[gentoo-commits] linux-patches r1650 - genpatches-2.6/trunk/2.6.32

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2010-01-07 02:43:48 +0000 (Thu, 07 Jan 2010)
New Revision: 1650

Added:
   genpatches-2.6/trunk/2.6.32/1002_linux-2.6.32.3.patch
Modified:
   genpatches-2.6/trunk/2.6.32/0000_README
Log:
Linux patch 2.6.32.3

Modified: genpatches-2.6/trunk/2.6.32/0000_README
===================================================================
--- genpatches-2.6/trunk/2.6.32/0000_README	2009-12-28 17:02:30 UTC (rev 1649)
+++ genpatches-2.6/trunk/2.6.32/0000_README	2010-01-07 02:43:48 UTC (rev 1650)
@@ -45,8 +45,12 @@
 
 Patch:  1001_linux-2.6.32.2.patch
 From:   http://www.kernel.org
-Desc:   Linux 2.6.32.1
+Desc:   Linux 2.6.32.2
 
+Patch:  1002_linux-2.6.32.3.patch
+From:   http://www.kernel.org
+Desc:   Linux 2.6.32.3
+
 Patch:  1900_EFI-GPT-header-read-fix.patch
 From:   http://bugs.gentoo.org/show_bug.cgi?id=296915
 Desc:   Read whole sector with EFI GPT header

Added: genpatches-2.6/trunk/2.6.32/1002_linux-2.6.32.3.patch
===================================================================
--- genpatches-2.6/trunk/2.6.32/1002_linux-2.6.32.3.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.32/1002_linux-2.6.32.3.patch	2010-01-07 02:43:48 UTC (rev 1650)
@@ -0,0 +1,4876 @@
+diff --git a/Documentation/filesystems/ext4.txt b/Documentation/filesystems/ext4.txt
+index af6885c..e1def17 100644
+--- a/Documentation/filesystems/ext4.txt
++++ b/Documentation/filesystems/ext4.txt
+@@ -196,7 +196,7 @@ nobarrier		This also requires an IO stack which can support
+ 			also be used to enable or disable barriers, for
+ 			consistency with other ext4 mount options.
+ 
+-inode_readahead=n	This tuning parameter controls the maximum
++inode_readahead_blks=n	This tuning parameter controls the maximum
+ 			number of inode table blocks that ext4's inode
+ 			table readahead algorithm will pre-read into
+ 			the buffer cache.  The default value is 32 blocks.
+diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
+index a5b632e..f0c624f 100644
+--- a/arch/powerpc/kernel/align.c
++++ b/arch/powerpc/kernel/align.c
+@@ -642,10 +642,14 @@ static int emulate_spe(struct pt_regs *regs, unsigned int reg,
+  */
+ static int emulate_vsx(unsigned char __user *addr, unsigned int reg,
+ 		       unsigned int areg, struct pt_regs *regs,
+-		       unsigned int flags, unsigned int length)
++		       unsigned int flags, unsigned int length,
++		       unsigned int elsize)
+ {
+ 	char *ptr;
++	unsigned long *lptr;
+ 	int ret = 0;
++	int sw = 0;
++	int i, j;
+ 
+ 	flush_vsx_to_thread(current);
+ 
+@@ -654,19 +658,35 @@ static int emulate_vsx(unsigned char __user *addr, unsigned int reg,
+ 	else
+ 		ptr = (char *) &current->thread.vr[reg - 32];
+ 
+-	if (flags & ST)
+-		ret = __copy_to_user(addr, ptr, length);
+-        else {
+-		if (flags & SPLT){
+-			ret = __copy_from_user(ptr, addr, length);
+-			ptr += length;
++	lptr = (unsigned long *) ptr;
++
++	if (flags & SW)
++		sw = elsize-1;
++
++	for (j = 0; j < length; j += elsize) {
++		for (i = 0; i < elsize; ++i) {
++			if (flags & ST)
++				ret |= __put_user(ptr[i^sw], addr + i);
++			else
++				ret |= __get_user(ptr[i^sw], addr + i);
+ 		}
+-		ret |= __copy_from_user(ptr, addr, length);
++		ptr  += elsize;
++		addr += elsize;
+ 	}
+-	if (flags & U)
+-		regs->gpr[areg] = regs->dar;
+-	if (ret)
++
++	if (!ret) {
++		if (flags & U)
++			regs->gpr[areg] = regs->dar;
++
++		/* Splat load copies the same data to top and bottom 8 bytes */
++		if (flags & SPLT)
++			lptr[1] = lptr[0];
++		/* For 8 byte loads, zero the top 8 bytes */
++		else if (!(flags & ST) && (8 == length))
++			lptr[1] = 0;
++	} else
+ 		return -EFAULT;
++
+ 	return 1;
+ }
+ #endif
+@@ -767,16 +787,25 @@ int fix_alignment(struct pt_regs *regs)
+ 
+ #ifdef CONFIG_VSX
+ 	if ((instruction & 0xfc00003e) == 0x7c000018) {
+-		/* Additional register addressing bit (64 VSX vs 32 FPR/GPR */
++		unsigned int elsize;
++
++		/* Additional register addressing bit (64 VSX vs 32 FPR/GPR) */
+ 		reg |= (instruction & 0x1) << 5;
+ 		/* Simple inline decoder instead of a table */
++		/* VSX has only 8 and 16 byte memory accesses */
++		nb = 8;
+ 		if (instruction & 0x200)
+ 			nb = 16;
+-		else if (instruction & 0x080)
+-			nb = 8;
+-		else
+-			nb = 4;
++
++		/* Vector stores in little-endian mode swap individual
++		   elements, so process them separately */
++		elsize = 4;
++		if (instruction & 0x80)
++			elsize = 8;
++
+ 		flags = 0;
++		if (regs->msr & MSR_LE)
++			flags |= SW;
+ 		if (instruction & 0x100)
+ 			flags |= ST;
+ 		if (instruction & 0x040)
+@@ -787,7 +816,7 @@ int fix_alignment(struct pt_regs *regs)
+ 			nb = 8;
+ 		}
+ 		PPC_WARN_EMULATED(vsx);
+-		return emulate_vsx(addr, reg, areg, regs, flags, nb);
++		return emulate_vsx(addr, reg, areg, regs, flags, nb, elsize);
+ 	}
+ #endif
+ 	/* A size of 0 indicates an instruction we don't support, with
+diff --git a/arch/x86/include/asm/msr.h b/arch/x86/include/asm/msr.h
+index 7e2b6ba..0e3e728 100644
+--- a/arch/x86/include/asm/msr.h
++++ b/arch/x86/include/asm/msr.h
+@@ -27,6 +27,18 @@ struct msr {
+ 	};
+ };
+ 
++struct msr_info {
++	u32 msr_no;
++	struct msr reg;
++	struct msr *msrs;
++	int err;
++};
++
++struct msr_regs_info {
++	u32 *regs;
++	int err;
++};
++
+ static inline unsigned long long native_read_tscp(unsigned int *aux)
+ {
+ 	unsigned long low, high;
+@@ -244,11 +256,14 @@ do {                                                            \
+ 
+ #define write_rdtscp_aux(val) wrmsr(0xc0000103, (val), 0)
+ 
++struct msr *msrs_alloc(void);
++void msrs_free(struct msr *msrs);
++
+ #ifdef CONFIG_SMP
+ int rdmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h);
+ int wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h);
+-void rdmsr_on_cpus(const cpumask_t *mask, u32 msr_no, struct msr *msrs);
+-void wrmsr_on_cpus(const cpumask_t *mask, u32 msr_no, struct msr *msrs);
++void rdmsr_on_cpus(const struct cpumask *mask, u32 msr_no, struct msr *msrs);
++void wrmsr_on_cpus(const struct cpumask *mask, u32 msr_no, struct msr *msrs);
+ int rdmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h);
+ int wrmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h);
+ int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 regs[8]);
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index c978648..13b1885 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -180,7 +180,7 @@ static inline void native_cpuid(unsigned int *eax, unsigned int *ebx,
+ 				unsigned int *ecx, unsigned int *edx)
+ {
+ 	/* ecx is often an input as well as an output. */
+-	asm("cpuid"
++	asm volatile("cpuid"
+ 	    : "=a" (*eax),
+ 	      "=b" (*ebx),
+ 	      "=c" (*ecx),
+diff --git a/arch/x86/include/asm/uv/uv_hub.h b/arch/x86/include/asm/uv/uv_hub.h
+index d1414af..e90a8a9 100644
+--- a/arch/x86/include/asm/uv/uv_hub.h
++++ b/arch/x86/include/asm/uv/uv_hub.h
+@@ -31,20 +31,20 @@
+  *		  contiguous (although various IO spaces may punch holes in
+  *		  it)..
+  *
+- * 	N	- Number of bits in the node portion of a socket physical
+- * 		  address.
++ *	N	- Number of bits in the node portion of a socket physical
++ *		  address.
+  *
+- * 	NASID   - network ID of a router, Mbrick or Cbrick. Nasid values of
+- * 	 	  routers always have low bit of 1, C/MBricks have low bit
+- * 		  equal to 0. Most addressing macros that target UV hub chips
+- * 		  right shift the NASID by 1 to exclude the always-zero bit.
+- * 		  NASIDs contain up to 15 bits.
++ *	NASID   - network ID of a router, Mbrick or Cbrick. Nasid values of
++ *		  routers always have low bit of 1, C/MBricks have low bit
++ *		  equal to 0. Most addressing macros that target UV hub chips
++ *		  right shift the NASID by 1 to exclude the always-zero bit.
++ *		  NASIDs contain up to 15 bits.
+  *
+  *	GNODE   - NASID right shifted by 1 bit. Most mmrs contain gnodes instead
+  *		  of nasids.
+  *
+- * 	PNODE   - the low N bits of the GNODE. The PNODE is the most useful variant
+- * 		  of the nasid for socket usage.
++ *	PNODE   - the low N bits of the GNODE. The PNODE is the most useful variant
++ *		  of the nasid for socket usage.
+  *
+  *
+  *  NumaLink Global Physical Address Format:
+@@ -71,12 +71,12 @@
+  *
+  *
+  * APICID format
+- * 	NOTE!!!!!! This is the current format of the APICID. However, code
+- * 	should assume that this will change in the future. Use functions
+- * 	in this file for all APICID bit manipulations and conversion.
++ *	NOTE!!!!!! This is the current format of the APICID. However, code
++ *	should assume that this will change in the future. Use functions
++ *	in this file for all APICID bit manipulations and conversion.
+  *
+- * 		1111110000000000
+- * 		5432109876543210
++ *		1111110000000000
++ *		5432109876543210
+  *		pppppppppplc0cch
+  *		sssssssssss
+  *
+@@ -89,9 +89,9 @@
+  *	Note: Processor only supports 12 bits in the APICID register. The ACPI
+  *	      tables hold all 16 bits. Software needs to be aware of this.
+  *
+- * 	      Unless otherwise specified, all references to APICID refer to
+- * 	      the FULL value contained in ACPI tables, not the subset in the
+- * 	      processor APICID register.
++ *	      Unless otherwise specified, all references to APICID refer to
++ *	      the FULL value contained in ACPI tables, not the subset in the
++ *	      processor APICID register.
+  */
+ 
+ 
+@@ -151,16 +151,16 @@ struct uv_hub_info_s {
+ };
+ 
+ DECLARE_PER_CPU(struct uv_hub_info_s, __uv_hub_info);
+-#define uv_hub_info 		(&__get_cpu_var(__uv_hub_info))
++#define uv_hub_info		(&__get_cpu_var(__uv_hub_info))
+ #define uv_cpu_hub_info(cpu)	(&per_cpu(__uv_hub_info, cpu))
+ 
+ /*
+  * Local & Global MMR space macros.
+- * 	Note: macros are intended to be used ONLY by inline functions
+- * 	in this file - not by other kernel code.
+- * 		n -  NASID (full 15-bit global nasid)
+- * 		g -  GNODE (full 15-bit global nasid, right shifted 1)
+- * 		p -  PNODE (local part of nsids, right shifted 1)
++ *	Note: macros are intended to be used ONLY by inline functions
++ *	in this file - not by other kernel code.
++ *		n -  NASID (full 15-bit global nasid)
++ *		g -  GNODE (full 15-bit global nasid, right shifted 1)
++ *		p -  PNODE (local part of nsids, right shifted 1)
+  */
+ #define UV_NASID_TO_PNODE(n)		(((n) >> 1) & uv_hub_info->pnode_mask)
+ #define UV_PNODE_TO_GNODE(p)		((p) |uv_hub_info->gnode_extra)
+@@ -213,8 +213,8 @@ DECLARE_PER_CPU(struct uv_hub_info_s, __uv_hub_info);
+ /*
+  * Macros for converting between kernel virtual addresses, socket local physical
+  * addresses, and UV global physical addresses.
+- * 	Note: use the standard __pa() & __va() macros for converting
+- * 	      between socket virtual and socket physical addresses.
++ *	Note: use the standard __pa() & __va() macros for converting
++ *	      between socket virtual and socket physical addresses.
+  */
+ 
+ /* socket phys RAM --> UV global physical address */
+@@ -265,21 +265,18 @@ static inline int uv_apicid_to_pnode(int apicid)
+  * Access global MMRs using the low memory MMR32 space. This region supports
+  * faster MMR access but not all MMRs are accessible in this space.
+  */
+-static inline unsigned long *uv_global_mmr32_address(int pnode,
+-				unsigned long offset)
++static inline unsigned long *uv_global_mmr32_address(int pnode, unsigned long offset)
+ {
+ 	return __va(UV_GLOBAL_MMR32_BASE |
+ 		       UV_GLOBAL_MMR32_PNODE_BITS(pnode) | offset);
+ }
+ 
+-static inline void uv_write_global_mmr32(int pnode, unsigned long offset,
+-				 unsigned long val)
++static inline void uv_write_global_mmr32(int pnode, unsigned long offset, unsigned long val)
+ {
+ 	writeq(val, uv_global_mmr32_address(pnode, offset));
+ }
+ 
+-static inline unsigned long uv_read_global_mmr32(int pnode,
+-						 unsigned long offset)
++static inline unsigned long uv_read_global_mmr32(int pnode, unsigned long offset)
+ {
+ 	return readq(uv_global_mmr32_address(pnode, offset));
+ }
+@@ -288,25 +285,32 @@ static inline unsigned long uv_read_global_mmr32(int pnode,
+  * Access Global MMR space using the MMR space located at the top of physical
+  * memory.
+  */
+-static inline unsigned long *uv_global_mmr64_address(int pnode,
+-				unsigned long offset)
++static inline unsigned long *uv_global_mmr64_address(int pnode, unsigned long offset)
+ {
+ 	return __va(UV_GLOBAL_MMR64_BASE |
+ 		    UV_GLOBAL_MMR64_PNODE_BITS(pnode) | offset);
+ }
+ 
+-static inline void uv_write_global_mmr64(int pnode, unsigned long offset,
+-				unsigned long val)
++static inline void uv_write_global_mmr64(int pnode, unsigned long offset, unsigned long val)
+ {
+ 	writeq(val, uv_global_mmr64_address(pnode, offset));
+ }
+ 
+-static inline unsigned long uv_read_global_mmr64(int pnode,
+-						 unsigned long offset)
++static inline unsigned long uv_read_global_mmr64(int pnode, unsigned long offset)
+ {
+ 	return readq(uv_global_mmr64_address(pnode, offset));
+ }
+ 
++static inline void uv_write_global_mmr8(int pnode, unsigned long offset, unsigned char val)
++{
++	writeb(val, uv_global_mmr64_address(pnode, offset));
++}
++
++static inline unsigned char uv_read_global_mmr8(int pnode, unsigned long offset)
++{
++	return readb(uv_global_mmr64_address(pnode, offset));
++}
++
+ /*
+  * Access hub local MMRs. Faster than using global space but only local MMRs
+  * are accessible.
+@@ -426,11 +430,17 @@ static inline void uv_set_scir_bits(unsigned char value)
+ 	}
+ }
+ 
++static inline unsigned long uv_scir_offset(int apicid)
++{
++	return SCIR_LOCAL_MMR_BASE | (apicid & 0x3f);
++}
++
+ static inline void uv_set_cpu_scir_bits(int cpu, unsigned char value)
+ {
+ 	if (uv_cpu_hub_info(cpu)->scir.state != value) {
++		uv_write_global_mmr8(uv_cpu_to_pnode(cpu),
++				uv_cpu_hub_info(cpu)->scir.offset, value);
+ 		uv_cpu_hub_info(cpu)->scir.state = value;
+-		uv_write_local_mmr8(uv_cpu_hub_info(cpu)->scir.offset, value);
+ 	}
+ }
+ 
+diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
+index e0b3130..c8243f0 100644
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -136,6 +136,11 @@ LIST_HEAD(amd_iommu_list);		/* list of all AMD IOMMUs in the
+ 					   system */
+ 
+ /*
++ * Set to true if ACPI table parsing and hardware intialization went properly
++ */
++static bool amd_iommu_initialized;
++
++/*
+  * Pointer to the device table which is shared by all AMD IOMMUs
+  * it is indexed by the PCI device id or the HT unit id and contains
+  * information about the domain the device belongs to as well as the
+@@ -913,6 +918,8 @@ static int __init init_iommu_all(struct acpi_table_header *table)
+ 	}
+ 	WARN_ON(p != end);
+ 
++	amd_iommu_initialized = true;
++
+ 	return 0;
+ }
+ 
+@@ -1263,6 +1270,9 @@ int __init amd_iommu_init(void)
+ 	if (acpi_table_parse("IVRS", init_iommu_all) != 0)
+ 		goto free;
+ 
++	if (!amd_iommu_initialized)
++		goto free;
++
+ 	if (acpi_table_parse("IVRS", init_memory_definitions) != 0)
+ 		goto free;
+ 
+diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
+index 326c254..2ab3535 100644
+--- a/arch/x86/kernel/apic/x2apic_uv_x.c
++++ b/arch/x86/kernel/apic/x2apic_uv_x.c
+@@ -607,8 +607,10 @@ void __init uv_system_init(void)
+ 	uv_rtc_init();
+ 
+ 	for_each_present_cpu(cpu) {
++		int apicid = per_cpu(x86_cpu_to_apicid, cpu);
++
+ 		nid = cpu_to_node(cpu);
+-		pnode = uv_apicid_to_pnode(per_cpu(x86_cpu_to_apicid, cpu));
++		pnode = uv_apicid_to_pnode(apicid);
+ 		blade = boot_pnode_to_blade(pnode);
+ 		lcpu = uv_blade_info[blade].nr_possible_cpus;
+ 		uv_blade_info[blade].nr_possible_cpus++;
+@@ -629,15 +631,13 @@ void __init uv_system_init(void)
+ 		uv_cpu_hub_info(cpu)->gnode_extra = gnode_extra;
+ 		uv_cpu_hub_info(cpu)->global_mmr_base = mmr_base;
+ 		uv_cpu_hub_info(cpu)->coherency_domain_number = sn_coherency_id;
+-		uv_cpu_hub_info(cpu)->scir.offset = SCIR_LOCAL_MMR_BASE + lcpu;
++		uv_cpu_hub_info(cpu)->scir.offset = uv_scir_offset(apicid);
+ 		uv_node_to_blade[nid] = blade;
+ 		uv_cpu_to_blade[cpu] = blade;
+ 		max_pnode = max(pnode, max_pnode);
+ 
+-		printk(KERN_DEBUG "UV: cpu %d, apicid 0x%x, pnode %d, nid %d, "
+-			"lcpu %d, blade %d\n",
+-			cpu, per_cpu(x86_cpu_to_apicid, cpu), pnode, nid,
+-			lcpu, blade);
++		printk(KERN_DEBUG "UV: cpu %d, apicid 0x%x, pnode %d, nid %d, lcpu %d, blade %d\n",
++			cpu, apicid, pnode, nid, lcpu, blade);
+ 	}
+ 
+ 	/* Add blade/pnode info for nodes without cpus */
+diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
+index 7b058a2..c06acdd 100644
+--- a/arch/x86/kernel/ptrace.c
++++ b/arch/x86/kernel/ptrace.c
+@@ -408,14 +408,14 @@ static int genregs_get(struct task_struct *target,
+ {
+ 	if (kbuf) {
+ 		unsigned long *k = kbuf;
+-		while (count > 0) {
++		while (count >= sizeof(*k)) {
+ 			*k++ = getreg(target, pos);
+ 			count -= sizeof(*k);
+ 			pos += sizeof(*k);
+ 		}
+ 	} else {
+ 		unsigned long __user *u = ubuf;
+-		while (count > 0) {
++		while (count >= sizeof(*u)) {
+ 			if (__put_user(getreg(target, pos), u++))
+ 				return -EFAULT;
+ 			count -= sizeof(*u);
+@@ -434,14 +434,14 @@ static int genregs_set(struct task_struct *target,
+ 	int ret = 0;
+ 	if (kbuf) {
+ 		const unsigned long *k = kbuf;
+-		while (count > 0 && !ret) {
++		while (count >= sizeof(*k) && !ret) {
+ 			ret = putreg(target, pos, *k++);
+ 			count -= sizeof(*k);
+ 			pos += sizeof(*k);
+ 		}
+ 	} else {
+ 		const unsigned long  __user *u = ubuf;
+-		while (count > 0 && !ret) {
++		while (count >= sizeof(*u) && !ret) {
+ 			unsigned long word;
+ 			ret = __get_user(word, u++);
+ 			if (ret)
+@@ -1219,14 +1219,14 @@ static int genregs32_get(struct task_struct *target,
+ {
+ 	if (kbuf) {
+ 		compat_ulong_t *k = kbuf;
+-		while (count > 0) {
++		while (count >= sizeof(*k)) {
+ 			getreg32(target, pos, k++);
+ 			count -= sizeof(*k);
+ 			pos += sizeof(*k);
+ 		}
+ 	} else {
+ 		compat_ulong_t __user *u = ubuf;
+-		while (count > 0) {
++		while (count >= sizeof(*u)) {
+ 			compat_ulong_t word;
+ 			getreg32(target, pos, &word);
+ 			if (__put_user(word, u++))
+@@ -1247,14 +1247,14 @@ static int genregs32_set(struct task_struct *target,
+ 	int ret = 0;
+ 	if (kbuf) {
+ 		const compat_ulong_t *k = kbuf;
+-		while (count > 0 && !ret) {
++		while (count >= sizeof(*k) && !ret) {
+ 			ret = putreg32(target, pos, *k++);
+ 			count -= sizeof(*k);
+ 			pos += sizeof(*k);
+ 		}
+ 	} else {
+ 		const compat_ulong_t __user *u = ubuf;
+-		while (count > 0 && !ret) {
++		while (count >= sizeof(*u) && !ret) {
+ 			compat_ulong_t word;
+ 			ret = __get_user(word, u++);
+ 			if (ret)
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 23c2176..41659fb 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -1156,6 +1156,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu)
+ 	hrtimer_cancel(&apic->lapic_timer.timer);
+ 	update_divide_count(apic);
+ 	start_apic_timer(apic);
++	apic->irr_pending = true;
+ }
+ 
+ void __kvm_migrate_apic_timer(struct kvm_vcpu *vcpu)
+diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
+index 72558f8..85e12cd 100644
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -455,8 +455,6 @@ out_unlock:
+ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
+ {
+ 	struct kvm_shadow_walk_iterator iterator;
+-	pt_element_t gpte;
+-	gpa_t pte_gpa = -1;
+ 	int level;
+ 	u64 *sptep;
+ 	int need_flush = 0;
+@@ -471,10 +469,6 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
+ 		if (level == PT_PAGE_TABLE_LEVEL  ||
+ 		    ((level == PT_DIRECTORY_LEVEL && is_large_pte(*sptep))) ||
+ 		    ((level == PT_PDPE_LEVEL && is_large_pte(*sptep)))) {
+-			struct kvm_mmu_page *sp = page_header(__pa(sptep));
+-
+-			pte_gpa = (sp->gfn << PAGE_SHIFT);
+-			pte_gpa += (sptep - sp->spt) * sizeof(pt_element_t);
+ 
+ 			if (is_shadow_present_pte(*sptep)) {
+ 				rmap_remove(vcpu->kvm, sptep);
+@@ -493,18 +487,6 @@ static void FNAME(invlpg)(struct kvm_vcpu *vcpu, gva_t gva)
+ 	if (need_flush)
+ 		kvm_flush_remote_tlbs(vcpu->kvm);
+ 	spin_unlock(&vcpu->kvm->mmu_lock);
+-
+-	if (pte_gpa == -1)
+-		return;
+-	if (kvm_read_guest_atomic(vcpu->kvm, pte_gpa, &gpte,
+-				  sizeof(pt_element_t)))
+-		return;
+-	if (is_present_gpte(gpte) && (gpte & PT_ACCESSED_MASK)) {
+-		if (mmu_topup_memory_caches(vcpu))
+-			return;
+-		kvm_mmu_pte_write(vcpu, pte_gpa, (const u8 *)&gpte,
+-				  sizeof(pt_element_t), 0);
+-	}
+ }
+ 
+ static gpa_t FNAME(gva_to_gpa)(struct kvm_vcpu *vcpu, gva_t vaddr)
+diff --git a/arch/x86/lib/Makefile b/arch/x86/lib/Makefile
+index 85f5db9..c2b6f39 100644
+--- a/arch/x86/lib/Makefile
++++ b/arch/x86/lib/Makefile
+@@ -2,14 +2,14 @@
+ # Makefile for x86 specific library files.
