enable);
+ 	(void)ehci_readl(ehci, &ehci->regs->intr_enable);
+ 
+diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
+index d9f78eb..aa46f57 100644
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1590,6 +1590,63 @@ itd_link (struct ehci_hcd *ehci, unsigned frame, struct ehci_itd *itd)
+ 	*hw_p = cpu_to_hc32(ehci, itd->itd_dma | Q_TYPE_ITD);
+ }
+ 
++#define AB_REG_BAR_LOW 0xe0
++#define AB_REG_BAR_HIGH 0xe1
++#define AB_INDX(addr) ((addr) + 0x00)
++#define AB_DATA(addr) ((addr) + 0x04)
++#define NB_PCIE_INDX_ADDR 0xe0
++#define NB_PCIE_INDX_DATA 0xe4
++#define NB_PIF0_PWRDOWN_0 0x01100012
++#define NB_PIF0_PWRDOWN_1 0x01100013
++
++static void ehci_quirk_amd_L1(struct ehci_hcd *ehci, int disable)
++{
++	u32 addr, addr_low, addr_high, val;
++
++	outb_p(AB_REG_BAR_LOW, 0xcd6);
++	addr_low = inb_p(0xcd7);
++	outb_p(AB_REG_BAR_HIGH, 0xcd6);
++	addr_high = inb_p(0xcd7);
++	addr = addr_high << 8 | addr_low;
++	outl_p(0x30, AB_INDX(addr));
++	outl_p(0x40, AB_DATA(addr));
++	outl_p(0x34, AB_INDX(addr));
++	val = inl_p(AB_DATA(addr));
++
++	if (disable) {
++		val &= ~0x8;
++		val |= (1 << 4) | (1 << 9);
++	} else {
++		val |= 0x8;
++		val &= ~((1 << 4) | (1 << 9));
++	}
++	outl_p(val, AB_DATA(addr));
++
++	if (amd_nb_dev) {
++		addr = NB_PIF0_PWRDOWN_0;
++		pci_write_config_dword(amd_nb_dev, NB_PCIE_INDX_ADDR, addr);
++		pci_read_config_dword(amd_nb_dev, NB_PCIE_INDX_DATA, &val);
++		if (disable)
++			val &= ~(0x3f << 7);
++		else
++			val |= 0x3f << 7;
++
++		pci_write_config_dword(amd_nb_dev, NB_PCIE_INDX_DATA, val);
++
++		addr = NB_PIF0_PWRDOWN_1;
++		pci_write_config_dword(amd_nb_dev, NB_PCIE_INDX_ADDR, addr);
++		pci_read_config_dword(amd_nb_dev, NB_PCIE_INDX_DATA, &val);
++		if (disable)
++			val &= ~(0x3f << 7);
++		else
++			val |= 0x3f << 7;
++
++		pci_write_config_dword(amd_nb_dev, NB_PCIE_INDX_DATA, val);
++	}
++
++	return;
++}
++
+ /* fit urb's itds into the selected schedule slot; activate as needed */
+ static int
+ itd_link_urb (
+@@ -1616,6 +1673,12 @@ itd_link_urb (
+ 			urb->interval,
+ 			next_uframe >> 3, next_uframe & 0x7);
+ 	}
++
++	if (ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs == 0) {
++		if (ehci->amd_l1_fix == 1)
++			ehci_quirk_amd_L1(ehci, 1);
++	}
++
+ 	ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs++;
+ 
+ 	/* fill iTDs uframe by uframe */
+@@ -1740,6 +1803,11 @@ itd_complete (
+ 	(void) disable_periodic(ehci);
+ 	ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs--;
+ 
++	if (ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs == 0) {
++		if (ehci->amd_l1_fix == 1)
++			ehci_quirk_amd_L1(ehci, 0);
++	}
++
+ 	if (unlikely(list_is_singular(&stream->td_list))) {
+ 		ehci_to_hcd(ehci)->self.bandwidth_allocated
+ 				-= stream->bandwidth;
+@@ -2025,6 +2093,12 @@ sitd_link_urb (
+ 			(next_uframe >> 3) & (ehci->periodic_size - 1),
+ 			stream->interval, hc32_to_cpu(ehci, stream->splits));
+ 	}
++
++	if (ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs == 0) {
++		if (ehci->amd_l1_fix == 1)
++			ehci_quirk_amd_L1(ehci, 1);
++	}
++
+ 	ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs++;
+ 
+ 	/* fill sITDs frame by frame */
+@@ -2125,6 +2199,11 @@ sitd_complete (
+ 	(void) disable_periodic(ehci);
+ 	ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs--;
+ 
++	if (ehci_to_hcd(ehci)->self.bandwidth_isoc_reqs == 0) {
++		if (ehci->amd_l1_fix == 1)
++			ehci_quirk_amd_L1(ehci, 0);
++	}
++
+ 	if (list_is_singular(&stream->td_list)) {
+ 		ehci_to_hcd(ehci)->self.bandwidth_allocated
+ 				-= stream->bandwidth;
+diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
+index ba8eab3..799ac16 100644
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -131,6 +131,7 @@ struct ehci_hcd {			/* one per controller */
+ 	unsigned		has_amcc_usb23:1;
+ 	unsigned		need_io_watchdog:1;
+ 	unsigned		broken_periodic:1;
++	unsigned		amd_l1_fix:1;
+ 	unsigned		fs_i_thresh:1;	/* Intel iso scheduling */
+ 	unsigned		use_dummy_qh:1;	/* AMD Frame List table quirk*/
+ 
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index df558f6..62c70c2 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1188,7 +1188,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ 
+ 	addr = &xhci->op_regs->port_status_base + NUM_PORT_REGS * (port_id - 1);
+ 	temp = xhci_readl(xhci, addr);
+-	if ((temp & PORT_CONNECT) && (hcd->state == HC_STATE_SUSPENDED)) {
++	if (hcd->state == HC_STATE_SUSPENDED) {
+ 		xhci_dbg(xhci, "resume root hub\n");
+ 		usb_hcd_resume_root_hub(hcd);
+ 	}
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 45e4a31..34cf4e1 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -226,7 +226,8 @@ static int xhci_setup_msi(struct xhci_hcd *xhci)
+ static int xhci_setup_msix(struct xhci_hcd *xhci)
+ {
+ 	int i, ret = 0;
+-	struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
++	struct usb_hcd *hcd = xhci_to_hcd(xhci);
++	struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
+ 
+ 	/*
+ 	 * calculate number of msi-x vectors supported.
+@@ -265,6 +266,7 @@ static int xhci_setup_msix(struct xhci_hcd *xhci)
+ 			goto disable_msix;
+ 	}
+ 
++	hcd->msix_enabled = 1;
+ 	return ret;
+ 
+ disable_msix:
+@@ -280,7 +282,8 @@ free_entries:
+ /* Free any IRQs and disable MSI-X */
+ static void xhci_cleanup_msix(struct xhci_hcd *xhci)
+ {
+-	struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
++	struct usb_hcd *hcd = xhci_to_hcd(xhci);
++	struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
+ 
+ 	xhci_free_irq(xhci);
+ 
+@@ -292,6 +295,7 @@ static void xhci_cleanup_msix(struct xhci_hcd *xhci)
+ 		pci_disable_msi(pdev);
+ 	}
+ 
++	hcd->msix_enabled = 0;
+ 	return;
+ }
+ 
+@@ -508,9 +512,10 @@ void xhci_stop(struct usb_hcd *hcd)
+ 	spin_lock_irq(&xhci->lock);
+ 	xhci_halt(xhci);
+ 	xhci_reset(xhci);
+-	xhci_cleanup_msix(xhci);
+ 	spin_unlock_irq(&xhci->lock);
+ 
++	xhci_cleanup_msix(xhci);
++
+ #ifdef CONFIG_USB_XHCI_HCD_DEBUGGING
+ 	/* Tell the event ring poll function not to reschedule */
+ 	xhci->zombie = 1;
+@@ -544,9 +549,10 @@ void xhci_shutdown(struct usb_hcd *hcd)
+ 
+ 	spin_lock_irq(&xhci->lock);
+ 	xhci_halt(xhci);
+-	xhci_cleanup_msix(xhci);
+ 	spin_unlock_irq(&xhci->lock);
+ 
++	xhci_cleanup_msix(xhci);
++
+ 	xhci_dbg(xhci, "xhci_shutdown completed - status = %x\n",
+ 		    xhci_readl(xhci, &xhci->op_regs->status));
+ }
+@@ -647,6 +653,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
+ 	int			rc = 0;
+ 	struct usb_hcd		*hcd = xhci_to_hcd(xhci);
+ 	u32			command;
++	int			i;
+ 
+ 	spin_lock_irq(&xhci->lock);
+ 	clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+@@ -677,10 +684,15 @@ int xhci_suspend(struct xhci_hcd *xhci)
+ 		spin_unlock_irq(&xhci->lock);
+ 		return -ETIMEDOUT;
+ 	}
+-	/* step 5: remove core well power */
+-	xhci_cleanup_msix(xhci);
+ 	spin_unlock_irq(&xhci->lock);
+ 
++	/* step 5: remove core well power */
++	/* synchronize irq when using MSI-X */
++	if (xhci->msix_entries) {
++		for (i = 0; i < xhci->msix_count; i++)
++			synchronize_irq(xhci->msix_entries[i].vector);
++	}
++
+ 	return rc;
+ }
+ 
+@@ -694,7 +706,6 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ {
+ 	u32			command, temp = 0;
+ 	struct usb_hcd		*hcd = xhci_to_hcd(xhci);
+-	struct pci_dev		*pdev = to_pci_dev(hcd->self.controller);
+ 	int	old_state, retval;
+ 
+ 	old_state = hcd->state;
+@@ -729,9 +740,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ 		xhci_dbg(xhci, "Stop HCD\n");
+ 		xhci_halt(xhci);
+ 		xhci_reset(xhci);
+-		if (hibernated)
+-			xhci_cleanup_msix(xhci);
+ 		spin_unlock_irq(&xhci->lock);
++		xhci_cleanup_msix(xhci);
+ 
+ #ifdef CONFIG_USB_XHCI_HCD_DEBUGGING
+ 		/* Tell the event ring poll function not to reschedule */
+@@ -765,30 +775,6 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ 		return retval;
+ 	}
+ 
+-	spin_unlock_irq(&xhci->lock);
+-	/* Re-setup MSI-X */
+-	if (hcd->irq)
+-		free_irq(hcd->irq, hcd);
+-	hcd->irq = -1;
+-
+-	retval = xhci_setup_msix(xhci);
+-	if (retval)
+-		/* fall back to msi*/
+-		retval = xhci_setup_msi(xhci);
+-
+-	if (retval) {
+-		/* fall back to legacy interrupt*/
+-		retval = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
+-					hcd->irq_descr, hcd);
+-		if (retval) {
+-			xhci_err(xhci, "request interrupt %d failed\n",
+-					pdev->irq);
+-			return retval;
+-		}
+-		hcd->irq = pdev->irq;
+-	}
+-
+-	spin_lock_irq(&xhci->lock);
+ 	/* step 4: set Run/Stop bit */
+ 	command = xhci_readl(xhci, &xhci->op_regs->command);
+ 	command |= CMD_RUN;
+@@ -2445,8 +2431,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ 		xhci_err(xhci, "Error while assigning device slot ID\n");
+ 		return 0;
+ 	}
+-	/* xhci_alloc_virt_device() does not touch rings; no need to lock */
+-	if (!xhci_alloc_virt_device(xhci, xhci->slot_id, udev, GFP_KERNEL)) {
++	/* xhci_alloc_virt_device() does not touch rings; no need to lock.
++	 * Use GFP_NOIO, since this function can be called from
++	 * xhci_discover_or_reset_device(), which may be called as part of
++	 * mass storage driver error handling.
++	 */
++	if (!xhci_alloc_virt_device(xhci, xhci->slot_id, udev, GFP_NOIO)) {
+ 		/* Disable slot, if we can do it without mem alloc */
+ 		xhci_warn(xhci, "Could not allocate xHCI USB device data structures\n");
+ 		spin_lock_irqsave(&xhci->lock, flags);
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index 63f7cc4..7b8815d 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -486,12 +486,22 @@ static void ch341_read_int_callback(struct urb *urb)
+ 	if (actual_length >= 4) {
+ 		struct ch341_private *priv = usb_get_serial_port_data(port);
+ 		unsigned long flags;
++		u8 prev_line_status = priv->line_status;
+ 
+ 		spin_lock_irqsave(&priv->lock, flags);
+ 		priv->line_status = (~(data[2])) & CH341_BITS_MODEM_STAT;
+ 		if ((data[1] & CH341_MULT_STAT))
+ 			priv->multi_status_change = 1;
+ 		spin_unlock_irqrestore(&priv->lock, flags);
++
++		if ((priv->line_status ^ prev_line_status) & CH341_BIT_DCD) {
++			struct tty_struct *tty = tty_port_tty_get(&port->port);
++			if (tty)
++				usb_serial_handle_dcd_change(port, tty,
++					    priv->line_status & CH341_BIT_DCD);
++			tty_kref_put(tty);
++		}
++
+ 		wake_up_interruptible(&priv->delta_msr_wait);
+ 	}
+ 
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 8d7731d..735ea03 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -49,7 +49,6 @@ static int cp210x_tiocmset_port(struct usb_serial_port *port, struct file *,
+ static void cp210x_break_ctl(struct tty_struct *, int);
+ static int cp210x_startup(struct usb_serial *);
+ static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
+-static int cp210x_carrier_raised(struct usb_serial_port *p);
+ 
+ static int debug;
+ 
+@@ -87,7 +86,6 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x8115) }, /* Arygon NFC/Mifare Reader */
+ 	{ USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */
+ 	{ USB_DEVICE(0x10C4, 0x813F) }, /* Tams Master Easy Control */
+-	{ USB_DEVICE(0x10C4, 0x8149) }, /* West Mountain Radio Computerized Battery Analyzer */
+ 	{ USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */
+ 	{ USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
+ 	{ USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */
+@@ -110,7 +108,9 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
+ 	{ USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */
+ 	{ USB_DEVICE(0x10C4, 0x83A8) }, /* Amber Wireless AMB2560 */
++	{ USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */
+ 	{ USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
++	{ USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
+ 	{ USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
+ 	{ USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
+ 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+@@ -165,8 +165,7 @@ static struct usb_serial_driver cp210x_device = {
+ 	.tiocmget 		= cp210x_tiocmget,
+ 	.tiocmset		= cp210x_tiocmset,
+ 	.attach			= cp210x_startup,
+-	.dtr_rts		= cp210x_dtr_rts,
+-	.carrier_raised		= cp210x_carrier_raised
++	.dtr_rts		= cp210x_dtr_rts
+ };
+ 
+ /* Config request types */
+@@ -765,15 +764,6 @@ static int cp210x_tiocmget (struct tty_struct *tty, struct file *file)
+ 	return result;
+ }
+ 
+-static int cp210x_carrier_raised(struct usb_serial_port *p)
+-{
+-	unsigned int control;
+-	cp210x_get_config(p, CP210X_GET_MDMSTS, &control, 1);
+-	if (control & CONTROL_DCD)
+-		return 1;
+-	return 0;
+-}
+-
+ static void cp210x_break_ctl (struct tty_struct *tty, int break_state)
+ {
+ 	struct usb_serial_port *port = tty->driver_data;
+diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
+index b92070c..666e5a6 100644
+--- a/drivers/usb/serial/digi_acceleport.c
++++ b/drivers/usb/serial/digi_acceleport.c
+@@ -455,7 +455,6 @@ static int digi_write_room(struct tty_struct *tty);
+ static int digi_chars_in_buffer(struct tty_struct *tty);
+ static int digi_open(struct tty_struct *tty, struct usb_serial_port *port);
+ static void digi_close(struct usb_serial_port *port);
+-static int digi_carrier_raised(struct usb_serial_port *port);
+ static void digi_dtr_rts(struct usb_serial_port *port, int on);
+ static int digi_startup_device(struct usb_serial *serial);
+ static int digi_startup(struct usb_serial *serial);
+@@ -511,7 +510,6 @@ static struct usb_serial_driver digi_acceleport_2_device = {
+ 	.open =				digi_open,
+ 	.close =			digi_close,
+ 	.dtr_rts =			digi_dtr_rts,
+-	.carrier_raised =		digi_carrier_raised,
+ 	.write =			digi_write,
+ 	.write_room =			digi_write_room,
+ 	.write_bulk_callback = 		digi_write_bulk_callback,
+@@ -1339,14 +1337,6 @@ static void digi_dtr_rts(struct usb_serial_port *port, int on)
+ 	digi_set_modem_signals(port, on * (TIOCM_DTR|TIOCM_RTS), 1);
+ }
+ 
+-static int digi_carrier_raised(struct usb_serial_port *port)
+-{
+-	struct digi_port *priv = usb_get_serial_port_data(port);
+-	if (priv->dp_modem_signals & TIOCM_CD)
+-		return 1;
+-	return 0;
+-}
+-
+ static int digi_open(struct tty_struct *tty, struct usb_serial_port *port)
+ {
+ 	int ret;
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 2dec500..48ce01e 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -99,6 +99,7 @@ struct ftdi_sio_quirk {
+ static int   ftdi_jtag_probe(struct usb_serial *serial);
+ static int   ftdi_mtxorb_hack_setup(struct usb_serial *serial);
+ static int   ftdi_NDI_device_setup(struct usb_serial *serial);
++static int   ftdi_stmclite_probe(struct usb_serial *serial);
+ static void  ftdi_USB_UIRT_setup(struct ftdi_private *priv);
+ static void  ftdi_HE_TIRA1_setup(struct ftdi_private *priv);
+ 
+@@ -122,6 +123,10 @@ static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
+ 	.port_probe = ftdi_HE_TIRA1_setup,
+ };
+ 
++static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
++	.probe	= ftdi_stmclite_probe,
++};
++
+ /*
+  * The 8U232AM has the same API as the sio except for:
+  * - it can support MUCH higher baudrates; up to:
+@@ -615,6 +620,7 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_OCEANIC_PID) },
+ 	{ USB_DEVICE(TTI_VID, TTI_QL355P_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_RM_CANVIEW_PID) },
++	{ USB_DEVICE(ACTON_VID, ACTON_SPECTRAPRO_PID) },
+ 	{ USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) },
+ 	{ USB_DEVICE(BANDB_VID, BANDB_USOTL4_PID) },
+ 	{ USB_DEVICE(BANDB_VID, BANDB_USTL4_PID) },
+@@ -675,7 +681,17 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
+-	{ USB_DEVICE(ICOM_ID1_VID, ICOM_ID1_PID) },
++	{ USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) },
++	{ USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) },
++	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
++	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2C2_PID) },
++	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2D_PID) },
++	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2VT_PID) },
++	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2VR_PID) },
++	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP4KVT_PID) },
++	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP4KVR_PID) },
++	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2KVT_PID) },
++	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2KVR_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_THORLABS_PID) },
+@@ -799,6 +815,8 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
+ 	{ USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++	{ USB_DEVICE(ST_VID, ST_STMCLT1030_PID),
++		.driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk },
+ 	{ },					/* Optional parameter entry */
+ 	{ }					/* Terminating entry */
+ };
+@@ -1681,6 +1699,25 @@ static int ftdi_jtag_probe(struct usb_serial *serial)
+ }
+ 
+ /*
++ * First and second port on STMCLiteadaptors is reserved for JTAG interface
++ * and the forth port for pio
++ */
++static int ftdi_stmclite_probe(struct usb_serial *serial)
++{
++	struct usb_device *udev = serial->dev;
++	struct usb_interface *interface = serial->interface;
++
++	dbg("%s", __func__);
++
++	if (interface == udev->actconfig->interface[2])
++		return 0;
++
++	dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n");
++
++	return -ENODEV;
++}
++
++/*
+  * The Matrix Orbital VK204-25-USB has an invalid IN endpoint.
+  * We have to correct it if we want to read from it.
+  */
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index bf08672..117e8e6 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -518,6 +518,12 @@
+ #define RATOC_PRODUCT_ID_USB60F	0xb020
+ 
+ /*
++ * Acton Research Corp.
++ */
++#define ACTON_VID		0x0647	/* Vendor ID */
++#define ACTON_SPECTRAPRO_PID	0x0100
++
++/*
+  * Contec products (http://www.contec.com)
+  * Submitted by Daniel Sangorrin
+  */
+@@ -569,11 +575,23 @@
+ #define OCT_US101_PID		0x0421	/* OCT US101 USB to RS-232 */
+ 
+ /*
+- * Icom ID-1 digital transceiver
++ * Definitions for Icom Inc. devices
+  */
+-
+-#define ICOM_ID1_VID            0x0C26
+-#define ICOM_ID1_PID            0x0004
++#define ICOM_VID		0x0C26 /* Icom vendor ID */
++/* Note: ID-1 is a communications tranceiver for HAM-radio operators */
++#define ICOM_ID_1_PID		0x0004 /* ID-1 USB to RS-232 */
++/* Note: OPC is an Optional cable to connect an Icom Tranceiver */
++#define ICOM_OPC_U_UC_PID	0x0018 /* OPC-478UC, OPC-1122U cloning cable */
++/* Note: ID-RP* devices are Icom Repeater Devices for HAM-radio */
++#define ICOM_ID_RP2C1_PID	0x0009 /* ID-RP2C Asset 1 to RS-232 */
++#define ICOM_ID_RP2C2_PID	0x000A /* ID-RP2C Asset 2 to RS-232 */
++#define ICOM_ID_RP2D_PID	0x000B /* ID-RP2D configuration port*/
++#define ICOM_ID_RP2VT_PID	0x000C /* ID-RP2V Transmit config port */
++#define ICOM_ID_RP2VR_PID	0x000D /* ID-RP2V Receive config port */
++#define ICOM_ID_RP4KVT_PID	0x0010 /* ID-RP4000V Transmit config port */
++#define ICOM_ID_RP4KVR_PID	0x0011 /* ID-RP4000V Receive config port */
++#define ICOM_ID_RP2KVT_PID	0x0012 /* ID-RP2000V Transmit config port */
++#define ICOM_ID_RP2KVR_PID	0x0013 /* ID-RP2000V Receive config port */
+ 
+ /*
+  * GN Otometrics (http://www.otometrics.com)
+@@ -1022,6 +1040,12 @@
+ #define WHT_PID			0x0004 /* Wireless Handheld Terminal */
+ 
+ /*
++ * STMicroelectonics
++ */
++#define ST_VID			0x0483
++#define ST_STMCLT1030_PID	0x3747 /* ST Micro Connect Lite STMCLT1030 */
++
++/*
+  * Papouch products (http://www.papouch.com/)
+  * Submitted by Folkert van Heusden
+  */
+diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
+index e6833e2..e4db5ad 100644
+--- a/drivers/usb/serial/generic.c
++++ b/drivers/usb/serial/generic.c
+@@ -479,6 +479,26 @@ int usb_serial_handle_break(struct usb_serial_port *port)
+ }
+ EXPORT_SYMBOL_GPL(usb_serial_handle_break);
+ 
++/**
++ *	usb_serial_handle_dcd_change - handle a change of carrier detect state
++ *	@port: usb_serial_port structure for the open port
++ *	@tty: tty_struct structure for the port
++ *	@status: new carrier detect status, nonzero if active
++ */
++void usb_serial_handle_dcd_change(struct usb_serial_port *usb_port,
++				struct tty_struct *tty, unsigned int status)
++{
++	struct tty_port *port = &usb_port->port;
++
++	dbg("%s - port %d, status %d", __func__, usb_port->number, status);
++
++	if (status)
++		wake_up_interruptible(&port->open_wait);
++	else if (tty && !C_CLOCAL(tty))
++		tty_hangup(tty);
++}
++EXPORT_SYMBOL_GPL(usb_serial_handle_dcd_change);
++
+ int usb_serial_generic_resume(struct usb_serial *serial)
+ {
+ 	struct usb_serial_port *port;
+diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
+index cd769ef..3b246d9 100644
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -2889,8 +2889,8 @@ static void load_application_firmware(struct edgeport_serial *edge_serial)
+ 
+ 	dbg("%s %d.%d.%d", fw_info, rec->data[0], rec->data[1], build);
+ 
+-	edge_serial->product_info.FirmwareMajorVersion = fw->data[0];
+-	edge_serial->product_info.FirmwareMinorVersion = fw->data[1];
++	edge_serial->product_info.FirmwareMajorVersion = rec->data[0];
++	edge_serial->product_info.FirmwareMinorVersion = rec->data[1];
+ 	edge_serial->product_info.FirmwareBuildNumber = cpu_to_le16(build);
+ 
+ 	for (rec = ihex_next_binrec(rec); rec;
+diff --git a/drivers/usb/serial/io_tables.h b/drivers/usb/serial/io_tables.h
+index 6ab2a3f..178b22e 100644
+--- a/drivers/usb/serial/io_tables.h
++++ b/drivers/usb/serial/io_tables.h
+@@ -199,6 +199,7 @@ static struct usb_serial_driver epic_device = {
+ 		.name		= "epic",
+ 	},
+ 	.description		= "EPiC device",
++	.usb_driver		= &io_driver,
+ 	.id_table		= Epic_port_id_table,
+ 	.num_ports		= 1,
+ 	.open			= edge_open,
+diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
+index 12ed594..99b97c0 100644
+--- a/drivers/usb/serial/iuu_phoenix.c
++++ b/drivers/usb/serial/iuu_phoenix.c
+@@ -1275,6 +1275,7 @@ static struct usb_serial_driver iuu_device = {
+ 		   .name = "iuu_phoenix",
+ 		   },
+ 	.id_table = id_table,
++	.usb_driver = &iuu_driver,
+ 	.num_ports = 1,
+ 	.bulk_in_size = 512,
+ 	.bulk_out_size = 512,
+diff --git a/drivers/usb/serial/keyspan.h b/drivers/usb/serial/keyspan.h
+index 2d8baf6..ce134dc 100644
+--- a/drivers/usb/serial/keyspan.h
++++ b/drivers/usb/serial/keyspan.h
+@@ -546,6 +546,7 @@ static struct usb_serial_driver keyspan_pre_device = {
+ 		.name		= "keyspan_no_firm",
+ 	},
+ 	.description		= "Keyspan - (without firmware)",
++	.usb_driver		= &keyspan_driver,
+ 	.id_table		= keyspan_pre_ids,
+ 	.num_ports		= 1,
+ 	.attach			= keyspan_fake_startup,
+@@ -557,6 +558,7 @@ static struct usb_serial_driver keyspan_1port_device = {
+ 		.name		= "keyspan_1",
+ 	},
+ 	.description		= "Keyspan 1 port adapter",
++	.usb_driver		= &keyspan_driver,
+ 	.id_table		= keyspan_1port_ids,
+ 	.num_ports		= 1,
+ 	.open			= keyspan_open,
+@@ -579,6 +581,7 @@ static struct usb_serial_driver keyspan_2port_device = {
+ 		.name		= "keyspan_2",
+ 	},
+ 	.description		= "Keyspan 2 port adapter",
++	.usb_driver		= &keyspan_driver,
+ 	.id_table		= keyspan_2port_ids,
+ 	.num_ports		= 2,
+ 	.open			= keyspan_open,
+@@ -601,6 +604,7 @@ static struct usb_serial_driver keyspan_4port_device = {
+ 		.name		= "keyspan_4",
+ 	},
+ 	.description		= "Keyspan 4 port adapter",
++	.usb_driver		= &keyspan_driver,
+ 	.id_table		= keyspan_4port_ids,
+ 	.num_ports		= 4,
+ 	.open			= keyspan_open,
+diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
+index a10dd56..554a869 100644
+--- a/drivers/usb/serial/keyspan_pda.c
++++ b/drivers/usb/serial/keyspan_pda.c
+@@ -679,22 +679,6 @@ static void keyspan_pda_dtr_rts(struct usb_serial_port *port, int on)
+ 	}
+ }
+ 
+-static int keyspan_pda_carrier_raised(struct usb_serial_port *port)
+-{
+-	struct usb_serial *serial = port->serial;
+-	unsigned char modembits;
+-
+-	/* If we can read the modem status and the DCD is low then
+-	   carrier is not raised yet */
+-	if (keyspan_pda_get_modem_info(serial, &modembits) >= 0) {
+-		if (!(modembits & (1>>6)))
+-			return 0;
+-	}
+-	/* Carrier raised, or we failed (eg disconnected) so
+-	   progress accordingly */
+-	return 1;
+-}
+-
+ 
+ static int keyspan_pda_open(struct tty_struct *tty,
+ 					struct usb_serial_port *port)
+@@ -881,7 +865,6 @@ static struct usb_serial_driver keyspan_pda_device = {
+ 	.id_table =		id_table_std,
+ 	.num_ports =		1,
+ 	.dtr_rts =		keyspan_pda_dtr_rts,
+-	.carrier_raised	=	keyspan_pda_carrier_raised,
+ 	.open =			keyspan_pda_open,
+ 	.close =		keyspan_pda_close,
+ 	.write =		keyspan_pda_write,
+diff --git a/drivers/usb/serial/moto_modem.c b/drivers/usb/serial/moto_modem.c
+index cf17183..653465f 100644
+--- a/drivers/usb/serial/moto_modem.c
++++ b/drivers/usb/serial/moto_modem.c
+@@ -44,6 +44,7 @@ static struct usb_serial_driver moto_device = {
+ 		.name =		"moto-modem",
+ 	},
+ 	.id_table =		id_table,
++	.usb_driver =		&moto_driver,
+ 	.num_ports =		1,
+ };
+ 
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index ef2977d..356c870 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -382,7 +382,16 @@ static void option_instat_callback(struct urb *urb);
+ #define HAIER_VENDOR_ID				0x201e
+ #define HAIER_PRODUCT_CE100			0x2009
+ 
+-#define CINTERION_VENDOR_ID			0x0681
++/* Cinterion (formerly Siemens) products */
++#define SIEMENS_VENDOR_ID				0x0681
++#define CINTERION_VENDOR_ID				0x1e2d
++#define CINTERION_PRODUCT_HC25_MDM		0x0047
++#define CINTERION_PRODUCT_HC25_MDMNET	0x0040
++#define CINTERION_PRODUCT_HC28_MDM		0x004C
++#define CINTERION_PRODUCT_HC28_MDMNET	0x004A /* same for HC28J */
++#define CINTERION_PRODUCT_EU3_E			0x0051
++#define CINTERION_PRODUCT_EU3_P			0x0052
++#define CINTERION_PRODUCT_PH8			0x0053
+ 
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID			0x0b3c
+@@ -945,7 +954,17 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100F) },
+ 	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)},
+ 	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)},
+-	{ USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) },
++	/* Cinterion */
++	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) },
++	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
++	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) },
++	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
++	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
++	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
++	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
++	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
++	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
++
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
+ 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+ 	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
+diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
+index e199b0f..1c46a86 100644
+--- a/drivers/usb/serial/oti6858.c
++++ b/drivers/usb/serial/oti6858.c
+@@ -157,6 +157,7 @@ static struct usb_serial_driver oti6858_device = {
+ 		.name =		"oti6858",
+ 	},
+ 	.id_table =		id_table,
++	.usb_driver =		&oti6858_driver,
+ 	.num_ports =		1,
+ 	.open =			oti6858_open,
+ 	.close =		oti6858_close,
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 8ae4c6c..08c9181 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -50,6 +50,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) },
+ 	{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
+ 	{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
++	{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
+ 	{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
+ 	{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
+ 	{ USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
+@@ -677,9 +678,11 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
+ {
+ 
+ 	struct pl2303_private *priv = usb_get_serial_port_data(port);
++	struct tty_struct *tty;
+ 	unsigned long flags;
+ 	u8 status_idx = UART_STATE;
+ 	u8 length = UART_STATE + 1;
++	u8 prev_line_status;
+ 	u16 idv, idp;
+ 
+ 	idv = le16_to_cpu(port->serial->dev->descriptor.idVendor);
+@@ -701,11 +704,20 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
+ 
+ 	/* Save off the uart status for others to look at */
+ 	spin_lock_irqsave(&priv->lock, flags);
++	prev_line_status = priv->line_status;
+ 	priv->line_status = data[status_idx];
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 	if (priv->line_status & UART_BREAK_ERROR)
+ 		usb_serial_handle_break(port);
+ 	wake_up_interruptible(&priv->delta_msr_wait);
++
++	tty = tty_port_tty_get(&port->port);
++	if (!tty)
++		return;
++	if ((priv->line_status ^ prev_line_status) & UART_DCD)
++		usb_serial_handle_dcd_change(port, tty,
++				priv->line_status & UART_DCD);
++	tty_kref_put(tty);
+ }
+ 
+ static void pl2303_read_int_callback(struct urb *urb)
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 43eb9bd..1b025f7 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -21,6 +21,7 @@
+ #define PL2303_PRODUCT_ID_MMX		0x0612
+ #define PL2303_PRODUCT_ID_GPRS		0x0609
+ #define PL2303_PRODUCT_ID_HCR331	0x331a
++#define PL2303_PRODUCT_ID_MOTOROLA	0x0307
+ 
+ #define ATEN_VENDOR_ID		0x0557
+ #define ATEN_VENDOR_ID2		0x0547
+diff --git a/drivers/usb/serial/qcaux.c b/drivers/usb/serial/qcaux.c
+index 214a3e5..30b73e6 100644
+--- a/drivers/usb/serial/qcaux.c
++++ b/drivers/usb/serial/qcaux.c
+@@ -36,6 +36,7 @@
+ #define UTSTARCOM_PRODUCT_UM175_V1		0x3712
+ #define UTSTARCOM_PRODUCT_UM175_V2		0x3714
+ #define UTSTARCOM_PRODUCT_UM175_ALLTEL		0x3715
++#define PANTECH_PRODUCT_UML290_VZW		0x3718
+ 
+ /* CMOTECH devices */
+ #define CMOTECH_VENDOR_ID			0x16d8
+@@ -66,6 +67,7 @@ static struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_U520, 0xff, 0x00, 0x00) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) },
+ 	{ },
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+@@ -84,6 +86,7 @@ static struct usb_serial_driver qcaux_device = {
+ 		.name =		"qcaux",
+ 	},
+ 	.id_table =		id_table,
++	.usb_driver =		&qcaux_driver,
+ 	.num_ports =		1,
+ };
+ 
+diff --git a/drivers/usb/serial/siemens_mpi.c b/drivers/usb/serial/siemens_mpi.c
+index cb8195c..74cd4cc 100644
+--- a/drivers/usb/serial/siemens_mpi.c
++++ b/drivers/usb/serial/siemens_mpi.c
+@@ -42,6 +42,7 @@ static struct usb_serial_driver siemens_usb_mpi_device = {
+ 		.name =		"siemens_mpi",
+ 	},
+ 	.id_table =		id_table,
++	.usb_driver =		&siemens_usb_mpi_driver,
+ 	.num_ports =		1,
+ };
+ 
+diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
+index 765aa98..cbfb70b 100644
+--- a/drivers/usb/serial/spcp8x5.c
++++ b/drivers/usb/serial/spcp8x5.c
+@@ -133,7 +133,7 @@ struct spcp8x5_usb_ctrl_arg {
+ 
+ /* how come ??? */
+ #define UART_STATE			0x08
+-#define UART_STATE_TRANSIENT_MASK	0x74
++#define UART_STATE_TRANSIENT_MASK	0x75
+ #define UART_DCD			0x01
+ #define UART_DSR			0x02
+ #define UART_BREAK_ERROR		0x04
+@@ -525,6 +525,10 @@ static void spcp8x5_process_read_urb(struct urb *urb)
+ 		/* overrun is special, not associated with a char */
+ 		if (status & UART_OVERRUN_ERROR)
+ 			tty_insert_flip_char(tty, 0, TTY_OVERRUN);
++
++		if (status & UART_DCD)
++			usb_serial_handle_dcd_change(port, tty,
++				   priv->line_status & MSR_STATUS_LINE_DCD);
+ 	}
+ 
+ 	tty_insert_flip_string_fixed_flag(tty, data, tty_flag,
+@@ -645,6 +649,7 @@ static struct usb_serial_driver spcp8x5_device = {
+ 		.name =		"SPCP8x5",
+ 	},
+ 	.id_table		= id_table,
++	.usb_driver		= &spcp8x5_driver,
+ 	.num_ports		= 1,
+ 	.open 			= spcp8x5_open,
+ 	.dtr_rts		= spcp8x5_dtr_rts,
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index b2902f3..a910004 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -369,9 +369,9 @@ failed_1port:
+ 
+ static void __exit ti_exit(void)
+ {
++	usb_deregister(&ti_usb_driver);
+ 	usb_serial_deregister(&ti_1port_device);
+ 	usb_serial_deregister(&ti_2port_device);
+-	usb_deregister(&ti_usb_driver);
+ }
+ 
+ 
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 6954de5..546a521 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1344,11 +1344,15 @@ int usb_serial_register(struct usb_serial_driver *driver)
+ 		return -ENODEV;
+ 
+ 	fixup_generic(driver);
+-	if (driver->usb_driver)
+-		driver->usb_driver->supports_autosuspend = 1;
+ 
+ 	if (!driver->description)
+ 		driver->description = driver->driver.name;
++	if (!driver->usb_driver) {
++		WARN(1, "Serial driver %s has no usb_driver\n",
++				driver->description);
++		return -EINVAL;
++	}
++	driver->usb_driver->supports_autosuspend = 1;
+ 
+ 	/* Add this device to our list of devices */
+ 	mutex_lock(&table_lock);
+diff --git a/drivers/usb/serial/usb_debug.c b/drivers/usb/serial/usb_debug.c
+index f2ed6a3..95a8214 100644
+--- a/drivers/usb/serial/usb_debug.c
++++ b/drivers/usb/serial/usb_debug.c
+@@ -75,6 +75,7 @@ static struct usb_serial_driver debug_device = {
+ 		.name =		"debug",
+ 	},
+ 	.id_table =		id_table,
++	.usb_driver =		&debug_driver,
+ 	.num_ports =		1,
+ 	.bulk_out_size =	USB_DEBUG_MAX_PACKET_SIZE,
+ 	.break_ctl =		usb_debug_break_ctl,
+diff --git a/drivers/usb/storage/unusual_cypress.h b/drivers/usb/storage/unusual_cypress.h
+index c854fde..2c85530 100644
+--- a/drivers/usb/storage/unusual_cypress.h
++++ b/drivers/usb/storage/unusual_cypress.h
+@@ -31,4 +31,9 @@ UNUSUAL_DEV(  0x04b4, 0x6831, 0x0000, 0x9999,
+ 		"Cypress ISD-300LP",
+ 		USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
+ 
++UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x9999,
++		"Super Top",
++		"USB 2.0  SATA BRIDGE",
++		USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
++
+ #endif /* defined(CONFIG_USB_STORAGE_CYPRESS_ATACB) || ... */
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index fcc1e32..c1602b8 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1044,6 +1044,15 @@ UNUSUAL_DEV(  0x084d, 0x0011, 0x0110, 0x0110,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_BULK32),
+ 
++/* Reported by <ttkspam@××××.fr>
++ * The device reports a vendor-specific device class, requiring an
++ * explicit vendor/product match.