+ #
+ 
+-obj-$(CONFIG_SMP) := msr.o
++obj-$(CONFIG_SMP) += msr-smp.o
+ 
+ lib-y := delay.o
+ lib-y += thunk_$(BITS).o
+ lib-y += usercopy_$(BITS).o getuser.o putuser.o
+ lib-y += memcpy_$(BITS).o
+ 
+-obj-y += msr-reg.o msr-reg-export.o
++obj-y += msr.o msr-reg.o msr-reg-export.o
+ 
+ ifeq ($(CONFIG_X86_32),y)
+         obj-y += atomic64_32.o
+diff --git a/arch/x86/lib/msr-smp.c b/arch/x86/lib/msr-smp.c
+new file mode 100644
+index 0000000..a6b1b86
+--- /dev/null
++++ b/arch/x86/lib/msr-smp.c
+@@ -0,0 +1,204 @@
++#include <linux/module.h>
++#include <linux/preempt.h>
++#include <linux/smp.h>
++#include <asm/msr.h>
++
++static void __rdmsr_on_cpu(void *info)
++{
++	struct msr_info *rv = info;
++	struct msr *reg;
++	int this_cpu = raw_smp_processor_id();
++
++	if (rv->msrs)
++		reg = per_cpu_ptr(rv->msrs, this_cpu);
++	else
++		reg = &rv->reg;
++
++	rdmsr(rv->msr_no, reg->l, reg->h);
++}
++
++static void __wrmsr_on_cpu(void *info)
++{
++	struct msr_info *rv = info;
++	struct msr *reg;
++	int this_cpu = raw_smp_processor_id();
++
++	if (rv->msrs)
++		reg = per_cpu_ptr(rv->msrs, this_cpu);
++	else
++		reg = &rv->reg;
++
++	wrmsr(rv->msr_no, reg->l, reg->h);
++}
++
++int rdmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
++{
++	int err;
++	struct msr_info rv;
++
++	memset(&rv, 0, sizeof(rv));
++
++	rv.msr_no = msr_no;
++	err = smp_call_function_single(cpu, __rdmsr_on_cpu, &rv, 1);
++	*l = rv.reg.l;
++	*h = rv.reg.h;
++
++	return err;
++}
++EXPORT_SYMBOL(rdmsr_on_cpu);
++
++int wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
++{
++	int err;
++	struct msr_info rv;
++
++	memset(&rv, 0, sizeof(rv));
++
++	rv.msr_no = msr_no;
++	rv.reg.l = l;
++	rv.reg.h = h;
++	err = smp_call_function_single(cpu, __wrmsr_on_cpu, &rv, 1);
++
++	return err;
++}
++EXPORT_SYMBOL(wrmsr_on_cpu);
++
++static void __rwmsr_on_cpus(const struct cpumask *mask, u32 msr_no,
++			    struct msr *msrs,
++			    void (*msr_func) (void *info))
++{
++	struct msr_info rv;
++	int this_cpu;
++
++	memset(&rv, 0, sizeof(rv));
++
++	rv.msrs	  = msrs;
++	rv.msr_no = msr_no;
++
++	this_cpu = get_cpu();
++
++	if (cpumask_test_cpu(this_cpu, mask))
++		msr_func(&rv);
++
++	smp_call_function_many(mask, msr_func, &rv, 1);
++	put_cpu();
++}
++
++/* rdmsr on a bunch of CPUs
++ *
++ * @mask:       which CPUs
++ * @msr_no:     which MSR
++ * @msrs:       array of MSR values
++ *
++ */
++void rdmsr_on_cpus(const struct cpumask *mask, u32 msr_no, struct msr *msrs)
++{
++	__rwmsr_on_cpus(mask, msr_no, msrs, __rdmsr_on_cpu);
++}
++EXPORT_SYMBOL(rdmsr_on_cpus);
++
++/*
++ * wrmsr on a bunch of CPUs
++ *
++ * @mask:       which CPUs
++ * @msr_no:     which MSR
++ * @msrs:       array of MSR values
++ *
++ */
++void wrmsr_on_cpus(const struct cpumask *mask, u32 msr_no, struct msr *msrs)
++{
++	__rwmsr_on_cpus(mask, msr_no, msrs, __wrmsr_on_cpu);
++}
++EXPORT_SYMBOL(wrmsr_on_cpus);
++
++/* These "safe" variants are slower and should be used when the target MSR
++   may not actually exist. */
++static void __rdmsr_safe_on_cpu(void *info)
++{
++	struct msr_info *rv = info;
++
++	rv->err = rdmsr_safe(rv->msr_no, &rv->reg.l, &rv->reg.h);
++}
++
++static void __wrmsr_safe_on_cpu(void *info)
++{
++	struct msr_info *rv = info;
++
++	rv->err = wrmsr_safe(rv->msr_no, rv->reg.l, rv->reg.h);
++}
++
++int rdmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
++{
++	int err;
++	struct msr_info rv;
++
++	memset(&rv, 0, sizeof(rv));
++
++	rv.msr_no = msr_no;
++	err = smp_call_function_single(cpu, __rdmsr_safe_on_cpu, &rv, 1);
++	*l = rv.reg.l;
++	*h = rv.reg.h;
++
++	return err ? err : rv.err;
++}
++EXPORT_SYMBOL(rdmsr_safe_on_cpu);
++
++int wrmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
++{
++	int err;
++	struct msr_info rv;
++
++	memset(&rv, 0, sizeof(rv));
++
++	rv.msr_no = msr_no;
++	rv.reg.l = l;
++	rv.reg.h = h;
++	err = smp_call_function_single(cpu, __wrmsr_safe_on_cpu, &rv, 1);
++
++	return err ? err : rv.err;
++}
++EXPORT_SYMBOL(wrmsr_safe_on_cpu);
++
++/*
++ * These variants are significantly slower, but allows control over
++ * the entire 32-bit GPR set.
++ */
++static void __rdmsr_safe_regs_on_cpu(void *info)
++{
++	struct msr_regs_info *rv = info;
++
++	rv->err = rdmsr_safe_regs(rv->regs);
++}
++
++static void __wrmsr_safe_regs_on_cpu(void *info)
++{
++	struct msr_regs_info *rv = info;
++
++	rv->err = wrmsr_safe_regs(rv->regs);
++}
++
++int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
++{
++	int err;
++	struct msr_regs_info rv;
++
++	rv.regs   = regs;
++	rv.err    = -EIO;
++	err = smp_call_function_single(cpu, __rdmsr_safe_regs_on_cpu, &rv, 1);
++
++	return err ? err : rv.err;
++}
++EXPORT_SYMBOL(rdmsr_safe_regs_on_cpu);
++
++int wrmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
++{
++	int err;
++	struct msr_regs_info rv;
++
++	rv.regs = regs;
++	rv.err  = -EIO;
++	err = smp_call_function_single(cpu, __wrmsr_safe_regs_on_cpu, &rv, 1);
++
++	return err ? err : rv.err;
++}
++EXPORT_SYMBOL(wrmsr_safe_regs_on_cpu);
+diff --git a/arch/x86/lib/msr.c b/arch/x86/lib/msr.c
+index 33a1e3c..8f8eebd 100644
+--- a/arch/x86/lib/msr.c
++++ b/arch/x86/lib/msr.c
+@@ -1,226 +1,23 @@
+ #include <linux/module.h>
+ #include <linux/preempt.h>
+-#include <linux/smp.h>
+ #include <asm/msr.h>
+ 
+-struct msr_info {
+-	u32 msr_no;
+-	struct msr reg;
+-	struct msr *msrs;
+-	int off;
+-	int err;
+-};
+-
+-static void __rdmsr_on_cpu(void *info)
+-{
+-	struct msr_info *rv = info;
+-	struct msr *reg;
+-	int this_cpu = raw_smp_processor_id();
+-
+-	if (rv->msrs)
+-		reg = &rv->msrs[this_cpu - rv->off];
+-	else
+-		reg = &rv->reg;
+-
+-	rdmsr(rv->msr_no, reg->l, reg->h);
+-}
+-
+-static void __wrmsr_on_cpu(void *info)
+-{
+-	struct msr_info *rv = info;
+-	struct msr *reg;
+-	int this_cpu = raw_smp_processor_id();
+-
+-	if (rv->msrs)
+-		reg = &rv->msrs[this_cpu - rv->off];
+-	else
+-		reg = &rv->reg;
+-
+-	wrmsr(rv->msr_no, reg->l, reg->h);
+-}
+-
+-int rdmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
+-{
+-	int err;
+-	struct msr_info rv;
+-
+-	memset(&rv, 0, sizeof(rv));
+-
+-	rv.msr_no = msr_no;
+-	err = smp_call_function_single(cpu, __rdmsr_on_cpu, &rv, 1);
+-	*l = rv.reg.l;
+-	*h = rv.reg.h;
+-
+-	return err;
+-}
+-EXPORT_SYMBOL(rdmsr_on_cpu);
+-
+-int wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
+-{
+-	int err;
+-	struct msr_info rv;
+-
+-	memset(&rv, 0, sizeof(rv));
+-
+-	rv.msr_no = msr_no;
+-	rv.reg.l = l;
+-	rv.reg.h = h;
+-	err = smp_call_function_single(cpu, __wrmsr_on_cpu, &rv, 1);
+-
+-	return err;
+-}
+-EXPORT_SYMBOL(wrmsr_on_cpu);
+-
+-/* rdmsr on a bunch of CPUs
+- *
+- * @mask:       which CPUs
+- * @msr_no:     which MSR
+- * @msrs:       array of MSR values
+- *
+- */
+-void rdmsr_on_cpus(const cpumask_t *mask, u32 msr_no, struct msr *msrs)
+-{
+-	struct msr_info rv;
+-	int this_cpu;
+-
+-	memset(&rv, 0, sizeof(rv));
+-
+-	rv.off    = cpumask_first(mask);
+-	rv.msrs	  = msrs;
+-	rv.msr_no = msr_no;
+-
+-	this_cpu = get_cpu();
+-
+-	if (cpumask_test_cpu(this_cpu, mask))
+-		__rdmsr_on_cpu(&rv);
+-
+-	smp_call_function_many(mask, __rdmsr_on_cpu, &rv, 1);
+-	put_cpu();
+-}
+-EXPORT_SYMBOL(rdmsr_on_cpus);
+-
+-/*
+- * wrmsr on a bunch of CPUs
+- *
+- * @mask:       which CPUs
+- * @msr_no:     which MSR
+- * @msrs:       array of MSR values
+- *
+- */
+-void wrmsr_on_cpus(const cpumask_t *mask, u32 msr_no, struct msr *msrs)
+-{
+-	struct msr_info rv;
+-	int this_cpu;
+-
+-	memset(&rv, 0, sizeof(rv));
+-
+-	rv.off    = cpumask_first(mask);
+-	rv.msrs   = msrs;
+-	rv.msr_no = msr_no;
+-
+-	this_cpu = get_cpu();
+-
+-	if (cpumask_test_cpu(this_cpu, mask))
+-		__wrmsr_on_cpu(&rv);
+-
+-	smp_call_function_many(mask, __wrmsr_on_cpu, &rv, 1);
+-	put_cpu();
+-}
+-EXPORT_SYMBOL(wrmsr_on_cpus);
+-
+-/* These "safe" variants are slower and should be used when the target MSR
+-   may not actually exist. */
+-static void __rdmsr_safe_on_cpu(void *info)
+-{
+-	struct msr_info *rv = info;
+-
+-	rv->err = rdmsr_safe(rv->msr_no, &rv->reg.l, &rv->reg.h);
+-}
+-
+-static void __wrmsr_safe_on_cpu(void *info)
+-{
+-	struct msr_info *rv = info;
+-
+-	rv->err = wrmsr_safe(rv->msr_no, rv->reg.l, rv->reg.h);
+-}
+-
+-int rdmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
++struct msr *msrs_alloc(void)
+ {
+-	int err;
+-	struct msr_info rv;
++	struct msr *msrs = NULL;
+ 
+-	memset(&rv, 0, sizeof(rv));
++	msrs = alloc_percpu(struct msr);
++	if (!msrs) {
++		pr_warning("%s: error allocating msrs\n", __func__);
++		return NULL;
++	}
+ 
+-	rv.msr_no = msr_no;
+-	err = smp_call_function_single(cpu, __rdmsr_safe_on_cpu, &rv, 1);
+-	*l = rv.reg.l;
+-	*h = rv.reg.h;
+-
+-	return err ? err : rv.err;
++	return msrs;
+ }
+-EXPORT_SYMBOL(rdmsr_safe_on_cpu);
++EXPORT_SYMBOL(msrs_alloc);
+ 
+-int wrmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
++void msrs_free(struct msr *msrs)
+ {
+-	int err;
+-	struct msr_info rv;
+-
+-	memset(&rv, 0, sizeof(rv));
+-
+-	rv.msr_no = msr_no;
+-	rv.reg.l = l;
+-	rv.reg.h = h;
+-	err = smp_call_function_single(cpu, __wrmsr_safe_on_cpu, &rv, 1);
+-
+-	return err ? err : rv.err;
+-}
+-EXPORT_SYMBOL(wrmsr_safe_on_cpu);
+-
+-/*
+- * These variants are significantly slower, but allows control over
+- * the entire 32-bit GPR set.
+- */
+-struct msr_regs_info {
+-	u32 *regs;
+-	int err;
+-};
+-
+-static void __rdmsr_safe_regs_on_cpu(void *info)
+-{
+-	struct msr_regs_info *rv = info;
+-
+-	rv->err = rdmsr_safe_regs(rv->regs);
+-}
+-
+-static void __wrmsr_safe_regs_on_cpu(void *info)
+-{
+-	struct msr_regs_info *rv = info;
+-
+-	rv->err = wrmsr_safe_regs(rv->regs);
+-}
+-
+-int rdmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
+-{
+-	int err;
+-	struct msr_regs_info rv;
+-
+-	rv.regs   = regs;
+-	rv.err    = -EIO;
+-	err = smp_call_function_single(cpu, __rdmsr_safe_regs_on_cpu, &rv, 1);
+-
+-	return err ? err : rv.err;
+-}
+-EXPORT_SYMBOL(rdmsr_safe_regs_on_cpu);
+-
+-int wrmsr_safe_regs_on_cpu(unsigned int cpu, u32 *regs)
+-{
+-	int err;
+-	struct msr_regs_info rv;
+-
+-	rv.regs = regs;
+-	rv.err  = -EIO;
+-	err = smp_call_function_single(cpu, __wrmsr_safe_regs_on_cpu, &rv, 1);
+-
+-	return err ? err : rv.err;
++	free_percpu(msrs);
+ }
+-EXPORT_SYMBOL(wrmsr_safe_regs_on_cpu);
++EXPORT_SYMBOL(msrs_free);
+diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
+index 0c9c6a9..8a95e83 100644
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -282,6 +282,13 @@ static int acpi_lid_send_state(struct acpi_device *device)
+ 	if (ret == NOTIFY_DONE)
+ 		ret = blocking_notifier_call_chain(&acpi_lid_notifier, state,
+ 						   device);
++	if (ret == NOTIFY_DONE || ret == NOTIFY_OK) {
++		/*
++		 * It is also regarded as success if the notifier_chain
++		 * returns NOTIFY_OK or NOTIFY_DONE.
++		 */
++		ret = 0;
++	}
+ 	return ret;
+ }
+ 
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index baef28c..7511029 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -916,6 +916,7 @@ static int ec_validate_ecdt(const struct dmi_system_id *id)
+ /* MSI EC needs special treatment, enable it */
+ static int ec_flag_msi(const struct dmi_system_id *id)
+ {
++	printk(KERN_DEBUG PREFIX "Detected MSI hardware, enabling workarounds.\n");
+ 	EC_FLAGS_MSI = 1;
+ 	EC_FLAGS_VALIDATE_ECDT = 1;
+ 	return 0;
+@@ -928,8 +929,13 @@ static struct dmi_system_id __initdata ec_dmi_table[] = {
+ 	DMI_MATCH(DMI_BOARD_NAME, "JFL92") }, NULL},
+ 	{
+ 	ec_flag_msi, "MSI hardware", {
+-	DMI_MATCH(DMI_BIOS_VENDOR, "Micro-Star"),
+-	DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-Star") }, NULL},
++	DMI_MATCH(DMI_BIOS_VENDOR, "Micro-Star")}, NULL},
++	{
++	ec_flag_msi, "MSI hardware", {
++	DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star")}, NULL},
++	{
++	ec_flag_msi, "MSI hardware", {
++	DMI_MATCH(DMI_CHASSIS_VENDOR, "MICRO-Star")}, NULL},
+ 	{
+ 	ec_validate_ecdt, "ASUS hardware", {
+ 	DMI_MATCH(DMI_BIOS_VENDOR, "ASUS") }, NULL},
+diff --git a/drivers/ata/pata_cmd64x.c b/drivers/ata/pata_cmd64x.c
+index f98dffe..f0bad9b 100644
+--- a/drivers/ata/pata_cmd64x.c
++++ b/drivers/ata/pata_cmd64x.c
+@@ -219,7 +219,7 @@ static void cmd64x_set_dmamode(struct ata_port *ap, struct ata_device *adev)
+ 		regU |= udma_data[adev->dma_mode - XFER_UDMA_0] << shift;
+ 		/* Merge the control bits */
+ 		regU |= 1 << adev->devno; /* UDMA on */
+-		if (adev->dma_mode > 2)	/* 15nS timing */
++		if (adev->dma_mode > XFER_UDMA_2) /* 15nS timing */
+ 			regU |= 4 << adev->devno;
+ 	} else {
+ 		regU &= ~ (1 << adev->devno);	/* UDMA off */
+diff --git a/drivers/ata/pata_hpt3x2n.c b/drivers/ata/pata_hpt3x2n.c
+index 21c5bd6..d16e87e 100644
+--- a/drivers/ata/pata_hpt3x2n.c
++++ b/drivers/ata/pata_hpt3x2n.c
+@@ -8,7 +8,7 @@
+  * Copyright (C) 1999-2003		Andre Hedrick <andre@×××××××××.org>
+  * Portions Copyright (C) 2001	        Sun Microsystems, Inc.
+  * Portions Copyright (C) 2003		Red Hat Inc
+- * Portions Copyright (C) 2005-2007	MontaVista Software, Inc.
++ * Portions Copyright (C) 2005-2009	MontaVista Software, Inc.
+  *
+  *
+  * TODO
+@@ -25,7 +25,7 @@
+ #include <linux/libata.h>
+ 
+ #define DRV_NAME	"pata_hpt3x2n"
+-#define DRV_VERSION	"0.3.7"
++#define DRV_VERSION	"0.3.8"
+ 
+ enum {
+ 	HPT_PCI_FAST	=	(1 << 31),
+@@ -262,7 +262,7 @@ static void hpt3x2n_bmdma_stop(struct ata_queued_cmd *qc)
+ 
+ static void hpt3x2n_set_clock(struct ata_port *ap, int source)
+ {
+-	void __iomem *bmdma = ap->ioaddr.bmdma_addr;
++	void __iomem *bmdma = ap->ioaddr.bmdma_addr - ap->port_no * 8;
+ 
+ 	/* Tristate the bus */
+ 	iowrite8(0x80, bmdma+0x73);
+@@ -272,9 +272,9 @@ static void hpt3x2n_set_clock(struct ata_port *ap, int source)
+ 	iowrite8(source, bmdma+0x7B);
+ 	iowrite8(0xC0, bmdma+0x79);
+ 
+-	/* Reset state machines */
+-	iowrite8(0x37, bmdma+0x70);
+-	iowrite8(0x37, bmdma+0x74);
++	/* Reset state machines, avoid enabling the disabled channels */
++	iowrite8(ioread8(bmdma+0x70) | 0x32, bmdma+0x70);
++	iowrite8(ioread8(bmdma+0x74) | 0x32, bmdma+0x74);
+ 
+ 	/* Complete reset */
+ 	iowrite8(0x00, bmdma+0x79);
+@@ -284,21 +284,10 @@ static void hpt3x2n_set_clock(struct ata_port *ap, int source)
+ 	iowrite8(0x00, bmdma+0x77);
+ }
+ 
+-/* Check if our partner interface is busy */
+-
+-static int hpt3x2n_pair_idle(struct ata_port *ap)
+-{
+-	struct ata_host *host = ap->host;
+-	struct ata_port *pair = host->ports[ap->port_no ^ 1];
+-
+-	if (pair->hsm_task_state == HSM_ST_IDLE)
+-		return 1;
+-	return 0;
+-}
+-
+ static int hpt3x2n_use_dpll(struct ata_port *ap, int writing)
+ {
+ 	long flags = (long)ap->host->private_data;
++
+ 	/* See if we should use the DPLL */
+ 	if (writing)
+ 		return USE_DPLL;	/* Needed for write */
+@@ -307,20 +296,35 @@ static int hpt3x2n_use_dpll(struct ata_port *ap, int writing)
+ 	return 0;
+ }
+ 
++static int hpt3x2n_qc_defer(struct ata_queued_cmd *qc)
++{
++	struct ata_port *ap = qc->ap;
++	struct ata_port *alt = ap->host->ports[ap->port_no ^ 1];
++	int rc, flags = (long)ap->host->private_data;
++	int dpll = hpt3x2n_use_dpll(ap, qc->tf.flags & ATA_TFLAG_WRITE);
++
++	/* First apply the usual rules */
++	rc = ata_std_qc_defer(qc);
++	if (rc != 0)
++		return rc;
++
++	if ((flags & USE_DPLL) != dpll && alt->qc_active)
++		return ATA_DEFER_PORT;
++	return 0;
++}
++
+ static unsigned int hpt3x2n_qc_issue(struct ata_queued_cmd *qc)
+ {
+-	struct ata_taskfile *tf = &qc->tf;
+ 	struct ata_port *ap = qc->ap;
+ 	int flags = (long)ap->host->private_data;
++	int dpll = hpt3x2n_use_dpll(ap, qc->tf.flags & ATA_TFLAG_WRITE);
+ 
+-	if (hpt3x2n_pair_idle(ap)) {
+-		int dpll = hpt3x2n_use_dpll(ap, (tf->flags & ATA_TFLAG_WRITE));
+-		if ((flags & USE_DPLL) != dpll) {
+-			if (dpll == 1)
+-				hpt3x2n_set_clock(ap, 0x21);
+-			else
+-				hpt3x2n_set_clock(ap, 0x23);
+-		}
++	if ((flags & USE_DPLL) != dpll) {
++		flags &= ~USE_DPLL;
++		flags |= dpll;
++		ap->host->private_data = (void *)(long)flags;
++
++		hpt3x2n_set_clock(ap, dpll ? 0x21 : 0x23);
+ 	}
+ 	return ata_sff_qc_issue(qc);
+ }
+@@ -337,6 +341,8 @@ static struct ata_port_operations hpt3x2n_port_ops = {
+ 	.inherits	= &ata_bmdma_port_ops,
+ 
+ 	.bmdma_stop	= hpt3x2n_bmdma_stop,
++
++	.qc_defer	= hpt3x2n_qc_defer,
+ 	.qc_issue	= hpt3x2n_qc_issue,
+ 
+ 	.cable_detect	= hpt3x2n_cable_detect,
+@@ -454,7 +460,7 @@ static int hpt3x2n_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+ 	unsigned int f_low, f_high;
+ 	int adjust;
+ 	unsigned long iobase = pci_resource_start(dev, 4);
+-	void *hpriv = NULL;
++	void *hpriv = (void *)USE_DPLL;
+ 	int rc;
+ 
+ 	rc = pcim_enable_device(dev);
+@@ -542,7 +548,7 @@ static int hpt3x2n_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+ 	/* Set our private data up. We only need a few flags so we use
+ 	   it directly */
+ 	if (pci_mhz > 60) {
+-		hpriv = (void *)PCI66;
++		hpriv = (void *)(PCI66 | USE_DPLL);
+ 		/*
+ 		 * On  HPT371N, if ATA clock is 66 MHz we must set bit 2 in
+ 		 * the MISC. register to stretch the UltraDMA Tss timing.