++ */
++UNUSUAL_DEV(  0x0851, 0x1542, 0x0002, 0x0002,
++		"MagicPixel",
++		"FW_Omega2",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL, 0),
++
+ /* Andrew Lunn <andrew@××××.ch>
+  * PanDigital Digital Picture Frame. Does not like ALLOW_MEDIUM_REMOVAL
+  * on LUN 4.
+@@ -1388,6 +1397,13 @@ UNUSUAL_DEV(  0x0f19, 0x0105, 0x0100, 0x0100,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_IGNORE_RESIDUE ),
+ 
++/* Submitted by Nick Holloway */
++UNUSUAL_DEV( 0x0f88, 0x042e, 0x0100, 0x0100,
++		"VTech",
++		"Kidizoom",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_FIX_CAPACITY ),
++
+ /* Reported by Michael Stattmann <michael@×××××××××.com> */
+ UNUSUAL_DEV(  0x0fce, 0xd008, 0x0000, 0x0000,
+ 		"Sony Ericsson",
+@@ -1872,6 +1888,22 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NO_READ_DISC_INFO ),
+ 
++/* Patch by Richard Schütz <r.schtz@××××××××.de>
++ * This external hard drive enclosure uses a JMicron chip which
++ * needs the US_FL_IGNORE_RESIDUE flag to work properly. */
++UNUSUAL_DEV(  0x1e68, 0x001b, 0x0000, 0x0000,
++		"TrekStor GmbH & Co. KG",
++		"DataStation maxi g.u",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
++
++/* Reported by Jasper Mackenzie <scarletpimpernal@×××××××.com> */
++UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0000,
++		"Coby Electronics",
++		"MP3 Player",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
++
+ UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001,
+ 		"ST",
+ 		"2A",
+diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
+index 5bf9123..5a3ce3a 100644
+--- a/drivers/video/aty/atyfb_base.c
++++ b/drivers/video/aty/atyfb_base.c
+@@ -2969,10 +2969,8 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
+ {
+ 	struct atyfb_par *par = info->par;
+ 	struct device_node *dp;
+-	char prop[128];
+-	phandle node;
+-	int len, i, j, ret;
+ 	u32 mem, chip_id;
++	int i, j, ret;
+ 
+ 	/*
+ 	 * Map memory-mapped registers.
+@@ -3088,23 +3086,8 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
+ 		aty_st_le32(MEM_CNTL, mem, par);
+ 	}
+ 
+-	/*
+-	 * If this is the console device, we will set default video
+-	 * settings to what the PROM left us with.
+-	 */
+-	node = prom_getchild(prom_root_node);
+-	node = prom_searchsiblings(node, "aliases");
+-	if (node) {
+-		len = prom_getproperty(node, "screen", prop, sizeof(prop));
+-		if (len > 0) {
+-			prop[len] = '\0';
+-			node = prom_finddevice(prop);
+-		} else
+-			node = 0;
+-	}
+-
+ 	dp = pci_device_to_OF_node(pdev);
+-	if (node == dp->phandle) {
++	if (dp == of_console_device) {
+ 		struct fb_var_screeninfo *var = &default_var;
+ 		unsigned int N, P, Q, M, T, R;
+ 		u32 v_total, h_total;
+@@ -3112,9 +3095,9 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
+ 		u8 pll_regs[16];
+ 		u8 clock_cntl;
+ 
+-		crtc.vxres = prom_getintdefault(node, "width", 1024);
+-		crtc.vyres = prom_getintdefault(node, "height", 768);
+-		var->bits_per_pixel = prom_getintdefault(node, "depth", 8);
++		crtc.vxres = of_getintprop_default(dp, "width", 1024);
++		crtc.vyres = of_getintprop_default(dp, "height", 768);
++		var->bits_per_pixel = of_getintprop_default(dp, "depth", 8);
+ 		var->xoffset = var->yoffset = 0;
+ 		crtc.h_tot_disp = aty_ld_le32(CRTC_H_TOTAL_DISP, par);
+ 		crtc.h_sync_strt_wid = aty_ld_le32(CRTC_H_SYNC_STRT_WID, par);
+diff --git a/drivers/video/backlight/88pm860x_bl.c b/drivers/video/backlight/88pm860x_bl.c
+index 38ffc3f..c06c667 100644
+--- a/drivers/video/backlight/88pm860x_bl.c
++++ b/drivers/video/backlight/88pm860x_bl.c
+@@ -21,7 +21,7 @@
+ #define MAX_BRIGHTNESS		(0xFF)
+ #define MIN_BRIGHTNESS		(0)
+ 
+-#define CURRENT_MASK		(0x1F << 1)
++#define CURRENT_BITMASK		(0x1F << 1)
+ 
+ struct pm860x_backlight_data {
+ 	struct pm860x_chip *chip;
+@@ -85,7 +85,7 @@ static int pm860x_backlight_set(struct backlight_device *bl, int brightness)
+ 	if ((data->current_brightness == 0) && brightness) {
+ 		if (data->iset) {
+ 			ret = pm860x_set_bits(data->i2c, wled_idc(data->port),
+-					      CURRENT_MASK, data->iset);
++					      CURRENT_BITMASK, data->iset);
+ 			if (ret < 0)
+ 				goto out;
+ 		}
+diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
+index ef8d9d5..4fb5b2b 100644
+--- a/drivers/virtio/virtio_pci.c
++++ b/drivers/virtio/virtio_pci.c
+@@ -96,11 +96,6 @@ static struct pci_device_id virtio_pci_id_table[] = {
+ 
+ MODULE_DEVICE_TABLE(pci, virtio_pci_id_table);
+ 
+-/* A PCI device has it's own struct device and so does a virtio device so
+- * we create a place for the virtio devices to show up in sysfs.  I think it
+- * would make more sense for virtio to not insist on having it's own device. */
+-static struct device *virtio_pci_root;
+-
+ /* Convert a generic virtio device to our structure */
+ static struct virtio_pci_device *to_vp_device(struct virtio_device *vdev)
+ {
+@@ -629,7 +624,7 @@ static int __devinit virtio_pci_probe(struct pci_dev *pci_dev,
+ 	if (vp_dev == NULL)
+ 		return -ENOMEM;
+ 
+-	vp_dev->vdev.dev.parent = virtio_pci_root;
++	vp_dev->vdev.dev.parent = &pci_dev->dev;
+ 	vp_dev->vdev.dev.release = virtio_pci_release_dev;
+ 	vp_dev->vdev.config = &virtio_pci_config_ops;
+ 	vp_dev->pci_dev = pci_dev;
+@@ -717,17 +712,7 @@ static struct pci_driver virtio_pci_driver = {
+ 
+ static int __init virtio_pci_init(void)
+ {
+-	int err;
+-
+-	virtio_pci_root = root_device_register("virtio-pci");
+-	if (IS_ERR(virtio_pci_root))
+-		return PTR_ERR(virtio_pci_root);
+-
+-	err = pci_register_driver(&virtio_pci_driver);
+-	if (err)
+-		root_device_unregister(virtio_pci_root);
+-
+-	return err;
++	return pci_register_driver(&virtio_pci_driver);
+ }
+ 
+ module_init(virtio_pci_init);
+@@ -735,7 +720,6 @@ module_init(virtio_pci_init);
+ static void __exit virtio_pci_exit(void)
+ {
+ 	pci_unregister_driver(&virtio_pci_driver);
+-	root_device_unregister(virtio_pci_root);
+ }
+ 
+ module_exit(virtio_pci_exit);
+diff --git a/drivers/xen/platform-pci.c b/drivers/xen/platform-pci.c
+index c01b5dd..afbe041 100644
+--- a/drivers/xen/platform-pci.c
++++ b/drivers/xen/platform-pci.c
+@@ -105,7 +105,7 @@ static int __devinit platform_pci_init(struct pci_dev *pdev,
+ 				       const struct pci_device_id *ent)
+ {
+ 	int i, ret;
+-	long ioaddr, iolen;
++	long ioaddr;
+ 	long mmio_addr, mmio_len;
+ 	unsigned int max_nr_gframes;
+ 
+@@ -114,7 +114,6 @@ static int __devinit platform_pci_init(struct pci_dev *pdev,
+ 		return i;
+ 
+ 	ioaddr = pci_resource_start(pdev, 0);
+-	iolen = pci_resource_len(pdev, 0);
+ 
+ 	mmio_addr = pci_resource_start(pdev, 1);
+ 	mmio_len = pci_resource_len(pdev, 1);
+@@ -125,19 +124,13 @@ static int __devinit platform_pci_init(struct pci_dev *pdev,
+ 		goto pci_out;
+ 	}
+ 
+-	if (request_mem_region(mmio_addr, mmio_len, DRV_NAME) == NULL) {
+-		dev_err(&pdev->dev, "MEM I/O resource 0x%lx @ 0x%lx busy\n",
+-		       mmio_addr, mmio_len);
+-		ret = -EBUSY;
++	ret = pci_request_region(pdev, 1, DRV_NAME);
++	if (ret < 0)
+ 		goto pci_out;
+-	}
+ 
+-	if (request_region(ioaddr, iolen, DRV_NAME) == NULL) {
+-		dev_err(&pdev->dev, "I/O resource 0x%lx @ 0x%lx busy\n",
+-		       iolen, ioaddr);
+-		ret = -EBUSY;
++	ret = pci_request_region(pdev, 0, DRV_NAME);
++	if (ret < 0)
+ 		goto mem_out;
+-	}
+ 
+ 	platform_mmio = mmio_addr;
+ 	platform_mmiolen = mmio_len;
+@@ -169,9 +162,9 @@ static int __devinit platform_pci_init(struct pci_dev *pdev,
+ 	return 0;
+ 
+ out:
+-	release_region(ioaddr, iolen);
++	pci_release_region(pdev, 0);
+ mem_out:
+-	release_mem_region(mmio_addr, mmio_len);
++	pci_release_region(pdev, 1);
+ pci_out:
+ 	pci_disable_device(pdev);
+ 	return ret;
+diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
+index e6d1481..95d5dbb 100644
+--- a/fs/cifs/cifsproto.h
++++ b/fs/cifs/cifsproto.h
+@@ -347,7 +347,7 @@ extern int CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
+ 			const __u16 netfid, const __u64 len,
+ 			const __u64 offset, const __u32 numUnlock,
+ 			const __u32 numLock, const __u8 lockType,
+-			const bool waitFlag);
++			const bool waitFlag, const __u8 oplock_level);
+ extern int CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
+ 			const __u16 smb_file_id, const int get_flag,
+ 			const __u64 len, struct file_lock *,
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 67acfb3..0fa5c1f 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -1666,7 +1666,8 @@ int
+ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
+ 	    const __u16 smb_file_id, const __u64 len,
+ 	    const __u64 offset, const __u32 numUnlock,
+-	    const __u32 numLock, const __u8 lockType, const bool waitFlag)
++	    const __u32 numLock, const __u8 lockType,
++	    const bool waitFlag, const __u8 oplock_level)
+ {
+ 	int rc = 0;
+ 	LOCK_REQ *pSMB = NULL;
+@@ -1694,6 +1695,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
+ 	pSMB->NumberOfLocks = cpu_to_le16(numLock);
+ 	pSMB->NumberOfUnlocks = cpu_to_le16(numUnlock);
+ 	pSMB->LockType = lockType;
++	pSMB->OplockLevel = oplock_level;
+ 	pSMB->AndXCommand = 0xFF;	/* none */
+ 	pSMB->Fid = smb_file_id; /* netfid stays le */
+ 
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index cc1a860..ac75883 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2999,7 +2999,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
+ 		bcc_ptr++;              /* skip password */
+ 		/* already aligned so no need to do it below */
+ 	} else {
+-		pSMB->PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
++		pSMB->PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
+ 		/* BB FIXME add code to fail this if NTLMv2 or Kerberos
+ 		   specified as required (when that support is added to
+ 		   the vfs in the future) as only NTLM or the much
+@@ -3017,7 +3017,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
+ #endif /* CIFS_WEAK_PW_HASH */
+ 		SMBNTencrypt(tcon->password, ses->server->cryptkey, bcc_ptr);
+ 
+-		bcc_ptr += CIFS_SESS_KEY_SIZE;
++		bcc_ptr += CIFS_AUTH_RESP_SIZE;
+ 		if (ses->capabilities & CAP_UNICODE) {
+ 			/* must align unicode strings */
+ 			*bcc_ptr = 0; /* null byte password */
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 5a28660..904edbe 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -779,12 +779,12 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
+ 
+ 		/* BB we could chain these into one lock request BB */
+ 		rc = CIFSSMBLock(xid, tcon, netfid, length, pfLock->fl_start,
+-				 0, 1, lockType, 0 /* wait flag */ );
++				 0, 1, lockType, 0 /* wait flag */, 0);
+ 		if (rc == 0) {
+ 			rc = CIFSSMBLock(xid, tcon, netfid, length,
+ 					 pfLock->fl_start, 1 /* numUnlock */ ,
+ 					 0 /* numLock */ , lockType,
+-					 0 /* wait flag */ );
++					 0 /* wait flag */, 0);
+ 			pfLock->fl_type = F_UNLCK;
+ 			if (rc != 0)
+ 				cERROR(1, "Error unlocking previously locked "
+@@ -801,13 +801,13 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
+ 				rc = CIFSSMBLock(xid, tcon, netfid, length,
+ 					pfLock->fl_start, 0, 1,
+ 					lockType | LOCKING_ANDX_SHARED_LOCK,
+-					0 /* wait flag */);
++					0 /* wait flag */, 0);
+ 				if (rc == 0) {
+ 					rc = CIFSSMBLock(xid, tcon, netfid,
+ 						length, pfLock->fl_start, 1, 0,
+ 						lockType |
+ 						LOCKING_ANDX_SHARED_LOCK,
+-						0 /* wait flag */);
++						0 /* wait flag */, 0);
+ 					pfLock->fl_type = F_RDLCK;
+ 					if (rc != 0)
+ 						cERROR(1, "Error unlocking "
+@@ -850,8 +850,8 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
+ 
+ 		if (numLock) {
+ 			rc = CIFSSMBLock(xid, tcon, netfid, length,
+-					pfLock->fl_start,
+-					0, numLock, lockType, wait_flag);
++					 pfLock->fl_start, 0, numLock, lockType,
++					 wait_flag, 0);
+ 
+ 			if (rc == 0) {
+ 				/* For Windows locks we must store them. */
+@@ -871,9 +871,9 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
+ 						(pfLock->fl_start + length) >=
+ 						(li->offset + li->length)) {
+ 					stored_rc = CIFSSMBLock(xid, tcon,
+-							netfid,
+-							li->length, li->offset,
+-							1, 0, li->type, false);
++							netfid, li->length,
++							li->offset, 1, 0,
++							li->type, false, 0);
+ 					if (stored_rc)
+ 						rc = stored_rc;
+ 					else {
+@@ -2245,7 +2245,8 @@ void cifs_oplock_break(struct work_struct *work)
+ 	 */
+ 	if (!cfile->oplock_break_cancelled) {
+ 		rc = CIFSSMBLock(0, tlink_tcon(cfile->tlink), cfile->netfid, 0,
+-				 0, 0, 0, LOCKING_ANDX_OPLOCK_RELEASE, false);
++				 0, 0, 0, LOCKING_ANDX_OPLOCK_RELEASE, false,
++				 cinode->clientCanCacheRead ? 1 : 0);
+ 		cFYI(1, "Oplock release rc = %d", rc);
+ 	}
+ 
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index 43f1028..09bfcf0 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -571,7 +571,7 @@ is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
+ 				pCifsInode = CIFS_I(netfile->dentry->d_inode);
+ 
+ 				cifs_set_oplock_level(pCifsInode,
+-						      pSMB->OplockLevel);
++					pSMB->OplockLevel ? OPLOCK_READ : 0);
+ 				/*
+ 				 * cifs_oplock_break_put() can't be called
+ 				 * from here.  Get reference after queueing
+diff --git a/fs/direct-io.c b/fs/direct-io.c
+index 85882f6..b044705 100644
+--- a/fs/direct-io.c
++++ b/fs/direct-io.c
+@@ -325,12 +325,16 @@ void dio_end_io(struct bio *bio, int error)
+ }
+ EXPORT_SYMBOL_GPL(dio_end_io);
+ 
+-static int
++static void
+ dio_bio_alloc(struct dio *dio, struct block_device *bdev,
+ 		sector_t first_sector, int nr_vecs)
+ {
+ 	struct bio *bio;
+ 
++	/*
++	 * bio_alloc() is guaranteed to return a bio when called with
++	 * __GFP_WAIT and we request a valid number of vectors.
++	 */
+ 	bio = bio_alloc(GFP_KERNEL, nr_vecs);
+ 
+ 	bio->bi_bdev = bdev;
+@@ -342,7 +346,6 @@ dio_bio_alloc(struct dio *dio, struct block_device *bdev,
+ 
+ 	dio->bio = bio;
+ 	dio->logical_offset_in_bio = dio->cur_page_fs_offset;
+-	return 0;
+ }
+ 
+ /*
+@@ -583,8 +586,9 @@ static int dio_new_bio(struct dio *dio, sector_t start_sector)
+ 		goto out;
+ 	sector = start_sector << (dio->blkbits - 9);
+ 	nr_pages = min(dio->pages_in_io, bio_get_nr_vecs(dio->map_bh.b_bdev));
++	nr_pages = min(nr_pages, BIO_MAX_PAGES);
+ 	BUG_ON(nr_pages <= 0);
+-	ret = dio_bio_alloc(dio, dio->map_bh.b_bdev, sector, nr_pages);
++	dio_bio_alloc(dio, dio->map_bh.b_bdev, sector, nr_pages);
+ 	dio->boundary = 0;
+ out:
+ 	return ret;
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index 8cf0724..7daf1e6 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1111,6 +1111,17 @@ static int ep_send_events(struct eventpoll *ep,
+ 	return ep_scan_ready_list(ep, ep_send_events_proc, &esed);
+ }
+ 
++static inline struct timespec ep_set_mstimeout(long ms)
++{
++	struct timespec now, ts = {
++		.tv_sec = ms / MSEC_PER_SEC,
++		.tv_nsec = NSEC_PER_MSEC * (ms % MSEC_PER_SEC),
++	};
++
++	ktime_get_ts(&now);
++	return timespec_add_safe(now, ts);
++}
++
+ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
+ 		   int maxevents, long timeout)
+ {
+@@ -1118,12 +1129,11 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
+ 	unsigned long flags;
+ 	long slack;
+ 	wait_queue_t wait;
+-	struct timespec end_time;
+ 	ktime_t expires, *to = NULL;
+ 
+ 	if (timeout > 0) {
+-		ktime_get_ts(&end_time);
+-		timespec_add_ns(&end_time, (u64)timeout * NSEC_PER_MSEC);
++		struct timespec end_time = ep_set_mstimeout(timeout);
++
+ 		slack = select_estimate_accuracy(&end_time);
+ 		to = &expires;
+ 		*to = timespec_to_ktime(end_time);
+diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
+index 4268542..a755523 100644
+--- a/fs/exofs/inode.c
++++ b/fs/exofs/inode.c
+@@ -1030,7 +1030,6 @@ struct inode *exofs_iget(struct super_block *sb, unsigned long ino)
+ 		memcpy(oi->i_data, fcb.i_data, sizeof(fcb.i_data));
+ 	}
+ 
+-	inode->i_mapping->backing_dev_info = sb->s_bdi;
+ 	if (S_ISREG(inode->i_mode)) {
+ 		inode->i_op = &exofs_file_inode_operations;
+ 		inode->i_fop = &exofs_file_operations;
+@@ -1131,7 +1130,6 @@ struct inode *exofs_new_inode(struct inode *dir, int mode)
+ 
+ 	sbi = sb->s_fs_info;
+ 
+-	inode->i_mapping->backing_dev_info = sb->s_bdi;
+ 	sb->s_dirt = 1;
+ 	inode_init_owner(inode, dir, mode);
+ 	inode->i_ino = sbi->s_nextid++;
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index e659597..97a28e9 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4349,6 +4349,7 @@ static void ext4_free_branches(handle_t *handle, struct inode *inode,
+ 					(__le32 *) bh->b_data,
+ 					(__le32 *) bh->b_data + addr_per_block,
+ 					depth);
++			brelse(bh);
+ 
+ 			/*
+ 			 * Everything below this this pointer has been
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 5b4d4e3..f1811d5 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -342,10 +342,15 @@ static struct kmem_cache *ext4_free_ext_cachep;
+ /* We create slab caches for groupinfo data structures based on the
+  * superblock block size.  There will be one per mounted filesystem for
+  * each unique s_blocksize_bits */
+-#define NR_GRPINFO_CACHES	\
+-	(EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE + 1)
++#define NR_GRPINFO_CACHES 8
+ static struct kmem_cache *ext4_groupinfo_caches[NR_GRPINFO_CACHES];
+ 
++static const char *ext4_groupinfo_slab_names[NR_GRPINFO_CACHES] = {
++	"ext4_groupinfo_1k", "ext4_groupinfo_2k", "ext4_groupinfo_4k",
++	"ext4_groupinfo_8k", "ext4_groupinfo_16k", "ext4_groupinfo_32k",
++	"ext4_groupinfo_64k", "ext4_groupinfo_128k"
++};
++
+ static void ext4_mb_generate_from_pa(struct super_block *sb, void *bitmap,
+ 					ext4_group_t group);
+ static void ext4_mb_generate_from_freelist(struct super_block *sb, void *bitmap,
+@@ -2414,6 +2419,55 @@ err_freesgi:
+ 	return -ENOMEM;
+ }
+ 
++static void ext4_groupinfo_destroy_slabs(void)
++{
++	int i;
++
++	for (i = 0; i < NR_GRPINFO_CACHES; i++) {
++		if (ext4_groupinfo_caches[i])
++			kmem_cache_destroy(ext4_groupinfo_caches[i]);
++		ext4_groupinfo_caches[i] = NULL;
++	}
++}
++
++static int ext4_groupinfo_create_slab(size_t size)
++{
++	static DEFINE_MUTEX(ext4_grpinfo_slab_create_mutex);
++	int slab_size;
++	int blocksize_bits = order_base_2(size);
++	int cache_index = blocksize_bits - EXT4_MIN_BLOCK_LOG_SIZE;
++	struct kmem_cache *cachep;
++
++	if (cache_index >= NR_GRPINFO_CACHES)
++		return -EINVAL;
++
++	if (unlikely(cache_index < 0))
++		cache_index = 0;
++
++	mutex_lock(&ext4_grpinfo_slab_create_mutex);
++	if (ext4_groupinfo_caches[cache_index]) {
++		mutex_unlock(&ext4_grpinfo_slab_create_mutex);
++		return 0;	/* Already created */
++	}
++
++	slab_size = offsetof(struct ext4_group_info,
++				bb_counters[blocksize_bits + 2]);
++
++	cachep = kmem_cache_create(ext4_groupinfo_slab_names[cache_index],
++					slab_size, 0, SLAB_RECLAIM_ACCOUNT,
++					NULL);
++
++	mutex_unlock(&ext4_grpinfo_slab_create_mutex);
++	if (!cachep) {
++		printk(KERN_EMERG "EXT4: no memory for groupinfo slab cache\n");
++		return -ENOMEM;
++	}
++
++	ext4_groupinfo_caches[cache_index] = cachep;
++
++	return 0;
++}
++
+ int ext4_mb_init(struct super_block *sb, int needs_recovery)
+ {
+ 	struct ext4_sb_info *sbi = EXT4_SB(sb);
+@@ -2421,9 +2475,6 @@ int ext4_mb_init(struct super_block *sb, int needs_recovery)
+ 	unsigned offset;
+ 	unsigned max;
+ 	int ret;
+-	int cache_index;
+-	struct kmem_cache *cachep;
+-	char *namep = NULL;
+ 
+ 	i = (sb->s_blocksize_bits + 2) * sizeof(*sbi->s_mb_offsets);
+ 
+@@ -2440,30 +2491,9 @@ int ext4_mb_init(struct super_block *sb, int needs_recovery)
+ 		goto out;
+ 	}
+ 
+-	cache_index = sb->s_blocksize_bits - EXT4_MIN_BLOCK_LOG_SIZE;
+-	cachep = ext4_groupinfo_caches[cache_index];
+-	if (!cachep) {
+-		char name[32];
+-		int len = offsetof(struct ext4_group_info,
+-					bb_counters[sb->s_blocksize_bits + 2]);
+-
+-		sprintf(name, "ext4_groupinfo_%d", sb->s_blocksize_bits);
+-		namep = kstrdup(name, GFP_KERNEL);
+-		if (!namep) {
+-			ret = -ENOMEM;
+-			goto out;
+-		}
+-
+-		/* Need to free the kmem_cache_name() when we
+-		 * destroy the slab */
+-		cachep = kmem_cache_create(namep, len, 0,
+-					     SLAB_RECLAIM_ACCOUNT, NULL);
+-		if (!cachep) {
+-			ret = -ENOMEM;
+-			goto out;
+-		}
+-		ext4_groupinfo_caches[cache_index] = cachep;
+-	}
++	ret = ext4_groupinfo_create_slab(sb->s_blocksize);
++	if (ret < 0)
++		goto out;
+ 
+ 	/* order 0 is regular bitmap */
+ 	sbi->s_mb_maxs[0] = sb->s_blocksize << 3;
+@@ -2520,7 +2550,6 @@ out:
+ 	if (ret) {
+ 		kfree(sbi->s_mb_offsets);
+ 		kfree(sbi->s_mb_maxs);
+-		kfree(namep);
+ 	}
+ 	return ret;
+ }
+@@ -2734,7 +2763,6 @@ int __init ext4_init_mballoc(void)
+ 
+ void ext4_exit_mballoc(void)
+ {
+-	int i;
+ 	/*
+ 	 * Wait for completion of call_rcu()'s on ext4_pspace_cachep
+ 	 * before destroying the slab cache.
+@@ -2743,15 +2771,7 @@ void ext4_exit_mballoc(void)
+ 	kmem_cache_destroy(ext4_pspace_cachep);
+ 	kmem_cache_destroy(ext4_ac_cachep);
+ 	kmem_cache_destroy(ext4_free_ext_cachep);
+-
+-	for (i = 0; i < NR_GRPINFO_CACHES; i++) {
+-		struct kmem_cache *cachep = ext4_groupinfo_caches[i];
+-		if (cachep) {
+-			char *name = (char *)kmem_cache_name(cachep);
+-			kmem_cache_destroy(cachep);
+-			kfree(name);
+-		}
+-	}
++	ext4_groupinfo_destroy_slabs();
+ 	ext4_remove_debugfs_entry();
+ }
+ 
+@@ -4851,7 +4871,7 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)
+ 		if (len >= EXT4_BLOCKS_PER_GROUP(sb))
+ 			len -= (EXT4_BLOCKS_PER_GROUP(sb) - first_block);
+ 		else
+-			last_block = len;
++			last_block = first_block + len;
+ 
+ 		if (e4b.bd_info->bb_free >= minlen) {
+ 			cnt = ext4_trim_all_free(sb, &e4b, first_block,
+diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
+index beacce1..736f4ee 100644
+--- a/fs/ext4/page-io.c
++++ b/fs/ext4/page-io.c
+@@ -193,6 +193,7 @@ static void ext4_end_bio(struct bio *bio, int error)
+ 	struct inode *inode;
+ 	unsigned long flags;
+ 	int i;
++	sector_t bi_sector = bio->bi_sector;
+ 
+ 	BUG_ON(!io_end);
+ 	bio->bi_private = NULL;
+@@ -210,9 +211,7 @@ static void ext4_end_bio(struct bio *bio, int error)
+ 		if (error)
+ 			SetPageError(page);
+ 		BUG_ON(!head);
+-		if (head->b_size == PAGE_CACHE_SIZE)
+-			clear_buffer_dirty(head);
+-		else {
++		if (head->b_size != PAGE_CACHE_SIZE) {
+ 			loff_t offset;
+ 			loff_t io_end_offset = io_end->offset + io_end->size;
+ 
+@@ -224,7 +223,6 @@ static void ext4_end_bio(struct bio *bio, int error)
+ 					if (error)
+ 						buffer_io_error(bh);
+ 
+-					clear_buffer_dirty(bh);
+ 				}
+ 				if (buffer_delay(bh))
+ 					partial_write = 1;
+@@ -260,7 +258,7 @@ static void ext4_end_bio(struct bio *bio, int error)
+ 			     (unsigned long long) io_end->offset,
+ 			     (long) io_end->size,
+ 			     (unsigned long long)
+-			     bio->bi_sector >> (inode->i_blkbits - 9));
++			     bi_sector >> (inode->i_blkbits - 9));
+ 	}
+ 
+ 	/* Add the io_end to per-inode completed io list*/
+@@ -383,6 +381,7 @@ int ext4_bio_write_page(struct ext4_io_submit *io,
+ 
+ 	blocksize = 1 << inode->i_blkbits;
+ 
++	BUG_ON(!PageLocked(page));
+ 	BUG_ON(PageWriteback(page));
+ 	set_page_writeback(page);
+ 	ClearPageError(page);
+@@ -400,12 +399,14 @@ int ext4_bio_write_page(struct ext4_io_submit *io,
+ 	for (bh = head = page_buffers(page), block_start = 0;
+ 	     bh != head || !block_start;
+ 	     block_start = block_end, bh = bh->b_this_page) {
++
+ 		block_end = block_start + blocksize;
+ 		if (block_start >= len) {
+ 			clear_buffer_dirty(bh);
+ 			set_buffer_uptodate(bh);
+ 			continue;
+ 		}
++		clear_buffer_dirty(bh);
+ 		ret = io_submit_add_bh(io, io_page, inode, wbc, bh);
+ 		if (ret) {
+ 			/*
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index fb15c9c..851eac3 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -77,6 +77,7 @@ static struct dentry *ext4_mount(struct file_system_type *fs_type, int flags,
+ 		       const char *dev_name, void *data);
+ static void ext4_destroy_lazyinit_thread(void);
+ static void ext4_unregister_li_request(struct super_block *sb);
++static void ext4_clear_request_list(void);
+ 
+ #if !defined(CONFIG_EXT3_FS) && !defined(CONFIG_EXT3_FS_MODULE) && defined(CONFIG_EXT4_USE_FOR_EXT23)
+ static struct file_system_type ext3_fs_type = {
+@@ -2704,6 +2705,8 @@ static void ext4_unregister_li_request(struct super_block *sb)
+ 	mutex_unlock(&ext4_li_info->li_list_mtx);
+ }
+ 
++static struct task_struct *ext4_lazyinit_task;
++
+ /*
+  * This is the function where ext4lazyinit thread lives. It walks
+  * through the request list searching for next scheduled filesystem.
+@@ -2772,6 +2775,10 @@ cont_thread:
+ 		if (time_before(jiffies, next_wakeup))
+ 			schedule();
+ 		finish_wait(&eli->li_wait_daemon, &wait);
++		if (kthread_should_stop()) {
++			ext4_clear_request_list();
++			goto exit_thread;
++		}
+ 	}
+ 
+ exit_thread:
+@@ -2796,6 +2803,7 @@ exit_thread:
+ 	wake_up(&eli->li_wait_task);
+ 
+ 	kfree(ext4_li_info);
++	ext4_lazyinit_task = NULL;
+ 	ext4_li_info = NULL;
+ 	mutex_unlock(&ext4_li_mtx);
+ 
+@@ -2818,11 +2826,10 @@ static void ext4_clear_request_list(void)
+ 
+ static int ext4_run_lazyinit_thread(void)
+ {
+-	struct task_struct *t;
+-
+-	t = kthread_run(ext4_lazyinit_thread, ext4_li_info, "ext4lazyinit");
+-	if (IS_ERR(t)) {
+-		int err = PTR_ERR(t);
++	ext4_lazyinit_task = kthread_run(ext4_lazyinit_thread,
++					 ext4_li_info, "ext4lazyinit");
++	if (IS_ERR(ext4_lazyinit_task)) {
++		int err = PTR_ERR(ext4_lazyinit_task);
+ 		ext4_clear_request_list();
+ 		del_timer_sync(&ext4_li_info->li_timer);
+ 		kfree(ext4_li_info);
+@@ -2916,7 +2923,7 @@ static int ext4_register_li_request(struct super_block *sb,
+ 	struct ext4_sb_info *sbi = EXT4_SB(sb);
+ 	struct ext4_li_request *elr;
+ 	ext4_group_t ngroups = EXT4_SB(sb)->s_groups_count;
+-	int ret;
++	int ret = 0;
+ 
+ 	if (sbi->s_li_request != NULL)
+ 		return 0;
+@@ -2973,16 +2980,10 @@ static void ext4_destroy_lazyinit_thread(void)
+ 	 * If thread exited earlier
+ 	 * there's nothing to be done.
+ 	 */
+-	if (!ext4_li_info)
++	if (!ext4_li_info || !ext4_lazyinit_task)
+ 		return;
+ 
+-	ext4_clear_request_list();
+-
+-	while (ext4_li_info->li_task) {
+-		wake_up(&ext4_li_info->li_wait_daemon);
+-		wait_event(ext4_li_info->li_wait_task,
+-			   ext4_li_info->li_task == NULL);
+-	}
++	kthread_stop(ext4_lazyinit_task);
+ }
+ 
+ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+@@ -4756,7 +4757,7 @@ static struct file_system_type ext4_fs_type = {
+ 	.fs_flags	= FS_REQUIRES_DEV,
+ };
+ 
+-int __init ext4_init_feat_adverts(void)
++static int __init ext4_init_feat_adverts(void)
+ {
+ 	struct ext4_features *ef;
+ 	int ret = -ENOMEM;
+@@ -4780,6 +4781,13 @@ out:
+ 	return ret;
+ }
+ 
++static void ext4_exit_feat_adverts(void)
++{
++	kobject_put(&ext4_feat->f_kobj);
++	wait_for_completion(&ext4_feat->f_kobj_unregister);
++	kfree(ext4_feat);
++}
++
+ static int __init ext4_init_fs(void)
+ {
+ 	int err;
+@@ -4826,7 +4834,7 @@ out1:
+ out2:
+ 	ext4_exit_mballoc();
+ out3:
+-	kfree(ext4_feat);
++	ext4_exit_feat_adverts();
+ 	remove_proc_entry("fs/ext4", NULL);
+ 	kset_unregister(ext4_kset);
+ out4:
+@@ -4845,6 +4853,7 @@ static void __exit ext4_exit_fs(void)
+ 	destroy_inodecache();
+ 	ext4_exit_xattr();
+ 	ext4_exit_mballoc();
++	ext4_exit_feat_adverts();
+ 	remove_proc_entry("fs/ext4", NULL);
+ 	kset_unregister(ext4_kset);
+ 	ext4_exit_system_zone();
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 3d06ccc..cdbf7ac 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -84,13 +84,9 @@ static inline struct inode *wb_inode(struct list_head *head)
+ 	return list_entry(head, struct inode, i_wb_list);
+ }
+ 
+-static void bdi_queue_work(struct backing_dev_info *bdi,
+-		struct wb_writeback_work *work)
++/* Wakeup flusher thread or forker thread to fork it. Requires bdi->wb_lock. */
++static void bdi_wakeup_flusher(struct backing_dev_info *bdi)
+ {
+-	trace_writeback_queue(bdi, work);
+-
+-	spin_lock_bh(&bdi->wb_lock);
+-	list_add_tail(&work->list, &bdi->work_list);
+ 	if (bdi->wb.task) {
+ 		wake_up_process(bdi->wb.task);
+ 	} else {
+@@ -98,15 +94,26 @@ static void bdi_queue_work(struct backing_dev_info *bdi,
+ 		 * The bdi thread isn't there, wake up the forker thread which
+ 		 * will create and run it.
+ 		 */
+-		trace_writeback_nothread(bdi, work);
+ 		wake_up_process(default_backing_dev_info.wb.task);
+ 	}
++}
++
++static void bdi_queue_work(struct backing_dev_info *bdi,
++			   struct wb_writeback_work *work)
++{
++	trace_writeback_queue(bdi, work);
++
++	spin_lock_bh(&bdi->wb_lock);
++	list_add_tail(&work->list, &bdi->work_list);
++	if (!bdi->wb.task)
++		trace_writeback_nothread(bdi, work);
++	bdi_wakeup_flusher(bdi);
+ 	spin_unlock_bh(&bdi->wb_lock);
+ }
+ 
+ static void
+ __bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages,
+-		bool range_cyclic, bool for_background)
++		      bool range_cyclic)
+ {
+ 	struct wb_writeback_work *work;
+ 
+@@ -126,7 +133,6 @@ __bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages,
+ 	work->sync_mode	= WB_SYNC_NONE;
+ 	work->nr_pages	= nr_pages;
+ 	work->range_cyclic = range_cyclic;
+-	work->for_background = for_background;
+ 
+ 	bdi_queue_work(bdi, work);
+ }
+@@ -144,7 +150,7 @@ __bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages,
+  */
+ void bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages)
+ {
+-	__bdi_start_writeback(bdi, nr_pages, true, false);
++	__bdi_start_writeback(bdi, nr_pages, true);
+ }
+ 
+ /**
+@@ -152,13 +158,20 @@ void bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages)
+  * @bdi: the backing device to write from
+  *
+  * Description:
+- *   This does WB_SYNC_NONE background writeback. The IO is only
+- *   started when this function returns, we make no guarentees on
+- *   completion. Caller need not hold sb s_umount semaphore.
++ *   This makes sure WB_SYNC_NONE background writeback happens. When
++ *   this function returns, it is only guaranteed that for given BDI
++ *   some IO is happening if we are over background dirty threshold.
++ *   Caller need not hold sb s_umount semaphore.
+  */
+ void bdi_start_background_writeback(struct backing_dev_info *bdi)
+ {
+-	__bdi_start_writeback(bdi, LONG_MAX, true, true);
++	/*
++	 * We just wake up the flusher thread. It will perform background
++	 * writeback as soon as there is no other work to do.
++	 */
++	spin_lock_bh(&bdi->wb_lock);
++	bdi_wakeup_flusher(bdi);
++	spin_unlock_bh(&bdi->wb_lock);
+ }
+ 
+ /*
+@@ -616,6 +629,7 @@ static long wb_writeback(struct bdi_writeback *wb,
+ 	};
+ 	unsigned long oldest_jif;
+ 	long wrote = 0;
++	long write_chunk;
+ 	struct inode *inode;
+ 
+ 	if (wbc.for_kupdate) {
+@@ -628,6 +642,24 @@ static long wb_writeback(struct bdi_writeback *wb,
+ 		wbc.range_end = LLONG_MAX;
+ 	}
+ 
++	/*
++	 * WB_SYNC_ALL mode does livelock avoidance by syncing dirty
++	 * inodes/pages in one big loop. Setting wbc.nr_to_write=LONG_MAX
++	 * here avoids calling into writeback_inodes_wb() more than once.