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 44bc8bb..1be7631 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -307,6 +307,7 @@ static void btusb_bulk_complete(struct urb *urb)
+ 		return;
+ 
+ 	usb_anchor_urb(urb, &data->bulk_anchor);
++	usb_mark_last_busy(data->udev);
+ 
+ 	err = usb_submit_urb(urb, GFP_ATOMIC);
+ 	if (err < 0) {
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index 7585c41..c558fa1 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -815,7 +815,7 @@ atc_is_tx_complete(struct dma_chan *chan,
+ 	dev_vdbg(chan2dev(chan), "is_tx_complete: %d (d%d, u%d)\n",
+ 			cookie, done ? *done : 0, used ? *used : 0);
+ 
+-	spin_lock_bh(atchan->lock);
++	spin_lock_bh(&atchan->lock);
+ 
+ 	last_complete = atchan->completed_cookie;
+ 	last_used = chan->cookie;
+@@ -830,7 +830,7 @@ atc_is_tx_complete(struct dma_chan *chan,
+ 		ret = dma_async_is_complete(cookie, last_complete, last_used);
+ 	}
+ 
+-	spin_unlock_bh(atchan->lock);
++	spin_unlock_bh(&atchan->lock);
+ 
+ 	if (done)
+ 		*done = last_complete;
+diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
+index c524d36..dcc4ab7 100644
+--- a/drivers/dma/ioat/dma.c
++++ b/drivers/dma/ioat/dma.c
+@@ -1032,7 +1032,7 @@ int __devinit ioat_probe(struct ioatdma_device *device)
+ 	dma->dev = &pdev->dev;
+ 
+ 	if (!dma->chancnt) {
+-		dev_err(dev, "zero channels detected\n");
++		dev_err(dev, "channel enumeration error\n");
+ 		goto err_setup_interrupts;
+ 	}
+ 
+diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
+index 45edde9..bbc3e78 100644
+--- a/drivers/dma/ioat/dma.h
++++ b/drivers/dma/ioat/dma.h
+@@ -60,6 +60,7 @@
+  * @dca: direct cache access context
+  * @intr_quirk: interrupt setup quirk (for ioat_v1 devices)
+  * @enumerate_channels: hw version specific channel enumeration
++ * @reset_hw: hw version specific channel (re)initialization
+  * @cleanup_tasklet: select between the v2 and v3 cleanup routines
+  * @timer_fn: select between the v2 and v3 timer watchdog routines
+  * @self_test: hardware version specific self test for each supported op type
+@@ -78,6 +79,7 @@ struct ioatdma_device {
+ 	struct dca_provider *dca;
+ 	void (*intr_quirk)(struct ioatdma_device *device);
+ 	int (*enumerate_channels)(struct ioatdma_device *device);
++	int (*reset_hw)(struct ioat_chan_common *chan);
+ 	void (*cleanup_tasklet)(unsigned long data);
+ 	void (*timer_fn)(unsigned long data);
+ 	int (*self_test)(struct ioatdma_device *device);
+@@ -264,6 +266,22 @@ static inline void ioat_suspend(struct ioat_chan_common *chan)
+ 	writeb(IOAT_CHANCMD_SUSPEND, chan->reg_base + IOAT_CHANCMD_OFFSET(ver));
+ }
+ 
++static inline void ioat_reset(struct ioat_chan_common *chan)
++{
++	u8 ver = chan->device->version;
++
++	writeb(IOAT_CHANCMD_RESET, chan->reg_base + IOAT_CHANCMD_OFFSET(ver));
++}
++
++static inline bool ioat_reset_pending(struct ioat_chan_common *chan)
++{
++	u8 ver = chan->device->version;
++	u8 cmd;
++
++	cmd = readb(chan->reg_base + IOAT_CHANCMD_OFFSET(ver));
++	return (cmd & IOAT_CHANCMD_RESET) == IOAT_CHANCMD_RESET;
++}
++
+ static inline void ioat_set_chainaddr(struct ioat_dma_chan *ioat, u64 addr)
+ {
+ 	struct ioat_chan_common *chan = &ioat->base;
+diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
+index 8f1f7f0..5f7a500 100644
+--- a/drivers/dma/ioat/dma_v2.c
++++ b/drivers/dma/ioat/dma_v2.c
+@@ -239,20 +239,50 @@ void __ioat2_restart_chan(struct ioat2_dma_chan *ioat)
+ 		__ioat2_start_null_desc(ioat);
+ }
+ 
+-static void ioat2_restart_channel(struct ioat2_dma_chan *ioat)
++int ioat2_quiesce(struct ioat_chan_common *chan, unsigned long tmo)
+ {
+-	struct ioat_chan_common *chan = &ioat->base;
+-	unsigned long phys_complete;
++	unsigned long end = jiffies + tmo;
++	int err = 0;
+ 	u32 status;
+ 
+ 	status = ioat_chansts(chan);
+ 	if (is_ioat_active(status) || is_ioat_idle(status))
+ 		ioat_suspend(chan);
+ 	while (is_ioat_active(status) || is_ioat_idle(status)) {
++		if (end && time_after(jiffies, end)) {
++			err = -ETIMEDOUT;
++			break;
++		}
+ 		status = ioat_chansts(chan);
+ 		cpu_relax();
+ 	}
+ 
++	return err;
++}
++
++int ioat2_reset_sync(struct ioat_chan_common *chan, unsigned long tmo)
++{
++	unsigned long end = jiffies + tmo;
++	int err = 0;
++
++	ioat_reset(chan);
++	while (ioat_reset_pending(chan)) {
++		if (end && time_after(jiffies, end)) {
++			err = -ETIMEDOUT;
++			break;
++		}
++		cpu_relax();
++	}
++
++	return err;
++}
++
++static void ioat2_restart_channel(struct ioat2_dma_chan *ioat)
++{
++	struct ioat_chan_common *chan = &ioat->base;
++	unsigned long phys_complete;
++
++	ioat2_quiesce(chan, 0);
+ 	if (ioat_cleanup_preamble(chan, &phys_complete))
+ 		__cleanup(ioat, phys_complete);
+ 
+@@ -318,6 +348,19 @@ void ioat2_timer_event(unsigned long data)
+ 	spin_unlock_bh(&chan->cleanup_lock);
+ }
+ 
++static int ioat2_reset_hw(struct ioat_chan_common *chan)
++{
++	/* throw away whatever the channel was doing and get it initialized */
++	u32 chanerr;
++
++	ioat2_quiesce(chan, msecs_to_jiffies(100));
++
++	chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
++	writel(chanerr, chan->reg_base + IOAT_CHANERR_OFFSET);
++
++	return ioat2_reset_sync(chan, msecs_to_jiffies(200));
++}
++
+ /**
+  * ioat2_enumerate_channels - find and initialize the device's channels
+  * @device: the device to be enumerated
+@@ -360,6 +403,10 @@ int ioat2_enumerate_channels(struct ioatdma_device *device)
+ 				  (unsigned long) ioat);
+ 		ioat->xfercap_log = xfercap_log;
+ 		spin_lock_init(&ioat->ring_lock);
++		if (device->reset_hw(&ioat->base)) {
++			i = 0;
++			break;
++		}
+ 	}
+ 	dma->chancnt = i;
+ 	return i;
+@@ -467,7 +514,6 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
+ 	struct ioat2_dma_chan *ioat = to_ioat2_chan(c);
+ 	struct ioat_chan_common *chan = &ioat->base;
+ 	struct ioat_ring_ent **ring;
+-	u32 chanerr;
+ 	int order;
+ 
+ 	/* have we already been set up? */
+@@ -477,12 +523,6 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
+ 	/* Setup register to interrupt and write completion status on error */
+ 	writew(IOAT_CHANCTRL_RUN, chan->reg_base + IOAT_CHANCTRL_OFFSET);
+ 
+-	chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
+-	if (chanerr) {
+-		dev_err(to_dev(chan), "CHANERR = %x, clearing\n", chanerr);
+-		writel(chanerr, chan->reg_base + IOAT_CHANERR_OFFSET);
+-	}
+-
+ 	/* allocate a completion writeback area */
+ 	/* doing 2 32bit writes to mmio since 1 64b write doesn't work */
+ 	chan->completion = pci_pool_alloc(chan->device->completion_pool,
+@@ -746,13 +786,7 @@ void ioat2_free_chan_resources(struct dma_chan *c)
+ 	tasklet_disable(&chan->cleanup_task);
+ 	del_timer_sync(&chan->timer);
+ 	device->cleanup_tasklet((unsigned long) ioat);
+-
+-	/* Delay 100ms after reset to allow internal DMA logic to quiesce
+-	 * before removing DMA descriptor resources.
+-	 */
+-	writeb(IOAT_CHANCMD_RESET,
+-	       chan->reg_base + IOAT_CHANCMD_OFFSET(chan->device->version));
+-	mdelay(100);
++	device->reset_hw(chan);
+ 
+ 	spin_lock_bh(&ioat->ring_lock);
+ 	descs = ioat2_ring_space(ioat);
+@@ -839,6 +873,7 @@ int __devinit ioat2_dma_probe(struct ioatdma_device *device, int dca)
+ 	int err;
+ 
+ 	device->enumerate_channels = ioat2_enumerate_channels;
++	device->reset_hw = ioat2_reset_hw;
+ 	device->cleanup_tasklet = ioat2_cleanup_tasklet;
+ 	device->timer_fn = ioat2_timer_event;
+ 	device->self_test = ioat_dma_self_test;
+diff --git a/drivers/dma/ioat/dma_v2.h b/drivers/dma/ioat/dma_v2.h
+index 1d849ef..3afad8d 100644
+--- a/drivers/dma/ioat/dma_v2.h
++++ b/drivers/dma/ioat/dma_v2.h
+@@ -185,6 +185,8 @@ bool reshape_ring(struct ioat2_dma_chan *ioat, int order);
+ void __ioat2_issue_pending(struct ioat2_dma_chan *ioat);
+ void ioat2_cleanup_tasklet(unsigned long data);
+ void ioat2_timer_event(unsigned long data);
++int ioat2_quiesce(struct ioat_chan_common *chan, unsigned long tmo);
++int ioat2_reset_sync(struct ioat_chan_common *chan, unsigned long tmo);
+ extern struct kobj_type ioat2_ktype;
+ extern struct kmem_cache *ioat2_cache;
+ #endif /* IOATDMA_V2_H */
+diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
+index 42f6f10..9908c9e 100644
+--- a/drivers/dma/ioat/dma_v3.c
++++ b/drivers/dma/ioat/dma_v3.c
+@@ -650,9 +650,11 @@ __ioat3_prep_pq_lock(struct dma_chan *c, enum sum_check_flags *result,
+ 
+ 	num_descs = ioat2_xferlen_to_descs(ioat, len);
+ 	/* we need 2x the number of descriptors to cover greater than 3
+-	 * sources
++	 * sources (we need 1 extra source in the q-only continuation
++	 * case and 3 extra sources in the p+q continuation case.
+ 	 */
+-	if (src_cnt > 3 || flags & DMA_PREP_CONTINUE) {
++	if (src_cnt + dmaf_p_disabled_continue(flags) > 3 ||
++	    (dmaf_continue(flags) && !dmaf_p_disabled_continue(flags))) {
+ 		with_ext = 1;
+ 		num_descs *= 2;
+ 	} else
+@@ -1128,6 +1130,45 @@ static int __devinit ioat3_dma_self_test(struct ioatdma_device *device)
+ 	return 0;
+ }
+ 
++static int ioat3_reset_hw(struct ioat_chan_common *chan)
++{
++	/* throw away whatever the channel was doing and get it
++	 * initialized, with ioat3 specific workarounds
++	 */
++	struct ioatdma_device *device = chan->device;
++	struct pci_dev *pdev = device->pdev;
++	u32 chanerr;
++	u16 dev_id;
++	int err;
++
++	ioat2_quiesce(chan, msecs_to_jiffies(100));
++
++	chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
++	writel(chanerr, chan->reg_base + IOAT_CHANERR_OFFSET);
++
++	/* -= IOAT ver.3 workarounds =- */
++	/* Write CHANERRMSK_INT with 3E07h to mask out the errors
++	 * that can cause stability issues for IOAT ver.3, and clear any
++	 * pending errors
++	 */
++	pci_write_config_dword(pdev, IOAT_PCI_CHANERRMASK_INT_OFFSET, 0x3e07);
++	err = pci_read_config_dword(pdev, IOAT_PCI_CHANERR_INT_OFFSET, &chanerr);
++	if (err) {
++		dev_err(&pdev->dev, "channel error register unreachable\n");
++		return err;
++	}
++	pci_write_config_dword(pdev, IOAT_PCI_CHANERR_INT_OFFSET, chanerr);
++
++	/* Clear DMAUNCERRSTS Cfg-Reg Parity Error status bit
++	 * (workaround for spurious config parity error after restart)
++	 */
++	pci_read_config_word(pdev, IOAT_PCI_DEVICE_ID_OFFSET, &dev_id);
++	if (dev_id == PCI_DEVICE_ID_INTEL_IOAT_TBG0)
++		pci_write_config_dword(pdev, IOAT_PCI_DMAUNCERRSTS_OFFSET, 0x10);
++
++	return ioat2_reset_sync(chan, msecs_to_jiffies(200));
++}
++
+ int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
+ {
+ 	struct pci_dev *pdev = device->pdev;
+@@ -1137,10 +1178,10 @@ int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
+ 	struct ioat_chan_common *chan;
+ 	bool is_raid_device = false;
+ 	int err;
+-	u16 dev_id;
+ 	u32 cap;
+ 
+ 	device->enumerate_channels = ioat2_enumerate_channels;
++	device->reset_hw = ioat3_reset_hw;
+ 	device->self_test = ioat3_dma_self_test;
+ 	dma = &device->common;
+ 	dma->device_prep_dma_memcpy = ioat2_dma_prep_memcpy_lock;
+@@ -1216,19 +1257,6 @@ int __devinit ioat3_dma_probe(struct ioatdma_device *device, int dca)
+ 	dma->device_prep_dma_xor_val = NULL;
+ 	#endif
+ 
+-	/* -= IOAT ver.3 workarounds =- */
+-	/* Write CHANERRMSK_INT with 3E07h to mask out the errors
+-	 * that can cause stability issues for IOAT ver.3
+-	 */
+-	pci_write_config_dword(pdev, IOAT_PCI_CHANERRMASK_INT_OFFSET, 0x3e07);
+-
+-	/* Clear DMAUNCERRSTS Cfg-Reg Parity Error status bit
+-	 * (workaround for spurious config parity error after restart)
+-	 */
+-	pci_read_config_word(pdev, IOAT_PCI_DEVICE_ID_OFFSET, &dev_id);
+-	if (dev_id == PCI_DEVICE_ID_INTEL_IOAT_TBG0)
+-		pci_write_config_dword(pdev, IOAT_PCI_DMAUNCERRSTS_OFFSET, 0x10);
+-
+ 	err = ioat_probe(device);
+ 	if (err)
+ 		return err;
+diff --git a/drivers/dma/ioat/registers.h b/drivers/dma/ioat/registers.h
+index f015ec1..e8ae63b 100644
+--- a/drivers/dma/ioat/registers.h
++++ b/drivers/dma/ioat/registers.h
+@@ -27,6 +27,7 @@
+ 
+ #define IOAT_PCI_DEVICE_ID_OFFSET		0x02
+ #define IOAT_PCI_DMAUNCERRSTS_OFFSET		0x148
++#define IOAT_PCI_CHANERR_INT_OFFSET		0x180
+ #define IOAT_PCI_CHANERRMASK_INT_OFFSET		0x184
+ 
+ /* MMIO Device Registers */
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index a38831c..a0bcfba 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -13,6 +13,8 @@ module_param(report_gart_errors, int, 0644);
+ static int ecc_enable_override;
+ module_param(ecc_enable_override, int, 0644);
+ 
++static struct msr *msrs;
++
+ /* Lookup table for all possible MC control instances */
+ struct amd64_pvt;
+ static struct mem_ctl_info *mci_lookup[EDAC_MAX_NUMNODES];
+@@ -2618,6 +2620,90 @@ static int amd64_init_csrows(struct mem_ctl_info *mci)
+ 	return empty;
+ }
+ 
++/* get all cores on this DCT */
++static void get_cpus_on_this_dct_cpumask(struct cpumask *mask, int nid)
++{
++	int cpu;
++
++	for_each_online_cpu(cpu)
++		if (amd_get_nb_id(cpu) == nid)
++			cpumask_set_cpu(cpu, mask);
++}
++
++/* check MCG_CTL on all the cpus on this node */
++static bool amd64_nb_mce_bank_enabled_on_node(int nid)
++{
++	cpumask_var_t mask;
++	int cpu, nbe;
++	bool ret = false;
++
++	if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) {
++		amd64_printk(KERN_WARNING, "%s: error allocating mask\n",
++			     __func__);
++		return false;
++	}
++
++	get_cpus_on_this_dct_cpumask(mask, nid);
++
++	rdmsr_on_cpus(mask, MSR_IA32_MCG_CTL, msrs);
++
++	for_each_cpu(cpu, mask) {
++		struct msr *reg = per_cpu_ptr(msrs, cpu);
++		nbe = reg->l & K8_MSR_MCGCTL_NBE;
++
++		debugf0("core: %u, MCG_CTL: 0x%llx, NB MSR is %s\n",
++			cpu, reg->q,
++			(nbe ? "enabled" : "disabled"));
++
++		if (!nbe)
++			goto out;
++	}
++	ret = true;
++
++out:
++	free_cpumask_var(mask);
++	return ret;
++}
++
++static int amd64_toggle_ecc_err_reporting(struct amd64_pvt *pvt, bool on)
++{
++	cpumask_var_t cmask;
++	int cpu;
++
++	if (!zalloc_cpumask_var(&cmask, GFP_KERNEL)) {
++		amd64_printk(KERN_WARNING, "%s: error allocating mask\n",
++			     __func__);
++		return false;
++	}
++
++	get_cpus_on_this_dct_cpumask(cmask, pvt->mc_node_id);
++
++	rdmsr_on_cpus(cmask, MSR_IA32_MCG_CTL, msrs);
++
++	for_each_cpu(cpu, cmask) {
++
++		struct msr *reg = per_cpu_ptr(msrs, cpu);
++
++		if (on) {
++			if (reg->l & K8_MSR_MCGCTL_NBE)
++				pvt->flags.ecc_report = 1;
++
++			reg->l |= K8_MSR_MCGCTL_NBE;
++		} else {
++			/*
++			 * Turn off ECC reporting only when it was off before
++			 */
++			if (!pvt->flags.ecc_report)
++				reg->l &= ~K8_MSR_MCGCTL_NBE;
++		}
++	}
++	wrmsr_on_cpus(cmask, MSR_IA32_MCG_CTL, msrs);
++
++	free_cpumask_var(cmask);
++
++	return 0;
++}
++
+ /*
+  * Only if 'ecc_enable_override' is set AND BIOS had ECC disabled, do "we"
+  * enable it.
+@@ -2625,17 +2711,12 @@ static int amd64_init_csrows(struct mem_ctl_info *mci)
+ static void amd64_enable_ecc_error_reporting(struct mem_ctl_info *mci)
+ {
+ 	struct amd64_pvt *pvt = mci->pvt_info;
+-	const cpumask_t *cpumask = cpumask_of_node(pvt->mc_node_id);
+-	int cpu, idx = 0, err = 0;
+-	struct msr msrs[cpumask_weight(cpumask)];
+-	u32 value;
+-	u32 mask = K8_NBCTL_CECCEn | K8_NBCTL_UECCEn;
++	int err = 0;
++	u32 value, mask = K8_NBCTL_CECCEn | K8_NBCTL_UECCEn;
+ 
+ 	if (!ecc_enable_override)
+ 		return;
+ 
+-	memset(msrs, 0, sizeof(msrs));
+-
+ 	amd64_printk(KERN_WARNING,
+ 		"'ecc_enable_override' parameter is active, "
+ 		"Enabling AMD ECC hardware now: CAUTION\n");
+@@ -2651,16 +2732,9 @@ static void amd64_enable_ecc_error_reporting(struct mem_ctl_info *mci)
+ 	value |= mask;
+ 	pci_write_config_dword(pvt->misc_f3_ctl, K8_NBCTL, value);
+ 
+-	rdmsr_on_cpus(cpumask, K8_MSR_MCGCTL, msrs);
+-
+-	for_each_cpu(cpu, cpumask) {
+-		if (msrs[idx].l & K8_MSR_MCGCTL_NBE)
+-			set_bit(idx, &pvt->old_mcgctl);
+-
+-		msrs[idx].l |= K8_MSR_MCGCTL_NBE;
+-		idx++;
+-	}
+-	wrmsr_on_cpus(cpumask, K8_MSR_MCGCTL, msrs);
++	if (amd64_toggle_ecc_err_reporting(pvt, ON))
++		amd64_printk(KERN_WARNING, "Error enabling ECC reporting over "
++					   "MCGCTL!\n");
+ 
+ 	err = pci_read_config_dword(pvt->misc_f3_ctl, K8_NBCFG, &value);
+ 	if (err)
+@@ -2701,17 +2775,12 @@ static void amd64_enable_ecc_error_reporting(struct mem_ctl_info *mci)
+ 
+ static void amd64_restore_ecc_error_reporting(struct amd64_pvt *pvt)
+ {
+-	const cpumask_t *cpumask = cpumask_of_node(pvt->mc_node_id);
+-	int cpu, idx = 0, err = 0;
+-	struct msr msrs[cpumask_weight(cpumask)];
+-	u32 value;
+-	u32 mask = K8_NBCTL_CECCEn | K8_NBCTL_UECCEn;
++	int err = 0;
++	u32 value, mask = K8_NBCTL_CECCEn | K8_NBCTL_UECCEn;
+ 
+ 	if (!pvt->nbctl_mcgctl_saved)
+ 		return;
+ 
+-	memset(msrs, 0, sizeof(msrs));
+-
+ 	err = pci_read_config_dword(pvt->misc_f3_ctl, K8_NBCTL, &value);
+ 	if (err)
+ 		debugf0("Reading K8_NBCTL failed\n");
+@@ -2721,66 +2790,9 @@ static void amd64_restore_ecc_error_reporting(struct amd64_pvt *pvt)
+ 	/* restore the NB Enable MCGCTL bit */
+ 	pci_write_config_dword(pvt->misc_f3_ctl, K8_NBCTL, value);
+ 
+-	rdmsr_on_cpus(cpumask, K8_MSR_MCGCTL, msrs);
+-
+-	for_each_cpu(cpu, cpumask) {
+-		msrs[idx].l &= ~K8_MSR_MCGCTL_NBE;
+-		msrs[idx].l |=
+-			test_bit(idx, &pvt->old_mcgctl) << K8_MSR_MCGCTL_NBE;
+-		idx++;
+-	}
+-
+-	wrmsr_on_cpus(cpumask, K8_MSR_MCGCTL, msrs);
+-}
+-
+-/* get all cores on this DCT */
+-static void get_cpus_on_this_dct_cpumask(cpumask_t *mask, int nid)
+-{
+-	int cpu;
+-
+-	for_each_online_cpu(cpu)
+-		if (amd_get_nb_id(cpu) == nid)
+-			cpumask_set_cpu(cpu, mask);
+-}
+-
+-/* check MCG_CTL on all the cpus on this node */
+-static bool amd64_nb_mce_bank_enabled_on_node(int nid)
+-{
+-	cpumask_t mask;
+-	struct msr *msrs;
+-	int cpu, nbe, idx = 0;
+-	bool ret = false;
+-
+-	cpumask_clear(&mask);
+-
+-	get_cpus_on_this_dct_cpumask(&mask, nid);
+-
+-	msrs = kzalloc(sizeof(struct msr) * cpumask_weight(&mask), GFP_KERNEL);
+-	if (!msrs) {
+-		amd64_printk(KERN_WARNING, "%s: error allocating msrs\n",
+-			      __func__);
+-		 return false;
+-	}
+-
+-	rdmsr_on_cpus(&mask, MSR_IA32_MCG_CTL, msrs);
+-
+-	for_each_cpu(cpu, &mask) {
+-		nbe = msrs[idx].l & K8_MSR_MCGCTL_NBE;
+-
+-		debugf0("core: %u, MCG_CTL: 0x%llx, NB MSR is %s\n",
+-			cpu, msrs[idx].q,
+-			(nbe ? "enabled" : "disabled"));
+-
+-		if (!nbe)
+-			goto out;
+-
+-		idx++;
+-	}
+-	ret = true;
+-
+-out:
+-	kfree(msrs);
+-	return ret;
++	if (amd64_toggle_ecc_err_reporting(pvt, OFF))
++		amd64_printk(KERN_WARNING, "Error restoring ECC reporting over "
++					   "MCGCTL!\n");
+ }
+ 
+ /*
+@@ -2824,9 +2836,8 @@ static int amd64_check_ecc_enabled(struct amd64_pvt *pvt)
+ 			amd64_printk(KERN_WARNING, "%s", ecc_warning);
+ 			return -ENODEV;
+ 		}
+-	} else
+-		/* CLEAR the override, since BIOS controlled it */
+ 		ecc_enable_override = 0;
++	}
+ 
+ 	return 0;
+ }
+@@ -2909,7 +2920,6 @@ static int amd64_probe_one_instance(struct pci_dev *dram_f2_ctl,
+ 	pvt->ext_model		= boot_cpu_data.x86_model >> 4;
+ 	pvt->mc_type_index	= mc_type_index;
+ 	pvt->ops		= family_ops(mc_type_index);
+-	pvt->old_mcgctl		= 0;
+ 
+ 	/*
+ 	 * We have the dram_f2_ctl device as an argument, now go reserve its
+@@ -3071,16 +3081,15 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev)
+ 
+ 	amd64_free_mc_sibling_devices(pvt);
+ 
+-	kfree(pvt);
+-	mci->pvt_info = NULL;
+-
+-	mci_lookup[pvt->mc_node_id] = NULL;
+-
+ 	/* unregister from EDAC MCE */
+ 	amd_report_gart_errors(false);
+ 	amd_unregister_ecc_decoder(amd64_decode_bus_error);
+ 
+ 	/* Free the EDAC CORE resources */
++	mci->pvt_info = NULL;
++	mci_lookup[pvt->mc_node_id] = NULL;
++
++	kfree(pvt);
+ 	edac_mc_free(mci);
+ }
+ 
+@@ -3157,23 +3166,29 @@ static void amd64_setup_pci_device(void)
+ static int __init amd64_edac_init(void)
+ {
+ 	int nb, err = -ENODEV;
++	bool load_ok = false;
+ 
+ 	edac_printk(KERN_INFO, EDAC_MOD_STR, EDAC_AMD64_VERSION "\n");
+ 
+ 	opstate_init();
+ 
+ 	if (cache_k8_northbridges() < 0)
+-		return err;
++		goto err_ret;
++
++	msrs = msrs_alloc();
++	if (!msrs)
++		goto err_ret;
+ 
+ 	err = pci_register_driver(&amd64_pci_driver);
+ 	if (err)
+-		return err;
++		goto err_pci;
+ 
+ 	/*
+ 	 * At this point, the array 'pvt_lookup[]' contains pointers to alloc'd
+ 	 * amd64_pvt structs. These will be used in the 2nd stage init function
+ 	 * to finish initialization of the MC instances.