++	 *
++	 * The intended call sequence for WB_SYNC_ALL writeback is:
++	 *
++	 *      wb_writeback()
++	 *          __writeback_inodes_sb()     <== called only once
++	 *              write_cache_pages()     <== called once for each inode
++	 *                   (quickly) tag currently dirty pages
++	 *                   (maybe slowly) sync all tagged pages
++	 */
++	if (wbc.sync_mode == WB_SYNC_NONE)
++		write_chunk = MAX_WRITEBACK_PAGES;
++	else
++		write_chunk = LONG_MAX;
++
+ 	wbc.wb_start = jiffies; /* livelock avoidance */
+ 	for (;;) {
+ 		/*
+@@ -637,6 +669,16 @@ static long wb_writeback(struct bdi_writeback *wb,
+ 			break;
+ 
+ 		/*
++		 * Background writeout and kupdate-style writeback may
++		 * run forever. Stop them if there is other work to do
++		 * so that e.g. sync can proceed. They'll be restarted
++		 * after the other works are all done.
++		 */
++		if ((work->for_background || work->for_kupdate) &&
++		    !list_empty(&wb->bdi->work_list))
++			break;
++
++		/*
+ 		 * For background writeout, stop when we are below the
+ 		 * background dirty threshold
+ 		 */
+@@ -644,7 +686,7 @@ static long wb_writeback(struct bdi_writeback *wb,
+ 			break;
+ 
+ 		wbc.more_io = 0;
+-		wbc.nr_to_write = MAX_WRITEBACK_PAGES;
++		wbc.nr_to_write = write_chunk;
+ 		wbc.pages_skipped = 0;
+ 
+ 		trace_wbc_writeback_start(&wbc, wb->bdi);
+@@ -654,8 +696,8 @@ static long wb_writeback(struct bdi_writeback *wb,
+ 			writeback_inodes_wb(wb, &wbc);
+ 		trace_wbc_writeback_written(&wbc, wb->bdi);
+ 
+-		work->nr_pages -= MAX_WRITEBACK_PAGES - wbc.nr_to_write;
+-		wrote += MAX_WRITEBACK_PAGES - wbc.nr_to_write;
++		work->nr_pages -= write_chunk - wbc.nr_to_write;
++		wrote += write_chunk - wbc.nr_to_write;
+ 
+ 		/*
+ 		 * If we consumed everything, see if we have more
+@@ -670,7 +712,7 @@ static long wb_writeback(struct bdi_writeback *wb,
+ 		/*
+ 		 * Did we write something? Try for more
+ 		 */
+-		if (wbc.nr_to_write < MAX_WRITEBACK_PAGES)
++		if (wbc.nr_to_write < write_chunk)
+ 			continue;
+ 		/*
+ 		 * Nothing written. Wait for some inode to
+@@ -718,6 +760,23 @@ static unsigned long get_nr_dirty_pages(void)
+ 		get_nr_dirty_inodes();
+ }
+ 
++static long wb_check_background_flush(struct bdi_writeback *wb)
++{
++	if (over_bground_thresh()) {
++
++		struct wb_writeback_work work = {
++			.nr_pages	= LONG_MAX,
++			.sync_mode	= WB_SYNC_NONE,
++			.for_background	= 1,
++			.range_cyclic	= 1,
++		};
++
++		return wb_writeback(wb, &work);
++	}
++
++	return 0;
++}
++
+ static long wb_check_old_data_flush(struct bdi_writeback *wb)
+ {
+ 	unsigned long expired;
+@@ -787,6 +846,7 @@ long wb_do_writeback(struct bdi_writeback *wb, int force_wait)
+ 	 * Check for periodic writeback, kupdated() style
+ 	 */
+ 	wrote += wb_check_old_data_flush(wb);
++	wrote += wb_check_background_flush(wb);
+ 	clear_bit(BDI_writeback_running, &wb->bdi->state);
+ 
+ 	return wrote;
+@@ -873,7 +933,7 @@ void wakeup_flusher_threads(long nr_pages)
+ 	list_for_each_entry_rcu(bdi, &bdi_list, bdi_list) {
+ 		if (!bdi_has_dirty_io(bdi))
+ 			continue;
+-		__bdi_start_writeback(bdi, nr_pages, false, false);
++		__bdi_start_writeback(bdi, nr_pages, false);
+ 	}
+ 	rcu_read_unlock();
+ }
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 1fd62fc..78df330 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -23,8 +23,6 @@
+ 
+ static void nfs_do_free_delegation(struct nfs_delegation *delegation)
+ {
+-	if (delegation->cred)
+-		put_rpccred(delegation->cred);
+ 	kfree(delegation);
+ }
+ 
+@@ -37,6 +35,10 @@ static void nfs_free_delegation_callback(struct rcu_head *head)
+ 
+ static void nfs_free_delegation(struct nfs_delegation *delegation)
+ {
++	if (delegation->cred) {
++		put_rpccred(delegation->cred);
++		delegation->cred = NULL;
++	}
+ 	call_rcu(&delegation->rcu, nfs_free_delegation_callback);
+ }
+ 
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 996dd89..bd80b38 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -33,7 +33,6 @@
+ #include <linux/namei.h>
+ #include <linux/mount.h>
+ #include <linux/sched.h>
+-#include <linux/vmalloc.h>
+ #include <linux/kmemleak.h>
+ 
+ #include "delegation.h"
+@@ -459,25 +458,26 @@ out:
+ /* Perform conversion from xdr to cache array */
+ static
+ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *entry,
+-				void *xdr_page, struct page *page, unsigned int buflen)
++				struct page **xdr_pages, struct page *page, unsigned int buflen)
+ {
+ 	struct xdr_stream stream;
+-	struct xdr_buf buf;
+-	__be32 *ptr = xdr_page;
++	struct xdr_buf buf = {
++		.pages = xdr_pages,
++		.page_len = buflen,
++		.buflen = buflen,
++		.len = buflen,
++	};
++	struct page *scratch;
+ 	struct nfs_cache_array *array;
+ 	unsigned int count = 0;
+ 	int status;
+ 
+-	buf.head->iov_base = xdr_page;
+-	buf.head->iov_len = buflen;
+-	buf.tail->iov_len = 0;
+-	buf.page_base = 0;
+-	buf.page_len = 0;
+-	buf.buflen = buf.head->iov_len;
+-	buf.len = buf.head->iov_len;
+-
+-	xdr_init_decode(&stream, &buf, ptr);
++	scratch = alloc_page(GFP_KERNEL);
++	if (scratch == NULL)
++		return -ENOMEM;
+ 
++	xdr_init_decode(&stream, &buf, NULL);
++	xdr_set_scratch_buffer(&stream, page_address(scratch), PAGE_SIZE);
+ 
+ 	do {
+ 		status = xdr_decode(desc, entry, &stream);
+@@ -506,6 +506,8 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en
+ 		} else
+ 			status = PTR_ERR(array);
+ 	}
++
++	put_page(scratch);
+ 	return status;
+ }
+ 
+@@ -521,7 +523,6 @@ static
+ void nfs_readdir_free_large_page(void *ptr, struct page **pages,
+ 		unsigned int npages)
+ {
+-	vm_unmap_ram(ptr, npages);
+ 	nfs_readdir_free_pagearray(pages, npages);
+ }
+ 
+@@ -530,9 +531,8 @@ void nfs_readdir_free_large_page(void *ptr, struct page **pages,
+  * to nfs_readdir_free_large_page
+  */
+ static
+-void *nfs_readdir_large_page(struct page **pages, unsigned int npages)
++int nfs_readdir_large_page(struct page **pages, unsigned int npages)
+ {
+-	void *ptr;
+ 	unsigned int i;
+ 
+ 	for (i = 0; i < npages; i++) {
+@@ -541,13 +541,11 @@ void *nfs_readdir_large_page(struct page **pages, unsigned int npages)
+ 			goto out_freepages;
+ 		pages[i] = page;
+ 	}
++	return 0;
+ 
+-	ptr = vm_map_ram(pages, npages, 0, PAGE_KERNEL);
+-	if (!IS_ERR_OR_NULL(ptr))
+-		return ptr;
+ out_freepages:
+ 	nfs_readdir_free_pagearray(pages, i);
+-	return NULL;
++	return -ENOMEM;
+ }
+ 
+ static
+@@ -577,8 +575,8 @@ int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page,
+ 	memset(array, 0, sizeof(struct nfs_cache_array));
+ 	array->eof_index = -1;
+ 
+-	pages_ptr = nfs_readdir_large_page(pages, array_size);
+-	if (!pages_ptr)
++	status = nfs_readdir_large_page(pages, array_size);
++	if (status < 0)
+ 		goto out_release_array;
+ 	do {
+ 		unsigned int pglen;
+@@ -587,7 +585,7 @@ int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page,
+ 		if (status < 0)
+ 			break;
+ 		pglen = status;
+-		status = nfs_readdir_page_filler(desc, &entry, pages_ptr, page, pglen);
++		status = nfs_readdir_page_filler(desc, &entry, pages, page, pglen);
+ 		if (status < 0) {
+ 			if (status == -ENOSPC)
+ 				status = 0;
+@@ -1579,6 +1577,7 @@ static int nfs_create(struct inode *dir, struct dentry *dentry, int mode,
+ {
+ 	struct iattr attr;
+ 	int error;
++	int open_flags = 0;
+ 
+ 	dfprintk(VFS, "NFS: create(%s/%ld), %s\n",
+ 			dir->i_sb->s_id, dir->i_ino, dentry->d_name.name);
+@@ -1586,7 +1585,10 @@ static int nfs_create(struct inode *dir, struct dentry *dentry, int mode,
+ 	attr.ia_mode = mode;
+ 	attr.ia_valid = ATTR_MODE;
+ 
+-	error = NFS_PROTO(dir)->create(dir, dentry, &attr, 0, NULL);
++	if ((nd->flags & LOOKUP_CREATE) != 0)
++		open_flags = nd->intent.open.flags;
++
++	error = NFS_PROTO(dir)->create(dir, dentry, &attr, open_flags, NULL);
+ 	if (error != 0)
+ 		goto out_err;
+ 	return 0;
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index e6ace0d..9943a75 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -407,15 +407,18 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq,
+ 		pos += vec->iov_len;
+ 	}
+ 
++	/*
++	 * If no bytes were started, return the error, and let the
++	 * generic layer handle the completion.
++	 */
++	if (requested_bytes == 0) {
++		nfs_direct_req_release(dreq);
++		return result < 0 ? result : -EIO;
++	}
++
+ 	if (put_dreq(dreq))
+ 		nfs_direct_complete(dreq);
+-
+-	if (requested_bytes != 0)
+-		return 0;
+-
+-	if (result < 0)
+-		return result;
+-	return -EIO;
++	return 0;
+ }
+ 
+ static ssize_t nfs_direct_read(struct kiocb *iocb, const struct iovec *iov,
+@@ -841,15 +844,18 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,
+ 		pos += vec->iov_len;
+ 	}
+ 
++	/*
++	 * If no bytes were started, return the error, and let the
++	 * generic layer handle the completion.
++	 */
++	if (requested_bytes == 0) {
++		nfs_direct_req_release(dreq);
++		return result < 0 ? result : -EIO;
++	}
++
+ 	if (put_dreq(dreq))
+ 		nfs_direct_write_complete(dreq, dreq->inode);
+-
+-	if (requested_bytes != 0)
+-		return 0;
+-
+-	if (result < 0)
+-		return result;
+-	return -EIO;
++	return 0;
+ }
+ 
+ static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
+diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
+index 5914a19..b382a1b 100644
+--- a/fs/nfs/nfs2xdr.c
++++ b/fs/nfs/nfs2xdr.c
+@@ -487,12 +487,6 @@ nfs_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, struct nfs_se
+ 
+ 	entry->d_type = DT_UNKNOWN;
+ 
+-	p = xdr_inline_peek(xdr, 8);
+-	if (p != NULL)
+-		entry->eof = !p[0] && p[1];
+-	else
+-		entry->eof = 0;
+-
+ 	return p;
+ 
+ out_overflow:
+diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
+index f6cc60f..ba91236 100644
+--- a/fs/nfs/nfs3xdr.c
++++ b/fs/nfs/nfs3xdr.c
+@@ -647,12 +647,6 @@ nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, struct nfs_s
+ 			memset((u8*)(entry->fh), 0, sizeof(*entry->fh));
+ 	}
+ 
+-	p = xdr_inline_peek(xdr, 8);
+-	if (p != NULL)
+-		entry->eof = !p[0] && p[1];
+-	else
+-		entry->eof = 0;
+-
+ 	return p;
+ 
+ out_overflow:
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index 9f1826b..0662a98 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -6215,12 +6215,6 @@ __be32 *nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
+ 	if (verify_attr_len(xdr, p, len) < 0)
+ 		goto out_overflow;
+ 
+-	p = xdr_inline_peek(xdr, 8);
+-	if (p != NULL)
+-		entry->eof = !p[0] && p[1];
+-	else
+-		entry->eof = 0;
+-
+ 	return p;
+ 
+ out_overflow:
+diff --git a/fs/nfsd/nfs4idmap.c b/fs/nfsd/nfs4idmap.c
+index f0695e8..844960f 100644
+--- a/fs/nfsd/nfs4idmap.c
++++ b/fs/nfsd/nfs4idmap.c
+@@ -524,13 +524,13 @@ idmap_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen
+ 	int ret;
+ 
+ 	if (namelen + 1 > sizeof(key.name))
+-		return -EINVAL;
++		return -ESRCH; /* nfserr_badowner */
+ 	memcpy(key.name, name, namelen);
+ 	key.name[namelen] = '\0';
+ 	strlcpy(key.authname, rqst_authname(rqstp), sizeof(key.authname));
+ 	ret = idmap_lookup(rqstp, nametoid_lookup, &key, &nametoid_cache, &item);
+ 	if (ret == -ENOENT)
+-		ret = -ESRCH; /* nfserr_badname */
++		ret = -ESRCH; /* nfserr_badowner */
+ 	if (ret)
+ 		return ret;
+ 	*id = item->id;
+diff --git a/fs/nfsd/nfsd.h b/fs/nfsd/nfsd.h
+index 6b641cf..7ecfa24 100644
+--- a/fs/nfsd/nfsd.h
++++ b/fs/nfsd/nfsd.h
+@@ -158,6 +158,7 @@ void		nfsd_lockd_shutdown(void);
+ #define	nfserr_attrnotsupp	cpu_to_be32(NFSERR_ATTRNOTSUPP)
+ #define	nfserr_bad_xdr		cpu_to_be32(NFSERR_BAD_XDR)
+ #define	nfserr_openmode		cpu_to_be32(NFSERR_OPENMODE)
++#define	nfserr_badowner		cpu_to_be32(NFSERR_BADOWNER)
+ #define	nfserr_locks_held	cpu_to_be32(NFSERR_LOCKS_HELD)
+ #define	nfserr_op_illegal	cpu_to_be32(NFSERR_OP_ILLEGAL)
+ #define	nfserr_grace		cpu_to_be32(NFSERR_GRACE)
+diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
+index 08e1726..f0c2f23 100644
+--- a/fs/nfsd/nfsproc.c
++++ b/fs/nfsd/nfsproc.c
+@@ -737,7 +737,7 @@ nfserrno (int errno)
+ 		{ nfserr_jukebox, -ERESTARTSYS },
+ 		{ nfserr_dropit, -EAGAIN },
+ 		{ nfserr_dropit, -ENOMEM },
+-		{ nfserr_badname, -ESRCH },
++		{ nfserr_badowner, -ESRCH },
+ 		{ nfserr_io, -ETXTBSY },
+ 		{ nfserr_notsupp, -EOPNOTSUPP },
+ 		{ nfserr_toosmall, -ETOOSMALL },
+diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
+index f804d41..2940a58 100644
+--- a/fs/nilfs2/super.c
++++ b/fs/nilfs2/super.c
+@@ -688,7 +688,8 @@ skip_mount_setup:
+ 	sbp[0]->s_state =
+ 		cpu_to_le16(le16_to_cpu(sbp[0]->s_state) & ~NILFS_VALID_FS);
+ 	/* synchronize sbp[1] with sbp[0] */
+-	memcpy(sbp[1], sbp[0], nilfs->ns_sbsize);
++	if (sbp[1])
++		memcpy(sbp[1], sbp[0], nilfs->ns_sbsize);
+ 	return nilfs_commit_super(sbi, NILFS_SB_COMMIT_ALL);
+ }
+ 
+diff --git a/fs/partitions/check.c b/fs/partitions/check.c
+index 0a8b0ad..0123717 100644
+--- a/fs/partitions/check.c
++++ b/fs/partitions/check.c
+@@ -372,6 +372,13 @@ static void delete_partition_rcu_cb(struct rcu_head *head)
+ 	put_device(part_to_dev(part));
+ }
+ 
++void __delete_partition(struct kref *ref)
++{
++	struct hd_struct *part = container_of(ref, struct hd_struct, ref);
++
++	call_rcu(&part->rcu_head, delete_partition_rcu_cb);
++}
++
+ void delete_partition(struct gendisk *disk, int partno)
+ {
+ 	struct disk_part_tbl *ptbl = disk->part_tbl;
+@@ -390,7 +397,7 @@ void delete_partition(struct gendisk *disk, int partno)
+ 	kobject_put(part->holder_dir);
+ 	device_del(part_to_dev(part));
+ 
+-	call_rcu(&part->rcu_head, delete_partition_rcu_cb);
++	kref_put(&part->ref, __delete_partition);
+ }
+ 
+ static ssize_t whole_disk_show(struct device *dev,
+@@ -489,6 +496,7 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno,
+ 	if (!dev_get_uevent_suppress(ddev))
+ 		kobject_uevent(&pdev->kobj, KOBJ_ADD);
+ 
++	kref_init(&p->ref);
+ 	return p;
+ 
+ out_free_info:
+diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
+index 6f37c39..d245cb2 100644
+--- a/fs/proc/kcore.c
++++ b/fs/proc/kcore.c
+@@ -558,7 +558,7 @@ static int open_kcore(struct inode *inode, struct file *filp)
+ static const struct file_operations proc_kcore_operations = {
+ 	.read		= read_kcore,
+ 	.open		= open_kcore,
+-	.llseek		= generic_file_llseek,
++	.llseek		= default_llseek,
+ };
+ 
+ #ifdef CONFIG_MEMORY_HOTPLUG
+diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
+index 883c1d4..40b1f0e 100644
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -28,7 +28,6 @@
+ 	{0x1002, 0x4156, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
+ 	{0x1002, 0x4237, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP}, \
+ 	{0x1002, 0x4242, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
+-	{0x1002, 0x4243, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
+ 	{0x1002, 0x4336, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS100|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
+ 	{0x1002, 0x4337, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
+ 	{0x1002, 0x4437, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 36ab42c..7572b19 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -115,6 +115,7 @@ struct request {
+ 	void *elevator_private3;
+ 
+ 	struct gendisk *rq_disk;
++	struct hd_struct *part;
+ 	unsigned long start_time;
+ #ifdef CONFIG_BLK_CGROUP
+ 	unsigned long long start_time_ns;
+diff --git a/include/linux/completion.h b/include/linux/completion.h
+index 36d57f7..51494e6 100644
+--- a/include/linux/completion.h
++++ b/include/linux/completion.h
+@@ -81,10 +81,10 @@ extern int wait_for_completion_interruptible(struct completion *x);
+ extern int wait_for_completion_killable(struct completion *x);
+ extern unsigned long wait_for_completion_timeout(struct completion *x,
+ 						   unsigned long timeout);
+-extern unsigned long wait_for_completion_interruptible_timeout(
+-			struct completion *x, unsigned long timeout);
+-extern unsigned long wait_for_completion_killable_timeout(
+-			struct completion *x, unsigned long timeout);
++extern long wait_for_completion_interruptible_timeout(
++	struct completion *x, unsigned long timeout);
++extern long wait_for_completion_killable_timeout(
++	struct completion *x, unsigned long timeout);
+ extern bool try_wait_for_completion(struct completion *x);
+ extern bool completion_done(struct completion *x);
+ 
+diff --git a/include/linux/dynamic_debug.h b/include/linux/dynamic_debug.h
+index a90b389..1c70028 100644
+--- a/include/linux/dynamic_debug.h
++++ b/include/linux/dynamic_debug.h
+@@ -44,34 +44,24 @@ int ddebug_add_module(struct _ddebug *tab, unsigned int n,
+ extern int ddebug_remove_module(const char *mod_name);
+ 
+ #define dynamic_pr_debug(fmt, ...) do {					\
+-	__label__ do_printk;						\
+-	__label__ out;							\
+ 	static struct _ddebug descriptor				\
+ 	__used								\
+ 	__attribute__((section("__verbose"), aligned(8))) =		\
+ 	{ KBUILD_MODNAME, __func__, __FILE__, fmt, __LINE__,		\
+ 		_DPRINTK_FLAGS_DEFAULT };				\
+-	JUMP_LABEL(&descriptor.enabled, do_printk);			\
+-	goto out;							\
+-do_printk:								\
+-	printk(KERN_DEBUG pr_fmt(fmt),	##__VA_ARGS__);			\
+-out:	;								\
++	if (unlikely(descriptor.enabled))				\
++		printk(KERN_DEBUG pr_fmt(fmt),	##__VA_ARGS__);		\
+ 	} while (0)
+ 
+ 
+ #define dynamic_dev_dbg(dev, fmt, ...) do {				\
+-	__label__ do_printk;						\
+-	__label__ out;							\
+ 	static struct _ddebug descriptor				\
+ 	__used								\
+ 	__attribute__((section("__verbose"), aligned(8))) =		\
+ 	{ KBUILD_MODNAME, __func__, __FILE__, fmt, __LINE__,		\
+ 		_DPRINTK_FLAGS_DEFAULT };				\
+-	JUMP_LABEL(&descriptor.enabled, do_printk);			\
+-	goto out;							\
+-do_printk:								\
+-	dev_printk(KERN_DEBUG, dev, fmt, ##__VA_ARGS__);		\
+-out:	;								\
++	if (unlikely(descriptor.enabled))				\
++		dev_printk(KERN_DEBUG, dev, fmt, ##__VA_ARGS__);	\
+ 	} while (0)
+ 
+ #else
+diff --git a/include/linux/genhd.h b/include/linux/genhd.h
+index 7a7b9c1..2ba2792 100644
+--- a/include/linux/genhd.h
++++ b/include/linux/genhd.h
+@@ -116,6 +116,7 @@ struct hd_struct {
+ 	struct disk_stats dkstats;
+ #endif
+ 	struct rcu_head rcu_head;
++	struct kref ref;
+ };
+ 
+ #define GENHD_FL_REMOVABLE			1
+@@ -583,6 +584,7 @@ extern struct hd_struct * __must_check add_partition(struct gendisk *disk,
+ 						     sector_t len, int flags,
+ 						     struct partition_meta_info
+ 						       *info);
++extern void __delete_partition(struct kref *ref);
+ extern void delete_partition(struct gendisk *, int);
+ extern void printk_all_partitions(void);
+ 
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index ed5a03c..1c2138d 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -959,7 +959,7 @@ struct ieee80211_ht_info {
+ /* block-ack parameters */
+ #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
+ #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
+-#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
++#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0
+ #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
+ #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
+ 
+diff --git a/include/linux/klist.h b/include/linux/klist.h
+index e91a4e5..a370ce5 100644
+--- a/include/linux/klist.h
++++ b/include/linux/klist.h
+@@ -22,7 +22,7 @@ struct klist {
+ 	struct list_head	k_list;
+ 	void			(*get)(struct klist_node *);
+ 	void			(*put)(struct klist_node *);
+-} __attribute__ ((aligned (4)));
++} __attribute__ ((aligned (sizeof(void *))));
+ 
+ #define KLIST_INIT(_name, _get, _put)					\
+ 	{ .k_lock	= __SPIN_LOCK_UNLOCKED(_name.k_lock),		\
+diff --git a/include/linux/kref.h b/include/linux/kref.h
+index 6cc38fc..90b9e44 100644
+--- a/include/linux/kref.h
++++ b/include/linux/kref.h
+@@ -23,6 +23,7 @@ struct kref {
+ 
+ void kref_init(struct kref *kref);
+ void kref_get(struct kref *kref);
++int kref_test_and_get(struct kref *kref);
+ int kref_put(struct kref *kref, void (*release) (struct kref *kref));
+ 
+ #endif /* _KREF_H_ */
+diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
+index 71c09b2..9f19430 100644
+--- a/include/linux/lockdep.h
++++ b/include/linux/lockdep.h
+@@ -522,12 +522,15 @@ static inline void print_irqtrace_events(struct task_struct *curr)
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+ # ifdef CONFIG_PROVE_LOCKING
+ #  define lock_map_acquire(l)		lock_acquire(l, 0, 0, 0, 2, NULL, _THIS_IP_)
++#  define lock_map_acquire_read(l)	lock_acquire(l, 0, 0, 2, 2, NULL, _THIS_IP_)
+ # else
+ #  define lock_map_acquire(l)		lock_acquire(l, 0, 0, 0, 1, NULL, _THIS_IP_)
++#  define lock_map_acquire_read(l)	lock_acquire(l, 0, 0, 2, 1, NULL, _THIS_IP_)
+ # endif
+ # define lock_map_release(l)			lock_release(l, 1, _THIS_IP_)
+ #else
+ # define lock_map_acquire(l)			do { } while (0)
++# define lock_map_acquire_read(l)		do { } while (0)
+ # define lock_map_release(l)			do { } while (0)
+ #endif
+ 
+diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
+index 31c237a..12b9eb5 100644
+--- a/include/linux/memory_hotplug.h
++++ b/include/linux/memory_hotplug.h
+@@ -161,6 +161,12 @@ extern void register_page_bootmem_info_node(struct pglist_data *pgdat);
+ extern void put_page_bootmem(struct page *page);
+ #endif
+ 
++/*
++ * Lock for memory hotplug guarantees 1) all callbacks for memory hotplug
++ * notifier will be called under this. 2) offline/online/add/remove memory
++ * will not run simultaneously.
++ */
++
+ void lock_memory_hotplug(void);
+ void unlock_memory_hotplug(void);
+ 
+diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
+index 39c24eb..4890662 100644
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -458,12 +458,6 @@ static inline int zone_is_oom_locked(const struct zone *zone)
+ 	return test_bit(ZONE_OOM_LOCKED, &zone->flags);
+ }
+ 
+-#ifdef CONFIG_SMP
+-unsigned long zone_nr_free_pages(struct zone *zone);
+-#else
+-#define zone_nr_free_pages(zone) zone_page_state(zone, NR_FREE_PAGES)
+-#endif /* CONFIG_SMP */
+-
+ /*
+  * The "priority" of VM scanning is how much of the queues we will scan in one
+  * go. A value of 12 for DEF_PRIORITY implies that we will scan 1/4096th of the
+@@ -661,7 +655,9 @@ typedef struct pglist_data {
+ extern struct mutex zonelists_mutex;
+ void build_all_zonelists(void *data);
+ void wakeup_kswapd(struct zone *zone, int order);
+-int zone_watermark_ok(struct zone *z, int order, unsigned long mark,
++bool zone_watermark_ok(struct zone *z, int order, unsigned long mark,
++		int classzone_idx, int alloc_flags);
++bool zone_watermark_ok_safe(struct zone *z, int order, unsigned long mark,
+ 		int classzone_idx, int alloc_flags);
+ enum memmap_context {
+ 	MEMMAP_EARLY,
+diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
+index 0edb256..fb877b5 100644
+--- a/include/linux/nl80211.h
++++ b/include/linux/nl80211.h
+@@ -1307,7 +1307,11 @@ enum nl80211_bitrate_attr {
+  * 	wireless core it thinks its knows the regulatory domain we should be in.
+  * @NL80211_REGDOM_SET_BY_COUNTRY_IE: the wireless core has received an
+  * 	802.11 country information element with regulatory information it
+- * 	thinks we should consider.
++ * 	thinks we should consider. cfg80211 only processes the country
++ *	code from the IE, and relies on the regulatory domain information
++ *	structure pased by userspace (CRDA) from our wireless-regdb.
++ *	If a channel is enabled but the country code indicates it should
++ *	be disabled we disable the channel and re-enable it upon disassociation.
+  */
+ enum nl80211_reg_initiator {
+ 	NL80211_REGDOM_SET_BY_CORE,
+diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
+index 32fb812..1ca6411 100644
+--- a/include/linux/oprofile.h
++++ b/include/linux/oprofile.h
+@@ -16,6 +16,8 @@
+ #include <linux/types.h>
+ #include <linux/spinlock.h>
+ #include <linux/init.h>
++#include <linux/errno.h>
++#include <linux/printk.h>
+ #include <asm/atomic.h>
+  
+ /* Each escaped entry is prefixed by ESCAPE_CODE
+@@ -186,10 +188,17 @@ int oprofile_add_data(struct op_entry *entry, unsigned long val);
+ int oprofile_add_data64(struct op_entry *entry, u64 val);
+ int oprofile_write_commit(struct op_entry *entry);
+ 
+-#ifdef CONFIG_PERF_EVENTS
++#ifdef CONFIG_HW_PERF_EVENTS
+ int __init oprofile_perf_init(struct oprofile_operations *ops);
+ void oprofile_perf_exit(void);
+ char *op_name_from_perf_id(void);
+-#endif /* CONFIG_PERF_EVENTS */
++#else
++static inline int __init oprofile_perf_init(struct oprofile_operations *ops)
++{
++	pr_info("oprofile: hardware counters not available\n");
++	return -ENODEV;
++}
++static inline void oprofile_perf_exit(void) { }
++#endif /* CONFIG_HW_PERF_EVENTS */
+ 
+ #endif /* OPROFILE_H */
+diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
+index ab2baa5..23241c2 100644
+--- a/include/linux/radix-tree.h
++++ b/include/linux/radix-tree.h
+@@ -146,6 +146,22 @@ static inline void *radix_tree_deref_slot(void **pslot)
+ }
+ 
+ /**
++ * radix_tree_deref_slot_protected	- dereference a slot without RCU lock but with tree lock held
++ * @pslot:	pointer to slot, returned by radix_tree_lookup_slot
++ * Returns:	item that was stored in that slot with any direct pointer flag
++ *		removed.
++ *
++ * Similar to radix_tree_deref_slot but only used during migration when a pages
++ * mapping is being moved. The caller does not hold the RCU read lock but it
++ * must hold the tree lock to prevent parallel updates.
++ */
++static inline void *radix_tree_deref_slot_protected(void **pslot,
++							spinlock_t *treelock)
++{
++	return rcu_dereference_protected(*pslot, lockdep_is_held(treelock));
++}
++
++/**
+  * radix_tree_deref_retry	- check radix_tree_deref_slot
+  * @arg:	pointer returned by radix_tree_deref_slot
+  * Returns:	0 if retry is not required, otherwise retry is required
+diff --git a/include/linux/security.h b/include/linux/security.h
+index fd4d55f..d47a4c2 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -796,8 +796,9 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
+  * @unix_stream_connect:
+  *	Check permissions before establishing a Unix domain stream connection
+  *	between @sock and @other.
+- *	@sock contains the socket structure.
+- *	@other contains the peer socket structure.
++ *	@sock contains the sock structure.
++ *	@other contains the peer sock structure.
++ *	@newsk contains the new sock structure.
+  *	Return 0 if permission is granted.
+  * @unix_may_send:
+  *	Check permissions before connecting or sending datagrams from @sock to
+@@ -1568,8 +1569,7 @@ struct security_operations {
+ 	int (*inode_getsecctx)(struct inode *inode, void **ctx, u32 *ctxlen);
+ 
+ #ifdef CONFIG_SECURITY_NETWORK
+-	int (*unix_stream_connect) (struct socket *sock,
+-				    struct socket *other, struct sock *newsk);
++	int (*unix_stream_connect) (struct sock *sock, struct sock *other, struct sock *newsk);
+ 	int (*unix_may_send) (struct socket *sock, struct socket *other);
+ 
+ 	int (*socket_create) (int family, int type, int protocol, int kern);
+@@ -2525,8 +2525,7 @@ static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32
+ 
+ #ifdef CONFIG_SECURITY_NETWORK
+ 
+-int security_unix_stream_connect(struct socket *sock, struct socket *other,
+-				 struct sock *newsk);
++int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
+ int security_unix_may_send(struct socket *sock,  struct socket *other);
+ int security_socket_create(int family, int type, int protocol, int kern);
+ int security_socket_post_create(struct socket *sock, int family,
+@@ -2567,8 +2566,8 @@ void security_tun_dev_post_create(struct sock *sk);
+ int security_tun_dev_attach(struct sock *sk);
+ 
+ #else	/* CONFIG_SECURITY_NETWORK */
+-static inline int security_unix_stream_connect(struct socket *sock,
+-					       struct socket *other,
++static inline int security_unix_stream_connect(struct sock *sock,
++					       struct sock *other,
+ 					       struct sock *newsk)
+ {
+ 	return 0;
+diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
+index 498ab93..7783c68 100644
+--- a/include/linux/sunrpc/xdr.h
++++ b/include/linux/sunrpc/xdr.h
+@@ -201,6 +201,8 @@ struct xdr_stream {
+ 
+ 	__be32 *end;		/* end of available buffer space */
+ 	struct kvec *iov;	/* pointer to the current kvec */
++	struct kvec scratch;	/* Scratch buffer */
++	struct page **page_ptr;	/* pointer to the current page */
+ };
+ 
+ extern void xdr_init_encode(struct xdr_stream *xdr, struct xdr_buf *buf, __be32 *p);
+@@ -208,7 +210,7 @@ extern __be32 *xdr_reserve_space(struct xdr_stream *xdr, size_t nbytes);
+ extern void xdr_write_pages(struct xdr_stream *xdr, struct page **pages,
+ 		unsigned int base, unsigned int len);
+ extern void xdr_init_decode(struct xdr_stream *xdr, struct xdr_buf *buf, __be32 *p);
+-extern __be32 *xdr_inline_peek(struct xdr_stream *xdr, size_t nbytes);
++extern void xdr_set_scratch_buffer(struct xdr_stream *xdr, void *buf, size_t buflen);
+ extern __be32 *xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes);
+ extern void xdr_read_pages(struct xdr_stream *xdr, unsigned int len);
+ extern void xdr_enter_page(struct xdr_stream *xdr, unsigned int len);
+diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
+index 387fa7d..7faf933 100644
+--- a/include/linux/sysrq.h
++++ b/include/linux/sysrq.h
+@@ -17,6 +17,9 @@
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ 
++/* Enable/disable SYSRQ support by default (0==no, 1==yes). */
++#define SYSRQ_DEFAULT_ENABLE	1
++
+ /* Possible values of bitmask for enabling sysrq functions */
+ /* 0x0001 is reserved for enable everything */
+ #define SYSRQ_ENABLE_LOG	0x0002
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index 0b6e751..6c37d78 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -112,6 +112,7 @@ struct usb_hcd {
+ 	/* Flags that get set only during HCD registration or removal. */
+ 	unsigned		rh_registered:1;/* is root hub registered? */
+ 	unsigned		rh_pollable:1;	/* may we poll the root hub? */
++	unsigned		msix_enabled:1;	/* driver has MSI-X enabled? */
+ 
+ 	/* The next flag is a stopgap, to be removed when all the HCDs
+ 	 * support the new root-hub polling mechanism. */
+diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
+index 16d682f..c904913 100644
+--- a/include/linux/usb/serial.h
++++ b/include/linux/usb/serial.h
+@@ -347,6 +347,9 @@ extern int usb_serial_generic_prepare_write_buffer(struct usb_serial_port *port,
+ extern int usb_serial_handle_sysrq_char(struct usb_serial_port *port,
+ 					unsigned int ch);
+ extern int usb_serial_handle_break(struct usb_serial_port *port);
++extern void usb_serial_handle_dcd_change(struct usb_serial_port *usb_port,
++					 struct tty_struct *tty,
++					 unsigned int status);
+ 
+ 
+ extern int usb_serial_bus_register(struct usb_serial_driver *device);
+diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
+index eaaea37..e4cc21c 100644
+--- a/include/linux/vmstat.h
++++ b/include/linux/vmstat.h
+@@ -254,6 +254,8 @@ extern void dec_zone_state(struct zone *, enum zone_stat_item);
+ extern void __dec_zone_state(struct zone *, enum zone_stat_item);
+ 
+ void refresh_cpu_vm_stats(int);
++void reduce_pgdat_percpu_threshold(pg_data_t *pgdat);
++void restore_pgdat_percpu_threshold(pg_data_t *pgdat);
+ #else /* CONFIG_SMP */
+ 
+ /*
+@@ -298,6 +300,9 @@ static inline void __dec_zone_page_state(struct page *page,
+ #define dec_zone_page_state __dec_zone_page_state
+ #define mod_zone_page_state __mod_zone_page_state
+ 
++static inline void reduce_pgdat_percpu_threshold(pg_data_t *pgdat) { }
++static inline void restore_pgdat_percpu_threshold(pg_data_t *pgdat) { }
++
+ static inline void refresh_cpu_vm_stats(int cpu) { }
+ #endif
+ 
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 97b8b7c..772dea2 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -1321,13 +1321,14 @@ struct cfg80211_ops {
+  * 	initiator is %REGDOM_SET_BY_CORE).
+  * @WIPHY_FLAG_STRICT_REGULATORY: tells us the driver for this device will
+  *	ignore regulatory domain settings until it gets its own regulatory
+- *	domain via its regulatory_hint(). After its gets its own regulatory
+- *	domain it will only allow further regulatory domain settings to
+- *	further enhance compliance. For example if channel 13 and 14 are
+- *	disabled by this regulatory domain no user regulatory domain can
+- *	enable these channels at a later time. This can be used for devices
+- *	which do not have calibration information gauranteed for frequencies
+- *	or settings outside of its regulatory domain.
++ *	domain via its regulatory_hint() unless the regulatory hint is
++ *	from a country IE. After its gets its own regulatory domain it will
++ *	only allow further regulatory domain settings to further enhance
++ *	compliance. For example if channel 13 and 14 are disabled by this
++ *	regulatory domain no user regulatory domain can enable these channels
++ *	at a later time. This can be used for devices which do not have
++ *	calibration information guaranteed for frequencies or settings
++ *	outside of its regulatory domain.