+ 	 */
++	err = -ENODEV;
+ 	for (nb = 0; nb < num_k8_northbridges; nb++) {
+ 		if (!pvt_lookup[nb])
+ 			continue;
+@@ -3181,16 +3196,21 @@ static int __init amd64_edac_init(void)
+ 		err = amd64_init_2nd_stage(pvt_lookup[nb]);
+ 		if (err)
+ 			goto err_2nd_stage;
+-	}
+ 
+-	amd64_setup_pci_device();
++		load_ok = true;
++	}
+ 
+-	return 0;
++	if (load_ok) {
++		amd64_setup_pci_device();
++		return 0;
++	}
+ 
+ err_2nd_stage:
+-	debugf0("2nd stage failed\n");
+ 	pci_unregister_driver(&amd64_pci_driver);
+-
++err_pci:
++	msrs_free(msrs);
++	msrs = NULL;
++err_ret:
+ 	return err;
+ }
+ 
+@@ -3200,6 +3220,9 @@ static void __exit amd64_edac_exit(void)
+ 		edac_pci_release_generic_ctl(amd64_ctl_pci);
+ 
+ 	pci_unregister_driver(&amd64_pci_driver);
++
++	msrs_free(msrs);
++	msrs = NULL;
+ }
+ 
+ module_init(amd64_edac_init);
+diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
+index c6f359a..bba6c94 100644
+--- a/drivers/edac/amd64_edac.h
++++ b/drivers/edac/amd64_edac.h
+@@ -147,6 +147,8 @@
+ #define MAX_CS_COUNT			8
+ #define DRAM_REG_COUNT			8
+ 
++#define ON true
++#define OFF false
+ 
+ /*
+  * PCI-defined configuration space registers
+@@ -386,10 +388,7 @@ enum {
+ #define K8_NBCAP_DUAL_NODE		BIT(1)
+ #define K8_NBCAP_DCT_DUAL		BIT(0)
+ 
+-/*
+- * MSR Regs
+- */
+-#define K8_MSR_MCGCTL			0x017b
++/* MSRs */
+ #define K8_MSR_MCGCTL_NBE		BIT(4)
+ 
+ #define K8_MSR_MC4CTL			0x0410
+@@ -487,7 +486,6 @@ struct amd64_pvt {
+ 	/* Save old hw registers' values before we modified them */
+ 	u32 nbctl_mcgctl_saved;		/* When true, following 2 are valid */
+ 	u32 old_nbctl;
+-	unsigned long old_mcgctl;	/* per core on this node */
+ 
+ 	/* MC Type Index value: socket F vs Family 10h */
+ 	u32 mc_type_index;
+@@ -495,6 +493,7 @@ struct amd64_pvt {
+ 	/* misc settings */
+ 	struct flags {
+ 		unsigned long cf8_extcfg:1;
++		unsigned long ecc_report:1;
+ 	} flags;
+ };
+ 
+diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
+index bbfd110..afed886 100644
+--- a/drivers/gpu/drm/drm_crtc_helper.c
++++ b/drivers/gpu/drm/drm_crtc_helper.c
+@@ -1020,6 +1020,9 @@ bool drm_helper_initial_config(struct drm_device *dev)
+ {
+ 	int count = 0;
+ 
++	/* disable all the possible outputs/crtcs before entering KMS mode */
++	drm_helper_disable_unused_functions(dev);
++
+ 	drm_fb_helper_parse_command_line(dev);
+ 
+ 	count = drm_helper_probe_connector_modes(dev,
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index c6777cb..19f93f2 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -249,13 +249,15 @@ void atombios_crtc_dpms(struct drm_crtc *crtc, int mode)
+ 		if (ASIC_IS_DCE3(rdev))
+ 			atombios_enable_crtc_memreq(crtc, 1);
+ 		atombios_blank_crtc(crtc, 0);
+-		drm_vblank_post_modeset(dev, radeon_crtc->crtc_id);
++		if (rdev->family < CHIP_R600)
++			drm_vblank_post_modeset(dev, radeon_crtc->crtc_id);
+ 		radeon_crtc_load_lut(crtc);
+ 		break;
+ 	case DRM_MODE_DPMS_STANDBY:
+ 	case DRM_MODE_DPMS_SUSPEND:
+ 	case DRM_MODE_DPMS_OFF:
+-		drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
++		if (rdev->family < CHIP_R600)
++			drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
+ 		atombios_blank_crtc(crtc, 1);
+ 		if (ASIC_IS_DCE3(rdev))
+ 			atombios_enable_crtc_memreq(crtc, 0);
+diff --git a/drivers/gpu/drm/radeon/radeon_test.c b/drivers/gpu/drm/radeon/radeon_test.c
+index f8a465d..c8942ca 100644
+--- a/drivers/gpu/drm/radeon/radeon_test.c
++++ b/drivers/gpu/drm/radeon/radeon_test.c
+@@ -42,8 +42,8 @@ void radeon_test_moves(struct radeon_device *rdev)
+ 	/* Number of tests =
+ 	 * (Total GTT - IB pool - writeback page - ring buffer) / test size
+ 	 */
+-	n = (rdev->mc.gtt_size - RADEON_IB_POOL_SIZE*64*1024 - RADEON_GPU_PAGE_SIZE -
+-	     rdev->cp.ring_size) / size;
++	n = ((u32)(rdev->mc.gtt_size - RADEON_IB_POOL_SIZE*64*1024 - RADEON_GPU_PAGE_SIZE -
++	     rdev->cp.ring_size)) / size;
+ 
+ 	gtt_obj = kzalloc(n * sizeof(*gtt_obj), GFP_KERNEL);
+ 	if (!gtt_obj) {
+diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
+index ebe38b6..864a371 100644
+--- a/drivers/hwmon/sht15.c
++++ b/drivers/hwmon/sht15.c
+@@ -305,7 +305,7 @@ static inline int sht15_calc_temp(struct sht15_data *data)
+ 	int d1 = 0;
+ 	int i;
+ 
+-	for (i = 1; i < ARRAY_SIZE(temppoints) - 1; i++)
++	for (i = 1; i < ARRAY_SIZE(temppoints); i++)
+ 		/* Find pointer to interpolate */
+ 		if (data->supply_uV > temppoints[i - 1].vdd) {
+ 			d1 = (data->supply_uV/1000 - temppoints[i - 1].vdd)
+@@ -332,12 +332,12 @@ static inline int sht15_calc_humid(struct sht15_data *data)
+ 
+ 	const int c1 = -4;
+ 	const int c2 = 40500; /* x 10 ^ -6 */
+-	const int c3 = 2800; /* x10 ^ -9 */
++	const int c3 = -2800; /* x10 ^ -9 */
+ 
+ 	RHlinear = c1*1000
+ 		+ c2 * data->val_humid/1000
+ 		+ (data->val_humid * data->val_humid * c3)/1000000;
+-	return (temp - 25000) * (10000 + 800 * data->val_humid)
++	return (temp - 25000) * (10000 + 80 * data->val_humid)
+ 		/ 1000000 + RHlinear;
+ }
+ 
+diff --git a/drivers/lguest/segments.c b/drivers/lguest/segments.c
+index 951c57b..ede4658 100644
+--- a/drivers/lguest/segments.c
++++ b/drivers/lguest/segments.c
+@@ -179,8 +179,10 @@ void load_guest_gdt_entry(struct lg_cpu *cpu, u32 num, u32 lo, u32 hi)
+ 	 * We assume the Guest has the same number of GDT entries as the
+ 	 * Host, otherwise we'd have to dynamically allocate the Guest GDT.
+ 	 */
+-	if (num >= ARRAY_SIZE(cpu->arch.gdt))
++	if (num >= ARRAY_SIZE(cpu->arch.gdt)) {
+ 		kill_guest(cpu, "too many gdt entries %i", num);
++		return;
++	}
+ 
+ 	/* Set it up, then fix it. */
+ 	cpu->arch.gdt[num].a = lo;
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 02e4551..c6a6685 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -282,7 +282,9 @@ static void mddev_put(mddev_t *mddev)
+ 	if (!atomic_dec_and_lock(&mddev->active, &all_mddevs_lock))
+ 		return;
+ 	if (!mddev->raid_disks && list_empty(&mddev->disks) &&
+-	    !mddev->hold_active) {
++	    mddev->ctime == 0 && !mddev->hold_active) {
++		/* Array is not configured at all, and not held active,
++		 * so destroy it */
+ 		list_del(&mddev->all_mddevs);
+ 		if (mddev->gendisk) {
+ 			/* we did a probe so need to clean up.
+@@ -5071,6 +5073,10 @@ static int set_array_info(mddev_t * mddev, mdu_array_info_t *info)
+ 		mddev->minor_version = info->minor_version;
+ 		mddev->patch_version = info->patch_version;
+ 		mddev->persistent = !info->not_persistent;
++		/* ensure mddev_put doesn't delete this now that there
++		 * is some minimal configuration.
++		 */
++		mddev->ctime         = get_seconds();
+ 		return 0;
+ 	}
+ 	mddev->major_version = MD_MAJOR_VERSION;
+diff --git a/drivers/media/video/ov511.c b/drivers/media/video/ov511.c
+index 0bc2cf5..2bed9e2 100644
+--- a/drivers/media/video/ov511.c
++++ b/drivers/media/video/ov511.c
+@@ -5878,7 +5878,7 @@ ov51x_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ 		goto error;
+ 	}
+ 
+-	mutex_lock(&ov->lock);
++	mutex_unlock(&ov->lock);
+ 
+ 	return 0;
+ 
+diff --git a/drivers/net/e100.c b/drivers/net/e100.c
+index d269a68..0c53c92 100644
+--- a/drivers/net/e100.c
++++ b/drivers/net/e100.c
+@@ -1817,6 +1817,7 @@ static int e100_alloc_cbs(struct nic *nic)
+ 				  &nic->cbs_dma_addr);
+ 	if (!nic->cbs)
+ 		return -ENOMEM;
++	memset(nic->cbs, 0, count * sizeof(struct cb));
+ 
+ 	for (cb = nic->cbs, i = 0; i < count; cb++, i++) {
+ 		cb->next = (i + 1 < count) ? cb + 1 : nic->cbs;
+@@ -1825,7 +1826,6 @@ static int e100_alloc_cbs(struct nic *nic)
+ 		cb->dma_addr = nic->cbs_dma_addr + i * sizeof(struct cb);
+ 		cb->link = cpu_to_le32(nic->cbs_dma_addr +
+ 			((i+1) % count) * sizeof(struct cb));
+-		cb->skb = NULL;
+ 	}
+ 
+ 	nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = nic->cbs;
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index b091e20..f14d225 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -324,7 +324,7 @@ static int rtl8150_set_mac_address(struct net_device *netdev, void *p)
+ 		dbg("%02X:", netdev->dev_addr[i]);
+ 	dbg("%02X\n", netdev->dev_addr[i]);
+ 	/* Set the IDR registers. */
+-	set_registers(dev, IDR, sizeof(netdev->dev_addr), netdev->dev_addr);
++	set_registers(dev, IDR, netdev->addr_len, netdev->dev_addr);
+ #ifdef EEPROM_WRITE
+ 	{
+ 	u8 cr;
+diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
+index 95a8e23..8a82c75 100644
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -2349,6 +2349,9 @@ ath5k_init(struct ath5k_softc *sc)
+ 	 */
+ 	ath5k_stop_locked(sc);
+ 
++	/* Set PHY calibration interval */
++	ah->ah_cal_intval = ath5k_calinterval;
++
+ 	/*
+ 	 * The basic interface to setting the hardware in a good
+ 	 * state is ``reset''.  On return the hardware is known to
+@@ -2376,10 +2379,6 @@ ath5k_init(struct ath5k_softc *sc)
+ 
+ 	/* Set ack to be sent at low bit-rates */
+ 	ath5k_hw_set_ack_bitrate_high(ah, false);
+-
+-	/* Set PHY calibration inteval */
+-	ah->ah_cal_intval = ath5k_calinterval;
+-
+ 	ret = 0;
+ done:
+ 	mmiowb();
+diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
+index 57f1463..ff4383b 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -408,7 +408,7 @@ struct ath9k_hw_version {
+  * Using de Bruijin sequence to to look up 1's index in a 32 bit number
+  * debruijn32 = 0000 0111 0111 1100 1011 0101 0011 0001
+  */
+-#define debruijn32 0x077CB531UL
++#define debruijn32 0x077CB531U
+ 
+ struct ath_gen_timer_configuration {
+ 	u32 next_addr;
+diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
+index d4d9d82..110c16d 100644
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -155,7 +155,7 @@ bool ath9k_hw_stoptxdma(struct ath_hw *ah, u32 q)
+ 		wait = wait_time;
+ 		while (ath9k_hw_numtxpending(ah, q)) {
+ 			if ((--wait) == 0) {
+-				DPRINTF(ah->ah_sc, ATH_DBG_QUEUE,
++				DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
+ 					"Failed to stop TX DMA in 100 "
+ 					"msec after killing last frame\n");
+ 				break;
+diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
+index ff65f85..9720c4d 100644
+--- a/drivers/net/wireless/ath/ath9k/mac.h
++++ b/drivers/net/wireless/ath/ath9k/mac.h
+@@ -77,6 +77,9 @@
+ #define ATH9K_TXERR_XTXOP          0x08
+ #define ATH9K_TXERR_TIMER_EXPIRED  0x10
+ #define ATH9K_TX_ACKED		   0x20
++#define ATH9K_TXERR_MASK						\
++	(ATH9K_TXERR_XRETRY | ATH9K_TXERR_FILT | ATH9K_TXERR_FIFO |	\
++	 ATH9K_TXERR_XTXOP | ATH9K_TXERR_TIMER_EXPIRED)
+ 
+ #define ATH9K_TX_BA                0x01
+ #define ATH9K_TX_PWRMGMT           0x02
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 59359e3..80df8f3 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -2147,6 +2147,9 @@ static void ath9k_stop(struct ieee80211_hw *hw)
+ 		return; /* another wiphy still in use */
+ 	}
+ 
++	/* Ensure HW is awake when we try to shut it down. */
++	ath9k_ps_wakeup(sc);
++
+ 	if (sc->sc_flags & SC_OP_BTCOEX_ENABLED) {
+ 		ath9k_hw_btcoex_disable(sc->sc_ah);
+ 		if (sc->btcoex_info.btcoex_scheme == ATH_BTCOEX_CFG_3WIRE)
+@@ -2167,6 +2170,9 @@ static void ath9k_stop(struct ieee80211_hw *hw)
+ 	/* disable HAL and put h/w to sleep */
+ 	ath9k_hw_disable(sc->sc_ah);
+ 	ath9k_hw_configpcipowersave(sc->sc_ah, 1, 1);
++	ath9k_ps_restore(sc);
++
++	/* Finally, put the chip in FULL SLEEP mode */
+ 	ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
+ 
+ 	sc->sc_flags |= SC_OP_INVALID;
+@@ -2277,8 +2283,10 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
+ 	if ((sc->sc_ah->opmode == NL80211_IFTYPE_AP) ||
+ 	    (sc->sc_ah->opmode == NL80211_IFTYPE_ADHOC) ||
+ 	    (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT)) {
++		ath9k_ps_wakeup(sc);
+ 		ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
+ 		ath_beacon_return(sc, avp);
++		ath9k_ps_restore(sc);
+ 	}
+ 
+ 	sc->sc_flags &= ~SC_OP_BEACONS;
+@@ -2724,15 +2732,21 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
+ 	case IEEE80211_AMPDU_RX_STOP:
+ 		break;
+ 	case IEEE80211_AMPDU_TX_START:
++		ath9k_ps_wakeup(sc);
+ 		ath_tx_aggr_start(sc, sta, tid, ssn);
+ 		ieee80211_start_tx_ba_cb_irqsafe(hw, sta->addr, tid);
++		ath9k_ps_restore(sc);
+ 		break;
+ 	case IEEE80211_AMPDU_TX_STOP:
++		ath9k_ps_wakeup(sc);
+ 		ath_tx_aggr_stop(sc, sta, tid);
+ 		ieee80211_stop_tx_ba_cb_irqsafe(hw, sta->addr, tid);
++		ath9k_ps_restore(sc);
+ 		break;
+ 	case IEEE80211_AMPDU_TX_OPERATIONAL:
++		ath9k_ps_wakeup(sc);
+ 		ath_tx_aggr_resume(sc, sta, tid);
++		ath9k_ps_restore(sc);
+ 		break;
+ 	default:
+ 		DPRINTF(sc, ATH_DBG_FATAL, "Unknown AMPDU action\n");
+diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
+index d83b77f..c0d7e65 100644
+--- a/drivers/net/wireless/ath/ath9k/reg.h
++++ b/drivers/net/wireless/ath/ath9k/reg.h
+@@ -969,10 +969,10 @@ enum {
+ #define AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_S         4
+ #define AR_GPIO_INPUT_EN_VAL_RFSILENT_DEF        0x00000080
+ #define AR_GPIO_INPUT_EN_VAL_RFSILENT_DEF_S      7
++#define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB      0x00000400
++#define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB_S    10
+ #define AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_BB        0x00001000
+ #define AR_GPIO_INPUT_EN_VAL_BT_ACTIVE_BB_S      12
+-#define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB      0x00001000
+-#define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_BB_S    1
+ #define AR_GPIO_INPUT_EN_VAL_RFSILENT_BB         0x00008000
+ #define AR_GPIO_INPUT_EN_VAL_RFSILENT_BB_S       15
+ #define AR_GPIO_RTC_RESET_OVERRIDE_ENABLE        0x00010000
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 4753909..2c6b063 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1076,10 +1076,10 @@ void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
+ 	if (npend) {
+ 		int r;
+ 
+-		DPRINTF(sc, ATH_DBG_XMIT, "Unable to stop TxDMA. Reset HAL!\n");
++		DPRINTF(sc, ATH_DBG_FATAL, "Unable to stop TxDMA. Reset HAL!\n");
+ 
+ 		spin_lock_bh(&sc->sc_resetlock);
+-		r = ath9k_hw_reset(ah, sc->sc_ah->curchan, true);
++		r = ath9k_hw_reset(ah, sc->sc_ah->curchan, false);
+ 		if (r)
+ 			DPRINTF(sc, ATH_DBG_FATAL,
+ 				"Unable to reset hardware; reset status %d\n",
+@@ -2020,7 +2020,7 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
+ 		if (bf_isaggr(bf))
+ 			txq->axq_aggr_depth--;
+ 
+-		txok = !(ds->ds_txstat.ts_status & ATH9K_TXERR_FILT);
++		txok = !(ds->ds_txstat.ts_status & ATH9K_TXERR_MASK);
+ 		txq->axq_tx_inprogress = false;
+ 		spin_unlock_bh(&txq->axq_lock);
+ 
+diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c
+index ffdce6f..78016ae 100644
+--- a/drivers/net/wireless/b43/rfkill.c
++++ b/drivers/net/wireless/b43/rfkill.c
+@@ -33,8 +33,14 @@ bool b43_is_hw_radio_enabled(struct b43_wldev *dev)
+ 		      & B43_MMIO_RADIO_HWENABLED_HI_MASK))
+ 			return 1;
+ 	} else {
+-		if (b43_status(dev) >= B43_STAT_STARTED &&
+-		    b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
++		/* To prevent CPU fault on PPC, do not read a register
++		 * unless the interface is started; however, on resume
++		 * for hibernation, this routine is entered early. When
++		 * that happens, unconditionally return TRUE.
++		 */
++		if (b43_status(dev) < B43_STAT_STARTED)
++			return 1;
++		if (b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
+ 		    & B43_MMIO_RADIO_HWENABLED_LO_MASK)
+ 			return 1;
+ 	}
+diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
+index f059b49..9d60f6c 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
++++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
+@@ -2895,6 +2895,7 @@ static struct iwl_cfg iwl3945_bg_cfg = {
+ 	.mod_params = &iwl3945_mod_params,
+ 	.use_isr_legacy = true,
+ 	.ht_greenfield_support = false,
++	.broken_powersave = true,
+ };
+ 
+ static struct iwl_cfg iwl3945_abg_cfg = {
+@@ -2909,6 +2910,7 @@ static struct iwl_cfg iwl3945_abg_cfg = {
+ 	.mod_params = &iwl3945_mod_params,
+ 	.use_isr_legacy = true,
+ 	.ht_greenfield_support = false,
++	.broken_powersave = true,
+ };
+ 
+ struct pci_device_id iwl3945_hw_card_ids[] = {
+diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
+index 6f703a0..f4e2e84 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
+@@ -1337,7 +1337,7 @@ static int iwl4965_fill_txpower_tbl(struct iwl_priv *priv, u8 band, u16 channel,
+ 	iwl4965_interpolate_chan(priv, channel, &ch_eeprom_info);
+ 
+ 	/* calculate tx gain adjustment based on power supply voltage */
+-	voltage = priv->calib_info->voltage;
++	voltage = le16_to_cpu(priv->calib_info->voltage);
+ 	init_voltage = (s32)le32_to_cpu(priv->card_alive_init.voltage);
+ 	voltage_compensation =
+ 	    iwl4965_get_voltage_compensation(voltage, init_voltage);
+diff --git a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
+index 4ef6804..bc056e9 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
++++ b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h
+@@ -92,11 +92,15 @@
+ 
+ static inline s32 iwl_temp_calib_to_offset(struct iwl_priv *priv)
+ {
+-	u16 *temp_calib = (u16 *)iwl_eeprom_query_addr(priv,
+-						       EEPROM_5000_TEMPERATURE);
+-	/* offset =  temperature -  voltage / coef */
+-	s32 offset = (s32)(temp_calib[0] - temp_calib[1] / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
+-	return offset;
++	u16 temperature, voltage;
++	__le16 *temp_calib =
++		(__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_TEMPERATURE);
++
++	temperature = le16_to_cpu(temp_calib[0]);
++	voltage = le16_to_cpu(temp_calib[1]);
++
++	/* offset = temp - volt / coeff */
++	return (s32)(temperature - voltage / IWL_5150_VOLTAGE_TO_TEMPERATURE_COEFF);
+ }
+ 
+ /* Fixed (non-configurable) rx data from phy */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
+index 6e6f516..94a1225 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -460,14 +460,15 @@ static void iwl5000_set_ct_threshold(struct iwl_priv *priv)
+ static int iwl5000_set_Xtal_calib(struct iwl_priv *priv)
+ {
+ 	struct iwl_calib_xtal_freq_cmd cmd;
+-	u16 *xtal_calib = (u16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL);
++	__le16 *xtal_calib =
++		(__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL);
+ 
+ 	cmd.hdr.op_code = IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD;
+ 	cmd.hdr.first_group = 0;
+ 	cmd.hdr.groups_num = 1;
+ 	cmd.hdr.data_valid = 1;
+-	cmd.cap_pin1 = (u8)xtal_calib[0];
+-	cmd.cap_pin2 = (u8)xtal_calib[1];
++	cmd.cap_pin1 = le16_to_cpu(xtal_calib[0]);
++	cmd.cap_pin2 = le16_to_cpu(xtal_calib[1]);
+ 	return iwl_calib_set(&priv->calib_results[IWL_CALIB_XTAL],
+ 			     (u8 *)&cmd, sizeof(cmd));
+ }
+diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
+index 028d505..c2d9b7a 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
++++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
+@@ -1149,7 +1149,7 @@ struct iwl_priv {
+ 	u32 last_beacon_time;
+ 	u64 last_tsf;
+ 
+-	/* eeprom */
++	/* eeprom -- this is in the card's little endian byte order */
+ 	u8 *eeprom;
+ 	int    nvm_device_type;
+ 	struct iwl_eeprom_calib_info *calib_info;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+index e14c995..18dc3a4 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
++++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+@@ -337,7 +337,7 @@ static int iwl_init_otp_access(struct iwl_priv *priv)
+ 	return ret;
+ }
+ 
+-static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
++static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, __le16 *eeprom_data)
+ {
+ 	int ret = 0;
+ 	u32 r;
+@@ -370,7 +370,7 @@ static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
+ 				CSR_OTP_GP_REG_ECC_CORR_STATUS_MSK);
+ 		IWL_ERR(priv, "Correctable OTP ECC error, continue read\n");
+ 	}
+-	*eeprom_data = le16_to_cpu((__force __le16)(r >> 16));
++	*eeprom_data = cpu_to_le16(r >> 16);
+ 	return 0;
+ }
+ 
+@@ -379,7 +379,8 @@ static int iwl_read_otp_word(struct iwl_priv *priv, u16 addr, u16 *eeprom_data)
+  */
+ static bool iwl_is_otp_empty(struct iwl_priv *priv)
+ {
+-	u16 next_link_addr = 0, link_value;
++	u16 next_link_addr = 0;
++	__le16 link_value;
+ 	bool is_empty = false;
+ 
+ 	/* locate the beginning of OTP link list */
+@@ -409,7 +410,8 @@ static bool iwl_is_otp_empty(struct iwl_priv *priv)
+ static int iwl_find_otp_image(struct iwl_priv *priv,
+ 					u16 *validblockaddr)
+ {
+-	u16 next_link_addr = 0, link_value = 0, valid_addr;
++	u16 next_link_addr = 0, valid_addr;
++	__le16 link_value = 0;
+ 	int usedblocks = 0;
+ 
+ 	/* set addressing mode to absolute to traverse the link list */
+@@ -429,7 +431,7 @@ static int iwl_find_otp_image(struct iwl_priv *priv,
+ 		 * check for more block on the link list
+ 		 */
+ 		valid_addr = next_link_addr;
+-		next_link_addr = link_value * sizeof(u16);
++		next_link_addr = le16_to_cpu(link_value) * sizeof(u16);
+ 		IWL_DEBUG_INFO(priv, "OTP blocks %d addr 0x%x\n",
+ 			       usedblocks, next_link_addr);
+ 		if (iwl_read_otp_word(priv, next_link_addr, &link_value))
+@@ -463,7 +465,7 @@ static int iwl_find_otp_image(struct iwl_priv *priv,
+  */
+ int iwl_eeprom_init(struct iwl_priv *priv)
+ {
+-	u16 *e;
++	__le16 *e;
+ 	u32 gp = iwl_read32(priv, CSR_EEPROM_GP);
+ 	int sz;
+ 	int ret;
+@@ -482,7 +484,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
+ 		ret = -ENOMEM;
+ 		goto alloc_err;
+ 	}
+-	e = (u16 *)priv->eeprom;
++	e = (__le16 *)priv->eeprom;
+ 
+ 	ret = priv->cfg->ops->lib->eeprom_ops.verify_signature(priv);
+ 	if (ret < 0) {
+@@ -521,7 +523,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
+ 		}
+ 		for (addr = validblockaddr; addr < validblockaddr + sz;
+ 		     addr += sizeof(u16)) {
+-			u16 eeprom_data;
++			__le16 eeprom_data;
+ 
+ 			ret = iwl_read_otp_word(priv, addr, &eeprom_data);
+ 			if (ret)
+@@ -545,7 +547,7 @@ int iwl_eeprom_init(struct iwl_priv *priv)
+ 				goto done;
+ 			}
+ 			r = _iwl_read_direct32(priv, CSR_EEPROM_REG);
+-			e[addr / 2] = le16_to_cpu((__force __le16)(r >> 16));
++			e[addr / 2] = cpu_to_le16(r >> 16);
+ 		}
+ 	}
+ 	ret = 0;
+@@ -709,7 +711,8 @@ static int iwl_mod_ht40_chan_info(struct iwl_priv *priv,
+ 	ch_info->ht40_min_power = 0;
+ 	ch_info->ht40_scan_power = eeprom_ch->max_power_avg;
+ 	ch_info->ht40_flags = eeprom_ch->flags;
+-	ch_info->ht40_extension_channel &= ~clear_ht40_extension_channel;
++	if (eeprom_ch->flags & EEPROM_CHANNEL_VALID)
++		ch_info->ht40_extension_channel &= ~clear_ht40_extension_channel;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+index 80b9e45..fc93f12 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
++++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+@@ -133,7 +133,7 @@ struct iwl_eeprom_channel {
+  *
+  */
+ struct iwl_eeprom_enhanced_txpwr {
+-	u16 reserved;
++	__le16 common;
+ 	s8 chain_a_max;
+ 	s8 chain_b_max;
+ 	s8 chain_c_max;
+@@ -347,7 +347,7 @@ struct iwl_eeprom_calib_subband_info {
+ struct iwl_eeprom_calib_info {
+ 	u8 saturation_power24;	/* half-dBm (e.g. "34" = 17 dBm) */
+ 	u8 saturation_power52;	/* half-dBm */
+-	s16 voltage;		/* signed */
++	__le16 voltage;		/* signed */
+ 	struct iwl_eeprom_calib_subband_info
+ 		band_info[EEPROM_TX_POWER_BANDS];
+ } __attribute__ ((packed));
+diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+index d00a803..5f26c93 100644
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -562,6 +562,9 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
+ 	txq = &priv->txq[txq_id];
+ 	q = &txq->q;
+ 
++	if ((iwl_queue_space(q) < q->high_mark))
++		goto drop;
++
+ 	spin_lock_irqsave(&priv->lock, flags);
+ 
+ 	idx = get_cmd_index(q, q->write_ptr, 0);
+@@ -3854,9 +3857,11 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
+ 	/* Tell mac80211 our characteristics */
+ 	hw->flags = IEEE80211_HW_SIGNAL_DBM |
+ 		    IEEE80211_HW_NOISE_DBM |
+-		    IEEE80211_HW_SPECTRUM_MGMT |
+-		    IEEE80211_HW_SUPPORTS_PS |
+-		    IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
++		    IEEE80211_HW_SPECTRUM_MGMT;
++
++	if (!priv->cfg->broken_powersave)
++		hw->flags |= IEEE80211_HW_SUPPORTS_PS |
++			     IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
+ 
+ 	hw->wiphy->interface_modes =
+ 		BIT(NL80211_IFTYPE_STATION) |
+diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h
+index 1b02a4e..93c8989 100644
+--- a/drivers/net/wireless/iwmc3200wifi/iwm.h
++++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
+@@ -258,7 +258,7 @@ struct iwm_priv {
+ 
+ 	struct sk_buff_head rx_list;
+ 	struct list_head rx_tickets;
+-	struct list_head rx_packets[IWM_RX_ID_HASH];
++	struct list_head rx_packets[IWM_RX_ID_HASH + 1];
+ 	struct workqueue_struct *rx_wq;
+ 	struct work_struct rx_worker;
+ 
+diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
+index be837a0..01c738b 100644
+--- a/drivers/net/wireless/libertas/wext.c
++++ b/drivers/net/wireless/libertas/wext.c
+@@ -1953,10 +1953,8 @@ static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
+ 	if (priv->connect_status == LBS_CONNECTED) {
+ 		memcpy(extra, priv->curbssparams.ssid,
+ 		       priv->curbssparams.ssid_len);
+-		extra[priv->curbssparams.ssid_len] = '\0';
+ 	} else {
+ 		memset(extra, 0, 32);
+-		extra[priv->curbssparams.ssid_len] = '\0';
+ 	}
+ 	/*
+ 	 * If none, we may want to get the one that was set
+diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
+index 7698fdd..31ca241 100644
+--- a/drivers/net/wireless/orinoco/wext.c
++++ b/drivers/net/wireless/orinoco/wext.c
+@@ -23,7 +23,7 @@
+ #define MAX_RID_LEN 1024
+ 
+ /* Helper routine to record keys
+- * Do not call from interrupt context */
++ * It is called under orinoco_lock so it may not sleep */
+ static int orinoco_set_key(struct orinoco_private *priv, int index,
+ 			   enum orinoco_alg alg, const u8 *key, int key_len,
+ 			   const u8 *seq, int seq_len)
+@@ -32,14 +32,14 @@ static int orinoco_set_key(struct orinoco_private *priv, int index,
+ 	kzfree(priv->keys[index].seq);
+ 
+ 	if (key_len) {
+-		priv->keys[index].key = kzalloc(key_len, GFP_KERNEL);
++		priv->keys[index].key = kzalloc(key_len, GFP_ATOMIC);
+ 		if (!priv->keys[index].key)
+ 			goto nomem;
+ 	} else
+ 		priv->keys[index].key = NULL;
+ 
+ 	if (seq_len) {
+-		priv->keys[index].seq = kzalloc(seq_len, GFP_KERNEL);
++		priv->keys[index].seq = kzalloc(seq_len, GFP_ATOMIC);
+ 		if (!priv->keys[index].seq)
+ 			goto free_key;
+ 	} else
+diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
+index b20e3ea..9a6ceb4 100644
+--- a/drivers/net/wireless/rt2x00/rt61pci.c
++++ b/drivers/net/wireless/rt2x00/rt61pci.c
+@@ -2538,6 +2538,11 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
+ 	unsigned int i;
+ 
+ 	/*
++	 * Disable powersaving as default.
++	 */
++	rt2x00dev->hw->wiphy->ps_default = false;
++
++	/*
+ 	 * Initialize all hw fields.
+ 	 */
+ 	rt2x00dev->hw->flags =
+diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c
+index d8b4229..4d922e4 100644
+--- a/drivers/platform/x86/acerhdf.c
++++ b/drivers/platform/x86/acerhdf.c
+@@ -640,9 +640,10 @@ static void __exit acerhdf_exit(void)
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Peter Feuerer");
+ MODULE_DESCRIPTION("Aspire One temperature and fan driver");
+-MODULE_ALIAS("dmi:*:*Acer*:*:");
+-MODULE_ALIAS("dmi:*:*Gateway*:*:");
+-MODULE_ALIAS("dmi:*:*Packard Bell*:*:");
++MODULE_ALIAS("dmi:*:*Acer*:pnAOA*:");
++MODULE_ALIAS("dmi:*:*Gateway*:pnAOA*:");
++MODULE_ALIAS("dmi:*:*Packard Bell*:pnAOA*:");
++MODULE_ALIAS("dmi:*:*Packard Bell*:pnDOA*:");
+ 
+ module_init(acerhdf_init);
+ module_exit(acerhdf_exit);
+diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
+index 4e49b4a..8174ec9 100644
+--- a/drivers/s390/block/dasd_diag.c
++++ b/drivers/s390/block/dasd_diag.c
+@@ -145,6 +145,15 @@ dasd_diag_erp(struct dasd_device *device)
+ 
+ 	mdsk_term_io(device);
+ 	rc = mdsk_init_io(device, device->block->bp_block, 0, NULL);
++	if (rc == 4) {
++		if (!(device->features & DASD_FEATURE_READONLY)) {
++			dev_warn(&device->cdev->dev,
++				 "The access mode of a DIAG device changed"
++				 " to read-only");
++			device->features |= DASD_FEATURE_READONLY;
++		}
++		rc = 0;
++	}
+ 	if (rc)
+ 		dev_warn(&device->cdev->dev, "DIAG ERP failed with "
+ 			    "rc=%d\n", rc);
+@@ -433,16 +442,20 @@ dasd_diag_check_device(struct dasd_device *device)
+ 	for (sb = 512; sb < bsize; sb = sb << 1)
+ 		block->s2b_shift++;
+ 	rc = mdsk_init_io(device, block->bp_block, 0, NULL);
+-	if (rc) {
++	if (rc && (rc != 4)) {
+ 		dev_warn(&device->cdev->dev, "DIAG initialization "
+ 			"failed with rc=%d\n", rc);
+ 		rc = -EIO;
+ 	} else {
++		if (rc == 4)
++			device->features |= DASD_FEATURE_READONLY;
+ 		dev_info(&device->cdev->dev,
+-			 "New DASD with %ld byte/block, total size %ld KB\n",
++			 "New DASD with %ld byte/block, total size %ld KB%s\n",
+ 			 (unsigned long) block->bp_block,
+ 			 (unsigned long) (block->blocks <<
+-					  block->s2b_shift) >> 1);
++					  block->s2b_shift) >> 1,
++			 (rc == 4) ? ", read-only device" : "");
++		rc = 0;
+ 	}
+ out_label:
+ 	free_page((long) label);
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index 76d294f..c3ff9a6 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -6516,6 +6516,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd)
+ 	int rc;
+ 
+ 	ENTER;
++	ioa_cfg->pdev->state_saved = true;
+ 	rc = pci_restore_state(ioa_cfg->pdev);
+ 
+ 	if (rc != PCIBIOS_SUCCESSFUL) {
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index b79fca7..06bbe0d 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -2016,13 +2016,13 @@ skip_dpc:
+ 	DEBUG2(printk("DEBUG: detect hba %ld at address = %p\n",
+ 	    base_vha->host_no, ha));
+ 
+-	base_vha->flags.init_done = 1;
+-	base_vha->flags.online = 1;
+-
+ 	ret = scsi_add_host(host, &pdev->dev);
+ 	if (ret)
+ 		goto probe_failed;
+ 
++	base_vha->flags.init_done = 1;
++	base_vha->flags.online = 1;
++
+ 	ha->isp_ops->enable_intrs(ha);
+ 
+ 	scsi_scan_host(host);
+diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
+index c6f70da..45be82f 100644
+--- a/drivers/scsi/scsi_transport_fc.c
++++ b/drivers/scsi/scsi_transport_fc.c
+@@ -648,11 +648,22 @@ static __init int fc_transport_init(void)
+ 		return error;
+ 	error = transport_class_register(&fc_vport_class);
+ 	if (error)
+-		return error;
++		goto unreg_host_class;
+ 	error = transport_class_register(&fc_rport_class);
+ 	if (error)
+-		return error;
+-	return transport_class_register(&fc_transport_class);
++		goto unreg_vport_class;
++	error = transport_class_register(&fc_transport_class);
++	if (error)
++		goto unreg_rport_class;
++	return 0;
++
++unreg_rport_class:
++	transport_class_unregister(&fc_rport_class);
++unreg_vport_class:
++	transport_class_unregister(&fc_vport_class);
++unreg_host_class:
++	transport_class_unregister(&fc_host_class);
++	return error;
+ }
+ 
+ static void __exit fc_transport_exit(void)
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index 12d58a7..5081f97 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -552,13 +552,15 @@ st_do_scsi(struct st_request * SRpnt, struct scsi_tape * STp, unsigned char *cmd
+ 	SRpnt->waiting = waiting;
+ 
+ 	if (STp->buffer->do_dio) {
++		mdata->page_order = 0;
+ 		mdata->nr_entries = STp->buffer->sg_segs;
+ 		mdata->pages = STp->buffer->mapped_pages;
+ 	} else {
++		mdata->page_order = STp->buffer->reserved_page_order;
+ 		mdata->nr_entries =
+ 			DIV_ROUND_UP(bytes, PAGE_SIZE << mdata->page_order);
+-		STp->buffer->map_data.pages = STp->buffer->reserved_pages;
+-		STp->buffer->map_data.offset = 0;
++		mdata->pages = STp->buffer->reserved_pages;
++		mdata->offset = 0;
+ 	}
+ 
+ 	memcpy(SRpnt->cmd, cmd, sizeof(SRpnt->cmd));
+@@ -3718,7 +3720,7 @@ static int enlarge_buffer(struct st_buffer * STbuffer, int new_size, int need_dm
+ 		priority |= __GFP_ZERO;
+ 
+ 	if (STbuffer->frp_segs) {
+-		order = STbuffer->map_data.page_order;
++		order = STbuffer->reserved_page_order;
+ 		b_size = PAGE_SIZE << order;
+ 	} else {
+ 		for (b_size = PAGE_SIZE, order = 0;
+@@ -3751,7 +3753,7 @@ static int enlarge_buffer(struct st_buffer * STbuffer, int new_size, int need_dm
+ 		segs++;
+ 	}
+ 	STbuffer->b_data = page_address(STbuffer->reserved_pages[0]);
+-	STbuffer->map_data.page_order = order;
++	STbuffer->reserved_page_order = order;
+ 
+ 	return 1;
+ }
+@@ -3764,7 +3766,7 @@ static void clear_buffer(struct st_buffer * st_bp)
+ 
+ 	for (i=0; i < st_bp->frp_segs; i++)
+ 		memset(page_address(st_bp->reserved_pages[i]), 0,
+-		       PAGE_SIZE << st_bp->map_data.page_order);
++		       PAGE_SIZE << st_bp->reserved_page_order);
+ 	st_bp->cleared = 1;
+ }
+ 
+@@ -3772,7 +3774,7 @@ static void clear_buffer(struct st_buffer * st_bp)
+ /* Release the extra buffer */
+ static void normalize_buffer(struct st_buffer * STbuffer)
+ {
+-	int i, order = STbuffer->map_data.page_order;
++	int i, order = STbuffer->reserved_page_order;
+ 
+ 	for (i = 0; i < STbuffer->frp_segs; i++) {
+ 		__free_pages(STbuffer->reserved_pages[i], order);
+@@ -3780,7 +3782,7 @@ static void normalize_buffer(struct st_buffer * STbuffer)
+ 	}
+ 	STbuffer->frp_segs = 0;
+ 	STbuffer->sg_segs = 0;
+-	STbuffer->map_data.page_order = 0;
++	STbuffer->reserved_page_order = 0;
+ 	STbuffer->map_data.offset = 0;
+ }
+ 
+@@ -3790,7 +3792,7 @@ static void normalize_buffer(struct st_buffer * STbuffer)
+ static int append_to_buffer(const char __user *ubp, struct st_buffer * st_bp, int do_count)
+ {
+ 	int i, cnt, res, offset;
+-	int length = PAGE_SIZE << st_bp->map_data.page_order;
++	int length = PAGE_SIZE << st_bp->reserved_page_order;
+ 
+ 	for (i = 0, offset = st_bp->buffer_bytes;
+ 	     i < st_bp->frp_segs && offset >= length; i++)
+@@ -3822,7 +3824,7 @@ static int append_to_buffer(const char __user *ubp, struct st_buffer * st_bp, in
+ static int from_buffer(struct st_buffer * st_bp, char __user *ubp, int do_count)
+ {
+ 	int i, cnt, res, offset;
+-	int length = PAGE_SIZE << st_bp->map_data.page_order;
++	int length = PAGE_SIZE << st_bp->reserved_page_order;
+ 
+ 	for (i = 0, offset = st_bp->read_pointer;
+ 	     i < st_bp->frp_segs && offset >= length; i++)
+@@ -3855,7 +3857,7 @@ static void move_buffer_data(struct st_buffer * st_bp, int offset)
+ {
+ 	int src_seg, dst_seg, src_offset = 0, dst_offset;
+ 	int count, total;
+-	int length = PAGE_SIZE << st_bp->map_data.page_order;
++	int length = PAGE_SIZE << st_bp->reserved_page_order;
+ 
+ 	if (offset == 0)
+ 		return;
+@@ -4577,7 +4579,6 @@ static int sgl_map_user_pages(struct st_buffer *STbp,
+         }
+ 
+ 	mdata->offset = uaddr & ~PAGE_MASK;
+-	mdata->page_order = 0;
+ 	STbp->mapped_pages = pages;
+ 
+ 	return nr_pages;
+diff --git a/drivers/scsi/st.h b/drivers/scsi/st.h
+index 544dc6b..f91a67c 100644
+--- a/drivers/scsi/st.h
++++ b/drivers/scsi/st.h
+@@ -46,6 +46,7 @@ struct st_buffer {
+ 	struct st_request *last_SRpnt;
+ 	struct st_cmdstatus cmdstat;
+ 	struct page **reserved_pages;
++	int reserved_page_order;
+ 	struct page **mapped_pages;
+ 	struct rq_map_data map_data;
+ 	unsigned char *b_data;
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 0f857e6..8b0c235 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1612,12 +1612,12 @@ static inline void announce_device(struct usb_device *udev) { }
+ #endif
+ 
+ /**
+- * usb_configure_device_otg - FIXME (usbcore-internal)
++ * usb_enumerate_device_otg - FIXME (usbcore-internal)
+  * @udev: newly addressed device (in ADDRESS state)
+  *
+- * Do configuration for On-The-Go devices
++ * Finish enumeration for On-The-Go devices
+  */
+-static int usb_configure_device_otg(struct usb_device *udev)
++static int usb_enumerate_device_otg(struct usb_device *udev)
+ {
+ 	int err = 0;
+ 
+@@ -1688,7 +1688,7 @@ fail:
+ 
+ 
+ /**
+- * usb_configure_device - Detect and probe device intfs/otg (usbcore-internal)
++ * usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal)
+  * @udev: newly addressed device (in ADDRESS state)
+  *
+  * This is only called by usb_new_device() and usb_authorize_device()
+@@ -1699,7 +1699,7 @@ fail:
+  * the string descriptors, as they will be errored out by the device
+  * until it has been authorized.
+  */
+-static int usb_configure_device(struct usb_device *udev)
++static int usb_enumerate_device(struct usb_device *udev)
+ {
+ 	int err;
+ 
+@@ -1723,7 +1723,7 @@ static int usb_configure_device(struct usb_device *udev)
+ 						      udev->descriptor.iManufacturer);
+ 		udev->serial = usb_cache_string(udev, udev->descriptor.iSerialNumber);
+ 	}
+-	err = usb_configure_device_otg(udev);
++	err = usb_enumerate_device_otg(udev);
+ fail:
+ 	return err;
+ }
+@@ -1733,8 +1733,8 @@ fail:
+  * usb_new_device - perform initial device setup (usbcore-internal)
+  * @udev: newly addressed device (in ADDRESS state)
+  *
+- * This is called with devices which have been enumerated, but not yet
+- * configured.  The device descriptor is available, but not descriptors
++ * This is called with devices which have been detected but not fully
++ * enumerated.  The device descriptor is available, but not descriptors
+  * for any device configuration.  The caller must have locked either
+  * the parent hub (if udev is a normal device) or else the
+  * usb_bus_list_lock (if udev is a root hub).  The parent's pointer to
+@@ -1757,8 +1757,8 @@ int usb_new_device(struct usb_device *udev)
+ 	if (udev->parent)
+ 		usb_autoresume_device(udev->parent);
+ 
+-	usb_detect_quirks(udev);		/* Determine quirks */
+-	err = usb_configure_device(udev);	/* detect & probe dev/intfs */
++	usb_detect_quirks(udev);
++	err = usb_enumerate_device(udev);	/* Read descriptors */
+ 	if (err < 0)
+ 		goto fail;
+ 	dev_dbg(&udev->dev, "udev %d, busnum %d, minor = %d\n",
+@@ -1803,21 +1803,23 @@ fail:
+  */
+ int usb_deauthorize_device(struct usb_device *usb_dev)
+ {
+-	unsigned cnt;
+ 	usb_lock_device(usb_dev);
+ 	if (usb_dev->authorized == 0)
+ 		goto out_unauthorized;
++
+ 	usb_dev->authorized = 0;
+ 	usb_set_configuration(usb_dev, -1);
++
++	kfree(usb_dev->product);
+ 	usb_dev->product = kstrdup("n/a (unauthorized)", GFP_KERNEL);
++	kfree(usb_dev->manufacturer);
+ 	usb_dev->manufacturer = kstrdup("n/a (unauthorized)", GFP_KERNEL);
++	kfree(usb_dev->serial);
+ 	usb_dev->serial = kstrdup("n/a (unauthorized)", GFP_KERNEL);
+-	kfree(usb_dev->config);
+-	usb_dev->config = NULL;
+-	for (cnt = 0; cnt < usb_dev->descriptor.bNumConfigurations; cnt++)
+-		kfree(usb_dev->rawdescriptors[cnt]);
++
++	usb_destroy_configuration(usb_dev);
+ 	usb_dev->descriptor.bNumConfigurations = 0;
+-	kfree(usb_dev->rawdescriptors);
++
+ out_unauthorized:
+ 	usb_unlock_device(usb_dev);
+ 	return 0;
+@@ -1827,15 +1829,11 @@ out_unauthorized:
+ int usb_authorize_device(struct usb_device *usb_dev)
+ {
+ 	int result = 0, c;
++
+ 	usb_lock_device(usb_dev);
+ 	if (usb_dev->authorized == 1)
+ 		goto out_authorized;
+-	kfree(usb_dev->product);
+-	usb_dev->product = NULL;
+-	kfree(usb_dev->manufacturer);
+-	usb_dev->manufacturer = NULL;
+-	kfree(usb_dev->serial);
+-	usb_dev->serial = NULL;
++
+ 	result = usb_autoresume_device(usb_dev);
+ 	if (result < 0) {
+ 		dev_err(&usb_dev->dev,
+@@ -1848,10 +1846,18 @@ int usb_authorize_device(struct usb_device *usb_dev)
+ 			"authorization: %d\n", result);
+ 		goto error_device_descriptor;
+ 	}
++
++	kfree(usb_dev->product);
++	usb_dev->product = NULL;
++	kfree(usb_dev->manufacturer);
++	usb_dev->manufacturer = NULL;
++	kfree(usb_dev->serial);
++	usb_dev->serial = NULL;
++
+ 	usb_dev->authorized = 1;
+-	result = usb_configure_device(usb_dev);
++	result = usb_enumerate_device(usb_dev);
+ 	if (result < 0)
+-		goto error_configure;
++		goto error_enumerate;
+ 	/* Choose and set the configuration.  This registers the interfaces
+ 	 * with the driver core and lets interface drivers bind to them.