+  * @WIPHY_FLAG_DISABLE_BEACON_HINTS: enable this if your driver needs to ensure
+  *	that passive scan flags and beaconing flags may not be lifted by
+  *	cfg80211 due to regulatory beacon hints. For more information on beacon
+diff --git a/include/scsi/scsi.h b/include/scsi/scsi.h
+index 216af85..1933e3c 100644
+--- a/include/scsi/scsi.h
++++ b/include/scsi/scsi.h
+@@ -9,6 +9,7 @@
+ #define _SCSI_SCSI_H
+ 
+ #include <linux/types.h>
++#include <linux/scatterlist.h>
+ 
+ struct scsi_cmnd;
+ 
+diff --git a/init/calibrate.c b/init/calibrate.c
+index 6eb48e5..24fe022 100644
+--- a/init/calibrate.c
++++ b/init/calibrate.c
+@@ -66,7 +66,7 @@ static unsigned long __cpuinit calibrate_delay_direct(void)
+ 		pre_start = 0;
+ 		read_current_timer(&start);
+ 		start_jiffies = jiffies;
+-		while (jiffies <= (start_jiffies + 1)) {
++		while (time_before_eq(jiffies, start_jiffies + 1)) {
+ 			pre_start = start;
+ 			read_current_timer(&start);
+ 		}
+@@ -74,8 +74,8 @@ static unsigned long __cpuinit calibrate_delay_direct(void)
+ 
+ 		pre_end = 0;
+ 		end = post_start;
+-		while (jiffies <=
+-		       (start_jiffies + 1 + DELAY_CALIBRATION_TICKS)) {
++		while (time_before_eq(jiffies, start_jiffies + 1 +
++					       DELAY_CALIBRATION_TICKS)) {
+ 			pre_end = end;
+ 			read_current_timer(&end);
+ 		}
+diff --git a/kernel/irq/migration.c b/kernel/irq/migration.c
+index 1d25419..441fd62 100644
+--- a/kernel/irq/migration.c
++++ b/kernel/irq/migration.c
+@@ -56,6 +56,7 @@ void move_masked_irq(int irq)
+ void move_native_irq(int irq)
+ {
+ 	struct irq_desc *desc = irq_to_desc(irq);
++	bool masked;
+ 
+ 	if (likely(!(desc->status & IRQ_MOVE_PENDING)))
+ 		return;
+@@ -63,8 +64,15 @@ void move_native_irq(int irq)
+ 	if (unlikely(desc->status & IRQ_DISABLED))
+ 		return;
+ 
+-	desc->irq_data.chip->irq_mask(&desc->irq_data);
++	/*
++	 * Be careful vs. already masked interrupts. If this is a
++	 * threaded interrupt with ONESHOT set, we can end up with an
++	 * interrupt storm.
++	 */
++	masked = desc->status & IRQ_MASKED;
++	if (!masked)
++		desc->irq_data.chip->irq_mask(&desc->irq_data);
+ 	move_masked_irq(irq);
+-	desc->irq_data.chip->irq_unmask(&desc->irq_data);
++	if (!masked)
++		desc->irq_data.chip->irq_unmask(&desc->irq_data);
+ }
+-
+diff --git a/kernel/perf_event.c b/kernel/perf_event.c
+index 2870fee..64668bd 100644
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -1872,8 +1872,7 @@ static int alloc_callchain_buffers(void)
+ 	 * accessed from NMI. Use a temporary manual per cpu allocation
+ 	 * until that gets sorted out.
+ 	 */
+-	size = sizeof(*entries) + sizeof(struct perf_callchain_entry *) *
+-		num_possible_cpus();
++	size = offsetof(struct callchain_cpus_entries, cpu_entries[nr_cpu_ids]);
+ 
+ 	entries = kzalloc(size, GFP_KERNEL);
+ 	if (!entries)
+@@ -2101,14 +2100,11 @@ find_get_context(struct pmu *pmu, struct task_struct *task, int cpu)
+ 	unsigned long flags;
+ 	int ctxn, err;
+ 
+-	if (!task && cpu != -1) {
++	if (!task) {
+ 		/* Must be root to operate on a CPU event: */
+ 		if (perf_paranoid_cpu() && !capable(CAP_SYS_ADMIN))
+ 			return ERR_PTR(-EACCES);
+ 
+-		if (cpu < 0 || cpu >= nr_cpumask_bits)
+-			return ERR_PTR(-EINVAL);
+-
+ 		/*
+ 		 * We could be clever and allow to attach a event to an
+ 		 * offline CPU and activate it when the CPU comes up, but
+@@ -5305,6 +5301,11 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+ 	struct hw_perf_event *hwc;
+ 	long err;
+ 
++	if ((unsigned)cpu >= nr_cpu_ids) {
++		if (!task || cpu != -1)
++			return ERR_PTR(-EINVAL);
++	}
++
+ 	event = kzalloc(sizeof(*event), GFP_KERNEL);
+ 	if (!event)
+ 		return ERR_PTR(-ENOMEM);
+@@ -5353,7 +5354,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+ 
+ 	if (!overflow_handler && parent_event)
+ 		overflow_handler = parent_event->overflow_handler;
+-	
++
+ 	event->overflow_handler	= overflow_handler;
+ 
+ 	if (attr->disabled)
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index 99bbaa3..1708b1e 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -313,7 +313,7 @@ int ptrace_detach(struct task_struct *child, unsigned int data)
+ 		child->exit_code = data;
+ 		dead = __ptrace_detach(current, child);
+ 		if (!child->exit_state)
+-			wake_up_process(child);
++			wake_up_state(child, TASK_TRACED | TASK_STOPPED);
+ 	}
+ 	write_unlock_irq(&tasklist_lock);
+ 
+diff --git a/kernel/sched.c b/kernel/sched.c
+index 297d1a0..2f912b7 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -607,6 +607,9 @@ static inline struct task_group *task_group(struct task_struct *p)
+ {
+ 	struct cgroup_subsys_state *css;
+ 
++	if (p->flags & PF_EXITING)
++		return &root_task_group;
++
+ 	css = task_subsys_state_check(p, cpu_cgroup_subsys_id,
+ 			lockdep_is_held(&task_rq(p)->lock));
+ 	return container_of(css, struct task_group, css);
+@@ -4526,7 +4529,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
+  * This waits for either a completion of a specific task to be signaled or for a
+  * specified timeout to expire. It is interruptible. The timeout is in jiffies.
+  */
+-unsigned long __sched
++long __sched
+ wait_for_completion_interruptible_timeout(struct completion *x,
+ 					  unsigned long timeout)
+ {
+@@ -4559,7 +4562,7 @@ EXPORT_SYMBOL(wait_for_completion_killable);
+  * signaled or for a specified timeout to expire. It can be
+  * interrupted by a kill signal. The timeout is in jiffies.
+  */
+-unsigned long __sched
++long __sched
+ wait_for_completion_killable_timeout(struct completion *x,
+ 				     unsigned long timeout)
+ {
+@@ -9178,6 +9181,20 @@ cpu_cgroup_attach(struct cgroup_subsys *ss, struct cgroup *cgrp,
+ 	}
+ }
+ 
++static void
++cpu_cgroup_exit(struct cgroup_subsys *ss, struct task_struct *task)
++{
++	/*
++	 * cgroup_exit() is called in the copy_process() failure path.
++	 * Ignore this case since the task hasn't ran yet, this avoids
++	 * trying to poke a half freed task state from generic code.
++	 */
++	if (!(task->flags & PF_EXITING))
++		return;
++
++	sched_move_task(task);
++}
++
+ #ifdef CONFIG_FAIR_GROUP_SCHED
+ static int cpu_shares_write_u64(struct cgroup *cgrp, struct cftype *cftype,
+ 				u64 shareval)
+@@ -9250,6 +9267,7 @@ struct cgroup_subsys cpu_cgroup_subsys = {
+ 	.destroy	= cpu_cgroup_destroy,
+ 	.can_attach	= cpu_cgroup_can_attach,
+ 	.attach		= cpu_cgroup_attach,
++	.exit		= cpu_cgroup_exit,
+ 	.populate	= cpu_cgroup_populate,
+ 	.subsys_id	= cpu_cgroup_subsys_id,
+ 	.early_init	= 1,
+diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
+index bea7d79..c5f1d23 100644
+--- a/kernel/sched_rt.c
++++ b/kernel/sched_rt.c
+@@ -606,7 +606,7 @@ static void update_curr_rt(struct rq *rq)
+ 	struct rt_rq *rt_rq = rt_rq_of_se(rt_se);
+ 	u64 delta_exec;
+ 
+-	if (!task_has_rt_policy(curr))
++	if (curr->sched_class != &rt_sched_class)
+ 		return;
+ 
+ 	delta_exec = rq->clock_task - curr->se.exec_start;
+diff --git a/kernel/smp.c b/kernel/smp.c
+index 12ed8b0..8448f8f 100644
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -194,6 +194,24 @@ void generic_smp_call_function_interrupt(void)
+ 	list_for_each_entry_rcu(data, &call_function.queue, csd.list) {
+ 		int refs;
+ 
++		/*
++		 * Since we walk the list without any locks, we might
++		 * see an entry that was completed, removed from the
++		 * list and is in the process of being reused.
++		 *
++		 * We must check that the cpu is in the cpumask before
++		 * checking the refs, and both must be set before
++		 * executing the callback on this cpu.
++		 */
++
++		if (!cpumask_test_cpu(cpu, data->cpumask))
++			continue;
++
++		smp_rmb();
++
++		if (atomic_read(&data->refs) == 0)
++			continue;
++
+ 		if (!cpumask_test_and_clear_cpu(cpu, data->cpumask))
+ 			continue;
+ 
+@@ -202,6 +220,8 @@ void generic_smp_call_function_interrupt(void)
+ 		refs = atomic_dec_return(&data->refs);
+ 		WARN_ON(refs < 0);
+ 		if (!refs) {
++			WARN_ON(!cpumask_empty(data->cpumask));
++
+ 			raw_spin_lock(&call_function.lock);
+ 			list_del_rcu(&data->csd.list);
+ 			raw_spin_unlock(&call_function.lock);
+@@ -453,11 +473,21 @@ void smp_call_function_many(const struct cpumask *mask,
+ 
+ 	data = &__get_cpu_var(cfd_data);
+ 	csd_lock(&data->csd);
++	BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask));
+ 
+ 	data->csd.func = func;
+ 	data->csd.info = info;
+ 	cpumask_and(data->cpumask, mask, cpu_online_mask);
+ 	cpumask_clear_cpu(this_cpu, data->cpumask);
++
++	/*
++	 * To ensure the interrupt handler gets an complete view
++	 * we order the cpumask and refs writes and order the read
++	 * of them in the interrupt handler.  In addition we may
++	 * only clear our own cpu bit from the mask.
++	 */
++	smp_wmb();
++
+ 	atomic_set(&data->refs, cpumask_weight(data->cpumask));
+ 
+ 	raw_spin_lock_irqsave(&call_function.lock, flags);
+diff --git a/kernel/sys.c b/kernel/sys.c
+index 7f5a0cd..66136ca 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1377,7 +1377,8 @@ static int check_prlimit_permission(struct task_struct *task)
+ 	const struct cred *cred = current_cred(), *tcred;
+ 
+ 	tcred = __task_cred(task);
+-	if ((cred->uid != tcred->euid ||
++	if (current != task &&
++	    (cred->uid != tcred->euid ||
+ 	     cred->uid != tcred->suid ||
+ 	     cred->uid != tcred->uid  ||
+ 	     cred->gid != tcred->egid ||
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 5abfa15..4e17828 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -169,7 +169,8 @@ static int proc_taint(struct ctl_table *table, int write,
+ #endif
+ 
+ #ifdef CONFIG_MAGIC_SYSRQ
+-static int __sysrq_enabled; /* Note: sysrq code ises it's own private copy */
++/* Note: sysrq code uses it's own private copy */
++static int __sysrq_enabled = SYSRQ_DEFAULT_ENABLE;
+ 
+ static int sysrq_sysctl_handler(ctl_table *table, int write,
+ 				void __user *buffer, size_t *lenp,
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index f8cf959..dc53ecb 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1313,12 +1313,10 @@ ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
+ 
+ 	__this_cpu_inc(user_stack_count);
+ 
+-
+-
+ 	event = trace_buffer_lock_reserve(buffer, TRACE_USER_STACK,
+ 					  sizeof(*entry), flags, pc);
+ 	if (!event)
+-		return;
++		goto out_drop_count;
+ 	entry	= ring_buffer_event_data(event);
+ 
+ 	entry->tgid		= current->tgid;
+@@ -1333,8 +1331,8 @@ ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
+ 	if (!filter_check_discard(call, entry, buffer, event))
+ 		ring_buffer_unlock_commit(buffer, event);
+ 
++ out_drop_count:
+ 	__this_cpu_dec(user_stack_count);
+-
+  out:
+ 	preempt_enable();
+ }
+diff --git a/kernel/watchdog.c b/kernel/watchdog.c
+index 5b08215..32a9ce5 100644
+--- a/kernel/watchdog.c
++++ b/kernel/watchdog.c
+@@ -27,7 +27,7 @@
+ #include <asm/irq_regs.h>
+ #include <linux/perf_event.h>
+ 
+-int watchdog_enabled;
++int watchdog_enabled = 1;
+ int __read_mostly softlockup_thresh = 60;
+ 
+ static DEFINE_PER_CPU(unsigned long, watchdog_touch_ts);
+@@ -43,9 +43,6 @@ static DEFINE_PER_CPU(unsigned long, hrtimer_interrupts_saved);
+ static DEFINE_PER_CPU(struct perf_event *, watchdog_ev);
+ #endif
+ 
+-static int no_watchdog;
+-
+-
+ /* boot commands */
+ /*
+  * Should we panic when a soft-lockup or hard-lockup occurs:
+@@ -75,7 +72,7 @@ __setup("softlockup_panic=", softlockup_panic_setup);
+ 
+ static int __init nowatchdog_setup(char *str)
+ {
+-	no_watchdog = 1;
++	watchdog_enabled = 0;
+ 	return 1;
+ }
+ __setup("nowatchdog", nowatchdog_setup);
+@@ -83,7 +80,7 @@ __setup("nowatchdog", nowatchdog_setup);
+ /* deprecated */
+ static int __init nosoftlockup_setup(char *str)
+ {
+-	no_watchdog = 1;
++	watchdog_enabled = 0;
+ 	return 1;
+ }
+ __setup("nosoftlockup", nosoftlockup_setup);
+@@ -430,9 +427,6 @@ static int watchdog_enable(int cpu)
+ 		wake_up_process(p);
+ 	}
+ 
+-	/* if any cpu succeeds, watchdog is considered enabled for the system */
+-	watchdog_enabled = 1;
+-
+ 	return 0;
+ }
+ 
+@@ -460,12 +454,16 @@ static void watchdog_disable(int cpu)
+ static void watchdog_enable_all_cpus(void)
+ {
+ 	int cpu;
+-	int result = 0;
++
++	watchdog_enabled = 0;
+ 
+ 	for_each_online_cpu(cpu)
+-		result += watchdog_enable(cpu);
++		if (!watchdog_enable(cpu))
++			/* if any cpu succeeds, watchdog is considered
++			   enabled for the system */
++			watchdog_enabled = 1;
+ 
+-	if (result)
++	if (!watchdog_enabled)
+ 		printk(KERN_ERR "watchdog: failed to be enabled on some cpus\n");
+ 
+ }
+@@ -474,9 +472,6 @@ static void watchdog_disable_all_cpus(void)
+ {
+ 	int cpu;
+ 
+-	if (no_watchdog)
+-		return;
+-
+ 	for_each_online_cpu(cpu)
+ 		watchdog_disable(cpu);
+ 
+@@ -496,10 +491,12 @@ int proc_dowatchdog_enabled(struct ctl_table *table, int write,
+ {
+ 	proc_dointvec(table, write, buffer, length, ppos);
+ 
+-	if (watchdog_enabled)
+-		watchdog_enable_all_cpus();
+-	else
+-		watchdog_disable_all_cpus();
++	if (write) {
++		if (watchdog_enabled)
++			watchdog_enable_all_cpus();
++		else
++			watchdog_disable_all_cpus();
++	}
+ 	return 0;
+ }
+ 
+@@ -528,7 +525,8 @@ cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
+ 		break;
+ 	case CPU_ONLINE:
+ 	case CPU_ONLINE_FROZEN:
+-		err = watchdog_enable(hotcpu);
++		if (watchdog_enabled)
++			err = watchdog_enable(hotcpu);
+ 		break;
+ #ifdef CONFIG_HOTPLUG_CPU
+ 	case CPU_UP_CANCELED:
+@@ -553,9 +551,6 @@ static int __init spawn_watchdog_task(void)
+ 	void *cpu = (void *)(long)smp_processor_id();
+ 	int err;
+ 
+-	if (no_watchdog)
+-		return 0;
+-
+ 	err = cpu_callback(&cpu_nfb, CPU_UP_PREPARE, cpu);
+ 	WARN_ON(notifier_to_errno(err));
+ 
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index e785b0f..4be7fa5 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1806,7 +1806,7 @@ __acquires(&gcwq->lock)
+ 	spin_unlock_irq(&gcwq->lock);
+ 
+ 	work_clear_pending(work);
+-	lock_map_acquire(&cwq->wq->lockdep_map);
++	lock_map_acquire_read(&cwq->wq->lockdep_map);
+ 	lock_map_acquire(&lockdep_map);
+ 	trace_workqueue_execute_start(work);
+ 	f(work);
+@@ -2350,8 +2350,18 @@ static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr,
+ 	insert_wq_barrier(cwq, barr, work, worker);
+ 	spin_unlock_irq(&gcwq->lock);
+ 
+-	lock_map_acquire(&cwq->wq->lockdep_map);
++	/*
++	 * If @max_active is 1 or rescuer is in use, flushing another work
++	 * item on the same workqueue may lead to deadlock.  Make sure the
++	 * flusher is not running on the same workqueue by verifying write
++	 * access.
++	 */
++	if (cwq->wq->saved_max_active == 1 || cwq->wq->flags & WQ_RESCUER)
++		lock_map_acquire(&cwq->wq->lockdep_map);
++	else
++		lock_map_acquire_read(&cwq->wq->lockdep_map);
+ 	lock_map_release(&cwq->wq->lockdep_map);
++
+ 	return true;
+ already_gone:
+ 	spin_unlock_irq(&gcwq->lock);
+diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
+index 3094318..b335acb 100644
+--- a/lib/dynamic_debug.c
++++ b/lib/dynamic_debug.c
+@@ -141,11 +141,10 @@ static void ddebug_change(const struct ddebug_query *query,
+ 			else if (!dp->flags)
+ 				dt->num_enabled++;
+ 			dp->flags = newflags;
+-			if (newflags) {
+-				jump_label_enable(&dp->enabled);
+-			} else {
+-				jump_label_disable(&dp->enabled);
+-			}
++			if (newflags)
++				dp->enabled = 1;
++			else
++				dp->enabled = 0;
+ 			if (verbose)
+ 				printk(KERN_INFO
+ 					"ddebug: changed %s:%d [%s]%s %s\n",
+diff --git a/lib/kref.c b/lib/kref.c
+index d3d227a..e7a6e10 100644
+--- a/lib/kref.c
++++ b/lib/kref.c
+@@ -37,6 +37,18 @@ void kref_get(struct kref *kref)
+ }
+ 
+ /**
++ * kref_test_and_get - increment refcount for object only if refcount is not
++ * zero.
++ * @kref: object.
++ *
++ * Return non-zero if the refcount was incremented, 0 otherwise
++ */
++int kref_test_and_get(struct kref *kref)
++{
++	return atomic_inc_not_zero(&kref->refcount);
++}
++
++/**
+  * kref_put - decrement refcount for object.
+  * @kref: object.
+  * @release: pointer to the function that will clean up the object when the
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 00bb8a6..d7a1e3d 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1842,6 +1842,7 @@ static int __mem_cgroup_do_charge(struct mem_cgroup *mem, gfp_t gfp_mask,
+ 		if (likely(!ret))
+ 			return CHARGE_OK;
+ 
++		res_counter_uncharge(&mem->res, csize);
+ 		mem_over_limit = mem_cgroup_from_res_counter(fail_res, memsw);
+ 		flags |= MEM_CGROUP_RECLAIM_NOSWAP;
+ 	} else
+@@ -4929,9 +4930,9 @@ struct cgroup_subsys mem_cgroup_subsys = {
+ static int __init enable_swap_account(char *s)
+ {
+ 	/* consider enabled if no parameter or 1 is given */
+-	if (!s || !strcmp(s, "1"))
++	if (!(*s) || !strcmp(s, "=1"))
+ 		really_do_swap_account = 1;
+-	else if (!strcmp(s, "0"))
++	else if (!strcmp(s, "=0"))
+ 		really_do_swap_account = 0;
+ 	return 1;
+ }
+@@ -4939,7 +4940,7 @@ __setup("swapaccount", enable_swap_account);
+ 
+ static int __init disable_swap_account(char *s)
+ {
+-	enable_swap_account("0");
++	enable_swap_account("=0");
+ 	return 1;
+ }
+ __setup("noswapaccount", disable_swap_account);
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 2c6523a..83163c0 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -407,6 +407,7 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
+ 	int ret;
+ 	struct memory_notify arg;
+ 
++	lock_memory_hotplug();
+ 	arg.start_pfn = pfn;
+ 	arg.nr_pages = nr_pages;
+ 	arg.status_change_nid = -1;
+@@ -419,6 +420,7 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
+ 	ret = notifier_to_errno(ret);
+ 	if (ret) {
+ 		memory_notify(MEM_CANCEL_ONLINE, &arg);
++		unlock_memory_hotplug();
+ 		return ret;
+ 	}
+ 	/*
+@@ -443,6 +445,7 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
+ 		printk(KERN_DEBUG "online_pages %lx at %lx failed\n",
+ 			nr_pages, pfn);
+ 		memory_notify(MEM_CANCEL_ONLINE, &arg);
++		unlock_memory_hotplug();
+ 		return ret;
+ 	}
+ 
+@@ -467,6 +470,7 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
+ 
+ 	if (onlined_pages)
+ 		memory_notify(MEM_ONLINE, &arg);
++	unlock_memory_hotplug();
+ 
+ 	return 0;
+ }
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 6ae8a66..87e7e3a 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -246,7 +246,7 @@ static int migrate_page_move_mapping(struct address_space *mapping,
+ 
+ 	expected_count = 2 + page_has_private(page);
+ 	if (page_count(page) != expected_count ||
+-			(struct page *)radix_tree_deref_slot(pslot) != page) {
++		radix_tree_deref_slot_protected(pslot, &mapping->tree_lock) != page) {
+ 		spin_unlock_irq(&mapping->tree_lock);
+ 		return -EAGAIN;
+ 	}
+@@ -318,7 +318,7 @@ int migrate_huge_page_move_mapping(struct address_space *mapping,
+ 
+ 	expected_count = 2 + page_has_private(page);
+ 	if (page_count(page) != expected_count ||
+-	    (struct page *)radix_tree_deref_slot(pslot) != page) {
++		radix_tree_deref_slot_protected(pslot, &mapping->tree_lock) != page) {
+ 		spin_unlock_irq(&mapping->tree_lock);
+ 		return -EAGAIN;
+ 	}
+@@ -620,7 +620,6 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
+ 	int *result = NULL;
+ 	struct page *newpage = get_new_page(page, private, &result);
+ 	int remap_swapcache = 1;
+-	int rcu_locked = 0;
+ 	int charge = 0;
+ 	struct mem_cgroup *mem = NULL;
+ 	struct anon_vma *anon_vma = NULL;
+@@ -672,20 +671,26 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
+ 	/*
+ 	 * By try_to_unmap(), page->mapcount goes down to 0 here. In this case,
+ 	 * we cannot notice that anon_vma is freed while we migrates a page.
+-	 * This rcu_read_lock() delays freeing anon_vma pointer until the end
++	 * This get_anon_vma() delays freeing anon_vma pointer until the end
+ 	 * of migration. File cache pages are no problem because of page_lock()
+ 	 * File Caches may use write_page() or lock_page() in migration, then,
+ 	 * just care Anon page here.
+ 	 */
+ 	if (PageAnon(page)) {
+-		rcu_read_lock();
+-		rcu_locked = 1;
+-
+-		/* Determine how to safely use anon_vma */
+-		if (!page_mapped(page)) {
+-			if (!PageSwapCache(page))
+-				goto rcu_unlock;
+-
++		/*
++		 * Only page_lock_anon_vma() understands the subtleties of
++		 * getting a hold on an anon_vma from outside one of its mms.
++		 */
++		anon_vma = page_lock_anon_vma(page);
++		if (anon_vma) {
++			/*
++			 * Take a reference count on the anon_vma if the
++			 * page is mapped so that it is guaranteed to
++			 * exist when the page is remapped later
++			 */
++			get_anon_vma(anon_vma);
++			page_unlock_anon_vma(anon_vma);
++		} else if (PageSwapCache(page)) {
+ 			/*
+ 			 * We cannot be sure that the anon_vma of an unmapped
+ 			 * swapcache page is safe to use because we don't
+@@ -700,13 +705,7 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
+ 			 */
+ 			remap_swapcache = 0;
+ 		} else {
+-			/*
+-			 * Take a reference count on the anon_vma if the
+-			 * page is mapped so that it is guaranteed to
+-			 * exist when the page is remapped later
+-			 */
+-			anon_vma = page_anon_vma(page);
+-			get_anon_vma(anon_vma);
++			goto uncharge;
+ 		}
+ 	}
+ 
+@@ -723,16 +722,10 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
+ 	 * free the metadata, so the page can be freed.
+ 	 */
+ 	if (!page->mapping) {
+-		if (!PageAnon(page) && page_has_private(page)) {
+-			/*
+-			 * Go direct to try_to_free_buffers() here because
+-			 * a) that's what try_to_release_page() would do anyway
+-			 * b) we may be under rcu_read_lock() here, so we can't
+-			 *    use GFP_KERNEL which is what try_to_release_page()
+-			 *    needs to be effective.
+-			 */
++		VM_BUG_ON(PageAnon(page));
++		if (page_has_private(page)) {
+ 			try_to_free_buffers(page);
+-			goto rcu_unlock;
++			goto uncharge;
+ 		}
+ 		goto skip_unmap;
+ 	}
+@@ -746,14 +739,11 @@ skip_unmap:
+ 
+ 	if (rc && remap_swapcache)
+ 		remove_migration_ptes(page, page);
+-rcu_unlock:
+ 
+ 	/* Drop an anon_vma reference if we took one */
+ 	if (anon_vma)
+ 		drop_anon_vma(anon_vma);
+ 
+-	if (rcu_locked)
+-		rcu_read_unlock();
+ uncharge:
+ 	if (!charge)
+ 		mem_cgroup_end_migration(mem, page, newpage);
+@@ -815,7 +805,6 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
+ 	int rc = 0;
+ 	int *result = NULL;
+ 	struct page *new_hpage = get_new_page(hpage, private, &result);
+-	int rcu_locked = 0;
+ 	struct anon_vma *anon_vma = NULL;
+ 
+ 	if (!new_hpage)
+@@ -830,12 +819,10 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
+ 	}
+ 
+ 	if (PageAnon(hpage)) {
+-		rcu_read_lock();
+-		rcu_locked = 1;
+-
+-		if (page_mapped(hpage)) {
+-			anon_vma = page_anon_vma(hpage);
+-			atomic_inc(&anon_vma->external_refcount);
++		anon_vma = page_lock_anon_vma(hpage);
++		if (anon_vma) {
++			get_anon_vma(anon_vma);
++			page_unlock_anon_vma(anon_vma);
+ 		}
+ 	}
+ 
+@@ -847,16 +834,8 @@ static int unmap_and_move_huge_page(new_page_t get_new_page,
+ 	if (rc)
+ 		remove_migration_ptes(hpage, hpage);
+ 
+-	if (anon_vma && atomic_dec_and_lock(&anon_vma->external_refcount,
+-					    &anon_vma->lock)) {
+-		int empty = list_empty(&anon_vma->head);
+-		spin_unlock(&anon_vma->lock);
+-		if (empty)
+-			anon_vma_free(anon_vma);
+-	}
+-
+-	if (rcu_locked)
+-		rcu_read_unlock();
++	if (anon_vma)
++		drop_anon_vma(anon_vma);
+ out:
+ 	unlock_page(hpage);
+ 
+diff --git a/mm/mmzone.c b/mm/mmzone.c
+index e35bfb8..f5b7d17 100644
+--- a/mm/mmzone.c
++++ b/mm/mmzone.c
+@@ -87,24 +87,3 @@ int memmap_valid_within(unsigned long pfn,
+ 	return 1;
+ }
+ #endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */
+-
+-#ifdef CONFIG_SMP
+-/* Called when a more accurate view of NR_FREE_PAGES is needed */
+-unsigned long zone_nr_free_pages(struct zone *zone)
+-{
+-	unsigned long nr_free_pages = zone_page_state(zone, NR_FREE_PAGES);
+-
+-	/*
+-	 * While kswapd is awake, it is considered the zone is under some
+-	 * memory pressure. Under pressure, there is a risk that
+-	 * per-cpu-counter-drift will allow the min watermark to be breached
+-	 * potentially causing a live-lock. While kswapd is awake and
+-	 * free pages are low, get a better estimate for free pages
+-	 */
+-	if (nr_free_pages < zone->percpu_drift_mark &&
+-			!waitqueue_active(&zone->zone_pgdat->kswapd_wait))
+-		return zone_page_state_snapshot(zone, NR_FREE_PAGES);
+-
+-	return nr_free_pages;
+-}
+-#endif /* CONFIG_SMP */
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index ff7e158..91b6d8c 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1460,24 +1460,24 @@ static inline int should_fail_alloc_page(gfp_t gfp_mask, unsigned int order)
+ #endif /* CONFIG_FAIL_PAGE_ALLOC */
+ 
+ /*
+- * Return 1 if free pages are above 'mark'. This takes into account the order
++ * Return true if free pages are above 'mark'. This takes into account the order
+  * of the allocation.
+  */
+-int zone_watermark_ok(struct zone *z, int order, unsigned long mark,
+-		      int classzone_idx, int alloc_flags)
++static bool __zone_watermark_ok(struct zone *z, int order, unsigned long mark,
++		      int classzone_idx, int alloc_flags, long free_pages)
+ {
+ 	/* free_pages my go negative - that's OK */
+ 	long min = mark;
+-	long free_pages = zone_nr_free_pages(z) - (1 << order) + 1;
+ 	int o;
+ 
++	free_pages -= (1 << order) + 1;
+ 	if (alloc_flags & ALLOC_HIGH)
+ 		min -= min / 2;
+ 	if (alloc_flags & ALLOC_HARDER)
+ 		min -= min / 4;
+ 
+ 	if (free_pages <= min + z->lowmem_reserve[classzone_idx])
+-		return 0;
++		return false;
+ 	for (o = 0; o < order; o++) {
+ 		/* At the next order, this order's pages become unavailable */
+ 		free_pages -= z->free_area[o].nr_free << o;
+@@ -1486,9 +1486,28 @@ int zone_watermark_ok(struct zone *z, int order, unsigned long mark,
+ 		min >>= 1;
+ 
+ 		if (free_pages <= min)
+-			return 0;
++			return false;
+ 	}
+-	return 1;
++	return true;
++}
++
++bool zone_watermark_ok(struct zone *z, int order, unsigned long mark,
++		      int classzone_idx, int alloc_flags)
++{
++	return __zone_watermark_ok(z, order, mark, classzone_idx, alloc_flags,
++					zone_page_state(z, NR_FREE_PAGES));
++}
++
++bool zone_watermark_ok_safe(struct zone *z, int order, unsigned long mark,
++		      int classzone_idx, int alloc_flags)
++{
++	long free_pages = zone_page_state(z, NR_FREE_PAGES);
++
++	if (z->percpu_drift_mark && free_pages < z->percpu_drift_mark)
++		free_pages = zone_page_state_snapshot(z, NR_FREE_PAGES);
++
++	return __zone_watermark_ok(z, order, mark, classzone_idx, alloc_flags,
++								free_pages);
+ }
+ 
+ #ifdef CONFIG_NUMA
+@@ -2442,7 +2461,7 @@ void show_free_areas(void)
+ 			" all_unreclaimable? %s"
+ 			"\n",
+ 			zone->name,
+-			K(zone_nr_free_pages(zone)),
++			K(zone_page_state(zone, NR_FREE_PAGES)),
+ 			K(min_wmark_pages(zone)),
+ 			K(low_wmark_pages(zone)),
+ 			K(high_wmark_pages(zone)),
+diff --git a/mm/slub.c b/mm/slub.c
+index bec0e35..96e6907 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -3821,7 +3821,7 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
+ 		}
+ 	}
+ 
+-	down_read(&slub_lock);
++	lock_memory_hotplug();
+ #ifdef CONFIG_SLUB_DEBUG
+ 	if (flags & SO_ALL) {
+ 		for_each_node_state(node, N_NORMAL_MEMORY) {
+@@ -3862,7 +3862,7 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
+ 			x += sprintf(buf + x, " N%d=%lu",
+ 					node, nodes[node]);
+ #endif
+-	up_read(&slub_lock);
++	unlock_memory_hotplug();
+ 	kfree(nodes);
+ 	return x + sprintf(buf + x, "\n");
+ }
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 9ca587c..5da4295 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2143,7 +2143,7 @@ static int sleeping_prematurely(pg_data_t *pgdat, int order, long remaining)
+ 		if (zone->all_unreclaimable)
+ 			continue;
+ 
+-		if (!zone_watermark_ok(zone, order, high_wmark_pages(zone),
++		if (!zone_watermark_ok_safe(zone, order, high_wmark_pages(zone),
+ 								0, 0))
+ 			return 1;
+ 	}
+@@ -2230,7 +2230,7 @@ loop_again:
+ 				shrink_active_list(SWAP_CLUSTER_MAX, zone,
+ 							&sc, priority, 0);
+ 
+-			if (!zone_watermark_ok(zone, order,
++			if (!zone_watermark_ok_safe(zone, order,
+ 					high_wmark_pages(zone), 0, 0)) {
+ 				end_zone = i;
+ 				break;
+@@ -2276,7 +2276,7 @@ loop_again:
+ 			 * We put equal pressure on every zone, unless one
+ 			 * zone has way too many pages free already.
+ 			 */
+-			if (!zone_watermark_ok(zone, order,
++			if (!zone_watermark_ok_safe(zone, order,
+ 					8*high_wmark_pages(zone), end_zone, 0))
+ 				shrink_zone(priority, zone, &sc);
+ 			reclaim_state->reclaimed_slab = 0;
+@@ -2297,7 +2297,7 @@ loop_again:
+ 			    total_scanned > sc.nr_reclaimed + sc.nr_reclaimed / 2)
+ 				sc.may_writepage = 1;
+ 
+-			if (!zone_watermark_ok(zone, order,
++			if (!zone_watermark_ok_safe(zone, order,
+ 					high_wmark_pages(zone), end_zone, 0)) {
+ 				all_zones_ok = 0;
+ 				/*
+@@ -2305,7 +2305,7 @@ loop_again:
+ 				 * means that we have a GFP_ATOMIC allocation
+ 				 * failure risk. Hurry up!
+ 				 */
+-				if (!zone_watermark_ok(zone, order,
++				if (!zone_watermark_ok_safe(zone, order,
+ 					    min_wmark_pages(zone), end_zone, 0))
+ 					has_under_min_watermark_zone = 1;
+ 			} else {
+@@ -2448,7 +2448,9 @@ static int kswapd(void *p)
+ 				 */
+ 				if (!sleeping_prematurely(pgdat, order, remaining)) {
+ 					trace_mm_vmscan_kswapd_sleep(pgdat->node_id);
++					restore_pgdat_percpu_threshold(pgdat);
+ 					schedule();
++					reduce_pgdat_percpu_threshold(pgdat);
+ 				} else {
+ 					if (remaining)
+ 						count_vm_event(KSWAPD_LOW_WMARK_HIT_QUICKLY);
+@@ -2487,16 +2489,17 @@ void wakeup_kswapd(struct zone *zone, int order)
+ 	if (!populated_zone(zone))
+ 		return;
+ 
+-	pgdat = zone->zone_pgdat;
+-	if (zone_watermark_ok(zone, order, low_wmark_pages(zone), 0, 0))
++	if (!cpuset_zone_allowed_hardwall(zone, GFP_KERNEL))
+ 		return;
++	pgdat = zone->zone_pgdat;
+ 	if (pgdat->kswapd_max_order < order)
+ 		pgdat->kswapd_max_order = order;
+-	trace_mm_vmscan_wakeup_kswapd(pgdat->node_id, zone_idx(zone), order);
+-	if (!cpuset_zone_allowed_hardwall(zone, GFP_KERNEL))
+-		return;
+ 	if (!waitqueue_active(&pgdat->kswapd_wait))
+ 		return;
++	if (zone_watermark_ok_safe(zone, order, low_wmark_pages(zone), 0, 0))
++		return;
++
++	trace_mm_vmscan_wakeup_kswapd(pgdat->node_id, zone_idx(zone), order);
+ 	wake_up_interruptible(&pgdat->kswapd_wait);
+ }
+ 
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index 8f62f17..8aff417 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -83,6 +83,30 @@ EXPORT_SYMBOL(vm_stat);
+ 
+ #ifdef CONFIG_SMP
+ 
++static int calculate_pressure_threshold(struct zone *zone)
++{
++	int threshold;
++	int watermark_distance;
++
++	/*
++	 * As vmstats are not up to date, there is drift between the estimated
++	 * and real values. For high thresholds and a high number of CPUs, it
++	 * is possible for the min watermark to be breached while the estimated
++	 * value looks fine. The pressure threshold is a reduced value such
++	 * that even the maximum amount of drift will not accidentally breach
++	 * the min watermark
++	 */
++	watermark_distance = low_wmark_pages(zone) - min_wmark_pages(zone);
++	threshold = max(1, (int)(watermark_distance / num_online_cpus()));
++
++	/*
++	 * Maximum threshold is 125
++	 */
++	threshold = min(125, threshold);
++
++	return threshold;
++}
++
+ static int calculate_threshold(struct zone *zone)
+ {
+ 	int threshold;
+@@ -161,6 +185,48 @@ static void refresh_zone_stat_thresholds(void)
+ 	}
+ }
+ 
++void reduce_pgdat_percpu_threshold(pg_data_t *pgdat)
++{
++	struct zone *zone;
++	int cpu;
++	int threshold;
++	int i;
++
++	get_online_cpus();
++	for (i = 0; i < pgdat->nr_zones; i++) {
++		zone = &pgdat->node_zones[i];
++		if (!zone->percpu_drift_mark)
++			continue;
++
++		threshold = calculate_pressure_threshold(zone);
++		for_each_online_cpu(cpu)
++			per_cpu_ptr(zone->pageset, cpu)->stat_threshold
++							= threshold;
++	}
++	put_online_cpus();
++}
++
++void restore_pgdat_percpu_threshold(pg_data_t *pgdat)
++{
++	struct zone *zone;
++	int cpu;
++	int threshold;
++	int i;
++
++	get_online_cpus();
++	for (i = 0; i < pgdat->nr_zones; i++) {
++		zone = &pgdat->node_zones[i];
++		if (!zone->percpu_drift_mark)
++			continue;
++
++		threshold = calculate_threshold(zone);
++		for_each_online_cpu(cpu)
++			per_cpu_ptr(zone->pageset, cpu)->stat_threshold
++							= threshold;
++	}
++	put_online_cpus();
++}
++
+ /*
+  * For use when we know that interrupts are disabled.
+  */
+@@ -834,7 +900,7 @@ static void zoneinfo_show_print(struct seq_file *m, pg_data_t *pgdat,
+ 		   "\n        scanned  %lu"
+ 		   "\n        spanned  %lu"
+ 		   "\n        present  %lu",
+-		   zone_nr_free_pages(zone),
++		   zone_page_state(zone, NR_FREE_PAGES),
+ 		   min_wmark_pages(zone),
+ 		   low_wmark_pages(zone),
+ 		   high_wmark_pages(zone),
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index bb86d29..6da5dae 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -1392,7 +1392,7 @@ static int ax25_getname(struct socket *sock, struct sockaddr *uaddr,
+ 	ax25_cb *ax25;
+ 	int err = 0;
+ 
+-	memset(fsa, 0, sizeof(fsa));
++	memset(fsa, 0, sizeof(*fsa));
+ 	lock_sock(sk);
+ 	ax25 = ax25_sk(sk);
+ 
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 956a9f4..1c6c3ac 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -817,7 +817,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
+ 	if (regs.len > reglen)
+ 		regs.len = reglen;
+ 
+-	regbuf = vmalloc(reglen);
++	regbuf = vzalloc(reglen);
+ 	if (!regbuf)
+ 		return -ENOMEM;
+ 
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 841c287..b078d90 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1510,6 +1510,9 @@ replay:
+ 			snprintf(ifname, IFNAMSIZ, "%s%%d", ops->kind);
+ 
+ 		dest_net = rtnl_link_get_net(net, tb);
++		if (IS_ERR(dest_net))
++			return PTR_ERR(dest_net);
++
+ 		dev = rtnl_create_link(net, dest_net, ifname, ops, tb);
+ 
+ 		if (IS_ERR(dev))
+diff --git a/net/core/sock.c b/net/core/sock.c
+index e5af8d5..7fd3541 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1907,7 +1907,7 @@ static void sock_def_readable(struct sock *sk, int len)
+ 	rcu_read_lock();
+ 	wq = rcu_dereference(sk->sk_wq);
+ 	if (wq_has_sleeper(wq))
+-		wake_up_interruptible_sync_poll(&wq->wait, POLLIN |
++		wake_up_interruptible_sync_poll(&wq->wait, POLLIN | POLLPRI |
+ 						POLLRDNORM | POLLRDBAND);
+ 	sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
+ 	rcu_read_unlock();
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index 1684408..fb9b94a 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -45,6 +45,7 @@
+ #include <linux/udp.h>
+ #include <linux/inet.h>
+ #include <linux/netfilter_ipv4.h>
++#include <net/inet_ecn.h>
+ 
+ /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6
+  * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c
+@@ -70,11 +71,28 @@ struct ipq {
+ 	__be32		daddr;
+ 	__be16		id;
+ 	u8		protocol;
++	u8		ecn; /* RFC3168 support */
+ 	int             iif;
+ 	unsigned int    rid;
+ 	struct inet_peer *peer;
+ };
+ 
++#define IPFRAG_ECN_CLEAR  0x01 /* one frag had INET_ECN_NOT_ECT */
++#define IPFRAG_ECN_SET_CE 0x04 /* one frag had INET_ECN_CE */
++
++static inline u8 ip4_frag_ecn(u8 tos)
++{
++	tos = (tos & INET_ECN_MASK) + 1;
++	/*
++	 * After the last operation we have (in binary):
++	 * INET_ECN_NOT_ECT => 001
++	 * INET_ECN_ECT_1   => 010
++	 * INET_ECN_ECT_0   => 011
++	 * INET_ECN_CE      => 100
++	 */
++	return (tos & 2) ? 0 : tos;
++}
++
+ static struct inet_frags ip4_frags;
+ 
+ int ip_frag_nqueues(struct net *net)
+@@ -137,6 +155,7 @@ static void ip4_frag_init(struct inet_frag_queue *q, void *a)
+ 
+ 	qp->protocol = arg->iph->protocol;
+ 	qp->id = arg->iph->id;
++	qp->ecn = ip4_frag_ecn(arg->iph->tos);
+ 	qp->saddr = arg->iph->saddr;
+ 	qp->daddr = arg->iph->daddr;
+ 	qp->user = arg->user;
+@@ -316,6 +335,7 @@ static int ip_frag_reinit(struct ipq *qp)
+ 	qp->q.fragments = NULL;
+ 	qp->q.fragments_tail = NULL;
+ 	qp->iif = 0;
++	qp->ecn = 0;
+ 
+ 	return 0;
+ }
+@@ -328,6 +348,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ 	int flags, offset;
+ 	int ihl, end;
+ 	int err = -ENOENT;
++	u8 ecn;
+ 
+ 	if (qp->q.last_in & INET_FRAG_COMPLETE)
+ 		goto err;
+@@ -339,6 +360,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ 		goto err;
+ 	}
+ 
++	ecn = ip4_frag_ecn(ip_hdr(skb)->tos);
+ 	offset = ntohs(ip_hdr(skb)->frag_off);
+ 	flags = offset & ~IP_OFFSET;
+ 	offset &= IP_OFFSET;
+@@ -472,6 +494,7 @@ found:
+ 	}
+ 	qp->q.stamp = skb->tstamp;
+ 	qp->q.meat += skb->len;
++	qp->ecn |= ecn;
+ 	atomic_add(skb->truesize, &qp->q.net->mem);
+ 	if (offset == 0)
+ 		qp->q.last_in |= INET_FRAG_FIRST_IN;
+@@ -583,6 +606,17 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
+ 	iph = ip_hdr(head);
+ 	iph->frag_off = 0;
+ 	iph->tot_len = htons(len);
++	/* RFC3168 5.3 Fragmentation support
++	 * If one fragment had INET_ECN_NOT_ECT,
++	 *	reassembled frame also has INET_ECN_NOT_ECT
++	 * Elif one fragment had INET_ECN_CE
++	 *	reassembled frame also has INET_ECN_CE
++	 */
++	if (qp->ecn & IPFRAG_ECN_CLEAR)
++		iph->tos &= ~INET_ECN_MASK;
++	else if (qp->ecn & IPFRAG_ECN_SET_CE)
++		iph->tos |= INET_ECN_CE;
++
+ 	IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
+ 	qp->q.fragments = NULL;
+ 	qp->q.fragments_tail = NULL;
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 94b5bf1..5f8d242 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -401,6 +401,9 @@ int ip6_forward(struct sk_buff *skb)
+ 		goto drop;
+ 	}
+ 
++	if (skb->pkt_type != PACKET_HOST)
++		goto drop;
++
+ 	skb_forward_csum(skb);
+ 
+ 	/*
+diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
+index 720b7a8..c080a5d 100644
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -187,8 +187,6 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
+ 				     struct ieee80211_mgmt *mgmt,
+ 				     size_t len)
+ {
+-	struct ieee80211_hw *hw = &local->hw;
+-	struct ieee80211_conf *conf = &hw->conf;
+ 	struct tid_ampdu_rx *tid_agg_rx;
+ 	u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
+ 	u8 dialog_token;
+@@ -233,13 +231,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
+ 		goto end_no_lock;
+ 	}
+ 	/* determine default buffer size */
+-	if (buf_size == 0) {
+-		struct ieee80211_supported_band *sband;
+-
+-		sband = local->hw.wiphy->bands[conf->channel->band];
+-		buf_size = IEEE80211_MIN_AMPDU_BUF;
+-		buf_size = buf_size << sband->ht_cap.ampdu_factor;
+-	}
++	if (buf_size == 0)
++		buf_size = IEEE80211_MAX_AMPDU_BUF;
+ 
+ 
+ 	/* examine state machine */
+diff --git a/net/mac80211/key.c b/net/mac80211/key.c
+index ccd676b..aa1b734 100644
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -366,6 +366,12 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key)
+ 	if (!key)
+ 		return;
+ 
++	/*
++	 * Synchronize so the TX path can no longer be using
++	 * this key before we free/remove it.
++	 */
++	synchronize_rcu();
++
+ 	if (key->local)
+ 		ieee80211_key_disable_hw_accel(key);
+ 
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index b01e467..e98668f 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1788,11 +1788,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ 
+ 			fwd_skb = skb_copy(skb, GFP_ATOMIC);
+ 
+-			if (!fwd_skb && net_ratelimit()) {
++			if (!fwd_skb && net_ratelimit())
+ 				printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
+ 						   sdata->name);
++			if (!fwd_skb)
+ 				goto out;
+-			}
+ 
+ 			fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
+ 			memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 7a637b8..2f09db5 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1726,7 +1726,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
+ {
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+ 	struct ieee80211_local *local = sdata->local;
+-	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++	struct ieee80211_tx_info *info;
+ 	int ret = NETDEV_TX_BUSY, head_need;
+ 	u16 ethertype, hdrlen,  meshhdrlen = 0;
+ 	__le16 fc;
+@@ -2017,6 +2017,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
+ 	skb_set_network_header(skb, nh_pos);
+ 	skb_set_transport_header(skb, h_pos);
+ 
++	info = IEEE80211_SKB_CB(skb);
+ 	memset(info, 0, sizeof(*info));
+ 
+ 	dev->trans_start = jiffies;
+@@ -2207,6 +2208,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
+ 
+ 	sdata = vif_to_sdata(vif);
+ 
++	if (!ieee80211_sdata_running(sdata))
++		goto out;
++
+ 	if (tim_offset)
+ 		*tim_offset = 0;
+ 	if (tim_length)
+diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
+index 4dfecb0..aa4d633 100644
+--- a/net/sched/sch_fifo.c
++++ b/net/sched/sch_fifo.c
+@@ -54,8 +54,6 @@ static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc* sch)
+ 
+ 	/* queue full, remove one skb to fulfill the limit */
+ 	skb_head = qdisc_dequeue_head(sch);
+-	sch->bstats.bytes -= qdisc_pkt_len(skb_head);
+-	sch->bstats.packets--;
+ 	sch->qstats.drops++;
+ 	kfree_skb(skb_head);
+ 
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index cd9e841..679cd67 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -552,6 +552,74 @@ void xdr_write_pages(struct xdr_stream *xdr, struct page **pages, unsigned int b
+ }
+ EXPORT_SYMBOL_GPL(xdr_write_pages);
+ 
++static void xdr_set_iov(struct xdr_stream *xdr, struct kvec *iov,
++		__be32 *p, unsigned int len)
++{
++	if (len > iov->iov_len)
++		len = iov->iov_len;
++	if (p == NULL)
++		p = (__be32*)iov->iov_base;
++	xdr->p = p;
++	xdr->end = (__be32*)(iov->iov_base + len);
++	xdr->iov = iov;
++	xdr->page_ptr = NULL;
++}
++
++static int xdr_set_page_base(struct xdr_stream *xdr,
++		unsigned int base, unsigned int len)
++{
++	unsigned int pgnr;
++	unsigned int maxlen;
++	unsigned int pgoff;
++	unsigned int pgend;
++	void *kaddr;
++
++	maxlen = xdr->buf->page_len;
++	if (base >= maxlen)
++		return -EINVAL;
++	maxlen -= base;
++	if (len > maxlen)
++		len = maxlen;
++
++	base += xdr->buf->page_base;
++
++	pgnr = base >> PAGE_SHIFT;
++	xdr->page_ptr = &xdr->buf->pages[pgnr];
++	kaddr = page_address(*xdr->page_ptr);
++
++	pgoff = base & ~PAGE_MASK;
++	xdr->p = (__be32*)(kaddr + pgoff);
++
++	pgend = pgoff + len;
++	if (pgend > PAGE_SIZE)
++		pgend = PAGE_SIZE;
++	xdr->end = (__be32*)(kaddr + pgend);
++	xdr->iov = NULL;
++	return 0;
++}
++
++static void xdr_set_next_page(struct xdr_stream *xdr)
++{
++	unsigned int newbase;
++
++	newbase = (1 + xdr->page_ptr - xdr->buf->pages) << PAGE_SHIFT;
++	newbase -= xdr->buf->page_base;
++
++	if (xdr_set_page_base(xdr, newbase, PAGE_SIZE) < 0)
++		xdr_set_iov(xdr, xdr->buf->tail, NULL, xdr->buf->len);
++}
++
++static bool xdr_set_next_buffer(struct xdr_stream *xdr)
++{
++	if (xdr->page_ptr != NULL)
++		xdr_set_next_page(xdr);
++	else if (xdr->iov == xdr->buf->head) {
++		if (xdr_set_page_base(xdr, 0, PAGE_SIZE) < 0)
++			xdr_set_iov(xdr, xdr->buf->tail, NULL, xdr->buf->len);
++	}
++	return xdr->p != xdr->end;
++}
++
+ /**
+  * xdr_init_decode - Initialize an xdr_stream for decoding data.
+  * @xdr: pointer to xdr_stream struct
+@@ -560,41 +628,67 @@ EXPORT_SYMBOL_GPL(xdr_write_pages);
+  */
+ void xdr_init_decode(struct xdr_stream *xdr, struct xdr_buf *buf, __be32 *p)
+ {
+-	struct kvec *iov = buf->head;
+-	unsigned int len = iov->iov_len;
+-
+-	if (len > buf->len)
+-		len = buf->len;
+ 	xdr->buf = buf;
+-	xdr->iov = iov;
+-	xdr->p = p;
+-	xdr->end = (__be32 *)((char *)iov->iov_base + len);
++	xdr->scratch.iov_base = NULL;
++	xdr->scratch.iov_len = 0;
++	if (buf->head[0].iov_len != 0)
++		xdr_set_iov(xdr, buf->head, p, buf->len);
++	else if (buf->page_len != 0)
++		xdr_set_page_base(xdr, 0, buf->len);
+ }
+ EXPORT_SYMBOL_GPL(xdr_init_decode);
+ 
+-/**
+- * xdr_inline_peek - Allow read-ahead in the XDR data stream
+- * @xdr: pointer to xdr_stream struct
+- * @nbytes: number of bytes of data to decode
+- *
+- * Check if the input buffer is long enough to enable us to decode
+- * 'nbytes' more bytes of data starting at the current position.
+- * If so return the current pointer without updating the current
+- * pointer position.
+- */
+-__be32 * xdr_inline_peek(struct xdr_stream *xdr, size_t nbytes)
++static __be32 * __xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes)
+ {
+ 	__be32 *p = xdr->p;
+ 	__be32 *q = p + XDR_QUADLEN(nbytes);
+ 
+ 	if (unlikely(q > xdr->end || q < p))
+ 		return NULL;
++	xdr->p = q;
+ 	return p;
+ }
+-EXPORT_SYMBOL_GPL(xdr_inline_peek);
+ 
+ /**
+- * xdr_inline_decode - Retrieve non-page XDR data to decode
++ * xdr_set_scratch_buffer - Attach a scratch buffer for decoding data.
++ * @xdr: pointer to xdr_stream struct
++ * @buf: pointer to an empty buffer
++ * @buflen: size of 'buf'
++ *
++ * The scratch buffer is used when decoding from an array of pages.
++ * If an xdr_inline_decode() call spans across page boundaries, then
++ * we copy the data into the scratch buffer in order to allow linear
++ * access.
++ */
++void xdr_set_scratch_buffer(struct xdr_stream *xdr, void *buf, size_t buflen)
++{
++	xdr->scratch.iov_base = buf;
++	xdr->scratch.iov_len = buflen;
++}
++EXPORT_SYMBOL_GPL(xdr_set_scratch_buffer);
++
++static __be32 *xdr_copy_to_scratch(struct xdr_stream *xdr, size_t nbytes)
++{
++	__be32 *p;
++	void *cpdest = xdr->scratch.iov_base;
++	size_t cplen = (char *)xdr->end - (char *)xdr->p;
++
++	if (nbytes > xdr->scratch.iov_len)
++		return NULL;
++	memcpy(cpdest, xdr->p, cplen);
++	cpdest += cplen;
++	nbytes -= cplen;
++	if (!xdr_set_next_buffer(xdr))
++		return NULL;
++	p = __xdr_inline_decode(xdr, nbytes);
++	if (p == NULL)
++		return NULL;
++	memcpy(cpdest, p, nbytes);
++	return xdr->scratch.iov_base;
++}
++
++/**
++ * xdr_inline_decode - Retrieve XDR data to decode
+  * @xdr: pointer to xdr_stream struct
+  * @nbytes: number of bytes of data to decode
+  *
+@@ -605,13 +699,16 @@ EXPORT_SYMBOL_GPL(xdr_inline_peek);
+  */
+ __be32 * xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes)
+ {
+-	__be32 *p = xdr->p;
+-	__be32 *q = p + XDR_QUADLEN(nbytes);
++	__be32 *p;
+ 
+-	if (unlikely(q > xdr->end || q < p))
++	if (nbytes == 0)
++		return xdr->p;
++	if (xdr->p == xdr->end && !xdr_set_next_buffer(xdr))
+ 		return NULL;
+-	xdr->p = q;
+-	return p;
++	p = __xdr_inline_decode(xdr, nbytes);
++	if (p != NULL)
++		return p;
++	return xdr_copy_to_scratch(xdr, nbytes);
+ }
+ EXPORT_SYMBOL_GPL(xdr_inline_decode);
+ 
+@@ -671,16 +768,12 @@ EXPORT_SYMBOL_GPL(xdr_read_pages);
+  */
+ void xdr_enter_page(struct xdr_stream *xdr, unsigned int len)
+ {
+-	char * kaddr = page_address(xdr->buf->pages[0]);
+ 	xdr_read_pages(xdr, len);
+ 	/*
+ 	 * Position current pointer at beginning of tail, and
+ 	 * set remaining message length.
+ 	 */
+-	if (len > PAGE_CACHE_SIZE - xdr->buf->page_base)
+-		len = PAGE_CACHE_SIZE - xdr->buf->page_base;
+-	xdr->p = (__be32 *)(kaddr + xdr->buf->page_base);
+-	xdr->end = (__be32 *)((char *)xdr->p + len);
++	xdr_set_page_base(xdr, 0, len);
+ }
+ EXPORT_SYMBOL_GPL(xdr_enter_page);
+ 
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 2268e67..759bbcb 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1156,7 +1156,7 @@ restart:
+ 		goto restart;
+ 	}
+ 
+-	err = security_unix_stream_connect(sock, other->sk_socket, newsk);
++	err = security_unix_stream_connect(sk, other, newsk);
+ 	if (err) {
+ 		unix_state_unlock(sk);
+ 		goto out_unlock;
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 4b9f891..8ab65f2 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -720,7 +720,9 @@ EXPORT_SYMBOL(freq_reg_info);
+  * on the wiphy with the target_bw specified. Then we can simply use
+  * that below for the desired_bw_khz below.
+  */
+-static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
++static void handle_channel(struct wiphy *wiphy,
++			   enum nl80211_reg_initiator initiator,
++			   enum ieee80211_band band,
+ 			   unsigned int chan_idx)
+ {
+ 	int r;
+@@ -748,8 +750,26 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
+ 			  desired_bw_khz,
+ 			  &reg_rule);
+ 
+-	if (r)
++	if (r) {
++		/*
++		 * We will disable all channels that do not match our
++		 * recieved regulatory rule unless the hint is coming
++		 * from a Country IE and the Country IE had no information
++		 * about a band. The IEEE 802.11 spec allows for an AP
++		 * to send only a subset of the regulatory rules allowed,
++		 * so an AP in the US that only supports 2.4 GHz may only send
++		 * a country IE with information for the 2.4 GHz band
++		 * while 5 GHz is still supported.
++		 */
++		if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
++		    r == -ERANGE)
++			return;
++
++		REG_DBG_PRINT("cfg80211: Disabling freq %d MHz\n",
++			      chan->center_freq);
++		chan->flags = IEEE80211_CHAN_DISABLED;
+ 		return;
++	}
+ 
+ 	power_rule = &reg_rule->power_rule;
+ 	freq_range = &reg_rule->freq_range;
+@@ -784,7 +804,9 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
+ 		chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
+ }
+ 
+-static void handle_band(struct wiphy *wiphy, enum ieee80211_band band)
++static void handle_band(struct wiphy *wiphy,
++			enum ieee80211_band band,
++			enum nl80211_reg_initiator initiator)
+ {
+ 	unsigned int i;
+ 	struct ieee80211_supported_band *sband;
+@@ -793,7 +815,7 @@ static void handle_band(struct wiphy *wiphy, enum ieee80211_band band)
+ 	sband = wiphy->bands[band];
+ 
+ 	for (i = 0; i < sband->n_channels; i++)
+-		handle_channel(wiphy, band, i);
++		handle_channel(wiphy, initiator, band, i);
+ }
+ 
+ static bool ignore_reg_update(struct wiphy *wiphy,
+@@ -809,6 +831,7 @@ static bool ignore_reg_update(struct wiphy *wiphy,
+ 	 * desired regulatory domain set
+ 	 */
+ 	if (wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY && !wiphy->regd &&
++	    initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+ 	    !is_world_regdom(last_request->alpha2))
+ 		return true;
+ 	return false;
+@@ -1030,7 +1053,7 @@ void wiphy_update_regulatory(struct wiphy *wiphy,
+ 		goto out;
+ 	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+ 		if (wiphy->bands[band])
+-			handle_band(wiphy, band);
++			handle_band(wiphy, band, initiator);
+ 	}
+ out:
+ 	reg_process_beacons(wiphy);
+diff --git a/security/capability.c b/security/capability.c
+index c773635..2a5df2b 100644
+--- a/security/capability.c
++++ b/security/capability.c
+@@ -548,7 +548,7 @@ static int cap_sem_semop(struct sem_array *sma, struct sembuf *sops,
+ }
+ 
+ #ifdef CONFIG_SECURITY_NETWORK
+-static int cap_unix_stream_connect(struct socket *sock, struct socket *other,
++static int cap_unix_stream_connect(struct sock *sock, struct sock *other,
+ 				   struct sock *newsk)
+ {
+ 	return 0;
+diff --git a/security/security.c b/security/security.c
+index 1b798d3..e5fb07a 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -977,8 +977,7 @@ EXPORT_SYMBOL(security_inode_getsecctx);
+ 
+ #ifdef CONFIG_SECURITY_NETWORK
+ 
+-int security_unix_stream_connect(struct socket *sock, struct socket *other,
+-				 struct sock *newsk)
++int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)
+ {
+ 	return security_ops->unix_stream_connect(sock, other, newsk);
+ }
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 65fa8bf..11d5c47 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -2525,7 +2525,10 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
+ 	sid = tsec->sid;
+ 	newsid = tsec->create_sid;
+ 
+-	if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
++	if ((sbsec->flags & SE_SBINITIALIZED) &&
++	    (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
++		newsid = sbsec->mntpoint_sid;
++	else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
+ 		rc = security_transition_sid(sid, dsec->sid,
+ 					     inode_mode_to_security_class(inode->i_mode),
+ 					     &newsid);
+@@ -3921,18 +3924,18 @@ static int selinux_socket_shutdown(struct socket *sock, int how)
+ 	return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
+ }
+ 
+-static int selinux_socket_unix_stream_connect(struct socket *sock,
+-					      struct socket *other,
++static int selinux_socket_unix_stream_connect(struct sock *sock,
++					      struct sock *other,
+ 					      struct sock *newsk)
+ {
+-	struct sk_security_struct *sksec_sock = sock->sk->sk_security;
+-	struct sk_security_struct *sksec_other = other->sk->sk_security;
++	struct sk_security_struct *sksec_sock = sock->sk_security;
++	struct sk_security_struct *sksec_other = other->sk_security;
+ 	struct sk_security_struct *sksec_new = newsk->sk_security;
+ 	struct common_audit_data ad;
+ 	int err;
+ 
+ 	COMMON_AUDIT_DATA_INIT(&ad, NET);
+-	ad.u.net.sk = other->sk;
++	ad.u.net.sk = other;
+ 
+ 	err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
+ 			   sksec_other->sclass,
+diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
+index 75ec0c6..8b02b21 100644
+--- a/security/selinux/nlmsgtab.c
++++ b/security/selinux/nlmsgtab.c
+@@ -65,6 +65,8 @@ static struct nlmsg_perm nlmsg_route_perms[] =
+ 	{ RTM_NEWADDRLABEL,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+ 	{ RTM_DELADDRLABEL,	NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+ 	{ RTM_GETADDRLABEL,	NETLINK_ROUTE_SOCKET__NLMSG_READ  },
++	{ RTM_GETDCB,		NETLINK_ROUTE_SOCKET__NLMSG_READ  },
++	{ RTM_SETDCB,		NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+ };
+ 
+ static struct nlmsg_perm nlmsg_firewall_perms[] =
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 489a85a..ccb71a0 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -2408,22 +2408,22 @@ static int smack_setprocattr(struct task_struct *p, char *name,
+ 
+ /**
+  * smack_unix_stream_connect - Smack access on UDS
+- * @sock: one socket
+- * @other: the other socket
++ * @sock: one sock
++ * @other: the other sock
+  * @newsk: unused
+  *
+  * Return 0 if a subject with the smack of sock could access
+  * an object with the smack of other, otherwise an error code
+  */
+-static int smack_unix_stream_connect(struct socket *sock,
+-				     struct socket *other, struct sock *newsk)
++static int smack_unix_stream_connect(struct sock *sock,
++				     struct sock *other, struct sock *newsk)
+ {
+-	struct inode *sp = SOCK_INODE(sock);
+-	struct inode *op = SOCK_INODE(other);
++	struct inode *sp = SOCK_INODE(sock->sk_socket);
++	struct inode *op = SOCK_INODE(other->sk_socket);
+ 	struct smk_audit_info ad;
+ 
+ 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
+-	smk_ad_setfield_u_net_sk(&ad, other->sk);
++	smk_ad_setfield_u_net_sk(&ad, other);
+ 	return smk_access(smk_of_inode(sp), smk_of_inode(op),
+ 				 MAY_READWRITE, &ad);
+ }
+diff --git a/sound/atmel/ac97c.c b/sound/atmel/ac97c.c
+index 10c3a87..b310702 100644
+--- a/sound/atmel/ac97c.c
++++ b/sound/atmel/ac97c.c
+@@ -33,9 +33,12 @@
+ #include <linux/dw_dmac.h>
+ 
+ #include <mach/cpu.h>
+-#include <mach/hardware.h>
+ #include <mach/gpio.h>
+ 
++#ifdef CONFIG_ARCH_AT91
++#include <mach/hardware.h>
++#endif
++
+ #include "ac97c.h"
+ 
+ enum {
+diff --git a/sound/core/hrtimer.c b/sound/core/hrtimer.c
+index 7730575..07efa29 100644
+--- a/sound/core/hrtimer.c
++++ b/sound/core/hrtimer.c
+@@ -45,12 +45,13 @@ static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt)
+ {
+ 	struct snd_hrtimer *stime = container_of(hrt, struct snd_hrtimer, hrt);
+ 	struct snd_timer *t = stime->timer;
++	unsigned long oruns;
+ 
+ 	if (!atomic_read(&stime->running))
+ 		return HRTIMER_NORESTART;
+ 
+-	hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution));
+-	snd_timer_interrupt(stime->timer, t->sticks);
++	oruns = hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution));
++	snd_timer_interrupt(stime->timer, t->sticks * oruns);
+ 
+ 	if (!atomic_read(&stime->running))
+ 		return HRTIMER_NORESTART;
+diff --git a/sound/pci/au88x0/au88x0_pcm.c b/sound/pci/au88x0/au88x0_pcm.c
+index b9d2f20..5439d66 100644
+--- a/sound/pci/au88x0/au88x0_pcm.c
++++ b/sound/pci/au88x0/au88x0_pcm.c
+@@ -42,11 +42,7 @@ static struct snd_pcm_hardware snd_vortex_playback_hw_adb = {
+ 	.rate_min = 5000,
+ 	.rate_max = 48000,
+ 	.channels_min = 1,
+-#ifdef CHIP_AU8830
+-	.channels_max = 4,
+-#else
+ 	.channels_max = 2,
+-#endif
+ 	.buffer_bytes_max = 0x10000,
+ 	.period_bytes_min = 0x1,
+ 	.period_bytes_max = 0x1000,
+@@ -115,6 +111,17 @@ static struct snd_pcm_hardware snd_vortex_playback_hw_wt = {
+ 	.periods_max = 64,
+ };
+ #endif
++#ifdef CHIP_AU8830
++static unsigned int au8830_channels[3] = {
++	1, 2, 4,
++};
++
++static struct snd_pcm_hw_constraint_list hw_constraints_au8830_channels = {
++	.count = ARRAY_SIZE(au8830_channels),
++	.list = au8830_channels,
++	.mask = 0,
++};
++#endif
+ /* open callback */
+ static int snd_vortex_pcm_open(struct snd_pcm_substream *substream)
+ {
+@@ -156,6 +163,15 @@ static int snd_vortex_pcm_open(struct snd_pcm_substream *substream)
+ 		if (VORTEX_PCM_TYPE(substream->pcm) == VORTEX_PCM_ADB
+ 		    || VORTEX_PCM_TYPE(substream->pcm) == VORTEX_PCM_I2S)
+ 			runtime->hw = snd_vortex_playback_hw_adb;
++#ifdef CHIP_AU8830
++		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
++			VORTEX_PCM_TYPE(substream->pcm) == VORTEX_PCM_ADB) {
++			runtime->hw.channels_max = 4;
++			snd_pcm_hw_constraint_list(runtime, 0,
++				SNDRV_PCM_HW_PARAM_CHANNELS,
++				&hw_constraints_au8830_channels);
++		}
++#endif
+ 		substream->runtime->private_data = NULL;
+ 	}
+ #ifndef CHIP_AU8810
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 98b6d02..05e5ec8 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -4571,6 +4571,9 @@ int snd_hda_parse_pin_def_config(struct hda_codec *codec,
+ 		}
+ 		memset(cfg->hp_pins + cfg->hp_outs, 0,
+ 		       sizeof(hda_nid_t) * (AUTO_CFG_MAX_OUTS - cfg->hp_outs));
++		if (!cfg->hp_outs)
++			cfg->line_out_type = AUTO_PIN_HP_OUT;
++
+ 	}
+ 
+ 	/* sort by sequence */
+diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
+index 4a66347..74b0560 100644
+--- a/sound/pci/hda/hda_eld.c
++++ b/sound/pci/hda/hda_eld.c
+@@ -381,7 +381,7 @@ static void hdmi_show_short_audio_desc(struct cea_sad *a)
+ 	snd_print_pcm_rates(a->rates, buf, sizeof(buf));
+ 
+ 	if (a->format == AUDIO_CODING_TYPE_LPCM)
+-		snd_print_pcm_bits(a->sample_bits, buf2 + 8, sizeof(buf2 - 8));
++		snd_print_pcm_bits(a->sample_bits, buf2 + 8, sizeof(buf2) - 8);
+ 	else if (a->max_bitrate)
+ 		snprintf(buf2, sizeof(buf2),
+ 				", max bitrate = %d", a->max_bitrate);
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 76bd58a..5667fb9 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -403,10 +403,16 @@ static int conexant_add_jack(struct hda_codec *codec,
+ 	struct conexant_spec *spec;
+ 	struct conexant_jack *jack;
+ 	const char *name;
+-	int err;
++	int i, err;
+ 
+ 	spec = codec->spec;
+ 	snd_array_init(&spec->jacks, sizeof(*jack), 32);
++
++	jack = spec->jacks.list;
++	for (i = 0; i < spec->jacks.used; i++, jack++)
++		if (jack->nid == nid)
++			return 0 ; /* already present */
++
+ 	jack = snd_array_new(&spec->jacks);
+ 	name = (type == SND_JACK_HEADPHONE) ? "Headphone" : "Mic" ;
+ 
+@@ -3097,6 +3103,7 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
+ 	SND_PCI_QUIRK_MASK(0x1025, 0xff00, 0x0400, "Acer", CXT5066_IDEAPAD),
+ 	SND_PCI_QUIRK(0x1028, 0x02d8, "Dell Vostro", CXT5066_DELL_VOSTRO),
+ 	SND_PCI_QUIRK(0x1028, 0x02f5, "Dell Vostro 320", CXT5066_IDEAPAD),
++	SND_PCI_QUIRK(0x1028, 0x0401, "Dell Vostro 1014", CXT5066_DELL_VOSTRO),
+ 	SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTRO),
+ 	SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
+ 	SND_PCI_QUIRK(0x103c, 0x360b, "HP G60", CXT5066_HP_LAPTOP),
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 31df774..232833b 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -31,10 +31,15 @@
+ #include <linux/init.h>
+ #include <linux/delay.h>
+ #include <linux/slab.h>
++#include <linux/moduleparam.h>
+ #include <sound/core.h>
+ #include "hda_codec.h"
+ #include "hda_local.h"
+ 
++static bool static_hdmi_pcm;
++module_param(static_hdmi_pcm, bool, 0644);
++MODULE_PARM_DESC(static_hdmi_pcm, "Don't restrict PCM parameters per ELD info");
++
+ /*
+  * The HDMI/DisplayPort configuration can be highly dynamic. A graphics device
+  * could support two independent pipes, each of them can be connected to one or
+@@ -637,6 +642,7 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec, hda_nid_t nid,
+ 			hdmi_ai->ver		= 0x01;
+ 			hdmi_ai->len		= 0x0a;
+ 			hdmi_ai->CC02_CT47	= channels - 1;
++			hdmi_ai->CA		= ca;
+ 			hdmi_checksum_audio_infoframe(hdmi_ai);
+ 		} else if (spec->sink_eld[i].conn_type == 1) { /* DisplayPort */
+ 			struct dp_audio_infoframe *dp_ai;
+@@ -646,6 +652,7 @@ static void hdmi_setup_audio_infoframe(struct hda_codec *codec, hda_nid_t nid,
+ 			dp_ai->len		= 0x1b;
+ 			dp_ai->ver		= 0x11 << 2;
+ 			dp_ai->CC02_CT47	= channels - 1;
++			dp_ai->CA		= ca;
+ 		} else {
+ 			snd_printd("HDMI: unknown connection type at pin %d\n",
+ 				   pin_nid);
+@@ -827,7 +834,7 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,
+ 		*codec_pars = *hinfo;
+ 
+ 	eld = &spec->sink_eld[idx];
+-	if (eld->sad_count > 0) {
++	if (!static_hdmi_pcm && eld->eld_valid && eld->sad_count > 0) {
+ 		hdmi_eld_update_pcm_info(eld, hinfo, codec_pars);
+ 		if (hinfo->channels_min > hinfo->channels_max ||
+ 		    !hinfo->rates || !hinfo->formats)
+@@ -1165,11 +1172,53 @@ static int nvhdmi_7x_init(struct hda_codec *codec)
+ 	return 0;
+ }
+ 
++static unsigned int channels_2_6_8[] = {
++	2, 6, 8
++};
++
++static unsigned int channels_2_8[] = {
++	2, 8
++};
++
++static struct snd_pcm_hw_constraint_list hw_constraints_2_6_8_channels = {
++	.count = ARRAY_SIZE(channels_2_6_8),
++	.list = channels_2_6_8,
++	.mask = 0,
++};
++
++static struct snd_pcm_hw_constraint_list hw_constraints_2_8_channels = {
++	.count = ARRAY_SIZE(channels_2_8),
++	.list = channels_2_8,
++	.mask = 0,
++};
++
+ static int simple_playback_pcm_open(struct hda_pcm_stream *hinfo,
+ 				    struct hda_codec *codec,
+ 				    struct snd_pcm_substream *substream)
+ {
+ 	struct hdmi_spec *spec = codec->spec;
++	struct snd_pcm_hw_constraint_list *hw_constraints_channels = NULL;
++
++	switch (codec->preset->id) {
++	case 0x10de0002:
++	case 0x10de0003:
++	case 0x10de0005:
++	case 0x10de0006:
++		hw_constraints_channels = &hw_constraints_2_8_channels;
++		break;
++	case 0x10de0007:
++		hw_constraints_channels = &hw_constraints_2_6_8_channels;
++		break;
++	default:
++		break;
++	}
++
++	if (hw_constraints_channels != NULL) {
++		snd_pcm_hw_constraint_list(substream->runtime, 0,
++				SNDRV_PCM_HW_PARAM_CHANNELS,
++				hw_constraints_channels);
++	}
++
+ 	return snd_hda_multi_out_dig_open(codec, &spec->multiout);
+ }
+ 
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 552a09e..0bc6e4e 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -14824,6 +14824,7 @@ static const struct alc_fixup alc269_fixups[] = {
+ 			{0x01, AC_VERB_SET_GPIO_MASK, 0x04},
+ 			{0x01, AC_VERB_SET_GPIO_DIRECTION, 0x04},
+ 			{0x01, AC_VERB_SET_GPIO_DATA, 0x00},
++			{0x19, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREFGRD},
+ 			{ }
+ 		}
+ 	},
+@@ -19379,6 +19380,7 @@ static const struct alc_fixup alc662_fixups[] = {
+ };
+ 
+ static struct snd_pci_quirk alc662_fixup_tbl[] = {
++	SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
+ 	SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
+ 	SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
+ 	SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index f03b2ff..fc16beb 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -3591,7 +3591,7 @@ static int stac_check_auto_mic(struct hda_codec *codec)
+ 		if (check_mic_pin(codec, spec->dmic_nids[i],
+ 		    &fixed, &ext, &dock))
+ 			return 0;
+-	if (!fixed && !ext && !dock)
++	if (!fixed || (!ext && !dock))
+ 		return 0; /* no input to switch */
+ 	if (!(get_wcaps(codec, ext) & AC_WCAP_UNSOL_CAP))
+ 		return 0; /* no unsol support */
+diff --git a/sound/soc/blackfin/bf5xx-ac97.c b/sound/soc/blackfin/bf5xx-ac97.c
+index c5f856e..ffbac26 100644
+--- a/sound/soc/blackfin/bf5xx-ac97.c
++++ b/sound/soc/blackfin/bf5xx-ac97.c
+@@ -260,9 +260,9 @@ static int bf5xx_ac97_suspend(struct snd_soc_dai *dai)
+ 	pr_debug("%s : sport %d\n", __func__, dai->id);
+ 	if (!dai->active)
+ 		return 0;
+-	if (dai->capture.active)
++	if (dai->capture_active)
+ 		sport_rx_stop(sport);
+-	if (dai->playback.active)
++	if (dai->playback_active)
+ 		sport_tx_stop(sport);
+ 	return 0;
+ }
+diff --git a/sound/soc/blackfin/bf5xx-tdm.c b/sound/soc/blackfin/bf5xx-tdm.c
+index 1251239..b2cf239 100644
+--- a/sound/soc/blackfin/bf5xx-tdm.c
++++ b/sound/soc/blackfin/bf5xx-tdm.c
+@@ -210,7 +210,7 @@ static int bf5xx_tdm_set_channel_map(struct snd_soc_dai *dai,
+ #ifdef CONFIG_PM
+ static int bf5xx_tdm_suspend(struct snd_soc_dai *dai)
+ {
+-	struct sport_device *sport = dai->private_data;
++	struct sport_device *sport = snd_soc_dai_get_drvdata(dai);
+ 
+ 	if (!dai->active)
+ 		return 0;
+diff --git a/sound/soc/codecs/wm8990.c b/sound/soc/codecs/wm8990.c
+index 264828e..f007d77 100644
+--- a/sound/soc/codecs/wm8990.c
++++ b/sound/soc/codecs/wm8990.c
+@@ -1183,7 +1183,7 @@ static int wm8990_set_bias_level(struct snd_soc_codec *codec,
+ 				     WM8990_VMIDTOG);