+ 	 */
+@@ -1866,8 +1872,10 @@ int usb_authorize_device(struct usb_device *usb_dev)
+ 		}
+ 	}
+ 	dev_info(&usb_dev->dev, "authorized to connect\n");
+-error_configure:
++
++error_enumerate:
+ error_device_descriptor:
++	usb_autosuspend_device(usb_dev);
+ error_autoresume:
+ out_authorized:
+ 	usb_unlock_device(usb_dev);	// complements locktree
+diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
+index 7ec3041..8752e55 100644
+--- a/drivers/usb/core/sysfs.c
++++ b/drivers/usb/core/sysfs.c
+@@ -82,9 +82,13 @@ static ssize_t  show_##name(struct device *dev,				\
+ 		struct device_attribute *attr, char *buf)		\
+ {									\
+ 	struct usb_device *udev;					\
++	int retval;							\
+ 									\
+ 	udev = to_usb_device(dev);					\
+-	return sprintf(buf, "%s\n", udev->name);			\
++	usb_lock_device(udev);						\
++	retval = sprintf(buf, "%s\n", udev->name);			\
++	usb_unlock_device(udev);					\
++	return retval;							\
+ }									\
+ static DEVICE_ATTR(name, S_IRUGO, show_##name, NULL);
+ 
+diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
+index 1d8e39a..62ff5e7 100644
+--- a/drivers/usb/misc/appledisplay.c
++++ b/drivers/usb/misc/appledisplay.c
+@@ -72,8 +72,8 @@ struct appledisplay {
+ 	struct usb_device *udev;	/* usb device */
+ 	struct urb *urb;		/* usb request block */
+ 	struct backlight_device *bd;	/* backlight device */
+-	char *urbdata;			/* interrupt URB data buffer */
+-	char *msgdata;			/* control message data buffer */
++	u8 *urbdata;			/* interrupt URB data buffer */
++	u8 *msgdata;			/* control message data buffer */
+ 
+ 	struct delayed_work work;
+ 	int button_pressed;
+diff --git a/drivers/usb/misc/emi62.c b/drivers/usb/misc/emi62.c
+index 602ee05..59860b3 100644
+--- a/drivers/usb/misc/emi62.c
++++ b/drivers/usb/misc/emi62.c
+@@ -167,7 +167,7 @@ static int emi62_load_firmware (struct usb_device *dev)
+ 			err("%s - error loading firmware: error = %d", __func__, err);
+ 			goto wraperr;
+ 		}
+-	} while (i > 0);
++	} while (rec);
+ 
+ 	/* Assert reset (stop the CPU in the EMI) */
+ 	err = emi62_set_reset(dev,1);
+diff --git a/drivers/usb/musb/musb_gadget_ep0.c b/drivers/usb/musb/musb_gadget_ep0.c
+index 1c44b97..067e5a9 100644
+--- a/drivers/usb/musb/musb_gadget_ep0.c
++++ b/drivers/usb/musb/musb_gadget_ep0.c
+@@ -647,7 +647,7 @@ irqreturn_t musb_g_ep0_irq(struct musb *musb)
+ 			musb->ep0_state = MUSB_EP0_STAGE_STATUSIN;
+ 			break;
+ 		default:
+-			ERR("SetupEnd came in a wrong ep0stage %s",
++			ERR("SetupEnd came in a wrong ep0stage %s\n",
+ 			    decode_ep0stage(musb->ep0_state));
+ 		}
+ 		csr = musb_readw(regs, MUSB_CSR0);
+@@ -770,12 +770,18 @@ setup:
+ 				handled = service_zero_data_request(
+ 						musb, &setup);
+ 
++				/*
++				 * We're expecting no data in any case, so
++				 * always set the DATAEND bit -- doing this
++				 * here helps avoid SetupEnd interrupt coming
++				 * in the idle stage when we're stalling...
++				 */
++				musb->ackpend |= MUSB_CSR0_P_DATAEND;
++
+ 				/* status stage might be immediate */
+-				if (handled > 0) {
+-					musb->ackpend |= MUSB_CSR0_P_DATAEND;
++				if (handled > 0)
+ 					musb->ep0_state =
+ 						MUSB_EP0_STAGE_STATUSIN;
+-				}
+ 				break;
+ 
+ 			/* sequence #1 (IN to host), includes GET_STATUS
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index dffc8a1..be3dff1 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -340,6 +340,10 @@ static int  option_resume(struct usb_serial *serial);
+ #define FOUR_G_SYSTEMS_VENDOR_ID		0x1c9e
+ #define FOUR_G_SYSTEMS_PRODUCT_W14		0x9603
+ 
++/* Haier products */
++#define HAIER_VENDOR_ID				0x201e
++#define HAIER_PRODUCT_CE100			0x2009
++
+ static struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+ 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
+@@ -641,6 +645,7 @@ static struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+ 	{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+ 	{ USB_DEVICE(FOUR_G_SYSTEMS_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14) },
++	{ USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+ 	{ } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
+index 3800da7..649fcdf 100644
+--- a/drivers/xen/xenbus/xenbus_probe.c
++++ b/drivers/xen/xenbus/xenbus_probe.c
+@@ -843,7 +843,7 @@ postcore_initcall(xenbus_probe_init);
+ 
+ MODULE_LICENSE("GPL");
+ 
+-static int is_disconnected_device(struct device *dev, void *data)
++static int is_device_connecting(struct device *dev, void *data)
+ {
+ 	struct xenbus_device *xendev = to_xenbus_device(dev);
+ 	struct device_driver *drv = data;
+@@ -861,14 +861,15 @@ static int is_disconnected_device(struct device *dev, void *data)
+ 		return 0;
+ 
+ 	xendrv = to_xenbus_driver(dev->driver);
+-	return (xendev->state != XenbusStateConnected ||
+-		(xendrv->is_ready && !xendrv->is_ready(xendev)));
++	return (xendev->state < XenbusStateConnected ||
++		(xendev->state == XenbusStateConnected &&
++		 xendrv->is_ready && !xendrv->is_ready(xendev)));
+ }
+ 
+-static int exists_disconnected_device(struct device_driver *drv)
++static int exists_connecting_device(struct device_driver *drv)
+ {
+ 	return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
+-				is_disconnected_device);
++				is_device_connecting);
+ }
+ 
+ static int print_device_status(struct device *dev, void *data)
+@@ -884,10 +885,13 @@ static int print_device_status(struct device *dev, void *data)
+ 		/* Information only: is this too noisy? */
+ 		printk(KERN_INFO "XENBUS: Device with no driver: %s\n",
+ 		       xendev->nodename);
+-	} else if (xendev->state != XenbusStateConnected) {
++	} else if (xendev->state < XenbusStateConnected) {
++		enum xenbus_state rstate = XenbusStateUnknown;
++		if (xendev->otherend)
++			rstate = xenbus_read_driver_state(xendev->otherend);
+ 		printk(KERN_WARNING "XENBUS: Timeout connecting "
+-		       "to device: %s (state %d)\n",
+-		       xendev->nodename, xendev->state);
++		       "to device: %s (local state %d, remote state %d)\n",
++		       xendev->nodename, xendev->state, rstate);
+ 	}
+ 
+ 	return 0;
+@@ -897,7 +901,7 @@ static int print_device_status(struct device *dev, void *data)
+ static int ready_to_wait_for_devices;
+ 
+ /*
+- * On a 10 second timeout, wait for all devices currently configured.  We need
++ * On a 5-minute timeout, wait for all devices currently configured.  We need
+  * to do this to guarantee that the filesystems and / or network devices
+  * needed for boot are available, before we can allow the boot to proceed.
+  *
+@@ -912,18 +916,30 @@ static int ready_to_wait_for_devices;
+  */
+ static void wait_for_devices(struct xenbus_driver *xendrv)
+ {
+-	unsigned long timeout = jiffies + 10*HZ;
++	unsigned long start = jiffies;
+ 	struct device_driver *drv = xendrv ? &xendrv->driver : NULL;
++	unsigned int seconds_waited = 0;
+ 
+ 	if (!ready_to_wait_for_devices || !xen_domain())
+ 		return;
+ 
+-	while (exists_disconnected_device(drv)) {
+-		if (time_after(jiffies, timeout))
+-			break;
++	while (exists_connecting_device(drv)) {
++		if (time_after(jiffies, start + (seconds_waited+5)*HZ)) {
++			if (!seconds_waited)
++				printk(KERN_WARNING "XENBUS: Waiting for "
++				       "devices to initialise: ");
++			seconds_waited += 5;
++			printk("%us...", 300 - seconds_waited);
++			if (seconds_waited == 300)
++				break;
++		}
++
+ 		schedule_timeout_interruptible(HZ/10);
+ 	}
+ 
++	if (seconds_waited)
++		printk("\n");
++
+ 	bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
+ 			 print_device_status);
+ }
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 63ea83f..3bbcaa7 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2287,12 +2287,12 @@ int
+ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
+ 		char *mount_data_global, const char *devname)
+ {
+-	int rc = 0;
++	int rc;
+ 	int xid;
+ 	struct smb_vol *volume_info;
+-	struct cifsSesInfo *pSesInfo = NULL;
+-	struct cifsTconInfo *tcon = NULL;
+-	struct TCP_Server_Info *srvTcp = NULL;
++	struct cifsSesInfo *pSesInfo;
++	struct cifsTconInfo *tcon;
++	struct TCP_Server_Info *srvTcp;
+ 	char   *full_path;
+ 	char *mount_data = mount_data_global;
+ #ifdef CONFIG_CIFS_DFS_UPCALL
+@@ -2301,6 +2301,10 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
+ 	int referral_walks_count = 0;
+ try_mount_again:
+ #endif
++	rc = 0;
++	tcon = NULL;
++	pSesInfo = NULL;
++	srvTcp = NULL;
+ 	full_path = NULL;
+ 
+ 	xid = GetXid();
+@@ -2597,6 +2601,7 @@ remote_path_check:
+ 
+ 			cleanup_volume_info(&volume_info);
+ 			referral_walks_count++;
++			FreeXid(xid);
+ 			goto try_mount_again;
+ 		}
+ #else /* No DFS support, return error on mount */
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index bd2a9dd..d0a2afb 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -698,6 +698,10 @@ struct ext4_inode_info {
+ 	__u16 i_extra_isize;
+ 
+ 	spinlock_t i_block_reservation_lock;
++#ifdef CONFIG_QUOTA
++	/* quota space reservation, managed internally by quota code */
++	qsize_t i_reserved_quota;
++#endif
+ 
+ 	/* completed async DIOs that might need unwritten extents handling */
+ 	struct list_head i_aio_dio_complete_list;
+@@ -1432,7 +1436,7 @@ extern int ext4_chunk_trans_blocks(struct inode *, int nrblocks);
+ extern int ext4_block_truncate_page(handle_t *handle,
+ 		struct address_space *mapping, loff_t from);
+ extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
+-extern qsize_t ext4_get_reserved_space(struct inode *inode);
++extern qsize_t *ext4_get_reserved_space(struct inode *inode);
+ extern int flush_aio_dio_completed_IO(struct inode *inode);
+ /* ioctl.c */
+ extern long ext4_ioctl(struct file *, unsigned int, unsigned long);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 1dae9a4..e233879 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1045,17 +1045,12 @@ out:
+ 	return err;
+ }
+ 
+-qsize_t ext4_get_reserved_space(struct inode *inode)
++#ifdef CONFIG_QUOTA
++qsize_t *ext4_get_reserved_space(struct inode *inode)
+ {
+-	unsigned long long total;
+-
+-	spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
+-	total = EXT4_I(inode)->i_reserved_data_blocks +
+-		EXT4_I(inode)->i_reserved_meta_blocks;
+-	spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+-
+-	return (total << inode->i_blkbits);
++	return &EXT4_I(inode)->i_reserved_quota;
+ }
++#endif
+ /*
+  * Calculate the number of metadata blocks need to reserve
+  * to allocate @blocks for non extent file based file
+@@ -1858,19 +1853,17 @@ repeat:
+ 
+ 	md_needed = mdblocks - EXT4_I(inode)->i_reserved_meta_blocks;
+ 	total = md_needed + nrblocks;
++	spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+ 
+ 	/*
+ 	 * Make quota reservation here to prevent quota overflow
+ 	 * later. Real quota accounting is done at pages writeout
+ 	 * time.
+ 	 */
+-	if (vfs_dq_reserve_block(inode, total)) {
+-		spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
++	if (vfs_dq_reserve_block(inode, total))
+ 		return -EDQUOT;
+-	}
+ 
+ 	if (ext4_claim_free_blocks(sbi, total)) {
+-		spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
+ 		vfs_dq_release_reservation_block(inode, total);
+ 		if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
+ 			yield();
+@@ -1878,10 +1871,11 @@ repeat:
+ 		}
+ 		return -ENOSPC;
+ 	}
++	spin_lock(&EXT4_I(inode)->i_block_reservation_lock);
+ 	EXT4_I(inode)->i_reserved_data_blocks += nrblocks;
+-	EXT4_I(inode)->i_reserved_meta_blocks = mdblocks;
+-
++	EXT4_I(inode)->i_reserved_meta_blocks += md_needed;
+ 	spin_unlock(&EXT4_I(inode)->i_block_reservation_lock);
++
+ 	return 0;       /* success */
+ }
+ 
+@@ -4850,6 +4844,9 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino)
+ 			((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32;
+ 	inode->i_size = ext4_isize(raw_inode);
+ 	ei->i_disksize = inode->i_size;
++#ifdef CONFIG_QUOTA
++	ei->i_reserved_quota = 0;
++#endif
+ 	inode->i_generation = le32_to_cpu(raw_inode->i_generation);
+ 	ei->i_block_group = iloc.block_group;
+ 	ei->i_last_alloc_group = ~0;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 9ae5217..92943f2 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -704,6 +704,9 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
+ 	ei->i_allocated_meta_blocks = 0;
+ 	ei->i_delalloc_reserved_flag = 0;
+ 	spin_lock_init(&(ei->i_block_reservation_lock));
++#ifdef CONFIG_QUOTA
++	ei->i_reserved_quota = 0;
++#endif
+ 	INIT_LIST_HEAD(&ei->i_aio_dio_complete_list);
+ 	ei->cur_aio_dio = NULL;
+ 	ei->i_sync_tid = 0;
+@@ -1001,7 +1004,9 @@ static const struct dquot_operations ext4_quota_operations = {
+ 	.reserve_space	= dquot_reserve_space,
+ 	.claim_space	= dquot_claim_space,
+ 	.release_rsv	= dquot_release_reserved_space,
++#ifdef CONFIG_QUOTA
+ 	.get_reserved_space = ext4_get_reserved_space,
++#endif
+ 	.alloc_inode	= dquot_alloc_inode,
+ 	.free_space	= dquot_free_space,
+ 	.free_inode	= dquot_free_inode,
+diff --git a/fs/namei.c b/fs/namei.c
+index d11f404..a2b3c28 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -234,6 +234,7 @@ int generic_permission(struct inode *inode, int mask,
+ 	/*
+ 	 * Searching includes executable on directories, else just read.
+ 	 */
++	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
+ 	if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
+ 		if (capable(CAP_DAC_READ_SEARCH))
+ 			return 0;
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 39b49c4..c4d07a8 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -1388,6 +1388,67 @@ void vfs_dq_drop(struct inode *inode)
+ EXPORT_SYMBOL(vfs_dq_drop);
+ 
+ /*
++ * inode_reserved_space is managed internally by quota, and protected by
++ * i_lock similar to i_blocks+i_bytes.
++ */
++static qsize_t *inode_reserved_space(struct inode * inode)
++{
++	/* Filesystem must explicitly define it's own method in order to use
++	 * quota reservation interface */
++	BUG_ON(!inode->i_sb->dq_op->get_reserved_space);
++	return inode->i_sb->dq_op->get_reserved_space(inode);
++}
++
++static void inode_add_rsv_space(struct inode *inode, qsize_t number)
++{
++	spin_lock(&inode->i_lock);
++	*inode_reserved_space(inode) += number;
++	spin_unlock(&inode->i_lock);
++}
++
++
++static void inode_claim_rsv_space(struct inode *inode, qsize_t number)
++{
++	spin_lock(&inode->i_lock);
++	*inode_reserved_space(inode) -= number;
++	__inode_add_bytes(inode, number);
++	spin_unlock(&inode->i_lock);
++}
++
++static void inode_sub_rsv_space(struct inode *inode, qsize_t number)
++{
++	spin_lock(&inode->i_lock);
++	*inode_reserved_space(inode) -= number;
++	spin_unlock(&inode->i_lock);
++}
++
++static qsize_t inode_get_rsv_space(struct inode *inode)
++{
++	qsize_t ret;
++	spin_lock(&inode->i_lock);
++	ret = *inode_reserved_space(inode);
++	spin_unlock(&inode->i_lock);
++	return ret;
++}
++
++static void inode_incr_space(struct inode *inode, qsize_t number,
++				int reserve)
++{
++	if (reserve)
++		inode_add_rsv_space(inode, number);
++	else
++		inode_add_bytes(inode, number);
++}
++
++static void inode_decr_space(struct inode *inode, qsize_t number, int reserve)
++{
++	if (reserve)
++		inode_sub_rsv_space(inode, number);
++	else
++		inode_sub_bytes(inode, number);
++}
++
++/*
+  * Following four functions update i_blocks+i_bytes fields and
+  * quota information (together with appropriate checks)
+  * NOTE: We absolutely rely on the fact that caller dirties
+@@ -1405,6 +1466,21 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number,
+ 	int cnt, ret = QUOTA_OK;
+ 	char warntype[MAXQUOTAS];
+ 
++	/*
++	 * First test before acquiring mutex - solves deadlocks when we
++	 * re-enter the quota code and are already holding the mutex
++	 */
++	if (IS_NOQUOTA(inode)) {
++		inode_incr_space(inode, number, reserve);
++		goto out;
++	}
++
++	down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
++	if (IS_NOQUOTA(inode)) {
++		inode_incr_space(inode, number, reserve);
++		goto out_unlock;
++	}
++
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++)
+ 		warntype[cnt] = QUOTA_NL_NOWARN;
+ 
+@@ -1415,7 +1491,8 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number,
+ 		if (check_bdq(inode->i_dquot[cnt], number, warn, warntype+cnt)
+ 		    == NO_QUOTA) {
+ 			ret = NO_QUOTA;
+-			goto out_unlock;
++			spin_unlock(&dq_data_lock);
++			goto out_flush_warn;
+ 		}
+ 	}
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+@@ -1426,64 +1503,32 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number,
+ 		else
+ 			dquot_incr_space(inode->i_dquot[cnt], number);
+ 	}
+-	if (!reserve)
+-		inode_add_bytes(inode, number);
+-out_unlock:
++	inode_incr_space(inode, number, reserve);
+ 	spin_unlock(&dq_data_lock);
+-	flush_warnings(inode->i_dquot, warntype);
+-	return ret;
+-}
+-
+-int dquot_alloc_space(struct inode *inode, qsize_t number, int warn)
+-{
+-	int cnt, ret = QUOTA_OK;
+-
+-	/*
+-	 * First test before acquiring mutex - solves deadlocks when we
+-	 * re-enter the quota code and are already holding the mutex
+-	 */
+-	if (IS_NOQUOTA(inode)) {
+-		inode_add_bytes(inode, number);
+-		goto out;
+-	}
+-
+-	down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
+-	if (IS_NOQUOTA(inode)) {
+-		inode_add_bytes(inode, number);
+-		goto out_unlock;
+-	}
+-
+-	ret = __dquot_alloc_space(inode, number, warn, 0);
+-	if (ret == NO_QUOTA)
+-		goto out_unlock;
+ 
++	if (reserve)
++		goto out_flush_warn;
+ 	/* Dirtify all the dquots - this can block when journalling */
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++)
+ 		if (inode->i_dquot[cnt])
+ 			mark_dquot_dirty(inode->i_dquot[cnt]);
++out_flush_warn:
++	flush_warnings(inode->i_dquot, warntype);
+ out_unlock:
+ 	up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
+ out:
+ 	return ret;
+ }
++
++int dquot_alloc_space(struct inode *inode, qsize_t number, int warn)
++{
++	return __dquot_alloc_space(inode, number, warn, 0);
++}
+ EXPORT_SYMBOL(dquot_alloc_space);
+ 
+ int dquot_reserve_space(struct inode *inode, qsize_t number, int warn)
+ {
+-	int ret = QUOTA_OK;
+-
+-	if (IS_NOQUOTA(inode))
+-		goto out;
+-
+-	down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
+-	if (IS_NOQUOTA(inode))
+-		goto out_unlock;
+-
+-	ret = __dquot_alloc_space(inode, number, warn, 1);
+-out_unlock:
+-	up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
+-out:
+-	return ret;
++	return __dquot_alloc_space(inode, number, warn, 1);
+ }
+ EXPORT_SYMBOL(dquot_reserve_space);
+ 
+@@ -1540,14 +1585,14 @@ int dquot_claim_space(struct inode *inode, qsize_t number)
+ 	int ret = QUOTA_OK;
+ 
+ 	if (IS_NOQUOTA(inode)) {
+-		inode_add_bytes(inode, number);
++		inode_claim_rsv_space(inode, number);
+ 		goto out;
+ 	}
+ 
+ 	down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
+ 	if (IS_NOQUOTA(inode))	{
+ 		up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
+-		inode_add_bytes(inode, number);
++		inode_claim_rsv_space(inode, number);
+ 		goto out;
+ 	}
+ 
+@@ -1559,7 +1604,7 @@ int dquot_claim_space(struct inode *inode, qsize_t number)
+ 							number);
+ 	}
+ 	/* Update inode bytes */
+-	inode_add_bytes(inode, number);
++	inode_claim_rsv_space(inode, number);
+ 	spin_unlock(&dq_data_lock);
+ 	/* Dirtify all the dquots - this can block when journalling */
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++)
+@@ -1572,38 +1617,9 @@ out:
+ EXPORT_SYMBOL(dquot_claim_space);
+ 
+ /*
+- * Release reserved quota space
+- */
+-void dquot_release_reserved_space(struct inode *inode, qsize_t number)
+-{
+-	int cnt;
+-
+-	if (IS_NOQUOTA(inode))
+-		goto out;
+-
+-	down_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
+-	if (IS_NOQUOTA(inode))
+-		goto out_unlock;
+-
+-	spin_lock(&dq_data_lock);
+-	/* Release reserved dquots */
+-	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		if (inode->i_dquot[cnt])
+-			dquot_free_reserved_space(inode->i_dquot[cnt], number);
+-	}
+-	spin_unlock(&dq_data_lock);
+-
+-out_unlock:
+-	up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
+-out:
+-	return;
+-}
+-EXPORT_SYMBOL(dquot_release_reserved_space);
+-
+-/*
+  * This operation can block, but only after everything is updated
+  */
+-int dquot_free_space(struct inode *inode, qsize_t number)
++int __dquot_free_space(struct inode *inode, qsize_t number, int reserve)
+ {
+ 	unsigned int cnt;
+ 	char warntype[MAXQUOTAS];
+@@ -1612,7 +1628,7 @@ int dquot_free_space(struct inode *inode, qsize_t number)
+          * re-enter the quota code and are already holding the mutex */
+ 	if (IS_NOQUOTA(inode)) {
+ out_sub:
+-		inode_sub_bytes(inode, number);
++		inode_decr_space(inode, number, reserve);
+ 		return QUOTA_OK;
+ 	}
+ 
+@@ -1627,21 +1643,43 @@ out_sub:
+ 		if (!inode->i_dquot[cnt])
+ 			continue;
+ 		warntype[cnt] = info_bdq_free(inode->i_dquot[cnt], number);
+-		dquot_decr_space(inode->i_dquot[cnt], number);
++		if (reserve)
++			dquot_free_reserved_space(inode->i_dquot[cnt], number);
++		else
++			dquot_decr_space(inode->i_dquot[cnt], number);
+ 	}
+-	inode_sub_bytes(inode, number);
++	inode_decr_space(inode, number, reserve);
+ 	spin_unlock(&dq_data_lock);
++
++	if (reserve)
++		goto out_unlock;
+ 	/* Dirtify all the dquots - this can block when journalling */
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++)
+ 		if (inode->i_dquot[cnt])
+ 			mark_dquot_dirty(inode->i_dquot[cnt]);
++out_unlock:
+ 	flush_warnings(inode->i_dquot, warntype);
+ 	up_read(&sb_dqopt(inode->i_sb)->dqptr_sem);
+ 	return QUOTA_OK;
+ }
++
++int dquot_free_space(struct inode *inode, qsize_t number)
++{
++	return  __dquot_free_space(inode, number, 0);
++}
+ EXPORT_SYMBOL(dquot_free_space);
+ 
+ /*
++ * Release reserved quota space
++ */
++void dquot_release_reserved_space(struct inode *inode, qsize_t number)
++{
++	__dquot_free_space(inode, number, 1);
++
++}
++EXPORT_SYMBOL(dquot_release_reserved_space);
++
++/*
+  * This operation can block, but only after everything is updated
+  */
+ int dquot_free_inode(const struct inode *inode, qsize_t number)
+@@ -1679,19 +1717,6 @@ int dquot_free_inode(const struct inode *inode, qsize_t number)
+ EXPORT_SYMBOL(dquot_free_inode);
+ 
+ /*
+- * call back function, get reserved quota space from underlying fs
+- */
+-qsize_t dquot_get_reserved_space(struct inode *inode)
+-{
+-	qsize_t reserved_space = 0;
+-
+-	if (sb_any_quota_active(inode->i_sb) &&
+-	    inode->i_sb->dq_op->get_reserved_space)
+-		reserved_space = inode->i_sb->dq_op->get_reserved_space(inode);
+-	return reserved_space;
+-}
+-
+-/*
+  * Transfer the number of inode and blocks from one diskquota to an other.