+ 
+ 			/* Delay to allow output caps to discharge */
+-			msleep(msecs_to_jiffies(300));
++			msleep(300);
+ 
+ 			/* Disable VMIDTOG */
+ 			snd_soc_write(codec, WM8990_ANTIPOP2, WM8990_SOFTST |
+@@ -1195,17 +1195,17 @@ static int wm8990_set_bias_level(struct snd_soc_codec *codec,
+ 			/* Enable outputs */
+ 			snd_soc_write(codec, WM8990_POWER_MANAGEMENT_1, 0x1b00);
+ 
+-			msleep(msecs_to_jiffies(50));
++			msleep(50);
+ 
+ 			/* Enable VMID at 2x50k */
+ 			snd_soc_write(codec, WM8990_POWER_MANAGEMENT_1, 0x1f02);
+ 
+-			msleep(msecs_to_jiffies(100));
++			msleep(100);
+ 
+ 			/* Enable VREF */
+ 			snd_soc_write(codec, WM8990_POWER_MANAGEMENT_1, 0x1f03);
+ 
+-			msleep(msecs_to_jiffies(600));
++			msleep(600);
+ 
+ 			/* Enable BUFIOEN */
+ 			snd_soc_write(codec, WM8990_ANTIPOP2, WM8990_SOFTST |
+@@ -1250,7 +1250,7 @@ static int wm8990_set_bias_level(struct snd_soc_codec *codec,
+ 		/* Disable VMID */
+ 		snd_soc_write(codec, WM8990_POWER_MANAGEMENT_1, 0x1f01);
+ 
+-		msleep(msecs_to_jiffies(300));
++		msleep(300);
+ 
+ 		/* Enable all output discharge bits */
+ 		snd_soc_write(codec, WM8990_ANTIPOP1, WM8990_DIS_LLINE |
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index 4d3e6f1..f451a2c 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2536,18 +2536,18 @@ SND_SOC_DAPM_SUPPLY("DSPINTCLK", WM8994_CLOCKING_1, 1, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, NULL, 0),
+ 
+-SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", "AIF1 Capture",
++SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", NULL,
+ 		     0, WM8994_POWER_MANAGEMENT_4, 9, 0),
+-SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", "AIF1 Capture",
++SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", NULL,
+ 		     0, WM8994_POWER_MANAGEMENT_4, 8, 0),
+ SND_SOC_DAPM_AIF_IN("AIF1DAC1L", NULL, 0,
+ 		    WM8994_POWER_MANAGEMENT_5, 9, 0),
+ SND_SOC_DAPM_AIF_IN("AIF1DAC1R", NULL, 0,
+ 		    WM8994_POWER_MANAGEMENT_5, 8, 0),
+ 
+-SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", "AIF1 Capture",
++SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", NULL,
+ 		     0, WM8994_POWER_MANAGEMENT_4, 11, 0),
+-SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", "AIF1 Capture",
++SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", NULL,
+ 		     0, WM8994_POWER_MANAGEMENT_4, 10, 0),
+ SND_SOC_DAPM_AIF_IN("AIF1DAC2L", NULL, 0,
+ 		    WM8994_POWER_MANAGEMENT_5, 11, 0),
+@@ -2588,6 +2588,7 @@ SND_SOC_DAPM_AIF_IN("AIF2DACR", NULL, 0,
+ 
+ SND_SOC_DAPM_AIF_IN("AIF1DACDAT", "AIF1 Playback", 0, SND_SOC_NOPM, 0, 0),
+ SND_SOC_DAPM_AIF_IN("AIF2DACDAT", "AIF2 Playback", 0, SND_SOC_NOPM, 0, 0),
++SND_SOC_DAPM_AIF_OUT("AIF1ADCDAT", "AIF1 Capture", 0, SND_SOC_NOPM, 0, 0),
+ SND_SOC_DAPM_AIF_OUT("AIF2ADCDAT", "AIF2 Capture", 0, SND_SOC_NOPM, 0, 0),
+ 
+ SND_SOC_DAPM_MUX("AIF1DAC Mux", SND_SOC_NOPM, 0, 0, &aif1dac_mux),
+@@ -2783,6 +2784,11 @@ static const struct snd_soc_dapm_route intercon[] = {
+ 	{ "AIF2DAC2R Mixer", "Left Sidetone Switch", "Left Sidetone" },
+ 	{ "AIF2DAC2R Mixer", "Right Sidetone Switch", "Right Sidetone" },
+ 
++	{ "AIF1ADCDAT", NULL, "AIF1ADC1L" },
++	{ "AIF1ADCDAT", NULL, "AIF1ADC1R" },
++	{ "AIF1ADCDAT", NULL, "AIF1ADC2L" },
++	{ "AIF1ADCDAT", NULL, "AIF1ADC2R" },
++
+ 	{ "AIF2ADCDAT", NULL, "AIF2ADC Mux" },
+ 
+ 	/* AIF3 output */
+@@ -2930,6 +2936,7 @@ static int _wm8994_set_fll(struct snd_soc_codec *codec, int id, int src,
+ 		/* Allow no source specification when stopping */
+ 		if (freq_out)
+ 			return -EINVAL;
++		src = wm8994->fll[id].src;
+ 		break;
+ 	case WM8994_FLL_SRC_MCLK1:
+ 	case WM8994_FLL_SRC_MCLK2:
+@@ -3512,7 +3519,7 @@ static int wm8994_set_tristate(struct snd_soc_dai *codec_dai, int tristate)
+ 	else
+ 		val = 0;
+ 
+-	return snd_soc_update_bits(codec, reg, mask, reg);
++	return snd_soc_update_bits(codec, reg, mask, val);
+ }
+ 
+ #define WM8994_RATES SNDRV_PCM_RATE_8000_96000
+diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
+index 0e24092..feacf18 100644
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -92,6 +92,7 @@ static void wait_for_dc_servo(struct snd_soc_codec *codec, unsigned int op)
+ static void calibrate_dc_servo(struct snd_soc_codec *codec)
+ {
+ 	struct wm_hubs_data *hubs = snd_soc_codec_get_drvdata(codec);
++	s8 offset;
+ 	u16 reg, reg_l, reg_r, dcs_cfg;
+ 
+ 	/* Set for 32 series updates */
+@@ -130,16 +131,14 @@ static void calibrate_dc_servo(struct snd_soc_codec *codec)
+ 		dev_dbg(codec->dev, "DCS input: %x %x\n", reg_l, reg_r);
+ 
+ 		/* HPOUT1L */
+-		if (reg_l + hubs->dcs_codes > 0 &&
+-		    reg_l + hubs->dcs_codes < 0xff)
+-			reg_l += hubs->dcs_codes;
+-		dcs_cfg = reg_l << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
++		offset = reg_l;
++		offset += hubs->dcs_codes;
++		dcs_cfg = (u8)offset << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
+ 
+ 		/* HPOUT1R */
+-		if (reg_r + hubs->dcs_codes > 0 &&
+-		    reg_r + hubs->dcs_codes < 0xff)
+-			reg_r += hubs->dcs_codes;
+-		dcs_cfg |= reg_r;
++		offset = reg_r;
++		offset += hubs->dcs_codes;
++		dcs_cfg |= (u8)offset;
+ 
+ 		dev_dbg(codec->dev, "DCS result: %x\n", dcs_cfg);
+ 
+diff --git a/sound/soc/davinci/davinci-evm.c b/sound/soc/davinci/davinci-evm.c
+index bc9e6b0..07db881 100644
+--- a/sound/soc/davinci/davinci-evm.c
++++ b/sound/soc/davinci/davinci-evm.c
+@@ -224,7 +224,7 @@ static struct snd_soc_dai_link da8xx_evm_dai = {
+ 	.stream_name = "AIC3X",
+ 	.cpu_dai_name= "davinci-mcasp.0",
+ 	.codec_dai_name = "tlv320aic3x-hifi",
+-	.codec_name = "tlv320aic3x-codec.0-001a",
++	.codec_name = "tlv320aic3x-codec.1-0018",
+ 	.platform_name = "davinci-pcm-audio",
+ 	.init = evm_aic3x_init,
+ 	.ops = &evm_ops,
+diff --git a/sound/soc/pxa/corgi.c b/sound/soc/pxa/corgi.c
+index f451acd..135d903 100644
+--- a/sound/soc/pxa/corgi.c
++++ b/sound/soc/pxa/corgi.c
+@@ -305,10 +305,10 @@ static int corgi_wm8731_init(struct snd_soc_pcm_runtime *rtd)
+ static struct snd_soc_dai_link corgi_dai = {
+ 	.name = "WM8731",
+ 	.stream_name = "WM8731",
+-	.cpu_dai_name = "pxa-is2-dai",
++	.cpu_dai_name = "pxa2xx-i2s",
+ 	.codec_dai_name = "wm8731-hifi",
+ 	.platform_name = "pxa-pcm-audio",
+-	.codec_name = "wm8731-codec-0.001a",
++	.codec_name = "wm8731-codec-0.001b",
+ 	.init = corgi_wm8731_init,
+ 	.ops = &corgi_ops,
+ };
+diff --git a/sound/soc/pxa/poodle.c b/sound/soc/pxa/poodle.c
+index 84edd03..0eebe11 100644
+--- a/sound/soc/pxa/poodle.c
++++ b/sound/soc/pxa/poodle.c
+@@ -274,7 +274,7 @@ static struct snd_soc_dai_link poodle_dai = {
+ 	.cpu_dai_name = "pxa2xx-i2s",
+ 	.codec_dai_name = "wm8731-hifi",
+ 	.platform_name = "pxa-pcm-audio",
+-	.codec_name = "wm8731-codec.0-001a",
++	.codec_name = "wm8731-codec.0-001b",
+ 	.init = poodle_wm8731_init,
+ 	.ops = &poodle_ops,
+ };
+diff --git a/sound/soc/pxa/spitz.c b/sound/soc/pxa/spitz.c
+index 0b30d7d..7604471 100644
+--- a/sound/soc/pxa/spitz.c
++++ b/sound/soc/pxa/spitz.c
+@@ -313,10 +313,10 @@ static int spitz_wm8750_init(struct snd_soc_pcm_runtime *rtd)
+ static struct snd_soc_dai_link spitz_dai = {
+ 	.name = "wm8750",
+ 	.stream_name = "WM8750",
+-	.cpu_dai_name = "pxa-is2",
++	.cpu_dai_name = "pxa2xx-i2s",
+ 	.codec_dai_name = "wm8750-hifi",
+ 	.platform_name = "pxa-pcm-audio",
+-	.codec_name = "wm8750-codec.0-001a",
++	.codec_name = "wm8750-codec.0-001b",
+ 	.init = spitz_wm8750_init,
+ 	.ops = &spitz_ops,
+ };
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 85b7d54..757ba59 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1623,7 +1623,7 @@ static void snd_soc_instantiate_card(struct snd_soc_card *card)
+ 		if (ret < 0) {
+ 			printk(KERN_ERR "asoc: failed to register AC97 %s\n", card->name);
+ 			while (--i >= 0)
+-				soc_unregister_ac97_dai_link(&card->rtd[i]);
++				soc_unregister_ac97_dai_link(card->rtd[i].codec);
+ 			goto probe_dai_err;
+ 		}
+ 	}
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index 25bce7e..b1f9ec9 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -850,8 +850,8 @@ static void snd_usbmidi_us122l_output(struct snd_usb_midi_out_endpoint *ep,
+ 		return;
+ 	}
+ 
+-	memset(urb->transfer_buffer + count, 0xFD, 9 - count);
+-	urb->transfer_buffer_length = count;
++	memset(urb->transfer_buffer + count, 0xFD, ep->max_transfer - count);
++	urb->transfer_buffer_length = ep->max_transfer;
+ }
+ 
+ static struct usb_protocol_ops snd_usbmidi_122l_ops = {
+@@ -1295,6 +1295,13 @@ static int snd_usbmidi_out_endpoint_create(struct snd_usb_midi* umidi,
+ 	case USB_ID(0x1a86, 0x752d): /* QinHeng CH345 "USB2.0-MIDI" */
+ 		ep->max_transfer = 4;
+ 		break;
++		/*
++		 * Some devices only work with 9 bytes packet size:
++		 */
++	case USB_ID(0x0644, 0x800E): /* Tascam US-122L */
++	case USB_ID(0x0644, 0x800F): /* Tascam US-144 */
++		ep->max_transfer = 9;
++		break;
+ 	}
+ 	for (i = 0; i < OUTPUT_URBS; ++i) {
+ 		buffer = usb_alloc_coherent(umidi->dev,
+diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
+index 6ef68e4..084e6fc 100644
+--- a/sound/usb/usx2y/us122l.c
++++ b/sound/usb/usx2y/us122l.c
+@@ -273,29 +273,26 @@ static unsigned int usb_stream_hwdep_poll(struct snd_hwdep *hw,
+ 					  struct file *file, poll_table *wait)
+ {
+ 	struct us122l	*us122l = hw->private_data;
+-	struct usb_stream *s = us122l->sk.s;
+ 	unsigned	*polled;
+ 	unsigned int	mask;
+ 
+ 	poll_wait(file, &us122l->sk.sleep, wait);
+ 
+-	switch (s->state) {
+-	case usb_stream_ready:
+-		if (us122l->first == file)
+-			polled = &s->periods_polled;
+-		else
+-			polled = &us122l->second_periods_polled;
+-		if (*polled != s->periods_done) {
+-			*polled = s->periods_done;
+-			mask = POLLIN | POLLOUT | POLLWRNORM;
+-			break;
++	mask = POLLIN | POLLOUT | POLLWRNORM | POLLERR;
++	if (mutex_trylock(&us122l->mutex)) {
++		struct usb_stream *s = us122l->sk.s;
++		if (s && s->state == usb_stream_ready) {
++			if (us122l->first == file)
++				polled = &s->periods_polled;
++			else
++				polled = &us122l->second_periods_polled;
++			if (*polled != s->periods_done) {
++				*polled = s->periods_done;
++				mask = POLLIN | POLLOUT | POLLWRNORM;
++			} else
++				mask = 0;
+ 		}
+-		/* Fall through */
+-		mask = 0;
+-		break;
+-	default:
+-		mask = POLLIN | POLLOUT | POLLWRNORM | POLLERR;
+-		break;
++		mutex_unlock(&us122l->mutex);
+ 	}
+ 	return mask;
+ }
+@@ -381,6 +378,7 @@ static int usb_stream_hwdep_ioctl(struct snd_hwdep *hw, struct file *file,
+ {
+ 	struct usb_stream_config *cfg;
+ 	struct us122l *us122l = hw->private_data;
++	struct usb_stream *s;
+ 	unsigned min_period_frames;
+ 	int err = 0;
+ 	bool high_speed;
+@@ -426,18 +424,18 @@ static int usb_stream_hwdep_ioctl(struct snd_hwdep *hw, struct file *file,
+ 	snd_power_wait(hw->card, SNDRV_CTL_POWER_D0);
+ 
+ 	mutex_lock(&us122l->mutex);
++	s = us122l->sk.s;
+ 	if (!us122l->master)
+ 		us122l->master = file;
+ 	else if (us122l->master != file) {
+-		if (memcmp(cfg, &us122l->sk.s->cfg, sizeof(*cfg))) {
++		if (!s || memcmp(cfg, &s->cfg, sizeof(*cfg))) {
+ 			err = -EIO;
+ 			goto unlock;
+ 		}
+ 		us122l->slave = file;
+ 	}
+-	if (!us122l->sk.s ||
+-	    memcmp(cfg, &us122l->sk.s->cfg, sizeof(*cfg)) ||
+-	    us122l->sk.s->state == usb_stream_xrun) {
++	if (!s || memcmp(cfg, &s->cfg, sizeof(*cfg)) ||
++	    s->state == usb_stream_xrun) {
+ 		us122l_stop(us122l);
+ 		if (!us122l_start(us122l, cfg->sample_rate, cfg->period_frames))
+ 			err = -EIO;
+@@ -448,6 +446,7 @@ unlock:
+ 	mutex_unlock(&us122l->mutex);
+ free:
+ 	kfree(cfg);
++	wake_up_all(&us122l->sk.sleep);
+ 	return err;
+ }
+ 

Added: genpatches-2.6/trunk/2.6.37/1001_linux-2.6.37.2.patch
===================================================================
--- genpatches-2.6/trunk/2.6.37/1001_linux-2.6.37.2.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.37/1001_linux-2.6.37.2.patch	2011-02-26 00:27:50 UTC (rev 1874)
@@ -0,0 +1,2336 @@
+diff --git a/Documentation/hwmon/jc42 b/Documentation/hwmon/jc42
+index 0e76ef1..a22ecf4 100644
+--- a/Documentation/hwmon/jc42
++++ b/Documentation/hwmon/jc42
+@@ -51,7 +51,8 @@ Supported chips:
+   * JEDEC JC 42.4 compliant temperature sensor chips
+     Prefix: 'jc42'
+     Addresses scanned: I2C 0x18 - 0x1f
+-    Datasheet: -
++    Datasheet:
++	http://www.jedec.org/sites/default/files/docs/4_01_04R19.pdf
+ 
+ Author:
+ 	Guenter Roeck <guenter.roeck@××××××××.com>
+@@ -60,7 +61,11 @@ Author:
+ Description
+ -----------
+ 
+-This driver implements support for JEDEC JC 42.4 compliant temperature sensors.
++This driver implements support for JEDEC JC 42.4 compliant temperature sensors,
++which are used on many DDR3 memory modules for mobile devices and servers. Some
++systems use the sensor to prevent memory overheating by automatically throttling
++the memory controller.
++
+ The driver auto-detects the chips listed above, but can be manually instantiated
+ to support other JC 42.4 compliant chips.
+ 
+@@ -81,15 +86,19 @@ limits. The chip supports only a single register to configure the hysteresis,
+ which applies to all limits. This register can be written by writing into
+ temp1_crit_hyst. Other hysteresis attributes are read-only.
+ 
++If the BIOS has configured the sensor for automatic temperature management, it
++is likely that it has locked the registers, i.e., that the temperature limits
++cannot be changed.
++
+ Sysfs entries
+ -------------
+ 
+ temp1_input		Temperature (RO)
+-temp1_min		Minimum temperature (RW)
+-temp1_max		Maximum temperature (RW)
+-temp1_crit		Critical high temperature (RW)
++temp1_min		Minimum temperature (RO or RW)
++temp1_max		Maximum temperature (RO or RW)
++temp1_crit		Critical high temperature (RO or RW)
+ 
+-temp1_crit_hyst		Critical hysteresis temperature (RW)
++temp1_crit_hyst		Critical hysteresis temperature (RO or RW)
+ temp1_max_hyst		Maximum hysteresis temperature (RO)
+ 
+ temp1_min_alarm		Temperature low alarm
+diff --git a/Documentation/hwmon/k10temp b/Documentation/hwmon/k10temp
+index 6526eee..d2b56a4 100644
+--- a/Documentation/hwmon/k10temp
++++ b/Documentation/hwmon/k10temp
+@@ -9,6 +9,8 @@ Supported chips:
+   Socket S1G3: Athlon II, Sempron, Turion II
+ * AMD Family 11h processors:
+   Socket S1G2: Athlon (X2), Sempron (X2), Turion X2 (Ultra)
++* AMD Family 12h processors: "Llano"
++* AMD Family 14h processors: "Brazos" (C/E/G-Series)
+ 
+   Prefix: 'k10temp'
+   Addresses scanned: PCI space
+@@ -17,10 +19,14 @@ Supported chips:
+     http://support.amd.com/us/Processor_TechDocs/31116.pdf
+   BIOS and Kernel Developer's Guide (BKDG) for AMD Family 11h Processors:
+     http://support.amd.com/us/Processor_TechDocs/41256.pdf
++  BIOS and Kernel Developer's Guide (BKDG) for AMD Family 14h Models 00h-0Fh Processors:
++    http://support.amd.com/us/Processor_TechDocs/43170.pdf
+   Revision Guide for AMD Family 10h Processors:
+     http://support.amd.com/us/Processor_TechDocs/41322.pdf
+   Revision Guide for AMD Family 11h Processors:
+     http://support.amd.com/us/Processor_TechDocs/41788.pdf
++  Revision Guide for AMD Family 14h Models 00h-0Fh Processors:
++    http://support.amd.com/us/Processor_TechDocs/47534.pdf
+   AMD Family 11h Processor Power and Thermal Data Sheet for Notebooks:
+     http://support.amd.com/us/Processor_TechDocs/43373.pdf
+   AMD Family 10h Server and Workstation Processor Power and Thermal Data Sheet:
+@@ -34,7 +40,7 @@ Description
+ -----------
+ 
+ This driver permits reading of the internal temperature sensor of AMD
+-Family 10h and 11h processors.
++Family 10h/11h/12h/14h processors.
+ 
+ All these processors have a sensor, but on those for Socket F or AM2+,
+ the sensor may return inconsistent values (erratum 319).  The driver
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index 907d5a6..abaf844 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -474,7 +474,9 @@ setup_return(struct pt_regs *regs, struct k_sigaction *ka,
+ 	unsigned long handler = (unsigned long)ka->sa.sa_handler;
+ 	unsigned long retcode;
+ 	int thumb = 0;
+-	unsigned long cpsr = regs->ARM_cpsr & ~PSR_f;
++	unsigned long cpsr = regs->ARM_cpsr & ~(PSR_f | PSR_E_BIT);
++
++	cpsr |= PSR_ENDSTATE;
+ 
+ 	/*
+ 	 * Maybe we need to deliver a 32-bit signal to a 26-bit task.
+diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
+index cead889..223ba96 100644
+--- a/arch/arm/kernel/vmlinux.lds.S
++++ b/arch/arm/kernel/vmlinux.lds.S
+@@ -21,6 +21,12 @@
+ #define ARM_CPU_KEEP(x)
+ #endif
+ 
++#if defined(CONFIG_SMP_ON_UP) && !defined(CONFIG_DEBUG_SPINLOCK)
++#define ARM_EXIT_KEEP(x)	x
++#else
++#define ARM_EXIT_KEEP(x)
++#endif
++
+ OUTPUT_ARCH(arm)
+ ENTRY(stext)
+ 
+@@ -43,6 +49,7 @@ SECTIONS
+ 		_sinittext = .;
+ 			HEAD_TEXT
+ 			INIT_TEXT
++			ARM_EXIT_KEEP(EXIT_TEXT)
+ 		_einittext = .;
+ 		ARM_CPU_DISCARD(PROC_INFO)
+ 		__arch_info_begin = .;
+@@ -67,6 +74,7 @@ SECTIONS
+ #ifndef CONFIG_XIP_KERNEL
+ 		__init_begin = _stext;
+ 		INIT_DATA
++		ARM_EXIT_KEEP(EXIT_DATA)
+ #endif
+ 	}
+ 
+@@ -161,6 +169,7 @@ SECTIONS
+ 		. = ALIGN(PAGE_SIZE);
+ 		__init_begin = .;
+ 		INIT_DATA
++		ARM_EXIT_KEEP(EXIT_DATA)
+ 		. = ALIGN(PAGE_SIZE);
+ 		__init_end = .;
+ #endif
+diff --git a/arch/arm/mach-sa1100/simpad.c b/arch/arm/mach-sa1100/simpad.c
+index 27692d0..cfb7607 100644
+--- a/arch/arm/mach-sa1100/simpad.c
++++ b/arch/arm/mach-sa1100/simpad.c
+@@ -166,9 +166,6 @@ static void __init simpad_map_io(void)
+ 	PCFR = 0;
+ 	PSDR = 0;
+ 
+-	sa11x0_register_mtd(&simpad_flash_data, simpad_flash_resources,
+-			      ARRAY_SIZE(simpad_flash_resources));
+-	sa11x0_register_mcp(&simpad_mcp_data);
+ }
+ 
+ static void simpad_power_off(void)
+@@ -216,6 +213,10 @@ static int __init simpad_init(void)
+ 
+ 	pm_power_off = simpad_power_off;
+ 
++	sa11x0_register_mtd(&simpad_flash_data, simpad_flash_resources,
++			      ARRAY_SIZE(simpad_flash_resources));
++	sa11x0_register_mcp(&simpad_mcp_data);
++
+ 	ret = platform_add_devices(devices, ARRAY_SIZE(devices));
+ 	if(ret)
+ 		printk(KERN_WARNING "simpad: Unable to register mq200 framebuffer device");
+diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
+index 8d6f871..b7cbfab 100644
+--- a/arch/s390/include/asm/processor.h
++++ b/arch/s390/include/asm/processor.h
+@@ -148,11 +148,6 @@ extern int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
+  */
+ extern unsigned long thread_saved_pc(struct task_struct *t);
+ 
+-/*
+- * Print register of task into buffer. Used in fs/proc/array.c.
+- */
+-extern void task_show_regs(struct seq_file *m, struct task_struct *task);
+-
+ extern void show_code(struct pt_regs *regs);
+ 
+ unsigned long get_wchan(struct task_struct *p);
+diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
+index 7064082..5aa4183 100644
+--- a/arch/s390/kernel/traps.c
++++ b/arch/s390/kernel/traps.c
+@@ -237,43 +237,6 @@ void show_regs(struct pt_regs *regs)
+ 	show_last_breaking_event(regs);
+ }
+ 
+-/* This is called from fs/proc/array.c */
+-void task_show_regs(struct seq_file *m, struct task_struct *task)
+-{
+-	struct pt_regs *regs;
+-
+-	regs = task_pt_regs(task);
+-	seq_printf(m, "task: %p, ksp: %p\n",
+-		       task, (void *)task->thread.ksp);
+-	seq_printf(m, "User PSW : %p %p\n",
+-		       (void *) regs->psw.mask, (void *)regs->psw.addr);
+-
+-	seq_printf(m, "User GPRS: " FOURLONG,
+-			  regs->gprs[0], regs->gprs[1],
+-			  regs->gprs[2], regs->gprs[3]);
+-	seq_printf(m, "           " FOURLONG,
+-			  regs->gprs[4], regs->gprs[5],
+-			  regs->gprs[6], regs->gprs[7]);
+-	seq_printf(m, "           " FOURLONG,
+-			  regs->gprs[8], regs->gprs[9],
+-			  regs->gprs[10], regs->gprs[11]);
+-	seq_printf(m, "           " FOURLONG,
+-			  regs->gprs[12], regs->gprs[13],
+-			  regs->gprs[14], regs->gprs[15]);
+-	seq_printf(m, "User ACRS: %08x %08x %08x %08x\n",
+-			  task->thread.acrs[0], task->thread.acrs[1],
+-			  task->thread.acrs[2], task->thread.acrs[3]);
+-	seq_printf(m, "           %08x %08x %08x %08x\n",
+-			  task->thread.acrs[4], task->thread.acrs[5],
+-			  task->thread.acrs[6], task->thread.acrs[7]);
+-	seq_printf(m, "           %08x %08x %08x %08x\n",
+-			  task->thread.acrs[8], task->thread.acrs[9],
+-			  task->thread.acrs[10], task->thread.acrs[11]);
+-	seq_printf(m, "           %08x %08x %08x %08x\n",
+-			  task->thread.acrs[12], task->thread.acrs[13],
+-			  task->thread.acrs[14], task->thread.acrs[15]);
+-}
+-
+ static DEFINE_SPINLOCK(die_lock);
+ 
+ void die(const char * str, struct pt_regs * regs, long err)
+diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h
+index 4fab24d..4564c8e 100644
+--- a/arch/x86/include/asm/cpu.h
++++ b/arch/x86/include/asm/cpu.h
+@@ -32,5 +32,6 @@ extern void arch_unregister_cpu(int);
+ 
+ DECLARE_PER_CPU(int, cpu_state);
+ 
++int mwait_usable(const struct cpuinfo_x86 *);
+ 
+ #endif /* _ASM_X86_CPU_H */
+diff --git a/arch/x86/kernel/apb_timer.c b/arch/x86/kernel/apb_timer.c
+index 92543c7..5181673 100644
+--- a/arch/x86/kernel/apb_timer.c
++++ b/arch/x86/kernel/apb_timer.c
+@@ -313,10 +313,12 @@ static void apbt_setup_irq(struct apbt_dev *adev)
+ 	if (adev->irq == 0)
+ 		return;
+ 
++	irq_modify_status(adev->irq, 0, IRQ_MOVE_PCNTXT);
++	irq_set_affinity(adev->irq, cpumask_of(adev->cpu));
++	/* APB timer irqs are set up as mp_irqs, timer is edge type */
++	__set_irq_handler(adev->irq, handle_edge_irq, 0, "edge");
++
+ 	if (system_state == SYSTEM_BOOTING) {
+-		irq_modify_status(adev->irq, 0, IRQ_MOVE_PCNTXT);
+-		/* APB timer irqs are set up as mp_irqs, timer is edge type */
+-		__set_irq_handler(adev->irq, handle_edge_irq, 0, "edge");
+ 		if (request_irq(adev->irq, apbt_interrupt_handler,
+ 				IRQF_TIMER | IRQF_DISABLED | IRQF_NOBALANCING,
+ 				adev->name, adev)) {
+diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
+index 96656f2..5206bb9 100644
+--- a/arch/x86/kernel/irq_32.c
++++ b/arch/x86/kernel/irq_32.c
+@@ -129,8 +129,7 @@ void __cpuinit irq_ctx_init(int cpu)
+ 	irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
+ 					       THREAD_FLAGS,
+ 					       THREAD_ORDER));
+-	irqctx->tinfo.task		= NULL;
+-	irqctx->tinfo.exec_domain	= NULL;
++	memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
+ 	irqctx->tinfo.cpu		= cpu;
+ 	irqctx->tinfo.preempt_count	= HARDIRQ_OFFSET;
+ 	irqctx->tinfo.addr_limit	= MAKE_MM_SEG(0);
+@@ -140,10 +139,8 @@ void __cpuinit irq_ctx_init(int cpu)
+ 	irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
+ 					       THREAD_FLAGS,
+ 					       THREAD_ORDER));
+-	irqctx->tinfo.task		= NULL;
+-	irqctx->tinfo.exec_domain	= NULL;
++	memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
+ 	irqctx->tinfo.cpu		= cpu;
+-	irqctx->tinfo.preempt_count	= 0;
+ 	irqctx->tinfo.addr_limit	= MAKE_MM_SEG(0);
+ 
+ 	per_cpu(softirq_ctx, cpu) = irqctx;
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 2502aaf..12d4bf1 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -14,6 +14,7 @@
+ #include <linux/utsname.h>
+ #include <trace/events/power.h>
+ #include <linux/hw_breakpoint.h>
++#include <asm/cpu.h>
+ #include <asm/system.h>
+ #include <asm/apic.h>
+ #include <asm/syscalls.h>
+@@ -509,13 +510,13 @@ static void poll_idle(void)
+  *
+  * idle=mwait overrides this decision and forces the usage of mwait.
+  */
+-static int __cpuinitdata force_mwait;
++static int force_mwait;
+ 
+ #define MWAIT_INFO			0x05
+ #define MWAIT_ECX_EXTENDED_INFO		0x01
+ #define MWAIT_EDX_C1			0xf0
+ 
+-static int __cpuinit mwait_usable(const struct cpuinfo_x86 *c)
++int mwait_usable(const struct cpuinfo_x86 *c)
+ {
+ 	u32 eax, ebx, ecx, edx;
+ 
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 083e99d..d8fd571 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1396,8 +1396,9 @@ static inline void mwait_play_dead(void)
+ 	unsigned int highest_subcstate = 0;
+ 	int i;
+ 	void *mwait_ptr;
++	struct cpuinfo_x86 *c = &current_cpu_data;
+ 
+-	if (!cpu_has(&current_cpu_data, X86_FEATURE_MWAIT))
++	if (!(cpu_has(c, X86_FEATURE_MWAIT) && mwait_usable(c)))
+ 		return;
+ 	if (!cpu_has(&current_cpu_data, X86_FEATURE_CLFLSH))
+ 		return;
+diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
+index 44924e5..198df8d 100644
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -395,6 +395,18 @@ void __init xen_build_dynamic_phys_to_machine(void)
+ 			p2m_top[topidx] = mid;
+ 		}
+ 
++		/*
++		 * As long as the mfn_list has enough entries to completely
++		 * fill a p2m page, pointing into the array is ok. But if
++		 * not the entries beyond the last pfn will be undefined.
++		 */
++		if (unlikely(pfn + P2M_PER_PAGE > max_pfn)) {
++			unsigned long p2midx;
++
++			p2midx = max_pfn % P2M_PER_PAGE;
++			for ( ; p2midx < P2M_PER_PAGE; p2midx++)
++				mfn_list[pfn + p2midx] = INVALID_P2M_ENTRY;
++		}
+ 		p2m_top[topidx][mididx] = &mfn_list[pfn];
+ 	}
+ }
+diff --git a/drivers/acpi/wakeup.c b/drivers/acpi/wakeup.c
+index f62a50c..3f3ab8f 100644
+--- a/drivers/acpi/wakeup.c
++++ b/drivers/acpi/wakeup.c
+@@ -84,8 +84,12 @@ int __init acpi_wakeup_device_init(void)
+ 		struct acpi_device *dev = container_of(node,
+ 						       struct acpi_device,
+ 						       wakeup_list);
+-		if (dev->wakeup.flags.always_enabled)
++		if (dev->wakeup.flags.always_enabled) {
++			/* Button GPEs are supposed to be always enabled. */
++			acpi_enable_gpe(dev->wakeup.gpe_device,
++					dev->wakeup.gpe_number);
+ 			dev->wakeup.state.enabled = 1;
++		}
+ 	}
+ 	mutex_unlock(&acpi_device_lock);
+ 	return 0;
+diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
+index 55d0466..d5284bc 100644
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -577,11 +577,9 @@ duration:
+ 	if (rc)
+ 		return;
+ 
+-	if (be32_to_cpu(tpm_cmd.header.out.return_code) != 0 ||
+-	    be32_to_cpu(tpm_cmd.header.out.length)
+-	    != sizeof(tpm_cmd.header.out) + sizeof(u32) + 3 * sizeof(u32))
++	if (be32_to_cpu(tpm_cmd.header.out.return_code)
++	    != 3 * sizeof(u32))
+ 		return;
+-
+ 	duration_cap = &tpm_cmd.params.getcap_out.cap.duration;
+ 	chip->vendor.duration[TPM_SHORT] =
+ 	    usecs_to_jiffies(be32_to_cpu(duration_cap->tpm_short));
+@@ -925,18 +923,6 @@ ssize_t tpm_show_caps_1_2(struct device * dev,
+ }
+ EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
+ 
+-ssize_t tpm_show_timeouts(struct device *dev, struct device_attribute *attr,
+-			  char *buf)
+-{
+-	struct tpm_chip *chip = dev_get_drvdata(dev);
+-
+-	return sprintf(buf, "%d %d %d\n",
+-	               jiffies_to_usecs(chip->vendor.duration[TPM_SHORT]),
+-	               jiffies_to_usecs(chip->vendor.duration[TPM_MEDIUM]),
+-	               jiffies_to_usecs(chip->vendor.duration[TPM_LONG]));
+-}
+-EXPORT_SYMBOL_GPL(tpm_show_timeouts);
+-
+ ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
+ 			const char *buf, size_t count)
+ {
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index ba1779c..792868d 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -56,8 +56,6 @@ extern ssize_t tpm_show_owned(struct device *, struct device_attribute *attr,
+ 				char *);
+ extern ssize_t tpm_show_temp_deactivated(struct device *,
+ 					 struct device_attribute *attr, char *);
+-extern ssize_t tpm_show_timeouts(struct device *,
+-				 struct device_attribute *attr, char *);
+ 
+ struct tpm_chip;
+ 
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index 0d1d38e..dd21df5 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -376,7 +376,6 @@ static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
+ 		   NULL);
+ static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+ static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+-static DEVICE_ATTR(timeouts, S_IRUGO, tpm_show_timeouts, NULL);
+ 
+ static struct attribute *tis_attrs[] = {
+ 	&dev_attr_pubek.attr,
+@@ -386,8 +385,7 @@ static struct attribute *tis_attrs[] = {
+ 	&dev_attr_owned.attr,
+ 	&dev_attr_temp_deactivated.attr,
+ 	&dev_attr_caps.attr,
+-	&dev_attr_cancel.attr,
+-	&dev_attr_timeouts.attr, NULL,
++	&dev_attr_cancel.attr, NULL,
+ };
+ 
+ static struct attribute_group tis_attr_grp = {
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index c1f13bf..5f08e2c 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1343,17 +1343,24 @@ intel_dp_complete_link_train(struct intel_dp *intel_dp)
+ 	struct drm_device *dev = intel_dp->base.base.dev;
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	bool channel_eq = false;
+-	int tries;
++	int tries, cr_tries;
+ 	u32 reg;
+ 	uint32_t DP = intel_dp->DP;
+ 
+ 	/* channel equalization */
+ 	tries = 0;
++	cr_tries = 0;
+ 	channel_eq = false;
+ 	for (;;) {
+ 		/* Use intel_dp->train_set[0] to set the voltage and pre emphasis values */
+ 		uint32_t    signal_levels;
+ 
++		if (cr_tries > 5) {
++			DRM_ERROR("failed to train DP, aborting\n");
++			intel_dp_link_down(intel_dp);
++			break;
++		}
++
+ 		if (IS_GEN6(dev) && is_edp(intel_dp)) {
+ 			signal_levels = intel_gen6_edp_signal_levels(intel_dp->train_set[0]);
+ 			DP = (DP & ~EDP_LINK_TRAIN_VOL_EMP_MASK_SNB) | signal_levels;
+@@ -1376,14 +1383,26 @@ intel_dp_complete_link_train(struct intel_dp *intel_dp)
+ 		if (!intel_dp_get_link_status(intel_dp))
+ 			break;
+ 
++		/* Make sure clock is still ok */
++		if (!intel_clock_recovery_ok(intel_dp->link_status, intel_dp->lane_count)) {
++			intel_dp_start_link_train(intel_dp);
++			cr_tries++;
++			continue;
++		}
++
+ 		if (intel_channel_eq_ok(intel_dp)) {
+ 			channel_eq = true;
+ 			break;
+ 		}
+ 
+-		/* Try 5 times */
+-		if (tries > 5)
+-			break;
++		/* Try 5 times, then try clock recovery if that fails */
++		if (tries > 5) {
++			intel_dp_link_down(intel_dp);
++			intel_dp_start_link_train(intel_dp);
++			tries = 0;
++			cr_tries++;
++			continue;
++		}
+ 
+ 		/* Compute new intel_dp->train_set as requested by target */
+ 		intel_get_adjust_train(intel_dp);
+diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
+index 920ca27..c0de519 100644
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -46,6 +46,7 @@
+                          SDVO_TV_MASK)
+ 
+ #define IS_TV(c)	(c->output_flag & SDVO_TV_MASK)
++#define IS_TMDS(c)	(c->output_flag & SDVO_TMDS_MASK)
+ #define IS_LVDS(c)	(c->output_flag & SDVO_LVDS_MASK)
+ #define IS_TV_OR_LVDS(c) (c->output_flag & (SDVO_TV_MASK | SDVO_LVDS_MASK))
+ 
+@@ -1356,7 +1357,8 @@ intel_sdvo_hdmi_sink_detect(struct drm_connector *connector)
+ 				intel_sdvo->has_hdmi_monitor = drm_detect_hdmi_monitor(edid);
+ 				intel_sdvo->has_hdmi_audio = drm_detect_monitor_audio(edid);
+ 			}
+-		}
++		} else
++			status = connector_status_disconnected;
+ 		connector->display_info.raw_edid = NULL;
+ 		kfree(edid);
+ 	}
+@@ -1404,10 +1406,25 @@ intel_sdvo_detect(struct drm_connector *connector, bool force)
+ 
+ 	if ((intel_sdvo_connector->output_flag & response) == 0)
+ 		ret = connector_status_disconnected;
+-	else if (response & SDVO_TMDS_MASK)
++	else if (IS_TMDS(intel_sdvo_connector))
+ 		ret = intel_sdvo_hdmi_sink_detect(connector);
+-	else
+-		ret = connector_status_connected;
++	else {
++		struct edid *edid;
++
++		/* if we have an edid check it matches the connection */
++		edid = intel_sdvo_get_edid(connector);
++		if (edid == NULL)
++			edid = intel_sdvo_get_analog_edid(connector);
++		if (edid != NULL) {
++			if (edid->input & DRM_EDID_INPUT_DIGITAL)
++				ret = connector_status_disconnected;
++			else
++				ret = connector_status_connected;
++			connector->display_info.raw_edid = NULL;
++			kfree(edid);
++		} else
++			ret = connector_status_connected;
++	}
+ 
+ 	/* May update encoder flag for like clock for SDVO TV, etc.*/
+ 	if (ret == connector_status_connected) {
+@@ -1443,10 +1460,15 @@ static void intel_sdvo_get_ddc_modes(struct drm_connector *connector)
+ 		edid = intel_sdvo_get_analog_edid(connector);
+ 
+ 	if (edid != NULL) {
+-		if (edid->input & DRM_EDID_INPUT_DIGITAL) {
++		struct intel_sdvo_connector *intel_sdvo_connector = to_intel_sdvo_connector(connector);
++		bool monitor_is_digital = !!(edid->input & DRM_EDID_INPUT_DIGITAL);
++		bool connector_is_digital = !!IS_TMDS(intel_sdvo_connector);
++
++		if (connector_is_digital == monitor_is_digital) {
+ 			drm_mode_connector_update_edid_property(connector, edid);
+ 			drm_add_edid_modes(connector, edid);
+ 		}
++
+ 		connector->display_info.raw_edid = NULL;
+ 		kfree(edid);
+ 	}
+diff --git a/drivers/gpu/drm/nouveau/Kconfig b/drivers/gpu/drm/nouveau/Kconfig
+index 72730e9..21d6c29 100644
+--- a/drivers/gpu/drm/nouveau/Kconfig
++++ b/drivers/gpu/drm/nouveau/Kconfig
+@@ -10,7 +10,7 @@ config DRM_NOUVEAU
+ 	select FB
+ 	select FRAMEBUFFER_CONSOLE if !EMBEDDED
+ 	select FB_BACKLIGHT if DRM_NOUVEAU_BACKLIGHT
+-	select ACPI_VIDEO if ACPI
++	select ACPI_VIDEO if ACPI && X86 && BACKLIGHT_CLASS_DEVICE && VIDEO_OUTPUT_CONTROL && INPUT
+ 	help
+ 	  Choose this option for open-source nVidia support.