+  *
+  * This operation can block, but only after everything is updated
+@@ -1734,7 +1759,7 @@ int dquot_transfer(struct inode *inode, struct iattr *iattr)
+ 	}
+ 	spin_lock(&dq_data_lock);
+ 	cur_space = inode_get_bytes(inode);
+-	rsv_space = dquot_get_reserved_space(inode);
++	rsv_space = inode_get_rsv_space(inode);
+ 	space = cur_space + rsv_space;
+ 	/* Build the transfer_from list and check the limits */
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+diff --git a/fs/stat.c b/fs/stat.c
+index 075694e..c4ecd52 100644
+--- a/fs/stat.c
++++ b/fs/stat.c
+@@ -401,9 +401,9 @@ SYSCALL_DEFINE4(fstatat64, int, dfd, char __user *, filename,
+ }
+ #endif /* __ARCH_WANT_STAT64 */
+ 
+-void inode_add_bytes(struct inode *inode, loff_t bytes)
++/* Caller is here responsible for sufficient locking (ie. inode->i_lock) */
++void __inode_add_bytes(struct inode *inode, loff_t bytes)
+ {
+-	spin_lock(&inode->i_lock);
+ 	inode->i_blocks += bytes >> 9;
+ 	bytes &= 511;
+ 	inode->i_bytes += bytes;
+@@ -411,6 +411,12 @@ void inode_add_bytes(struct inode *inode, loff_t bytes)
+ 		inode->i_blocks++;
+ 		inode->i_bytes -= 512;
+ 	}
++}
++
++void inode_add_bytes(struct inode *inode, loff_t bytes)
++{
++	spin_lock(&inode->i_lock);
++	__inode_add_bytes(inode, bytes);
+ 	spin_unlock(&inode->i_lock);
+ }
+ 
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 9d1b8c2..1e4543c 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -1078,21 +1078,39 @@ static int udf_fill_partdesc_info(struct super_block *sb,
+ 	return 0;
+ }
+ 
+-static int udf_load_vat(struct super_block *sb, int p_index, int type1_index)
++static void udf_find_vat_block(struct super_block *sb, int p_index,
++			       int type1_index, sector_t start_block)
+ {
+ 	struct udf_sb_info *sbi = UDF_SB(sb);
+ 	struct udf_part_map *map = &sbi->s_partmaps[p_index];
++	sector_t vat_block;
+ 	struct kernel_lb_addr ino;
++
++	/*
++	 * VAT file entry is in the last recorded block. Some broken disks have
++	 * it a few blocks before so try a bit harder...
++	 */
++	ino.partitionReferenceNum = type1_index;
++	for (vat_block = start_block;
++	     vat_block >= map->s_partition_root &&
++	     vat_block >= start_block - 3 &&
++	     !sbi->s_vat_inode; vat_block--) {
++		ino.logicalBlockNum = vat_block - map->s_partition_root;
++		sbi->s_vat_inode = udf_iget(sb, &ino);
++	}
++}
++
++static int udf_load_vat(struct super_block *sb, int p_index, int type1_index)
++{
++	struct udf_sb_info *sbi = UDF_SB(sb);
++	struct udf_part_map *map = &sbi->s_partmaps[p_index];
+ 	struct buffer_head *bh = NULL;
+ 	struct udf_inode_info *vati;
+ 	uint32_t pos;
+ 	struct virtualAllocationTable20 *vat20;
+ 	sector_t blocks = sb->s_bdev->bd_inode->i_size >> sb->s_blocksize_bits;
+ 
+-	/* VAT file entry is in the last recorded block */
+-	ino.partitionReferenceNum = type1_index;
+-	ino.logicalBlockNum = sbi->s_last_block - map->s_partition_root;
+-	sbi->s_vat_inode = udf_iget(sb, &ino);
++	udf_find_vat_block(sb, p_index, type1_index, sbi->s_last_block);
+ 	if (!sbi->s_vat_inode &&
+ 	    sbi->s_last_block != blocks - 1) {
+ 		printk(KERN_NOTICE "UDF-fs: Failed to read VAT inode from the"
+@@ -1100,9 +1118,7 @@ static int udf_load_vat(struct super_block *sb, int p_index, int type1_index)
+ 		       "block of the device (%lu).\n",
+ 		       (unsigned long)sbi->s_last_block,
+ 		       (unsigned long)blocks - 1);
+-		ino.partitionReferenceNum = type1_index;
+-		ino.logicalBlockNum = blocks - 1 - map->s_partition_root;
+-		sbi->s_vat_inode = udf_iget(sb, &ino);
++		udf_find_vat_block(sb, p_index, type1_index, blocks - 1);
+ 	}
+ 	if (!sbi->s_vat_inode)
+ 		return 1;
+diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
+index 789cf5f..d77b547 100644
+--- a/include/linux/cpumask.h
++++ b/include/linux/cpumask.h
+@@ -84,6 +84,7 @@ extern const struct cpumask *const cpu_active_mask;
+ #define num_online_cpus()	cpumask_weight(cpu_online_mask)
+ #define num_possible_cpus()	cpumask_weight(cpu_possible_mask)
+ #define num_present_cpus()	cpumask_weight(cpu_present_mask)
++#define num_active_cpus()	cpumask_weight(cpu_active_mask)
+ #define cpu_online(cpu)		cpumask_test_cpu((cpu), cpu_online_mask)
+ #define cpu_possible(cpu)	cpumask_test_cpu((cpu), cpu_possible_mask)
+ #define cpu_present(cpu)	cpumask_test_cpu((cpu), cpu_present_mask)
+@@ -92,6 +93,7 @@ extern const struct cpumask *const cpu_active_mask;
+ #define num_online_cpus()	1
+ #define num_possible_cpus()	1
+ #define num_present_cpus()	1
++#define num_active_cpus()	1
+ #define cpu_online(cpu)		((cpu) == 0)
+ #define cpu_possible(cpu)	((cpu) == 0)
+ #define cpu_present(cpu)	((cpu) == 0)
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 2620a8c..98ea200 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2314,6 +2314,7 @@ extern const struct inode_operations page_symlink_inode_operations;
+ extern int generic_readlink(struct dentry *, char __user *, int);
+ extern void generic_fillattr(struct inode *, struct kstat *);
+ extern int vfs_getattr(struct vfsmount *, struct dentry *, struct kstat *);
++void __inode_add_bytes(struct inode *inode, loff_t bytes);
+ void inode_add_bytes(struct inode *inode, loff_t bytes);
+ void inode_sub_bytes(struct inode *inode, loff_t bytes);
+ loff_t inode_get_bytes(struct inode *inode);
+diff --git a/include/linux/quota.h b/include/linux/quota.h
+index 78c4889..8fd8efc 100644
+--- a/include/linux/quota.h
++++ b/include/linux/quota.h
+@@ -313,8 +313,9 @@ struct dquot_operations {
+ 	int (*claim_space) (struct inode *, qsize_t);
+ 	/* release rsved quota for delayed alloc */
+ 	void (*release_rsv) (struct inode *, qsize_t);
+-	/* get reserved quota for delayed alloc */
+-	qsize_t (*get_reserved_space) (struct inode *);
++	/* get reserved quota for delayed alloc, value returned is managed by
++	 * quota code only */
++	qsize_t *(*get_reserved_space) (struct inode *);
+ };
+ 
+ /* Operations handling requests from userspace */
+diff --git a/include/linux/security.h b/include/linux/security.h
+index 239e40d..d40d23f 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -95,8 +95,13 @@ struct seq_file;
+ extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);
+ extern int cap_netlink_recv(struct sk_buff *skb, int cap);
+ 
++#ifdef CONFIG_MMU
+ extern unsigned long mmap_min_addr;
+ extern unsigned long dac_mmap_min_addr;
++#else
++#define dac_mmap_min_addr	0UL
++#endif
++
+ /*
+  * Values used in the task_security_ops calls
+  */
+@@ -121,6 +126,7 @@ struct request_sock;
+ #define LSM_UNSAFE_PTRACE	2
+ #define LSM_UNSAFE_PTRACE_CAP	4
+ 
++#ifdef CONFIG_MMU
+ /*
+  * If a hint addr is less than mmap_min_addr change hint to be as
+  * low as possible but still greater than mmap_min_addr
+@@ -135,6 +141,7 @@ static inline unsigned long round_hint_to_min(unsigned long hint)
+ }
+ extern int mmap_min_addr_handler(struct ctl_table *table, int write,
+ 				 void __user *buffer, size_t *lenp, loff_t *ppos);
++#endif
+ 
+ #ifdef CONFIG_SECURITY
+ 
+diff --git a/include/net/ip.h b/include/net/ip.h
+index 2f47e54..69db943 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -342,6 +342,7 @@ enum ip_defrag_users
+ 	IP_DEFRAG_CALL_RA_CHAIN,
+ 	IP_DEFRAG_CONNTRACK_IN,
+ 	IP_DEFRAG_CONNTRACK_OUT,
++	IP_DEFRAG_CONNTRACK_BRIDGE_IN,
+ 	IP_DEFRAG_VS_IN,
+ 	IP_DEFRAG_VS_OUT,
+ 	IP_DEFRAG_VS_FWD
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 8c31d8a..639bbf0 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -354,8 +354,16 @@ static inline int ipv6_prefix_equal(const struct in6_addr *a1,
+ 
+ struct inet_frag_queue;
+ 
++enum ip6_defrag_users {
++	IP6_DEFRAG_LOCAL_DELIVER,
++	IP6_DEFRAG_CONNTRACK_IN,
++	IP6_DEFRAG_CONNTRACK_OUT,
++	IP6_DEFRAG_CONNTRACK_BRIDGE_IN,
++};
++
+ struct ip6_create_arg {
+ 	__be32 id;
++	u32 user;
+ 	struct in6_addr *src;
+ 	struct in6_addr *dst;
+ };
+diff --git a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
+index abc55ad..1ee717e 100644
+--- a/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
++++ b/include/net/netfilter/ipv6/nf_conntrack_ipv6.h
+@@ -9,7 +9,7 @@ extern struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6;
+ 
+ extern int nf_ct_frag6_init(void);
+ extern void nf_ct_frag6_cleanup(void);
+-extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb);
++extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user);
+ extern void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
+ 			       struct net_device *in,
+ 			       struct net_device *out,
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 6ba0f1e..b216886 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -212,6 +212,8 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen)
+ 	err = __raw_notifier_call_chain(&cpu_chain, CPU_DOWN_PREPARE | mod,
+ 					hcpu, -1, &nr_calls);
+ 	if (err == NOTIFY_BAD) {
++		set_cpu_active(cpu, true);
++
+ 		nr_calls--;
+ 		__raw_notifier_call_chain(&cpu_chain, CPU_DOWN_FAILED | mod,
+ 					  hcpu, nr_calls, NULL);
+@@ -223,11 +225,11 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen)
+ 
+ 	/* Ensure that we are not runnable on dying cpu */
+ 	cpumask_copy(old_allowed, &current->cpus_allowed);
+-	set_cpus_allowed_ptr(current,
+-			     cpumask_of(cpumask_any_but(cpu_online_mask, cpu)));
++	set_cpus_allowed_ptr(current, cpu_active_mask);
+ 
+ 	err = __stop_machine(take_cpu_down, &tcd_param, cpumask_of(cpu));
+ 	if (err) {
++		set_cpu_active(cpu, true);
+ 		/* CPU didn't die: tell everyone.  Can't complain. */
+ 		if (raw_notifier_call_chain(&cpu_chain, CPU_DOWN_FAILED | mod,
+ 					    hcpu) == NOTIFY_BAD)
+@@ -292,9 +294,6 @@ int __ref cpu_down(unsigned int cpu)
+ 
+ 	err = _cpu_down(cpu, 0);
+ 
+-	if (cpu_online(cpu))
+-		set_cpu_active(cpu, true);
+-
+ out:
+ 	cpu_maps_update_done();
+ 	stop_machine_destroy();
+@@ -387,6 +386,15 @@ int disable_nonboot_cpus(void)
+ 	 * with the userspace trying to use the CPU hotplug at the same time
+ 	 */
+ 	cpumask_clear(frozen_cpus);
++
++	for_each_online_cpu(cpu) {
++		if (cpu == first_cpu)
++			continue;
++		set_cpu_active(cpu, false);
++	}
++
++	synchronize_sched();
++
+ 	printk("Disabling non-boot CPUs ...\n");
+ 	for_each_online_cpu(cpu) {
+ 		if (cpu == first_cpu)
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index b5cb469..39e5121 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -873,7 +873,7 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
+ 		if (retval < 0)
+ 			return retval;
+ 
+-		if (!cpumask_subset(trialcs->cpus_allowed, cpu_online_mask))
++		if (!cpumask_subset(trialcs->cpus_allowed, cpu_active_mask))
+ 			return -EINVAL;
+ 	}
+ 	retval = validate_change(cs, trialcs);
+@@ -2011,7 +2011,7 @@ static void scan_for_empty_cpusets(struct cpuset *root)
+ 		}
+ 
+ 		/* Continue past cpusets with all cpus, mems online */
+-		if (cpumask_subset(cp->cpus_allowed, cpu_online_mask) &&
++		if (cpumask_subset(cp->cpus_allowed, cpu_active_mask) &&
+ 		    nodes_subset(cp->mems_allowed, node_states[N_HIGH_MEMORY]))
+ 			continue;
+ 
+@@ -2020,7 +2020,7 @@ static void scan_for_empty_cpusets(struct cpuset *root)
+ 		/* Remove offline cpus and mems from this cpuset. */
+ 		mutex_lock(&callback_mutex);
+ 		cpumask_and(cp->cpus_allowed, cp->cpus_allowed,
+-			    cpu_online_mask);
++			    cpu_active_mask);
+ 		nodes_and(cp->mems_allowed, cp->mems_allowed,
+ 						node_states[N_HIGH_MEMORY]);
+ 		mutex_unlock(&callback_mutex);
+@@ -2058,8 +2058,10 @@ static int cpuset_track_online_cpus(struct notifier_block *unused_nb,
+ 	switch (phase) {
+ 	case CPU_ONLINE:
+ 	case CPU_ONLINE_FROZEN:
+-	case CPU_DEAD:
+-	case CPU_DEAD_FROZEN:
++	case CPU_DOWN_PREPARE:
++	case CPU_DOWN_PREPARE_FROZEN:
++	case CPU_DOWN_FAILED:
++	case CPU_DOWN_FAILED_FROZEN:
+ 		break;
+ 
+ 	default:
+@@ -2068,7 +2070,7 @@ static int cpuset_track_online_cpus(struct notifier_block *unused_nb,
+ 
+ 	cgroup_lock();
+ 	mutex_lock(&callback_mutex);
+-	cpumask_copy(top_cpuset.cpus_allowed, cpu_online_mask);
++	cpumask_copy(top_cpuset.cpus_allowed, cpu_active_mask);
+ 	mutex_unlock(&callback_mutex);
+ 	scan_for_empty_cpusets(&top_cpuset);
+ 	ndoms = generate_sched_domains(&doms, &attr);
+@@ -2115,7 +2117,7 @@ static int cpuset_track_online_nodes(struct notifier_block *self,
+ 
+ void __init cpuset_init_smp(void)
+ {
+-	cpumask_copy(top_cpuset.cpus_allowed, cpu_online_mask);
++	cpumask_copy(top_cpuset.cpus_allowed, cpu_active_mask);
+ 	top_cpuset.mems_allowed = node_states[N_HIGH_MEMORY];
+ 
+ 	hotcpu_notifier(cpuset_track_online_cpus, 0);
+diff --git a/kernel/sched.c b/kernel/sched.c
+index d079a9f..dd0dccd 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -2036,6 +2036,9 @@ task_hot(struct task_struct *p, u64 now, struct sched_domain *sd)
+ {
+ 	s64 delta;
+ 
++	if (p->sched_class != &fair_sched_class)
++		return 0;
++
+ 	/*
+ 	 * Buddy candidates are cache hot:
+ 	 */
+@@ -2044,9 +2047,6 @@ task_hot(struct task_struct *p, u64 now, struct sched_domain *sd)
+ 			 &p->se == cfs_rq_of(&p->se)->last))
+ 		return 1;
+ 
+-	if (p->sched_class != &fair_sched_class)
+-		return 0;
+-
+ 	if (sysctl_sched_migration_cost == -1)
+ 		return 1;
+ 	if (sysctl_sched_migration_cost == 0)
+@@ -4139,7 +4139,7 @@ static int load_balance(int this_cpu, struct rq *this_rq,
+ 	unsigned long flags;
+ 	struct cpumask *cpus = __get_cpu_var(load_balance_tmpmask);
+ 
+-	cpumask_copy(cpus, cpu_online_mask);
++	cpumask_copy(cpus, cpu_active_mask);
+ 
+ 	/*
+ 	 * When power savings policy is enabled for the parent domain, idle
+@@ -4302,7 +4302,7 @@ load_balance_newidle(int this_cpu, struct rq *this_rq, struct sched_domain *sd)
+ 	int all_pinned = 0;
+ 	struct cpumask *cpus = __get_cpu_var(load_balance_tmpmask);
+ 
+-	cpumask_copy(cpus, cpu_online_mask);
++	cpumask_copy(cpus, cpu_active_mask);
+ 
+ 	/*
+ 	 * When power savings policy is enabled for the parent domain, idle
+@@ -4699,7 +4699,7 @@ int select_nohz_load_balancer(int stop_tick)
+ 		cpumask_set_cpu(cpu, nohz.cpu_mask);
+ 
+ 		/* time for ilb owner also to sleep */
+-		if (cpumask_weight(nohz.cpu_mask) == num_online_cpus()) {
++		if (cpumask_weight(nohz.cpu_mask) == num_active_cpus()) {
+ 			if (atomic_read(&nohz.load_balancer) == cpu)
+ 				atomic_set(&nohz.load_balancer, -1);
+ 			return 0;
+@@ -7075,7 +7075,7 @@ int set_cpus_allowed_ptr(struct task_struct *p, const struct cpumask *new_mask)
+ 	int ret = 0;
+ 
+ 	rq = task_rq_lock(p, &flags);
+-	if (!cpumask_intersects(new_mask, cpu_online_mask)) {
++	if (!cpumask_intersects(new_mask, cpu_active_mask)) {
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
+@@ -7097,7 +7097,7 @@ int set_cpus_allowed_ptr(struct task_struct *p, const struct cpumask *new_mask)
+ 	if (cpumask_test_cpu(task_cpu(p), new_mask))
+ 		goto out;
+ 
+-	if (migrate_task(p, cpumask_any_and(cpu_online_mask, new_mask), &req)) {
++	if (migrate_task(p, cpumask_any_and(cpu_active_mask, new_mask), &req)) {
+ 		/* Need help from migration thread: drop lock and wait. */
+ 		struct task_struct *mt = rq->migration_thread;
+ 
+@@ -7251,19 +7251,19 @@ static void move_task_off_dead_cpu(int dead_cpu, struct task_struct *p)
+ 
+ again:
+ 	/* Look for allowed, online CPU in same node. */
+-	for_each_cpu_and(dest_cpu, nodemask, cpu_online_mask)
++	for_each_cpu_and(dest_cpu, nodemask, cpu_active_mask)
+ 		if (cpumask_test_cpu(dest_cpu, &p->cpus_allowed))
+ 			goto move;
+ 
+ 	/* Any allowed, online CPU? */
+-	dest_cpu = cpumask_any_and(&p->cpus_allowed, cpu_online_mask);
++	dest_cpu = cpumask_any_and(&p->cpus_allowed, cpu_active_mask);
+ 	if (dest_cpu < nr_cpu_ids)
+ 		goto move;
+ 
+ 	/* No more Mr. Nice Guy. */
+ 	if (dest_cpu >= nr_cpu_ids) {
+ 		cpuset_cpus_allowed_locked(p, &p->cpus_allowed);
+-		dest_cpu = cpumask_any_and(cpu_online_mask, &p->cpus_allowed);
++		dest_cpu = cpumask_any_and(cpu_active_mask, &p->cpus_allowed);
+ 
+ 		/*
+ 		 * Don't tell them about moving exiting tasks or
+@@ -7292,7 +7292,7 @@ move:
+  */
+ static void migrate_nr_uninterruptible(struct rq *rq_src)
+ {
+-	struct rq *rq_dest = cpu_rq(cpumask_any(cpu_online_mask));
++	struct rq *rq_dest = cpu_rq(cpumask_any(cpu_active_mask));
+ 	unsigned long flags;
+ 
+ 	local_irq_save(flags);
+@@ -7546,7 +7546,7 @@ static ctl_table *sd_alloc_ctl_cpu_table(int cpu)
+ static struct ctl_table_header *sd_sysctl_header;
+ static void register_sched_domain_sysctl(void)
+ {
+-	int i, cpu_num = num_online_cpus();
++	int i, cpu_num = num_possible_cpus();
+ 	struct ctl_table *entry = sd_alloc_ctl_entry(cpu_num + 1);
+ 	char buf[32];
+ 
+@@ -7556,7 +7556,7 @@ static void register_sched_domain_sysctl(void)
+ 	if (entry == NULL)
+ 		return;
+ 
+-	for_each_online_cpu(i) {
++	for_each_possible_cpu(i) {
+ 		snprintf(buf, 32, "cpu%d", i);
+ 		entry->procname = kstrdup(buf, GFP_KERNEL);
+ 		entry->mode = 0555;
+@@ -7925,6 +7925,8 @@ sd_parent_degenerate(struct sched_domain *sd, struct sched_domain *parent)
+ 
+ static void free_rootdomain(struct root_domain *rd)
+ {
++	synchronize_sched();
++
+ 	cpupri_cleanup(&rd->cpupri);
+ 
+ 	free_cpumask_var(rd->rto_mask);
+@@ -9042,7 +9044,7 @@ match1:
+ 	if (doms_new == NULL) {
+ 		ndoms_cur = 0;
+ 		doms_new = fallback_doms;
+-		cpumask_andnot(&doms_new[0], cpu_online_mask, cpu_isolated_map);
++		cpumask_andnot(&doms_new[0], cpu_active_mask, cpu_isolated_map);
+ 		WARN_ON_ONCE(dattr_new);
+ 	}
+ 
+@@ -9173,8 +9175,10 @@ static int update_sched_domains(struct notifier_block *nfb,
+ 	switch (action) {
+ 	case CPU_ONLINE:
+ 	case CPU_ONLINE_FROZEN:
+-	case CPU_DEAD:
+-	case CPU_DEAD_FROZEN:
++	case CPU_DOWN_PREPARE:
++	case CPU_DOWN_PREPARE_FROZEN:
++	case CPU_DOWN_FAILED:
++	case CPU_DOWN_FAILED_FROZEN:
+ 		partition_sched_domains(1, NULL, NULL);
+ 		return NOTIFY_OK;
+ 
+@@ -9221,7 +9225,7 @@ void __init sched_init_smp(void)
+ #endif
+ 	get_online_cpus();
+ 	mutex_lock(&sched_domains_mutex);
+-	arch_init_sched_domains(cpu_online_mask);
++	arch_init_sched_domains(cpu_active_mask);
+ 	cpumask_andnot(non_isolated_cpus, cpu_possible_mask, cpu_isolated_map);
+ 	if (cpumask_empty(non_isolated_cpus))
+ 		cpumask_set_cpu(smp_processor_id(), non_isolated_cpus);
+diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
+index 5488a5d..199228b 100644
+--- a/kernel/sched_fair.c
++++ b/kernel/sched_fair.c
+@@ -1374,6 +1374,9 @@ static int select_task_rq_fair(struct task_struct *p, int sd_flag, int wake_flag
+ 
+ 	rcu_read_lock();
+ 	for_each_domain(cpu, tmp) {
++		if (!(tmp->flags & SD_LOAD_BALANCE))
++			continue;
++
+ 		/*
+ 		 * If power savings logic is enabled for a domain, see if we
+ 		 * are not overloaded, if so, don't balance wider.