+ 
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 6b7fc4b..ee14b8a 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -514,7 +514,6 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ 			pll->flags |= RADEON_PLL_PREFER_HIGH_FB_DIV;
+ 		else
+ 			pll->flags |= RADEON_PLL_PREFER_LOW_REF_DIV;
+-
+ 	}
+ 
+ 	list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+@@ -531,29 +530,28 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ 					dp_clock = dig_connector->dp_clock;
+ 				}
+ 			}
+-/* this might work properly with the new pll algo */
+-#if 0 /* doesn't work properly on some laptops */
++
+ 			/* use recommended ref_div for ss */
+ 			if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
+ 				if (ss_enabled) {
+ 					if (ss->refdiv) {
++						pll->flags |= RADEON_PLL_PREFER_MINM_OVER_MAXP;
+ 						pll->flags |= RADEON_PLL_USE_REF_DIV;
+ 						pll->reference_div = ss->refdiv;
++						if (ASIC_IS_AVIVO(rdev))
++							pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ 					}
+ 				}
+ 			}
+-#endif
++
+ 			if (ASIC_IS_AVIVO(rdev)) {
+ 				/* DVO wants 2x pixel clock if the DVO chip is in 12 bit mode */
+ 				if (radeon_encoder->encoder_id == ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DVO1)
+ 					adjusted_clock = mode->clock * 2;
+ 				if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT))
+ 					pll->flags |= RADEON_PLL_PREFER_CLOSEST_LOWER;
+-				/* rv515 needs more testing with this option */
+-				if (rdev->family != CHIP_RV515) {
+-					if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT))
+-						pll->flags |= RADEON_PLL_IS_LCD;
+-				}
++				if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT))
++					pll->flags |= RADEON_PLL_IS_LCD;
+ 			} else {
+ 				if (encoder->encoder_type != DRM_MODE_ENCODER_DAC)
+ 					pll->flags |= RADEON_PLL_NO_ODD_POST_DIV;
+@@ -652,10 +650,12 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
+ 						   index, (uint32_t *)&args);
+ 				adjusted_clock = le32_to_cpu(args.v3.sOutput.ulDispPllFreq) * 10;
+ 				if (args.v3.sOutput.ucRefDiv) {
++					pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ 					pll->flags |= RADEON_PLL_USE_REF_DIV;
+ 					pll->reference_div = args.v3.sOutput.ucRefDiv;
+ 				}
+ 				if (args.v3.sOutput.ucPostDiv) {
++					pll->flags |= RADEON_PLL_USE_FRAC_FB_DIV;
+ 					pll->flags |= RADEON_PLL_USE_POST_DIV;
+ 					pll->post_div = args.v3.sOutput.ucPostDiv;
+ 				}
+@@ -921,11 +921,7 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
+ 	/* adjust pixel clock as needed */
+ 	adjusted_clock = atombios_adjust_pll(crtc, mode, pll, ss_enabled, &ss);
+ 
+-	/* rv515 seems happier with the old algo */
+-	if (rdev->family == CHIP_RV515)
+-		radeon_compute_pll_legacy(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
+-					  &ref_div, &post_div);
+-	else if (ASIC_IS_AVIVO(rdev))
++	if (ASIC_IS_AVIVO(rdev))
+ 		radeon_compute_pll_avivo(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
+ 					 &ref_div, &post_div);
+ 	else
+@@ -959,9 +955,9 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
+ 	}
+ }
+ 
+-static int evergreen_crtc_do_set_base(struct drm_crtc *crtc,
+-				      struct drm_framebuffer *fb,
+-				      int x, int y, int atomic)
++static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
++				 struct drm_framebuffer *fb,
++				 int x, int y, int atomic)
+ {
+ 	struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+ 	struct drm_device *dev = crtc->dev;
+@@ -1093,12 +1089,6 @@ static int evergreen_crtc_do_set_base(struct drm_crtc *crtc,
+ 	WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+ 	       (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay);
+ 
+-	if (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE)
+-		WREG32(EVERGREEN_DATA_FORMAT + radeon_crtc->crtc_offset,
+-		       EVERGREEN_INTERLEAVE_EN);
+-	else
+-		WREG32(EVERGREEN_DATA_FORMAT + radeon_crtc->crtc_offset, 0);
+-
+ 	if (!atomic && fb && fb != crtc->fb) {
+ 		radeon_fb = to_radeon_framebuffer(fb);
+ 		rbo = radeon_fb->obj->driver_private;
+@@ -1247,12 +1237,6 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
+ 	WREG32(AVIVO_D1MODE_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+ 	       (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay);
+ 
+-	if (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE)
+-		WREG32(AVIVO_D1MODE_DATA_FORMAT + radeon_crtc->crtc_offset,
+-		       AVIVO_D1MODE_INTERLEAVE_EN);
+-	else
+-		WREG32(AVIVO_D1MODE_DATA_FORMAT + radeon_crtc->crtc_offset, 0);
+-
+ 	if (!atomic && fb && fb != crtc->fb) {
+ 		radeon_fb = to_radeon_framebuffer(fb);
+ 		rbo = radeon_fb->obj->driver_private;
+@@ -1276,7 +1260,7 @@ int atombios_crtc_set_base(struct drm_crtc *crtc, int x, int y,
+ 	struct radeon_device *rdev = dev->dev_private;
+ 
+ 	if (ASIC_IS_DCE4(rdev))
+-		return evergreen_crtc_do_set_base(crtc, old_fb, x, y, 0);
++		return dce4_crtc_do_set_base(crtc, old_fb, x, y, 0);
+ 	else if (ASIC_IS_AVIVO(rdev))
+ 		return avivo_crtc_do_set_base(crtc, old_fb, x, y, 0);
+ 	else
+@@ -1291,7 +1275,7 @@ int atombios_crtc_set_base_atomic(struct drm_crtc *crtc,
+        struct radeon_device *rdev = dev->dev_private;
+ 
+ 	if (ASIC_IS_DCE4(rdev))
+-		return evergreen_crtc_do_set_base(crtc, fb, x, y, 1);
++		return dce4_crtc_do_set_base(crtc, fb, x, y, 1);
+ 	else if (ASIC_IS_AVIVO(rdev))
+ 		return avivo_crtc_do_set_base(crtc, fb, x, y, 1);
+ 	else
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index 7831e08..153095f 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -295,17 +295,18 @@ static inline int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
+ 	}
+ 
+ 	if (!IS_ALIGNED(pitch, pitch_align)) {
+-		dev_warn(p->dev, "%s:%d cb pitch (%d) invalid\n",
+-			 __func__, __LINE__, pitch);
++		dev_warn(p->dev, "%s:%d cb pitch (%d, 0x%x, %d) invalid\n",
++			 __func__, __LINE__, pitch, pitch_align, array_mode);
+ 		return -EINVAL;
+ 	}
+ 	if (!IS_ALIGNED(height, height_align)) {
+-		dev_warn(p->dev, "%s:%d cb height (%d) invalid\n",
+-			 __func__, __LINE__, height);
++		dev_warn(p->dev, "%s:%d cb height (%d, 0x%x, %d) invalid\n",
++			 __func__, __LINE__, height, height_align, array_mode);
+ 		return -EINVAL;
+ 	}
+ 	if (!IS_ALIGNED(base_offset, base_align)) {
+-		dev_warn(p->dev, "%s offset[%d] 0x%llx not aligned\n", __func__, i, base_offset);
++		dev_warn(p->dev, "%s offset[%d] 0x%llx 0x%llx, %d not aligned\n", __func__, i,
++			 base_offset, base_align, array_mode);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -320,7 +321,10 @@ static inline int r600_cs_track_validate_cb(struct radeon_cs_parser *p, int i)
+ 			 * broken userspace.
+ 			 */
+ 		} else {
+-			dev_warn(p->dev, "%s offset[%d] %d %d %lu too big\n", __func__, i, track->cb_color_bo_offset[i], tmp, radeon_bo_size(track->cb_color_bo[i]));
++			dev_warn(p->dev, "%s offset[%d] %d %d %d %lu too big\n", __func__, i,
++				 array_mode,
++				 track->cb_color_bo_offset[i], tmp,
++				 radeon_bo_size(track->cb_color_bo[i]));
+ 			return -EINVAL;
+ 		}
+ 	}
+@@ -455,17 +459,18 @@ static int r600_cs_track_check(struct radeon_cs_parser *p)
+ 			}
+ 
+ 			if (!IS_ALIGNED(pitch, pitch_align)) {
+-				dev_warn(p->dev, "%s:%d db pitch (%d) invalid\n",
+-					 __func__, __LINE__, pitch);
++				dev_warn(p->dev, "%s:%d db pitch (%d, 0x%x, %d) invalid\n",
++					 __func__, __LINE__, pitch, pitch_align, array_mode);
+ 				return -EINVAL;
+ 			}
+ 			if (!IS_ALIGNED(height, height_align)) {
+-				dev_warn(p->dev, "%s:%d db height (%d) invalid\n",
+-					 __func__, __LINE__, height);
++				dev_warn(p->dev, "%s:%d db height (%d, 0x%x, %d) invalid\n",
++					 __func__, __LINE__, height, height_align, array_mode);
+ 				return -EINVAL;
+ 			}
+ 			if (!IS_ALIGNED(base_offset, base_align)) {
+-				dev_warn(p->dev, "%s offset[%d] 0x%llx not aligned\n", __func__, i, base_offset);
++				dev_warn(p->dev, "%s offset[%d] 0x%llx, 0x%llx, %d not aligned\n", __func__, i,
++					 base_offset, base_align, array_mode);
+ 				return -EINVAL;
+ 			}
+ 
+@@ -473,9 +478,10 @@ static int r600_cs_track_check(struct radeon_cs_parser *p)
+ 			nviews = G_028004_SLICE_MAX(track->db_depth_view) + 1;
+ 			tmp = ntiles * bpe * 64 * nviews;
+ 			if ((tmp + track->db_offset) > radeon_bo_size(track->db_bo)) {
+-				dev_warn(p->dev, "z/stencil buffer too small (0x%08X %d %d %d -> %u have %lu)\n",
+-						track->db_depth_size, ntiles, nviews, bpe, tmp + track->db_offset,
+-						radeon_bo_size(track->db_bo));
++				dev_warn(p->dev, "z/stencil buffer (%d) too small (0x%08X %d %d %d -> %u have %lu)\n",
++					 array_mode,
++					 track->db_depth_size, ntiles, nviews, bpe, tmp + track->db_offset,
++					 radeon_bo_size(track->db_bo));
+ 				return -EINVAL;
+ 			}
+ 		}
+@@ -1227,18 +1233,18 @@ static inline int r600_check_texture_resource(struct radeon_cs_parser *p,  u32 i
+ 	/* XXX check height as well... */
+ 
+ 	if (!IS_ALIGNED(pitch, pitch_align)) {
+-		dev_warn(p->dev, "%s:%d tex pitch (%d) invalid\n",
+-			 __func__, __LINE__, pitch);
++		dev_warn(p->dev, "%s:%d tex pitch (%d, 0x%x, %d) invalid\n",
++			 __func__, __LINE__, pitch, pitch_align, G_038000_TILE_MODE(word0));
+ 		return -EINVAL;
+ 	}
+ 	if (!IS_ALIGNED(base_offset, base_align)) {
+-		dev_warn(p->dev, "%s:%d tex base offset (0x%llx) invalid\n",
+-			 __func__, __LINE__, base_offset);
++		dev_warn(p->dev, "%s:%d tex base offset (0x%llx, 0x%llx, %d) invalid\n",
++			 __func__, __LINE__, base_offset, base_align, G_038000_TILE_MODE(word0));
+ 		return -EINVAL;
+ 	}
+ 	if (!IS_ALIGNED(mip_offset, base_align)) {
+-		dev_warn(p->dev, "%s:%d tex mip offset (0x%llx) invalid\n",
+-			 __func__, __LINE__, mip_offset);
++		dev_warn(p->dev, "%s:%d tex mip offset (0x%llx, 0x%llx, %d) invalid\n",
++			 __func__, __LINE__, mip_offset, base_align, G_038000_TILE_MODE(word0));
+ 		return -EINVAL;
+ 	}
+ 
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index 137b807..57bee7e 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -1503,6 +1503,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
+ 			   (rdev->pdev->subsystem_device == 0x4a48)) {
+ 			/* Mac X800 */
+ 			rdev->mode_info.connector_table = CT_MAC_X800;
++		} else if ((rdev->pdev->device == 0x4150) &&
++			   (rdev->pdev->subsystem_vendor == 0x1002) &&
++			   (rdev->pdev->subsystem_device == 0x4150)) {
++			/* Mac G5 9600 */
++			rdev->mode_info.connector_table = CT_MAC_G5_9600;
+ 		} else
+ #endif /* CONFIG_PPC_PMAC */
+ #ifdef CONFIG_PPC64
+@@ -2021,6 +2026,48 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
+ 					    CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I,
+ 					    &hpd);
+ 		break;
++	case CT_MAC_G5_9600:
++		DRM_INFO("Connector Table: %d (mac g5 9600)\n",
++			 rdev->mode_info.connector_table);
++		/* DVI - tv dac, dvo */
++		ddc_i2c = combios_setup_i2c_bus(rdev, DDC_DVI, 0, 0);
++		hpd.hpd = RADEON_HPD_1; /* ??? */
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								  ATOM_DEVICE_DFP2_SUPPORT,
++								  0),
++					  ATOM_DEVICE_DFP2_SUPPORT);
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								  ATOM_DEVICE_CRT2_SUPPORT,
++								  2),
++					  ATOM_DEVICE_CRT2_SUPPORT);
++		radeon_add_legacy_connector(dev, 0,
++					    ATOM_DEVICE_DFP2_SUPPORT |
++					    ATOM_DEVICE_CRT2_SUPPORT,
++					    DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
++					    &hpd);
++		/* ADC - primary dac, internal tmds */
++		ddc_i2c = combios_setup_i2c_bus(rdev, DDC_VGA, 0, 0);
++		hpd.hpd = RADEON_HPD_2; /* ??? */
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								  ATOM_DEVICE_DFP1_SUPPORT,
++								  0),
++					  ATOM_DEVICE_DFP1_SUPPORT);
++		radeon_add_legacy_encoder(dev,
++					  radeon_get_encoder_enum(dev,
++								  ATOM_DEVICE_CRT1_SUPPORT,
++								  1),
++					  ATOM_DEVICE_CRT1_SUPPORT);
++		radeon_add_legacy_connector(dev, 1,
++					    ATOM_DEVICE_DFP1_SUPPORT |
++					    ATOM_DEVICE_CRT1_SUPPORT,
++					    DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
++					    CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
++					    &hpd);
++		break;
+ 	default:
+ 		DRM_INFO("Connector table: %d (invalid)\n",
+ 			 rdev->mode_info.connector_table);
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index a26a70d..c7d1fca 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -461,6 +461,11 @@ static void avivo_get_fb_div(struct radeon_pll *pll,
+ 	tmp *= target_clock;
+ 	*fb_div = tmp / pll->reference_freq;
+ 	*frac_fb_div = tmp % pll->reference_freq;
++
++        if (*fb_div > pll->max_feedback_div)
++		*fb_div = pll->max_feedback_div;
++        else if (*fb_div < pll->min_feedback_div)
++                *fb_div = pll->min_feedback_div;
+ }
+ 
+ static u32 avivo_get_post_div(struct radeon_pll *pll,
+@@ -494,6 +499,11 @@ static u32 avivo_get_post_div(struct radeon_pll *pll,
+ 			post_div--;
+ 	}
+ 
++	if (post_div > pll->max_post_div)
++		post_div = pll->max_post_div;
++	else if (post_div < pll->min_post_div)
++		post_div = pll->min_post_div;
++
+ 	return post_div;
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
+index 041943d..6a3d063 100644
+--- a/drivers/gpu/drm/radeon/radeon_encoders.c
++++ b/drivers/gpu/drm/radeon/radeon_encoders.c
+@@ -1465,11 +1465,21 @@ atombios_apply_encoder_quirks(struct drm_encoder *encoder,
+ 	}
+ 
+ 	/* set scaler clears this on some chips */
+-	/* XXX check DCE4 */
+-	if (!(radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT))) {
+-		if (ASIC_IS_AVIVO(rdev) && (mode->flags & DRM_MODE_FLAG_INTERLACE))
+-			WREG32(AVIVO_D1MODE_DATA_FORMAT + radeon_crtc->crtc_offset,
+-			       AVIVO_D1MODE_INTERLEAVE_EN);
++	if (ASIC_IS_AVIVO(rdev) &&
++	    (!(radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT)))) {
++		if (ASIC_IS_DCE4(rdev)) {
++			if (mode->flags & DRM_MODE_FLAG_INTERLACE)
++				WREG32(EVERGREEN_DATA_FORMAT + radeon_crtc->crtc_offset,
++				       EVERGREEN_INTERLEAVE_EN);
++			else
++				WREG32(EVERGREEN_DATA_FORMAT + radeon_crtc->crtc_offset, 0);
++		} else {
++			if (mode->flags & DRM_MODE_FLAG_INTERLACE)
++				WREG32(AVIVO_D1MODE_DATA_FORMAT + radeon_crtc->crtc_offset,
++				       AVIVO_D1MODE_INTERLEAVE_EN);
++			else
++				WREG32(AVIVO_D1MODE_DATA_FORMAT + radeon_crtc->crtc_offset, 0);
++		}
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
+index aa22570..2615e51 100644
+--- a/drivers/gpu/drm/radeon/radeon_mode.h
++++ b/drivers/gpu/drm/radeon/radeon_mode.h
+@@ -209,6 +209,7 @@ enum radeon_connector_table {
+ 	CT_EMAC,
+ 	CT_RN50_POWER,
+ 	CT_MAC_X800,
++	CT_MAC_G5_9600,
+ };
+ 
+ enum radeon_dvo_chip {
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index 1272e4b..e5b2cf1 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -787,9 +787,9 @@ static int radeon_ttm_debugfs_init(struct radeon_device *rdev)
+ 		radeon_mem_types_list[i].show = &radeon_mm_dump_table;
+ 		radeon_mem_types_list[i].driver_features = 0;
+ 		if (i == 0)
+-			radeon_mem_types_list[i].data = &rdev->mman.bdev.man[TTM_PL_VRAM].priv;
++			radeon_mem_types_list[i].data = rdev->mman.bdev.man[TTM_PL_VRAM].priv;
+ 		else
+-			radeon_mem_types_list[i].data = &rdev->mman.bdev.man[TTM_PL_TT].priv;
++			radeon_mem_types_list[i].data = rdev->mman.bdev.man[TTM_PL_TT].priv;
+ 
+ 	}
+ 	/* Add ttm page pool to debugfs */
+diff --git a/drivers/hid/hid-cando.c b/drivers/hid/hid-cando.c
+index 5925bdc..343c41b 100644
+--- a/drivers/hid/hid-cando.c
++++ b/drivers/hid/hid-cando.c
+@@ -236,6 +236,8 @@ static const struct hid_device_id cando_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+ 			USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
++			USB_DEVICE_ID_CANDO_MULTI_TOUCH_10_1) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+ 			USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+ 		USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 88cb04e..52cf7ca 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1287,6 +1287,7 @@ static const struct hid_device_id hid_blacklist[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_10_1) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
+@@ -1390,6 +1391,7 @@ static const struct hid_device_id hid_blacklist[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_PF1209) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 3341baa..f04789d 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -135,6 +135,7 @@
+ 
+ #define USB_VENDOR_ID_CANDO		0x2087
+ #define USB_DEVICE_ID_CANDO_MULTI_TOUCH	0x0a01
++#define USB_DEVICE_ID_CANDO_MULTI_TOUCH_10_1 0x0a02
+ #define USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6 0x0b03
+ #define USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6 0x0f01
+ 
+diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
+index e6dc151..ed732b7 100644
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -433,6 +433,11 @@ static int magicmouse_input_mapping(struct hid_device *hdev,
+ 	if (!msc->input)
+ 		msc->input = hi->input;
+ 
++	/* Magic Trackpad does not give relative data after switching to MT */
++	if (hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD &&
++	    field->flags & HID_MAIN_ITEM_RELATIVE)
++		return -1;
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/hid/hid-mosart.c b/drivers/hid/hid-mosart.c
+index ac5421d..251eaa4 100644
+--- a/drivers/hid/hid-mosart.c
++++ b/drivers/hid/hid-mosart.c
+@@ -240,6 +240,7 @@ static void mosart_remove(struct hid_device *hdev)
+ static const struct hid_device_id mosart_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_T91MT) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUSTEK_MULTITOUCH_YFO) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART) },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(hid, mosart_devices);
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 2c18547..af34376 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -35,7 +35,6 @@ static const struct hid_blacklist {
+ 	{ USB_VENDOR_ID_CHIC, USB_DEVICE_ID_CHIC_GAMEPAD, HID_QUIRK_BADPAD },
+ 	{ USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER, HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_MOJO, USB_DEVICE_ID_RETRO_ADAPTER, HID_QUIRK_MULTI_INPUT },
+-	{ USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART, HID_QUIRK_MULTI_INPUT },
+ 	{ USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ 	{ USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ 	{ USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
+index a56f6ad..004ff55 100644
+--- a/drivers/hwmon/Kconfig
++++ b/drivers/hwmon/Kconfig
+@@ -238,13 +238,13 @@ config SENSORS_K8TEMP
+ 	  will be called k8temp.
+ 
+ config SENSORS_K10TEMP
+-	tristate "AMD Phenom/Sempron/Turion/Opteron temperature sensor"
++	tristate "AMD Family 10h/11h/12h/14h temperature sensor"
+ 	depends on X86 && PCI
+ 	help
+ 	  If you say yes here you get support for the temperature
+ 	  sensor(s) inside your CPU. Supported are later revisions of
+-	  the AMD Family 10h and all revisions of the AMD Family 11h
+-	  microarchitectures.
++	  the AMD Family 10h and all revisions of the AMD Family 11h,
++	  12h (Llano), and 14h (Brazos) microarchitectures.
+ 
+ 	  This driver can also be built as a module.  If so, the module
+ 	  will be called k10temp.
+@@ -445,13 +445,14 @@ config SENSORS_JZ4740
+ 	  called jz4740-hwmon.
+ 
+ config SENSORS_JC42
+-	tristate "JEDEC JC42.4 compliant temperature sensors"
++	tristate "JEDEC JC42.4 compliant memory module temperature sensors"
+ 	depends on I2C
+ 	help
+-	  If you say yes here you get support for Jedec JC42.4 compliant
+-	  temperature sensors. Support will include, but not be limited to,
+-	  ADT7408, CAT34TS02,, CAT6095, MAX6604, MCP9805, MCP98242, MCP98243,
+-	  MCP9843, SE97, SE98, STTS424, TSE2002B3, and TS3000B3.
++	  If you say yes here, you get support for JEDEC JC42.4 compliant
++	  temperature sensors, which are used on many DDR3 memory modules for
++	  mobile devices and servers.  Support will include, but not be limited
++	  to, ADT7408, CAT34TS02, CAT6095, MAX6604, MCP9805, MCP98242, MCP98243,
++	  MCP9843, SE97, SE98, STTS424(E), TSE2002B3, and TS3000B3.
+ 
+ 	  This driver can also be built as a module.  If so, the module
+ 	  will be called jc42.
+@@ -564,7 +565,7 @@ config SENSORS_LM85
+ 	help
+ 	  If you say yes here you get support for National Semiconductor LM85
+ 	  sensor chips and clones: ADM1027, ADT7463, ADT7468, EMC6D100,
+-	  EMC6D101 and EMC6D102.
++	  EMC6D101, EMC6D102, and EMC6D103.
+ 
+ 	  This driver can also be built as a module.  If so, the module
+ 	  will be called lm85.
+diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c
+index 340fc78..9349912 100644
+--- a/drivers/hwmon/jc42.c
++++ b/drivers/hwmon/jc42.c
+@@ -53,6 +53,8 @@ static const unsigned short normal_i2c[] = {
+ 
+ /* Configuration register defines */
+ #define JC42_CFG_CRIT_ONLY	(1 << 2)
++#define JC42_CFG_TCRIT_LOCK	(1 << 6)
++#define JC42_CFG_EVENT_LOCK	(1 << 7)
+ #define JC42_CFG_SHUTDOWN	(1 << 8)
+ #define JC42_CFG_HYST_SHIFT	9
+ #define JC42_CFG_HYST_MASK	0x03
+@@ -332,7 +334,7 @@ static ssize_t set_temp_crit_hyst(struct device *dev,
+ {
+ 	struct i2c_client *client = to_i2c_client(dev);
+ 	struct jc42_data *data = i2c_get_clientdata(client);
+-	long val;
++	unsigned long val;
+ 	int diff, hyst;
+ 	int err;
+ 	int ret = count;
+@@ -380,14 +382,14 @@ static ssize_t show_alarm(struct device *dev,
+ 
+ static DEVICE_ATTR(temp1_input, S_IRUGO,
+ 		   show_temp_input, NULL);
+-static DEVICE_ATTR(temp1_crit, S_IWUSR | S_IRUGO,
++static DEVICE_ATTR(temp1_crit, S_IRUGO,
+ 		   show_temp_crit, set_temp_crit);
+-static DEVICE_ATTR(temp1_min, S_IWUSR | S_IRUGO,
++static DEVICE_ATTR(temp1_min, S_IRUGO,
+ 		   show_temp_min, set_temp_min);
+-static DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO,
++static DEVICE_ATTR(temp1_max, S_IRUGO,
+ 		   show_temp_max, set_temp_max);
+ 
+-static DEVICE_ATTR(temp1_crit_hyst, S_IWUSR | S_IRUGO,
++static DEVICE_ATTR(temp1_crit_hyst, S_IRUGO,
+ 		   show_temp_crit_hyst, set_temp_crit_hyst);
+ static DEVICE_ATTR(temp1_max_hyst, S_IRUGO,
+ 		   show_temp_max_hyst, NULL);
+@@ -412,8 +414,31 @@ static struct attribute *jc42_attributes[] = {
+ 	NULL
+ };
+ 
++static mode_t jc42_attribute_mode(struct kobject *kobj,
++				  struct attribute *attr, int index)
++{
++	struct device *dev = container_of(kobj, struct device, kobj);
++	struct i2c_client *client = to_i2c_client(dev);
++	struct jc42_data *data = i2c_get_clientdata(client);
++	unsigned int config = data->config;
++	bool readonly;
++
++	if (attr == &dev_attr_temp1_crit.attr)
++		readonly = config & JC42_CFG_TCRIT_LOCK;
++	else if (attr == &dev_attr_temp1_min.attr ||
++		 attr == &dev_attr_temp1_max.attr)
++		readonly = config & JC42_CFG_EVENT_LOCK;
++	else if (attr == &dev_attr_temp1_crit_hyst.attr)
++		readonly = config & (JC42_CFG_EVENT_LOCK | JC42_CFG_TCRIT_LOCK);
++	else
++		readonly = true;
++
++	return S_IRUGO | (readonly ? 0 : S_IWUSR);
++}
++
+ static const struct attribute_group jc42_group = {
+ 	.attrs = jc42_attributes,
++	.is_visible = jc42_attribute_mode,
+ };
+ 
+ /* Return 0 if detection is successful, -ENODEV otherwise */
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index da5a240..82bf65a 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -1,5 +1,5 @@
+ /*
+- * k10temp.c - AMD Family 10h/11h processor hardware monitoring
++ * k10temp.c - AMD Family 10h/11h/12h/14h processor hardware monitoring
+  *
+  * Copyright (c) 2009 Clemens Ladisch <clemens@×××××××.de>
+  *
+@@ -25,7 +25,7 @@
+ #include <linux/pci.h>
+ #include <asm/processor.h>
+ 
+-MODULE_DESCRIPTION("AMD Family 10h/11h CPU core temperature monitor");
++MODULE_DESCRIPTION("AMD Family 10h/11h/12h/14h CPU core temperature monitor");
+ MODULE_AUTHOR("Clemens Ladisch <clemens@×××××××.de>");
+ MODULE_LICENSE("GPL");
+ 
+@@ -208,6 +208,7 @@ static void __devexit k10temp_remove(struct pci_dev *pdev)
+ static const struct pci_device_id k10temp_id_table[] = {
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
+ 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_11H_NB_MISC) },
++	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(pci, k10temp_id_table);
+diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
+index 1e22984..d2cc286 100644
+--- a/drivers/hwmon/lm85.c
++++ b/drivers/hwmon/lm85.c
+@@ -41,7 +41,7 @@ static const unsigned short normal_i2c[] = { 0x2c, 0x2d, 0x2e, I2C_CLIENT_END };
+ enum chips {
+ 	any_chip, lm85b, lm85c,
+ 	adm1027, adt7463, adt7468,
+-	emc6d100, emc6d102
++	emc6d100, emc6d102, emc6d103
+ };
+ 
+ /* The LM85 registers */
+@@ -90,6 +90,9 @@ enum chips {
+ #define	LM85_VERSTEP_EMC6D100_A0        0x60
+ #define	LM85_VERSTEP_EMC6D100_A1        0x61
+ #define	LM85_VERSTEP_EMC6D102		0x65
++#define	LM85_VERSTEP_EMC6D103_A0	0x68
++#define	LM85_VERSTEP_EMC6D103_A1	0x69
++#define	LM85_VERSTEP_EMC6D103S		0x6A	/* Also known as EMC6D103:A2 */
+ 
+ #define	LM85_REG_CONFIG			0x40
+ 
+@@ -348,6 +351,7 @@ static const struct i2c_device_id lm85_id[] = {
+ 	{ "emc6d100", emc6d100 },
+ 	{ "emc6d101", emc6d100 },
+ 	{ "emc6d102", emc6d102 },
++	{ "emc6d103", emc6d103 },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(i2c, lm85_id);
+@@ -1250,6 +1254,20 @@ static int lm85_detect(struct i2c_client *client, struct i2c_board_info *info)
+ 		case LM85_VERSTEP_EMC6D102:
+ 			type_name = "emc6d102";
+ 			break;
++		case LM85_VERSTEP_EMC6D103_A0:
++		case LM85_VERSTEP_EMC6D103_A1:
++			type_name = "emc6d103";
++			break;
++		/*
++		 * Registers apparently missing in EMC6D103S/EMC6D103:A2
++		 * compared to EMC6D103:A0, EMC6D103:A1, and EMC6D102
++		 * (according to the data sheets), but used unconditionally
++		 * in the driver: 62[5:7], 6D[0:7], and 6E[0:7].
++		 * So skip EMC6D103S for now.
++		case LM85_VERSTEP_EMC6D103S:
++			type_name = "emc6d103s";
++			break;
++		 */
+ 		}
+ 	} else {
+ 		dev_dbg(&adapter->dev,
+@@ -1283,6 +1301,7 @@ static int lm85_probe(struct i2c_client *client,
+ 	case adt7468:
+ 	case emc6d100:
+ 	case emc6d102:
++	case emc6d103:
+ 		data->freq_map = adm1027_freq_map;
+ 		break;
+ 	default:
+@@ -1468,7 +1487,7 @@ static struct lm85_data *lm85_update_device(struct device *dev)
+ 			/* More alarm bits */
+ 			data->alarms |= lm85_read_value(client,
+ 						EMC6D100_REG_ALARM3) << 16;
+-		} else if (data->type == emc6d102) {
++		} else if (data->type == emc6d102 || data->type == emc6d103) {
+ 			/* Have to read LSB bits after the MSB ones because
+ 			   the reading of the MSB bits has frozen the
+ 			   LSBs (backward from the ADM1027).
+diff --git a/drivers/media/dvb/ttpci/av7110_ca.c b/drivers/media/dvb/ttpci/av7110_ca.c
+index 122c728..9fc1dd0 100644
+--- a/drivers/media/dvb/ttpci/av7110_ca.c
++++ b/drivers/media/dvb/ttpci/av7110_ca.c
+@@ -277,7 +277,7 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg)
+ 	{
+ 		ca_slot_info_t *info=(ca_slot_info_t *)parg;
+ 
+-		if (info->num > 1)
++		if (info->num < 0 || info->num > 1)
+ 			return -EINVAL;
+ 		av7110->ci_slot[info->num].num = info->num;
+ 		av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?