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 0d949c5..dd84be9 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -1200,6 +1200,7 @@ static struct ctl_table vm_table[] = {
+ 		.extra2		= (void *)&hugetlb_infinity,
+ 	},
+ #endif
++#ifdef CONFIG_MMU
+ 	{
+ 		.ctl_name	= VM_LOWMEM_RESERVE_RATIO,
+ 		.procname	= "lowmem_reserve_ratio",
+@@ -1353,6 +1354,7 @@ static struct ctl_table vm_table[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= &mmap_min_addr_handler,
+ 	},
++#endif
+ #ifdef CONFIG_NUMA
+ 	{
+ 		.ctl_name	= CTL_UNNUMBERED,
+@@ -1605,7 +1607,8 @@ static struct ctl_table debug_table[] = {
+ 		.data		= &show_unhandled_signals,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec
++		.proc_handler	= proc_dointvec_minmax,
++		.extra1		= &zero,
+ 	},
+ #endif
+ 	{ .ctl_name = 0 }
+diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
+index 620b58a..9484be4 100644
+--- a/kernel/time/clockevents.c
++++ b/kernel/time/clockevents.c
+@@ -237,8 +237,9 @@ void clockevents_exchange_device(struct clock_event_device *old,
+  */
+ void clockevents_notify(unsigned long reason, void *arg)
+ {
+-	struct list_head *node, *tmp;
++	struct clock_event_device *dev, *tmp;
+ 	unsigned long flags;
++	int cpu;
+ 
+ 	spin_lock_irqsave(&clockevents_lock, flags);
+ 	clockevents_do_notify(reason, arg);
+@@ -249,8 +250,19 @@ void clockevents_notify(unsigned long reason, void *arg)
+ 		 * Unregister the clock event devices which were
+ 		 * released from the users in the notify chain.
+ 		 */
+-		list_for_each_safe(node, tmp, &clockevents_released)
+-			list_del(node);
++		list_for_each_entry_safe(dev, tmp, &clockevents_released, list)
++			list_del(&dev->list);
++		/*
++		 * Now check whether the CPU has left unused per cpu devices
++		 */
++		cpu = *((int *)arg);
++		list_for_each_entry_safe(dev, tmp, &clockevent_devices, list) {
++			if (cpumask_test_cpu(cpu, dev->cpumask) &&
++			    cpumask_weight(dev->cpumask) == 1) {
++				BUG_ON(dev->mode != CLOCK_EVT_MODE_UNUSED);
++				list_del(&dev->list);
++			}
++		}
+ 		break;
+ 	default:
+ 		break;
+diff --git a/lib/dma-debug.c b/lib/dma-debug.c
+index ce6b7ea..5a77c7c 100644
+--- a/lib/dma-debug.c
++++ b/lib/dma-debug.c
+@@ -670,12 +670,13 @@ static int device_dma_allocations(struct device *dev)
+ 	return count;
+ }
+ 
+-static int dma_debug_device_change(struct notifier_block *nb,
+-				    unsigned long action, void *data)
++static int dma_debug_device_change(struct notifier_block *nb, unsigned long action, void *data)
+ {
+ 	struct device *dev = data;
+ 	int count;
+ 
++	if (global_disable)
++		return 0;
+ 
+ 	switch (action) {
+ 	case BUS_NOTIFY_UNBOUND_DRIVER:
+@@ -697,6 +698,9 @@ void dma_debug_add_bus(struct bus_type *bus)
+ {
+ 	struct notifier_block *nb;
+ 
++	if (global_disable)
++		return;
++
+ 	nb = kzalloc(sizeof(struct notifier_block), GFP_KERNEL);
+ 	if (nb == NULL) {
+ 		pr_err("dma_debug_add_bus: out of memory\n");
+diff --git a/mm/Kconfig b/mm/Kconfig
+index 44cf6f0..2c19c0b 100644
+--- a/mm/Kconfig
++++ b/mm/Kconfig
+@@ -227,6 +227,7 @@ config KSM
+ 
+ config DEFAULT_MMAP_MIN_ADDR
+         int "Low address space to protect from user allocation"
++	depends on MMU
+         default 4096
+         help
+ 	  This is the portion of low virtual memory which should be protected
+diff --git a/mm/internal.h b/mm/internal.h
+index 22ec8d2..17bc0df 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -107,9 +107,10 @@ static inline int is_mlocked_vma(struct vm_area_struct *vma, struct page *page)
+ }
+ 
+ /*
+- * must be called with vma's mmap_sem held for read, and page locked.
++ * must be called with vma's mmap_sem held for read or write, and page locked.
+  */
+ extern void mlock_vma_page(struct page *page);
++extern void munlock_vma_page(struct page *page);
+ 
+ /*
+  * Clear the page's PageMlocked().  This can be useful in a situation where
+diff --git a/mm/ksm.c b/mm/ksm.c
+index 5575f86..e9501f8 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -34,6 +34,7 @@
+ #include <linux/ksm.h>
+ 
+ #include <asm/tlbflush.h>
++#include "internal.h"
+ 
+ /*
+  * A few notes about the KSM scanning process,
+@@ -767,15 +768,14 @@ static int try_to_merge_one_page(struct vm_area_struct *vma,
+ 	 * ptes are necessarily already write-protected.  But in either
+ 	 * case, we need to lock and check page_count is not raised.
+ 	 */
+-	if (write_protect_page(vma, oldpage, &orig_pte)) {
+-		unlock_page(oldpage);
+-		goto out_putpage;
+-	}
+-	unlock_page(oldpage);
+-
+-	if (pages_identical(oldpage, newpage))
++	if (write_protect_page(vma, oldpage, &orig_pte) == 0 &&
++	    pages_identical(oldpage, newpage))
+ 		err = replace_page(vma, oldpage, newpage, orig_pte);
+ 
++	if ((vma->vm_flags & VM_LOCKED) && !err)
++		munlock_vma_page(oldpage);
++
++	unlock_page(oldpage);
+ out_putpage:
+ 	put_page(oldpage);
+ 	put_page(newpage);
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 6314015..5dc1037 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -758,7 +758,13 @@ int task_in_mem_cgroup(struct task_struct *task, const struct mem_cgroup *mem)
+ 	task_unlock(task);
+ 	if (!curr)
+ 		return 0;
+-	if (curr->use_hierarchy)
++	/*
++	 * We should check use_hierarchy of "mem" not "curr". Because checking
++	 * use_hierarchy of "curr" here make this function true if hierarchy is
++	 * enabled in "curr" and "curr" is a child of "mem" in *cgroup*
++	 * hierarchy(even if use_hierarchy is disabled in "mem").
++	 */
++	if (mem->use_hierarchy)
+ 		ret = css_is_ancestor(&curr->css, &mem->css);
+ 	else
+ 		ret = (curr == mem);
+diff --git a/mm/mlock.c b/mm/mlock.c
+index bd6f0e4..2e05c97 100644
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -99,14 +99,14 @@ void mlock_vma_page(struct page *page)
+  * not get another chance to clear PageMlocked.  If we successfully
+  * isolate the page and try_to_munlock() detects other VM_LOCKED vmas
+  * mapping the page, it will restore the PageMlocked state, unless the page
+- * is mapped in a non-linear vma.  So, we go ahead and SetPageMlocked(),
++ * is mapped in a non-linear vma.  So, we go ahead and ClearPageMlocked(),
+  * perhaps redundantly.
+  * If we lose the isolation race, and the page is mapped by other VM_LOCKED
+  * vmas, we'll detect this in vmscan--via try_to_munlock() or try_to_unmap()
+  * either of which will restore the PageMlocked state by calling
+  * mlock_vma_page() above, if it can grab the vma's mmap sem.
+  */
+-static void munlock_vma_page(struct page *page)
++void munlock_vma_page(struct page *page)
+ {
+ 	BUG_ON(!PageLocked(page));
+ 
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index ea2147d..9092b43 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -404,7 +404,7 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
+ 		cpuset_print_task_mems_allowed(current);
+ 		task_unlock(current);
+ 		dump_stack();
+-		mem_cgroup_print_oom_info(mem, current);
++		mem_cgroup_print_oom_info(mem, p);
+ 		show_mem();
+ 		if (sysctl_oom_dump_tasks)
+ 			dump_tasks(mem);
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 777af57..692807f 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -1464,20 +1464,26 @@ static int inactive_file_is_low(struct zone *zone, struct scan_control *sc)
+ 	return low;
+ }
+ 
++static int inactive_list_is_low(struct zone *zone, struct scan_control *sc,
++				int file)
++{
++	if (file)
++		return inactive_file_is_low(zone, sc);
++	else
++		return inactive_anon_is_low(zone, sc);
++}
++
+ static unsigned long shrink_list(enum lru_list lru, unsigned long nr_to_scan,
+ 	struct zone *zone, struct scan_control *sc, int priority)
+ {
+ 	int file = is_file_lru(lru);
+ 
+-	if (lru == LRU_ACTIVE_FILE && inactive_file_is_low(zone, sc)) {
+-		shrink_active_list(nr_to_scan, zone, sc, priority, file);
++	if (is_active_lru(lru)) {
++		if (inactive_list_is_low(zone, sc, file))
++		    shrink_active_list(nr_to_scan, zone, sc, priority, file);
+ 		return 0;
+ 	}
+ 
+-	if (lru == LRU_ACTIVE_ANON && inactive_anon_is_low(zone, sc)) {
+-		shrink_active_list(nr_to_scan, zone, sc, priority, file);
+-		return 0;
+-	}
+ 	return shrink_inactive_list(nr_to_scan, zone, sc, priority, file);
+ }
+ 
+diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
+index fa2d6b6..331ead3 100644
+--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
++++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
+@@ -14,6 +14,7 @@
+ #include <net/route.h>
+ #include <net/ip.h>
+ 
++#include <linux/netfilter_bridge.h>
+ #include <linux/netfilter_ipv4.h>
+ #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+ 
+@@ -34,6 +35,20 @@ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
+ 	return err;
+ }
+ 
++static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
++					      struct sk_buff *skb)
++{
++#ifdef CONFIG_BRIDGE_NETFILTER
++	if (skb->nf_bridge &&
++	    skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
++		return IP_DEFRAG_CONNTRACK_BRIDGE_IN;
++#endif
++	if (hooknum == NF_INET_PRE_ROUTING)
++		return IP_DEFRAG_CONNTRACK_IN;
++	else
++		return IP_DEFRAG_CONNTRACK_OUT;
++}
++
+ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
+ 					  struct sk_buff *skb,
+ 					  const struct net_device *in,
+@@ -50,10 +65,8 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
+ #endif
+ 	/* Gather fragments. */
+ 	if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
+-		if (nf_ct_ipv4_gather_frags(skb,
+-					    hooknum == NF_INET_PRE_ROUTING ?
+-					    IP_DEFRAG_CONNTRACK_IN :
+-					    IP_DEFRAG_CONNTRACK_OUT))
++		enum ip_defrag_users user = nf_ct_defrag_user(hooknum, skb);
++		if (nf_ct_ipv4_gather_frags(skb, user))
+ 			return NF_STOLEN;
+ 	}
+ 	return NF_ACCEPT;
+diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+index 5f2ec20..0956eba 100644
+--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
++++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+@@ -20,6 +20,7 @@
+ #include <net/ipv6.h>
+ #include <net/inet_frag.h>
+ 
++#include <linux/netfilter_bridge.h>
+ #include <linux/netfilter_ipv6.h>
+ #include <net/netfilter/nf_conntrack.h>
+ #include <net/netfilter/nf_conntrack_helper.h>
+@@ -187,6 +188,21 @@ out:
+ 	return nf_conntrack_confirm(skb);
+ }
+ 
++static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
++						struct sk_buff *skb)
++{
++#ifdef CONFIG_BRIDGE_NETFILTER
++	if (skb->nf_bridge &&
++	    skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
++		return IP6_DEFRAG_CONNTRACK_BRIDGE_IN;
++#endif
++	if (hooknum == NF_INET_PRE_ROUTING)
++		return IP6_DEFRAG_CONNTRACK_IN;
++	else
++		return IP6_DEFRAG_CONNTRACK_OUT;
++
++}
++
+ static unsigned int ipv6_defrag(unsigned int hooknum,
+ 				struct sk_buff *skb,
+ 				const struct net_device *in,
+@@ -199,8 +215,7 @@ static unsigned int ipv6_defrag(unsigned int hooknum,
+ 	if (skb->nfct)
+ 		return NF_ACCEPT;
+ 
+-	reasm = nf_ct_frag6_gather(skb);
+-
++	reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb));
+ 	/* queued */
+ 	if (reasm == NULL)
+ 		return NF_STOLEN;
+diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
+index f3aba25..4b6a539 100644
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -170,13 +170,14 @@ out:
+ /* Creation primitives. */
+ 
+ static __inline__ struct nf_ct_frag6_queue *
+-fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
++fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst)
+ {
+ 	struct inet_frag_queue *q;
+ 	struct ip6_create_arg arg;
+ 	unsigned int hash;
+ 
+ 	arg.id = id;
++	arg.user = user;
+ 	arg.src = src;
+ 	arg.dst = dst;
+ 
+@@ -561,7 +562,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
+ 	return 0;
+ }
+ 
+-struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
++struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
+ {
+ 	struct sk_buff *clone;
+ 	struct net_device *dev = skb->dev;
+@@ -607,7 +608,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
+ 	if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh)
+ 		nf_ct_frag6_evictor();
+ 
+-	fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr);
++	fq = fq_find(fhdr->identification, user, &hdr->saddr, &hdr->daddr);
+ 	if (fq == NULL) {
+ 		pr_debug("Can't find and can't create new queue\n");
+ 		goto ret_orig;
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index da5bd0e..4d18699 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -72,6 +72,7 @@ struct frag_queue
+ 	struct inet_frag_queue	q;
+ 
+ 	__be32			id;		/* fragment id		*/
++	u32			user;
+ 	struct in6_addr		saddr;
+ 	struct in6_addr		daddr;
+ 
+@@ -141,7 +142,7 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a)
+ 	struct ip6_create_arg *arg = a;
+ 
+ 	fq = container_of(q, struct frag_queue, q);
+-	return (fq->id == arg->id &&
++	return (fq->id == arg->id && fq->user == arg->user &&
+ 			ipv6_addr_equal(&fq->saddr, arg->src) &&
+ 			ipv6_addr_equal(&fq->daddr, arg->dst));
+ }
+@@ -163,6 +164,7 @@ void ip6_frag_init(struct inet_frag_queue *q, void *a)
+ 	struct ip6_create_arg *arg = a;
+ 
+ 	fq->id = arg->id;
++	fq->user = arg->user;
+ 	ipv6_addr_copy(&fq->saddr, arg->src);
+ 	ipv6_addr_copy(&fq->daddr, arg->dst);
+ }
+@@ -244,6 +246,7 @@ fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
+ 	unsigned int hash;
+ 
+ 	arg.id = id;
++	arg.user = IP6_DEFRAG_LOCAL_DELIVER;
+ 	arg.src = src;
+ 	arg.dst = dst;
+ 
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index f1362f3..fbffce9 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -455,6 +455,10 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
+ 
+ 	ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
+ 
++	if (time_before(jiffies, ifibss->last_scan_completed +
++		       IEEE80211_IBSS_MERGE_INTERVAL))
++		return;
++
+ 	if (ieee80211_sta_active_ibss(sdata))
+ 		return;
+ 
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index dc5049d..f13d181 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -904,6 +904,14 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
+ 	sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
+ 				IEEE80211_STA_BEACON_POLL);
+ 
++	/*
++	 * Always handle WMM once after association regardless
++	 * of the first value the AP uses. Setting -1 here has
++	 * that effect because the AP values is an unsigned
++	 * 4-bit value.
++	 */
++	sdata->u.mgd.wmm_last_param_set = -1;
++
+ 	ieee80211_led_assoc(local, 1);
+ 
+ 	sdata->vif.bss_conf.assoc = 1;
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index eaa4118..d398197 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1401,6 +1401,7 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
+ 
+ 	if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
+ 	    local->hw.conf.dynamic_ps_timeout > 0 &&
++	    !local->quiescing &&
+ 	    !(local->scanning) && local->ps_sdata) {
+ 		if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+ 			ieee80211_stop_queues_by_reason(&local->hw,
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index cbc5d20..51e0bd2 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1031,7 +1031,19 @@ int ieee80211_reconfig(struct ieee80211_local *local)
+ 
+ 	/* restart hardware */
+ 	if (local->open_count) {
++		/*
++		 * Upon resume hardware can sometimes be goofy due to
++		 * various platform / driver / bus issues, so restarting
++		 * the device may at times not work immediately. Propagate
++		 * the error.
++		 */
+ 		res = drv_start(local);
++		if (res) {
++			WARN(local->suspended, "Harware became unavailable "
++			     "upon resume. This is could be a software issue"
++			     "prior to suspend or a harware issue\n");
++			return res;
++		}
+ 
+ 		ieee80211_led_radio(local, true);
+ 	}
+diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
+index 0a6b7a0..0d86248 100644
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -94,7 +94,18 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
+ 			}
+ 		}
+ 
+-		WARN_ON(!bss);
++		/*
++		 * We might be coming here because the driver reported
++		 * a successful association at the same time as the
++		 * user requested a deauth. In that case, we will have
++		 * removed the BSS from the auth_bsses list due to the
++		 * deauth request when the assoc response makes it. If
++		 * the two code paths acquire the lock the other way
++		 * around, that's just the standard situation of a
++		 * deauth being requested while connected.
++		 */
++		if (!bss)
++			goto out;
+ 	} else if (wdev->conn) {
+ 		cfg80211_sme_failed_assoc(wdev);
+ 		need_connect_result = false;
+diff --git a/security/Makefile b/security/Makefile
+index 95ecc06..510bbc8 100644
+--- a/security/Makefile
++++ b/security/Makefile
+@@ -8,7 +8,8 @@ subdir-$(CONFIG_SECURITY_SMACK)		+= smack
+ subdir-$(CONFIG_SECURITY_TOMOYO)        += tomoyo
+ 
+ # always enable default capabilities
+-obj-y		+= commoncap.o min_addr.o
++obj-y					+= commoncap.o
++obj-$(CONFIG_MMU)			+= min_addr.o
+ 
+ # Object file lists
+ obj-$(CONFIG_SECURITY)			+= security.o capability.o
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index 06ec722..1cad4c7 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -1236,6 +1236,7 @@ long keyctl_get_security(key_serial_t keyid,
+  */
+ long keyctl_session_to_parent(void)
+ {
++#ifdef TIF_NOTIFY_RESUME
+ 	struct task_struct *me, *parent;
+ 	const struct cred *mycred, *pcred;
+ 	struct cred *cred, *oldcred;
+@@ -1326,6 +1327,15 @@ not_permitted:
+ error_keyring:
+ 	key_ref_put(keyring_r);
+ 	return ret;
++
++#else /* !TIF_NOTIFY_RESUME */
++	/*
++	 * To be removed when TIF_NOTIFY_RESUME has been implemented on
++	 * m68k/xtensa
++	 */
++#warning TIF_NOTIFY_RESUME not implemented
++	return -EOPNOTSUPP;
++#endif /* !TIF_NOTIFY_RESUME */
+ }
+ 
+ /*****************************************************************************/
+diff --git a/sound/mips/sgio2audio.c b/sound/mips/sgio2audio.c
+index 8691f4c..f1d9d16 100644
+--- a/sound/mips/sgio2audio.c
++++ b/sound/mips/sgio2audio.c
+@@ -609,7 +609,7 @@ static int snd_sgio2audio_pcm_hw_params(struct snd_pcm_substream *substream,
+ 	/* alloc virtual 'dma' area */
+ 	if (runtime->dma_area)
+ 		vfree(runtime->dma_area);
+-	runtime->dma_area = vmalloc(size);
++	runtime->dma_area = vmalloc_user(size);
+ 	if (runtime->dma_area == NULL)
+ 		return -ENOMEM;
+ 	runtime->dma_bytes = size;
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 7058371..e40d31f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9141,6 +9141,8 @@ static struct alc_config_preset alc882_presets[] = {
+ 		.dac_nids = alc883_dac_nids,
+ 		.num_adc_nids = ARRAY_SIZE(alc889_adc_nids),
+ 		.adc_nids = alc889_adc_nids,
++		.capsrc_nids = alc889_capsrc_nids,
++		.capsrc_nids = alc889_capsrc_nids,
+ 		.dig_out_nid = ALC883_DIGOUT_NID,
+ 		.dig_in_nid = ALC883_DIGIN_NID,
+ 		.slave_dig_outs = alc883_slave_dig_outs,
+@@ -9187,6 +9189,7 @@ static struct alc_config_preset alc882_presets[] = {
+ 		.dac_nids = alc883_dac_nids,
+ 		.adc_nids = alc883_adc_nids_alt,
+ 		.num_adc_nids = ARRAY_SIZE(alc883_adc_nids_alt),
++		.capsrc_nids = alc883_capsrc_nids,
+ 		.dig_out_nid = ALC883_DIGOUT_NID,
+ 		.num_channel_mode = ARRAY_SIZE(alc883_3ST_2ch_modes),
+ 		.channel_mode = alc883_3ST_2ch_modes,
+@@ -9333,6 +9336,7 @@ static struct alc_config_preset alc882_presets[] = {
+ 		.dac_nids = alc883_dac_nids,
+ 		.adc_nids = alc883_adc_nids_alt,
+ 		.num_adc_nids = ARRAY_SIZE(alc883_adc_nids_alt),
++		.capsrc_nids = alc883_capsrc_nids,
+ 		.num_channel_mode = ARRAY_SIZE(alc883_sixstack_modes),
+ 		.channel_mode = alc883_sixstack_modes,
+ 		.input_mux = &alc883_capture_source,
+@@ -9394,6 +9398,7 @@ static struct alc_config_preset alc882_presets[] = {
+ 		.dac_nids = alc883_dac_nids,
+ 		.adc_nids = alc883_adc_nids_alt,
+ 		.num_adc_nids = ARRAY_SIZE(alc883_adc_nids_alt),
++		.capsrc_nids = alc883_capsrc_nids,
+ 		.num_channel_mode = ARRAY_SIZE(alc883_3ST_2ch_modes),
+ 		.channel_mode = alc883_3ST_2ch_modes,
+ 		.input_mux = &alc883_lenovo_101e_capture_source,
+@@ -9573,6 +9578,7 @@ static struct alc_config_preset alc882_presets[] = {
+ 			alc880_gpio1_init_verbs },
+ 		.adc_nids = alc883_adc_nids,
+ 		.num_adc_nids = ARRAY_SIZE(alc883_adc_nids),
++		.capsrc_nids = alc883_capsrc_nids,
+ 		.dac_nids = alc883_dac_nids,
+ 		.num_dacs = ARRAY_SIZE(alc883_dac_nids),
+ 		.channel_mode = alc889A_mb31_6ch_modes,
+diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c b/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
+index d057e64..5cfa608 100644
+--- a/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
++++ b/sound/pcmcia/pdaudiocf/pdaudiocf_pcm.c
+@@ -51,7 +51,7 @@ static int snd_pcm_alloc_vmalloc_buffer(struct snd_pcm_substream *subs, size_t s
+ 			return 0; /* already enough large */
+ 		vfree(runtime->dma_area);
+ 	}
+-	runtime->dma_area = vmalloc_32(size);
++	runtime->dma_area = vmalloc_32_user(size);
+ 	if (! runtime->dma_area)
+ 		return -ENOMEM;
+ 	runtime->dma_bytes = size;
+diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c
+index 98d663a..b0bd1c0 100644
+--- a/sound/soc/codecs/wm8974.c
++++ b/sound/soc/codecs/wm8974.c
+@@ -47,7 +47,7 @@ static const u16 wm8974_reg[WM8974_CACHEREGNUM] = {
+ };
+ 
+ #define WM8974_POWER1_BIASEN  0x08
+-#define WM8974_POWER1_BUFIOEN 0x10
++#define WM8974_POWER1_BUFIOEN 0x04
+ 
+ struct wm8974_priv {
+ 	struct snd_soc_codec codec;
+diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
+index 1fd4e88..e9123f5 100644
+--- a/sound/soc/codecs/wm9712.c
++++ b/sound/soc/codecs/wm9712.c
+@@ -464,7 +464,8 @@ static int ac97_write(struct snd_soc_codec *codec, unsigned int reg,
+ {
+ 	u16 *cache = codec->reg_cache;
+ 
+-	soc_ac97_ops.write(codec->ac97, reg, val);
++	if (reg < 0x7c)
++		soc_ac97_ops.write(codec->ac97, reg, val);
+ 	reg = reg >> 1;
+ 	if (reg < (ARRAY_SIZE(wm9712_reg)))
+ 		cache[reg] = val;
+diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
+index 8db0374..8803d9d 100644
+--- a/sound/usb/usbaudio.c
++++ b/sound/usb/usbaudio.c
+@@ -752,7 +752,7 @@ static int snd_pcm_alloc_vmalloc_buffer(struct snd_pcm_substream *subs, size_t s
+ 			return 0; /* already large enough */
+ 		vfree(runtime->dma_area);
+ 	}
+-	runtime->dma_area = vmalloc(size);
++	runtime->dma_area = vmalloc_user(size);
+ 	if (!runtime->dma_area)
+ 		return -ENOMEM;
+ 	runtime->dma_bytes = size;