+diff --git a/drivers/media/radio/radio-aimslab.c b/drivers/media/radio/radio-aimslab.c
+index 6cc5d13..4ce10db 100644
+--- a/drivers/media/radio/radio-aimslab.c
++++ b/drivers/media/radio/radio-aimslab.c
+@@ -31,6 +31,7 @@
+ #include <linux/module.h>	/* Modules 			*/
+ #include <linux/init.h>		/* Initdata			*/
+ #include <linux/ioport.h>	/* request_region		*/
++#include <linux/delay.h>	/* msleep			*/
+ #include <linux/videodev2.h>	/* kernel radio structs		*/
+ #include <linux/version.h>	/* for KERNEL_VERSION MACRO	*/
+ #include <linux/io.h>		/* outb, outb_p			*/
+diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
+index a3856ed..e8deb8e 100644
+--- a/drivers/message/fusion/mptctl.c
++++ b/drivers/message/fusion/mptctl.c
+@@ -597,6 +597,13 @@ mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
+ }
+ 
+ static int
++mptctl_release(struct inode *inode, struct file *filep)
++{
++	fasync_helper(-1, filep, 0, &async_queue);
++	return 0;
++}
++
++static int
+ mptctl_fasync(int fd, struct file *filep, int mode)
+ {
+ 	MPT_ADAPTER	*ioc;
+@@ -2815,6 +2822,7 @@ static const struct file_operations mptctl_fops = {
+ 	.llseek =	no_llseek,
+ 	.fasync = 	mptctl_fasync,
+ 	.unlocked_ioctl = mptctl_ioctl,
++	.release =	mptctl_release,
+ #ifdef CONFIG_COMPAT
+ 	.compat_ioctl = compat_mpctl_ioctl,
+ #endif
+diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
+index 59b8f53..0d9b82a 100644
+--- a/drivers/message/fusion/mptscsih.c
++++ b/drivers/message/fusion/mptscsih.c
+@@ -1873,8 +1873,9 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
+ 	}
+ 
+  out:
+-	printk(MYIOC_s_INFO_FMT "task abort: %s (sc=%p)\n",
+-	    ioc->name, ((retval == SUCCESS) ? "SUCCESS" : "FAILED"), SCpnt);
++	printk(MYIOC_s_INFO_FMT "task abort: %s (rv=%04x) (sc=%p) (sn=%ld)\n",
++	    ioc->name, ((retval == SUCCESS) ? "SUCCESS" : "FAILED"), retval,
++	    SCpnt, SCpnt->serial_number);
+ 
+ 	return retval;
+ }
+@@ -1911,7 +1912,7 @@ mptscsih_dev_reset(struct scsi_cmnd * SCpnt)
+ 
+ 	vdevice = SCpnt->device->hostdata;
+ 	if (!vdevice || !vdevice->vtarget) {
+-		retval = SUCCESS;
++		retval = 0;
+ 		goto out;
+ 	}
+ 
+diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
+index 6e533dc..e733f2c 100644
+--- a/drivers/net/can/janz-ican3.c
++++ b/drivers/net/can/janz-ican3.c
+@@ -1627,7 +1627,7 @@ static ssize_t ican3_sysfs_set_term(struct device *dev,
+ 	return count;
+ }
+ 
+-static DEVICE_ATTR(termination, S_IWUGO | S_IRUGO, ican3_sysfs_show_term,
++static DEVICE_ATTR(termination, S_IWUSR | S_IRUGO, ican3_sysfs_show_term,
+ 						   ican3_sysfs_set_term);
+ 
+ static struct attribute *ican3_sysfs_attrs[] = {
+diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
+index 176e525..e7fe35c 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
++++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
+@@ -2727,7 +2727,6 @@ static struct iwl_lib_ops iwl3945_lib = {
+ 	.config_ap = iwl3945_config_ap,
+ 	.manage_ibss_station = iwl3945_manage_ibss_station,
+ 	.recover_from_tx_stall = iwl_bg_monitor_recover,
+-	.check_plcp_health = iwl3945_good_plcp_health,
+ 
+ 	.debugfs_ops = {
+ 		.rx_stats_read = iwl3945_ucode_rx_stats_read,
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index 63d5042..1539d2c 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -23,6 +23,7 @@
+ #include <linux/mm.h>
+ #include <linux/fs.h>
+ #include <linux/capability.h>
++#include <linux/security.h>
+ #include <linux/pci-aspm.h>
+ #include <linux/slab.h>
+ #include "pci.h"
+@@ -368,7 +369,7 @@ pci_read_config(struct file *filp, struct kobject *kobj,
+ 	u8 *data = (u8*) buf;
+ 
+ 	/* Several chips lock up trying to read undefined config space */
+-	if (cap_raised(filp->f_cred->cap_effective, CAP_SYS_ADMIN)) {
++	if (security_capable(filp->f_cred, CAP_SYS_ADMIN) == 0) {
+ 		size = dev->cfg_size;
+ 	} else if (dev->hdr_type == PCI_HEADER_TYPE_CARDBUS) {
+ 		size = 128;
+diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
+index 0bdda5b..42fbf1a 100644
+--- a/drivers/pcmcia/pcmcia_resource.c
++++ b/drivers/pcmcia/pcmcia_resource.c
+@@ -518,6 +518,8 @@ int pcmcia_enable_device(struct pcmcia_device *p_dev)
+ 		flags |= CONF_ENABLE_IOCARD;
+ 	if (flags & CONF_ENABLE_IOCARD)
+ 		s->socket.flags |= SS_IOCARD;
++	if (flags & CONF_ENABLE_ZVCARD)
++		s->socket.flags |= SS_ZVCARD | SS_IOCARD;
+ 	if (flags & CONF_ENABLE_SPKR) {
+ 		s->socket.flags |= SS_SPKR_ENA;
+ 		status = CCSR_AUDIO_ENA;
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index c8c6537..196a59e 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -80,7 +80,7 @@ MODULE_LICENSE("GPL");
+  */
+ #define AMW0_GUID1		"67C3371D-95A3-4C37-BB61-DD47B491DAAB"
+ #define AMW0_GUID2		"431F16ED-0C2B-444C-B267-27DEB140CF9C"
+-#define WMID_GUID1		"6AF4F258-B401-42fd-BE91-3D4AC2D7C0D3"
++#define WMID_GUID1		"6AF4F258-B401-42FD-BE91-3D4AC2D7C0D3"
+ #define WMID_GUID2		"95764E09-FB56-4e83-B31A-37761F60994A"
+ 
+ MODULE_ALIAS("wmi:67C3371D-95A3-4C37-BB61-DD47B491DAAB");
+@@ -1065,7 +1065,7 @@ static ssize_t set_bool_threeg(struct device *dev,
+ 			return -EINVAL;
+ 	return count;
+ }
+-static DEVICE_ATTR(threeg, S_IWUGO | S_IRUGO | S_IWUSR, show_bool_threeg,
++static DEVICE_ATTR(threeg, S_IRUGO | S_IWUSR, show_bool_threeg,
+ 	set_bool_threeg);
+ 
+ static ssize_t show_interface(struct device *dev, struct device_attribute *attr,
+diff --git a/drivers/platform/x86/asus_acpi.c b/drivers/platform/x86/asus_acpi.c
+index ca05aef..cfab7b1 100644
+--- a/drivers/platform/x86/asus_acpi.c
++++ b/drivers/platform/x86/asus_acpi.c
+@@ -1081,14 +1081,8 @@ static int asus_hotk_add_fs(struct acpi_device *device)
+ 	struct proc_dir_entry *proc;
+ 	mode_t mode;
+ 
+-	/*
+-	 * If parameter uid or gid is not changed, keep the default setting for
+-	 * our proc entries (-rw-rw-rw-) else, it means we care about security,
+-	 * and then set to -rw-rw----
+-	 */
+-
+ 	if ((asus_uid == 0) && (asus_gid == 0)) {
+-		mode = S_IFREG | S_IRUGO | S_IWUGO;
++		mode = S_IFREG | S_IRUGO | S_IWUSR | S_IWGRP;
+ 	} else {
+ 		mode = S_IFREG | S_IRUSR | S_IRGRP | S_IWUSR | S_IWGRP;
+ 		printk(KERN_WARNING "  asus_uid and asus_gid parameters are "
+diff --git a/drivers/platform/x86/tc1100-wmi.c b/drivers/platform/x86/tc1100-wmi.c
+index 1fe0f1f..865ef78 100644
+--- a/drivers/platform/x86/tc1100-wmi.c
++++ b/drivers/platform/x86/tc1100-wmi.c
+@@ -162,7 +162,7 @@ set_bool_##value(struct device *dev, struct device_attribute *attr, \
+ 			return -EINVAL; \
+ 	return count; \
+ } \
+-static DEVICE_ATTR(value, S_IWUGO | S_IRUGO | S_IWUSR, \
++static DEVICE_ATTR(value, S_IRUGO | S_IWUSR, \
+ 	show_bool_##value, set_bool_##value);
+ 
+ show_set_bool(wireless, TC1100_INSTANCE_WIRELESS);
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index a8ec48e..9130699 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -3524,7 +3524,7 @@ int register_con_driver(const struct consw *csw, int first, int last)
+ 
+ 		/* already registered */
+ 		if (con_driver->con == csw)
+-			retval = -EINVAL;
++			retval = -EBUSY;
+ 	}
+ 
+ 	if (retval)
+@@ -3635,7 +3635,12 @@ int take_over_console(const struct consw *csw, int first, int last, int deflt)
+ 	int err;
+ 
+ 	err = register_con_driver(csw, first, last);
+-
++	/* if we get an busy error we still want to bind the console driver
++	 * and return success, as we may have unbound the console driver
++	 * but not unregistered it.
++	*/
++	if (err == -EBUSY)
++		err = 0;
+ 	if (!err)
+ 		bind_con_driver(csw, first, last, deflt);
+ 
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 31edd87..32d0ad2 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2744,11 +2744,6 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
+ 		udev->ttport = hdev->ttport;
+ 	} else if (udev->speed != USB_SPEED_HIGH
+ 			&& hdev->speed == USB_SPEED_HIGH) {
+-		if (!hub->tt.hub) {
+-			dev_err(&udev->dev, "parent hub has no TT\n");
+-			retval = -EINVAL;
+-			goto fail;
+-		}
+ 		udev->tt = &hub->tt;
+ 		udev->ttport = port1;
+ 	}
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index f87552a..866a1d5 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2087,7 +2087,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+ 	int num_types = 4;
+ 	int alloc_size;
+ 	int ret = 0;
+-	int slot_count = 0;
++	u64 slot_count = 0;
+ 	int i, c;
+ 
+ 	if (copy_from_user(&space_args,
+@@ -2126,7 +2126,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+ 		goto out;
+ 	}
+ 
+-	slot_count = min_t(int, space_args.space_slots, slot_count);
++	slot_count = min_t(u64, space_args.space_slots, slot_count);
+ 
+ 	alloc_size = sizeof(*dest) * slot_count;
+ 
+@@ -2146,6 +2146,9 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+ 	for (i = 0; i < num_types; i++) {
+ 		struct btrfs_space_info *tmp;
+ 
++		if (!slot_count)
++			break;
++
+ 		info = NULL;
+ 		rcu_read_lock();
+ 		list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
+@@ -2167,7 +2170,10 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+ 				memcpy(dest, &space, sizeof(space));
+ 				dest++;
+ 				space_args.total_spaces++;
++				slot_count--;
+ 			}
++			if (!slot_count)
++				break;
+ 		}
+ 		up_read(&info->groups_sem);
+ 	}
+diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
+index 9aad47a..23b741d 100644
+--- a/fs/cifs/netmisc.c
++++ b/fs/cifs/netmisc.c
+@@ -170,7 +170,7 @@ cifs_convert_address(struct sockaddr *dst, const char *src, int len)
+ {
+ 	int rc, alen, slen;
+ 	const char *pct;
+-	char *endp, scope_id[13];
++	char scope_id[13];
+ 	struct sockaddr_in *s4 = (struct sockaddr_in *) dst;
+ 	struct sockaddr_in6 *s6 = (struct sockaddr_in6 *) dst;
+ 
+@@ -197,9 +197,9 @@ cifs_convert_address(struct sockaddr *dst, const char *src, int len)
+ 		memcpy(scope_id, pct + 1, slen);
+ 		scope_id[slen] = '\0';
+ 
+-		s6->sin6_scope_id = (u32) simple_strtoul(pct, &endp, 0);
+-		if (endp != scope_id + slen)
+-			return 0;
++		rc = strict_strtoul(scope_id, 0,
++					(unsigned long *)&s6->sin6_scope_id);
++		rc = (rc == 0) ? 1 : 0;
+ 	}
+ 
+ 	return rc;
+diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
+index 7b01d3f..a91f8d2 100644
+--- a/fs/cifs/sess.c
++++ b/fs/cifs/sess.c
+@@ -667,13 +667,13 @@ ssetup_ntlmssp_authenticate:
+ 
+ 	if (type == LANMAN) {
+ #ifdef CONFIG_CIFS_WEAK_PW_HASH
+-		char lnm_session_key[CIFS_SESS_KEY_SIZE];
++		char lnm_session_key[CIFS_AUTH_RESP_SIZE];
+ 
+ 		pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE;
+ 
+ 		/* no capabilities flags in old lanman negotiation */
+ 
+-		pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_SESS_KEY_SIZE);
++		pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
+ 
+ 		/* Calculate hash with password and copy into bcc_ptr.
+ 		 * Encryption Key (stored as in cryptkey) gets used if the
+@@ -686,8 +686,8 @@ ssetup_ntlmssp_authenticate:
+ 					true : false, lnm_session_key);
+ 
+ 		ses->flags |= CIFS_SES_LANMAN;
+-		memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_SESS_KEY_SIZE);
+-		bcc_ptr += CIFS_SESS_KEY_SIZE;
++		memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
++		bcc_ptr += CIFS_AUTH_RESP_SIZE;
+ 
+ 		/* can not sign if LANMAN negotiated so no need
+ 		to calculate signing key? but what if server
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index 9d1a22d..89edfe3 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -1095,6 +1095,8 @@ int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
+ 	rc = vfs_getattr(ecryptfs_dentry_to_lower_mnt(dentry),
+ 			 ecryptfs_dentry_to_lower(dentry), &lower_stat);
+ 	if (!rc) {
++		fsstack_copy_attr_all(dentry->d_inode,
++				      ecryptfs_inode_to_lower(dentry->d_inode));
+ 		generic_fillattr(dentry->d_inode, stat);
+ 		stat->blocks = lower_stat.blocks;
+ 	}
+diff --git a/fs/file_table.c b/fs/file_table.c
+index c3dee38..079940a 100644
+--- a/fs/file_table.c
++++ b/fs/file_table.c
+@@ -125,13 +125,13 @@ struct file *get_empty_filp(void)
+ 		goto fail;
+ 
+ 	percpu_counter_inc(&nr_files);
++	f->f_cred = get_cred(cred);
+ 	if (security_file_alloc(f))
+ 		goto fail_sec;
+ 
+ 	INIT_LIST_HEAD(&f->f_u.fu_list);
+ 	atomic_long_set(&f->f_count, 1);
+ 	rwlock_init(&f->f_owner.lock);
+-	f->f_cred = get_cred(cred);
+ 	spin_lock_init(&f->f_lock);
+ 	eventpoll_init_file(f);
+ 	/* f->f_version: 0 */
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index f35a94a..67080e4 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -316,8 +316,8 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
+ 		READ_BUF(dummy32);
+ 		len += (XDR_QUADLEN(dummy32) << 2);
+ 		READMEM(buf, dummy32);
+-		if ((host_err = nfsd_map_name_to_uid(argp->rqstp, buf, dummy32, &iattr->ia_uid)))
+-			goto out_nfserr;
++		if ((status = nfsd_map_name_to_uid(argp->rqstp, buf, dummy32, &iattr->ia_uid)))
++			return status;
+ 		iattr->ia_valid |= ATTR_UID;
+ 	}
+ 	if (bmval[1] & FATTR4_WORD1_OWNER_GROUP) {
+@@ -327,8 +327,8 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
+ 		READ_BUF(dummy32);
+ 		len += (XDR_QUADLEN(dummy32) << 2);
+ 		READMEM(buf, dummy32);
+-		if ((host_err = nfsd_map_name_to_gid(argp->rqstp, buf, dummy32, &iattr->ia_gid)))
+-			goto out_nfserr;
++		if ((status = nfsd_map_name_to_gid(argp->rqstp, buf, dummy32, &iattr->ia_gid)))
++			return status;
+ 		iattr->ia_valid |= ATTR_GID;
+ 	}
+ 	if (bmval[1] & FATTR4_WORD1_TIME_ACCESS_SET) {
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 184938f..f1b0951 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -809,7 +809,7 @@ nfsd_get_raparms(dev_t dev, ino_t ino)
+ 		if (ra->p_count == 0)
+ 			frap = rap;
+ 	}
+-	depth = nfsdstats.ra_size*11/10;
++	depth = nfsdstats.ra_size;
+ 	if (!frap) {	
+ 		spin_unlock(&rab->pb_lock);
+ 		return NULL;
+diff --git a/fs/partitions/mac.c b/fs/partitions/mac.c
+index 68d6a21..11f688b 100644
+--- a/fs/partitions/mac.c
++++ b/fs/partitions/mac.c
+@@ -29,10 +29,9 @@ static inline void mac_fix_string(char *stg, int len)
+ 
+ int mac_partition(struct parsed_partitions *state)
+ {
+-	int slot = 1;
+ 	Sector sect;
+ 	unsigned char *data;
+-	int blk, blocks_in_map;
++	int slot, blocks_in_map;
+ 	unsigned secsize;
+ #ifdef CONFIG_PPC_PMAC
+ 	int found_root = 0;
+@@ -59,10 +58,14 @@ int mac_partition(struct parsed_partitions *state)
+ 		put_dev_sector(sect);
+ 		return 0;		/* not a MacOS disk */
+ 	}
+-	strlcat(state->pp_buf, " [mac]", PAGE_SIZE);
+ 	blocks_in_map = be32_to_cpu(part->map_count);
+-	for (blk = 1; blk <= blocks_in_map; ++blk) {
+-		int pos = blk * secsize;
++	if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
++		put_dev_sector(sect);
++		return 0;
++	}
++	strlcat(state->pp_buf, " [mac]", PAGE_SIZE);
++	for (slot = 1; slot <= blocks_in_map; ++slot) {
++		int pos = slot * secsize;
+ 		put_dev_sector(sect);
+ 		data = read_part_sector(state, pos/512, &sect);
+ 		if (!data)
+@@ -113,13 +116,11 @@ int mac_partition(struct parsed_partitions *state)
+ 			}
+ 
+ 			if (goodness > found_root_goodness) {
+-				found_root = blk;
++				found_root = slot;
+ 				found_root_goodness = goodness;
+ 			}
+ 		}
+ #endif /* CONFIG_PPC_PMAC */
+-
+-		++slot;
+ 	}
+ #ifdef CONFIG_PPC_PMAC
+ 	if (found_root_goodness)
+diff --git a/fs/proc/array.c b/fs/proc/array.c
+index fff6572..3d88fe1 100644
+--- a/fs/proc/array.c
++++ b/fs/proc/array.c
+@@ -353,9 +353,6 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
+ 	task_cap(m, task);
+ 	task_cpus_allowed(m, task);
+ 	cpuset_task_status_allowed(m, task);
+-#if defined(CONFIG_S390)
+-	task_show_regs(m, task);
+-#endif
+ 	task_context_switch_counts(m, task);
+ 	return 0;
+ }
+diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
+index f8e854b..206a281 100644
+--- a/fs/xfs/quota/xfs_qm.c
++++ b/fs/xfs/quota/xfs_qm.c
+@@ -1863,12 +1863,14 @@ xfs_qm_dqreclaim_one(void)
+ 	xfs_dquot_t	*dqpout;
+ 	xfs_dquot_t	*dqp;
+ 	int		restarts;
++	int		startagain;
+ 
+ 	restarts = 0;
+ 	dqpout = NULL;
+ 
+ 	/* lockorder: hashchainlock, freelistlock, mplistlock, dqlock, dqflock */
+-startagain:
++again:
++	startagain = 0;
+ 	mutex_lock(&xfs_Gqm->qm_dqfrlist_lock);
+ 
+ 	list_for_each_entry(dqp, &xfs_Gqm->qm_dqfrlist, q_freelist) {
+@@ -1885,13 +1887,10 @@ startagain:
+ 			ASSERT(! (dqp->dq_flags & XFS_DQ_INACTIVE));
+ 
+ 			trace_xfs_dqreclaim_want(dqp);
+-
+-			xfs_dqunlock(dqp);
+-			mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
+-			if (++restarts >= XFS_QM_RECLAIM_MAX_RESTARTS)
+-				return NULL;
+ 			XQM_STATS_INC(xqmstats.xs_qm_dqwants);
+-			goto startagain;
++			restarts++;
++			startagain = 1;
++			goto dqunlock;
+ 		}
+ 
+ 		/*
+@@ -1906,23 +1905,20 @@ startagain:
+ 			ASSERT(list_empty(&dqp->q_mplist));
+ 			list_del_init(&dqp->q_freelist);
+ 			xfs_Gqm->qm_dqfrlist_cnt--;
+-			xfs_dqunlock(dqp);
+ 			dqpout = dqp;
+ 			XQM_STATS_INC(xqmstats.xs_qm_dqinact_reclaims);
+-			break;
++			goto dqunlock;
+ 		}
+ 
+ 		ASSERT(dqp->q_hash);
+ 		ASSERT(!list_empty(&dqp->q_mplist));
+ 
+ 		/*
+-		 * Try to grab the flush lock. If this dquot is in the process of
+-		 * getting flushed to disk, we don't want to reclaim it.
++		 * Try to grab the flush lock. If this dquot is in the process
++		 * of getting flushed to disk, we don't want to reclaim it.
+ 		 */
+-		if (!xfs_dqflock_nowait(dqp)) {
+-			xfs_dqunlock(dqp);
+-			continue;
+-		}
++		if (!xfs_dqflock_nowait(dqp))
++			goto dqunlock;
+ 
+ 		/*
+ 		 * We have the flush lock so we know that this is not in the
+@@ -1944,8 +1940,7 @@ startagain:
+ 				xfs_fs_cmn_err(CE_WARN, mp,
+ 			"xfs_qm_dqreclaim: dquot %p flush failed", dqp);
+ 			}
+-			xfs_dqunlock(dqp); /* dqflush unlocks dqflock */
+-			continue;
++			goto dqunlock;
+ 		}
+ 
+ 		/*
+@@ -1967,13 +1962,8 @@ startagain:
+ 		 */
+ 		if (!mutex_trylock(&mp->m_quotainfo->qi_dqlist_lock)) {
+ 			restarts++;
+-			mutex_unlock(&dqp->q_hash->qh_lock);
+-			xfs_dqfunlock(dqp);
+-			xfs_dqunlock(dqp);
+-			mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
+-			if (restarts++ >= XFS_QM_RECLAIM_MAX_RESTARTS)
+-				return NULL;
+-			goto startagain;
++			startagain = 1;
++			goto qhunlock;
+ 		}
+ 
+ 		ASSERT(dqp->q_nrefs == 0);
+@@ -1986,14 +1976,20 @@ startagain:
+ 		xfs_Gqm->qm_dqfrlist_cnt--;
+ 		dqpout = dqp;
+ 		mutex_unlock(&mp->m_quotainfo->qi_dqlist_lock);
++qhunlock:
+ 		mutex_unlock(&dqp->q_hash->qh_lock);
+ dqfunlock:
+ 		xfs_dqfunlock(dqp);
++dqunlock:
+ 		xfs_dqunlock(dqp);
+ 		if (dqpout)
+ 			break;
+ 		if (restarts >= XFS_QM_RECLAIM_MAX_RESTARTS)
+-			return NULL;
++			break;
++		if (startagain) {
++			mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
++			goto again;
++		}
+ 	}
+ 	mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
+ 	return dqpout;
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index cb845c1..dd7d4e2 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -518,6 +518,7 @@
+ #define PCI_DEVICE_ID_AMD_11H_NB_MISC	0x1303
+ #define PCI_DEVICE_ID_AMD_11H_NB_LINK	0x1304
+ #define PCI_DEVICE_ID_AMD_15H_NB_MISC	0x1603
++#define PCI_DEVICE_ID_AMD_CNB17H_F3	0x1703
+ #define PCI_DEVICE_ID_AMD_LANCE		0x2000
+ #define PCI_DEVICE_ID_AMD_LANCE_HOME	0x2001
+ #define PCI_DEVICE_ID_AMD_SCSI		0x2020
+diff --git a/include/linux/security.h b/include/linux/security.h
+index d47a4c2..b3f2f47 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -1664,7 +1664,7 @@ int security_capset(struct cred *new, const struct cred *old,
+ 		    const kernel_cap_t *effective,
+ 		    const kernel_cap_t *inheritable,
+ 		    const kernel_cap_t *permitted);
+-int security_capable(int cap);
++int security_capable(const struct cred *cred, int cap);
+ int security_real_capable(struct task_struct *tsk, int cap);
+ int security_real_capable_noaudit(struct task_struct *tsk, int cap);
+ int security_sysctl(struct ctl_table *table, int op);
+@@ -1857,9 +1857,9 @@ static inline int security_capset(struct cred *new,
+ 	return cap_capset(new, old, effective, inheritable, permitted);
+ }
+ 
+-static inline int security_capable(int cap)
++static inline int security_capable(const struct cred *cred, int cap)
+ {
+-	return cap_capable(current, current_cred(), cap, SECURITY_CAP_AUDIT);
++	return cap_capable(current, cred, cap, SECURITY_CAP_AUDIT);
+ }
+ 
+ static inline int security_real_capable(struct task_struct *tsk, int cap)
+diff --git a/include/pcmcia/ds.h b/include/pcmcia/ds.h
+index 8479b66..3fd5064 100644
+--- a/include/pcmcia/ds.h
++++ b/include/pcmcia/ds.h
+@@ -261,6 +261,7 @@ void pcmcia_disable_device(struct pcmcia_device *p_dev);
+ #define CONF_ENABLE_ESR         0x0008
+ #define CONF_ENABLE_IOCARD	0x0010 /* auto-enabled if IO resources or IRQ
+ 					* (CONF_ENABLE_IRQ) in use */
++#define CONF_ENABLE_ZVCARD	0x0020
+ 
+ /* flags used by pcmcia_loop_config() autoconfiguration */
+ #define CONF_AUTO_CHECK_VCC	0x0100 /* check for matching Vcc? */
+diff --git a/kernel/capability.c b/kernel/capability.c
+index 2f05303..9e9385f 100644
+--- a/kernel/capability.c
++++ b/kernel/capability.c
+@@ -306,7 +306,7 @@ int capable(int cap)
+ 		BUG();
+ 	}
+ 
+-	if (security_capable(cap) == 0) {
++	if (security_capable(current_cred(), cap) == 0) {
+ 		current->flags |= PF_SUPERPRIV;
+ 		return 1;
+ 	}
+diff --git a/kernel/cred.c b/kernel/cred.c
+index 6a1aa00..3a9d6dd 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -252,13 +252,13 @@ struct cred *cred_alloc_blank(void)
+ #endif
+ 
+ 	atomic_set(&new->usage, 1);
++#ifdef CONFIG_DEBUG_CREDENTIALS
++	new->magic = CRED_MAGIC;
++#endif
+ 
+ 	if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
+ 		goto error;
+ 
+-#ifdef CONFIG_DEBUG_CREDENTIALS
+-	new->magic = CRED_MAGIC;
+-#endif
+ 	return new;
+ 
+ error:
+@@ -657,6 +657,8 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
+ 	validate_creds(old);
+ 
+ 	*new = *old;
++	atomic_set(&new->usage, 1);
++	set_cred_subscribers(new, 0);
+ 	get_uid(new->user);
+ 	get_group_info(new->group_info);
+ 
+@@ -674,8 +676,6 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
+ 	if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
+ 		goto error;
+ 
+-	atomic_set(&new->usage, 1);
+-	set_cred_subscribers(new, 0);
+ 	put_cred(old);
+ 	validate_creds(new);
+ 	return new;
+@@ -748,7 +748,11 @@ bool creds_are_invalid(const struct cred *cred)
+ 	if (cred->magic != CRED_MAGIC)
+ 		return true;
+ #ifdef CONFIG_SECURITY_SELINUX
+-	if (selinux_is_enabled()) {
++	/*
++	 * cred->security == NULL if security_cred_alloc_blank() or
++	 * security_prepare_creds() returned an error.
++	 */
++	if (selinux_is_enabled() && cred->security) {
+ 		if ((unsigned long) cred->security < PAGE_SIZE)
+ 			return true;
+ 		if ((*(u32 *)cred->security & 0xffffff00) ==
+diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
+index 4571ae7..99c3bc8 100644
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -3,6 +3,12 @@
+  */
+ #include <linux/irqdesc.h>
+ 
++#ifdef CONFIG_SPARSE_IRQ
++# define IRQ_BITMAP_BITS	(NR_IRQS + 8196)
++#else
++# define IRQ_BITMAP_BITS	NR_IRQS
++#endif
++
+ extern int noirqdebug;
+ 
+ #define irq_data_to_desc(data)	container_of(data, struct irq_desc, irq_data)
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index 9988d03..49b8394 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -91,7 +91,7 @@ int nr_irqs = NR_IRQS;
+ EXPORT_SYMBOL_GPL(nr_irqs);
+ 
+ static DEFINE_MUTEX(sparse_irq_lock);
+-static DECLARE_BITMAP(allocated_irqs, NR_IRQS);
++static DECLARE_BITMAP(allocated_irqs, IRQ_BITMAP_BITS);
+ 
+ #ifdef CONFIG_SPARSE_IRQ
+ 
+@@ -215,6 +215,15 @@ int __init early_irq_init(void)
+ 	initcnt = arch_probe_nr_irqs();
+ 	printk(KERN_INFO "NR_IRQS:%d nr_irqs:%d %d\n", NR_IRQS, nr_irqs, initcnt);
+ 
++	if (WARN_ON(nr_irqs > IRQ_BITMAP_BITS))
++		nr_irqs = IRQ_BITMAP_BITS;
++
++	if (WARN_ON(initcnt > IRQ_BITMAP_BITS))
++		initcnt = IRQ_BITMAP_BITS;
++
++	if (initcnt > nr_irqs)
++		nr_irqs = initcnt;
++
+ 	for (i = 0; i < initcnt; i++) {
+ 		desc = alloc_desc(i, node);
+ 		set_bit(i, allocated_irqs);
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 5f92acc5..6f7c114 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -1098,7 +1098,7 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
+ 	if (retval)
+ 		kfree(action);
+ 
+-#ifdef CONFIG_DEBUG_SHIRQ
++#ifdef CONFIG_DEBUG_SHIRQ_FIXME
+ 	if (!retval && (irqflags & IRQF_SHARED)) {
+ 		/*
+ 		 * It's a shared IRQ -- the driver ought to be prepared for it
+diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
+index 891115a..dc49358 100644
+--- a/kernel/irq/resend.c
++++ b/kernel/irq/resend.c
+@@ -23,7 +23,7 @@
+ #ifdef CONFIG_HARDIRQS_SW_RESEND
+ 
+ /* Bitmap to handle software resend of interrupts: */
+-static DECLARE_BITMAP(irqs_resend, NR_IRQS);
++static DECLARE_BITMAP(irqs_resend, IRQ_BITMAP_BITS);
+ 
+ /*
+  * Run software resends of IRQ's
+diff --git a/kernel/perf_event.c b/kernel/perf_event.c
+index 64668bd..785c66a 100644
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -652,6 +652,10 @@ retry:
+ 	raw_spin_unlock_irq(&ctx->lock);
+ }
+ 
++#define MAX_INTERRUPTS (~0ULL)
++
++static void perf_log_throttle(struct perf_event *event, int enable);
++
+ static int
+ event_sched_in(struct perf_event *event,
+ 		 struct perf_cpu_context *cpuctx,
+@@ -662,6 +666,17 @@ event_sched_in(struct perf_event *event,
+ 
+ 	event->state = PERF_EVENT_STATE_ACTIVE;
+ 	event->oncpu = smp_processor_id();
++
++	/*
++	 * Unthrottle events, since we scheduled we might have missed several
++	 * ticks already, also for a heavily scheduling task there is little
++	 * guarantee it'll get a tick in a timely manner.
++	 */
++	if (unlikely(event->hw.interrupts == MAX_INTERRUPTS)) {
++		perf_log_throttle(event, 1);
++		event->hw.interrupts = 0;
++	}
++
+ 	/*
+ 	 * The new state must be visible before we turn it on in the hardware:
+ 	 */
+@@ -1469,10 +1484,6 @@ void __perf_event_task_sched_in(struct task_struct *task)
+ 	}
+ }
+ 
+-#define MAX_INTERRUPTS (~0ULL)
+-
+-static void perf_log_throttle(struct perf_event *event, int enable);
+-
+ static u64 perf_calculate_period(struct perf_event *event, u64 nsec, u64 count)
+ {
+ 	u64 frequency = event->attr.sample_freq;
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index 0dac75e..64db648 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -1519,11 +1519,8 @@ static int
+ swsusp_alloc(struct memory_bitmap *orig_bm, struct memory_bitmap *copy_bm,
+ 		unsigned int nr_pages, unsigned int nr_highmem)
+ {
+-	int error = 0;
+-
+ 	if (nr_highmem > 0) {
+-		error = get_highmem_buffer(PG_ANY);
+-		if (error)
++		if (get_highmem_buffer(PG_ANY))
+ 			goto err_out;
+ 		if (nr_highmem > alloc_highmem) {
+ 			nr_highmem -= alloc_highmem;
+@@ -1546,7 +1543,7 @@ swsusp_alloc(struct memory_bitmap *orig_bm, struct memory_bitmap *copy_bm,
+ 
+  err_out:
+ 	swsusp_free();
+-	return error;
++	return -ENOMEM;
+ }
+ 
+ asmlinkage int swsusp_save(void)
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 4be7fa5..c95f321 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -79,7 +79,9 @@ enum {
+ 	MAX_IDLE_WORKERS_RATIO	= 4,		/* 1/4 of busy can be idle */
+ 	IDLE_WORKER_TIMEOUT	= 300 * HZ,	/* keep idle ones for 5 mins */
+ 
+-	MAYDAY_INITIAL_TIMEOUT	= HZ / 100,	/* call for help after 10ms */
++	MAYDAY_INITIAL_TIMEOUT  = HZ / 100 >= 2 ? HZ / 100 : 2,
++						/* call for help after 10ms
++						   (min two ticks) */
+ 	MAYDAY_INTERVAL		= HZ / 10,	/* and then every 100ms */
+ 	CREATE_COOLDOWN		= HZ,		/* time to breath after fail */
+ 	TRUSTEE_COOLDOWN	= HZ / 10,	/* for trustee draining */
+@@ -2009,6 +2011,15 @@ repeat:
+ 				move_linked_works(work, scheduled, &n);
+ 
+ 		process_scheduled_works(rescuer);
++
++		/*
++		 * Leave this gcwq.  If keep_working() is %true, notify a
++		 * regular worker; otherwise, we end up with 0 concurrency
++		 * and stalling the execution.
++		 */
++		if (keep_working(gcwq))
++			wake_up_worker(gcwq);
++
+ 		spin_unlock_irq(&gcwq->lock);
+ 	}
+ 
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 0dd54a6..c0d3b5f 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4945,6 +4945,7 @@ static void rollback_registered(struct net_device *dev)
+ 
+ 	list_add(&dev->unreg_list, &single);
+ 	rollback_registered_many(&single);
++	list_del(&single);
+ }
+ 
+ unsigned long netdev_fix_features(unsigned long features, const char *name)
+@@ -6114,6 +6115,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
+ 		}
+ 	}
+ 	unregister_netdevice_many(&dev_kill_list);
++	list_del(&dev_kill_list);
+ 	rtnl_unlock();
+ }
+ 
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index b729ace..742a6dc 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -642,30 +642,29 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
+ 	struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh);
+ 	u_int8_t l3proto = nfmsg->nfgen_family;
+ 
+-	rcu_read_lock();
++	spin_lock_bh(&nf_conntrack_lock);
+ 	last = (struct nf_conn *)cb->args[1];
+ 	for (; cb->args[0] < net->ct.htable_size; cb->args[0]++) {
+ restart:
+-		hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[cb->args[0]],
++		hlist_nulls_for_each_entry(h, n, &net->ct.hash[cb->args[0]],
+ 					 hnnode) {
+ 			if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
+ 				continue;
+ 			ct = nf_ct_tuplehash_to_ctrack(h);
+-			if (!atomic_inc_not_zero(&ct->ct_general.use))
+-				continue;
+ 			/* Dump entries of a given L3 protocol number.
+ 			 * If it is not specified, ie. l3proto == 0,
+ 			 * then dump everything. */
+ 			if (l3proto && nf_ct_l3num(ct) != l3proto)
+-				goto releasect;
++				continue;
+ 			if (cb->args[1]) {
+ 				if (ct != last)
+-					goto releasect;
++					continue;
+ 				cb->args[1] = 0;
+ 			}
+ 			if (ctnetlink_fill_info(skb, NETLINK_CB(cb->skb).pid,
+ 						cb->nlh->nlmsg_seq,
+ 						IPCTNL_MSG_CT_NEW, ct) < 0) {
++				nf_conntrack_get(&ct->ct_general);
+ 				cb->args[1] = (unsigned long)ct;
+ 				goto out;
+ 			}
+@@ -678,8 +677,6 @@ restart:
+ 				if (acct)
+ 					memset(acct, 0, sizeof(struct nf_conn_counter[IP_CT_DIR_MAX]));
+ 			}
+-releasect:
+-		nf_ct_put(ct);
+ 		}
+ 		if (cb->args[1]) {
+ 			cb->args[1] = 0;
+@@ -687,7 +684,7 @@ releasect:
+ 		}
+ 	}
+ out:
+-	rcu_read_unlock();
++	spin_unlock_bh(&nf_conntrack_lock);
+ 	if (last)
+ 		nf_ct_put(last);
+ 
+diff --git a/security/security.c b/security/security.c
+index e5fb07a..8d57dbb 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -154,10 +154,9 @@ int security_capset(struct cred *new, const struct cred *old,
+ 				    effective, inheritable, permitted);
+ }
+ 
+-int security_capable(int cap)
++int security_capable(const struct cred *cred, int cap)
+ {
+-	return security_ops->capable(current, current_cred(), cap,
+-				     SECURITY_CAP_AUDIT);
++	return security_ops->capable(current, cred, cap, SECURITY_CAP_AUDIT);
+ }
+ 
+ int security_real_capable(struct task_struct *tsk, int cap)
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 11d5c47..a373ab6 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -3198,7 +3198,11 @@ static void selinux_cred_free(struct cred *cred)
+ {
+ 	struct task_security_struct *tsec = cred->security;
+ 
+-	BUG_ON((unsigned long) cred->security < PAGE_SIZE);
++	/*
++	 * cred->security == NULL if security_cred_alloc_blank() or
++	 * security_prepare_creds() returned an error.
++	 */
++	BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
+ 	cred->security = (void *) 0x7UL;
+ 	kfree(tsec);
+ }
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index a1c4008..5825d18 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2305,6 +2305,7 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
+ 	SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS M2V", POS_FIX_LPIB),
++	SND_PCI_QUIRK(0x1043, 0x8410, "ASUS", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x104d, 0x9069, "Sony VPCS11V9E", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB),
+ 	SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba A100-259", POS_FIX_LPIB),
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 5667fb9..fc5e027 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3401,7 +3401,7 @@ static void cx_auto_parse_output(struct hda_codec *codec)
+ 		}
+ 	}
+ 	spec->multiout.dac_nids = spec->private_dac_nids;
+-	spec->multiout.max_channels = nums * 2;
++	spec->multiout.max_channels = spec->multiout.num_dacs * 2;
+ 
+ 	if (cfg->hp_outs > 0)
+ 		spec->auto_mute = 1;
+diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
+index 622b602..8b87e04 100644
+--- a/sound/soc/codecs/wm8903.c
++++ b/sound/soc/codecs/wm8903.c
+@@ -1479,7 +1479,7 @@ int wm8903_mic_detect(struct snd_soc_codec *codec, struct snd_soc_jack *jack,
+ 			    WM8903_MICDET_EINT | WM8903_MICSHRT_EINT,
+ 			    irq_mask);
+ 
+-	if (det && shrt) {
++	if (det || shrt) {
+ 		/* Enable mic detection, this may not have been set through
+ 		 * platform data (eg, if the defaults are OK). */
+ 		snd_soc_update_bits(codec, WM8903_WRITE_SEQUENCER_0,
+diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
+index 68b9747..66eabaf 100644
+--- a/sound/usb/caiaq/audio.c
++++ b/sound/usb/caiaq/audio.c
+@@ -785,7 +785,7 @@ int snd_usb_caiaq_audio_init(struct snd_usb_caiaqdev *dev)
+ 	}
+ 
+ 	dev->pcm->private_data = dev;
+-	strcpy(dev->pcm->name, dev->product_name);
++	strlcpy(dev->pcm->name, dev->product_name, sizeof(dev->pcm->name));
+ 
+ 	memset(dev->sub_playback, 0, sizeof(dev->sub_playback));
+ 	memset(dev->sub_capture, 0, sizeof(dev->sub_capture));
+diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c
+index 2f218c7..a1a4708 100644
+--- a/sound/usb/caiaq/midi.c
++++ b/sound/usb/caiaq/midi.c
+@@ -136,7 +136,7 @@ int snd_usb_caiaq_midi_init(struct snd_usb_caiaqdev *device)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	strcpy(rmidi->name, device->product_name);
++	strlcpy(rmidi->name, device->product_name, sizeof(rmidi->name));
+ 
+ 	rmidi->info_flags = SNDRV_RAWMIDI_INFO_DUPLEX;
+ 	rmidi->private_data = device;
+diff --git a/tools/perf/builtin-timechart.c b/tools/perf/builtin-timechart.c
+index 9bcc38f..b3028eb 100644
+--- a/tools/perf/builtin-timechart.c
++++ b/tools/perf/builtin-timechart.c
+@@ -502,7 +502,7 @@ static int process_sample_event(event_t *event, struct perf_session *session)
+ 			c_state_start(pe->cpu_id, data.time, pe->value);
+ 
+ 		if (strcmp(event_str, "power:power_end") == 0)
+-			c_state_end(pe->cpu_id, data.time);
++			c_state_end(data.cpu, data.time);
+ 
+ 		if (strcmp(event_str, "power:power_frequency") == 0)
+ 			p_state_change(pe->cpu_id, data.time, pe->value);